@primitive.ai/prim 0.1.0-alpha.68 → 0.1.0-alpha.69

package/dist/chunk-4A2XB2PC.js

@@ -0,0 +1,310 @@
+import {
+  stripControlChars
+} from "./chunk-Z7YPFWAZ.js";
+
+// src/lib/bin-path.ts
+import { existsSync, readFileSync } from "fs";
+import { dirname, isAbsolute, join } from "path";
+import { fileURLToPath } from "url";
+
+// src/lib/semver.ts
+function parseSemver(value) {
+  if (typeof value !== "string" || value.length > 256) return;
+  const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/u.exec(
+    value
+  );
+  if (!match) return;
+  const prerelease = match[4]?.split(".") ?? [];
+  if (prerelease.some((part) => /^\d+$/u.test(part) && part.length > 1 && part.startsWith("0"))) {
+    return;
+  }
+  return { core: [BigInt(match[1]), BigInt(match[2]), BigInt(match[3])], prerelease };
+}
+function compareSemver(left, right) {
+  const a = parseSemver(left);
+  const b = parseSemver(right);
+  if (!a || !b) return;
+  for (let i = 0; i < a.core.length; i += 1) {
+    if (a.core[i] !== b.core[i]) return a.core[i] < b.core[i] ? -1 : 1;
+  }
+  if (a.prerelease.length === 0 || b.prerelease.length === 0) {
+    return a.prerelease.length === b.prerelease.length ? 0 : a.prerelease.length === 0 ? 1 : -1;
+  }
+  for (let i = 0; i < Math.max(a.prerelease.length, b.prerelease.length); i += 1) {
+    const x = a.prerelease[i];
+    const y = b.prerelease[i];
+    if (x === void 0 || y === void 0) return x === void 0 ? -1 : 1;
+    if (x === y) continue;
+    const xNumeric = /^\d+$/u.test(x);
+    const yNumeric = /^\d+$/u.test(y);
+    if (xNumeric && yNumeric) return BigInt(x) < BigInt(y) ? -1 : 1;
+    if (xNumeric !== yNumeric) return xNumeric ? -1 : 1;
+    return x < y ? -1 : 1;
+  }
+  return 0;
+}
+
+// src/lib/bin-path.ts
+var PKG_NAME = "@primitive.ai/prim";
+var ROOT_WALK_LIMIT = 6;
+var STABLE_HOOK_LAUNCHER_NAME = "prim-hook-launcher-v1";
+var resolvedRoot;
+function locateRoot() {
+  if (resolvedRoot !== void 0) {
+    return resolvedRoot;
+  }
+  let dir = dirname(fileURLToPath(import.meta.url));
+  for (let depth = 0; depth < ROOT_WALK_LIMIT; depth++) {
+    const manifestPath = join(dir, "package.json");
+    if (existsSync(manifestPath)) {
+      try {
+        const manifest = JSON.parse(readFileSync(manifestPath, "utf-8"));
+        if (manifest.name === PKG_NAME && manifest.bin) {
+          resolvedRoot = { dir, version: manifest.version, bin: manifest.bin };
+          return resolvedRoot;
+        }
+      } catch {
+      }
+    }
+    const parent = dirname(dir);
+    if (parent === dir) {
+      break;
+    }
+    dir = parent;
+  }
+  resolvedRoot = null;
+  return resolvedRoot;
+}
+function binFile(bin) {
+  const root = locateRoot();
+  const rel = root?.bin[bin];
+  if (!root || !rel) {
+    return null;
+  }
+  return isAbsolute(rel) ? rel : join(root.dir, rel);
+}
+function packageVersion() {
+  return locateRoot()?.version ?? null;
+}
+function packageRoot() {
+  return locateRoot()?.dir ?? null;
+}
+function shellQuote(value) {
+  return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+function shellWord(value) {
+  return /^[A-Za-z0-9_@%+=:,./-]+$/u.test(value) ? value : shellQuote(value);
+}
+function pinnedNpxArgs(bin, args = [], options = {}) {
+  const version = packageVersion();
+  if (!version) throw new Error("cannot determine Primitive package version");
+  return [
+    "--yes",
+    "--ignore-scripts",
+    ...options.preferOnline ? ["--prefer-online"] : [],
+    "-p",
+    `${PKG_NAME}@${version}`,
+    bin,
+    ...args
+  ];
+}
+function pinnedNpxCommand(bin, args = [], options = {}) {
+  return ["npx", ...pinnedNpxArgs(bin, args, options)].map(shellWord).join(" ");
+}
+function pinnedHookCommand(bin, args = "") {
+  const suffix = args ? ` ${args}` : "";
+  const fallback = `${pinnedNpxCommand(bin)}${suffix}`;
+  const file = binFile(bin);
+  if (!file) return fallback;
+  return `if [ -x ${shellQuote(process.execPath)} ] && [ -f ${shellQuote(file)} ]; then ${shellQuote(process.execPath)} ${shellQuote(file)}${suffix}; else ${fallback}; fi`;
+}
+var STABLE_HOOK_ARGUMENTS_RE = /^[-A-Za-z0-9_ ]*$/u;
+var STABLE_HOOK_BIN_RE = /^[A-Za-z0-9][A-Za-z0-9-]*$/u;
+function stableHookCommand(bin, args = "") {
+  if (!STABLE_HOOK_BIN_RE.test(bin) || !STABLE_HOOK_ARGUMENTS_RE.test(args)) {
+    throw new Error("invalid stable hook command");
+  }
+  const resolver = [
+    // #242 and earlier identify managed commands by this package marker. Keep
+    // it as inert data during the rolling window so an older uninstall or
+    // reinstall can remove the stable entry without invoking npm or PATH.
+    `prim_legacy_reader='-p ${PKG_NAME}@stable prim-shim.sh ${bin} '; `,
+    'prim_absolute() { case "$1" in /*) ;; *) return 1 ;; esac; case "$1" in [[:space:]]*|*[[:space:]]|*//*|*/./*|*/../*|*/.|*/..|?*/) return 1 ;; esac; }; ',
+    'prim_config=${PRIM_CONFIG_DIR:-}; if ! prim_absolute "$prim_config"; then prim_config=${XDG_CONFIG_HOME:-}; if prim_absolute "$prim_config"; then ',
+    'case "$prim_config" in /) prim_config=/prim ;; *) prim_config="$prim_config/prim" ;; esac; ',
+    'else prim_home=${HOME:-}; prim_absolute "$prim_home" || exit 78; case "$prim_home" in /) prim_config=/.config/prim ;; *) prim_config="$prim_home/.config/prim" ;; esac; ',
+    "fi; fi; ",
+    `case "$prim_config" in /) prim_launcher=/${STABLE_HOOK_LAUNCHER_NAME} ;; *) prim_launcher="$prim_config/${STABLE_HOOK_LAUNCHER_NAME}" ;; esac; `,
+    'exec "$prim_launcher" "$@"'
+  ].join("");
+  const suffix = args ? ` ${args}` : "";
+  return `/bin/sh -c ${shellQuote(resolver)} ${STABLE_HOOK_LAUNCHER_NAME} ${bin}${suffix}`;
+}
+function detachedHookShimCommand(bin, args = "") {
+  return `payload=$(cat); { trap '' HUP; printf '%s' "$payload" | { ${stableHookCommand(bin, args)}; }; } </dev/null >/dev/null 2>&1 &`;
+}
+function commandMatchesBin(command, bin) {
+  if (!command) {
+    return false;
+  }
+  const c = command.trim();
+  if (c === bin || c.startsWith(`${bin} `)) {
+    return true;
+  }
+  const exactBin = new RegExp(`(?:^|\\s)${bin.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:\\s|;|$)`);
+  return c.includes(`command -v ${bin} `) || c.includes(`-p ${PKG_NAME}@`) && exactBin.test(c) || c.includes(STABLE_HOOK_LAUNCHER_NAME) && exactBin.test(c);
+}
+function exactPinnedNpxVersion(command, bin) {
+  const escapedBin = bin.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const shellQuoted = `'(?:[^']|'"'"')*'`;
+  const safeArgs = "(?: [A-Za-z0-9_@%+=:,./-]+)*";
+  const direct = new RegExp(
+    `^npx --yes --ignore-scripts -p @primitive\\.ai/prim@(?<version>[0-9A-Za-z.+-]+) ${escapedBin}${safeArgs}$`,
+    "u"
+  ).exec(command);
+  const wrapped = new RegExp(
+    `^if \\[ -x (?<node>${shellQuoted}) \\] && \\[ -f (?<entry>${shellQuoted}) \\]; then \\k<node> \\k<entry>(?<args>${safeArgs}); else npx --yes --ignore-scripts -p @primitive\\.ai/prim@(?<version>[0-9A-Za-z.+-]+) ${escapedBin}\\k<args>; fi$`,
+    "u"
+  ).exec(command);
+  const version = direct?.groups?.version ?? wrapped?.groups?.version;
+  return version && compareSemver(version, version) !== void 0 ? version : void 0;
+}
+function hookCommandResolution(command, bin) {
+  const trimmed = command?.trim();
+  if (!trimmed || !commandMatchesBin(trimmed, bin)) return void 0;
+  if (trimmed.includes(STABLE_HOOK_LAUNCHER_NAME)) return { kind: "stable_launcher" };
+  const version = exactPinnedNpxVersion(trimmed, bin);
+  return version ? { kind: "exact_npx_fallback", version } : { kind: "legacy_path" };
+}
+function hookCommandResolutions(commands, bins) {
+  const resolutions = [];
+  for (const command of commands) {
+    for (const bin of bins) {
+      const resolution = hookCommandResolution(command, bin);
+      if (resolution) resolutions.push(resolution);
+    }
+  }
+  return resolutions;
+}
+
+// src/lib/presence.ts
+var DECISION_ORIGIN = "https://app.getprimitive.ai";
+function validDecisionUrl(value) {
+  if (typeof value !== "string" || stripControlChars(value) !== value) {
+    return void 0;
+  }
+  try {
+    const url = new URL(value);
+    if (url.origin !== DECISION_ORIGIN || url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "" || !/^\/decisions\/[^/]+$/u.test(url.pathname)) {
+      return void 0;
+    }
+    return url.href;
+  } catch {
+    return void 0;
+  }
+}
+function decisionLink(label, decisionUrl, plain) {
+  const url = validDecisionUrl(decisionUrl);
+  if (plain || !url) {
+    return label;
+  }
+  return `\x1B]8;;${url}\x07\x1B[34;4m${label}\x1B[0m\x1B]8;;\x07`;
+}
+function formatLabeled(labels, cap) {
+  if (labels === void 0) {
+    return "\u2014";
+  }
+  if (labels.length === 0) {
+    return "just you";
+  }
+  if (labels.length <= cap) {
+    return labels.join(", ");
+  }
+  return `${labels.slice(0, cap).join(", ")} +${String(labels.length - cap)}`;
+}
+function formatTeammates(names, cap) {
+  return formatLabeled(names?.map(stripControlChars), cap);
+}
+function formatTeammatesWithArea(teammates, cap, plainLinks = false) {
+  return formatLabeled(
+    teammates?.map((t) => {
+      const name = stripControlChars(t.name);
+      const area = stripControlChars(t.area ?? "").trim();
+      const label = area ? `${name} - ${area}` : name;
+      return decisionLink(label, t.decisionUrl, plainLinks);
+    }),
+    cap
+  );
+}
+
+// src/lib/statusline-render.ts
+function repositoryBindingDiagnosticLabel(state) {
+  if (state === "unbound") return "repository: unbound (enforcement not evaluating)";
+  if (state === "invalid") return "repository binding: invalid (run `prim doctor`)";
+  return void 0;
+}
+var STATUSLINE_NAME_CAP = 3;
+function formatStatusline(version, snapshot, resolveIngestionStatus, options = {}) {
+  const ingestionSuffix = (status) => status === void 0 ? "" : ` \xB7 Decision ingestion ${status}`;
+  const ingestionStatus = snapshot === null || snapshot.healthy === false ? options.includeIngestionWhenUnavailable ? resolveIngestionStatus() : void 0 : resolveIngestionStatus();
+  if (snapshot?.healthy === false && snapshot.needsReauth) {
+    return `primitive ${version} (daemon: paused \xB7 run \`prim auth login\`${ingestionSuffix(ingestionStatus)})`;
+  }
+  const repositoryLabel = repositoryBindingDiagnosticLabel(
+    snapshot !== null && snapshot.healthy !== false || options.includeIngestionWhenUnavailable === true ? options.resolveRepositoryBindingState?.() : void 0
+  );
+  const repositorySuffix = repositoryLabel ? ` \xB7 ${repositoryLabel}` : "";
+  if (!snapshot) {
+    return `primitive ${version} (daemon: down${repositorySuffix}${ingestionSuffix(ingestionStatus)})`;
+  }
+  if (snapshot.healthy === false) {
+    if (snapshot.ingestion?.healthy === false) {
+      const pending = snapshot.ingestion.pendingCount;
+      const qualifier = snapshot.ingestion.pendingSampled ? "at least " : "";
+      return `primitive ${version} (daemon: degraded \xB7 delivery: stalled${typeof pending === "number" ? ` \xB7 ${qualifier}${String(pending)} pending` : ""}${repositorySuffix}${ingestionSuffix(ingestionStatus)})`;
+    }
+    if (snapshot.heartbeat?.healthy === false) {
+      return `primitive ${version} (daemon: degraded \xB7 presence: unavailable${repositorySuffix}${ingestionSuffix(ingestionStatus)})`;
+    }
+    return `primitive ${version} (daemon: starting${repositorySuffix}${ingestionSuffix(ingestionStatus)})`;
+  }
+  if (snapshot.envMismatch) {
+    return `primitive ${version} (daemon: live, Decision ingestion ${ingestionStatus}${repositorySuffix} \xB7 presence: other env)`;
+  }
+  if (snapshot.principalMismatch) {
+    return `primitive ${version} (daemon: live, Decision ingestion ${ingestionStatus}${repositorySuffix} \xB7 presence: other account)`;
+  }
+  if (snapshot.presenceStale) {
+    return `primitive ${version} (daemon: live, Decision ingestion ${ingestionStatus}${repositorySuffix} \xB7 presence: stale)`;
+  }
+  let team;
+  if (snapshot.onlineTeammates !== void 0) {
+    team = `team: ${formatTeammatesWithArea(snapshot.onlineTeammates, STATUSLINE_NAME_CAP, options.plainLinks === true)}`;
+  } else if (snapshot.onlineNames !== void 0) {
+    team = `team: ${formatTeammates(snapshot.onlineNames, STATUSLINE_NAME_CAP)}`;
+  } else if (typeof snapshot.onlineCount === "number") {
+    team = `team: ${String(snapshot.onlineCount)} online`;
+  } else {
+    team = "team: \u2014";
+  }
+  return `primitive ${version} (daemon: live, Decision ingestion ${ingestionStatus}${repositorySuffix} \xB7 ${team})`;
+}
+
+export {
+  compareSemver,
+  STABLE_HOOK_LAUNCHER_NAME,
+  binFile,
+  packageVersion,
+  packageRoot,
+  pinnedNpxArgs,
+  pinnedNpxCommand,
+  pinnedHookCommand,
+  stableHookCommand,
+  detachedHookShimCommand,
+  commandMatchesBin,
+  hookCommandResolution,
+  hookCommandResolutions,
+  formatTeammates,
+  repositoryBindingDiagnosticLabel,
+  formatStatusline
+};

package/dist/{chunk-G5D3FF3D.js → chunk-BQUJ4AFJ.js}

@@ -199,85 +199,6 @@ function demoteForMode(verdict, mode) {
   return verdict;
 }
 
-// src/hooks/redact.ts
-import { existsSync, readFileSync } from "fs";
-import { join } from "path";
-var DEFAULT_RULES = [
-  { pattern: /Bearer\s+[A-Za-z0-9._\-]+/g, reason: "bearer-token" },
-  { pattern: /sk-[A-Za-z0-9]{32,}/g, reason: "sk-api-key" },
-  {
-    pattern: /-----BEGIN [A-Z ]+PRIVATE KEY-----[\s\S]+?-----END [A-Z ]+PRIVATE KEY-----/g,
-    reason: "private-key"
-  },
-  { pattern: /xox[abprs]-[A-Za-z0-9-]{10,}/g, reason: "slack-token" },
-  { pattern: /ghp_[A-Za-z0-9]{36,}/g, reason: "github-pat" }
-];
-var MAX_SCRUB_LEN = 256e3;
-var WORKSPACE_FILE = ".prim/redaction.json";
-function debugRedaction(message, err) {
-  if (!process.env.PRIM_HOOK_DEBUG) {
-    return;
-  }
-  const detail = err instanceof Error ? err.message : String(err);
-  process.stderr.write(`[prim-hook] redaction: ${message}: ${detail}
-`);
-}
-function loadWorkspaceRules(cwd) {
-  const path = join(cwd, WORKSPACE_FILE);
-  if (!existsSync(path)) {
-    return [];
-  }
-  let cfg;
-  try {
-    cfg = JSON.parse(readFileSync(path, "utf-8"));
-  } catch (err) {
-    debugRedaction(`ignoring unparseable ${WORKSPACE_FILE}`, err);
-    return [];
-  }
-  if (!cfg.rules) {
-    return [];
-  }
-  const compiled = [];
-  for (const r of cfg.rules) {
-    try {
-      compiled.push({ pattern: new RegExp(r.pattern, r.flags ?? "g"), reason: r.reason });
-    } catch (err) {
-      debugRedaction(`skipping invalid redaction rule "${r.reason}"`, err);
-    }
-  }
-  return compiled;
-}
-function applyRules(input, rules) {
-  if (input.length > MAX_SCRUB_LEN) {
-    return "<REDACTED:oversized>";
-  }
-  let out = input;
-  for (const rule of rules) {
-    out = out.replace(rule.pattern, `<REDACTED:${rule.reason}>`);
-  }
-  return out;
-}
-function scrub(value, rules = DEFAULT_RULES) {
-  if (typeof value === "string") {
-    return applyRules(value, rules);
-  }
-  if (Array.isArray(value)) {
-    return value.map((v) => scrub(v, rules));
-  }
-  if (value && typeof value === "object") {
-    const out = {};
-    for (const [k, v] of Object.entries(value)) {
-      out[k] = scrub(v, rules);
-    }
-    return out;
-  }
-  return value;
-}
-function scrubFromCwd(value, cwd) {
-  const rules = [...DEFAULT_RULES, ...loadWorkspaceRules(cwd)];
-  return scrub(value, rules);
-}
-
 // src/hooks/shell-targets.ts
 import { parse } from "unbash";
 var OUTPUT_REDIRECTS = /* @__PURE__ */ new Set([">", ">>", ">|", "&>", "&>>"]);
@@ -846,8 +767,5 @@ export {
   extractFileTargets,
   readHookMode,
   demoteForMode,
-  analyzeShellTargets,
-  DEFAULT_RULES,
-  scrub,
-  scrubFromCwd
+  analyzeShellTargets
 };

package/dist/chunk-CUE2LKLR.js

@@ -0,0 +1,155 @@
+import {
+  decodeJwtPayload,
+  primConfigDirectory,
+  resolveAuthCredential
+} from "./chunk-3EEFL6NJ.js";
+
+// src/daemon/client.ts
+import { createConnection } from "net";
+import { join } from "path";
+
+// src/daemon/principal.ts
+import { createHash } from "crypto";
+var PRINCIPAL_COMPONENT_MAX_LENGTH = 512;
+function boundedClaim(value) {
+  return typeof value === "string" && value.length > 0 && value.length <= PRINCIPAL_COMPONENT_MAX_LENGTH ? value : void 0;
+}
+function sha256(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+function resolveDaemonPrincipal(token = resolveAuthCredential()?.token) {
+  if (!token) return void 0;
+  const payload = decodeJwtPayload(token);
+  const subject = boundedClaim(payload?.sub);
+  const organizationId = boundedClaim(payload?.org_id);
+  if (!(subject && organizationId)) return void 0;
+  const issuer = boundedClaim(payload?.iss) ?? "unknown-issuer";
+  return {
+    principalId: sha256(`${issuer}\0${subject}`),
+    organizationId,
+    credentialFingerprint: sha256(token)
+  };
+}
+function daemonPrincipalsMatch(caller, daemon) {
+  return caller !== void 0 && daemon !== void 0 && caller.principalId === daemon.principalId && caller.organizationId === daemon.organizationId && caller.credentialFingerprint === daemon.credentialFingerprint;
+}
+
+// src/daemon/protocol.ts
+var DAEMON_JSON_REQUEST_MAX_BYTES = 64 * 1024;
+var DAEMON_JSON_RESPONSE_MAX_BYTES = 8 * 1024 * 1024;
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseDaemonResponseEnvelope(value) {
+  if (!isRecord(value)) return void 0;
+  if (!(typeof value.id === "number" && Number.isSafeInteger(value.id) && value.id >= 0)) {
+    return void 0;
+  }
+  if (typeof value.ok !== "boolean") return void 0;
+  if (value.error !== void 0 && typeof value.error !== "string") return void 0;
+  return {
+    id: value.id,
+    ok: value.ok,
+    ...value.result === void 0 ? {} : { result: value.result },
+    ...value.error === void 0 ? {} : { error: value.error }
+  };
+}
+
+// src/daemon/client.ts
+var SOCK_PATH = join(primConfigDirectory(), "sock");
+var DEFAULT_TIMEOUT_MS = 250;
+var nextRequestId = 1;
+function daemonRequest(method, params = {}, opts = {}) {
+  const id = nextRequestId++;
+  const caller = resolveDaemonPrincipal();
+  const request = {
+    id,
+    method,
+    params,
+    ...caller ? { caller } : {}
+  };
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  return new Promise((resolve) => {
+    let settled = false;
+    let socket;
+    let buffer = Buffer.alloc(0);
+    const settle = (value) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      if (socket) {
+        try {
+          socket.destroy();
+        } catch {
+        }
+      }
+      resolve(value);
+    };
+    const timer = setTimeout(() => settle(null), timeoutMs);
+    timer.unref();
+    try {
+      socket = createConnection(SOCK_PATH);
+    } catch {
+      clearTimeout(timer);
+      settle(null);
+      return;
+    }
+    socket.on("error", () => {
+      clearTimeout(timer);
+      settle(null);
+    });
+    socket.on("connect", () => {
+      try {
+        socket?.write(`${JSON.stringify(request)}
+`);
+      } catch {
+        clearTimeout(timer);
+        settle(null);
+      }
+    });
+    socket.on("data", (chunk) => {
+      buffer = Buffer.concat([buffer, Buffer.from(chunk)]);
+      if (buffer.length > DAEMON_JSON_RESPONSE_MAX_BYTES) {
+        clearTimeout(timer);
+        settle(null);
+        return;
+      }
+      const newlineIdx = buffer.indexOf(10);
+      if (newlineIdx === -1) {
+        return;
+      }
+      const line = buffer.subarray(0, newlineIdx).toString("utf8");
+      try {
+        const res = parseDaemonResponseEnvelope(JSON.parse(line));
+        if (!res || res.id !== id) {
+          clearTimeout(timer);
+          settle(null);
+          return;
+        }
+        clearTimeout(timer);
+        settle(res.ok && res.result !== void 0 ? res.result : null);
+      } catch {
+        clearTimeout(timer);
+        settle(null);
+      }
+    });
+    socket.on("end", () => {
+      if (!settled) {
+        clearTimeout(timer);
+        settle(null);
+      }
+    });
+  });
+}
+async function daemonIsLive(timeoutMs = DEFAULT_TIMEOUT_MS) {
+  const result = await daemonRequest("ping", {}, { timeoutMs });
+  return result?.pong === true;
+}
+
+export {
+  resolveDaemonPrincipal,
+  daemonPrincipalsMatch,
+  daemonRequest,
+  daemonIsLive
+};