@primitive.ai/prim 0.1.0-alpha.68 → 0.1.0-alpha.69

package/dist/{chunk-XUAP572Z.js → chunk-RO3F6JYV.js}

@@ -1,10 +1,11 @@
 import {
   getClient,
-  getSiteUrl
-} from "./chunk-RTLFE6EZ.js";
+  getSiteUrl,
+  terminalSafeLine
+} from "./chunk-Z7YPFWAZ.js";
 import {
   daemonRequest
-} from "./chunk-UTKQTZHL.js";
+} from "./chunk-CUE2LKLR.js";
 
 // src/daemon/proxy.ts
 var DAEMON_HTTP_TIMEOUT_MS = 1e4;
@@ -93,7 +94,7 @@ var FILES_PREVIEW_LIMIT = 3;
 function formatDecisionsWarning(result) {
   const lines = [];
   if (result.unavailable !== void 0) {
-    lines.push(`[prim] decision check not verified \u2014 ${result.unavailable}`);
+    lines.push(`[prim] decision check not verified \u2014 ${terminalSafeLine(result.unavailable)}`);
   }
   if (result.decisions.length > 0) {
     lines.push(
@@ -101,12 +102,12 @@ function formatDecisionsWarning(result) {
     );
     for (const d of result.decisions) {
       const statusMark = d.status === "under_review" ? " (under review)" : "";
-      const preview = d.matchedFiles.slice(0, FILES_PREVIEW_LIMIT).join(", ");
+      const preview = d.matchedFiles.slice(0, FILES_PREVIEW_LIMIT).map(terminalSafeLine).join(", ");
       const overflow = d.matchedFiles.length > FILES_PREVIEW_LIMIT ? ` (+${String(d.matchedFiles.length - FILES_PREVIEW_LIMIT)} more)` : "";
-      lines.push(`  \xB7 ${d.intent}${statusMark}`);
+      lines.push(`  \xB7 ${terminalSafeLine(d.intent)}${statusMark}`);
       lines.push(`    files: ${preview}${overflow}`);
       if (d.rationale) {
-        lines.push(`    rationale: ${d.rationale}`);
+        lines.push(`    rationale: ${terminalSafeLine(d.rationale)}`);
       }
     }
   }

package/dist/{chunk-TDRXHBEX.js → chunk-TJTVHDJ5.js}

@@ -4,6 +4,8 @@ import { createHash } from "crypto";
 import { lstatSync, realpathSync } from "fs";
 import { basename, dirname, isAbsolute, relative, resolve, sep } from "path";
 var GIT_TIMEOUT_MS = 1e3;
+var GITHUB_OWNER_PATTERN = /^(?![A-Za-z0-9-]*--)[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/u;
+var GITHUB_REPOSITORY_PATTERN = /^[A-Za-z0-9._-]{1,100}$/u;
 function gitToplevel(cwd) {
   try {
     return execFileSync("git", ["rev-parse", "--show-toplevel"], {
@@ -38,7 +40,9 @@ function githubRepositoryFullName(cwd) {
   const path = match?.[1] ?? match?.[2];
   if (!path) return null;
   const parts = path.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "").split("/");
-  if (parts.length !== 2 || parts.some((part) => !part || part !== part.trim())) return null;
+  if (parts.length !== 2 || !GITHUB_OWNER_PATTERN.test(parts[0] ?? "") || !GITHUB_REPOSITORY_PATTERN.test(parts[1] ?? "")) {
+    return null;
+  }
   return `${parts[0]}/${parts[1]}`;
 }
 function canonicalGitRoot(cwd) {
@@ -186,6 +190,8 @@ import { homedir } from "os";
 import { join } from "path";
 var PRIM_ACTIVE_KEY = "prim.active";
 var PRIM_REPO_SYNC_ID_KEY = "prim.repoSyncId";
+var PRIM_REPO_SYNC_REPOSITORY_KEY = "prim.repoSyncRepository";
+var PRIM_REPO_BINDING_STATE_KEY = "prim.repoBindingState";
 var GIT_TIMEOUT_MS2 = 1e3;
 var REPO_SYNC_ID_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
 var PROJECT_INSTALL_FILES = [".claude/settings.json", ".codex/hooks.json"];
@@ -218,20 +224,26 @@ function setRepoActive(cwd, active) {
 function isValidRepoSyncId(value) {
   return typeof value === "string" && REPO_SYNC_ID_RE.test(value);
 }
-function repoSyncId(cwd) {
+function localGitConfigValue(cwd, key) {
   try {
-    const value = execFileSync2("git", ["config", "--local", "--get", PRIM_REPO_SYNC_ID_KEY], {
+    const value = execFileSync2("git", ["config", "--local", "--get", key], {
       cwd,
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"],
       timeout: GIT_TIMEOUT_MS2
     }).trim();
-    return isValidRepoSyncId(value) ? value : void 0;
+    return value || void 0;
   } catch {
     return void 0;
   }
 }
-function setRepoSyncId(cwd, value) {
+function repoSyncId(cwd) {
+  const value = localGitConfigValue(cwd, PRIM_REPO_SYNC_ID_KEY);
+  if (!isValidRepoSyncId(value)) return void 0;
+  const repositoryFullName = localGitConfigValue(cwd, PRIM_REPO_SYNC_REPOSITORY_KEY);
+  return repositoryFullName === githubRepositoryFullName(cwd) ? value : void 0;
+}
+function setRepoSyncId(cwd, value, repositoryFullName) {
   if (!isValidRepoSyncId(value)) {
     throw new Error("invalid repository binding returned by server");
   }
@@ -240,20 +252,30 @@ function setRepoSyncId(cwd, value) {
     stdio: ["ignore", "ignore", "pipe"],
     timeout: GIT_TIMEOUT_MS2
   });
+  execFileSync2("git", ["config", "--local", PRIM_REPO_SYNC_REPOSITORY_KEY, repositoryFullName], {
+    cwd,
+    stdio: ["ignore", "ignore", "pipe"],
+    timeout: GIT_TIMEOUT_MS2
+  });
 }
-function clearRepoSyncId(cwd) {
-  try {
-    execFileSync2("git", ["config", "--local", "--unset-all", PRIM_REPO_SYNC_ID_KEY], {
-      cwd,
-      stdio: ["ignore", "ignore", "pipe"],
-      timeout: GIT_TIMEOUT_MS2
-    });
-  } catch (error) {
-    if (typeof error === "object" && error !== null && "status" in error && error.status === 5) {
-      return;
-    }
-    throw error;
+function setRepositoryBindingState(cwd, state) {
+  if (state !== "connected" && state !== "unbound" && state !== "invalid") {
+    throw new Error("invalid repository binding state");
   }
+  execFileSync2("git", ["config", "--local", PRIM_REPO_BINDING_STATE_KEY, state], {
+    cwd,
+    stdio: ["ignore", "ignore", "pipe"],
+    timeout: GIT_TIMEOUT_MS2
+  });
+}
+function repositoryBindingState(cwd) {
+  const rawId = localGitConfigValue(cwd, PRIM_REPO_SYNC_ID_KEY);
+  const marker = localGitConfigValue(cwd, PRIM_REPO_BINDING_STATE_KEY);
+  if (rawId !== void 0 && !isValidRepoSyncId(rawId)) return "invalid";
+  if (marker === "unbound" || marker === "invalid") return marker;
+  if (marker === "connected") return repoSyncId(cwd) ? "connected" : "invalid";
+  if (marker !== void 0) return "invalid";
+  return rawId === void 0 ? "unbound" : repoSyncId(cwd) ? void 0 : "unbound";
 }
 function hasProjectPrimInstall(cwd) {
   const root = gitToplevel(cwd);
@@ -292,7 +314,8 @@ export {
   isValidRepoSyncId,
   repoSyncId,
   setRepoSyncId,
-  clearRepoSyncId,
+  setRepositoryBindingState,
+  repositoryBindingState,
   isRepoActiveForCapture,
   decisionIngestionStatus
 };

package/dist/{chunk-TCDUH7AN.js → chunk-WB7AUZ4C.js}

@@ -9,6 +9,7 @@ function parseAgent(argv) {
 }
 
 // src/hooks/normalize.ts
+import { createHash } from "crypto";
 var HERMES_EVENT_MAP = {
   on_session_start: "SessionStart",
   on_session_end: "SessionEnd",
@@ -19,6 +20,22 @@ var HERMES_EVENT_MAP = {
   subagent_stop: "SubagentStop"
 };
 function normalizeEnvelope(parsed, agent) {
+  if (agent === "codex") {
+    const event = parsed.hook_event_name;
+    if ((event === "PreToolUse" || event === "PostToolUse") && (typeof parsed.tool_use_id !== "string" || parsed.tool_use_id.length === 0)) {
+      const stableToolIdentity = JSON.stringify([
+        parsed.session_id ?? null,
+        parsed.turn_id ?? null,
+        parsed.tool_name ?? null,
+        parsed.tool_input ?? null
+      ]);
+      return {
+        ...parsed,
+        tool_use_id: `codex:fallback:v1:${createHash("sha256").update(stableToolIdentity).digest("hex")}`
+      };
+    }
+    return parsed;
+  }
   if (agent !== "hermes") {
     return parsed;
   }

package/dist/{chunk-UN5O5SYG.js → chunk-YWO7O6QG.js}

@@ -1,6 +1,11 @@
 import {
   getSiteUrl
-} from "./chunk-RTLFE6EZ.js";
+} from "./chunk-Z7YPFWAZ.js";
+import {
+  jwtOrganizationId,
+  primConfigDirectory,
+  resolveAuthCredential
+} from "./chunk-3EEFL6NJ.js";
 
 // src/journal.ts
 import {
@@ -15,9 +20,8 @@ import {
   readSync,
   readdirSync
 } from "fs";
-import { homedir } from "os";
 import { dirname, join } from "path";
-var JOURNAL_DIR = join(homedir(), ".config", "prim", "moves");
+var JOURNAL_DIR = join(primConfigDirectory(), "moves");
 var UNBOUND_BUCKET = "_unbound";
 var JOURNAL_BASENAME = "journal.ndjson";
 var JOURNAL_STATS_SAMPLE_BYTES = 64 * 1024;
@@ -139,7 +143,9 @@ function sampleJournalFile(path, maxBytes = JOURNAL_STATS_SAMPLE_BYTES) {
 function parseFlushingPid(name) {
   const segments = name.slice(FLUSHING_PREFIX.length).split(".");
   const last = segments.length >= 2 ? segments[segments.length - 1] : void 0;
-  return last !== void 0 && /^[0-9]+$/.test(last) ? Number(last) : void 0;
+  if (last === void 0 || !/^[0-9]+$/.test(last)) return void 0;
+  const pid = Number(last);
+  return Number.isSafeInteger(pid) && pid > 0 ? pid : void 0;
 }
 function listFlushingInDir(dir, bucket, options = {}) {
   if (!existsSync(dir)) {
@@ -253,18 +259,10 @@ function pendingJournalStats() {
 
 // src/binding.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
-import { homedir as homedir2 } from "os";
 import { dirname as dirname2, join as join2 } from "path";
-var PRIM_CONFIG_DIR = join2(homedir2(), ".config", "prim");
-var TOKEN_PATH = join2(PRIM_CONFIG_DIR, "token");
+var PRIM_CONFIG_DIR = primConfigDirectory();
 var SESSIONS_DIR = join2(PRIM_CONFIG_DIR, "sessions");
 var WORKSPACE_FILE = ".prim/workspace.json";
-var JWT_PARTS = 3;
-var BASE64_PAD_4 = 4;
-var ENV_TOKEN_LINE = /^\s*PRIM_TOKEN\s*=\s*(.*)$/m;
-var SURROUNDING_QUOTES = /^["']|["']$/g;
-var BASE64URL_MINUS = /-/g;
-var BASE64URL_UNDERSCORE = /_/g;
 function readJsonSafe(path) {
   if (!existsSync2(path)) {
     return;
@@ -296,46 +294,9 @@ function fromWorkspaceFile(startDir) {
     dir = parent;
   }
 }
-function readToken(cwd) {
-  const fromEnv = process.env.PRIM_TOKEN;
-  if (fromEnv) {
-    return fromEnv.trim();
-  }
-  if (existsSync2(TOKEN_PATH)) {
-    return readFileSync2(TOKEN_PATH, "utf-8").trim();
-  }
-  const envLocal = join2(cwd, ".env.local");
-  if (existsSync2(envLocal)) {
-    const match = readFileSync2(envLocal, "utf-8").match(ENV_TOKEN_LINE);
-    if (match) {
-      return match[1].trim().replace(SURROUNDING_QUOTES, "");
-    }
-  }
-  return;
-}
-function base64UrlDecode(s) {
-  const padded = s.padEnd(
-    s.length + (BASE64_PAD_4 - s.length % BASE64_PAD_4) % BASE64_PAD_4,
-    "="
-  );
-  const normalized = padded.replace(BASE64URL_MINUS, "+").replace(BASE64URL_UNDERSCORE, "/");
-  return Buffer.from(normalized, "base64").toString("utf-8");
-}
-function fromDefaultOrg(cwd) {
-  const token = readToken(cwd);
-  if (!token) {
-    return;
-  }
-  const parts = token.split(".");
-  if (parts.length !== JWT_PARTS) {
-    return;
-  }
-  try {
-    const claims = JSON.parse(base64UrlDecode(parts[1]));
-    return claims.org_id;
-  } catch {
-    return;
-  }
+function fromDefaultOrg(_cwd) {
+  const credential = resolveAuthCredential();
+  return credential ? jwtOrganizationId(credential.token) : void 0;
 }
 function resolveOrg(args) {
   const fromSession = fromSessionMarker(args.sessionId);