@primitive.ai/prim 0.1.0-alpha.74 → 0.1.0-alpha.75

package/dist/hook-runtime/index.js

@@ -20473,6 +20473,23 @@ function decisionIngestionStatus(cwd) {
   return isRepoActiveForCapture(cwd) ? "enabled" : "disabled";
 }
 
+// src/lib/confirmation.ts
+function isNonInteractive(globals) {
+  return Boolean(globals.nonInteractive || process.env.CI || process.env.PRIM_NON_INTERACTIVE);
+}
+async function askConfirmation(question, output = process.stdout) {
+  if (!process.stdin.isTTY) return false;
+  const { createInterface } = await import("readline/promises");
+  const rl = createInterface({ input: process.stdin, output });
+  try {
+    const answer = await rl.question(`${question} [y/N] `);
+    const normalized = answer.trim().toLowerCase();
+    return normalized === "y" || normalized === "yes";
+  } finally {
+    rl.close();
+  }
+}
+
 // src/lib/post-commit-hook.ts
 import { execFileSync as execFileSync3 } from "child_process";
 import { createHash as createHash4, randomUUID as randomUUID2 } from "crypto";
@@ -22353,85 +22370,72 @@ function printJson(data) {
   console.log(JSON.stringify(data, null, 2));
 }
 
-// src/commands/activation.ts
-async function applyActivation(active) {
-  const root = gitToplevel();
-  if (!root) {
-    process.stderr.write(
-      `[prim] not a git repository \u2014 run \`prim ${active ? "enable" : "disable"}\` inside a repo
-`
-    );
-    process.exit(1);
+// src/lib/ansi.ts
+var ANSI_CODES = {
+  yellow: "\x1B[33m",
+  magenta: "\x1B[35m",
+  blue: "\x1B[34m",
+  cyan: "\x1B[36m",
+  green: "\x1B[32m",
+  red: "\x1B[31m",
+  // 256-color approximation of the orange trigger marker (xterm 208).
+  orange: "\x1B[38;5;208m",
+  gray: "\x1B[90m"
+};
+var ANSI_RESET = "\x1B[0m";
+var ANSI_DIM = "\x1B[2m";
+var ANSI_BOLD = "\x1B[1m";
+function supportsColor2() {
+  if (process.env.NO_COLOR !== void 0 && process.env.NO_COLOR !== "") {
+    return false;
   }
-  let phase = active ? "post-commit hook coverage" : "local deactivation";
-  try {
-    let binding;
-    let postCommitHook;
-    let postRewriteHook;
-    if (active) {
-      postCommitHook = ensureEffectivePostCommitHook(root).path;
-      try {
-        postRewriteHook = ensureEffectivePostRewriteHook(root).path;
-      } catch (error) {
-        const detail = error instanceof Error ? error.message : String(error);
-        process.stderr.write(`[prim] post-rewrite hook coverage is degraded: ${detail}
-`);
-      }
-      phase = "repository binding";
-      binding = await bindRepository(root);
-      phase = "local activation";
-    }
-    setRepoActive(root, active);
-    await daemonRequest("statusline_invalidate", {}, { timeoutMs: 250 });
-    if (binding?.status === "unbound") {
-      process.stderr.write(`[prim] Prim is enabled locally in ${root}
-`);
-      process.stderr.write(
-        "[prim] repository is not connected to Primitive; Moves still ingest into the team graph without repository-specific file attribution, Conflict Gate verification, or commit correlation\n"
-      );
-      process.stderr.write(
-        `[prim] ask an organization owner or administrator to grant Primitive's GitHub App access to this repository through Primitive's GitHub App onboarding; binding retries automatically at the next agent SessionStart
-`
-      );
-    } else {
-      process.stderr.write(`[prim] prim ${active ? "enabled" : "disabled"} in ${root}
-`);
-    }
-    printJson({
-      active,
-      repo: root,
-      ...binding ? {
-        bindingStatus: binding.status,
-        repositoryFullName: binding.repositoryFullName,
-        ...binding.status === "connected" ? { repoSyncId: binding.repoSyncId } : {}
-      } : {},
-      ...postCommitHook ? { postCommitHook } : {},
-      ...postRewriteHook ? { postRewriteHook } : {}
-    });
-  } catch (err) {
-    const detail = err instanceof Error ? err.message : String(err);
-    process.stderr.write(
-      active ? `[prim] failed to enable prim during ${phase}: ${detail}
-` : `[prim] failed to disable prim: ${detail}
-`
-    );
-    process.exit(1);
+  return process.stderr.isTTY === true;
+}
+function color(text, c) {
+  if (!supportsColor2()) {
+    return text;
   }
+  return `${ANSI_CODES[c]}${text}${ANSI_RESET}`;
 }
-function registerActivationCommands(program3) {
-  program3.command("enable").description("Activate prim's hooks in this repo (git config prim.active=true)").action(() => applyActivation(true));
-  program3.command("disable").description("Mute prim's hooks in this repo (git config prim.active=false)").action(() => applyActivation(false));
+function dim(text) {
+  if (!supportsColor2()) {
+    return text;
+  }
+  return `${ANSI_DIM}${text}${ANSI_RESET}`;
+}
+function bold(text) {
+  if (!supportsColor2()) {
+    return text;
+  }
+  return `${ANSI_BOLD}${text}${ANSI_RESET}`;
+}
+var AREA_COLORS = {
+  auth: "yellow",
+  data: "magenta",
+  mobile: "blue",
+  infra: "cyan",
+  ui: "green",
+  billing: "orange",
+  api: "blue",
+  docs: "gray",
+  testing: "gray"
+};
+function colorForArea(area) {
+  if (!area) {
+    return "gray";
+  }
+  return AREA_COLORS[area] ?? "gray";
+}
+var MAX_HEALTH_ERROR_LENGTH = 240;
+function boundedHealthError(value) {
+  if (!value) return void 0;
+  const clean = terminalSafeLine(value);
+  if (!clean) return void 0;
+  return clean.length <= MAX_HEALTH_ERROR_LENGTH ? clean : `${clean.slice(0, MAX_HEALTH_ERROR_LENGTH - 1)}\u2026`;
+}
+function stripAnsi2(text) {
+  return text.replace(/\u001b\[[0-9;]*m/g, "");
 }
-
-// src/commands/auth.ts
-import { execFile } from "child_process";
-import { createHash as createHash6, randomBytes as randomBytes3 } from "crypto";
-import { existsSync as existsSync6, readFileSync as readFileSync7 } from "fs";
-import { createServer } from "http";
-import { platform } from "os";
-
-// src/auth/api-keys.ts
-import { randomBytes as randomBytes2 } from "crypto";
 
 // src/generated/cli-http-v1.validators.js
 var import_ucs2length = __toESM(require_ucs2length(), 1);
@@ -32165,7 +32169,113 @@ function isGitHubInstallIntentStatusResponse(value) {
   }
 }
 
+// src/lib/github-install-intent.ts
+var PROTOCOL_VERSION = 1;
+var MODE = "install_intent_v1";
+var START_PATH = "/api/cli/github/install-intents";
+var POLL_REQUEST_TIMEOUT_MS2 = 1e4;
+var MAX_INTENT_LIFETIME_MS = 15 * 6e4;
+var REPOSITORY_IDENTITY_MIGRATION_REQUIRED = "repository_identity_migration_required";
+function isRepositoryIdentityMigrationRequiredStatus(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return false;
+  }
+  const record2 = value;
+  if (record2.failureCode !== REPOSITORY_IDENTITY_MIGRATION_REQUIRED) {
+    return false;
+  }
+  return isGitHubInstallIntentStatusResponse({
+    ...record2,
+    failureCode: "proof_commit_failed"
+  });
+}
+function parseGitHubInstallIntentStart(value, now = Date.now()) {
+  if (!isGitHubInstallIntentStartResponse(value) || value.expiresAt <= now || value.expiresAt - now > MAX_INTENT_LIFETIME_MS) {
+    return null;
+  }
+  return value;
+}
+function parseGitHubInstallIntentStatus(value, expectedExpiresAt) {
+  if (isGitHubInstallIntentStatusResponse(value)) {
+    return value.expiresAt === expectedExpiresAt ? value : null;
+  }
+  if (!isRepositoryIdentityMigrationRequiredStatus(value) || value.expiresAt !== expectedExpiresAt) {
+    return null;
+  }
+  return value;
+}
+async function createGitHubInstallIntent(client, options = {}) {
+  const { now = Date.now, ...requestOptions } = options;
+  const raw = await client.post(START_PATH, void 0, requestOptions);
+  const parsed = parseGitHubInstallIntentStart(raw, now());
+  if (!parsed) throw new Error("server returned an invalid GitHub install-intent response");
+  return parsed;
+}
+function defaultSleep3(milliseconds, signal) {
+  if (signal.aborted) return Promise.reject(signal.reason);
+  return new Promise((resolvePromise, reject) => {
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(signal.reason);
+    };
+    const timer = setTimeout(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolvePromise();
+    }, milliseconds);
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
+function expiredStatus(start) {
+  return {
+    protocolVersion: PROTOCOL_VERSION,
+    mode: MODE,
+    found: true,
+    status: "expired",
+    expiresAt: start.expiresAt,
+    closedAt: start.expiresAt
+  };
+}
+async function pollGitHubInstallIntent(client, start, options = {}) {
+  const now = options.now ?? Date.now;
+  const sleep2 = options.sleep ?? defaultSleep3;
+  const signal = options.signal ?? new AbortController().signal;
+  const path9 = `${START_PATH}/${encodeURIComponent(start.intentId)}`;
+  while (true) {
+    if (signal.aborted) throw signal.reason;
+    const remainingBeforeSleep = start.expiresAt - now();
+    if (remainingBeforeSleep <= 0) return expiredStatus(start);
+    await sleep2(Math.min(start.pollAfterMs, remainingBeforeSleep), signal);
+    if (signal.aborted) throw signal.reason;
+    const remainingBeforeRequest = start.expiresAt - now();
+    if (remainingBeforeRequest <= 0) return expiredStatus(start);
+    let raw;
+    try {
+      raw = await client.get(path9, {
+        signal: AbortSignal.any([
+          signal,
+          AbortSignal.timeout(Math.min(POLL_REQUEST_TIMEOUT_MS2, remainingBeforeRequest))
+        ])
+      });
+    } catch (error) {
+      if (signal.aborted) throw error;
+      if (now() >= start.expiresAt) return expiredStatus(start);
+      throw error;
+    }
+    const status = parseGitHubInstallIntentStatus(raw, start.expiresAt);
+    if (!status) throw new Error("server returned an invalid GitHub install-intent status");
+    if (status.status !== "pending" && status.status !== "claimed") return status;
+  }
+}
+
+// src/commands/auth.ts
+import { execFile } from "child_process";
+import { createHash as createHash6, randomBytes as randomBytes3 } from "crypto";
+import { existsSync as existsSync6, readFileSync as readFileSync7 } from "fs";
+import { createServer } from "http";
+import { platform } from "os";
+
 // src/auth/api-keys.ts
+import { randomBytes as randomBytes2 } from "crypto";
 var USER_API_KEY_TIMEOUT_MS = 1e4;
 var USER_API_KEY_EXIT = {
   ok: 0,
@@ -33054,6 +33164,231 @@ async function exchangeCode(siteUrl, code, codeVerifier, redirectUri) {
   };
 }
 
+// src/commands/github.ts
+var BIND_TIMEOUT_MS = 1e4;
+var START_TIMEOUT_MS = 1e4;
+var EXIT_OK2 = 0;
+var EXIT_FAILURE = 1;
+var EXIT_UNBOUND = 2;
+var defaultDependencies2 = {
+  cwd: () => process.cwd(),
+  gitToplevel,
+  bindRepositoryWithClient,
+  getPinnedClient,
+  createInstallIntent: createGitHubInstallIntent,
+  pollInstallIntent: pollGitHubInstallIntent,
+  openBrowser,
+  now: Date.now
+};
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function reportConnectFailure(error) {
+  const message = errorMessage(error);
+  const human = boundedHealthError(message) ?? "unknown error";
+  process.stderr.write(`[prim] github connect failed: ${human}
+`);
+  printJson({
+    status: "error",
+    error: message,
+    ...error instanceof HttpError ? { httpStatus: error.status } : {}
+  });
+  process.exitCode = EXIT_FAILURE;
+}
+function reportBinding(binding, installAttempted = false) {
+  if (binding.status === "connected") {
+    process.stderr.write(
+      `[prim] repository binding connected for GitHub origin ${binding.repositoryFullName}
+`
+    );
+    printJson(binding);
+    process.exitCode = EXIT_OK2;
+    return;
+  }
+  process.stderr.write(
+    installAttempted ? `[prim] GitHub installation completed, but ${binding.repositoryFullName} was not granted admin access; repository binding remains unbound
+` : `[prim] repository binding unbound for GitHub origin ${binding.repositoryFullName}; starting GitHub App installation
+`
+  );
+  printJson(binding);
+  process.exitCode = EXIT_UNBOUND;
+}
+function terminalInstallError(status) {
+  if (status.status === "failed_terminal") {
+    return new Error(`GitHub installation failed: ${status.failureCode}`);
+  }
+  return new Error(`GitHub installation ${status.status}`);
+}
+async function completeInstallIntent(client, start, dependencies, browser) {
+  process.stderr.write(`[prim] complete GitHub App installation at:
+${start.browserUrl}
+`);
+  if (browser) dependencies.openBrowser(start.browserUrl);
+  return dependencies.pollInstallIntent(client, start, {
+    now: dependencies.now
+  });
+}
+async function runGithubConnect(dependencies = defaultDependencies2, options = {}) {
+  const root = options.root ?? dependencies.gitToplevel(dependencies.cwd());
+  if (!root) return { kind: "not-a-repo" };
+  try {
+    const client = await dependencies.getPinnedClient({
+      signal: AbortSignal.timeout(BIND_TIMEOUT_MS)
+    });
+    const existing = await dependencies.bindRepositoryWithClient(root, client, {
+      signal: AbortSignal.timeout(BIND_TIMEOUT_MS)
+    });
+    if (existing.status === "connected") {
+      return { kind: "connected", binding: existing };
+    }
+    const start = await dependencies.createInstallIntent(client, {
+      signal: AbortSignal.timeout(START_TIMEOUT_MS),
+      now: dependencies.now
+    });
+    const status = await completeInstallIntent(
+      client,
+      start,
+      dependencies,
+      options.browser ?? true
+    );
+    if (status.status !== "consumed") throw terminalInstallError(status);
+    process.stderr.write(
+      `[prim] GitHub installation verified: ${status.adminRepositoryCount} admin repositories (${status.repositoryCount} total)
+`
+    );
+    const binding = await dependencies.bindRepositoryWithClient(root, client, {
+      signal: AbortSignal.timeout(BIND_TIMEOUT_MS)
+    });
+    return binding.status === "connected" ? { kind: "connected", binding } : { kind: "unbound", binding, installAttempted: true };
+  } catch (error) {
+    return { kind: "error", error };
+  }
+}
+async function performGithubConnect(dependencies = defaultDependencies2, options = {}) {
+  const outcome = await runGithubConnect(dependencies, options);
+  switch (outcome.kind) {
+    case "not-a-repo":
+      reportConnectFailure(
+        new Error("not a git repository \u2014 run `prim github connect` inside a GitHub repository")
+      );
+      return;
+    case "error":
+      reportConnectFailure(outcome.error);
+      return;
+    case "connected":
+      reportBinding(outcome.binding);
+      return;
+    case "unbound":
+      reportBinding(outcome.binding, outcome.installAttempted);
+      return;
+  }
+}
+function registerGithubCommands(program3, dependencies = defaultDependencies2) {
+  const github = program3.command("github").description("Manage GitHub repository bindings");
+  github.command("connect").description("Install or reuse the Primitive GitHub App and bind the current GitHub origin").option("--no-browser", "Print the GitHub installation URL without opening a browser").action(async (options, command) => {
+    const globals = command.optsWithGlobals();
+    await performGithubConnect(dependencies, {
+      browser: options.browser && globals.nonInteractive !== true
+    });
+  });
+}
+
+// src/commands/activation.ts
+var CONNECT_PROMPT = "[prim] Connect this repository to Primitive via the GitHub App now?";
+async function maybeConnectRepository(root, globals) {
+  if (isNonInteractive(globals)) return void 0;
+  const approved = Boolean(globals.yes) || await askConfirmation(CONNECT_PROMPT, process.stderr);
+  if (!approved) return void 0;
+  const outcome = await runGithubConnect(void 0, { root, browser: true });
+  if (outcome.kind === "connected") {
+    process.stderr.write(
+      `[prim] repository binding connected for GitHub origin ${outcome.binding.repositoryFullName}
+`
+    );
+    return outcome.binding;
+  }
+  if (outcome.kind === "error") {
+    const detail = outcome.error instanceof Error ? outcome.error.message : String(outcome.error);
+    process.stderr.write(`[prim] connect could not complete: ${detail}
+`);
+  }
+  return void 0;
+}
+async function applyActivation(active, globals = {}) {
+  const root = gitToplevel();
+  if (!root) {
+    process.stderr.write(
+      `[prim] not a git repository \u2014 run \`prim ${active ? "enable" : "disable"}\` inside a repo
+`
+    );
+    process.exit(1);
+  }
+  let phase = active ? "post-commit hook coverage" : "local deactivation";
+  try {
+    let binding;
+    let postCommitHook;
+    let postRewriteHook;
+    if (active) {
+      postCommitHook = ensureEffectivePostCommitHook(root).path;
+      try {
+        postRewriteHook = ensureEffectivePostRewriteHook(root).path;
+      } catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        process.stderr.write(`[prim] post-rewrite hook coverage is degraded: ${detail}
+`);
+      }
+      phase = "repository binding";
+      binding = await bindRepository(root);
+      phase = "local activation";
+    }
+    setRepoActive(root, active);
+    if (active && binding?.status === "unbound") {
+      const connected = await maybeConnectRepository(root, globals);
+      if (connected) binding = connected;
+    }
+    await daemonRequest("statusline_invalidate", {}, { timeoutMs: 250 });
+    if (binding?.status === "unbound") {
+      process.stderr.write(`[prim] Prim is enabled locally in ${root}
+`);
+      process.stderr.write(
+        "[prim] repository is not connected to Primitive; Moves still ingest into the team graph without repository-specific file attribution, Conflict Gate verification, or commit correlation\n"
+      );
+      process.stderr.write(
+        `[prim] ask an organization owner or administrator to grant Primitive's GitHub App access to this repository through Primitive's GitHub App onboarding; binding retries automatically at the next agent SessionStart
+`
+      );
+    } else {
+      process.stderr.write(`[prim] prim ${active ? "enabled" : "disabled"} in ${root}
+`);
+    }
+    printJson({
+      active,
+      repo: root,
+      ...binding ? {
+        bindingStatus: binding.status,
+        repositoryFullName: binding.repositoryFullName,
+        ...binding.status === "connected" ? { repoSyncId: binding.repoSyncId } : {}
+      } : {},
+      ...postCommitHook ? { postCommitHook } : {},
+      ...postRewriteHook ? { postRewriteHook } : {}
+    });
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    process.stderr.write(
+      active ? `[prim] failed to enable prim during ${phase}: ${detail}
+` : `[prim] failed to disable prim: ${detail}
+`
+    );
+    process.exit(1);
+  }
+}
+function registerActivationCommands(program3) {
+  program3.command("enable").description("Activate prim's hooks in this repo (git config prim.active=true)").action((_opts, command) => applyActivation(true, command.optsWithGlobals()));
+  program3.command("disable").description("Mute prim's hooks in this repo (git config prim.active=false)").action(
+    (_opts, command) => applyActivation(false, command.optsWithGlobals())
+  );
+}
+
 // src/commands/claude-install.ts
 import { existsSync as existsSync8, readFileSync as readFileSync9 } from "fs";
 import { homedir as homedir4 } from "os";
@@ -34855,7 +35190,7 @@ function atomicWrite3(path9, content, mode, validate3) {
   }
   return true;
 }
-function defaultSleep3(ms) {
+function defaultSleep4(ms) {
   return new Promise((resolvePromise) => setTimeout(resolvePromise, ms));
 }
 function validatePlist(path9, timeoutMs2) {
@@ -35174,7 +35509,7 @@ async function ensureMacDaemonLocked(options) {
     PLIST_FILE_MODE,
     options.validatePlist ?? validatePlist
   );
-  const sleep2 = options.sleep ?? defaultSleep3;
+  const sleep2 = options.sleep ?? defaultSleep4;
   const nowMs = options.nowMs ?? performance.now.bind(performance);
   const deadlineMs = nowMs() + TRANSITION_TIMEOUT_MS;
   const inspect = options.inspectDaemon ?? inspectDaemon;
@@ -35228,7 +35563,7 @@ async function bootoutMacDaemon(options = {}) {
 async function bootoutMacDaemonLocked(options) {
   const runner = options.runner ?? runLaunchctl;
   const inspect = options.inspectDaemon ?? inspectDaemon;
-  const sleep2 = options.sleep ?? defaultSleep3;
+  const sleep2 = options.sleep ?? defaultSleep4;
   const nowMs = options.nowMs ?? performance.now.bind(performance);
   const deadlineMs = nowMs() + TRANSITION_TIMEOUT_MS;
   const paths = launchdPaths(options);
@@ -35282,73 +35617,6 @@ async function bootoutMacDaemonLocked(options) {
   return { wasLoaded, legacyStopped, service };
 }
 
-// src/lib/ansi.ts
-var ANSI_CODES = {
-  yellow: "\x1B[33m",
-  magenta: "\x1B[35m",
-  blue: "\x1B[34m",
-  cyan: "\x1B[36m",
-  green: "\x1B[32m",
-  red: "\x1B[31m",
-  // 256-color approximation of the orange trigger marker (xterm 208).
-  orange: "\x1B[38;5;208m",
-  gray: "\x1B[90m"
-};
-var ANSI_RESET = "\x1B[0m";
-var ANSI_DIM = "\x1B[2m";
-var ANSI_BOLD = "\x1B[1m";
-function supportsColor2() {
-  if (process.env.NO_COLOR !== void 0 && process.env.NO_COLOR !== "") {
-    return false;
-  }
-  return process.stderr.isTTY === true;
-}
-function color(text, c) {
-  if (!supportsColor2()) {
-    return text;
-  }
-  return `${ANSI_CODES[c]}${text}${ANSI_RESET}`;
-}
-function dim(text) {
-  if (!supportsColor2()) {
-    return text;
-  }
-  return `${ANSI_DIM}${text}${ANSI_RESET}`;
-}
-function bold(text) {
-  if (!supportsColor2()) {
-    return text;
-  }
-  return `${ANSI_BOLD}${text}${ANSI_RESET}`;
-}
-var AREA_COLORS = {
-  auth: "yellow",
-  data: "magenta",
-  mobile: "blue",
-  infra: "cyan",
-  ui: "green",
-  billing: "orange",
-  api: "blue",
-  docs: "gray",
-  testing: "gray"
-};
-function colorForArea(area) {
-  if (!area) {
-    return "gray";
-  }
-  return AREA_COLORS[area] ?? "gray";
-}
-var MAX_HEALTH_ERROR_LENGTH = 240;
-function boundedHealthError(value) {
-  if (!value) return void 0;
-  const clean = terminalSafeLine(value);
-  if (!clean) return void 0;
-  return clean.length <= MAX_HEALTH_ERROR_LENGTH ? clean : `${clean.slice(0, MAX_HEALTH_ERROR_LENGTH - 1)}\u2026`;
-}
-function stripAnsi2(text) {
-  return text.replace(/\u001b\[[0-9;]*m/g, "");
-}
-
 // src/lib/presence.ts
 var DECISION_ORIGIN = "https://app.getprimitive.ai";
 function validDecisionUrl(value) {
@@ -35468,7 +35736,7 @@ var READY_POLL_MS2 = 100;
 var READY_PROBE_TIMEOUT_MS2 = 250;
 var HEALTHY_TIMEOUT_MS = 3e4;
 var HEALTHY_POLL_MS = 250;
-var EXIT_OK2 = 0;
+var EXIT_OK3 = 0;
 var EXIT_NOT_RUNNING = 2;
 var EXIT_BOOTING = 3;
 function formatDaemonLifecycleMessage(message, decisionIngestion) {
@@ -35849,7 +36117,7 @@ function classifyStatus(pidAlive, responding, snapshot, pid) {
     };
   }
   if (!snapshot) {
-    return { json: { running: true, responding: true }, exitCode: EXIT_OK2 };
+    return { json: { running: true, responding: true }, exitCode: EXIT_OK3 };
   }
   if (snapshot.healthy === false) {
     return {
@@ -35857,7 +36125,7 @@ function classifyStatus(pidAlive, responding, snapshot, pid) {
       exitCode: EXIT_BOOTING
     };
   }
-  return { json: { running: true, responding: true, ...snapshot }, exitCode: EXIT_OK2 };
+  return { json: { running: true, responding: true, ...snapshot }, exitCode: EXIT_OK3 };
 }
 function classifyLaunchdStatus(service, responding, snapshot, disabled) {
   if (!service) {
@@ -35955,7 +36223,7 @@ function classifyLaunchdStatus(service, responding, snapshot, disabled) {
       disabled,
       ...snapshot
     },
-    exitCode: EXIT_OK2
+    exitCode: EXIT_OK3
   };
 }
 function formatDaemonSnapshotMessage(snapshot, supervised, decisionIngestion, bindingState) {
@@ -36005,7 +36273,7 @@ async function detachedDaemonStatus() {
     writeLiveSnapshot(snapshot);
   }
   console.log(JSON.stringify(json, null, 2));
-  if (exitCode !== EXIT_OK2 && !process.exitCode) {
+  if (exitCode !== EXIT_OK3 && !process.exitCode) {
     process.exitCode = exitCode;
   }
 }
@@ -36055,7 +36323,7 @@ async function macDaemonStatus() {
     writeLiveSnapshot(snapshot, true);
   }
   console.log(JSON.stringify(json, null, 2));
-  if (exitCode !== EXIT_OK2 && !process.exitCode) process.exitCode = exitCode;
+  if (exitCode !== EXIT_OK3 && !process.exitCode) process.exitCode = exitCode;
 }
 async function daemonStatus() {
   if (process.platform === "darwin") {
@@ -36672,7 +36940,7 @@ var DECISION_LIFECYCLE_EXIT = {
   server: 3,
   notFound: 4
 };
-var defaultDependencies2 = {
+var defaultDependencies3 = {
   getClient,
   signal: () => AbortSignal.timeout(DECISION_LIFECYCLE_TIMEOUT_MS),
   writeStdout: (value) => console.log(value),
@@ -36885,19 +37153,19 @@ async function executeLifecycle(operation, request2, dependencies) {
     return writeFailure2(operation, classifyError2(error), dependencies);
   }
 }
-function publishDecision(id, dependencies = defaultDependencies2) {
+function publishDecision(id, dependencies = defaultDependencies3) {
   const request2 = { id };
   return executeLifecycle("publish", request2, dependencies);
 }
-function restoreDecision(id, dependencies = defaultDependencies2) {
+function restoreDecision(id, dependencies = defaultDependencies3) {
   const request2 = { id };
   return executeLifecycle("restore", request2, dependencies);
 }
-function ratifyDecision(id, dependencies = defaultDependencies2) {
+function ratifyDecision(id, dependencies = defaultDependencies3) {
   const request2 = { id };
   return executeLifecycle("ratify", request2, dependencies);
 }
-function supersedeDecision(id, by, dependencies = defaultDependencies2) {
+function supersedeDecision(id, by, dependencies = defaultDependencies3) {
   const request2 = { id, by };
   return executeLifecycle("supersede", request2, dependencies);
 }
@@ -37736,26 +38004,9 @@ function formatDecisionsWarning(result) {
   return lines.join("\n");
 }
 
-// src/lib/confirmation.ts
-function isNonInteractive(globals) {
-  return Boolean(globals.nonInteractive || process.env.CI || process.env.PRIM_NON_INTERACTIVE);
-}
-async function askConfirmation(question, output = process.stdout) {
-  if (!process.stdin.isTTY) return false;
-  const { createInterface } = await import("readline/promises");
-  const rl = createInterface({ input: process.stdin, output });
-  try {
-    const answer = await rl.question(`${question} [y/N] `);
-    const normalized = answer.trim().toLowerCase();
-    return normalized === "y" || normalized === "yes";
-  } finally {
-    rl.close();
-  }
-}
-
 // src/commands/decisions.ts
 var EXIT_NOT_FOUND = 4;
-var EXIT_FAILURE = 1;
+var EXIT_FAILURE2 = 1;
 var EXIT_USAGE = 2;
 function handleRepairCommandError(error) {
   if (error instanceof RepairProposalNotFoundError) {
@@ -37772,12 +38023,12 @@ function handleRepairCommandError(error) {
     console.error(
       `[prim] ${error instanceof RepairAuthorizationError ? error.message : "Not authorized to review commit repairs; active organization membership and current repository authorization are required"}`
     );
-    process.exitCode = EXIT_FAILURE;
+    process.exitCode = EXIT_FAILURE2;
     return true;
   }
   if (error instanceof RepairEndpointVersionError || error instanceof RepairListContractError) {
     console.error(`[prim] ${error.message}`);
-    process.exitCode = EXIT_FAILURE;
+    process.exitCode = EXIT_FAILURE2;
     return true;
   }
   return false;
@@ -39802,220 +40053,6 @@ function registerDoctorCommands(program3) {
   });
 }
 
-// src/lib/github-install-intent.ts
-var PROTOCOL_VERSION = 1;
-var MODE = "install_intent_v1";
-var START_PATH = "/api/cli/github/install-intents";
-var POLL_REQUEST_TIMEOUT_MS2 = 1e4;
-var MAX_INTENT_LIFETIME_MS = 15 * 6e4;
-var REPOSITORY_IDENTITY_MIGRATION_REQUIRED = "repository_identity_migration_required";
-function isRepositoryIdentityMigrationRequiredStatus(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    return false;
-  }
-  const record2 = value;
-  if (record2.failureCode !== REPOSITORY_IDENTITY_MIGRATION_REQUIRED) {
-    return false;
-  }
-  return isGitHubInstallIntentStatusResponse({
-    ...record2,
-    failureCode: "proof_commit_failed"
-  });
-}
-function parseGitHubInstallIntentStart(value, now = Date.now()) {
-  if (!isGitHubInstallIntentStartResponse(value) || value.expiresAt <= now || value.expiresAt - now > MAX_INTENT_LIFETIME_MS) {
-    return null;
-  }
-  return value;
-}
-function parseGitHubInstallIntentStatus(value, expectedExpiresAt) {
-  if (isGitHubInstallIntentStatusResponse(value)) {
-    return value.expiresAt === expectedExpiresAt ? value : null;
-  }
-  if (!isRepositoryIdentityMigrationRequiredStatus(value) || value.expiresAt !== expectedExpiresAt) {
-    return null;
-  }
-  return value;
-}
-async function createGitHubInstallIntent(client, options = {}) {
-  const { now = Date.now, ...requestOptions } = options;
-  const raw = await client.post(START_PATH, void 0, requestOptions);
-  const parsed = parseGitHubInstallIntentStart(raw, now());
-  if (!parsed) throw new Error("server returned an invalid GitHub install-intent response");
-  return parsed;
-}
-function defaultSleep4(milliseconds, signal) {
-  if (signal.aborted) return Promise.reject(signal.reason);
-  return new Promise((resolvePromise, reject) => {
-    const onAbort = () => {
-      clearTimeout(timer);
-      reject(signal.reason);
-    };
-    const timer = setTimeout(() => {
-      signal.removeEventListener("abort", onAbort);
-      resolvePromise();
-    }, milliseconds);
-    signal.addEventListener("abort", onAbort, { once: true });
-  });
-}
-function expiredStatus(start) {
-  return {
-    protocolVersion: PROTOCOL_VERSION,
-    mode: MODE,
-    found: true,
-    status: "expired",
-    expiresAt: start.expiresAt,
-    closedAt: start.expiresAt
-  };
-}
-async function pollGitHubInstallIntent(client, start, options = {}) {
-  const now = options.now ?? Date.now;
-  const sleep2 = options.sleep ?? defaultSleep4;
-  const signal = options.signal ?? new AbortController().signal;
-  const path9 = `${START_PATH}/${encodeURIComponent(start.intentId)}`;
-  while (true) {
-    if (signal.aborted) throw signal.reason;
-    const remainingBeforeSleep = start.expiresAt - now();
-    if (remainingBeforeSleep <= 0) return expiredStatus(start);
-    await sleep2(Math.min(start.pollAfterMs, remainingBeforeSleep), signal);
-    if (signal.aborted) throw signal.reason;
-    const remainingBeforeRequest = start.expiresAt - now();
-    if (remainingBeforeRequest <= 0) return expiredStatus(start);
-    let raw;
-    try {
-      raw = await client.get(path9, {
-        signal: AbortSignal.any([
-          signal,
-          AbortSignal.timeout(Math.min(POLL_REQUEST_TIMEOUT_MS2, remainingBeforeRequest))
-        ])
-      });
-    } catch (error) {
-      if (signal.aborted) throw error;
-      if (now() >= start.expiresAt) return expiredStatus(start);
-      throw error;
-    }
-    const status = parseGitHubInstallIntentStatus(raw, start.expiresAt);
-    if (!status) throw new Error("server returned an invalid GitHub install-intent status");
-    if (status.status !== "pending" && status.status !== "claimed") return status;
-  }
-}
-
-// src/commands/github.ts
-var BIND_TIMEOUT_MS = 1e4;
-var START_TIMEOUT_MS = 1e4;
-var EXIT_OK3 = 0;
-var EXIT_FAILURE2 = 1;
-var EXIT_UNBOUND = 2;
-var defaultDependencies3 = {
-  cwd: () => process.cwd(),
-  gitToplevel,
-  bindRepositoryWithClient,
-  getPinnedClient,
-  createInstallIntent: createGitHubInstallIntent,
-  pollInstallIntent: pollGitHubInstallIntent,
-  openBrowser,
-  now: Date.now
-};
-function errorMessage(error) {
-  return error instanceof Error ? error.message : String(error);
-}
-function reportConnectFailure(error) {
-  const message = errorMessage(error);
-  const human = boundedHealthError(message) ?? "unknown error";
-  process.stderr.write(`[prim] github connect failed: ${human}
-`);
-  printJson({
-    status: "error",
-    error: message,
-    ...error instanceof HttpError ? { httpStatus: error.status } : {}
-  });
-  process.exitCode = EXIT_FAILURE2;
-}
-function reportBinding(binding, installAttempted = false) {
-  if (binding.status === "connected") {
-    process.stderr.write(
-      `[prim] repository binding connected for GitHub origin ${binding.repositoryFullName}
-`
-    );
-    printJson(binding);
-    process.exitCode = EXIT_OK3;
-    return;
-  }
-  process.stderr.write(
-    installAttempted ? `[prim] GitHub installation completed, but ${binding.repositoryFullName} was not granted admin access; repository binding remains unbound
-` : `[prim] repository binding unbound for GitHub origin ${binding.repositoryFullName}; starting GitHub App installation
-`
-  );
-  printJson(binding);
-  process.exitCode = EXIT_UNBOUND;
-}
-function terminalInstallError(status) {
-  if (status.status === "failed_terminal") {
-    return new Error(`GitHub installation failed: ${status.failureCode}`);
-  }
-  return new Error(`GitHub installation ${status.status}`);
-}
-async function completeInstallIntent(client, start, dependencies, browser) {
-  process.stderr.write(`[prim] complete GitHub App installation at:
-${start.browserUrl}
-`);
-  if (browser) dependencies.openBrowser(start.browserUrl);
-  return dependencies.pollInstallIntent(client, start, {
-    now: dependencies.now
-  });
-}
-async function performGithubConnect(dependencies = defaultDependencies3, options = {}) {
-  const root = dependencies.gitToplevel(dependencies.cwd());
-  if (!root) {
-    reportConnectFailure(
-      new Error("not a git repository \u2014 run `prim github connect` inside a GitHub repository")
-    );
-    return;
-  }
-  try {
-    const client = await dependencies.getPinnedClient({
-      signal: AbortSignal.timeout(BIND_TIMEOUT_MS)
-    });
-    const existing = await dependencies.bindRepositoryWithClient(root, client, {
-      signal: AbortSignal.timeout(BIND_TIMEOUT_MS)
-    });
-    if (existing.status === "connected") {
-      reportBinding(existing);
-      return;
-    }
-    const start = await dependencies.createInstallIntent(client, {
-      signal: AbortSignal.timeout(START_TIMEOUT_MS),
-      now: dependencies.now
-    });
-    const status = await completeInstallIntent(
-      client,
-      start,
-      dependencies,
-      options.browser ?? true
-    );
-    if (status.status !== "consumed") throw terminalInstallError(status);
-    process.stderr.write(
-      `[prim] GitHub installation verified: ${status.adminRepositoryCount} admin repositories (${status.repositoryCount} total)
-`
-    );
-    const binding = await dependencies.bindRepositoryWithClient(root, client, {
-      signal: AbortSignal.timeout(BIND_TIMEOUT_MS)
-    });
-    reportBinding(binding, true);
-  } catch (error) {
-    reportConnectFailure(error);
-  }
-}
-function registerGithubCommands(program3, dependencies = defaultDependencies3) {
-  const github = program3.command("github").description("Manage GitHub repository bindings");
-  github.command("connect").description("Install or reuse the Primitive GitHub App and bind the current GitHub origin").option("--no-browser", "Print the GitHub installation URL without opening a browser").action(async (options, command) => {
-    const globals = command.optsWithGlobals();
-    await performGithubConnect(dependencies, {
-      browser: options.browser && globals.nonInteractive !== true
-    });
-  });
-}
-
 // src/commands/hooks.ts
 import { execFileSync as execFileSync5 } from "child_process";
 import {
@@ -40333,14 +40370,9 @@ function writeOwnHooks() {
     mkdirSync11(PRIM_GIT_HOOKS_DIR, { recursive: true });
   }
   for (const spec of HOOKS) {
-    const path9 = resolve7(PRIM_GIT_HOOKS_DIR, spec.hookName);
-    if (spec.hookName === POST_COMMIT.hookName) {
-      ensurePostCommitHookAtPath(path9, globalHookScript(spec));
-    } else if (spec.hookName === POST_REWRITE.hookName) {
-      writeFileSync8(path9, globalHookScript(spec), { mode: 493 });
-    } else {
-      writeFileSync8(path9, globalHookScript(spec), { mode: 493 });
-    }
+    writeFileSync8(resolve7(PRIM_GIT_HOOKS_DIR, spec.hookName), globalHookScript(spec), {
+      mode: 493
+    });
   }
   for (const name of PASSTHROUGH_HOOKS) {
     writeFileSync8(resolve7(PRIM_GIT_HOOKS_DIR, name), passThroughScript(name), { mode: 493 });
@@ -41408,6 +41440,7 @@ function registerSetupCommand(program3, dependencies = {}) {
     const agent = agentInput;
     const scope = opts.scope;
     const self = process.argv[1];
+    const globals = program3.optsWithGlobals();
     const run = dependencies.run ?? ((args, capture = false) => {
       const r = spawnSync2(process.execPath, [self, ...args], {
         stdio: capture ? ["inherit", "pipe", "ignore"] : "inherit",
@@ -41477,7 +41510,12 @@ function registerSetupCommand(program3, dependencies = {}) {
     const enableStep = setupSteps.find((candidate) => candidate.key === "enable");
     if (enableStep) {
       note(`${enableStep.label} \xB7 installing\u2026`);
-      const { code } = run(enableStep.args);
+      const enableArgs = [
+        ...enableStep.args,
+        ...globals.yes ? ["--yes"] : [],
+        ...globals.nonInteractive ? ["--non-interactive"] : []
+      ];
+      const { code } = run(enableArgs);
       results[enableStep.key] = code === 0 ? "ok" : enableStep.required ? "failed" : "skipped";
     }
     const healthStep = setupSteps.find((candidate) => candidate.key === "health");