@primitive.ai/prim 0.1.0-alpha.74 → 0.1.0-alpha.75

package/dist/index.js

@@ -149,85 +149,22 @@ import { fileURLToPath as fileURLToPath2 } from "url";
 import { Command } from "commander";
 import updateNotifier from "update-notifier";
 
-// src/commands/activation.ts
-async function applyActivation(active) {
-  const root = gitToplevel();
-  if (!root) {
-    process.stderr.write(
-      `[prim] not a git repository \u2014 run \`prim ${active ? "enable" : "disable"}\` inside a repo
-`
-    );
-    process.exit(1);
-  }
-  let phase = active ? "post-commit hook coverage" : "local deactivation";
+// src/lib/confirmation.ts
+function isNonInteractive(globals) {
+  return Boolean(globals.nonInteractive || process.env.CI || process.env.PRIM_NON_INTERACTIVE);
+}
+async function askConfirmation(question, output = process.stdout) {
+  if (!process.stdin.isTTY) return false;
+  const { createInterface } = await import("readline/promises");
+  const rl = createInterface({ input: process.stdin, output });
   try {
-    let binding;
-    let postCommitHook;
-    let postRewriteHook;
-    if (active) {
-      postCommitHook = ensureEffectivePostCommitHook(root).path;
-      try {
-        postRewriteHook = ensureEffectivePostRewriteHook(root).path;
-      } catch (error) {
-        const detail = error instanceof Error ? error.message : String(error);
-        process.stderr.write(`[prim] post-rewrite hook coverage is degraded: ${detail}
-`);
-      }
-      phase = "repository binding";
-      binding = await bindRepository(root);
-      phase = "local activation";
-    }
-    setRepoActive(root, active);
-    await daemonRequest("statusline_invalidate", {}, { timeoutMs: 250 });
-    if (binding?.status === "unbound") {
-      process.stderr.write(`[prim] Prim is enabled locally in ${root}
-`);
-      process.stderr.write(
-        "[prim] repository is not connected to Primitive; Moves still ingest into the team graph without repository-specific file attribution, Conflict Gate verification, or commit correlation\n"
-      );
-      process.stderr.write(
-        `[prim] ask an organization owner or administrator to grant Primitive's GitHub App access to this repository through Primitive's GitHub App onboarding; binding retries automatically at the next agent SessionStart
-`
-      );
-    } else {
-      process.stderr.write(`[prim] prim ${active ? "enabled" : "disabled"} in ${root}
-`);
-    }
-    printJson({
-      active,
-      repo: root,
-      ...binding ? {
-        bindingStatus: binding.status,
-        repositoryFullName: binding.repositoryFullName,
-        ...binding.status === "connected" ? { repoSyncId: binding.repoSyncId } : {}
-      } : {},
-      ...postCommitHook ? { postCommitHook } : {},
-      ...postRewriteHook ? { postRewriteHook } : {}
-    });
-  } catch (err) {
-    const detail = err instanceof Error ? err.message : String(err);
-    process.stderr.write(
-      active ? `[prim] failed to enable prim during ${phase}: ${detail}
-` : `[prim] failed to disable prim: ${detail}
-`
-    );
-    process.exit(1);
+    const answer = await rl.question(`${question} [y/N] `);
+    const normalized = answer.trim().toLowerCase();
+    return normalized === "y" || normalized === "yes";
+  } finally {
+    rl.close();
   }
 }
-function registerActivationCommands(program2) {
-  program2.command("enable").description("Activate prim's hooks in this repo (git config prim.active=true)").action(() => applyActivation(true));
-  program2.command("disable").description("Mute prim's hooks in this repo (git config prim.active=false)").action(() => applyActivation(false));
-}
-
-// src/commands/auth.ts
-import { execFile } from "child_process";
-import { createHash, randomBytes as randomBytes2 } from "crypto";
-import { existsSync, readFileSync } from "fs";
-import { createServer } from "http";
-import { platform } from "os";
-
-// src/auth/api-keys.ts
-import { randomBytes } from "crypto";
 
 // src/generated/cli-http-v1.validators.js
 var import_ucs2length = __toESM(require_ucs2length(), 1);
@@ -9961,7 +9898,113 @@ function isGitHubInstallIntentStatusResponse(value) {
   }
 }
 
+// src/lib/github-install-intent.ts
+var PROTOCOL_VERSION = 1;
+var MODE = "install_intent_v1";
+var START_PATH = "/api/cli/github/install-intents";
+var POLL_REQUEST_TIMEOUT_MS = 1e4;
+var MAX_INTENT_LIFETIME_MS = 15 * 6e4;
+var REPOSITORY_IDENTITY_MIGRATION_REQUIRED = "repository_identity_migration_required";
+function isRepositoryIdentityMigrationRequiredStatus(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return false;
+  }
+  const record2 = value;
+  if (record2.failureCode !== REPOSITORY_IDENTITY_MIGRATION_REQUIRED) {
+    return false;
+  }
+  return isGitHubInstallIntentStatusResponse({
+    ...record2,
+    failureCode: "proof_commit_failed"
+  });
+}
+function parseGitHubInstallIntentStart(value, now = Date.now()) {
+  if (!isGitHubInstallIntentStartResponse(value) || value.expiresAt <= now || value.expiresAt - now > MAX_INTENT_LIFETIME_MS) {
+    return null;
+  }
+  return value;
+}
+function parseGitHubInstallIntentStatus(value, expectedExpiresAt) {
+  if (isGitHubInstallIntentStatusResponse(value)) {
+    return value.expiresAt === expectedExpiresAt ? value : null;
+  }
+  if (!isRepositoryIdentityMigrationRequiredStatus(value) || value.expiresAt !== expectedExpiresAt) {
+    return null;
+  }
+  return value;
+}
+async function createGitHubInstallIntent(client, options = {}) {
+  const { now = Date.now, ...requestOptions } = options;
+  const raw = await client.post(START_PATH, void 0, requestOptions);
+  const parsed = parseGitHubInstallIntentStart(raw, now());
+  if (!parsed) throw new Error("server returned an invalid GitHub install-intent response");
+  return parsed;
+}
+function defaultSleep(milliseconds, signal) {
+  if (signal.aborted) return Promise.reject(signal.reason);
+  return new Promise((resolvePromise, reject) => {
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(signal.reason);
+    };
+    const timer = setTimeout(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolvePromise();
+    }, milliseconds);
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
+function expiredStatus(start) {
+  return {
+    protocolVersion: PROTOCOL_VERSION,
+    mode: MODE,
+    found: true,
+    status: "expired",
+    expiresAt: start.expiresAt,
+    closedAt: start.expiresAt
+  };
+}
+async function pollGitHubInstallIntent(client, start, options = {}) {
+  const now = options.now ?? Date.now;
+  const sleep2 = options.sleep ?? defaultSleep;
+  const signal = options.signal ?? new AbortController().signal;
+  const path = `${START_PATH}/${encodeURIComponent(start.intentId)}`;
+  while (true) {
+    if (signal.aborted) throw signal.reason;
+    const remainingBeforeSleep = start.expiresAt - now();
+    if (remainingBeforeSleep <= 0) return expiredStatus(start);
+    await sleep2(Math.min(start.pollAfterMs, remainingBeforeSleep), signal);
+    if (signal.aborted) throw signal.reason;
+    const remainingBeforeRequest = start.expiresAt - now();
+    if (remainingBeforeRequest <= 0) return expiredStatus(start);
+    let raw;
+    try {
+      raw = await client.get(path, {
+        signal: AbortSignal.any([
+          signal,
+          AbortSignal.timeout(Math.min(POLL_REQUEST_TIMEOUT_MS, remainingBeforeRequest))
+        ])
+      });
+    } catch (error) {
+      if (signal.aborted) throw error;
+      if (now() >= start.expiresAt) return expiredStatus(start);
+      throw error;
+    }
+    const status = parseGitHubInstallIntentStatus(raw, start.expiresAt);
+    if (!status) throw new Error("server returned an invalid GitHub install-intent status");
+    if (status.status !== "pending" && status.status !== "claimed") return status;
+  }
+}
+
+// src/commands/auth.ts
+import { execFile } from "child_process";
+import { createHash, randomBytes as randomBytes2 } from "crypto";
+import { existsSync, readFileSync } from "fs";
+import { createServer } from "http";
+import { platform } from "os";
+
 // src/auth/api-keys.ts
+import { randomBytes } from "crypto";
 var USER_API_KEY_TIMEOUT_MS = 1e4;
 var USER_API_KEY_EXIT = {
   ok: 0,
@@ -10850,71 +10893,296 @@ async function exchangeCode(siteUrl, code, codeVerifier, redirectUri) {
   };
 }
 
-// src/commands/claude-install.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
-import { homedir } from "os";
-import { join as join2 } from "path";
-
-// src/lib/hook-runtime.ts
-import { createHash as createHash2, randomBytes as randomBytes3 } from "crypto";
-import {
-  constants,
-  accessSync,
-  chmodSync,
-  copyFileSync,
-  existsSync as existsSync2,
-  lstatSync,
-  mkdirSync,
-  mkdtempSync,
-  readFileSync as readFileSync2,
-  readdirSync,
-  realpathSync,
-  renameSync,
-  rmSync,
-  statSync,
-  utimesSync,
-  writeFileSync
-} from "fs";
-import { dirname, isAbsolute, join, resolve } from "path";
-var HOOK_RUNTIME_SCHEMA_VERSION = 1;
-var DIRECTORY_MODE = 448;
-var DATA_FILE_MODE = 384;
-var LAUNCHER_MODE = 448;
-var RELEASE_PREFIX = "release-";
-var RELEASE_NAME_RE = /^release-[0-9a-f]{64}$/u;
-var MAX_MANIFEST_BYTES = 64 * 1024;
-var MAX_RELEASES = 8;
-var MAX_RELEASE_DELETIONS_PER_STAGE = 8;
-var RETAIN_PREDECESSORS = 2;
-var RELEASE_GRACE_MS = 10 * 60 * 1e3;
-var HOOK_RUNTIME_ENTRIES = {
-  // SessionStart self-healing resolves this exact CLI entry to run
-  // `daemon ensure`; it must travel with the immutable hook release.
-  prim: "dist/index.js",
-  "prim-hook": "dist/hooks/prim-hook.js",
-  "prim-pre-commit": "dist/hooks/pre-commit.js",
-  "prim-post-commit": "dist/hooks/post-commit.js",
-  "prim-post-rewrite": "dist/hooks/post-rewrite.js",
-  "prim-pre-tool-use": "dist/hooks/pre-tool-use.js",
-  "prim-post-tool-use": "dist/hooks/post-tool-use.js",
-  "prim-session-start": "dist/hooks/session-start.js",
-  "prim-session-end": "dist/hooks/session-end.js",
-  "prim-daemon-server": "dist/daemon/server.js",
-  "prim-statusline": "dist/statusline-main.js"
-};
-var SOURCE_ENTRIES = Object.fromEntries(
-  Object.entries(HOOK_RUNTIME_ENTRIES).map(([bin, target]) => [
-    bin,
-    target.replace(/^dist\//u, "")
-  ])
-);
-function hookRuntimePaths(options = {}) {
-  const env = options.env ?? process.env;
-  const configDir = primConfigDirectory({
-    ...options,
-    env,
-    homeDir: options.homeDir ?? env.HOME ?? ""
-  });
+// src/commands/github.ts
+var BIND_TIMEOUT_MS = 1e4;
+var START_TIMEOUT_MS = 1e4;
+var EXIT_OK2 = 0;
+var EXIT_FAILURE = 1;
+var EXIT_UNBOUND = 2;
+var defaultDependencies2 = {
+  cwd: () => process.cwd(),
+  gitToplevel,
+  bindRepositoryWithClient,
+  getPinnedClient,
+  createInstallIntent: createGitHubInstallIntent,
+  pollInstallIntent: pollGitHubInstallIntent,
+  openBrowser,
+  now: Date.now
+};
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function reportConnectFailure(error) {
+  const message = errorMessage(error);
+  const human = boundedHealthError(message) ?? "unknown error";
+  process.stderr.write(`[prim] github connect failed: ${human}
+`);
+  printJson({
+    status: "error",
+    error: message,
+    ...error instanceof HttpError ? { httpStatus: error.status } : {}
+  });
+  process.exitCode = EXIT_FAILURE;
+}
+function reportBinding(binding, installAttempted = false) {
+  if (binding.status === "connected") {
+    process.stderr.write(
+      `[prim] repository binding connected for GitHub origin ${binding.repositoryFullName}
+`
+    );
+    printJson(binding);
+    process.exitCode = EXIT_OK2;
+    return;
+  }
+  process.stderr.write(
+    installAttempted ? `[prim] GitHub installation completed, but ${binding.repositoryFullName} was not granted admin access; repository binding remains unbound
+` : `[prim] repository binding unbound for GitHub origin ${binding.repositoryFullName}; starting GitHub App installation
+`
+  );
+  printJson(binding);
+  process.exitCode = EXIT_UNBOUND;
+}
+function terminalInstallError(status) {
+  if (status.status === "failed_terminal") {
+    return new Error(`GitHub installation failed: ${status.failureCode}`);
+  }
+  return new Error(`GitHub installation ${status.status}`);
+}
+async function completeInstallIntent(client, start, dependencies, browser) {
+  process.stderr.write(`[prim] complete GitHub App installation at:
+${start.browserUrl}
+`);
+  if (browser) dependencies.openBrowser(start.browserUrl);
+  return dependencies.pollInstallIntent(client, start, {
+    now: dependencies.now
+  });
+}
+async function runGithubConnect(dependencies = defaultDependencies2, options = {}) {
+  const root = options.root ?? dependencies.gitToplevel(dependencies.cwd());
+  if (!root) return { kind: "not-a-repo" };
+  try {
+    const client = await dependencies.getPinnedClient({
+      signal: AbortSignal.timeout(BIND_TIMEOUT_MS)
+    });
+    const existing = await dependencies.bindRepositoryWithClient(root, client, {
+      signal: AbortSignal.timeout(BIND_TIMEOUT_MS)
+    });
+    if (existing.status === "connected") {
+      return { kind: "connected", binding: existing };
+    }
+    const start = await dependencies.createInstallIntent(client, {
+      signal: AbortSignal.timeout(START_TIMEOUT_MS),
+      now: dependencies.now
+    });
+    const status = await completeInstallIntent(
+      client,
+      start,
+      dependencies,
+      options.browser ?? true
+    );
+    if (status.status !== "consumed") throw terminalInstallError(status);
+    process.stderr.write(
+      `[prim] GitHub installation verified: ${status.adminRepositoryCount} admin repositories (${status.repositoryCount} total)
+`
+    );
+    const binding = await dependencies.bindRepositoryWithClient(root, client, {
+      signal: AbortSignal.timeout(BIND_TIMEOUT_MS)
+    });
+    return binding.status === "connected" ? { kind: "connected", binding } : { kind: "unbound", binding, installAttempted: true };
+  } catch (error) {
+    return { kind: "error", error };
+  }
+}
+async function performGithubConnect(dependencies = defaultDependencies2, options = {}) {
+  const outcome = await runGithubConnect(dependencies, options);
+  switch (outcome.kind) {
+    case "not-a-repo":
+      reportConnectFailure(
+        new Error("not a git repository \u2014 run `prim github connect` inside a GitHub repository")
+      );
+      return;
+    case "error":
+      reportConnectFailure(outcome.error);
+      return;
+    case "connected":
+      reportBinding(outcome.binding);
+      return;
+    case "unbound":
+      reportBinding(outcome.binding, outcome.installAttempted);
+      return;
+  }
+}
+function registerGithubCommands(program2, dependencies = defaultDependencies2) {
+  const github = program2.command("github").description("Manage GitHub repository bindings");
+  github.command("connect").description("Install or reuse the Primitive GitHub App and bind the current GitHub origin").option("--no-browser", "Print the GitHub installation URL without opening a browser").action(async (options, command) => {
+    const globals = command.optsWithGlobals();
+    await performGithubConnect(dependencies, {
+      browser: options.browser && globals.nonInteractive !== true
+    });
+  });
+}
+
+// src/commands/activation.ts
+var CONNECT_PROMPT = "[prim] Connect this repository to Primitive via the GitHub App now?";
+async function maybeConnectRepository(root, globals) {
+  if (isNonInteractive(globals)) return void 0;
+  const approved = Boolean(globals.yes) || await askConfirmation(CONNECT_PROMPT, process.stderr);
+  if (!approved) return void 0;
+  const outcome = await runGithubConnect(void 0, { root, browser: true });
+  if (outcome.kind === "connected") {
+    process.stderr.write(
+      `[prim] repository binding connected for GitHub origin ${outcome.binding.repositoryFullName}
+`
+    );
+    return outcome.binding;
+  }
+  if (outcome.kind === "error") {
+    const detail = outcome.error instanceof Error ? outcome.error.message : String(outcome.error);
+    process.stderr.write(`[prim] connect could not complete: ${detail}
+`);
+  }
+  return void 0;
+}
+async function applyActivation(active, globals = {}) {
+  const root = gitToplevel();
+  if (!root) {
+    process.stderr.write(
+      `[prim] not a git repository \u2014 run \`prim ${active ? "enable" : "disable"}\` inside a repo
+`
+    );
+    process.exit(1);
+  }
+  let phase = active ? "post-commit hook coverage" : "local deactivation";
+  try {
+    let binding;
+    let postCommitHook;
+    let postRewriteHook;
+    if (active) {
+      postCommitHook = ensureEffectivePostCommitHook(root).path;
+      try {
+        postRewriteHook = ensureEffectivePostRewriteHook(root).path;
+      } catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        process.stderr.write(`[prim] post-rewrite hook coverage is degraded: ${detail}
+`);
+      }
+      phase = "repository binding";
+      binding = await bindRepository(root);
+      phase = "local activation";
+    }
+    setRepoActive(root, active);
+    if (active && binding?.status === "unbound") {
+      const connected = await maybeConnectRepository(root, globals);
+      if (connected) binding = connected;
+    }
+    await daemonRequest("statusline_invalidate", {}, { timeoutMs: 250 });
+    if (binding?.status === "unbound") {
+      process.stderr.write(`[prim] Prim is enabled locally in ${root}
+`);
+      process.stderr.write(
+        "[prim] repository is not connected to Primitive; Moves still ingest into the team graph without repository-specific file attribution, Conflict Gate verification, or commit correlation\n"
+      );
+      process.stderr.write(
+        `[prim] ask an organization owner or administrator to grant Primitive's GitHub App access to this repository through Primitive's GitHub App onboarding; binding retries automatically at the next agent SessionStart
+`
+      );
+    } else {
+      process.stderr.write(`[prim] prim ${active ? "enabled" : "disabled"} in ${root}
+`);
+    }
+    printJson({
+      active,
+      repo: root,
+      ...binding ? {
+        bindingStatus: binding.status,
+        repositoryFullName: binding.repositoryFullName,
+        ...binding.status === "connected" ? { repoSyncId: binding.repoSyncId } : {}
+      } : {},
+      ...postCommitHook ? { postCommitHook } : {},
+      ...postRewriteHook ? { postRewriteHook } : {}
+    });
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    process.stderr.write(
+      active ? `[prim] failed to enable prim during ${phase}: ${detail}
+` : `[prim] failed to disable prim: ${detail}
+`
+    );
+    process.exit(1);
+  }
+}
+function registerActivationCommands(program2) {
+  program2.command("enable").description("Activate prim's hooks in this repo (git config prim.active=true)").action((_opts, command) => applyActivation(true, command.optsWithGlobals()));
+  program2.command("disable").description("Mute prim's hooks in this repo (git config prim.active=false)").action(
+    (_opts, command) => applyActivation(false, command.optsWithGlobals())
+  );
+}
+
+// src/commands/claude-install.ts
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { homedir } from "os";
+import { join as join2 } from "path";
+
+// src/lib/hook-runtime.ts
+import { createHash as createHash2, randomBytes as randomBytes3 } from "crypto";
+import {
+  constants,
+  accessSync,
+  chmodSync,
+  copyFileSync,
+  existsSync as existsSync2,
+  lstatSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync as readFileSync2,
+  readdirSync,
+  realpathSync,
+  renameSync,
+  rmSync,
+  statSync,
+  utimesSync,
+  writeFileSync
+} from "fs";
+import { dirname, isAbsolute, join, resolve } from "path";
+var HOOK_RUNTIME_SCHEMA_VERSION = 1;
+var DIRECTORY_MODE = 448;
+var DATA_FILE_MODE = 384;
+var LAUNCHER_MODE = 448;
+var RELEASE_PREFIX = "release-";
+var RELEASE_NAME_RE = /^release-[0-9a-f]{64}$/u;
+var MAX_MANIFEST_BYTES = 64 * 1024;
+var MAX_RELEASES = 8;
+var MAX_RELEASE_DELETIONS_PER_STAGE = 8;
+var RETAIN_PREDECESSORS = 2;
+var RELEASE_GRACE_MS = 10 * 60 * 1e3;
+var HOOK_RUNTIME_ENTRIES = {
+  // SessionStart self-healing resolves this exact CLI entry to run
+  // `daemon ensure`; it must travel with the immutable hook release.
+  prim: "dist/index.js",
+  "prim-hook": "dist/hooks/prim-hook.js",
+  "prim-pre-commit": "dist/hooks/pre-commit.js",
+  "prim-post-commit": "dist/hooks/post-commit.js",
+  "prim-post-rewrite": "dist/hooks/post-rewrite.js",
+  "prim-pre-tool-use": "dist/hooks/pre-tool-use.js",
+  "prim-post-tool-use": "dist/hooks/post-tool-use.js",
+  "prim-session-start": "dist/hooks/session-start.js",
+  "prim-session-end": "dist/hooks/session-end.js",
+  "prim-daemon-server": "dist/daemon/server.js",
+  "prim-statusline": "dist/statusline-main.js"
+};
+var SOURCE_ENTRIES = Object.fromEntries(
+  Object.entries(HOOK_RUNTIME_ENTRIES).map(([bin, target]) => [
+    bin,
+    target.replace(/^dist\//u, "")
+  ])
+);
+function hookRuntimePaths(options = {}) {
+  const env = options.env ?? process.env;
+  const configDir = primConfigDirectory({
+    ...options,
+    env,
+    homeDir: options.homeDir ?? env.HOME ?? ""
+  });
   const runtimeDir = join(configDir, "hook-runtime");
   return {
     configDir,
@@ -12652,7 +12920,7 @@ function atomicWrite2(path, content, mode, validate) {
   }
   return true;
 }
-function defaultSleep(ms) {
+function defaultSleep2(ms) {
   return new Promise((resolvePromise) => setTimeout(resolvePromise, ms));
 }
 function validatePlist(path, timeoutMs2) {
@@ -12971,7 +13239,7 @@ async function ensureMacDaemonLocked(options) {
     PLIST_FILE_MODE,
     options.validatePlist ?? validatePlist
   );
-  const sleep2 = options.sleep ?? defaultSleep;
+  const sleep2 = options.sleep ?? defaultSleep2;
   const nowMs = options.nowMs ?? performance.now.bind(performance);
   const deadlineMs = nowMs() + TRANSITION_TIMEOUT_MS;
   const inspect = options.inspectDaemon ?? inspectDaemon;
@@ -13025,7 +13293,7 @@ async function bootoutMacDaemon(options = {}) {
 async function bootoutMacDaemonLocked(options) {
   const runner = options.runner ?? runLaunchctl;
   const inspect = options.inspectDaemon ?? inspectDaemon;
-  const sleep2 = options.sleep ?? defaultSleep;
+  const sleep2 = options.sleep ?? defaultSleep2;
   const nowMs = options.nowMs ?? performance.now.bind(performance);
   const deadlineMs = nowMs() + TRANSITION_TIMEOUT_MS;
   const paths = launchdPaths(options);
@@ -13095,7 +13363,7 @@ var READY_POLL_MS2 = 100;
 var READY_PROBE_TIMEOUT_MS2 = 250;
 var HEALTHY_TIMEOUT_MS = 3e4;
 var HEALTHY_POLL_MS = 250;
-var EXIT_OK2 = 0;
+var EXIT_OK3 = 0;
 var EXIT_NOT_RUNNING = 2;
 var EXIT_BOOTING = 3;
 function formatDaemonLifecycleMessage(message, decisionIngestion) {
@@ -13476,7 +13744,7 @@ function classifyStatus(pidAlive, responding, snapshot, pid) {
     };
   }
   if (!snapshot) {
-    return { json: { running: true, responding: true }, exitCode: EXIT_OK2 };
+    return { json: { running: true, responding: true }, exitCode: EXIT_OK3 };
   }
   if (snapshot.healthy === false) {
     return {
@@ -13484,7 +13752,7 @@ function classifyStatus(pidAlive, responding, snapshot, pid) {
       exitCode: EXIT_BOOTING
     };
   }
-  return { json: { running: true, responding: true, ...snapshot }, exitCode: EXIT_OK2 };
+  return { json: { running: true, responding: true, ...snapshot }, exitCode: EXIT_OK3 };
 }
 function classifyLaunchdStatus(service, responding, snapshot, disabled) {
   if (!service) {
@@ -13582,7 +13850,7 @@ function classifyLaunchdStatus(service, responding, snapshot, disabled) {
       disabled,
       ...snapshot
     },
-    exitCode: EXIT_OK2
+    exitCode: EXIT_OK3
   };
 }
 function formatDaemonSnapshotMessage(snapshot, supervised, decisionIngestion, bindingState) {
@@ -13632,7 +13900,7 @@ async function detachedDaemonStatus() {
     writeLiveSnapshot(snapshot);
   }
   console.log(JSON.stringify(json, null, 2));
-  if (exitCode !== EXIT_OK2 && !process.exitCode) {
+  if (exitCode !== EXIT_OK3 && !process.exitCode) {
     process.exitCode = exitCode;
   }
 }
@@ -13682,7 +13950,7 @@ async function macDaemonStatus() {
     writeLiveSnapshot(snapshot, true);
   }
   console.log(JSON.stringify(json, null, 2));
-  if (exitCode !== EXIT_OK2 && !process.exitCode) process.exitCode = exitCode;
+  if (exitCode !== EXIT_OK3 && !process.exitCode) process.exitCode = exitCode;
 }
 async function daemonStatus() {
   if (process.platform === "darwin") {
@@ -14278,7 +14546,7 @@ var DECISION_LIFECYCLE_EXIT = {
   server: 3,
   notFound: 4
 };
-var defaultDependencies2 = {
+var defaultDependencies3 = {
   getClient,
   signal: () => AbortSignal.timeout(DECISION_LIFECYCLE_TIMEOUT_MS),
   writeStdout: (value) => console.log(value),
@@ -14491,19 +14759,19 @@ async function executeLifecycle(operation, request, dependencies) {
     return writeFailure2(operation, classifyError2(error), dependencies);
   }
 }
-function publishDecision(id, dependencies = defaultDependencies2) {
+function publishDecision(id, dependencies = defaultDependencies3) {
   const request = { id };
   return executeLifecycle("publish", request, dependencies);
 }
-function restoreDecision(id, dependencies = defaultDependencies2) {
+function restoreDecision(id, dependencies = defaultDependencies3) {
   const request = { id };
   return executeLifecycle("restore", request, dependencies);
 }
-function ratifyDecision(id, dependencies = defaultDependencies2) {
+function ratifyDecision(id, dependencies = defaultDependencies3) {
   const request = { id };
   return executeLifecycle("ratify", request, dependencies);
 }
-function supersedeDecision(id, by, dependencies = defaultDependencies2) {
+function supersedeDecision(id, by, dependencies = defaultDependencies3) {
   const request = { id, by };
   return executeLifecycle("supersede", request, dependencies);
 }
@@ -15254,26 +15522,9 @@ function formatShowJson(result) {
   return JSON.stringify(result, null, 2);
 }
 
-// src/lib/confirmation.ts
-function isNonInteractive(globals) {
-  return Boolean(globals.nonInteractive || process.env.CI || process.env.PRIM_NON_INTERACTIVE);
-}
-async function askConfirmation(question, output = process.stdout) {
-  if (!process.stdin.isTTY) return false;
-  const { createInterface } = await import("readline/promises");
-  const rl = createInterface({ input: process.stdin, output });
-  try {
-    const answer = await rl.question(`${question} [y/N] `);
-    const normalized = answer.trim().toLowerCase();
-    return normalized === "y" || normalized === "yes";
-  } finally {
-    rl.close();
-  }
-}
-
 // src/commands/decisions.ts
 var EXIT_NOT_FOUND = 4;
-var EXIT_FAILURE = 1;
+var EXIT_FAILURE2 = 1;
 var EXIT_USAGE = 2;
 function handleRepairCommandError(error) {
   if (error instanceof RepairProposalNotFoundError) {
@@ -15290,12 +15541,12 @@ function handleRepairCommandError(error) {
     console.error(
       `[prim] ${error instanceof RepairAuthorizationError ? error.message : "Not authorized to review commit repairs; active organization membership and current repository authorization are required"}`
     );
-    process.exitCode = EXIT_FAILURE;
+    process.exitCode = EXIT_FAILURE2;
     return true;
   }
   if (error instanceof RepairEndpointVersionError || error instanceof RepairListContractError) {
     console.error(`[prim] ${error.message}`);
-    process.exitCode = EXIT_FAILURE;
+    process.exitCode = EXIT_FAILURE2;
     return true;
   }
   return false;
@@ -16927,220 +17178,6 @@ function registerDoctorCommands(program2) {
   });
 }
 
-// src/lib/github-install-intent.ts
-var PROTOCOL_VERSION = 1;
-var MODE = "install_intent_v1";
-var START_PATH = "/api/cli/github/install-intents";
-var POLL_REQUEST_TIMEOUT_MS = 1e4;
-var MAX_INTENT_LIFETIME_MS = 15 * 6e4;
-var REPOSITORY_IDENTITY_MIGRATION_REQUIRED = "repository_identity_migration_required";
-function isRepositoryIdentityMigrationRequiredStatus(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    return false;
-  }
-  const record2 = value;
-  if (record2.failureCode !== REPOSITORY_IDENTITY_MIGRATION_REQUIRED) {
-    return false;
-  }
-  return isGitHubInstallIntentStatusResponse({
-    ...record2,
-    failureCode: "proof_commit_failed"
-  });
-}
-function parseGitHubInstallIntentStart(value, now = Date.now()) {
-  if (!isGitHubInstallIntentStartResponse(value) || value.expiresAt <= now || value.expiresAt - now > MAX_INTENT_LIFETIME_MS) {
-    return null;
-  }
-  return value;
-}
-function parseGitHubInstallIntentStatus(value, expectedExpiresAt) {
-  if (isGitHubInstallIntentStatusResponse(value)) {
-    return value.expiresAt === expectedExpiresAt ? value : null;
-  }
-  if (!isRepositoryIdentityMigrationRequiredStatus(value) || value.expiresAt !== expectedExpiresAt) {
-    return null;
-  }
-  return value;
-}
-async function createGitHubInstallIntent(client, options = {}) {
-  const { now = Date.now, ...requestOptions } = options;
-  const raw = await client.post(START_PATH, void 0, requestOptions);
-  const parsed = parseGitHubInstallIntentStart(raw, now());
-  if (!parsed) throw new Error("server returned an invalid GitHub install-intent response");
-  return parsed;
-}
-function defaultSleep2(milliseconds, signal) {
-  if (signal.aborted) return Promise.reject(signal.reason);
-  return new Promise((resolvePromise, reject) => {
-    const onAbort = () => {
-      clearTimeout(timer);
-      reject(signal.reason);
-    };
-    const timer = setTimeout(() => {
-      signal.removeEventListener("abort", onAbort);
-      resolvePromise();
-    }, milliseconds);
-    signal.addEventListener("abort", onAbort, { once: true });
-  });
-}
-function expiredStatus(start) {
-  return {
-    protocolVersion: PROTOCOL_VERSION,
-    mode: MODE,
-    found: true,
-    status: "expired",
-    expiresAt: start.expiresAt,
-    closedAt: start.expiresAt
-  };
-}
-async function pollGitHubInstallIntent(client, start, options = {}) {
-  const now = options.now ?? Date.now;
-  const sleep2 = options.sleep ?? defaultSleep2;
-  const signal = options.signal ?? new AbortController().signal;
-  const path = `${START_PATH}/${encodeURIComponent(start.intentId)}`;
-  while (true) {
-    if (signal.aborted) throw signal.reason;
-    const remainingBeforeSleep = start.expiresAt - now();
-    if (remainingBeforeSleep <= 0) return expiredStatus(start);
-    await sleep2(Math.min(start.pollAfterMs, remainingBeforeSleep), signal);
-    if (signal.aborted) throw signal.reason;
-    const remainingBeforeRequest = start.expiresAt - now();
-    if (remainingBeforeRequest <= 0) return expiredStatus(start);
-    let raw;
-    try {
-      raw = await client.get(path, {
-        signal: AbortSignal.any([
-          signal,
-          AbortSignal.timeout(Math.min(POLL_REQUEST_TIMEOUT_MS, remainingBeforeRequest))
-        ])
-      });
-    } catch (error) {
-      if (signal.aborted) throw error;
-      if (now() >= start.expiresAt) return expiredStatus(start);
-      throw error;
-    }
-    const status = parseGitHubInstallIntentStatus(raw, start.expiresAt);
-    if (!status) throw new Error("server returned an invalid GitHub install-intent status");
-    if (status.status !== "pending" && status.status !== "claimed") return status;
-  }
-}
-
-// src/commands/github.ts
-var BIND_TIMEOUT_MS = 1e4;
-var START_TIMEOUT_MS = 1e4;
-var EXIT_OK3 = 0;
-var EXIT_FAILURE2 = 1;
-var EXIT_UNBOUND = 2;
-var defaultDependencies3 = {
-  cwd: () => process.cwd(),
-  gitToplevel,
-  bindRepositoryWithClient,
-  getPinnedClient,
-  createInstallIntent: createGitHubInstallIntent,
-  pollInstallIntent: pollGitHubInstallIntent,
-  openBrowser,
-  now: Date.now
-};
-function errorMessage(error) {
-  return error instanceof Error ? error.message : String(error);
-}
-function reportConnectFailure(error) {
-  const message = errorMessage(error);
-  const human = boundedHealthError(message) ?? "unknown error";
-  process.stderr.write(`[prim] github connect failed: ${human}
-`);
-  printJson({
-    status: "error",
-    error: message,
-    ...error instanceof HttpError ? { httpStatus: error.status } : {}
-  });
-  process.exitCode = EXIT_FAILURE2;
-}
-function reportBinding(binding, installAttempted = false) {
-  if (binding.status === "connected") {
-    process.stderr.write(
-      `[prim] repository binding connected for GitHub origin ${binding.repositoryFullName}
-`
-    );
-    printJson(binding);
-    process.exitCode = EXIT_OK3;
-    return;
-  }
-  process.stderr.write(
-    installAttempted ? `[prim] GitHub installation completed, but ${binding.repositoryFullName} was not granted admin access; repository binding remains unbound
-` : `[prim] repository binding unbound for GitHub origin ${binding.repositoryFullName}; starting GitHub App installation
-`
-  );
-  printJson(binding);
-  process.exitCode = EXIT_UNBOUND;
-}
-function terminalInstallError(status) {
-  if (status.status === "failed_terminal") {
-    return new Error(`GitHub installation failed: ${status.failureCode}`);
-  }
-  return new Error(`GitHub installation ${status.status}`);
-}
-async function completeInstallIntent(client, start, dependencies, browser) {
-  process.stderr.write(`[prim] complete GitHub App installation at:
-${start.browserUrl}
-`);
-  if (browser) dependencies.openBrowser(start.browserUrl);
-  return dependencies.pollInstallIntent(client, start, {
-    now: dependencies.now
-  });
-}
-async function performGithubConnect(dependencies = defaultDependencies3, options = {}) {
-  const root = dependencies.gitToplevel(dependencies.cwd());
-  if (!root) {
-    reportConnectFailure(
-      new Error("not a git repository \u2014 run `prim github connect` inside a GitHub repository")
-    );
-    return;
-  }
-  try {
-    const client = await dependencies.getPinnedClient({
-      signal: AbortSignal.timeout(BIND_TIMEOUT_MS)
-    });
-    const existing = await dependencies.bindRepositoryWithClient(root, client, {
-      signal: AbortSignal.timeout(BIND_TIMEOUT_MS)
-    });
-    if (existing.status === "connected") {
-      reportBinding(existing);
-      return;
-    }
-    const start = await dependencies.createInstallIntent(client, {
-      signal: AbortSignal.timeout(START_TIMEOUT_MS),
-      now: dependencies.now
-    });
-    const status = await completeInstallIntent(
-      client,
-      start,
-      dependencies,
-      options.browser ?? true
-    );
-    if (status.status !== "consumed") throw terminalInstallError(status);
-    process.stderr.write(
-      `[prim] GitHub installation verified: ${status.adminRepositoryCount} admin repositories (${status.repositoryCount} total)
-`
-    );
-    const binding = await dependencies.bindRepositoryWithClient(root, client, {
-      signal: AbortSignal.timeout(BIND_TIMEOUT_MS)
-    });
-    reportBinding(binding, true);
-  } catch (error) {
-    reportConnectFailure(error);
-  }
-}
-function registerGithubCommands(program2, dependencies = defaultDependencies3) {
-  const github = program2.command("github").description("Manage GitHub repository bindings");
-  github.command("connect").description("Install or reuse the Primitive GitHub App and bind the current GitHub origin").option("--no-browser", "Print the GitHub installation URL without opening a browser").action(async (options, command) => {
-    const globals = command.optsWithGlobals();
-    await performGithubConnect(dependencies, {
-      browser: options.browser && globals.nonInteractive !== true
-    });
-  });
-}
-
 // src/commands/hooks.ts
 import { execFileSync } from "child_process";
 import {
@@ -17459,14 +17496,9 @@ function writeOwnHooks() {
     mkdirSync4(PRIM_GIT_HOOKS_DIR, { recursive: true });
   }
   for (const spec of HOOKS) {
-    const path = resolve3(PRIM_GIT_HOOKS_DIR, spec.hookName);
-    if (spec.hookName === POST_COMMIT.hookName) {
-      ensurePostCommitHookAtPath(path, globalHookScript(spec));
-    } else if (spec.hookName === POST_REWRITE.hookName) {
-      writeFileSync3(path, globalHookScript(spec), { mode: 493 });
-    } else {
-      writeFileSync3(path, globalHookScript(spec), { mode: 493 });
-    }
+    writeFileSync3(resolve3(PRIM_GIT_HOOKS_DIR, spec.hookName), globalHookScript(spec), {
+      mode: 493
+    });
   }
   for (const name of PASSTHROUGH_HOOKS) {
     writeFileSync3(resolve3(PRIM_GIT_HOOKS_DIR, name), passThroughScript(name), { mode: 493 });
@@ -18503,6 +18535,7 @@ function registerSetupCommand(program2, dependencies = {}) {
     const agent = agentInput;
     const scope = opts.scope;
     const self = process.argv[1];
+    const globals = program2.optsWithGlobals();
     const run = dependencies.run ?? ((args, capture = false) => {
       const r = spawnSync2(process.execPath, [self, ...args], {
         stdio: capture ? ["inherit", "pipe", "ignore"] : "inherit",
@@ -18572,7 +18605,12 @@ function registerSetupCommand(program2, dependencies = {}) {
     const enableStep = setupSteps.find((candidate) => candidate.key === "enable");
     if (enableStep) {
       note(`${enableStep.label} \xB7 installing\u2026`);
-      const { code } = run(enableStep.args);
+      const enableArgs = [
+        ...enableStep.args,
+        ...globals.yes ? ["--yes"] : [],
+        ...globals.nonInteractive ? ["--non-interactive"] : []
+      ];
+      const { code } = run(enableArgs);
       results[enableStep.key] = code === 0 ? "ok" : enableStep.required ? "failed" : "skipped";
     }
     const healthStep = setupSteps.find((candidate) => candidate.key === "health");