@primitive.ai/prim 0.1.0-alpha.8 → 0.1.0-alpha.81

package/dist/hook-runtime/hooks/post-rewrite.js

@@ -0,0 +1,1148 @@
+#!/usr/bin/env node
+
+// src/hooks/post-rewrite.ts
+import { execFileSync as execFileSync4, spawn } from "child_process";
+import {
+  constants as constants3,
+  closeSync as closeSync4,
+  fstatSync as fstatSync2,
+  lstatSync as lstatSync3,
+  openSync as openSync4,
+  readFileSync as readFileSync9,
+  unlinkSync as unlinkSync2
+} from "fs";
+import { basename as basename2, dirname as dirname8, isAbsolute as isAbsolute4, join as join10 } from "path";
+import { fileURLToPath } from "url";
+
+// src/binding.ts
+import { existsSync, readFileSync as readFileSync2 } from "fs";
+import { dirname, join as join3 } from "path";
+
+// src/lib/credentials.ts
+import { createHash } from "crypto";
+import { readFileSync } from "fs";
+import { join as join2 } from "path";
+
+// src/lib/paths.ts
+import { homedir } from "os";
+import { isAbsolute, join, normalize } from "path";
+var UNSAFE_CONFIG_PATH_CHARACTERS = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u;
+function absolutePath(value, variable) {
+  if (value !== void 0 && UNSAFE_CONFIG_PATH_CHARACTERS.test(value)) {
+    throw new Error(`${variable} contains unsafe characters`);
+  }
+  if (!value || value.trim() !== value || !isAbsolute(value)) return;
+  const normalized = normalize(value);
+  return normalized === value ? value : void 0;
+}
+function resolvePrimConfigDirectory(options = {}) {
+  const env = options.env ?? process.env;
+  const explicit = absolutePath(env.PRIM_CONFIG_DIR, "PRIM_CONFIG_DIR");
+  if (explicit) return { path: explicit, source: "explicit" };
+  const xdgConfigHome = absolutePath(env.XDG_CONFIG_HOME, "XDG_CONFIG_HOME");
+  if (xdgConfigHome) return { path: join(xdgConfigHome, "prim"), source: "xdg" };
+  const home = absolutePath(options.homeDir ?? homedir(), "HOME");
+  if (!home) {
+    throw new Error("cannot resolve Primitive config directory: HOME is not an absolute path");
+  }
+  return { path: join(home, ".config", "prim"), source: "default" };
+}
+function primConfigDirectory(options = {}) {
+  return resolvePrimConfigDirectory(options).path;
+}
+
+// src/lib/workos-connect.ts
+var DISCOVERY_MAX_BYTES = 16 * 1024;
+var WORKOS_CONNECT_RESPONSE_MAX_BYTES = 64 * 1024;
+var MAX_DEVICE_LIFETIME_SECONDS = 60 * 60;
+var MAX_TOKEN_LIFETIME_SECONDS = 24 * 60 * 60;
+var MAX_URL_LENGTH = 2048;
+var MAX_CLIENT_ID_LENGTH = 256;
+var CONNECT_CLIENT_ID_PATTERN = /^client_[A-Za-z0-9_-]+$/u;
+var WorkosConnectProtocolError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "WorkosConnectProtocolError";
+    this.code = code;
+  }
+};
+function recordFrom(value, label) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new WorkosConnectProtocolError("invalid_response", `${label} must be an object`);
+  }
+  return value;
+}
+function exactString(value, field, maxLength) {
+  const containsControl = typeof value === "string" && [...value].some((character) => {
+    const code = character.charCodeAt(0);
+    return code <= 31 || code === 127;
+  });
+  if (typeof value !== "string" || value.length === 0 || value.length > maxLength || value.trim() !== value || containsControl) {
+    throw new WorkosConnectProtocolError("invalid_response", `${field} is invalid`);
+  }
+  return value;
+}
+function canonicalIssuer(value) {
+  const issuer = exactString(value, "issuer", MAX_URL_LENGTH);
+  let parsed;
+  try {
+    parsed = new URL(issuer);
+  } catch {
+    throw new WorkosConnectProtocolError("invalid_response", "issuer must be an HTTPS origin");
+  }
+  if (parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash || parsed.origin !== issuer) {
+    throw new WorkosConnectProtocolError("invalid_response", "issuer must be an HTTPS origin");
+  }
+  return issuer;
+}
+function parseWorkosConnectCredentialMetadata(value) {
+  const record = recordFrom(value, "credential metadata");
+  if (record.version !== 1 || record.family !== "workos_connect") {
+    throw new WorkosConnectProtocolError("invalid_metadata", "credential metadata is invalid");
+  }
+  const issuer = canonicalIssuer(record.issuer);
+  const clientId = exactString(record.clientId, "clientId", MAX_CLIENT_ID_LENGTH);
+  const accessTokenHash = exactString(record.accessTokenHash, "accessTokenHash", 64);
+  const refreshTokenHash = exactString(record.refreshTokenHash, "refreshTokenHash", 64);
+  if (!CONNECT_CLIENT_ID_PATTERN.test(clientId)) {
+    throw new WorkosConnectProtocolError("invalid_metadata", "credential clientId is invalid");
+  }
+  if (!/^[a-f0-9]{64}$/u.test(accessTokenHash)) {
+    throw new WorkosConnectProtocolError(
+      "invalid_metadata",
+      "credential accessTokenHash is invalid"
+    );
+  }
+  if (!/^[a-f0-9]{64}$/u.test(refreshTokenHash)) {
+    throw new WorkosConnectProtocolError(
+      "invalid_metadata",
+      "credential refreshTokenHash is invalid"
+    );
+  }
+  return {
+    version: 1,
+    family: "workos_connect",
+    issuer,
+    clientId,
+    accessTokenHash,
+    refreshTokenHash
+  };
+}
+
+// src/lib/credentials.ts
+var CONFIG_DIRECTORY = primConfigDirectory();
+var TOKEN_FILE_PATH = join2(CONFIG_DIRECTORY, "token");
+var REFRESH_TOKEN_PATH = join2(CONFIG_DIRECTORY, "refresh_token");
+var TOKEN_EXPIRES_PATH = join2(CONFIG_DIRECTORY, "token_expires_at");
+var TERMINAL_REFRESH_PATH = join2(CONFIG_DIRECTORY, "refresh_terminal");
+var CREDENTIAL_METADATA_PATH = join2(CONFIG_DIRECTORY, "credential_metadata.json");
+var CREDENTIAL_FAMILY_PATH = join2(CONFIG_DIRECTORY, "credential_family.json");
+var CREDENTIAL_MIGRATION_PATH = join2(CONFIG_DIRECTORY, "credential_migration.json");
+var CREDENTIAL_LOCK_PATH = join2(CONFIG_DIRECTORY, "credentials.lock");
+var MAX_CREDENTIAL_METADATA_BYTES = 4096;
+var CREDENTIAL_MIGRATION_VERSION = 1;
+var CREDENTIAL_MIGRATION_STATE = "family_bound";
+function readTrimmed(path) {
+  try {
+    const value = readFileSync(path, "utf8").trim();
+    return value || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function resolveAuthCredential(options = {}) {
+  const envToken = (options.env ?? process.env).PRIM_TOKEN?.trim();
+  if (envToken) return { token: envToken, source: "environment" };
+  const stored = readTrimmed(options.tokenFilePath ?? TOKEN_FILE_PATH);
+  if (!stored) return void 0;
+  const metadata = readStoredCredentialMetadata(
+    options.metadataPath ?? CREDENTIAL_METADATA_PATH,
+    options.familyPath ?? CREDENTIAL_FAMILY_PATH,
+    options.migrationPath ?? CREDENTIAL_MIGRATION_PATH
+  );
+  if (metadata.state === "legacy_broker") {
+    if (metadata.metadata) {
+      const refreshToken2 = readTrimmed(options.refreshTokenPath ?? REFRESH_TOKEN_PATH);
+      if (!refreshToken2 || metadata.metadata.accessTokenHash !== credentialFingerprint(stored) || metadata.metadata.refreshTokenHash !== credentialFingerprint(refreshToken2)) {
+        return void 0;
+      }
+    }
+    return { token: stored, source: "token_file" };
+  }
+  if (metadata.state === "invalid") return void 0;
+  const refreshToken = readTrimmed(options.refreshTokenPath ?? REFRESH_TOKEN_PATH);
+  if (!refreshToken || metadata.metadata.accessTokenHash !== credentialFingerprint(stored) || metadata.metadata.refreshTokenHash !== credentialFingerprint(refreshToken)) {
+    return void 0;
+  }
+  return { token: stored, source: "token_file" };
+}
+function credentialFingerprint(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+function parseLegacyBrokerCredentialMetadata(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("credential family is invalid");
+  }
+  const record = value;
+  if (record.version !== 1 || record.family !== "legacy_broker" || typeof record.accessTokenHash !== "string" || typeof record.refreshTokenHash !== "string" || !/^[a-f0-9]{64}$/u.test(record.accessTokenHash) || !/^[a-f0-9]{64}$/u.test(record.refreshTokenHash)) {
+    throw new Error("credential family is invalid");
+  }
+  return {
+    version: 1,
+    family: "legacy_broker",
+    accessTokenHash: record.accessTokenHash,
+    refreshTokenHash: record.refreshTokenHash
+  };
+}
+function readBoundedCredentialJson(path) {
+  let raw;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch (error) {
+    return error.code === "ENOENT" ? void 0 : null;
+  }
+  if (Buffer.byteLength(raw, "utf8") > MAX_CREDENTIAL_METADATA_BYTES) return null;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function readCredentialFamily(path) {
+  const parsed = readBoundedCredentialJson(path);
+  if (parsed === void 0) return void 0;
+  if (parsed === null) return { state: "invalid" };
+  try {
+    if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) && parsed.family === "legacy_broker") {
+      return { state: "legacy_broker", metadata: parseLegacyBrokerCredentialMetadata(parsed) };
+    }
+    return {
+      state: "workos_connect",
+      metadata: parseWorkosConnectCredentialMetadata(parsed)
+    };
+  } catch {
+    return { state: "invalid" };
+  }
+}
+function isCredentialMigrationSentinel(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const record = value;
+  const keys = Object.keys(record).sort();
+  return keys.length === 2 && keys[0] === "state" && keys[1] === "version" && record.version === CREDENTIAL_MIGRATION_VERSION && record.state === CREDENTIAL_MIGRATION_STATE;
+}
+function readCredentialMigrationState(path = CREDENTIAL_MIGRATION_PATH) {
+  const parsed = readBoundedCredentialJson(path);
+  if (parsed === void 0) return "absent";
+  return parsed !== null && isCredentialMigrationSentinel(parsed) ? "valid" : "invalid";
+}
+function readStoredCredentialMetadata(metadataPath = CREDENTIAL_METADATA_PATH, familyPath = CREDENTIAL_FAMILY_PATH, migrationPath = CREDENTIAL_MIGRATION_PATH) {
+  const family = readCredentialFamily(familyPath);
+  if (family) return family;
+  const parsed = readBoundedCredentialJson(metadataPath);
+  if (parsed === void 0) {
+    return readCredentialMigrationState(migrationPath) === "absent" ? { state: "legacy_broker" } : { state: "invalid" };
+  }
+  if (parsed === null) return { state: "invalid" };
+  try {
+    return {
+      state: "workos_connect",
+      metadata: parseWorkosConnectCredentialMetadata(parsed)
+    };
+  } catch {
+    return { state: "invalid" };
+  }
+}
+function decodeJwtPayload(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return void 0;
+  try {
+    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    if (payload === null || typeof payload !== "object" || Array.isArray(payload)) return void 0;
+    return payload;
+  } catch {
+    return void 0;
+  }
+}
+function jwtOrganizationId(token) {
+  const orgId = decodeJwtPayload(token)?.org_id;
+  return typeof orgId === "string" && orgId.length > 0 ? orgId : void 0;
+}
+
+// src/binding.ts
+var PRIM_CONFIG_DIR = primConfigDirectory();
+var SESSIONS_DIR = join3(PRIM_CONFIG_DIR, "sessions");
+var WORKSPACE_FILE = ".prim/workspace.json";
+function readJsonSafe(path) {
+  if (!existsSync(path)) {
+    return;
+  }
+  try {
+    return JSON.parse(readFileSync2(path, "utf-8"));
+  } catch {
+    return;
+  }
+}
+function fromSessionMarker(sessionId) {
+  if (!sessionId) {
+    return;
+  }
+  const marker = readJsonSafe(join3(SESSIONS_DIR, `${sessionId}.json`));
+  return marker?.orgId;
+}
+function fromWorkspaceFile(startDir) {
+  let dir = startDir;
+  while (true) {
+    const config = readJsonSafe(join3(dir, WORKSPACE_FILE));
+    if (config?.orgId) {
+      return config.orgId;
+    }
+    const parent = dirname(dir);
+    if (parent === dir) {
+      return;
+    }
+    dir = parent;
+  }
+}
+function fromDefaultOrg(_cwd) {
+  const credential = resolveAuthCredential();
+  return credential ? jwtOrganizationId(credential.token) : void 0;
+}
+function resolveOrg(args) {
+  const fromSession = fromSessionMarker(args.sessionId);
+  if (fromSession) {
+    return { orgId: fromSession, source: "session" };
+  }
+  const fromWorkspace = fromWorkspaceFile(args.cwd);
+  if (fromWorkspace) {
+    return { orgId: fromWorkspace, source: "workspace" };
+  }
+  const fromDefault = fromDefaultOrg(args.cwd);
+  if (fromDefault) {
+    return { orgId: fromDefault, source: "defaultOrg" };
+  }
+  return { orgId: void 0, source: "unbound" };
+}
+
+// src/journal.ts
+import {
+  appendFileSync,
+  closeSync as closeSync2,
+  existsSync as existsSync4,
+  fstatSync,
+  mkdirSync as mkdirSync4,
+  openSync as openSync2,
+  opendirSync,
+  readFileSync as readFileSync5,
+  readSync,
+  readdirSync
+} from "fs";
+import { dirname as dirname5, join as join6 } from "path";
+
+// src/client.ts
+import { createHash as createHash2 } from "crypto";
+import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync4, rmSync as rmSync3 } from "fs";
+import { dirname as dirname4 } from "path";
+
+// src/lib/atomic-file.ts
+import { randomUUID } from "crypto";
+import {
+  constants,
+  closeSync,
+  fchmodSync,
+  fsyncSync,
+  mkdirSync,
+  openSync,
+  renameSync,
+  rmSync,
+  writeFileSync
+} from "fs";
+import { dirname as dirname2 } from "path";
+
+// src/lib/file-lock.ts
+import { randomBytes } from "crypto";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, rmSync as rmSync2, statSync, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname3, join as join4 } from "path";
+var syncSleeper = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
+
+// src/client.ts
+var DEFAULT_API_URL = "https://api.getprimitive.ai";
+function getSiteUrl() {
+  return getSiteUrlForEnvironment(process.env.PRIM_API_URL);
+}
+function getSiteUrlForEnvironment(primApiUrl) {
+  return primApiUrl?.trim() || DEFAULT_API_URL;
+}
+var CLI_MANAGEMENT_RESPONSE_MAX_BYTES = 2 * 1024 * 1024;
+
+// src/journal.ts
+var JOURNAL_DIR = join6(primConfigDirectory(), "moves");
+var UNBOUND_BUCKET = "_unbound";
+var JOURNAL_BASENAME = "journal.ndjson";
+var JOURNAL_STATS_SAMPLE_BYTES = 64 * 1024;
+function envSlug(apiUrl) {
+  const slug = apiUrl.replace(/^https?:\/\//, "").replace(/[^a-zA-Z0-9._-]/g, "_").replace(/^_+|_+$/g, "").toLowerCase();
+  if (slug.length === 0 || slug === "." || slug === "..") {
+    return "default";
+  }
+  return slug;
+}
+function currentEnvDir() {
+  return join6(JOURNAL_DIR, envSlug(getSiteUrl()));
+}
+var DIR_MODE = 448;
+var FILE_MODE = 384;
+var SAFE_BUCKET = /^[A-Za-z0-9_-]+$/;
+var RESERVED_BUCKETS = /* @__PURE__ */ new Set([UNBOUND_BUCKET, "_legacy"]);
+function appendMoveToPath(path, move) {
+  const dir = dirname5(path);
+  if (!existsSync4(dir)) {
+    mkdirSync4(dir, { recursive: true, mode: DIR_MODE });
+  }
+  appendFileSync(path, `${JSON.stringify(move)}
+`, { mode: FILE_MODE });
+}
+function bucketDir(orgId) {
+  const safe = orgId !== void 0 && SAFE_BUCKET.test(orgId) && !RESERVED_BUCKETS.has(orgId);
+  return join6(currentEnvDir(), safe ? orgId : UNBOUND_BUCKET);
+}
+function journalPath(orgId) {
+  return join6(bucketDir(orgId), JOURNAL_BASENAME);
+}
+function appendMove(move, orgId) {
+  appendMoveToPath(journalPath(orgId), move);
+}
+var FLUSHING_PREFIX = `${JOURNAL_BASENAME}.flushing.`;
+
+// src/lib/activation.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import { existsSync as existsSync5, readFileSync as readFileSync6 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join7 } from "path";
+
+// src/lib/git.ts
+import { execFileSync } from "child_process";
+import { createHash as createHash3 } from "crypto";
+import { lstatSync, realpathSync } from "fs";
+import { basename, dirname as dirname6, isAbsolute as isAbsolute2, relative, resolve as resolve2, sep } from "path";
+var GIT_TIMEOUT_MS = 1e3;
+var GITHUB_OWNER_PATTERN = /^(?![A-Za-z0-9-]*--)[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/u;
+var GITHUB_REPOSITORY_PATTERN = /^[A-Za-z0-9._-]{1,100}$/u;
+function gitToplevel(cwd) {
+  try {
+    return execFileSync("git", ["rev-parse", "--show-toplevel"], {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function gitValue(cwd, args) {
+  try {
+    const value = execFileSync("git", args, {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS
+    }).trim();
+    return value || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function githubRepositoryFullName(cwd) {
+  const remote = gitValue(cwd, ["config", "--get", "remote.origin.url"]);
+  if (!remote || [...remote].some((char) => char < " " || char === "\x7F")) return null;
+  const match = /^(?:git@github\.com:([^?#]+)|(?:https|ssh):\/\/(?:[^/@]+@)?github\.com(?::\d+)?\/([^?#]+))$/i.exec(
+    remote
+  );
+  const path = match?.[1] ?? match?.[2];
+  if (!path) return null;
+  const parts = path.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "").split("/");
+  if (parts.length !== 2 || !GITHUB_OWNER_PATTERN.test(parts[0] ?? "") || !GITHUB_REPOSITORY_PATTERN.test(parts[1] ?? "")) {
+    return null;
+  }
+  return `${parts[0]}/${parts[1]}`;
+}
+function normalizeOriginRemote(remote) {
+  const value = remote.trim();
+  if (!value) return void 0;
+  const scp = !value.includes("://") ? /^(?:[^@/\s]+@)?(?<host>[^:/\s]+):(?<path>.+)$/.exec(value)?.groups : void 0;
+  if (scp?.host && scp.path) {
+    const path = scp.path.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "");
+    return path ? `${scp.host.toLowerCase()}/${path}` : void 0;
+  }
+  try {
+    const url = new URL(value);
+    url.username = "";
+    url.password = "";
+    url.search = "";
+    url.hash = "";
+    const path = url.pathname.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "");
+    if (url.host && path) return `${url.host.toLowerCase()}/${path}`;
+    return void 0;
+  } catch {
+    return void 0;
+  }
+}
+function opaqueRepoKey(source, value) {
+  return `repo_v1_${createHash3("sha256").update(`${source}\0${value}`).digest("hex")}`;
+}
+function resolveRepositoryContext(cwd = process.cwd()) {
+  const top = gitToplevel(cwd);
+  if (!top) return null;
+  let repoRoot;
+  try {
+    repoRoot = realpathSync.native(top);
+  } catch {
+    repoRoot = resolve2(top);
+  }
+  const origin = gitValue(repoRoot, ["config", "--get", "remote.origin.url"]);
+  const repoFullName = githubRepositoryFullName(repoRoot) ?? void 0;
+  const normalizedOrigin = origin ? normalizeOriginRemote(origin) : void 0;
+  if (normalizedOrigin) {
+    return {
+      repoRoot,
+      repoKey: opaqueRepoKey("origin", normalizedOrigin),
+      identitySource: "origin",
+      repoFullName
+    };
+  }
+  const roots = gitValue(repoRoot, ["rev-list", "--max-parents=0", "HEAD"])?.split(/\s+/).filter(Boolean).sort();
+  if (roots && roots.length > 0) {
+    return {
+      repoRoot,
+      repoKey: opaqueRepoKey("root_commit", roots.join("\n")),
+      identitySource: "root_commit",
+      repoFullName
+    };
+  }
+  return { repoRoot, repoFullName };
+}
+
+// src/lib/activation.ts
+var PRIM_ACTIVE_KEY = "prim.active";
+var PRIM_REPO_SYNC_ID_KEY = "prim.repoSyncId";
+var PRIM_REPO_SYNC_REPOSITORY_KEY = "prim.repoSyncRepository";
+var GIT_TIMEOUT_MS2 = 1e3;
+var REPO_SYNC_ID_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+var PROJECT_INSTALL_FILES = [".claude/settings.json", ".codex/hooks.json"];
+var PRIM_HOOK_BINS = ["prim-hook", "prim-pre-tool-use", "prim-post-tool-use"];
+function repoActiveFlag(cwd) {
+  try {
+    const value = execFileSync2("git", ["config", "--get", PRIM_ACTIVE_KEY], {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS2
+    }).trim();
+    if (value === "true") return "true";
+    if (value === "false") return "false";
+    return void 0;
+  } catch {
+    return void 0;
+  }
+}
+function isValidRepoSyncId(value) {
+  return typeof value === "string" && REPO_SYNC_ID_RE.test(value);
+}
+function localGitConfigValue(cwd, key) {
+  try {
+    const value = execFileSync2("git", ["config", "--local", "--get", key], {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS2
+    }).trim();
+    return value || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function repoSyncId(cwd) {
+  const value = localGitConfigValue(cwd, PRIM_REPO_SYNC_ID_KEY);
+  if (!isValidRepoSyncId(value)) return void 0;
+  const repositoryFullName = localGitConfigValue(cwd, PRIM_REPO_SYNC_REPOSITORY_KEY);
+  return repositoryFullName === githubRepositoryFullName(cwd) ? value : void 0;
+}
+function hasProjectPrimInstall(cwd) {
+  const root = gitToplevel(cwd);
+  if (root === null || root === homedir2()) return false;
+  for (const rel of PROJECT_INSTALL_FILES) {
+    const path = join7(root, rel);
+    if (existsSync5(path)) {
+      try {
+        const content = readFileSync6(path, "utf-8");
+        if (PRIM_HOOK_BINS.some((bin) => content.includes(bin))) return true;
+      } catch {
+      }
+    }
+  }
+  return false;
+}
+function isRepoActiveForCapture(cwd) {
+  const flag = repoActiveFlag(cwd);
+  if (flag === "true") return true;
+  if (flag === "false") return false;
+  return hasProjectPrimInstall(cwd);
+}
+
+// src/lib/workspace-id.ts
+import { execFileSync as execFileSync3 } from "child_process";
+import { randomUUID as randomUUID2 } from "crypto";
+import {
+  constants as constants2,
+  chmodSync as chmodSync2,
+  closeSync as closeSync3,
+  fchmodSync as fchmodSync2,
+  fsyncSync as fsyncSync2,
+  linkSync,
+  lstatSync as lstatSync2,
+  mkdirSync as mkdirSync5,
+  openSync as openSync3,
+  readFileSync as readFileSync7,
+  statSync as statSync2,
+  unlinkSync,
+  writeFileSync as writeFileSync3
+} from "fs";
+import { dirname as dirname7, isAbsolute as isAbsolute3, join as join8, resolve as resolve3 } from "path";
+var WORKSPACE_ID_RELATIVE_PATH = join8("prim", "workspace-id");
+var MAX_ANCESTORS = 64;
+var MAX_GIT_FILE_BYTES = 4096;
+var MAX_ID_FILE_BYTES = 128;
+var GIT_FALLBACK_TIMEOUT_MS = 250;
+var RACE_READ_ATTEMPTS = 5;
+var RACE_READ_DELAY_MS = 5;
+var CANONICAL_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+var raceDelay = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
+function isCanonicalWorkspaceId(value) {
+  return CANONICAL_UUID.test(value);
+}
+function inspectWorkspaceId(cwd = process.cwd()) {
+  const resolved = resolveWorkspaceIdPath(cwd);
+  if (resolved.status !== "resolved") return resolved;
+  return inspectPath(resolved.path);
+}
+function getOrCreateWorkspaceId(cwd = process.cwd()) {
+  const inspection = inspectWorkspaceId(cwd);
+  if (inspection.status !== "missing") return inspection;
+  return createWorkspaceId(inspection.path);
+}
+function resolveWorkspaceIdPath(cwd) {
+  if (!process.env.GIT_DIR && !process.env.GIT_WORK_TREE) {
+    const fromFilesystem = resolveFromFilesystem(cwd);
+    if (fromFilesystem) return { status: "resolved", path: fromFilesystem };
+  }
+  try {
+    const output = execFileSync3(
+      "git",
+      ["rev-parse", "--is-inside-work-tree", "--git-path", WORKSPACE_ID_RELATIVE_PATH],
+      {
+        cwd,
+        encoding: "utf8",
+        maxBuffer: 4096,
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: GIT_FALLBACK_TIMEOUT_MS,
+        windowsHide: true
+      }
+    );
+    const [insideWorktree, gitPath, ...extra] = output.trim().split(/\r?\n/);
+    if (insideWorktree !== "true" || !gitPath || extra.length > 0 || gitPath.includes("\0")) {
+      return { status: "not_git" };
+    }
+    return {
+      status: "resolved",
+      path: isAbsolute3(gitPath) ? resolve3(gitPath) : resolve3(cwd, gitPath)
+    };
+  } catch (error) {
+    const code = errorCode(error);
+    if (code === "ETIMEDOUT" || code === "EACCES" || code === "EPERM") {
+      return { status: "unavailable", operation: "resolve", errorCode: code };
+    }
+    return { status: "not_git" };
+  }
+}
+function resolveFromFilesystem(cwd) {
+  let current = resolve3(cwd);
+  for (let depth = 0; depth < MAX_ANCESTORS; depth += 1) {
+    const dotGit = join8(current, ".git");
+    try {
+      const stat = lstatSync2(dotGit);
+      if (stat.isDirectory() && isGitDirectory(dotGit)) {
+        return join8(dotGit, WORKSPACE_ID_RELATIVE_PATH);
+      }
+      if (stat.isFile() && stat.size <= MAX_GIT_FILE_BYTES) {
+        const contents = readFileSync7(dotGit, "utf8");
+        const match = /^gitdir: (.+?)(?:\r?\n)?$/.exec(contents);
+        if (match?.[1]) {
+          const gitDirectory = isAbsolute3(match[1]) ? resolve3(match[1]) : resolve3(current, match[1]);
+          if (isGitDirectory(gitDirectory)) {
+            return join8(gitDirectory, WORKSPACE_ID_RELATIVE_PATH);
+          }
+        }
+      }
+      return null;
+    } catch (error) {
+      const code = errorCode(error);
+      if (code !== "ENOENT" && code !== "ENOTDIR") {
+        return null;
+      }
+    }
+    const parent = dirname7(current);
+    if (parent === current) break;
+    current = parent;
+  }
+  return null;
+}
+function isGitDirectory(path) {
+  try {
+    return statSync2(join8(path, "HEAD")).isFile();
+  } catch {
+    return false;
+  }
+}
+function inspectPath(path) {
+  let stat;
+  try {
+    stat = lstatSync2(path);
+  } catch (error) {
+    const code = errorCode(error);
+    if (code === "ENOENT" || code === "ENOTDIR") return { status: "missing", path };
+    return { status: "unavailable", path, operation: "read", errorCode: code };
+  }
+  if (!stat.isFile()) return { status: "corrupt", path, reason: "not_file" };
+  if (stat.size > MAX_ID_FILE_BYTES) {
+    return { status: "corrupt", path, reason: "invalid_content" };
+  }
+  try {
+    const contents = readFileSync7(path, "utf8");
+    const workspaceId = contents.endsWith("\n") ? contents.slice(0, -1) : contents;
+    if ((contents === workspaceId || contents === `${workspaceId}
+`) && isCanonicalWorkspaceId(workspaceId)) {
+      return { status: "ready", workspaceId, path, created: false };
+    }
+    return { status: "corrupt", path, reason: "invalid_content" };
+  } catch (error) {
+    return {
+      status: "unavailable",
+      path,
+      operation: "read",
+      errorCode: errorCode(error)
+    };
+  }
+}
+function createWorkspaceId(path) {
+  const parent = dirname7(path);
+  const workspaceId = randomUUID2();
+  const temporaryPath = join8(parent, `.workspace-id-${process.pid}-${randomUUID2()}.tmp`);
+  let temporaryCreated = false;
+  let publishing = false;
+  try {
+    mkdirSync5(parent, { recursive: true, mode: 448 });
+    chmodSync2(parent, 448);
+    const fd = openSync3(
+      temporaryPath,
+      constants2.O_CREAT | constants2.O_EXCL | constants2.O_WRONLY,
+      384
+    );
+    temporaryCreated = true;
+    try {
+      writeFileSync3(fd, `${workspaceId}
+`, "utf8");
+      fchmodSync2(fd, 384);
+      fsyncSync2(fd);
+    } finally {
+      closeSync3(fd);
+    }
+    publishing = true;
+    linkSync(temporaryPath, path);
+    return { status: "ready", workspaceId, path, created: true };
+  } catch (error) {
+    if (publishing && errorCode(error) === "EEXIST") return inspectAfterRace(path);
+    return {
+      status: "unavailable",
+      path,
+      operation: "create",
+      errorCode: errorCode(error)
+    };
+  } finally {
+    if (temporaryCreated) {
+      try {
+        unlinkSync(temporaryPath);
+      } catch {
+      }
+    }
+  }
+}
+function inspectAfterRace(path) {
+  let result = { status: "missing", path };
+  for (let attempt = 0; attempt < RACE_READ_ATTEMPTS; attempt += 1) {
+    result = inspectPath(path);
+    if (result.status === "ready") return result;
+    if (attempt + 1 < RACE_READ_ATTEMPTS) {
+      Atomics.wait(raceDelay, 0, 0, RACE_READ_DELAY_MS);
+    }
+  }
+  if (result.status === "missing") {
+    return { status: "unavailable", path, operation: "create", errorCode: "EEXIST" };
+  }
+  return result;
+}
+function errorCode(error) {
+  if (typeof error !== "object" || error === null || !("code" in error)) return void 0;
+  return typeof error.code === "string" ? error.code : void 0;
+}
+
+// src/hooks/prim-hook-core.ts
+import { createHash as createHash4, randomUUID as randomUUID3 } from "crypto";
+import { platform } from "os";
+
+// src/protocol/move.ts
+var LEGACY_ENVELOPE_VERSION = 1;
+var ENVELOPE_VERSION = LEGACY_ENVELOPE_VERSION;
+
+// src/hooks/redact.ts
+import { existsSync as existsSync6, readFileSync as readFileSync8, statSync as statSync3 } from "fs";
+import { join as join9 } from "path";
+import { Worker } from "worker_threads";
+var USER_HOME_RULES = [
+  {
+    pattern: /\/Users\/[^/\\\s"'`]+/g,
+    reason: "user-home-path",
+    replacement: "/Users/__redacted_user__"
+  },
+  {
+    pattern: /\/home\/[^/\\\s"'`]+/g,
+    reason: "user-home-path",
+    replacement: "/home/__redacted_user__"
+  },
+  {
+    pattern: /([A-Za-z]:\\Users\\)[^/\\\s"'`]+/gi,
+    reason: "user-home-path",
+    replacement: "$1__redacted_user__"
+  },
+  {
+    pattern: /\/root(?=\/|$)/g,
+    reason: "user-home-path",
+    replacement: "/__redacted_user__"
+  }
+];
+var DEFAULT_RULES = [
+  { pattern: /Bearer\s+[A-Za-z0-9._~+/=-]+/gi, reason: "bearer-token" },
+  {
+    pattern: /\bsk-(?:(?:ant|proj)-)?[A-Za-z0-9_-]{16,}(?![A-Za-z0-9_-])/g,
+    reason: "sk-api-key"
+  },
+  {
+    pattern: /-----BEGIN [A-Z ]+PRIVATE KEY-----[\s\S]+?-----END [A-Z ]+PRIVATE KEY-----/g,
+    reason: "private-key"
+  },
+  { pattern: /xox[abprs]-[A-Za-z0-9-]{10,}/g, reason: "slack-token" },
+  {
+    pattern: /\b(?:gh[pousr]_[A-Za-z0-9]{36,}|github_pat_[A-Za-z0-9_]{50,})\b/g,
+    reason: "github-pat"
+  },
+  { pattern: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g, reason: "aws-access-key" },
+  {
+    pattern: /\bAWS_(?:SECRET_ACCESS_KEY|SESSION_TOKEN)"?\s*[:=]\s*["']?[A-Za-z0-9/+=]{20,}["']?/gi,
+    reason: "aws-secret"
+  },
+  { pattern: /\bAIza[0-9A-Za-z_-]{35}(?![0-9A-Za-z_-])/g, reason: "gcp-api-key" },
+  {
+    pattern: /\bya29\.[0-9A-Za-z_-]{20,}(?![0-9A-Za-z_-])/g,
+    reason: "gcp-oauth-token"
+  },
+  {
+    pattern: /\beyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*(?![A-Za-z0-9_-])/g,
+    reason: "jwt"
+  },
+  { pattern: /\bBasic\s+[A-Za-z0-9+/]+={0,2}/gi, reason: "basic-auth" },
+  { pattern: /\bhttps?:\/\/[^/\s:@]+:[^/\s@]+@/gi, reason: "basic-auth" },
+  ...USER_HOME_RULES
+];
+var MAX_SCRUB_LEN = 256e3;
+var MAX_WORKSPACE_CONFIG_BYTES = 64 * 1024;
+function applyRules(input, rules) {
+  if (input.length > MAX_SCRUB_LEN) return "<REDACTED:oversized>";
+  let out = input;
+  for (const rule of rules) {
+    out = out.replace(rule.pattern, rule.replacement ?? `<REDACTED:${rule.reason}>`);
+  }
+  return out;
+}
+var WORKSPACE_REDACTION_WORKER = String.raw`
+  const { parentPort, workerData } = require("node:worker_threads");
+  const REDACTED_OBJECT_KEY = "<REDACTED:object-key>";
+  const rules = workerData.rules.map((rule) => ({
+    pattern: new RegExp(rule.source, rule.flags),
+    reason: rule.reason,
+  }));
+  function redact(input) {
+      let output = input;
+      for (const rule of rules) {
+        output = output.replace(rule.pattern, "<REDACTED:" + rule.reason + ">");
+      }
+      return output;
+  }
+  function objectKey(input) {
+    return redact(input) === input ? input : REDACTED_OBJECT_KEY;
+  }
+  function uniqueKey(output, key) {
+    let candidate = key;
+    let suffix = 2;
+    while (Object.hasOwn(output, candidate)) candidate = key + "_" + suffix++;
+    return candidate;
+  }
+  function walk(value) {
+    if (typeof value === "string") {
+      return redact(value);
+    }
+    if (Array.isArray(value)) return value.map(walk);
+    if (value && typeof value === "object") {
+      const output = Object.create(null);
+      for (const [key, item] of Object.entries(value)) {
+        output[uniqueKey(output, objectKey(key))] = walk(item);
+      }
+      return output;
+    }
+    return value;
+  }
+  parentPort.postMessage(walk(workerData.value));
+`;
+function scrubEnvironmentPaths(environment) {
+  const scrubPath = (value) => value === void 0 ? void 0 : applyRules(value, USER_HOME_RULES);
+  return {
+    ...environment,
+    cwd: scrubPath(environment.cwd) ?? environment.cwd,
+    ...environment.repoRoot === void 0 ? {} : { repoRoot: scrubPath(environment.repoRoot) },
+    ...environment.gitRoot === void 0 ? {} : { gitRoot: scrubPath(environment.gitRoot) }
+  };
+}
+
+// src/hooks/prim-hook-core.ts
+var MAX_REWRITE_PAIRS_PER_MOVE = 40;
+var MAX_REWRITE_PAIRS_PER_HOOK = 2e3;
+var FULL_SHA_RE = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/u;
+function canonicalRewritePairs(pairs) {
+  const unique = /* @__PURE__ */ new Map();
+  for (const pair of pairs) {
+    const oldSha = pair.oldSha.toLowerCase();
+    const newSha = pair.newSha.toLowerCase();
+    if (!FULL_SHA_RE.test(oldSha) || !FULL_SHA_RE.test(newSha)) return null;
+    if (oldSha === newSha) continue;
+    unique.set(`${oldSha}\0${newSha}`, { oldSha, newSha });
+  }
+  return [...unique.values()].sort((left, right) => {
+    const leftKey = `${left.oldSha}\0${left.newSha}`;
+    const rightKey = `${right.oldSha}\0${right.newSha}`;
+    return leftKey < rightKey ? -1 : leftKey > rightKey ? 1 : 0;
+  }).slice(0, MAX_REWRITE_PAIRS_PER_HOOK);
+}
+function toRewriteMove(rewrite, cliVersion, cwd, context) {
+  const { repository, repoFullName, repoSyncId: repoSyncId2, workspaceId, capturedAt } = context;
+  if (rewrite.source !== "amend" && rewrite.source !== "rebase" || !isValidRepoSyncId(repoSyncId2) || !workspaceId || !isCanonicalWorkspaceId(workspaceId)) {
+    return [];
+  }
+  const pairs = canonicalRewritePairs(rewrite.pairs);
+  if (!pairs || pairs.length === 0) return [];
+  const branch = rewrite.branch && rewrite.branch === rewrite.branch.trim() && ![...rewrite.branch].some((char) => char < " " || char === "\x7F") ? rewrite.branch : void 0;
+  const observedAt = typeof capturedAt === "number" && Number.isSafeInteger(capturedAt) && capturedAt > 0 ? capturedAt : Date.now();
+  const moves = [];
+  for (let offset = 0; offset < pairs.length; offset += MAX_REWRITE_PAIRS_PER_MOVE) {
+    const sortedPairs = pairs.slice(offset, offset + MAX_REWRITE_PAIRS_PER_MOVE);
+    const moveId = `rewrite:v1:${createHash4("sha256").update(JSON.stringify(["rewrite:v1", repoSyncId2, workspaceId, rewrite.source, sortedPairs])).digest("hex")}`;
+    moves.push({
+      moveId,
+      capturedAt: observedAt,
+      sessionId: "",
+      eventType: "git.rewrite",
+      payload: {
+        kind: "git.rewrite",
+        source: rewrite.source,
+        pairs: sortedPairs,
+        ...branch ? { branch } : {}
+      },
+      env: scrubEnvironmentPaths({
+        cwd,
+        cliVersion,
+        osPlatform: platform(),
+        ...repository ? {
+          repoRoot: repository.repoRoot,
+          repoKey: repository.repoKey,
+          gitRoot: repository.repoRoot
+        } : {},
+        ...repoFullName ? { repoFullName } : {},
+        repoSyncId: repoSyncId2,
+        workspaceId
+      }),
+      envelopeVersion: ENVELOPE_VERSION
+    });
+  }
+  return moves;
+}
+
+// src/hooks/post-rewrite.ts
+var here = dirname8(fileURLToPath(import.meta.url));
+var GIT_TIMEOUT_MS3 = 1e3;
+var MAX_PAIRS_FILE_BYTES = 1048576;
+var MAX_PAIRS_FILE_AGE_MS = 10 * 60 * 1e3;
+var MAX_PAIRS_FILE_FUTURE_SKEW_MS = 5e3;
+var PAIRS_FILE_RE = /^prim-post-rewrite-pairs\.[A-Za-z0-9]+$/u;
+var FULL_SHA_SOURCE = "(?:[0-9a-fA-F]{40}|[0-9a-fA-F]{64})";
+var REWRITE_PAIR_RE = new RegExp(
+  `^(${FULL_SHA_SOURCE}) (${FULL_SHA_SOURCE})(?: ([^\\s]+))?$`,
+  "u"
+);
+function parseRewritePairs(value) {
+  if (value.length === 0) return [];
+  const body = value.endsWith("\n") ? value.slice(0, -1) : value;
+  if (body.length === 0) return [];
+  const parsed = [];
+  for (const line of body.split("\n")) {
+    const match = REWRITE_PAIR_RE.exec(line);
+    if (!match?.[1] || !match[2]) return;
+    parsed.push({ oldSha: match[1], newSha: match[2] });
+  }
+  return canonicalRewritePairs(parsed) ?? void 0;
+}
+function privatePairsFileStat(stat, now) {
+  const capturedAt = Math.trunc(stat.mtimeMs);
+  const uid = process.getuid?.();
+  return stat.isFile() && !stat.isSymbolicLink() && stat.size <= MAX_PAIRS_FILE_BYTES && stat.nlink === 1 && (stat.mode & 511) === 384 && (uid === void 0 || stat.uid === uid) && Number.isSafeInteger(capturedAt) && capturedAt > 0 && capturedAt >= now - MAX_PAIRS_FILE_AGE_MS && capturedAt <= now + MAX_PAIRS_FILE_FUTURE_SKEW_MS;
+}
+function rewritePairsFromLauncher(env = process.env, now = Date.now()) {
+  const path = env.PRIM_REWRITE_PAIRS_FILE;
+  if (!path || !isAbsolute4(path) || !PAIRS_FILE_RE.test(basename2(path))) return;
+  let fd;
+  try {
+    const pathStat = lstatSync3(path);
+    if (!privatePairsFileStat(pathStat, now)) return;
+    fd = openSync4(path, constants3.O_RDONLY | constants3.O_NOFOLLOW);
+    const openStat = fstatSync2(fd);
+    if (!privatePairsFileStat(openStat, now) || openStat.dev !== pathStat.dev || openStat.ino !== pathStat.ino) {
+      return;
+    }
+    const bytes = readFileSync9(fd);
+    if (bytes.length !== openStat.size) return;
+    let text;
+    try {
+      text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    } catch {
+      return;
+    }
+    const pairs = parseRewritePairs(text);
+    if (!pairs) return;
+    return {
+      path,
+      dev: openStat.dev,
+      ino: openStat.ino,
+      capturedAt: Math.trunc(openStat.mtimeMs),
+      pairs
+    };
+  } catch {
+    return;
+  } finally {
+    if (fd !== void 0) {
+      try {
+        closeSync4(fd);
+      } catch {
+      }
+    }
+  }
+}
+function unlinkSnapshot(snapshot) {
+  try {
+    const current = lstatSync3(snapshot.path);
+    if (current.isFile() && !current.isSymbolicLink() && current.dev === snapshot.dev && current.ino === snapshot.ino) {
+      unlinkSync2(snapshot.path);
+    }
+  } catch {
+  }
+}
+function gitText(args) {
+  try {
+    return execFileSync4("git", args, {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS3
+    }).trim();
+  } catch {
+    return;
+  }
+}
+function validSource(value) {
+  return value === "amend" || value === "rebase";
+}
+function validBranch(value) {
+  return value && value === value.trim() && ![...value].some((char) => char < " " || char === "\x7F") ? value : void 0;
+}
+function resolveCliVersion() {
+  try {
+    const pkg = JSON.parse(readFileSync9(join10(here, "..", "..", "package.json"), "utf-8"));
+    return pkg.version ?? "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+function spawnBackgroundFlush() {
+  const entry = join10(here, "..", "index.js");
+  spawn(process.execPath, [entry, "moves", "flush"], {
+    detached: true,
+    stdio: "ignore"
+  }).unref();
+}
+function runPostRewrite() {
+  const snapshot = rewritePairsFromLauncher();
+  if (!snapshot) return;
+  try {
+    const source = process.env.PRIM_REWRITE_SOURCE;
+    if (!validSource(source) || snapshot.pairs.length === 0) return;
+    const cwd = gitText(["rev-parse", "--show-toplevel"]) ?? process.cwd();
+    if (!isRepoActiveForCapture(cwd)) return;
+    const repository = resolveRepositoryContext(cwd);
+    const identity = getOrCreateWorkspaceId(cwd);
+    const workspaceId = identity.status === "ready" ? identity.workspaceId : void 0;
+    const moves = toRewriteMove(
+      {
+        source,
+        pairs: snapshot.pairs,
+        branch: validBranch(process.env.PRIM_REWRITE_BRANCH)
+      },
+      resolveCliVersion(),
+      cwd,
+      {
+        repository,
+        repoFullName: githubRepositoryFullName(cwd) ?? void 0,
+        repoSyncId: repoSyncId(cwd),
+        workspaceId,
+        capturedAt: snapshot.capturedAt
+      }
+    );
+    if (moves.length === 0) return;
+    const { orgId } = resolveOrg({ sessionId: "", cwd });
+    for (const move of moves) appendMove(move, orgId);
+    spawnBackgroundFlush();
+  } finally {
+    unlinkSnapshot(snapshot);
+  }
+}
+if (!process.env.VITEST) {
+  try {
+    runPostRewrite();
+  } catch (error) {
+    if (process.env.PRIM_HOOK_DEBUG) {
+      const detail = error instanceof Error ? error.message : String(error);
+      process.stderr.write(`[prim-post-rewrite] capture failed: ${detail}
+`);
+    }
+  }
+  process.exit(0);
+}
+export {
+  parseRewritePairs,
+  rewritePairsFromLauncher,
+  runPostRewrite
+};