@primitive.ai/prim 0.1.0-alpha.8 → 0.1.0-alpha.81

package/dist/hook-runtime/hooks/pre-commit.js

@@ -0,0 +1,1314 @@
+#!/usr/bin/env node
+
+// src/hooks/pre-commit.ts
+import { execSync } from "child_process";
+
+// src/client.ts
+import { createHash as createHash2 } from "crypto";
+import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync3, rmSync as rmSync3 } from "fs";
+import { dirname as dirname3 } from "path";
+
+// src/lib/atomic-file.ts
+import { randomUUID } from "crypto";
+import {
+  constants,
+  closeSync,
+  fchmodSync,
+  fsyncSync,
+  mkdirSync,
+  openSync,
+  renameSync,
+  rmSync,
+  writeFileSync
+} from "fs";
+import { dirname } from "path";
+var DEFAULT_FILE_MODE = 438;
+function syncDirectory(path) {
+  const fd = openSync(path, constants.O_RDONLY);
+  try {
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+}
+function syncCreatedParentChain(firstCreatedParent, parent) {
+  const createdDirectories = [];
+  let current = parent;
+  while (current !== firstCreatedParent) {
+    createdDirectories.push(current);
+    const next = dirname(current);
+    if (next === current) {
+      throw new Error("recursive mkdir returned a path outside the target parent chain");
+    }
+    current = next;
+  }
+  createdDirectories.push(firstCreatedParent);
+  syncDirectory(dirname(firstCreatedParent));
+  for (const directory of createdDirectories.reverse().slice(0, -1)) {
+    syncDirectory(directory);
+  }
+}
+function ensureDurableDirectory(path, mode) {
+  const firstCreatedParent = mkdirSync(path, { recursive: true, mode });
+  if (firstCreatedParent) {
+    syncCreatedParentChain(firstCreatedParent, path);
+  }
+}
+function atomicWriteFile(target, content, options = {}) {
+  const parent = dirname(target);
+  if (options.ensureParent) {
+    ensureDurableDirectory(parent);
+  }
+  const temporaryPath = `${target}.${randomUUID()}.tmp`;
+  let temporaryCreated = false;
+  try {
+    const flags = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW;
+    const fd = openSync(temporaryPath, flags, options.mode ?? DEFAULT_FILE_MODE);
+    temporaryCreated = true;
+    try {
+      if (options.mode !== void 0) fchmodSync(fd, options.mode);
+      writeFileSync(fd, content);
+      fsyncSync(fd);
+    } finally {
+      closeSync(fd);
+    }
+    options.validate?.(temporaryPath);
+    renameSync(temporaryPath, target);
+    syncDirectory(parent);
+  } catch (error) {
+    if (temporaryCreated) {
+      try {
+        rmSync(temporaryPath, { force: true });
+      } catch {
+      }
+    }
+    throw error;
+  }
+}
+
+// src/lib/credentials.ts
+import { createHash } from "crypto";
+import { readFileSync } from "fs";
+import { join as join2 } from "path";
+
+// src/lib/paths.ts
+import { homedir } from "os";
+import { isAbsolute, join, normalize } from "path";
+var UNSAFE_CONFIG_PATH_CHARACTERS = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u;
+function absolutePath(value, variable) {
+  if (value !== void 0 && UNSAFE_CONFIG_PATH_CHARACTERS.test(value)) {
+    throw new Error(`${variable} contains unsafe characters`);
+  }
+  if (!value || value.trim() !== value || !isAbsolute(value)) return;
+  const normalized = normalize(value);
+  return normalized === value ? value : void 0;
+}
+function resolvePrimConfigDirectory(options = {}) {
+  const env = options.env ?? process.env;
+  const explicit = absolutePath(env.PRIM_CONFIG_DIR, "PRIM_CONFIG_DIR");
+  if (explicit) return { path: explicit, source: "explicit" };
+  const xdgConfigHome = absolutePath(env.XDG_CONFIG_HOME, "XDG_CONFIG_HOME");
+  if (xdgConfigHome) return { path: join(xdgConfigHome, "prim"), source: "xdg" };
+  const home = absolutePath(options.homeDir ?? homedir(), "HOME");
+  if (!home) {
+    throw new Error("cannot resolve Primitive config directory: HOME is not an absolute path");
+  }
+  return { path: join(home, ".config", "prim"), source: "default" };
+}
+function primConfigDirectory(options = {}) {
+  return resolvePrimConfigDirectory(options).path;
+}
+
+// src/lib/workos-connect.ts
+var TOKEN_PATH = "/oauth2/token";
+var DISCOVERY_MAX_BYTES = 16 * 1024;
+var WORKOS_CONNECT_RESPONSE_MAX_BYTES = 64 * 1024;
+var MAX_DEVICE_LIFETIME_SECONDS = 60 * 60;
+var MAX_TOKEN_LIFETIME_SECONDS = 24 * 60 * 60;
+var MAX_URL_LENGTH = 2048;
+var MAX_CLIENT_ID_LENGTH = 256;
+var CONNECT_CLIENT_ID_PATTERN = /^client_[A-Za-z0-9_-]+$/u;
+var WorkosConnectProtocolError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "WorkosConnectProtocolError";
+    this.code = code;
+  }
+};
+function recordFrom(value, label) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new WorkosConnectProtocolError("invalid_response", `${label} must be an object`);
+  }
+  return value;
+}
+function exactString(value, field, maxLength) {
+  const containsControl = typeof value === "string" && [...value].some((character) => {
+    const code = character.charCodeAt(0);
+    return code <= 31 || code === 127;
+  });
+  if (typeof value !== "string" || value.length === 0 || value.length > maxLength || value.trim() !== value || containsControl) {
+    throw new WorkosConnectProtocolError("invalid_response", `${field} is invalid`);
+  }
+  return value;
+}
+function safeInteger(value, field, minimum, maximum) {
+  if (!Number.isSafeInteger(value) || value < minimum || value > maximum) {
+    throw new WorkosConnectProtocolError("invalid_response", `${field} is invalid`);
+  }
+  return value;
+}
+function canonicalIssuer(value) {
+  const issuer = exactString(value, "issuer", MAX_URL_LENGTH);
+  let parsed;
+  try {
+    parsed = new URL(issuer);
+  } catch {
+    throw new WorkosConnectProtocolError("invalid_response", "issuer must be an HTTPS origin");
+  }
+  if (parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash || parsed.origin !== issuer) {
+    throw new WorkosConnectProtocolError("invalid_response", "issuer must be an HTTPS origin");
+  }
+  return issuer;
+}
+function parseWorkosConnectCredentialMetadata(value) {
+  const record = recordFrom(value, "credential metadata");
+  if (record.version !== 1 || record.family !== "workos_connect") {
+    throw new WorkosConnectProtocolError("invalid_metadata", "credential metadata is invalid");
+  }
+  const issuer = canonicalIssuer(record.issuer);
+  const clientId = exactString(record.clientId, "clientId", MAX_CLIENT_ID_LENGTH);
+  const accessTokenHash = exactString(record.accessTokenHash, "accessTokenHash", 64);
+  const refreshTokenHash = exactString(record.refreshTokenHash, "refreshTokenHash", 64);
+  if (!CONNECT_CLIENT_ID_PATTERN.test(clientId)) {
+    throw new WorkosConnectProtocolError("invalid_metadata", "credential clientId is invalid");
+  }
+  if (!/^[a-f0-9]{64}$/u.test(accessTokenHash)) {
+    throw new WorkosConnectProtocolError(
+      "invalid_metadata",
+      "credential accessTokenHash is invalid"
+    );
+  }
+  if (!/^[a-f0-9]{64}$/u.test(refreshTokenHash)) {
+    throw new WorkosConnectProtocolError(
+      "invalid_metadata",
+      "credential refreshTokenHash is invalid"
+    );
+  }
+  return {
+    version: 1,
+    family: "workos_connect",
+    issuer,
+    clientId,
+    accessTokenHash,
+    refreshTokenHash
+  };
+}
+async function readBoundedJson(response, maxBytes) {
+  const contentLength = response.headers.get("content-length");
+  if (contentLength !== null) {
+    if (!/^\d+$/u.test(contentLength) || Number(contentLength) > maxBytes) {
+      throw new WorkosConnectProtocolError("invalid_response", "response body is too large");
+    }
+  }
+  if (!response.body) {
+    throw new WorkosConnectProtocolError("invalid_response", "response body is missing");
+  }
+  const reader = response.body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    while (true) {
+      const result = await reader.read();
+      if (result.done) break;
+      total += result.value.byteLength;
+      if (total > maxBytes) {
+        await reader.cancel();
+        throw new WorkosConnectProtocolError("invalid_response", "response body is too large");
+      }
+      chunks.push(result.value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk2 of chunks) {
+    bytes.set(chunk2, offset);
+    offset += chunk2.byteLength;
+  }
+  let text;
+  try {
+    text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    return JSON.parse(text);
+  } catch {
+    throw new WorkosConnectProtocolError("invalid_response", "response body is not valid JSON");
+  }
+}
+function workosConnectTokenEndpoint(issuer) {
+  return `${issuer}${TOKEN_PATH}`;
+}
+function parseWorkosConnectTokens(value, options = {}) {
+  const record = recordFrom(value, "token response");
+  const accessToken = exactString(
+    record.access_token,
+    "access_token",
+    WORKOS_CONNECT_RESPONSE_MAX_BYTES
+  );
+  const refreshToken2 = record.refresh_token === void 0 && options.fallbackRefreshToken !== void 0 ? options.fallbackRefreshToken : exactString(record.refresh_token, "refresh_token", WORKOS_CONNECT_RESPONSE_MAX_BYTES);
+  return {
+    accessToken,
+    refreshToken: refreshToken2,
+    expiresIn: record.expires_in === void 0 ? void 0 : safeInteger(record.expires_in, "expires_in", 1, MAX_TOKEN_LIFETIME_SECONDS)
+  };
+}
+
+// src/lib/credentials.ts
+var CONFIG_DIRECTORY = primConfigDirectory();
+var TOKEN_FILE_PATH = join2(CONFIG_DIRECTORY, "token");
+var REFRESH_TOKEN_PATH = join2(CONFIG_DIRECTORY, "refresh_token");
+var TOKEN_EXPIRES_PATH = join2(CONFIG_DIRECTORY, "token_expires_at");
+var TERMINAL_REFRESH_PATH = join2(CONFIG_DIRECTORY, "refresh_terminal");
+var CREDENTIAL_METADATA_PATH = join2(CONFIG_DIRECTORY, "credential_metadata.json");
+var CREDENTIAL_FAMILY_PATH = join2(CONFIG_DIRECTORY, "credential_family.json");
+var CREDENTIAL_MIGRATION_PATH = join2(CONFIG_DIRECTORY, "credential_migration.json");
+var CREDENTIAL_LOCK_PATH = join2(CONFIG_DIRECTORY, "credentials.lock");
+var MAX_CREDENTIAL_METADATA_BYTES = 4096;
+var CREDENTIAL_MIGRATION_VERSION = 1;
+var CREDENTIAL_MIGRATION_STATE = "family_bound";
+function readTrimmed(path) {
+  try {
+    const value = readFileSync(path, "utf8").trim();
+    return value || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function resolveAuthCredential(options = {}) {
+  const envToken = (options.env ?? process.env).PRIM_TOKEN?.trim();
+  if (envToken) return { token: envToken, source: "environment" };
+  const stored = readTrimmed(options.tokenFilePath ?? TOKEN_FILE_PATH);
+  if (!stored) return void 0;
+  const metadata = readStoredCredentialMetadata(
+    options.metadataPath ?? CREDENTIAL_METADATA_PATH,
+    options.familyPath ?? CREDENTIAL_FAMILY_PATH,
+    options.migrationPath ?? CREDENTIAL_MIGRATION_PATH
+  );
+  if (metadata.state === "legacy_broker") {
+    if (metadata.metadata) {
+      const refreshToken3 = readTrimmed(options.refreshTokenPath ?? REFRESH_TOKEN_PATH);
+      if (!refreshToken3 || metadata.metadata.accessTokenHash !== credentialFingerprint(stored) || metadata.metadata.refreshTokenHash !== credentialFingerprint(refreshToken3)) {
+        return void 0;
+      }
+    }
+    return { token: stored, source: "token_file" };
+  }
+  if (metadata.state === "invalid") return void 0;
+  const refreshToken2 = readTrimmed(options.refreshTokenPath ?? REFRESH_TOKEN_PATH);
+  if (!refreshToken2 || metadata.metadata.accessTokenHash !== credentialFingerprint(stored) || metadata.metadata.refreshTokenHash !== credentialFingerprint(refreshToken2)) {
+    return void 0;
+  }
+  return { token: stored, source: "token_file" };
+}
+function credentialFingerprint(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+function parseLegacyBrokerCredentialMetadata(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("credential family is invalid");
+  }
+  const record = value;
+  if (record.version !== 1 || record.family !== "legacy_broker" || typeof record.accessTokenHash !== "string" || typeof record.refreshTokenHash !== "string" || !/^[a-f0-9]{64}$/u.test(record.accessTokenHash) || !/^[a-f0-9]{64}$/u.test(record.refreshTokenHash)) {
+    throw new Error("credential family is invalid");
+  }
+  return {
+    version: 1,
+    family: "legacy_broker",
+    accessTokenHash: record.accessTokenHash,
+    refreshTokenHash: record.refreshTokenHash
+  };
+}
+function readBoundedCredentialJson(path) {
+  let raw;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch (error) {
+    return error.code === "ENOENT" ? void 0 : null;
+  }
+  if (Buffer.byteLength(raw, "utf8") > MAX_CREDENTIAL_METADATA_BYTES) return null;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function readCredentialFamily(path) {
+  const parsed = readBoundedCredentialJson(path);
+  if (parsed === void 0) return void 0;
+  if (parsed === null) return { state: "invalid" };
+  try {
+    if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) && parsed.family === "legacy_broker") {
+      return { state: "legacy_broker", metadata: parseLegacyBrokerCredentialMetadata(parsed) };
+    }
+    return {
+      state: "workos_connect",
+      metadata: parseWorkosConnectCredentialMetadata(parsed)
+    };
+  } catch {
+    return { state: "invalid" };
+  }
+}
+function isCredentialMigrationSentinel(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const record = value;
+  const keys = Object.keys(record).sort();
+  return keys.length === 2 && keys[0] === "state" && keys[1] === "version" && record.version === CREDENTIAL_MIGRATION_VERSION && record.state === CREDENTIAL_MIGRATION_STATE;
+}
+function readCredentialMigrationState(path = CREDENTIAL_MIGRATION_PATH) {
+  const parsed = readBoundedCredentialJson(path);
+  if (parsed === void 0) return "absent";
+  return parsed !== null && isCredentialMigrationSentinel(parsed) ? "valid" : "invalid";
+}
+function readStoredCredentialMetadata(metadataPath = CREDENTIAL_METADATA_PATH, familyPath = CREDENTIAL_FAMILY_PATH, migrationPath = CREDENTIAL_MIGRATION_PATH) {
+  const family = readCredentialFamily(familyPath);
+  if (family) return family;
+  const parsed = readBoundedCredentialJson(metadataPath);
+  if (parsed === void 0) {
+    return readCredentialMigrationState(migrationPath) === "absent" ? { state: "legacy_broker" } : { state: "invalid" };
+  }
+  if (parsed === null) return { state: "invalid" };
+  try {
+    return {
+      state: "workos_connect",
+      metadata: parseWorkosConnectCredentialMetadata(parsed)
+    };
+  } catch {
+    return { state: "invalid" };
+  }
+}
+function decodeJwtPayload(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return void 0;
+  try {
+    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    if (payload === null || typeof payload !== "object" || Array.isArray(payload)) return void 0;
+    return payload;
+  } catch {
+    return void 0;
+  }
+}
+function jwtExpiresAt(token) {
+  const exp = decodeJwtPayload(token)?.exp;
+  return typeof exp === "number" && Number.isFinite(exp) ? exp * 1e3 : void 0;
+}
+
+// src/lib/file-lock.ts
+import { randomBytes } from "crypto";
+import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync as rmSync2, statSync, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2, join as join3 } from "path";
+
+// src/lib/process-liveness.ts
+function processIsAlive(pid, probe = process.kill) {
+  if (!Number.isSafeInteger(pid) || pid <= 0) return false;
+  try {
+    probe(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+
+// src/lib/file-lock.ts
+var DEFAULT_TIMEOUT_MS = 3e4;
+var DEFAULT_POLL_MS = 50;
+var DEFAULT_INIT_GRACE_MS = 2e3;
+var DIRECTORY_MODE = 448;
+var FILE_MODE = 384;
+function ownerPath(lockDir) {
+  return join3(lockDir, "owner.json");
+}
+function readOwner(lockDir) {
+  try {
+    const owner = JSON.parse(readFileSync2(ownerPath(lockDir), "utf8"));
+    if (!Number.isInteger(owner.pid) || owner.pid <= 0 || typeof owner.nonce !== "string" || typeof owner.createdAt !== "number") {
+      return null;
+    }
+    return owner;
+  } catch {
+    return null;
+  }
+}
+function sameOwner(a, b) {
+  return a?.pid === b.pid && a.nonce === b.nonce && a.createdAt === b.createdAt;
+}
+function tryTakeLock(lockDir, now) {
+  try {
+    mkdirSync2(lockDir, { mode: DIRECTORY_MODE });
+  } catch (error) {
+    if (error.code === "EEXIST") return null;
+    throw error;
+  }
+  const owner = {
+    pid: process.pid,
+    nonce: randomBytes(16).toString("hex"),
+    createdAt: now
+  };
+  try {
+    writeFileSync2(ownerPath(lockDir), `${JSON.stringify(owner)}
+`, {
+      encoding: "utf8",
+      mode: FILE_MODE,
+      flag: "wx"
+    });
+    return owner;
+  } catch (error) {
+    rmSync2(lockDir, { recursive: true, force: true });
+    throw error;
+  }
+}
+function recoverStaleLock(lockDir, now, alive, initGraceMs) {
+  const owner = readOwner(lockDir);
+  if (owner) {
+    if (alive(owner.pid)) return false;
+    if (!sameOwner(readOwner(lockDir), owner)) return false;
+    rmSync2(lockDir, { recursive: true, force: true });
+    return true;
+  }
+  try {
+    const before = statSync(lockDir).mtimeMs;
+    if (now - before < initGraceMs) return false;
+    if (readOwner(lockDir)) return false;
+    if (statSync(lockDir).mtimeMs !== before) return false;
+    rmSync2(lockDir, { recursive: true, force: true });
+    return true;
+  } catch {
+    return true;
+  }
+}
+function abortError(signal) {
+  if (signal.reason instanceof Error) return signal.reason;
+  const error = new Error("The operation was aborted");
+  error.name = "AbortError";
+  return error;
+}
+function throwIfAborted(signal) {
+  if (signal?.aborted) throw abortError(signal);
+}
+async function defaultSleep(ms, signal) {
+  if (!signal) {
+    await new Promise((resolve2) => setTimeout(resolve2, ms));
+    return;
+  }
+  throwIfAborted(signal);
+  await new Promise((resolve2, reject) => {
+    const timer = setTimeout(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolve2();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(abortError(signal));
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
+var syncSleeper = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
+async function withFileLock(lockDir, operation, options = {}) {
+  mkdirSync2(dirname2(lockDir), { recursive: true, mode: DIRECTORY_MODE });
+  const nowMs = options.nowMs ?? Date.now;
+  const alive = options.processAlive ?? processIsAlive;
+  const deadline = nowMs() + (options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+  let owner = null;
+  while (!owner) {
+    throwIfAborted(options.signal);
+    const now = nowMs();
+    owner = tryTakeLock(lockDir, now);
+    if (owner) break;
+    recoverStaleLock(lockDir, now, alive, options.initGraceMs ?? DEFAULT_INIT_GRACE_MS);
+    if (now >= deadline) {
+      throw new Error(`timed out waiting for file lock ${lockDir}`);
+    }
+    if (options.sleep) {
+      await options.sleep(options.pollMs ?? DEFAULT_POLL_MS);
+      throwIfAborted(options.signal);
+    } else {
+      await defaultSleep(options.pollMs ?? DEFAULT_POLL_MS, options.signal);
+    }
+  }
+  try {
+    throwIfAborted(options.signal);
+    return await operation();
+  } finally {
+    if (sameOwner(readOwner(lockDir), owner)) {
+      rmSync2(lockDir, { recursive: true, force: true });
+    }
+  }
+}
+
+// src/lib/terminal-safe.ts
+function replaceIsolatedSurrogates(value) {
+  let out = "";
+  for (let index = 0; index < value.length; index += 1) {
+    const unit = value.charCodeAt(index);
+    if (unit >= 55296 && unit <= 56319) {
+      const next = value.charCodeAt(index + 1);
+      if (next >= 56320 && next <= 57343) {
+        out += value[index] + value[index + 1];
+        index += 1;
+      } else {
+        out += "\uFFFD";
+      }
+    } else if (unit >= 56320 && unit <= 57343) {
+      out += "\uFFFD";
+    } else {
+      out += value[index];
+    }
+  }
+  return out;
+}
+function isUnsafeTerminalCodePoint(point) {
+  const c0OrC1 = point <= 31 || point >= 127 && point <= 159;
+  const bidiOrZeroWidth = point === 173 || // soft hyphen
+  point === 1564 || // Arabic letter mark
+  point === 6158 || // Mongolian vowel separator
+  point >= 8203 && point <= 8207 || // zero-width + directional marks
+  point >= 8234 && point <= 8238 || // bidi embeddings/overrides
+  point >= 8288 && point <= 8303 || // word joiner + bidi isolates/controls
+  point >= 65529 && point <= 65531 || // interlinear annotation controls
+  point === 65279 || // zero-width no-break space / BOM
+  point >= 917504 && point <= 917631;
+  return c0OrC1 || bidiOrZeroWidth;
+}
+function terminalSafeText(value) {
+  return Array.from(replaceIsolatedSurrogates(value)).filter((character) => !isUnsafeTerminalCodePoint(character.codePointAt(0) ?? 0)).join("");
+}
+function terminalSafeLine(value) {
+  return terminalSafeText(value.replace(/\s+/gu, " ")).replace(/\s+/gu, " ").trim();
+}
+
+// src/client.ts
+var CONFIG_DIR_MODE = 448;
+var CREDENTIAL_FILE_MODE = 384;
+var REFRESH_THRESHOLD_MS = 6e4;
+var DEFAULT_API_URL = "https://api.getprimitive.ai";
+var AUTH_EXPIRED_MESSAGE = "Authentication expired. Run `prim auth login` to re-authenticate.";
+function readTrimmed2(path) {
+  try {
+    const value = readFileSync3(path, "utf8").trim();
+    return value || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function getSiteUrl() {
+  return getSiteUrlForEnvironment(process.env.PRIM_API_URL);
+}
+function getSiteUrlForEnvironment(primApiUrl) {
+  return primApiUrl?.trim() || DEFAULT_API_URL;
+}
+function expiresAtFor(token, expiresIn) {
+  return expiresIn === void 0 ? jwtExpiresAt(token) : Date.now() + expiresIn * 1e3;
+}
+function ensureConfigDirectory() {
+  const directory = dirname3(TOKEN_FILE_PATH);
+  mkdirSync3(directory, { recursive: true, mode: CONFIG_DIR_MODE });
+  chmodSync(directory, CONFIG_DIR_MODE);
+}
+function atomicWrite(path, content) {
+  ensureConfigDirectory();
+  atomicWriteFile(path, content, { mode: CREDENTIAL_FILE_MODE });
+}
+function removeCredentialFile(path) {
+  if (!existsSync2(path)) return false;
+  rmSync3(path, { force: true });
+  return true;
+}
+function getTokenExpiresAt() {
+  const stored = readTrimmed2(TOKEN_EXPIRES_PATH);
+  if (stored === void 0) return void 0;
+  const value = Number(stored);
+  return Number.isNaN(value) ? void 0 : value;
+}
+function isTokenExpiringSoon(credential) {
+  if (credential.source !== "token_file") return false;
+  const expiresAt = getTokenExpiresAt();
+  return expiresAt !== void 0 && Date.now() >= expiresAt - REFRESH_THRESHOLD_MS;
+}
+function refreshFingerprint(refreshToken2) {
+  return createHash2("sha256").update(refreshToken2).digest("hex");
+}
+function legacyBrokerCredentialMetadata(accessToken, refreshToken2) {
+  return {
+    version: 1,
+    family: "legacy_broker",
+    accessTokenHash: refreshFingerprint(accessToken),
+    refreshTokenHash: refreshFingerprint(refreshToken2)
+  };
+}
+function credentialFamilyMetadata(accessToken, refreshToken2, metadata) {
+  const hashes = {
+    accessTokenHash: refreshFingerprint(accessToken),
+    refreshTokenHash: refreshFingerprint(refreshToken2)
+  };
+  return metadata === void 0 ? legacyBrokerCredentialMetadata(accessToken, refreshToken2) : { ...metadata, ...hashes };
+}
+function writeCredentialMigrationSentinel() {
+  atomicWrite(
+    CREDENTIAL_MIGRATION_PATH,
+    `${JSON.stringify({
+      version: CREDENTIAL_MIGRATION_VERSION,
+      state: CREDENTIAL_MIGRATION_STATE
+    })}
+`
+  );
+}
+function bindLegacyBrokerGeneration(accessToken, refreshToken2, metadata) {
+  if (metadata.state !== "legacy_broker" || !accessToken || !refreshToken2) {
+    return { state: "invalid" };
+  }
+  const familyMetadata = legacyBrokerCredentialMetadata(accessToken, refreshToken2);
+  if (metadata.metadata !== void 0 && (metadata.metadata.accessTokenHash !== familyMetadata.accessTokenHash || metadata.metadata.refreshTokenHash !== familyMetadata.refreshTokenHash)) {
+    return { state: "invalid" };
+  }
+  if (metadata.metadata === void 0) {
+    atomicWrite(CREDENTIAL_FAMILY_PATH, `${JSON.stringify(familyMetadata)}
+`);
+  }
+  const migrationState = readCredentialMigrationState();
+  if (migrationState === "invalid") return { state: "invalid" };
+  if (migrationState === "absent") writeCredentialMigrationSentinel();
+  return { state: "legacy_broker", metadata: familyMetadata };
+}
+function preserveMarkerlessLegacyGeneration() {
+  const metadata = readStoredCredentialMetadata();
+  if (metadata.state !== "legacy_broker" || metadata.metadata !== void 0) return;
+  const accessToken = readTrimmed2(TOKEN_FILE_PATH);
+  const refreshToken2 = readTrimmed2(REFRESH_TOKEN_PATH);
+  if (!(accessToken && refreshToken2)) return;
+  const familyMetadata = legacyBrokerCredentialMetadata(accessToken, refreshToken2);
+  atomicWrite(CREDENTIAL_FAMILY_PATH, `${JSON.stringify(familyMetadata)}
+`);
+}
+function terminalFingerprint() {
+  return readTrimmed2(TERMINAL_REFRESH_PATH);
+}
+function writeTerminalFingerprint(refreshToken2) {
+  atomicWrite(TERMINAL_REFRESH_PATH, `${refreshFingerprint(refreshToken2)}
+`);
+}
+function clearTerminalFingerprint() {
+  removeCredentialFile(TERMINAL_REFRESH_PATH);
+}
+function isSessionEnded() {
+  if (resolveAuthCredential()?.source !== "token_file") return false;
+  const refreshToken2 = readTrimmed2(REFRESH_TOKEN_PATH);
+  const ended = terminalFingerprint();
+  return Boolean(refreshToken2 && ended && refreshFingerprint(refreshToken2) === ended);
+}
+function withCredentialLock(operation, options = {}) {
+  return withFileLock(CREDENTIAL_LOCK_PATH, operation, options);
+}
+function commitCredentialsUnlocked(credentials) {
+  const accessToken = credentials.accessToken.trim();
+  const refreshToken2 = credentials.refreshToken.trim();
+  if (!accessToken || !refreshToken2) {
+    throw new Error("OAuth credentials require both access and refresh tokens");
+  }
+  const familyMetadata = credentialFamilyMetadata(accessToken, refreshToken2, credentials.metadata);
+  if (credentials.metadata !== void 0) {
+    preserveMarkerlessLegacyGeneration();
+    writeCredentialMigrationSentinel();
+    atomicWrite(CREDENTIAL_FAMILY_PATH, `${JSON.stringify(familyMetadata)}
+`);
+    atomicWrite(CREDENTIAL_METADATA_PATH, `${JSON.stringify(familyMetadata)}
+`);
+    atomicWrite(REFRESH_TOKEN_PATH, `${refreshToken2}
+`);
+  } else {
+    atomicWrite(REFRESH_TOKEN_PATH, `${refreshToken2}
+`);
+    atomicWrite(CREDENTIAL_FAMILY_PATH, `${JSON.stringify(familyMetadata)}
+`);
+    removeCredentialFile(CREDENTIAL_METADATA_PATH);
+  }
+  const expiresAt = expiresAtFor(accessToken, credentials.expiresIn);
+  if (expiresAt === void 0) removeCredentialFile(TOKEN_EXPIRES_PATH);
+  else atomicWrite(TOKEN_EXPIRES_PATH, `${expiresAt}
+`);
+  atomicWrite(TOKEN_FILE_PATH, `${accessToken}
+`);
+  clearTerminalFingerprint();
+  _cachedCredential = { token: accessToken, source: "token_file" };
+}
+function isTerminalRefreshResponse(response, detail) {
+  if (detail.includes("invalid_grant") || detail.includes("Session has already ended")) return true;
+  try {
+    const error = JSON.parse(detail).error;
+    return error === "invalid_grant" || response.status === 401 && error === "Invalid or expired refresh token";
+  } catch {
+    return response.status === 401 && detail.includes("Invalid or expired refresh token");
+  }
+}
+function workosConnectRefreshErrorCode(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return "";
+  return value.error === "invalid_grant" ? "invalid_grant" : "";
+}
+function refreshDiagnostic(response, detail, quiet, provider) {
+  if (quiet) return;
+  const statusText = terminalSafeLine(response.statusText).slice(0, 120);
+  const safeDetail = terminalSafeLine(detail).slice(0, 200);
+  process.stderr.write(
+    `[prim] token refresh rejected by ${provider}: ${response.status}${statusText ? ` ${statusText}` : ""}${safeDetail ? ` \u2014 ${safeDetail}` : ""}
+`
+  );
+}
+function metadataMatchesCredentialGeneration(expected, accessToken, refreshToken2) {
+  const current = readStoredCredentialMetadata();
+  if (expected.state === "legacy_broker") {
+    if (current.state !== "legacy_broker") return false;
+    if (!expected.metadata) return current.metadata === void 0;
+    return current.metadata !== void 0 && current.metadata.accessTokenHash === refreshFingerprint(accessToken) && current.metadata.accessTokenHash === expected.metadata.accessTokenHash && current.metadata.refreshTokenHash === refreshFingerprint(refreshToken2) && current.metadata.refreshTokenHash === expected.metadata.refreshTokenHash;
+  }
+  if (expected.state !== "workos_connect" || current.state !== "workos_connect") return false;
+  return current.metadata.issuer === expected.metadata.issuer && current.metadata.clientId === expected.metadata.clientId && current.metadata.accessTokenHash === refreshFingerprint(accessToken) && current.metadata.accessTokenHash === expected.metadata.accessTokenHash && current.metadata.refreshTokenHash === refreshFingerprint(refreshToken2) && current.metadata.refreshTokenHash === expected.metadata.refreshTokenHash;
+}
+function uncoordinatedLegacyWinnerAccessToken(expected, currentGeneration) {
+  if (!expected || readCredentialMigrationState() !== "valid") return void 0;
+  const stored = readStoredCredentialMetadata();
+  if (stored.state !== "legacy_broker" || stored.metadata === void 0 || stored.metadata.accessTokenHash !== expected.accessTokenHash || stored.metadata.refreshTokenHash !== expected.refreshTokenHash) {
+    return void 0;
+  }
+  const replacementRefreshToken = readTrimmed2(REFRESH_TOKEN_PATH);
+  if (!replacementRefreshToken || replacementRefreshToken === currentGeneration) return void 0;
+  return readTrimmed2(TOKEN_FILE_PATH);
+}
+function winnerAfterRefreshRace(currentGeneration, expectedLegacyGeneration) {
+  if (readTrimmed2(REFRESH_TOKEN_PATH) === currentGeneration) return void 0;
+  const winner = resolveAuthCredential();
+  return (winner?.source === "token_file" ? winner.token : void 0) ?? uncoordinatedLegacyWinnerAccessToken(expectedLegacyGeneration, currentGeneration);
+}
+async function performTokenRefresh(options = {}) {
+  const selected = resolveAuthCredential();
+  if (selected?.source !== "token_file") return void 0;
+  const startingGeneration = readTrimmed2(REFRESH_TOKEN_PATH);
+  if (!startingGeneration || isSessionEnded()) return void 0;
+  const startingAccessToken = selected.token;
+  return withCredentialLock(
+    async () => {
+      const currentCredential = resolveAuthCredential();
+      if (currentCredential?.source !== "token_file") return void 0;
+      const currentGeneration = readTrimmed2(REFRESH_TOKEN_PATH);
+      if (!currentGeneration) return void 0;
+      if (currentGeneration !== startingGeneration) {
+        return currentCredential.token;
+      }
+      if (currentCredential.token !== startingAccessToken) {
+        return currentCredential.token;
+      }
+      if (isSessionEnded()) return void 0;
+      let metadata = readStoredCredentialMetadata();
+      const markerlessLegacyAtStart = metadata.state === "legacy_broker" && metadata.metadata === void 0;
+      if (metadata.state === "invalid" || metadata.state === "workos_connect" && (metadata.metadata.accessTokenHash !== refreshFingerprint(currentCredential.token) || metadata.metadata.refreshTokenHash !== refreshFingerprint(currentGeneration))) {
+        return void 0;
+      }
+      if (metadata.state === "legacy_broker") {
+        try {
+          metadata = bindLegacyBrokerGeneration(
+            currentCredential.token,
+            currentGeneration,
+            metadata
+          );
+        } catch {
+          return void 0;
+        }
+        if (metadata.state !== "legacy_broker") return void 0;
+      }
+      const expectedLegacyGeneration = markerlessLegacyAtStart && metadata.state === "legacy_broker" ? metadata.metadata : void 0;
+      const connectContext = metadata.state === "workos_connect" ? {
+        version: 1,
+        family: "workos_connect",
+        issuer: metadata.metadata.issuer,
+        clientId: metadata.metadata.clientId
+      } : void 0;
+      const response = await fetch(
+        connectContext ? workosConnectTokenEndpoint(connectContext.issuer) : `${getSiteUrl()}/mcp/broker/refresh`,
+        connectContext ? {
+          method: "POST",
+          headers: { "Content-Type": "application/x-www-form-urlencoded" },
+          body: new URLSearchParams({
+            grant_type: "refresh_token",
+            refresh_token: currentGeneration,
+            client_id: connectContext.clientId
+          }),
+          signal: options.signal
+        } : {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ refresh_token: currentGeneration }),
+          signal: options.signal
+        }
+      );
+      let directResponse;
+      if (connectContext) {
+        try {
+          directResponse = await readBoundedJson(response, WORKOS_CONNECT_RESPONSE_MAX_BYTES);
+        } catch {
+          if (response.ok && readTrimmed2(REFRESH_TOKEN_PATH) === currentGeneration && metadataMatchesCredentialGeneration(
+            metadata,
+            currentCredential.token,
+            currentGeneration
+          )) {
+            writeTerminalFingerprint(currentGeneration);
+          }
+          return void 0;
+        }
+      }
+      if (!response.ok) {
+        let detail = "";
+        if (connectContext) {
+          detail = workosConnectRefreshErrorCode(directResponse);
+        } else {
+          detail = (await response.text().catch(() => "")).slice(0, 200);
+        }
+        if (isTerminalRefreshResponse(response, detail) && readTrimmed2(REFRESH_TOKEN_PATH) === currentGeneration && metadataMatchesCredentialGeneration(metadata, currentCredential.token, currentGeneration)) {
+          writeTerminalFingerprint(currentGeneration);
+        }
+        refreshDiagnostic(
+          response,
+          detail,
+          options.quiet,
+          connectContext ? "WorkOS Connect" : "broker"
+        );
+        return winnerAfterRefreshRace(currentGeneration, expectedLegacyGeneration);
+      }
+      let accessToken;
+      let replacementRefreshToken;
+      let expiresIn;
+      if (connectContext) {
+        try {
+          const tokens = parseWorkosConnectTokens(directResponse, {
+            fallbackRefreshToken: currentGeneration
+          });
+          accessToken = tokens.accessToken;
+          replacementRefreshToken = tokens.refreshToken;
+          expiresIn = tokens.expiresIn;
+        } catch {
+          if (readTrimmed2(REFRESH_TOKEN_PATH) === currentGeneration && metadataMatchesCredentialGeneration(
+            metadata,
+            currentCredential.token,
+            currentGeneration
+          )) {
+            writeTerminalFingerprint(currentGeneration);
+          }
+          return void 0;
+        }
+      } else {
+        let data;
+        try {
+          data = await response.json();
+        } catch {
+          if (readTrimmed2(REFRESH_TOKEN_PATH) === currentGeneration) {
+            writeTerminalFingerprint(currentGeneration);
+          }
+          return void 0;
+        }
+        const record = typeof data === "object" && data !== null && !Array.isArray(data) ? data : void 0;
+        accessToken = typeof record?.access_token === "string" ? record.access_token.trim() : "";
+        replacementRefreshToken = typeof record?.refresh_token === "string" ? record.refresh_token.trim() : "";
+        expiresIn = typeof record?.expires_in === "number" && Number.isFinite(record.expires_in) ? record.expires_in : void 0;
+        if (!(accessToken && replacementRefreshToken)) {
+          if (readTrimmed2(REFRESH_TOKEN_PATH) === currentGeneration) {
+            writeTerminalFingerprint(currentGeneration);
+          }
+          return void 0;
+        }
+      }
+      const latestCredential = resolveAuthCredential();
+      if (readTrimmed2(REFRESH_TOKEN_PATH) !== currentGeneration || latestCredential?.source !== "token_file" || latestCredential.token !== currentCredential.token || !metadataMatchesCredentialGeneration(metadata, currentCredential.token, currentGeneration)) {
+        return latestCredential?.source === "token_file" ? latestCredential.token : winnerAfterRefreshRace(currentGeneration, expectedLegacyGeneration);
+      }
+      commitCredentialsUnlocked({
+        accessToken,
+        refreshToken: replacementRefreshToken,
+        expiresIn,
+        metadata: connectContext
+      });
+      return accessToken;
+    },
+    { signal: options.signal }
+  );
+}
+var _refreshInFlight;
+function refreshToken(options = {}) {
+  if (_refreshInFlight) return _refreshInFlight;
+  const attempt = performTokenRefresh(options).then((token) => {
+    if (token) _cachedCredential = { token, source: "token_file" };
+    return token;
+  }).finally(() => {
+    if (_refreshInFlight === attempt) _refreshInFlight = void 0;
+  });
+  _refreshInFlight = attempt;
+  return attempt;
+}
+var HttpError = class extends Error {
+  status;
+  body;
+  constructor(status, message, body) {
+    super(message);
+    this.name = "HttpError";
+    this.status = status;
+    this.body = body;
+  }
+};
+var CLI_MANAGEMENT_RESPONSE_MAX_BYTES = 2 * 1024 * 1024;
+var _cachedCredential;
+function selectedCredential() {
+  const resolved = resolveAuthCredential();
+  if (!_cachedCredential || resolved?.token !== _cachedCredential.token || resolved?.source !== _cachedCredential.source) {
+    _cachedCredential = resolved;
+  }
+  return _cachedCredential;
+}
+function fetchWithToken(method, path, body, options, token, siteUrl) {
+  return fetch(`${siteUrl}${path}`, {
+    method,
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/json"
+    },
+    body: body === void 0 ? void 0 : JSON.stringify(body),
+    signal: options?.signal
+  });
+}
+async function responseValue(response) {
+  if (!response.ok) {
+    if (response.status === 401) {
+      throw new HttpError(401, AUTH_EXPIRED_MESSAGE);
+    }
+    const errorBody = await response.json().catch(() => null);
+    const errorRecord = typeof errorBody === "object" && errorBody !== null && !Array.isArray(errorBody) ? errorBody : void 0;
+    const message = typeof errorRecord?.error === "string" ? errorRecord.error : `HTTP ${response.status}`;
+    throw new HttpError(response.status, message, errorBody);
+  }
+  return response.json();
+}
+async function request(method, path, body, options) {
+  const siteUrl = getSiteUrl();
+  let credential = selectedCredential();
+  let refreshAttempted = false;
+  if (credential && isTokenExpiringSoon(credential)) {
+    refreshAttempted = true;
+    const token = await refreshToken({
+      signal: options?.signal,
+      quiet: options?.quietRefresh
+    });
+    if (token) credential = { token, source: "token_file" };
+  }
+  if (!credential) {
+    throw new HttpError(401, AUTH_EXPIRED_MESSAGE);
+  }
+  if (isTokenExpiringSoon(credential) && isSessionEnded()) {
+    throw new HttpError(401, AUTH_EXPIRED_MESSAGE);
+  }
+  const tokenUsed = credential.token;
+  let response = await fetchWithToken(method, path, body, options, tokenUsed, siteUrl);
+  if (response.status === 401) {
+    const latest = resolveAuthCredential();
+    let retryToken = latest?.token !== tokenUsed ? latest?.token : void 0;
+    if (!retryToken && latest?.source === "token_file" && !refreshAttempted) {
+      refreshAttempted = true;
+      retryToken = await refreshToken({ signal: options?.signal, quiet: options?.quietRefresh });
+    }
+    if (retryToken) {
+      _cachedCredential = {
+        token: retryToken,
+        source: latest?.source === "token_file" ? "token_file" : latest?.source ?? "token_file"
+      };
+      response = await fetchWithToken(method, path, body, options, retryToken, siteUrl);
+    }
+  }
+  return responseValue(response);
+}
+function getClient() {
+  return {
+    get: (path, options) => request("GET", path, void 0, options),
+    post: (path, body, options) => request("POST", path, body, options)
+  };
+}
+
+// src/daemon/client.ts
+import { createConnection } from "net";
+import { join as join5 } from "path";
+
+// src/daemon/principal.ts
+import { createHash as createHash3 } from "crypto";
+var PRINCIPAL_COMPONENT_MAX_LENGTH = 512;
+function boundedClaim(value) {
+  return typeof value === "string" && value.length > 0 && value.length <= PRINCIPAL_COMPONENT_MAX_LENGTH ? value : void 0;
+}
+function sha256(value) {
+  return createHash3("sha256").update(value).digest("hex");
+}
+function resolveDaemonPrincipal(token = resolveAuthCredential()?.token) {
+  if (!token) return void 0;
+  const payload = decodeJwtPayload(token);
+  const subject = boundedClaim(payload?.sub);
+  const organizationId = boundedClaim(payload?.org_id);
+  if (!(subject && organizationId)) return void 0;
+  const issuer = boundedClaim(payload?.iss) ?? "unknown-issuer";
+  return {
+    principalId: sha256(`${issuer}\0${subject}`),
+    organizationId,
+    credentialFingerprint: sha256(token)
+  };
+}
+
+// src/daemon/protocol.ts
+var DAEMON_JSON_REQUEST_MAX_BYTES = 64 * 1024;
+var DAEMON_JSON_RESPONSE_MAX_BYTES = 8 * 1024 * 1024;
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseDaemonResponseEnvelope(value) {
+  if (!isRecord(value)) return void 0;
+  if (!(typeof value.id === "number" && Number.isSafeInteger(value.id) && value.id >= 0)) {
+    return void 0;
+  }
+  if (typeof value.ok !== "boolean") return void 0;
+  if (value.error !== void 0 && typeof value.error !== "string") return void 0;
+  return {
+    id: value.id,
+    ok: value.ok,
+    ...value.result === void 0 ? {} : { result: value.result },
+    ...value.error === void 0 ? {} : { error: value.error }
+  };
+}
+
+// src/daemon/client.ts
+var SOCK_PATH = join5(primConfigDirectory(), "sock");
+var DEFAULT_TIMEOUT_MS2 = 250;
+var nextRequestId = 1;
+function daemonRequest(method, params = {}, opts = {}) {
+  const id = nextRequestId++;
+  const caller = resolveDaemonPrincipal();
+  const request2 = {
+    id,
+    method,
+    params,
+    ...caller ? { caller } : {}
+  };
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
+  return new Promise((resolve2) => {
+    let settled = false;
+    let socket;
+    let buffer = Buffer.alloc(0);
+    const settle = (value) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      if (socket) {
+        try {
+          socket.destroy();
+        } catch {
+        }
+      }
+      resolve2(value);
+    };
+    const timer = setTimeout(() => settle(null), timeoutMs);
+    timer.unref();
+    try {
+      socket = createConnection(SOCK_PATH);
+    } catch {
+      clearTimeout(timer);
+      settle(null);
+      return;
+    }
+    socket.on("error", () => {
+      clearTimeout(timer);
+      settle(null);
+    });
+    socket.on("connect", () => {
+      try {
+        socket?.write(`${JSON.stringify(request2)}
+`);
+      } catch {
+        clearTimeout(timer);
+        settle(null);
+      }
+    });
+    socket.on("data", (chunk2) => {
+      buffer = Buffer.concat([buffer, Buffer.from(chunk2)]);
+      if (buffer.length > DAEMON_JSON_RESPONSE_MAX_BYTES) {
+        clearTimeout(timer);
+        settle(null);
+        return;
+      }
+      const newlineIdx = buffer.indexOf(10);
+      if (newlineIdx === -1) {
+        return;
+      }
+      const line = buffer.subarray(0, newlineIdx).toString("utf8");
+      try {
+        const res = parseDaemonResponseEnvelope(JSON.parse(line));
+        if (!res || res.id !== id) {
+          clearTimeout(timer);
+          settle(null);
+          return;
+        }
+        clearTimeout(timer);
+        settle(res.ok && res.result !== void 0 ? res.result : null);
+      } catch {
+        clearTimeout(timer);
+        settle(null);
+      }
+    });
+    socket.on("end", () => {
+      if (!settled) {
+        clearTimeout(timer);
+        settle(null);
+      }
+    });
+  });
+}
+
+// src/daemon/proxy.ts
+var DAEMON_HTTP_TIMEOUT_MS = 1e4;
+var DAEMON_PROBE_TIMEOUT_MS = 250;
+async function daemonOrDirect(method, params, direct) {
+  const fromDaemon = await daemonRequest(
+    method,
+    { ...params, callerEnv: getSiteUrl() },
+    { timeoutMs: DAEMON_PROBE_TIMEOUT_MS }
+  );
+  if (fromDaemon !== null) {
+    return fromDaemon;
+  }
+  return await direct();
+}
+async function daemonOrDirectGet(method, path, client, timeoutMs = DAEMON_HTTP_TIMEOUT_MS) {
+  return await daemonOrDirect(
+    method,
+    { path },
+    async () => await client.get(path, {
+      signal: AbortSignal.timeout(timeoutMs)
+    })
+  );
+}
+
+// src/hooks/decisions-check.ts
+var DECISIONS_CHECK_TIMEOUT_MS = 1e4;
+var MAX_FILES_PER_REQUEST = 25;
+var defaultDeps = { getClient };
+function chunk(items, size) {
+  const out = [];
+  for (let i = 0; i < items.length; i += size) {
+    out.push(items.slice(i, i + size));
+  }
+  return out;
+}
+async function fetchAffecting(client, batch) {
+  const params = new URLSearchParams();
+  for (const file of batch) {
+    params.append("files", file);
+  }
+  try {
+    return await daemonOrDirectGet(
+      "decisions_affecting",
+      `/api/cli/decisions/affecting?${params.toString()}`,
+      client,
+      DECISIONS_CHECK_TIMEOUT_MS
+    );
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    return { decisions: [], truncated: false, unavailable: `decision check failed: ${detail}` };
+  }
+}
+async function checkAffectedDecisions(filePaths, deps = defaultDeps) {
+  if (filePaths.length === 0) {
+    return { decisions: [], truncated: false };
+  }
+  const client = deps.getClient();
+  const responses = await Promise.all(
+    chunk(filePaths, MAX_FILES_PER_REQUEST).map((batch) => fetchAffecting(client, batch))
+  );
+  const byId = /* @__PURE__ */ new Map();
+  let truncated = false;
+  let unavailable;
+  for (const res of responses) {
+    if (res.unavailable !== void 0 && unavailable === void 0) {
+      unavailable = res.unavailable;
+    }
+    truncated ||= res.truncated === true;
+    for (const d of res.decisions) {
+      const existing = byId.get(d.id);
+      if (existing) {
+        existing.matchedFiles = [.../* @__PURE__ */ new Set([...existing.matchedFiles, ...d.matchedFiles])];
+      } else {
+        byId.set(d.id, { ...d, matchedFiles: [...d.matchedFiles] });
+      }
+    }
+  }
+  const result = { decisions: [...byId.values()], truncated };
+  if (unavailable !== void 0) {
+    result.unavailable = unavailable;
+  }
+  return result;
+}
+var FILES_PREVIEW_LIMIT = 3;
+function formatDecisionsWarning(result) {
+  const lines = [];
+  if (result.unavailable !== void 0) {
+    lines.push(`[prim] decision check not verified \u2014 ${terminalSafeLine(result.unavailable)}`);
+  }
+  if (result.decisions.length > 0) {
+    lines.push(
+      `[prim] ${String(result.decisions.length)} active decision(s) reference staged files:`
+    );
+    for (const d of result.decisions) {
+      const statusMark = d.status === "under_review" ? " (under review)" : "";
+      const preview = d.matchedFiles.slice(0, FILES_PREVIEW_LIMIT).map(terminalSafeLine).join(", ");
+      const overflow = d.matchedFiles.length > FILES_PREVIEW_LIMIT ? ` (+${String(d.matchedFiles.length - FILES_PREVIEW_LIMIT)} more)` : "";
+      lines.push(`  \xB7 ${terminalSafeLine(d.intent)}${statusMark}`);
+      lines.push(`    files: ${preview}${overflow}`);
+      if (d.rationale) {
+        lines.push(`    rationale: ${terminalSafeLine(d.rationale)}`);
+      }
+    }
+  }
+  if (result.truncated) {
+    lines.push(
+      "[prim] result truncated \u2014 more files than the server checks per request; not all decisions shown"
+    );
+  }
+  return lines.join("\n");
+}
+
+// src/hooks/pre-commit.ts
+function getStagedFiles() {
+  const output = execSync("git diff --cached --name-only", {
+    encoding: "utf-8"
+  });
+  return output.trim().split("\n").filter((f) => f.length > 0);
+}
+async function runDecisionsCheck() {
+  const stagedFiles = getStagedFiles();
+  if (stagedFiles.length === 0) {
+    return { decisions: [], truncated: false };
+  }
+  return checkAffectedDecisions(stagedFiles);
+}
+async function main() {
+  const decisionsResult = await runDecisionsCheck();
+  const warning = formatDecisionsWarning(decisionsResult);
+  if (warning) {
+    console.error(warning);
+  }
+  process.exit(0);
+}
+if (!process.env.VITEST) {
+  main().catch((error) => {
+    console.error("[prim] Pre-commit hook error:", error);
+    process.exit(0);
+  });
+}