@primitive.ai/prim 0.1.0-alpha.9 → 0.1.0-alpha.91

package/dist/hook-runtime/hooks/session-end.js

@@ -0,0 +1,1078 @@
+#!/usr/bin/env node
+
+// src/daemon/client.ts
+import { createConnection } from "net";
+import { join as join3 } from "path";
+
+// src/lib/paths.ts
+import { homedir } from "os";
+import { isAbsolute, join, normalize } from "path";
+var UNSAFE_CONFIG_PATH_CHARACTERS = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u;
+function absolutePath(value, variable) {
+  if (value !== void 0 && UNSAFE_CONFIG_PATH_CHARACTERS.test(value)) {
+    throw new Error(`${variable} contains unsafe characters`);
+  }
+  if (!value || value.trim() !== value || !isAbsolute(value)) return;
+  const normalized = normalize(value);
+  return normalized === value ? value : void 0;
+}
+function resolvePrimConfigDirectory(options = {}) {
+  const env = options.env ?? process.env;
+  const explicit = absolutePath(env.PRIM_CONFIG_DIR, "PRIM_CONFIG_DIR");
+  if (explicit) return { path: explicit, source: "explicit" };
+  const xdgConfigHome = absolutePath(env.XDG_CONFIG_HOME, "XDG_CONFIG_HOME");
+  if (xdgConfigHome) return { path: join(xdgConfigHome, "prim"), source: "xdg" };
+  const home = absolutePath(options.homeDir ?? homedir(), "HOME");
+  if (!home) {
+    throw new Error("cannot resolve Primitive config directory: HOME is not an absolute path");
+  }
+  return { path: join(home, ".config", "prim"), source: "default" };
+}
+function primConfigDirectory(options = {}) {
+  return resolvePrimConfigDirectory(options).path;
+}
+
+// src/daemon/principal.ts
+import { createHash as createHash2 } from "crypto";
+
+// src/lib/credentials.ts
+import { createHash } from "crypto";
+import { readFileSync } from "fs";
+import { join as join2 } from "path";
+
+// src/lib/workos-connect.ts
+var DISCOVERY_MAX_BYTES = 16 * 1024;
+var WORKOS_CONNECT_RESPONSE_MAX_BYTES = 64 * 1024;
+var MAX_DEVICE_LIFETIME_SECONDS = 60 * 60;
+var MAX_TOKEN_LIFETIME_SECONDS = 24 * 60 * 60;
+var MAX_URL_LENGTH = 2048;
+var MAX_CLIENT_ID_LENGTH = 256;
+var CONNECT_CLIENT_ID_PATTERN = /^client_[A-Za-z0-9_-]+$/u;
+var WorkosConnectProtocolError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "WorkosConnectProtocolError";
+    this.code = code;
+  }
+};
+function recordFrom(value, label) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new WorkosConnectProtocolError("invalid_response", `${label} must be an object`);
+  }
+  return value;
+}
+function exactString(value, field, maxLength) {
+  const containsControl = typeof value === "string" && [...value].some((character) => {
+    const code = character.charCodeAt(0);
+    return code <= 31 || code === 127;
+  });
+  if (typeof value !== "string" || value.length === 0 || value.length > maxLength || value.trim() !== value || containsControl) {
+    throw new WorkosConnectProtocolError("invalid_response", `${field} is invalid`);
+  }
+  return value;
+}
+function canonicalIssuer(value) {
+  const issuer = exactString(value, "issuer", MAX_URL_LENGTH);
+  let parsed;
+  try {
+    parsed = new URL(issuer);
+  } catch {
+    throw new WorkosConnectProtocolError("invalid_response", "issuer must be an HTTPS origin");
+  }
+  if (parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash || parsed.origin !== issuer) {
+    throw new WorkosConnectProtocolError("invalid_response", "issuer must be an HTTPS origin");
+  }
+  return issuer;
+}
+function parseWorkosConnectCredentialMetadata(value) {
+  const record = recordFrom(value, "credential metadata");
+  if (record.version !== 1 || record.family !== "workos_connect") {
+    throw new WorkosConnectProtocolError("invalid_metadata", "credential metadata is invalid");
+  }
+  const issuer = canonicalIssuer(record.issuer);
+  const clientId = exactString(record.clientId, "clientId", MAX_CLIENT_ID_LENGTH);
+  const accessTokenHash = exactString(record.accessTokenHash, "accessTokenHash", 64);
+  const refreshTokenHash = exactString(record.refreshTokenHash, "refreshTokenHash", 64);
+  if (!CONNECT_CLIENT_ID_PATTERN.test(clientId)) {
+    throw new WorkosConnectProtocolError("invalid_metadata", "credential clientId is invalid");
+  }
+  if (!/^[a-f0-9]{64}$/u.test(accessTokenHash)) {
+    throw new WorkosConnectProtocolError(
+      "invalid_metadata",
+      "credential accessTokenHash is invalid"
+    );
+  }
+  if (!/^[a-f0-9]{64}$/u.test(refreshTokenHash)) {
+    throw new WorkosConnectProtocolError(
+      "invalid_metadata",
+      "credential refreshTokenHash is invalid"
+    );
+  }
+  return {
+    version: 1,
+    family: "workos_connect",
+    issuer,
+    clientId,
+    accessTokenHash,
+    refreshTokenHash
+  };
+}
+
+// src/lib/credentials.ts
+var CONFIG_DIRECTORY = primConfigDirectory();
+var TOKEN_FILE_PATH = join2(CONFIG_DIRECTORY, "token");
+var REFRESH_TOKEN_PATH = join2(CONFIG_DIRECTORY, "refresh_token");
+var TOKEN_EXPIRES_PATH = join2(CONFIG_DIRECTORY, "token_expires_at");
+var TERMINAL_REFRESH_PATH = join2(CONFIG_DIRECTORY, "refresh_terminal");
+var CREDENTIAL_METADATA_PATH = join2(CONFIG_DIRECTORY, "credential_metadata.json");
+var CREDENTIAL_FAMILY_PATH = join2(CONFIG_DIRECTORY, "credential_family.json");
+var CREDENTIAL_MIGRATION_PATH = join2(CONFIG_DIRECTORY, "credential_migration.json");
+var CREDENTIAL_LOCK_PATH = join2(CONFIG_DIRECTORY, "credentials.lock");
+var MAX_CREDENTIAL_METADATA_BYTES = 4096;
+var CREDENTIAL_MIGRATION_VERSION = 1;
+var CREDENTIAL_MIGRATION_STATE = "family_bound";
+function readTrimmed(path) {
+  try {
+    const value = readFileSync(path, "utf8").trim();
+    return value || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function resolveAuthCredential(options = {}) {
+  const envToken = (options.env ?? process.env).PRIM_TOKEN?.trim();
+  if (envToken) return { token: envToken, source: "environment" };
+  const stored = readTrimmed(options.tokenFilePath ?? TOKEN_FILE_PATH);
+  if (!stored) return void 0;
+  const metadata = readStoredCredentialMetadata(
+    options.metadataPath ?? CREDENTIAL_METADATA_PATH,
+    options.familyPath ?? CREDENTIAL_FAMILY_PATH,
+    options.migrationPath ?? CREDENTIAL_MIGRATION_PATH
+  );
+  if (metadata.state === "legacy_broker") {
+    if (metadata.metadata) {
+      const refreshToken2 = readTrimmed(options.refreshTokenPath ?? REFRESH_TOKEN_PATH);
+      if (!refreshToken2 || metadata.metadata.accessTokenHash !== credentialFingerprint(stored) || metadata.metadata.refreshTokenHash !== credentialFingerprint(refreshToken2)) {
+        return void 0;
+      }
+    }
+    return { token: stored, source: "token_file" };
+  }
+  if (metadata.state === "invalid") return void 0;
+  const refreshToken = readTrimmed(options.refreshTokenPath ?? REFRESH_TOKEN_PATH);
+  if (!refreshToken || metadata.metadata.accessTokenHash !== credentialFingerprint(stored) || metadata.metadata.refreshTokenHash !== credentialFingerprint(refreshToken)) {
+    return void 0;
+  }
+  return { token: stored, source: "token_file" };
+}
+function credentialFingerprint(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+function parseLegacyBrokerCredentialMetadata(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("credential family is invalid");
+  }
+  const record = value;
+  if (record.version !== 1 || record.family !== "legacy_broker" || typeof record.accessTokenHash !== "string" || typeof record.refreshTokenHash !== "string" || !/^[a-f0-9]{64}$/u.test(record.accessTokenHash) || !/^[a-f0-9]{64}$/u.test(record.refreshTokenHash)) {
+    throw new Error("credential family is invalid");
+  }
+  return {
+    version: 1,
+    family: "legacy_broker",
+    accessTokenHash: record.accessTokenHash,
+    refreshTokenHash: record.refreshTokenHash
+  };
+}
+function readBoundedCredentialJson(path) {
+  let raw;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch (error) {
+    return error.code === "ENOENT" ? void 0 : null;
+  }
+  if (Buffer.byteLength(raw, "utf8") > MAX_CREDENTIAL_METADATA_BYTES) return null;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function readCredentialFamily(path) {
+  const parsed = readBoundedCredentialJson(path);
+  if (parsed === void 0) return void 0;
+  if (parsed === null) return { state: "invalid" };
+  try {
+    if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) && parsed.family === "legacy_broker") {
+      return { state: "legacy_broker", metadata: parseLegacyBrokerCredentialMetadata(parsed) };
+    }
+    return {
+      state: "workos_connect",
+      metadata: parseWorkosConnectCredentialMetadata(parsed)
+    };
+  } catch {
+    return { state: "invalid" };
+  }
+}
+function isCredentialMigrationSentinel(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const record = value;
+  const keys = Object.keys(record).sort();
+  return keys.length === 2 && keys[0] === "state" && keys[1] === "version" && record.version === CREDENTIAL_MIGRATION_VERSION && record.state === CREDENTIAL_MIGRATION_STATE;
+}
+function readCredentialMigrationState(path = CREDENTIAL_MIGRATION_PATH) {
+  const parsed = readBoundedCredentialJson(path);
+  if (parsed === void 0) return "absent";
+  return parsed !== null && isCredentialMigrationSentinel(parsed) ? "valid" : "invalid";
+}
+function readStoredCredentialMetadata(metadataPath = CREDENTIAL_METADATA_PATH, familyPath = CREDENTIAL_FAMILY_PATH, migrationPath = CREDENTIAL_MIGRATION_PATH) {
+  const family = readCredentialFamily(familyPath);
+  if (family) return family;
+  const parsed = readBoundedCredentialJson(metadataPath);
+  if (parsed === void 0) {
+    return readCredentialMigrationState(migrationPath) === "absent" ? { state: "legacy_broker" } : { state: "invalid" };
+  }
+  if (parsed === null) return { state: "invalid" };
+  try {
+    return {
+      state: "workos_connect",
+      metadata: parseWorkosConnectCredentialMetadata(parsed)
+    };
+  } catch {
+    return { state: "invalid" };
+  }
+}
+function decodeJwtPayload(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return void 0;
+  try {
+    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    if (payload === null || typeof payload !== "object" || Array.isArray(payload)) return void 0;
+    return payload;
+  } catch {
+    return void 0;
+  }
+}
+
+// src/daemon/principal.ts
+var PRINCIPAL_COMPONENT_MAX_LENGTH = 512;
+function boundedClaim(value) {
+  return typeof value === "string" && value.length > 0 && value.length <= PRINCIPAL_COMPONENT_MAX_LENGTH ? value : void 0;
+}
+function sha256(value) {
+  return createHash2("sha256").update(value).digest("hex");
+}
+function resolveDaemonPrincipal(token = resolveAuthCredential()?.token) {
+  if (!token) return void 0;
+  const payload = decodeJwtPayload(token);
+  const subject = boundedClaim(payload?.sub);
+  const organizationId = boundedClaim(payload?.org_id);
+  if (!(subject && organizationId)) return void 0;
+  const issuer = boundedClaim(payload?.iss) ?? "unknown-issuer";
+  return {
+    principalId: sha256(`${issuer}\0${subject}`),
+    organizationId,
+    credentialFingerprint: sha256(token)
+  };
+}
+
+// src/daemon/protocol.ts
+var DAEMON_JSON_REQUEST_MAX_BYTES = 64 * 1024;
+var DAEMON_JSON_RESPONSE_MAX_BYTES = 8 * 1024 * 1024;
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseDaemonResponseEnvelope(value) {
+  if (!isRecord(value)) return void 0;
+  if (!(typeof value.id === "number" && Number.isSafeInteger(value.id) && value.id >= 0)) {
+    return void 0;
+  }
+  if (typeof value.ok !== "boolean") return void 0;
+  if (value.error !== void 0 && typeof value.error !== "string") return void 0;
+  return {
+    id: value.id,
+    ok: value.ok,
+    ...value.result === void 0 ? {} : { result: value.result },
+    ...value.error === void 0 ? {} : { error: value.error }
+  };
+}
+
+// src/daemon/client.ts
+var SOCK_PATH = join3(primConfigDirectory(), "sock");
+var DEFAULT_TIMEOUT_MS = 250;
+var nextRequestId = 1;
+function daemonRequest(method, params = {}, opts = {}) {
+  const id = nextRequestId++;
+  const caller = resolveDaemonPrincipal();
+  const request = {
+    id,
+    method,
+    params,
+    ...caller ? { caller } : {}
+  };
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  return new Promise((resolve4) => {
+    let settled = false;
+    let socket;
+    let buffer = Buffer.alloc(0);
+    const settle = (value) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      if (socket) {
+        try {
+          socket.destroy();
+        } catch {
+        }
+      }
+      resolve4(value);
+    };
+    const timer = setTimeout(() => settle(null), timeoutMs);
+    timer.unref();
+    try {
+      socket = createConnection(SOCK_PATH);
+    } catch {
+      clearTimeout(timer);
+      settle(null);
+      return;
+    }
+    socket.on("error", () => {
+      clearTimeout(timer);
+      settle(null);
+    });
+    socket.on("connect", () => {
+      try {
+        socket?.write(`${JSON.stringify(request)}
+`);
+      } catch {
+        clearTimeout(timer);
+        settle(null);
+      }
+    });
+    socket.on("data", (chunk) => {
+      buffer = Buffer.concat([buffer, Buffer.from(chunk)]);
+      if (buffer.length > DAEMON_JSON_RESPONSE_MAX_BYTES) {
+        clearTimeout(timer);
+        settle(null);
+        return;
+      }
+      const newlineIdx = buffer.indexOf(10);
+      if (newlineIdx === -1) {
+        return;
+      }
+      const line = buffer.subarray(0, newlineIdx).toString("utf8");
+      try {
+        const res = parseDaemonResponseEnvelope(JSON.parse(line));
+        if (!res || res.id !== id) {
+          clearTimeout(timer);
+          settle(null);
+          return;
+        }
+        clearTimeout(timer);
+        settle(res.ok && res.result !== void 0 ? res.result : null);
+      } catch {
+        clearTimeout(timer);
+        settle(null);
+      }
+    });
+    socket.on("end", () => {
+      if (!settled) {
+        clearTimeout(timer);
+        settle(null);
+      }
+    });
+  });
+}
+
+// src/hooks/agent.ts
+function parseAgent(argv) {
+  const i = argv.indexOf("--agent");
+  const value = i !== -1 ? argv[i + 1] : void 0;
+  if (value === "codex" || value === "cursor" || value === "hermes") {
+    return value;
+  }
+  return "claude_code";
+}
+
+// src/commands/cursor-install.ts
+import { existsSync as existsSync5, readFileSync as readFileSync6 } from "fs";
+import { homedir as homedir3 } from "os";
+import { isAbsolute as isAbsolute5, join as join8 } from "path";
+
+// src/lib/atomic-file.ts
+import { randomUUID } from "crypto";
+import {
+  constants,
+  closeSync,
+  fchmodSync,
+  fsyncSync,
+  mkdirSync,
+  openSync,
+  renameSync,
+  rmSync,
+  writeFileSync
+} from "fs";
+import { dirname } from "path";
+
+// src/lib/bin-path.ts
+import { existsSync, readFileSync as readFileSync2 } from "fs";
+import { dirname as dirname2, isAbsolute as isAbsolute2, join as join4 } from "path";
+import { fileURLToPath } from "url";
+var PKG_NAME = "@primitive.ai/prim";
+var STABLE_HOOK_LAUNCHER_NAME = "prim-hook-launcher-v1";
+function shellQuote(value) {
+  return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+var STABLE_HOOK_ARGUMENTS_RE = /^[-A-Za-z0-9_ ]*$/u;
+var STABLE_HOOK_BIN_RE = /^[A-Za-z0-9][A-Za-z0-9-]*$/u;
+function stableHookCommand(bin, args = "") {
+  if (!STABLE_HOOK_BIN_RE.test(bin) || !STABLE_HOOK_ARGUMENTS_RE.test(args)) {
+    throw new Error("invalid stable hook command");
+  }
+  const resolver = [
+    // #242 and earlier identify managed commands by this package marker. Keep
+    // it as inert data during the rolling window so an older uninstall or
+    // reinstall can remove the stable entry without invoking npm or PATH.
+    `prim_legacy_reader='-p ${PKG_NAME}@stable prim-shim.sh ${bin} '; `,
+    'prim_absolute() { case "$1" in [/]* ) ;; *) return 1 ;; esac; case "$1" in [[:space:]]*|*[[:space:]]|*[/][/]*|*[/].[/]*|*[/]..[/]*|*[/].|*[/]..|?*[/]) return 1 ;; esac; }; ',
+    'prim_config=${PRIM_CONFIG_DIR:-}; if ! prim_absolute "$prim_config"; then prim_config=${XDG_CONFIG_HOME:-}; if prim_absolute "$prim_config"; then ',
+    'case "$prim_config" in /) prim_config=/prim ;; *) prim_config="$prim_config/prim" ;; esac; ',
+    'else prim_home=${HOME:-}; prim_absolute "$prim_home" || exit 78; case "$prim_home" in /) prim_config=/.config/prim ;; *) prim_config="$prim_home/.config/prim" ;; esac; ',
+    "fi; fi; ",
+    `case "$prim_config" in /) prim_launcher=/${STABLE_HOOK_LAUNCHER_NAME} ;; *) prim_launcher="$prim_config/${STABLE_HOOK_LAUNCHER_NAME}" ;; esac; `,
+    'exec "$prim_launcher" "$@"'
+  ].join("");
+  const suffix = args ? ` ${args}` : "";
+  return `/bin/sh -c ${shellQuote(resolver)} ${STABLE_HOOK_LAUNCHER_NAME} ${bin}${suffix}`;
+}
+function detachedHookShimCommand(bin, args = "") {
+  return `payload=$(cat); { trap '' HUP; printf '%s' "$payload" | { ${stableHookCommand(bin, args)}; }; } </dev/null >/dev/null 2>&1 &`;
+}
+
+// src/lib/hook-runtime.ts
+import { createHash as createHash3, randomBytes as randomBytes2 } from "crypto";
+import {
+  constants as constants2,
+  accessSync,
+  chmodSync,
+  copyFileSync,
+  existsSync as existsSync3,
+  lstatSync,
+  mkdirSync as mkdirSync3,
+  mkdtempSync,
+  readFileSync as readFileSync4,
+  readdirSync,
+  realpathSync,
+  renameSync as renameSync2,
+  rmSync as rmSync3,
+  statSync as statSync2,
+  utimesSync,
+  writeFileSync as writeFileSync3
+} from "fs";
+import { dirname as dirname4, isAbsolute as isAbsolute3, join as join6, resolve } from "path";
+
+// src/lib/file-lock.ts
+import { randomBytes } from "crypto";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, rmSync as rmSync2, statSync, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname3, join as join5 } from "path";
+var syncSleeper = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
+
+// src/lib/hook-runtime.ts
+var RELEASE_PREFIX = "release-";
+var MAX_MANIFEST_BYTES = 64 * 1024;
+var RELEASE_GRACE_MS = 10 * 60 * 1e3;
+var HOOK_RUNTIME_ENTRIES = {
+  // SessionStart self-healing resolves this exact CLI entry to run
+  // `daemon ensure`; it must travel with the immutable hook release.
+  prim: "dist/index.js",
+  "prim-hook": "dist/hooks/prim-hook.js",
+  "prim-pre-commit": "dist/hooks/pre-commit.js",
+  "prim-post-commit": "dist/hooks/post-commit.js",
+  "prim-post-rewrite": "dist/hooks/post-rewrite.js",
+  "prim-pre-tool-use": "dist/hooks/pre-tool-use.js",
+  "prim-post-tool-use": "dist/hooks/post-tool-use.js",
+  "prim-session-start": "dist/hooks/session-start.js",
+  "prim-session-end": "dist/hooks/session-end.js",
+  "prim-daemon-server": "dist/daemon/server.js",
+  "prim-statusline": "dist/statusline-main.js"
+};
+var SOURCE_ENTRIES = Object.fromEntries(
+  Object.entries(HOOK_RUNTIME_ENTRIES).map(([bin, target]) => [
+    bin,
+    target.replace(/^dist\//u, "")
+  ])
+);
+var STABLE_HOOK_LAUNCHER_CONTENT = `#!/bin/sh
+set -eu
+case "$0" in */*) prim_launcher_dir=\${0%/*} ;; *) exit 78 ;; esac
+IFS= read -r prim_release_name < "$prim_launcher_dir/hook-runtime/current" || exit 69
+case "$prim_release_name" in ${RELEASE_PREFIX}*) ;; *) exit 69 ;; esac
+prim_release_id=\${prim_release_name#${RELEASE_PREFIX}}
+case "$prim_release_id" in *[!0-9a-f]*|"") exit 69 ;; esac
+[ "\${#prim_release_id}" -eq 64 ] || exit 69
+prim_release="$prim_launcher_dir/hook-runtime/releases/$prim_release_name"
+case "\${1-}" in
+${Object.entries(HOOK_RUNTIME_ENTRIES).map(([bin, entry]) => `  ${bin}) prim_entry="$prim_release/${entry}" ;;`).join("\n")}
+  *) exit 64 ;;
+esac
+shift
+IFS= read -r prim_node < "$prim_release/node" || exit 69
+case "$prim_node" in /*) ;; *) exit 69 ;; esac
+[ -x "$prim_node" ] && [ -f "$prim_entry" ] || exit 69
+exec "$prim_node" "$prim_entry" "$@"
+`;
+
+// src/commands/claude-install.ts
+import { existsSync as existsSync4, readFileSync as readFileSync5 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join7 } from "path";
+
+// src/lib/git.ts
+import { execFileSync } from "child_process";
+import { createHash as createHash4 } from "crypto";
+import { lstatSync as lstatSync2, realpathSync as realpathSync2 } from "fs";
+import { basename, dirname as dirname5, isAbsolute as isAbsolute4, relative, resolve as resolve2, sep } from "path";
+var GIT_TIMEOUT_MS = 1e3;
+var GITHUB_OWNER_PATTERN = /^(?![A-Za-z0-9-]*--)[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/u;
+var GITHUB_REPOSITORY_PATTERN = /^[A-Za-z0-9._-]{1,100}$/u;
+function gitToplevel(cwd) {
+  try {
+    return execFileSync("git", ["rev-parse", "--show-toplevel"], {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function gitValue(cwd, args) {
+  try {
+    const value = execFileSync("git", args, {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS
+    }).trim();
+    return value || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function githubRepositoryFullName(cwd) {
+  const remote = gitValue(cwd, ["config", "--get", "remote.origin.url"]);
+  if (!remote || [...remote].some((char) => char < " " || char === "\x7F")) return null;
+  const match = /^(?:git@github\.com:([^?#]+)|(?:https|ssh):\/\/(?:[^/@]+@)?github\.com(?::\d+)?\/([^?#]+))$/i.exec(
+    remote
+  );
+  const path = match?.[1] ?? match?.[2];
+  if (!path) return null;
+  const parts = path.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "").split("/");
+  if (parts.length !== 2 || !GITHUB_OWNER_PATTERN.test(parts[0] ?? "") || !GITHUB_REPOSITORY_PATTERN.test(parts[1] ?? "")) {
+    return null;
+  }
+  return `${parts[0]}/${parts[1]}`;
+}
+function normalizeOriginRemote(remote) {
+  const value = remote.trim();
+  if (!value) return void 0;
+  const scp = !value.includes("://") ? /^(?:[^@/\s]+@)?(?<host>[^:/\s]+):(?<path>.+)$/.exec(value)?.groups : void 0;
+  if (scp?.host && scp.path) {
+    const path = scp.path.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "");
+    return path ? `${scp.host.toLowerCase()}/${path}` : void 0;
+  }
+  try {
+    const url = new URL(value);
+    url.username = "";
+    url.password = "";
+    url.search = "";
+    url.hash = "";
+    const path = url.pathname.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "");
+    if (url.host && path) return `${url.host.toLowerCase()}/${path}`;
+    return void 0;
+  } catch {
+    return void 0;
+  }
+}
+function opaqueRepoKey(source, value) {
+  return `repo_v1_${createHash4("sha256").update(`${source}\0${value}`).digest("hex")}`;
+}
+function resolveRepositoryContext(cwd = process.cwd()) {
+  const top = gitToplevel(cwd);
+  if (!top) return null;
+  let repoRoot;
+  try {
+    repoRoot = realpathSync2.native(top);
+  } catch {
+    repoRoot = resolve2(top);
+  }
+  const origin = gitValue(repoRoot, ["config", "--get", "remote.origin.url"]);
+  const repoFullName = githubRepositoryFullName(repoRoot) ?? void 0;
+  const normalizedOrigin = origin ? normalizeOriginRemote(origin) : void 0;
+  if (normalizedOrigin) {
+    return {
+      repoRoot,
+      repoKey: opaqueRepoKey("origin", normalizedOrigin),
+      identitySource: "origin",
+      repoFullName
+    };
+  }
+  const roots = gitValue(repoRoot, ["rev-list", "--max-parents=0", "HEAD"])?.split(/\s+/).filter(Boolean).sort();
+  if (roots && roots.length > 0) {
+    return {
+      repoRoot,
+      repoKey: opaqueRepoKey("root_commit", roots.join("\n")),
+      identitySource: "root_commit",
+      repoFullName
+    };
+  }
+  return { repoRoot, repoFullName };
+}
+
+// src/commands/claude-install.ts
+var CAPTURE_BIN = "prim-hook";
+var GATE_BIN = "prim-pre-tool-use";
+var POST_TOOL_USE_BIN = "prim-post-tool-use";
+var SESSION_START_BIN = "prim-session-start";
+var SESSION_END_BIN = "prim-session-end";
+var STATUSLINE_BIN = "prim-statusline";
+var STATUSLINE_ARGS = "";
+var STATUSLINE_COMMAND = stableHookCommand(STATUSLINE_BIN, STATUSLINE_ARGS);
+var USER_SCOPE_PATH = join7(homedir2(), ".claude", "settings.json");
+function projectRoot() {
+  return gitToplevel() ?? process.cwd();
+}
+var CAPTURE_EVENTS = [
+  "SessionStart",
+  "UserPromptSubmit",
+  "PreToolUse",
+  "PostToolUse",
+  "PostToolUseFailure",
+  "Stop",
+  "SessionEnd",
+  "SubagentStop"
+];
+function makeRegistration(event, matcher, bin, args = "") {
+  return {
+    event,
+    matcher,
+    bin,
+    command: stableHookCommand(bin, args)
+  };
+}
+function makeDetachedRegistration(event, matcher, bin, args = "") {
+  return { event, matcher, bin, command: detachedHookShimCommand(bin, args) };
+}
+var REGISTRATIONS = [
+  ...CAPTURE_EVENTS.map(
+    (event) => event === "SessionEnd" ? makeDetachedRegistration(event, "*", CAPTURE_BIN) : makeRegistration(event, "*", CAPTURE_BIN)
+  ),
+  makeRegistration("PreToolUse", "Edit|Write|MultiEdit|NotebookEdit|Bash", GATE_BIN),
+  makeRegistration("PostToolUse", "Edit|Write|MultiEdit|NotebookEdit|Bash", POST_TOOL_USE_BIN),
+  makeRegistration(
+    "PostToolUseFailure",
+    "Edit|Write|MultiEdit|NotebookEdit|Bash",
+    POST_TOOL_USE_BIN
+  ),
+  makeRegistration("SessionStart", "*", SESSION_START_BIN),
+  makeDetachedRegistration("SessionEnd", "*", SESSION_END_BIN)
+];
+var PRIM_PERMISSION_RULE = "Bash(npx --yes @primitive.ai/prim*)";
+var LEGACY_PRIM_PERMISSION_RULES = [
+  "Bash(npx --yes @primitive.ai/prim@latest:*)",
+  "Bash(npx --yes @primitive.ai/prim:*)"
+];
+var ALL_PRIM_PERMISSION_RULES = /* @__PURE__ */ new Set([
+  PRIM_PERMISSION_RULE,
+  ...LEGACY_PRIM_PERMISSION_RULES
+]);
+
+// src/commands/cursor-install.ts
+var CAPTURE_BIN2 = "prim-hook";
+var GATE_BIN2 = "prim-pre-tool-use";
+var POST_TOOL_BIN = "prim-post-tool-use";
+var SESSION_START_BIN2 = "prim-session-start";
+var SESSION_END_BIN2 = "prim-session-end";
+var STATUSLINE_BIN2 = "prim-statusline";
+var CURSOR_EVENTS = [
+  "sessionStart",
+  "beforeSubmitPrompt",
+  "preToolUse",
+  "postToolUse",
+  "postToolUseFailure",
+  "afterAgentResponse",
+  "subagentStop",
+  "stop",
+  "sessionEnd"
+];
+var REGISTRATIONS2 = [
+  ...CURSOR_EVENTS.map((event) => ({ event, bin: CAPTURE_BIN2 })),
+  { event: "preToolUse", bin: GATE_BIN2, matcher: "Write|Delete|Shell", timeout: 10 },
+  { event: "postToolUse", bin: POST_TOOL_BIN },
+  { event: "postToolUseFailure", bin: POST_TOOL_BIN },
+  { event: "sessionStart", bin: SESSION_START_BIN2 },
+  { event: "sessionEnd", bin: SESSION_END_BIN2 }
+];
+function cursorConfigDirectory(env = process.env, home = homedir3(), platform = process.platform) {
+  const explicit = env.CURSOR_CONFIG_DIR?.trim();
+  if (explicit && isAbsolute5(explicit)) return explicit;
+  const xdg = env.XDG_CONFIG_HOME?.trim();
+  if (platform !== "darwin" && xdg && isAbsolute5(xdg)) return join8(xdg, "cursor");
+  return join8(home, ".cursor");
+}
+function cursorHooksPath(scope, root = projectRoot()) {
+  return scope === "user" ? join8(cursorConfigDirectory(), "hooks.json") : join8(root, ".cursor", "hooks.json");
+}
+function plainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readCursorHooks(path) {
+  if (!existsSync5(path)) return {};
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync6(path, "utf8"));
+  } catch {
+    throw new Error(`invalid Cursor hooks JSON at ${path}`);
+  }
+  if (!plainObject(parsed)) throw new Error(`Cursor hooks config must be an object: ${path}`);
+  if (parsed.version !== void 0 && parsed.version !== 1) {
+    throw new Error(`unsupported Cursor hooks version at ${path} (expected version 1)`);
+  }
+  if (parsed.hooks !== void 0) {
+    if (!plainObject(parsed.hooks)) throw new Error(`Cursor hooks must be an object: ${path}`);
+    for (const [event, entries] of Object.entries(parsed.hooks)) {
+      if (!Array.isArray(entries) || !entries.every(plainObject)) {
+        throw new Error(`Cursor hook list must contain objects: ${event} in ${path}`);
+      }
+    }
+  }
+  return parsed;
+}
+function commandFor(registration, scope) {
+  return stableHookCommand(
+    registration.bin,
+    `--agent cursor --event ${registration.event} --scope ${scope}`
+  );
+}
+var OWNED_COMMANDS = new Set(
+  ["project", "user"].flatMap(
+    (scope) => REGISTRATIONS2.map((registration) => commandFor(registration, scope))
+  )
+);
+function jsoncUnsafeCommand(command) {
+  return command.replace('case "$1" in [/]* ', 'case "$1" in /*').replace("*[/][/]*", "*//*").replace("*[/].[/]*", "*/./*").replace("*[/]..[/]*", "*/../*").replace("*[/].", "*/.").replace("*[/]..", "*/..").replace("?*[/]", "?*/");
+}
+var JSONC_UNSAFE_OWNED_COMMANDS = new Set([...OWNED_COMMANDS].map(jsoncUnsafeCommand));
+function hookFor(registration, scope) {
+  return {
+    command: commandFor(registration, scope),
+    ...registration.matcher ? { matcher: registration.matcher } : {},
+    ...registration.timeout ? { timeout: registration.timeout } : {}
+  };
+}
+function exactHook(entry, registration, scope) {
+  return JSON.stringify(entry) === JSON.stringify(hookFor(registration, scope));
+}
+function hasExactCursorHandler(settings, event, bin, scope) {
+  const registration = REGISTRATIONS2.find(
+    (candidate) => candidate.event === event && candidate.bin === bin
+  );
+  return registration ? (settings.hooks?.[event] ?? []).some((entry) => exactHook(entry, registration, scope)) : false;
+}
+var FOOTER = {
+  type: "command",
+  command: stableHookCommand(STATUSLINE_BIN2),
+  updateIntervalMs: 1e3,
+  timeoutMs: 2e3
+};
+var JSONC_UNSAFE_FOOTER = {
+  ...FOOTER,
+  command: jsoncUnsafeCommand(FOOTER.command)
+};
+
+// src/hooks/cursor-coexistence.ts
+var CURSOR_EVENTS2 = /* @__PURE__ */ new Set([
+  "sessionStart",
+  "beforeSubmitPrompt",
+  "preToolUse",
+  "postToolUse",
+  "postToolUseFailure",
+  "afterAgentResponse",
+  "subagentStop",
+  "stop",
+  "sessionEnd"
+]);
+function cursorEvidence(parsed) {
+  return typeof parsed.cursor_version === "string" && parsed.cursor_version.length > 0 && typeof parsed.conversation_id === "string" && parsed.conversation_id.length > 0 && typeof parsed.generation_id === "string" && parsed.generation_id.length > 0 && Array.isArray(parsed.workspace_roots) && typeof parsed.hook_event_name === "string" && CURSOR_EVENTS2.has(parsed.hook_event_name);
+}
+function uniqueProjectRoot(parsed) {
+  if (!Array.isArray(parsed.workspace_roots)) return;
+  const roots = new Set(
+    parsed.workspace_roots.filter((value) => typeof value === "string" && value.length > 0).map((value) => resolveRepositoryContext(value)?.repoRoot).filter((value) => !!value)
+  );
+  return roots.size === 1 ? [...roots][0] : void 0;
+}
+function shouldSuppressImportedCursorHandler(parsed, bin) {
+  if (!cursorEvidence(parsed)) return false;
+  const project = uniqueProjectRoot(parsed);
+  if (project) {
+    try {
+      if (hasExactCursorHandler(
+        readCursorHooks(cursorHooksPath("project", project)),
+        parsed.hook_event_name,
+        bin,
+        "project"
+      )) {
+        return true;
+      }
+    } catch {
+    }
+  }
+  try {
+    return hasExactCursorHandler(
+      readCursorHooks(cursorHooksPath("user")),
+      parsed.hook_event_name,
+      bin,
+      "user"
+    );
+  } catch {
+    return false;
+  }
+}
+
+// src/hooks/hook-stdin.ts
+var DEFAULT_MAX_BYTES = 1024 * 1024;
+function readHookStdin(timeoutMs = 1e3, maxBytes = DEFAULT_MAX_BYTES) {
+  return new Promise((resolve4, reject) => {
+    const chunks = [];
+    let bytes = 0;
+    let settled = false;
+    const finish = (error) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      process.stdin.removeAllListeners("data");
+      process.stdin.removeAllListeners("end");
+      process.stdin.removeAllListeners("error");
+      if (error) reject(error);
+      else resolve4(Buffer.concat(chunks, bytes).toString("utf-8"));
+    };
+    const timer = setTimeout(() => finish(new Error("stdin read timeout")), timeoutMs);
+    process.stdin.on("data", (chunk) => {
+      bytes += chunk.length;
+      if (bytes > maxBytes) {
+        finish(new Error("stdin envelope exceeds size limit"));
+        return;
+      }
+      chunks.push(chunk);
+    });
+    process.stdin.on("end", () => finish());
+    process.stdin.on("error", (error) => finish(error));
+  });
+}
+
+// src/hooks/normalize.ts
+import { createHash as createHash5 } from "crypto";
+import { realpathSync as realpathSync3 } from "fs";
+import { isAbsolute as isAbsolute6, resolve as resolve3 } from "path";
+var HERMES_EVENT_MAP = {
+  on_session_start: "SessionStart",
+  on_session_end: "SessionEnd",
+  pre_llm_call: "UserPromptSubmit",
+  post_llm_call: "Stop",
+  pre_tool_call: "PreToolUse",
+  post_tool_call: "PostToolUse",
+  subagent_stop: "SubagentStop"
+};
+var CURSOR_EVENT_MAP = {
+  sessionStart: "SessionStart",
+  beforeSubmitPrompt: "UserPromptSubmit",
+  preToolUse: "PreToolUse",
+  postToolUse: "PostToolUse",
+  postToolUseFailure: "PostToolUseFailure",
+  afterAgentResponse: "AssistantResponse",
+  subagentStop: "SubagentStop",
+  stop: "Stop",
+  sessionEnd: "SessionEnd"
+};
+var CURSOR_TOOL_EVENTS = /* @__PURE__ */ new Set(["PreToolUse", "PostToolUse", "PostToolUseFailure"]);
+var SAFE_CORRELATION_ID_RE = /^[A-Za-z0-9._:-]{1,128}$/u;
+var CURSOR_LOCAL_ONLY_FIELDS = /* @__PURE__ */ new Set([
+  "conversation_id",
+  "generation_id",
+  "user_email",
+  "account_email",
+  "transcript_path",
+  "transcript",
+  "thought",
+  "thoughts",
+  "thinking",
+  "tool_output"
+]);
+function requiredId(value, field) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new TypeError(`Cursor hook envelope is missing ${field}`);
+  }
+  return value;
+}
+function cursorToolUseId(value) {
+  if (SAFE_CORRELATION_ID_RE.test(value)) return value;
+  return `cursor:tool:v1:${createHash5("sha256").update(value).digest("hex")}`;
+}
+function workspaceCandidates(value) {
+  if (!Array.isArray(value)) return [];
+  const roots = value.filter((item) => typeof item === "string" && item.length > 0);
+  if (roots.some((root) => !isAbsolute6(root))) {
+    throw new TypeError("Cursor workspace roots must be absolute");
+  }
+  return roots;
+}
+function pathIdentity(path) {
+  try {
+    return realpathSync3.native(path);
+  } catch {
+    return resolve3(path);
+  }
+}
+function resolveCursorCwd(parsed) {
+  const roots = workspaceCandidates(parsed.workspace_roots).map(pathIdentity);
+  const rootRepositories = roots.map((root) => resolveRepositoryContext(root)?.repoRoot);
+  const repositoryRoots = new Set(rootRepositories.filter((root) => !!root));
+  if (repositoryRoots.size > 1) {
+    throw new TypeError("Cursor hook envelope spans multiple repositories");
+  }
+  if (roots.length > 1 && rootRepositories.some((root) => root === void 0)) {
+    throw new TypeError("Cursor hook envelope has ambiguous workspace roots");
+  }
+  const expectedRepo = [...repositoryRoots][0];
+  const rawCwd = typeof parsed.cwd === "string" && parsed.cwd.length > 0 ? parsed.cwd : void 0;
+  if (rawCwd && !isAbsolute6(rawCwd)) {
+    throw new TypeError("Cursor hook cwd must be absolute");
+  }
+  const envelopeCwd = rawCwd ? pathIdentity(rawCwd) : void 0;
+  const input = typeof parsed.tool_input === "object" && parsed.tool_input !== null && !Array.isArray(parsed.tool_input) ? parsed.tool_input : void 0;
+  const rawToolCwd = parsed.tool_name === "Shell" && typeof input?.working_directory === "string" ? input.working_directory : void 0;
+  const base = envelopeCwd ?? (roots.length === 1 ? roots[0] : expectedRepo);
+  if (rawToolCwd && !isAbsolute6(rawToolCwd) && !base) {
+    throw new TypeError("relative Cursor tool cwd has no workspace base");
+  }
+  const toolCwd = rawToolCwd ? pathIdentity(isAbsolute6(rawToolCwd) ? rawToolCwd : resolve3(base, rawToolCwd)) : void 0;
+  const selected = toolCwd ?? envelopeCwd ?? (roots.length === 1 ? roots[0] : expectedRepo);
+  if (!selected) {
+    throw new TypeError("Cursor hook envelope has no unambiguous workspace");
+  }
+  const selectedRepo = resolveRepositoryContext(selected)?.repoRoot;
+  if (expectedRepo && selectedRepo !== expectedRepo) {
+    throw new TypeError("Cursor hook cwd conflicts with workspace repository");
+  }
+  return selected;
+}
+function normalizeCursorEnvelope(parsed) {
+  const rawEvent = requiredId(parsed.hook_event_name, "hook_event_name");
+  const event = CURSOR_EVENT_MAP[rawEvent];
+  if (!event) throw new TypeError(`unsupported Cursor hook event: ${rawEvent}`);
+  const sessionId = requiredId(parsed.conversation_id, "conversation_id");
+  const turnId = requiredId(parsed.generation_id, "generation_id");
+  if (parsed.session_id !== void 0 && parsed.session_id !== sessionId) {
+    throw new TypeError("Cursor conversation_id conflicts with session_id");
+  }
+  if (parsed.turn_id !== void 0 && parsed.turn_id !== turnId) {
+    throw new TypeError("Cursor generation_id conflicts with turn_id");
+  }
+  const rawToolUseId = CURSOR_TOOL_EVENTS.has(event) ? requiredId(parsed.tool_use_id, "tool_use_id") : void 0;
+  const normalized = {
+    ...Object.fromEntries(
+      Object.entries(parsed).filter(([key]) => !CURSOR_LOCAL_ONLY_FIELDS.has(key))
+    ),
+    hook_event_name: event,
+    session_id: sessionId,
+    turn_id: turnId,
+    cwd: resolveCursorCwd(parsed),
+    ...rawToolUseId === void 0 ? {} : { tool_use_id: cursorToolUseId(rawToolUseId) }
+  };
+  if (typeof parsed.tool_output === "string") {
+    try {
+      normalized.tool_response = JSON.parse(parsed.tool_output);
+    } catch {
+      normalized.tool_response = parsed.tool_output;
+    }
+  }
+  return normalized;
+}
+function normalizeEnvelope(parsed, agent) {
+  if (agent === "cursor") {
+    return normalizeCursorEnvelope(parsed);
+  }
+  if (agent === "codex") {
+    const event = parsed.hook_event_name;
+    if ((event === "PreToolUse" || event === "PostToolUse") && (typeof parsed.tool_use_id !== "string" || parsed.tool_use_id.length === 0)) {
+      const stableToolIdentity = JSON.stringify([
+        parsed.session_id ?? null,
+        parsed.turn_id ?? null,
+        parsed.tool_name ?? null,
+        parsed.tool_input ?? null
+      ]);
+      return {
+        ...parsed,
+        tool_use_id: `codex:fallback:v1:${createHash5("sha256").update(stableToolIdentity).digest("hex")}`
+      };
+    }
+    return parsed;
+  }
+  if (agent !== "hermes") {
+    return parsed;
+  }
+  const raw = parsed.hook_event_name;
+  if (typeof raw === "string" && raw in HERMES_EVENT_MAP) {
+    return { ...parsed, hook_event_name: HERMES_EVENT_MAP[raw] };
+  }
+  return parsed;
+}
+
+// src/hooks/session-end.ts
+var STDIN_TIMEOUT_MS = 1e3;
+var DAEMON_TIMEOUT_MS = 250;
+function emit() {
+  process.stdout.write("{}\n");
+}
+async function main() {
+  const agent = parseAgent(process.argv);
+  let raw;
+  try {
+    raw = await readHookStdin(STDIN_TIMEOUT_MS);
+  } catch {
+    emit();
+    return;
+  }
+  let envelope;
+  try {
+    const incoming = JSON.parse(raw);
+    if (agent !== "cursor" && shouldSuppressImportedCursorHandler(incoming, "prim-session-end")) {
+      emit();
+      return;
+    }
+    envelope = normalizeEnvelope(incoming, agent);
+  } catch {
+    emit();
+    return;
+  }
+  if (envelope.hook_event_name !== "SessionEnd") {
+    emit();
+    return;
+  }
+  if (typeof envelope.session_id !== "string" || envelope.session_id.length === 0) {
+    emit();
+    return;
+  }
+  await daemonRequest(
+    "session_end",
+    { sessionId: envelope.session_id },
+    { timeoutMs: DAEMON_TIMEOUT_MS }
+  );
+  emit();
+}
+main().catch(() => {
+  emit();
+});