@primitive.ai/prim 0.1.0-alpha.9 → 0.1.0-alpha.91

package/dist/hooks/post-commit.js

@@ -0,0 +1,190 @@
+#!/usr/bin/env node
+import {
+  commitAttributionFromEnvironment,
+  toCommitMove
+} from "../chunk-NAHHFSLH.js";
+import {
+  getOrCreateWorkspaceId
+} from "../chunk-EZXEWFDG.js";
+import {
+  appendMove,
+  resolveOrg
+} from "../chunk-FBAYCS3X.js";
+import "../chunk-OAAP2MY6.js";
+import "../chunk-BTNNEH2W.js";
+import {
+  cachedCollectScopeAdmits,
+  isRepoActiveForCapture,
+  repoSyncId
+} from "../chunk-M6RIJVRE.js";
+import "../chunk-PCVGBE5B.js";
+import {
+  githubRepositoryFullName,
+  resolveRepositoryContext
+} from "../chunk-H4UNYFUC.js";
+import "../chunk-67VNLLBN.js";
+
+// src/hooks/post-commit.ts
+import { execFileSync, spawn } from "child_process";
+import { lstatSync, readFileSync } from "fs";
+import { basename, dirname, isAbsolute, join } from "path";
+import { fileURLToPath } from "url";
+var here = dirname(fileURLToPath(import.meta.url));
+var GIT_TIMEOUT_MS = 1e3;
+var FULL_SHA_RE = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/u;
+var OBSERVATION_MARKER_RE = /^prim-post-commit-observed\.[A-Za-z0-9]+$/u;
+var MAX_OBSERVATION_MARKER_AGE_MS = 10 * 60 * 1e3;
+var MAX_OBSERVATION_MARKER_FUTURE_SKEW_MS = 5e3;
+function capturedAtFromLauncher(env = process.env, now = Date.now()) {
+  const path = env.PRIM_COMMIT_OBSERVED_FILE;
+  if (!path || !isAbsolute(path) || !OBSERVATION_MARKER_RE.test(basename(path))) return;
+  try {
+    const stat = lstatSync(path);
+    const capturedAt = Math.trunc(stat.mtimeMs);
+    const uid = process.getuid?.();
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size !== 0 || stat.nlink !== 1 || (stat.mode & 63) !== 0 || uid !== void 0 && stat.uid !== uid || !Number.isSafeInteger(capturedAt) || capturedAt <= 0 || capturedAt < now - MAX_OBSERVATION_MARKER_AGE_MS || capturedAt > now + MAX_OBSERVATION_MARKER_FUTURE_SKEW_MS) {
+      return;
+    }
+    return capturedAt;
+  } catch {
+    return;
+  }
+}
+function gitText(args) {
+  try {
+    return execFileSync("git", args, {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS
+    }).trim();
+  } catch {
+    return;
+  }
+}
+function gitBytes(args) {
+  try {
+    return execFileSync("git", args, {
+      encoding: "buffer",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS
+    });
+  } catch {
+    return;
+  }
+}
+function parseNulPaths(value) {
+  if (value.length === 0) return { files: [], complete: true };
+  const chunks = [];
+  let start = 0;
+  for (let i = 0; i < value.length; i += 1) {
+    if (value[i] !== 0) continue;
+    chunks.push(value.subarray(start, i));
+    start = i + 1;
+  }
+  if (start !== value.length || chunks.some((chunk) => chunk.length === 0)) {
+    return { files: [], complete: false };
+  }
+  const files = [];
+  for (const chunk of chunks) {
+    const file = chunk.toString("utf8");
+    if (!Buffer.from(file, "utf8").equals(chunk)) {
+      return { files: [], complete: false };
+    }
+    files.push(file);
+  }
+  return { files: [...new Set(files)], complete: true };
+}
+function readCommit() {
+  const snapshotProvided = process.env.PRIM_COMMIT_SHA !== void 0;
+  const sha = snapshotProvided ? process.env.PRIM_COMMIT_SHA : gitText(["rev-parse", "HEAD"]);
+  if (!sha || !FULL_SHA_RE.test(sha)) {
+    return null;
+  }
+  const rawBranch = process.env.PRIM_COMMIT_BRANCH !== void 0 ? process.env.PRIM_COMMIT_BRANCH : gitText(["rev-parse", "--abbrev-ref", "HEAD"]);
+  const branch = rawBranch && rawBranch === rawBranch.trim() && ![...rawBranch].some((char) => char < " " || char === "\x7F") ? rawBranch : void 0;
+  const rawFiles = gitBytes([
+    "diff-tree",
+    "--no-commit-id",
+    "--name-only",
+    "-z",
+    "-r",
+    "-m",
+    "--root",
+    sha
+  ]);
+  const { files, complete } = rawFiles === void 0 ? { files: [], complete: false } : parseNulPaths(rawFiles);
+  return {
+    sha,
+    parentSha: gitText(["rev-parse", "--verify", "--quiet", `${sha}^`]) || void 0,
+    branch: branch && branch !== "HEAD" ? branch : void 0,
+    files,
+    filesComplete: complete
+  };
+}
+function resolveCliVersion() {
+  try {
+    const pkg = JSON.parse(readFileSync(join(here, "..", "..", "package.json"), "utf-8"));
+    return pkg.version ?? "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+function spawnBackgroundFlush() {
+  const entry = join(here, "..", "index.js");
+  spawn(process.execPath, [entry, "moves", "flush"], {
+    detached: true,
+    stdio: "ignore"
+  }).unref();
+}
+function runPostCommit() {
+  const cwd = gitText(["rev-parse", "--show-toplevel"]) ?? process.cwd();
+  if (!isRepoActiveForCapture(cwd)) {
+    return;
+  }
+  const capturedAt = capturedAtFromLauncher();
+  if (process.env.PRIM_COMMIT_OBSERVED_FILE !== void 0 && capturedAt === void 0) {
+    return;
+  }
+  const commit = readCommit();
+  if (commit) {
+    const repositoryFullName = githubRepositoryFullName(cwd) ?? void 0;
+    if (!cachedCollectScopeAdmits(cwd, {
+      repository: repositoryFullName,
+      branch: commit.branch,
+      ...commit.files.length > 0 || !commit.filesComplete ? { paths: commit.files, pathsComplete: commit.filesComplete } : {}
+    })) {
+      return;
+    }
+    const repository = resolveRepositoryContext(cwd);
+    const identity = getOrCreateWorkspaceId(cwd);
+    const workspaceId = identity.status === "ready" ? identity.workspaceId : void 0;
+    const attribution = commitAttributionFromEnvironment(process.env, workspaceId);
+    const move = toCommitMove(commit, resolveCliVersion(), cwd, {
+      repository,
+      repoFullName: repositoryFullName,
+      repoSyncId: repoSyncId(cwd),
+      workspaceId,
+      attribution,
+      ...capturedAt === void 0 ? {} : { capturedAt }
+    });
+    const { orgId } = resolveOrg({ sessionId: move.sessionId, cwd });
+    appendMove(move, orgId);
+    spawnBackgroundFlush();
+  }
+}
+if (!process.env.VITEST) {
+  try {
+    runPostCommit();
+  } catch (err) {
+    if (process.env.PRIM_HOOK_DEBUG) {
+      const detail = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`[prim-post-commit] capture failed: ${detail}
+`);
+    }
+  }
+  process.exit(0);
+}
+export {
+  capturedAtFromLauncher,
+  runPostCommit
+};

package/dist/hooks/post-rewrite.js

@@ -0,0 +1,203 @@
+#!/usr/bin/env node
+import {
+  canonicalRewritePairs,
+  toRewriteMove
+} from "../chunk-NAHHFSLH.js";
+import {
+  getOrCreateWorkspaceId
+} from "../chunk-EZXEWFDG.js";
+import {
+  appendMove,
+  resolveOrg
+} from "../chunk-FBAYCS3X.js";
+import "../chunk-OAAP2MY6.js";
+import "../chunk-BTNNEH2W.js";
+import {
+  cachedCollectScopeAdmits,
+  isRepoActiveForCapture,
+  repoSyncId
+} from "../chunk-M6RIJVRE.js";
+import "../chunk-PCVGBE5B.js";
+import {
+  githubRepositoryFullName,
+  resolveRepositoryContext
+} from "../chunk-H4UNYFUC.js";
+import "../chunk-67VNLLBN.js";
+
+// src/hooks/post-rewrite.ts
+import { execFileSync, spawn } from "child_process";
+import {
+  constants,
+  closeSync,
+  fstatSync,
+  lstatSync,
+  openSync,
+  readFileSync,
+  unlinkSync
+} from "fs";
+import { basename, dirname, isAbsolute, join } from "path";
+import { fileURLToPath } from "url";
+var here = dirname(fileURLToPath(import.meta.url));
+var GIT_TIMEOUT_MS = 1e3;
+var MAX_PAIRS_FILE_BYTES = 1048576;
+var MAX_PAIRS_FILE_AGE_MS = 10 * 60 * 1e3;
+var MAX_PAIRS_FILE_FUTURE_SKEW_MS = 5e3;
+var PAIRS_FILE_RE = /^prim-post-rewrite-pairs\.[A-Za-z0-9]+$/u;
+var FULL_SHA_SOURCE = "(?:[0-9a-fA-F]{40}|[0-9a-fA-F]{64})";
+var REWRITE_PAIR_RE = new RegExp(
+  `^(${FULL_SHA_SOURCE}) (${FULL_SHA_SOURCE})(?: ([^\\s]+))?$`,
+  "u"
+);
+function parseRewritePairs(value) {
+  if (value.length === 0) return [];
+  const body = value.endsWith("\n") ? value.slice(0, -1) : value;
+  if (body.length === 0) return [];
+  const parsed = [];
+  for (const line of body.split("\n")) {
+    const match = REWRITE_PAIR_RE.exec(line);
+    if (!match?.[1] || !match[2]) return;
+    parsed.push({ oldSha: match[1], newSha: match[2] });
+  }
+  return canonicalRewritePairs(parsed) ?? void 0;
+}
+function privatePairsFileStat(stat, now) {
+  const capturedAt = Math.trunc(stat.mtimeMs);
+  const uid = process.getuid?.();
+  return stat.isFile() && !stat.isSymbolicLink() && stat.size <= MAX_PAIRS_FILE_BYTES && stat.nlink === 1 && (stat.mode & 511) === 384 && (uid === void 0 || stat.uid === uid) && Number.isSafeInteger(capturedAt) && capturedAt > 0 && capturedAt >= now - MAX_PAIRS_FILE_AGE_MS && capturedAt <= now + MAX_PAIRS_FILE_FUTURE_SKEW_MS;
+}
+function rewritePairsFromLauncher(env = process.env, now = Date.now()) {
+  const path = env.PRIM_REWRITE_PAIRS_FILE;
+  if (!path || !isAbsolute(path) || !PAIRS_FILE_RE.test(basename(path))) return;
+  let fd;
+  try {
+    const pathStat = lstatSync(path);
+    if (!privatePairsFileStat(pathStat, now)) return;
+    fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    const openStat = fstatSync(fd);
+    if (!privatePairsFileStat(openStat, now) || openStat.dev !== pathStat.dev || openStat.ino !== pathStat.ino) {
+      return;
+    }
+    const bytes = readFileSync(fd);
+    if (bytes.length !== openStat.size) return;
+    let text;
+    try {
+      text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    } catch {
+      return;
+    }
+    const pairs = parseRewritePairs(text);
+    if (!pairs) return;
+    return {
+      path,
+      dev: openStat.dev,
+      ino: openStat.ino,
+      capturedAt: Math.trunc(openStat.mtimeMs),
+      pairs
+    };
+  } catch {
+    return;
+  } finally {
+    if (fd !== void 0) {
+      try {
+        closeSync(fd);
+      } catch {
+      }
+    }
+  }
+}
+function unlinkSnapshot(snapshot) {
+  try {
+    const current = lstatSync(snapshot.path);
+    if (current.isFile() && !current.isSymbolicLink() && current.dev === snapshot.dev && current.ino === snapshot.ino) {
+      unlinkSync(snapshot.path);
+    }
+  } catch {
+  }
+}
+function gitText(args) {
+  try {
+    return execFileSync("git", args, {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS
+    }).trim();
+  } catch {
+    return;
+  }
+}
+function validSource(value) {
+  return value === "amend" || value === "rebase";
+}
+function validBranch(value) {
+  return value && value === value.trim() && ![...value].some((char) => char < " " || char === "\x7F") ? value : void 0;
+}
+function resolveCliVersion() {
+  try {
+    const pkg = JSON.parse(readFileSync(join(here, "..", "..", "package.json"), "utf-8"));
+    return pkg.version ?? "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+function spawnBackgroundFlush() {
+  const entry = join(here, "..", "index.js");
+  spawn(process.execPath, [entry, "moves", "flush"], {
+    detached: true,
+    stdio: "ignore"
+  }).unref();
+}
+function runPostRewrite() {
+  const snapshot = rewritePairsFromLauncher();
+  if (!snapshot) return;
+  try {
+    const source = process.env.PRIM_REWRITE_SOURCE;
+    if (!validSource(source) || snapshot.pairs.length === 0) return;
+    const cwd = gitText(["rev-parse", "--show-toplevel"]) ?? process.cwd();
+    if (!isRepoActiveForCapture(cwd)) return;
+    const branch = validBranch(process.env.PRIM_REWRITE_BRANCH);
+    const repositoryFullName = githubRepositoryFullName(cwd) ?? void 0;
+    if (!cachedCollectScopeAdmits(cwd, { repository: repositoryFullName, branch })) return;
+    const repository = resolveRepositoryContext(cwd);
+    const identity = getOrCreateWorkspaceId(cwd);
+    const workspaceId = identity.status === "ready" ? identity.workspaceId : void 0;
+    const moves = toRewriteMove(
+      {
+        source,
+        pairs: snapshot.pairs,
+        branch
+      },
+      resolveCliVersion(),
+      cwd,
+      {
+        repository,
+        repoFullName: repositoryFullName,
+        repoSyncId: repoSyncId(cwd),
+        workspaceId,
+        capturedAt: snapshot.capturedAt
+      }
+    );
+    if (moves.length === 0) return;
+    const { orgId } = resolveOrg({ sessionId: "", cwd });
+    for (const move of moves) appendMove(move, orgId);
+    spawnBackgroundFlush();
+  } finally {
+    unlinkSnapshot(snapshot);
+  }
+}
+if (!process.env.VITEST) {
+  try {
+    runPostRewrite();
+  } catch (error) {
+    if (process.env.PRIM_HOOK_DEBUG) {
+      const detail = error instanceof Error ? error.message : String(error);
+      process.stderr.write(`[prim-post-rewrite] capture failed: ${detail}
+`);
+    }
+  }
+  process.exit(0);
+}
+export {
+  parseRewritePairs,
+  rewritePairsFromLauncher,
+  runPostRewrite
+};

package/dist/hooks/post-tool-use.js

@@ -0,0 +1,288 @@
+#!/usr/bin/env node
+import {
+  requireDurableIngestAcknowledgement
+} from "../chunk-FKXFUUWJ.js";
+import {
+  enrichHookPayloadWithFileRefs,
+  preserveHookFileMetadata
+} from "../chunk-LFFLHSQO.js";
+import {
+  postToolInvocationId,
+  toMove,
+  toolOutcomeFor
+} from "../chunk-NAHHFSLH.js";
+import {
+  getOrCreateWorkspaceId
+} from "../chunk-EZXEWFDG.js";
+import {
+  appendMove,
+  resolveOrg
+} from "../chunk-FBAYCS3X.js";
+import "../chunk-ZB4F75SZ.js";
+import {
+  appendCodexContext,
+  prepareCodexContext
+} from "../chunk-VW3FDYRT.js";
+import "../chunk-WX52U7Z2.js";
+import {
+  scrubFromCwd
+} from "../chunk-OAAP2MY6.js";
+import {
+  bold,
+  color
+} from "../chunk-BTNNEH2W.js";
+import {
+  cachedCollectScopeAdmits,
+  isRepoActiveForCapture,
+  repoSyncId
+} from "../chunk-M6RIJVRE.js";
+import {
+  getClient,
+  terminalSafeLine
+} from "../chunk-PCVGBE5B.js";
+import {
+  normalizeEnvelope,
+  parseAgent,
+  readHookStdin,
+  shouldSuppressImportedCursorHandler
+} from "../chunk-HU4PW6I6.js";
+import "../chunk-EWZMDD44.js";
+import {
+  currentBranch,
+  resolveRepositoryContext
+} from "../chunk-H4UNYFUC.js";
+import "../chunk-KFXF2V5G.js";
+import "../chunk-67VNLLBN.js";
+
+// src/hooks/post-tool-use.ts
+import { readFileSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+
+// src/hooks/post-tool-delivery.ts
+var INGEST_TIMEOUT_MS = 4e3;
+async function deliverPostToolMove(move, orgId) {
+  appendMove(move, orgId);
+  const response = await getClient().post(
+    "/api/cli/moves/ingest",
+    { batch: [move] },
+    { signal: AbortSignal.timeout(INGEST_TIMEOUT_MS) }
+  );
+  return requireDurableIngestAcknowledgement(response, 1, move.env.gitRoot ?? move.env.cwd);
+}
+
+// src/hooks/verdict-footer.ts
+function renderVerdictFooter(ctx) {
+  const successPrefix = color("\u2713 Conflict caught before merge", "green");
+  const savedCount = `${String(ctx.decisionsSaved)}${ctx.decisionsSavedTruncated ? "+" : ""}`;
+  const savedFragment = `${savedCount} decisions saved`;
+  const intentFragment = `${bold(terminalSafeLine(ctx.author))}'s intent preserved`;
+  return `${successPrefix} \xB7 ${savedFragment} \xB7 ${intentFragment}`;
+}
+function isVerdictFooterContext(value) {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const v = value;
+  return typeof v.author === "string" && typeof v.intent === "string" && typeof v.decisionsSaved === "number" && typeof v.decisionsSavedTruncated === "boolean" && typeof v.decisionId === "string";
+}
+
+// src/hooks/post-tool-use.ts
+var STDIN_TIMEOUT_MS = 1e3;
+var EDITING_TOOLS = /* @__PURE__ */ new Set(["Edit", "Write", "MultiEdit", "NotebookEdit", "Bash"]);
+var CODEX_EDITING_TOOLS = /* @__PURE__ */ new Set(["apply_patch", "Bash"]);
+var HERMES_EDITING_TOOLS = /* @__PURE__ */ new Set(["write_file", "patch"]);
+var CURSOR_EDITING_TOOLS = /* @__PURE__ */ new Set(["Write", "Delete", "Shell"]);
+function editingToolsFor(agent) {
+  if (agent === "codex") {
+    return CODEX_EDITING_TOOLS;
+  }
+  if (agent === "hermes") {
+    return HERMES_EDITING_TOOLS;
+  }
+  if (agent === "cursor") {
+    return CURSOR_EDITING_TOOLS;
+  }
+  return EDITING_TOOLS;
+}
+var here = dirname(fileURLToPath(import.meta.url));
+function resolveCliVersion() {
+  try {
+    const pkg = JSON.parse(readFileSync(join(here, "..", "..", "package.json"), "utf-8"));
+    return pkg.version ?? "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+async function emit(output = {}) {
+  return await new Promise((resolve) => {
+    try {
+      process.stdout.write(`${JSON.stringify(output)}
+`, (error) => resolve(!error));
+    } catch {
+      resolve(false);
+    }
+  });
+}
+async function emitWithAcknowledgment(output, acknowledge) {
+  const handedOff = await emit(output);
+  await acknowledge?.(handedOff);
+}
+async function emitCursorContext(envelope) {
+  if (typeof envelope.session_id !== "string" || envelope.session_id.length === 0 || typeof envelope.cwd !== "string" || envelope.cwd.length === 0) {
+    await emit();
+    return;
+  }
+  try {
+    const context = await prepareCodexContext({
+      cwd: envelope.cwd,
+      sessionId: envelope.session_id,
+      includeDigest: true,
+      namespace: "cursor"
+    });
+    await emitWithAcknowledgment(
+      context.context ? { additional_context: context.context } : {},
+      context.acknowledge
+    );
+  } catch {
+    await emit();
+  }
+}
+async function finish(agent, envelope) {
+  if (agent === "cursor" && envelope) await emitCursorContext(envelope);
+  else await emit();
+}
+function debug(msg) {
+  if (process.env.PRIM_HOOK_VERBOSE === "1") {
+    process.stderr.write(`[prim-post-tool-use] ${msg}
+`);
+  }
+}
+async function main() {
+  const agent = parseAgent(process.argv);
+  let raw;
+  try {
+    raw = await readHookStdin(STDIN_TIMEOUT_MS);
+  } catch {
+    await emit();
+    return;
+  }
+  let parsed;
+  try {
+    const incoming = JSON.parse(raw);
+    if (agent !== "cursor" && shouldSuppressImportedCursorHandler(incoming, "prim-post-tool-use")) {
+      await emit();
+      return;
+    }
+    parsed = normalizeEnvelope(incoming, agent);
+  } catch {
+    await emit();
+    return;
+  }
+  let envelope = parsed;
+  const isToolResult = envelope.hook_event_name === "PostToolUse" || (agent === "claude_code" || agent === "cursor") && envelope.hook_event_name === "PostToolUseFailure";
+  const isHermesDenial = agent === "hermes" && envelope.hook_event_name === "post_approval_response" && toolOutcomeFor(parsed, agent) === "prevented";
+  if (!isToolResult && !isHermesDenial) {
+    await finish(agent, envelope);
+    return;
+  }
+  const invocationId = postToolInvocationId(parsed, agent);
+  if (isHermesDenial && !invocationId) {
+    await finish(agent, envelope);
+    return;
+  }
+  const toolName = typeof envelope.tool_name === "string" ? envelope.tool_name : "";
+  if (!isHermesDenial && !editingToolsFor(agent).has(toolName)) {
+    await finish(agent, envelope);
+    return;
+  }
+  if (isHermesDenial && (typeof envelope.session_id !== "string" || envelope.session_id.length === 0) && typeof envelope.extra?.session_key === "string" && envelope.extra.session_key.length > 0) {
+    parsed = { ...parsed, session_id: envelope.extra.session_key };
+    envelope = parsed;
+  }
+  if (typeof envelope.session_id !== "string" || envelope.session_id.length === 0) {
+    await finish(agent, envelope);
+    return;
+  }
+  const cwd = parsed.cwd ?? process.cwd();
+  if (!isRepoActiveForCapture(cwd)) {
+    await finish(agent, envelope);
+    return;
+  }
+  const resolvedRepository = resolveRepositoryContext(cwd);
+  if (!resolvedRepository) {
+    await finish(agent, envelope);
+    return;
+  }
+  const repository = { ...resolvedRepository, repoSyncId: repoSyncId(cwd) };
+  const enrichment = enrichHookPayloadWithFileRefs({
+    parsed,
+    agent,
+    cwd,
+    repository
+  });
+  const { resolution } = enrichment;
+  if (!isHermesDenial) {
+    if (resolution.shellMutation === "none") {
+      await finish(agent, envelope);
+      return;
+    }
+    if (resolution.shellMutation === void 0 && resolution.fileRefs.length === 0) {
+      await finish(agent, envelope);
+      return;
+    }
+  }
+  const pathsComplete = !resolution.targetsIncomplete && !resolution.targetsTruncated && resolution.rejected.length === 0 && resolution.shellMutation !== "unresolved";
+  const hasPathEvidence = resolution.fileRefs.length > 0 || resolution.rejected.length > 0 || resolution.targetsIncomplete || resolution.targetsTruncated || resolution.shellMutation === "unresolved";
+  if (agent === "cursor" && (resolution.rejected.length > 0 || resolution.targetsIncomplete || resolution.targetsTruncated || resolution.shellMutation === "unresolved")) {
+    await finish(agent, envelope);
+    return;
+  }
+  if (!cachedCollectScopeAdmits(cwd, {
+    repository: resolvedRepository.repoFullName,
+    branch: currentBranch(cwd),
+    agent,
+    ...isHermesDenial || !hasPathEvidence ? {} : { paths: resolution.fileRefs, pathsComplete }
+  })) {
+    await finish(agent, envelope);
+    return;
+  }
+  const enriched = enrichment.parsed;
+  const identity = getOrCreateWorkspaceId(cwd);
+  const workspaceId = identity.status === "ready" ? identity.workspaceId : void 0;
+  const base = toMove(enriched, resolveCliVersion(), agent, workspaceId, repository, invocationId);
+  const scrubbed = await scrubFromCwd(enriched, cwd);
+  const move = {
+    ...base,
+    payload: preserveHookFileMetadata(scrubbed, resolution)
+  };
+  const { orgId } = resolveOrg({ sessionId: move.sessionId, cwd });
+  let verdictFooter = false;
+  try {
+    const result = await deliverPostToolMove(move, orgId);
+    debug(`durably ingested ${move.moveId} (${toolName})`);
+    if (isVerdictFooterContext(result.verdictFooter)) {
+      verdictFooter = true;
+      process.stderr.write(`${renderVerdictFooter(result.verdictFooter)}
+`);
+    }
+  } catch (err) {
+    debug(`ingest failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  if (agent === "codex" && verdictFooter) {
+    try {
+      const context = await prepareCodexContext({
+        cwd,
+        sessionId: envelope.session_id,
+        includeDigest: false
+      });
+      await emitWithAcknowledgment(appendCodexContext({}, context.context), context.acknowledge);
+      return;
+    } catch {
+    }
+  }
+  await finish(agent, envelope);
+}
+main().catch(async () => {
+  await emit();
+});