@primitive.ai/prim 0.1.0-alpha.9 → 0.1.0-alpha.91

package/dist/hooks/pre-commit.js

@@ -1,7 +1,11 @@
 #!/usr/bin/env node
 import {
-  getClient
-} from "../chunk-3APLWTLB.js";
+  checkAffectedDecisions,
+  formatDecisionsWarning
+} from "../chunk-5GYQ4J3D.js";
+import "../chunk-PCVGBE5B.js";
+import "../chunk-KFXF2V5G.js";
+import "../chunk-67VNLLBN.js";
 
 // src/hooks/pre-commit.ts
 import { execSync } from "child_process";
@@ -11,113 +15,24 @@ function getStagedFiles() {
   });
   return output.trim().split("\n").filter((f) => f.length > 0);
 }
-function getStagedDiff(files) {
-  return execSync(`git diff --cached -- ${files.map((f) => `"${f}"`).join(" ")}`, {
-    encoding: "utf-8"
-  });
-}
-function matchPattern(filePath, pattern) {
-  const regexStr = pattern.replaceAll("**", "\xA7GLOBSTAR\xA7").replaceAll("*", "[^/]*").replaceAll("\xA7GLOBSTAR\xA7", ".*");
-  const regex = new RegExp(`^${regexStr}$`);
-  return regex.test(filePath);
-}
-function findAffectedContexts(stagedFiles, specs) {
-  const affected = /* @__PURE__ */ new Map();
-  for (const file of stagedFiles) {
-    for (const spec of specs) {
-      for (const pattern of spec.filePatterns) {
-        if (matchPattern(file, pattern)) {
-          const existing = affected.get(spec._id);
-          if (existing) {
-            existing.matchedFiles.push(file);
-          } else {
-            affected.set(spec._id, {
-              contextId: spec._id,
-              matchedFiles: [file]
-            });
-          }
-          break;
-        }
-      }
-    }
-  }
-  return affected;
-}
-var HOOK_TIMEOUT_MS = 1e4;
-var defaultDeps = {
-  getClient,
-  getStagedFiles,
-  getStagedDiff
-};
-async function syncAffectedSpecs(deps = defaultDeps) {
-  const stagedFiles = deps.getStagedFiles();
+async function runDecisionsCheck() {
+  const stagedFiles = getStagedFiles();
   if (stagedFiles.length === 0) {
-    return [];
+    return { decisions: [], truncated: false };
   }
-  const client = deps.getClient();
-  let mappings = [];
-  try {
-    mappings = await client.get("/api/cli/specs/mappings", {
-      signal: AbortSignal.timeout(HOOK_TIMEOUT_MS)
-    });
-  } catch {
-    return [];
-  }
-  if (mappings.length === 0) {
-    return [];
-  }
-  const affectedContexts = findAffectedContexts(stagedFiles, mappings);
-  if (affectedContexts.size === 0) {
-    return [];
-  }
-  console.log(`[prim] ${String(affectedContexts.size)} spec(s) affected by staged changes:`);
-  const synced = [];
-  for (const [contextId, affected] of affectedContexts) {
-    try {
-      const ctx = await client.get(`/api/cli/contexts/${contextId}`, {
-        signal: AbortSignal.timeout(HOOK_TIMEOUT_MS)
-      });
-      if (!ctx._id) {
-        console.log(`  [skip] ${contextId} \u2014 not found`);
-        continue;
-      }
-      if (!ctx.isSpecDocument) {
-        console.log(`  [skip] ${contextId} \u2014 not a spec document`);
-        continue;
-      }
-      const diffContent = deps.getStagedDiff(affected.matchedFiles);
-      if (!diffContent) {
-        console.log(`  [skip] ${contextId} \u2014 no diff content`);
-        continue;
-      }
-      await client.post(
-        `/api/cli/contexts/${contextId}/sync-diff`,
-        { diffContent, affectedFiles: affected.matchedFiles },
-        { signal: AbortSignal.timeout(HOOK_TIMEOUT_MS) }
-      );
-      console.log(`  [synced] ${contextId} \u2014 ${ctx.name ?? "(unnamed)"}`);
-      synced.push(contextId);
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      console.error(`  [error] ${contextId} \u2014 ${message}`);
-    }
-  }
-  return synced;
+  return checkAffectedDecisions(stagedFiles);
 }
 async function main() {
-  await syncAffectedSpecs();
+  const decisionsResult = await runDecisionsCheck();
+  const warning = formatDecisionsWarning(decisionsResult);
+  if (warning) {
+    console.error(warning);
+  }
   process.exit(0);
 }
-var isDirectExecution = typeof process !== "undefined" && process.argv[1] && import.meta.url.endsWith(process.argv[1].replace(/\\/g, "/"));
-if (isDirectExecution) {
+if (!process.env.VITEST) {
   main().catch((error) => {
     console.error("[prim] Pre-commit hook error:", error);
     process.exit(0);
   });
 }
-export {
-  HOOK_TIMEOUT_MS,
-  findAffectedContexts,
-  matchPattern,
-  syncAffectedSpecs
-};

package/dist/hooks/pre-tool-use.js

@@ -0,0 +1,369 @@
+#!/usr/bin/env node
+import {
+  analyzeShellTargets,
+  buildCodexOutput,
+  buildCursorOutput,
+  buildHermesOutput,
+  buildHookOutput,
+  demoteForMode,
+  extractFileTargets,
+  failOpenCodex,
+  failOpenCursor,
+  failOpenHermes,
+  failOpenOutput,
+  readHookMode
+} from "../chunk-ZB4F75SZ.js";
+import {
+  appendCodexContext,
+  hasVisibleCodexMessage,
+  prepareCodexContext
+} from "../chunk-VW3FDYRT.js";
+import "../chunk-WX52U7Z2.js";
+import {
+  DEFAULT_RULES,
+  scrub
+} from "../chunk-OAAP2MY6.js";
+import {
+  boundedHealthError
+} from "../chunk-BTNNEH2W.js";
+import {
+  cachedCollectScopeAdmits,
+  isRepoActive,
+  repoSyncId
+} from "../chunk-M6RIJVRE.js";
+import {
+  getClient
+} from "../chunk-PCVGBE5B.js";
+import {
+  normalizeEnvelope,
+  parseAgent,
+  readHookStdin,
+  shouldSuppressImportedCursorHandler
+} from "../chunk-HU4PW6I6.js";
+import {
+  packageVersion
+} from "../chunk-EWZMDD44.js";
+import {
+  canonicalGitRoot,
+  canonicalRepositoryPath,
+  currentBranch,
+  githubRepositoryFullName
+} from "../chunk-H4UNYFUC.js";
+import "../chunk-KFXF2V5G.js";
+import "../chunk-67VNLLBN.js";
+
+// src/hooks/preflight-v3.ts
+import { Buffer } from "buffer";
+var PREFLIGHT_PROTOCOL_VERSION = 3;
+var PREFLIGHT_TIMEOUT_MS = 6500;
+var MAX_PREFLIGHT_PATHS = 32;
+var MAX_PROPOSAL_BYTES = 6144;
+var MAX_CLIENT_VERSION_CHARS = 32;
+var CLIENT_VERSION_RE = /^[A-Za-z0-9][A-Za-z0-9._+-]*$/;
+var MAX_DECISION_DISCLOSURES = 16;
+var DISCLOSED_DECISION_ID_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/u;
+var DISCLOSED_DECISION_SHORT_ID_RE = /^[0-9a-f]{8}$/u;
+function boundedClientVersion(raw) {
+  return typeof raw === "string" && raw.length <= MAX_CLIENT_VERSION_CHARS && CLIENT_VERSION_RE.test(raw) ? raw : "unknown";
+}
+function resolvePreflightTargets(args) {
+  let rawPaths;
+  let coverage = "complete";
+  let mutation = "present";
+  let definite = false;
+  const shellTool = (args.agent === "claude_code" || args.agent === "codex") && args.toolName === "Bash" || args.agent === "cursor" && args.toolName === "Shell";
+  if (shellTool) {
+    const command = typeof args.toolInput === "string" ? args.toolInput : args.toolInput && typeof args.toolInput === "object" ? args.toolInput.command : void 0;
+    if (typeof command !== "string") {
+      return { paths: [], coverage: "unverified", mutation: "present" };
+    }
+    const shell = analyzeShellTargets(command);
+    rawPaths = shell.paths;
+    coverage = shell.coverage;
+    mutation = shell.mutation;
+    definite = shell.definiteEdit === true;
+  } else {
+    const extracted = extractFileTargets(args.toolName, args.toolInput, args.agent);
+    if (!extracted) return { paths: [], coverage: "complete", mutation: "none" };
+    rawPaths = extracted.paths;
+    if (!extracted.complete) coverage = "unverified";
+    definite = true;
+  }
+  const root = canonicalGitRoot(args.cwd);
+  const paths = /* @__PURE__ */ new Set();
+  for (const rawPath of rawPaths) {
+    const canonical = canonicalRepositoryPath(rawPath, args.cwd, root);
+    if (canonical) paths.add(canonical);
+    else coverage = "unverified";
+  }
+  const bounded = [...paths];
+  if (bounded.length > MAX_PREFLIGHT_PATHS) coverage = "unverified";
+  const resolved = bounded.slice(0, MAX_PREFLIGHT_PATHS);
+  if (definite && resolved.length === 0 && mutation === "present") {
+    return { paths: resolved, coverage: "unverified", mutation, definite: true };
+  }
+  return { paths: resolved, coverage, mutation };
+}
+function truncateUtf8(value, maxBytes) {
+  const encoded = Buffer.from(value);
+  if (encoded.byteLength <= maxBytes) return value;
+  return encoded.subarray(0, maxBytes).toString("utf8").replace(/\uFFFD$/u, "");
+}
+function proposalFor(toolInput) {
+  const redacted = scrub(toolInput, DEFAULT_RULES);
+  return truncateUtf8(JSON.stringify(redacted) ?? "", MAX_PROPOSAL_BYTES);
+}
+function parsePreflightResponse(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const response = value;
+  const verdicts = /* @__PURE__ */ new Set(["allow", "warn", "ask", "block", "unavailable"]);
+  if (response.protocolVersion !== PREFLIGHT_PROTOCOL_VERSION || typeof response.verdict !== "string" || !verdicts.has(response.verdict) || typeof response.reasonCode !== "string" || typeof response.message !== "string" || !Array.isArray(response.conflicts) || !Array.isArray(response.bypassed)) {
+    return null;
+  }
+  const disclosures = response.decisionDisclosures;
+  if (disclosures !== void 0) {
+    if (!Array.isArray(disclosures) || disclosures.length === 0 || disclosures.length > MAX_DECISION_DISCLOSURES) {
+      return null;
+    }
+    const seen = /* @__PURE__ */ new Set();
+    for (const value2 of disclosures) {
+      if (!value2 || typeof value2 !== "object" || Array.isArray(value2)) return null;
+      const disclosure = value2;
+      if (Object.keys(disclosure).length !== 3 || !Object.hasOwn(disclosure, "decisionId") || !Object.hasOwn(disclosure, "shortId") || !Object.hasOwn(disclosure, "participation") || typeof disclosure.decisionId !== "string" || !DISCLOSED_DECISION_ID_RE.test(disclosure.decisionId) || typeof disclosure.shortId !== "string" || !DISCLOSED_DECISION_SHORT_ID_RE.test(disclosure.shortId) || disclosure.participation !== "candidate" && disclosure.participation !== "reconcile_bypass" || seen.has(disclosure.decisionId)) {
+        return null;
+      }
+      seen.add(disclosure.decisionId);
+    }
+  }
+  return response;
+}
+function decisionDisclosureContext(response) {
+  return response.decisionDisclosures?.map(({ decisionId }) => `[primitive] hidden Decision: prim decisions show ${decisionId}`).join("\n") ?? "";
+}
+async function requestPreflight(request, signal = AbortSignal.timeout(PREFLIGHT_TIMEOUT_MS)) {
+  const response = await getClient().post("/api/cli/decisions/conflict-check", request, {
+    signal,
+    quietRefresh: true
+  });
+  return parsePreflightResponse(response);
+}
+function resultForPreflight(response) {
+  const verdict = response.verdict === "block" ? "deny" : response.verdict;
+  const message = boundedHealthError(response.message) ?? "";
+  const unavailable = message || boundedHealthError(response.reasonCode);
+  const safe = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
+  const directives = response.conflicts.flatMap((value) => {
+    if (!value || typeof value !== "object") return [];
+    const { decisionId, shortId } = value;
+    const id = typeof shortId === "string" && safe.test(shortId) ? `dec_${shortId}` : typeof decisionId === "string" && safe.test(decisionId) ? decisionId : void 0;
+    return id ? [`To reconcile, run: prim reconcile ${id}`] : [];
+  });
+  const reason = [message, ...new Set(directives)].filter(Boolean).join("\n");
+  const disclosureContext = decisionDisclosureContext(response);
+  return {
+    verdict,
+    conflicts: response.conflicts,
+    reason,
+    additionalContext: disclosureContext || (["warn", "ask", "block"].includes(response.verdict) ? reason : ""),
+    truncated: false,
+    unavailable: response.verdict === "unavailable" ? unavailable : void 0
+  };
+}
+function unverifiedResult(message) {
+  return {
+    verdict: "unavailable",
+    conflicts: [],
+    reason: "",
+    additionalContext: "",
+    truncated: false,
+    unavailable: message
+  };
+}
+
+// src/hooks/pre-tool-use.ts
+var STDIN_TIMEOUT_MS = 1e3;
+var agent = parseAgent(process.argv);
+async function emit(output) {
+  return await new Promise((resolve) => {
+    try {
+      process.stdout.write(`${JSON.stringify(output)}
+`, (error) => resolve(!error));
+    } catch {
+      resolve(false);
+    }
+  });
+}
+async function emitWithAcknowledgment(output, acknowledge) {
+  const handedOff = await emit(output);
+  await acknowledge?.(handedOff);
+}
+function failOpen() {
+  if (agent === "hermes") return failOpenHermes();
+  if (agent === "cursor") return failOpenCursor();
+  return agent === "codex" ? failOpenCodex() : failOpenOutput();
+}
+function invocationId(envelope) {
+  const value = agent === "hermes" ? envelope.extra?.tool_call_id : envelope.tool_use_id;
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function hermesAdvisory(result, aggregate) {
+  const parts = [];
+  if (aggregate === "warn") parts.push(result.reason);
+  if (result.verdict === "unavailable") {
+    parts.push(result.unavailable ?? result.reason);
+  }
+  if (result.additionalContext && result.additionalContext !== result.reason) {
+    parts.push(result.additionalContext);
+  }
+  const message = [...new Set(parts.filter(Boolean))].join("\n");
+  return message.startsWith("[primitive]") ? message : message ? `[primitive] ${message}` : "";
+}
+async function emitUnverified(message, envelope) {
+  const result = unverifiedResult(message);
+  if (agent === "hermes") {
+    process.stderr.write(`[primitive] ${message}
+`);
+    await emit(failOpenHermes());
+  } else if (agent === "cursor") {
+    process.stderr.write(`[primitive] ${message}
+`);
+    await emit(buildCursorOutput("allow", [result]));
+  } else {
+    let output = agent === "codex" ? buildCodexOutput("allow", [result]) : buildHookOutput("allow", [result]);
+    if (agent === "codex" && typeof envelope?.session_id === "string" && envelope.session_id) {
+      try {
+        const context = await prepareCodexContext({
+          cwd: envelope.cwd ?? process.cwd(),
+          sessionId: envelope.session_id,
+          includeDigest: false
+        });
+        output = appendCodexContext(output, context.context);
+        await emitWithAcknowledgment(output, context.acknowledge);
+        return;
+      } catch {
+      }
+    }
+    await emit(output);
+  }
+}
+async function main() {
+  let raw;
+  try {
+    raw = await readHookStdin(STDIN_TIMEOUT_MS);
+  } catch {
+    await emit(failOpen());
+    return;
+  }
+  let envelope;
+  try {
+    const incoming = JSON.parse(raw);
+    if (agent !== "cursor" && shouldSuppressImportedCursorHandler(incoming, "prim-pre-tool-use")) {
+      await emit(failOpenCursor());
+      return;
+    }
+    envelope = normalizeEnvelope(incoming, agent);
+  } catch {
+    await emit(failOpen());
+    return;
+  }
+  if (envelope.hook_event_name !== "PreToolUse") {
+    await emit(failOpen());
+    return;
+  }
+  const env = process.env;
+  const mode = readHookMode(env);
+  if (mode === "off") {
+    await emit(failOpen());
+    return;
+  }
+  const toolName = typeof envelope.tool_name === "string" ? envelope.tool_name : "";
+  const cwd = typeof envelope.cwd === "string" && envelope.cwd.length > 0 ? envelope.cwd : process.cwd();
+  const targets = resolvePreflightTargets({
+    toolName,
+    toolInput: envelope.tool_input,
+    agent,
+    cwd
+  });
+  if (targets.mutation === "none") {
+    await emit(failOpen());
+    return;
+  }
+  if (!isRepoActive(cwd)) {
+    await emit(failOpen());
+    return;
+  }
+  if (targets.paths.length === 0 && !targets.definite) {
+    await emit(failOpen());
+    return;
+  }
+  if (agent === "cursor" && targets.coverage === "unverified") {
+    await emitUnverified("tool targets were ambiguous or outside the active repository", envelope);
+    return;
+  }
+  const binding = repoSyncId(cwd);
+  const branch = currentBranch(cwd);
+  const sessionId = envelope.session_id;
+  const callId = invocationId(envelope);
+  if (!binding || typeof sessionId !== "string" || !sessionId || !callId) {
+    await emitUnverified(
+      "GitHub repo connection is required for repository-specific file attribution, Conflict Gate verification, and commit correlation; or tool invocation identity is unavailable",
+      envelope
+    );
+    return;
+  }
+  const collectScopeAdmits = cachedCollectScopeAdmits(cwd, {
+    repository: githubRepositoryFullName(cwd) ?? void 0,
+    branch,
+    agent,
+    paths: targets.paths,
+    pathsComplete: targets.coverage === "complete"
+  });
+  const request = {
+    protocolVersion: PREFLIGHT_PROTOCOL_VERSION,
+    agent,
+    clientMode: mode,
+    clientVersion: boundedClientVersion(packageVersion()),
+    sessionId,
+    invocationId: callId,
+    repoSyncId: binding,
+    paths: targets.paths,
+    coverage: targets.coverage,
+    ...branch === void 0 ? {} : { branch },
+    proposal: collectScopeAdmits ? proposalFor(envelope.tool_input) : ""
+  };
+  let result;
+  try {
+    const response = await requestPreflight(request);
+    if (!response) {
+      await emitUnverified("enforcement service returned an incompatible response", envelope);
+      return;
+    }
+    result = resultForPreflight(response);
+  } catch {
+    await emitUnverified("enforcement service unavailable; change was not verified", envelope);
+    return;
+  }
+  const aggregate = demoteForMode(
+    result.verdict === "unavailable" ? "allow" : result.verdict,
+    mode
+  );
+  if (agent === "hermes" && aggregate !== "deny" && aggregate !== "ask") {
+    const advisory = hermesAdvisory(result, aggregate);
+    if (advisory) process.stderr.write(`${advisory}
+`);
+  }
+  let output = agent === "hermes" ? buildHermesOutput(aggregate, [result]) : agent === "cursor" ? buildCursorOutput(aggregate, [result]) : agent === "codex" ? buildCodexOutput(aggregate, [result]) : buildHookOutput(aggregate, [result]);
+  if (agent === "codex" && hasVisibleCodexMessage(output) && typeof sessionId === "string" && sessionId.length > 0) {
+    try {
+      const context = await prepareCodexContext({ cwd, sessionId, includeDigest: false });
+      output = appendCodexContext(output, context.context);
+      await emitWithAcknowledgment(output, context.acknowledge);
+      return;
+    } catch {
+    }
+  }
+  await emit(output);
+}
+main().catch(async () => {
+  await emit(failOpen());
+});