@primitive.ai/prim 0.1.0-alpha.9 → 0.1.0-alpha.91

package/dist/chunk-EWZMDD44.js

@@ -0,0 +1,1474 @@
+import {
+  gitToplevel
+} from "./chunk-H4UNYFUC.js";
+import {
+  atomicWriteFile,
+  primConfigDirectory,
+  syncDirectory,
+  syncFile,
+  withFileLockSync
+} from "./chunk-67VNLLBN.js";
+
+// src/lib/bin-path.ts
+import { existsSync, readFileSync } from "fs";
+import { dirname, isAbsolute, join } from "path";
+import { fileURLToPath } from "url";
+
+// src/lib/semver.ts
+function parseSemver(value) {
+  if (typeof value !== "string" || value.length > 256) return;
+  const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/u.exec(
+    value
+  );
+  if (!match) return;
+  const prerelease = match[4]?.split(".") ?? [];
+  if (prerelease.some((part) => /^\d+$/u.test(part) && part.length > 1 && part.startsWith("0"))) {
+    return;
+  }
+  return { core: [BigInt(match[1]), BigInt(match[2]), BigInt(match[3])], prerelease };
+}
+function compareSemver(left, right) {
+  const a = parseSemver(left);
+  const b = parseSemver(right);
+  if (!a || !b) return;
+  for (let i = 0; i < a.core.length; i += 1) {
+    if (a.core[i] !== b.core[i]) return a.core[i] < b.core[i] ? -1 : 1;
+  }
+  if (a.prerelease.length === 0 || b.prerelease.length === 0) {
+    return a.prerelease.length === b.prerelease.length ? 0 : a.prerelease.length === 0 ? 1 : -1;
+  }
+  for (let i = 0; i < Math.max(a.prerelease.length, b.prerelease.length); i += 1) {
+    const x = a.prerelease[i];
+    const y = b.prerelease[i];
+    if (x === void 0 || y === void 0) return x === void 0 ? -1 : 1;
+    if (x === y) continue;
+    const xNumeric = /^\d+$/u.test(x);
+    const yNumeric = /^\d+$/u.test(y);
+    if (xNumeric && yNumeric) return BigInt(x) < BigInt(y) ? -1 : 1;
+    if (xNumeric !== yNumeric) return xNumeric ? -1 : 1;
+    return x < y ? -1 : 1;
+  }
+  return 0;
+}
+
+// src/lib/bin-path.ts
+var PKG_NAME = "@primitive.ai/prim";
+var ROOT_WALK_LIMIT = 6;
+var STABLE_HOOK_LAUNCHER_NAME = "prim-hook-launcher-v1";
+var resolvedRoot;
+function locateRoot() {
+  if (resolvedRoot !== void 0) {
+    return resolvedRoot;
+  }
+  let dir = dirname(fileURLToPath(import.meta.url));
+  for (let depth = 0; depth < ROOT_WALK_LIMIT; depth++) {
+    const manifestPath = join(dir, "package.json");
+    if (existsSync(manifestPath)) {
+      try {
+        const manifest = JSON.parse(readFileSync(manifestPath, "utf-8"));
+        if (manifest.name === PKG_NAME && manifest.bin) {
+          resolvedRoot = { dir, version: manifest.version, bin: manifest.bin };
+          return resolvedRoot;
+        }
+      } catch {
+      }
+    }
+    const parent = dirname(dir);
+    if (parent === dir) {
+      break;
+    }
+    dir = parent;
+  }
+  resolvedRoot = null;
+  return resolvedRoot;
+}
+function binFile(bin) {
+  const root = locateRoot();
+  const rel = root?.bin[bin];
+  if (!root || !rel) {
+    return null;
+  }
+  return isAbsolute(rel) ? rel : join(root.dir, rel);
+}
+function packageVersion() {
+  return locateRoot()?.version ?? null;
+}
+function packageRoot() {
+  return locateRoot()?.dir ?? null;
+}
+function shellQuote(value) {
+  return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+function shellWord(value) {
+  return /^[A-Za-z0-9_@%+=:,./-]+$/u.test(value) ? value : shellQuote(value);
+}
+function pinnedNpxArgs(bin, args = [], options = {}) {
+  const version = packageVersion();
+  if (!version) throw new Error("cannot determine Primitive package version");
+  return [
+    "--yes",
+    "--ignore-scripts",
+    ...options.preferOnline ? ["--prefer-online"] : [],
+    "-p",
+    `${PKG_NAME}@${version}`,
+    bin,
+    ...args
+  ];
+}
+function pinnedNpxCommand(bin, args = [], options = {}) {
+  return ["npx", ...pinnedNpxArgs(bin, args, options)].map(shellWord).join(" ");
+}
+function pinnedHookCommand(bin, args = "") {
+  const suffix = args ? ` ${args}` : "";
+  const fallback = `${pinnedNpxCommand(bin)}${suffix}`;
+  const file = binFile(bin);
+  if (!file) return fallback;
+  return `if [ -x ${shellQuote(process.execPath)} ] && [ -f ${shellQuote(file)} ]; then ${shellQuote(process.execPath)} ${shellQuote(file)}${suffix}; else ${fallback}; fi`;
+}
+var STABLE_HOOK_ARGUMENTS_RE = /^[-A-Za-z0-9_ ]*$/u;
+var STABLE_HOOK_BIN_RE = /^[A-Za-z0-9][A-Za-z0-9-]*$/u;
+function stableHookCommand(bin, args = "") {
+  if (!STABLE_HOOK_BIN_RE.test(bin) || !STABLE_HOOK_ARGUMENTS_RE.test(args)) {
+    throw new Error("invalid stable hook command");
+  }
+  const resolver = [
+    // #242 and earlier identify managed commands by this package marker. Keep
+    // it as inert data during the rolling window so an older uninstall or
+    // reinstall can remove the stable entry without invoking npm or PATH.
+    `prim_legacy_reader='-p ${PKG_NAME}@stable prim-shim.sh ${bin} '; `,
+    'prim_absolute() { case "$1" in [/]* ) ;; *) return 1 ;; esac; case "$1" in [[:space:]]*|*[[:space:]]|*[/][/]*|*[/].[/]*|*[/]..[/]*|*[/].|*[/]..|?*[/]) return 1 ;; esac; }; ',
+    'prim_config=${PRIM_CONFIG_DIR:-}; if ! prim_absolute "$prim_config"; then prim_config=${XDG_CONFIG_HOME:-}; if prim_absolute "$prim_config"; then ',
+    'case "$prim_config" in /) prim_config=/prim ;; *) prim_config="$prim_config/prim" ;; esac; ',
+    'else prim_home=${HOME:-}; prim_absolute "$prim_home" || exit 78; case "$prim_home" in /) prim_config=/.config/prim ;; *) prim_config="$prim_home/.config/prim" ;; esac; ',
+    "fi; fi; ",
+    `case "$prim_config" in /) prim_launcher=/${STABLE_HOOK_LAUNCHER_NAME} ;; *) prim_launcher="$prim_config/${STABLE_HOOK_LAUNCHER_NAME}" ;; esac; `,
+    'exec "$prim_launcher" "$@"'
+  ].join("");
+  const suffix = args ? ` ${args}` : "";
+  return `/bin/sh -c ${shellQuote(resolver)} ${STABLE_HOOK_LAUNCHER_NAME} ${bin}${suffix}`;
+}
+function detachedHookShimCommand(bin, args = "") {
+  return `payload=$(cat); { trap '' HUP; printf '%s' "$payload" | { ${stableHookCommand(bin, args)}; }; } </dev/null >/dev/null 2>&1 &`;
+}
+function commandMatchesBin(command, bin) {
+  if (!command) {
+    return false;
+  }
+  const c = command.trim();
+  if (c === bin || c.startsWith(`${bin} `)) {
+    return true;
+  }
+  const exactBin = new RegExp(`(?:^|\\s)${bin.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:\\s|;|$)`);
+  return c.includes(`command -v ${bin} `) || c.includes(`-p ${PKG_NAME}@`) && exactBin.test(c) || c.includes(STABLE_HOOK_LAUNCHER_NAME) && exactBin.test(c);
+}
+function exactPinnedNpxVersion(command, bin) {
+  const escapedBin = bin.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const shellQuoted = `'(?:[^']|'"'"')*'`;
+  const safeArgs = "(?: [A-Za-z0-9_@%+=:,./-]+)*";
+  const direct = new RegExp(
+    `^npx --yes --ignore-scripts -p @primitive\\.ai/prim@(?<version>[0-9A-Za-z.+-]+) ${escapedBin}${safeArgs}$`,
+    "u"
+  ).exec(command);
+  const wrapped = new RegExp(
+    `^if \\[ -x (?<node>${shellQuoted}) \\] && \\[ -f (?<entry>${shellQuoted}) \\]; then \\k<node> \\k<entry>(?<args>${safeArgs}); else npx --yes --ignore-scripts -p @primitive\\.ai/prim@(?<version>[0-9A-Za-z.+-]+) ${escapedBin}\\k<args>; fi$`,
+    "u"
+  ).exec(command);
+  const version = direct?.groups?.version ?? wrapped?.groups?.version;
+  return version && compareSemver(version, version) !== void 0 ? version : void 0;
+}
+function hookCommandResolution(command, bin) {
+  const trimmed = command?.trim();
+  if (!trimmed || !commandMatchesBin(trimmed, bin)) return void 0;
+  if (trimmed.includes(STABLE_HOOK_LAUNCHER_NAME)) return { kind: "stable_launcher" };
+  const version = exactPinnedNpxVersion(trimmed, bin);
+  return version ? { kind: "exact_npx_fallback", version } : { kind: "legacy_path" };
+}
+function hookCommandResolutions(commands, bins) {
+  const resolutions = [];
+  for (const command of commands) {
+    for (const bin of bins) {
+      const resolution = hookCommandResolution(command, bin);
+      if (resolution) resolutions.push(resolution);
+    }
+  }
+  return resolutions;
+}
+
+// src/commands/claude-install.ts
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { homedir } from "os";
+import { join as join3 } from "path";
+
+// src/lib/hook-runtime.ts
+import { createHash, randomBytes } from "crypto";
+import {
+  constants,
+  accessSync,
+  chmodSync,
+  copyFileSync,
+  existsSync as existsSync2,
+  lstatSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync as readFileSync2,
+  readdirSync,
+  realpathSync,
+  renameSync,
+  rmSync,
+  statSync,
+  utimesSync,
+  writeFileSync
+} from "fs";
+import { dirname as dirname2, isAbsolute as isAbsolute2, join as join2, resolve } from "path";
+var HOOK_RUNTIME_SCHEMA_VERSION = 1;
+var DIRECTORY_MODE = 448;
+var DATA_FILE_MODE = 384;
+var LAUNCHER_MODE = 448;
+var RELEASE_PREFIX = "release-";
+var RELEASE_NAME_RE = /^release-[0-9a-f]{64}$/u;
+var MAX_MANIFEST_BYTES = 64 * 1024;
+var MAX_RELEASES = 8;
+var MAX_RELEASE_DELETIONS_PER_STAGE = 8;
+var RETAIN_PREDECESSORS = 2;
+var RELEASE_GRACE_MS = 10 * 60 * 1e3;
+var HOOK_RUNTIME_ENTRIES = {
+  // SessionStart self-healing resolves this exact CLI entry to run
+  // `daemon ensure`; it must travel with the immutable hook release.
+  prim: "dist/index.js",
+  "prim-hook": "dist/hooks/prim-hook.js",
+  "prim-pre-commit": "dist/hooks/pre-commit.js",
+  "prim-post-commit": "dist/hooks/post-commit.js",
+  "prim-post-rewrite": "dist/hooks/post-rewrite.js",
+  "prim-pre-tool-use": "dist/hooks/pre-tool-use.js",
+  "prim-post-tool-use": "dist/hooks/post-tool-use.js",
+  "prim-session-start": "dist/hooks/session-start.js",
+  "prim-session-end": "dist/hooks/session-end.js",
+  "prim-daemon-server": "dist/daemon/server.js",
+  "prim-statusline": "dist/statusline-main.js"
+};
+var SOURCE_ENTRIES = Object.fromEntries(
+  Object.entries(HOOK_RUNTIME_ENTRIES).map(([bin, target]) => [
+    bin,
+    target.replace(/^dist\//u, "")
+  ])
+);
+function hookRuntimePaths(options = {}) {
+  const env = options.env ?? process.env;
+  const configDir = primConfigDirectory({
+    ...options,
+    env,
+    homeDir: options.homeDir ?? env.HOME ?? ""
+  });
+  const runtimeDir = join2(configDir, "hook-runtime");
+  return {
+    configDir,
+    launcher: join2(configDir, STABLE_HOOK_LAUNCHER_NAME),
+    runtimeDir,
+    releasesDir: join2(runtimeDir, "releases"),
+    current: join2(runtimeDir, "current"),
+    selectionLock: join2(runtimeDir, "selection.lock")
+  };
+}
+function sha256(path) {
+  return createHash("sha256").update(readFileSync2(path)).digest("hex");
+}
+function exactManifest(manifest) {
+  return `${JSON.stringify(manifest, null, 2)}
+`;
+}
+function exactKeys(value, expected) {
+  const actual = Object.keys(value).sort();
+  const wanted = [...expected].sort();
+  return actual.length === wanted.length && actual.every((key, index) => key === wanted[index]);
+}
+function releaseId(manifest) {
+  return createHash("sha256").update(exactManifest(manifest)).digest("hex");
+}
+function runtimePackageJson(manifest) {
+  return `${JSON.stringify(
+    {
+      name: "@primitive.ai/prim",
+      version: manifest.version,
+      type: "module",
+      bin: HOOK_RUNTIME_ENTRIES
+    },
+    null,
+    2
+  )}
+`;
+}
+function validateRelease(releaseDir, manifest) {
+  try {
+    if (!directReleaseLayout(releaseDir)) return false;
+    if (readFileSync2(join2(releaseDir, "manifest.json"), "utf8") !== exactManifest(manifest)) {
+      return false;
+    }
+    if (readFileSync2(join2(releaseDir, "package.json"), "utf8") !== runtimePackageJson(manifest)) {
+      return false;
+    }
+    if (readFileSync2(join2(releaseDir, "node"), "utf8") !== `${manifest.nodePath}
+`) {
+      return false;
+    }
+    for (const [bin, relativePath] of Object.entries(HOOK_RUNTIME_ENTRIES)) {
+      const target = join2(releaseDir, relativePath);
+      if (sha256(target) !== manifest.files[bin]) return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+function directReleaseLayout(releaseDir) {
+  try {
+    const directories = /* @__PURE__ */ new Set([releaseDir]);
+    for (const relativePath of Object.values(HOOK_RUNTIME_ENTRIES)) {
+      for (let directory = dirname2(relativePath); directory !== "."; directory = dirname2(directory)) {
+        directories.add(join2(releaseDir, directory));
+      }
+    }
+    if (![...directories].every((directory) => lstatSync(directory).isDirectory())) return false;
+    const files = ["manifest.json", "package.json", "node", ...Object.values(HOOK_RUNTIME_ENTRIES)];
+    return files.every((relativePath) => lstatSync(join2(releaseDir, relativePath)).isFile());
+  } catch {
+    return false;
+  }
+}
+function readReleaseManifest(releaseDir, releaseName) {
+  try {
+    const manifestPath = join2(releaseDir, "manifest.json");
+    const manifestStat = statSync(manifestPath);
+    if (!manifestStat.isFile() || manifestStat.size > MAX_MANIFEST_BYTES) return null;
+    const raw = readFileSync2(manifestPath, "utf8");
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+    if (!exactKeys(parsed, ["schemaVersion", "version", "nodePath", "files"])) return null;
+    const candidate = parsed;
+    if (candidate.schemaVersion !== HOOK_RUNTIME_SCHEMA_VERSION || typeof candidate.version !== "string" || compareSemver(candidate.version, candidate.version) !== 0 || typeof candidate.nodePath !== "string" || !isAbsolute2(candidate.nodePath) || /[\r\n]/u.test(candidate.nodePath) || !candidate.files || typeof candidate.files !== "object" || Array.isArray(candidate.files) || !exactKeys(candidate.files, Object.keys(HOOK_RUNTIME_ENTRIES)) || Object.values(candidate.files).some(
+      (digest) => typeof digest !== "string" || !/^[0-9a-f]{64}$/u.test(digest)
+    )) {
+      return null;
+    }
+    const manifest = candidate;
+    if (raw !== exactManifest(manifest) || releaseName !== `${RELEASE_PREFIX}${releaseId(manifest)}` || !validateRelease(releaseDir, manifest)) {
+      return null;
+    }
+    return manifest;
+  } catch {
+    return null;
+  }
+}
+function readSelectedRelease(paths) {
+  let raw;
+  try {
+    raw = readFileSync2(paths.current, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+  const name = raw.endsWith("\n") ? raw.slice(0, -1) : "";
+  if (`${name}
+` !== raw || !RELEASE_NAME_RE.test(name)) {
+    throw new Error("cannot stage hook runtime: selected release is malformed");
+  }
+  const dir = join2(paths.releasesDir, name);
+  const manifest = readReleaseManifest(dir, name);
+  if (!manifest) {
+    throw new Error("cannot stage hook runtime: immutable release is corrupt");
+  }
+  return { name, dir, manifest };
+}
+function releaseEntries(paths) {
+  return readdirSync(paths.releasesDir, { withFileTypes: true }).flatMap((entry) => {
+    if (!entry.isDirectory() || !RELEASE_NAME_RE.test(entry.name)) return [];
+    const dir = join2(paths.releasesDir, entry.name);
+    try {
+      return [{ name: entry.name, dir, mtimeMs: statSync(dir).mtimeMs }];
+    } catch {
+      return [];
+    }
+  });
+}
+function pruneReleases(paths, protectedNames, reserveSlots, now) {
+  const entries = releaseEntries(paths).sort(
+    (left, right) => right.mtimeMs - left.mtimeMs || left.name.localeCompare(right.name)
+  );
+  const protectedWithPredecessors = new Set(protectedNames);
+  for (const entry of entries) {
+    if (protectedWithPredecessors.size >= protectedNames.size + RETAIN_PREDECESSORS) break;
+    if (!protectedWithPredecessors.has(entry.name)) protectedWithPredecessors.add(entry.name);
+  }
+  const candidates = entries.filter(
+    (entry) => !protectedWithPredecessors.has(entry.name) && now - entry.mtimeMs >= RELEASE_GRACE_MS
+  ).sort((left, right) => left.mtimeMs - right.mtimeMs || left.name.localeCompare(right.name));
+  let remaining = entries.length;
+  let deleted = 0;
+  for (const entry of candidates) {
+    if (remaining + reserveSlots <= MAX_RELEASES || deleted >= MAX_RELEASE_DELETIONS_PER_STAGE) {
+      break;
+    }
+    rmSync(entry.dir, { recursive: true, force: true });
+    remaining -= 1;
+    deleted += 1;
+  }
+  if (remaining + reserveSlots > MAX_RELEASES) {
+    throw new Error(
+      "cannot stage hook runtime: release retention is full while recent runtimes are protected"
+    );
+  }
+}
+function sourceManifest(sourceDir, version, nodePath) {
+  const files = {};
+  for (const [bin, relativePath] of Object.entries(SOURCE_ENTRIES)) {
+    const source = join2(sourceDir, relativePath);
+    if (!existsSync2(source) || !statSync(source).isFile()) {
+      throw new Error(`cannot stage hook runtime: missing self-contained ${bin} bundle`);
+    }
+    files[bin] = sha256(source);
+  }
+  return { schemaVersion: HOOK_RUNTIME_SCHEMA_VERSION, version, nodePath, files };
+}
+var STABLE_HOOK_LAUNCHER_CONTENT = `#!/bin/sh
+set -eu
+case "$0" in */*) prim_launcher_dir=\${0%/*} ;; *) exit 78 ;; esac
+IFS= read -r prim_release_name < "$prim_launcher_dir/hook-runtime/current" || exit 69
+case "$prim_release_name" in ${RELEASE_PREFIX}*) ;; *) exit 69 ;; esac
+prim_release_id=\${prim_release_name#${RELEASE_PREFIX}}
+case "$prim_release_id" in *[!0-9a-f]*|"") exit 69 ;; esac
+[ "\${#prim_release_id}" -eq 64 ] || exit 69
+prim_release="$prim_launcher_dir/hook-runtime/releases/$prim_release_name"
+case "\${1-}" in
+${Object.entries(HOOK_RUNTIME_ENTRIES).map(([bin, entry]) => `  ${bin}) prim_entry="$prim_release/${entry}" ;;`).join("\n")}
+  *) exit 64 ;;
+esac
+shift
+IFS= read -r prim_node < "$prim_release/node" || exit 69
+case "$prim_node" in /*) ;; *) exit 69 ;; esac
+[ -x "$prim_node" ] && [ -f "$prim_entry" ] || exit 69
+exec "$prim_node" "$prim_entry" "$@"
+`;
+function privateDirectory(path) {
+  const stat = lstatIfPresent(path);
+  if (!stat?.isDirectory()) return false;
+  if (process.platform === "win32") return true;
+  const uid = process.getuid?.();
+  return (Number(stat.mode) & 511) === DIRECTORY_MODE && (uid === void 0 || stat.uid === uid);
+}
+function privateFile(path, mode) {
+  const stat = lstatIfPresent(path);
+  if (!stat?.isFile()) return false;
+  if (process.platform === "win32") return true;
+  const uid = process.getuid?.();
+  return (Number(stat.mode) & 511) === mode && (uid === void 0 || stat.uid === uid);
+}
+function hasSafeRuntimeLayout(paths, selected) {
+  const releaseDirectories = /* @__PURE__ */ new Set([selected.dir]);
+  for (const relativePath of Object.values(HOOK_RUNTIME_ENTRIES)) {
+    for (let directory = dirname2(relativePath); directory !== "."; directory = dirname2(directory)) {
+      releaseDirectories.add(join2(selected.dir, directory));
+    }
+  }
+  if (!privateDirectory(paths.configDir) || !privateDirectory(paths.runtimeDir) || !privateDirectory(paths.releasesDir) || ![...releaseDirectories].every(privateDirectory) || !privateFile(paths.launcher, LAUNCHER_MODE) || !privateFile(paths.current, DATA_FILE_MODE) || !privateFile(join2(selected.dir, "manifest.json"), DATA_FILE_MODE) || !privateFile(join2(selected.dir, "package.json"), DATA_FILE_MODE) || !privateFile(join2(selected.dir, "node"), DATA_FILE_MODE)) {
+    return false;
+  }
+  return Object.values(HOOK_RUNTIME_ENTRIES).every(
+    (relativePath) => privateFile(join2(selected.dir, relativePath), DATA_FILE_MODE)
+  );
+}
+function recordedNodeMatchesCurrentProcess(nodePath) {
+  try {
+    if (!statSync(nodePath).isFile()) return false;
+    accessSync(nodePath, constants.X_OK);
+    return realpathSync(nodePath) === realpathSync(process.execPath);
+  } catch {
+    return false;
+  }
+}
+function inspectHookRuntime(options = {}) {
+  let paths;
+  try {
+    paths = hookRuntimePaths(options);
+  } catch {
+    return { state: "invalid" };
+  }
+  const launcher = lstatIfPresent(paths.launcher);
+  const selector = lstatIfPresent(paths.current);
+  if (!(launcher || selector)) return { state: "missing" };
+  if (!(launcher && selector)) return { state: "invalid" };
+  try {
+    if (readFileSync2(paths.launcher, "utf8") !== STABLE_HOOK_LAUNCHER_CONTENT) {
+      return { state: "invalid" };
+    }
+    const selected = readSelectedRelease(paths);
+    if (!selected) return { state: "invalid" };
+    assertOwnedHookRuntime(paths);
+    if (!hasSafeRuntimeLayout(paths, selected)) return { state: "invalid" };
+    return recordedNodeMatchesCurrentProcess(selected.manifest.nodePath) ? { state: "ready", version: selected.manifest.version } : { state: "invalid" };
+  } catch {
+    return { state: "invalid" };
+  }
+}
+function writeRelease(sourceDir, releaseDir, manifest, releasesDir) {
+  const stagingDir = mkdtempSync(join2(releasesDir, ".stage-"));
+  chmodSync(stagingDir, DIRECTORY_MODE);
+  try {
+    const directories = /* @__PURE__ */ new Set([stagingDir]);
+    const syncStagedFile = (path) => {
+      syncFile(path);
+      for (let directory = dirname2(path); ; directory = dirname2(directory)) {
+        directories.add(directory);
+        if (directory === stagingDir) break;
+      }
+    };
+    for (const [bin, targetRelative] of Object.entries(HOOK_RUNTIME_ENTRIES)) {
+      const source = join2(sourceDir, SOURCE_ENTRIES[bin]);
+      const target = join2(stagingDir, targetRelative);
+      mkdirSync(dirname2(target), { recursive: true, mode: DIRECTORY_MODE });
+      chmodSync(dirname2(target), DIRECTORY_MODE);
+      copyFileSync(source, target);
+      chmodSync(target, DATA_FILE_MODE);
+      if (sha256(target) !== manifest.files[bin]) {
+        throw new Error(`cannot stage hook runtime: ${bin} changed while it was copied`);
+      }
+      syncStagedFile(target);
+    }
+    const nodePath = join2(stagingDir, "node");
+    writeFileSync(nodePath, `${manifest.nodePath}
+`, {
+      encoding: "utf8",
+      flag: "wx",
+      mode: DATA_FILE_MODE
+    });
+    syncStagedFile(nodePath);
+    const packageJsonPath = join2(stagingDir, "package.json");
+    writeFileSync(packageJsonPath, runtimePackageJson(manifest), {
+      encoding: "utf8",
+      flag: "wx",
+      mode: DATA_FILE_MODE
+    });
+    syncStagedFile(packageJsonPath);
+    const manifestPath = join2(stagingDir, "manifest.json");
+    writeFileSync(manifestPath, exactManifest(manifest), {
+      encoding: "utf8",
+      flag: "wx",
+      mode: DATA_FILE_MODE
+    });
+    syncStagedFile(manifestPath);
+    for (const directory of [...directories].sort((left, right) => right.length - left.length)) {
+      syncDirectory(directory);
+    }
+    try {
+      renameSync(stagingDir, releaseDir);
+    } catch (error) {
+      const code = error.code;
+      if (code !== "EEXIST" && code !== "ENOTEMPTY" || !validateRelease(releaseDir, manifest)) {
+        throw error;
+      }
+    }
+  } finally {
+    rmSync(stagingDir, { recursive: true, force: true });
+  }
+}
+function stageHookRuntime(options = {}) {
+  const root = packageRoot();
+  const sourceDir = options.sourceDir ?? (root ? join2(root, "dist", "hook-runtime") : null);
+  const version = options.version ?? packageVersion();
+  const nodePath = resolve(options.nodePath ?? process.execPath);
+  if (!sourceDir || !version || compareSemver(version, version) !== 0 || !isAbsolute2(nodePath) || /[\r\n]/u.test(nodePath)) {
+    throw new Error("cannot stage hook runtime: package identity is unavailable");
+  }
+  const manifest = sourceManifest(sourceDir, version, nodePath);
+  const paths = hookRuntimePaths(options);
+  const releaseName = `${RELEASE_PREFIX}${releaseId(manifest)}`;
+  const releaseDir = join2(paths.releasesDir, releaseName);
+  mkdirSync(paths.releasesDir, { recursive: true, mode: DIRECTORY_MODE });
+  chmodSync(paths.configDir, DIRECTORY_MODE);
+  chmodSync(paths.runtimeDir, DIRECTORY_MODE);
+  chmodSync(paths.releasesDir, DIRECTORY_MODE);
+  return withFileLockSync(paths.selectionLock, () => {
+    const now = Date.now();
+    const selected = readSelectedRelease(paths);
+    if (selected) utimesSync(selected.dir, now / 1e3, now / 1e3);
+    const precedence = selected ? compareSemver(selected.manifest.version, manifest.version) : -1;
+    if (precedence === void 0) {
+      throw new Error("cannot stage hook runtime: selected release version is malformed");
+    }
+    const selectRequested = !selected || precedence < 0;
+    const requestedExists = existsSync2(releaseDir);
+    const protectedBefore = new Set(selected ? [selected.name] : []);
+    if (selectRequested && requestedExists) protectedBefore.add(releaseName);
+    pruneReleases(paths, protectedBefore, selectRequested && !requestedExists ? 1 : 0, now);
+    if (selectRequested && !validateRelease(releaseDir, manifest)) {
+      if (requestedExists) {
+        throw new Error("cannot stage hook runtime: immutable release is corrupt");
+      }
+      writeRelease(sourceDir, releaseDir, manifest, paths.releasesDir);
+    }
+    const finalRelease = selectRequested ? { name: releaseName, dir: releaseDir, manifest } : selected;
+    const launcherCurrent = (() => {
+      try {
+        return readFileSync2(paths.launcher, "utf8") === STABLE_HOOK_LAUNCHER_CONTENT;
+      } catch {
+        return false;
+      }
+    })();
+    const selectorCurrent = selected?.name === finalRelease.name;
+    if (!launcherCurrent) {
+      atomicWriteFile(paths.launcher, STABLE_HOOK_LAUNCHER_CONTENT, {
+        ensureParent: true,
+        mode: LAUNCHER_MODE
+      });
+    }
+    if (!selectorCurrent) {
+      syncDirectory(paths.releasesDir);
+      atomicWriteFile(paths.current, `${finalRelease.name}
+`, {
+        ensureParent: true,
+        mode: DATA_FILE_MODE
+      });
+    }
+    utimesSync(finalRelease.dir, now / 1e3, now / 1e3);
+    pruneReleases(
+      paths,
+      /* @__PURE__ */ new Set([finalRelease.name, ...selected ? [selected.name] : []]),
+      0,
+      now
+    );
+    return {
+      changed: !launcherCurrent || !selectorCurrent,
+      releaseDir: finalRelease.dir,
+      manifest: finalRelease.manifest,
+      paths
+    };
+  });
+}
+function lstatIfPresent(path) {
+  try {
+    return lstatSync(path);
+  } catch (error) {
+    const code = error.code;
+    if (code === "ENOENT" || code === "ENOTDIR") return void 0;
+    throw error;
+  }
+}
+function assertOwnedHookRuntime(paths) {
+  const launcher = lstatIfPresent(paths.launcher);
+  if (launcher) {
+    if (!launcher.isFile() || readFileSync2(paths.launcher, "utf8") !== STABLE_HOOK_LAUNCHER_CONTENT) {
+      throw new Error(`refusing to remove unrecognized hook launcher at ${paths.launcher}`);
+    }
+  }
+  const runtime = lstatIfPresent(paths.runtimeDir);
+  if (!runtime) return;
+  if (!runtime.isDirectory()) {
+    throw new Error(`refusing to remove non-directory hook runtime at ${paths.runtimeDir}`);
+  }
+  const allowed = /* @__PURE__ */ new Set(["current", "releases", "selection.lock"]);
+  const unexpected = readdirSync(paths.runtimeDir).filter((entry) => !allowed.has(entry));
+  if (unexpected.length > 0) {
+    throw new Error(
+      `refusing to remove hook runtime with unrecognized entries: ${unexpected.sort().join(", ")}`
+    );
+  }
+  const current = lstatIfPresent(paths.current);
+  const releases = lstatIfPresent(paths.releasesDir);
+  if (current) {
+    if (!current.isFile() || !releases || !readSelectedRelease(paths)) {
+      throw new Error(`refusing to remove malformed hook runtime selection at ${paths.current}`);
+    }
+  }
+  if (!releases) return;
+  if (!releases.isDirectory()) {
+    throw new Error(`refusing to remove non-directory hook releases at ${paths.releasesDir}`);
+  }
+  for (const entry of readdirSync(paths.releasesDir, { withFileTypes: true })) {
+    const releaseDir = join2(paths.releasesDir, entry.name);
+    if (!entry.isDirectory() || !RELEASE_NAME_RE.test(entry.name) || !readReleaseManifest(releaseDir, entry.name)) {
+      throw new Error(`refusing to remove unrecognized hook release ${releaseDir}`);
+    }
+  }
+}
+function removeHookRuntime(options = {}) {
+  const paths = hookRuntimePaths(options);
+  const hadLauncher = lstatIfPresent(paths.launcher) !== void 0;
+  const hadRuntime = lstatIfPresent(paths.runtimeDir) !== void 0;
+  if (!hadLauncher && !hadRuntime) return { changed: false, paths };
+  assertOwnedHookRuntime(paths);
+  if (!hadRuntime) {
+    rmSync(paths.launcher, { force: true });
+    return { changed: hadLauncher, paths };
+  }
+  withFileLockSync(paths.selectionLock, () => {
+    assertOwnedHookRuntime(paths);
+    if (lstatIfPresent(paths.launcher)) rmSync(paths.launcher, { force: true });
+    const quarantined = `${paths.runtimeDir}.uninstall-${String(process.pid)}-${randomBytes(8).toString("hex")}`;
+    renameSync(paths.runtimeDir, quarantined);
+    rmSync(quarantined, { recursive: true, force: true });
+  });
+  return { changed: true, paths };
+}
+
+// src/commands/claude-install.ts
+var CAPTURE_BIN = "prim-hook";
+var GATE_BIN = "prim-pre-tool-use";
+var POST_TOOL_USE_BIN = "prim-post-tool-use";
+var SESSION_START_BIN = "prim-session-start";
+var SESSION_END_BIN = "prim-session-end";
+var STATUSLINE_BIN = "prim-statusline";
+var STATUSLINE_ARGS = "";
+var STATUSLINE_COMMAND = stableHookCommand(STATUSLINE_BIN, STATUSLINE_ARGS);
+var STATUSLINE_REFRESH_SECONDS = 5;
+var PRIM_BINS = [
+  CAPTURE_BIN,
+  GATE_BIN,
+  POST_TOOL_USE_BIN,
+  SESSION_START_BIN,
+  SESSION_END_BIN
+];
+var JSON_INDENT = 2;
+var USER_SCOPE_PATH = join3(homedir(), ".claude", "settings.json");
+function projectRoot() {
+  return gitToplevel() ?? process.cwd();
+}
+var projectScopePath = () => join3(projectRoot(), ".claude", "settings.json");
+var CAPTURE_EVENTS = [
+  "SessionStart",
+  "UserPromptSubmit",
+  "PreToolUse",
+  "PostToolUse",
+  "PostToolUseFailure",
+  "Stop",
+  "SessionEnd",
+  "SubagentStop"
+];
+function makeRegistration(event, matcher, bin, args = "") {
+  return {
+    event,
+    matcher,
+    bin,
+    command: stableHookCommand(bin, args)
+  };
+}
+function makeDetachedRegistration(event, matcher, bin, args = "") {
+  return { event, matcher, bin, command: detachedHookShimCommand(bin, args) };
+}
+var REGISTRATIONS = [
+  ...CAPTURE_EVENTS.map(
+    (event) => event === "SessionEnd" ? makeDetachedRegistration(event, "*", CAPTURE_BIN) : makeRegistration(event, "*", CAPTURE_BIN)
+  ),
+  makeRegistration("PreToolUse", "Edit|Write|MultiEdit|NotebookEdit|Bash", GATE_BIN),
+  makeRegistration("PostToolUse", "Edit|Write|MultiEdit|NotebookEdit|Bash", POST_TOOL_USE_BIN),
+  makeRegistration(
+    "PostToolUseFailure",
+    "Edit|Write|MultiEdit|NotebookEdit|Bash",
+    POST_TOOL_USE_BIN
+  ),
+  makeRegistration("SessionStart", "*", SESSION_START_BIN),
+  makeDetachedRegistration("SessionEnd", "*", SESSION_END_BIN)
+];
+var PRIM_PERMISSION_RULE = "Bash(npx --yes @primitive.ai/prim*)";
+var LEGACY_PRIM_PERMISSION_RULES = [
+  "Bash(npx --yes @primitive.ai/prim@latest:*)",
+  "Bash(npx --yes @primitive.ai/prim:*)"
+];
+var ALL_PRIM_PERMISSION_RULES = /* @__PURE__ */ new Set([
+  PRIM_PERMISSION_RULE,
+  ...LEGACY_PRIM_PERMISSION_RULES
+]);
+var PRIM_AUTOMODE_TRUST = "Primitive CLI (prim): the @primitive.ai/prim npm package \u2014 run via `npx --yes @primitive.ai/prim \u2026` \u2014 and its API at api.getprimitive.ai are trusted developer tooling this user installed for passive decision capture, conflict checks, and team presence. Running prim and its routine API/daemon calls is expected, not untrusted code execution or data exfiltration.";
+var AUTOMODE_DEFAULTS = "$defaults";
+function settingsPathFor(scope) {
+  return scope === "user" ? USER_SCOPE_PATH : projectScopePath();
+}
+function readSettings(path) {
+  if (!existsSync3(path)) {
+    return {};
+  }
+  const raw = readFileSync3(path, "utf-8");
+  try {
+    return JSON.parse(raw);
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    throw new Error(`${path} is not valid JSON: ${detail}`);
+  }
+}
+function entryHasCommand(entry, bin) {
+  return entry.hooks?.some((h) => commandMatchesBin(h.command, bin)) ?? false;
+}
+function ownedRegistrationEntries(settings) {
+  return Object.entries(settings.hooks ?? {}).flatMap(
+    ([event, entries]) => (entries ?? []).filter((entry) => PRIM_BINS.some((bin) => entryHasCommand(entry, bin))).map((entry) => ({ event, entry }))
+  );
+}
+function hasAnyHookRegistration(settings) {
+  return ownedRegistrationEntries(settings).length > 0;
+}
+function entryMatchesRegistration(owned, registration) {
+  return owned.event === registration.event && owned.entry.matcher === registration.matcher && owned.entry.hooks?.length === 1 && owned.entry.hooks[0].type === "command" && owned.entry.hooks[0].command === registration.command;
+}
+function hasCompleteHookRegistration(settings) {
+  const owned = ownedRegistrationEntries(settings);
+  return owned.length === REGISTRATIONS.length && REGISTRATIONS.every(
+    (registration) => owned.filter((entry) => entryMatchesRegistration(entry, registration)).length === 1
+  );
+}
+function canonicalEntry(reg) {
+  return { matcher: reg.matcher, hooks: [{ type: "command", command: reg.command }] };
+}
+function stripCommand(list, bin) {
+  const out = [];
+  for (const e of list) {
+    const hooks = (e.hooks ?? []).filter((h) => !commandMatchesBin(h.command, bin));
+    if (hooks.length > 0) {
+      out.push({ ...e, hooks });
+    }
+  }
+  return out;
+}
+function ensureRegistration(list, reg, force) {
+  const isCanonical = (e) => e.matcher === reg.matcher && e.hooks?.length === 1 && e.hooks[0].command === reg.command;
+  const hasStray = (e) => !isCanonical(e) && (e.hooks ?? []).some((h) => commandMatchesBin(h.command, reg.bin));
+  if (list.some(isCanonical) && !list.some(hasStray) && !force) {
+    return list;
+  }
+  return [...stripCommand(list, reg.bin), canonicalEntry(reg)];
+}
+var LEGACY_STATUSLINE_COMMAND = "prim statusline";
+var RUNTIME_STATUSLINE_SUFFIXES = [
+  "/prim/runtime/prim-statusline",
+  // One pre-launcher build persisted the JS entry directly. Keep recognizing
+  // it so reinstall migrates and uninstall removes that older staged form.
+  "/prim/runtime/current/prim-statusline"
+];
+function isPrimStatusLine(settings) {
+  const s = settings.statusLine;
+  if (s?.type !== "command") {
+    return false;
+  }
+  const c = (s.command ?? "").trim();
+  return c === LEGACY_STATUSLINE_COMMAND || c.includes("@primitive.ai/prim") && c.includes("statusline") || c.includes("prim-hook-launcher-v1") && commandMatchesBin(c, STATUSLINE_BIN) || RUNTIME_STATUSLINE_SUFFIXES.some((suffix) => c.includes(suffix));
+}
+function hookRuntimeResolutions(settings) {
+  const resolutions = hookCommandResolutions(
+    Object.values(settings.hooks ?? {}).flatMap(
+      (entries) => (entries ?? []).flatMap((entry) => (entry.hooks ?? []).map((hook) => hook.command))
+    ),
+    PRIM_BINS
+  );
+  if (!isPrimStatusLine(settings)) return resolutions;
+  const statusline = hookCommandResolution(settings.statusLine?.command, STATUSLINE_BIN);
+  resolutions.push(statusline ?? { kind: "legacy_path" });
+  return resolutions;
+}
+function inspectHookRuntimeResolutions() {
+  return [
+    ...hookRuntimeResolutions(readSettings(USER_SCOPE_PATH)),
+    ...hookRuntimeResolutions(readSettings(projectScopePath()))
+  ];
+}
+function applyStatusLine(settings, command = STATUSLINE_COMMAND) {
+  if (command === false) {
+    return isPrimStatusLine(settings) ? { ...settings, statusLine: void 0 } : settings;
+  }
+  if (settings.statusLine && !isPrimStatusLine(settings)) {
+    return settings;
+  }
+  return {
+    ...settings,
+    statusLine: {
+      type: "command",
+      command,
+      refreshInterval: STATUSLINE_REFRESH_SECONDS
+    }
+  };
+}
+function applyPermissions(settings) {
+  const permissions = settings.permissions ?? {};
+  const allow = permissions.allow ?? [];
+  const hasCanonical = allow.includes(PRIM_PERMISSION_RULE);
+  const hasLegacy = allow.some((rule) => LEGACY_PRIM_PERMISSION_RULES.includes(rule));
+  if (hasCanonical && !hasLegacy) {
+    return settings;
+  }
+  const withoutPrim = allow.filter((rule) => !ALL_PRIM_PERMISSION_RULES.has(rule));
+  return {
+    ...settings,
+    permissions: { ...permissions, allow: [...withoutPrim, PRIM_PERMISSION_RULE] }
+  };
+}
+function removePrimPermission(settings) {
+  const permissions = settings.permissions;
+  if (!permissions?.allow?.some((rule) => ALL_PRIM_PERMISSION_RULES.has(rule))) {
+    return settings;
+  }
+  const allow = permissions.allow.filter((rule) => !ALL_PRIM_PERMISSION_RULES.has(rule));
+  const nextPermissions = {
+    ...permissions,
+    allow: allow.length > 0 ? allow : void 0
+  };
+  const hasOtherPerms = Object.values(nextPermissions).some((v) => v !== void 0);
+  return { ...settings, permissions: hasOtherPerms ? nextPermissions : void 0 };
+}
+function applyAutoModeTrust(settings) {
+  const autoMode = settings.autoMode ?? {};
+  const env = autoMode.environment;
+  if (env?.includes(PRIM_AUTOMODE_TRUST)) {
+    return settings;
+  }
+  const nextEnv = env ? [...env, PRIM_AUTOMODE_TRUST] : [AUTOMODE_DEFAULTS, PRIM_AUTOMODE_TRUST];
+  return { ...settings, autoMode: { ...autoMode, environment: nextEnv } };
+}
+function removeAutoModeTrust(settings) {
+  const autoMode = settings.autoMode;
+  if (!autoMode?.environment?.includes(PRIM_AUTOMODE_TRUST)) {
+    return settings;
+  }
+  const env = autoMode.environment.filter((e) => e !== PRIM_AUTOMODE_TRUST);
+  const onlyDefaultsLeft = env.length === 0 || env.length === 1 && env[0] === AUTOMODE_DEFAULTS;
+  const nextAutoMode = {
+    ...autoMode,
+    environment: onlyDefaultsLeft ? void 0 : env
+  };
+  const hasOther = Object.values(nextAutoMode).some((v) => v !== void 0);
+  return { ...settings, autoMode: hasOther ? nextAutoMode : void 0 };
+}
+function applyInstall(settings, options = {}) {
+  const hooks = { ...settings.hooks ?? {} };
+  for (const reg of REGISTRATIONS) {
+    hooks[reg.event] = ensureRegistration(hooks[reg.event] ?? [], reg, options.force ?? false);
+  }
+  return applyPermissions(
+    applyStatusLine(
+      { ...settings, hooks },
+      options.installStatusline === false ? false : options.statuslineCommand ?? STATUSLINE_COMMAND
+    )
+  );
+}
+function applyUninstall(settings) {
+  const source = settings.hooks ?? {};
+  const hooks = {};
+  for (const event of Object.keys(source)) {
+    let list = source[event] ?? [];
+    for (const bin of PRIM_BINS) {
+      list = stripCommand(list, bin);
+    }
+    if (list.length > 0) {
+      hooks[event] = list;
+    }
+  }
+  const next = { ...settings, hooks };
+  if (isPrimStatusLine(next)) {
+    next.statusLine = void 0;
+  }
+  return removeAutoModeTrust(removePrimPermission(next));
+}
+function captureInstalled(settings) {
+  return CAPTURE_EVENTS.some(
+    (event) => (settings.hooks?.[event] ?? []).some((e) => entryHasCommand(e, CAPTURE_BIN))
+  );
+}
+function feedbackInstalled(settings) {
+  const stopCapture = (settings.hooks?.Stop ?? []).some(
+    (entry) => entryHasCommand(entry, CAPTURE_BIN)
+  );
+  const sessionStart = (settings.hooks?.SessionStart ?? []).some(
+    (entry) => entryHasCommand(entry, SESSION_START_BIN)
+  );
+  return stopCapture && sessionStart;
+}
+function statuslineInstalled(settings) {
+  return isPrimStatusLine(settings);
+}
+function statuslineState(settings) {
+  if (isPrimStatusLine(settings)) {
+    return "primitive";
+  }
+  return settings.statusLine ? "custom" : "empty";
+}
+function isGateInstalled(settings) {
+  return (settings.hooks?.PreToolUse ?? []).some((e) => entryHasCommand(e, GATE_BIN));
+}
+function atomicWrite(path, content) {
+  atomicWriteFile(path, `${JSON.stringify(content, null, JSON_INDENT)}
+`, {
+    ensureParent: true
+  });
+}
+function userStatuslineBlocksProjectInstall(scope, userSettings) {
+  return scope === "project" && statuslineState(userSettings) === "custom";
+}
+function performInstall(scope, force) {
+  stageHookRuntime();
+  const path = settingsPathFor(scope);
+  const before = readSettings(path);
+  const blockedByUserStatusline = userStatuslineBlocksProjectInstall(
+    scope,
+    scope === "project" ? readSettings(USER_SCOPE_PATH) : {}
+  );
+  const after = applyInstall(before, {
+    force,
+    statuslineCommand: STATUSLINE_COMMAND,
+    installStatusline: !blockedByUserStatusline
+  });
+  const changed = JSON.stringify(before) !== JSON.stringify(after);
+  if (changed) {
+    atomicWrite(path, after);
+  }
+  return {
+    scope,
+    path,
+    gate: isGateInstalled(after),
+    capture: captureInstalled(after),
+    feedback: feedbackInstalled(after),
+    statusline: statuslineInstalled(after),
+    statuslineState: statuslineState(after),
+    changed
+  };
+}
+function performUninstall(scope) {
+  const path = settingsPathFor(scope);
+  const before = readSettings(path);
+  const after = applyUninstall(before);
+  const changed = JSON.stringify(before) !== JSON.stringify(after);
+  if (changed) {
+    atomicWrite(path, after);
+  }
+  return {
+    scope,
+    path,
+    gate: isGateInstalled(after),
+    capture: captureInstalled(after),
+    feedback: feedbackInstalled(after),
+    statusline: statuslineInstalled(after),
+    statuslineState: statuslineState(after),
+    changed
+  };
+}
+function performPermissionInstall(scope) {
+  const path = settingsPathFor(scope);
+  const before = readSettings(path);
+  const after = applyAutoModeTrust(applyPermissions(before));
+  const changed = JSON.stringify(before) !== JSON.stringify(after);
+  if (changed) {
+    atomicWrite(path, after);
+  }
+  return {
+    scope,
+    path,
+    allowed: (after.permissions?.allow ?? []).includes(PRIM_PERMISSION_RULE),
+    autoModeTrusted: (after.autoMode?.environment ?? []).includes(PRIM_AUTOMODE_TRUST),
+    changed
+  };
+}
+function performStatus() {
+  const statusFor2 = (path) => {
+    const settings = readSettings(path);
+    return {
+      path,
+      present: hasAnyHookRegistration(settings) || statuslineInstalled(settings),
+      gate: isGateInstalled(settings),
+      capture: captureInstalled(settings),
+      feedback: feedbackInstalled(settings),
+      complete: hasCompleteHookRegistration(settings),
+      statusline: statuslineInstalled(settings),
+      statuslineState: statuslineState(settings)
+    };
+  };
+  return { user: statusFor2(USER_SCOPE_PATH), project: statusFor2(projectScopePath()) };
+}
+function resolveScope(input) {
+  if (input === void 0 || input === "project") {
+    return "project";
+  }
+  if (input === "user") {
+    return "user";
+  }
+  console.error(`[prim] unknown --scope "${input}" (expected: user or project)`);
+  process.exit(1);
+}
+function registerClaudeCommands(program) {
+  const claude = program.command("claude").description("Manage the prim Claude Code integration (capture, gate, ingest, presence)");
+  claude.command("install").description("Register the prim hooks + statusline in Claude Code's settings.json").option(
+    "--scope <scope>",
+    "project (default, the repo's .claude/settings.json) or user (~/.claude/settings.json)"
+  ).option("--force", "Replace any drifted prim hook entries").action((opts) => {
+    const scope = resolveScope(opts.scope);
+    const result = performInstall(scope, opts.force ?? false);
+    if (result.changed) {
+      console.error(
+        `[prim] Claude Code integration installed (${scope} scope) at ${result.path}`
+      );
+    } else {
+      console.error(
+        `[prim] Claude Code integration already present at ${result.path} (no changes)`
+      );
+    }
+    const projectState = scope === "user" ? performStatus().project.statuslineState : void 0;
+    const userState = scope === "project" ? performStatus().user.statuslineState : void 0;
+    if (result.statuslineState === "custom" || projectState === "custom" || userState === "custom") {
+      const owner = result.statuslineState === "custom" ? result.path : projectState === "custom" ? projectScopePath() : USER_SCOPE_PATH;
+      console.error(
+        `[prim] \u26A0 statusline skipped: an existing custom statusLine is preserved at ${owner}; run \`prim daemon status\` for Primitive health`
+      );
+    }
+    console.log(JSON.stringify(result, null, JSON_INDENT));
+  });
+  claude.command("preauth").description(
+    "Pre-authorize prim's own calls (allow-rule + auto-mode trust, no hooks) so they never prompt"
+  ).option(
+    "--scope <scope>",
+    "user (default for preauth \u2014 covers every repo) or project (this repo's .claude/settings.json)"
+  ).action((opts) => {
+    const scope = resolveScope(opts.scope ?? "user");
+    const result = performPermissionInstall(scope);
+    console.error(
+      result.changed ? `[prim] prim pre-authorization written (${scope} scope) at ${result.path} (allow-rule + auto-mode trust)` : `[prim] prim pre-authorization already present at ${result.path} (no changes)`
+    );
+    console.log(JSON.stringify(result, null, JSON_INDENT));
+  });
+  claude.command("uninstall").description("Remove all prim hooks + the prim statusline from settings.json").option(
+    "--scope <scope>",
+    "project (default, the repo's .claude/settings.json) or user (~/.claude/settings.json)"
+  ).action((opts) => {
+    const scope = resolveScope(opts.scope);
+    const result = performUninstall(scope);
+    if (result.changed) {
+      console.error(`[prim] prim hooks removed from ${result.path}`);
+    } else {
+      console.error(`[prim] no prim hooks to remove at ${result.path} (nothing changed)`);
+    }
+    console.log(JSON.stringify(result, null, JSON_INDENT));
+  });
+  claude.command("status").description(
+    "Report whether each prim surface (gate, capture, feedback, statusline) is installed per scope"
+  ).action(() => {
+    const result = performStatus();
+    const mark = (b) => b ? "\u2713" : "\u2717";
+    const line = (label, s) => `[prim] ${label}: gate ${mark(s.gate)} \xB7 capture ${mark(s.capture)} \xB7 feedback ${mark(s.feedback)} \xB7 statusline ${s.statuslineState} (${s.path})`;
+    console.error(`${line("user", result.user)}
+${line("project", result.project)}`);
+    console.log(JSON.stringify(result, null, JSON_INDENT));
+  });
+}
+
+// src/commands/cursor-install.ts
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
+import { homedir as homedir2 } from "os";
+import { isAbsolute as isAbsolute3, join as join4 } from "path";
+var CAPTURE_BIN2 = "prim-hook";
+var GATE_BIN2 = "prim-pre-tool-use";
+var POST_TOOL_BIN = "prim-post-tool-use";
+var SESSION_START_BIN2 = "prim-session-start";
+var SESSION_END_BIN2 = "prim-session-end";
+var STATUSLINE_BIN2 = "prim-statusline";
+var PRIM_BINS2 = [CAPTURE_BIN2, GATE_BIN2, POST_TOOL_BIN, SESSION_START_BIN2, SESSION_END_BIN2];
+var CURSOR_EVENTS = [
+  "sessionStart",
+  "beforeSubmitPrompt",
+  "preToolUse",
+  "postToolUse",
+  "postToolUseFailure",
+  "afterAgentResponse",
+  "subagentStop",
+  "stop",
+  "sessionEnd"
+];
+var REGISTRATIONS2 = [
+  ...CURSOR_EVENTS.map((event) => ({ event, bin: CAPTURE_BIN2 })),
+  { event: "preToolUse", bin: GATE_BIN2, matcher: "Write|Delete|Shell", timeout: 10 },
+  { event: "postToolUse", bin: POST_TOOL_BIN },
+  { event: "postToolUseFailure", bin: POST_TOOL_BIN },
+  { event: "sessionStart", bin: SESSION_START_BIN2 },
+  { event: "sessionEnd", bin: SESSION_END_BIN2 }
+];
+function cursorConfigDirectory(env = process.env, home = homedir2(), platform = process.platform) {
+  const explicit = env.CURSOR_CONFIG_DIR?.trim();
+  if (explicit && isAbsolute3(explicit)) return explicit;
+  const xdg = env.XDG_CONFIG_HOME?.trim();
+  if (platform !== "darwin" && xdg && isAbsolute3(xdg)) return join4(xdg, "cursor");
+  return join4(home, ".cursor");
+}
+function cursorHooksPath(scope, root = projectRoot()) {
+  return scope === "user" ? join4(cursorConfigDirectory(), "hooks.json") : join4(root, ".cursor", "hooks.json");
+}
+function cursorCliConfigPath() {
+  return join4(cursorConfigDirectory(), "cli-config.json");
+}
+function plainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readCursorHooks(path) {
+  if (!existsSync4(path)) return {};
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync4(path, "utf8"));
+  } catch {
+    throw new Error(`invalid Cursor hooks JSON at ${path}`);
+  }
+  if (!plainObject(parsed)) throw new Error(`Cursor hooks config must be an object: ${path}`);
+  if (parsed.version !== void 0 && parsed.version !== 1) {
+    throw new Error(`unsupported Cursor hooks version at ${path} (expected version 1)`);
+  }
+  if (parsed.hooks !== void 0) {
+    if (!plainObject(parsed.hooks)) throw new Error(`Cursor hooks must be an object: ${path}`);
+    for (const [event, entries] of Object.entries(parsed.hooks)) {
+      if (!Array.isArray(entries) || !entries.every(plainObject)) {
+        throw new Error(`Cursor hook list must contain objects: ${event} in ${path}`);
+      }
+    }
+  }
+  return parsed;
+}
+function readObject(path) {
+  if (!existsSync4(path)) return {};
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync4(path, "utf8"));
+  } catch {
+    throw new Error(`invalid Cursor CLI config JSON at ${path}`);
+  }
+  if (!plainObject(parsed)) throw new Error(`Cursor CLI config must be an object: ${path}`);
+  return parsed;
+}
+function writeJson(path, value) {
+  atomicWriteFile(path, `${JSON.stringify(value, null, 2)}
+`, { ensureParent: true });
+}
+function commandFor(registration, scope) {
+  return stableHookCommand(
+    registration.bin,
+    `--agent cursor --event ${registration.event} --scope ${scope}`
+  );
+}
+var OWNED_COMMANDS = new Set(
+  ["project", "user"].flatMap(
+    (scope) => REGISTRATIONS2.map((registration) => commandFor(registration, scope))
+  )
+);
+function jsoncUnsafeCommand(command) {
+  return command.replace('case "$1" in [/]* ', 'case "$1" in /*').replace("*[/][/]*", "*//*").replace("*[/].[/]*", "*/./*").replace("*[/]..[/]*", "*/../*").replace("*[/].", "*/.").replace("*[/]..", "*/..").replace("?*[/]", "?*/");
+}
+var JSONC_UNSAFE_OWNED_COMMANDS = new Set([...OWNED_COMMANDS].map(jsoncUnsafeCommand));
+function isOwnedCursorHookCommand(command) {
+  return typeof command === "string" && (OWNED_COMMANDS.has(command) || JSONC_UNSAFE_OWNED_COMMANDS.has(command));
+}
+function hookFor(registration, scope) {
+  return {
+    command: commandFor(registration, scope),
+    ...registration.matcher ? { matcher: registration.matcher } : {},
+    ...registration.timeout ? { timeout: registration.timeout } : {}
+  };
+}
+function exactHook(entry, registration, scope) {
+  return JSON.stringify(entry) === JSON.stringify(hookFor(registration, scope));
+}
+function applyCursorInstall(settings, scope) {
+  const hooks = {};
+  for (const [event, entries] of Object.entries(settings.hooks ?? {})) {
+    hooks[event] = entries.filter((entry) => !isOwnedCursorHookCommand(entry.command));
+  }
+  for (const registration of REGISTRATIONS2) {
+    const entries = hooks[registration.event] ?? [];
+    entries.push(hookFor(registration, scope));
+    hooks[registration.event] = entries;
+  }
+  return { ...settings, version: 1, hooks };
+}
+function applyCursorUninstall(settings) {
+  const hooks = {};
+  for (const [event, entries] of Object.entries(settings.hooks ?? {})) {
+    const retained = entries.filter((entry) => !isOwnedCursorHookCommand(entry.command));
+    if (retained.length > 0) hooks[event] = retained;
+  }
+  return { ...settings, hooks };
+}
+function ownedEntries(settings) {
+  return Object.entries(settings.hooks ?? {}).flatMap(
+    ([event, entries]) => entries.filter((entry) => isOwnedCursorHookCommand(entry.command)).map((entry) => ({ event, entry }))
+  );
+}
+function hasExactCursorHandler(settings, event, bin, scope) {
+  const registration = REGISTRATIONS2.find(
+    (candidate) => candidate.event === event && candidate.bin === bin
+  );
+  return registration ? (settings.hooks?.[event] ?? []).some((entry) => exactHook(entry, registration, scope)) : false;
+}
+function complete(settings, scope) {
+  const owned = ownedEntries(settings);
+  return owned.length === REGISTRATIONS2.length && REGISTRATIONS2.every(
+    (registration) => owned.filter(
+      ({ event, entry }) => event === registration.event && exactHook(entry, registration, scope)
+    ).length === 1
+  );
+}
+function captureInstalled2(settings, scope) {
+  return CURSOR_EVENTS.every((event) => hasExactCursorHandler(settings, event, CAPTURE_BIN2, scope));
+}
+function gateInstalled(settings, scope) {
+  return hasExactCursorHandler(settings, "preToolUse", GATE_BIN2, scope);
+}
+var FOOTER = {
+  type: "command",
+  command: stableHookCommand(STATUSLINE_BIN2),
+  updateIntervalMs: 1e3,
+  timeoutMs: 2e3
+};
+var JSONC_UNSAFE_FOOTER = {
+  ...FOOTER,
+  command: jsoncUnsafeCommand(FOOTER.command)
+};
+function exactFooter(value) {
+  return plainObject(value) && JSON.stringify(value) === JSON.stringify(FOOTER);
+}
+function jsoncUnsafeFooter(value) {
+  return plainObject(value) && JSON.stringify(value) === JSON.stringify(JSONC_UNSAFE_FOOTER);
+}
+function applyCursorFooterInstall(config) {
+  if (config.statusLine === void 0)
+    return { config: { ...config, statusLine: FOOTER }, installed: true, preservedCustom: false };
+  if (exactFooter(config.statusLine)) return { config, installed: true, preservedCustom: false };
+  if (jsoncUnsafeFooter(config.statusLine)) {
+    return { config: { ...config, statusLine: FOOTER }, installed: true, preservedCustom: false };
+  }
+  return { config, installed: false, preservedCustom: true };
+}
+function applyCursorFooterUninstall(config) {
+  if (!exactFooter(config.statusLine) && !jsoncUnsafeFooter(config.statusLine)) {
+    return { config, removed: false };
+  }
+  return {
+    config: Object.fromEntries(Object.entries(config).filter(([key]) => key !== "statusLine")),
+    removed: true
+  };
+}
+function statusFor(scope, path = cursorHooksPath(scope)) {
+  const settings = readCursorHooks(path);
+  const base = {
+    path,
+    present: ownedEntries(settings).length > 0,
+    gate: gateInstalled(settings, scope),
+    capture: captureInstalled2(settings, scope),
+    complete: complete(settings, scope)
+  };
+  if (scope === "user") {
+    const cliConfig = readObject(cursorCliConfigPath());
+    base.footer = exactFooter(cliConfig.statusLine);
+    base.footerPreservedCustom = cliConfig.statusLine !== void 0 && !base.footer;
+  }
+  return base;
+}
+function performInstall2(scope, _force = false) {
+  stageHookRuntime();
+  const path = cursorHooksPath(scope);
+  const before = readCursorHooks(path);
+  const after = applyCursorInstall(before, scope);
+  let changed = JSON.stringify(before) !== JSON.stringify(after);
+  if (changed) writeJson(path, after);
+  let restartRequired = false;
+  if (scope === "user") {
+    const cliPath = cursorCliConfigPath();
+    const cliBefore = readObject(cliPath);
+    const footer = applyCursorFooterInstall(cliBefore);
+    if (JSON.stringify(cliBefore) !== JSON.stringify(footer.config)) {
+      writeJson(cliPath, footer.config);
+      changed = true;
+      restartRequired = true;
+    }
+  }
+  return { scope, ...statusFor(scope, path), changed, restartRequired };
+}
+function performUninstall2(scope) {
+  const path = cursorHooksPath(scope);
+  const before = readCursorHooks(path);
+  const after = applyCursorUninstall(before);
+  let changed = JSON.stringify(before) !== JSON.stringify(after);
+  if (changed) writeJson(path, after);
+  let restartRequired = false;
+  if (scope === "user") {
+    const cliPath = cursorCliConfigPath();
+    const cliBefore = readObject(cliPath);
+    const footer = applyCursorFooterUninstall(cliBefore);
+    if (footer.removed) {
+      writeJson(cliPath, footer.config);
+      changed = true;
+      restartRequired = true;
+    }
+  }
+  return { scope, ...statusFor(scope, path), changed, restartRequired };
+}
+function performStatus2() {
+  return { user: statusFor("user"), project: statusFor("project") };
+}
+function inspectHookRuntimeResolutions2() {
+  const commands = ["user", "project"].flatMap(
+    (scope) => ownedEntries(readCursorHooks(cursorHooksPath(scope))).map(({ entry }) => entry.command)
+  );
+  return hookCommandResolutions(commands, PRIM_BINS2);
+}
+function resolveScope2(input) {
+  if (input === void 0 || input === "project") return "project";
+  if (input === "user") return "user";
+  throw new Error(`unknown --scope "${input}" (expected: user or project)`);
+}
+function registerCursorCommands(program) {
+  const cursor = program.command("cursor").description("Manage the native Cursor integration (capture, gate, ingest, presence)");
+  cursor.command("install").description("Register Primitive in Cursor's native hooks.json").option("--scope <scope>", "project (default) or user").option("--force", "Repair drifted Primitive entries; custom Cursor fields remain untouched").action((opts) => {
+    const result = performInstall2(resolveScope2(opts.scope), opts.force);
+    console.error(
+      result.changed ? `[prim] Cursor integration installed (${result.scope} scope) at ${result.path}` : `[prim] Cursor integration already present at ${result.path}`
+    );
+    if (result.restartRequired) console.error("[prim] restart Cursor CLI to load the footer");
+    console.log(JSON.stringify(result, null, 2));
+  });
+  cursor.command("uninstall").description("Remove only Primitive-owned Cursor hooks and footer").option("--scope <scope>", "project (default) or user").action((opts) => {
+    const result = performUninstall2(resolveScope2(opts.scope));
+    console.error(
+      result.changed ? `[prim] Cursor integration removed (${result.scope} scope)` : `[prim] no Primitive-owned Cursor integration found (${result.scope} scope)`
+    );
+    if (result.restartRequired) console.error("[prim] restart Cursor CLI to remove the footer");
+    console.log(JSON.stringify(result, null, 2));
+  });
+  cursor.command("status").description("Report native Cursor hook and footer status").action(() => {
+    const result = performStatus2();
+    const mark = (value) => value ? "\u2713" : "\u2717";
+    console.error(
+      `[prim] user: gate ${mark(result.user.gate)} \xB7 capture ${mark(result.user.capture)} \xB7 footer ${mark(result.user.footer)} (${result.user.path})
+[prim] project: gate ${mark(result.project.gate)} \xB7 capture ${mark(result.project.capture)} (${result.project.path})`
+    );
+    console.log(JSON.stringify(result, null, 2));
+  });
+}
+
+export {
+  compareSemver,
+  binFile,
+  packageVersion,
+  pinnedNpxArgs,
+  pinnedNpxCommand,
+  pinnedHookCommand,
+  stableHookCommand,
+  commandMatchesBin,
+  hookCommandResolutions,
+  hookRuntimePaths,
+  inspectHookRuntime,
+  stageHookRuntime,
+  assertOwnedHookRuntime,
+  removeHookRuntime,
+  projectRoot,
+  makeRegistration,
+  readSettings,
+  entryHasCommand,
+  stripCommand,
+  ensureRegistration,
+  inspectHookRuntimeResolutions,
+  atomicWrite,
+  performStatus,
+  registerClaudeCommands,
+  cursorConfigDirectory,
+  cursorHooksPath,
+  readCursorHooks,
+  hasExactCursorHandler,
+  performStatus2,
+  inspectHookRuntimeResolutions2,
+  registerCursorCommands
+};