@primitive.ai/prim 0.1.0-alpha.9 → 0.1.0-alpha.91

package/dist/chunk-H4UNYFUC.js

@@ -0,0 +1,196 @@
+// src/lib/git.ts
+import { execFileSync } from "child_process";
+import { createHash } from "crypto";
+import { lstatSync, realpathSync } from "fs";
+import { basename, dirname, isAbsolute, relative, resolve, sep } from "path";
+var GIT_TIMEOUT_MS = 1e3;
+var GITHUB_OWNER_PATTERN = /^(?![A-Za-z0-9-]*--)[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/u;
+var GITHUB_REPOSITORY_PATTERN = /^[A-Za-z0-9._-]{1,100}$/u;
+function gitToplevel(cwd) {
+  try {
+    return execFileSync("git", ["rev-parse", "--show-toplevel"], {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function gitValue(cwd, args) {
+  try {
+    const value = execFileSync("git", args, {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS
+    }).trim();
+    return value || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function currentBranch(cwd) {
+  return gitValue(cwd, ["symbolic-ref", "--quiet", "--short", "HEAD"]);
+}
+function githubRepositoryFullName(cwd) {
+  const remote = gitValue(cwd, ["config", "--get", "remote.origin.url"]);
+  if (!remote || [...remote].some((char) => char < " " || char === "\x7F")) return null;
+  const match = /^(?:git@github\.com:([^?#]+)|(?:https|ssh):\/\/(?:[^/@]+@)?github\.com(?::\d+)?\/([^?#]+))$/i.exec(
+    remote
+  );
+  const path = match?.[1] ?? match?.[2];
+  if (!path) return null;
+  const parts = path.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "").split("/");
+  if (parts.length !== 2 || !GITHUB_OWNER_PATTERN.test(parts[0] ?? "") || !GITHUB_REPOSITORY_PATTERN.test(parts[1] ?? "")) {
+    return null;
+  }
+  return `${parts[0]}/${parts[1]}`;
+}
+function canonicalGitRoot(cwd) {
+  try {
+    const top = gitToplevel(cwd);
+    return top ? realpathSync.native(top) : null;
+  } catch {
+    return null;
+  }
+}
+function normalizeOriginRemote(remote) {
+  const value = remote.trim();
+  if (!value) return void 0;
+  const scp = !value.includes("://") ? /^(?:[^@/\s]+@)?(?<host>[^:/\s]+):(?<path>.+)$/.exec(value)?.groups : void 0;
+  if (scp?.host && scp.path) {
+    const path = scp.path.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "");
+    return path ? `${scp.host.toLowerCase()}/${path}` : void 0;
+  }
+  try {
+    const url = new URL(value);
+    url.username = "";
+    url.password = "";
+    url.search = "";
+    url.hash = "";
+    const path = url.pathname.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "");
+    if (url.host && path) return `${url.host.toLowerCase()}/${path}`;
+    return void 0;
+  } catch {
+    return void 0;
+  }
+}
+function opaqueRepoKey(source, value) {
+  return `repo_v1_${createHash("sha256").update(`${source}\0${value}`).digest("hex")}`;
+}
+function resolveRepositoryContext(cwd = process.cwd()) {
+  const top = gitToplevel(cwd);
+  if (!top) return null;
+  let repoRoot;
+  try {
+    repoRoot = realpathSync.native(top);
+  } catch {
+    repoRoot = resolve(top);
+  }
+  const origin = gitValue(repoRoot, ["config", "--get", "remote.origin.url"]);
+  const repoFullName = githubRepositoryFullName(repoRoot) ?? void 0;
+  const normalizedOrigin = origin ? normalizeOriginRemote(origin) : void 0;
+  if (normalizedOrigin) {
+    return {
+      repoRoot,
+      repoKey: opaqueRepoKey("origin", normalizedOrigin),
+      identitySource: "origin",
+      repoFullName
+    };
+  }
+  const roots = gitValue(repoRoot, ["rev-list", "--max-parents=0", "HEAD"])?.split(/\s+/).filter(Boolean).sort();
+  if (roots && roots.length > 0) {
+    return {
+      repoRoot,
+      repoKey: opaqueRepoKey("root_commit", roots.join("\n")),
+      identitySource: "root_commit",
+      repoFullName
+    };
+  }
+  return { repoRoot, repoFullName };
+}
+function nearestExistingAncestor(path) {
+  const suffix = [];
+  let cursor = path;
+  while (true) {
+    try {
+      lstatSync(cursor);
+      break;
+    } catch (error) {
+      const code = typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
+      if (code !== "ENOENT" && code !== "ENOTDIR") return null;
+      const parent = dirname(cursor);
+      if (parent === cursor) return null;
+      suffix.unshift(cursor.slice(parent.length + (parent.endsWith(sep) ? 0 : 1)));
+      cursor = parent;
+    }
+  }
+  try {
+    return { real: realpathSync.native(cursor), suffix };
+  } catch {
+    return null;
+  }
+}
+function canonicalRepositoryPathScoped(filePath, context, baseDir) {
+  if (!filePath || filePath !== filePath.trim() || filePath.includes("\0")) {
+    return { ok: false, reason: "invalid_path" };
+  }
+  const absolute = resolve(baseDir, filePath);
+  const resolved = nearestExistingAncestor(absolute);
+  if (!resolved) return { ok: false, reason: "invalid_path" };
+  const target = resolve(resolved.real, ...resolved.suffix);
+  const rel = relative(context.repoRoot, target);
+  if (!rel || rel === ".") return { ok: false, reason: "invalid_path" };
+  if (isAbsolute(rel) || rel === ".." || rel.startsWith(`..${sep}`)) {
+    return { ok: false, reason: "outside_repository" };
+  }
+  return { ok: true, file: sep === "/" ? rel : rel.split(sep).join("/") };
+}
+function canonicalRepositoryPathLegacy(filePath, cwd, repositoryRoot = canonicalGitRoot(cwd)) {
+  if (!repositoryRoot || !filePath || [...filePath].some((char) => char < " " || char === "\x7F" || "~*?[]{}$`\\".includes(char)))
+    return null;
+  const absolute = resolve(cwd, filePath);
+  let target;
+  try {
+    const stat = lstatSync(absolute);
+    if (!stat.isFile() || stat.isSymbolicLink()) return null;
+    target = realpathSync.native(absolute);
+  } catch (error) {
+    if (!(error instanceof Error) || error.code !== "ENOENT") {
+      return null;
+    }
+    try {
+      const parent = realpathSync.native(dirname(absolute));
+      if (!lstatSync(parent).isDirectory()) return null;
+      target = resolve(parent, basename(absolute));
+    } catch {
+      return null;
+    }
+  }
+  const rel = relative(repositoryRoot, target);
+  if (!rel || isAbsolute(rel) || rel === ".." || rel.startsWith(`..${sep}`)) {
+    return null;
+  }
+  return sep === "/" ? rel : rel.split(sep).join("/");
+}
+function canonicalRepositoryPath(filePath, contextOrCwd, baseDirOrRoot) {
+  if (typeof contextOrCwd === "string") {
+    return canonicalRepositoryPathLegacy(filePath, contextOrCwd, baseDirOrRoot);
+  }
+  return canonicalRepositoryPathScoped(
+    filePath,
+    contextOrCwd,
+    baseDirOrRoot ?? contextOrCwd.repoRoot
+  );
+}
+
+export {
+  gitToplevel,
+  currentBranch,
+  githubRepositoryFullName,
+  canonicalGitRoot,
+  resolveRepositoryContext,
+  canonicalRepositoryPath
+};

package/dist/chunk-HU4PW6I6.js

@@ -0,0 +1,264 @@
+import {
+  cursorHooksPath,
+  hasExactCursorHandler,
+  readCursorHooks
+} from "./chunk-EWZMDD44.js";
+import {
+  resolveRepositoryContext
+} from "./chunk-H4UNYFUC.js";
+
+// src/hooks/agent.ts
+function parseAgent(argv) {
+  const i = argv.indexOf("--agent");
+  const value = i !== -1 ? argv[i + 1] : void 0;
+  if (value === "codex" || value === "cursor" || value === "hermes") {
+    return value;
+  }
+  return "claude_code";
+}
+
+// src/hooks/cursor-coexistence.ts
+var CURSOR_EVENTS = /* @__PURE__ */ new Set([
+  "sessionStart",
+  "beforeSubmitPrompt",
+  "preToolUse",
+  "postToolUse",
+  "postToolUseFailure",
+  "afterAgentResponse",
+  "subagentStop",
+  "stop",
+  "sessionEnd"
+]);
+function cursorEvidence(parsed) {
+  return typeof parsed.cursor_version === "string" && parsed.cursor_version.length > 0 && typeof parsed.conversation_id === "string" && parsed.conversation_id.length > 0 && typeof parsed.generation_id === "string" && parsed.generation_id.length > 0 && Array.isArray(parsed.workspace_roots) && typeof parsed.hook_event_name === "string" && CURSOR_EVENTS.has(parsed.hook_event_name);
+}
+function uniqueProjectRoot(parsed) {
+  if (!Array.isArray(parsed.workspace_roots)) return;
+  const roots = new Set(
+    parsed.workspace_roots.filter((value) => typeof value === "string" && value.length > 0).map((value) => resolveRepositoryContext(value)?.repoRoot).filter((value) => !!value)
+  );
+  return roots.size === 1 ? [...roots][0] : void 0;
+}
+function shouldSuppressImportedCursorHandler(parsed, bin) {
+  if (!cursorEvidence(parsed)) return false;
+  const project = uniqueProjectRoot(parsed);
+  if (project) {
+    try {
+      if (hasExactCursorHandler(
+        readCursorHooks(cursorHooksPath("project", project)),
+        parsed.hook_event_name,
+        bin,
+        "project"
+      )) {
+        return true;
+      }
+    } catch {
+    }
+  }
+  try {
+    return hasExactCursorHandler(
+      readCursorHooks(cursorHooksPath("user")),
+      parsed.hook_event_name,
+      bin,
+      "user"
+    );
+  } catch {
+    return false;
+  }
+}
+
+// src/hooks/hook-stdin.ts
+var DEFAULT_MAX_BYTES = 1024 * 1024;
+function readHookStdin(timeoutMs = 1e3, maxBytes = DEFAULT_MAX_BYTES) {
+  return new Promise((resolve2, reject) => {
+    const chunks = [];
+    let bytes = 0;
+    let settled = false;
+    const finish = (error) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      process.stdin.removeAllListeners("data");
+      process.stdin.removeAllListeners("end");
+      process.stdin.removeAllListeners("error");
+      if (error) reject(error);
+      else resolve2(Buffer.concat(chunks, bytes).toString("utf-8"));
+    };
+    const timer = setTimeout(() => finish(new Error("stdin read timeout")), timeoutMs);
+    process.stdin.on("data", (chunk) => {
+      bytes += chunk.length;
+      if (bytes > maxBytes) {
+        finish(new Error("stdin envelope exceeds size limit"));
+        return;
+      }
+      chunks.push(chunk);
+    });
+    process.stdin.on("end", () => finish());
+    process.stdin.on("error", (error) => finish(error));
+  });
+}
+
+// src/hooks/normalize.ts
+import { createHash } from "crypto";
+import { realpathSync } from "fs";
+import { isAbsolute, resolve } from "path";
+var HERMES_EVENT_MAP = {
+  on_session_start: "SessionStart",
+  on_session_end: "SessionEnd",
+  pre_llm_call: "UserPromptSubmit",
+  post_llm_call: "Stop",
+  pre_tool_call: "PreToolUse",
+  post_tool_call: "PostToolUse",
+  subagent_stop: "SubagentStop"
+};
+var CURSOR_EVENT_MAP = {
+  sessionStart: "SessionStart",
+  beforeSubmitPrompt: "UserPromptSubmit",
+  preToolUse: "PreToolUse",
+  postToolUse: "PostToolUse",
+  postToolUseFailure: "PostToolUseFailure",
+  afterAgentResponse: "AssistantResponse",
+  subagentStop: "SubagentStop",
+  stop: "Stop",
+  sessionEnd: "SessionEnd"
+};
+var CURSOR_TOOL_EVENTS = /* @__PURE__ */ new Set(["PreToolUse", "PostToolUse", "PostToolUseFailure"]);
+var SAFE_CORRELATION_ID_RE = /^[A-Za-z0-9._:-]{1,128}$/u;
+var CURSOR_LOCAL_ONLY_FIELDS = /* @__PURE__ */ new Set([
+  "conversation_id",
+  "generation_id",
+  "user_email",
+  "account_email",
+  "transcript_path",
+  "transcript",
+  "thought",
+  "thoughts",
+  "thinking",
+  "tool_output"
+]);
+function requiredId(value, field) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new TypeError(`Cursor hook envelope is missing ${field}`);
+  }
+  return value;
+}
+function cursorToolUseId(value) {
+  if (SAFE_CORRELATION_ID_RE.test(value)) return value;
+  return `cursor:tool:v1:${createHash("sha256").update(value).digest("hex")}`;
+}
+function workspaceCandidates(value) {
+  if (!Array.isArray(value)) return [];
+  const roots = value.filter((item) => typeof item === "string" && item.length > 0);
+  if (roots.some((root) => !isAbsolute(root))) {
+    throw new TypeError("Cursor workspace roots must be absolute");
+  }
+  return roots;
+}
+function pathIdentity(path) {
+  try {
+    return realpathSync.native(path);
+  } catch {
+    return resolve(path);
+  }
+}
+function resolveCursorCwd(parsed) {
+  const roots = workspaceCandidates(parsed.workspace_roots).map(pathIdentity);
+  const rootRepositories = roots.map((root) => resolveRepositoryContext(root)?.repoRoot);
+  const repositoryRoots = new Set(rootRepositories.filter((root) => !!root));
+  if (repositoryRoots.size > 1) {
+    throw new TypeError("Cursor hook envelope spans multiple repositories");
+  }
+  if (roots.length > 1 && rootRepositories.some((root) => root === void 0)) {
+    throw new TypeError("Cursor hook envelope has ambiguous workspace roots");
+  }
+  const expectedRepo = [...repositoryRoots][0];
+  const rawCwd = typeof parsed.cwd === "string" && parsed.cwd.length > 0 ? parsed.cwd : void 0;
+  if (rawCwd && !isAbsolute(rawCwd)) {
+    throw new TypeError("Cursor hook cwd must be absolute");
+  }
+  const envelopeCwd = rawCwd ? pathIdentity(rawCwd) : void 0;
+  const input = typeof parsed.tool_input === "object" && parsed.tool_input !== null && !Array.isArray(parsed.tool_input) ? parsed.tool_input : void 0;
+  const rawToolCwd = parsed.tool_name === "Shell" && typeof input?.working_directory === "string" ? input.working_directory : void 0;
+  const base = envelopeCwd ?? (roots.length === 1 ? roots[0] : expectedRepo);
+  if (rawToolCwd && !isAbsolute(rawToolCwd) && !base) {
+    throw new TypeError("relative Cursor tool cwd has no workspace base");
+  }
+  const toolCwd = rawToolCwd ? pathIdentity(isAbsolute(rawToolCwd) ? rawToolCwd : resolve(base, rawToolCwd)) : void 0;
+  const selected = toolCwd ?? envelopeCwd ?? (roots.length === 1 ? roots[0] : expectedRepo);
+  if (!selected) {
+    throw new TypeError("Cursor hook envelope has no unambiguous workspace");
+  }
+  const selectedRepo = resolveRepositoryContext(selected)?.repoRoot;
+  if (expectedRepo && selectedRepo !== expectedRepo) {
+    throw new TypeError("Cursor hook cwd conflicts with workspace repository");
+  }
+  return selected;
+}
+function normalizeCursorEnvelope(parsed) {
+  const rawEvent = requiredId(parsed.hook_event_name, "hook_event_name");
+  const event = CURSOR_EVENT_MAP[rawEvent];
+  if (!event) throw new TypeError(`unsupported Cursor hook event: ${rawEvent}`);
+  const sessionId = requiredId(parsed.conversation_id, "conversation_id");
+  const turnId = requiredId(parsed.generation_id, "generation_id");
+  if (parsed.session_id !== void 0 && parsed.session_id !== sessionId) {
+    throw new TypeError("Cursor conversation_id conflicts with session_id");
+  }
+  if (parsed.turn_id !== void 0 && parsed.turn_id !== turnId) {
+    throw new TypeError("Cursor generation_id conflicts with turn_id");
+  }
+  const rawToolUseId = CURSOR_TOOL_EVENTS.has(event) ? requiredId(parsed.tool_use_id, "tool_use_id") : void 0;
+  const normalized = {
+    ...Object.fromEntries(
+      Object.entries(parsed).filter(([key]) => !CURSOR_LOCAL_ONLY_FIELDS.has(key))
+    ),
+    hook_event_name: event,
+    session_id: sessionId,
+    turn_id: turnId,
+    cwd: resolveCursorCwd(parsed),
+    ...rawToolUseId === void 0 ? {} : { tool_use_id: cursorToolUseId(rawToolUseId) }
+  };
+  if (typeof parsed.tool_output === "string") {
+    try {
+      normalized.tool_response = JSON.parse(parsed.tool_output);
+    } catch {
+      normalized.tool_response = parsed.tool_output;
+    }
+  }
+  return normalized;
+}
+function normalizeEnvelope(parsed, agent) {
+  if (agent === "cursor") {
+    return normalizeCursorEnvelope(parsed);
+  }
+  if (agent === "codex") {
+    const event = parsed.hook_event_name;
+    if ((event === "PreToolUse" || event === "PostToolUse") && (typeof parsed.tool_use_id !== "string" || parsed.tool_use_id.length === 0)) {
+      const stableToolIdentity = JSON.stringify([
+        parsed.session_id ?? null,
+        parsed.turn_id ?? null,
+        parsed.tool_name ?? null,
+        parsed.tool_input ?? null
+      ]);
+      return {
+        ...parsed,
+        tool_use_id: `codex:fallback:v1:${createHash("sha256").update(stableToolIdentity).digest("hex")}`
+      };
+    }
+    return parsed;
+  }
+  if (agent !== "hermes") {
+    return parsed;
+  }
+  const raw = parsed.hook_event_name;
+  if (typeof raw === "string" && raw in HERMES_EVENT_MAP) {
+    return { ...parsed, hook_event_name: HERMES_EVENT_MAP[raw] };
+  }
+  return parsed;
+}
+
+export {
+  parseAgent,
+  shouldSuppressImportedCursorHandler,
+  readHookStdin,
+  normalizeEnvelope
+};

package/dist/chunk-KFXF2V5G.js

@@ -0,0 +1,155 @@
+import {
+  decodeJwtPayload,
+  primConfigDirectory,
+  resolveAuthCredential
+} from "./chunk-67VNLLBN.js";
+
+// src/daemon/client.ts
+import { createConnection } from "net";
+import { join } from "path";
+
+// src/daemon/principal.ts
+import { createHash } from "crypto";
+var PRINCIPAL_COMPONENT_MAX_LENGTH = 512;
+function boundedClaim(value) {
+  return typeof value === "string" && value.length > 0 && value.length <= PRINCIPAL_COMPONENT_MAX_LENGTH ? value : void 0;
+}
+function sha256(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+function resolveDaemonPrincipal(token = resolveAuthCredential()?.token) {
+  if (!token) return void 0;
+  const payload = decodeJwtPayload(token);
+  const subject = boundedClaim(payload?.sub);
+  const organizationId = boundedClaim(payload?.org_id);
+  if (!(subject && organizationId)) return void 0;
+  const issuer = boundedClaim(payload?.iss) ?? "unknown-issuer";
+  return {
+    principalId: sha256(`${issuer}\0${subject}`),
+    organizationId,
+    credentialFingerprint: sha256(token)
+  };
+}
+function daemonPrincipalsMatch(caller, daemon) {
+  return caller !== void 0 && daemon !== void 0 && caller.principalId === daemon.principalId && caller.organizationId === daemon.organizationId && caller.credentialFingerprint === daemon.credentialFingerprint;
+}
+
+// src/daemon/protocol.ts
+var DAEMON_JSON_REQUEST_MAX_BYTES = 64 * 1024;
+var DAEMON_JSON_RESPONSE_MAX_BYTES = 8 * 1024 * 1024;
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseDaemonResponseEnvelope(value) {
+  if (!isRecord(value)) return void 0;
+  if (!(typeof value.id === "number" && Number.isSafeInteger(value.id) && value.id >= 0)) {
+    return void 0;
+  }
+  if (typeof value.ok !== "boolean") return void 0;
+  if (value.error !== void 0 && typeof value.error !== "string") return void 0;
+  return {
+    id: value.id,
+    ok: value.ok,
+    ...value.result === void 0 ? {} : { result: value.result },
+    ...value.error === void 0 ? {} : { error: value.error }
+  };
+}
+
+// src/daemon/client.ts
+var SOCK_PATH = join(primConfigDirectory(), "sock");
+var DEFAULT_TIMEOUT_MS = 250;
+var nextRequestId = 1;
+function daemonRequest(method, params = {}, opts = {}) {
+  const id = nextRequestId++;
+  const caller = resolveDaemonPrincipal();
+  const request = {
+    id,
+    method,
+    params,
+    ...caller ? { caller } : {}
+  };
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  return new Promise((resolve) => {
+    let settled = false;
+    let socket;
+    let buffer = Buffer.alloc(0);
+    const settle = (value) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      if (socket) {
+        try {
+          socket.destroy();
+        } catch {
+        }
+      }
+      resolve(value);
+    };
+    const timer = setTimeout(() => settle(null), timeoutMs);
+    timer.unref();
+    try {
+      socket = createConnection(SOCK_PATH);
+    } catch {
+      clearTimeout(timer);
+      settle(null);
+      return;
+    }
+    socket.on("error", () => {
+      clearTimeout(timer);
+      settle(null);
+    });
+    socket.on("connect", () => {
+      try {
+        socket?.write(`${JSON.stringify(request)}
+`);
+      } catch {
+        clearTimeout(timer);
+        settle(null);
+      }
+    });
+    socket.on("data", (chunk) => {
+      buffer = Buffer.concat([buffer, Buffer.from(chunk)]);
+      if (buffer.length > DAEMON_JSON_RESPONSE_MAX_BYTES) {
+        clearTimeout(timer);
+        settle(null);
+        return;
+      }
+      const newlineIdx = buffer.indexOf(10);
+      if (newlineIdx === -1) {
+        return;
+      }
+      const line = buffer.subarray(0, newlineIdx).toString("utf8");
+      try {
+        const res = parseDaemonResponseEnvelope(JSON.parse(line));
+        if (!res || res.id !== id) {
+          clearTimeout(timer);
+          settle(null);
+          return;
+        }
+        clearTimeout(timer);
+        settle(res.ok && res.result !== void 0 ? res.result : null);
+      } catch {
+        clearTimeout(timer);
+        settle(null);
+      }
+    });
+    socket.on("end", () => {
+      if (!settled) {
+        clearTimeout(timer);
+        settle(null);
+      }
+    });
+  });
+}
+async function daemonIsLive(timeoutMs = DEFAULT_TIMEOUT_MS) {
+  const result = await daemonRequest("ping", {}, { timeoutMs });
+  return result?.pong === true;
+}
+
+export {
+  resolveDaemonPrincipal,
+  daemonPrincipalsMatch,
+  daemonRequest,
+  daemonIsLive
+};

package/dist/chunk-LFFLHSQO.js

@@ -0,0 +1,78 @@
+import {
+  analyzeShellTargets,
+  extractFileTargets
+} from "./chunk-ZB4F75SZ.js";
+import {
+  canonicalRepositoryPath
+} from "./chunk-H4UNYFUC.js";
+
+// src/hooks/file-refs.ts
+var MAX_PREFLIGHT_FILE_TARGETS = 25;
+function primitiveMetadataForResolution(resolution) {
+  const shouldAttach = resolution.fileRefs.length > 0 || resolution.rejected.length > 0 || resolution.targetsIncomplete || resolution.targetsTruncated || resolution.shellMutation !== void 0;
+  if (!shouldAttach) return;
+  return {
+    fileRefs: [...resolution.fileRefs],
+    ...resolution.rejected.length > 0 || resolution.targetsIncomplete ? { fileRefsIncomplete: true } : {},
+    ...resolution.targetsTruncated ? { fileRefsTruncated: true } : {},
+    ...resolution.shellMutation !== void 0 ? { shellMutation: resolution.shellMutation } : {}
+  };
+}
+function preserveHookFileMetadata(payload, resolution) {
+  const primitive = primitiveMetadataForResolution(resolution);
+  if (!primitive || !payload || typeof payload !== "object" || Array.isArray(payload)) {
+    return payload;
+  }
+  return { ...payload, primitive };
+}
+function resolveHookFileRefs(args) {
+  const isShellTool = (args.agent === "claude_code" || args.agent === "codex") && args.toolName === "Bash" || args.agent === "cursor" && args.toolName === "Shell";
+  const command = isShellTool ? typeof args.toolInput === "string" ? args.toolInput : args.toolInput && typeof args.toolInput === "object" && typeof args.toolInput.command === "string" ? args.toolInput.command : void 0 : void 0;
+  const shell = command === void 0 ? void 0 : analyzeShellTargets(command);
+  const shellMutation = shell?.mutation === "none" ? "none" : shell?.coverage === "complete" ? "resolved" : shell ? "unresolved" : void 0;
+  const readPath = args.agent === "claude_code" && args.toolName === "Read" && args.toolInput && typeof args.toolInput === "object" && typeof args.toolInput.file_path === "string" ? [args.toolInput.file_path] : void 0;
+  const nativeTargets = shell ? null : readPath ? { paths: readPath, complete: true } : extractFileTargets(args.toolName, args.toolInput, args.agent);
+  const rawPaths = shell ? shellMutation === "unresolved" ? [] : shell.paths : nativeTargets?.paths ?? [];
+  const uniqueRawPaths = Array.from(new Set(rawPaths));
+  const targetsTruncated = uniqueRawPaths.length > MAX_PREFLIGHT_FILE_TARGETS;
+  const fileRefs = /* @__PURE__ */ new Set();
+  const rejected = [];
+  for (const path of uniqueRawPaths.slice(0, MAX_PREFLIGHT_FILE_TARGETS)) {
+    const canonical = canonicalRepositoryPath(path, args.repository, args.cwd);
+    if (canonical.ok) fileRefs.add(canonical.file);
+    else rejected.push({ path, reason: canonical.reason });
+  }
+  return {
+    fileRefs: [...fileRefs],
+    rejected,
+    targetsIncomplete: nativeTargets?.complete === false,
+    targetsTruncated,
+    ...shellMutation ? { shellMutation: targetsTruncated ? "unresolved" : shellMutation } : {}
+  };
+}
+function enrichHookPayloadWithFileRefs(args) {
+  const toolName = typeof args.parsed.tool_name === "string" ? args.parsed.tool_name : "";
+  const resolution = resolveHookFileRefs({
+    toolName,
+    toolInput: args.parsed.tool_input,
+    agent: args.agent,
+    cwd: args.cwd,
+    repository: args.repository
+  });
+  const primitive = primitiveMetadataForResolution(resolution);
+  if (!primitive) return { parsed: args.parsed, resolution };
+  return {
+    parsed: {
+      ...args.parsed,
+      // An explicit empty list is authoritative when every exposed target was
+      // rejected. It prevents backend fallback to unsafe raw tool input.
+      primitive
+    },
+    resolution
+  };
+}
+
+export {
+  preserveHookFileMetadata,
+  enrichHookPayloadWithFileRefs
+};