@primitive.ai/prim 0.1.0-alpha.90 → 0.1.0-alpha.91

package/dist/hook-runtime/hooks/session-end.js

@@ -311,7 +311,7 @@ function daemonRequest(method, params = {}, opts = {}) {
     ...caller ? { caller } : {}
   };
   const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  return new Promise((resolve) => {
+  return new Promise((resolve4) => {
     let settled = false;
     let socket;
     let buffer = Buffer.alloc(0);
@@ -326,7 +326,7 @@ function daemonRequest(method, params = {}, opts = {}) {
         } catch {
         }
       }
-      resolve(value);
+      resolve4(value);
     };
     const timer = setTimeout(() => settle(null), timeoutMs);
     timer.unref();
@@ -389,14 +389,494 @@ function daemonRequest(method, params = {}, opts = {}) {
 function parseAgent(argv) {
   const i = argv.indexOf("--agent");
   const value = i !== -1 ? argv[i + 1] : void 0;
-  if (value === "codex" || value === "hermes") {
+  if (value === "codex" || value === "cursor" || value === "hermes") {
     return value;
   }
   return "claude_code";
 }
 
+// src/commands/cursor-install.ts
+import { existsSync as existsSync5, readFileSync as readFileSync6 } from "fs";
+import { homedir as homedir3 } from "os";
+import { isAbsolute as isAbsolute5, join as join8 } from "path";
+
+// src/lib/atomic-file.ts
+import { randomUUID } from "crypto";
+import {
+  constants,
+  closeSync,
+  fchmodSync,
+  fsyncSync,
+  mkdirSync,
+  openSync,
+  renameSync,
+  rmSync,
+  writeFileSync
+} from "fs";
+import { dirname } from "path";
+
+// src/lib/bin-path.ts
+import { existsSync, readFileSync as readFileSync2 } from "fs";
+import { dirname as dirname2, isAbsolute as isAbsolute2, join as join4 } from "path";
+import { fileURLToPath } from "url";
+var PKG_NAME = "@primitive.ai/prim";
+var STABLE_HOOK_LAUNCHER_NAME = "prim-hook-launcher-v1";
+function shellQuote(value) {
+  return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+var STABLE_HOOK_ARGUMENTS_RE = /^[-A-Za-z0-9_ ]*$/u;
+var STABLE_HOOK_BIN_RE = /^[A-Za-z0-9][A-Za-z0-9-]*$/u;
+function stableHookCommand(bin, args = "") {
+  if (!STABLE_HOOK_BIN_RE.test(bin) || !STABLE_HOOK_ARGUMENTS_RE.test(args)) {
+    throw new Error("invalid stable hook command");
+  }
+  const resolver = [
+    // #242 and earlier identify managed commands by this package marker. Keep
+    // it as inert data during the rolling window so an older uninstall or
+    // reinstall can remove the stable entry without invoking npm or PATH.
+    `prim_legacy_reader='-p ${PKG_NAME}@stable prim-shim.sh ${bin} '; `,
+    'prim_absolute() { case "$1" in [/]* ) ;; *) return 1 ;; esac; case "$1" in [[:space:]]*|*[[:space:]]|*[/][/]*|*[/].[/]*|*[/]..[/]*|*[/].|*[/]..|?*[/]) return 1 ;; esac; }; ',
+    'prim_config=${PRIM_CONFIG_DIR:-}; if ! prim_absolute "$prim_config"; then prim_config=${XDG_CONFIG_HOME:-}; if prim_absolute "$prim_config"; then ',
+    'case "$prim_config" in /) prim_config=/prim ;; *) prim_config="$prim_config/prim" ;; esac; ',
+    'else prim_home=${HOME:-}; prim_absolute "$prim_home" || exit 78; case "$prim_home" in /) prim_config=/.config/prim ;; *) prim_config="$prim_home/.config/prim" ;; esac; ',
+    "fi; fi; ",
+    `case "$prim_config" in /) prim_launcher=/${STABLE_HOOK_LAUNCHER_NAME} ;; *) prim_launcher="$prim_config/${STABLE_HOOK_LAUNCHER_NAME}" ;; esac; `,
+    'exec "$prim_launcher" "$@"'
+  ].join("");
+  const suffix = args ? ` ${args}` : "";
+  return `/bin/sh -c ${shellQuote(resolver)} ${STABLE_HOOK_LAUNCHER_NAME} ${bin}${suffix}`;
+}
+function detachedHookShimCommand(bin, args = "") {
+  return `payload=$(cat); { trap '' HUP; printf '%s' "$payload" | { ${stableHookCommand(bin, args)}; }; } </dev/null >/dev/null 2>&1 &`;
+}
+
+// src/lib/hook-runtime.ts
+import { createHash as createHash3, randomBytes as randomBytes2 } from "crypto";
+import {
+  constants as constants2,
+  accessSync,
+  chmodSync,
+  copyFileSync,
+  existsSync as existsSync3,
+  lstatSync,
+  mkdirSync as mkdirSync3,
+  mkdtempSync,
+  readFileSync as readFileSync4,
+  readdirSync,
+  realpathSync,
+  renameSync as renameSync2,
+  rmSync as rmSync3,
+  statSync as statSync2,
+  utimesSync,
+  writeFileSync as writeFileSync3
+} from "fs";
+import { dirname as dirname4, isAbsolute as isAbsolute3, join as join6, resolve } from "path";
+
+// src/lib/file-lock.ts
+import { randomBytes } from "crypto";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, rmSync as rmSync2, statSync, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname3, join as join5 } from "path";
+var syncSleeper = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
+
+// src/lib/hook-runtime.ts
+var RELEASE_PREFIX = "release-";
+var MAX_MANIFEST_BYTES = 64 * 1024;
+var RELEASE_GRACE_MS = 10 * 60 * 1e3;
+var HOOK_RUNTIME_ENTRIES = {
+  // SessionStart self-healing resolves this exact CLI entry to run
+  // `daemon ensure`; it must travel with the immutable hook release.
+  prim: "dist/index.js",
+  "prim-hook": "dist/hooks/prim-hook.js",
+  "prim-pre-commit": "dist/hooks/pre-commit.js",
+  "prim-post-commit": "dist/hooks/post-commit.js",
+  "prim-post-rewrite": "dist/hooks/post-rewrite.js",
+  "prim-pre-tool-use": "dist/hooks/pre-tool-use.js",
+  "prim-post-tool-use": "dist/hooks/post-tool-use.js",
+  "prim-session-start": "dist/hooks/session-start.js",
+  "prim-session-end": "dist/hooks/session-end.js",
+  "prim-daemon-server": "dist/daemon/server.js",
+  "prim-statusline": "dist/statusline-main.js"
+};
+var SOURCE_ENTRIES = Object.fromEntries(
+  Object.entries(HOOK_RUNTIME_ENTRIES).map(([bin, target]) => [
+    bin,
+    target.replace(/^dist\//u, "")
+  ])
+);
+var STABLE_HOOK_LAUNCHER_CONTENT = `#!/bin/sh
+set -eu
+case "$0" in */*) prim_launcher_dir=\${0%/*} ;; *) exit 78 ;; esac
+IFS= read -r prim_release_name < "$prim_launcher_dir/hook-runtime/current" || exit 69
+case "$prim_release_name" in ${RELEASE_PREFIX}*) ;; *) exit 69 ;; esac
+prim_release_id=\${prim_release_name#${RELEASE_PREFIX}}
+case "$prim_release_id" in *[!0-9a-f]*|"") exit 69 ;; esac
+[ "\${#prim_release_id}" -eq 64 ] || exit 69
+prim_release="$prim_launcher_dir/hook-runtime/releases/$prim_release_name"
+case "\${1-}" in
+${Object.entries(HOOK_RUNTIME_ENTRIES).map(([bin, entry]) => `  ${bin}) prim_entry="$prim_release/${entry}" ;;`).join("\n")}
+  *) exit 64 ;;
+esac
+shift
+IFS= read -r prim_node < "$prim_release/node" || exit 69
+case "$prim_node" in /*) ;; *) exit 69 ;; esac
+[ -x "$prim_node" ] && [ -f "$prim_entry" ] || exit 69
+exec "$prim_node" "$prim_entry" "$@"
+`;
+
+// src/commands/claude-install.ts
+import { existsSync as existsSync4, readFileSync as readFileSync5 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join7 } from "path";
+
+// src/lib/git.ts
+import { execFileSync } from "child_process";
+import { createHash as createHash4 } from "crypto";
+import { lstatSync as lstatSync2, realpathSync as realpathSync2 } from "fs";
+import { basename, dirname as dirname5, isAbsolute as isAbsolute4, relative, resolve as resolve2, sep } from "path";
+var GIT_TIMEOUT_MS = 1e3;
+var GITHUB_OWNER_PATTERN = /^(?![A-Za-z0-9-]*--)[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/u;
+var GITHUB_REPOSITORY_PATTERN = /^[A-Za-z0-9._-]{1,100}$/u;
+function gitToplevel(cwd) {
+  try {
+    return execFileSync("git", ["rev-parse", "--show-toplevel"], {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function gitValue(cwd, args) {
+  try {
+    const value = execFileSync("git", args, {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS
+    }).trim();
+    return value || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function githubRepositoryFullName(cwd) {
+  const remote = gitValue(cwd, ["config", "--get", "remote.origin.url"]);
+  if (!remote || [...remote].some((char) => char < " " || char === "\x7F")) return null;
+  const match = /^(?:git@github\.com:([^?#]+)|(?:https|ssh):\/\/(?:[^/@]+@)?github\.com(?::\d+)?\/([^?#]+))$/i.exec(
+    remote
+  );
+  const path = match?.[1] ?? match?.[2];
+  if (!path) return null;
+  const parts = path.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "").split("/");
+  if (parts.length !== 2 || !GITHUB_OWNER_PATTERN.test(parts[0] ?? "") || !GITHUB_REPOSITORY_PATTERN.test(parts[1] ?? "")) {
+    return null;
+  }
+  return `${parts[0]}/${parts[1]}`;
+}
+function normalizeOriginRemote(remote) {
+  const value = remote.trim();
+  if (!value) return void 0;
+  const scp = !value.includes("://") ? /^(?:[^@/\s]+@)?(?<host>[^:/\s]+):(?<path>.+)$/.exec(value)?.groups : void 0;
+  if (scp?.host && scp.path) {
+    const path = scp.path.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "");
+    return path ? `${scp.host.toLowerCase()}/${path}` : void 0;
+  }
+  try {
+    const url = new URL(value);
+    url.username = "";
+    url.password = "";
+    url.search = "";
+    url.hash = "";
+    const path = url.pathname.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "");
+    if (url.host && path) return `${url.host.toLowerCase()}/${path}`;
+    return void 0;
+  } catch {
+    return void 0;
+  }
+}
+function opaqueRepoKey(source, value) {
+  return `repo_v1_${createHash4("sha256").update(`${source}\0${value}`).digest("hex")}`;
+}
+function resolveRepositoryContext(cwd = process.cwd()) {
+  const top = gitToplevel(cwd);
+  if (!top) return null;
+  let repoRoot;
+  try {
+    repoRoot = realpathSync2.native(top);
+  } catch {
+    repoRoot = resolve2(top);
+  }
+  const origin = gitValue(repoRoot, ["config", "--get", "remote.origin.url"]);
+  const repoFullName = githubRepositoryFullName(repoRoot) ?? void 0;
+  const normalizedOrigin = origin ? normalizeOriginRemote(origin) : void 0;
+  if (normalizedOrigin) {
+    return {
+      repoRoot,
+      repoKey: opaqueRepoKey("origin", normalizedOrigin),
+      identitySource: "origin",
+      repoFullName
+    };
+  }
+  const roots = gitValue(repoRoot, ["rev-list", "--max-parents=0", "HEAD"])?.split(/\s+/).filter(Boolean).sort();
+  if (roots && roots.length > 0) {
+    return {
+      repoRoot,
+      repoKey: opaqueRepoKey("root_commit", roots.join("\n")),
+      identitySource: "root_commit",
+      repoFullName
+    };
+  }
+  return { repoRoot, repoFullName };
+}
+
+// src/commands/claude-install.ts
+var CAPTURE_BIN = "prim-hook";
+var GATE_BIN = "prim-pre-tool-use";
+var POST_TOOL_USE_BIN = "prim-post-tool-use";
+var SESSION_START_BIN = "prim-session-start";
+var SESSION_END_BIN = "prim-session-end";
+var STATUSLINE_BIN = "prim-statusline";
+var STATUSLINE_ARGS = "";
+var STATUSLINE_COMMAND = stableHookCommand(STATUSLINE_BIN, STATUSLINE_ARGS);
+var USER_SCOPE_PATH = join7(homedir2(), ".claude", "settings.json");
+function projectRoot() {
+  return gitToplevel() ?? process.cwd();
+}
+var CAPTURE_EVENTS = [
+  "SessionStart",
+  "UserPromptSubmit",
+  "PreToolUse",
+  "PostToolUse",
+  "PostToolUseFailure",
+  "Stop",
+  "SessionEnd",
+  "SubagentStop"
+];
+function makeRegistration(event, matcher, bin, args = "") {
+  return {
+    event,
+    matcher,
+    bin,
+    command: stableHookCommand(bin, args)
+  };
+}
+function makeDetachedRegistration(event, matcher, bin, args = "") {
+  return { event, matcher, bin, command: detachedHookShimCommand(bin, args) };
+}
+var REGISTRATIONS = [
+  ...CAPTURE_EVENTS.map(
+    (event) => event === "SessionEnd" ? makeDetachedRegistration(event, "*", CAPTURE_BIN) : makeRegistration(event, "*", CAPTURE_BIN)
+  ),
+  makeRegistration("PreToolUse", "Edit|Write|MultiEdit|NotebookEdit|Bash", GATE_BIN),
+  makeRegistration("PostToolUse", "Edit|Write|MultiEdit|NotebookEdit|Bash", POST_TOOL_USE_BIN),
+  makeRegistration(
+    "PostToolUseFailure",
+    "Edit|Write|MultiEdit|NotebookEdit|Bash",
+    POST_TOOL_USE_BIN
+  ),
+  makeRegistration("SessionStart", "*", SESSION_START_BIN),
+  makeDetachedRegistration("SessionEnd", "*", SESSION_END_BIN)
+];
+var PRIM_PERMISSION_RULE = "Bash(npx --yes @primitive.ai/prim*)";
+var LEGACY_PRIM_PERMISSION_RULES = [
+  "Bash(npx --yes @primitive.ai/prim@latest:*)",
+  "Bash(npx --yes @primitive.ai/prim:*)"
+];
+var ALL_PRIM_PERMISSION_RULES = /* @__PURE__ */ new Set([
+  PRIM_PERMISSION_RULE,
+  ...LEGACY_PRIM_PERMISSION_RULES
+]);
+
+// src/commands/cursor-install.ts
+var CAPTURE_BIN2 = "prim-hook";
+var GATE_BIN2 = "prim-pre-tool-use";
+var POST_TOOL_BIN = "prim-post-tool-use";
+var SESSION_START_BIN2 = "prim-session-start";
+var SESSION_END_BIN2 = "prim-session-end";
+var STATUSLINE_BIN2 = "prim-statusline";
+var CURSOR_EVENTS = [
+  "sessionStart",
+  "beforeSubmitPrompt",
+  "preToolUse",
+  "postToolUse",
+  "postToolUseFailure",
+  "afterAgentResponse",
+  "subagentStop",
+  "stop",
+  "sessionEnd"
+];
+var REGISTRATIONS2 = [
+  ...CURSOR_EVENTS.map((event) => ({ event, bin: CAPTURE_BIN2 })),
+  { event: "preToolUse", bin: GATE_BIN2, matcher: "Write|Delete|Shell", timeout: 10 },
+  { event: "postToolUse", bin: POST_TOOL_BIN },
+  { event: "postToolUseFailure", bin: POST_TOOL_BIN },
+  { event: "sessionStart", bin: SESSION_START_BIN2 },
+  { event: "sessionEnd", bin: SESSION_END_BIN2 }
+];
+function cursorConfigDirectory(env = process.env, home = homedir3(), platform = process.platform) {
+  const explicit = env.CURSOR_CONFIG_DIR?.trim();
+  if (explicit && isAbsolute5(explicit)) return explicit;
+  const xdg = env.XDG_CONFIG_HOME?.trim();
+  if (platform !== "darwin" && xdg && isAbsolute5(xdg)) return join8(xdg, "cursor");
+  return join8(home, ".cursor");
+}
+function cursorHooksPath(scope, root = projectRoot()) {
+  return scope === "user" ? join8(cursorConfigDirectory(), "hooks.json") : join8(root, ".cursor", "hooks.json");
+}
+function plainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readCursorHooks(path) {
+  if (!existsSync5(path)) return {};
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync6(path, "utf8"));
+  } catch {
+    throw new Error(`invalid Cursor hooks JSON at ${path}`);
+  }
+  if (!plainObject(parsed)) throw new Error(`Cursor hooks config must be an object: ${path}`);
+  if (parsed.version !== void 0 && parsed.version !== 1) {
+    throw new Error(`unsupported Cursor hooks version at ${path} (expected version 1)`);
+  }
+  if (parsed.hooks !== void 0) {
+    if (!plainObject(parsed.hooks)) throw new Error(`Cursor hooks must be an object: ${path}`);
+    for (const [event, entries] of Object.entries(parsed.hooks)) {
+      if (!Array.isArray(entries) || !entries.every(plainObject)) {
+        throw new Error(`Cursor hook list must contain objects: ${event} in ${path}`);
+      }
+    }
+  }
+  return parsed;
+}
+function commandFor(registration, scope) {
+  return stableHookCommand(
+    registration.bin,
+    `--agent cursor --event ${registration.event} --scope ${scope}`
+  );
+}
+var OWNED_COMMANDS = new Set(
+  ["project", "user"].flatMap(
+    (scope) => REGISTRATIONS2.map((registration) => commandFor(registration, scope))
+  )
+);
+function jsoncUnsafeCommand(command) {
+  return command.replace('case "$1" in [/]* ', 'case "$1" in /*').replace("*[/][/]*", "*//*").replace("*[/].[/]*", "*/./*").replace("*[/]..[/]*", "*/../*").replace("*[/].", "*/.").replace("*[/]..", "*/..").replace("?*[/]", "?*/");
+}
+var JSONC_UNSAFE_OWNED_COMMANDS = new Set([...OWNED_COMMANDS].map(jsoncUnsafeCommand));
+function hookFor(registration, scope) {
+  return {
+    command: commandFor(registration, scope),
+    ...registration.matcher ? { matcher: registration.matcher } : {},
+    ...registration.timeout ? { timeout: registration.timeout } : {}
+  };
+}
+function exactHook(entry, registration, scope) {
+  return JSON.stringify(entry) === JSON.stringify(hookFor(registration, scope));
+}
+function hasExactCursorHandler(settings, event, bin, scope) {
+  const registration = REGISTRATIONS2.find(
+    (candidate) => candidate.event === event && candidate.bin === bin
+  );
+  return registration ? (settings.hooks?.[event] ?? []).some((entry) => exactHook(entry, registration, scope)) : false;
+}
+var FOOTER = {
+  type: "command",
+  command: stableHookCommand(STATUSLINE_BIN2),
+  updateIntervalMs: 1e3,
+  timeoutMs: 2e3
+};
+var JSONC_UNSAFE_FOOTER = {
+  ...FOOTER,
+  command: jsoncUnsafeCommand(FOOTER.command)
+};
+
+// src/hooks/cursor-coexistence.ts
+var CURSOR_EVENTS2 = /* @__PURE__ */ new Set([
+  "sessionStart",
+  "beforeSubmitPrompt",
+  "preToolUse",
+  "postToolUse",
+  "postToolUseFailure",
+  "afterAgentResponse",
+  "subagentStop",
+  "stop",
+  "sessionEnd"
+]);
+function cursorEvidence(parsed) {
+  return typeof parsed.cursor_version === "string" && parsed.cursor_version.length > 0 && typeof parsed.conversation_id === "string" && parsed.conversation_id.length > 0 && typeof parsed.generation_id === "string" && parsed.generation_id.length > 0 && Array.isArray(parsed.workspace_roots) && typeof parsed.hook_event_name === "string" && CURSOR_EVENTS2.has(parsed.hook_event_name);
+}
+function uniqueProjectRoot(parsed) {
+  if (!Array.isArray(parsed.workspace_roots)) return;
+  const roots = new Set(
+    parsed.workspace_roots.filter((value) => typeof value === "string" && value.length > 0).map((value) => resolveRepositoryContext(value)?.repoRoot).filter((value) => !!value)
+  );
+  return roots.size === 1 ? [...roots][0] : void 0;
+}
+function shouldSuppressImportedCursorHandler(parsed, bin) {
+  if (!cursorEvidence(parsed)) return false;
+  const project = uniqueProjectRoot(parsed);
+  if (project) {
+    try {
+      if (hasExactCursorHandler(
+        readCursorHooks(cursorHooksPath("project", project)),
+        parsed.hook_event_name,
+        bin,
+        "project"
+      )) {
+        return true;
+      }
+    } catch {
+    }
+  }
+  try {
+    return hasExactCursorHandler(
+      readCursorHooks(cursorHooksPath("user")),
+      parsed.hook_event_name,
+      bin,
+      "user"
+    );
+  } catch {
+    return false;
+  }
+}
+
+// src/hooks/hook-stdin.ts
+var DEFAULT_MAX_BYTES = 1024 * 1024;
+function readHookStdin(timeoutMs = 1e3, maxBytes = DEFAULT_MAX_BYTES) {
+  return new Promise((resolve4, reject) => {
+    const chunks = [];
+    let bytes = 0;
+    let settled = false;
+    const finish = (error) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      process.stdin.removeAllListeners("data");
+      process.stdin.removeAllListeners("end");
+      process.stdin.removeAllListeners("error");
+      if (error) reject(error);
+      else resolve4(Buffer.concat(chunks, bytes).toString("utf-8"));
+    };
+    const timer = setTimeout(() => finish(new Error("stdin read timeout")), timeoutMs);
+    process.stdin.on("data", (chunk) => {
+      bytes += chunk.length;
+      if (bytes > maxBytes) {
+        finish(new Error("stdin envelope exceeds size limit"));
+        return;
+      }
+      chunks.push(chunk);
+    });
+    process.stdin.on("end", () => finish());
+    process.stdin.on("error", (error) => finish(error));
+  });
+}
+
 // src/hooks/normalize.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash5 } from "crypto";
+import { realpathSync as realpathSync3 } from "fs";
+import { isAbsolute as isAbsolute6, resolve as resolve3 } from "path";
 var HERMES_EVENT_MAP = {
   on_session_start: "SessionStart",
   on_session_end: "SessionEnd",
@@ -406,7 +886,125 @@ var HERMES_EVENT_MAP = {
   post_tool_call: "PostToolUse",
   subagent_stop: "SubagentStop"
 };
+var CURSOR_EVENT_MAP = {
+  sessionStart: "SessionStart",
+  beforeSubmitPrompt: "UserPromptSubmit",
+  preToolUse: "PreToolUse",
+  postToolUse: "PostToolUse",
+  postToolUseFailure: "PostToolUseFailure",
+  afterAgentResponse: "AssistantResponse",
+  subagentStop: "SubagentStop",
+  stop: "Stop",
+  sessionEnd: "SessionEnd"
+};
+var CURSOR_TOOL_EVENTS = /* @__PURE__ */ new Set(["PreToolUse", "PostToolUse", "PostToolUseFailure"]);
+var SAFE_CORRELATION_ID_RE = /^[A-Za-z0-9._:-]{1,128}$/u;
+var CURSOR_LOCAL_ONLY_FIELDS = /* @__PURE__ */ new Set([
+  "conversation_id",
+  "generation_id",
+  "user_email",
+  "account_email",
+  "transcript_path",
+  "transcript",
+  "thought",
+  "thoughts",
+  "thinking",
+  "tool_output"
+]);
+function requiredId(value, field) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new TypeError(`Cursor hook envelope is missing ${field}`);
+  }
+  return value;
+}
+function cursorToolUseId(value) {
+  if (SAFE_CORRELATION_ID_RE.test(value)) return value;
+  return `cursor:tool:v1:${createHash5("sha256").update(value).digest("hex")}`;
+}
+function workspaceCandidates(value) {
+  if (!Array.isArray(value)) return [];
+  const roots = value.filter((item) => typeof item === "string" && item.length > 0);
+  if (roots.some((root) => !isAbsolute6(root))) {
+    throw new TypeError("Cursor workspace roots must be absolute");
+  }
+  return roots;
+}
+function pathIdentity(path) {
+  try {
+    return realpathSync3.native(path);
+  } catch {
+    return resolve3(path);
+  }
+}
+function resolveCursorCwd(parsed) {
+  const roots = workspaceCandidates(parsed.workspace_roots).map(pathIdentity);
+  const rootRepositories = roots.map((root) => resolveRepositoryContext(root)?.repoRoot);
+  const repositoryRoots = new Set(rootRepositories.filter((root) => !!root));
+  if (repositoryRoots.size > 1) {
+    throw new TypeError("Cursor hook envelope spans multiple repositories");
+  }
+  if (roots.length > 1 && rootRepositories.some((root) => root === void 0)) {
+    throw new TypeError("Cursor hook envelope has ambiguous workspace roots");
+  }
+  const expectedRepo = [...repositoryRoots][0];
+  const rawCwd = typeof parsed.cwd === "string" && parsed.cwd.length > 0 ? parsed.cwd : void 0;
+  if (rawCwd && !isAbsolute6(rawCwd)) {
+    throw new TypeError("Cursor hook cwd must be absolute");
+  }
+  const envelopeCwd = rawCwd ? pathIdentity(rawCwd) : void 0;
+  const input = typeof parsed.tool_input === "object" && parsed.tool_input !== null && !Array.isArray(parsed.tool_input) ? parsed.tool_input : void 0;
+  const rawToolCwd = parsed.tool_name === "Shell" && typeof input?.working_directory === "string" ? input.working_directory : void 0;
+  const base = envelopeCwd ?? (roots.length === 1 ? roots[0] : expectedRepo);
+  if (rawToolCwd && !isAbsolute6(rawToolCwd) && !base) {
+    throw new TypeError("relative Cursor tool cwd has no workspace base");
+  }
+  const toolCwd = rawToolCwd ? pathIdentity(isAbsolute6(rawToolCwd) ? rawToolCwd : resolve3(base, rawToolCwd)) : void 0;
+  const selected = toolCwd ?? envelopeCwd ?? (roots.length === 1 ? roots[0] : expectedRepo);
+  if (!selected) {
+    throw new TypeError("Cursor hook envelope has no unambiguous workspace");
+  }
+  const selectedRepo = resolveRepositoryContext(selected)?.repoRoot;
+  if (expectedRepo && selectedRepo !== expectedRepo) {
+    throw new TypeError("Cursor hook cwd conflicts with workspace repository");
+  }
+  return selected;
+}
+function normalizeCursorEnvelope(parsed) {
+  const rawEvent = requiredId(parsed.hook_event_name, "hook_event_name");
+  const event = CURSOR_EVENT_MAP[rawEvent];
+  if (!event) throw new TypeError(`unsupported Cursor hook event: ${rawEvent}`);
+  const sessionId = requiredId(parsed.conversation_id, "conversation_id");
+  const turnId = requiredId(parsed.generation_id, "generation_id");
+  if (parsed.session_id !== void 0 && parsed.session_id !== sessionId) {
+    throw new TypeError("Cursor conversation_id conflicts with session_id");
+  }
+  if (parsed.turn_id !== void 0 && parsed.turn_id !== turnId) {
+    throw new TypeError("Cursor generation_id conflicts with turn_id");
+  }
+  const rawToolUseId = CURSOR_TOOL_EVENTS.has(event) ? requiredId(parsed.tool_use_id, "tool_use_id") : void 0;
+  const normalized = {
+    ...Object.fromEntries(
+      Object.entries(parsed).filter(([key]) => !CURSOR_LOCAL_ONLY_FIELDS.has(key))
+    ),
+    hook_event_name: event,
+    session_id: sessionId,
+    turn_id: turnId,
+    cwd: resolveCursorCwd(parsed),
+    ...rawToolUseId === void 0 ? {} : { tool_use_id: cursorToolUseId(rawToolUseId) }
+  };
+  if (typeof parsed.tool_output === "string") {
+    try {
+      normalized.tool_response = JSON.parse(parsed.tool_output);
+    } catch {
+      normalized.tool_response = parsed.tool_output;
+    }
+  }
+  return normalized;
+}
 function normalizeEnvelope(parsed, agent) {
+  if (agent === "cursor") {
+    return normalizeCursorEnvelope(parsed);
+  }
   if (agent === "codex") {
     const event = parsed.hook_event_name;
     if ((event === "PreToolUse" || event === "PostToolUse") && (typeof parsed.tool_use_id !== "string" || parsed.tool_use_id.length === 0)) {
@@ -418,7 +1016,7 @@ function normalizeEnvelope(parsed, agent) {
       ]);
       return {
         ...parsed,
-        tool_use_id: `codex:fallback:v1:${createHash3("sha256").update(stableToolIdentity).digest("hex")}`
+        tool_use_id: `codex:fallback:v1:${createHash5("sha256").update(stableToolIdentity).digest("hex")}`
       };
     }
     return parsed;
@@ -436,23 +1034,6 @@ function normalizeEnvelope(parsed, agent) {
 // src/hooks/session-end.ts
 var STDIN_TIMEOUT_MS = 1e3;
 var DAEMON_TIMEOUT_MS = 250;
-function readStdin() {
-  return new Promise((resolve, reject) => {
-    const chunks = [];
-    const timer = setTimeout(() => {
-      reject(new Error("stdin read timeout"));
-    }, STDIN_TIMEOUT_MS);
-    process.stdin.on("data", (chunk) => chunks.push(chunk));
-    process.stdin.on("end", () => {
-      clearTimeout(timer);
-      resolve(Buffer.concat(chunks).toString("utf-8"));
-    });
-    process.stdin.on("error", (err) => {
-      clearTimeout(timer);
-      reject(err);
-    });
-  });
-}
 function emit() {
   process.stdout.write("{}\n");
 }
@@ -460,17 +1041,19 @@ async function main() {
   const agent = parseAgent(process.argv);
   let raw;
   try {
-    raw = await readStdin();
+    raw = await readHookStdin(STDIN_TIMEOUT_MS);
   } catch {
     emit();
     return;
   }
   let envelope;
   try {
-    envelope = normalizeEnvelope(
-      JSON.parse(raw),
-      agent
-    );
+    const incoming = JSON.parse(raw);
+    if (agent !== "cursor" && shouldSuppressImportedCursorHandler(incoming, "prim-session-end")) {
+      emit();
+      return;
+    }
+    envelope = normalizeEnvelope(incoming, agent);
   } catch {
     emit();
     return;