@primitive.ai/prim 0.1.0-alpha.90 → 0.1.0-alpha.92

package/dist/hook-runtime/hooks/session-start.js

@@ -179,6 +179,7 @@ function compareSemver(left, right) {
 // src/lib/bin-path.ts
 var PKG_NAME = "@primitive.ai/prim";
 var ROOT_WALK_LIMIT = 6;
+var STABLE_HOOK_LAUNCHER_NAME = "prim-hook-launcher-v1";
 var resolvedRoot;
 function locateRoot() {
   if (resolvedRoot !== void 0) {
@@ -239,6 +240,31 @@ function pinnedNpxArgs(bin, args = [], options = {}) {
 function pinnedNpxCommand(bin, args = [], options = {}) {
   return ["npx", ...pinnedNpxArgs(bin, args, options)].map(shellWord).join(" ");
 }
+var STABLE_HOOK_ARGUMENTS_RE = /^[-A-Za-z0-9_ ]*$/u;
+var STABLE_HOOK_BIN_RE = /^[A-Za-z0-9][A-Za-z0-9-]*$/u;
+function stableHookCommand(bin, args = "") {
+  if (!STABLE_HOOK_BIN_RE.test(bin) || !STABLE_HOOK_ARGUMENTS_RE.test(args)) {
+    throw new Error("invalid stable hook command");
+  }
+  const resolver = [
+    // #242 and earlier identify managed commands by this package marker. Keep
+    // it as inert data during the rolling window so an older uninstall or
+    // reinstall can remove the stable entry without invoking npm or PATH.
+    `prim_legacy_reader='-p ${PKG_NAME}@stable prim-shim.sh ${bin} '; `,
+    'prim_absolute() { case "$1" in [/]* ) ;; *) return 1 ;; esac; case "$1" in [[:space:]]*|*[[:space:]]|*[/][/]*|*[/].[/]*|*[/]..[/]*|*[/].|*[/]..|?*[/]) return 1 ;; esac; }; ',
+    'prim_config=${PRIM_CONFIG_DIR:-}; if ! prim_absolute "$prim_config"; then prim_config=${XDG_CONFIG_HOME:-}; if prim_absolute "$prim_config"; then ',
+    'case "$prim_config" in /) prim_config=/prim ;; *) prim_config="$prim_config/prim" ;; esac; ',
+    'else prim_home=${HOME:-}; prim_absolute "$prim_home" || exit 78; case "$prim_home" in /) prim_config=/.config/prim ;; *) prim_config="$prim_home/.config/prim" ;; esac; ',
+    "fi; fi; ",
+    `case "$prim_config" in /) prim_launcher=/${STABLE_HOOK_LAUNCHER_NAME} ;; *) prim_launcher="$prim_config/${STABLE_HOOK_LAUNCHER_NAME}" ;; esac; `,
+    'exec "$prim_launcher" "$@"'
+  ].join("");
+  const suffix = args ? ` ${args}` : "";
+  return `/bin/sh -c ${shellQuote(resolver)} ${STABLE_HOOK_LAUNCHER_NAME} ${bin}${suffix}`;
+}
+function detachedHookShimCommand(bin, args = "") {
+  return `payload=$(cat); { trap '' HUP; printf '%s' "$payload" | { ${stableHookCommand(bin, args)}; }; } </dev/null >/dev/null 2>&1 &`;
+}
 
 // src/lib/bin-cache.ts
 var GIT_HOOK_CACHE_SHELL_DIR = "${XDG_CACHE_HOME:-$HOME/.cache}/prim/bin";
@@ -274,12 +300,574 @@ function warmBinCache() {
 function parseAgent(argv) {
   const i = argv.indexOf("--agent");
   const value = i !== -1 ? argv[i + 1] : void 0;
-  if (value === "codex" || value === "hermes") {
+  if (value === "codex" || value === "cursor" || value === "hermes") {
     return value;
   }
   return "claude_code";
 }
 
+// src/commands/cursor-install.ts
+import { existsSync as existsSync5, readFileSync as readFileSync5 } from "fs";
+import { homedir as homedir4 } from "os";
+import { isAbsolute as isAbsolute5, join as join7 } from "path";
+
+// src/lib/hook-runtime.ts
+import { createHash, randomBytes as randomBytes2 } from "crypto";
+import {
+  constants as constants2,
+  accessSync,
+  chmodSync as chmodSync2,
+  copyFileSync,
+  existsSync as existsSync3,
+  lstatSync,
+  mkdirSync as mkdirSync4,
+  mkdtempSync,
+  readFileSync as readFileSync3,
+  readdirSync,
+  realpathSync,
+  renameSync as renameSync2,
+  rmSync as rmSync3,
+  statSync as statSync2,
+  utimesSync,
+  writeFileSync as writeFileSync3
+} from "fs";
+import { delimiter, dirname as dirname4, isAbsolute as isAbsolute3, join as join5, resolve } from "path";
+
+// src/lib/file-lock.ts
+import { randomBytes } from "crypto";
+import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync2, rmSync as rmSync2, statSync, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname3, join as join3 } from "path";
+
+// src/lib/process-liveness.ts
+function processIsAlive(pid, probe = process.kill) {
+  if (!Number.isSafeInteger(pid) || pid <= 0) return false;
+  try {
+    probe(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+
+// src/lib/file-lock.ts
+var DEFAULT_TIMEOUT_MS = 3e4;
+var DEFAULT_POLL_MS = 50;
+var DEFAULT_INIT_GRACE_MS = 2e3;
+var DIRECTORY_MODE = 448;
+var FILE_MODE = 384;
+function ownerPath(lockDir) {
+  return join3(lockDir, "owner.json");
+}
+function readOwner(lockDir) {
+  try {
+    const owner = JSON.parse(readFileSync2(ownerPath(lockDir), "utf8"));
+    if (!Number.isInteger(owner.pid) || owner.pid <= 0 || typeof owner.nonce !== "string" || typeof owner.createdAt !== "number") {
+      return null;
+    }
+    return owner;
+  } catch {
+    return null;
+  }
+}
+function sameOwner(a, b) {
+  return a?.pid === b.pid && a.nonce === b.nonce && a.createdAt === b.createdAt;
+}
+function tryTakeLock(lockDir, now) {
+  try {
+    mkdirSync3(lockDir, { mode: DIRECTORY_MODE });
+  } catch (error) {
+    if (error.code === "EEXIST") return null;
+    throw error;
+  }
+  const owner = {
+    pid: process.pid,
+    nonce: randomBytes(16).toString("hex"),
+    createdAt: now
+  };
+  try {
+    writeFileSync2(ownerPath(lockDir), `${JSON.stringify(owner)}
+`, {
+      encoding: "utf8",
+      mode: FILE_MODE,
+      flag: "wx"
+    });
+    return owner;
+  } catch (error) {
+    rmSync2(lockDir, { recursive: true, force: true });
+    throw error;
+  }
+}
+function recoverStaleLock(lockDir, now, alive, initGraceMs) {
+  const owner = readOwner(lockDir);
+  if (owner) {
+    if (alive(owner.pid)) return false;
+    if (!sameOwner(readOwner(lockDir), owner)) return false;
+    rmSync2(lockDir, { recursive: true, force: true });
+    return true;
+  }
+  try {
+    const before = statSync(lockDir).mtimeMs;
+    if (now - before < initGraceMs) return false;
+    if (readOwner(lockDir)) return false;
+    if (statSync(lockDir).mtimeMs !== before) return false;
+    rmSync2(lockDir, { recursive: true, force: true });
+    return true;
+  } catch {
+    return true;
+  }
+}
+function abortError(signal) {
+  if (signal.reason instanceof Error) return signal.reason;
+  const error = new Error("The operation was aborted");
+  error.name = "AbortError";
+  return error;
+}
+function throwIfAborted(signal) {
+  if (signal?.aborted) throw abortError(signal);
+}
+async function defaultSleep(ms, signal) {
+  if (!signal) {
+    await new Promise((resolve9) => setTimeout(resolve9, ms));
+    return;
+  }
+  throwIfAborted(signal);
+  await new Promise((resolve9, reject) => {
+    const timer = setTimeout(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolve9();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(abortError(signal));
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
+var syncSleeper = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
+async function withFileLock(lockDir, operation, options = {}) {
+  mkdirSync3(dirname3(lockDir), { recursive: true, mode: DIRECTORY_MODE });
+  const nowMs = options.nowMs ?? Date.now;
+  const alive = options.processAlive ?? processIsAlive;
+  const deadline = nowMs() + (options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+  let owner = null;
+  while (!owner) {
+    throwIfAborted(options.signal);
+    const now = nowMs();
+    owner = tryTakeLock(lockDir, now);
+    if (owner) break;
+    recoverStaleLock(lockDir, now, alive, options.initGraceMs ?? DEFAULT_INIT_GRACE_MS);
+    if (now >= deadline) {
+      throw new Error(`timed out waiting for file lock ${lockDir}`);
+    }
+    if (options.sleep) {
+      await options.sleep(options.pollMs ?? DEFAULT_POLL_MS);
+      throwIfAborted(options.signal);
+    } else {
+      await defaultSleep(options.pollMs ?? DEFAULT_POLL_MS, options.signal);
+    }
+  }
+  try {
+    throwIfAborted(options.signal);
+    return await operation();
+  } finally {
+    if (sameOwner(readOwner(lockDir), owner)) {
+      rmSync2(lockDir, { recursive: true, force: true });
+    }
+  }
+}
+
+// src/lib/paths.ts
+import { homedir as homedir2 } from "os";
+import { isAbsolute as isAbsolute2, join as join4, normalize } from "path";
+var UNSAFE_CONFIG_PATH_CHARACTERS = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u;
+function absolutePath(value, variable) {
+  if (value !== void 0 && UNSAFE_CONFIG_PATH_CHARACTERS.test(value)) {
+    throw new Error(`${variable} contains unsafe characters`);
+  }
+  if (!value || value.trim() !== value || !isAbsolute2(value)) return;
+  const normalized = normalize(value);
+  return normalized === value ? value : void 0;
+}
+function resolvePrimConfigDirectory(options = {}) {
+  const env = options.env ?? process.env;
+  const explicit = absolutePath(env.PRIM_CONFIG_DIR, "PRIM_CONFIG_DIR");
+  if (explicit) return { path: explicit, source: "explicit" };
+  const xdgConfigHome = absolutePath(env.XDG_CONFIG_HOME, "XDG_CONFIG_HOME");
+  if (xdgConfigHome) return { path: join4(xdgConfigHome, "prim"), source: "xdg" };
+  const home = absolutePath(options.homeDir ?? homedir2(), "HOME");
+  if (!home) {
+    throw new Error("cannot resolve Primitive config directory: HOME is not an absolute path");
+  }
+  return { path: join4(home, ".config", "prim"), source: "default" };
+}
+function primConfigDirectory(options = {}) {
+  return resolvePrimConfigDirectory(options).path;
+}
+
+// src/lib/hook-runtime.ts
+var RELEASE_PREFIX = "release-";
+var MAX_MANIFEST_BYTES = 64 * 1024;
+var RELEASE_GRACE_MS = 10 * 60 * 1e3;
+var HOOK_RUNTIME_ENTRIES = {
+  // SessionStart self-healing resolves this exact CLI entry to run
+  // `daemon ensure`; it must travel with the immutable hook release.
+  prim: "dist/index.js",
+  "prim-hook": "dist/hooks/prim-hook.js",
+  "prim-pre-commit": "dist/hooks/pre-commit.js",
+  "prim-post-commit": "dist/hooks/post-commit.js",
+  "prim-post-rewrite": "dist/hooks/post-rewrite.js",
+  "prim-pre-tool-use": "dist/hooks/pre-tool-use.js",
+  "prim-post-tool-use": "dist/hooks/post-tool-use.js",
+  "prim-session-start": "dist/hooks/session-start.js",
+  "prim-session-end": "dist/hooks/session-end.js",
+  "prim-daemon-server": "dist/daemon/server.js",
+  "prim-statusline": "dist/statusline-main.js"
+};
+var SOURCE_ENTRIES = Object.fromEntries(
+  Object.entries(HOOK_RUNTIME_ENTRIES).map(([bin, target]) => [
+    bin,
+    target.replace(/^dist\//u, "")
+  ])
+);
+var STABLE_HOOK_LAUNCHER_CONTENT = `#!/bin/sh
+set -eu
+case "$0" in */*) prim_launcher_dir=\${0%/*} ;; *) exit 78 ;; esac
+IFS= read -r prim_release_name < "$prim_launcher_dir/hook-runtime/current" || exit 69
+case "$prim_release_name" in ${RELEASE_PREFIX}*) ;; *) exit 69 ;; esac
+prim_release_id=\${prim_release_name#${RELEASE_PREFIX}}
+case "$prim_release_id" in *[!0-9a-f]*|"") exit 69 ;; esac
+[ "\${#prim_release_id}" -eq 64 ] || exit 69
+prim_release="$prim_launcher_dir/hook-runtime/releases/$prim_release_name"
+case "\${1-}" in
+${Object.entries(HOOK_RUNTIME_ENTRIES).map(([bin, entry]) => `  ${bin}) prim_entry="$prim_release/${entry}" ;;`).join("\n")}
+  *) exit 64 ;;
+esac
+shift
+IFS= read -r prim_node < "$prim_release/node" || exit 69
+case "$prim_node" in /*) ;; *) exit 69 ;; esac
+[ -x "$prim_node" ] && [ -f "$prim_entry" ] || exit 69
+exec "$prim_node" "$prim_entry" "$@"
+`;
+
+// src/commands/claude-install.ts
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join6 } from "path";
+
+// src/lib/git.ts
+import { execFileSync } from "child_process";
+import { createHash as createHash2 } from "crypto";
+import { lstatSync as lstatSync2, realpathSync as realpathSync2 } from "fs";
+import { basename, dirname as dirname5, isAbsolute as isAbsolute4, relative, resolve as resolve2, sep } from "path";
+var GIT_TIMEOUT_MS = 1e3;
+var GITHUB_OWNER_PATTERN = /^(?![A-Za-z0-9-]*--)[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/u;
+var GITHUB_REPOSITORY_PATTERN = /^[A-Za-z0-9._-]{1,100}$/u;
+function gitToplevel(cwd) {
+  try {
+    return execFileSync("git", ["rev-parse", "--show-toplevel"], {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function gitValue(cwd, args) {
+  try {
+    const value = execFileSync("git", args, {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS
+    }).trim();
+    return value || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function githubRepositoryFullName(cwd) {
+  const remote = gitValue(cwd, ["config", "--get", "remote.origin.url"]);
+  if (!remote || [...remote].some((char) => char < " " || char === "\x7F")) return null;
+  const match = /^(?:git@github\.com:([^?#]+)|(?:https|ssh):\/\/(?:[^/@]+@)?github\.com(?::\d+)?\/([^?#]+))$/i.exec(
+    remote
+  );
+  const path = match?.[1] ?? match?.[2];
+  if (!path) return null;
+  const parts = path.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "").split("/");
+  if (parts.length !== 2 || !GITHUB_OWNER_PATTERN.test(parts[0] ?? "") || !GITHUB_REPOSITORY_PATTERN.test(parts[1] ?? "")) {
+    return null;
+  }
+  return `${parts[0]}/${parts[1]}`;
+}
+function normalizeOriginRemote(remote) {
+  const value = remote.trim();
+  if (!value) return void 0;
+  const scp = !value.includes("://") ? /^(?:[^@/\s]+@)?(?<host>[^:/\s]+):(?<path>.+)$/.exec(value)?.groups : void 0;
+  if (scp?.host && scp.path) {
+    const path = scp.path.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "");
+    return path ? `${scp.host.toLowerCase()}/${path}` : void 0;
+  }
+  try {
+    const url = new URL(value);
+    url.username = "";
+    url.password = "";
+    url.search = "";
+    url.hash = "";
+    const path = url.pathname.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "");
+    if (url.host && path) return `${url.host.toLowerCase()}/${path}`;
+    return void 0;
+  } catch {
+    return void 0;
+  }
+}
+function opaqueRepoKey(source, value) {
+  return `repo_v1_${createHash2("sha256").update(`${source}\0${value}`).digest("hex")}`;
+}
+function resolveRepositoryContext(cwd = process.cwd()) {
+  const top = gitToplevel(cwd);
+  if (!top) return null;
+  let repoRoot;
+  try {
+    repoRoot = realpathSync2.native(top);
+  } catch {
+    repoRoot = resolve2(top);
+  }
+  const origin = gitValue(repoRoot, ["config", "--get", "remote.origin.url"]);
+  const repoFullName = githubRepositoryFullName(repoRoot) ?? void 0;
+  const normalizedOrigin = origin ? normalizeOriginRemote(origin) : void 0;
+  if (normalizedOrigin) {
+    return {
+      repoRoot,
+      repoKey: opaqueRepoKey("origin", normalizedOrigin),
+      identitySource: "origin",
+      repoFullName
+    };
+  }
+  const roots = gitValue(repoRoot, ["rev-list", "--max-parents=0", "HEAD"])?.split(/\s+/).filter(Boolean).sort();
+  if (roots && roots.length > 0) {
+    return {
+      repoRoot,
+      repoKey: opaqueRepoKey("root_commit", roots.join("\n")),
+      identitySource: "root_commit",
+      repoFullName
+    };
+  }
+  return { repoRoot, repoFullName };
+}
+
+// src/commands/claude-install.ts
+var CAPTURE_BIN = "prim-hook";
+var GATE_BIN = "prim-pre-tool-use";
+var POST_TOOL_USE_BIN = "prim-post-tool-use";
+var SESSION_START_BIN = "prim-session-start";
+var SESSION_END_BIN = "prim-session-end";
+var STATUSLINE_BIN = "prim-statusline";
+var STATUSLINE_ARGS = "";
+var STATUSLINE_COMMAND = stableHookCommand(STATUSLINE_BIN, STATUSLINE_ARGS);
+var USER_SCOPE_PATH = join6(homedir3(), ".claude", "settings.json");
+function projectRoot() {
+  return gitToplevel() ?? process.cwd();
+}
+var CAPTURE_EVENTS = [
+  "SessionStart",
+  "UserPromptSubmit",
+  "PreToolUse",
+  "PostToolUse",
+  "PostToolUseFailure",
+  "Stop",
+  "SessionEnd",
+  "SubagentStop"
+];
+function makeRegistration(event, matcher, bin, args = "") {
+  return {
+    event,
+    matcher,
+    bin,
+    command: stableHookCommand(bin, args)
+  };
+}
+function makeDetachedRegistration(event, matcher, bin, args = "") {
+  return { event, matcher, bin, command: detachedHookShimCommand(bin, args) };
+}
+var REGISTRATIONS = [
+  ...CAPTURE_EVENTS.map(
+    (event) => event === "SessionEnd" ? makeDetachedRegistration(event, "*", CAPTURE_BIN) : makeRegistration(event, "*", CAPTURE_BIN)
+  ),
+  makeRegistration("PreToolUse", "Edit|Write|MultiEdit|NotebookEdit|Bash", GATE_BIN),
+  makeRegistration("PostToolUse", "Edit|Write|MultiEdit|NotebookEdit|Bash", POST_TOOL_USE_BIN),
+  makeRegistration(
+    "PostToolUseFailure",
+    "Edit|Write|MultiEdit|NotebookEdit|Bash",
+    POST_TOOL_USE_BIN
+  ),
+  makeRegistration("SessionStart", "*", SESSION_START_BIN),
+  makeDetachedRegistration("SessionEnd", "*", SESSION_END_BIN)
+];
+var PRIM_PERMISSION_RULE = "Bash(npx --yes @primitive.ai/prim*)";
+var LEGACY_PRIM_PERMISSION_RULES = [
+  "Bash(npx --yes @primitive.ai/prim@latest:*)",
+  "Bash(npx --yes @primitive.ai/prim:*)"
+];
+var ALL_PRIM_PERMISSION_RULES = /* @__PURE__ */ new Set([
+  PRIM_PERMISSION_RULE,
+  ...LEGACY_PRIM_PERMISSION_RULES
+]);
+
+// src/commands/cursor-install.ts
+var CAPTURE_BIN2 = "prim-hook";
+var GATE_BIN2 = "prim-pre-tool-use";
+var POST_TOOL_BIN = "prim-post-tool-use";
+var SESSION_START_BIN2 = "prim-session-start";
+var SESSION_END_BIN2 = "prim-session-end";
+var STATUSLINE_BIN2 = "prim-statusline";
+var CURSOR_EVENTS = [
+  "sessionStart",
+  "beforeSubmitPrompt",
+  "preToolUse",
+  "postToolUse",
+  "postToolUseFailure",
+  "afterAgentResponse",
+  "subagentStop",
+  "stop",
+  "sessionEnd"
+];
+var REGISTRATIONS2 = [
+  ...CURSOR_EVENTS.map((event) => ({ event, bin: CAPTURE_BIN2 })),
+  { event: "preToolUse", bin: GATE_BIN2, matcher: "Write|Delete|Shell", timeout: 10 },
+  { event: "postToolUse", bin: POST_TOOL_BIN },
+  { event: "postToolUseFailure", bin: POST_TOOL_BIN },
+  { event: "sessionStart", bin: SESSION_START_BIN2 },
+  { event: "sessionEnd", bin: SESSION_END_BIN2 }
+];
+function cursorConfigDirectory(env = process.env, home = homedir4(), platform = process.platform) {
+  const explicit = env.CURSOR_CONFIG_DIR?.trim();
+  if (explicit && isAbsolute5(explicit)) return explicit;
+  const xdg = env.XDG_CONFIG_HOME?.trim();
+  if (platform !== "darwin" && xdg && isAbsolute5(xdg)) return join7(xdg, "cursor");
+  return join7(home, ".cursor");
+}
+function cursorHooksPath(scope, root = projectRoot()) {
+  return scope === "user" ? join7(cursorConfigDirectory(), "hooks.json") : join7(root, ".cursor", "hooks.json");
+}
+function plainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readCursorHooks(path) {
+  if (!existsSync5(path)) return {};
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync5(path, "utf8"));
+  } catch {
+    throw new Error(`invalid Cursor hooks JSON at ${path}`);
+  }
+  if (!plainObject(parsed)) throw new Error(`Cursor hooks config must be an object: ${path}`);
+  if (parsed.version !== void 0 && parsed.version !== 1) {
+    throw new Error(`unsupported Cursor hooks version at ${path} (expected version 1)`);
+  }
+  if (parsed.hooks !== void 0) {
+    if (!plainObject(parsed.hooks)) throw new Error(`Cursor hooks must be an object: ${path}`);
+    for (const [event, entries] of Object.entries(parsed.hooks)) {
+      if (!Array.isArray(entries) || !entries.every(plainObject)) {
+        throw new Error(`Cursor hook list must contain objects: ${event} in ${path}`);
+      }
+    }
+  }
+  return parsed;
+}
+function commandFor(registration, scope) {
+  return stableHookCommand(
+    registration.bin,
+    `--agent cursor --event ${registration.event} --scope ${scope}`
+  );
+}
+var OWNED_COMMANDS = new Set(
+  ["project", "user"].flatMap(
+    (scope) => REGISTRATIONS2.map((registration) => commandFor(registration, scope))
+  )
+);
+function jsoncUnsafeCommand(command) {
+  return command.replace('case "$1" in [/]* ', 'case "$1" in /*').replace("*[/][/]*", "*//*").replace("*[/].[/]*", "*/./*").replace("*[/]..[/]*", "*/../*").replace("*[/].", "*/.").replace("*[/]..", "*/..").replace("?*[/]", "?*/");
+}
+var JSONC_UNSAFE_OWNED_COMMANDS = new Set([...OWNED_COMMANDS].map(jsoncUnsafeCommand));
+function hookFor(registration, scope) {
+  return {
+    command: commandFor(registration, scope),
+    ...registration.matcher ? { matcher: registration.matcher } : {},
+    ...registration.timeout ? { timeout: registration.timeout } : {}
+  };
+}
+function exactHook(entry, registration, scope) {
+  return JSON.stringify(entry) === JSON.stringify(hookFor(registration, scope));
+}
+function hasExactCursorHandler(settings, event, bin, scope) {
+  const registration = REGISTRATIONS2.find(
+    (candidate) => candidate.event === event && candidate.bin === bin
+  );
+  return registration ? (settings.hooks?.[event] ?? []).some((entry) => exactHook(entry, registration, scope)) : false;
+}
+var FOOTER = {
+  type: "command",
+  command: stableHookCommand(STATUSLINE_BIN2),
+  updateIntervalMs: 1e3,
+  timeoutMs: 2e3
+};
+var JSONC_UNSAFE_FOOTER = {
+  ...FOOTER,
+  command: jsoncUnsafeCommand(FOOTER.command)
+};
+
+// src/hooks/cursor-coexistence.ts
+var CURSOR_EVENTS2 = /* @__PURE__ */ new Set([
+  "sessionStart",
+  "beforeSubmitPrompt",
+  "preToolUse",
+  "postToolUse",
+  "postToolUseFailure",
+  "afterAgentResponse",
+  "subagentStop",
+  "stop",
+  "sessionEnd"
+]);
+function cursorEvidence(parsed) {
+  return typeof parsed.cursor_version === "string" && parsed.cursor_version.length > 0 && typeof parsed.conversation_id === "string" && parsed.conversation_id.length > 0 && typeof parsed.generation_id === "string" && parsed.generation_id.length > 0 && Array.isArray(parsed.workspace_roots) && typeof parsed.hook_event_name === "string" && CURSOR_EVENTS2.has(parsed.hook_event_name);
+}
+function uniqueProjectRoot(parsed) {
+  if (!Array.isArray(parsed.workspace_roots)) return;
+  const roots = new Set(
+    parsed.workspace_roots.filter((value) => typeof value === "string" && value.length > 0).map((value) => resolveRepositoryContext(value)?.repoRoot).filter((value) => !!value)
+  );
+  return roots.size === 1 ? [...roots][0] : void 0;
+}
+function shouldSuppressImportedCursorHandler(parsed, bin) {
+  if (!cursorEvidence(parsed)) return false;
+  const project = uniqueProjectRoot(parsed);
+  if (project) {
+    try {
+      if (hasExactCursorHandler(
+        readCursorHooks(cursorHooksPath("project", project)),
+        parsed.hook_event_name,
+        bin,
+        "project"
+      )) {
+        return true;
+      }
+    } catch {
+    }
+  }
+  try {
+    return hasExactCursorHandler(
+      readCursorHooks(cursorHooksPath("user")),
+      parsed.hook_event_name,
+      bin,
+      "user"
+    );
+  } catch {
+    return false;
+  }
+}
+
 // src/hooks/decision-feedback-core.ts
 function buildHookOutput(options) {
   const output = {};
@@ -293,13 +881,13 @@ function buildHookOutput(options) {
   return output;
 }
 function writeHookOutput(output, stream = process.stdout) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve9) => {
     let settled = false;
     const finish = (ok, retainErrorListener = false) => {
       if (settled) return;
       settled = true;
       if (!retainErrorListener) stream.off("error", onError);
-      resolve7(ok);
+      resolve9(ok);
     };
     const onError = () => {
       if (settled) {
@@ -331,43 +919,46 @@ async function handoffHookOutput(output, acknowledge, stream = process.stdout) {
   return handedOff;
 }
 
+// src/hooks/hook-stdin.ts
+var DEFAULT_MAX_BYTES = 1024 * 1024;
+function readHookStdin(timeoutMs = 1e3, maxBytes = DEFAULT_MAX_BYTES) {
+  return new Promise((resolve9, reject) => {
+    const chunks = [];
+    let bytes = 0;
+    let settled = false;
+    const finish = (error) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      process.stdin.removeAllListeners("data");
+      process.stdin.removeAllListeners("end");
+      process.stdin.removeAllListeners("error");
+      if (error) reject(error);
+      else resolve9(Buffer.concat(chunks, bytes).toString("utf-8"));
+    };
+    const timer = setTimeout(() => finish(new Error("stdin read timeout")), timeoutMs);
+    process.stdin.on("data", (chunk) => {
+      bytes += chunk.length;
+      if (bytes > maxBytes) {
+        finish(new Error("stdin envelope exceeds size limit"));
+        return;
+      }
+      chunks.push(chunk);
+    });
+    process.stdin.on("end", () => finish());
+    process.stdin.on("error", (error) => finish(error));
+  });
+}
+
 // src/client.ts
-import { createHash as createHash2 } from "crypto";
-import { chmodSync as chmodSync2, existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync as readFileSync4, rmSync as rmSync3 } from "fs";
-import { dirname as dirname4 } from "path";
+import { createHash as createHash4 } from "crypto";
+import { chmodSync as chmodSync3, existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync7, rmSync as rmSync4 } from "fs";
+import { dirname as dirname7 } from "path";
 
 // src/lib/credentials.ts
-import { createHash } from "crypto";
-import { readFileSync as readFileSync2 } from "fs";
-import { join as join4 } from "path";
-
-// src/lib/paths.ts
-import { homedir as homedir2 } from "os";
-import { isAbsolute as isAbsolute2, join as join3, normalize } from "path";
-var UNSAFE_CONFIG_PATH_CHARACTERS = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u;
-function absolutePath(value, variable) {
-  if (value !== void 0 && UNSAFE_CONFIG_PATH_CHARACTERS.test(value)) {
-    throw new Error(`${variable} contains unsafe characters`);
-  }
-  if (!value || value.trim() !== value || !isAbsolute2(value)) return;
-  const normalized = normalize(value);
-  return normalized === value ? value : void 0;
-}
-function resolvePrimConfigDirectory(options = {}) {
-  const env = options.env ?? process.env;
-  const explicit = absolutePath(env.PRIM_CONFIG_DIR, "PRIM_CONFIG_DIR");
-  if (explicit) return { path: explicit, source: "explicit" };
-  const xdgConfigHome = absolutePath(env.XDG_CONFIG_HOME, "XDG_CONFIG_HOME");
-  if (xdgConfigHome) return { path: join3(xdgConfigHome, "prim"), source: "xdg" };
-  const home = absolutePath(options.homeDir ?? homedir2(), "HOME");
-  if (!home) {
-    throw new Error("cannot resolve Primitive config directory: HOME is not an absolute path");
-  }
-  return { path: join3(home, ".config", "prim"), source: "default" };
-}
-function primConfigDirectory(options = {}) {
-  return resolvePrimConfigDirectory(options).path;
-}
+import { createHash as createHash3 } from "crypto";
+import { readFileSync as readFileSync6 } from "fs";
+import { join as join8 } from "path";
 
 // src/lib/workos-connect.ts
 var TOKEN_PATH = "/oauth2/token";
@@ -515,20 +1106,20 @@ function parseWorkosConnectTokens(value, options = {}) {
 
 // src/lib/credentials.ts
 var CONFIG_DIRECTORY = primConfigDirectory();
-var TOKEN_FILE_PATH = join4(CONFIG_DIRECTORY, "token");
-var REFRESH_TOKEN_PATH = join4(CONFIG_DIRECTORY, "refresh_token");
-var TOKEN_EXPIRES_PATH = join4(CONFIG_DIRECTORY, "token_expires_at");
-var TERMINAL_REFRESH_PATH = join4(CONFIG_DIRECTORY, "refresh_terminal");
-var CREDENTIAL_METADATA_PATH = join4(CONFIG_DIRECTORY, "credential_metadata.json");
-var CREDENTIAL_FAMILY_PATH = join4(CONFIG_DIRECTORY, "credential_family.json");
-var CREDENTIAL_MIGRATION_PATH = join4(CONFIG_DIRECTORY, "credential_migration.json");
-var CREDENTIAL_LOCK_PATH = join4(CONFIG_DIRECTORY, "credentials.lock");
+var TOKEN_FILE_PATH = join8(CONFIG_DIRECTORY, "token");
+var REFRESH_TOKEN_PATH = join8(CONFIG_DIRECTORY, "refresh_token");
+var TOKEN_EXPIRES_PATH = join8(CONFIG_DIRECTORY, "token_expires_at");
+var TERMINAL_REFRESH_PATH = join8(CONFIG_DIRECTORY, "refresh_terminal");
+var CREDENTIAL_METADATA_PATH = join8(CONFIG_DIRECTORY, "credential_metadata.json");
+var CREDENTIAL_FAMILY_PATH = join8(CONFIG_DIRECTORY, "credential_family.json");
+var CREDENTIAL_MIGRATION_PATH = join8(CONFIG_DIRECTORY, "credential_migration.json");
+var CREDENTIAL_LOCK_PATH = join8(CONFIG_DIRECTORY, "credentials.lock");
 var MAX_CREDENTIAL_METADATA_BYTES = 4096;
 var CREDENTIAL_MIGRATION_VERSION = 1;
 var CREDENTIAL_MIGRATION_STATE = "family_bound";
 function readTrimmed(path) {
   try {
-    const value = readFileSync2(path, "utf8").trim();
+    const value = readFileSync6(path, "utf8").trim();
     return value || void 0;
   } catch {
     return void 0;
@@ -561,7 +1152,7 @@ function resolveAuthCredential(options = {}) {
   return { token: stored, source: "token_file" };
 }
 function credentialFingerprint(value) {
-  return createHash("sha256").update(value).digest("hex");
+  return createHash3("sha256").update(value).digest("hex");
 }
 function parseLegacyBrokerCredentialMetadata(value) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
@@ -581,7 +1172,7 @@ function parseLegacyBrokerCredentialMetadata(value) {
 function readBoundedCredentialJson(path) {
   let raw;
   try {
-    raw = readFileSync2(path, "utf8");
+    raw = readFileSync6(path, "utf8");
   } catch (error) {
     return error.code === "ENOENT" ? void 0 : null;
   }
@@ -618,182 +1209,39 @@ function readCredentialMigrationState(path = CREDENTIAL_MIGRATION_PATH) {
   const parsed = readBoundedCredentialJson(path);
   if (parsed === void 0) return "absent";
   return parsed !== null && isCredentialMigrationSentinel(parsed) ? "valid" : "invalid";
-}
-function readStoredCredentialMetadata(metadataPath = CREDENTIAL_METADATA_PATH, familyPath = CREDENTIAL_FAMILY_PATH, migrationPath = CREDENTIAL_MIGRATION_PATH) {
-  const family = readCredentialFamily(familyPath);
-  if (family) return family;
-  const parsed = readBoundedCredentialJson(metadataPath);
-  if (parsed === void 0) {
-    return readCredentialMigrationState(migrationPath) === "absent" ? { state: "legacy_broker" } : { state: "invalid" };
-  }
-  if (parsed === null) return { state: "invalid" };
-  try {
-    return {
-      state: "workos_connect",
-      metadata: parseWorkosConnectCredentialMetadata(parsed)
-    };
-  } catch {
-    return { state: "invalid" };
-  }
-}
-function decodeJwtPayload(token) {
-  const parts = token.split(".");
-  if (parts.length !== 3) return void 0;
-  try {
-    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
-    if (payload === null || typeof payload !== "object" || Array.isArray(payload)) return void 0;
-    return payload;
-  } catch {
-    return void 0;
-  }
-}
-function jwtExpiresAt(token) {
-  const exp = decodeJwtPayload(token)?.exp;
-  return typeof exp === "number" && Number.isFinite(exp) ? exp * 1e3 : void 0;
-}
-
-// src/lib/file-lock.ts
-import { randomBytes } from "crypto";
-import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync3, rmSync as rmSync2, statSync, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname3, join as join5 } from "path";
-
-// src/lib/process-liveness.ts
-function processIsAlive(pid, probe = process.kill) {
-  if (!Number.isSafeInteger(pid) || pid <= 0) return false;
-  try {
-    probe(pid, 0);
-    return true;
-  } catch (error) {
-    return error.code === "EPERM";
-  }
-}
-
-// src/lib/file-lock.ts
-var DEFAULT_TIMEOUT_MS = 3e4;
-var DEFAULT_POLL_MS = 50;
-var DEFAULT_INIT_GRACE_MS = 2e3;
-var DIRECTORY_MODE = 448;
-var FILE_MODE = 384;
-function ownerPath(lockDir) {
-  return join5(lockDir, "owner.json");
-}
-function readOwner(lockDir) {
-  try {
-    const owner = JSON.parse(readFileSync3(ownerPath(lockDir), "utf8"));
-    if (!Number.isInteger(owner.pid) || owner.pid <= 0 || typeof owner.nonce !== "string" || typeof owner.createdAt !== "number") {
-      return null;
-    }
-    return owner;
-  } catch {
-    return null;
-  }
-}
-function sameOwner(a, b) {
-  return a?.pid === b.pid && a.nonce === b.nonce && a.createdAt === b.createdAt;
-}
-function tryTakeLock(lockDir, now) {
-  try {
-    mkdirSync3(lockDir, { mode: DIRECTORY_MODE });
-  } catch (error) {
-    if (error.code === "EEXIST") return null;
-    throw error;
-  }
-  const owner = {
-    pid: process.pid,
-    nonce: randomBytes(16).toString("hex"),
-    createdAt: now
-  };
-  try {
-    writeFileSync2(ownerPath(lockDir), `${JSON.stringify(owner)}
-`, {
-      encoding: "utf8",
-      mode: FILE_MODE,
-      flag: "wx"
-    });
-    return owner;
-  } catch (error) {
-    rmSync2(lockDir, { recursive: true, force: true });
-    throw error;
-  }
-}
-function recoverStaleLock(lockDir, now, alive, initGraceMs) {
-  const owner = readOwner(lockDir);
-  if (owner) {
-    if (alive(owner.pid)) return false;
-    if (!sameOwner(readOwner(lockDir), owner)) return false;
-    rmSync2(lockDir, { recursive: true, force: true });
-    return true;
-  }
-  try {
-    const before = statSync(lockDir).mtimeMs;
-    if (now - before < initGraceMs) return false;
-    if (readOwner(lockDir)) return false;
-    if (statSync(lockDir).mtimeMs !== before) return false;
-    rmSync2(lockDir, { recursive: true, force: true });
-    return true;
-  } catch {
-    return true;
-  }
-}
-function abortError(signal) {
-  if (signal.reason instanceof Error) return signal.reason;
-  const error = new Error("The operation was aborted");
-  error.name = "AbortError";
-  return error;
-}
-function throwIfAborted(signal) {
-  if (signal?.aborted) throw abortError(signal);
-}
-async function defaultSleep(ms, signal) {
-  if (!signal) {
-    await new Promise((resolve7) => setTimeout(resolve7, ms));
-    return;
+}
+function readStoredCredentialMetadata(metadataPath = CREDENTIAL_METADATA_PATH, familyPath = CREDENTIAL_FAMILY_PATH, migrationPath = CREDENTIAL_MIGRATION_PATH) {
+  const family = readCredentialFamily(familyPath);
+  if (family) return family;
+  const parsed = readBoundedCredentialJson(metadataPath);
+  if (parsed === void 0) {
+    return readCredentialMigrationState(migrationPath) === "absent" ? { state: "legacy_broker" } : { state: "invalid" };
   }
-  throwIfAborted(signal);
-  await new Promise((resolve7, reject) => {
-    const timer = setTimeout(() => {
-      signal.removeEventListener("abort", onAbort);
-      resolve7();
-    }, ms);
-    const onAbort = () => {
-      clearTimeout(timer);
-      reject(abortError(signal));
+  if (parsed === null) return { state: "invalid" };
+  try {
+    return {
+      state: "workos_connect",
+      metadata: parseWorkosConnectCredentialMetadata(parsed)
     };
-    signal.addEventListener("abort", onAbort, { once: true });
-  });
-}
-var syncSleeper = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
-async function withFileLock(lockDir, operation, options = {}) {
-  mkdirSync3(dirname3(lockDir), { recursive: true, mode: DIRECTORY_MODE });
-  const nowMs = options.nowMs ?? Date.now;
-  const alive = options.processAlive ?? processIsAlive;
-  const deadline = nowMs() + (options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
-  let owner = null;
-  while (!owner) {
-    throwIfAborted(options.signal);
-    const now = nowMs();
-    owner = tryTakeLock(lockDir, now);
-    if (owner) break;
-    recoverStaleLock(lockDir, now, alive, options.initGraceMs ?? DEFAULT_INIT_GRACE_MS);
-    if (now >= deadline) {
-      throw new Error(`timed out waiting for file lock ${lockDir}`);
-    }
-    if (options.sleep) {
-      await options.sleep(options.pollMs ?? DEFAULT_POLL_MS);
-      throwIfAborted(options.signal);
-    } else {
-      await defaultSleep(options.pollMs ?? DEFAULT_POLL_MS, options.signal);
-    }
+  } catch {
+    return { state: "invalid" };
   }
+}
+function decodeJwtPayload(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return void 0;
   try {
-    throwIfAborted(options.signal);
-    return await operation();
-  } finally {
-    if (sameOwner(readOwner(lockDir), owner)) {
-      rmSync2(lockDir, { recursive: true, force: true });
-    }
+    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    if (payload === null || typeof payload !== "object" || Array.isArray(payload)) return void 0;
+    return payload;
+  } catch {
+    return void 0;
   }
 }
+function jwtExpiresAt(token) {
+  const exp = decodeJwtPayload(token)?.exp;
+  return typeof exp === "number" && Number.isFinite(exp) ? exp * 1e3 : void 0;
+}
 
 // src/lib/terminal-safe.ts
 function replaceIsolatedSurrogates(value) {
@@ -848,7 +1296,7 @@ var DEFAULT_API_URL = "https://api.getprimitive.ai";
 var AUTH_EXPIRED_MESSAGE = "Authentication expired. Run `prim auth login` to re-authenticate.";
 function readTrimmed2(path) {
   try {
-    const value = readFileSync4(path, "utf8").trim();
+    const value = readFileSync7(path, "utf8").trim();
     return value || void 0;
   } catch {
     return void 0;
@@ -864,17 +1312,17 @@ function expiresAtFor(token, expiresIn) {
   return expiresIn === void 0 ? jwtExpiresAt(token) : Date.now() + expiresIn * 1e3;
 }
 function ensureConfigDirectory() {
-  const directory = dirname4(TOKEN_FILE_PATH);
-  mkdirSync4(directory, { recursive: true, mode: CONFIG_DIR_MODE });
-  chmodSync2(directory, CONFIG_DIR_MODE);
+  const directory = dirname7(TOKEN_FILE_PATH);
+  mkdirSync5(directory, { recursive: true, mode: CONFIG_DIR_MODE });
+  chmodSync3(directory, CONFIG_DIR_MODE);
 }
 function atomicWrite(path, content) {
   ensureConfigDirectory();
   atomicWriteFile(path, content, { mode: CREDENTIAL_FILE_MODE });
 }
 function removeCredentialFile(path) {
-  if (!existsSync3(path)) return false;
-  rmSync3(path, { force: true });
+  if (!existsSync6(path)) return false;
+  rmSync4(path, { force: true });
   return true;
 }
 function getTokenExpiresAt() {
@@ -889,7 +1337,7 @@ function isTokenExpiringSoon(credential) {
   return expiresAt !== void 0 && Date.now() >= expiresAt - REFRESH_THRESHOLD_MS;
 }
 function refreshFingerprint(refreshToken2) {
-  return createHash2("sha256").update(refreshToken2).digest("hex");
+  return createHash4("sha256").update(refreshToken2).digest("hex");
 }
 function legacyBrokerCredentialMetadata(accessToken, refreshToken2) {
   return {
@@ -1291,24 +1739,24 @@ function getClient() {
 }
 
 // src/commands/claude-plugin.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 import {
-  constants as constants3,
+  constants as constants4,
   closeSync as closeSync3,
-  existsSync as existsSync5,
+  existsSync as existsSync8,
   fstatSync as fstatSync2,
-  lstatSync as lstatSync3,
-  mkdirSync as mkdirSync5,
+  lstatSync as lstatSync4,
+  mkdirSync as mkdirSync6,
   openSync as openSync3,
-  readFileSync as readFileSync6,
+  readFileSync as readFileSync9,
   readSync as readSync2,
-  readdirSync,
-  realpathSync as realpathSync2,
-  rmSync as rmSync4,
-  rmdirSync
+  readdirSync as readdirSync3,
+  realpathSync as realpathSync3,
+  rmSync as rmSync5,
+  rmdirSync as rmdirSync2
 } from "fs";
-import { homedir as homedir4 } from "os";
-import { dirname as dirname7, isAbsolute as isAbsolute4, join as join9, relative as relative2, resolve as resolve4, sep as sep2 } from "path";
+import { homedir as homedir6 } from "os";
+import { dirname as dirname9, isAbsolute as isAbsolute6, join as join12, relative as relative2, resolve as resolve5, sep as sep2 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
 // node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/browser/dist/nodes/identity.js
@@ -7578,67 +8026,23 @@ function parse(src, reviver, options) {
   return doc.toJS(Object.assign({ reviver: _reviver }, options));
 }
 
-// src/lib/git.ts
-import { execFileSync } from "child_process";
-import { createHash as createHash3 } from "crypto";
-import { lstatSync, realpathSync } from "fs";
-import { basename, dirname as dirname5, isAbsolute as isAbsolute3, relative, resolve as resolve2, sep } from "path";
-var GIT_TIMEOUT_MS = 1e3;
-var GITHUB_OWNER_PATTERN = /^(?![A-Za-z0-9-]*--)[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/u;
-var GITHUB_REPOSITORY_PATTERN = /^[A-Za-z0-9._-]{1,100}$/u;
-function gitToplevel(cwd) {
-  try {
-    return execFileSync("git", ["rev-parse", "--show-toplevel"], {
-      cwd,
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"],
-      timeout: GIT_TIMEOUT_MS
-    }).trim();
-  } catch {
-    return null;
-  }
-}
-function gitValue(cwd, args) {
-  try {
-    const value = execFileSync("git", args, {
-      cwd,
-      encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"],
-      timeout: GIT_TIMEOUT_MS
-    }).trim();
-    return value || void 0;
-  } catch {
-    return void 0;
-  }
-}
-function githubRepositoryFullName(cwd) {
-  const remote = gitValue(cwd, ["config", "--get", "remote.origin.url"]);
-  if (!remote || [...remote].some((char) => char < " " || char === "\x7F")) return null;
-  const match = /^(?:git@github\.com:([^?#]+)|(?:https|ssh):\/\/(?:[^/@]+@)?github\.com(?::\d+)?\/([^?#]+))$/i.exec(
-    remote
-  );
-  const path = match?.[1] ?? match?.[2];
-  if (!path) return null;
-  const parts = path.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "").split("/");
-  if (parts.length !== 2 || !GITHUB_OWNER_PATTERN.test(parts[0] ?? "") || !GITHUB_REPOSITORY_PATTERN.test(parts[1] ?? "")) {
-    return null;
-  }
-  return `${parts[0]}/${parts[1]}`;
-}
-
 // src/commands/skill.ts
+import { createHash as createHash5 } from "crypto";
 import {
-  constants as constants2,
+  constants as constants3,
   closeSync as closeSync2,
-  existsSync as existsSync4,
+  existsSync as existsSync7,
   fstatSync,
-  lstatSync as lstatSync2,
+  lstatSync as lstatSync3,
   openSync as openSync2,
-  readFileSync as readFileSync5,
-  readSync
+  readFileSync as readFileSync8,
+  readSync,
+  readdirSync as readdirSync2,
+  rmdirSync,
+  unlinkSync
 } from "fs";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname6, join as join8, resolve as resolve3 } from "path";
+import { homedir as homedir5 } from "os";
+import { dirname as dirname8, join as join11, resolve as resolve4 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // node_modules/.pnpm/diff@5.2.2/node_modules/diff/lib/index.mjs
@@ -7808,7 +8212,7 @@ Diff.prototype = {
   tokenize: function tokenize(value) {
     return value.split("");
   },
-  join: function join7(chars) {
+  join: function join10(chars) {
     return chars.join("");
   }
 };
@@ -7993,7 +8397,7 @@ arrayDiff.join = arrayDiff.removeEmpty = function(value) {
 };
 
 // src/commands/skill.ts
-var __dirname = dirname6(fileURLToPath2(import.meta.url));
+var __dirname = dirname8(fileURLToPath2(import.meta.url));
 var SKILL_BEGIN = "<!-- BEGIN PRIM SKILL v1 -->";
 var SKILL_END = "<!-- END PRIM SKILL v1 -->";
 var CODEX_GUIDANCE_LIMIT_BYTES = 1024 * 1024;
@@ -8002,9 +8406,9 @@ var SKILL_BEGIN_BUFFER = Buffer.from(SKILL_BEGIN);
 var SKILL_END_BUFFER = Buffer.from(SKILL_END);
 function readCodexGuidance(path) {
   try {
-    const entry = lstatSync2(path);
+    const entry = lstatSync3(path);
     if (entry.isSymbolicLink() || !entry.isFile()) return null;
-    const fd = openSync2(path, constants2.O_RDONLY | constants2.O_NOFOLLOW);
+    const fd = openSync2(path, constants3.O_RDONLY | constants3.O_NOFOLLOW);
     try {
       const opened = fstatSync(fd);
       if (!opened.isFile() || opened.size > CODEX_GUIDANCE_LIMIT_BYTES) return null;
@@ -8025,10 +8429,10 @@ function readCodexGuidance(path) {
   }
 }
 function effectiveCodexGuidance(scope) {
-  const override = readCodexGuidance(join8(scope, "AGENTS.override.md"));
+  const override = readCodexGuidance(join11(scope, "AGENTS.override.md"));
   if (override === null) return null;
   if (override !== void 0 && override.toString("utf8").trim().length > 0) return override;
-  const base = readCodexGuidance(join8(scope, "AGENTS.md"));
+  const base = readCodexGuidance(join11(scope, "AGENTS.md"));
   return base ?? null;
 }
 function hasUsablePrimBlock(content, visibleBytes) {
@@ -8049,12 +8453,12 @@ function hasUsablePrimBlock(content, visibleBytes) {
     return false;
   }
 }
-function hasUsableCodexGuidance(projectRoot) {
+function hasUsableCodexGuidance(projectRoot2) {
   try {
-    const codexHome = process.env.CODEX_HOME?.trim() ? resolve3(process.env.CODEX_HOME) : join8(homedir3(), ".codex");
+    const codexHome = process.env.CODEX_HOME?.trim() ? resolve4(process.env.CODEX_HOME) : join11(homedir5(), ".codex");
     const scopes = [
       { path: codexHome, visibleBytes: CODEX_GUIDANCE_LIMIT_BYTES },
-      { path: projectRoot, visibleBytes: CODEX_DEFAULT_PROJECT_GUIDANCE_BYTES }
+      { path: projectRoot2, visibleBytes: CODEX_DEFAULT_PROJECT_GUIDANCE_BYTES }
     ];
     return scopes.some(({ path, visibleBytes }) => {
       const guidance = effectiveCodexGuidance(path);
@@ -8064,12 +8468,58 @@ function hasUsableCodexGuidance(projectRoot) {
     return false;
   }
 }
+var CURSOR_SKILL_OWNER = "@primitive.ai/prim";
+var CURSOR_SKILL_MANIFEST = ".prim-owned.json";
+function sha256(content) {
+  return createHash5("sha256").update(content).digest("hex");
+}
+function cursorSkillDirectory(cwd, scope) {
+  const base = scope === "user" ? cursorConfigDirectory() : gitToplevel(cwd) ?? cwd;
+  return join11(base, scope === "user" ? "skills" : ".cursor/skills", "prim");
+}
+function cursorSkillPaths(cwd, scope) {
+  const directory = cursorSkillDirectory(cwd, scope);
+  return {
+    directory,
+    skill: join11(directory, "SKILL.md"),
+    manifest: join11(directory, CURSOR_SKILL_MANIFEST)
+  };
+}
+function readCursorSkillManifest(path) {
+  try {
+    const value = JSON.parse(readFileSync8(path, "utf8"));
+    if (!value || typeof value !== "object" || Array.isArray(value)) return;
+    const record = value;
+    if (record.version !== 1 || record.owner !== CURSOR_SKILL_OWNER || typeof record.contentSha256 !== "string" || !/^[0-9a-f]{64}$/u.test(record.contentSha256)) {
+      return;
+    }
+    return record;
+  } catch {
+    return;
+  }
+}
+function cursorSkillStatus(cwd, scope) {
+  const paths = cursorSkillPaths(cwd, scope);
+  const manifest = readCursorSkillManifest(paths.manifest);
+  const content = existsSync7(paths.skill) ? readFileSync8(paths.skill, "utf8") : void 0;
+  const owned = manifest !== void 0;
+  const installed = owned && content !== void 0 && sha256(content) === manifest.contentSha256;
+  return {
+    installed,
+    owned,
+    edited: owned && content !== void 0 && !installed,
+    target: paths.skill
+  };
+}
+function hasUsableCursorSkill(projectRoot2) {
+  return cursorSkillStatus(projectRoot2, "project").installed || cursorSkillStatus(projectRoot2, "user").installed;
+}
 function loadSkill() {
   let dir = __dirname;
-  while (dir !== dirname6(dir)) {
-    const p = resolve3(dir, "SKILL.md");
-    if (existsSync4(p)) return readFileSync5(p, "utf-8");
-    dir = dirname6(dir);
+  while (dir !== dirname8(dir)) {
+    const p = resolve4(dir, "SKILL.md");
+    if (existsSync7(p)) return readFileSync8(p, "utf-8");
+    dir = dirname8(dir);
   }
   throw new Error("SKILL.md not found in package");
 }
@@ -8078,22 +8528,22 @@ function atomicWrite2(target, content) {
 }
 
 // src/commands/claude-plugin.ts
-var __dirname2 = dirname7(fileURLToPath3(import.meta.url));
+var __dirname2 = dirname9(fileURLToPath3(import.meta.url));
 var PLUGIN_DESCRIPTION = "Primitive decision-graph guidance for the prim CLI \u2014 a model-invoked skill installed by prim skill install.";
-var MAX_MANIFEST_BYTES = 64 * 1024;
+var MAX_MANIFEST_BYTES2 = 64 * 1024;
 var MAX_SKILL_BYTES = 1024 * 1024;
 var REFRESH_LOCK_TIMEOUT_MS = 150;
 var REFRESH_LOCK_POLL_MS = 10;
 function pluginDirFor(cwd, scope) {
-  const base = scope === "user" ? join9(homedir4(), ".claude") : join9(gitToplevel(cwd) ?? cwd, ".claude");
-  return join9(base, "skills", "prim");
+  const base = scope === "user" ? join12(homedir6(), ".claude") : join12(gitToplevel(cwd) ?? cwd, ".claude");
+  return join12(base, "skills", "prim");
 }
 function packageVersion2() {
   let dir = __dirname2;
-  while (dir !== dirname7(dir)) {
-    const p = resolve4(dir, "package.json");
-    if (existsSync5(p)) return JSON.parse(readFileSync6(p, "utf-8")).version;
-    dir = dirname7(dir);
+  while (dir !== dirname9(dir)) {
+    const p = resolve5(dir, "package.json");
+    if (existsSync8(p)) return JSON.parse(readFileSync9(p, "utf-8")).version;
+    dir = dirname9(dir);
   }
   return "0.0.0";
 }
@@ -8108,27 +8558,27 @@ function renderClaudePlugin() {
 }
 function pluginPaths(dir) {
   return {
-    manifestPath: join9(dir, ".claude-plugin", "plugin.json"),
-    skillPath: join9(dir, "SKILL.md")
+    manifestPath: join12(dir, ".claude-plugin", "plugin.json"),
+    skillPath: join12(dir, "SKILL.md")
   };
 }
 function pathIsInside(root, path) {
   const rel = relative2(root, path);
-  return rel !== ".." && !rel.startsWith(`..${sep2}`) && !isAbsolute4(rel);
+  return rel !== ".." && !rel.startsWith(`..${sep2}`) && !isAbsolute6(rel);
 }
-function managedPathsAreSafe(paths, projectRoot) {
+function managedPathsAreSafe(paths, projectRoot2) {
   try {
     const managed = [paths.manifestPath, paths.skillPath];
-    if (managed.some((path) => !lstatSync3(path).isFile())) return false;
-    if (projectRoot === void 0) return true;
-    const realRoot = realpathSync2(projectRoot);
-    return managed.every((path) => pathIsInside(realRoot, realpathSync2(path)));
+    if (managed.some((path) => !lstatSync4(path).isFile())) return false;
+    if (projectRoot2 === void 0) return true;
+    const realRoot = realpathSync3(projectRoot2);
+    return managed.every((path) => pathIsInside(realRoot, realpathSync3(path)));
   } catch {
     return false;
   }
 }
 function readBoundedRegularFile(path, maxBytes) {
-  const fd = openSync3(path, constants3.O_RDONLY | constants3.O_NOFOLLOW);
+  const fd = openSync3(path, constants4.O_RDONLY | constants4.O_NOFOLLOW);
   try {
     const stat = fstatSync2(fd);
     if (!stat.isFile() || stat.size > maxBytes) throw new Error("unsafe managed file");
@@ -8159,10 +8609,10 @@ function hasUsablePrimFrontmatter(skill) {
     return false;
   }
 }
-function inspectRecognizedInstallation(paths, projectRoot) {
-  if (!existsSync5(paths.manifestPath) || !existsSync5(paths.skillPath)) return;
-  if (!managedPathsAreSafe(paths, projectRoot)) return;
-  const manifest = readBoundedRegularFile(paths.manifestPath, MAX_MANIFEST_BYTES);
+function inspectRecognizedInstallation(paths, projectRoot2) {
+  if (!existsSync8(paths.manifestPath) || !existsSync8(paths.skillPath)) return;
+  if (!managedPathsAreSafe(paths, projectRoot2)) return;
+  const manifest = readBoundedRegularFile(paths.manifestPath, MAX_MANIFEST_BYTES2);
   const parsed = JSON.parse(manifest);
   if (parsed.name !== "prim") return;
   const skill = readBoundedRegularFile(paths.skillPath, MAX_SKILL_BYTES);
@@ -8174,23 +8624,23 @@ function inspectRecognizedInstallation(paths, projectRoot) {
   };
 }
 function refreshLockDir(physicalPluginDir) {
-  const cacheRoot = process.env.XDG_CACHE_HOME || join9(homedir4(), ".cache");
-  const identity = createHash4("sha256").update(physicalPluginDir).digest("hex");
-  return join9(cacheRoot, "prim", "skill-refresh-locks", `${identity}.lock`);
+  const cacheRoot = process.env.XDG_CACHE_HOME || join12(homedir6(), ".cache");
+  const identity = createHash6("sha256").update(physicalPluginDir).digest("hex");
+  return join12(cacheRoot, "prim", "skill-refresh-locks", `${identity}.lock`);
 }
 async function refreshClaudePlugins(cwd, options = {}) {
   const result = { installed: 0, refreshed: 0 };
   const candidates = [];
   if (options.includeProject !== false) {
-    const projectRoot = options.projectRoot ?? gitToplevel(cwd);
-    if (projectRoot !== null && isAbsolute4(projectRoot)) {
-      candidates.push({ dir: join9(projectRoot, ".claude", "skills", "prim"), projectRoot });
+    const projectRoot2 = options.projectRoot ?? gitToplevel(cwd);
+    if (projectRoot2 !== null && isAbsolute6(projectRoot2)) {
+      candidates.push({ dir: join12(projectRoot2, ".claude", "skills", "prim"), projectRoot: projectRoot2 });
     }
   }
   candidates.push({ dir: pluginDirFor(cwd, "user") });
   const seen = /* @__PURE__ */ new Set();
   let desired;
-  for (const { dir, projectRoot } of candidates) {
+  for (const { dir, projectRoot: projectRoot2 } of candidates) {
     let counted = false;
     const markInstalled = () => {
       if (!counted) {
@@ -8203,21 +8653,21 @@ async function refreshClaudePlugins(cwd, options = {}) {
       const paths = { manifestPath, skillPath };
       try {
         let changed = false;
-        const current = inspectRecognizedInstallation(paths, projectRoot);
+        const current = inspectRecognizedInstallation(paths, projectRoot2);
         if (!current) return;
         desired ??= renderClaudePlugin();
-        if (projectRoot !== void 0 && current.usable && compareSemver(current.manifestVersion, desired.version) === 1) {
+        if (projectRoot2 !== void 0 && current.usable && compareSemver(current.manifestVersion, desired.version) === 1) {
           markInstalled();
           return;
         }
         if (current.manifest !== desired.manifest) {
-          if (!managedPathsAreSafe(paths, projectRoot)) throw new Error("unsafe managed path");
+          if (!managedPathsAreSafe(paths, projectRoot2)) throw new Error("unsafe managed path");
           atomicWrite2(manifestPath, desired.manifest);
           if (!changed) result.refreshed += 1;
           changed = true;
         }
         if (current.skill !== desired.skill) {
-          if (!managedPathsAreSafe(paths, projectRoot)) throw new Error("unsafe managed path");
+          if (!managedPathsAreSafe(paths, projectRoot2)) throw new Error("unsafe managed path");
           atomicWrite2(skillPath, desired.skill);
           if (!changed) result.refreshed += 1;
           changed = true;
@@ -8225,15 +8675,15 @@ async function refreshClaudePlugins(cwd, options = {}) {
         markInstalled();
       } catch {
         try {
-          if (inspectRecognizedInstallation(paths, projectRoot)?.usable) markInstalled();
+          if (inspectRecognizedInstallation(paths, projectRoot2)?.usable) markInstalled();
         } catch {
         }
       }
     };
     try {
       const paths = pluginPaths(dir);
-      if (!existsSync5(paths.manifestPath) || !existsSync5(paths.skillPath)) continue;
-      const physicalPluginDir = realpathSync2(dir);
+      if (!existsSync8(paths.manifestPath) || !existsSync8(paths.skillPath)) continue;
+      const physicalPluginDir = realpathSync3(dir);
       if (seen.has(physicalPluginDir)) continue;
       seen.add(physicalPluginDir);
       await withFileLock(refreshLockDir(physicalPluginDir), refreshCandidate, {
@@ -8248,16 +8698,16 @@ async function refreshClaudePlugins(cwd, options = {}) {
 
 // src/daemon/client.ts
 import { createConnection } from "net";
-import { join as join10 } from "path";
+import { join as join13 } from "path";
 
 // src/daemon/principal.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 var PRINCIPAL_COMPONENT_MAX_LENGTH = 512;
 function boundedClaim(value) {
   return typeof value === "string" && value.length > 0 && value.length <= PRINCIPAL_COMPONENT_MAX_LENGTH ? value : void 0;
 }
-function sha256(value) {
-  return createHash5("sha256").update(value).digest("hex");
+function sha2562(value) {
+  return createHash7("sha256").update(value).digest("hex");
 }
 function resolveDaemonPrincipal(token = resolveAuthCredential()?.token) {
   if (!token) return void 0;
@@ -8267,9 +8717,9 @@ function resolveDaemonPrincipal(token = resolveAuthCredential()?.token) {
   if (!(subject && organizationId)) return void 0;
   const issuer = boundedClaim(payload?.iss) ?? "unknown-issuer";
   return {
-    principalId: sha256(`${issuer}\0${subject}`),
+    principalId: sha2562(`${issuer}\0${subject}`),
     organizationId,
-    credentialFingerprint: sha256(token)
+    credentialFingerprint: sha2562(token)
   };
 }
 function daemonPrincipalsMatch(caller, daemon) {
@@ -8298,7 +8748,7 @@ function parseDaemonResponseEnvelope(value) {
 }
 
 // src/daemon/client.ts
-var SOCK_PATH = join10(primConfigDirectory(), "sock");
+var SOCK_PATH = join13(primConfigDirectory(), "sock");
 var DEFAULT_TIMEOUT_MS2 = 250;
 var nextRequestId = 1;
 function daemonRequest(method, params = {}, opts = {}) {
@@ -8311,7 +8761,7 @@ function daemonRequest(method, params = {}, opts = {}) {
     ...caller ? { caller } : {}
   };
   const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
-  return new Promise((resolve7) => {
+  return new Promise((resolve9) => {
     let settled = false;
     let socket;
     let buffer = Buffer.alloc(0);
@@ -8326,7 +8776,7 @@ function daemonRequest(method, params = {}, opts = {}) {
         } catch {
         }
       }
-      resolve7(value);
+      resolve9(value);
     };
     const timer = setTimeout(() => settle(null), timeoutMs);
     timer.unref();
@@ -8592,16 +9042,16 @@ async function acknowledgeDecisionFeedback(input, dependencies = {}) {
 
 // src/lib/activation.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync6, readFileSync as readFileSync7 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join11 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync10 } from "fs";
+import { homedir as homedir7 } from "os";
+import { join as join14 } from "path";
 var PRIM_ACTIVE_KEY = "prim.active";
 var PRIM_REPO_SYNC_ID_KEY = "prim.repoSyncId";
 var PRIM_REPO_SYNC_REPOSITORY_KEY = "prim.repoSyncRepository";
 var PRIM_REPO_BINDING_STATE_KEY = "prim.repoBindingState";
 var GIT_TIMEOUT_MS2 = 1e3;
 var REPO_SYNC_ID_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
-var PROJECT_INSTALL_FILES = [".claude/settings.json", ".codex/hooks.json"];
+var PROJECT_INSTALL_FILES = [".claude/settings.json", ".codex/hooks.json", ".cursor/hooks.json"];
 var PRIM_HOOK_BINS = ["prim-hook", "prim-pre-tool-use", "prim-post-tool-use"];
 function repoActiveFlag(cwd) {
   try {
@@ -8690,12 +9140,12 @@ function repositoryBindingState(cwd) {
 }
 function hasProjectPrimInstall(cwd) {
   const root = gitToplevel(cwd);
-  if (root === null || root === homedir5()) return false;
+  if (root === null || root === homedir7()) return false;
   for (const rel of PROJECT_INSTALL_FILES) {
-    const path = join11(root, rel);
-    if (existsSync6(path)) {
+    const path = join14(root, rel);
+    if (existsSync9(path)) {
       try {
-        const content = readFileSync7(path, "utf-8");
+        const content = readFileSync10(path, "utf-8");
         if (PRIM_HOOK_BINS.some((bin) => content.includes(bin))) return true;
       } catch {
       }
@@ -9536,7 +9986,7 @@ function validate23(data, { instancePath = "", parentData, parentDataProperty, r
 }
 validate23.evaluated = { "props": true, "dynamicProps": false, "dynamicItems": false };
 var isDecisionCollectScopeResponse = validate24;
-var schema39 = { "type": "object", "properties": { "policy": { "anyOf": [{ "type": "object", "properties": { "repositories": { "type": "array", "items": { "type": "string" } }, "directories": { "type": "array", "items": { "type": "string" } }, "globs": { "type": "array", "items": { "type": "string" } }, "branches": { "type": "array", "items": { "type": "string" } }, "effectiveFrom": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 }, "effectiveUntil": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 }, "users": { "type": "array", "items": { "oneOf": [{ "type": "object", "properties": { "kind": { "type": "string", "const": "user" }, "userId": { "type": "string", "minLength": 1 } }, "required": ["kind", "userId"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "role" }, "role": { "type": "string", "enum": ["owner", "admin", "member"] } }, "required": ["kind", "role"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "agent" }, "agent": { "type": "string", "enum": ["claude_code", "codex", "hermes"] } }, "required": ["kind", "agent"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "credential" }, "credential": { "type": "string", "enum": ["workos_jwt", "workos_api_key", "service_token"] } }, "required": ["kind", "credential"], "additionalProperties": false }] } }, "updatedAt": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": ["updatedAt"], "additionalProperties": {} }, { "type": "null" }] }, "collectScopeVersion": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "callerIncluded": { "type": "boolean" } }, "required": ["policy", "collectScopeVersion", "callerIncluded"], "additionalProperties": {} };
+var schema39 = { "type": "object", "properties": { "policy": { "anyOf": [{ "type": "object", "properties": { "repositories": { "type": "array", "items": { "type": "string" } }, "directories": { "type": "array", "items": { "type": "string" } }, "globs": { "type": "array", "items": { "type": "string" } }, "branches": { "type": "array", "items": { "type": "string" } }, "effectiveFrom": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 }, "effectiveUntil": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 }, "users": { "type": "array", "items": { "oneOf": [{ "type": "object", "properties": { "kind": { "type": "string", "const": "user" }, "userId": { "type": "string", "minLength": 1 } }, "required": ["kind", "userId"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "role" }, "role": { "type": "string", "enum": ["owner", "admin", "member"] } }, "required": ["kind", "role"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "agent" }, "agent": { "type": "string", "enum": ["claude_code", "codex", "cursor", "hermes"] } }, "required": ["kind", "agent"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "credential" }, "credential": { "type": "string", "enum": ["workos_jwt", "workos_api_key", "service_token"] } }, "required": ["kind", "credential"], "additionalProperties": false }] } }, "updatedAt": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 } }, "required": ["updatedAt"], "additionalProperties": {} }, { "type": "null" }] }, "collectScopeVersion": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }, "callerIncluded": { "type": "boolean" } }, "required": ["policy", "collectScopeVersion", "callerIncluded"], "additionalProperties": {} };
 function validate24(data, { instancePath = "", parentData, parentDataProperty, rootData = data, dynamicAnchors = {} } = {}) {
   ;
   let vErrors = null;
@@ -10087,7 +10537,7 @@ function validate24(data, { instancePath = "", parentData, parentDataProperty, r
                                                     }
                                                     errors++;
                                                   }
-                                                  if (!(data18 === "claude_code" || data18 === "codex" || data18 === "hermes")) {
+                                                  if (!(data18 === "claude_code" || data18 === "codex" || data18 === "cursor" || data18 === "hermes")) {
                                                     const err34 = { instancePath: instancePath + "/policy/users/" + i4 + "/agent", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/DecisionCollectScopeResponse/properties/policy/anyOf/0/properties/users/items/oneOf/2/properties/agent/enum", keyword: "enum", params: { allowedValues: schema39.properties.policy.anyOf[0].properties.users.items.oneOf[2].properties.agent.enum }, message: "must be equal to one of the allowed values" };
                                                     if (vErrors === null) {
                                                       vErrors = [err34];
@@ -10856,7 +11306,7 @@ function validate26(data, { instancePath = "", parentData, parentDataProperty, r
   return errors === 0;
 }
 validate26.evaluated = { "dynamicProps": true, "dynamicItems": false };
-var schema45 = { "type": "object", "properties": { "intent": { "type": "string", "minLength": 1, "maxLength": 500 }, "attribution": { "type": "string", "enum": ["user", "agent", "unknown"] }, "kind": { "type": "string", "enum": ["change", "exploration", "task_execution", "unclear"] }, "rationale": { "type": "string" }, "area": { "type": "string" }, "decided": { "type": "array", "items": { "type": "string" } }, "alternatives": { "type": "array", "items": { "type": "string" } }, "confidence": { "type": "string", "enum": ["high", "medium", "low"] }, "reversibility": { "type": "string", "enum": ["high", "low"] }, "files": { "type": "array", "items": { "type": "string" } }, "protocolVersion": { "type": "number", "const": 3 }, "repoSyncId": { "type": "string" }, "scope": { "default": {}, "type": "object", "properties": { "location": { "default": {}, "type": "object", "properties": { "repository": { "type": "boolean" }, "directories": { "type": "array", "items": { "type": "string" } }, "globs": { "type": "array", "items": { "type": "string" } }, "branches": { "type": "array", "items": { "type": "string" } } }, "additionalProperties": {} }, "time": { "default": {}, "type": "object", "properties": { "effectiveFrom": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 }, "effectiveUntil": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 } }, "additionalProperties": {} }, "users": { "type": "array", "items": { "oneOf": [{ "type": "object", "properties": { "kind": { "type": "string", "const": "user" }, "userId": { "type": "string", "minLength": 1 } }, "required": ["kind", "userId"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "role" }, "role": { "type": "string", "enum": ["owner", "admin", "member"] } }, "required": ["kind", "role"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "agent" }, "agent": { "type": "string", "enum": ["claude_code", "codex", "hermes"] } }, "required": ["kind", "agent"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "credential" }, "credential": { "type": "string", "enum": ["workos_jwt", "workos_api_key", "service_token"] } }, "required": ["kind", "credential"], "additionalProperties": false }] } } }, "additionalProperties": {} }, "stageOverride": { "type": "string", "enum": ["candidate", "draft", "adopted"] } }, "required": ["intent"], "additionalProperties": {}, "x-primitive-runtime-refinements": ["degrade_invalid_rollout_fields", "degrade_invalid_location_scope", "degrade_invalid_time_scope"] };
+var schema45 = { "type": "object", "properties": { "intent": { "type": "string", "minLength": 1, "maxLength": 500 }, "attribution": { "type": "string", "enum": ["user", "agent", "unknown"] }, "kind": { "type": "string", "enum": ["change", "exploration", "task_execution", "unclear"] }, "rationale": { "type": "string" }, "area": { "type": "string" }, "decided": { "type": "array", "items": { "type": "string" } }, "alternatives": { "type": "array", "items": { "type": "string" } }, "confidence": { "type": "string", "enum": ["high", "medium", "low"] }, "reversibility": { "type": "string", "enum": ["high", "low"] }, "files": { "type": "array", "items": { "type": "string" } }, "protocolVersion": { "type": "number", "const": 3 }, "repoSyncId": { "type": "string" }, "scope": { "default": {}, "type": "object", "properties": { "location": { "default": {}, "type": "object", "properties": { "repository": { "type": "boolean" }, "directories": { "type": "array", "items": { "type": "string" } }, "globs": { "type": "array", "items": { "type": "string" } }, "branches": { "type": "array", "items": { "type": "string" } } }, "additionalProperties": {} }, "time": { "default": {}, "type": "object", "properties": { "effectiveFrom": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 }, "effectiveUntil": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 } }, "additionalProperties": {} }, "users": { "type": "array", "items": { "oneOf": [{ "type": "object", "properties": { "kind": { "type": "string", "const": "user" }, "userId": { "type": "string", "minLength": 1 } }, "required": ["kind", "userId"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "role" }, "role": { "type": "string", "enum": ["owner", "admin", "member"] } }, "required": ["kind", "role"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "agent" }, "agent": { "type": "string", "enum": ["claude_code", "codex", "cursor", "hermes"] } }, "required": ["kind", "agent"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "credential" }, "credential": { "type": "string", "enum": ["workos_jwt", "workos_api_key", "service_token"] } }, "required": ["kind", "credential"], "additionalProperties": false }] } } }, "additionalProperties": {} }, "stageOverride": { "type": "string", "enum": ["candidate", "draft", "adopted"] } }, "required": ["intent"], "additionalProperties": {}, "x-primitive-runtime-refinements": ["degrade_invalid_rollout_fields", "degrade_invalid_location_scope", "degrade_invalid_time_scope"] };
 function validate27(data, { instancePath = "", parentData, parentDataProperty, rootData = data, dynamicAnchors = {} } = {}) {
   ;
   let vErrors = null;
@@ -11560,7 +12010,7 @@ function validate27(data, { instancePath = "", parentData, parentDataProperty, r
                                                                   }
                                                                   errors++;
                                                                 }
-                                                                if (!(data34 === "claude_code" || data34 === "codex" || data34 === "hermes")) {
+                                                                if (!(data34 === "claude_code" || data34 === "codex" || data34 === "cursor" || data34 === "hermes")) {
                                                                   const err19 = { instancePath: instancePath + "/scope/users/" + i6 + "/agent", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/DecisionCreateRequest/properties/scope/properties/users/items/oneOf/2/properties/agent/enum", keyword: "enum", params: { allowedValues: schema45.properties.scope.properties.users.items.oneOf[2].properties.agent.enum }, message: "must be equal to one of the allowed values" };
                                                                   if (vErrors === null) {
                                                                     vErrors = [err19];
@@ -11788,7 +12238,7 @@ function validate27(data, { instancePath = "", parentData, parentDataProperty, r
   return errors === 0;
 }
 validate27.evaluated = { "props": true, "dynamicProps": false, "dynamicItems": false };
-var schema47 = { "type": "object", "properties": { "decisionId": { "type": "string", "minLength": 1 }, "shortId": { "type": "string" }, "createdAt": { "type": "number" }, "scope": { "type": "object", "properties": { "location": { "type": "object", "properties": { "repository": { "type": "boolean" }, "directories": { "type": "array", "items": { "type": "string" } }, "globs": { "type": "array", "items": { "type": "string" } }, "branches": { "type": "array", "items": { "type": "string" } } }, "required": ["repository", "directories", "globs", "branches"], "additionalProperties": {} }, "time": { "type": "object", "properties": { "effectiveFrom": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 }, "effectiveUntil": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 } }, "additionalProperties": {} }, "users": { "type": "array", "items": { "oneOf": [{ "type": "object", "properties": { "kind": { "type": "string", "const": "user" }, "userId": { "type": "string", "minLength": 1 } }, "required": ["kind", "userId"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "role" }, "role": { "type": "string", "enum": ["owner", "admin", "member"] } }, "required": ["kind", "role"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "agent" }, "agent": { "type": "string", "enum": ["claude_code", "codex", "hermes"] } }, "required": ["kind", "agent"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "credential" }, "credential": { "type": "string", "enum": ["workos_jwt", "workos_api_key", "service_token"] } }, "required": ["kind", "credential"], "additionalProperties": false }] } } }, "required": ["location", "time", "users"], "additionalProperties": {} }, "scopeWarnings": { "type": "array", "items": { "type": "string" } } }, "required": ["decisionId", "shortId", "createdAt"], "additionalProperties": {} };
+var schema47 = { "type": "object", "properties": { "decisionId": { "type": "string", "minLength": 1 }, "shortId": { "type": "string" }, "createdAt": { "type": "number" }, "scope": { "type": "object", "properties": { "location": { "type": "object", "properties": { "repository": { "type": "boolean" }, "directories": { "type": "array", "items": { "type": "string" } }, "globs": { "type": "array", "items": { "type": "string" } }, "branches": { "type": "array", "items": { "type": "string" } } }, "required": ["repository", "directories", "globs", "branches"], "additionalProperties": {} }, "time": { "type": "object", "properties": { "effectiveFrom": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 }, "effectiveUntil": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 } }, "additionalProperties": {} }, "users": { "type": "array", "items": { "oneOf": [{ "type": "object", "properties": { "kind": { "type": "string", "const": "user" }, "userId": { "type": "string", "minLength": 1 } }, "required": ["kind", "userId"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "role" }, "role": { "type": "string", "enum": ["owner", "admin", "member"] } }, "required": ["kind", "role"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "agent" }, "agent": { "type": "string", "enum": ["claude_code", "codex", "cursor", "hermes"] } }, "required": ["kind", "agent"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "credential" }, "credential": { "type": "string", "enum": ["workos_jwt", "workos_api_key", "service_token"] } }, "required": ["kind", "credential"], "additionalProperties": false }] } } }, "required": ["location", "time", "users"], "additionalProperties": {} }, "scopeWarnings": { "type": "array", "items": { "type": "string" } } }, "required": ["decisionId", "shortId", "createdAt"], "additionalProperties": {} };
 function validate28(data, { instancePath = "", parentData, parentDataProperty, rootData = data, dynamicAnchors = {} } = {}) {
   ;
   let vErrors = null;
@@ -12324,7 +12774,7 @@ function validate28(data, { instancePath = "", parentData, parentDataProperty, r
                                                   }
                                                   errors++;
                                                 }
-                                                if (!(data22 === "claude_code" || data22 === "codex" || data22 === "hermes")) {
+                                                if (!(data22 === "claude_code" || data22 === "codex" || data22 === "cursor" || data22 === "hermes")) {
                                                   const err19 = { instancePath: instancePath + "/scope/users/" + i3 + "/agent", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/DecisionCreateResponse/properties/scope/properties/users/items/oneOf/2/properties/agent/enum", keyword: "enum", params: { allowedValues: schema47.properties.scope.properties.users.items.oneOf[2].properties.agent.enum }, message: "must be equal to one of the allowed values" };
                                                   if (vErrors === null) {
                                                     vErrors = [err19];
@@ -12556,7 +13006,7 @@ function validate28(data, { instancePath = "", parentData, parentDataProperty, r
   return errors === 0;
 }
 validate28.evaluated = { "props": true, "dynamicProps": false, "dynamicItems": false };
-var schema49 = { "type": "object", "properties": { "decision": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "shortId": { "type": "string" }, "intent": { "type": "string" }, "intentKind": { "type": "string", "enum": ["change", "exploration", "task_execution", "unclear"] }, "rationale": { "type": "string" }, "decided": { "type": "array", "items": { "type": "string" } }, "alternatives": { "type": "array", "items": { "type": "string" } }, "area": { "type": "string" }, "producerKind": { "type": "string" }, "stage": { "type": "string", "enum": ["draft", "provisional", "adopted", "superseded", "abandoned"] }, "status": { "type": "string", "enum": ["active", "superseded", "under_review"] }, "supersededBy": { "anyOf": [{ "type": "string", "minLength": 1 }, { "type": "null" }] }, "confidence": { "type": "string", "enum": ["high", "medium", "low"] }, "reversibility": { "type": "string", "enum": ["high", "low"] }, "confirmed": { "type": "boolean" }, "respondedAt": { "type": "number" }, "fanOut": { "type": "number" }, "classifiedAt": { "type": "number" }, "authorName": { "type": "string" } }, "required": ["id", "intent", "intentKind", "alternatives", "stage", "status", "supersededBy", "confidence", "classifiedAt", "authorName"], "additionalProperties": {} }, "files": { "type": "array", "items": { "type": "string" } }, "flags": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "enum": ["file_edit", "supersession", "invalidation", "confirmation_request"] }, "file": { "type": "string" }, "flaggedAt": { "type": "number" }, "acknowledgedAt": { "type": "number" }, "gateVerdict": { "type": "string" }, "reason": { "type": "string" } }, "required": ["type", "flaggedAt"], "additionalProperties": {} } }, "dependsOn": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "shortId": { "type": "string" }, "intent": { "type": "string" }, "area": { "type": "string" }, "authorName": { "type": "string" }, "classifiedAt": { "type": "number" }, "status": { "type": "string", "enum": ["active", "superseded", "under_review"] } }, "required": ["id", "intent", "authorName", "classifiedAt", "status"], "additionalProperties": {} } }, "dependents": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "shortId": { "type": "string" }, "intent": { "type": "string" }, "area": { "type": "string" }, "authorName": { "type": "string" }, "classifiedAt": { "type": "number" }, "status": { "type": "string", "enum": ["active", "superseded", "under_review"] } }, "required": ["id", "intent", "authorName", "classifiedAt", "status"], "additionalProperties": {} } }, "scope": { "type": "object", "properties": { "location": { "type": "object", "properties": { "repository": { "type": "boolean" }, "directories": { "type": "array", "items": { "type": "string" } }, "globs": { "type": "array", "items": { "type": "string" } }, "branches": { "type": "array", "items": { "type": "string" } } }, "required": ["repository", "directories", "globs", "branches"], "additionalProperties": {} }, "time": { "type": "object", "properties": { "effectiveFrom": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 }, "effectiveUntil": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 } }, "additionalProperties": {} }, "users": { "type": "array", "items": { "oneOf": [{ "type": "object", "properties": { "kind": { "type": "string", "const": "user" }, "userId": { "type": "string", "minLength": 1 }, "displayName": { "type": "string" } }, "required": ["kind", "userId", "displayName"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "role" }, "role": { "type": "string", "enum": ["owner", "admin", "member"] } }, "required": ["kind", "role"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "agent" }, "agent": { "type": "string", "enum": ["claude_code", "codex", "hermes"] } }, "required": ["kind", "agent"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "credential" }, "credential": { "type": "string", "enum": ["workos_jwt", "workos_api_key", "service_token"] } }, "required": ["kind", "credential"], "additionalProperties": false }] } } }, "required": ["location", "time", "users"], "additionalProperties": {} }, "truncated": { "type": "boolean" } }, "required": ["decision", "files", "flags", "dependsOn", "dependents", "scope", "truncated"], "additionalProperties": {} };
+var schema49 = { "type": "object", "properties": { "decision": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "shortId": { "type": "string" }, "intent": { "type": "string" }, "intentKind": { "type": "string", "enum": ["change", "exploration", "task_execution", "unclear"] }, "rationale": { "type": "string" }, "decided": { "type": "array", "items": { "type": "string" } }, "alternatives": { "type": "array", "items": { "type": "string" } }, "area": { "type": "string" }, "producerKind": { "type": "string" }, "stage": { "type": "string", "enum": ["draft", "provisional", "adopted", "superseded", "abandoned"] }, "status": { "type": "string", "enum": ["active", "superseded", "under_review"] }, "supersededBy": { "anyOf": [{ "type": "string", "minLength": 1 }, { "type": "null" }] }, "confidence": { "type": "string", "enum": ["high", "medium", "low"] }, "reversibility": { "type": "string", "enum": ["high", "low"] }, "confirmed": { "type": "boolean" }, "respondedAt": { "type": "number" }, "fanOut": { "type": "number" }, "classifiedAt": { "type": "number" }, "authorName": { "type": "string" } }, "required": ["id", "intent", "intentKind", "alternatives", "stage", "status", "supersededBy", "confidence", "classifiedAt", "authorName"], "additionalProperties": {} }, "files": { "type": "array", "items": { "type": "string" } }, "flags": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "enum": ["file_edit", "supersession", "invalidation", "confirmation_request"] }, "file": { "type": "string" }, "flaggedAt": { "type": "number" }, "acknowledgedAt": { "type": "number" }, "gateVerdict": { "type": "string" }, "reason": { "type": "string" } }, "required": ["type", "flaggedAt"], "additionalProperties": {} } }, "dependsOn": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "shortId": { "type": "string" }, "intent": { "type": "string" }, "area": { "type": "string" }, "authorName": { "type": "string" }, "classifiedAt": { "type": "number" }, "status": { "type": "string", "enum": ["active", "superseded", "under_review"] } }, "required": ["id", "intent", "authorName", "classifiedAt", "status"], "additionalProperties": {} } }, "dependents": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "minLength": 1 }, "shortId": { "type": "string" }, "intent": { "type": "string" }, "area": { "type": "string" }, "authorName": { "type": "string" }, "classifiedAt": { "type": "number" }, "status": { "type": "string", "enum": ["active", "superseded", "under_review"] } }, "required": ["id", "intent", "authorName", "classifiedAt", "status"], "additionalProperties": {} } }, "scope": { "type": "object", "properties": { "location": { "type": "object", "properties": { "repository": { "type": "boolean" }, "directories": { "type": "array", "items": { "type": "string" } }, "globs": { "type": "array", "items": { "type": "string" } }, "branches": { "type": "array", "items": { "type": "string" } } }, "required": ["repository", "directories", "globs", "branches"], "additionalProperties": {} }, "time": { "type": "object", "properties": { "effectiveFrom": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 }, "effectiveUntil": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 } }, "additionalProperties": {} }, "users": { "type": "array", "items": { "oneOf": [{ "type": "object", "properties": { "kind": { "type": "string", "const": "user" }, "userId": { "type": "string", "minLength": 1 }, "displayName": { "type": "string" } }, "required": ["kind", "userId", "displayName"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "role" }, "role": { "type": "string", "enum": ["owner", "admin", "member"] } }, "required": ["kind", "role"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "agent" }, "agent": { "type": "string", "enum": ["claude_code", "codex", "cursor", "hermes"] } }, "required": ["kind", "agent"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "credential" }, "credential": { "type": "string", "enum": ["workos_jwt", "workos_api_key", "service_token"] } }, "required": ["kind", "credential"], "additionalProperties": false }] } } }, "required": ["location", "time", "users"], "additionalProperties": {} }, "truncated": { "type": "boolean" } }, "required": ["decision", "files", "flags", "dependsOn", "dependents", "scope", "truncated"], "additionalProperties": {} };
 function validate29(data, { instancePath = "", parentData, parentDataProperty, rootData = data, dynamicAnchors = {} } = {}) {
   ;
   let vErrors = null;
@@ -13850,7 +14300,7 @@ function validate29(data, { instancePath = "", parentData, parentDataProperty, r
                                                       }
                                                       errors++;
                                                     }
-                                                    if (!(data70 === "claude_code" || data70 === "codex" || data70 === "hermes")) {
+                                                    if (!(data70 === "claude_code" || data70 === "codex" || data70 === "cursor" || data70 === "hermes")) {
                                                       const err24 = { instancePath: instancePath + "/scope/users/" + i9 + "/agent", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/DecisionDetailResponse/properties/scope/properties/users/items/oneOf/2/properties/agent/enum", keyword: "enum", params: { allowedValues: schema49.properties.scope.properties.users.items.oneOf[2].properties.agent.enum }, message: "must be equal to one of the allowed values" };
                                                       if (vErrors === null) {
                                                         vErrors = [err24];
@@ -14411,7 +14861,7 @@ function validate33(data, { instancePath = "", parentData, parentDataProperty, r
   return errors === 0;
 }
 validate33.evaluated = { "props": true, "dynamicProps": false, "dynamicItems": false };
-var schema59 = { "type": "object", "properties": { "id": { "type": "string" }, "location": { "anyOf": [{ "default": {}, "type": "object", "properties": { "repository": { "type": "boolean" }, "directories": { "type": "array", "items": { "type": "string" } }, "globs": { "type": "array", "items": { "type": "string" } }, "branches": { "type": "array", "items": { "type": "string" } } }, "additionalProperties": {} }, { "type": "null" }] }, "time": { "anyOf": [{ "default": {}, "type": "object", "properties": { "effectiveFrom": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 }, "effectiveUntil": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 } }, "additionalProperties": {} }, { "type": "null" }] }, "users": { "anyOf": [{ "type": "array", "items": { "oneOf": [{ "type": "object", "properties": { "kind": { "type": "string", "const": "user" }, "userId": { "type": "string", "minLength": 1 } }, "required": ["kind", "userId"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "role" }, "role": { "type": "string", "enum": ["owner", "admin", "member"] } }, "required": ["kind", "role"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "agent" }, "agent": { "type": "string", "enum": ["claude_code", "codex", "hermes"] } }, "required": ["kind", "agent"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "credential" }, "credential": { "type": "string", "enum": ["workos_jwt", "workos_api_key", "service_token"] } }, "required": ["kind", "credential"], "additionalProperties": false }] } }, { "type": "null" }] } }, "required": ["id"], "additionalProperties": {} };
+var schema59 = { "type": "object", "properties": { "id": { "type": "string" }, "location": { "anyOf": [{ "default": {}, "type": "object", "properties": { "repository": { "type": "boolean" }, "directories": { "type": "array", "items": { "type": "string" } }, "globs": { "type": "array", "items": { "type": "string" } }, "branches": { "type": "array", "items": { "type": "string" } } }, "additionalProperties": {} }, { "type": "null" }] }, "time": { "anyOf": [{ "default": {}, "type": "object", "properties": { "effectiveFrom": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 }, "effectiveUntil": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 } }, "additionalProperties": {} }, { "type": "null" }] }, "users": { "anyOf": [{ "type": "array", "items": { "oneOf": [{ "type": "object", "properties": { "kind": { "type": "string", "const": "user" }, "userId": { "type": "string", "minLength": 1 } }, "required": ["kind", "userId"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "role" }, "role": { "type": "string", "enum": ["owner", "admin", "member"] } }, "required": ["kind", "role"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "agent" }, "agent": { "type": "string", "enum": ["claude_code", "codex", "cursor", "hermes"] } }, "required": ["kind", "agent"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "credential" }, "credential": { "type": "string", "enum": ["workos_jwt", "workos_api_key", "service_token"] } }, "required": ["kind", "credential"], "additionalProperties": false }] } }, { "type": "null" }] } }, "required": ["id"], "additionalProperties": {} };
 function validate34(data, { instancePath = "", parentData, parentDataProperty, rootData = data, dynamicAnchors = {} } = {}) {
   ;
   let vErrors = null;
@@ -15052,7 +15502,7 @@ function validate34(data, { instancePath = "", parentData, parentDataProperty, r
                                       }
                                       errors++;
                                     }
-                                    if (!(data19 === "claude_code" || data19 === "codex" || data19 === "hermes")) {
+                                    if (!(data19 === "claude_code" || data19 === "codex" || data19 === "cursor" || data19 === "hermes")) {
                                       const err38 = { instancePath: instancePath + "/users/" + i3 + "/agent", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/DecisionRescopeRequest/properties/users/anyOf/0/items/oneOf/2/properties/agent/enum", keyword: "enum", params: { allowedValues: schema59.properties.users.anyOf[0].items.oneOf[2].properties.agent.enum }, message: "must be equal to one of the allowed values" };
                                       if (vErrors === null) {
                                         vErrors = [err38];
@@ -15280,7 +15730,7 @@ function validate34(data, { instancePath = "", parentData, parentDataProperty, r
   return errors === 0;
 }
 validate34.evaluated = { "props": true, "dynamicProps": false, "dynamicItems": false };
-var schema61 = { "anyOf": [{ "type": "object", "properties": { "outcome": { "type": "string", "const": "no_op" }, "stage": { "type": "string", "enum": ["draft", "provisional", "adopted", "superseded", "abandoned"] }, "scope": { "type": "object", "properties": { "location": { "type": "object", "properties": { "repository": { "type": "boolean" }, "directories": { "type": "array", "items": { "type": "string" } }, "globs": { "type": "array", "items": { "type": "string" } }, "branches": { "type": "array", "items": { "type": "string" } } }, "required": ["repository", "directories", "globs", "branches"], "additionalProperties": {} }, "time": { "type": "object", "properties": { "effectiveFrom": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 }, "effectiveUntil": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 } }, "additionalProperties": {} }, "users": { "type": "array", "items": { "oneOf": [{ "type": "object", "properties": { "kind": { "type": "string", "const": "user" }, "userId": { "type": "string", "minLength": 1 } }, "required": ["kind", "userId"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "role" }, "role": { "type": "string", "enum": ["owner", "admin", "member"] } }, "required": ["kind", "role"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "agent" }, "agent": { "type": "string", "enum": ["claude_code", "codex", "hermes"] } }, "required": ["kind", "agent"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "credential" }, "credential": { "type": "string", "enum": ["workos_jwt", "workos_api_key", "service_token"] } }, "required": ["kind", "credential"], "additionalProperties": false }] } } }, "required": ["location", "time", "users"], "additionalProperties": {} }, "scopeWarnings": { "type": "array", "items": { "type": "string" } } }, "required": ["outcome", "stage", "scope"], "additionalProperties": {} }, { "type": "object", "properties": { "outcome": { "type": "string", "const": "ok" }, "decisionId": { "type": "string", "minLength": 1 }, "shortId": { "type": "string" }, "stage": { "type": "string", "enum": ["draft", "provisional", "adopted", "superseded", "abandoned"] }, "scope": { "type": "object", "properties": { "location": { "type": "object", "properties": { "repository": { "type": "boolean" }, "directories": { "type": "array", "items": { "type": "string" } }, "globs": { "type": "array", "items": { "type": "string" } }, "branches": { "type": "array", "items": { "type": "string" } } }, "required": ["repository", "directories", "globs", "branches"], "additionalProperties": {} }, "time": { "type": "object", "properties": { "effectiveFrom": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 }, "effectiveUntil": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 } }, "additionalProperties": {} }, "users": { "type": "array", "items": { "oneOf": [{ "type": "object", "properties": { "kind": { "type": "string", "const": "user" }, "userId": { "type": "string", "minLength": 1 } }, "required": ["kind", "userId"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "role" }, "role": { "type": "string", "enum": ["owner", "admin", "member"] } }, "required": ["kind", "role"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "agent" }, "agent": { "type": "string", "enum": ["claude_code", "codex", "hermes"] } }, "required": ["kind", "agent"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "credential" }, "credential": { "type": "string", "enum": ["workos_jwt", "workos_api_key", "service_token"] } }, "required": ["kind", "credential"], "additionalProperties": false }] } } }, "required": ["location", "time", "users"], "additionalProperties": {} }, "scopeWarnings": { "type": "array", "items": { "type": "string" } } }, "required": ["outcome", "decisionId", "stage", "scope"], "additionalProperties": {} }] };
+var schema61 = { "anyOf": [{ "type": "object", "properties": { "outcome": { "type": "string", "const": "no_op" }, "stage": { "type": "string", "enum": ["draft", "provisional", "adopted", "superseded", "abandoned"] }, "scope": { "type": "object", "properties": { "location": { "type": "object", "properties": { "repository": { "type": "boolean" }, "directories": { "type": "array", "items": { "type": "string" } }, "globs": { "type": "array", "items": { "type": "string" } }, "branches": { "type": "array", "items": { "type": "string" } } }, "required": ["repository", "directories", "globs", "branches"], "additionalProperties": {} }, "time": { "type": "object", "properties": { "effectiveFrom": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 }, "effectiveUntil": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 } }, "additionalProperties": {} }, "users": { "type": "array", "items": { "oneOf": [{ "type": "object", "properties": { "kind": { "type": "string", "const": "user" }, "userId": { "type": "string", "minLength": 1 } }, "required": ["kind", "userId"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "role" }, "role": { "type": "string", "enum": ["owner", "admin", "member"] } }, "required": ["kind", "role"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "agent" }, "agent": { "type": "string", "enum": ["claude_code", "codex", "cursor", "hermes"] } }, "required": ["kind", "agent"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "credential" }, "credential": { "type": "string", "enum": ["workos_jwt", "workos_api_key", "service_token"] } }, "required": ["kind", "credential"], "additionalProperties": false }] } } }, "required": ["location", "time", "users"], "additionalProperties": {} }, "scopeWarnings": { "type": "array", "items": { "type": "string" } } }, "required": ["outcome", "stage", "scope"], "additionalProperties": {} }, { "type": "object", "properties": { "outcome": { "type": "string", "const": "ok" }, "decisionId": { "type": "string", "minLength": 1 }, "shortId": { "type": "string" }, "stage": { "type": "string", "enum": ["draft", "provisional", "adopted", "superseded", "abandoned"] }, "scope": { "type": "object", "properties": { "location": { "type": "object", "properties": { "repository": { "type": "boolean" }, "directories": { "type": "array", "items": { "type": "string" } }, "globs": { "type": "array", "items": { "type": "string" } }, "branches": { "type": "array", "items": { "type": "string" } } }, "required": ["repository", "directories", "globs", "branches"], "additionalProperties": {} }, "time": { "type": "object", "properties": { "effectiveFrom": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 }, "effectiveUntil": { "type": "integer", "minimum": -9007199254740991, "maximum": 9007199254740991 } }, "additionalProperties": {} }, "users": { "type": "array", "items": { "oneOf": [{ "type": "object", "properties": { "kind": { "type": "string", "const": "user" }, "userId": { "type": "string", "minLength": 1 } }, "required": ["kind", "userId"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "role" }, "role": { "type": "string", "enum": ["owner", "admin", "member"] } }, "required": ["kind", "role"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "agent" }, "agent": { "type": "string", "enum": ["claude_code", "codex", "cursor", "hermes"] } }, "required": ["kind", "agent"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "credential" }, "credential": { "type": "string", "enum": ["workos_jwt", "workos_api_key", "service_token"] } }, "required": ["kind", "credential"], "additionalProperties": false }] } } }, "required": ["location", "time", "users"], "additionalProperties": {} }, "scopeWarnings": { "type": "array", "items": { "type": "string" } } }, "required": ["outcome", "decisionId", "stage", "scope"], "additionalProperties": {} }] };
 function validate35(data, { instancePath = "", parentData, parentDataProperty, rootData = data, dynamicAnchors = {} } = {}) {
   ;
   let vErrors = null;
@@ -15918,7 +16368,7 @@ function validate35(data, { instancePath = "", parentData, parentDataProperty, r
                                                 }
                                                 errors++;
                                               }
-                                              if (!(data21 === "claude_code" || data21 === "codex" || data21 === "hermes")) {
+                                              if (!(data21 === "claude_code" || data21 === "codex" || data21 === "cursor" || data21 === "hermes")) {
                                                 const err41 = { instancePath: instancePath + "/scope/users/" + i3 + "/agent", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/DecisionRescopeResponse/anyOf/0/properties/scope/properties/users/items/oneOf/2/properties/agent/enum", keyword: "enum", params: { allowedValues: schema61.anyOf[0].properties.scope.properties.users.items.oneOf[2].properties.agent.enum }, message: "must be equal to one of the allowed values" };
                                                 if (vErrors === null) {
                                                   vErrors = [err41];
@@ -16842,7 +17292,7 @@ function validate35(data, { instancePath = "", parentData, parentDataProperty, r
                                                     }
                                                     errors++;
                                                   }
-                                                  if (!(data49 === "claude_code" || data49 === "codex" || data49 === "hermes")) {
+                                                  if (!(data49 === "claude_code" || data49 === "codex" || data49 === "cursor" || data49 === "hermes")) {
                                                     const err100 = { instancePath: instancePath + "/scope/users/" + i8 + "/agent", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/DecisionRescopeResponse/anyOf/1/properties/scope/properties/users/items/oneOf/2/properties/agent/enum", keyword: "enum", params: { allowedValues: schema61.anyOf[1].properties.scope.properties.users.items.oneOf[2].properties.agent.enum }, message: "must be equal to one of the allowed values" };
                                                     if (vErrors === null) {
                                                       vErrors = [err100];
@@ -22488,7 +22938,7 @@ function validate50(data, { instancePath = "", parentData, parentDataProperty, r
   return errors === 0;
 }
 validate50.evaluated = { "dynamicProps": true, "dynamicItems": false };
-var schema93 = { "type": "object", "properties": { "batch": { "type": "array", "items": { "anyOf": [{ "type": "object", "properties": { "moveId": { "type": "string" }, "capturedAt": { "type": "number" }, "sessionId": { "type": "string" }, "invocationId": { "type": "string" }, "eventType": { "type": "string" }, "payload": {}, "env": {}, "capturedOrganizationId": { "type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[A-Za-z0-9_-]+$" }, "captureAuthorityKind": { "type": "string", "enum": ["workos", "service_token"] }, "decisionLifecycleProtocolVersion": { "type": "integer", "minimum": 1, "maximum": 9007199254740991 }, "producer": { "type": "string", "enum": ["claude_code", "codex", "hermes"] }, "toolOutcome": { "type": "string", "enum": ["succeeded", "returned", "failed", "interrupted", "prevented", "unknown"] }, "envelopeVersion": { "type": "number", "const": 4 } }, "required": ["moveId", "capturedAt", "sessionId", "eventType", "capturedOrganizationId", "captureAuthorityKind", "decisionLifecycleProtocolVersion", "envelopeVersion"], "additionalProperties": {} }, { "type": "object", "properties": { "moveId": { "type": "string" }, "capturedAt": { "type": "number" }, "sessionId": { "type": "string" }, "invocationId": { "type": "string" }, "eventType": { "type": "string" }, "payload": {}, "env": {}, "capturedOrganizationId": { "type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[A-Za-z0-9_-]+$" }, "captureAuthorityKind": { "type": "string", "enum": ["workos", "service_token"] }, "decisionLifecycleProtocolVersion": { "type": "integer", "minimum": 1, "maximum": 9007199254740991 }, "producer": { "type": "string", "enum": ["claude_code", "codex", "hermes"] }, "toolOutcome": { "type": "string", "enum": ["succeeded", "returned", "failed", "interrupted", "prevented", "unknown"] }, "envelopeVersion": { "type": "number", "exclusiveMaximum": 4 } }, "required": ["moveId", "capturedAt", "sessionId", "eventType"], "additionalProperties": {} }] } } }, "required": ["batch"], "additionalProperties": {} };
+var schema93 = { "type": "object", "properties": { "batch": { "type": "array", "items": { "anyOf": [{ "type": "object", "properties": { "moveId": { "type": "string" }, "capturedAt": { "type": "number" }, "sessionId": { "type": "string" }, "invocationId": { "type": "string" }, "eventType": { "type": "string" }, "payload": {}, "env": {}, "capturedOrganizationId": { "type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[A-Za-z0-9_-]+$" }, "captureAuthorityKind": { "type": "string", "enum": ["workos", "service_token"] }, "decisionLifecycleProtocolVersion": { "type": "integer", "minimum": 1, "maximum": 9007199254740991 }, "producer": { "type": "string", "enum": ["claude_code", "codex", "cursor", "hermes"] }, "toolOutcome": { "type": "string", "enum": ["succeeded", "returned", "failed", "interrupted", "prevented", "unknown"] }, "envelopeVersion": { "type": "number", "const": 4 } }, "required": ["moveId", "capturedAt", "sessionId", "eventType", "capturedOrganizationId", "captureAuthorityKind", "decisionLifecycleProtocolVersion", "envelopeVersion"], "additionalProperties": {} }, { "type": "object", "properties": { "moveId": { "type": "string" }, "capturedAt": { "type": "number" }, "sessionId": { "type": "string" }, "invocationId": { "type": "string" }, "eventType": { "type": "string" }, "payload": {}, "env": {}, "capturedOrganizationId": { "type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[A-Za-z0-9_-]+$" }, "captureAuthorityKind": { "type": "string", "enum": ["workos", "service_token"] }, "decisionLifecycleProtocolVersion": { "type": "integer", "minimum": 1, "maximum": 9007199254740991 }, "producer": { "type": "string", "enum": ["claude_code", "codex", "cursor", "hermes"] }, "toolOutcome": { "type": "string", "enum": ["succeeded", "returned", "failed", "interrupted", "prevented", "unknown"] }, "envelopeVersion": { "type": "number", "exclusiveMaximum": 4 } }, "required": ["moveId", "capturedAt", "sessionId", "eventType"], "additionalProperties": {} }] } } }, "required": ["batch"], "additionalProperties": {} };
 var pattern8 = new RegExp("^[A-Za-z0-9_-]+$", "u");
 function validate51(data, { instancePath = "", parentData, parentDataProperty, rootData = data, dynamicAnchors = {} } = {}) {
   ;
@@ -22742,7 +23192,7 @@ function validate51(data, { instancePath = "", parentData, parentDataProperty, r
                                           }
                                           errors++;
                                         }
-                                        if (!(data10 === "claude_code" || data10 === "codex" || data10 === "hermes")) {
+                                        if (!(data10 === "claude_code" || data10 === "codex" || data10 === "cursor" || data10 === "hermes")) {
                                           const err16 = { instancePath: instancePath + "/batch/" + i0 + "/producer", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/0/properties/producer/enum", keyword: "enum", params: { allowedValues: schema93.properties.batch.items.anyOf[0].properties.producer.enum }, message: "must be equal to one of the allowed values" };
                                           if (vErrors === null) {
                                             vErrors = [err16];
@@ -23054,7 +23504,7 @@ function validate51(data, { instancePath = "", parentData, parentDataProperty, r
                                           }
                                           errors++;
                                         }
-                                        if (!(data21 === "claude_code" || data21 === "codex" || data21 === "hermes")) {
+                                        if (!(data21 === "claude_code" || data21 === "codex" || data21 === "cursor" || data21 === "hermes")) {
                                           const err38 = { instancePath: instancePath + "/batch/" + i0 + "/producer", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/MoveIngestRequest/properties/batch/items/anyOf/1/properties/producer/enum", keyword: "enum", params: { allowedValues: schema93.properties.batch.items.anyOf[1].properties.producer.enum }, message: "must be equal to one of the allowed values" };
                                           if (vErrors === null) {
                                             vErrors = [err38];
@@ -23191,7 +23641,7 @@ function validate51(data, { instancePath = "", parentData, parentDataProperty, r
   return errors === 0;
 }
 validate51.evaluated = { "props": true, "dynamicProps": false, "dynamicItems": false };
-var schema95 = { "type": "object", "properties": { "protocolVersion": { "type": "number", "const": 3 }, "agent": { "type": "string", "enum": ["claude_code", "codex", "hermes"] }, "sessionId": { "type": "string", "pattern": "^[A-Za-z0-9._:-]{1,128}$" }, "invocationId": { "type": "string", "pattern": "^[A-Za-z0-9._:-]{1,128}$" }, "repoSyncId": { "type": "string", "pattern": "^[A-Za-z0-9]{1,64}$" }, "paths": { "maxItems": 32, "type": "array", "items": { "type": "string" } }, "coverage": { "type": "string", "enum": ["complete", "unverified"] }, "branch": { "type": "string", "maxLength": 255, "pattern": "^(?!@?$)(?!\\/)(?!.*\\/$)(?!.*\\/\\/)(?!.*(?:^|\\/)\\.{1,2}(?:\\/|$))(?!.*(?:^|\\/)[^/]*\\.lock(?:\\/|$))(?!.*\\.\\.)(?!.*@\\{)(?!.*[~^:?*\\\\]).+$" }, "clientMode": { "type": "string", "enum": ["block", "warn"] }, "clientVersion": { "type": "string", "maxLength": 32, "pattern": "^[A-Za-z0-9][A-Za-z0-9._+-]*$" }, "proposal": { "type": "string" } }, "required": ["protocolVersion", "agent", "sessionId", "invocationId", "repoSyncId", "paths", "coverage", "proposal"], "additionalProperties": false, "x-primitive-runtime-refinements": ["canonical_repository_paths", "unique_repository_paths", "complete_coverage_requires_path", "proposal_utf8_max_6144", "degrade_invalid_rollout_fields", "degrade_invalid_branch"] };
+var schema95 = { "type": "object", "properties": { "protocolVersion": { "type": "number", "const": 3 }, "agent": { "type": "string", "enum": ["claude_code", "codex", "cursor", "hermes"] }, "sessionId": { "type": "string", "pattern": "^[A-Za-z0-9._:-]{1,128}$" }, "invocationId": { "type": "string", "pattern": "^[A-Za-z0-9._:-]{1,128}$" }, "repoSyncId": { "type": "string", "pattern": "^[A-Za-z0-9]{1,64}$" }, "paths": { "maxItems": 32, "type": "array", "items": { "type": "string" } }, "coverage": { "type": "string", "enum": ["complete", "unverified"] }, "branch": { "type": "string", "maxLength": 255, "pattern": "^(?!@?$)(?!\\/)(?!.*\\/$)(?!.*\\/\\/)(?!.*(?:^|\\/)\\.{1,2}(?:\\/|$))(?!.*(?:^|\\/)[^/]*\\.lock(?:\\/|$))(?!.*\\.\\.)(?!.*@\\{)(?!.*[~^:?*\\\\]).+$" }, "clientMode": { "type": "string", "enum": ["block", "warn"] }, "clientVersion": { "type": "string", "maxLength": 32, "pattern": "^[A-Za-z0-9][A-Za-z0-9._+-]*$" }, "proposal": { "type": "string" } }, "required": ["protocolVersion", "agent", "sessionId", "invocationId", "repoSyncId", "paths", "coverage", "proposal"], "additionalProperties": false, "x-primitive-runtime-refinements": ["canonical_repository_paths", "unique_repository_paths", "complete_coverage_requires_path", "proposal_utf8_max_6144", "degrade_invalid_rollout_fields", "degrade_invalid_branch"] };
 var pattern10 = new RegExp("^[A-Za-z0-9._:-]{1,128}$", "u");
 var pattern12 = new RegExp("^[A-Za-z0-9]{1,64}$", "u");
 var pattern13 = new RegExp("^(?!@?$)(?!\\/)(?!.*\\/$)(?!.*\\/\\/)(?!.*(?:^|\\/)\\.{1,2}(?:\\/|$))(?!.*(?:^|\\/)[^/]*\\.lock(?:\\/|$))(?!.*\\.\\.)(?!.*@\\{)(?!.*[~^:?*\\\\]).+$", "u");
@@ -23247,7 +23697,7 @@ function validate52(data, { instancePath = "", parentData, parentDataProperty, r
                 validate52.errors = [{ instancePath: instancePath + "/agent", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/PreflightRequestV3/properties/agent/type", keyword: "type", params: { type: "string" }, message: "must be string" }];
                 return false;
               }
-              if (!(data1 === "claude_code" || data1 === "codex" || data1 === "hermes")) {
+              if (!(data1 === "claude_code" || data1 === "codex" || data1 === "cursor" || data1 === "hermes")) {
                 validate52.errors = [{ instancePath: instancePath + "/agent", schemaPath: "https://api.getprimitive.ai/contracts/cli-http-v1.schema.json#/$defs/PreflightRequestV3/properties/agent/enum", keyword: "enum", params: { allowedValues: schema95.properties.agent.enum }, message: "must be equal to one of the allowed values" }];
                 return false;
               }
@@ -26539,7 +26989,7 @@ function optionalUserScopeMembers(record) {
       members.push({ kind: "role", role: candidate.role });
       continue;
     }
-    if (candidate.kind === "agent" && (candidate.agent === "claude_code" || candidate.agent === "codex" || candidate.agent === "hermes")) {
+    if (candidate.kind === "agent" && (candidate.agent === "claude_code" || candidate.agent === "codex" || candidate.agent === "cursor" || candidate.agent === "hermes")) {
       members.push({ kind: "agent", agent: candidate.agent });
       continue;
     }
@@ -26629,22 +27079,22 @@ async function fetchAndCacheCollectScope(cwd, dependencies = defaultDependencies
 
 // src/lib/post-commit-hook.ts
 import { execFileSync as execFileSync3 } from "child_process";
-import { createHash as createHash6, randomUUID as randomUUID2 } from "crypto";
+import { createHash as createHash8, randomUUID as randomUUID2 } from "crypto";
 import {
-  constants as constants4,
+  constants as constants5,
   closeSync as closeSync4,
-  existsSync as existsSync7,
+  existsSync as existsSync10,
   fchmodSync as fchmodSync2,
   fsyncSync as fsyncSync2,
-  lstatSync as lstatSync4,
-  mkdirSync as mkdirSync6,
+  lstatSync as lstatSync5,
+  mkdirSync as mkdirSync7,
   openSync as openSync4,
-  readFileSync as readFileSync8,
-  renameSync as renameSync2,
-  unlinkSync,
-  writeFileSync as writeFileSync3
+  readFileSync as readFileSync11,
+  renameSync as renameSync3,
+  unlinkSync as unlinkSync2,
+  writeFileSync as writeFileSync4
 } from "fs";
-import { basename as basename2, dirname as dirname8, isAbsolute as isAbsolute5, resolve as resolve5 } from "path";
+import { basename as basename2, dirname as dirname10, isAbsolute as isAbsolute7, resolve as resolve6 } from "path";
 var PRIM_POST_COMMIT_BLOCK_START = "# >>> prim post-commit hook >>>";
 var PRIM_POST_COMMIT_BLOCK_END = "# <<< prim post-commit hook <<<";
 var PRIM_CREATED_MARK = "prim-created-post-commit-hook";
@@ -26790,7 +27240,7 @@ var SHELL_QUOTED_RE = /^'(?:[^']|'"'"')*'$/u;
 function decodePinnedPath(token) {
   if (!token || !SHELL_QUOTED_RE.test(token)) return void 0;
   const value = token.slice(1, -1).replaceAll(`'"'"'`, "'");
-  if (!isAbsolute5(value) || value.includes("\0") || value.includes("\n") || value.includes("\r")) {
+  if (!isAbsolute7(value) || value.includes("\0") || value.includes("\n") || value.includes("\r")) {
     return void 0;
   }
   return value;
@@ -26835,7 +27285,7 @@ function safeGitPath(root, value) {
   if (value.length === 0 || value !== value.trim() || value.includes("\0") || value.includes("\n") || value.includes("\r")) {
     throw new Error("Git returned an unsafe hooks path");
   }
-  return isAbsolute5(value) ? resolve5(value) : resolve5(root, value);
+  return isAbsolute7(value) ? resolve6(value) : resolve6(root, value);
 }
 function resolveEffectiveManagedHook(spec, cwd = process.cwd()) {
   const gitRoot = gitToplevel(cwd);
@@ -26847,19 +27297,19 @@ function resolveEffectiveManagedHook(spec, cwd = process.cwd()) {
     timeout: GIT_TIMEOUT_MS3
   }).replace(/\r?\n$/u, "");
   const hooksDir = safeGitPath(gitRoot, value);
-  if (basename2(hooksDir) === "_" && basename2(dirname8(hooksDir)) === ".husky") {
+  if (basename2(hooksDir) === "_" && basename2(dirname10(hooksDir)) === ".husky") {
     return {
       gitRoot,
       hooksDir,
-      hookPath: resolve5(dirname8(hooksDir), spec.hookName),
+      hookPath: resolve6(dirname10(hooksDir), spec.hookName),
       kind: "husky_v9",
-      dispatcherPath: resolve5(hooksDir, spec.hookName)
+      dispatcherPath: resolve6(hooksDir, spec.hookName)
     };
   }
   return {
     gitRoot,
     hooksDir,
-    hookPath: resolve5(hooksDir, spec.hookName),
+    hookPath: resolve6(hooksDir, spec.hookName),
     kind: "direct"
   };
 }
@@ -26870,8 +27320,8 @@ function resolveEffectivePostRewriteHook(cwd = process.cwd()) {
   return resolveEffectiveManagedHook(POST_REWRITE_MANAGED_HOOK, cwd);
 }
 function assertSafeFile(path, spec) {
-  if (!existsSync7(path)) return void 0;
-  const stat = lstatSync4(path);
+  if (!existsSync10(path)) return void 0;
+  const stat = lstatSync5(path);
   if (!stat.isFile() || stat.isSymbolicLink() || stat.size > MAX_HOOK_BYTES) {
     throw new Error(`unsafe ${spec.hookName} hook target: ${path}`);
   }
@@ -26892,16 +27342,16 @@ function assertUsableHuskyDispatcher(target, spec) {
   if (!HUSKY_V9_DISPATCHERS.has(normalizedDispatcher)) {
     throw new Error(`unrecognized Husky ${spec.hookName} dispatcher: ${target.dispatcherPath}`);
   }
-  const huskyRuntime = resolve5(dirname8(target.dispatcherPath), "h");
+  const huskyRuntime = resolve6(dirname10(target.dispatcherPath), "h");
   const runtimeStat = assertSafeFile(huskyRuntime, spec);
   const runtime = runtimeStat ? readHookFile(huskyRuntime) : void 0;
-  const runtimeHash = runtime ? createHash6("sha256").update(runtime).digest("hex") : void 0;
+  const runtimeHash = runtime ? createHash8("sha256").update(runtime).digest("hex") : void 0;
   if (!runtimeHash || !HUSKY_V9_RUNTIME_HASHES.has(runtimeHash)) {
     throw new Error(`unrecognized Husky v9 hook runtime: ${huskyRuntime}`);
   }
 }
 function readHookFile(path) {
-  const value = readFileSync8(path);
+  const value = readFileSync11(path);
   return Buffer.isBuffer(value) ? value : Buffer.from(value);
 }
 function decodeHookText(content, spec) {
@@ -27034,7 +27484,7 @@ function errorCode(error) {
 function assertTargetUnchanged(path, expected, spec, stat) {
   let current;
   try {
-    current = lstatSync4(path);
+    current = lstatSync5(path);
   } catch (error) {
     if (expected === void 0 && errorCode(error) === "ENOENT") return;
     throw new Error(`${spec.hookName} hook changed concurrently: ${path}`);
@@ -27047,9 +27497,9 @@ function assertTargetUnchanged(path, expected, spec, stat) {
   }
 }
 function rewriteHookAtomically(path, next, expected, spec, stat) {
-  const parent = dirname8(path);
-  mkdirSync6(parent, { recursive: true });
-  const temporary = resolve5(
+  const parent = dirname10(path);
+  mkdirSync7(parent, { recursive: true });
+  const temporary = resolve6(
     parent,
     `.${basename2(path)}.prim-${String(process.pid)}-${randomUUID2()}.tmp`
   );
@@ -27057,16 +27507,16 @@ function rewriteHookAtomically(path, next, expected, spec, stat) {
   try {
     fd = openSync4(
       temporary,
-      constants4.O_CREAT | constants4.O_EXCL | constants4.O_WRONLY | constants4.O_NOFOLLOW,
+      constants5.O_CREAT | constants5.O_EXCL | constants5.O_WRONLY | constants5.O_NOFOLLOW,
       stat?.mode ?? 493
     );
-    writeFileSync3(fd, next);
+    writeFileSync4(fd, next);
     fchmodSync2(fd, (stat?.mode ?? 493) & 4095);
     fsyncSync2(fd);
     closeSync4(fd);
     fd = void 0;
     assertTargetUnchanged(path, expected, spec, stat);
-    renameSync2(temporary, path);
+    renameSync3(temporary, path);
   } finally {
     if (fd !== void 0) {
       try {
@@ -27075,7 +27525,7 @@ function rewriteHookAtomically(path, next, expected, spec, stat) {
       }
     }
     try {
-      unlinkSync(temporary);
+      unlinkSync2(temporary);
     } catch (error) {
       if (errorCode(error) !== "ENOENT") {
       }
@@ -27172,22 +27622,22 @@ async function bindRepository(root, options) {
 import { execFileSync as execFileSync4 } from "child_process";
 import { randomUUID as randomUUID3 } from "crypto";
 import {
-  constants as constants5,
-  chmodSync as chmodSync3,
+  constants as constants6,
+  chmodSync as chmodSync4,
   closeSync as closeSync5,
   fchmodSync as fchmodSync3,
   fsyncSync as fsyncSync3,
   linkSync,
-  lstatSync as lstatSync5,
-  mkdirSync as mkdirSync7,
+  lstatSync as lstatSync6,
+  mkdirSync as mkdirSync8,
   openSync as openSync5,
-  readFileSync as readFileSync9,
-  statSync as statSync2,
-  unlinkSync as unlinkSync2,
-  writeFileSync as writeFileSync4
+  readFileSync as readFileSync12,
+  statSync as statSync3,
+  unlinkSync as unlinkSync3,
+  writeFileSync as writeFileSync5
 } from "fs";
-import { dirname as dirname9, isAbsolute as isAbsolute6, join as join12, resolve as resolve6 } from "path";
-var WORKSPACE_ID_RELATIVE_PATH = join12("prim", "workspace-id");
+import { dirname as dirname11, isAbsolute as isAbsolute8, join as join15, resolve as resolve7 } from "path";
+var WORKSPACE_ID_RELATIVE_PATH = join15("prim", "workspace-id");
 var MAX_ANCESTORS = 64;
 var MAX_GIT_FILE_BYTES = 4096;
 var MAX_ID_FILE_BYTES = 128;
@@ -27233,7 +27683,7 @@ function resolveWorkspaceIdPath(cwd) {
     }
     return {
       status: "resolved",
-      path: isAbsolute6(gitPath) ? resolve6(gitPath) : resolve6(cwd, gitPath)
+      path: isAbsolute8(gitPath) ? resolve7(gitPath) : resolve7(cwd, gitPath)
     };
   } catch (error) {
     const code = errorCode2(error);
@@ -27244,21 +27694,21 @@ function resolveWorkspaceIdPath(cwd) {
   }
 }
 function resolveFromFilesystem(cwd) {
-  let current = resolve6(cwd);
+  let current = resolve7(cwd);
   for (let depth = 0; depth < MAX_ANCESTORS; depth += 1) {
-    const dotGit = join12(current, ".git");
+    const dotGit = join15(current, ".git");
     try {
-      const stat = lstatSync5(dotGit);
+      const stat = lstatSync6(dotGit);
       if (stat.isDirectory() && isGitDirectory(dotGit)) {
-        return join12(dotGit, WORKSPACE_ID_RELATIVE_PATH);
+        return join15(dotGit, WORKSPACE_ID_RELATIVE_PATH);
       }
       if (stat.isFile() && stat.size <= MAX_GIT_FILE_BYTES) {
-        const contents = readFileSync9(dotGit, "utf8");
+        const contents = readFileSync12(dotGit, "utf8");
         const match = /^gitdir: (.+?)(?:\r?\n)?$/.exec(contents);
         if (match?.[1]) {
-          const gitDirectory = isAbsolute6(match[1]) ? resolve6(match[1]) : resolve6(current, match[1]);
+          const gitDirectory = isAbsolute8(match[1]) ? resolve7(match[1]) : resolve7(current, match[1]);
           if (isGitDirectory(gitDirectory)) {
-            return join12(gitDirectory, WORKSPACE_ID_RELATIVE_PATH);
+            return join15(gitDirectory, WORKSPACE_ID_RELATIVE_PATH);
           }
         }
       }
@@ -27269,7 +27719,7 @@ function resolveFromFilesystem(cwd) {
         return null;
       }
     }
-    const parent = dirname9(current);
+    const parent = dirname11(current);
     if (parent === current) break;
     current = parent;
   }
@@ -27277,7 +27727,7 @@ function resolveFromFilesystem(cwd) {
 }
 function isGitDirectory(path) {
   try {
-    return statSync2(join12(path, "HEAD")).isFile();
+    return statSync3(join15(path, "HEAD")).isFile();
   } catch {
     return false;
   }
@@ -27285,7 +27735,7 @@ function isGitDirectory(path) {
 function inspectPath(path) {
   let stat;
   try {
-    stat = lstatSync5(path);
+    stat = lstatSync6(path);
   } catch (error) {
     const code = errorCode2(error);
     if (code === "ENOENT" || code === "ENOTDIR") return { status: "missing", path };
@@ -27296,7 +27746,7 @@ function inspectPath(path) {
     return { status: "corrupt", path, reason: "invalid_content" };
   }
   try {
-    const contents = readFileSync9(path, "utf8");
+    const contents = readFileSync12(path, "utf8");
     const workspaceId = contents.endsWith("\n") ? contents.slice(0, -1) : contents;
     if ((contents === workspaceId || contents === `${workspaceId}
 `) && isCanonicalWorkspaceId(workspaceId)) {
@@ -27313,22 +27763,22 @@ function inspectPath(path) {
   }
 }
 function createWorkspaceId(path) {
-  const parent = dirname9(path);
+  const parent = dirname11(path);
   const workspaceId = randomUUID3();
-  const temporaryPath = join12(parent, `.workspace-id-${process.pid}-${randomUUID3()}.tmp`);
+  const temporaryPath = join15(parent, `.workspace-id-${process.pid}-${randomUUID3()}.tmp`);
   let temporaryCreated = false;
   let publishing = false;
   try {
-    mkdirSync7(parent, { recursive: true, mode: 448 });
-    chmodSync3(parent, 448);
+    mkdirSync8(parent, { recursive: true, mode: 448 });
+    chmodSync4(parent, 448);
     const fd = openSync5(
       temporaryPath,
-      constants5.O_CREAT | constants5.O_EXCL | constants5.O_WRONLY,
+      constants6.O_CREAT | constants6.O_EXCL | constants6.O_WRONLY,
       384
     );
     temporaryCreated = true;
     try {
-      writeFileSync4(fd, `${workspaceId}
+      writeFileSync5(fd, `${workspaceId}
 `, "utf8");
       fchmodSync3(fd, 384);
       fsyncSync3(fd);
@@ -27349,7 +27799,7 @@ function createWorkspaceId(path) {
   } finally {
     if (temporaryCreated) {
       try {
-        unlinkSync2(temporaryPath);
+        unlinkSync3(temporaryPath);
       } catch {
       }
     }
@@ -27375,23 +27825,23 @@ function errorCode2(error) {
 }
 
 // src/hooks/codex-context.ts
-import { createHash as createHash7, randomBytes as randomBytes3 } from "crypto";
+import { createHash as createHash9, randomBytes as randomBytes4 } from "crypto";
 import {
-  chmodSync as chmodSync4,
-  existsSync as existsSync8,
-  mkdirSync as mkdirSync8,
-  readFileSync as readFileSync10,
-  readdirSync as readdirSync2,
-  renameSync as renameSync3,
-  rmSync as rmSync5,
-  statSync as statSync3,
-  unlinkSync as unlinkSync3,
-  writeFileSync as writeFileSync5
+  chmodSync as chmodSync5,
+  existsSync as existsSync11,
+  mkdirSync as mkdirSync9,
+  readFileSync as readFileSync13,
+  readdirSync as readdirSync4,
+  renameSync as renameSync4,
+  rmSync as rmSync6,
+  statSync as statSync4,
+  unlinkSync as unlinkSync4,
+  writeFileSync as writeFileSync6
 } from "fs";
-import { join as join13 } from "path";
+import { join as join16 } from "path";
 
 // src/daemon/decision-digest-cache.ts
-import { randomBytes as randomBytes2 } from "crypto";
+import { randomBytes as randomBytes3 } from "crypto";
 var DECISION_DIGEST_CACHE_LIMIT = 100;
 var DECISION_DIGEST_CACHE_WINDOW = "24h";
 var DECISION_DIGEST_CACHE_PATH = `/api/cli/decisions/recent?limit=${String(DECISION_DIGEST_CACHE_LIMIT)}&since=${DECISION_DIGEST_CACHE_WINDOW}`;
@@ -27516,15 +27966,13 @@ var CODEX_DRAFT_DIGEST_MAX_SEEN_IDS = 4096;
 var CODEX_DIGEST_STATE_RETENTION_MS = 7 * 24 * 60 * 60 * 1e3;
 var CODEX_DIGEST_STATE_MAX_FILES = 256;
 var STATE_VERSION = 1;
-var STATE_DIRECTORY = ["codex", "decision-digests"];
 var DRAFT_STATE_VERSION = 2;
-var DRAFT_STATE_DIRECTORY = ["codex", "decision-draft-deliveries"];
 var NO_CURSOR = -1;
-function stateRoot() {
-  return join13(primConfigDirectory(), ...STATE_DIRECTORY);
+function stateRoot(namespace) {
+  return join16(primConfigDirectory(), namespace, "decision-digests");
 }
-function draftStateRoot() {
-  return join13(primConfigDirectory(), ...DRAFT_STATE_DIRECTORY);
+function draftStateRoot(namespace) {
+  return join16(primConfigDirectory(), namespace, "decision-draft-deliveries");
 }
 function workspaceFor(cwd) {
   try {
@@ -27535,13 +27983,13 @@ function workspaceFor(cwd) {
 }
 function statePath(args) {
   const identity = `${args.siteUrl}\0${workspaceFor(args.cwd)}\0${args.sessionId}`;
-  const key = createHash7("sha256").update(identity).digest("hex");
-  return join13(stateRoot(), `${key}.json`);
+  const key = createHash9("sha256").update(identity).digest("hex");
+  return join16(stateRoot(args.namespace), `${key}.json`);
 }
 function draftStatePath(args) {
   const identity = `${args.siteUrl}\0${workspaceFor(args.cwd)}\0${args.sessionId}\0${args.principalId}\0${args.organizationId}\0${args.credentialFingerprint}`;
-  const key = createHash7("sha256").update(identity).digest("hex");
-  return join13(draftStateRoot(), `${key}.json`);
+  const key = createHash9("sha256").update(identity).digest("hex");
+  return join16(draftStateRoot(args.namespace), `${key}.json`);
 }
 function parseState(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
@@ -27580,58 +28028,58 @@ function parseDraftState(value) {
   };
 }
 function readState(path) {
-  if (!existsSync8(path)) return void 0;
+  if (!existsSync11(path)) return void 0;
   try {
-    return parseState(JSON.parse(readFileSync10(path, "utf8")));
+    return parseState(JSON.parse(readFileSync13(path, "utf8")));
   } catch {
     return void 0;
   }
 }
 function readDraftState(path) {
-  if (!existsSync8(path)) return void 0;
+  if (!existsSync11(path)) return void 0;
   try {
-    return parseDraftState(JSON.parse(readFileSync10(path, "utf8")));
+    return parseDraftState(JSON.parse(readFileSync13(path, "utf8")));
   } catch {
     return void 0;
   }
 }
 function writeStateFile(path, directory, state) {
-  mkdirSync8(directory, { recursive: true, mode: 448 });
-  chmodSync4(directory, 448);
-  const temporary = join13(
+  mkdirSync9(directory, { recursive: true, mode: 448 });
+  chmodSync5(directory, 448);
+  const temporary = join16(
     directory,
-    `.${path.slice(directory.length + 1)}.tmp-${process.pid}-${randomBytes3(8).toString("hex")}`
+    `.${path.slice(directory.length + 1)}.tmp-${process.pid}-${randomBytes4(8).toString("hex")}`
   );
   try {
-    writeFileSync5(temporary, `${JSON.stringify(state)}
+    writeFileSync6(temporary, `${JSON.stringify(state)}
 `, {
       encoding: "utf8",
       mode: 384,
       flag: "wx"
     });
-    chmodSync4(temporary, 384);
-    renameSync3(temporary, path);
+    chmodSync5(temporary, 384);
+    renameSync4(temporary, path);
   } finally {
     try {
-      unlinkSync3(temporary);
+      unlinkSync4(temporary);
     } catch {
     }
   }
 }
 function cleanupStateFiles(directory, now) {
-  if (!existsSync8(directory)) return;
+  if (!existsSync11(directory)) return;
   let names;
   try {
-    names = readdirSync2(directory);
+    names = readdirSync4(directory);
   } catch {
     return;
   }
   const files = [];
   const residue = [];
   for (const name of names) {
-    const path = join13(directory, name);
+    const path = join16(directory, name);
     try {
-      const mtimeMs = statSync3(path).mtimeMs;
+      const mtimeMs = statSync4(path).mtimeMs;
       if (name.endsWith(".json")) {
         files.push({ path, mtimeMs });
       } else if ((name.includes(".json.tmp-") || name.endsWith(".json.lock")) && now - mtimeMs > CODEX_DIGEST_STATE_RETENTION_MS) {
@@ -27644,14 +28092,14 @@ function cleanupStateFiles(directory, now) {
   const excess = files.filter((file) => !stale.some((candidate) => candidate.path === file.path)).sort((a, b) => a.mtimeMs - b.mtimeMs).slice(0, Math.max(0, files.length - CODEX_DIGEST_STATE_MAX_FILES));
   for (const file of [...stale, ...excess]) {
     try {
-      unlinkSync3(file.path);
+      unlinkSync4(file.path);
     } catch {
     }
   }
   for (const path of residue) {
     try {
-      if (now - statSync3(path).mtimeMs > CODEX_DIGEST_STATE_RETENTION_MS) {
-        rmSync5(path, { recursive: true, force: true });
+      if (now - statSync4(path).mtimeMs > CODEX_DIGEST_STATE_RETENTION_MS) {
+        rmSync6(path, { recursive: true, force: true });
       }
     } catch {
     }
@@ -27732,14 +28180,14 @@ function mergeState(latest, args) {
     updatedAt: args.now
   };
 }
-async function commitState(path, args) {
+async function commitState(path, args, namespace) {
   try {
     await withFileLock(
       `${path}.lock`,
       () => {
         const latest = readState(path);
-        writeStateFile(path, stateRoot(), mergeState(latest, args));
-        cleanupStateFiles(stateRoot(), args.now);
+        writeStateFile(path, stateRoot(namespace), mergeState(latest, args));
+        cleanupStateFiles(stateRoot(namespace), args.now);
       },
       { timeoutMs: 50, pollMs: 10 }
     );
@@ -27761,7 +28209,7 @@ function mergeDraftState(latest, args) {
     updatedAt: args.now
   };
 }
-async function commitDraftState(path, args) {
+async function commitDraftState(path, args, namespace) {
   try {
     let next;
     await withFileLock(
@@ -27769,8 +28217,8 @@ async function commitDraftState(path, args) {
       () => {
         const latest = readDraftState(path);
         next = mergeDraftState(latest, args);
-        writeStateFile(path, draftStateRoot(), next);
-        cleanupStateFiles(draftStateRoot(), args.now);
+        writeStateFile(path, draftStateRoot(namespace), next);
+        cleanupStateFiles(draftStateRoot(namespace), args.now);
       },
       { timeoutMs: 50, pollMs: 10 }
     );
@@ -27780,9 +28228,10 @@ async function commitDraftState(path, args) {
   }
 }
 async function prepareCodexContext(options) {
+  const namespace = options.namespace ?? "codex";
   const siteUrl = getSiteUrl();
   const workspace = workspaceFor(options.cwd);
-  const path = statePath({ cwd: options.cwd, sessionId: options.sessionId, siteUrl });
+  const path = statePath({ cwd: options.cwd, sessionId: options.sessionId, siteUrl, namespace });
   const previous = readState(path);
   const principal = resolveDaemonPrincipal();
   const privatePath = principal ? draftStatePath({
@@ -27791,7 +28240,8 @@ async function prepareCodexContext(options) {
     siteUrl,
     principalId: principal.principalId,
     organizationId: principal.organizationId,
-    credentialFingerprint: principal.credentialFingerprint
+    credentialFingerprint: principal.credentialFingerprint,
+    namespace
   }) : void 0;
   const previousDraft = privatePath ? readDraftState(privatePath) : void 0;
   const startup = options.startup === true;
@@ -27881,32 +28331,40 @@ async function prepareCodexContext(options) {
     acknowledge: async (handedOff) => {
       if (!handedOff || acknowledged) return;
       acknowledged = true;
-      await commitState(path, {
-        sessionId: options.sessionId,
-        siteUrl,
-        workspace,
-        startedAt,
-        watermarkMs: pageWatermark,
-        seenIds: freshRows.map((row) => row.id),
-        report,
-        feedAvailable,
-        now: Date.now()
-      });
+      await commitState(
+        path,
+        {
+          sessionId: options.sessionId,
+          siteUrl,
+          workspace,
+          startedAt,
+          watermarkMs: pageWatermark,
+          seenIds: freshRows.map((row) => row.id),
+          report,
+          feedAvailable,
+          now: Date.now()
+        },
+        namespace
+      );
       if (privatePath === void 0 || principal === void 0 || draftPageToken === void 0) {
         return;
       }
       let persistedDraft = previousDraft;
       if (draftDigest?.deliveredIds.length) {
-        persistedDraft = await commitDraftState(privatePath, {
-          sessionId: options.sessionId,
-          siteUrl,
-          workspace,
-          principalId: principal.principalId,
-          organizationId: principal.organizationId,
-          credentialFingerprint: principal.credentialFingerprint,
-          deliveredIds: draftDigest.deliveredIds,
-          now: Date.now()
-        });
+        persistedDraft = await commitDraftState(
+          privatePath,
+          {
+            sessionId: options.sessionId,
+            siteUrl,
+            workspace,
+            principalId: principal.principalId,
+            organizationId: principal.organizationId,
+            credentialFingerprint: principal.credentialFingerprint,
+            deliveredIds: draftDigest.deliveredIds,
+            now: Date.now()
+          },
+          namespace
+        );
       }
       const seenDrafts = new Set(persistedDraft?.seenDraftIds ?? []);
       const deliveredOnThisPage = draftPageActionableIds.filter((id) => seenDrafts.has(id));
@@ -27924,7 +28382,9 @@ async function prepareCodexContext(options) {
 }
 
 // src/hooks/normalize.ts
-import { createHash as createHash8 } from "crypto";
+import { createHash as createHash10 } from "crypto";
+import { realpathSync as realpathSync4 } from "fs";
+import { isAbsolute as isAbsolute9, resolve as resolve8 } from "path";
 var HERMES_EVENT_MAP = {
   on_session_start: "SessionStart",
   on_session_end: "SessionEnd",
@@ -27934,7 +28394,125 @@ var HERMES_EVENT_MAP = {
   post_tool_call: "PostToolUse",
   subagent_stop: "SubagentStop"
 };
+var CURSOR_EVENT_MAP = {
+  sessionStart: "SessionStart",
+  beforeSubmitPrompt: "UserPromptSubmit",
+  preToolUse: "PreToolUse",
+  postToolUse: "PostToolUse",
+  postToolUseFailure: "PostToolUseFailure",
+  afterAgentResponse: "AssistantResponse",
+  subagentStop: "SubagentStop",
+  stop: "Stop",
+  sessionEnd: "SessionEnd"
+};
+var CURSOR_TOOL_EVENTS = /* @__PURE__ */ new Set(["PreToolUse", "PostToolUse", "PostToolUseFailure"]);
+var SAFE_CORRELATION_ID_RE = /^[A-Za-z0-9._:-]{1,128}$/u;
+var CURSOR_LOCAL_ONLY_FIELDS = /* @__PURE__ */ new Set([
+  "conversation_id",
+  "generation_id",
+  "user_email",
+  "account_email",
+  "transcript_path",
+  "transcript",
+  "thought",
+  "thoughts",
+  "thinking",
+  "tool_output"
+]);
+function requiredId(value, field) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new TypeError(`Cursor hook envelope is missing ${field}`);
+  }
+  return value;
+}
+function cursorToolUseId(value) {
+  if (SAFE_CORRELATION_ID_RE.test(value)) return value;
+  return `cursor:tool:v1:${createHash10("sha256").update(value).digest("hex")}`;
+}
+function workspaceCandidates(value) {
+  if (!Array.isArray(value)) return [];
+  const roots = value.filter((item) => typeof item === "string" && item.length > 0);
+  if (roots.some((root) => !isAbsolute9(root))) {
+    throw new TypeError("Cursor workspace roots must be absolute");
+  }
+  return roots;
+}
+function pathIdentity(path) {
+  try {
+    return realpathSync4.native(path);
+  } catch {
+    return resolve8(path);
+  }
+}
+function resolveCursorCwd(parsed) {
+  const roots = workspaceCandidates(parsed.workspace_roots).map(pathIdentity);
+  const rootRepositories = roots.map((root) => resolveRepositoryContext(root)?.repoRoot);
+  const repositoryRoots = new Set(rootRepositories.filter((root) => !!root));
+  if (repositoryRoots.size > 1) {
+    throw new TypeError("Cursor hook envelope spans multiple repositories");
+  }
+  if (roots.length > 1 && rootRepositories.some((root) => root === void 0)) {
+    throw new TypeError("Cursor hook envelope has ambiguous workspace roots");
+  }
+  const expectedRepo = [...repositoryRoots][0];
+  const rawCwd = typeof parsed.cwd === "string" && parsed.cwd.length > 0 ? parsed.cwd : void 0;
+  if (rawCwd && !isAbsolute9(rawCwd)) {
+    throw new TypeError("Cursor hook cwd must be absolute");
+  }
+  const envelopeCwd = rawCwd ? pathIdentity(rawCwd) : void 0;
+  const input = typeof parsed.tool_input === "object" && parsed.tool_input !== null && !Array.isArray(parsed.tool_input) ? parsed.tool_input : void 0;
+  const rawToolCwd = parsed.tool_name === "Shell" && typeof input?.working_directory === "string" ? input.working_directory : void 0;
+  const base = envelopeCwd ?? (roots.length === 1 ? roots[0] : expectedRepo);
+  if (rawToolCwd && !isAbsolute9(rawToolCwd) && !base) {
+    throw new TypeError("relative Cursor tool cwd has no workspace base");
+  }
+  const toolCwd = rawToolCwd ? pathIdentity(isAbsolute9(rawToolCwd) ? rawToolCwd : resolve8(base, rawToolCwd)) : void 0;
+  const selected = toolCwd ?? envelopeCwd ?? (roots.length === 1 ? roots[0] : expectedRepo);
+  if (!selected) {
+    throw new TypeError("Cursor hook envelope has no unambiguous workspace");
+  }
+  const selectedRepo = resolveRepositoryContext(selected)?.repoRoot;
+  if (expectedRepo && selectedRepo !== expectedRepo) {
+    throw new TypeError("Cursor hook cwd conflicts with workspace repository");
+  }
+  return selected;
+}
+function normalizeCursorEnvelope(parsed) {
+  const rawEvent = requiredId(parsed.hook_event_name, "hook_event_name");
+  const event = CURSOR_EVENT_MAP[rawEvent];
+  if (!event) throw new TypeError(`unsupported Cursor hook event: ${rawEvent}`);
+  const sessionId = requiredId(parsed.conversation_id, "conversation_id");
+  const turnId = requiredId(parsed.generation_id, "generation_id");
+  if (parsed.session_id !== void 0 && parsed.session_id !== sessionId) {
+    throw new TypeError("Cursor conversation_id conflicts with session_id");
+  }
+  if (parsed.turn_id !== void 0 && parsed.turn_id !== turnId) {
+    throw new TypeError("Cursor generation_id conflicts with turn_id");
+  }
+  const rawToolUseId = CURSOR_TOOL_EVENTS.has(event) ? requiredId(parsed.tool_use_id, "tool_use_id") : void 0;
+  const normalized = {
+    ...Object.fromEntries(
+      Object.entries(parsed).filter(([key]) => !CURSOR_LOCAL_ONLY_FIELDS.has(key))
+    ),
+    hook_event_name: event,
+    session_id: sessionId,
+    turn_id: turnId,
+    cwd: resolveCursorCwd(parsed),
+    ...rawToolUseId === void 0 ? {} : { tool_use_id: cursorToolUseId(rawToolUseId) }
+  };
+  if (typeof parsed.tool_output === "string") {
+    try {
+      normalized.tool_response = JSON.parse(parsed.tool_output);
+    } catch {
+      normalized.tool_response = parsed.tool_output;
+    }
+  }
+  return normalized;
+}
 function normalizeEnvelope(parsed, agent) {
+  if (agent === "cursor") {
+    return normalizeCursorEnvelope(parsed);
+  }
   if (agent === "codex") {
     const event = parsed.hook_event_name;
     if ((event === "PreToolUse" || event === "PostToolUse") && (typeof parsed.tool_use_id !== "string" || parsed.tool_use_id.length === 0)) {
@@ -27946,7 +28524,7 @@ function normalizeEnvelope(parsed, agent) {
       ]);
       return {
         ...parsed,
-        tool_use_id: `codex:fallback:v1:${createHash8("sha256").update(stableToolIdentity).digest("hex")}`
+        tool_use_id: `codex:fallback:v1:${createHash10("sha256").update(stableToolIdentity).digest("hex")}`
       };
     }
     return parsed;
@@ -28048,24 +28626,24 @@ async function processSessionStart(raw, agent, feedbackSignal) {
     { timeoutMs: DAEMON_TIMEOUT_MS }
   );
   const cwd = envelope.cwd ?? process.cwd();
-  let projectRoot = null;
+  let projectRoot2 = null;
   let active = false;
   let skillState = { installed: 0, refreshed: 0 };
   let claudeBinding;
   if (agent === "claude_code") {
     const activeProject = await activeProjectRoot(cwd);
-    projectRoot = activeProject?.root ?? null;
-    active = projectRoot !== null;
+    projectRoot2 = activeProject?.root ?? null;
+    active = projectRoot2 !== null;
     claudeBinding = activeProject?.binding;
     try {
       skillState = await refreshClaudePlugins(
         cwd,
-        active && projectRoot !== null ? { includeProject: true, projectRoot } : { includeProject: false }
+        active && projectRoot2 !== null ? { includeProject: true, projectRoot: projectRoot2 } : { includeProject: false }
       );
     } catch {
     }
   }
-  if (isSessionEnded() && agent !== "codex") {
+  if (isSessionEnded() && agent !== "codex" && agent !== "cursor") {
     const notice = reauthNoticeFields(agent);
     if (notice) {
       return {
@@ -28084,11 +28662,11 @@ async function processSessionStart(raw, agent, feedbackSignal) {
       });
     } catch {
     }
-    projectRoot = (await activeProjectRoot(cwd))?.root ?? null;
-    active = projectRoot !== null;
+    projectRoot2 = (await activeProjectRoot(cwd))?.root ?? null;
+    active = projectRoot2 !== null;
     let proactive = false;
     try {
-      proactive = projectRoot !== null && active && hasUsableCodexGuidance(projectRoot);
+      proactive = projectRoot2 !== null && active && hasUsableCodexGuidance(projectRoot2);
     } catch {
     }
     const additionalContext = [proactive ? CODEX_PRIM_REMINDER : void 0, context?.context].filter((value) => value !== void 0).join("\n\n");
@@ -28099,6 +28677,34 @@ async function processSessionStart(raw, agent, feedbackSignal) {
       }
     };
   }
+  if (agent === "cursor") {
+    const activeProject = await activeProjectRoot(cwd);
+    projectRoot2 = activeProject?.root ?? null;
+    active = projectRoot2 !== null;
+    let context;
+    try {
+      context = await prepareCodexContext({
+        cwd,
+        sessionId: envelope.session_id,
+        startup: true,
+        includeDigest: true,
+        namespace: "cursor"
+      });
+    } catch {
+    }
+    let proactive = false;
+    try {
+      proactive = projectRoot2 !== null && active && hasUsableCursorSkill(projectRoot2);
+    } catch {
+    }
+    const additionalContext = [proactive ? CODEX_PRIM_REMINDER : void 0, context?.context].filter((value) => value !== void 0).join("\n\n");
+    return {
+      output: additionalContext ? { additional_context: additionalContext } : {},
+      acknowledge: async () => {
+        await context?.acknowledge(true);
+      }
+    };
+  }
   if (agent === "claude_code") {
     const additionalContext = [
       claudeBinding ? claudeBindingReminder(claudeBinding) : void 0,
@@ -28145,33 +28751,26 @@ function emitOutput(output, acknowledge) {
   outputAttempted = true;
   return handoffHookOutput(output, acknowledge);
 }
-function readStdin() {
-  return new Promise((resolve7, reject) => {
-    const chunks = [];
-    const timer = setTimeout(() => {
-      reject(new Error("stdin read timeout"));
-    }, STDIN_TIMEOUT_MS);
-    process.stdin.on("data", (chunk) => chunks.push(chunk));
-    process.stdin.on("end", () => {
-      clearTimeout(timer);
-      resolve7(Buffer.concat(chunks).toString("utf-8"));
-    });
-    process.stdin.on("error", (err) => {
-      clearTimeout(timer);
-      reject(err);
-    });
-  });
-}
 async function main() {
   warmBinCache();
   const agent = parseAgent(process.argv);
   let raw;
   try {
-    raw = await readStdin();
+    raw = await readHookStdin(STDIN_TIMEOUT_MS);
   } catch {
     await emitOutput(buildHookOutput({}));
     return;
   }
+  if (agent !== "cursor") {
+    try {
+      const incoming = JSON.parse(raw);
+      if (shouldSuppressImportedCursorHandler(incoming, "prim-session-start")) {
+        await emitOutput({});
+        return;
+      }
+    } catch {
+    }
+  }
   const result = await processSessionStart(raw, agent);
   await emitOutput(result.output, result.acknowledge);
 }