@primitive.ai/prim 0.1.0-alpha.90 → 0.1.0-alpha.92

package/dist/index.js

@@ -17,18 +17,18 @@ import {
   uninstallPostRewriteHookAtPath,
   uninstallProjectPostCommitHook,
   uninstallProjectPostRewriteHook
-} from "./chunk-C7T7B45R.js";
+} from "./chunk-LGGMJYY4.js";
 import {
   requireDurableIngestAcknowledgement
-} from "./chunk-R26A7TWY.js";
+} from "./chunk-FKXFUUWJ.js";
 import {
   checkAffectedDecisions,
   daemonOrDirectGet,
   formatDecisionsWarning
-} from "./chunk-RO3F6JYV.js";
+} from "./chunk-5GYQ4J3D.js";
 import {
   fetchFeedbackCapability
-} from "./chunk-LMRYZL3D.js";
+} from "./chunk-5AFRMOPX.js";
 import {
   JOURNAL_DIR,
   SESSIONS_DIR,
@@ -37,24 +37,12 @@ import {
   listFlushing,
   pendingJournalStats,
   readMovesFromPath
-} from "./chunk-YWO7O6QG.js";
+} from "./chunk-FBAYCS3X.js";
 import {
-  STABLE_HOOK_LAUNCHER_NAME,
-  binFile,
-  commandMatchesBin,
-  compareSemver,
-  detachedHookShimCommand,
   formatStatusline,
   formatTeammates,
-  hookCommandResolution,
-  hookCommandResolutions,
-  packageRoot,
-  packageVersion,
-  pinnedHookCommand,
-  pinnedNpxArgs,
-  repositoryBindingDiagnosticLabel,
-  stableHookCommand
-} from "./chunk-PMRDE2DA.js";
+  repositoryBindingDiagnosticLabel
+} from "./chunk-WX52U7Z2.js";
 import {
   bold,
   boundedHealthError,
@@ -62,13 +50,10 @@ import {
   colorForArea,
   dim,
   stripAnsi
-} from "./chunk-LEMX3IOG.js";
+} from "./chunk-BTNNEH2W.js";
 import {
-  canonicalGitRoot,
-  canonicalRepositoryPath,
   decisionIngestionStatus,
   fetchAndCacheCollectScope,
-  gitToplevel,
   isCliErrorResponse,
   isDecisionIdRequest,
   isDecisionRescopeRequest,
@@ -84,11 +69,10 @@ import {
   repoSyncId,
   repositoryBindingState,
   setRepoActive
-} from "./chunk-MAZWKJGL.js";
+} from "./chunk-M6RIJVRE.js";
 import {
   CliManagementResponseError,
   HttpError,
-  atomicWriteFile,
   clearStoredCredentials,
   commitCredentials,
   getClient,
@@ -97,34 +81,66 @@ import {
   getSiteUrl,
   getTokenExpiresAt,
   isSessionEnded,
-  processIsAlive,
   refreshToken,
   setStoredToken,
   stripControlChars,
-  syncDirectory,
-  syncFile,
-  terminalSafeLine,
-  withFileLock,
-  withFileLockSync
-} from "./chunk-Z7YPFWAZ.js";
+  terminalSafeLine
+} from "./chunk-PCVGBE5B.js";
+import {
+  assertOwnedHookRuntime,
+  atomicWrite,
+  binFile,
+  commandMatchesBin,
+  compareSemver,
+  ensureRegistration,
+  entryHasCommand,
+  hookCommandResolutions,
+  hookRuntimePaths,
+  inspectHookRuntime,
+  inspectHookRuntimeResolutions,
+  inspectHookRuntimeResolutions2,
+  makeRegistration,
+  packageVersion,
+  performStatus,
+  performStatus2,
+  pinnedHookCommand,
+  pinnedNpxArgs,
+  projectRoot,
+  readSettings,
+  registerClaudeCommands,
+  registerCursorCommands,
+  removeHookRuntime,
+  stableHookCommand,
+  stageHookRuntime,
+  stripCommand
+} from "./chunk-26P57LAR.js";
+import {
+  canonicalGitRoot,
+  canonicalRepositoryPath,
+  gitToplevel
+} from "./chunk-H4UNYFUC.js";
 import {
   daemonIsLive,
   daemonRequest
-} from "./chunk-CUE2LKLR.js";
+} from "./chunk-KFXF2V5G.js";
 import {
   REFRESH_TOKEN_PATH,
   TOKEN_FILE_PATH,
   WorkosConnectProtocolError,
+  atomicWriteFile,
   discoverWorkosConnect,
   pollWorkosDeviceAuthorization,
   primConfigDirectory,
+  processIsAlive,
   requestWorkosDeviceAuthorization,
-  resolveAuthCredential
-} from "./chunk-3EEFL6NJ.js";
+  resolveAuthCredential,
+  syncDirectory,
+  withFileLock
+} from "./chunk-67VNLLBN.js";
 
 // src/index.ts
-import { readFileSync as readFileSync11 } from "fs";
-import { dirname as dirname8, resolve as resolve5 } from "path";
+import { readFileSync as readFileSync9 } from "fs";
+import { dirname as dirname6, resolve as resolve4 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { Command } from "commander";
 import updateNotifier from "update-notifier";
@@ -1007,8 +1023,8 @@ ${verificationUrl}`);
     const state = base64url(randomBytes2(16));
     const redirectUri = `http://${LOCALHOST}:${CALLBACK_PORT}/callback`;
     let settle;
-    const outcome = new Promise((resolve6) => {
-      settle = resolve6;
+    const outcome = new Promise((resolve5) => {
+      settle = resolve5;
     });
     const server = createServer((req, res) => {
       const url = new URL(req.url ?? "/", `http://${LOCALHOST}`);
@@ -1022,12 +1038,12 @@ ${verificationUrl}`);
       res.end(page.html, () => settle(page.result));
     });
     try {
-      await new Promise((resolve6, reject) => {
+      await new Promise((resolve5, reject) => {
         const onError = (err) => reject(err);
         server.once("error", onError);
         server.listen(CALLBACK_PORT, LOCALHOST, () => {
           server.removeListener("error", onError);
-          resolve6();
+          resolve5();
         });
       });
     } catch (err) {
@@ -1908,1041 +1924,84 @@ async function applyActivation(active, globals = {}) {
     if (active) {
       refreshOwnedGlobalHooks();
       postCommitHook = ensureEffectivePostCommitHook(root).path;
-      try {
-        postRewriteHook = ensureEffectivePostRewriteHook(root).path;
-      } catch (error) {
-        const detail = error instanceof Error ? error.message : String(error);
-        process.stderr.write(`[prim] post-rewrite hook coverage is degraded: ${detail}
-`);
-      }
-      phase = "GitHub repo connection";
-      binding = await bindRepository(root);
-    }
-    if (active && binding?.status === "unbound") {
-      const connected = await maybeConnectRepository(root, globals);
-      if (!connected) {
-        process.stderr.write(`[prim] ${GITHUB_CONNECTION_REQUIRED}
-`);
-        printJson({
-          active: false,
-          repo: root,
-          bindingStatus: binding.status,
-          repositoryFullName: binding.repositoryFullName,
-          ...postCommitHook ? { postCommitHook } : {},
-          ...postRewriteHook ? { postRewriteHook } : {}
-        });
-        process.exitCode = 1;
-        return;
-      }
-      binding = connected;
-    }
-    if (active) {
-      try {
-        await fetchAndCacheCollectScope(root);
-      } catch {
-      }
-    }
-    phase = "local activation";
-    setRepoActive(root, active);
-    await daemonRequest("statusline_invalidate", {}, { timeoutMs: 250 });
-    process.stderr.write(`[prim] prim ${active ? "enabled" : "disabled"} in ${root}
-`);
-    printJson({
-      active,
-      repo: root,
-      ...binding ? {
-        bindingStatus: binding.status,
-        repositoryFullName: binding.repositoryFullName,
-        ...binding.status === "connected" ? { repoSyncId: binding.repoSyncId } : {}
-      } : {},
-      ...postCommitHook ? { postCommitHook } : {},
-      ...postRewriteHook ? { postRewriteHook } : {}
-    });
-  } catch (err) {
-    const detail = err instanceof Error ? err.message : String(err);
-    process.stderr.write(
-      active ? `[prim] failed to enable prim during ${phase}: ${detail}
-` : `[prim] failed to disable prim: ${detail}
-`
-    );
-    process.exit(1);
-  }
-}
-function registerActivationCommands(program2) {
-  program2.command("enable").description("Activate prim's hooks in this repo (git config prim.active=true)").action((_opts, command) => applyActivation(true, command.optsWithGlobals()));
-  program2.command("disable").description("Mute prim's hooks in this repo (git config prim.active=false)").action(
-    (_opts, command) => applyActivation(false, command.optsWithGlobals())
-  );
-}
-
-// src/commands/claude-install.ts
-import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join3 } from "path";
-
-// src/lib/hook-runtime.ts
-import { createHash as createHash2, randomBytes as randomBytes3 } from "crypto";
-import {
-  constants,
-  accessSync,
-  chmodSync,
-  copyFileSync,
-  existsSync as existsSync3,
-  lstatSync as lstatSync2,
-  mkdirSync as mkdirSync2,
-  mkdtempSync,
-  readFileSync as readFileSync3,
-  readdirSync as readdirSync2,
-  realpathSync,
-  renameSync,
-  rmSync,
-  statSync,
-  utimesSync,
-  writeFileSync as writeFileSync2
-} from "fs";
-import { dirname as dirname2, isAbsolute, join as join2, resolve as resolve2 } from "path";
-var HOOK_RUNTIME_SCHEMA_VERSION = 1;
-var DIRECTORY_MODE = 448;
-var DATA_FILE_MODE = 384;
-var LAUNCHER_MODE = 448;
-var RELEASE_PREFIX = "release-";
-var RELEASE_NAME_RE = /^release-[0-9a-f]{64}$/u;
-var MAX_MANIFEST_BYTES = 64 * 1024;
-var MAX_RELEASES = 8;
-var MAX_RELEASE_DELETIONS_PER_STAGE = 8;
-var RETAIN_PREDECESSORS = 2;
-var RELEASE_GRACE_MS = 10 * 60 * 1e3;
-var HOOK_RUNTIME_ENTRIES = {
-  // SessionStart self-healing resolves this exact CLI entry to run
-  // `daemon ensure`; it must travel with the immutable hook release.
-  prim: "dist/index.js",
-  "prim-hook": "dist/hooks/prim-hook.js",
-  "prim-pre-commit": "dist/hooks/pre-commit.js",
-  "prim-post-commit": "dist/hooks/post-commit.js",
-  "prim-post-rewrite": "dist/hooks/post-rewrite.js",
-  "prim-pre-tool-use": "dist/hooks/pre-tool-use.js",
-  "prim-post-tool-use": "dist/hooks/post-tool-use.js",
-  "prim-session-start": "dist/hooks/session-start.js",
-  "prim-session-end": "dist/hooks/session-end.js",
-  "prim-daemon-server": "dist/daemon/server.js",
-  "prim-statusline": "dist/statusline-main.js"
-};
-var SOURCE_ENTRIES = Object.fromEntries(
-  Object.entries(HOOK_RUNTIME_ENTRIES).map(([bin, target]) => [
-    bin,
-    target.replace(/^dist\//u, "")
-  ])
-);
-function hookRuntimePaths(options = {}) {
-  const env = options.env ?? process.env;
-  const configDir = primConfigDirectory({
-    ...options,
-    env,
-    homeDir: options.homeDir ?? env.HOME ?? ""
-  });
-  const runtimeDir = join2(configDir, "hook-runtime");
-  return {
-    configDir,
-    launcher: join2(configDir, STABLE_HOOK_LAUNCHER_NAME),
-    runtimeDir,
-    releasesDir: join2(runtimeDir, "releases"),
-    current: join2(runtimeDir, "current"),
-    selectionLock: join2(runtimeDir, "selection.lock")
-  };
-}
-function sha256(path) {
-  return createHash2("sha256").update(readFileSync3(path)).digest("hex");
-}
-function exactManifest(manifest) {
-  return `${JSON.stringify(manifest, null, 2)}
-`;
-}
-function exactKeys(value, expected) {
-  const actual = Object.keys(value).sort();
-  const wanted = [...expected].sort();
-  return actual.length === wanted.length && actual.every((key, index) => key === wanted[index]);
-}
-function releaseId(manifest) {
-  return createHash2("sha256").update(exactManifest(manifest)).digest("hex");
-}
-function runtimePackageJson(manifest) {
-  return `${JSON.stringify(
-    {
-      name: "@primitive.ai/prim",
-      version: manifest.version,
-      type: "module",
-      bin: HOOK_RUNTIME_ENTRIES
-    },
-    null,
-    2
-  )}
-`;
-}
-function validateRelease(releaseDir, manifest) {
-  try {
-    if (!directReleaseLayout(releaseDir)) return false;
-    if (readFileSync3(join2(releaseDir, "manifest.json"), "utf8") !== exactManifest(manifest)) {
-      return false;
-    }
-    if (readFileSync3(join2(releaseDir, "package.json"), "utf8") !== runtimePackageJson(manifest)) {
-      return false;
-    }
-    if (readFileSync3(join2(releaseDir, "node"), "utf8") !== `${manifest.nodePath}
-`) {
-      return false;
-    }
-    for (const [bin, relativePath] of Object.entries(HOOK_RUNTIME_ENTRIES)) {
-      const target = join2(releaseDir, relativePath);
-      if (sha256(target) !== manifest.files[bin]) return false;
-    }
-    return true;
-  } catch {
-    return false;
-  }
-}
-function directReleaseLayout(releaseDir) {
-  try {
-    const directories = /* @__PURE__ */ new Set([releaseDir]);
-    for (const relativePath of Object.values(HOOK_RUNTIME_ENTRIES)) {
-      for (let directory = dirname2(relativePath); directory !== "."; directory = dirname2(directory)) {
-        directories.add(join2(releaseDir, directory));
-      }
-    }
-    if (![...directories].every((directory) => lstatSync2(directory).isDirectory())) return false;
-    const files = ["manifest.json", "package.json", "node", ...Object.values(HOOK_RUNTIME_ENTRIES)];
-    return files.every((relativePath) => lstatSync2(join2(releaseDir, relativePath)).isFile());
-  } catch {
-    return false;
-  }
-}
-function readReleaseManifest(releaseDir, releaseName) {
-  try {
-    const manifestPath = join2(releaseDir, "manifest.json");
-    const manifestStat = statSync(manifestPath);
-    if (!manifestStat.isFile() || manifestStat.size > MAX_MANIFEST_BYTES) return null;
-    const raw = readFileSync3(manifestPath, "utf8");
-    const parsed = JSON.parse(raw);
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-    if (!exactKeys(parsed, ["schemaVersion", "version", "nodePath", "files"])) return null;
-    const candidate = parsed;
-    if (candidate.schemaVersion !== HOOK_RUNTIME_SCHEMA_VERSION || typeof candidate.version !== "string" || compareSemver(candidate.version, candidate.version) !== 0 || typeof candidate.nodePath !== "string" || !isAbsolute(candidate.nodePath) || /[\r\n]/u.test(candidate.nodePath) || !candidate.files || typeof candidate.files !== "object" || Array.isArray(candidate.files) || !exactKeys(candidate.files, Object.keys(HOOK_RUNTIME_ENTRIES)) || Object.values(candidate.files).some(
-      (digest) => typeof digest !== "string" || !/^[0-9a-f]{64}$/u.test(digest)
-    )) {
-      return null;
-    }
-    const manifest = candidate;
-    if (raw !== exactManifest(manifest) || releaseName !== `${RELEASE_PREFIX}${releaseId(manifest)}` || !validateRelease(releaseDir, manifest)) {
-      return null;
-    }
-    return manifest;
-  } catch {
-    return null;
-  }
-}
-function readSelectedRelease(paths) {
-  let raw;
-  try {
-    raw = readFileSync3(paths.current, "utf8");
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  }
-  const name = raw.endsWith("\n") ? raw.slice(0, -1) : "";
-  if (`${name}
-` !== raw || !RELEASE_NAME_RE.test(name)) {
-    throw new Error("cannot stage hook runtime: selected release is malformed");
-  }
-  const dir = join2(paths.releasesDir, name);
-  const manifest = readReleaseManifest(dir, name);
-  if (!manifest) {
-    throw new Error("cannot stage hook runtime: immutable release is corrupt");
-  }
-  return { name, dir, manifest };
-}
-function releaseEntries(paths) {
-  return readdirSync2(paths.releasesDir, { withFileTypes: true }).flatMap((entry) => {
-    if (!entry.isDirectory() || !RELEASE_NAME_RE.test(entry.name)) return [];
-    const dir = join2(paths.releasesDir, entry.name);
-    try {
-      return [{ name: entry.name, dir, mtimeMs: statSync(dir).mtimeMs }];
-    } catch {
-      return [];
-    }
-  });
-}
-function pruneReleases(paths, protectedNames, reserveSlots, now) {
-  const entries = releaseEntries(paths).sort(
-    (left, right) => right.mtimeMs - left.mtimeMs || left.name.localeCompare(right.name)
-  );
-  const protectedWithPredecessors = new Set(protectedNames);
-  for (const entry of entries) {
-    if (protectedWithPredecessors.size >= protectedNames.size + RETAIN_PREDECESSORS) break;
-    if (!protectedWithPredecessors.has(entry.name)) protectedWithPredecessors.add(entry.name);
-  }
-  const candidates = entries.filter(
-    (entry) => !protectedWithPredecessors.has(entry.name) && now - entry.mtimeMs >= RELEASE_GRACE_MS
-  ).sort((left, right) => left.mtimeMs - right.mtimeMs || left.name.localeCompare(right.name));
-  let remaining = entries.length;
-  let deleted = 0;
-  for (const entry of candidates) {
-    if (remaining + reserveSlots <= MAX_RELEASES || deleted >= MAX_RELEASE_DELETIONS_PER_STAGE) {
-      break;
-    }
-    rmSync(entry.dir, { recursive: true, force: true });
-    remaining -= 1;
-    deleted += 1;
-  }
-  if (remaining + reserveSlots > MAX_RELEASES) {
-    throw new Error(
-      "cannot stage hook runtime: release retention is full while recent runtimes are protected"
-    );
-  }
-}
-function sourceManifest(sourceDir, version, nodePath) {
-  const files = {};
-  for (const [bin, relativePath] of Object.entries(SOURCE_ENTRIES)) {
-    const source = join2(sourceDir, relativePath);
-    if (!existsSync3(source) || !statSync(source).isFile()) {
-      throw new Error(`cannot stage hook runtime: missing self-contained ${bin} bundle`);
-    }
-    files[bin] = sha256(source);
-  }
-  return { schemaVersion: HOOK_RUNTIME_SCHEMA_VERSION, version, nodePath, files };
-}
-var STABLE_HOOK_LAUNCHER_CONTENT = `#!/bin/sh
-set -eu
-case "$0" in */*) prim_launcher_dir=\${0%/*} ;; *) exit 78 ;; esac
-IFS= read -r prim_release_name < "$prim_launcher_dir/hook-runtime/current" || exit 69
-case "$prim_release_name" in ${RELEASE_PREFIX}*) ;; *) exit 69 ;; esac
-prim_release_id=\${prim_release_name#${RELEASE_PREFIX}}
-case "$prim_release_id" in *[!0-9a-f]*|"") exit 69 ;; esac
-[ "\${#prim_release_id}" -eq 64 ] || exit 69
-prim_release="$prim_launcher_dir/hook-runtime/releases/$prim_release_name"
-case "\${1-}" in
-${Object.entries(HOOK_RUNTIME_ENTRIES).map(([bin, entry]) => `  ${bin}) prim_entry="$prim_release/${entry}" ;;`).join("\n")}
-  *) exit 64 ;;
-esac
-shift
-IFS= read -r prim_node < "$prim_release/node" || exit 69
-case "$prim_node" in /*) ;; *) exit 69 ;; esac
-[ -x "$prim_node" ] && [ -f "$prim_entry" ] || exit 69
-exec "$prim_node" "$prim_entry" "$@"
-`;
-function privateDirectory(path) {
-  const stat = lstatIfPresent2(path);
-  if (!stat?.isDirectory()) return false;
-  if (process.platform === "win32") return true;
-  const uid = process.getuid?.();
-  return (Number(stat.mode) & 511) === DIRECTORY_MODE && (uid === void 0 || stat.uid === uid);
-}
-function privateFile(path, mode) {
-  const stat = lstatIfPresent2(path);
-  if (!stat?.isFile()) return false;
-  if (process.platform === "win32") return true;
-  const uid = process.getuid?.();
-  return (Number(stat.mode) & 511) === mode && (uid === void 0 || stat.uid === uid);
-}
-function hasSafeRuntimeLayout(paths, selected) {
-  const releaseDirectories = /* @__PURE__ */ new Set([selected.dir]);
-  for (const relativePath of Object.values(HOOK_RUNTIME_ENTRIES)) {
-    for (let directory = dirname2(relativePath); directory !== "."; directory = dirname2(directory)) {
-      releaseDirectories.add(join2(selected.dir, directory));
-    }
-  }
-  if (!privateDirectory(paths.configDir) || !privateDirectory(paths.runtimeDir) || !privateDirectory(paths.releasesDir) || ![...releaseDirectories].every(privateDirectory) || !privateFile(paths.launcher, LAUNCHER_MODE) || !privateFile(paths.current, DATA_FILE_MODE) || !privateFile(join2(selected.dir, "manifest.json"), DATA_FILE_MODE) || !privateFile(join2(selected.dir, "package.json"), DATA_FILE_MODE) || !privateFile(join2(selected.dir, "node"), DATA_FILE_MODE)) {
-    return false;
-  }
-  return Object.values(HOOK_RUNTIME_ENTRIES).every(
-    (relativePath) => privateFile(join2(selected.dir, relativePath), DATA_FILE_MODE)
-  );
-}
-function recordedNodeMatchesCurrentProcess(nodePath) {
-  try {
-    if (!statSync(nodePath).isFile()) return false;
-    accessSync(nodePath, constants.X_OK);
-    return realpathSync(nodePath) === realpathSync(process.execPath);
-  } catch {
-    return false;
-  }
-}
-function inspectHookRuntime(options = {}) {
-  let paths;
-  try {
-    paths = hookRuntimePaths(options);
-  } catch {
-    return { state: "invalid" };
-  }
-  const launcher = lstatIfPresent2(paths.launcher);
-  const selector = lstatIfPresent2(paths.current);
-  if (!(launcher || selector)) return { state: "missing" };
-  if (!(launcher && selector)) return { state: "invalid" };
-  try {
-    if (readFileSync3(paths.launcher, "utf8") !== STABLE_HOOK_LAUNCHER_CONTENT) {
-      return { state: "invalid" };
-    }
-    const selected = readSelectedRelease(paths);
-    if (!selected) return { state: "invalid" };
-    assertOwnedHookRuntime(paths);
-    if (!hasSafeRuntimeLayout(paths, selected)) return { state: "invalid" };
-    return recordedNodeMatchesCurrentProcess(selected.manifest.nodePath) ? { state: "ready", version: selected.manifest.version } : { state: "invalid" };
-  } catch {
-    return { state: "invalid" };
-  }
-}
-function writeRelease(sourceDir, releaseDir, manifest, releasesDir) {
-  const stagingDir = mkdtempSync(join2(releasesDir, ".stage-"));
-  chmodSync(stagingDir, DIRECTORY_MODE);
-  try {
-    const directories = /* @__PURE__ */ new Set([stagingDir]);
-    const syncStagedFile = (path) => {
-      syncFile(path);
-      for (let directory = dirname2(path); ; directory = dirname2(directory)) {
-        directories.add(directory);
-        if (directory === stagingDir) break;
-      }
-    };
-    for (const [bin, targetRelative] of Object.entries(HOOK_RUNTIME_ENTRIES)) {
-      const source = join2(sourceDir, SOURCE_ENTRIES[bin]);
-      const target = join2(stagingDir, targetRelative);
-      mkdirSync2(dirname2(target), { recursive: true, mode: DIRECTORY_MODE });
-      chmodSync(dirname2(target), DIRECTORY_MODE);
-      copyFileSync(source, target);
-      chmodSync(target, DATA_FILE_MODE);
-      if (sha256(target) !== manifest.files[bin]) {
-        throw new Error(`cannot stage hook runtime: ${bin} changed while it was copied`);
-      }
-      syncStagedFile(target);
-    }
-    const nodePath = join2(stagingDir, "node");
-    writeFileSync2(nodePath, `${manifest.nodePath}
-`, {
-      encoding: "utf8",
-      flag: "wx",
-      mode: DATA_FILE_MODE
-    });
-    syncStagedFile(nodePath);
-    const packageJsonPath = join2(stagingDir, "package.json");
-    writeFileSync2(packageJsonPath, runtimePackageJson(manifest), {
-      encoding: "utf8",
-      flag: "wx",
-      mode: DATA_FILE_MODE
-    });
-    syncStagedFile(packageJsonPath);
-    const manifestPath = join2(stagingDir, "manifest.json");
-    writeFileSync2(manifestPath, exactManifest(manifest), {
-      encoding: "utf8",
-      flag: "wx",
-      mode: DATA_FILE_MODE
-    });
-    syncStagedFile(manifestPath);
-    for (const directory of [...directories].sort((left, right) => right.length - left.length)) {
-      syncDirectory(directory);
-    }
-    try {
-      renameSync(stagingDir, releaseDir);
-    } catch (error) {
-      const code = error.code;
-      if (code !== "EEXIST" && code !== "ENOTEMPTY" || !validateRelease(releaseDir, manifest)) {
-        throw error;
-      }
-    }
-  } finally {
-    rmSync(stagingDir, { recursive: true, force: true });
-  }
-}
-function stageHookRuntime(options = {}) {
-  const root = packageRoot();
-  const sourceDir = options.sourceDir ?? (root ? join2(root, "dist", "hook-runtime") : null);
-  const version = options.version ?? packageVersion();
-  const nodePath = resolve2(options.nodePath ?? process.execPath);
-  if (!sourceDir || !version || compareSemver(version, version) !== 0 || !isAbsolute(nodePath) || /[\r\n]/u.test(nodePath)) {
-    throw new Error("cannot stage hook runtime: package identity is unavailable");
-  }
-  const manifest = sourceManifest(sourceDir, version, nodePath);
-  const paths = hookRuntimePaths(options);
-  const releaseName = `${RELEASE_PREFIX}${releaseId(manifest)}`;
-  const releaseDir = join2(paths.releasesDir, releaseName);
-  mkdirSync2(paths.releasesDir, { recursive: true, mode: DIRECTORY_MODE });
-  chmodSync(paths.configDir, DIRECTORY_MODE);
-  chmodSync(paths.runtimeDir, DIRECTORY_MODE);
-  chmodSync(paths.releasesDir, DIRECTORY_MODE);
-  return withFileLockSync(paths.selectionLock, () => {
-    const now = Date.now();
-    const selected = readSelectedRelease(paths);
-    if (selected) utimesSync(selected.dir, now / 1e3, now / 1e3);
-    const precedence = selected ? compareSemver(selected.manifest.version, manifest.version) : -1;
-    if (precedence === void 0) {
-      throw new Error("cannot stage hook runtime: selected release version is malformed");
-    }
-    const selectRequested = !selected || precedence < 0;
-    const requestedExists = existsSync3(releaseDir);
-    const protectedBefore = new Set(selected ? [selected.name] : []);
-    if (selectRequested && requestedExists) protectedBefore.add(releaseName);
-    pruneReleases(paths, protectedBefore, selectRequested && !requestedExists ? 1 : 0, now);
-    if (selectRequested && !validateRelease(releaseDir, manifest)) {
-      if (requestedExists) {
-        throw new Error("cannot stage hook runtime: immutable release is corrupt");
-      }
-      writeRelease(sourceDir, releaseDir, manifest, paths.releasesDir);
-    }
-    const finalRelease = selectRequested ? { name: releaseName, dir: releaseDir, manifest } : selected;
-    const launcherCurrent = (() => {
-      try {
-        return readFileSync3(paths.launcher, "utf8") === STABLE_HOOK_LAUNCHER_CONTENT;
-      } catch {
-        return false;
-      }
-    })();
-    const selectorCurrent = selected?.name === finalRelease.name;
-    if (!launcherCurrent) {
-      atomicWriteFile(paths.launcher, STABLE_HOOK_LAUNCHER_CONTENT, {
-        ensureParent: true,
-        mode: LAUNCHER_MODE
-      });
-    }
-    if (!selectorCurrent) {
-      syncDirectory(paths.releasesDir);
-      atomicWriteFile(paths.current, `${finalRelease.name}
-`, {
-        ensureParent: true,
-        mode: DATA_FILE_MODE
-      });
-    }
-    utimesSync(finalRelease.dir, now / 1e3, now / 1e3);
-    pruneReleases(
-      paths,
-      /* @__PURE__ */ new Set([finalRelease.name, ...selected ? [selected.name] : []]),
-      0,
-      now
-    );
-    return {
-      changed: !launcherCurrent || !selectorCurrent,
-      releaseDir: finalRelease.dir,
-      manifest: finalRelease.manifest,
-      paths
-    };
-  });
-}
-function lstatIfPresent2(path) {
-  try {
-    return lstatSync2(path);
-  } catch (error) {
-    const code = error.code;
-    if (code === "ENOENT" || code === "ENOTDIR") return void 0;
-    throw error;
-  }
-}
-function assertOwnedHookRuntime(paths) {
-  const launcher = lstatIfPresent2(paths.launcher);
-  if (launcher) {
-    if (!launcher.isFile() || readFileSync3(paths.launcher, "utf8") !== STABLE_HOOK_LAUNCHER_CONTENT) {
-      throw new Error(`refusing to remove unrecognized hook launcher at ${paths.launcher}`);
-    }
-  }
-  const runtime = lstatIfPresent2(paths.runtimeDir);
-  if (!runtime) return;
-  if (!runtime.isDirectory()) {
-    throw new Error(`refusing to remove non-directory hook runtime at ${paths.runtimeDir}`);
-  }
-  const allowed = /* @__PURE__ */ new Set(["current", "releases", "selection.lock"]);
-  const unexpected = readdirSync2(paths.runtimeDir).filter((entry) => !allowed.has(entry));
-  if (unexpected.length > 0) {
-    throw new Error(
-      `refusing to remove hook runtime with unrecognized entries: ${unexpected.sort().join(", ")}`
-    );
-  }
-  const current = lstatIfPresent2(paths.current);
-  const releases = lstatIfPresent2(paths.releasesDir);
-  if (current) {
-    if (!current.isFile() || !releases || !readSelectedRelease(paths)) {
-      throw new Error(`refusing to remove malformed hook runtime selection at ${paths.current}`);
-    }
-  }
-  if (!releases) return;
-  if (!releases.isDirectory()) {
-    throw new Error(`refusing to remove non-directory hook releases at ${paths.releasesDir}`);
-  }
-  for (const entry of readdirSync2(paths.releasesDir, { withFileTypes: true })) {
-    const releaseDir = join2(paths.releasesDir, entry.name);
-    if (!entry.isDirectory() || !RELEASE_NAME_RE.test(entry.name) || !readReleaseManifest(releaseDir, entry.name)) {
-      throw new Error(`refusing to remove unrecognized hook release ${releaseDir}`);
-    }
-  }
-}
-function removeHookRuntime(options = {}) {
-  const paths = hookRuntimePaths(options);
-  const hadLauncher = lstatIfPresent2(paths.launcher) !== void 0;
-  const hadRuntime = lstatIfPresent2(paths.runtimeDir) !== void 0;
-  if (!hadLauncher && !hadRuntime) return { changed: false, paths };
-  assertOwnedHookRuntime(paths);
-  if (!hadRuntime) {
-    rmSync(paths.launcher, { force: true });
-    return { changed: hadLauncher, paths };
-  }
-  withFileLockSync(paths.selectionLock, () => {
-    assertOwnedHookRuntime(paths);
-    if (lstatIfPresent2(paths.launcher)) rmSync(paths.launcher, { force: true });
-    const quarantined = `${paths.runtimeDir}.uninstall-${String(process.pid)}-${randomBytes3(8).toString("hex")}`;
-    renameSync(paths.runtimeDir, quarantined);
-    rmSync(quarantined, { recursive: true, force: true });
-  });
-  return { changed: true, paths };
-}
-
-// src/commands/claude-install.ts
-var CAPTURE_BIN = "prim-hook";
-var GATE_BIN = "prim-pre-tool-use";
-var POST_TOOL_USE_BIN = "prim-post-tool-use";
-var SESSION_START_BIN = "prim-session-start";
-var SESSION_END_BIN = "prim-session-end";
-var STATUSLINE_BIN = "prim-statusline";
-var STATUSLINE_ARGS = "";
-var STATUSLINE_COMMAND = stableHookCommand(STATUSLINE_BIN, STATUSLINE_ARGS);
-var STATUSLINE_REFRESH_SECONDS = 5;
-var PRIM_BINS = [
-  CAPTURE_BIN,
-  GATE_BIN,
-  POST_TOOL_USE_BIN,
-  SESSION_START_BIN,
-  SESSION_END_BIN
-];
-var JSON_INDENT = 2;
-var USER_SCOPE_PATH = join3(homedir2(), ".claude", "settings.json");
-function projectRoot() {
-  return gitToplevel() ?? process.cwd();
-}
-var projectScopePath = () => join3(projectRoot(), ".claude", "settings.json");
-var CAPTURE_EVENTS = [
-  "SessionStart",
-  "UserPromptSubmit",
-  "PreToolUse",
-  "PostToolUse",
-  "PostToolUseFailure",
-  "Stop",
-  "SessionEnd",
-  "SubagentStop"
-];
-function makeRegistration(event, matcher, bin, args = "") {
-  return {
-    event,
-    matcher,
-    bin,
-    command: stableHookCommand(bin, args)
-  };
-}
-function makeDetachedRegistration(event, matcher, bin, args = "") {
-  return { event, matcher, bin, command: detachedHookShimCommand(bin, args) };
-}
-var REGISTRATIONS = [
-  ...CAPTURE_EVENTS.map(
-    (event) => event === "SessionEnd" ? makeDetachedRegistration(event, "*", CAPTURE_BIN) : makeRegistration(event, "*", CAPTURE_BIN)
-  ),
-  makeRegistration("PreToolUse", "Edit|Write|MultiEdit|NotebookEdit|Bash", GATE_BIN),
-  makeRegistration("PostToolUse", "Edit|Write|MultiEdit|NotebookEdit|Bash", POST_TOOL_USE_BIN),
-  makeRegistration(
-    "PostToolUseFailure",
-    "Edit|Write|MultiEdit|NotebookEdit|Bash",
-    POST_TOOL_USE_BIN
-  ),
-  makeRegistration("SessionStart", "*", SESSION_START_BIN),
-  makeDetachedRegistration("SessionEnd", "*", SESSION_END_BIN)
-];
-var PRIM_PERMISSION_RULE = "Bash(npx --yes @primitive.ai/prim*)";
-var LEGACY_PRIM_PERMISSION_RULES = [
-  "Bash(npx --yes @primitive.ai/prim@latest:*)",
-  "Bash(npx --yes @primitive.ai/prim:*)"
-];
-var ALL_PRIM_PERMISSION_RULES = /* @__PURE__ */ new Set([
-  PRIM_PERMISSION_RULE,
-  ...LEGACY_PRIM_PERMISSION_RULES
-]);
-var PRIM_AUTOMODE_TRUST = "Primitive CLI (prim): the @primitive.ai/prim npm package \u2014 run via `npx --yes @primitive.ai/prim \u2026` \u2014 and its API at api.getprimitive.ai are trusted developer tooling this user installed for passive decision capture, conflict checks, and team presence. Running prim and its routine API/daemon calls is expected, not untrusted code execution or data exfiltration.";
-var AUTOMODE_DEFAULTS = "$defaults";
-function settingsPathFor(scope) {
-  return scope === "user" ? USER_SCOPE_PATH : projectScopePath();
-}
-function readSettings(path) {
-  if (!existsSync4(path)) {
-    return {};
-  }
-  const raw = readFileSync4(path, "utf-8");
-  try {
-    return JSON.parse(raw);
-  } catch (err) {
-    const detail = err instanceof Error ? err.message : String(err);
-    throw new Error(`${path} is not valid JSON: ${detail}`);
-  }
-}
-function entryHasCommand(entry, bin) {
-  return entry.hooks?.some((h) => commandMatchesBin(h.command, bin)) ?? false;
-}
-function ownedRegistrationEntries(settings) {
-  return Object.entries(settings.hooks ?? {}).flatMap(
-    ([event, entries]) => (entries ?? []).filter((entry) => PRIM_BINS.some((bin) => entryHasCommand(entry, bin))).map((entry) => ({ event, entry }))
-  );
-}
-function hasAnyHookRegistration(settings) {
-  return ownedRegistrationEntries(settings).length > 0;
-}
-function entryMatchesRegistration(owned, registration) {
-  return owned.event === registration.event && owned.entry.matcher === registration.matcher && owned.entry.hooks?.length === 1 && owned.entry.hooks[0].type === "command" && owned.entry.hooks[0].command === registration.command;
-}
-function hasCompleteHookRegistration(settings) {
-  const owned = ownedRegistrationEntries(settings);
-  return owned.length === REGISTRATIONS.length && REGISTRATIONS.every(
-    (registration) => owned.filter((entry) => entryMatchesRegistration(entry, registration)).length === 1
-  );
-}
-function canonicalEntry(reg) {
-  return { matcher: reg.matcher, hooks: [{ type: "command", command: reg.command }] };
-}
-function stripCommand(list, bin) {
-  const out = [];
-  for (const e of list) {
-    const hooks = (e.hooks ?? []).filter((h) => !commandMatchesBin(h.command, bin));
-    if (hooks.length > 0) {
-      out.push({ ...e, hooks });
-    }
-  }
-  return out;
-}
-function ensureRegistration(list, reg, force) {
-  const isCanonical = (e) => e.matcher === reg.matcher && e.hooks?.length === 1 && e.hooks[0].command === reg.command;
-  const hasStray = (e) => !isCanonical(e) && (e.hooks ?? []).some((h) => commandMatchesBin(h.command, reg.bin));
-  if (list.some(isCanonical) && !list.some(hasStray) && !force) {
-    return list;
-  }
-  return [...stripCommand(list, reg.bin), canonicalEntry(reg)];
-}
-var LEGACY_STATUSLINE_COMMAND = "prim statusline";
-var RUNTIME_STATUSLINE_SUFFIXES = [
-  "/prim/runtime/prim-statusline",
-  // One pre-launcher build persisted the JS entry directly. Keep recognizing
-  // it so reinstall migrates and uninstall removes that older staged form.
-  "/prim/runtime/current/prim-statusline"
-];
-function isPrimStatusLine(settings) {
-  const s = settings.statusLine;
-  if (s?.type !== "command") {
-    return false;
-  }
-  const c = (s.command ?? "").trim();
-  return c === LEGACY_STATUSLINE_COMMAND || c.includes("@primitive.ai/prim") && c.includes("statusline") || c.includes("prim-hook-launcher-v1") && commandMatchesBin(c, STATUSLINE_BIN) || RUNTIME_STATUSLINE_SUFFIXES.some((suffix) => c.includes(suffix));
-}
-function hookRuntimeResolutions(settings) {
-  const resolutions = hookCommandResolutions(
-    Object.values(settings.hooks ?? {}).flatMap(
-      (entries) => (entries ?? []).flatMap((entry) => (entry.hooks ?? []).map((hook) => hook.command))
-    ),
-    PRIM_BINS
-  );
-  if (!isPrimStatusLine(settings)) return resolutions;
-  const statusline = hookCommandResolution(settings.statusLine?.command, STATUSLINE_BIN);
-  resolutions.push(statusline ?? { kind: "legacy_path" });
-  return resolutions;
-}
-function inspectHookRuntimeResolutions() {
-  return [
-    ...hookRuntimeResolutions(readSettings(USER_SCOPE_PATH)),
-    ...hookRuntimeResolutions(readSettings(projectScopePath()))
-  ];
-}
-function applyStatusLine(settings, command = STATUSLINE_COMMAND) {
-  if (command === false) {
-    return isPrimStatusLine(settings) ? { ...settings, statusLine: void 0 } : settings;
-  }
-  if (settings.statusLine && !isPrimStatusLine(settings)) {
-    return settings;
-  }
-  return {
-    ...settings,
-    statusLine: {
-      type: "command",
-      command,
-      refreshInterval: STATUSLINE_REFRESH_SECONDS
-    }
-  };
-}
-function applyPermissions(settings) {
-  const permissions = settings.permissions ?? {};
-  const allow = permissions.allow ?? [];
-  const hasCanonical = allow.includes(PRIM_PERMISSION_RULE);
-  const hasLegacy = allow.some((rule) => LEGACY_PRIM_PERMISSION_RULES.includes(rule));
-  if (hasCanonical && !hasLegacy) {
-    return settings;
-  }
-  const withoutPrim = allow.filter((rule) => !ALL_PRIM_PERMISSION_RULES.has(rule));
-  return {
-    ...settings,
-    permissions: { ...permissions, allow: [...withoutPrim, PRIM_PERMISSION_RULE] }
-  };
-}
-function removePrimPermission(settings) {
-  const permissions = settings.permissions;
-  if (!permissions?.allow?.some((rule) => ALL_PRIM_PERMISSION_RULES.has(rule))) {
-    return settings;
-  }
-  const allow = permissions.allow.filter((rule) => !ALL_PRIM_PERMISSION_RULES.has(rule));
-  const nextPermissions = {
-    ...permissions,
-    allow: allow.length > 0 ? allow : void 0
-  };
-  const hasOtherPerms = Object.values(nextPermissions).some((v) => v !== void 0);
-  return { ...settings, permissions: hasOtherPerms ? nextPermissions : void 0 };
-}
-function applyAutoModeTrust(settings) {
-  const autoMode = settings.autoMode ?? {};
-  const env = autoMode.environment;
-  if (env?.includes(PRIM_AUTOMODE_TRUST)) {
-    return settings;
-  }
-  const nextEnv = env ? [...env, PRIM_AUTOMODE_TRUST] : [AUTOMODE_DEFAULTS, PRIM_AUTOMODE_TRUST];
-  return { ...settings, autoMode: { ...autoMode, environment: nextEnv } };
-}
-function removeAutoModeTrust(settings) {
-  const autoMode = settings.autoMode;
-  if (!autoMode?.environment?.includes(PRIM_AUTOMODE_TRUST)) {
-    return settings;
-  }
-  const env = autoMode.environment.filter((e) => e !== PRIM_AUTOMODE_TRUST);
-  const onlyDefaultsLeft = env.length === 0 || env.length === 1 && env[0] === AUTOMODE_DEFAULTS;
-  const nextAutoMode = {
-    ...autoMode,
-    environment: onlyDefaultsLeft ? void 0 : env
-  };
-  const hasOther = Object.values(nextAutoMode).some((v) => v !== void 0);
-  return { ...settings, autoMode: hasOther ? nextAutoMode : void 0 };
-}
-function applyInstall(settings, options = {}) {
-  const hooks = { ...settings.hooks ?? {} };
-  for (const reg of REGISTRATIONS) {
-    hooks[reg.event] = ensureRegistration(hooks[reg.event] ?? [], reg, options.force ?? false);
-  }
-  return applyPermissions(
-    applyStatusLine(
-      { ...settings, hooks },
-      options.installStatusline === false ? false : options.statuslineCommand ?? STATUSLINE_COMMAND
-    )
-  );
-}
-function applyUninstall(settings) {
-  const source = settings.hooks ?? {};
-  const hooks = {};
-  for (const event of Object.keys(source)) {
-    let list = source[event] ?? [];
-    for (const bin of PRIM_BINS) {
-      list = stripCommand(list, bin);
-    }
-    if (list.length > 0) {
-      hooks[event] = list;
-    }
-  }
-  const next = { ...settings, hooks };
-  if (isPrimStatusLine(next)) {
-    next.statusLine = void 0;
-  }
-  return removeAutoModeTrust(removePrimPermission(next));
-}
-function captureInstalled(settings) {
-  return CAPTURE_EVENTS.some(
-    (event) => (settings.hooks?.[event] ?? []).some((e) => entryHasCommand(e, CAPTURE_BIN))
-  );
-}
-function feedbackInstalled(settings) {
-  const stopCapture = (settings.hooks?.Stop ?? []).some(
-    (entry) => entryHasCommand(entry, CAPTURE_BIN)
-  );
-  const sessionStart = (settings.hooks?.SessionStart ?? []).some(
-    (entry) => entryHasCommand(entry, SESSION_START_BIN)
-  );
-  return stopCapture && sessionStart;
-}
-function statuslineInstalled(settings) {
-  return isPrimStatusLine(settings);
-}
-function statuslineState(settings) {
-  if (isPrimStatusLine(settings)) {
-    return "primitive";
-  }
-  return settings.statusLine ? "custom" : "empty";
-}
-function isGateInstalled(settings) {
-  return (settings.hooks?.PreToolUse ?? []).some((e) => entryHasCommand(e, GATE_BIN));
-}
-function atomicWrite(path, content) {
-  atomicWriteFile(path, `${JSON.stringify(content, null, JSON_INDENT)}
-`, {
-    ensureParent: true
-  });
-}
-function userStatuslineBlocksProjectInstall(scope, userSettings) {
-  return scope === "project" && statuslineState(userSettings) === "custom";
-}
-function performInstall(scope, force) {
-  stageHookRuntime();
-  const path = settingsPathFor(scope);
-  const before = readSettings(path);
-  const blockedByUserStatusline = userStatuslineBlocksProjectInstall(
-    scope,
-    scope === "project" ? readSettings(USER_SCOPE_PATH) : {}
-  );
-  const after = applyInstall(before, {
-    force,
-    statuslineCommand: STATUSLINE_COMMAND,
-    installStatusline: !blockedByUserStatusline
-  });
-  const changed = JSON.stringify(before) !== JSON.stringify(after);
-  if (changed) {
-    atomicWrite(path, after);
-  }
-  return {
-    scope,
-    path,
-    gate: isGateInstalled(after),
-    capture: captureInstalled(after),
-    feedback: feedbackInstalled(after),
-    statusline: statuslineInstalled(after),
-    statuslineState: statuslineState(after),
-    changed
-  };
-}
-function performUninstall(scope) {
-  const path = settingsPathFor(scope);
-  const before = readSettings(path);
-  const after = applyUninstall(before);
-  const changed = JSON.stringify(before) !== JSON.stringify(after);
-  if (changed) {
-    atomicWrite(path, after);
-  }
-  return {
-    scope,
-    path,
-    gate: isGateInstalled(after),
-    capture: captureInstalled(after),
-    feedback: feedbackInstalled(after),
-    statusline: statuslineInstalled(after),
-    statuslineState: statuslineState(after),
-    changed
-  };
-}
-function performPermissionInstall(scope) {
-  const path = settingsPathFor(scope);
-  const before = readSettings(path);
-  const after = applyAutoModeTrust(applyPermissions(before));
-  const changed = JSON.stringify(before) !== JSON.stringify(after);
-  if (changed) {
-    atomicWrite(path, after);
-  }
-  return {
-    scope,
-    path,
-    allowed: (after.permissions?.allow ?? []).includes(PRIM_PERMISSION_RULE),
-    autoModeTrusted: (after.autoMode?.environment ?? []).includes(PRIM_AUTOMODE_TRUST),
-    changed
-  };
-}
-function performStatus() {
-  const statusFor = (path) => {
-    const settings = readSettings(path);
-    return {
-      path,
-      present: hasAnyHookRegistration(settings) || statuslineInstalled(settings),
-      gate: isGateInstalled(settings),
-      capture: captureInstalled(settings),
-      feedback: feedbackInstalled(settings),
-      complete: hasCompleteHookRegistration(settings),
-      statusline: statuslineInstalled(settings),
-      statuslineState: statuslineState(settings)
-    };
-  };
-  return { user: statusFor(USER_SCOPE_PATH), project: statusFor(projectScopePath()) };
-}
-function resolveScope(input) {
-  if (input === void 0 || input === "project") {
-    return "project";
-  }
-  if (input === "user") {
-    return "user";
-  }
-  console.error(`[prim] unknown --scope "${input}" (expected: user or project)`);
-  process.exit(1);
-}
-function registerClaudeCommands(program2) {
-  const claude = program2.command("claude").description("Manage the prim Claude Code integration (capture, gate, ingest, presence)");
-  claude.command("install").description("Register the prim hooks + statusline in Claude Code's settings.json").option(
-    "--scope <scope>",
-    "project (default, the repo's .claude/settings.json) or user (~/.claude/settings.json)"
-  ).option("--force", "Replace any drifted prim hook entries").action((opts) => {
-    const scope = resolveScope(opts.scope);
-    const result = performInstall(scope, opts.force ?? false);
-    if (result.changed) {
-      console.error(
-        `[prim] Claude Code integration installed (${scope} scope) at ${result.path}`
-      );
-    } else {
-      console.error(
-        `[prim] Claude Code integration already present at ${result.path} (no changes)`
-      );
+      try {
+        postRewriteHook = ensureEffectivePostRewriteHook(root).path;
+      } catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        process.stderr.write(`[prim] post-rewrite hook coverage is degraded: ${detail}
+`);
+      }
+      phase = "GitHub repo connection";
+      binding = await bindRepository(root);
     }
-    const projectState = scope === "user" ? performStatus().project.statuslineState : void 0;
-    const userState = scope === "project" ? performStatus().user.statuslineState : void 0;
-    if (result.statuslineState === "custom" || projectState === "custom" || userState === "custom") {
-      const owner = result.statuslineState === "custom" ? result.path : projectState === "custom" ? projectScopePath() : USER_SCOPE_PATH;
-      console.error(
-        `[prim] \u26A0 statusline skipped: an existing custom statusLine is preserved at ${owner}; run \`prim daemon status\` for Primitive health`
-      );
+    if (active && binding?.status === "unbound") {
+      const connected = await maybeConnectRepository(root, globals);
+      if (!connected) {
+        process.stderr.write(`[prim] ${GITHUB_CONNECTION_REQUIRED}
+`);
+        printJson({
+          active: false,
+          repo: root,
+          bindingStatus: binding.status,
+          repositoryFullName: binding.repositoryFullName,
+          ...postCommitHook ? { postCommitHook } : {},
+          ...postRewriteHook ? { postRewriteHook } : {}
+        });
+        process.exitCode = 1;
+        return;
+      }
+      binding = connected;
     }
-    console.log(JSON.stringify(result, null, JSON_INDENT));
-  });
-  claude.command("preauth").description(
-    "Pre-authorize prim's own calls (allow-rule + auto-mode trust, no hooks) so they never prompt"
-  ).option(
-    "--scope <scope>",
-    "user (default for preauth \u2014 covers every repo) or project (this repo's .claude/settings.json)"
-  ).action((opts) => {
-    const scope = resolveScope(opts.scope ?? "user");
-    const result = performPermissionInstall(scope);
-    console.error(
-      result.changed ? `[prim] prim pre-authorization written (${scope} scope) at ${result.path} (allow-rule + auto-mode trust)` : `[prim] prim pre-authorization already present at ${result.path} (no changes)`
-    );
-    console.log(JSON.stringify(result, null, JSON_INDENT));
-  });
-  claude.command("uninstall").description("Remove all prim hooks + the prim statusline from settings.json").option(
-    "--scope <scope>",
-    "project (default, the repo's .claude/settings.json) or user (~/.claude/settings.json)"
-  ).action((opts) => {
-    const scope = resolveScope(opts.scope);
-    const result = performUninstall(scope);
-    if (result.changed) {
-      console.error(`[prim] prim hooks removed from ${result.path}`);
-    } else {
-      console.error(`[prim] no prim hooks to remove at ${result.path} (nothing changed)`);
+    if (active) {
+      try {
+        await fetchAndCacheCollectScope(root);
+      } catch {
+      }
     }
-    console.log(JSON.stringify(result, null, JSON_INDENT));
-  });
-  claude.command("status").description(
-    "Report whether each prim surface (gate, capture, feedback, statusline) is installed per scope"
-  ).action(() => {
-    const result = performStatus();
-    const mark = (b) => b ? "\u2713" : "\u2717";
-    const line = (label, s) => `[prim] ${label}: gate ${mark(s.gate)} \xB7 capture ${mark(s.capture)} \xB7 feedback ${mark(s.feedback)} \xB7 statusline ${s.statuslineState} (${s.path})`;
-    console.error(`${line("user", result.user)}
-${line("project", result.project)}`);
-    console.log(JSON.stringify(result, null, JSON_INDENT));
-  });
+    phase = "local activation";
+    setRepoActive(root, active);
+    await daemonRequest("statusline_invalidate", {}, { timeoutMs: 250 });
+    process.stderr.write(`[prim] prim ${active ? "enabled" : "disabled"} in ${root}
+`);
+    printJson({
+      active,
+      repo: root,
+      ...binding ? {
+        bindingStatus: binding.status,
+        repositoryFullName: binding.repositoryFullName,
+        ...binding.status === "connected" ? { repoSyncId: binding.repoSyncId } : {}
+      } : {},
+      ...postCommitHook ? { postCommitHook } : {},
+      ...postRewriteHook ? { postRewriteHook } : {}
+    });
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    process.stderr.write(
+      active ? `[prim] failed to enable prim during ${phase}: ${detail}
+` : `[prim] failed to disable prim: ${detail}
+`
+    );
+    process.exit(1);
+  }
+}
+function registerActivationCommands(program2) {
+  program2.command("enable").description("Activate prim's hooks in this repo (git config prim.active=true)").action((_opts, command) => applyActivation(true, command.optsWithGlobals()));
+  program2.command("disable").description("Mute prim's hooks in this repo (git config prim.active=false)").action(
+    (_opts, command) => applyActivation(false, command.optsWithGlobals())
+  );
 }
 
 // src/commands/codex-install.ts
-import { homedir as homedir3 } from "os";
-import { join as join4 } from "path";
-var CAPTURE_BIN2 = "prim-hook";
-var GATE_BIN2 = "prim-pre-tool-use";
-var POST_TOOL_USE_BIN2 = "prim-post-tool-use";
-var SESSION_START_BIN2 = "prim-session-start";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+var CAPTURE_BIN = "prim-hook";
+var GATE_BIN = "prim-pre-tool-use";
+var POST_TOOL_USE_BIN = "prim-post-tool-use";
+var SESSION_START_BIN = "prim-session-start";
 var CODEX_ARGS = "--agent codex";
 var CODEX_EDIT_MATCHER = "apply_patch|Bash";
 var CODEX_POST_TOOL_MATCHER = "apply_patch|Bash";
-var JSON_INDENT2 = 2;
+var JSON_INDENT = 2;
 var CODEX_CAPTURE_EVENTS = [
   "SessionStart",
   "UserPromptSubmit",
@@ -2951,31 +2010,31 @@ var CODEX_CAPTURE_EVENTS = [
   "Stop",
   "SubagentStop"
 ];
-var PRIM_BINS2 = [CAPTURE_BIN2, GATE_BIN2, POST_TOOL_USE_BIN2, SESSION_START_BIN2];
+var PRIM_BINS = [CAPTURE_BIN, GATE_BIN, POST_TOOL_USE_BIN, SESSION_START_BIN];
 var CODEX_REGISTRATIONS = [
-  ...CODEX_CAPTURE_EVENTS.map((event) => makeRegistration(event, "*", CAPTURE_BIN2, CODEX_ARGS)),
-  makeRegistration("PreToolUse", CODEX_EDIT_MATCHER, GATE_BIN2, CODEX_ARGS),
-  makeRegistration("PostToolUse", CODEX_POST_TOOL_MATCHER, POST_TOOL_USE_BIN2, CODEX_ARGS),
-  makeRegistration("SessionStart", "*", SESSION_START_BIN2, CODEX_ARGS)
+  ...CODEX_CAPTURE_EVENTS.map((event) => makeRegistration(event, "*", CAPTURE_BIN, CODEX_ARGS)),
+  makeRegistration("PreToolUse", CODEX_EDIT_MATCHER, GATE_BIN, CODEX_ARGS),
+  makeRegistration("PostToolUse", CODEX_POST_TOOL_MATCHER, POST_TOOL_USE_BIN, CODEX_ARGS),
+  makeRegistration("SessionStart", "*", SESSION_START_BIN, CODEX_ARGS)
 ];
-var USER_SCOPE_PATH2 = join4(homedir3(), ".codex", "hooks.json");
-var projectScopePath2 = () => join4(projectRoot(), ".codex", "hooks.json");
-function settingsPathFor2(scope) {
-  return scope === "user" ? USER_SCOPE_PATH2 : projectScopePath2();
+var USER_SCOPE_PATH = join2(homedir2(), ".codex", "hooks.json");
+var projectScopePath = () => join2(projectRoot(), ".codex", "hooks.json");
+function settingsPathFor(scope) {
+  return scope === "user" ? USER_SCOPE_PATH : projectScopePath();
 }
-function applyInstall2(settings, options = {}) {
+function applyInstall(settings, options = {}) {
   const hooks = { ...settings.hooks ?? {} };
   for (const reg of CODEX_REGISTRATIONS) {
     hooks[reg.event] = ensureRegistration(hooks[reg.event] ?? [], reg, options.force ?? false);
   }
   return { ...settings, hooks };
 }
-function applyUninstall2(settings) {
+function applyUninstall(settings) {
   const source = settings.hooks ?? {};
   const hooks = {};
   for (const event of Object.keys(source)) {
     let list = source[event] ?? [];
-    for (const bin of PRIM_BINS2) {
+    for (const bin of PRIM_BINS) {
       list = stripCommand(list, bin);
     }
     if (list.length > 0) {
@@ -2984,89 +2043,89 @@ function applyUninstall2(settings) {
   }
   return { ...settings, hooks };
 }
-function captureInstalled2(settings) {
+function captureInstalled(settings) {
   return CODEX_CAPTURE_EVENTS.some(
-    (event) => (settings.hooks?.[event] ?? []).some((e) => entryHasCommand(e, CAPTURE_BIN2))
+    (event) => (settings.hooks?.[event] ?? []).some((e) => entryHasCommand(e, CAPTURE_BIN))
   );
 }
-function ownedRegistrationEntries2(settings) {
+function ownedRegistrationEntries(settings) {
   return Object.entries(settings.hooks ?? {}).flatMap(
-    ([event, entries]) => (entries ?? []).filter((entry) => PRIM_BINS2.some((bin) => entryHasCommand(entry, bin))).map((entry) => ({ event, entry }))
+    ([event, entries]) => (entries ?? []).filter((entry) => PRIM_BINS.some((bin) => entryHasCommand(entry, bin))).map((entry) => ({ event, entry }))
   );
 }
-function hasAnyHookRegistration2(settings) {
-  return ownedRegistrationEntries2(settings).length > 0;
+function hasAnyHookRegistration(settings) {
+  return ownedRegistrationEntries(settings).length > 0;
 }
-function hookRuntimeResolutions2(settings) {
+function hookRuntimeResolutions(settings) {
   return hookCommandResolutions(
     Object.values(settings.hooks ?? {}).flatMap(
       (entries) => (entries ?? []).flatMap((entry) => (entry.hooks ?? []).map((hook) => hook.command))
     ),
-    PRIM_BINS2
+    PRIM_BINS
   );
 }
-function inspectHookRuntimeResolutions2() {
+function inspectHookRuntimeResolutions3() {
   return [
-    ...hookRuntimeResolutions2(readSettings(USER_SCOPE_PATH2)),
-    ...hookRuntimeResolutions2(readSettings(projectScopePath2()))
+    ...hookRuntimeResolutions(readSettings(USER_SCOPE_PATH)),
+    ...hookRuntimeResolutions(readSettings(projectScopePath()))
   ];
 }
-function entryMatchesRegistration2(owned, registration) {
+function entryMatchesRegistration(owned, registration) {
   return owned.event === registration.event && owned.entry.matcher === registration.matcher && owned.entry.hooks?.length === 1 && owned.entry.hooks[0].type === "command" && owned.entry.hooks[0].command === registration.command;
 }
-function hasCompleteHookRegistration2(settings) {
-  const owned = ownedRegistrationEntries2(settings);
+function hasCompleteHookRegistration(settings) {
+  const owned = ownedRegistrationEntries(settings);
   return owned.length === CODEX_REGISTRATIONS.length && CODEX_REGISTRATIONS.every(
-    (registration) => owned.filter((entry) => entryMatchesRegistration2(entry, registration)).length === 1
+    (registration) => owned.filter((entry) => entryMatchesRegistration(entry, registration)).length === 1
   );
 }
-function isGateInstalled2(settings) {
-  return (settings.hooks?.PreToolUse ?? []).some((e) => entryHasCommand(e, GATE_BIN2));
+function isGateInstalled(settings) {
+  return (settings.hooks?.PreToolUse ?? []).some((e) => entryHasCommand(e, GATE_BIN));
 }
 function resultFor(scope, path, after, changed) {
   return {
     scope,
     path,
-    gate: isGateInstalled2(after),
-    capture: captureInstalled2(after),
+    gate: isGateInstalled(after),
+    capture: captureInstalled(after),
     changed
   };
 }
-function performInstall2(scope, force) {
+function performInstall(scope, force) {
   stageHookRuntime();
-  const path = settingsPathFor2(scope);
+  const path = settingsPathFor(scope);
   const before = readSettings(path);
-  const after = applyInstall2(before, { force });
+  const after = applyInstall(before, { force });
   const changed = JSON.stringify(before) !== JSON.stringify(after);
   if (changed) {
     atomicWrite(path, after);
   }
   return resultFor(scope, path, after, changed);
 }
-function performUninstall2(scope) {
-  const path = settingsPathFor2(scope);
+function performUninstall(scope) {
+  const path = settingsPathFor(scope);
   const before = readSettings(path);
-  const after = applyUninstall2(before);
+  const after = applyUninstall(before);
   const changed = JSON.stringify(before) !== JSON.stringify(after);
   if (changed) {
     atomicWrite(path, after);
   }
   return resultFor(scope, path, after, changed);
 }
-function performStatus2() {
+function performStatus3() {
   const statusFor = (path) => {
     const settings = readSettings(path);
     return {
       path,
-      present: hasAnyHookRegistration2(settings),
-      gate: isGateInstalled2(settings),
-      capture: captureInstalled2(settings),
-      complete: hasCompleteHookRegistration2(settings)
+      present: hasAnyHookRegistration(settings),
+      gate: isGateInstalled(settings),
+      capture: captureInstalled(settings),
+      complete: hasCompleteHookRegistration(settings)
     };
   };
-  return { user: statusFor(USER_SCOPE_PATH2), project: statusFor(projectScopePath2()) };
+  return { user: statusFor(USER_SCOPE_PATH), project: statusFor(projectScopePath()) };
 }
-function resolveScope2(input) {
+function resolveScope(input) {
   if (input === void 0 || input === "project") {
     return "project";
   }
@@ -3083,48 +2142,48 @@ function registerCodexCommands(program2) {
     "--scope <scope>",
     "project (default, the repo's .codex/hooks.json) or user (~/.codex/hooks.json)"
   ).option("--force", "Replace any drifted prim hook entries").action((opts) => {
-    const scope = resolveScope2(opts.scope);
-    const result = performInstall2(scope, opts.force ?? false);
+    const scope = resolveScope(opts.scope);
+    const result = performInstall(scope, opts.force ?? false);
     if (result.changed) {
       console.error(`[prim] Codex integration installed (${scope} scope) at ${result.path}`);
     } else {
       console.error(`[prim] Codex integration already present at ${result.path} (no changes)`);
     }
     console.error(TRUST_NOTICE);
-    console.log(JSON.stringify(result, null, JSON_INDENT2));
+    console.log(JSON.stringify(result, null, JSON_INDENT));
   });
   codex.command("uninstall").description("Remove all prim hooks from Codex's hooks.json").option(
     "--scope <scope>",
     "project (default, the repo's .codex/hooks.json) or user (~/.codex/hooks.json)"
   ).action((opts) => {
-    const scope = resolveScope2(opts.scope);
-    const result = performUninstall2(scope);
+    const scope = resolveScope(opts.scope);
+    const result = performUninstall(scope);
     if (result.changed) {
       console.error(`[prim] prim hooks removed from ${result.path}`);
     } else {
       console.error(`[prim] no prim hooks to remove at ${result.path} (nothing changed)`);
     }
-    console.log(JSON.stringify(result, null, JSON_INDENT2));
+    console.log(JSON.stringify(result, null, JSON_INDENT));
   });
   codex.command("status").description("Report whether each prim surface (gate, capture) is installed per scope").action(() => {
-    const result = performStatus2();
+    const result = performStatus3();
     const mark = (b) => b ? "\u2713" : "\u2717";
     const line = (label, s) => `[prim] ${label}: gate ${mark(s.gate)} \xB7 capture ${mark(s.capture)} (${s.path})`;
     console.error(`${line("user", result.user)}
 ${line("project", result.project)}`);
-    console.log(JSON.stringify(result, null, JSON_INDENT2));
+    console.log(JSON.stringify(result, null, JSON_INDENT));
   });
 }
 
 // src/commands/daemon.ts
 import { spawn as spawn2 } from "child_process";
-import { closeSync, existsSync as existsSync6, mkdirSync as mkdirSync4, openSync, readFileSync as readFileSync6, unlinkSync as unlinkSync2 } from "fs";
-import { join as join7 } from "path";
+import { closeSync, existsSync as existsSync4, mkdirSync as mkdirSync3, openSync, readFileSync as readFileSync4, unlinkSync as unlinkSync2 } from "fs";
+import { join as join5 } from "path";
 import { Option as Option2 } from "commander";
 
 // src/daemon/latest-bootstrap.ts
 import { spawn } from "child_process";
-import { join as join5 } from "path";
+import { join as join3 } from "path";
 var LATEST_BOOTSTRAP_TIMEOUT_MS = 45e3;
 var LATEST_BOOTSTRAP_LOCK_NAME = "daemon-latest.lock";
 async function runPinnedEnsure(options) {
@@ -3136,7 +2195,7 @@ async function runPinnedEnsure(options) {
     npm_config_fetch_retry_maxtimeout: "5000",
     npm_config_fetch_timeout: "15000"
   };
-  return await new Promise((resolve6) => {
+  return await new Promise((resolve5) => {
     let settled = false;
     let child;
     try {
@@ -3146,7 +2205,7 @@ async function runPinnedEnsure(options) {
         { env, stdio: "ignore" }
       );
     } catch {
-      resolve6(false);
+      resolve5(false);
       return;
     }
     const timer = setTimeout(() => {
@@ -3157,7 +2216,7 @@ async function runPinnedEnsure(options) {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve6(result);
+      resolve5(result);
     };
     timer.unref();
     child.once("error", () => finish(false));
@@ -3165,7 +2224,7 @@ async function runPinnedEnsure(options) {
   });
 }
 async function runLatestDaemonBootstrap(ensureCurrent, options = {}) {
-  const lockPath = options.lockPath ?? join5(
+  const lockPath = options.lockPath ?? join3(
     primConfigDirectory({ env: options.env, homeDir: options.homeDir }),
     LATEST_BOOTSTRAP_LOCK_NAME
   );
@@ -3189,27 +2248,27 @@ async function runLatestDaemonBootstrap(ensureCurrent, options = {}) {
 
 // src/daemon/launchd.ts
 import { spawnSync } from "child_process";
-import { createHash as createHash3, randomBytes as randomBytes4 } from "crypto";
+import { createHash as createHash2, randomBytes as randomBytes3 } from "crypto";
 import {
-  constants as constants2,
-  accessSync as accessSync2,
-  chmodSync as chmodSync2,
-  copyFileSync as copyFileSync2,
-  existsSync as existsSync5,
-  lstatSync as lstatSync3,
-  mkdirSync as mkdirSync3,
-  mkdtempSync as mkdtempSync2,
-  readFileSync as readFileSync5,
-  readdirSync as readdirSync3,
+  constants,
+  accessSync,
+  chmodSync,
+  copyFileSync,
+  existsSync as existsSync3,
+  lstatSync as lstatSync2,
+  mkdirSync as mkdirSync2,
+  mkdtempSync,
+  readFileSync as readFileSync3,
+  readdirSync as readdirSync2,
   readlinkSync,
-  realpathSync as realpathSync2,
-  renameSync as renameSync2,
-  rmSync as rmSync2,
+  realpathSync,
+  renameSync,
+  rmSync,
   symlinkSync,
-  writeFileSync as writeFileSync3
+  writeFileSync as writeFileSync2
 } from "fs";
-import { homedir as homedir4 } from "os";
-import { basename, dirname as dirname4, isAbsolute as isAbsolute2, join as join6, resolve as resolve3 } from "path";
+import { homedir as homedir3 } from "os";
+import { basename, dirname as dirname2, isAbsolute, join as join4, resolve as resolve2 } from "path";
 
 // src/daemon/env-binding.ts
 function normalizeApiUrl(url) {
@@ -3248,49 +2307,49 @@ var LaunchctlError = class extends Error {
   }
 };
 function xdgDataHome(options) {
-  const home = options.homeDir ?? homedir4();
+  const home = options.homeDir ?? homedir3();
   const configured = (options.env ?? process.env).XDG_DATA_HOME;
-  return configured && isAbsolute2(configured) ? configured : join6(home, ".local", "share");
+  return configured && isAbsolute(configured) ? configured : join4(home, ".local", "share");
 }
 function runtimePaths(options = {}) {
-  const dataDir = join6(xdgDataHome(options), "prim");
-  const runtimeDir = join6(dataDir, "runtime");
-  const currentLink = join6(runtimeDir, "current");
+  const dataDir = join4(xdgDataHome(options), "prim");
+  const runtimeDir = join4(dataDir, "runtime");
+  const currentLink = join4(runtimeDir, "current");
   return {
     dataDir,
     runtimeDir,
-    releasesDir: join6(runtimeDir, "releases"),
+    releasesDir: join4(runtimeDir, "releases"),
     currentLink,
-    statuslineLauncher: join6(runtimeDir, "prim-statusline"),
-    disabledMarker: join6(dataDir, "daemon.disabled"),
-    lifecycleLockDir: join6(dataDir, "daemon.lifecycle.lock")
+    statuslineLauncher: join4(runtimeDir, "prim-statusline"),
+    disabledMarker: join4(dataDir, "daemon.disabled"),
+    lifecycleLockDir: join4(dataDir, "daemon.lifecycle.lock")
   };
 }
 function daemonControlPaths(options = {}) {
   const configDir = primConfigDirectory(options);
   const legacy = runtimePaths(options);
   return {
-    launcher: join6(configDir, `prim-daemon-launcher-v${LAUNCHER_SCHEMA_VERSION}`),
-    disabledMarker: join6(configDir, "daemon.disabled"),
-    lifecycleLockDir: join6(configDir, "daemon.lifecycle.lock"),
+    launcher: join4(configDir, `prim-daemon-launcher-v${LAUNCHER_SCHEMA_VERSION}`),
+    disabledMarker: join4(configDir, "daemon.disabled"),
+    lifecycleLockDir: join4(configDir, "daemon.lifecycle.lock"),
     legacyDisabledMarker: legacy.disabledMarker,
     legacyLifecycleLockDir: legacy.lifecycleLockDir
   };
 }
 function findPackageVersion(entryFile) {
-  let dir = dirname4(resolve3(entryFile));
+  let dir = dirname2(resolve2(entryFile));
   for (let depth = 0; depth < 6; depth++) {
-    const packagePath = join6(dir, "package.json");
-    if (existsSync5(packagePath)) {
+    const packagePath = join4(dir, "package.json");
+    if (existsSync3(packagePath)) {
       try {
-        const manifest = JSON.parse(readFileSync5(packagePath, "utf8"));
+        const manifest = JSON.parse(readFileSync3(packagePath, "utf8"));
         if (manifest.name === "@primitive.ai/prim" && manifest.version) {
           return manifest.version;
         }
       } catch {
       }
     }
-    const parent = dirname4(dir);
+    const parent = dirname2(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -3298,7 +2357,7 @@ function findPackageVersion(entryFile) {
 }
 function readRuntimeManifest(path) {
   try {
-    const parsed = JSON.parse(readFileSync5(path, "utf8"));
+    const parsed = JSON.parse(readFileSync3(path, "utf8"));
     if (parsed.schemaVersion !== RUNTIME_SCHEMA_VERSION || typeof parsed.version !== "string" || typeof parsed.nodePath !== "string" || parsed.daemonFile !== "prim-daemon-server" || typeof parsed.daemonSha256 !== "string" || !/^[a-f0-9]{64}$/u.test(parsed.daemonSha256)) {
       return null;
     }
@@ -3308,19 +2367,19 @@ function readRuntimeManifest(path) {
   }
 }
 var RUNTIME_RELEASE_RE = /^release-[0-9a-f]{16}$/u;
-function exactKeys2(value, expected) {
+function exactKeys(value, expected) {
   const actual = Object.keys(value).sort();
   const wanted = [...expected].sort();
   return actual.length === wanted.length && actual.every((key, index) => key === wanted[index]);
 }
 function readOwnedRuntimeManifest(releaseDir) {
-  const manifestPath = join6(releaseDir, "manifest.json");
-  const daemonPath = join6(releaseDir, "prim-daemon-server");
+  const manifestPath = join4(releaseDir, "manifest.json");
+  const daemonPath = join4(releaseDir, "prim-daemon-server");
   try {
-    const raw = readFileSync5(manifestPath, "utf8");
+    const raw = readFileSync3(manifestPath, "utf8");
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-    if (!exactKeys2(parsed, [
+    if (!exactKeys(parsed, [
       "schemaVersion",
       "version",
       "nodePath",
@@ -3331,11 +2390,11 @@ function readOwnedRuntimeManifest(releaseDir) {
       return null;
     }
     const manifest = parsed;
-    if (manifest.schemaVersion !== RUNTIME_SCHEMA_VERSION || compareSemver(manifest.version, manifest.version) !== 0 || !isAbsolute2(manifest.nodePath) || /[\r\n]/u.test(manifest.nodePath) || manifest.daemonFile !== "prim-daemon-server" || !/^[0-9a-f]{64}$/u.test(manifest.daemonSha256) || new Date(manifest.stagedAt).toISOString() !== manifest.stagedAt || raw !== `${JSON.stringify(manifest, null, 2)}
-` || !lstatSync3(daemonPath).isFile() || sha256File(daemonPath) !== manifest.daemonSha256) {
+    if (manifest.schemaVersion !== RUNTIME_SCHEMA_VERSION || compareSemver(manifest.version, manifest.version) !== 0 || !isAbsolute(manifest.nodePath) || /[\r\n]/u.test(manifest.nodePath) || manifest.daemonFile !== "prim-daemon-server" || !/^[0-9a-f]{64}$/u.test(manifest.daemonSha256) || new Date(manifest.stagedAt).toISOString() !== manifest.stagedAt || raw !== `${JSON.stringify(manifest, null, 2)}
+` || !lstatSync2(daemonPath).isFile() || sha256File(daemonPath) !== manifest.daemonSha256) {
       return null;
     }
-    const entries = readdirSync3(releaseDir).sort();
+    const entries = readdirSync2(releaseDir).sort();
     return entries.length === 2 && entries[0] === "manifest.json" && entries[1] === "prim-daemon-server" ? manifest : null;
   } catch {
     return null;
@@ -3352,25 +2411,25 @@ function sameRuntime(current, desired, daemonPath) {
   }
 }
 function sha256File(path) {
-  return createHash3("sha256").update(readFileSync5(path)).digest("hex");
+  return createHash2("sha256").update(readFileSync3(path)).digest("hex");
 }
 function atomicSymlink(target, linkPath) {
-  const tempLink = `${linkPath}.tmp-${process.pid}-${createHash3("sha256").update(`${target}\0${Date.now()}\0${Math.random()}`).digest("hex").slice(0, 12)}`;
+  const tempLink = `${linkPath}.tmp-${process.pid}-${createHash2("sha256").update(`${target}\0${Date.now()}\0${Math.random()}`).digest("hex").slice(0, 12)}`;
   symlinkSync(target, tempLink);
   try {
-    renameSync2(tempLink, linkPath);
+    renameSync(tempLink, linkPath);
   } catch (error) {
-    rmSync2(tempLink, { force: true });
+    rmSync(tempLink, { force: true });
     throw error;
   }
 }
 function stageRuntime(options = {}) {
   const paths = runtimePaths(options);
   const daemonSource = options.daemonSource ?? binFile("prim-daemon-server");
-  if (!daemonSource || !existsSync5(daemonSource)) {
+  if (!daemonSource || !existsSync3(daemonSource)) {
     throw new Error("cannot stage runtime: prim-daemon-server bundle is unavailable");
   }
-  const nodePath = resolve3(options.nodePath ?? process.execPath);
+  const nodePath = resolve2(options.nodePath ?? process.execPath);
   const version = options.version ?? findPackageVersion(daemonSource);
   const desired = {
     schemaVersion: RUNTIME_SCHEMA_VERSION,
@@ -3382,11 +2441,11 @@ function stageRuntime(options = {}) {
   };
   let currentRelease = null;
   try {
-    currentRelease = realpathSync2(paths.currentLink);
+    currentRelease = realpathSync(paths.currentLink);
   } catch {
   }
-  const current = currentRelease ? readRuntimeManifest(join6(currentRelease, "manifest.json")) : null;
-  const currentDaemon = currentRelease ? join6(currentRelease, desired.daemonFile) : "";
+  const current = currentRelease ? readRuntimeManifest(join4(currentRelease, "manifest.json")) : null;
+  const currentDaemon = currentRelease ? join4(currentRelease, desired.daemonFile) : "";
   if (currentRelease && sameRuntime(current, desired, currentDaemon)) {
     const manifest = current;
     atomicWrite2(
@@ -3401,52 +2460,52 @@ function stageRuntime(options = {}) {
       daemonPath: currentDaemon
     };
   }
-  mkdirSync3(paths.releasesDir, { recursive: true, mode: RUNTIME_DIR_MODE });
-  chmodSync2(paths.runtimeDir, RUNTIME_DIR_MODE);
-  chmodSync2(paths.releasesDir, RUNTIME_DIR_MODE);
-  const stagingDir = mkdtempSync2(join6(paths.releasesDir, ".stage-"));
-  chmodSync2(stagingDir, RUNTIME_DIR_MODE);
+  mkdirSync2(paths.releasesDir, { recursive: true, mode: RUNTIME_DIR_MODE });
+  chmodSync(paths.runtimeDir, RUNTIME_DIR_MODE);
+  chmodSync(paths.releasesDir, RUNTIME_DIR_MODE);
+  const stagingDir = mkdtempSync(join4(paths.releasesDir, ".stage-"));
+  chmodSync(stagingDir, RUNTIME_DIR_MODE);
   let releaseDir;
   try {
-    const daemonTarget = join6(stagingDir, desired.daemonFile);
-    copyFileSync2(daemonSource, daemonTarget);
-    chmodSync2(daemonTarget, RUNTIME_FILE_MODE);
+    const daemonTarget = join4(stagingDir, desired.daemonFile);
+    copyFileSync(daemonSource, daemonTarget);
+    chmodSync(daemonTarget, RUNTIME_FILE_MODE);
     if (sha256File(daemonTarget) !== desired.daemonSha256) {
       throw new Error("cannot stage runtime: daemon bundle changed while it was copied");
     }
-    const manifestTarget = join6(stagingDir, "manifest.json");
-    writeFileSync3(manifestTarget, `${JSON.stringify(desired, null, 2)}
+    const manifestTarget = join4(stagingDir, "manifest.json");
+    writeFileSync2(manifestTarget, `${JSON.stringify(desired, null, 2)}
 `, {
       encoding: "utf8",
       mode: RUNTIME_FILE_MODE,
       flag: "wx"
     });
-    const releaseName = `release-${createHash3("sha256").update(`${version}\0${nodePath}\0${desired.stagedAt}\0${process.pid}\0${Math.random()}`).digest("hex").slice(0, 16)}`;
-    releaseDir = join6(paths.releasesDir, releaseName);
-    renameSync2(stagingDir, releaseDir);
-    releaseDir = realpathSync2(releaseDir);
-    atomicSymlink(join6("releases", releaseName), paths.currentLink);
+    const releaseName = `release-${createHash2("sha256").update(`${version}\0${nodePath}\0${desired.stagedAt}\0${process.pid}\0${Math.random()}`).digest("hex").slice(0, 16)}`;
+    releaseDir = join4(paths.releasesDir, releaseName);
+    renameSync(stagingDir, releaseDir);
+    releaseDir = realpathSync(releaseDir);
+    atomicSymlink(join4("releases", releaseName), paths.currentLink);
     atomicWrite2(
       paths.statuslineLauncher,
       statuslineLauncherContent(desired.version, options),
       RUNTIME_LAUNCHER_MODE
     );
   } catch (error) {
-    rmSync2(stagingDir, { recursive: true, force: true });
+    rmSync(stagingDir, { recursive: true, force: true });
     throw error;
   }
   return {
     changed: true,
     manifest: desired,
     paths,
-    daemonPath: join6(releaseDir, desired.daemonFile)
+    daemonPath: join4(releaseDir, desired.daemonFile)
   };
 }
 function shellQuote(value) {
   return `'${value.replaceAll("'", `'"'"'`)}'`;
 }
 function statuslineLauncherContent(version, options = {}) {
-  const socketPath = join6(primConfigDirectory(options), "sock");
+  const socketPath = join4(primConfigDirectory(options), "sock");
   const fallback = `primitive ${version} (daemon: down)`;
   return `#!/bin/sh
 response=$(
@@ -3462,14 +2521,14 @@ fi
 `;
 }
 function assertRegularFile(path, label) {
-  const stat = lstatIfPresent3(path);
+  const stat = lstatIfPresent2(path);
   if (stat && !stat.isFile()) {
     throw new Error(`refusing to remove non-file ${label} at ${path}`);
   }
 }
-function lstatIfPresent3(path) {
+function lstatIfPresent2(path) {
   try {
-    return lstatSync3(path);
+    return lstatSync2(path);
   } catch (error) {
     const code = error.code;
     if (code === "ENOENT" || code === "ENOTDIR") return void 0;
@@ -3477,9 +2536,9 @@ function lstatIfPresent3(path) {
   }
 }
 function assertExactFile(path, expected, label) {
-  if (!lstatIfPresent3(path)) return;
+  if (!lstatIfPresent2(path)) return;
   assertRegularFile(path, label);
-  if (readFileSync5(path, "utf8") !== expected) {
+  if (readFileSync3(path, "utf8") !== expected) {
     throw new Error(`refusing to remove unrecognized ${label} at ${path}`);
   }
 }
@@ -3488,18 +2547,18 @@ function assertOwnedDaemonRuntime(options) {
   const control = daemonControlPaths(options);
   const configDir = primConfigDirectory(options);
   const service = process.platform === "darwin" ? launchdPaths(options) : void 0;
-  const logPath = service?.logPath ?? join6(configDir, "daemon.log");
+  const logPath = service?.logPath ?? join4(configDir, "daemon.log");
   for (const activeArtifact of [
-    join6(configDir, "daemon.pid"),
-    join6(configDir, "sock"),
-    join6(configDir, "daemon.lock"),
-    join6(configDir, "client-instance.lock")
+    join4(configDir, "daemon.pid"),
+    join4(configDir, "sock"),
+    join4(configDir, "daemon.lock"),
+    join4(configDir, "client-instance.lock")
   ]) {
-    if (lstatIfPresent3(activeArtifact)) {
+    if (lstatIfPresent2(activeArtifact)) {
       throw new Error(`refusing runtime removal while daemon state remains at ${activeArtifact}`);
     }
   }
-  if (lstatIfPresent3(control.launcher)) {
+  if (lstatIfPresent2(control.launcher)) {
     assertRegularFile(control.launcher, "daemon launcher");
     if (!readDaemonLauncher(control.launcher)) {
       throw new Error(`refusing to remove unrecognized daemon launcher at ${control.launcher}`);
@@ -3514,42 +2573,42 @@ function assertOwnedDaemonRuntime(options) {
     );
   }
   assertRegularFile(logPath, "daemon log");
-  assertRegularFile(join6(configDir, "daemon-health.json"), "daemon health snapshot");
-  assertRegularFile(join6(configDir, "client_instance_id"), "daemon client instance id");
-  if (service && lstatIfPresent3(service.plistPath)) {
+  assertRegularFile(join4(configDir, "daemon-health.json"), "daemon health snapshot");
+  assertRegularFile(join4(configDir, "client_instance_id"), "daemon client instance id");
+  if (service && lstatIfPresent2(service.plistPath)) {
     assertRegularFile(service.plistPath, "launchd property list");
     const expected = generateLaunchAgentPlist({
       launcherPath: control.launcher,
       logPath,
-      workingDirectory: options.homeDir ?? homedir4(),
+      workingDirectory: options.homeDir ?? homedir3(),
       label: options.label
     });
-    if (readFileSync5(service.plistPath, "utf8") !== expected) {
+    if (readFileSync3(service.plistPath, "utf8") !== expected) {
       throw new Error(
         `refusing to remove unrecognized launchd property list at ${service.plistPath}`
       );
     }
   }
-  const runtimeDirectory = lstatIfPresent3(runtime.runtimeDir);
+  const runtimeDirectory = lstatIfPresent2(runtime.runtimeDir);
   if (!runtimeDirectory) return;
   if (!runtimeDirectory.isDirectory()) {
     throw new Error(`refusing to remove non-directory daemon runtime at ${runtime.runtimeDir}`);
   }
   const allowed = /* @__PURE__ */ new Set(["current", "prim-statusline", "releases"]);
-  const unexpected = readdirSync3(runtime.runtimeDir).filter((entry) => !allowed.has(entry));
+  const unexpected = readdirSync2(runtime.runtimeDir).filter((entry) => !allowed.has(entry));
   if (unexpected.length > 0) {
     throw new Error(
       `refusing to remove daemon runtime with unrecognized entries: ${unexpected.sort().join(", ")}`
     );
   }
   const manifests = /* @__PURE__ */ new Map();
-  const releasesDirectory = lstatIfPresent3(runtime.releasesDir);
+  const releasesDirectory = lstatIfPresent2(runtime.releasesDir);
   if (releasesDirectory) {
     if (!releasesDirectory.isDirectory()) {
       throw new Error(`refusing to remove non-directory daemon releases at ${runtime.releasesDir}`);
     }
-    for (const entry of readdirSync3(runtime.releasesDir, { withFileTypes: true })) {
-      const releaseDir = join6(runtime.releasesDir, entry.name);
+    for (const entry of readdirSync2(runtime.releasesDir, { withFileTypes: true })) {
+      const releaseDir = join4(runtime.releasesDir, entry.name);
       const manifest = entry.isDirectory() && RUNTIME_RELEASE_RE.test(entry.name) ? readOwnedRuntimeManifest(releaseDir) : null;
       if (!manifest) {
         throw new Error(`refusing to remove unrecognized daemon release ${releaseDir}`);
@@ -3558,7 +2617,7 @@ function assertOwnedDaemonRuntime(options) {
     }
   }
   let selected;
-  const currentLink = lstatIfPresent3(runtime.currentLink);
+  const currentLink = lstatIfPresent2(runtime.currentLink);
   if (currentLink) {
     if (!currentLink.isSymbolicLink()) {
       throw new Error(
@@ -3567,7 +2626,7 @@ function assertOwnedDaemonRuntime(options) {
     }
     const target = readlinkSync(runtime.currentLink);
     const releaseName = basename(target);
-    if (target !== join6("releases", releaseName) || !RUNTIME_RELEASE_RE.test(releaseName)) {
+    if (target !== join4("releases", releaseName) || !RUNTIME_RELEASE_RE.test(releaseName)) {
       throw new Error(
         `refusing to remove malformed daemon runtime selector ${runtime.currentLink}`
       );
@@ -3577,7 +2636,7 @@ function assertOwnedDaemonRuntime(options) {
       throw new Error(`refusing to remove missing selected daemon release ${releaseName}`);
     }
   }
-  if (lstatIfPresent3(runtime.statuslineLauncher)) {
+  if (lstatIfPresent2(runtime.statuslineLauncher)) {
     if (!selected) {
       throw new Error(
         `refusing to remove daemon statusline without a selected runtime at ${runtime.statuslineLauncher}`
@@ -3595,7 +2654,7 @@ async function removeDaemonRuntime(options = {}) {
   const control = daemonControlPaths(options);
   const configDir = primConfigDirectory(options);
   const service = process.platform === "darwin" ? launchdPaths(options) : void 0;
-  const logPath = service?.logPath ?? join6(configDir, "daemon.log");
+  const logPath = service?.logPath ?? join4(configDir, "daemon.log");
   const ownedArtifacts = [
     runtime.runtimeDir,
     control.launcher,
@@ -3603,21 +2662,21 @@ async function removeDaemonRuntime(options = {}) {
     control.legacyDisabledMarker,
     ...service ? [service.plistPath] : [],
     logPath,
-    join6(configDir, "daemon-health.json"),
-    join6(configDir, "client_instance_id")
+    join4(configDir, "daemon-health.json"),
+    join4(configDir, "client_instance_id")
   ];
-  if (!ownedArtifacts.some((path) => lstatIfPresent3(path))) {
+  if (!ownedArtifacts.some((path) => lstatIfPresent2(path))) {
     return { changed: false, runtimePaths: runtime };
   }
   return withDaemonLifecycleLock(async () => {
     assertOwnedDaemonRuntime(options);
     for (const path of ownedArtifacts.filter((candidate) => candidate !== runtime.runtimeDir)) {
-      rmSync2(path, { force: true });
+      rmSync(path, { force: true });
     }
-    if (lstatIfPresent3(runtime.runtimeDir)) {
-      const quarantined = `${runtime.runtimeDir}.uninstall-${String(process.pid)}-${randomBytes4(8).toString("hex")}`;
-      renameSync2(runtime.runtimeDir, quarantined);
-      rmSync2(quarantined, { recursive: true, force: true });
+    if (lstatIfPresent2(runtime.runtimeDir)) {
+      const quarantined = `${runtime.runtimeDir}.uninstall-${String(process.pid)}-${randomBytes3(8).toString("hex")}`;
+      renameSync(runtime.runtimeDir, quarantined);
+      rmSync(quarantined, { recursive: true, force: true });
     }
     return { changed: true, runtimePaths: runtime };
   }, options);
@@ -3632,7 +2691,7 @@ function generateDaemonLauncher(config) {
     apiUrl: apiUrl ?? null,
     ...config.configDir ? { configDir: config.configDir } : {}
   };
-  const revision = createHash3("sha256").update(JSON.stringify(metadata)).digest("hex");
+  const revision = createHash2("sha256").update(JSON.stringify(metadata)).digest("hex");
   const encoded = Buffer.from(JSON.stringify({ ...metadata, revision })).toString("base64url");
   return {
     revision,
@@ -3648,11 +2707,11 @@ ${config.configDir ? `export PRIM_CONFIG_DIR=${shellQuote(config.configDir)}
 }
 function readDaemonLauncher(path) {
   try {
-    const content = readFileSync5(path, "utf8");
+    const content = readFileSync3(path, "utf8");
     const encoded = /^# prim-daemon-launcher: ([A-Za-z0-9_-]+)$/mu.exec(content)?.[1];
     if (!encoded) return null;
     const value = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
-    if (value.schemaVersion !== LAUNCHER_SCHEMA_VERSION || typeof value.nodePath !== "string" || typeof value.daemonPath !== "string" || typeof value.runtimeVersion !== "string" || value.apiUrl !== null && typeof value.apiUrl !== "string" || value.configDir !== void 0 && (typeof value.configDir !== "string" || !isAbsolute2(value.configDir)) || typeof value.revision !== "string") {
+    if (value.schemaVersion !== LAUNCHER_SCHEMA_VERSION || typeof value.nodePath !== "string" || typeof value.daemonPath !== "string" || typeof value.runtimeVersion !== "string" || value.apiUrl !== null && typeof value.apiUrl !== "string" || value.configDir !== void 0 && (typeof value.configDir !== "string" || !isAbsolute(value.configDir)) || typeof value.revision !== "string") {
       return null;
     }
     const config = {
@@ -3671,9 +2730,9 @@ function readDaemonLauncher(path) {
 function readUsableDaemonConfig(path) {
   const config = readDaemonLauncher(path);
   if (!config) return null;
-  const manifest = readRuntimeManifest(join6(dirname4(config.daemonPath), "manifest.json"));
+  const manifest = readRuntimeManifest(join4(dirname2(config.daemonPath), "manifest.json"));
   try {
-    accessSync2(config.nodePath, constants2.X_OK);
+    accessSync(config.nodePath, constants.X_OK);
     return manifest?.version === config.runtimeVersion && manifest.nodePath === config.nodePath && manifest.daemonSha256 === sha256File(config.daemonPath) ? config : null;
   } catch {
     return null;
@@ -3716,7 +2775,7 @@ function generateLaunchAgentPlist(config) {
 `;
 }
 function launchdPaths(options = {}) {
-  const home = options.homeDir ?? homedir4();
+  const home = options.homeDir ?? homedir3();
   const configDir = primConfigDirectory(options);
   const uid = options.uid ?? process.getuid?.();
   const label = options.label ?? LAUNCHD_LABEL;
@@ -3724,8 +2783,8 @@ function launchdPaths(options = {}) {
   return {
     domainTarget: `gui/${uid}`,
     serviceTarget: `gui/${uid}/${label}`,
-    plistPath: join6(home, "Library", "LaunchAgents", `${label}.plist`),
-    logPath: join6(configDir, "daemon.log")
+    plistPath: join4(home, "Library", "LaunchAgents", `${label}.plist`),
+    logPath: join4(configDir, "daemon.log")
   };
 }
 var runLaunchctl = (args, timeoutMs2 = COMMAND_TIMEOUT_MS) => {
@@ -3758,21 +2817,21 @@ function getLaunchdService(options = {}) {
 }
 function atomicWrite2(path, content, mode, validate) {
   try {
-    if (readFileSync5(path, "utf8") === content) {
-      chmodSync2(path, mode);
+    if (readFileSync3(path, "utf8") === content) {
+      chmodSync(path, mode);
       validate?.(path, COMMAND_TIMEOUT_MS);
       return false;
     }
   } catch {
   }
-  mkdirSync3(dirname4(path), { recursive: true, mode: RUNTIME_DIR_MODE });
+  mkdirSync2(dirname2(path), { recursive: true, mode: RUNTIME_DIR_MODE });
   const temp = `${path}.tmp-${process.pid}-${Date.now()}`;
-  writeFileSync3(temp, content, { encoding: "utf8", mode, flag: "wx" });
+  writeFileSync2(temp, content, { encoding: "utf8", mode, flag: "wx" });
   try {
     validate?.(temp, COMMAND_TIMEOUT_MS);
-    renameSync2(temp, path);
+    renameSync(temp, path);
   } catch (error) {
-    rmSync2(temp, { force: true });
+    rmSync(temp, { force: true });
     throw error;
   }
   return true;
@@ -3799,17 +2858,17 @@ async function inspectDaemon(timeoutMs2) {
 }
 function canonicalProspectivePath(path) {
   const suffix = [];
-  let ancestor = resolve3(path);
-  while (!existsSync5(ancestor)) {
-    const parent = dirname4(ancestor);
-    if (parent === ancestor) return resolve3(path);
+  let ancestor = resolve2(path);
+  while (!existsSync3(ancestor)) {
+    const parent = dirname2(ancestor);
+    if (parent === ancestor) return resolve2(path);
     suffix.unshift(basename(ancestor));
     ancestor = parent;
   }
   try {
-    return join6(realpathSync2(ancestor), ...suffix);
+    return join4(realpathSync(ancestor), ...suffix);
   } catch {
-    return resolve3(path);
+    return resolve2(path);
   }
 }
 async function withDaemonLifecycleLock(operation, options = {}) {
@@ -3822,10 +2881,10 @@ async function withDaemonLifecycleLock(operation, options = {}) {
   );
 }
 async function stopVerifiedLegacyDaemon(options, deadlineMs, nowMs, sleep2) {
-  const pidPath = join6(primConfigDirectory(options), "daemon.pid");
+  const pidPath = join4(primConfigDirectory(options), "daemon.pid");
   let pid;
   try {
-    pid = Number(readFileSync5(pidPath, "utf8").trim());
+    pid = Number(readFileSync3(pidPath, "utf8").trim());
   } catch {
     throw new Error("an unsupervised daemon answered, but it has no verifiable pidfile");
   }
@@ -4002,13 +3061,13 @@ async function waitForAbsence(context) {
 }
 function daemonExplicitlyDisabled(options = {}) {
   const paths = daemonControlPaths(options);
-  return existsSync5(paths.disabledMarker) || existsSync5(paths.legacyDisabledMarker);
+  return existsSync3(paths.disabledMarker) || existsSync3(paths.legacyDisabledMarker);
 }
 function setDaemonExplicitlyDisabled(disabled, options = {}) {
   const paths = daemonControlPaths(options);
   if (!disabled) {
-    rmSync2(paths.disabledMarker, { force: true });
-    rmSync2(paths.legacyDisabledMarker, { force: true });
+    rmSync(paths.disabledMarker, { force: true });
+    rmSync(paths.legacyDisabledMarker, { force: true });
     return;
   }
   const content = DAEMON_DISABLED_CONTENT;
@@ -4025,7 +3084,7 @@ async function ensureMacDaemonLocked(options) {
   let service = getLaunchdService({ ...options, runner });
   if (!options.explicitlyStarted && daemonExplicitlyDisabled(options)) {
     const control2 = daemonControlPaths(options);
-    if (!existsSync5(control2.disabledMarker)) {
+    if (!existsSync3(control2.disabledMarker)) {
       atomicWrite2(control2.disabledMarker, "disabled by `prim daemon stop`\n", RUNTIME_FILE_MODE);
     }
     return {
@@ -4052,7 +3111,7 @@ async function ensureMacDaemonLocked(options) {
   const configuredApiUrl = (options.env ?? process.env).PRIM_API_URL;
   const apiUrl = configuredApiUrl ? normalizeApiUrl(configuredApiUrl) || void 0 : void 0;
   const configDir = primConfigDirectory(options);
-  const legacyDefaultConfigDir = join6(options.homeDir ?? homedir4(), ".config", "prim");
+  const legacyDefaultConfigDir = join4(options.homeDir ?? homedir3(), ".config", "prim");
   const launcherConfigDir = configDir === legacyDefaultConfigDir ? void 0 : configDir;
   if (retainSelected && selected) {
     const usable = readUsableDaemonConfig(control.launcher);
@@ -4079,15 +3138,15 @@ async function ensureMacDaemonLocked(options) {
     };
   }
   const servicePaths = launchdPaths(options);
-  mkdirSync3(dirname4(servicePaths.logPath), { recursive: true, mode: RUNTIME_DIR_MODE });
-  writeFileSync3(servicePaths.logPath, "", { mode: RUNTIME_FILE_MODE, flag: "a" });
-  chmodSync2(servicePaths.logPath, RUNTIME_FILE_MODE);
+  mkdirSync2(dirname2(servicePaths.logPath), { recursive: true, mode: RUNTIME_DIR_MODE });
+  writeFileSync2(servicePaths.logPath, "", { mode: RUNTIME_FILE_MODE, flag: "a" });
+  chmodSync(servicePaths.logPath, RUNTIME_FILE_MODE);
   const launcher = generateDaemonLauncher(daemonConfig);
   atomicWrite2(control.launcher, launcher.content, RUNTIME_LAUNCHER_MODE);
   const plist = generateLaunchAgentPlist({
     launcherPath: control.launcher,
     logPath: servicePaths.logPath,
-    workingDirectory: options.homeDir ?? homedir4(),
+    workingDirectory: options.homeDir ?? homedir3(),
     label: options.label
   });
   const plistChanged = atomicWrite2(
@@ -4159,7 +3218,7 @@ async function bootoutMacDaemonLocked(options) {
   const wasLoaded = service.loaded;
   if (wasLoaded) {
     const control = daemonControlPaths(options);
-    const launcher = lstatIfPresent3(control.launcher);
+    const launcher = lstatIfPresent2(control.launcher);
     if (service.program !== control.launcher || !launcher?.isFile() || readDaemonLauncher(control.launcher) === null) {
       throw new Error(
         `refusing to stop unrecognized launchd program ${service.program ?? "(missing)"}`
@@ -4207,9 +3266,9 @@ async function bootoutMacDaemonLocked(options) {
 // src/commands/daemon.ts
 var DAEMON_BIN = "prim-daemon-server";
 var CONFIG_DIR = primConfigDirectory();
-var PID_PATH = join7(CONFIG_DIR, "daemon.pid");
-var SOCK_PATH = join7(CONFIG_DIR, "sock");
-var LOG_PATH = join7(CONFIG_DIR, "daemon.log");
+var PID_PATH = join5(CONFIG_DIR, "daemon.pid");
+var SOCK_PATH = join5(CONFIG_DIR, "sock");
+var LOG_PATH = join5(CONFIG_DIR, "daemon.log");
 var CONFIG_DIR_MODE = 448;
 var LOG_FILE_MODE = 384;
 var STOP_TIMEOUT_MS = 5e3;
@@ -4247,10 +3306,10 @@ function daemonDegradedReason(snapshot) {
   return "health checks have not recovered";
 }
 function readPidfile() {
-  if (!existsSync6(PID_PATH)) {
+  if (!existsSync4(PID_PATH)) {
     return null;
   }
-  const raw = readFileSync6(PID_PATH, "utf-8").trim();
+  const raw = readFileSync4(PID_PATH, "utf-8").trim();
   const pid = Number(raw);
   if (!Number.isInteger(pid) || pid <= 0) {
     return null;
@@ -4268,17 +3327,17 @@ function clearStaleArtifacts() {
   }
 }
 function sleep(ms) {
-  return new Promise((resolve6) => setTimeout(resolve6, ms));
+  return new Promise((resolve5) => setTimeout(resolve5, ms));
 }
 function spawnDaemon(options) {
   const file = binFile(DAEMON_BIN);
   return file ? spawn2(process.execPath, [file], options) : spawn2(DAEMON_BIN, [], options);
 }
 function openDaemonLog(configDir = CONFIG_DIR) {
-  if (!existsSync6(configDir)) {
-    mkdirSync4(configDir, { recursive: true, mode: CONFIG_DIR_MODE });
+  if (!existsSync4(configDir)) {
+    mkdirSync3(configDir, { recursive: true, mode: CONFIG_DIR_MODE });
   }
-  return openSync(join7(configDir, "daemon.log"), "a", LOG_FILE_MODE);
+  return openSync(join5(configDir, "daemon.log"), "a", LOG_FILE_MODE);
 }
 async function waitForReady() {
   const deadline = Date.now() + READY_TIMEOUT_MS;
@@ -4412,7 +3471,7 @@ async function detachedDaemonStop() {
       {},
       { timeoutMs: STATUS_PROBE_TIMEOUT_MS }
     );
-    if (existsSync6(PID_PATH) || existsSync6(SOCK_PATH) || socketOwner) {
+    if (existsSync4(PID_PATH) || existsSync4(SOCK_PATH) || socketOwner) {
       process.stderr.write(
         `[prim] refusing to verify daemon absence: ${socketOwner ? `socket is owned by pid=${socketOwner.pid}` : "daemon artifacts remain"}
 `
@@ -4444,7 +3503,7 @@ async function detachedDaemonStop() {
       {},
       { timeoutMs: STATUS_PROBE_TIMEOUT_MS }
     );
-    if (socketOwner || existsSync6(SOCK_PATH)) {
+    if (socketOwner || existsSync4(SOCK_PATH)) {
       process.stderr.write(
         `[prim] refusing to clear stale pidfile: ${socketOwner ? `socket is owned by pid=${socketOwner.pid}` : "socket artifact remains"}
 `
@@ -5212,6 +4271,8 @@ function authorLabel(row) {
       return "Your Claude Code";
     case "codex":
       return "Your Codex";
+    case "cursor":
+      return "Your Cursor";
     case "hermes":
       return "Your Hermes";
     case "chat":
@@ -6644,6 +5705,7 @@ function describeAudienceMember(member) {
       return {
         claude_code: "Claude Code agent",
         codex: "Codex agent",
+        cursor: "Cursor agent",
         hermes: "Hermes agent"
       }[member.agent] ?? terminalSafeLine(member.agent);
     case "credential":
@@ -6767,7 +5829,7 @@ var UserScopeInputError = class extends Error {
   }
 };
 var USER_SCOPE_ROLES = /* @__PURE__ */ new Set(["owner", "admin", "member"]);
-var USER_SCOPE_AGENTS = /* @__PURE__ */ new Set(["claude_code", "codex", "hermes"]);
+var USER_SCOPE_AGENTS = /* @__PURE__ */ new Set(["claude_code", "codex", "cursor", "hermes"]);
 var USER_SCOPE_CREDENTIALS = /* @__PURE__ */ new Set(["workos_jwt", "workos_api_key", "service_token"]);
 function requiredScopeValue(flag, value) {
   const trimmed = value.trim();
@@ -6795,9 +5857,12 @@ function userScopeFromOptions(opts) {
   for (const value of agents) {
     const agent = requiredScopeValue("--for-agent", value);
     if (!USER_SCOPE_AGENTS.has(agent)) {
-      throw new UserScopeInputError("--for-agent must be claude_code, codex, or hermes");
+      throw new UserScopeInputError("--for-agent must be claude_code, codex, cursor, or hermes");
     }
-    members.push({ kind: "agent", agent });
+    members.push({
+      kind: "agent",
+      agent
+    });
   }
   for (const value of credentials) {
     const credential = requiredScopeValue("--for-credential", value);
@@ -7004,7 +6069,7 @@ function registerDecisionsCommands(program2) {
     []
   ).option(
     "--for-agent <agent>",
-    "Include one agent: claude_code | codex | hermes (repeatable)",
+    "Include one agent: claude_code | codex | cursor | hermes (repeatable)",
     collectItem,
     []
   ).option(
@@ -7160,7 +6225,7 @@ function registerDecisionsCommands(program2) {
     []
   ).option(
     "--for-agent <agent>",
-    "Set one agent: claude_code | codex | hermes (repeatable)",
+    "Set one agent: claude_code | codex | cursor | hermes (repeatable)",
     collectItem,
     []
   ).option(
@@ -7240,7 +6305,7 @@ function registerDecisionsCommands(program2) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync8 } from "fs";
+import { existsSync as existsSync6 } from "fs";
 
 // src/protocol/decision-lifecycle.ts
 var DECISION_LIFECYCLE_PROTOCOL_VERSION = 2;
@@ -7358,28 +6423,28 @@ async function inspectJournalDelivery(buckets, options = {}) {
 }
 
 // src/commands/hermes-install.ts
-import { existsSync as existsSync7, readFileSync as readFileSync7, rmSync as rmSync3, statSync as statSync2 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join8 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync5, rmSync as rmSync2, statSync } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join6 } from "path";
 import { Document, isMap, isSeq, parseAllDocuments, stringify, visit } from "yaml";
-var CAPTURE_BIN3 = "prim-hook";
-var GATE_BIN3 = "prim-pre-tool-use";
-var POST_TOOL_USE_BIN3 = "prim-post-tool-use";
-var SESSION_START_BIN3 = "prim-session-start";
-var SESSION_END_BIN2 = "prim-session-end";
+var CAPTURE_BIN2 = "prim-hook";
+var GATE_BIN2 = "prim-pre-tool-use";
+var POST_TOOL_USE_BIN2 = "prim-post-tool-use";
+var SESSION_START_BIN2 = "prim-session-start";
+var SESSION_END_BIN = "prim-session-end";
 var HERMES_ARGS = "--agent hermes";
 var EDIT_MATCHER = "write_file|patch";
-var JSON_INDENT3 = 2;
+var JSON_INDENT2 = 2;
 var CONFIG_MODE = 384;
-var PRIM_BINS3 = [CAPTURE_BIN3, GATE_BIN3, POST_TOOL_USE_BIN3, SESSION_START_BIN3, SESSION_END_BIN2];
+var PRIM_BINS2 = [CAPTURE_BIN2, GATE_BIN2, POST_TOOL_USE_BIN2, SESSION_START_BIN2, SESSION_END_BIN];
 function hermesHome() {
-  return process.env.HERMES_HOME ?? join8(homedir5(), ".hermes");
+  return process.env.HERMES_HOME ?? join6(homedir4(), ".hermes");
 }
 function configPath() {
-  return join8(hermesHome(), "config.yaml");
+  return join6(hermesHome(), "config.yaml");
 }
 function legacyShimPath() {
-  return join8(hermesHome(), "agent-hooks", "prim-shim.sh");
+  return join6(hermesHome(), "agent-hooks", "prim-shim.sh");
 }
 function commandFor(bin) {
   return stableHookCommand(bin, HERMES_ARGS);
@@ -7390,7 +6455,7 @@ function legacyCommandFor(bin) {
 function commandUsesBin(command, bin) {
   return command === commandFor(bin) || command === legacyCommandFor(bin);
 }
-var CAPTURE_EVENTS2 = [
+var CAPTURE_EVENTS = [
   "on_session_start",
   "pre_llm_call",
   "pre_tool_call",
@@ -7400,13 +6465,13 @@ var CAPTURE_EVENTS2 = [
   "subagent_stop"
 ];
 var GATE_TIMEOUT_SECONDS = 10;
-var REGISTRATIONS2 = [
-  ...CAPTURE_EVENTS2.map((event) => ({ event, bin: CAPTURE_BIN3 })),
-  { event: "pre_tool_call", matcher: EDIT_MATCHER, bin: GATE_BIN3, timeout: GATE_TIMEOUT_SECONDS },
-  { event: "post_tool_call", matcher: EDIT_MATCHER, bin: POST_TOOL_USE_BIN3 },
-  { event: "post_approval_response", bin: POST_TOOL_USE_BIN3 },
-  { event: "on_session_start", bin: SESSION_START_BIN3 },
-  { event: "on_session_end", bin: SESSION_END_BIN2 }
+var REGISTRATIONS = [
+  ...CAPTURE_EVENTS.map((event) => ({ event, bin: CAPTURE_BIN2 })),
+  { event: "pre_tool_call", matcher: EDIT_MATCHER, bin: GATE_BIN2, timeout: GATE_TIMEOUT_SECONDS },
+  { event: "post_tool_call", matcher: EDIT_MATCHER, bin: POST_TOOL_USE_BIN2 },
+  { event: "post_approval_response", bin: POST_TOOL_USE_BIN2 },
+  { event: "on_session_start", bin: SESSION_START_BIN2 },
+  { event: "on_session_end", bin: SESSION_END_BIN }
 ];
 function yamlValue(node) {
   return typeof node?.toJSON === "function" ? node.toJSON?.() : node;
@@ -7436,18 +6501,18 @@ function ensureReg(list, reg, force) {
   }
   return [...stripBin(list, reg.bin), entry];
 }
-function applyInstall3(hooks, force) {
+function applyInstall2(hooks, force) {
   const next = { ...hooks };
-  for (const reg of REGISTRATIONS2) {
+  for (const reg of REGISTRATIONS) {
     next[reg.event] = ensureReg(next[reg.event] ?? [], reg, force);
   }
   return next;
 }
-function applyUninstall3(hooks) {
+function applyUninstall2(hooks) {
   const next = {};
   for (const [event, list] of Object.entries(hooks)) {
     let kept = list;
-    for (const bin of PRIM_BINS3) {
+    for (const bin of PRIM_BINS2) {
       kept = stripBin(kept, bin);
     }
     if (kept.length > 0) {
@@ -7456,54 +6521,54 @@ function applyUninstall3(hooks) {
   }
   return next;
 }
-function isGateInstalled3(hooks) {
-  return (hooks.pre_tool_call ?? []).some((e) => commandUsesBin(e.command, GATE_BIN3));
+function isGateInstalled2(hooks) {
+  return (hooks.pre_tool_call ?? []).some((e) => commandUsesBin(e.command, GATE_BIN2));
 }
 function isCaptureInstalled(hooks) {
-  return CAPTURE_EVENTS2.some(
-    (event) => (hooks[event] ?? []).some((e) => commandUsesBin(e.command, CAPTURE_BIN3))
+  return CAPTURE_EVENTS.some(
+    (event) => (hooks[event] ?? []).some((e) => commandUsesBin(e.command, CAPTURE_BIN2))
   );
 }
 function entryUsesOwnedBin(entry) {
-  return PRIM_BINS3.some(
+  return PRIM_BINS2.some(
     (bin) => commandUsesBin(entry.command, bin) || commandMatchesBin(entry.command, bin)
   );
 }
-function ownedRegistrationEntries3(hooks) {
+function ownedRegistrationEntries2(hooks) {
   return Object.entries(hooks).flatMap(
     ([event, entries]) => entries.filter(entryUsesOwnedBin).map((entry) => ({ event, entry }))
   );
 }
-function hasAnyHookRegistration3(hooks) {
-  return ownedRegistrationEntries3(hooks).length > 0;
+function hasAnyHookRegistration2(hooks) {
+  return ownedRegistrationEntries2(hooks).length > 0;
 }
-function hookRuntimeResolutions3(hooks) {
+function hookRuntimeResolutions2(hooks) {
   const resolutions = hookCommandResolutions(
     Object.values(hooks).flatMap((entries) => entries.map((entry) => entry.command)),
-    PRIM_BINS3
+    PRIM_BINS2
   );
   for (const entries of Object.values(hooks)) {
     for (const entry of entries) {
-      for (const bin of PRIM_BINS3) {
+      for (const bin of PRIM_BINS2) {
         if (entry.command === legacyCommandFor(bin)) resolutions.push({ kind: "legacy_path" });
       }
     }
   }
   return resolutions;
 }
-function inspectHookRuntimeResolutions3() {
+function inspectHookRuntimeResolutions4() {
   const path = configPath();
-  if (!existsSync7(path)) return [];
-  return hookRuntimeResolutions3(readHooks(parseHermesDocument(readFileSync7(path, "utf8"))));
+  if (!existsSync5(path)) return [];
+  return hookRuntimeResolutions2(readHooks(parseHermesDocument(readFileSync5(path, "utf8"))));
 }
-function entryMatchesRegistration3(owned, registration) {
+function entryMatchesRegistration2(owned, registration) {
   const expected = entryFor(registration);
   return owned.event === registration.event && owned.entry.command === expected.command && (owned.entry.matcher ?? "") === (expected.matcher ?? "") && (owned.entry.timeout ?? null) === (expected.timeout ?? null);
 }
-function hasCompleteHookRegistration3(hooks) {
-  const owned = ownedRegistrationEntries3(hooks);
-  return owned.length === REGISTRATIONS2.length && REGISTRATIONS2.every(
-    (registration) => owned.filter((entry) => entryMatchesRegistration3(entry, registration)).length === 1
+function hasCompleteHookRegistration2(hooks) {
+  const owned = ownedRegistrationEntries2(hooks);
+  return owned.length === REGISTRATIONS.length && REGISTRATIONS.every(
+    (registration) => owned.filter((entry) => entryMatchesRegistration2(entry, registration)).length === 1
   );
 }
 var INVALID_CONFIG_MESSAGE = "Hermes config must be valid, single-document YAML with a top-level mapping";
@@ -7578,7 +6643,7 @@ function serializeHooks(hooks) {
   return stringify({ hooks }, { lineWidth: 0 });
 }
 function isPrimEntry(entry) {
-  return PRIM_BINS3.some((bin) => commandUsesBin(entry.command, bin));
+  return PRIM_BINS2.some((bin) => commandUsesBin(entry.command, bin));
 }
 function entryKey(entry) {
   return JSON.stringify(entry);
@@ -7763,11 +6828,11 @@ function assertMergeValid(before, after, expectedHooks) {
   }
 }
 function readConfigSnapshot(path) {
-  if (!existsSync7(path)) return { exists: false, mode: CONFIG_MODE, raw: "" };
+  if (!existsSync5(path)) return { exists: false, mode: CONFIG_MODE, raw: "" };
   return {
     exists: true,
-    mode: statSync2(path).mode & 511,
-    raw: readFileSync7(path, "utf8")
+    mode: statSync(path).mode & 511,
+    raw: readFileSync5(path, "utf8")
   };
 }
 var CONCURRENT_CONFIG_MESSAGE = "Hermes config changed during update; concurrent changes were preserved, retry the command";
@@ -7776,7 +6841,7 @@ function writeHermesConfigSnapshot(path, before, after, expectedHooks) {
     ensureParent: true,
     mode: before.mode,
     validate(temporaryPath) {
-      const flushed = readFileSync7(temporaryPath, "utf8");
+      const flushed = readFileSync5(temporaryPath, "utf8");
       if (!mergePreservesHermesSemantics(before.raw, flushed, expectedHooks)) {
         throw new Error(INVALID_MERGE_MESSAGE);
       }
@@ -7788,7 +6853,7 @@ function writeHermesConfigSnapshot(path, before, after, expectedHooks) {
   });
 }
 function removeLegacyShim() {
-  rmSync3(legacyShimPath(), { force: true });
+  rmSync2(legacyShimPath(), { force: true });
 }
 function autoAcceptOf(raw) {
   if (raw.trim().length === 0) {
@@ -7799,13 +6864,13 @@ function autoAcceptOf(raw) {
 function readHooksFromRaw(raw) {
   return readHooks(parseHermesDocument(raw));
 }
-function performInstall3(opts) {
+function performInstall2(opts) {
   (opts.stageRuntime ?? stageHookRuntime)();
   const path = configPath();
   const snapshot = readConfigSnapshot(path);
   const raw = snapshot.raw;
   const existing = readHooksFromRaw(raw);
-  const desired = applyInstall3(existing, opts.force);
+  const desired = applyInstall2(existing, opts.force);
   let next = raw;
   if (JSON.stringify(existing) !== JSON.stringify(desired)) {
     next = spliceHooks(next, desired);
@@ -7821,22 +6886,22 @@ function performInstall3(opts) {
   removeLegacyShim();
   return {
     path,
-    gate: isGateInstalled3(desired),
+    gate: isGateInstalled2(desired),
     capture: isCaptureInstalled(desired),
     autoAccept: autoAcceptOf(next),
     changed
   };
 }
-function performUninstall3() {
+function performUninstall2() {
   const path = configPath();
-  if (!existsSync7(path)) {
+  if (!existsSync5(path)) {
     removeLegacyShim();
     return { path, gate: false, capture: false, autoAccept: false, changed: false };
   }
   const snapshot = readConfigSnapshot(path);
   const raw = snapshot.raw;
   const existing = readHooksFromRaw(raw);
-  const remaining = applyUninstall3(existing);
+  const remaining = applyUninstall2(existing);
   const next = JSON.stringify(existing) === JSON.stringify(remaining) ? raw : spliceHooks(raw, remaining);
   const changed = next !== raw;
   if (changed) {
@@ -7846,22 +6911,22 @@ function performUninstall3() {
   removeLegacyShim();
   return {
     path,
-    gate: isGateInstalled3(remaining),
+    gate: isGateInstalled2(remaining),
     capture: isCaptureInstalled(remaining),
     autoAccept: autoAcceptOf(next),
     changed
   };
 }
-function performStatus3() {
+function performStatus4() {
   const path = configPath();
-  const raw = existsSync7(path) ? readFileSync7(path, "utf8") : "";
+  const raw = existsSync5(path) ? readFileSync5(path, "utf8") : "";
   const hooks = raw ? readHooks(parseHermesDocument(raw)) : {};
   return {
     path,
-    present: hasAnyHookRegistration3(hooks),
-    gate: isGateInstalled3(hooks),
+    present: hasAnyHookRegistration2(hooks),
+    gate: isGateInstalled2(hooks),
     capture: isCaptureInstalled(hooks),
-    complete: hasCompleteHookRegistration3(hooks),
+    complete: hasCompleteHookRegistration2(hooks),
     autoAccept: raw ? autoAcceptOf(raw) : false
   };
 }
@@ -7878,7 +6943,7 @@ function registerHermesCommands(program2) {
   const hermes = program2.command("hermes").description("Manage the prim Hermes Agent integration (capture, gate, ingest, presence)");
   hermes.command("install").description("Register the prim hooks in Hermes's ~/.hermes/config.yaml").option("--scope <scope>", "user (default; Hermes config is global-only)").option("--force", "Replace any drifted prim hook entries").option("--auto-accept", "Also set hooks_auto_accept: true so the hooks need no TTY consent").action((opts) => {
     rejectProjectScope(opts.scope);
-    const result = performInstall3({
+    const result = performInstall2({
       force: opts.force ?? false,
       autoAccept: opts.autoAccept ?? false
     });
@@ -7886,22 +6951,22 @@ function registerHermesCommands(program2) {
       result.changed ? `[prim] Hermes integration installed at ${result.path}` : `[prim] Hermes integration already present at ${result.path} (no changes)`
     );
     console.error(TRUST_NOTICE2);
-    console.log(JSON.stringify(result, null, JSON_INDENT3));
+    console.log(JSON.stringify(result, null, JSON_INDENT2));
   });
   hermes.command("uninstall").description("Remove all prim hooks from Hermes's ~/.hermes/config.yaml").action(() => {
-    const result = performUninstall3();
+    const result = performUninstall2();
     console.error(
       result.changed ? `[prim] prim hooks removed from ${result.path}` : `[prim] no prim hooks to remove at ${result.path} (nothing changed)`
     );
-    console.log(JSON.stringify(result, null, JSON_INDENT3));
+    console.log(JSON.stringify(result, null, JSON_INDENT2));
   });
   hermes.command("status").description("Report whether each prim surface (gate, capture) is installed").action(() => {
-    const result = performStatus3();
+    const result = performStatus4();
     const mark = (b) => b ? "\u2713" : "\u2717";
     console.error(
       `[prim] hermes: gate ${mark(result.gate)} \xB7 capture ${mark(result.capture)} (${result.path})`
     );
-    console.log(JSON.stringify(result, null, JSON_INDENT3));
+    console.log(JSON.stringify(result, null, JSON_INDENT2));
   });
 }
 
@@ -7944,7 +7009,7 @@ function checkAuth() {
   return classifyAuthCredential(
     credential,
     storedCredential ? getTokenExpiresAt() : void 0,
-    storedCredential && existsSync8(REFRESH_TOKEN_PATH)
+    storedCredential && existsSync6(REFRESH_TOKEN_PATH)
   );
 }
 function classifyDaemonHealth(snapshot, options = {}) {
@@ -8288,6 +7353,34 @@ function classifyCodexHooks(statuses) {
     detail: "installed; Codex trust is not machine-readable \u2014 verify with `/hooks`"
   };
 }
+function classifyCursorHooks(statuses) {
+  const installed = statuses.filter((status) => status.present);
+  if (installed.length === 0)
+    return { name: "cursor-hooks", status: "ok", detail: "not installed" };
+  if (installed.some((status) => !status.complete)) {
+    return {
+      name: "cursor-hooks",
+      status: "fail",
+      detail: "incomplete or drifted native lifecycle \u2014 run `prim cursor install --force`"
+    };
+  }
+  const user = statuses.find((status) => status.footer !== void 0);
+  if (user?.present && user.footer === false && !user.footerPreservedCustom) {
+    return {
+      name: "cursor-hooks",
+      status: "fail",
+      detail: "native lifecycle ready but Cursor CLI footer is missing \u2014 run `prim cursor install --scope user --force`"
+    };
+  }
+  if (statuses.some((status) => status.footerPreservedCustom)) {
+    return {
+      name: "cursor-hooks",
+      status: "warn",
+      detail: "native lifecycle ready; custom Cursor CLI footer preserved"
+    };
+  }
+  return { name: "cursor-hooks", status: "ok", detail: "complete native lifecycle ready" };
+}
 function classifyHermesHooks(status) {
   if (!status.present) {
     return { name: "hermes-hooks", status: "ok", detail: "not installed" };
@@ -8308,7 +7401,7 @@ function classifyHermesHooks(status) {
 function checkAgentHooks() {
   const checks = [];
   try {
-    const status = performStatus2();
+    const status = performStatus3();
     checks.push(classifyCodexHooks([status.project, status.user]));
   } catch (error) {
     const detail = boundedHealthError(error instanceof Error ? error.message : String(error));
@@ -8319,7 +7412,18 @@ function checkAgentHooks() {
     });
   }
   try {
-    checks.push(classifyHermesHooks(performStatus3()));
+    const status = performStatus2();
+    checks.push(classifyCursorHooks([status.project, status.user]));
+  } catch (error) {
+    const detail = boundedHealthError(error instanceof Error ? error.message : String(error));
+    checks.push({
+      name: "cursor-hooks",
+      status: "fail",
+      detail: detail ?? "hook configuration is unreadable"
+    });
+  }
+  try {
+    checks.push(classifyHermesHooks(performStatus4()));
   } catch (error) {
     const detail = boundedHealthError(error instanceof Error ? error.message : String(error));
     checks.push({
@@ -8428,8 +7532,9 @@ function checkHookRuntime() {
     return diagnoseRegisteredHookRuntime(
       [
         ...inspectHookRuntimeResolutions(),
+        ...inspectHookRuntimeResolutions3(),
         ...inspectHookRuntimeResolutions2(),
-        ...inspectHookRuntimeResolutions3()
+        ...inspectHookRuntimeResolutions4()
       ],
       inspectHookRuntime,
       packageVersion
@@ -8564,70 +7669,70 @@ function registerDoctorCommands(program2) {
 }
 
 // src/commands/moves.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync6, unlinkSync as unlinkSync4, writeFileSync as writeFileSync5 } from "fs";
-import { join as join11 } from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, unlinkSync as unlinkSync4, writeFileSync as writeFileSync4 } from "fs";
+import { join as join9 } from "path";
 
 // src/flusher.ts
-import { createReadStream, renameSync as renameSync4, unlinkSync as unlinkSync3 } from "fs";
-import { dirname as dirname6, join as join10 } from "path";
+import { createReadStream, renameSync as renameSync3, unlinkSync as unlinkSync3 } from "fs";
+import { dirname as dirname4, join as join8 } from "path";
 
 // src/dead-letter.ts
-import { createHash as createHash4, randomBytes as randomBytes5 } from "crypto";
+import { createHash as createHash3, randomBytes as randomBytes4 } from "crypto";
 import {
-  constants as constants3,
-  chmodSync as chmodSync3,
+  constants as constants2,
+  chmodSync as chmodSync2,
   closeSync as closeSync2,
-  existsSync as existsSync9,
+  existsSync as existsSync7,
   fchmodSync,
   fsyncSync,
-  mkdirSync as mkdirSync5,
+  mkdirSync as mkdirSync4,
   openSync as openSync2,
-  renameSync as renameSync3,
-  rmSync as rmSync4,
-  writeFileSync as writeFileSync4
+  renameSync as renameSync2,
+  rmSync as rmSync3,
+  writeFileSync as writeFileSync3
 } from "fs";
-import { dirname as dirname5, join as join9 } from "path";
-var DIRECTORY_MODE2 = 448;
+import { dirname as dirname3, join as join7 } from "path";
+var DIRECTORY_MODE = 448;
 var FILE_MODE = 384;
 var DEAD_LETTER_DIRNAME = "dead-letter";
 function deadLetterDirectoryForRotation(flushingPath) {
-  return join9(dirname5(flushingPath), DEAD_LETTER_DIRNAME);
+  return join7(dirname3(flushingPath), DEAD_LETTER_DIRNAME);
 }
 function deadLetterPathForRawLine(flushingPath, rawLine) {
-  const quarantineId = createHash4("sha256").update(rawLine).digest("hex");
-  return join9(deadLetterDirectoryForRotation(flushingPath), `raw-${quarantineId}.json`);
+  const quarantineId = createHash3("sha256").update(rawLine).digest("hex");
+  return join7(deadLetterDirectoryForRotation(flushingPath), `raw-${quarantineId}.json`);
 }
 function ensureDeadLetterDirectory(flushingPath, persistDirectory) {
   const directory = deadLetterDirectoryForRotation(flushingPath);
-  mkdirSync5(directory, { recursive: true, mode: DIRECTORY_MODE2 });
-  chmodSync3(directory, DIRECTORY_MODE2);
-  persistDirectory(dirname5(directory));
+  mkdirSync4(directory, { recursive: true, mode: DIRECTORY_MODE });
+  chmodSync2(directory, DIRECTORY_MODE);
+  persistDirectory(dirname3(directory));
   return directory;
 }
 function persistDeadLetter(directory, path, quarantineId, record2, persistDirectory) {
-  if (existsSync9(path)) {
+  if (existsSync7(path)) {
     persistDirectory(directory);
     return;
   }
-  const temporaryPath = join9(
+  const temporaryPath = join7(
     directory,
-    `.${quarantineId}.${String(process.pid)}.${randomBytes5(8).toString("hex")}.tmp`
+    `.${quarantineId}.${String(process.pid)}.${randomBytes4(8).toString("hex")}.tmp`
   );
-  const flags = constants3.O_CREAT | constants3.O_EXCL | constants3.O_WRONLY | constants3.O_NOFOLLOW;
+  const flags = constants2.O_CREAT | constants2.O_EXCL | constants2.O_WRONLY | constants2.O_NOFOLLOW;
   try {
     const fd = openSync2(temporaryPath, flags, FILE_MODE);
     try {
       fchmodSync(fd, FILE_MODE);
-      writeFileSync4(fd, `${JSON.stringify(record2)}
+      writeFileSync3(fd, `${JSON.stringify(record2)}
 `, "utf8");
       fsyncSync(fd);
     } finally {
       closeSync2(fd);
     }
-    renameSync3(temporaryPath, path);
+    renameSync2(temporaryPath, path);
     persistDirectory(directory);
   } finally {
-    rmSync4(temporaryPath, { force: true });
+    rmSync3(temporaryPath, { force: true });
   }
 }
 function quarantineMove(flushingPath, move, reason, now = Date.now, options = {}) {
@@ -8636,12 +7741,12 @@ function quarantineMove(flushingPath, move, reason, now = Date.now, options = {}
   const serializedMove = JSON.stringify(move);
   const record2 = {
     version: 1,
-    quarantineId: createHash4("sha256").update(serializedMove).digest("hex"),
+    quarantineId: createHash3("sha256").update(serializedMove).digest("hex"),
     quarantinedAt: now(),
     reason,
     move
   };
-  const path = join9(directory, `${record2.quarantineId}.json`);
+  const path = join7(directory, `${record2.quarantineId}.json`);
   persistDeadLetter(directory, path, record2.quarantineId, record2, persistDirectory);
   return record2;
 }
@@ -8652,7 +7757,7 @@ function quarantineRawLine(flushingPath, rawLine, now = Date.now, options = {})
   const record2 = {
     version: 1,
     recordKind: "raw_line_v1",
-    quarantineId: createHash4("sha256").update(bytes).digest("hex"),
+    quarantineId: createHash3("sha256").update(bytes).digest("hex"),
     quarantinedAt: now(),
     reason: "invalid_move",
     rawLineEncoding: "base64",
@@ -8717,6 +7822,12 @@ function deadLetterReason(error) {
   }
   return void 0;
 }
+function mayBeBatchSizeFailure(error) {
+  if (error instanceof HttpError) {
+    return error.status >= 500 && error.status !== 503;
+  }
+  return error instanceof Error && error.name === "TimeoutError";
+}
 async function* rawJournalLines(input) {
   let pending = [];
   let pendingBytes = 0;
@@ -8758,7 +7869,7 @@ async function drainFlushingPath(flushingPath, client, binding, options = {}) {
       return { flushed: batch2.length, quarantined: 0 };
     } catch (error) {
       const reason = deadLetterReason(error);
-      if (!reason) {
+      if (!(reason || mayBeBatchSizeFailure(error))) {
         throw error;
       }
       if (batch2.length > 1) {
@@ -8767,6 +7878,9 @@ async function drainFlushingPath(flushingPath, client, binding, options = {}) {
         const right = await postBatch(batch2.slice(midpoint));
         return addDrainCounts(left, right);
       }
+      if (!reason) {
+        throw error;
+      }
       const [move] = batch2;
       const quarantined = quarantineMove(
         flushingPath,
@@ -8825,7 +7939,7 @@ async function drainFlushingPath(flushingPath, client, binding, options = {}) {
 async function drainPath(path, client, binding) {
   const tmpPath = `${path}.flushing.${String(Date.now())}.${String(process.pid)}`;
   try {
-    renameSync4(path, tmpPath);
+    renameSync3(path, tmpPath);
   } catch (err) {
     if (err.code === "ENOENT") {
       return { flushed: 0, quarantined: 0 };
@@ -8924,7 +8038,7 @@ async function flushOnce() {
   return inspection.retainedBuckets.length > 0 ? { flushed: total, quarantined, retained: inspection.retainedBuckets } : { flushed: total, quarantined };
 }
 var flushInFlight;
-var FLUSH_LOCK_PATH = join10(dirname6(JOURNAL_DIR), ".flush.lock");
+var FLUSH_LOCK_PATH = join8(dirname4(JOURNAL_DIR), ".flush.lock");
 var FLUSH_LOCK_TIMEOUT_MS = 250;
 function isFlushLockContended(error) {
   return error instanceof Error && error.message.startsWith("timed out waiting for file lock");
@@ -9058,19 +8172,19 @@ function registerMovesCommands(program2) {
     }
   });
   moves.command("bind").description("Pin the current directory to an org via .prim/workspace.json").requiredOption("--orgId <orgId>", "Convex organization id").action((opts) => {
-    const dir = join11(process.cwd(), ".prim");
-    if (!existsSync10(dir)) {
-      mkdirSync6(dir, { recursive: true, mode: DIR_MODE });
+    const dir = join9(process.cwd(), ".prim");
+    if (!existsSync8(dir)) {
+      mkdirSync5(dir, { recursive: true, mode: DIR_MODE });
     }
-    const file = join11(process.cwd(), WORKSPACE_FILE);
-    writeFileSync5(file, JSON.stringify({ orgId: opts.orgId, boundAt: Date.now() }, null, 2), {
+    const file = join9(process.cwd(), WORKSPACE_FILE);
+    writeFileSync4(file, JSON.stringify({ orgId: opts.orgId, boundAt: Date.now() }, null, 2), {
       mode: FILE_MODE2
     });
     console.log(`[prim] bound ${process.cwd()} to org ${opts.orgId}`);
   });
   moves.command("drop").description("Remove the .prim/workspace.json binding from the cwd").action(() => {
-    const file = join11(process.cwd(), WORKSPACE_FILE);
-    if (!existsSync10(file)) {
+    const file = join9(process.cwd(), WORKSPACE_FILE);
+    if (!existsSync8(file)) {
       console.log("[prim] no workspace binding in cwd");
       return;
     }
@@ -9161,23 +8275,23 @@ function registerReconcileCommands(program2) {
 
 // src/commands/session.ts
 import {
-  existsSync as existsSync11,
-  mkdirSync as mkdirSync7,
-  readFileSync as readFileSync8,
-  readdirSync as readdirSync4,
+  existsSync as existsSync9,
+  mkdirSync as mkdirSync6,
+  readFileSync as readFileSync6,
+  readdirSync as readdirSync3,
   unlinkSync as unlinkSync5,
-  writeFileSync as writeFileSync6
+  writeFileSync as writeFileSync5
 } from "fs";
-import { join as join12 } from "path";
+import { join as join10 } from "path";
 var DIR_MODE2 = 448;
 var FILE_MODE3 = 384;
 function ensureDir() {
-  if (!existsSync11(SESSIONS_DIR)) {
-    mkdirSync7(SESSIONS_DIR, { recursive: true, mode: DIR_MODE2 });
+  if (!existsSync9(SESSIONS_DIR)) {
+    mkdirSync6(SESSIONS_DIR, { recursive: true, mode: DIR_MODE2 });
   }
 }
 function markerPath(sessionId) {
-  return join12(SESSIONS_DIR, `${sessionId}.json`);
+  return join10(SESSIONS_DIR, `${sessionId}.json`);
 }
 function registerSessionCommands(program2) {
   const session = program2.command("session").description("Decision Event Pipeline \u2014 session binding markers");
@@ -9187,17 +8301,17 @@ function registerSessionCommands(program2) {
       orgId: opts.orgId,
       startedAt: Date.now()
     };
-    writeFileSync6(markerPath(sessionId), JSON.stringify(marker, null, 2), {
+    writeFileSync5(markerPath(sessionId), JSON.stringify(marker, null, 2), {
       mode: FILE_MODE3
     });
     console.log(`[prim] session ${sessionId} bound to org ${opts.orgId}`);
   });
   session.command("list").description("List active session markers").action(() => {
-    if (!existsSync11(SESSIONS_DIR)) {
+    if (!existsSync9(SESSIONS_DIR)) {
       console.log("[prim] no session markers");
       return;
     }
-    const files = readdirSync4(SESSIONS_DIR).filter((f) => f.endsWith(".json"));
+    const files = readdirSync3(SESSIONS_DIR).filter((f) => f.endsWith(".json"));
     if (files.length === 0) {
       console.log("[prim] no session markers");
       return;
@@ -9205,7 +8319,7 @@ function registerSessionCommands(program2) {
     for (const f of files) {
       const sessionId = f.replace(/\.json$/, "");
       try {
-        const m = JSON.parse(readFileSync8(join12(SESSIONS_DIR, f), "utf-8"));
+        const m = JSON.parse(readFileSync6(join10(SESSIONS_DIR, f), "utf-8"));
         console.log(`${sessionId}  org=${m.orgId}`);
       } catch {
       }
@@ -9213,7 +8327,7 @@ function registerSessionCommands(program2) {
   });
   session.command("drop <sessionId>").description("Remove a session marker").action((sessionId) => {
     const p = markerPath(sessionId);
-    if (!existsSync11(p)) {
+    if (!existsSync9(p)) {
       console.log(`[prim] no marker for session ${sessionId}`);
       return;
     }
@@ -9224,13 +8338,14 @@ function registerSessionCommands(program2) {
 
 // src/commands/setup.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync12, readFileSync as readFileSync9 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync7 } from "fs";
+import { join as join11 } from "path";
 var EXIT_INCOMPLETE = 1;
 var EXIT_USAGE3 = 2;
 var SESSION_LABELS = {
   claude: "Claude Code integration",
   codex: "Codex integration",
+  cursor: "Cursor integration",
   hermes: "Hermes integration"
 };
 function planSetupSteps(opts) {
@@ -9306,8 +8421,8 @@ function detectProjectConflicts(agent, run) {
   }
   try {
     const root = gitToplevel();
-    const preCommit = root && join13(root, ".git", "hooks", "pre-commit");
-    if (preCommit && existsSync12(preCommit) && readFileSync9(preCommit, "utf-8").includes("prim-pre-commit")) {
+    const preCommit = root && join11(root, ".git", "hooks", "pre-commit");
+    if (preCommit && existsSync10(preCommit) && readFileSync7(preCommit, "utf-8").includes("prim-pre-commit")) {
       conflicts.push(CONFLICT_HOOKS);
     }
   } catch {
@@ -9325,6 +8440,9 @@ function detectAgent(env) {
   if (env.HERMES_INTERACTIVE) {
     return "hermes";
   }
+  if (env.CURSOR_AGENT) {
+    return "cursor";
+  }
   return "claude";
 }
 function resolveAgent(agentFlag, env) {
@@ -9346,7 +8464,7 @@ function parseSetupAuthStatus(result) {
 function registerSetupCommand(program2, dependencies = {}) {
   program2.command("setup").description(
     "Install everything in one shot (auth, session + git hooks, daemon, skill, welcome)"
-  ).option("--agent <agent>", "claude, codex, or hermes (auto-detected when omitted)").option(
+  ).option("--agent <agent>", "claude, codex, cursor, or hermes (auto-detected when omitted)").option(
     "--scope <scope>",
     "user (default \u2014 install once for every repo) or project (this repo only)",
     "user"
@@ -9355,9 +8473,9 @@ function registerSetupCommand(program2, dependencies = {}) {
     "with the default user scope, remove any project-scoped prim config in this repo (else just warn)"
   ).option("--no-daemon", "stop and disable the companion daemon").action((opts) => {
     const { agent: agentInput, detected } = resolveAgent(opts.agent, process.env);
-    if (agentInput !== "claude" && agentInput !== "codex" && agentInput !== "hermes") {
+    if (agentInput !== "claude" && agentInput !== "codex" && agentInput !== "cursor" && agentInput !== "hermes") {
       process.stderr.write(
-        `[prim] unknown --agent "${agentInput}" (expected claude, codex, or hermes)
+        `[prim] unknown --agent "${agentInput}" (expected claude, codex, cursor, or hermes)
 `
       );
       (dependencies.exit ?? process.exit)(EXIT_USAGE3);
@@ -9468,23 +8586,23 @@ function registerSetupCommand(program2, dependencies = {}) {
 }
 
 // src/commands/statusline.ts
-import { readFileSync as readFileSync10 } from "fs";
-import { dirname as dirname7, resolve as resolve4 } from "path";
+import { readFileSync as readFileSync8 } from "fs";
+import { dirname as dirname5, resolve as resolve3 } from "path";
 import { fileURLToPath } from "url";
 var STATUSLINE_TIMEOUT_MS = 200;
 function readPackageVersion() {
   try {
-    const here = dirname7(fileURLToPath(import.meta.url));
+    const here = dirname5(fileURLToPath(import.meta.url));
     const candidates = [
       // Schema-v2 runtimes staged a manifest beside this standalone bundle.
       // Keep resolving it while those legacy launchers transition to schema v3.
-      resolve4(here, "manifest.json"),
-      resolve4(here, "../../package.json"),
-      resolve4(here, "../package.json")
+      resolve3(here, "manifest.json"),
+      resolve3(here, "../../package.json"),
+      resolve3(here, "../package.json")
     ];
     for (const path of candidates) {
       try {
-        const pkg2 = JSON.parse(readFileSync10(path, "utf-8"));
+        const pkg2 = JSON.parse(readFileSync8(path, "utf-8"));
         if (pkg2.version) {
           return pkg2.version;
         }
@@ -9501,9 +8619,8 @@ function debug(msg) {
 `);
   }
 }
-async function renderStatusline() {
+async function renderStatusline(cwd = process.cwd()) {
   const version = readPackageVersion();
-  const cwd = process.cwd();
   let ingestion;
   const resolveIngestion = () => {
     ingestion ??= decisionIngestionStatus(cwd);
@@ -9551,6 +8668,11 @@ function planUninstallSteps(inRepository) {
       label: "Codex project integration",
       args: ["codex", "uninstall", "--scope", "project"]
     },
+    {
+      key: "cursor-project",
+      label: "Cursor project integration",
+      args: ["cursor", "uninstall", "--scope", "project"]
+    },
     {
       key: "hooks-project",
       label: "project Git hooks",
@@ -9570,6 +8692,11 @@ function planUninstallSteps(inRepository) {
       label: "Codex user integration",
       args: ["codex", "uninstall", "--scope", "user"]
     },
+    {
+      key: "cursor-user",
+      label: "Cursor user integration",
+      args: ["cursor", "uninstall", "--scope", "user"]
+    },
     { key: "hermes-user", label: "Hermes integration", args: ["hermes", "uninstall"] },
     {
       key: "hooks-user",
@@ -9588,7 +8715,7 @@ function uninstallStepSucceeded(step, result) {
       return false;
     }
   }
-  if (!step.key.startsWith("claude-") && !step.key.startsWith("codex-") && step.key !== "hermes-user") {
+  if (!step.key.startsWith("claude-") && !step.key.startsWith("codex-") && !step.key.startsWith("cursor-") && step.key !== "hermes-user") {
     return true;
   }
   try {
@@ -9596,7 +8723,7 @@ function uninstallStepSucceeded(step, result) {
     if (step.key.startsWith("claude-")) {
       return parsed.gate === false && parsed.capture === false && parsed.feedback === false && parsed.statusline === false;
     }
-    return parsed.gate === false && parsed.capture === false;
+    return parsed.gate === false && parsed.capture === false && (!step.key.startsWith("cursor-user") || parsed.footer === false);
   } catch {
     return false;
   }
@@ -9736,7 +8863,7 @@ function registerUninstallCommand(program2, dependencies = {}) {
 // src/commands/welcome.ts
 var CMD_GUTTER = 38;
 var RECENT_LIMIT = 5;
-var WELCOME_AGENTS = ["claude", "codex", "hermes"];
+var WELCOME_AGENTS = ["claude", "codex", "cursor", "hermes"];
 function resolveWelcomeAgent(agentFlag, env) {
   if (agentFlag !== void 0 && WELCOME_AGENTS.includes(agentFlag)) {
     return agentFlag;
@@ -9744,6 +8871,9 @@ function resolveWelcomeAgent(agentFlag, env) {
   if (agentFlag === void 0 && env.HERMES_INTERACTIVE) {
     return "hermes";
   }
+  if (agentFlag === void 0 && env.CURSOR_AGENT) {
+    return "cursor";
+  }
   return void 0;
 }
 var CAPTURE_LINES = {
@@ -9752,6 +8882,7 @@ var CAPTURE_LINES = {
     "Capture starts once you trust the prim hooks \u2014 run /hooks in Codex;",
     "until then nothing is recorded."
   ],
+  cursor: ["Capture is automatic in trusted Cursor workspaces; restart Cursor CLI for the footer."],
   hermes: [
     "Capture starts once you approve the prim hooks when Hermes prompts;",
     "until then nothing is recorded."
@@ -9767,6 +8898,7 @@ var PASSIVE_LINES = {
     "Once you trust the prim hooks (/hooks in Codex), Primitive captures",
     "decisions passively while you work."
   ],
+  cursor: ["In trusted Cursor workspaces, Primitive captures decisions passively while you work."],
   hermes: [
     "Once you approve the prim hooks, Primitive captures decisions",
     "passively while you work."
@@ -9779,6 +8911,7 @@ var PASSIVE_LINES = {
 var GUIDANCE_PASSIVE = {
   claude: "Otherwise, Primitive passively captures decisions in the background while you work.",
   codex: "Otherwise, once you trust the prim hooks (run /hooks in Codex), Primitive passively captures decisions in the background while you work.",
+  cursor: "Otherwise, Primitive passively captures decisions in trusted Cursor workspaces while you work.",
   hermes: "Otherwise, once you approve the prim hooks when Hermes prompts, Primitive passively captures decisions in the background while you work.",
   generic: "Otherwise, once your agent's prim hooks are active, Primitive passively captures decisions in the background while you work."
 };
@@ -9873,10 +9006,7 @@ function welcomeJson(state, agent) {
   return { welcomed: true, org: "unknown" };
 }
 function registerWelcomeCommand(program2, deps = { getClient }) {
-  program2.command("welcome").description("Print a brief orientation to Primitive's decision graph").option(
-    "--agent <agent>",
-    "claude, codex, or hermes \u2014 tailors the capture guidance (Hermes auto-detected)"
-  ).action(async (options) => {
+  program2.command("welcome").description("Print a brief orientation to Primitive's decision graph").option("--agent <agent>", "claude, codex, cursor, or hermes \u2014 tailors the capture guidance").action(async (options) => {
     const agent = resolveWelcomeAgent(options.agent, process.env);
     const result = await fetchRecent({ limit: RECENT_LIMIT }, deps);
     const state = welcomeStateFromRecent(result);
@@ -9903,8 +9033,8 @@ function runStartupBackgroundWork(argv, env, work) {
 }
 
 // src/index.ts
-var __dirname = dirname8(fileURLToPath2(import.meta.url));
-var pkg = JSON.parse(readFileSync11(resolve5(__dirname, "../package.json"), "utf-8"));
+var __dirname = dirname6(fileURLToPath2(import.meta.url));
+var pkg = JSON.parse(readFileSync9(resolve4(__dirname, "../package.json"), "utf-8"));
 runStartupBackgroundWork(process.argv.slice(2), process.env, {
   notify: () => updateNotifier({ pkg }).notify(),
   flush: () => flushIfNeeded()
@@ -9923,6 +9053,7 @@ registerSessionCommands(program);
 registerDecisionsCommands(program);
 registerClaudeCommands(program);
 registerCodexCommands(program);
+registerCursorCommands(program);
 registerHermesCommands(program);
 registerDaemonCommands(program);
 registerGithubCommands(program);