@primitive.ai/prim 0.1.0-alpha.90 → 0.1.0-alpha.92

package/dist/{chunk-UZPBB7V4.js → chunk-ADUTW66W.js}

@@ -1,26 +1,30 @@
 import {
-  formatStatusline,
-  packageVersion
-} from "./chunk-PMRDE2DA.js";
+  formatStatusline
+} from "./chunk-WX52U7Z2.js";
 import {
   decisionIngestionStatus,
-  gitToplevel,
   repositoryBindingState
-} from "./chunk-MAZWKJGL.js";
+} from "./chunk-M6RIJVRE.js";
 import {
   getSiteUrl,
   isSessionEnded,
-  terminalSafeText,
-  withFileLock
-} from "./chunk-Z7YPFWAZ.js";
+  terminalSafeText
+} from "./chunk-PCVGBE5B.js";
+import {
+  packageVersion
+} from "./chunk-26P57LAR.js";
+import {
+  gitToplevel
+} from "./chunk-H4UNYFUC.js";
 import {
   daemonPrincipalsMatch,
   daemonRequest,
   resolveDaemonPrincipal
-} from "./chunk-CUE2LKLR.js";
+} from "./chunk-KFXF2V5G.js";
 import {
-  primConfigDirectory
-} from "./chunk-3EEFL6NJ.js";
+  primConfigDirectory,
+  withFileLock
+} from "./chunk-67VNLLBN.js";
 
 // src/hooks/codex-context.ts
 import { createHash, randomBytes as randomBytes2 } from "crypto";
@@ -61,9 +65,7 @@ var CODEX_DRAFT_DIGEST_MAX_SEEN_IDS = 4096;
 var CODEX_DIGEST_STATE_RETENTION_MS = 7 * 24 * 60 * 60 * 1e3;
 var CODEX_DIGEST_STATE_MAX_FILES = 256;
 var STATE_VERSION = 1;
-var STATE_DIRECTORY = ["codex", "decision-digests"];
 var DRAFT_STATE_VERSION = 2;
-var DRAFT_STATE_DIRECTORY = ["codex", "decision-draft-deliveries"];
 var NO_CURSOR = -1;
 function hasVisibleCodexMessage(output) {
   if (typeof output !== "object" || output === null || Array.isArray(output)) return false;
@@ -95,11 +97,11 @@ function appendCodexContext(output, context) {
   }
   return next;
 }
-function stateRoot() {
-  return join(primConfigDirectory(), ...STATE_DIRECTORY);
+function stateRoot(namespace) {
+  return join(primConfigDirectory(), namespace, "decision-digests");
 }
-function draftStateRoot() {
-  return join(primConfigDirectory(), ...DRAFT_STATE_DIRECTORY);
+function draftStateRoot(namespace) {
+  return join(primConfigDirectory(), namespace, "decision-draft-deliveries");
 }
 function workspaceFor(cwd) {
   try {
@@ -111,12 +113,12 @@ function workspaceFor(cwd) {
 function statePath(args) {
   const identity = `${args.siteUrl}\0${workspaceFor(args.cwd)}\0${args.sessionId}`;
   const key = createHash("sha256").update(identity).digest("hex");
-  return join(stateRoot(), `${key}.json`);
+  return join(stateRoot(args.namespace), `${key}.json`);
 }
 function draftStatePath(args) {
   const identity = `${args.siteUrl}\0${workspaceFor(args.cwd)}\0${args.sessionId}\0${args.principalId}\0${args.organizationId}\0${args.credentialFingerprint}`;
   const key = createHash("sha256").update(identity).digest("hex");
-  return join(draftStateRoot(), `${key}.json`);
+  return join(draftStateRoot(args.namespace), `${key}.json`);
 }
 function parseState(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
@@ -307,14 +309,14 @@ function mergeState(latest, args) {
     updatedAt: args.now
   };
 }
-async function commitState(path, args) {
+async function commitState(path, args, namespace) {
   try {
     await withFileLock(
       `${path}.lock`,
       () => {
         const latest = readState(path);
-        writeStateFile(path, stateRoot(), mergeState(latest, args));
-        cleanupStateFiles(stateRoot(), args.now);
+        writeStateFile(path, stateRoot(namespace), mergeState(latest, args));
+        cleanupStateFiles(stateRoot(namespace), args.now);
       },
       { timeoutMs: 50, pollMs: 10 }
     );
@@ -336,7 +338,7 @@ function mergeDraftState(latest, args) {
     updatedAt: args.now
   };
 }
-async function commitDraftState(path, args) {
+async function commitDraftState(path, args, namespace) {
   try {
     let next;
     await withFileLock(
@@ -344,8 +346,8 @@ async function commitDraftState(path, args) {
       () => {
         const latest = readDraftState(path);
         next = mergeDraftState(latest, args);
-        writeStateFile(path, draftStateRoot(), next);
-        cleanupStateFiles(draftStateRoot(), args.now);
+        writeStateFile(path, draftStateRoot(namespace), next);
+        cleanupStateFiles(draftStateRoot(namespace), args.now);
       },
       { timeoutMs: 50, pollMs: 10 }
     );
@@ -355,9 +357,10 @@ async function commitDraftState(path, args) {
   }
 }
 async function prepareCodexContext(options) {
+  const namespace = options.namespace ?? "codex";
   const siteUrl = getSiteUrl();
   const workspace = workspaceFor(options.cwd);
-  const path = statePath({ cwd: options.cwd, sessionId: options.sessionId, siteUrl });
+  const path = statePath({ cwd: options.cwd, sessionId: options.sessionId, siteUrl, namespace });
   const previous = readState(path);
   const principal = resolveDaemonPrincipal();
   const privatePath = principal ? draftStatePath({
@@ -366,7 +369,8 @@ async function prepareCodexContext(options) {
     siteUrl,
     principalId: principal.principalId,
     organizationId: principal.organizationId,
-    credentialFingerprint: principal.credentialFingerprint
+    credentialFingerprint: principal.credentialFingerprint,
+    namespace
   }) : void 0;
   const previousDraft = privatePath ? readDraftState(privatePath) : void 0;
   const startup = options.startup === true;
@@ -456,32 +460,40 @@ async function prepareCodexContext(options) {
     acknowledge: async (handedOff) => {
       if (!handedOff || acknowledged) return;
       acknowledged = true;
-      await commitState(path, {
-        sessionId: options.sessionId,
-        siteUrl,
-        workspace,
-        startedAt,
-        watermarkMs: pageWatermark,
-        seenIds: freshRows.map((row) => row.id),
-        report,
-        feedAvailable,
-        now: Date.now()
-      });
+      await commitState(
+        path,
+        {
+          sessionId: options.sessionId,
+          siteUrl,
+          workspace,
+          startedAt,
+          watermarkMs: pageWatermark,
+          seenIds: freshRows.map((row) => row.id),
+          report,
+          feedAvailable,
+          now: Date.now()
+        },
+        namespace
+      );
       if (privatePath === void 0 || principal === void 0 || draftPageToken === void 0) {
         return;
       }
       let persistedDraft = previousDraft;
       if (draftDigest?.deliveredIds.length) {
-        persistedDraft = await commitDraftState(privatePath, {
-          sessionId: options.sessionId,
-          siteUrl,
-          workspace,
-          principalId: principal.principalId,
-          organizationId: principal.organizationId,
-          credentialFingerprint: principal.credentialFingerprint,
-          deliveredIds: draftDigest.deliveredIds,
-          now: Date.now()
-        });
+        persistedDraft = await commitDraftState(
+          privatePath,
+          {
+            sessionId: options.sessionId,
+            siteUrl,
+            workspace,
+            principalId: principal.principalId,
+            organizationId: principal.organizationId,
+            credentialFingerprint: principal.credentialFingerprint,
+            deliveredIds: draftDigest.deliveredIds,
+            now: Date.now()
+          },
+          namespace
+        );
       }
       const seenDrafts = new Set(persistedDraft?.seenDraftIds ?? []);
       const deliveredOnThisPage = draftPageActionableIds.filter((id) => seenDrafts.has(id));

package/dist/{chunk-LEMX3IOG.js → chunk-BTNNEH2W.js}

@@ -1,6 +1,6 @@
 import {
   terminalSafeLine
-} from "./chunk-Z7YPFWAZ.js";
+} from "./chunk-PCVGBE5B.js";
 
 // src/lib/ansi.ts
 var ANSI_CODES = {

package/dist/{chunk-YWO7O6QG.js → chunk-FBAYCS3X.js}

@@ -1,11 +1,11 @@
 import {
   getSiteUrl
-} from "./chunk-Z7YPFWAZ.js";
+} from "./chunk-PCVGBE5B.js";
 import {
   jwtOrganizationId,
   primConfigDirectory,
   resolveAuthCredential
-} from "./chunk-3EEFL6NJ.js";
+} from "./chunk-67VNLLBN.js";
 
 // src/journal.ts
 import {

package/dist/{chunk-R26A7TWY.js → chunk-FKXFUUWJ.js}

@@ -1,6 +1,6 @@
 import {
   scheduleCollectScopeRefresh
-} from "./chunk-MAZWKJGL.js";
+} from "./chunk-M6RIJVRE.js";
 
 // src/ingest-response.ts
 var IngestAcknowledgementError = class extends Error {

package/dist/chunk-H4UNYFUC.js

@@ -0,0 +1,196 @@
+// src/lib/git.ts
+import { execFileSync } from "child_process";
+import { createHash } from "crypto";
+import { lstatSync, realpathSync } from "fs";
+import { basename, dirname, isAbsolute, relative, resolve, sep } from "path";
+var GIT_TIMEOUT_MS = 1e3;
+var GITHUB_OWNER_PATTERN = /^(?![A-Za-z0-9-]*--)[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/u;
+var GITHUB_REPOSITORY_PATTERN = /^[A-Za-z0-9._-]{1,100}$/u;
+function gitToplevel(cwd) {
+  try {
+    return execFileSync("git", ["rev-parse", "--show-toplevel"], {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function gitValue(cwd, args) {
+  try {
+    const value = execFileSync("git", args, {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS
+    }).trim();
+    return value || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function currentBranch(cwd) {
+  return gitValue(cwd, ["symbolic-ref", "--quiet", "--short", "HEAD"]);
+}
+function githubRepositoryFullName(cwd) {
+  const remote = gitValue(cwd, ["config", "--get", "remote.origin.url"]);
+  if (!remote || [...remote].some((char) => char < " " || char === "\x7F")) return null;
+  const match = /^(?:git@github\.com:([^?#]+)|(?:https|ssh):\/\/(?:[^/@]+@)?github\.com(?::\d+)?\/([^?#]+))$/i.exec(
+    remote
+  );
+  const path = match?.[1] ?? match?.[2];
+  if (!path) return null;
+  const parts = path.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "").split("/");
+  if (parts.length !== 2 || !GITHUB_OWNER_PATTERN.test(parts[0] ?? "") || !GITHUB_REPOSITORY_PATTERN.test(parts[1] ?? "")) {
+    return null;
+  }
+  return `${parts[0]}/${parts[1]}`;
+}
+function canonicalGitRoot(cwd) {
+  try {
+    const top = gitToplevel(cwd);
+    return top ? realpathSync.native(top) : null;
+  } catch {
+    return null;
+  }
+}
+function normalizeOriginRemote(remote) {
+  const value = remote.trim();
+  if (!value) return void 0;
+  const scp = !value.includes("://") ? /^(?:[^@/\s]+@)?(?<host>[^:/\s]+):(?<path>.+)$/.exec(value)?.groups : void 0;
+  if (scp?.host && scp.path) {
+    const path = scp.path.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "");
+    return path ? `${scp.host.toLowerCase()}/${path}` : void 0;
+  }
+  try {
+    const url = new URL(value);
+    url.username = "";
+    url.password = "";
+    url.search = "";
+    url.hash = "";
+    const path = url.pathname.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "");
+    if (url.host && path) return `${url.host.toLowerCase()}/${path}`;
+    return void 0;
+  } catch {
+    return void 0;
+  }
+}
+function opaqueRepoKey(source, value) {
+  return `repo_v1_${createHash("sha256").update(`${source}\0${value}`).digest("hex")}`;
+}
+function resolveRepositoryContext(cwd = process.cwd()) {
+  const top = gitToplevel(cwd);
+  if (!top) return null;
+  let repoRoot;
+  try {
+    repoRoot = realpathSync.native(top);
+  } catch {
+    repoRoot = resolve(top);
+  }
+  const origin = gitValue(repoRoot, ["config", "--get", "remote.origin.url"]);
+  const repoFullName = githubRepositoryFullName(repoRoot) ?? void 0;
+  const normalizedOrigin = origin ? normalizeOriginRemote(origin) : void 0;
+  if (normalizedOrigin) {
+    return {
+      repoRoot,
+      repoKey: opaqueRepoKey("origin", normalizedOrigin),
+      identitySource: "origin",
+      repoFullName
+    };
+  }
+  const roots = gitValue(repoRoot, ["rev-list", "--max-parents=0", "HEAD"])?.split(/\s+/).filter(Boolean).sort();
+  if (roots && roots.length > 0) {
+    return {
+      repoRoot,
+      repoKey: opaqueRepoKey("root_commit", roots.join("\n")),
+      identitySource: "root_commit",
+      repoFullName
+    };
+  }
+  return { repoRoot, repoFullName };
+}
+function nearestExistingAncestor(path) {
+  const suffix = [];
+  let cursor = path;
+  while (true) {
+    try {
+      lstatSync(cursor);
+      break;
+    } catch (error) {
+      const code = typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
+      if (code !== "ENOENT" && code !== "ENOTDIR") return null;
+      const parent = dirname(cursor);
+      if (parent === cursor) return null;
+      suffix.unshift(cursor.slice(parent.length + (parent.endsWith(sep) ? 0 : 1)));
+      cursor = parent;
+    }
+  }
+  try {
+    return { real: realpathSync.native(cursor), suffix };
+  } catch {
+    return null;
+  }
+}
+function canonicalRepositoryPathScoped(filePath, context, baseDir) {
+  if (!filePath || filePath !== filePath.trim() || filePath.includes("\0")) {
+    return { ok: false, reason: "invalid_path" };
+  }
+  const absolute = resolve(baseDir, filePath);
+  const resolved = nearestExistingAncestor(absolute);
+  if (!resolved) return { ok: false, reason: "invalid_path" };
+  const target = resolve(resolved.real, ...resolved.suffix);
+  const rel = relative(context.repoRoot, target);
+  if (!rel || rel === ".") return { ok: false, reason: "invalid_path" };
+  if (isAbsolute(rel) || rel === ".." || rel.startsWith(`..${sep}`)) {
+    return { ok: false, reason: "outside_repository" };
+  }
+  return { ok: true, file: sep === "/" ? rel : rel.split(sep).join("/") };
+}
+function canonicalRepositoryPathLegacy(filePath, cwd, repositoryRoot = canonicalGitRoot(cwd)) {
+  if (!repositoryRoot || !filePath || [...filePath].some((char) => char < " " || char === "\x7F" || "~*?[]{}$`\\".includes(char)))
+    return null;
+  const absolute = resolve(cwd, filePath);
+  let target;
+  try {
+    const stat = lstatSync(absolute);
+    if (!stat.isFile() || stat.isSymbolicLink()) return null;
+    target = realpathSync.native(absolute);
+  } catch (error) {
+    if (!(error instanceof Error) || error.code !== "ENOENT") {
+      return null;
+    }
+    try {
+      const parent = realpathSync.native(dirname(absolute));
+      if (!lstatSync(parent).isDirectory()) return null;
+      target = resolve(parent, basename(absolute));
+    } catch {
+      return null;
+    }
+  }
+  const rel = relative(repositoryRoot, target);
+  if (!rel || isAbsolute(rel) || rel === ".." || rel.startsWith(`..${sep}`)) {
+    return null;
+  }
+  return sep === "/" ? rel : rel.split(sep).join("/");
+}
+function canonicalRepositoryPath(filePath, contextOrCwd, baseDirOrRoot) {
+  if (typeof contextOrCwd === "string") {
+    return canonicalRepositoryPathLegacy(filePath, contextOrCwd, baseDirOrRoot);
+  }
+  return canonicalRepositoryPathScoped(
+    filePath,
+    contextOrCwd,
+    baseDirOrRoot ?? contextOrCwd.repoRoot
+  );
+}
+
+export {
+  gitToplevel,
+  currentBranch,
+  githubRepositoryFullName,
+  canonicalGitRoot,
+  resolveRepositoryContext,
+  canonicalRepositoryPath
+};

package/dist/{chunk-CUE2LKLR.js → chunk-KFXF2V5G.js}

@@ -2,7 +2,7 @@ import {
   decodeJwtPayload,
   primConfigDirectory,
   resolveAuthCredential
-} from "./chunk-3EEFL6NJ.js";
+} from "./chunk-67VNLLBN.js";
 
 // src/daemon/client.ts
 import { createConnection } from "net";

package/dist/{chunk-6IWNH776.js → chunk-LFFLHSQO.js}

@@ -1,10 +1,10 @@
 import {
   analyzeShellTargets,
   extractFileTargets
-} from "./chunk-PPQYQEIR.js";
+} from "./chunk-ZB4F75SZ.js";
 import {
   canonicalRepositoryPath
-} from "./chunk-MAZWKJGL.js";
+} from "./chunk-H4UNYFUC.js";
 
 // src/hooks/file-refs.ts
 var MAX_PREFLIGHT_FILE_TARGETS = 25;
@@ -26,7 +26,8 @@ function preserveHookFileMetadata(payload, resolution) {
   return { ...payload, primitive };
 }
 function resolveHookFileRefs(args) {
-  const command = (args.agent === "claude_code" || args.agent === "codex") && args.toolName === "Bash" ? typeof args.toolInput === "string" ? args.toolInput : args.toolInput && typeof args.toolInput === "object" && typeof args.toolInput.command === "string" ? args.toolInput.command : void 0 : void 0;
+  const isShellTool = (args.agent === "claude_code" || args.agent === "codex") && args.toolName === "Bash" || args.agent === "cursor" && args.toolName === "Shell";
+  const command = isShellTool ? typeof args.toolInput === "string" ? args.toolInput : args.toolInput && typeof args.toolInput === "object" && typeof args.toolInput.command === "string" ? args.toolInput.command : void 0 : void 0;
   const shell = command === void 0 ? void 0 : analyzeShellTargets(command);
   const shellMutation = shell?.mutation === "none" ? "none" : shell?.coverage === "complete" ? "resolved" : shell ? "unresolved" : void 0;
   const readPath = args.agent === "claude_code" && args.toolName === "Read" && args.toolInput && typeof args.toolInput === "object" && typeof args.toolInput.file_path === "string" ? [args.toolInput.file_path] : void 0;