@primitive.ai/prim 0.1.0-alpha.92 → 0.1.0-alpha.94

package/README.md

@@ -75,7 +75,7 @@ Install the Primitive CLI and activate passive decision capture for this reposit
 ```
 
 That single command runs the whole install and current-repository activation in one
-process (auth → session hooks → daemon → git hooks → skill → welcome). The detailed
+process (auth → session hooks → daemon → skill → activate this repository and wire its git hooks → welcome). The detailed
 step-by-step the agent follows — and the manual fallback — live in
 [`setup.md`](./setup.md).
 
@@ -89,12 +89,17 @@ prim setup --agent cursor    # Same, for Cursor IDE and Cursor CLI
 prim setup --agent codex     # Same, for OpenAI Codex
 prim setup --agent hermes    # Same, for Hermes Agent (global-only config)
 prim setup --no-daemon       # Stop it and persistently opt out of supervised delivery
+prim setup --global-hooks-path  # Also route every repository's git hooks through prim
 ```
 
-Orchestrates auth → session hooks → supervised daemon → capture-health gate → git hooks → skill → welcome,
+Orchestrates auth → session hooks → supervised daemon → git hooks (`--scope project`, or `--global-hooks-path`) → skill → activate this repo (which wires its git hooks) → capture-health gate → welcome,
 re-running each underlying command so every step behaves exactly as if run by
 hand (including the browser login). Idempotent — safe to re-run.
 
+Setup wires the current repository's git hooks and never changes git's global
+config on its own: a global `core.hooksPath` reroutes every repository on the
+machine. Pass `--global-hooks-path` to opt in; `prim --yes setup` does not.
+
 ### Uninstall
 
 ```bash
@@ -238,13 +243,39 @@ installation.
 
 A supervised long-lived companion process that continuously drains captured
 Moves, accelerates decision-graph reads, and powers the "team: N online"
-presence count. `prim setup` requires it to become healthy unless the explicit
-`--no-daemon` opt-out is supplied; hooks still fail soft if it later degrades.
+presence count. `prim setup` requires it to be live on the current version with
+an authenticated, healthy heartbeat unless the explicit `--no-daemon` opt-out is
+supplied. Hooks still fail soft if it later degrades.
+
+`prim daemon start` (and `restart`/`ensure`) does not gate on delivery. While
+Moves are past the 30s delivery SLA it reports them as draining in the
+background when the daemon's last sweep recorded no failure, or when the drains
+that failed acknowledged Moves before failing; another bucket delivering in the
+same sweep does not count. Journal buckets the daemon holds back (unbound,
+another organization, identity unavailable) read as delivery held back, and a
+failure with no progress reads as delivery failing; both are a ⚠ warning,
+still exit 0. Its JSON adds `draining`, `deliveryRetained`, `deliveryFailing`,
+and `ingestion` in those states. Start's JSON `healthy` means the start
+succeeded, so it can differ from `daemon status --json`, which stays degraded
+until the backlog drains. Setup's own health check reports a backlog the
+daemon is draining as a warning and fails on held-back buckets and on failures
+recorded without progress; standalone `prim doctor` still fails a missed SLA.
 
 ```bash
 prim daemon start      # start (stop / restart / status)
 ```
 
+Ordinary commands may upgrade an older daemon in the background. When an
+installed CLI runs an attended, allowlisted command (for example `auth`,
+`decisions`, `moves`, `skill`, or an agent's `install`/`status`) on macOS and
+finds the launchd daemon on an older version, or on its own version but unable
+to run (say, after a Node upgrade deleted the binary it pinned), it starts a
+detached `prim daemon ensure`, at most once an hour whatever version it
+targets. It never downgrades, never repoints the daemon at another deployment
+or config root, and never runs from hooks or their background drains, `daemon`,
+`doctor`, `setup` or its steps, `auth clear`, removal commands, a development
+checkout, or as root. Set `PRIM_DAEMON_DRIFT_HEAL=0` to turn it off.
+
 ### Decisions
 
 Read and respond to the decision graph.
@@ -295,15 +326,52 @@ authorizes one retry for the named decision.
 ### Hooks
 
 ```bash
-prim hooks install     # Install git hooks (pre-commit decision check + post-commit capture)
-prim hooks uninstall   # Remove the prim git hooks
+prim hooks install                # Wire the pre-commit, post-commit, and post-rewrite hooks
+prim hooks install --scope user --global-hooks-path  # Route every repository through prim (exits 3, with the reason on STDERR, if it installs nothing; 1 if prim's hook runtime is not staged)
+prim hooks snippet post-commit    # Print the block that wires one hook, to place by hand
+prim hooks uninstall              # Remove prim's blocks (and any hook file prim created)
 ```
 
 The pre-commit hook checks staged files against the live decision graph
-(warn-only — it never blocks the commit). The post-commit hook records each
-commit as a capture boundary for classification. Supports
-[Husky](https://typicode.github.io/husky/) — `prim hooks install` detects Husky
-and offers to install into `.husky/`.
+(warn-only — it never blocks the commit). The post-commit and post-rewrite hooks
+record each commit and each amend/rebase as capture boundaries for
+classification. All three act only in repos where prim is active (`prim enable`).
+Supports [Husky](https://typicode.github.io/husky/) — `prim hooks install`
+detects Husky and offers to install into `.husky/`.
+
+Each hook file gets one short block, inserted right after the shebang so it runs
+before any `exit` or `exec`. The block names no version and no machine path: it
+runs prim's staged entrypoint (`~/.config/prim/prim-git-hook-v1`) and does
+nothing on a machine without prim, so a tracked `.husky/*` file never changes
+across prim releases. `prim enable` and `prim hooks install` write it once and
+never move or rewrite a current block, reformatted or not. Agent session hooks
+only repair Git-private hook files under `.git` and prim's own hooks dir, and
+never add the pre-commit check. prim never edits a hooks dir outside the
+repository, such as a global `core.hooksPath` every repository shares, unless
+you run `prim hooks install --scope user --global-hooks-path` or answer yes at
+its terminal prompt. In a Husky v8 hook the block goes
+after the `husky.sh` line, so it runs once and honors `HUSKY=0`. `prim doctor`
+only reports; it never rewrites a hook.
+
+`prim doctor` also checks evidence rather than file contents: each post-commit
+run that reaches prim leaves a stamp in the checkout's git dir, and doctor's
+`hook-fired` check fails when a local commit made since the hooks were wired
+never reached prim. That catches an `exit` before prim's block, hand wiring
+that broke, or a git client whose environment cannot find prim. The check
+applies in manual mode too: once a repository is enabled, doctor expects your
+own wiring to reach prim. `prim disable` ends the expectation, so commits made
+while disabled are never judged. Turning prim off with `git config prim.active
+false` directly ends it too, once an agent session starts while it is off; if
+doctor still flags a commit made while it was off, run `prim disable` then
+`prim enable`.
+
+To wire the hooks yourself (lefthook, a custom Husky layout, …), run
+`git config prim.gitHooks manual` (or `--global`) first: prim then never writes
+a hook file. That setting is the only signal prim honors. It does not guess
+from a hook that already mentions prim, so without it, `prim enable` adds its
+block. Paste the block from `prim hooks snippet <hook>`, or have your hook
+manager run `~/.config/prim/prim-git-hook-v1 <hook> "$@"` (post-rewrite also
+needs Git's stdin).
 
 ### Presence statusline
 
@@ -338,6 +406,12 @@ prim moves tail           # Pretty-print recent journal entries
 prim moves flush          # Drain the local journals to the server (also runs from hooks)
 ```
 
+Any other command except `uninstall` and a `setup` that starts the daemon (or
+one of its steps) that finds Moves waiting over a minute (or cannot tell how
+long) hands them to a detached background `prim moves flush` and never waits for
+it. It starts none while a live daemon on the same version and deployment, with
+a healthy heartbeat and no recorded ingestion failure, already owns the drain.
+
 ### Skill
 
 ```bash

package/SKILL.md

@@ -223,7 +223,7 @@ With the daemon running (`npx --yes @primitive.ai/prim daemon start`), `npx --ye
 
 ## The git hooks
 
-`npx --yes @primitive.ai/prim hooks install` installs two git hooks:
+`npx --yes @primitive.ai/prim hooks install` installs three git hooks:
 
 ```
 npx --yes @primitive.ai/prim hooks install                       # auto-detects Husky and prompts
@@ -234,8 +234,11 @@ npx --yes @primitive.ai/prim hooks uninstall
 
 - **pre-commit** -- checks staged files against the live decision graph and prints any active decisions that reference them to stderr. It is **warn-only**: failures (auth, network, backend) or matches never block the commit; a successful `git commit` doesn't prove the check ran clean. When the check can't complete it says so ("not verified" / "truncated") rather than implying all-clear.
 - **post-commit** -- records each commit as a capture boundary so the server can classify the surrounding work into decisions. It never blocks and runs in the background.
+- **post-rewrite** -- records amend/rebase rewrites the same way, in the background.
 
-Under `CI=1` (or with `--non-interactive`), `hooks install` fails fast in a Husky repo unless `--yes` or `--target` is set; the error names both escapes. `hooks uninstall` only removes the `.git/hooks` copies — if a hook was installed into `.husky/`, remove the prim block from that file manually. To suppress the hooks for one commit, use `git commit --no-verify`.
+All three act only where the repo is active (`prim enable`). Each hook file gets one version-stable block right after its shebang; `prim enable` and `hooks install` write it once and never rewrite a current block, while session hooks only repair Git-private files under `.git` (and never add the pre-commit check). prim never edits a hooks dir outside the repository, such as a shared global `core.hooksPath`: `hooks install --scope user` changes git's global hooks only with `--global-hooks-path` or a yes typed at a terminal. That changes every repository, so never pass the flag for the user without asking, and know that `--yes` does not count. `prim doctor`'s `hook-fired` check fails if a local commit since the hooks were wired never reached prim (in manual mode too, once the repo is enabled): surface it, since capture is silently missing. If the user wires the hooks themselves, they must set `git config prim.gitHooks manual` (prim does not infer hand wiring from what a hook mentions); prim then never edits their hook files; `npx --yes @primitive.ai/prim hooks snippet <hook>` prints the block to place.
+
+Under `CI=1` (or with `--non-interactive`), `hooks install` fails fast in a Husky repo that Husky has not yet configured, unless `--yes` or `--target` is set; the error names both escapes. `hooks uninstall` removes prim's blocks from `.git/hooks` and `.husky/` alike and leaves the rest of each hook untouched. To suppress the hooks for one commit, use `git commit --no-verify`.
 
 These git hooks are separate from the **session hooks** (`claude install` / `cursor install` / `codex install` / `hermes install`) that drive in-session capture (and Conflict Gates, when enabled).
 

package/dist/{chunk-67VNLLBN.js → chunk-2GP5UFV7.js}

@@ -782,6 +782,7 @@ export {
   jwtOrganizationId,
   syncDirectory,
   syncFile,
+  ensureDurableDirectory,
   atomicWriteFile,
   processIsAlive,
   withFileLockSync,

package/dist/{chunk-26P57LAR.js → chunk-AXQQMX2U.js}

@@ -7,7 +7,7 @@ import {
   syncDirectory,
   syncFile,
   withFileLockSync
-} from "./chunk-67VNLLBN.js";
+} from "./chunk-2GP5UFV7.js";
 
 // src/lib/bin-path.ts
 import { existsSync, readFileSync } from "fs";
@@ -127,6 +127,13 @@ function pinnedHookCommand(bin, args = "") {
 }
 var STABLE_HOOK_ARGUMENTS_RE = /^[-A-Za-z0-9_ ]*$/u;
 var STABLE_HOOK_BIN_RE = /^[A-Za-z0-9][A-Za-z0-9-]*$/u;
+var PRIM_CONFIG_SHELL_RESOLVER = [
+  'prim_absolute() { case "$1" in [/]* ) ;; *) return 1 ;; esac; case "$1" in [[:space:]]*|*[[:space:]]|*[/][/]*|*[/].[/]*|*[/]..[/]*|*[/].|*[/]..|?*[/]) return 1 ;; esac; }; ',
+  'prim_config=${PRIM_CONFIG_DIR:-}; if ! prim_absolute "$prim_config"; then prim_config=${XDG_CONFIG_HOME:-}; if prim_absolute "$prim_config"; then ',
+  'case "$prim_config" in /) prim_config=/prim ;; *) prim_config="$prim_config/prim" ;; esac; ',
+  'else prim_home=${HOME:-}; prim_absolute "$prim_home" || exit 78; case "$prim_home" in /) prim_config=/.config/prim ;; *) prim_config="$prim_home/.config/prim" ;; esac; ',
+  "fi; fi; "
+].join("");
 function stableHookCommand(bin, args = "") {
   if (!STABLE_HOOK_BIN_RE.test(bin) || !STABLE_HOOK_ARGUMENTS_RE.test(args)) {
     throw new Error("invalid stable hook command");
@@ -136,11 +143,7 @@ function stableHookCommand(bin, args = "") {
     // it as inert data during the rolling window so an older uninstall or
     // reinstall can remove the stable entry without invoking npm or PATH.
     `prim_legacy_reader='-p ${PKG_NAME}@stable prim-shim.sh ${bin} '; `,
-    'prim_absolute() { case "$1" in [/]* ) ;; *) return 1 ;; esac; case "$1" in [[:space:]]*|*[[:space:]]|*[/][/]*|*[/].[/]*|*[/]..[/]*|*[/].|*[/]..|?*[/]) return 1 ;; esac; }; ',
-    'prim_config=${PRIM_CONFIG_DIR:-}; if ! prim_absolute "$prim_config"; then prim_config=${XDG_CONFIG_HOME:-}; if prim_absolute "$prim_config"; then ',
-    'case "$prim_config" in /) prim_config=/prim ;; *) prim_config="$prim_config/prim" ;; esac; ',
-    'else prim_home=${HOME:-}; prim_absolute "$prim_home" || exit 78; case "$prim_home" in /) prim_config=/.config/prim ;; *) prim_config="$prim_home/.config/prim" ;; esac; ',
-    "fi; fi; ",
+    PRIM_CONFIG_SHELL_RESOLVER,
     `case "$prim_config" in /) prim_launcher=/${STABLE_HOOK_LAUNCHER_NAME} ;; *) prim_launcher="$prim_config/${STABLE_HOOK_LAUNCHER_NAME}" ;; esac; `,
     'exec "$prim_launcher" "$@"'
   ].join("");
@@ -220,6 +223,146 @@ import {
   writeFileSync
 } from "fs";
 import { delimiter, dirname as dirname2, isAbsolute as isAbsolute2, join as join2, resolve } from "path";
+
+// src/lib/git-hook-contract.ts
+var MANAGED_GIT_HOOK_NAMES = ["pre-commit", "post-commit", "post-rewrite"];
+var GIT_HOOK_ENTRYPOINT_NAME = "prim-git-hook-v1";
+var GIT_HOOK_CONTRACT_VERSION = 1;
+var CONTRACT_LINE_PREFIX = "# prim git hook v";
+var CONTRACT_LINE_RE = /^# prim git hook v([0-9]+)\b/mu;
+function blockMarkers(hook) {
+  return { start: `# >>> prim ${hook} hook >>>`, end: `# <<< prim ${hook} hook <<<` };
+}
+function entrypointCommand(hook) {
+  const script = [
+    PRIM_CONFIG_SHELL_RESOLVER,
+    `case "$prim_config" in /) prim_entry=/${GIT_HOOK_ENTRYPOINT_NAME} ;; `,
+    `*) prim_entry="$prim_config/${GIT_HOOK_ENTRYPOINT_NAME}" ;; esac; `,
+    '[ -x "$prim_entry" ] || exit 0; exec "$prim_entry" "$@"'
+  ].join("");
+  return `/bin/sh -c ${shellQuote(script)} ${GIT_HOOK_ENTRYPOINT_NAME} ${hook} "$@"`;
+}
+function managedHookBlock(hook) {
+  const { start, end } = blockMarkers(hook);
+  const header = `${CONTRACT_LINE_PREFIX}${GIT_HOOK_CONTRACT_VERSION}: a no-op unless prim is installed and enabled here (see \`prim hooks snippet ${hook}\`).`;
+  if (hook !== "post-rewrite") {
+    return `${start}
+${header}
+# shellcheck disable=SC2016
+${entrypointCommand(hook)} || :
+${end}`;
+  }
+  return `${start}
+${header}
+prim_rewrite_stdin=$(mktemp 2>/dev/null) || prim_rewrite_stdin=
+if test -n "\${prim_rewrite_stdin}" && cat >"\${prim_rewrite_stdin}"; then
+  # shellcheck disable=SC2016
+  ${entrypointCommand(hook)} <"\${prim_rewrite_stdin}" || :
+  exec <"\${prim_rewrite_stdin}"
+fi
+if test -n "\${prim_rewrite_stdin}"; then rm -f "\${prim_rewrite_stdin}"; fi
+unset prim_rewrite_stdin
+${end}`;
+}
+var OPEN_WORDS = /* @__PURE__ */ new Set(["then", "do", "else", "{", "(", "&&", "||", "|"]);
+function canonicalHookBlock(text) {
+  const tokens = [];
+  let word = "";
+  let quote;
+  const separate = () => {
+    const last = tokens.at(-1);
+    if (last !== void 0 && last !== ";" && !OPEN_WORDS.has(last)) tokens.push(";");
+  };
+  const flush = () => {
+    if (word === "") return;
+    const last = tokens.at(-1);
+    if (last !== void 0 && /^[0-9]*(?:<|>|>>|<&|>&)$/u.test(last))
+      tokens[tokens.length - 1] += word;
+    else tokens.push(word);
+    word = "";
+  };
+  for (let index = 0; index < text.length; index += 1) {
+    const char = text[index];
+    if (quote) {
+      word += char;
+      if (char === quote) quote = void 0;
+      continue;
+    }
+    if (char === "'" || char === '"') {
+      quote = char;
+      word += char;
+    } else if (char === "#" && word === "") {
+      const end = text.indexOf("\n", index);
+      const comment = text.slice(index, end === -1 ? text.length : end);
+      tokens.push(comment.replace(/\s+/gu, " ").trim());
+      index = (end === -1 ? text.length : end) - 1;
+    } else if (char === "\n" || char === ";") {
+      flush();
+      if (char === ";" && text[index + 1] === ";") {
+        tokens.push(";;");
+        index += 1;
+      } else {
+        separate();
+      }
+    } else if (/\s/u.test(char)) {
+      flush();
+    } else {
+      word += char;
+    }
+  }
+  flush();
+  while (tokens.at(-1) === ";") tokens.pop();
+  return tokens.join("\0");
+}
+function hookBlockContractVersion(block) {
+  const match = CONTRACT_LINE_RE.exec(block);
+  return match?.[1] ? Number(match[1]) : void 0;
+}
+var GIT_HOOK_ENTRYPOINT_CONTENT = `#!/bin/sh
+# prim git hook entrypoint v1 \u2014 managed by prim; do not edit.
+# Run by the "# >>> prim <hook> hook >>>" block in a Git hook file. Acts only
+# where prim is active (git config prim.active true) and never fails the hook.
+case "$0" in */*) prim_dir=\${0%/*} ;; *) exit 0 ;; esac
+prim_launcher="$prim_dir/${STABLE_HOOK_LAUNCHER_NAME}"
+[ -x "$prim_launcher" ] || exit 0
+[ "$(git config --get prim.active 2>/dev/null)" = "true" ] || exit 0
+prim_hook=\${1-}
+if [ "$#" -gt 0 ]; then shift; fi
+case "$prim_hook" in
+pre-commit)
+  "$prim_launcher" prim-pre-commit "$@" || :
+  ;;
+post-commit)
+  prim_sha=$(git rev-parse --verify HEAD 2>/dev/null) || exit 0
+  case "$prim_sha" in *[!0-9a-f]* | "") exit 0 ;; esac
+  case "\${#prim_sha}" in 40 | 64) ;; *) exit 0 ;; esac
+  prim_branch=$(git symbolic-ref --quiet --short HEAD 2>/dev/null) || prim_branch=
+  prim_observed=$(mktemp "\${TMPDIR:-/tmp}/prim-post-commit-observed.XXXXXXXX" 2>/dev/null) || prim_observed=
+  (
+    trap '' HUP
+    trap 'if [ -n "$prim_observed" ]; then rm -f "$prim_observed"; fi' 0
+    PRIM_COMMIT_SHA=$prim_sha PRIM_COMMIT_BRANCH=$prim_branch PRIM_COMMIT_OBSERVED_FILE=$prim_observed "$prim_launcher" prim-post-commit
+  ) </dev/null >/dev/null 2>&1 &
+  ;;
+post-rewrite)
+  case "\${1-}" in amend | rebase) prim_source=$1 ;; *) exit 0 ;; esac
+  prim_pairs=$(mktemp "\${TMPDIR:-/tmp}/prim-post-rewrite-pairs.XXXXXXXX" 2>/dev/null) || exit 0
+  if ! chmod 600 "$prim_pairs" 2>/dev/null || ! cat >"$prim_pairs"; then
+    rm -f "$prim_pairs"
+    exit 0
+  fi
+  prim_branch=$(git symbolic-ref --quiet --short HEAD 2>/dev/null) || prim_branch=
+  (
+    trap '' HUP
+    trap 'rm -f "$prim_pairs"' 0
+    PRIM_REWRITE_SOURCE=$prim_source PRIM_REWRITE_BRANCH=$prim_branch PRIM_REWRITE_PAIRS_FILE=$prim_pairs "$prim_launcher" prim-post-rewrite
+  ) </dev/null >/dev/null 2>&1 &
+  ;;
+esac
+exit 0
+`;
+
+// src/lib/hook-runtime.ts
 var HOOK_RUNTIME_SCHEMA_VERSION = 1;
 var DIRECTORY_MODE = 448;
 var DATA_FILE_MODE = 384;
@@ -263,6 +406,7 @@ function hookRuntimePaths(options = {}) {
   return {
     configDir,
     launcher: join2(configDir, STABLE_HOOK_LAUNCHER_NAME),
+    gitHookEntrypoint: join2(configDir, GIT_HOOK_ENTRYPOINT_NAME),
     runtimeDir,
     releasesDir: join2(runtimeDir, "releases"),
     current: join2(runtimeDir, "current"),
@@ -636,6 +780,13 @@ function stageHookRuntime(options = {}) {
         mode: LAUNCHER_MODE
       });
     }
+    const entrypointCurrent = gitHookEntrypointCurrent(paths);
+    if (!entrypointCurrent) {
+      atomicWriteFile(paths.gitHookEntrypoint, GIT_HOOK_ENTRYPOINT_CONTENT, {
+        ensureParent: true,
+        mode: LAUNCHER_MODE
+      });
+    }
     if (!selectorCurrent) {
       syncDirectory(paths.releasesDir);
       atomicWriteFile(paths.current, `${finalRelease.name}
@@ -652,13 +803,38 @@ function stageHookRuntime(options = {}) {
       now
     );
     return {
-      changed: !launcherCurrent || !selectorCurrent,
+      changed: !launcherCurrent || !entrypointCurrent || !selectorCurrent,
       releaseDir: finalRelease.dir,
       manifest: finalRelease.manifest,
       paths
     };
   });
 }
+function gitHookEntrypointCurrent(paths) {
+  try {
+    return readFileSync2(paths.gitHookEntrypoint, "utf8") === GIT_HOOK_ENTRYPOINT_CONTENT;
+  } catch {
+    return false;
+  }
+}
+function inspectGitHookEntrypoint(options = {}) {
+  let paths;
+  try {
+    paths = hookRuntimePaths(options);
+  } catch {
+    return "invalid";
+  }
+  try {
+    const entrypoint = lstatIfPresent(paths.gitHookEntrypoint);
+    if (!entrypoint) return "missing";
+    if (!entrypoint.isFile() || (Number(entrypoint.mode) & 64) === 0 || !gitHookEntrypointCurrent(paths) || readFileSync2(paths.launcher, "utf8") !== STABLE_HOOK_LAUNCHER_CONTENT || !lstatIfPresent(paths.current)?.isFile()) {
+      return "invalid";
+    }
+    return "ready";
+  } catch {
+    return "invalid";
+  }
+}
 function lstatIfPresent(path) {
   try {
     return lstatSync(path);
@@ -669,6 +845,12 @@ function lstatIfPresent(path) {
   }
 }
 function assertOwnedHookRuntime(paths) {
+  const entrypoint = lstatIfPresent(paths.gitHookEntrypoint);
+  if (entrypoint && (!entrypoint.isFile() || !gitHookEntrypointCurrent(paths))) {
+    throw new Error(
+      `refusing to remove unrecognized Git hook entrypoint at ${paths.gitHookEntrypoint}`
+    );
+  }
   const launcher = lstatIfPresent(paths.launcher);
   if (launcher) {
     if (!launcher.isFile() || readFileSync2(paths.launcher, "utf8") !== STABLE_HOOK_LAUNCHER_CONTENT) {
@@ -708,15 +890,18 @@ function assertOwnedHookRuntime(paths) {
 function removeHookRuntime(options = {}) {
   const paths = hookRuntimePaths(options);
   const hadLauncher = lstatIfPresent(paths.launcher) !== void 0;
+  const hadEntrypoint = lstatIfPresent(paths.gitHookEntrypoint) !== void 0;
   const hadRuntime = lstatIfPresent(paths.runtimeDir) !== void 0;
-  if (!hadLauncher && !hadRuntime) return { changed: false, paths };
+  if (!hadLauncher && !hadEntrypoint && !hadRuntime) return { changed: false, paths };
   assertOwnedHookRuntime(paths);
   if (!hadRuntime) {
+    rmSync(paths.gitHookEntrypoint, { force: true });
     rmSync(paths.launcher, { force: true });
-    return { changed: hadLauncher, paths };
+    return { changed: true, paths };
   }
   withFileLockSync(paths.selectionLock, () => {
     assertOwnedHookRuntime(paths);
+    if (lstatIfPresent(paths.gitHookEntrypoint)) rmSync(paths.gitHookEntrypoint, { force: true });
     if (lstatIfPresent(paths.launcher)) rmSync(paths.launcher, { force: true });
     const quarantined = `${paths.runtimeDir}.uninstall-${String(process.pid)}-${randomBytes(8).toString("hex")}`;
     renameSync(paths.runtimeDir, quarantined);
@@ -1460,15 +1645,24 @@ export {
   compareSemver,
   binFile,
   packageVersion,
+  packageRoot,
   pinnedNpxArgs,
   pinnedNpxCommand,
   pinnedHookCommand,
   stableHookCommand,
   commandMatchesBin,
   hookCommandResolutions,
+  MANAGED_GIT_HOOK_NAMES,
+  GIT_HOOK_CONTRACT_VERSION,
+  blockMarkers,
+  managedHookBlock,
+  canonicalHookBlock,
+  hookBlockContractVersion,
   hookRuntimePaths,
   inspectHookRuntime,
+  stableNodePath,
   stageHookRuntime,
+  inspectGitHookEntrypoint,
   assertOwnedHookRuntime,
   removeHookRuntime,
   projectRoot,

package/dist/{chunk-M6RIJVRE.js → chunk-DSWT6BCC.js}

@@ -1,6 +1,7 @@
 import {
-  getClient
-} from "./chunk-PCVGBE5B.js";
+  getClient,
+  terminalSafeLine
+} from "./chunk-G2VMA2QO.js";
 import {
   gitToplevel,
   githubRepositoryFullName
@@ -8,7 +9,7 @@ import {
 import {
   __commonJS,
   __toESM
-} from "./chunk-67VNLLBN.js";
+} from "./chunk-2GP5UFV7.js";
 
 // node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/runtime/ucs2length.js
 var require_ucs2length = __commonJS({
@@ -18331,6 +18332,73 @@ function scheduleCollectScopeRefresh(cwd, collectScopeVersion, dependencies = de
   scheduledRefreshes.set(cwd, refresh);
 }
 
+// src/lib/ansi.ts
+var ANSI_CODES = {
+  yellow: "\x1B[33m",
+  magenta: "\x1B[35m",
+  blue: "\x1B[34m",
+  cyan: "\x1B[36m",
+  green: "\x1B[32m",
+  red: "\x1B[31m",
+  // 256-color approximation of the orange trigger marker (xterm 208).
+  orange: "\x1B[38;5;208m",
+  gray: "\x1B[90m"
+};
+var ANSI_RESET = "\x1B[0m";
+var ANSI_DIM = "\x1B[2m";
+var ANSI_BOLD = "\x1B[1m";
+function supportsColor() {
+  if (process.env.NO_COLOR !== void 0 && process.env.NO_COLOR !== "") {
+    return false;
+  }
+  return process.stderr.isTTY === true;
+}
+function color(text, c) {
+  if (!supportsColor()) {
+    return text;
+  }
+  return `${ANSI_CODES[c]}${text}${ANSI_RESET}`;
+}
+function dim(text) {
+  if (!supportsColor()) {
+    return text;
+  }
+  return `${ANSI_DIM}${text}${ANSI_RESET}`;
+}
+function bold(text) {
+  if (!supportsColor()) {
+    return text;
+  }
+  return `${ANSI_BOLD}${text}${ANSI_RESET}`;
+}
+var AREA_COLORS = {
+  auth: "yellow",
+  data: "magenta",
+  mobile: "blue",
+  infra: "cyan",
+  ui: "green",
+  billing: "orange",
+  api: "blue",
+  docs: "gray",
+  testing: "gray"
+};
+function colorForArea(area) {
+  if (!area) {
+    return "gray";
+  }
+  return AREA_COLORS[area] ?? "gray";
+}
+var MAX_HEALTH_ERROR_LENGTH = 240;
+function boundedHealthError(value) {
+  if (!value) return void 0;
+  const clean = terminalSafeLine(value);
+  if (!clean) return void 0;
+  return clean.length <= MAX_HEALTH_ERROR_LENGTH ? clean : `${clean.slice(0, MAX_HEALTH_ERROR_LENGTH - 1)}\u2026`;
+}
+function stripAnsi(text) {
+  return text.replace(/\u001b\[[0-9;]*m/g, "");
+}
+
 export {
   repoActiveFlag,
   isRepoActive,
@@ -18354,5 +18422,11 @@ export {
   isGitHubInstallIntentStatusResponse,
   cachedCollectScopeAdmits,
   fetchAndCacheCollectScope,
-  scheduleCollectScopeRefresh
+  scheduleCollectScopeRefresh,
+  color,
+  dim,
+  bold,
+  colorForArea,
+  boundedHealthError,
+  stripAnsi
 };