@primitive.ai/prim 0.1.0-alpha.92 → 0.1.0-alpha.94

package/dist/hook-runtime/hooks/session-start.js

@@ -242,6 +242,13 @@ function pinnedNpxCommand(bin, args = [], options = {}) {
 }
 var STABLE_HOOK_ARGUMENTS_RE = /^[-A-Za-z0-9_ ]*$/u;
 var STABLE_HOOK_BIN_RE = /^[A-Za-z0-9][A-Za-z0-9-]*$/u;
+var PRIM_CONFIG_SHELL_RESOLVER = [
+  'prim_absolute() { case "$1" in [/]* ) ;; *) return 1 ;; esac; case "$1" in [[:space:]]*|*[[:space:]]|*[/][/]*|*[/].[/]*|*[/]..[/]*|*[/].|*[/]..|?*[/]) return 1 ;; esac; }; ',
+  'prim_config=${PRIM_CONFIG_DIR:-}; if ! prim_absolute "$prim_config"; then prim_config=${XDG_CONFIG_HOME:-}; if prim_absolute "$prim_config"; then ',
+  'case "$prim_config" in /) prim_config=/prim ;; *) prim_config="$prim_config/prim" ;; esac; ',
+  'else prim_home=${HOME:-}; prim_absolute "$prim_home" || exit 78; case "$prim_home" in /) prim_config=/.config/prim ;; *) prim_config="$prim_home/.config/prim" ;; esac; ',
+  "fi; fi; "
+].join("");
 function stableHookCommand(bin, args = "") {
   if (!STABLE_HOOK_BIN_RE.test(bin) || !STABLE_HOOK_ARGUMENTS_RE.test(args)) {
     throw new Error("invalid stable hook command");
@@ -251,11 +258,7 @@ function stableHookCommand(bin, args = "") {
     // it as inert data during the rolling window so an older uninstall or
     // reinstall can remove the stable entry without invoking npm or PATH.
     `prim_legacy_reader='-p ${PKG_NAME}@stable prim-shim.sh ${bin} '; `,
-    'prim_absolute() { case "$1" in [/]* ) ;; *) return 1 ;; esac; case "$1" in [[:space:]]*|*[[:space:]]|*[/][/]*|*[/].[/]*|*[/]..[/]*|*[/].|*[/]..|?*[/]) return 1 ;; esac; }; ',
-    'prim_config=${PRIM_CONFIG_DIR:-}; if ! prim_absolute "$prim_config"; then prim_config=${XDG_CONFIG_HOME:-}; if prim_absolute "$prim_config"; then ',
-    'case "$prim_config" in /) prim_config=/prim ;; *) prim_config="$prim_config/prim" ;; esac; ',
-    'else prim_home=${HOME:-}; prim_absolute "$prim_home" || exit 78; case "$prim_home" in /) prim_config=/.config/prim ;; *) prim_config="$prim_home/.config/prim" ;; esac; ',
-    "fi; fi; ",
+    PRIM_CONFIG_SHELL_RESOLVER,
     `case "$prim_config" in /) prim_launcher=/${STABLE_HOOK_LAUNCHER_NAME} ;; *) prim_launcher="$prim_config/${STABLE_HOOK_LAUNCHER_NAME}" ;; esac; `,
     'exec "$prim_launcher" "$@"'
   ].join("");
@@ -427,14 +430,14 @@ function throwIfAborted(signal) {
 }
 async function defaultSleep(ms, signal) {
   if (!signal) {
-    await new Promise((resolve9) => setTimeout(resolve9, ms));
+    await new Promise((resolve10) => setTimeout(resolve10, ms));
     return;
   }
   throwIfAborted(signal);
-  await new Promise((resolve9, reject) => {
+  await new Promise((resolve10, reject) => {
     const timer = setTimeout(() => {
       signal.removeEventListener("abort", onAbort);
-      resolve9();
+      resolve10();
     }, ms);
     const onAbort = () => {
       clearTimeout(timer);
@@ -476,6 +479,144 @@ async function withFileLock(lockDir, operation, options = {}) {
   }
 }
 
+// src/lib/git-hook-contract.ts
+var MANAGED_GIT_HOOK_NAMES = ["pre-commit", "post-commit", "post-rewrite"];
+var GIT_HOOK_ENTRYPOINT_NAME = "prim-git-hook-v1";
+var GIT_HOOK_CONTRACT_VERSION = 1;
+var CONTRACT_LINE_PREFIX = "# prim git hook v";
+var CONTRACT_LINE_RE = /^# prim git hook v([0-9]+)\b/mu;
+function blockMarkers(hook) {
+  return { start: `# >>> prim ${hook} hook >>>`, end: `# <<< prim ${hook} hook <<<` };
+}
+function entrypointCommand(hook) {
+  const script = [
+    PRIM_CONFIG_SHELL_RESOLVER,
+    `case "$prim_config" in /) prim_entry=/${GIT_HOOK_ENTRYPOINT_NAME} ;; `,
+    `*) prim_entry="$prim_config/${GIT_HOOK_ENTRYPOINT_NAME}" ;; esac; `,
+    '[ -x "$prim_entry" ] || exit 0; exec "$prim_entry" "$@"'
+  ].join("");
+  return `/bin/sh -c ${shellQuote(script)} ${GIT_HOOK_ENTRYPOINT_NAME} ${hook} "$@"`;
+}
+function managedHookBlock(hook) {
+  const { start, end } = blockMarkers(hook);
+  const header = `${CONTRACT_LINE_PREFIX}${GIT_HOOK_CONTRACT_VERSION}: a no-op unless prim is installed and enabled here (see \`prim hooks snippet ${hook}\`).`;
+  if (hook !== "post-rewrite") {
+    return `${start}
+${header}
+# shellcheck disable=SC2016
+${entrypointCommand(hook)} || :
+${end}`;
+  }
+  return `${start}
+${header}
+prim_rewrite_stdin=$(mktemp 2>/dev/null) || prim_rewrite_stdin=
+if test -n "\${prim_rewrite_stdin}" && cat >"\${prim_rewrite_stdin}"; then
+  # shellcheck disable=SC2016
+  ${entrypointCommand(hook)} <"\${prim_rewrite_stdin}" || :
+  exec <"\${prim_rewrite_stdin}"
+fi
+if test -n "\${prim_rewrite_stdin}"; then rm -f "\${prim_rewrite_stdin}"; fi
+unset prim_rewrite_stdin
+${end}`;
+}
+var OPEN_WORDS = /* @__PURE__ */ new Set(["then", "do", "else", "{", "(", "&&", "||", "|"]);
+function canonicalHookBlock(text) {
+  const tokens = [];
+  let word = "";
+  let quote;
+  const separate = () => {
+    const last = tokens.at(-1);
+    if (last !== void 0 && last !== ";" && !OPEN_WORDS.has(last)) tokens.push(";");
+  };
+  const flush = () => {
+    if (word === "") return;
+    const last = tokens.at(-1);
+    if (last !== void 0 && /^[0-9]*(?:<|>|>>|<&|>&)$/u.test(last))
+      tokens[tokens.length - 1] += word;
+    else tokens.push(word);
+    word = "";
+  };
+  for (let index = 0; index < text.length; index += 1) {
+    const char = text[index];
+    if (quote) {
+      word += char;
+      if (char === quote) quote = void 0;
+      continue;
+    }
+    if (char === "'" || char === '"') {
+      quote = char;
+      word += char;
+    } else if (char === "#" && word === "") {
+      const end = text.indexOf("\n", index);
+      const comment = text.slice(index, end === -1 ? text.length : end);
+      tokens.push(comment.replace(/\s+/gu, " ").trim());
+      index = (end === -1 ? text.length : end) - 1;
+    } else if (char === "\n" || char === ";") {
+      flush();
+      if (char === ";" && text[index + 1] === ";") {
+        tokens.push(";;");
+        index += 1;
+      } else {
+        separate();
+      }
+    } else if (/\s/u.test(char)) {
+      flush();
+    } else {
+      word += char;
+    }
+  }
+  flush();
+  while (tokens.at(-1) === ";") tokens.pop();
+  return tokens.join("\0");
+}
+function hookBlockContractVersion(block) {
+  const match = CONTRACT_LINE_RE.exec(block);
+  return match?.[1] ? Number(match[1]) : void 0;
+}
+var GIT_HOOK_ENTRYPOINT_CONTENT = `#!/bin/sh
+# prim git hook entrypoint v1 \u2014 managed by prim; do not edit.
+# Run by the "# >>> prim <hook> hook >>>" block in a Git hook file. Acts only
+# where prim is active (git config prim.active true) and never fails the hook.
+case "$0" in */*) prim_dir=\${0%/*} ;; *) exit 0 ;; esac
+prim_launcher="$prim_dir/${STABLE_HOOK_LAUNCHER_NAME}"
+[ -x "$prim_launcher" ] || exit 0
+[ "$(git config --get prim.active 2>/dev/null)" = "true" ] || exit 0
+prim_hook=\${1-}
+if [ "$#" -gt 0 ]; then shift; fi
+case "$prim_hook" in
+pre-commit)
+  "$prim_launcher" prim-pre-commit "$@" || :
+  ;;
+post-commit)
+  prim_sha=$(git rev-parse --verify HEAD 2>/dev/null) || exit 0
+  case "$prim_sha" in *[!0-9a-f]* | "") exit 0 ;; esac
+  case "\${#prim_sha}" in 40 | 64) ;; *) exit 0 ;; esac
+  prim_branch=$(git symbolic-ref --quiet --short HEAD 2>/dev/null) || prim_branch=
+  prim_observed=$(mktemp "\${TMPDIR:-/tmp}/prim-post-commit-observed.XXXXXXXX" 2>/dev/null) || prim_observed=
+  (
+    trap '' HUP
+    trap 'if [ -n "$prim_observed" ]; then rm -f "$prim_observed"; fi' 0
+    PRIM_COMMIT_SHA=$prim_sha PRIM_COMMIT_BRANCH=$prim_branch PRIM_COMMIT_OBSERVED_FILE=$prim_observed "$prim_launcher" prim-post-commit
+  ) </dev/null >/dev/null 2>&1 &
+  ;;
+post-rewrite)
+  case "\${1-}" in amend | rebase) prim_source=$1 ;; *) exit 0 ;; esac
+  prim_pairs=$(mktemp "\${TMPDIR:-/tmp}/prim-post-rewrite-pairs.XXXXXXXX" 2>/dev/null) || exit 0
+  if ! chmod 600 "$prim_pairs" 2>/dev/null || ! cat >"$prim_pairs"; then
+    rm -f "$prim_pairs"
+    exit 0
+  fi
+  prim_branch=$(git symbolic-ref --quiet --short HEAD 2>/dev/null) || prim_branch=
+  (
+    trap '' HUP
+    trap 'rm -f "$prim_pairs"' 0
+    PRIM_REWRITE_SOURCE=$prim_source PRIM_REWRITE_BRANCH=$prim_branch PRIM_REWRITE_PAIRS_FILE=$prim_pairs "$prim_launcher" prim-post-rewrite
+  ) </dev/null >/dev/null 2>&1 &
+  ;;
+esac
+exit 0
+`;
+
 // src/lib/paths.ts
 import { homedir as homedir2 } from "os";
 import { isAbsolute as isAbsolute2, join as join4, normalize } from "path";
@@ -529,6 +670,24 @@ var SOURCE_ENTRIES = Object.fromEntries(
     target.replace(/^dist\//u, "")
   ])
 );
+function hookRuntimePaths(options = {}) {
+  const env = options.env ?? process.env;
+  const configDir = primConfigDirectory({
+    ...options,
+    env,
+    homeDir: options.homeDir ?? env.HOME ?? ""
+  });
+  const runtimeDir = join5(configDir, "hook-runtime");
+  return {
+    configDir,
+    launcher: join5(configDir, STABLE_HOOK_LAUNCHER_NAME),
+    gitHookEntrypoint: join5(configDir, GIT_HOOK_ENTRYPOINT_NAME),
+    runtimeDir,
+    releasesDir: join5(runtimeDir, "releases"),
+    current: join5(runtimeDir, "current"),
+    selectionLock: join5(runtimeDir, "selection.lock")
+  };
+}
 var STABLE_HOOK_LAUNCHER_CONTENT = `#!/bin/sh
 set -eu
 case "$0" in */*) prim_launcher_dir=\${0%/*} ;; *) exit 78 ;; esac
@@ -548,6 +707,40 @@ case "$prim_node" in /*) ;; *) exit 69 ;; esac
 [ -x "$prim_node" ] && [ -f "$prim_entry" ] || exit 69
 exec "$prim_node" "$prim_entry" "$@"
 `;
+function gitHookEntrypointCurrent(paths) {
+  try {
+    return readFileSync3(paths.gitHookEntrypoint, "utf8") === GIT_HOOK_ENTRYPOINT_CONTENT;
+  } catch {
+    return false;
+  }
+}
+function inspectGitHookEntrypoint(options = {}) {
+  let paths;
+  try {
+    paths = hookRuntimePaths(options);
+  } catch {
+    return "invalid";
+  }
+  try {
+    const entrypoint = lstatIfPresent(paths.gitHookEntrypoint);
+    if (!entrypoint) return "missing";
+    if (!entrypoint.isFile() || (Number(entrypoint.mode) & 64) === 0 || !gitHookEntrypointCurrent(paths) || readFileSync3(paths.launcher, "utf8") !== STABLE_HOOK_LAUNCHER_CONTENT || !lstatIfPresent(paths.current)?.isFile()) {
+      return "invalid";
+    }
+    return "ready";
+  } catch {
+    return "invalid";
+  }
+}
+function lstatIfPresent(path) {
+  try {
+    return lstatSync(path);
+  } catch (error) {
+    const code = error.code;
+    if (code === "ENOENT" || code === "ENOTDIR") return void 0;
+    throw error;
+  }
+}
 
 // src/commands/claude-install.ts
 import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
@@ -881,13 +1074,13 @@ function buildHookOutput(options) {
   return output;
 }
 function writeHookOutput(output, stream = process.stdout) {
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     let settled = false;
     const finish = (ok, retainErrorListener = false) => {
       if (settled) return;
       settled = true;
       if (!retainErrorListener) stream.off("error", onError);
-      resolve9(ok);
+      resolve10(ok);
     };
     const onError = () => {
       if (settled) {
@@ -922,7 +1115,7 @@ async function handoffHookOutput(output, acknowledge, stream = process.stdout) {
 // src/hooks/hook-stdin.ts
 var DEFAULT_MAX_BYTES = 1024 * 1024;
 function readHookStdin(timeoutMs = 1e3, maxBytes = DEFAULT_MAX_BYTES) {
-  return new Promise((resolve9, reject) => {
+  return new Promise((resolve10, reject) => {
     const chunks = [];
     let bytes = 0;
     let settled = false;
@@ -934,7 +1127,7 @@ function readHookStdin(timeoutMs = 1e3, maxBytes = DEFAULT_MAX_BYTES) {
       process.stdin.removeAllListeners("end");
       process.stdin.removeAllListeners("error");
       if (error) reject(error);
-      else resolve9(Buffer.concat(chunks, bytes).toString("utf-8"));
+      else resolve10(Buffer.concat(chunks, bytes).toString("utf-8"));
     };
     const timer = setTimeout(() => finish(new Error("stdin read timeout")), timeoutMs);
     process.stdin.on("data", (chunk) => {
@@ -5191,10 +5384,10 @@ function resolveBlockMap({ composeNode: composeNode2, composeEmptyNode: composeE
   let offset = bm.offset;
   let commentEnd = null;
   for (const collItem of bm.items) {
-    const { start, key, sep: sep3, value } = collItem;
+    const { start, key, sep: sep4, value } = collItem;
     const keyProps = resolveProps(start, {
       indicator: "explicit-key-ind",
-      next: key ?? sep3?.[0],
+      next: key ?? sep4?.[0],
       offset,
       onError,
       parentIndent: bm.indent,
@@ -5208,7 +5401,7 @@ function resolveBlockMap({ composeNode: composeNode2, composeEmptyNode: composeE
         else if ("indent" in key && key.indent !== bm.indent)
           onError(offset, "BAD_INDENT", startColMsg);
       }
-      if (!keyProps.anchor && !keyProps.tag && !sep3) {
+      if (!keyProps.anchor && !keyProps.tag && !sep4) {
         commentEnd = keyProps.end;
         if (keyProps.comment) {
           if (map2.comment)
@@ -5232,7 +5425,7 @@ function resolveBlockMap({ composeNode: composeNode2, composeEmptyNode: composeE
     ctx.atKey = false;
     if (mapIncludes(ctx, map2.items, keyNode))
       onError(keyStart, "DUPLICATE_KEY", "Map keys must be unique");
-    const valueProps = resolveProps(sep3 ?? [], {
+    const valueProps = resolveProps(sep4 ?? [], {
       indicator: "map-value-ind",
       next: value,
       offset: keyNode.range[2],
@@ -5248,7 +5441,7 @@ function resolveBlockMap({ composeNode: composeNode2, composeEmptyNode: composeE
         if (ctx.options.strict && keyProps.start < valueProps.found.offset - 1024)
           onError(keyNode.range, "KEY_OVER_1024_CHARS", "The : indicator must be at most 1024 chars after the start of an implicit block mapping key");
       }
-      const valueNode = value ? composeNode2(ctx, value, valueProps, onError) : composeEmptyNode2(ctx, offset, sep3, null, valueProps, onError);
+      const valueNode = value ? composeNode2(ctx, value, valueProps, onError) : composeEmptyNode2(ctx, offset, sep4, null, valueProps, onError);
       if (ctx.schema.compat)
         flowIndentCheck(bm.indent, value, onError);
       offset = valueNode.range[2];
@@ -5324,7 +5517,7 @@ function resolveEnd(end, offset, reqSpace, onError) {
   let comment = "";
   if (end) {
     let hasSpace = false;
-    let sep3 = "";
+    let sep4 = "";
     for (const token of end) {
       const { source, type } = token;
       switch (type) {
@@ -5338,13 +5531,13 @@ function resolveEnd(end, offset, reqSpace, onError) {
           if (!comment)
             comment = cb;
           else
-            comment += sep3 + cb;
-          sep3 = "";
+            comment += sep4 + cb;
+          sep4 = "";
           break;
         }
         case "newline":
           if (comment)
-            sep3 += source;
+            sep4 += source;
           hasSpace = true;
           break;
         default:
@@ -5373,18 +5566,18 @@ function resolveFlowCollection({ composeNode: composeNode2, composeEmptyNode: co
   let offset = fc.offset + fc.start.source.length;
   for (let i = 0; i < fc.items.length; ++i) {
     const collItem = fc.items[i];
-    const { start, key, sep: sep3, value } = collItem;
+    const { start, key, sep: sep4, value } = collItem;
     const props = resolveProps(start, {
       flow: fcName,
       indicator: "explicit-key-ind",
-      next: key ?? sep3?.[0],
+      next: key ?? sep4?.[0],
       offset,
       onError,
       parentIndent: fc.indent,
       startOnNewline: false
     });
     if (!props.found) {
-      if (!props.anchor && !props.tag && !sep3 && !value) {
+      if (!props.anchor && !props.tag && !sep4 && !value) {
         if (i === 0 && props.comma)
           onError(props.comma, "UNEXPECTED_TOKEN", `Unexpected , in ${fcName}`);
         else if (i < fc.items.length - 1)
@@ -5438,8 +5631,8 @@ function resolveFlowCollection({ composeNode: composeNode2, composeEmptyNode: co
         }
       }
     }
-    if (!isMap2 && !sep3 && !props.found) {
-      const valueNode = value ? composeNode2(ctx, value, props, onError) : composeEmptyNode2(ctx, props.end, sep3, null, props, onError);
+    if (!isMap2 && !sep4 && !props.found) {
+      const valueNode = value ? composeNode2(ctx, value, props, onError) : composeEmptyNode2(ctx, props.end, sep4, null, props, onError);
       coll.items.push(valueNode);
       offset = valueNode.range[2];
       if (isBlock(value))
@@ -5451,7 +5644,7 @@ function resolveFlowCollection({ composeNode: composeNode2, composeEmptyNode: co
       if (isBlock(key))
         onError(keyNode.range, "BLOCK_IN_FLOW", blockMsg);
       ctx.atKey = false;
-      const valueProps = resolveProps(sep3 ?? [], {
+      const valueProps = resolveProps(sep4 ?? [], {
         flow: fcName,
         indicator: "map-value-ind",
         next: value,
@@ -5462,8 +5655,8 @@ function resolveFlowCollection({ composeNode: composeNode2, composeEmptyNode: co
       });
       if (valueProps.found) {
         if (!isMap2 && !props.found && ctx.options.strict) {
-          if (sep3)
-            for (const st of sep3) {
+          if (sep4)
+            for (const st of sep4) {
               if (st === valueProps.found)
                 break;
               if (st.type === "newline") {
@@ -5480,7 +5673,7 @@ function resolveFlowCollection({ composeNode: composeNode2, composeEmptyNode: co
         else
           onError(valueProps.start, "MISSING_CHAR", `Missing , or : between ${fcName} items`);
       }
-      const valueNode = value ? composeNode2(ctx, value, valueProps, onError) : valueProps.found ? composeEmptyNode2(ctx, valueProps.end, sep3, null, valueProps, onError) : null;
+      const valueNode = value ? composeNode2(ctx, value, valueProps, onError) : valueProps.found ? composeEmptyNode2(ctx, valueProps.end, sep4, null, valueProps, onError) : null;
       if (valueNode) {
         if (isBlock(value))
           onError(valueNode.range, "BLOCK_IN_FLOW", blockMsg);
@@ -5640,7 +5833,7 @@ function resolveBlockScalar(ctx, scalar, onError) {
       chompStart = i + 1;
   }
   let value = "";
-  let sep3 = "";
+  let sep4 = "";
   let prevMoreIndented = false;
   for (let i = 0; i < contentStart; ++i)
     value += lines[i][0].slice(trimIndent) + "\n";
@@ -5657,24 +5850,24 @@ function resolveBlockScalar(ctx, scalar, onError) {
       indent = "";
     }
     if (type === Scalar.BLOCK_LITERAL) {
-      value += sep3 + indent.slice(trimIndent) + content;
-      sep3 = "\n";
+      value += sep4 + indent.slice(trimIndent) + content;
+      sep4 = "\n";
     } else if (indent.length > trimIndent || content[0] === "	") {
-      if (sep3 === " ")
-        sep3 = "\n";
-      else if (!prevMoreIndented && sep3 === "\n")
-        sep3 = "\n\n";
-      value += sep3 + indent.slice(trimIndent) + content;
-      sep3 = "\n";
+      if (sep4 === " ")
+        sep4 = "\n";
+      else if (!prevMoreIndented && sep4 === "\n")
+        sep4 = "\n\n";
+      value += sep4 + indent.slice(trimIndent) + content;
+      sep4 = "\n";
       prevMoreIndented = true;
     } else if (content === "") {
-      if (sep3 === "\n")
+      if (sep4 === "\n")
         value += "\n";
       else
-        sep3 = "\n";
+        sep4 = "\n";
     } else {
-      value += sep3 + content;
-      sep3 = " ";
+      value += sep4 + content;
+      sep4 = " ";
       prevMoreIndented = false;
     }
   }
@@ -5848,25 +6041,25 @@ function foldLines(source) {
   if (!match)
     return source;
   let res = match[1];
-  let sep3 = " ";
+  let sep4 = " ";
   let pos = first.lastIndex;
   line.lastIndex = pos;
   while (match = line.exec(source)) {
     if (match[1] === "") {
-      if (sep3 === "\n")
-        res += sep3;
+      if (sep4 === "\n")
+        res += sep4;
       else
-        sep3 = "\n";
+        sep4 = "\n";
     } else {
-      res += sep3 + match[1];
-      sep3 = " ";
+      res += sep4 + match[1];
+      sep4 = " ";
     }
     pos = line.lastIndex;
   }
   const last = /[ \t]*(.*)/sy;
   last.lastIndex = pos;
   match = last.exec(source);
-  return res + sep3 + (match?.[1] ?? "");
+  return res + sep4 + (match?.[1] ?? "");
 }
 function doubleQuotedValue(source, onError) {
   let res = "";
@@ -7483,18 +7676,18 @@ var Parser = class {
     if (this.type === "map-value-ind") {
       const prev = getPrevProps(this.peek(2));
       const start = getFirstKeyStartProps(prev);
-      let sep3;
+      let sep4;
       if (scalar.end) {
-        sep3 = scalar.end;
-        sep3.push(this.sourceToken);
+        sep4 = scalar.end;
+        sep4.push(this.sourceToken);
         delete scalar.end;
       } else
-        sep3 = [this.sourceToken];
+        sep4 = [this.sourceToken];
       const map2 = {
         type: "block-map",
         offset: scalar.offset,
         indent: scalar.indent,
-        items: [{ start, key: scalar, sep: sep3 }]
+        items: [{ start, key: scalar, sep: sep4 }]
       };
       this.onKeyLine = true;
       this.stack[this.stack.length - 1] = map2;
@@ -7647,15 +7840,15 @@ var Parser = class {
             } else if (isFlowToken(it.key) && !includesToken(it.sep, "newline")) {
               const start2 = getFirstKeyStartProps(it.start);
               const key = it.key;
-              const sep3 = it.sep;
-              sep3.push(this.sourceToken);
+              const sep4 = it.sep;
+              sep4.push(this.sourceToken);
               delete it.key;
               delete it.sep;
               this.stack.push({
                 type: "block-map",
                 offset: this.offset,
                 indent: this.indent,
-                items: [{ start: start2, key, sep: sep3 }]
+                items: [{ start: start2, key, sep: sep4 }]
               });
             } else if (start.length > 0) {
               it.sep = it.sep.concat(start, this.sourceToken);
@@ -7849,13 +8042,13 @@ var Parser = class {
         const prev = getPrevProps(parent);
         const start = getFirstKeyStartProps(prev);
         fixFlowSeqItems(fc);
-        const sep3 = fc.end.splice(1, fc.end.length);
-        sep3.push(this.sourceToken);
+        const sep4 = fc.end.splice(1, fc.end.length);
+        sep4.push(this.sourceToken);
         const map2 = {
           type: "block-map",
           offset: fc.offset,
           indent: fc.indent,
-          items: [{ start, key: fc, sep: sep3 }]
+          items: [{ start, key: fc, sep: sep4 }]
         };
         this.onKeyLine = true;
         this.stack[this.stack.length - 1] = map2;
@@ -8761,7 +8954,7 @@ function daemonRequest(method, params = {}, opts = {}) {
     ...caller ? { caller } : {}
   };
   const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     let settled = false;
     let socket;
     let buffer = Buffer.alloc(0);
@@ -8776,7 +8969,7 @@ function daemonRequest(method, params = {}, opts = {}) {
         } catch {
         }
       }
-      resolve9(value);
+      resolve10(value);
     };
     const timer = setTimeout(() => settle(null), timeoutMs);
     timer.unref();
@@ -8837,6 +9030,14 @@ function daemonRequest(method, params = {}, opts = {}) {
 
 // src/daemon/self-heal.ts
 import { spawn } from "child_process";
+
+// src/lib/unattended.ts
+var UNATTENDED_ENV = "PRIM_UNATTENDED";
+function unattendedEnv(env = process.env) {
+  return { ...env, [UNATTENDED_ENV]: "1" };
+}
+
+// src/daemon/self-heal.ts
 function kickDaemonEnsure(options = {}) {
   const primEntry = options.primEntry === void 0 ? binFile("prim") : options.primEntry;
   if (!primEntry) {
@@ -8844,14 +9045,18 @@ function kickDaemonEnsure(options = {}) {
   }
   try {
     const args = [primEntry, "daemon", "ensure"];
-    if ((options.platform ?? process.platform) === "darwin") {
+    if (options.latestBootstrap ?? (options.platform ?? process.platform) === "darwin") {
       args.push("--latest-bootstrap");
     }
     const child = (options.spawnProcess ?? spawn)(
       options.nodeEntry ?? process.execPath,
       args,
-      { detached: true, stdio: "ignore" }
+      // Unattended: neither SessionStart's repair nor a drift heal is a person
+      // running prim, so the child (and its descendants) never heal in turn.
+      { detached: true, stdio: "ignore", env: unattendedEnv() }
     );
+    child.once("error", () => {
+    });
     child.unref();
     return true;
   } catch {
@@ -27077,8 +27282,59 @@ async function fetchAndCacheCollectScope(cwd, dependencies = defaultDependencies
   return dependencies.writeCached(cwd, response);
 }
 
-// src/lib/post-commit-hook.ts
+// src/lib/commit-heartbeat.ts
 import { execFileSync as execFileSync3 } from "child_process";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync11, readdirSync as readdirSync4, unlinkSync as unlinkSync2 } from "fs";
+import { dirname as dirname10, join as join15, resolve as resolve6 } from "path";
+var WIRED_PATH = "prim/git-hooks-wired";
+var GIT_TIMEOUT_MS3 = 1e3;
+var MAX_STAMP_BYTES = 1024;
+function commonPath(cwd, relative4) {
+  const value = execFileSync3("git", ["rev-parse", "--git-common-dir"], {
+    cwd,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout: GIT_TIMEOUT_MS3
+  }).replace(/\r?\n$/u, "");
+  if (value === "" || /[\0\r\n]/u.test(value)) throw new Error("Git returned an unsafe path");
+  return join15(resolve6(cwd, value), relative4);
+}
+function ensurePrivateParent(path) {
+  mkdirSync7(dirname10(dirname10(path)), { recursive: true, mode: 448 });
+  mkdirSync7(dirname10(path), { recursive: true, mode: 448 });
+}
+function writeStamp(path, at) {
+  ensurePrivateParent(path);
+  atomicWriteFile(path, `${JSON.stringify({ at })}
+`, { mode: 384 });
+}
+function readStampAt(path) {
+  try {
+    const raw = readFileSync11(path, "utf8");
+    if (raw.length > MAX_STAMP_BYTES) return void 0;
+    const parsed = JSON.parse(raw);
+    return typeof parsed.at === "number" && Number.isSafeInteger(parsed.at) && parsed.at > 0 ? parsed.at : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function recordHooksWired(cwd, options = {}) {
+  try {
+    const path = commonPath(cwd, WIRED_PATH);
+    if (options.onlyIfAbsent && readStampAt(path) !== void 0) return;
+    writeStamp(path, options.now ?? Date.now());
+  } catch {
+  }
+}
+function clearHooksWired(cwd) {
+  try {
+    unlinkSync2(commonPath(cwd, WIRED_PATH));
+  } catch {
+  }
+}
+
+// src/lib/git-hooks.ts
+import { execFileSync as execFileSync4 } from "child_process";
 import { createHash as createHash8, randomUUID as randomUUID2 } from "crypto";
 import {
   constants as constants5,
@@ -27087,50 +27343,28 @@ import {
   fchmodSync as fchmodSync2,
   fsyncSync as fsyncSync2,
   lstatSync as lstatSync5,
-  mkdirSync as mkdirSync7,
+  mkdirSync as mkdirSync8,
   openSync as openSync4,
-  readFileSync as readFileSync11,
+  readFileSync as readFileSync12,
+  realpathSync as realpathSync4,
   renameSync as renameSync3,
-  unlinkSync as unlinkSync2,
+  unlinkSync as unlinkSync3,
   writeFileSync as writeFileSync4
 } from "fs";
-import { basename as basename2, dirname as dirname10, isAbsolute as isAbsolute7, resolve as resolve6 } from "path";
-var PRIM_POST_COMMIT_BLOCK_START = "# >>> prim post-commit hook >>>";
-var PRIM_POST_COMMIT_BLOCK_END = "# <<< prim post-commit hook <<<";
-var PRIM_CREATED_MARK = "prim-created-post-commit-hook";
-var PRIM_POST_REWRITE_BLOCK_START = "# >>> prim post-rewrite hook >>>";
-var PRIM_POST_REWRITE_BLOCK_END = "# <<< prim post-rewrite hook <<<";
-var PRIM_POST_REWRITE_CREATED_MARK = "prim-created-post-rewrite-hook";
-var LEGACY_PRIM_CREATED_MARK = "prim-created-hook";
-var LEGACY_PRIM_OWNED_HEADER = "# prim post-commit hook \u2014 installed by: prim hooks install (prim-managed-hook)";
-var LEGACY_GLOBAL_OWNED_HEADER = "# prim global post-commit hook (core.hooksPath) \u2014 managed by prim; do not edit.";
-var MAX_HOOK_BYTES = 1048576;
-var GIT_TIMEOUT_MS3 = 1e3;
-var SUPPORTED_SHEBANGS = /* @__PURE__ */ new Set([
-  "#!/bin/sh",
-  "#!/usr/bin/env sh",
-  "#!/bin/bash",
-  "#!/usr/bin/env bash",
-  "#!/bin/zsh",
-  "#!/usr/bin/env zsh"
-]);
-var HUSKY_V9_DISPATCHERS = /* @__PURE__ */ new Set([
-  '#!/usr/bin/env sh\n. "${0%/*}/h"',
-  '#!/usr/bin/env sh\n. "$(dirname "$0")/h"'
-]);
-var HUSKY_DIRECT_DISPATCHER = '#!/bin/sh\nexec sh "$(dirname "$0")/../post-commit"\n';
-var HUSKY_V9_RUNTIME_HASHES = /* @__PURE__ */ new Set([
-  "d6aaa6f3f7c11008c525e649161df4a93152f1e55d0887fa1d7b8d622735d380",
-  "b02cb91cab7125a9e906be723a1b85297fc435a8307d429ae845546b4ee0ecde",
-  "9db5d129c4eb822a773157d98cd8fb8f1b156b85e3193117fefe527ca6d45e91",
-  "3b2cb21335e544b4ebce658ca47af4a69d2c77026cc4d3f8b2227c34d062b207",
-  "548990e1c11285694096184993d907b258d41235461a7ca2551e3b53ff9d3a38",
-  "c029a943acea5d6e2ddbaa271a1fb22c2da55d56b5c6fb59ca804ac9a4018708",
-  "ae3413a8fe2b39372de48bdc9691f42055f089c0c7529834b2fb07a131585b6a",
-  "70200b200ca709b0622784f93839a5b2872333a917a09afddefd7dc2d8cdc680"
-]);
-function currentPostCommitBlock() {
-  return `${PRIM_POST_COMMIT_BLOCK_START}
+import { basename as basename2, dirname as dirname11, isAbsolute as isAbsolute8, join as join16, relative as relative3, resolve as resolve7, sep as sep3 } from "path";
+
+// src/lib/git-hook-legacy.ts
+import { isAbsolute as isAbsolute7 } from "path";
+var PRIM_MANAGED_MARK = "prim-managed-hook";
+var PRE_COMMIT = { hookName: "pre-commit", binName: "prim-pre-commit" };
+function blockMarkers2(spec) {
+  return {
+    start: `# >>> prim ${spec.hookName} hook >>>`,
+    end: `# <<< prim ${spec.hookName} hook <<<`
+  };
+}
+function legacyPostCommitBlock() {
+  return `# >>> prim post-commit hook >>>
 if [ "$(git config --get prim.active 2>/dev/null)" = "true" ]; then
   prim_commit_sha=$(git rev-parse --verify HEAD 2>/dev/null) || prim_commit_sha=
   case "$prim_commit_sha" in *[!0-9a-f]*|"") prim_commit_sha= ;; esac
@@ -27159,13 +27393,10 @@ if [ "$(git config --get prim.active 2>/dev/null)" = "true" ]; then
   fi
   unset prim_commit_sha
 fi
-${PRIM_POST_COMMIT_BLOCK_END}`;
+# <<< prim post-commit hook <<<`;
 }
-function postCommitHookBlock() {
-  return currentPostCommitBlock();
-}
-function postRewriteHookBlock() {
-  return `${PRIM_POST_REWRITE_BLOCK_START}
+function legacyPostRewriteBlock() {
+  return `# >>> prim post-rewrite hook >>>
 if [ "$(git config --get prim.active 2>/dev/null)" = "true" ]; then
   case "$1" in amend|rebase) prim_rewrite_source="$1" ;; *) prim_rewrite_source= ;; esac
   if [ -n "$prim_rewrite_source" ]; then
@@ -27204,22 +27435,159 @@ if [ "$(git config --get prim.active 2>/dev/null)" = "true" ]; then
   fi
   unset prim_rewrite_source
 fi
-${PRIM_POST_REWRITE_BLOCK_END}`;
-}
-var POST_COMMIT_MANAGED_HOOK = {
-  hookName: "post-commit",
-  blockStart: PRIM_POST_COMMIT_BLOCK_START,
-  blockEnd: PRIM_POST_COMMIT_BLOCK_END,
-  createdMark: PRIM_CREATED_MARK,
-  block: postCommitHookBlock
-};
-var POST_REWRITE_MANAGED_HOOK = {
-  hookName: "post-rewrite",
-  blockStart: PRIM_POST_REWRITE_BLOCK_START,
-  blockEnd: PRIM_POST_REWRITE_BLOCK_END,
-  createdMark: PRIM_POST_REWRITE_CREATED_MARK,
-  block: postRewriteHookBlock
+# <<< prim post-rewrite hook <<<`;
+}
+var PRE_COMMIT_GATE = 'if [ "$(git config --get prim.active 2>/dev/null)" = "true" ]; then';
+function preCommitLadder(fallback, failSoft) {
+  const soft = failSoft ? " || true" : "";
+  return `if command -v prim-pre-commit >/dev/null 2>&1; then
+  prim-pre-commit${soft}
+elif [ -f "./node_modules/.bin/prim-pre-commit" ]; then
+  ./node_modules/.bin/prim-pre-commit${soft}
+else
+  ${fallback} 2>/dev/null || true
+fi`;
+}
+var LADDER_ALPHA_2 = preCommitLadder("npx --yes @primitive.ai/prim pre-commit-hook", false);
+var LADDER_ALPHA_9 = preCommitLadder("npx --yes -p @primitive.ai/prim prim-pre-commit", false);
+var LADDER_ALPHA_35 = preCommitLadder("npx --yes -p @primitive.ai/prim prim-pre-commit", true);
+var PINNED_NPX_PRE_COMMIT = String.raw`npx --yes(?: --ignore-scripts)? -p @primitive\.ai/prim@[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)? prim-pre-commit`;
+var PINNED_PRE_COMMIT_RE = new RegExp(
+  String.raw`^\{ (?:${PINNED_NPX_PRE_COMMIT}|if \[ -x (?<node>'.*') \] && \[ -f (?<entry>'.*') \]; then \k<node> \k<entry>; else ${PINNED_NPX_PRE_COMMIT}; fi); \} \|\| true$`,
+  "u"
+);
+var SHELL_QUOTED_RE = /^'(?:[^']|'"'"')*'$/u;
+function decodePinnedPath(token) {
+  if (!token || !SHELL_QUOTED_RE.test(token)) return void 0;
+  const value = token.slice(1, -1).replaceAll(`'"'"'`, "'");
+  if (!isAbsolute7(value) || value.includes("\0") || value.includes("\n") || value.includes("\r")) {
+    return void 0;
+  }
+  return value;
+}
+function isPinnedPreCommitInvocation(line) {
+  const match = PINNED_PRE_COMMIT_RE.exec(line);
+  if (!match) return false;
+  if (match.groups?.node === void 0) return true;
+  return Boolean(
+    decodePinnedPath(match.groups.node) && decodePinnedPath(match.groups.entry)?.endsWith("/dist/hooks/pre-commit.js")
+  );
+}
+function isLegacyPreCommitBody(body) {
+  if (body === LADDER_ALPHA_2 || body === LADDER_ALPHA_9 || body === LADDER_ALPHA_35) return true;
+  if (isPinnedPreCommitInvocation(body)) return true;
+  const prefix = `${PRE_COMMIT_GATE}
+`;
+  if (!body.startsWith(prefix) || !body.endsWith("\nfi")) return false;
+  const inner = body.slice(prefix.length, -"\nfi".length);
+  return inner === LADDER_ALPHA_35 || isPinnedPreCommitInvocation(inner);
+}
+function isLegacyOwnedPreCommitScript(content) {
+  const original = (ladder) => `#!/bin/sh
+# prim pre-commit hook \u2014 auto-syncs affected specs on commit
+# Installed by: prim hooks install
+
+# Find the nearest node_modules/.bin with prim, or use npx
+${ladder}
+`;
+  if (content === original(LADDER_ALPHA_2) || content === original(LADDER_ALPHA_9)) return true;
+  if (content === `#!/bin/sh
+# prim pre-commit hook \u2014 installed by: prim hooks install
+
+${LADDER_ALPHA_9}
+`) {
+    return true;
+  }
+  const prefix = `#!/bin/sh
+# prim pre-commit hook \u2014 installed by: prim hooks install (${PRIM_MANAGED_MARK})
+
+`;
+  if (!content.startsWith(prefix) || !content.endsWith("\n")) return false;
+  const body = content.slice(prefix.length, -1);
+  return body === LADDER_ALPHA_35 || isPinnedPreCommitInvocation(body);
+}
+var PINNED_PACKAGE_VERSION_RE = /@primitive\.ai\/prim@[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?/gu;
+function legacyInlineHookBlock(hookName) {
+  return hookName === "post-commit" ? legacyPostCommitBlock() : legacyPostRewriteBlock();
+}
+function isRecognizedLegacyBlock(hookName, block) {
+  if (hookName === "pre-commit") {
+    const { start, end } = blockMarkers2(PRE_COMMIT);
+    const prefix = `${start}
+`;
+    const suffix = `
+${end}`;
+    if (!block.startsWith(prefix) || !block.endsWith(suffix)) return false;
+    return isLegacyPreCommitBody(block.slice(prefix.length, -suffix.length));
+  }
+  const expected = legacyInlineHookBlock(hookName);
+  const normalize2 = (text) => text.replace(PINNED_PACKAGE_VERSION_RE, "@primitive.ai/prim@<version>");
+  return normalize2(block) === normalize2(expected);
+}
+
+// src/lib/git-hooks.ts
+var LEGACY_PRIM_CREATED_MARK = "prim-created-hook";
+var LEGACY_PRIM_OWNED_HEADER = "# prim post-commit hook \u2014 installed by: prim hooks install (prim-managed-hook)";
+var LEGACY_GLOBAL_OWNED_HEADER = "# prim global post-commit hook (core.hooksPath) \u2014 managed by prim; do not edit.";
+var MAX_HOOK_BYTES = 1048576;
+var GIT_TIMEOUT_MS4 = 1e3;
+var SUPPORTED_SHEBANGS = /* @__PURE__ */ new Set([
+  "#!/bin/sh",
+  "#!/usr/bin/env sh",
+  "#!/bin/bash",
+  "#!/usr/bin/env bash",
+  "#!/bin/zsh",
+  "#!/usr/bin/env zsh"
+]);
+var HUSKY_V9_DISPATCHERS = /* @__PURE__ */ new Set([
+  '#!/usr/bin/env sh\n. "${0%/*}/h"',
+  '#!/usr/bin/env sh\n. "$(dirname "$0")/h"'
+]);
+var HUSKY_DIRECT_DISPATCHER = '#!/bin/sh\nexec sh "$(dirname "$0")/../post-commit"\n';
+var HUSKY_V9_RUNTIME_HASHES = /* @__PURE__ */ new Set([
+  "d6aaa6f3f7c11008c525e649161df4a93152f1e55d0887fa1d7b8d622735d380",
+  "b02cb91cab7125a9e906be723a1b85297fc435a8307d429ae845546b4ee0ecde",
+  "9db5d129c4eb822a773157d98cd8fb8f1b156b85e3193117fefe527ca6d45e91",
+  "3b2cb21335e544b4ebce658ca47af4a69d2c77026cc4d3f8b2227c34d062b207",
+  "548990e1c11285694096184993d907b258d41235461a7ca2551e3b53ff9d3a38",
+  "c029a943acea5d6e2ddbaa271a1fb22c2da55d56b5c6fb59ca804ac9a4018708",
+  "ae3413a8fe2b39372de48bdc9691f42055f089c0c7529834b2fb07a131585b6a",
+  "70200b200ca709b0622784f93839a5b2872333a917a09afddefd7dc2d8cdc680"
+]);
+function managedHookSpecFor(hookName) {
+  const { start, end } = blockMarkers(hookName);
+  return {
+    hookName,
+    blockStart: start,
+    blockEnd: end,
+    createdMark: `prim-created-${hookName}-hook`
+  };
+}
+var MANAGED_HOOK_SPECS = {
+  "pre-commit": managedHookSpecFor("pre-commit"),
+  "post-commit": managedHookSpecFor("post-commit"),
+  "post-rewrite": managedHookSpecFor("post-rewrite")
 };
+function managedHookSpec(hookName) {
+  return MANAGED_HOOK_SPECS[hookName];
+}
+function gitHooksMode(options = {}) {
+  try {
+    const value = execFileSync4(
+      "git",
+      ["config", ...options.global ? ["--global"] : [], "--get", "prim.gitHooks"],
+      {
+        cwd: options.cwd,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: GIT_TIMEOUT_MS4
+      }
+    ).trim();
+    return value === "manual" ? "manual" : "auto";
+  } catch {
+    return "auto";
+  }
+}
 function legacyFloatingInvocation() {
   return `if command -v prim-post-commit >/dev/null 2>&1; then
   prim-post-commit || true
@@ -27236,15 +27604,6 @@ fi
 `);
 }
 var PINNED_INVOCATION_RE = /^\{ if \[ -x (?<node>'.*') \] && \[ -f (?<entry>'.*') \]; then \k<node> \k<entry>; else npx --yes -p @primitive\.ai\/prim@(?<version>[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?) prim-post-commit; fi; \} \|\| true$/u;
-var SHELL_QUOTED_RE = /^'(?:[^']|'"'"')*'$/u;
-function decodePinnedPath(token) {
-  if (!token || !SHELL_QUOTED_RE.test(token)) return void 0;
-  const value = token.slice(1, -1).replaceAll(`'"'"'`, "'");
-  if (!isAbsolute7(value) || value.includes("\0") || value.includes("\n") || value.includes("\r")) {
-    return void 0;
-  }
-  return value;
-}
 function isPinnedInvocation(value) {
   const match = PINNED_INVOCATION_RE.exec(value);
   const node = decodePinnedPath(match?.groups?.node);
@@ -27277,48 +27636,122 @@ function isKnownLegacyGlobalGate(value) {
 }
 function createdScaffold(spec) {
   return Buffer.from(`#!/bin/sh
-${spec.block()}
+${managedHookBlock(spec.hookName)}
 # ${spec.createdMark}
 `);
 }
+function oldCreatedPrefixes(spec) {
+  return [
+    Buffer.from(`#!/bin/sh
+# ${spec.createdMark}
+
+`),
+    Buffer.from(`#!/bin/sh
+# ${LEGACY_PRIM_CREATED_MARK}
+
+`)
+  ];
+}
+function isOwnedStandalonePreCommit(content) {
+  return content === "#!/bin/sh\nprim-pre-commit\n" || isLegacyOwnedPreCommitScript(content);
+}
+function realpathLoose(path) {
+  const missing = [];
+  let current = resolve7(path);
+  for (; ; ) {
+    try {
+      return join16(realpathSync4.native(current), ...missing);
+    } catch {
+      const parent = dirname11(current);
+      if (parent === current) return resolve7(path);
+      missing.unshift(basename2(current));
+      current = parent;
+    }
+  }
+}
+function isWithin(path, directory) {
+  const rel = relative3(directory, path);
+  return rel === "" || !isAbsolute8(rel) && rel !== ".." && !rel.startsWith(`..${sep3}`);
+}
+function primGitHooksDirectory() {
+  try {
+    return join16(primConfigDirectory(), "git-hooks");
+  } catch {
+    return void 0;
+  }
+}
+function otherWorktreeRoots(gitRoot) {
+  try {
+    const self = realpathLoose(gitRoot);
+    return execFileSync4("git", ["worktree", "list", "--porcelain"], {
+      cwd: gitRoot,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS4
+    }).split("\n").flatMap((line) => line.startsWith("worktree ") ? [realpathLoose(line.slice(9))] : []).filter((root) => root !== self);
+  } catch {
+    return [];
+  }
+}
+function hookLocation(hookPath, dirs) {
+  const path = realpathLoose(hookPath);
+  if (isWithin(path, realpathLoose(dirs.gitDir)) || isWithin(path, realpathLoose(dirs.commonDir))) {
+    return "repository";
+  }
+  const primDir = primGitHooksDirectory();
+  if (primDir !== void 0 && isWithin(path, realpathLoose(primDir))) return "prim";
+  const root = realpathLoose(dirs.gitRoot);
+  if (!isWithin(path, root)) return "external";
+  const nested = otherWorktreeRoots(dirs.gitRoot).filter((other) => isWithin(other, root));
+  return nested.some((other) => isWithin(path, other)) ? "external" : "worktree";
+}
 function safeGitPath(root, value) {
   if (value.length === 0 || value !== value.trim() || value.includes("\0") || value.includes("\n") || value.includes("\r")) {
     throw new Error("Git returned an unsafe hooks path");
   }
-  return isAbsolute7(value) ? resolve6(value) : resolve6(root, value);
+  return isAbsolute8(value) ? resolve7(value) : resolve7(root, value);
 }
-function resolveEffectiveManagedHook(spec, cwd = process.cwd()) {
+function resolveEffectiveGitHook(hookName, cwd = process.cwd()) {
   const gitRoot = gitToplevel(cwd);
   if (!gitRoot) throw new Error("not a git repository");
-  const value = execFileSync3("git", ["rev-parse", "--git-path", "hooks"], {
-    cwd: gitRoot,
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "ignore"],
-    timeout: GIT_TIMEOUT_MS3
-  }).replace(/\r?\n$/u, "");
-  const hooksDir = safeGitPath(gitRoot, value);
-  if (basename2(hooksDir) === "_" && basename2(dirname10(hooksDir)) === ".husky") {
+  const lines = execFileSync4(
+    "git",
+    ["rev-parse", "--git-path", "hooks", "--absolute-git-dir", "--git-common-dir"],
+    {
+      cwd: gitRoot,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS4
+    }
+  ).replace(/\r?\n$/u, "").split(/\r?\n/u);
+  if (lines.length !== 3) throw new Error("Git returned unexpected repository paths");
+  const [hooksValue, gitDirValue, commonDirValue] = lines;
+  const hooksDir = safeGitPath(gitRoot, hooksValue);
+  const dirs = {
+    gitRoot,
+    gitDir: safeGitPath(gitRoot, gitDirValue),
+    commonDir: safeGitPath(gitRoot, commonDirValue)
+  };
+  if (basename2(hooksDir) === "_" && basename2(dirname11(hooksDir)) === ".husky") {
+    const hookPath2 = resolve7(dirname11(hooksDir), hookName);
     return {
       gitRoot,
       hooksDir,
-      hookPath: resolve6(dirname10(hooksDir), spec.hookName),
+      hookPath: hookPath2,
       kind: "husky_v9",
-      dispatcherPath: resolve6(hooksDir, spec.hookName)
+      dispatcherPath: resolve7(hooksDir, hookName),
+      location: hookLocation(hookPath2, dirs)
     };
   }
+  const hookPath = resolve7(hooksDir, hookName);
   return {
     gitRoot,
     hooksDir,
-    hookPath: resolve6(hooksDir, spec.hookName),
-    kind: "direct"
+    hookPath,
+    kind: "direct",
+    location: hookLocation(hookPath, dirs)
   };
 }
-function resolveEffectivePostCommitHook(cwd = process.cwd()) {
-  return resolveEffectiveManagedHook(POST_COMMIT_MANAGED_HOOK, cwd);
-}
-function resolveEffectivePostRewriteHook(cwd = process.cwd()) {
-  return resolveEffectiveManagedHook(POST_REWRITE_MANAGED_HOOK, cwd);
-}
 function assertSafeFile(path, spec) {
   if (!existsSync10(path)) return void 0;
   const stat = lstatSync5(path);
@@ -27342,7 +27775,7 @@ function assertUsableHuskyDispatcher(target, spec) {
   if (!HUSKY_V9_DISPATCHERS.has(normalizedDispatcher)) {
     throw new Error(`unrecognized Husky ${spec.hookName} dispatcher: ${target.dispatcherPath}`);
   }
-  const huskyRuntime = resolve6(dirname10(target.dispatcherPath), "h");
+  const huskyRuntime = resolve7(dirname11(target.dispatcherPath), "h");
   const runtimeStat = assertSafeFile(huskyRuntime, spec);
   const runtime = runtimeStat ? readHookFile(huskyRuntime) : void 0;
   const runtimeHash = runtime ? createHash8("sha256").update(runtime).digest("hex") : void 0;
@@ -27351,7 +27784,7 @@ function assertUsableHuskyDispatcher(target, spec) {
   }
 }
 function readHookFile(path) {
-  const value = readFileSync11(path);
+  const value = readFileSync12(path);
   return Buffer.isBuffer(value) ? value : Buffer.from(value);
 }
 function decodeHookText(content, spec) {
@@ -27400,16 +27833,107 @@ function blockRange(content, spec) {
   }
   const start = starts[0];
   const end = ends[0] + endMarker.length;
-  const current = Buffer.from(spec.block());
-  return content.subarray(start, end).equals(current) ? { kind: "current", start, end } : { kind: "stale", start, end };
+  const text = content.subarray(start, end).toString("utf8");
+  if (canonicalHookBlock(text) === canonicalHookBlock(managedHookBlock(spec.hookName))) {
+    return { kind: "current", start, end };
+  }
+  const version = hookBlockContractVersion(text);
+  if (version !== void 0 && version > GIT_HOOK_CONTRACT_VERSION) {
+    return { kind: "newer", start, end };
+  }
+  return { kind: "stale", start, end };
+}
+var HUSKY_V8_SOURCE_RE = /^\.[ \t]+"\$\(dirname(?:[ \t]+--)?[ \t]+"\$0"\)\/_\/husky\.sh"[ \t]*$/mu;
+function blockInsertionPoint(content, allowShebangless, spec, huskyV8) {
+  const shebangEnd = shellInsertionPoint(content, allowShebangless, spec);
+  if (!huskyV8) return shebangEnd;
+  const rest = content.subarray(shebangEnd).toString("utf8");
+  const match = HUSKY_V8_SOURCE_RE.exec(rest);
+  if (!match) return shebangEnd;
+  const lineEnd = match.index + match[0].length;
+  const afterLine = rest[lineEnd] === "\n" ? lineEnd + 1 : lineEnd;
+  return shebangEnd + Buffer.byteLength(rest.slice(0, afterLine), "utf8");
+}
+var HUSKY_SPEC_MAJOR_RE = /^\s*[~^]?=?\s*v?([0-9]+)(?:\.(?:[0-9]+|[xX*])){0,2}(?:-[0-9A-Za-z.-]+)?\s*$/u;
+function declaredHuskyMajor(dir) {
+  for (let current = resolve7(dir); ; ) {
+    const manifest = join16(current, "package.json");
+    if (existsSync10(manifest)) {
+      try {
+        if (lstatSync5(manifest).size > MAX_HOOK_BYTES) return void 0;
+        const parsed = JSON.parse(readFileSync12(manifest, "utf8"));
+        const range = parsed.devDependencies?.husky ?? parsed.dependencies?.husky;
+        const major = typeof range === "string" ? HUSKY_SPEC_MAJOR_RE.exec(range)?.[1] : void 0;
+        return major === void 0 ? void 0 : Number(major);
+      } catch {
+        return void 0;
+      }
+    }
+    const parent = dirname11(current);
+    if (parent === current || existsSync10(join16(current, ".git"))) return void 0;
+    current = parent;
+  }
+}
+function isHuskyV8Hook(hookPath) {
+  const runtime = join16(dirname11(hookPath), "_", "husky.sh");
+  try {
+    const stat = lstatSync5(runtime);
+    return stat.isFile() && stat.size <= MAX_HOOK_BYTES && readFileSync12(runtime, "utf8").includes("husky_skip_init");
+  } catch (error) {
+    if (errorCode(error) !== "ENOENT") return false;
+  }
+  const major = declaredHuskyMajor(dirname11(dirname11(hookPath)));
+  return major !== void 0 && major <= 8;
+}
+var TERMINAL_LINE_RE = /^(?:exit|return)(?:\s|;|$)/u;
+var REDIRECT_OPERATOR_RE = /^[0-9]*(?:<<?|>>?|<&|>&|<>|>\|)$/u;
+var REDIRECT_WORD_RE = /^[0-9]*(?:<|>)/u;
+function isReplacingExec(line) {
+  if (!/^exec(?:\s|$)/u.test(line)) return false;
+  const words = line.slice(4).trim().split(/\s+/u).filter(Boolean);
+  for (let index = 0; index < words.length; index += 1) {
+    const word = words[index];
+    if (word.startsWith("#")) break;
+    if (REDIRECT_OPERATOR_RE.test(word)) {
+      index += 1;
+      continue;
+    }
+    if (!REDIRECT_WORD_RE.test(word)) return true;
+  }
+  return false;
+}
+function terminatesBefore(content, from, offset) {
+  const lines = content.subarray(from, offset).toString("utf8").split("\n");
+  return lines.some((line) => TERMINAL_LINE_RE.test(line) || isReplacingExec(line));
+}
+function mayTerminateBefore(content, from, offset) {
+  return content.subarray(from, offset).toString("utf8").split(/\n|;|&&|\|\||\||[{()]|\b(?:then|do|else)\b/u).some((part) => {
+    const command = part.trim();
+    return TERMINAL_LINE_RE.test(command) || isReplacingExec(command);
+  });
+}
+function withoutRange(content, start, end) {
+  const suffix = content.subarray(end);
+  return Buffer.concat([
+    content.subarray(0, start),
+    suffix.at(0) === 10 ? suffix.subarray(1) : suffix
+  ]);
+}
+function insertBlock(content, at, spec) {
+  return Buffer.concat([
+    content.subarray(0, at),
+    Buffer.from(managedHookBlock(spec.hookName)),
+    Buffer.from("\n"),
+    content.subarray(at)
+  ]);
 }
-function mergedContent(existing, allowShebangless, spec) {
-  const block = Buffer.from(spec.block());
-  if (!existing) {
+function migratedLegacyContent(existing, allowShebangless, spec, huskyV8) {
+  const text = existing.toString("utf8");
+  if (spec.hookName === "pre-commit" && isOwnedStandalonePreCommit(text)) {
     return createdScaffold(spec);
   }
-  const range = blockRange(existing, spec);
-  if (spec.hookName === POST_COMMIT_MANAGED_HOOK.hookName && range.kind === "absent" && existing.toString("utf8").startsWith(`#!/bin/sh
+  if (spec.hookName !== "post-commit") return void 0;
+  if (text.startsWith(`#!/bin/sh
 ${LEGACY_GLOBAL_OWNED_HEADER}
 `)) {
     const gateAt = existing.indexOf(Buffer.from('if [ "$(git config --get prim.active'));
@@ -27424,15 +27948,13 @@ ${LEGACY_GLOBAL_OWNED_HEADER}
       existing.subarray(0, gateAt),
       existing.subarray(chainAt)
     ]);
-    const shebangEnd2 = shellInsertionPoint(withoutLegacyGate, allowShebangless, spec);
-    return Buffer.concat([
-      withoutLegacyGate.subarray(0, shebangEnd2),
-      block,
-      Buffer.from("\n"),
-      withoutLegacyGate.subarray(shebangEnd2)
-    ]);
+    return insertBlock(
+      withoutLegacyGate,
+      blockInsertionPoint(withoutLegacyGate, allowShebangless, spec, huskyV8),
+      spec
+    );
   }
-  if (spec.hookName === POST_COMMIT_MANAGED_HOOK.hookName && range.kind === "absent" && existing.toString("utf8").startsWith(`#!/bin/sh
+  if (text.startsWith(`#!/bin/sh
 ${LEGACY_PRIM_OWNED_HEADER}
 `)) {
     const prefixLength = legacyProjectPrefixLength(existing);
@@ -27441,42 +27963,59 @@ ${LEGACY_PRIM_OWNED_HEADER}
     }
     return Buffer.concat([createdScaffold(spec), existing.subarray(prefixLength)]);
   }
-  if (range.kind !== "absent") {
-    const oldCreatedPrefixes = [
-      Buffer.from(`#!/bin/sh
-# ${spec.createdMark}
-
-`),
-      ...spec.hookName === POST_COMMIT_MANAGED_HOOK.hookName ? [Buffer.from(`#!/bin/sh
-# ${LEGACY_PRIM_CREATED_MARK}
-
-`)] : []
-    ];
-    const oldCreated = oldCreatedPrefixes.some(
+  return void 0;
+}
+function mergedContent(existing, allowShebangless, spec, relocate, huskyV8) {
+  if (!existing) return { content: createdScaffold(spec), migrates: false };
+  const range = blockRange(existing, spec);
+  if (range.kind === "absent") {
+    const migrated = migratedLegacyContent(existing, allowShebangless, spec, huskyV8);
+    if (migrated) return { content: migrated, migrates: true };
+  } else if (range.kind !== "newer") {
+    const oldCreated = oldCreatedPrefixes(spec).some(
       (prefix) => range.start === prefix.length && existing.subarray(0, prefix.length).equals(prefix)
     );
     if (oldCreated) {
       const suffix = existing.subarray(range.end);
       const tail = suffix.at(0) === 10 ? suffix.subarray(1) : suffix;
-      return Buffer.concat([createdScaffold(spec), tail]);
+      return {
+        content: Buffer.concat([createdScaffold(spec), tail]),
+        migrates: range.kind === "stale"
+      };
     }
   }
   const shebangEnd = shellInsertionPoint(existing, allowShebangless, spec);
-  if (range.kind === "current" && range.start === shebangEnd) return existing;
-  let withoutBlock = existing;
-  if (range.kind !== "absent") {
-    const suffix = existing.subarray(range.end);
-    withoutBlock = Buffer.concat([
-      existing.subarray(0, range.start),
-      range.start === shebangEnd && suffix.at(0) === 10 ? suffix.subarray(1) : suffix
-    ]);
+  const insertion = blockInsertionPoint(existing, allowShebangless, spec, huskyV8);
+  switch (range.kind) {
+    case "newer":
+      return { content: existing, migrates: false };
+    case "absent":
+      return { content: insertBlock(existing, insertion, spec), migrates: false };
+    case "current":
+    case "stale": {
+      const misplaced = terminatesBefore(existing, shebangEnd, range.start) || range.start < insertion;
+      if (relocate && misplaced) {
+        const without = withoutRange(existing, range.start, range.end);
+        return {
+          content: insertBlock(
+            without,
+            blockInsertionPoint(without, allowShebangless, spec, huskyV8),
+            spec
+          ),
+          migrates: range.kind === "stale"
+        };
+      }
+      if (range.kind === "current") return { content: existing, migrates: false };
+      return {
+        content: Buffer.concat([
+          existing.subarray(0, range.start),
+          Buffer.from(managedHookBlock(spec.hookName)),
+          existing.subarray(range.end)
+        ]),
+        migrates: true
+      };
+    }
   }
-  return Buffer.concat([
-    withoutBlock.subarray(0, shebangEnd),
-    block,
-    Buffer.from("\n"),
-    withoutBlock.subarray(shebangEnd)
-  ]);
 }
 function errorCode(error) {
   return typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
@@ -27497,9 +28036,9 @@ function assertTargetUnchanged(path, expected, spec, stat) {
   }
 }
 function rewriteHookAtomically(path, next, expected, spec, stat) {
-  const parent = dirname10(path);
-  mkdirSync7(parent, { recursive: true });
-  const temporary = resolve6(
+  const parent = dirname11(path);
+  mkdirSync8(parent, { recursive: true });
+  const temporary = resolve7(
     parent,
     `.${basename2(path)}.prim-${String(process.pid)}-${randomUUID2()}.tmp`
   );
@@ -27525,41 +28064,71 @@ function rewriteHookAtomically(path, next, expected, spec, stat) {
       }
     }
     try {
-      unlinkSync2(temporary);
+      unlinkSync3(temporary);
     } catch (error) {
       if (errorCode(error) !== "ENOENT") {
       }
     }
   }
 }
-function ensureEffectivePostCommitHook(cwd = process.cwd()) {
-  const target = resolveEffectivePostCommitHook(cwd);
-  return ensureTarget(target, POST_COMMIT_MANAGED_HOOK);
-}
-function ensureEffectivePostRewriteHook(cwd = process.cwd()) {
-  const target = resolveEffectivePostRewriteHook(cwd);
-  return ensureTarget(target, POST_REWRITE_MANAGED_HOOK);
+function workingLegacyBlock(content, target, spec) {
+  try {
+    const range = blockRange(content, spec);
+    if (range.kind !== "stale") return false;
+    const block = content.subarray(range.start, range.end).toString("utf8");
+    const from = shellInsertionPoint(content, target.kind === "husky_v9", spec);
+    return isRecognizedLegacyBlock(spec.hookName, block) && !mayTerminateBefore(content, from, range.start);
+  } catch {
+    return false;
+  }
 }
-function ensureTarget(target, spec, initialContent) {
+var AMBIENT_LOCATIONS = ["repository", "prim"];
+var EXPLICIT_LOCATIONS = ["repository", "prim", "worktree"];
+function ensureTarget(target, spec, policy) {
+  const result = { hookName: spec.hookName, path: target.hookPath, kind: target.kind };
+  const skip = (outcome) => ({
+    ...result,
+    changed: false,
+    outcome
+  });
   assertUsableHuskyDispatcher(target, spec);
   const stat = assertSafeFile(target.hookPath, spec);
   if (stat && target.kind === "direct" && (stat.mode & 64) === 0) {
     throw new Error(`existing ${spec.hookName} hook is not executable: ${target.hookPath}`);
   }
   const existing = stat ? readHookFile(target.hookPath) : void 0;
-  const next = !existing && initialContent !== void 0 ? Buffer.from(initialContent) : mergedContent(existing, target.kind === "husky_v9", spec);
-  if (!existing && initialContent !== void 0) {
-    const shebangEnd = shellInsertionPoint(next, target.kind === "husky_v9", spec);
-    const range = blockRange(next, spec);
-    if (range.kind !== "current" || range.start !== shebangEnd) {
-      throw new Error(`invalid initial Prim ${spec.hookName} scaffold`);
-    }
-  }
-  const contentChanged = !existing || !next.equals(existing);
-  if (contentChanged) {
-    rewriteHookAtomically(target.hookPath, next, existing, spec, stat);
+  if (policy.repairOnly && (!existing || blockRange(existing, spec).kind === "absent")) {
+    return skip("skipped");
+  }
+  const huskyV8 = isHuskyV8Hook(target.hookPath);
+  const next = mergedContent(existing, target.kind === "husky_v9", spec, policy.relocate, huskyV8);
+  if (existing && next.content.equals(existing)) return skip("unchanged");
+  if (!policy.writable(target.location)) {
+    if (target.location === "worktree") return skip("deferred");
+    return skip(existing && workingLegacyBlock(existing, target, spec) ? "kept" : "external");
+  }
+  if (next.migrates && inspectGitHookEntrypoint() !== "ready") return skip("runtime_missing");
+  rewriteHookAtomically(target.hookPath, next.content, existing, spec, stat);
+  return { ...result, changed: true, outcome: existing ? "updated" : "created" };
+}
+function ensureEffectiveGitHook(hookName, cwd = process.cwd(), options = {}) {
+  const target = resolveEffectiveGitHook(hookName, cwd);
+  if (gitHooksMode({ cwd: target.gitRoot }) === "manual") {
+    return {
+      hookName,
+      path: target.hookPath,
+      kind: target.kind,
+      changed: false,
+      outcome: "manual"
+    };
   }
-  return { path: target.hookPath, changed: contentChanged || !stat, kind: target.kind };
+  const explicit = (options.context ?? "explicit") === "explicit";
+  const allowed = explicit ? EXPLICIT_LOCATIONS : AMBIENT_LOCATIONS;
+  return ensureTarget(target, managedHookSpec(hookName), {
+    writable: (location) => allowed.includes(location),
+    relocate: explicit,
+    repairOnly: options.repairOnly === true
+  });
 }
 
 // src/lib/repository-binding.ts
@@ -27619,7 +28188,7 @@ async function bindRepository(root, options) {
 }
 
 // src/lib/workspace-id.ts
-import { execFileSync as execFileSync4 } from "child_process";
+import { execFileSync as execFileSync5 } from "child_process";
 import { randomUUID as randomUUID3 } from "crypto";
 import {
   constants as constants6,
@@ -27629,15 +28198,15 @@ import {
   fsyncSync as fsyncSync3,
   linkSync,
   lstatSync as lstatSync6,
-  mkdirSync as mkdirSync8,
+  mkdirSync as mkdirSync9,
   openSync as openSync5,
-  readFileSync as readFileSync12,
+  readFileSync as readFileSync13,
   statSync as statSync3,
-  unlinkSync as unlinkSync3,
+  unlinkSync as unlinkSync4,
   writeFileSync as writeFileSync5
 } from "fs";
-import { dirname as dirname11, isAbsolute as isAbsolute8, join as join15, resolve as resolve7 } from "path";
-var WORKSPACE_ID_RELATIVE_PATH = join15("prim", "workspace-id");
+import { dirname as dirname12, isAbsolute as isAbsolute9, join as join17, resolve as resolve8 } from "path";
+var WORKSPACE_ID_RELATIVE_PATH = join17("prim", "workspace-id");
 var MAX_ANCESTORS = 64;
 var MAX_GIT_FILE_BYTES = 4096;
 var MAX_ID_FILE_BYTES = 128;
@@ -27665,7 +28234,7 @@ function resolveWorkspaceIdPath(cwd) {
     if (fromFilesystem) return { status: "resolved", path: fromFilesystem };
   }
   try {
-    const output = execFileSync4(
+    const output = execFileSync5(
       "git",
       ["rev-parse", "--is-inside-work-tree", "--git-path", WORKSPACE_ID_RELATIVE_PATH],
       {
@@ -27683,7 +28252,7 @@ function resolveWorkspaceIdPath(cwd) {
     }
     return {
       status: "resolved",
-      path: isAbsolute8(gitPath) ? resolve7(gitPath) : resolve7(cwd, gitPath)
+      path: isAbsolute9(gitPath) ? resolve8(gitPath) : resolve8(cwd, gitPath)
     };
   } catch (error) {
     const code = errorCode2(error);
@@ -27694,21 +28263,21 @@ function resolveWorkspaceIdPath(cwd) {
   }
 }
 function resolveFromFilesystem(cwd) {
-  let current = resolve7(cwd);
+  let current = resolve8(cwd);
   for (let depth = 0; depth < MAX_ANCESTORS; depth += 1) {
-    const dotGit = join15(current, ".git");
+    const dotGit = join17(current, ".git");
     try {
       const stat = lstatSync6(dotGit);
       if (stat.isDirectory() && isGitDirectory(dotGit)) {
-        return join15(dotGit, WORKSPACE_ID_RELATIVE_PATH);
+        return join17(dotGit, WORKSPACE_ID_RELATIVE_PATH);
       }
       if (stat.isFile() && stat.size <= MAX_GIT_FILE_BYTES) {
-        const contents = readFileSync12(dotGit, "utf8");
+        const contents = readFileSync13(dotGit, "utf8");
         const match = /^gitdir: (.+?)(?:\r?\n)?$/.exec(contents);
         if (match?.[1]) {
-          const gitDirectory = isAbsolute8(match[1]) ? resolve7(match[1]) : resolve7(current, match[1]);
+          const gitDirectory = isAbsolute9(match[1]) ? resolve8(match[1]) : resolve8(current, match[1]);
           if (isGitDirectory(gitDirectory)) {
-            return join15(gitDirectory, WORKSPACE_ID_RELATIVE_PATH);
+            return join17(gitDirectory, WORKSPACE_ID_RELATIVE_PATH);
           }
         }
       }
@@ -27719,7 +28288,7 @@ function resolveFromFilesystem(cwd) {
         return null;
       }
     }
-    const parent = dirname11(current);
+    const parent = dirname12(current);
     if (parent === current) break;
     current = parent;
   }
@@ -27727,7 +28296,7 @@ function resolveFromFilesystem(cwd) {
 }
 function isGitDirectory(path) {
   try {
-    return statSync3(join15(path, "HEAD")).isFile();
+    return statSync3(join17(path, "HEAD")).isFile();
   } catch {
     return false;
   }
@@ -27746,7 +28315,7 @@ function inspectPath(path) {
     return { status: "corrupt", path, reason: "invalid_content" };
   }
   try {
-    const contents = readFileSync12(path, "utf8");
+    const contents = readFileSync13(path, "utf8");
     const workspaceId = contents.endsWith("\n") ? contents.slice(0, -1) : contents;
     if ((contents === workspaceId || contents === `${workspaceId}
 `) && isCanonicalWorkspaceId(workspaceId)) {
@@ -27763,13 +28332,13 @@ function inspectPath(path) {
   }
 }
 function createWorkspaceId(path) {
-  const parent = dirname11(path);
+  const parent = dirname12(path);
   const workspaceId = randomUUID3();
-  const temporaryPath = join15(parent, `.workspace-id-${process.pid}-${randomUUID3()}.tmp`);
+  const temporaryPath = join17(parent, `.workspace-id-${process.pid}-${randomUUID3()}.tmp`);
   let temporaryCreated = false;
   let publishing = false;
   try {
-    mkdirSync8(parent, { recursive: true, mode: 448 });
+    mkdirSync9(parent, { recursive: true, mode: 448 });
     chmodSync4(parent, 448);
     const fd = openSync5(
       temporaryPath,
@@ -27799,7 +28368,7 @@ function createWorkspaceId(path) {
   } finally {
     if (temporaryCreated) {
       try {
-        unlinkSync3(temporaryPath);
+        unlinkSync4(temporaryPath);
       } catch {
       }
     }
@@ -27829,16 +28398,16 @@ import { createHash as createHash9, randomBytes as randomBytes4 } from "crypto";
 import {
   chmodSync as chmodSync5,
   existsSync as existsSync11,
-  mkdirSync as mkdirSync9,
-  readFileSync as readFileSync13,
-  readdirSync as readdirSync4,
+  mkdirSync as mkdirSync10,
+  readFileSync as readFileSync14,
+  readdirSync as readdirSync5,
   renameSync as renameSync4,
   rmSync as rmSync6,
   statSync as statSync4,
-  unlinkSync as unlinkSync4,
+  unlinkSync as unlinkSync5,
   writeFileSync as writeFileSync6
 } from "fs";
-import { join as join16 } from "path";
+import { join as join18 } from "path";
 
 // src/daemon/decision-digest-cache.ts
 import { randomBytes as randomBytes3 } from "crypto";
@@ -27853,6 +28422,27 @@ function isActionablePrivateDraft(row) {
   return typeof candidate.id === "string" && SAFE_PRIVATE_DRAFT_ID.test(candidate.id) && typeof candidate.intent === "string" && candidate.authorIsSelf === true && candidate.stage === "draft" && (candidate.intentKind === void 0 || candidate.intentKind === "change");
 }
 
+// src/lib/delivery-backlog.ts
+var MS_PER_SECOND = 1e3;
+var MS_PER_MINUTE = 60 * MS_PER_SECOND;
+var MS_PER_HOUR = 60 * MS_PER_MINUTE;
+var MS_PER_DAY = 24 * MS_PER_HOUR;
+function isNonNegativeInteger(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= 0;
+}
+function isPositiveInteger(value) {
+  return isNonNegativeInteger(value) && value > 0;
+}
+function deliveryBacklogState(ingestion) {
+  if (ingestion?.healthy !== false) return void 0;
+  const failures = ingestion.consecutiveFailures;
+  const failedWithoutProgress = failures !== 0 && !(isPositiveInteger(failures) && isPositiveInteger(ingestion.lastFailedDrainAcknowledgedCount));
+  if (failedWithoutProgress) return "failing";
+  const retained = ingestion.lastRetainedBucketCount;
+  if (!isNonNegativeInteger(retained)) return "failing";
+  return retained > 0 ? "retained" : "draining";
+}
+
 // src/lib/presence.ts
 var DECISION_ORIGIN = "https://app.getprimitive.ai";
 function validDecisionUrl(value) {
@@ -27927,7 +28517,8 @@ function formatStatusline(version, snapshot, resolveIngestionStatus, options = {
     if (snapshot.ingestion?.healthy === false) {
       const pending = snapshot.ingestion.pendingCount;
       const qualifier = snapshot.ingestion.pendingSampled ? "at least " : "";
-      return `primitive ${version} (daemon: degraded \xB7 delivery: stalled${typeof pending === "number" ? ` \xB7 ${qualifier}${String(pending)} pending` : ""}${repositorySuffix}${ingestionSuffix(ingestionStatus)})`;
+      const delivery = deliveryBacklogState(snapshot.ingestion) === "draining" && snapshot.heartbeat?.healthy === true ? "draining" : "stalled";
+      return `primitive ${version} (daemon: degraded \xB7 delivery: ${delivery}${typeof pending === "number" ? ` \xB7 ${qualifier}${String(pending)} pending` : ""}${repositorySuffix}${ingestionSuffix(ingestionStatus)})`;
     }
     if (snapshot.heartbeat?.healthy === false) {
       return `primitive ${version} (daemon: degraded \xB7 presence: unavailable${repositorySuffix}${ingestionSuffix(ingestionStatus)})`;
@@ -27969,10 +28560,10 @@ var STATE_VERSION = 1;
 var DRAFT_STATE_VERSION = 2;
 var NO_CURSOR = -1;
 function stateRoot(namespace) {
-  return join16(primConfigDirectory(), namespace, "decision-digests");
+  return join18(primConfigDirectory(), namespace, "decision-digests");
 }
 function draftStateRoot(namespace) {
-  return join16(primConfigDirectory(), namespace, "decision-draft-deliveries");
+  return join18(primConfigDirectory(), namespace, "decision-draft-deliveries");
 }
 function workspaceFor(cwd) {
   try {
@@ -27984,12 +28575,12 @@ function workspaceFor(cwd) {
 function statePath(args) {
   const identity = `${args.siteUrl}\0${workspaceFor(args.cwd)}\0${args.sessionId}`;
   const key = createHash9("sha256").update(identity).digest("hex");
-  return join16(stateRoot(args.namespace), `${key}.json`);
+  return join18(stateRoot(args.namespace), `${key}.json`);
 }
 function draftStatePath(args) {
   const identity = `${args.siteUrl}\0${workspaceFor(args.cwd)}\0${args.sessionId}\0${args.principalId}\0${args.organizationId}\0${args.credentialFingerprint}`;
   const key = createHash9("sha256").update(identity).digest("hex");
-  return join16(draftStateRoot(args.namespace), `${key}.json`);
+  return join18(draftStateRoot(args.namespace), `${key}.json`);
 }
 function parseState(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
@@ -28030,7 +28621,7 @@ function parseDraftState(value) {
 function readState(path) {
   if (!existsSync11(path)) return void 0;
   try {
-    return parseState(JSON.parse(readFileSync13(path, "utf8")));
+    return parseState(JSON.parse(readFileSync14(path, "utf8")));
   } catch {
     return void 0;
   }
@@ -28038,15 +28629,15 @@ function readState(path) {
 function readDraftState(path) {
   if (!existsSync11(path)) return void 0;
   try {
-    return parseDraftState(JSON.parse(readFileSync13(path, "utf8")));
+    return parseDraftState(JSON.parse(readFileSync14(path, "utf8")));
   } catch {
     return void 0;
   }
 }
 function writeStateFile(path, directory, state) {
-  mkdirSync9(directory, { recursive: true, mode: 448 });
+  mkdirSync10(directory, { recursive: true, mode: 448 });
   chmodSync5(directory, 448);
-  const temporary = join16(
+  const temporary = join18(
     directory,
     `.${path.slice(directory.length + 1)}.tmp-${process.pid}-${randomBytes4(8).toString("hex")}`
   );
@@ -28061,7 +28652,7 @@ function writeStateFile(path, directory, state) {
     renameSync4(temporary, path);
   } finally {
     try {
-      unlinkSync4(temporary);
+      unlinkSync5(temporary);
     } catch {
     }
   }
@@ -28070,14 +28661,14 @@ function cleanupStateFiles(directory, now) {
   if (!existsSync11(directory)) return;
   let names;
   try {
-    names = readdirSync4(directory);
+    names = readdirSync5(directory);
   } catch {
     return;
   }
   const files = [];
   const residue = [];
   for (const name of names) {
-    const path = join16(directory, name);
+    const path = join18(directory, name);
     try {
       const mtimeMs = statSync4(path).mtimeMs;
       if (name.endsWith(".json")) {
@@ -28092,7 +28683,7 @@ function cleanupStateFiles(directory, now) {
   const excess = files.filter((file) => !stale.some((candidate) => candidate.path === file.path)).sort((a, b) => a.mtimeMs - b.mtimeMs).slice(0, Math.max(0, files.length - CODEX_DIGEST_STATE_MAX_FILES));
   for (const file of [...stale, ...excess]) {
     try {
-      unlinkSync4(file.path);
+      unlinkSync5(file.path);
     } catch {
     }
   }
@@ -28383,8 +28974,8 @@ async function prepareCodexContext(options) {
 
 // src/hooks/normalize.ts
 import { createHash as createHash10 } from "crypto";
-import { realpathSync as realpathSync4 } from "fs";
-import { isAbsolute as isAbsolute9, resolve as resolve8 } from "path";
+import { realpathSync as realpathSync5 } from "fs";
+import { isAbsolute as isAbsolute10, resolve as resolve9 } from "path";
 var HERMES_EVENT_MAP = {
   on_session_start: "SessionStart",
   on_session_end: "SessionEnd",
@@ -28432,16 +29023,16 @@ function cursorToolUseId(value) {
 function workspaceCandidates(value) {
   if (!Array.isArray(value)) return [];
   const roots = value.filter((item) => typeof item === "string" && item.length > 0);
-  if (roots.some((root) => !isAbsolute9(root))) {
+  if (roots.some((root) => !isAbsolute10(root))) {
     throw new TypeError("Cursor workspace roots must be absolute");
   }
   return roots;
 }
 function pathIdentity(path) {
   try {
-    return realpathSync4.native(path);
+    return realpathSync5.native(path);
   } catch {
-    return resolve8(path);
+    return resolve9(path);
   }
 }
 function resolveCursorCwd(parsed) {
@@ -28456,17 +29047,17 @@ function resolveCursorCwd(parsed) {
   }
   const expectedRepo = [...repositoryRoots][0];
   const rawCwd = typeof parsed.cwd === "string" && parsed.cwd.length > 0 ? parsed.cwd : void 0;
-  if (rawCwd && !isAbsolute9(rawCwd)) {
+  if (rawCwd && !isAbsolute10(rawCwd)) {
     throw new TypeError("Cursor hook cwd must be absolute");
   }
   const envelopeCwd = rawCwd ? pathIdentity(rawCwd) : void 0;
   const input = typeof parsed.tool_input === "object" && parsed.tool_input !== null && !Array.isArray(parsed.tool_input) ? parsed.tool_input : void 0;
   const rawToolCwd = parsed.tool_name === "Shell" && typeof input?.working_directory === "string" ? input.working_directory : void 0;
   const base = envelopeCwd ?? (roots.length === 1 ? roots[0] : expectedRepo);
-  if (rawToolCwd && !isAbsolute9(rawToolCwd) && !base) {
+  if (rawToolCwd && !isAbsolute10(rawToolCwd) && !base) {
     throw new TypeError("relative Cursor tool cwd has no workspace base");
   }
-  const toolCwd = rawToolCwd ? pathIdentity(isAbsolute9(rawToolCwd) ? rawToolCwd : resolve8(base, rawToolCwd)) : void 0;
+  const toolCwd = rawToolCwd ? pathIdentity(isAbsolute10(rawToolCwd) ? rawToolCwd : resolve9(base, rawToolCwd)) : void 0;
   const selected = toolCwd ?? envelopeCwd ?? (roots.length === 1 ? roots[0] : expectedRepo);
   if (!selected) {
     throw new TypeError("Cursor hook envelope has no unambiguous workspace");
@@ -28560,7 +29151,11 @@ var CODEX_PRIM_REMINDER = primReminder(CODEX_PRIM_ACTION, CODEX_PRIM_ACTION);
 async function activeProjectRoot(cwd) {
   try {
     const root = gitToplevel(cwd);
-    if (!root || !isRepoActiveForCapture(cwd)) return null;
+    if (!root) return null;
+    if (!isRepoActiveForCapture(cwd)) {
+      if (repoActiveFlag(root) === "false") clearHooksWired(root);
+      return null;
+    }
     let shellGateActive = repoActiveFlag(root) === "true";
     if (!shellGateActive) {
       try {
@@ -28570,13 +29165,18 @@ async function activeProjectRoot(cwd) {
       }
     }
     if (shellGateActive) {
-      try {
-        ensureEffectivePostCommitHook(root);
-      } catch {
-      }
-      try {
-        ensureEffectivePostRewriteHook(root);
-      } catch {
+      for (const hookName of MANAGED_GIT_HOOK_NAMES) {
+        try {
+          const result = ensureEffectiveGitHook(hookName, root, {
+            context: "ambient",
+            repairOnly: hookName === "pre-commit"
+          });
+          if (hookName === "post-commit" && // Manual mode: the user's own wiring is expected to reach prim too.
+          ["created", "updated", "unchanged", "manual"].includes(result.outcome)) {
+            recordHooksWired(root, { onlyIfAbsent: true });
+          }
+        } catch {
+        }
       }
     }
     try {