@primitive.ai/prim 0.1.0-alpha.92 → 0.1.0-alpha.94

package/dist/hook-runtime/hooks/post-commit.js

@@ -52,9 +52,9 @@ var require_ucs2length = __commonJS({
 });
 
 // src/hooks/post-commit.ts
-import { execFileSync as execFileSync4, spawn } from "child_process";
-import { lstatSync as lstatSync3, readFileSync as readFileSync9 } from "fs";
-import { basename as basename2, dirname as dirname8, isAbsolute as isAbsolute4, join as join10 } from "path";
+import { execFileSync as execFileSync5, spawn } from "child_process";
+import { lstatSync as lstatSync3, readFileSync as readFileSync11 } from "fs";
+import { basename as basename3, dirname as dirname10, isAbsolute as isAbsolute4, join as join12 } from "path";
 import { fileURLToPath } from "url";
 
 // src/binding.ts
@@ -371,16 +371,16 @@ function resolveOrg(args) {
 import {
   appendFileSync,
   closeSync as closeSync2,
-  existsSync as existsSync4,
+  existsSync as existsSync5,
   fstatSync,
   mkdirSync as mkdirSync4,
   openSync as openSync2,
   opendirSync,
-  readFileSync as readFileSync5,
+  readFileSync as readFileSync6,
   readSync,
-  readdirSync
+  readdirSync as readdirSync2
 } from "fs";
-import { dirname as dirname5, join as join6 } from "path";
+import { dirname as dirname6, join as join7 } from "path";
 
 // src/client.ts
 import { createHash as createHash2 } from "crypto";
@@ -401,6 +401,69 @@ import {
   writeFileSync
 } from "fs";
 import { dirname as dirname2 } from "path";
+var DEFAULT_FILE_MODE = 438;
+function syncDirectory(path) {
+  const fd = openSync(path, constants.O_RDONLY);
+  try {
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+}
+function syncCreatedParentChain(firstCreatedParent, parent) {
+  const createdDirectories = [];
+  let current = parent;
+  while (current !== firstCreatedParent) {
+    createdDirectories.push(current);
+    const next = dirname2(current);
+    if (next === current) {
+      throw new Error("recursive mkdir returned a path outside the target parent chain");
+    }
+    current = next;
+  }
+  createdDirectories.push(firstCreatedParent);
+  syncDirectory(dirname2(firstCreatedParent));
+  for (const directory of createdDirectories.reverse().slice(0, -1)) {
+    syncDirectory(directory);
+  }
+}
+function ensureDurableDirectory(path, mode) {
+  const firstCreatedParent = mkdirSync(path, { recursive: true, mode });
+  if (firstCreatedParent) {
+    syncCreatedParentChain(firstCreatedParent, path);
+  }
+}
+function atomicWriteFile(target, content, options = {}) {
+  const parent = dirname2(target);
+  if (options.ensureParent) {
+    ensureDurableDirectory(parent);
+  }
+  const temporaryPath = `${target}.${randomUUID()}.tmp`;
+  let temporaryCreated = false;
+  try {
+    const flags = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW;
+    const fd = openSync(temporaryPath, flags, options.mode ?? DEFAULT_FILE_MODE);
+    temporaryCreated = true;
+    try {
+      if (options.mode !== void 0) fchmodSync(fd, options.mode);
+      writeFileSync(fd, content);
+      fsyncSync(fd);
+    } finally {
+      closeSync(fd);
+    }
+    options.validate?.(temporaryPath);
+    renameSync(temporaryPath, target);
+    syncDirectory(parent);
+  } catch (error) {
+    if (temporaryCreated) {
+      try {
+        rmSync(temporaryPath, { force: true });
+      } catch {
+      }
+    }
+    throw error;
+  }
+}
 
 // src/lib/file-lock.ts
 import { randomBytes } from "crypto";
@@ -418,8 +481,19 @@ function getSiteUrlForEnvironment(primApiUrl) {
 }
 var CLI_MANAGEMENT_RESPONSE_MAX_BYTES = 2 * 1024 * 1024;
 
+// src/drain-progress.ts
+import {
+  chmodSync as chmodSync2,
+  existsSync as existsSync4,
+  readFileSync as readFileSync5,
+  readdirSync,
+  rmSync as rmSync4,
+  rmdirSync
+} from "fs";
+import { basename, dirname as dirname5, join as join6 } from "path";
+
 // src/journal.ts
-var JOURNAL_DIR = join6(primConfigDirectory(), "moves");
+var JOURNAL_DIR = join7(primConfigDirectory(), "moves");
 var UNBOUND_BUCKET = "_unbound";
 var JOURNAL_BASENAME = "journal.ndjson";
 var JOURNAL_STATS_SAMPLE_BYTES = 64 * 1024;
@@ -431,15 +505,15 @@ function envSlug(apiUrl) {
   return slug;
 }
 function currentEnvDir() {
-  return join6(JOURNAL_DIR, envSlug(getSiteUrl()));
+  return join7(JOURNAL_DIR, envSlug(getSiteUrl()));
 }
 var DIR_MODE = 448;
 var FILE_MODE = 384;
 var SAFE_BUCKET = /^[A-Za-z0-9_-]+$/;
 var RESERVED_BUCKETS = /* @__PURE__ */ new Set([UNBOUND_BUCKET, "_legacy"]);
 function appendMoveToPath(path, move) {
-  const dir = dirname5(path);
-  if (!existsSync4(dir)) {
+  const dir = dirname6(path);
+  if (!existsSync5(dir)) {
     mkdirSync4(dir, { recursive: true, mode: DIR_MODE });
   }
   appendFileSync(path, `${JSON.stringify(move)}
@@ -447,10 +521,10 @@ function appendMoveToPath(path, move) {
 }
 function bucketDir(orgId) {
   const safe = orgId !== void 0 && SAFE_BUCKET.test(orgId) && !RESERVED_BUCKETS.has(orgId);
-  return join6(currentEnvDir(), safe ? orgId : UNBOUND_BUCKET);
+  return join7(currentEnvDir(), safe ? orgId : UNBOUND_BUCKET);
 }
 function journalPath(orgId) {
-  return join6(bucketDir(orgId), JOURNAL_BASENAME);
+  return join7(bucketDir(orgId), JOURNAL_BASENAME);
 }
 function appendMove(move, orgId) {
   appendMoveToPath(journalPath(orgId), move);
@@ -459,15 +533,15 @@ var FLUSHING_PREFIX = `${JOURNAL_BASENAME}.flushing.`;
 
 // src/lib/activation.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync5, readFileSync as readFileSync6 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync7 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 
 // src/lib/git.ts
 import { execFileSync } from "child_process";
 import { createHash as createHash3 } from "crypto";
 import { lstatSync, realpathSync } from "fs";
-import { basename, dirname as dirname6, isAbsolute as isAbsolute2, relative, resolve as resolve2, sep } from "path";
+import { basename as basename2, dirname as dirname7, isAbsolute as isAbsolute2, relative, resolve as resolve2, sep } from "path";
 var GIT_TIMEOUT_MS = 1e3;
 var GITHUB_OWNER_PATTERN = /^(?![A-Za-z0-9-]*--)[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/u;
 var GITHUB_REPOSITORY_PATTERN = /^[A-Za-z0-9._-]{1,100}$/u;
@@ -615,10 +689,10 @@ function hasProjectPrimInstall(cwd) {
   const root = gitToplevel(cwd);
   if (root === null || root === homedir2()) return false;
   for (const rel of PROJECT_INSTALL_FILES) {
-    const path = join7(root, rel);
-    if (existsSync5(path)) {
+    const path = join8(root, rel);
+    if (existsSync6(path)) {
       try {
-        const content = readFileSync6(path, "utf-8");
+        const content = readFileSync7(path, "utf-8");
         if (PRIM_HOOK_BINS.some((bin) => content.includes(bin))) return true;
       } catch {
       }
@@ -18704,26 +18778,84 @@ function cachedCollectScopeAdmits(cwd, facts) {
   );
 }
 
-// src/lib/workspace-id.ts
+// src/lib/commit-heartbeat.ts
 import { execFileSync as execFileSync3 } from "child_process";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync8, readdirSync as readdirSync3, unlinkSync } from "fs";
+import { dirname as dirname8, join as join9, resolve as resolve3 } from "path";
+var FIRED_DIR = "prim/post-commit-fired";
+var GIT_TIMEOUT_MS3 = 1e3;
+var MAX_STAMP_BYTES = 1024;
+var MAX_FIRED_STAMPS = 256;
+var PRUNE_SLACK = 64;
+var FULL_SHA_RE = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/u;
+function gitPath(cwd, relative2) {
+  const value = execFileSync3("git", ["rev-parse", "--git-path", relative2], {
+    cwd,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout: GIT_TIMEOUT_MS3
+  }).replace(/\r?\n$/u, "");
+  if (value === "" || /[\0\r\n]/u.test(value)) throw new Error("Git returned an unsafe path");
+  return resolve3(cwd, value);
+}
+function ensurePrivateParent(path) {
+  mkdirSync5(dirname8(dirname8(path)), { recursive: true, mode: 448 });
+  mkdirSync5(dirname8(path), { recursive: true, mode: 448 });
+}
+function writeStamp(path, at) {
+  ensurePrivateParent(path);
+  atomicWriteFile(path, `${JSON.stringify({ at })}
+`, { mode: 384 });
+}
+function readStampAt(path) {
+  try {
+    const raw = readFileSync8(path, "utf8");
+    if (raw.length > MAX_STAMP_BYTES) return void 0;
+    const parsed = JSON.parse(raw);
+    return typeof parsed.at === "number" && Number.isSafeInteger(parsed.at) && parsed.at > 0 ? parsed.at : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function recordPostCommitFired(cwd, sha, now = Date.now()) {
+  if (!sha || !FULL_SHA_RE.test(sha)) return;
+  try {
+    const dir = gitPath(cwd, FIRED_DIR);
+    writeStamp(join9(dir, sha), now);
+    const names = readdirSync3(dir).filter((name) => FULL_SHA_RE.test(name));
+    if (names.length <= MAX_FIRED_STAMPS + PRUNE_SLACK) return;
+    const stale = names.map((name) => ({ name, at: readStampAt(join9(dir, name)) ?? 0 })).sort((left, right) => right.at - left.at || left.name.localeCompare(right.name)).slice(MAX_FIRED_STAMPS);
+    for (const { name } of stale) unlinkSync(join9(dir, name));
+  } catch {
+  }
+}
+
+// src/lib/unattended.ts
+var UNATTENDED_ENV = "PRIM_UNATTENDED";
+function unattendedEnv(env = process.env) {
+  return { ...env, [UNATTENDED_ENV]: "1" };
+}
+
+// src/lib/workspace-id.ts
+import { execFileSync as execFileSync4 } from "child_process";
 import { randomUUID as randomUUID2 } from "crypto";
 import {
   constants as constants2,
-  chmodSync as chmodSync2,
+  chmodSync as chmodSync3,
   closeSync as closeSync3,
   fchmodSync as fchmodSync2,
   fsyncSync as fsyncSync2,
   linkSync,
   lstatSync as lstatSync2,
-  mkdirSync as mkdirSync5,
+  mkdirSync as mkdirSync6,
   openSync as openSync3,
-  readFileSync as readFileSync7,
+  readFileSync as readFileSync9,
   statSync as statSync2,
-  unlinkSync,
+  unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync3
 } from "fs";
-import { dirname as dirname7, isAbsolute as isAbsolute3, join as join8, resolve as resolve3 } from "path";
-var WORKSPACE_ID_RELATIVE_PATH = join8("prim", "workspace-id");
+import { dirname as dirname9, isAbsolute as isAbsolute3, join as join10, resolve as resolve4 } from "path";
+var WORKSPACE_ID_RELATIVE_PATH = join10("prim", "workspace-id");
 var MAX_ANCESTORS = 64;
 var MAX_GIT_FILE_BYTES = 4096;
 var MAX_ID_FILE_BYTES = 128;
@@ -18751,7 +18883,7 @@ function resolveWorkspaceIdPath(cwd) {
     if (fromFilesystem) return { status: "resolved", path: fromFilesystem };
   }
   try {
-    const output = execFileSync3(
+    const output = execFileSync4(
       "git",
       ["rev-parse", "--is-inside-work-tree", "--git-path", WORKSPACE_ID_RELATIVE_PATH],
       {
@@ -18763,13 +18895,13 @@ function resolveWorkspaceIdPath(cwd) {
         windowsHide: true
       }
     );
-    const [insideWorktree, gitPath, ...extra] = output.trim().split(/\r?\n/);
-    if (insideWorktree !== "true" || !gitPath || extra.length > 0 || gitPath.includes("\0")) {
+    const [insideWorktree, gitPath2, ...extra] = output.trim().split(/\r?\n/);
+    if (insideWorktree !== "true" || !gitPath2 || extra.length > 0 || gitPath2.includes("\0")) {
       return { status: "not_git" };
     }
     return {
       status: "resolved",
-      path: isAbsolute3(gitPath) ? resolve3(gitPath) : resolve3(cwd, gitPath)
+      path: isAbsolute3(gitPath2) ? resolve4(gitPath2) : resolve4(cwd, gitPath2)
     };
   } catch (error) {
     const code = errorCode(error);
@@ -18780,21 +18912,21 @@ function resolveWorkspaceIdPath(cwd) {
   }
 }
 function resolveFromFilesystem(cwd) {
-  let current = resolve3(cwd);
+  let current = resolve4(cwd);
   for (let depth = 0; depth < MAX_ANCESTORS; depth += 1) {
-    const dotGit = join8(current, ".git");
+    const dotGit = join10(current, ".git");
     try {
       const stat = lstatSync2(dotGit);
       if (stat.isDirectory() && isGitDirectory(dotGit)) {
-        return join8(dotGit, WORKSPACE_ID_RELATIVE_PATH);
+        return join10(dotGit, WORKSPACE_ID_RELATIVE_PATH);
       }
       if (stat.isFile() && stat.size <= MAX_GIT_FILE_BYTES) {
-        const contents = readFileSync7(dotGit, "utf8");
+        const contents = readFileSync9(dotGit, "utf8");
         const match = /^gitdir: (.+?)(?:\r?\n)?$/.exec(contents);
         if (match?.[1]) {
-          const gitDirectory = isAbsolute3(match[1]) ? resolve3(match[1]) : resolve3(current, match[1]);
+          const gitDirectory = isAbsolute3(match[1]) ? resolve4(match[1]) : resolve4(current, match[1]);
           if (isGitDirectory(gitDirectory)) {
-            return join8(gitDirectory, WORKSPACE_ID_RELATIVE_PATH);
+            return join10(gitDirectory, WORKSPACE_ID_RELATIVE_PATH);
           }
         }
       }
@@ -18805,7 +18937,7 @@ function resolveFromFilesystem(cwd) {
         return null;
       }
     }
-    const parent = dirname7(current);
+    const parent = dirname9(current);
     if (parent === current) break;
     current = parent;
   }
@@ -18813,7 +18945,7 @@ function resolveFromFilesystem(cwd) {
 }
 function isGitDirectory(path) {
   try {
-    return statSync2(join8(path, "HEAD")).isFile();
+    return statSync2(join10(path, "HEAD")).isFile();
   } catch {
     return false;
   }
@@ -18832,7 +18964,7 @@ function inspectPath(path) {
     return { status: "corrupt", path, reason: "invalid_content" };
   }
   try {
-    const contents = readFileSync7(path, "utf8");
+    const contents = readFileSync9(path, "utf8");
     const workspaceId = contents.endsWith("\n") ? contents.slice(0, -1) : contents;
     if ((contents === workspaceId || contents === `${workspaceId}
 `) && isCanonicalWorkspaceId(workspaceId)) {
@@ -18849,14 +18981,14 @@ function inspectPath(path) {
   }
 }
 function createWorkspaceId(path) {
-  const parent = dirname7(path);
+  const parent = dirname9(path);
   const workspaceId = randomUUID2();
-  const temporaryPath = join8(parent, `.workspace-id-${process.pid}-${randomUUID2()}.tmp`);
+  const temporaryPath = join10(parent, `.workspace-id-${process.pid}-${randomUUID2()}.tmp`);
   let temporaryCreated = false;
   let publishing = false;
   try {
-    mkdirSync5(parent, { recursive: true, mode: 448 });
-    chmodSync2(parent, 448);
+    mkdirSync6(parent, { recursive: true, mode: 448 });
+    chmodSync3(parent, 448);
     const fd = openSync3(
       temporaryPath,
       constants2.O_CREAT | constants2.O_EXCL | constants2.O_WRONLY,
@@ -18885,7 +19017,7 @@ function createWorkspaceId(path) {
   } finally {
     if (temporaryCreated) {
       try {
-        unlinkSync(temporaryPath);
+        unlinkSync2(temporaryPath);
       } catch {
       }
     }
@@ -18920,8 +19052,8 @@ var AGENT_ENVELOPE_VERSION = 3;
 var ENVELOPE_VERSION = LEGACY_ENVELOPE_VERSION;
 
 // src/hooks/redact.ts
-import { existsSync as existsSync6, readFileSync as readFileSync8, statSync as statSync3 } from "fs";
-import { join as join9 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync10, statSync as statSync3 } from "fs";
+import { join as join11 } from "path";
 import { Worker } from "worker_threads";
 var USER_HOME_RULES = [
   {
@@ -19097,15 +19229,15 @@ function toCommitMove(commit, cliVersion, cwd, context = {}) {
 }
 
 // src/hooks/post-commit.ts
-var here = dirname8(fileURLToPath(import.meta.url));
-var GIT_TIMEOUT_MS3 = 1e3;
-var FULL_SHA_RE = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/u;
+var here = dirname10(fileURLToPath(import.meta.url));
+var GIT_TIMEOUT_MS4 = 1e3;
+var FULL_SHA_RE2 = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/u;
 var OBSERVATION_MARKER_RE = /^prim-post-commit-observed\.[A-Za-z0-9]+$/u;
 var MAX_OBSERVATION_MARKER_AGE_MS = 10 * 60 * 1e3;
 var MAX_OBSERVATION_MARKER_FUTURE_SKEW_MS = 5e3;
 function capturedAtFromLauncher(env = process.env, now = Date.now()) {
   const path = env.PRIM_COMMIT_OBSERVED_FILE;
-  if (!path || !isAbsolute4(path) || !OBSERVATION_MARKER_RE.test(basename2(path))) return;
+  if (!path || !isAbsolute4(path) || !OBSERVATION_MARKER_RE.test(basename3(path))) return;
   try {
     const stat = lstatSync3(path);
     const capturedAt = Math.trunc(stat.mtimeMs);
@@ -19120,10 +19252,10 @@ function capturedAtFromLauncher(env = process.env, now = Date.now()) {
 }
 function gitText(args) {
   try {
-    return execFileSync4("git", args, {
+    return execFileSync5("git", args, {
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"],
-      timeout: GIT_TIMEOUT_MS3
+      timeout: GIT_TIMEOUT_MS4
     }).trim();
   } catch {
     return;
@@ -19131,10 +19263,10 @@ function gitText(args) {
 }
 function gitBytes(args) {
   try {
-    return execFileSync4("git", args, {
+    return execFileSync5("git", args, {
       encoding: "buffer",
       stdio: ["ignore", "pipe", "ignore"],
-      timeout: GIT_TIMEOUT_MS3
+      timeout: GIT_TIMEOUT_MS4
     });
   } catch {
     return;
@@ -19165,7 +19297,7 @@ function parseNulPaths(value) {
 function readCommit() {
   const snapshotProvided = process.env.PRIM_COMMIT_SHA !== void 0;
   const sha = snapshotProvided ? process.env.PRIM_COMMIT_SHA : gitText(["rev-parse", "HEAD"]);
-  if (!sha || !FULL_SHA_RE.test(sha)) {
+  if (!sha || !FULL_SHA_RE2.test(sha)) {
     return null;
   }
   const rawBranch = process.env.PRIM_COMMIT_BRANCH !== void 0 ? process.env.PRIM_COMMIT_BRANCH : gitText(["rev-parse", "--abbrev-ref", "HEAD"]);
@@ -19191,21 +19323,23 @@ function readCommit() {
 }
 function resolveCliVersion() {
   try {
-    const pkg = JSON.parse(readFileSync9(join10(here, "..", "..", "package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync11(join12(here, "..", "..", "package.json"), "utf-8"));
     return pkg.version ?? "unknown";
   } catch {
     return "unknown";
   }
 }
 function spawnBackgroundFlush() {
-  const entry = join10(here, "..", "index.js");
+  const entry = join12(here, "..", "index.js");
   spawn(process.execPath, [entry, "moves", "flush"], {
     detached: true,
-    stdio: "ignore"
+    stdio: "ignore",
+    env: unattendedEnv()
   }).unref();
 }
 function runPostCommit() {
   const cwd = gitText(["rev-parse", "--show-toplevel"]) ?? process.cwd();
+  recordPostCommitFired(cwd, process.env.PRIM_COMMIT_SHA);
   if (!isRepoActiveForCapture(cwd)) {
     return;
   }