@primitive.ai/prim 0.1.0-alpha.93 → 0.1.0-alpha.94

package/dist/hook-runtime/hooks/post-commit.js

@@ -52,9 +52,9 @@ var require_ucs2length = __commonJS({
 });
 
 // src/hooks/post-commit.ts
-import { execFileSync as execFileSync4, spawn } from "child_process";
-import { lstatSync as lstatSync3, readFileSync as readFileSync10 } from "fs";
-import { basename as basename3, dirname as dirname9, isAbsolute as isAbsolute4, join as join11 } from "path";
+import { execFileSync as execFileSync5, spawn } from "child_process";
+import { lstatSync as lstatSync3, readFileSync as readFileSync11 } from "fs";
+import { basename as basename3, dirname as dirname10, isAbsolute as isAbsolute4, join as join12 } from "path";
 import { fileURLToPath } from "url";
 
 // src/binding.ts
@@ -401,6 +401,69 @@ import {
   writeFileSync
 } from "fs";
 import { dirname as dirname2 } from "path";
+var DEFAULT_FILE_MODE = 438;
+function syncDirectory(path) {
+  const fd = openSync(path, constants.O_RDONLY);
+  try {
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+}
+function syncCreatedParentChain(firstCreatedParent, parent) {
+  const createdDirectories = [];
+  let current = parent;
+  while (current !== firstCreatedParent) {
+    createdDirectories.push(current);
+    const next = dirname2(current);
+    if (next === current) {
+      throw new Error("recursive mkdir returned a path outside the target parent chain");
+    }
+    current = next;
+  }
+  createdDirectories.push(firstCreatedParent);
+  syncDirectory(dirname2(firstCreatedParent));
+  for (const directory of createdDirectories.reverse().slice(0, -1)) {
+    syncDirectory(directory);
+  }
+}
+function ensureDurableDirectory(path, mode) {
+  const firstCreatedParent = mkdirSync(path, { recursive: true, mode });
+  if (firstCreatedParent) {
+    syncCreatedParentChain(firstCreatedParent, path);
+  }
+}
+function atomicWriteFile(target, content, options = {}) {
+  const parent = dirname2(target);
+  if (options.ensureParent) {
+    ensureDurableDirectory(parent);
+  }
+  const temporaryPath = `${target}.${randomUUID()}.tmp`;
+  let temporaryCreated = false;
+  try {
+    const flags = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW;
+    const fd = openSync(temporaryPath, flags, options.mode ?? DEFAULT_FILE_MODE);
+    temporaryCreated = true;
+    try {
+      if (options.mode !== void 0) fchmodSync(fd, options.mode);
+      writeFileSync(fd, content);
+      fsyncSync(fd);
+    } finally {
+      closeSync(fd);
+    }
+    options.validate?.(temporaryPath);
+    renameSync(temporaryPath, target);
+    syncDirectory(parent);
+  } catch (error) {
+    if (temporaryCreated) {
+      try {
+        rmSync(temporaryPath, { force: true });
+      } catch {
+      }
+    }
+    throw error;
+  }
+}
 
 // src/lib/file-lock.ts
 import { randomBytes } from "crypto";
@@ -18715,6 +18778,58 @@ function cachedCollectScopeAdmits(cwd, facts) {
   );
 }
 
+// src/lib/commit-heartbeat.ts
+import { execFileSync as execFileSync3 } from "child_process";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync8, readdirSync as readdirSync3, unlinkSync } from "fs";
+import { dirname as dirname8, join as join9, resolve as resolve3 } from "path";
+var FIRED_DIR = "prim/post-commit-fired";
+var GIT_TIMEOUT_MS3 = 1e3;
+var MAX_STAMP_BYTES = 1024;
+var MAX_FIRED_STAMPS = 256;
+var PRUNE_SLACK = 64;
+var FULL_SHA_RE = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/u;
+function gitPath(cwd, relative2) {
+  const value = execFileSync3("git", ["rev-parse", "--git-path", relative2], {
+    cwd,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout: GIT_TIMEOUT_MS3
+  }).replace(/\r?\n$/u, "");
+  if (value === "" || /[\0\r\n]/u.test(value)) throw new Error("Git returned an unsafe path");
+  return resolve3(cwd, value);
+}
+function ensurePrivateParent(path) {
+  mkdirSync5(dirname8(dirname8(path)), { recursive: true, mode: 448 });
+  mkdirSync5(dirname8(path), { recursive: true, mode: 448 });
+}
+function writeStamp(path, at) {
+  ensurePrivateParent(path);
+  atomicWriteFile(path, `${JSON.stringify({ at })}
+`, { mode: 384 });
+}
+function readStampAt(path) {
+  try {
+    const raw = readFileSync8(path, "utf8");
+    if (raw.length > MAX_STAMP_BYTES) return void 0;
+    const parsed = JSON.parse(raw);
+    return typeof parsed.at === "number" && Number.isSafeInteger(parsed.at) && parsed.at > 0 ? parsed.at : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function recordPostCommitFired(cwd, sha, now = Date.now()) {
+  if (!sha || !FULL_SHA_RE.test(sha)) return;
+  try {
+    const dir = gitPath(cwd, FIRED_DIR);
+    writeStamp(join9(dir, sha), now);
+    const names = readdirSync3(dir).filter((name) => FULL_SHA_RE.test(name));
+    if (names.length <= MAX_FIRED_STAMPS + PRUNE_SLACK) return;
+    const stale = names.map((name) => ({ name, at: readStampAt(join9(dir, name)) ?? 0 })).sort((left, right) => right.at - left.at || left.name.localeCompare(right.name)).slice(MAX_FIRED_STAMPS);
+    for (const { name } of stale) unlinkSync(join9(dir, name));
+  } catch {
+  }
+}
+
 // src/lib/unattended.ts
 var UNATTENDED_ENV = "PRIM_UNATTENDED";
 function unattendedEnv(env = process.env) {
@@ -18722,7 +18837,7 @@ function unattendedEnv(env = process.env) {
 }
 
 // src/lib/workspace-id.ts
-import { execFileSync as execFileSync3 } from "child_process";
+import { execFileSync as execFileSync4 } from "child_process";
 import { randomUUID as randomUUID2 } from "crypto";
 import {
   constants as constants2,
@@ -18732,15 +18847,15 @@ import {
   fsyncSync as fsyncSync2,
   linkSync,
   lstatSync as lstatSync2,
-  mkdirSync as mkdirSync5,
+  mkdirSync as mkdirSync6,
   openSync as openSync3,
-  readFileSync as readFileSync8,
+  readFileSync as readFileSync9,
   statSync as statSync2,
-  unlinkSync,
+  unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync3
 } from "fs";
-import { dirname as dirname8, isAbsolute as isAbsolute3, join as join9, resolve as resolve3 } from "path";
-var WORKSPACE_ID_RELATIVE_PATH = join9("prim", "workspace-id");
+import { dirname as dirname9, isAbsolute as isAbsolute3, join as join10, resolve as resolve4 } from "path";
+var WORKSPACE_ID_RELATIVE_PATH = join10("prim", "workspace-id");
 var MAX_ANCESTORS = 64;
 var MAX_GIT_FILE_BYTES = 4096;
 var MAX_ID_FILE_BYTES = 128;
@@ -18768,7 +18883,7 @@ function resolveWorkspaceIdPath(cwd) {
     if (fromFilesystem) return { status: "resolved", path: fromFilesystem };
   }
   try {
-    const output = execFileSync3(
+    const output = execFileSync4(
       "git",
       ["rev-parse", "--is-inside-work-tree", "--git-path", WORKSPACE_ID_RELATIVE_PATH],
       {
@@ -18780,13 +18895,13 @@ function resolveWorkspaceIdPath(cwd) {
         windowsHide: true
       }
     );
-    const [insideWorktree, gitPath, ...extra] = output.trim().split(/\r?\n/);
-    if (insideWorktree !== "true" || !gitPath || extra.length > 0 || gitPath.includes("\0")) {
+    const [insideWorktree, gitPath2, ...extra] = output.trim().split(/\r?\n/);
+    if (insideWorktree !== "true" || !gitPath2 || extra.length > 0 || gitPath2.includes("\0")) {
       return { status: "not_git" };
     }
     return {
       status: "resolved",
-      path: isAbsolute3(gitPath) ? resolve3(gitPath) : resolve3(cwd, gitPath)
+      path: isAbsolute3(gitPath2) ? resolve4(gitPath2) : resolve4(cwd, gitPath2)
     };
   } catch (error) {
     const code = errorCode(error);
@@ -18797,21 +18912,21 @@ function resolveWorkspaceIdPath(cwd) {
   }
 }
 function resolveFromFilesystem(cwd) {
-  let current = resolve3(cwd);
+  let current = resolve4(cwd);
   for (let depth = 0; depth < MAX_ANCESTORS; depth += 1) {
-    const dotGit = join9(current, ".git");
+    const dotGit = join10(current, ".git");
     try {
       const stat = lstatSync2(dotGit);
       if (stat.isDirectory() && isGitDirectory(dotGit)) {
-        return join9(dotGit, WORKSPACE_ID_RELATIVE_PATH);
+        return join10(dotGit, WORKSPACE_ID_RELATIVE_PATH);
       }
       if (stat.isFile() && stat.size <= MAX_GIT_FILE_BYTES) {
-        const contents = readFileSync8(dotGit, "utf8");
+        const contents = readFileSync9(dotGit, "utf8");
         const match = /^gitdir: (.+?)(?:\r?\n)?$/.exec(contents);
         if (match?.[1]) {
-          const gitDirectory = isAbsolute3(match[1]) ? resolve3(match[1]) : resolve3(current, match[1]);
+          const gitDirectory = isAbsolute3(match[1]) ? resolve4(match[1]) : resolve4(current, match[1]);
           if (isGitDirectory(gitDirectory)) {
-            return join9(gitDirectory, WORKSPACE_ID_RELATIVE_PATH);
+            return join10(gitDirectory, WORKSPACE_ID_RELATIVE_PATH);
           }
         }
       }
@@ -18822,7 +18937,7 @@ function resolveFromFilesystem(cwd) {
         return null;
       }
     }
-    const parent = dirname8(current);
+    const parent = dirname9(current);
     if (parent === current) break;
     current = parent;
   }
@@ -18830,7 +18945,7 @@ function resolveFromFilesystem(cwd) {
 }
 function isGitDirectory(path) {
   try {
-    return statSync2(join9(path, "HEAD")).isFile();
+    return statSync2(join10(path, "HEAD")).isFile();
   } catch {
     return false;
   }
@@ -18849,7 +18964,7 @@ function inspectPath(path) {
     return { status: "corrupt", path, reason: "invalid_content" };
   }
   try {
-    const contents = readFileSync8(path, "utf8");
+    const contents = readFileSync9(path, "utf8");
     const workspaceId = contents.endsWith("\n") ? contents.slice(0, -1) : contents;
     if ((contents === workspaceId || contents === `${workspaceId}
 `) && isCanonicalWorkspaceId(workspaceId)) {
@@ -18866,13 +18981,13 @@ function inspectPath(path) {
   }
 }
 function createWorkspaceId(path) {
-  const parent = dirname8(path);
+  const parent = dirname9(path);
   const workspaceId = randomUUID2();
-  const temporaryPath = join9(parent, `.workspace-id-${process.pid}-${randomUUID2()}.tmp`);
+  const temporaryPath = join10(parent, `.workspace-id-${process.pid}-${randomUUID2()}.tmp`);
   let temporaryCreated = false;
   let publishing = false;
   try {
-    mkdirSync5(parent, { recursive: true, mode: 448 });
+    mkdirSync6(parent, { recursive: true, mode: 448 });
     chmodSync3(parent, 448);
     const fd = openSync3(
       temporaryPath,
@@ -18902,7 +19017,7 @@ function createWorkspaceId(path) {
   } finally {
     if (temporaryCreated) {
       try {
-        unlinkSync(temporaryPath);
+        unlinkSync2(temporaryPath);
       } catch {
       }
     }
@@ -18937,8 +19052,8 @@ var AGENT_ENVELOPE_VERSION = 3;
 var ENVELOPE_VERSION = LEGACY_ENVELOPE_VERSION;
 
 // src/hooks/redact.ts
-import { existsSync as existsSync7, readFileSync as readFileSync9, statSync as statSync3 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync10, statSync as statSync3 } from "fs";
+import { join as join11 } from "path";
 import { Worker } from "worker_threads";
 var USER_HOME_RULES = [
   {
@@ -19114,9 +19229,9 @@ function toCommitMove(commit, cliVersion, cwd, context = {}) {
 }
 
 // src/hooks/post-commit.ts
-var here = dirname9(fileURLToPath(import.meta.url));
-var GIT_TIMEOUT_MS3 = 1e3;
-var FULL_SHA_RE = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/u;
+var here = dirname10(fileURLToPath(import.meta.url));
+var GIT_TIMEOUT_MS4 = 1e3;
+var FULL_SHA_RE2 = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/u;
 var OBSERVATION_MARKER_RE = /^prim-post-commit-observed\.[A-Za-z0-9]+$/u;
 var MAX_OBSERVATION_MARKER_AGE_MS = 10 * 60 * 1e3;
 var MAX_OBSERVATION_MARKER_FUTURE_SKEW_MS = 5e3;
@@ -19137,10 +19252,10 @@ function capturedAtFromLauncher(env = process.env, now = Date.now()) {
 }
 function gitText(args) {
   try {
-    return execFileSync4("git", args, {
+    return execFileSync5("git", args, {
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"],
-      timeout: GIT_TIMEOUT_MS3
+      timeout: GIT_TIMEOUT_MS4
     }).trim();
   } catch {
     return;
@@ -19148,10 +19263,10 @@ function gitText(args) {
 }
 function gitBytes(args) {
   try {
-    return execFileSync4("git", args, {
+    return execFileSync5("git", args, {
       encoding: "buffer",
       stdio: ["ignore", "pipe", "ignore"],
-      timeout: GIT_TIMEOUT_MS3
+      timeout: GIT_TIMEOUT_MS4
     });
   } catch {
     return;
@@ -19182,7 +19297,7 @@ function parseNulPaths(value) {
 function readCommit() {
   const snapshotProvided = process.env.PRIM_COMMIT_SHA !== void 0;
   const sha = snapshotProvided ? process.env.PRIM_COMMIT_SHA : gitText(["rev-parse", "HEAD"]);
-  if (!sha || !FULL_SHA_RE.test(sha)) {
+  if (!sha || !FULL_SHA_RE2.test(sha)) {
     return null;
   }
   const rawBranch = process.env.PRIM_COMMIT_BRANCH !== void 0 ? process.env.PRIM_COMMIT_BRANCH : gitText(["rev-parse", "--abbrev-ref", "HEAD"]);
@@ -19208,14 +19323,14 @@ function readCommit() {
 }
 function resolveCliVersion() {
   try {
-    const pkg = JSON.parse(readFileSync10(join11(here, "..", "..", "package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync11(join12(here, "..", "..", "package.json"), "utf-8"));
     return pkg.version ?? "unknown";
   } catch {
     return "unknown";
   }
 }
 function spawnBackgroundFlush() {
-  const entry = join11(here, "..", "index.js");
+  const entry = join12(here, "..", "index.js");
   spawn(process.execPath, [entry, "moves", "flush"], {
     detached: true,
     stdio: "ignore",
@@ -19224,6 +19339,7 @@ function spawnBackgroundFlush() {
 }
 function runPostCommit() {
   const cwd = gitText(["rev-parse", "--show-toplevel"]) ?? process.cwd();
+  recordPostCommitFired(cwd, process.env.PRIM_COMMIT_SHA);
   if (!isRepoActiveForCapture(cwd)) {
     return;
   }

package/dist/hook-runtime/hooks/post-tool-use.js

@@ -19998,6 +19998,13 @@ function shellQuote(value) {
 }
 var STABLE_HOOK_ARGUMENTS_RE = /^[-A-Za-z0-9_ ]*$/u;
 var STABLE_HOOK_BIN_RE = /^[A-Za-z0-9][A-Za-z0-9-]*$/u;
+var PRIM_CONFIG_SHELL_RESOLVER = [
+  'prim_absolute() { case "$1" in [/]* ) ;; *) return 1 ;; esac; case "$1" in [[:space:]]*|*[[:space:]]|*[/][/]*|*[/].[/]*|*[/]..[/]*|*[/].|*[/]..|?*[/]) return 1 ;; esac; }; ',
+  'prim_config=${PRIM_CONFIG_DIR:-}; if ! prim_absolute "$prim_config"; then prim_config=${XDG_CONFIG_HOME:-}; if prim_absolute "$prim_config"; then ',
+  'case "$prim_config" in /) prim_config=/prim ;; *) prim_config="$prim_config/prim" ;; esac; ',
+  'else prim_home=${HOME:-}; prim_absolute "$prim_home" || exit 78; case "$prim_home" in /) prim_config=/.config/prim ;; *) prim_config="$prim_home/.config/prim" ;; esac; ',
+  "fi; fi; "
+].join("");
 function stableHookCommand(bin, args = "") {
   if (!STABLE_HOOK_BIN_RE.test(bin) || !STABLE_HOOK_ARGUMENTS_RE.test(args)) {
     throw new Error("invalid stable hook command");
@@ -20007,11 +20014,7 @@ function stableHookCommand(bin, args = "") {
     // it as inert data during the rolling window so an older uninstall or
     // reinstall can remove the stable entry without invoking npm or PATH.
     `prim_legacy_reader='-p ${PKG_NAME}@stable prim-shim.sh ${bin} '; `,
-    'prim_absolute() { case "$1" in [/]* ) ;; *) return 1 ;; esac; case "$1" in [[:space:]]*|*[[:space:]]|*[/][/]*|*[/].[/]*|*[/]..[/]*|*[/].|*[/]..|?*[/]) return 1 ;; esac; }; ',
-    'prim_config=${PRIM_CONFIG_DIR:-}; if ! prim_absolute "$prim_config"; then prim_config=${XDG_CONFIG_HOME:-}; if prim_absolute "$prim_config"; then ',
-    'case "$prim_config" in /) prim_config=/prim ;; *) prim_config="$prim_config/prim" ;; esac; ',
-    'else prim_home=${HOME:-}; prim_absolute "$prim_home" || exit 78; case "$prim_home" in /) prim_config=/.config/prim ;; *) prim_config="$prim_home/.config/prim" ;; esac; ',
-    "fi; fi; ",
+    PRIM_CONFIG_SHELL_RESOLVER,
     `case "$prim_config" in /) prim_launcher=/${STABLE_HOOK_LAUNCHER_NAME} ;; *) prim_launcher="$prim_config/${STABLE_HOOK_LAUNCHER_NAME}" ;; esac; `,
     'exec "$prim_launcher" "$@"'
   ].join("");
@@ -20661,6 +20664,53 @@ import {
   writeFileSync as writeFileSync5
 } from "fs";
 import { delimiter, dirname as dirname8, isAbsolute as isAbsolute5, join as join11, resolve as resolve4 } from "path";
+
+// src/lib/git-hook-contract.ts
+var GIT_HOOK_ENTRYPOINT_CONTENT = `#!/bin/sh
+# prim git hook entrypoint v1 \u2014 managed by prim; do not edit.
+# Run by the "# >>> prim <hook> hook >>>" block in a Git hook file. Acts only
+# where prim is active (git config prim.active true) and never fails the hook.
+case "$0" in */*) prim_dir=\${0%/*} ;; *) exit 0 ;; esac
+prim_launcher="$prim_dir/${STABLE_HOOK_LAUNCHER_NAME}"
+[ -x "$prim_launcher" ] || exit 0
+[ "$(git config --get prim.active 2>/dev/null)" = "true" ] || exit 0
+prim_hook=\${1-}
+if [ "$#" -gt 0 ]; then shift; fi
+case "$prim_hook" in
+pre-commit)
+  "$prim_launcher" prim-pre-commit "$@" || :
+  ;;
+post-commit)
+  prim_sha=$(git rev-parse --verify HEAD 2>/dev/null) || exit 0
+  case "$prim_sha" in *[!0-9a-f]* | "") exit 0 ;; esac
+  case "\${#prim_sha}" in 40 | 64) ;; *) exit 0 ;; esac
+  prim_branch=$(git symbolic-ref --quiet --short HEAD 2>/dev/null) || prim_branch=
+  prim_observed=$(mktemp "\${TMPDIR:-/tmp}/prim-post-commit-observed.XXXXXXXX" 2>/dev/null) || prim_observed=
+  (
+    trap '' HUP
+    trap 'if [ -n "$prim_observed" ]; then rm -f "$prim_observed"; fi' 0
+    PRIM_COMMIT_SHA=$prim_sha PRIM_COMMIT_BRANCH=$prim_branch PRIM_COMMIT_OBSERVED_FILE=$prim_observed "$prim_launcher" prim-post-commit
+  ) </dev/null >/dev/null 2>&1 &
+  ;;
+post-rewrite)
+  case "\${1-}" in amend | rebase) prim_source=$1 ;; *) exit 0 ;; esac
+  prim_pairs=$(mktemp "\${TMPDIR:-/tmp}/prim-post-rewrite-pairs.XXXXXXXX" 2>/dev/null) || exit 0
+  if ! chmod 600 "$prim_pairs" 2>/dev/null || ! cat >"$prim_pairs"; then
+    rm -f "$prim_pairs"
+    exit 0
+  fi
+  prim_branch=$(git symbolic-ref --quiet --short HEAD 2>/dev/null) || prim_branch=
+  (
+    trap '' HUP
+    trap 'rm -f "$prim_pairs"' 0
+    PRIM_REWRITE_SOURCE=$prim_source PRIM_REWRITE_BRANCH=$prim_branch PRIM_REWRITE_PAIRS_FILE=$prim_pairs "$prim_launcher" prim-post-rewrite
+  ) </dev/null >/dev/null 2>&1 &
+  ;;
+esac
+exit 0
+`;
+
+// src/lib/hook-runtime.ts
 var RELEASE_PREFIX = "release-";
 var MAX_MANIFEST_BYTES = 64 * 1024;
 var RELEASE_GRACE_MS = 10 * 60 * 1e3;

package/dist/hook-runtime/hooks/pre-tool-use.js

@@ -370,6 +370,13 @@ function shellQuote(value) {
 }
 var STABLE_HOOK_ARGUMENTS_RE = /^[-A-Za-z0-9_ ]*$/u;
 var STABLE_HOOK_BIN_RE = /^[A-Za-z0-9][A-Za-z0-9-]*$/u;
+var PRIM_CONFIG_SHELL_RESOLVER = [
+  'prim_absolute() { case "$1" in [/]* ) ;; *) return 1 ;; esac; case "$1" in [[:space:]]*|*[[:space:]]|*[/][/]*|*[/].[/]*|*[/]..[/]*|*[/].|*[/]..|?*[/]) return 1 ;; esac; }; ',
+  'prim_config=${PRIM_CONFIG_DIR:-}; if ! prim_absolute "$prim_config"; then prim_config=${XDG_CONFIG_HOME:-}; if prim_absolute "$prim_config"; then ',
+  'case "$prim_config" in /) prim_config=/prim ;; *) prim_config="$prim_config/prim" ;; esac; ',
+  'else prim_home=${HOME:-}; prim_absolute "$prim_home" || exit 78; case "$prim_home" in /) prim_config=/.config/prim ;; *) prim_config="$prim_home/.config/prim" ;; esac; ',
+  "fi; fi; "
+].join("");
 function stableHookCommand(bin, args = "") {
   if (!STABLE_HOOK_BIN_RE.test(bin) || !STABLE_HOOK_ARGUMENTS_RE.test(args)) {
     throw new Error("invalid stable hook command");
@@ -379,11 +386,7 @@ function stableHookCommand(bin, args = "") {
     // it as inert data during the rolling window so an older uninstall or
     // reinstall can remove the stable entry without invoking npm or PATH.
     `prim_legacy_reader='-p ${PKG_NAME}@stable prim-shim.sh ${bin} '; `,
-    'prim_absolute() { case "$1" in [/]* ) ;; *) return 1 ;; esac; case "$1" in [[:space:]]*|*[[:space:]]|*[/][/]*|*[/].[/]*|*[/]..[/]*|*[/].|*[/]..|?*[/]) return 1 ;; esac; }; ',
-    'prim_config=${PRIM_CONFIG_DIR:-}; if ! prim_absolute "$prim_config"; then prim_config=${XDG_CONFIG_HOME:-}; if prim_absolute "$prim_config"; then ',
-    'case "$prim_config" in /) prim_config=/prim ;; *) prim_config="$prim_config/prim" ;; esac; ',
-    'else prim_home=${HOME:-}; prim_absolute "$prim_home" || exit 78; case "$prim_home" in /) prim_config=/.config/prim ;; *) prim_config="$prim_home/.config/prim" ;; esac; ',
-    "fi; fi; ",
+    PRIM_CONFIG_SHELL_RESOLVER,
     `case "$prim_config" in /) prim_launcher=/${STABLE_HOOK_LAUNCHER_NAME} ;; *) prim_launcher="$prim_config/${STABLE_HOOK_LAUNCHER_NAME}" ;; esac; `,
     'exec "$prim_launcher" "$@"'
   ].join("");
@@ -20292,6 +20295,53 @@ import {
   writeFileSync as writeFileSync4
 } from "fs";
 import { delimiter, dirname as dirname6, isAbsolute as isAbsolute4, join as join9, resolve as resolve3 } from "path";
+
+// src/lib/git-hook-contract.ts
+var GIT_HOOK_ENTRYPOINT_CONTENT = `#!/bin/sh
+# prim git hook entrypoint v1 \u2014 managed by prim; do not edit.
+# Run by the "# >>> prim <hook> hook >>>" block in a Git hook file. Acts only
+# where prim is active (git config prim.active true) and never fails the hook.
+case "$0" in */*) prim_dir=\${0%/*} ;; *) exit 0 ;; esac
+prim_launcher="$prim_dir/${STABLE_HOOK_LAUNCHER_NAME}"
+[ -x "$prim_launcher" ] || exit 0
+[ "$(git config --get prim.active 2>/dev/null)" = "true" ] || exit 0
+prim_hook=\${1-}
+if [ "$#" -gt 0 ]; then shift; fi
+case "$prim_hook" in
+pre-commit)
+  "$prim_launcher" prim-pre-commit "$@" || :
+  ;;
+post-commit)
+  prim_sha=$(git rev-parse --verify HEAD 2>/dev/null) || exit 0
+  case "$prim_sha" in *[!0-9a-f]* | "") exit 0 ;; esac
+  case "\${#prim_sha}" in 40 | 64) ;; *) exit 0 ;; esac
+  prim_branch=$(git symbolic-ref --quiet --short HEAD 2>/dev/null) || prim_branch=
+  prim_observed=$(mktemp "\${TMPDIR:-/tmp}/prim-post-commit-observed.XXXXXXXX" 2>/dev/null) || prim_observed=
+  (
+    trap '' HUP
+    trap 'if [ -n "$prim_observed" ]; then rm -f "$prim_observed"; fi' 0
+    PRIM_COMMIT_SHA=$prim_sha PRIM_COMMIT_BRANCH=$prim_branch PRIM_COMMIT_OBSERVED_FILE=$prim_observed "$prim_launcher" prim-post-commit
+  ) </dev/null >/dev/null 2>&1 &
+  ;;
+post-rewrite)
+  case "\${1-}" in amend | rebase) prim_source=$1 ;; *) exit 0 ;; esac
+  prim_pairs=$(mktemp "\${TMPDIR:-/tmp}/prim-post-rewrite-pairs.XXXXXXXX" 2>/dev/null) || exit 0
+  if ! chmod 600 "$prim_pairs" 2>/dev/null || ! cat >"$prim_pairs"; then
+    rm -f "$prim_pairs"
+    exit 0
+  fi
+  prim_branch=$(git symbolic-ref --quiet --short HEAD 2>/dev/null) || prim_branch=
+  (
+    trap '' HUP
+    trap 'rm -f "$prim_pairs"' 0
+    PRIM_REWRITE_SOURCE=$prim_source PRIM_REWRITE_BRANCH=$prim_branch PRIM_REWRITE_PAIRS_FILE=$prim_pairs "$prim_launcher" prim-post-rewrite
+  ) </dev/null >/dev/null 2>&1 &
+  ;;
+esac
+exit 0
+`;
+
+// src/lib/hook-runtime.ts
 var RELEASE_PREFIX = "release-";
 var MAX_MANIFEST_BYTES = 64 * 1024;
 var RELEASE_GRACE_MS = 10 * 60 * 1e3;

package/dist/hook-runtime/hooks/prim-hook.js

@@ -20180,6 +20180,13 @@ function shellQuote(value) {
 }
 var STABLE_HOOK_ARGUMENTS_RE = /^[-A-Za-z0-9_ ]*$/u;
 var STABLE_HOOK_BIN_RE = /^[A-Za-z0-9][A-Za-z0-9-]*$/u;
+var PRIM_CONFIG_SHELL_RESOLVER = [
+  'prim_absolute() { case "$1" in [/]* ) ;; *) return 1 ;; esac; case "$1" in [[:space:]]*|*[[:space:]]|*[/][/]*|*[/].[/]*|*[/]..[/]*|*[/].|*[/]..|?*[/]) return 1 ;; esac; }; ',
+  'prim_config=${PRIM_CONFIG_DIR:-}; if ! prim_absolute "$prim_config"; then prim_config=${XDG_CONFIG_HOME:-}; if prim_absolute "$prim_config"; then ',
+  'case "$prim_config" in /) prim_config=/prim ;; *) prim_config="$prim_config/prim" ;; esac; ',
+  'else prim_home=${HOME:-}; prim_absolute "$prim_home" || exit 78; case "$prim_home" in /) prim_config=/.config/prim ;; *) prim_config="$prim_home/.config/prim" ;; esac; ',
+  "fi; fi; "
+].join("");
 function stableHookCommand(bin, args = "") {
   if (!STABLE_HOOK_BIN_RE.test(bin) || !STABLE_HOOK_ARGUMENTS_RE.test(args)) {
     throw new Error("invalid stable hook command");
@@ -20189,11 +20196,7 @@ function stableHookCommand(bin, args = "") {
     // it as inert data during the rolling window so an older uninstall or
     // reinstall can remove the stable entry without invoking npm or PATH.
     `prim_legacy_reader='-p ${PKG_NAME}@stable prim-shim.sh ${bin} '; `,
-    'prim_absolute() { case "$1" in [/]* ) ;; *) return 1 ;; esac; case "$1" in [[:space:]]*|*[[:space:]]|*[/][/]*|*[/].[/]*|*[/]..[/]*|*[/].|*[/]..|?*[/]) return 1 ;; esac; }; ',
-    'prim_config=${PRIM_CONFIG_DIR:-}; if ! prim_absolute "$prim_config"; then prim_config=${XDG_CONFIG_HOME:-}; if prim_absolute "$prim_config"; then ',
-    'case "$prim_config" in /) prim_config=/prim ;; *) prim_config="$prim_config/prim" ;; esac; ',
-    'else prim_home=${HOME:-}; prim_absolute "$prim_home" || exit 78; case "$prim_home" in /) prim_config=/.config/prim ;; *) prim_config="$prim_home/.config/prim" ;; esac; ',
-    "fi; fi; ",
+    PRIM_CONFIG_SHELL_RESOLVER,
     `case "$prim_config" in /) prim_launcher=/${STABLE_HOOK_LAUNCHER_NAME} ;; *) prim_launcher="$prim_config/${STABLE_HOOK_LAUNCHER_NAME}" ;; esac; `,
     'exec "$prim_launcher" "$@"'
   ].join("");
@@ -20822,6 +20825,53 @@ import {
   writeFileSync as writeFileSync5
 } from "fs";
 import { delimiter, dirname as dirname10, isAbsolute as isAbsolute5, join as join13, resolve as resolve4 } from "path";
+
+// src/lib/git-hook-contract.ts
+var GIT_HOOK_ENTRYPOINT_CONTENT = `#!/bin/sh
+# prim git hook entrypoint v1 \u2014 managed by prim; do not edit.
+# Run by the "# >>> prim <hook> hook >>>" block in a Git hook file. Acts only
+# where prim is active (git config prim.active true) and never fails the hook.
+case "$0" in */*) prim_dir=\${0%/*} ;; *) exit 0 ;; esac
+prim_launcher="$prim_dir/${STABLE_HOOK_LAUNCHER_NAME}"
+[ -x "$prim_launcher" ] || exit 0
+[ "$(git config --get prim.active 2>/dev/null)" = "true" ] || exit 0
+prim_hook=\${1-}
+if [ "$#" -gt 0 ]; then shift; fi
+case "$prim_hook" in
+pre-commit)
+  "$prim_launcher" prim-pre-commit "$@" || :
+  ;;
+post-commit)
+  prim_sha=$(git rev-parse --verify HEAD 2>/dev/null) || exit 0
+  case "$prim_sha" in *[!0-9a-f]* | "") exit 0 ;; esac
+  case "\${#prim_sha}" in 40 | 64) ;; *) exit 0 ;; esac
+  prim_branch=$(git symbolic-ref --quiet --short HEAD 2>/dev/null) || prim_branch=
+  prim_observed=$(mktemp "\${TMPDIR:-/tmp}/prim-post-commit-observed.XXXXXXXX" 2>/dev/null) || prim_observed=
+  (
+    trap '' HUP
+    trap 'if [ -n "$prim_observed" ]; then rm -f "$prim_observed"; fi' 0
+    PRIM_COMMIT_SHA=$prim_sha PRIM_COMMIT_BRANCH=$prim_branch PRIM_COMMIT_OBSERVED_FILE=$prim_observed "$prim_launcher" prim-post-commit
+  ) </dev/null >/dev/null 2>&1 &
+  ;;
+post-rewrite)
+  case "\${1-}" in amend | rebase) prim_source=$1 ;; *) exit 0 ;; esac
+  prim_pairs=$(mktemp "\${TMPDIR:-/tmp}/prim-post-rewrite-pairs.XXXXXXXX" 2>/dev/null) || exit 0
+  if ! chmod 600 "$prim_pairs" 2>/dev/null || ! cat >"$prim_pairs"; then
+    rm -f "$prim_pairs"
+    exit 0
+  fi
+  prim_branch=$(git symbolic-ref --quiet --short HEAD 2>/dev/null) || prim_branch=
+  (
+    trap '' HUP
+    trap 'rm -f "$prim_pairs"' 0
+    PRIM_REWRITE_SOURCE=$prim_source PRIM_REWRITE_BRANCH=$prim_branch PRIM_REWRITE_PAIRS_FILE=$prim_pairs "$prim_launcher" prim-post-rewrite
+  ) </dev/null >/dev/null 2>&1 &
+  ;;
+esac
+exit 0
+`;
+
+// src/lib/hook-runtime.ts
 var RELEASE_PREFIX = "release-";
 var MAX_MANIFEST_BYTES = 64 * 1024;
 var RELEASE_GRACE_MS = 10 * 60 * 1e3;