@primitive.ai/prim 0.1.0-alpha.93 → 0.1.0-alpha.96

package/dist/{chunk-DCJN6LZH.js → chunk-7KABYYWG.js}

@@ -1,62 +1,35 @@
 import {
   unattendedEnv
 } from "./chunk-OYHYCK4K.js";
-import {
-  isValidRepoSyncId,
-  setRepoSyncId,
-  setRepositoryBindingState
-} from "./chunk-DSWT6BCC.js";
 import {
   HttpError,
   getClient
-} from "./chunk-G2VMA2QO.js";
+} from "./chunk-LY6NJ7KL.js";
 import {
+  GIT_HOOK_CONTRACT_VERSION,
   binFile,
+  blockMarkers,
+  canonicalHookBlock,
   compareSemver,
   cursorConfigDirectory,
+  hookBlockContractVersion,
+  inspectGitHookEntrypoint,
+  managedHookBlock,
+  pinnedHookCommand,
   pinnedNpxCommand
-} from "./chunk-X64HTHUF.js";
+} from "./chunk-Y5W4TZM7.js";
 import {
   gitToplevel,
-  githubRepositoryFullName
-} from "./chunk-H4UNYFUC.js";
+  githubRepositoryFullName,
+  isValidRepoSyncId,
+  setRepoSyncId,
+  setRepositoryBindingState
+} from "./chunk-DHOQGHKQ.js";
 import {
   atomicWriteFile,
+  primConfigDirectory,
   withFileLock
-} from "./chunk-2GP5UFV7.js";
-
-// src/lib/bin-cache.ts
-import { chmodSync, mkdirSync } from "fs";
-import { homedir } from "os";
-import { join } from "path";
-var GIT_HOOK_CACHE_SHELL_DIR = "${XDG_CACHE_HOME:-$HOME/.cache}/prim/bin";
-var GIT_HOOK_CACHE_TTL_MINUTES = 1440;
-var GIT_HOOK_CACHED_BINS = ["prim-post-commit", "prim-post-rewrite"];
-function binCacheDir() {
-  const base = process.env.XDG_CACHE_HOME || join(homedir(), ".cache");
-  return join(base, "prim", "bin");
-}
-function writeAtomic(path, content) {
-  atomicWriteFile(path, content, { mode: 384 });
-}
-function warmBinCache() {
-  try {
-    if (process.env.PRIM_BIN_CACHE === "0") {
-      return;
-    }
-    const dir = binCacheDir();
-    mkdirSync(dir, { recursive: true, mode: 448 });
-    chmodSync(dir, 448);
-    writeAtomic(join(dir, "node"), process.execPath);
-    for (const bin of GIT_HOOK_CACHED_BINS) {
-      const file = binFile(bin);
-      if (file) {
-        writeAtomic(join(dir, bin), file);
-      }
-    }
-  } catch {
-  }
-}
+} from "./chunk-DWRSEC34.js";
 
 // src/commands/skill.ts
 import { createHash as createHash2 } from "crypto";
@@ -73,8 +46,8 @@ import {
   rmdirSync as rmdirSync2,
   unlinkSync
 } from "fs";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname2, join as join3, resolve as resolve2 } from "path";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname2, join as join2, resolve as resolve2 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { createPatch } from "diff";
 import { parse as parseYaml2 } from "yaml";
@@ -92,7 +65,7 @@ import {
   existsSync,
   fstatSync,
   lstatSync,
-  mkdirSync as mkdirSync2,
+  mkdirSync,
   openSync,
   readFileSync,
   readSync,
@@ -101,8 +74,8 @@ import {
   rmSync,
   rmdirSync
 } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname, isAbsolute, join as join2, relative, resolve, sep } from "path";
+import { homedir } from "os";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "path";
 import { fileURLToPath } from "url";
 import { parse as parseYaml } from "yaml";
 var __dirname = dirname(fileURLToPath(import.meta.url));
@@ -112,8 +85,8 @@ var MAX_SKILL_BYTES = 1024 * 1024;
 var REFRESH_LOCK_TIMEOUT_MS = 150;
 var REFRESH_LOCK_POLL_MS = 10;
 function pluginDirFor(cwd, scope) {
-  const base = scope === "user" ? join2(homedir2(), ".claude") : join2(gitToplevel(cwd) ?? cwd, ".claude");
-  return join2(base, "skills", "prim");
+  const base = scope === "user" ? join(homedir(), ".claude") : join(gitToplevel(cwd) ?? cwd, ".claude");
+  return join(base, "skills", "prim");
 }
 function resolvePluginDir(cwd, scope) {
   if (scope && scope !== "user" && scope !== "project") {
@@ -145,8 +118,8 @@ function removeDirIfEmpty(dir) {
 }
 function pluginPaths(dir) {
   return {
-    manifestPath: join2(dir, ".claude-plugin", "plugin.json"),
-    skillPath: join2(dir, "SKILL.md")
+    manifestPath: join(dir, ".claude-plugin", "plugin.json"),
+    skillPath: join(dir, "SKILL.md")
   };
 }
 function pathIsInside(root, path) {
@@ -211,9 +184,9 @@ function inspectRecognizedInstallation(paths, projectRoot) {
   };
 }
 function refreshLockDir(physicalPluginDir) {
-  const cacheRoot = process.env.XDG_CACHE_HOME || join2(homedir2(), ".cache");
+  const cacheRoot = process.env.XDG_CACHE_HOME || join(homedir(), ".cache");
   const identity = createHash("sha256").update(physicalPluginDir).digest("hex");
-  return join2(cacheRoot, "prim", "skill-refresh-locks", `${identity}.lock`);
+  return join(cacheRoot, "prim", "skill-refresh-locks", `${identity}.lock`);
 }
 async function refreshClaudePlugins(cwd, options = {}) {
   const result = { installed: 0, refreshed: 0 };
@@ -221,7 +194,7 @@ async function refreshClaudePlugins(cwd, options = {}) {
   if (options.includeProject !== false) {
     const projectRoot = options.projectRoot ?? gitToplevel(cwd);
     if (projectRoot !== null && isAbsolute(projectRoot)) {
-      candidates.push({ dir: join2(projectRoot, ".claude", "skills", "prim"), projectRoot });
+      candidates.push({ dir: join(projectRoot, ".claude", "skills", "prim"), projectRoot });
     }
   }
   candidates.push({ dir: pluginDirFor(cwd, "user") });
@@ -297,7 +270,7 @@ function installClaudePlugin(cwd, opts) {
     console.log(`Would write plugin to ${dir} (.claude-plugin/plugin.json + SKILL.md)`);
     return 0;
   }
-  mkdirSync2(join2(dir, ".claude-plugin"), { recursive: true });
+  mkdirSync(join(dir, ".claude-plugin"), { recursive: true });
   atomicWrite(manifestPath, manifest);
   atomicWrite(skillPath, skill);
   console.log(`Installed prim skill plugin at ${dir}`);
@@ -317,7 +290,7 @@ function uninstallClaudePlugin(cwd, opts) {
   }
   rmSync(manifestPath, { force: true });
   rmSync(skillPath, { force: true });
-  removeDirIfEmpty(join2(dir, ".claude-plugin"));
+  removeDirIfEmpty(join(dir, ".claude-plugin"));
   removeDirIfEmpty(dir);
   console.log(`Removed prim skill plugin from ${dir}`);
   return 0;
@@ -372,10 +345,10 @@ function readCodexGuidance(path) {
   }
 }
 function effectiveCodexGuidance(scope) {
-  const override = readCodexGuidance(join3(scope, "AGENTS.override.md"));
+  const override = readCodexGuidance(join2(scope, "AGENTS.override.md"));
   if (override === null) return null;
   if (override !== void 0 && override.toString("utf8").trim().length > 0) return override;
-  const base = readCodexGuidance(join3(scope, "AGENTS.md"));
+  const base = readCodexGuidance(join2(scope, "AGENTS.md"));
   return base ?? null;
 }
 function hasUsablePrimBlock(content, visibleBytes) {
@@ -398,7 +371,7 @@ function hasUsablePrimBlock(content, visibleBytes) {
 }
 function hasUsableCodexGuidance(projectRoot) {
   try {
-    const codexHome = process.env.CODEX_HOME?.trim() ? resolve2(process.env.CODEX_HOME) : join3(homedir3(), ".codex");
+    const codexHome = process.env.CODEX_HOME?.trim() ? resolve2(process.env.CODEX_HOME) : join2(homedir2(), ".codex");
     const scopes = [
       { path: codexHome, visibleBytes: CODEX_GUIDANCE_LIMIT_BYTES },
       { path: projectRoot, visibleBytes: CODEX_DEFAULT_PROJECT_GUIDANCE_BYTES }
@@ -432,14 +405,14 @@ function sha256(content) {
 }
 function cursorSkillDirectory(cwd, scope) {
   const base = scope === "user" ? cursorConfigDirectory() : gitToplevel(cwd) ?? cwd;
-  return join3(base, scope === "user" ? "skills" : ".cursor/skills", "prim");
+  return join2(base, scope === "user" ? "skills" : ".cursor/skills", "prim");
 }
 function cursorSkillPaths(cwd, scope) {
   const directory = cursorSkillDirectory(cwd, scope);
   return {
     directory,
-    skill: join3(directory, "SKILL.md"),
-    manifest: join3(directory, CURSOR_SKILL_MANIFEST)
+    skill: join2(directory, "SKILL.md"),
+    manifest: join2(directory, CURSOR_SKILL_MANIFEST)
   };
 }
 function readCursorSkillManifest(path) {
@@ -527,10 +500,10 @@ function hasUsableCursorSkill(projectRoot) {
   return cursorSkillStatus(projectRoot, "project").installed || cursorSkillStatus(projectRoot, "user").installed;
 }
 function userTargetFor(agent) {
-  if (agent === "claude") return join3(homedir3(), ".claude", "CLAUDE.md");
-  if (agent === "codex") return join3(homedir3(), ".codex", "AGENTS.md");
+  if (agent === "claude") return join2(homedir2(), ".claude", "CLAUDE.md");
+  if (agent === "codex") return join2(homedir2(), ".codex", "AGENTS.md");
   if (agent === "hermes") {
-    return join3(process.env.HERMES_HOME ?? join3(homedir3(), ".hermes"), ".hermes.md");
+    return join2(process.env.HERMES_HOME ?? join2(homedir2(), ".hermes"), ".hermes.md");
   }
   return null;
 }
@@ -560,8 +533,8 @@ function applyBlock(existing, block, eol) {
     return existing.slice(0, b) + block + existing.slice(e + SKILL_END.length);
   }
   if (existing.length === 0) return `${block}${eol}`;
-  const sep2 = existing.endsWith(eol) ? "" : eol;
-  return `${existing}${sep2}${block}${eol}`;
+  const sep3 = existing.endsWith(eol) ? "" : eol;
+  return `${existing}${sep3}${block}${eol}`;
 }
 function removeBlock(existing) {
   const b = existing.indexOf(SKILL_BEGIN);
@@ -701,60 +674,61 @@ function registerSkillCommands(program) {
   });
 }
 
-// src/lib/post-commit-hook.ts
-import { execFileSync } from "child_process";
-import { createHash as createHash3, randomUUID } from "crypto";
-import {
-  constants as constants3,
-  closeSync as closeSync3,
-  existsSync as existsSync3,
-  fchmodSync,
-  fsyncSync,
-  lstatSync as lstatSync3,
-  mkdirSync as mkdirSync3,
-  openSync as openSync3,
-  readFileSync as readFileSync3,
-  renameSync,
-  unlinkSync as unlinkSync2,
-  writeFileSync
-} from "fs";
-import { basename, dirname as dirname3, isAbsolute as isAbsolute2, resolve as resolve3 } from "path";
-var PRIM_POST_COMMIT_BLOCK_START = "# >>> prim post-commit hook >>>";
-var PRIM_POST_COMMIT_BLOCK_END = "# <<< prim post-commit hook <<<";
-var PRIM_CREATED_MARK = "prim-created-post-commit-hook";
-var PRIM_POST_REWRITE_BLOCK_START = "# >>> prim post-rewrite hook >>>";
-var PRIM_POST_REWRITE_BLOCK_END = "# <<< prim post-rewrite hook <<<";
-var PRIM_POST_REWRITE_CREATED_MARK = "prim-created-post-rewrite-hook";
-var LEGACY_PRIM_CREATED_MARK = "prim-created-hook";
-var LEGACY_PRIM_OWNED_HEADER = "# prim post-commit hook \u2014 installed by: prim hooks install (prim-managed-hook)";
-var LEGACY_GLOBAL_OWNED_HEADER = "# prim global post-commit hook (core.hooksPath) \u2014 managed by prim; do not edit.";
-var MAX_HOOK_BYTES = 1048576;
-var GIT_TIMEOUT_MS = 1e3;
-var SUPPORTED_SHEBANGS = /* @__PURE__ */ new Set([
-  "#!/bin/sh",
-  "#!/usr/bin/env sh",
-  "#!/bin/bash",
-  "#!/usr/bin/env bash",
-  "#!/bin/zsh",
-  "#!/usr/bin/env zsh"
-]);
-var HUSKY_V9_DISPATCHERS = /* @__PURE__ */ new Set([
-  '#!/usr/bin/env sh\n. "${0%/*}/h"',
-  '#!/usr/bin/env sh\n. "$(dirname "$0")/h"'
-]);
-var HUSKY_DIRECT_DISPATCHER = '#!/bin/sh\nexec sh "$(dirname "$0")/../post-commit"\n';
-var HUSKY_V9_RUNTIME_HASHES = /* @__PURE__ */ new Set([
-  "d6aaa6f3f7c11008c525e649161df4a93152f1e55d0887fa1d7b8d622735d380",
-  "b02cb91cab7125a9e906be723a1b85297fc435a8307d429ae845546b4ee0ecde",
-  "9db5d129c4eb822a773157d98cd8fb8f1b156b85e3193117fefe527ca6d45e91",
-  "3b2cb21335e544b4ebce658ca47af4a69d2c77026cc4d3f8b2227c34d062b207",
-  "548990e1c11285694096184993d907b258d41235461a7ca2551e3b53ff9d3a38",
-  "c029a943acea5d6e2ddbaa271a1fb22c2da55d56b5c6fb59ca804ac9a4018708",
-  "ae3413a8fe2b39372de48bdc9691f42055f089c0c7529834b2fb07a131585b6a",
-  "70200b200ca709b0622784f93839a5b2872333a917a09afddefd7dc2d8cdc680"
-]);
-function currentPostCommitBlock() {
-  return `${PRIM_POST_COMMIT_BLOCK_START}
+// src/lib/bin-cache.ts
+import { chmodSync, mkdirSync as mkdirSync2 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join3 } from "path";
+var GIT_HOOK_CACHE_SHELL_DIR = "${XDG_CACHE_HOME:-$HOME/.cache}/prim/bin";
+var GIT_HOOK_CACHE_TTL_MINUTES = 1440;
+var GIT_HOOK_CACHED_BINS = ["prim-post-commit", "prim-post-rewrite"];
+function binCacheDir() {
+  const base = process.env.XDG_CACHE_HOME || join3(homedir3(), ".cache");
+  return join3(base, "prim", "bin");
+}
+function writeAtomic(path, content) {
+  atomicWriteFile(path, content, { mode: 384 });
+}
+function warmBinCache() {
+  try {
+    if (process.env.PRIM_BIN_CACHE === "0") {
+      return;
+    }
+    const dir = binCacheDir();
+    mkdirSync2(dir, { recursive: true, mode: 448 });
+    chmodSync(dir, 448);
+    writeAtomic(join3(dir, "node"), process.execPath);
+    for (const bin of GIT_HOOK_CACHED_BINS) {
+      const file = binFile(bin);
+      if (file) {
+        writeAtomic(join3(dir, bin), file);
+      }
+    }
+  } catch {
+  }
+}
+
+// src/lib/git-hook-legacy.ts
+import { isAbsolute as isAbsolute2 } from "path";
+var PRIM_MANAGED_MARK = "prim-managed-hook";
+var PRE_COMMIT = { hookName: "pre-commit", binName: "prim-pre-commit" };
+var POST_COMMIT = { hookName: "post-commit", binName: "prim-post-commit" };
+var POST_REWRITE = { hookName: "post-rewrite", binName: "prim-post-rewrite" };
+function blockMarkers2(spec) {
+  return {
+    start: `# >>> prim ${spec.hookName} hook >>>`,
+    end: `# <<< prim ${spec.hookName} hook <<<`
+  };
+}
+function hookShim(binName) {
+  return `{ ${pinnedHookCommand(binName)}; } || true`;
+}
+function gatedShim(binName) {
+  return `if [ "$(git config --get prim.active 2>/dev/null)" = "true" ]; then
+${hookShim(binName)}
+fi`;
+}
+function legacyPostCommitBlock() {
+  return `# >>> prim post-commit hook >>>
 if [ "$(git config --get prim.active 2>/dev/null)" = "true" ]; then
   prim_commit_sha=$(git rev-parse --verify HEAD 2>/dev/null) || prim_commit_sha=
   case "$prim_commit_sha" in *[!0-9a-f]*|"") prim_commit_sha= ;; esac
@@ -783,13 +757,10 @@ if [ "$(git config --get prim.active 2>/dev/null)" = "true" ]; then
   fi
   unset prim_commit_sha
 fi
-${PRIM_POST_COMMIT_BLOCK_END}`;
+# <<< prim post-commit hook <<<`;
 }
-function postCommitHookBlock() {
-  return currentPostCommitBlock();
-}
-function postRewriteHookBlock() {
-  return `${PRIM_POST_REWRITE_BLOCK_START}
+function legacyPostRewriteBlock() {
+  return `# >>> prim post-rewrite hook >>>
 if [ "$(git config --get prim.active 2>/dev/null)" = "true" ]; then
   case "$1" in amend|rebase) prim_rewrite_source="$1" ;; *) prim_rewrite_source= ;; esac
   if [ -n "$prim_rewrite_source" ]; then
@@ -828,22 +799,227 @@ if [ "$(git config --get prim.active 2>/dev/null)" = "true" ]; then
   fi
   unset prim_rewrite_source
 fi
-${PRIM_POST_REWRITE_BLOCK_END}`;
-}
-var POST_COMMIT_MANAGED_HOOK = {
-  hookName: "post-commit",
-  blockStart: PRIM_POST_COMMIT_BLOCK_START,
-  blockEnd: PRIM_POST_COMMIT_BLOCK_END,
-  createdMark: PRIM_CREATED_MARK,
-  block: postCommitHookBlock
-};
-var POST_REWRITE_MANAGED_HOOK = {
-  hookName: "post-rewrite",
-  blockStart: PRIM_POST_REWRITE_BLOCK_START,
-  blockEnd: PRIM_POST_REWRITE_BLOCK_END,
-  createdMark: PRIM_POST_REWRITE_CREATED_MARK,
-  block: postRewriteHookBlock
+# <<< prim post-rewrite hook <<<`;
+}
+function legacyGlobalHookScript(spec) {
+  const chainExit = spec.hookName === PRE_COMMIT.hookName ? "|| exit $?" : "|| true";
+  const managedBlock = spec.hookName === POST_COMMIT.hookName ? legacyPostCommitBlock() : spec.hookName === POST_REWRITE.hookName ? legacyPostRewriteBlock() : void 0;
+  const invocation = managedBlock ?? gatedShim(spec.binName);
+  const managedRepoGuard = managedBlock ? ` && ! grep -Fq '${blockMarkers2(spec).start.slice(0, -3)}'">>>" "$repo_hook" 2>/dev/null` : "";
+  const beforeComments = managedBlock ? `${invocation}
+` : "";
+  const afterComments = managedBlock ? "" : `${invocation}
+`;
+  return `#!/bin/sh
+${beforeComments}# prim global ${spec.hookName} hook (core.hooksPath) \u2014 managed by prim; do not edit.
+# Install/uninstall: prim hooks install|uninstall --scope user
+# Runs prim only where activated \u2014 'prim enable' (this repo) or
+# 'git config --global prim.active true' (every repo). Chains to the repo's own
+# hook regardless, so inactive repos are unaffected.
+${afterComments}common_dir=$(git rev-parse --git-common-dir 2>/dev/null) || exit 0
+repo_hook="$common_dir/hooks/${spec.hookName}"
+if [ -x "$repo_hook" ] && ! grep -q '${PRIM_MANAGED_MARK}' "$repo_hook" 2>/dev/null${managedRepoGuard}; then
+  "$repo_hook" "$@" ${chainExit}
+fi
+exit 0
+`;
+}
+var PRE_COMMIT_GATE = 'if [ "$(git config --get prim.active 2>/dev/null)" = "true" ]; then';
+function preCommitLadder(fallback, failSoft) {
+  const soft = failSoft ? " || true" : "";
+  return `if command -v prim-pre-commit >/dev/null 2>&1; then
+  prim-pre-commit${soft}
+elif [ -f "./node_modules/.bin/prim-pre-commit" ]; then
+  ./node_modules/.bin/prim-pre-commit${soft}
+else
+  ${fallback} 2>/dev/null || true
+fi`;
+}
+var LADDER_ALPHA_2 = preCommitLadder("npx --yes @primitive.ai/prim pre-commit-hook", false);
+var LADDER_ALPHA_9 = preCommitLadder("npx --yes -p @primitive.ai/prim prim-pre-commit", false);
+var LADDER_ALPHA_35 = preCommitLadder("npx --yes -p @primitive.ai/prim prim-pre-commit", true);
+var PINNED_NPX_PRE_COMMIT = String.raw`npx --yes(?: --ignore-scripts)? -p @primitive\.ai/prim@[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)? prim-pre-commit`;
+var PINNED_PRE_COMMIT_RE = new RegExp(
+  String.raw`^\{ (?:${PINNED_NPX_PRE_COMMIT}|if \[ -x (?<node>'.*') \] && \[ -f (?<entry>'.*') \]; then \k<node> \k<entry>; else ${PINNED_NPX_PRE_COMMIT}; fi); \} \|\| true$`,
+  "u"
+);
+var SHELL_QUOTED_RE = /^'(?:[^']|'"'"')*'$/u;
+function decodePinnedPath(token) {
+  if (!token || !SHELL_QUOTED_RE.test(token)) return void 0;
+  const value = token.slice(1, -1).replaceAll(`'"'"'`, "'");
+  if (!isAbsolute2(value) || value.includes("\0") || value.includes("\n") || value.includes("\r")) {
+    return void 0;
+  }
+  return value;
+}
+function isPinnedPreCommitInvocation(line) {
+  const match = PINNED_PRE_COMMIT_RE.exec(line);
+  if (!match) return false;
+  if (match.groups?.node === void 0) return true;
+  return Boolean(
+    decodePinnedPath(match.groups.node) && decodePinnedPath(match.groups.entry)?.endsWith("/dist/hooks/pre-commit.js")
+  );
+}
+function isLegacyPreCommitBody(body) {
+  if (body === LADDER_ALPHA_2 || body === LADDER_ALPHA_9 || body === LADDER_ALPHA_35) return true;
+  if (isPinnedPreCommitInvocation(body)) return true;
+  const prefix = `${PRE_COMMIT_GATE}
+`;
+  if (!body.startsWith(prefix) || !body.endsWith("\nfi")) return false;
+  const inner = body.slice(prefix.length, -"\nfi".length);
+  return inner === LADDER_ALPHA_35 || isPinnedPreCommitInvocation(inner);
+}
+function isLegacyOwnedPreCommitScript(content) {
+  const original = (ladder) => `#!/bin/sh
+# prim pre-commit hook \u2014 auto-syncs affected specs on commit
+# Installed by: prim hooks install
+
+# Find the nearest node_modules/.bin with prim, or use npx
+${ladder}
+`;
+  if (content === original(LADDER_ALPHA_2) || content === original(LADDER_ALPHA_9)) return true;
+  if (content === `#!/bin/sh
+# prim pre-commit hook \u2014 installed by: prim hooks install
+
+${LADDER_ALPHA_9}
+`) {
+    return true;
+  }
+  const prefix = `#!/bin/sh
+# prim pre-commit hook \u2014 installed by: prim hooks install (${PRIM_MANAGED_MARK})
+
+`;
+  if (!content.startsWith(prefix) || !content.endsWith("\n")) return false;
+  const body = content.slice(prefix.length, -1);
+  return body === LADDER_ALPHA_35 || isPinnedPreCommitInvocation(body);
+}
+var PINNED_PACKAGE_VERSION_RE = /@primitive\.ai\/prim@[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?/gu;
+function normalizeOwnedGlobalHook(content, hookName) {
+  if (hookName === PRE_COMMIT.hookName) {
+    const lines = content.split("\n");
+    const invocationIndexes = lines.flatMap(
+      (line, index) => line.startsWith("{ ") && line.endsWith("; } || true") ? [index] : []
+    );
+    if (invocationIndexes.length !== 1) return null;
+    const invocationIndex = invocationIndexes[0];
+    if (!isPinnedPreCommitInvocation(lines[invocationIndex])) return null;
+    lines[invocationIndex] = "{ <recognized Prim pre-commit invocation>; } || true";
+    return lines.join("\n");
+  }
+  return content.replace(PINNED_PACKAGE_VERSION_RE, "@primitive.ai/prim@<version>");
+}
+function isLegacyOwnedGlobalHook(content, hookName) {
+  const spec = [PRE_COMMIT, POST_COMMIT, POST_REWRITE].find((s) => s.hookName === hookName);
+  if (!spec) return false;
+  const expected = legacyGlobalHookScript(spec);
+  if (content === expected) return true;
+  if (spec === PRE_COMMIT && content === expected.replace(gatedShim(spec.binName), `${PRE_COMMIT_GATE}
+${LADDER_ALPHA_35}
+fi`)) {
+    return true;
+  }
+  const normalized = normalizeOwnedGlobalHook(content, hookName);
+  return normalized !== null && normalized === normalizeOwnedGlobalHook(expected, hookName);
+}
+function legacyInlineHookBlock(hookName) {
+  return hookName === "post-commit" ? legacyPostCommitBlock() : legacyPostRewriteBlock();
+}
+function isRecognizedLegacyBlock(hookName, block) {
+  if (hookName === "pre-commit") {
+    const { start, end } = blockMarkers2(PRE_COMMIT);
+    const prefix = `${start}
+`;
+    const suffix = `
+${end}`;
+    if (!block.startsWith(prefix) || !block.endsWith(suffix)) return false;
+    return isLegacyPreCommitBody(block.slice(prefix.length, -suffix.length));
+  }
+  const expected = legacyInlineHookBlock(hookName);
+  const normalize = (text) => text.replace(PINNED_PACKAGE_VERSION_RE, "@primitive.ai/prim@<version>");
+  return normalize(block) === normalize(expected);
+}
+
+// src/lib/git-hooks.ts
+import { execFileSync } from "child_process";
+import { createHash as createHash3, randomUUID } from "crypto";
+import {
+  constants as constants3,
+  closeSync as closeSync3,
+  existsSync as existsSync3,
+  fchmodSync,
+  fsyncSync,
+  lstatSync as lstatSync3,
+  mkdirSync as mkdirSync3,
+  openSync as openSync3,
+  readFileSync as readFileSync3,
+  realpathSync as realpathSync2,
+  renameSync,
+  unlinkSync as unlinkSync2,
+  writeFileSync
+} from "fs";
+import { basename, dirname as dirname3, isAbsolute as isAbsolute3, join as join4, relative as relative2, resolve as resolve3, sep as sep2 } from "path";
+var LEGACY_PRIM_CREATED_MARK = "prim-created-hook";
+var LEGACY_PRIM_OWNED_HEADER = "# prim post-commit hook \u2014 installed by: prim hooks install (prim-managed-hook)";
+var LEGACY_GLOBAL_OWNED_HEADER = "# prim global post-commit hook (core.hooksPath) \u2014 managed by prim; do not edit.";
+var MAX_HOOK_BYTES = 1048576;
+var GIT_TIMEOUT_MS = 1e3;
+var SUPPORTED_SHEBANGS = /* @__PURE__ */ new Set([
+  "#!/bin/sh",
+  "#!/usr/bin/env sh",
+  "#!/bin/bash",
+  "#!/usr/bin/env bash",
+  "#!/bin/zsh",
+  "#!/usr/bin/env zsh"
+]);
+var HUSKY_V9_DISPATCHERS = /* @__PURE__ */ new Set([
+  '#!/usr/bin/env sh\n. "${0%/*}/h"',
+  '#!/usr/bin/env sh\n. "$(dirname "$0")/h"'
+]);
+var HUSKY_DIRECT_DISPATCHER = '#!/bin/sh\nexec sh "$(dirname "$0")/../post-commit"\n';
+var HUSKY_V9_RUNTIME_HASHES = /* @__PURE__ */ new Set([
+  "d6aaa6f3f7c11008c525e649161df4a93152f1e55d0887fa1d7b8d622735d380",
+  "b02cb91cab7125a9e906be723a1b85297fc435a8307d429ae845546b4ee0ecde",
+  "9db5d129c4eb822a773157d98cd8fb8f1b156b85e3193117fefe527ca6d45e91",
+  "3b2cb21335e544b4ebce658ca47af4a69d2c77026cc4d3f8b2227c34d062b207",
+  "548990e1c11285694096184993d907b258d41235461a7ca2551e3b53ff9d3a38",
+  "c029a943acea5d6e2ddbaa271a1fb22c2da55d56b5c6fb59ca804ac9a4018708",
+  "ae3413a8fe2b39372de48bdc9691f42055f089c0c7529834b2fb07a131585b6a",
+  "70200b200ca709b0622784f93839a5b2872333a917a09afddefd7dc2d8cdc680"
+]);
+function managedHookSpecFor(hookName) {
+  const { start, end } = blockMarkers(hookName);
+  return {
+    hookName,
+    blockStart: start,
+    blockEnd: end,
+    createdMark: `prim-created-${hookName}-hook`
+  };
+}
+var MANAGED_HOOK_SPECS = {
+  "pre-commit": managedHookSpecFor("pre-commit"),
+  "post-commit": managedHookSpecFor("post-commit"),
+  "post-rewrite": managedHookSpecFor("post-rewrite")
 };
+function managedHookSpec(hookName) {
+  return MANAGED_HOOK_SPECS[hookName];
+}
+function gitHooksMode(options = {}) {
+  try {
+    const value = execFileSync(
+      "git",
+      ["config", ...options.global ? ["--global"] : [], "--get", "prim.gitHooks"],
+      {
+        cwd: options.cwd,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: GIT_TIMEOUT_MS
+      }
+    ).trim();
+    return value === "manual" ? "manual" : "auto";
+  } catch {
+    return "auto";
+  }
+}
 function legacyFloatingInvocation() {
   return `if command -v prim-post-commit >/dev/null 2>&1; then
   prim-post-commit || true
@@ -860,15 +1036,6 @@ fi
 `);
 }
 var PINNED_INVOCATION_RE = /^\{ if \[ -x (?<node>'.*') \] && \[ -f (?<entry>'.*') \]; then \k<node> \k<entry>; else npx --yes -p @primitive\.ai\/prim@(?<version>[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?) prim-post-commit; fi; \} \|\| true$/u;
-var SHELL_QUOTED_RE = /^'(?:[^']|'"'"')*'$/u;
-function decodePinnedPath(token) {
-  if (!token || !SHELL_QUOTED_RE.test(token)) return void 0;
-  const value = token.slice(1, -1).replaceAll(`'"'"'`, "'");
-  if (!isAbsolute2(value) || value.includes("\0") || value.includes("\n") || value.includes("\r")) {
-    return void 0;
-  }
-  return value;
-}
 function isPinnedInvocation(value) {
   const match = PINNED_INVOCATION_RE.exec(value);
   const node = decodePinnedPath(match?.groups?.node);
@@ -901,48 +1068,149 @@ function isKnownLegacyGlobalGate(value) {
 }
 function createdScaffold(spec) {
   return Buffer.from(`#!/bin/sh
-${spec.block()}
+${managedHookBlock(spec.hookName)}
 # ${spec.createdMark}
 `);
 }
+function oldCreatedPrefixes(spec) {
+  return [
+    Buffer.from(`#!/bin/sh
+# ${spec.createdMark}
+
+`),
+    Buffer.from(`#!/bin/sh
+# ${LEGACY_PRIM_CREATED_MARK}
+
+`)
+  ];
+}
+function isOwnedStandalonePreCommit(content) {
+  return content === "#!/bin/sh\nprim-pre-commit\n" || isLegacyOwnedPreCommitScript(content);
+}
+function realpathLoose(path) {
+  const missing = [];
+  let current = resolve3(path);
+  for (; ; ) {
+    try {
+      return join4(realpathSync2.native(current), ...missing);
+    } catch {
+      const parent = dirname3(current);
+      if (parent === current) return resolve3(path);
+      missing.unshift(basename(current));
+      current = parent;
+    }
+  }
+}
+function isWithin(path, directory) {
+  const rel = relative2(directory, path);
+  return rel === "" || !isAbsolute3(rel) && rel !== ".." && !rel.startsWith(`..${sep2}`);
+}
+function primGitHooksDirectory() {
+  try {
+    return join4(primConfigDirectory(), "git-hooks");
+  } catch {
+    return void 0;
+  }
+}
+function otherWorktreeRoots(gitRoot) {
+  try {
+    const self = realpathLoose(gitRoot);
+    return execFileSync("git", ["worktree", "list", "--porcelain"], {
+      cwd: gitRoot,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS
+    }).split("\n").flatMap((line) => line.startsWith("worktree ") ? [realpathLoose(line.slice(9))] : []).filter((root) => root !== self);
+  } catch {
+    return [];
+  }
+}
+function hookLocation(hookPath, dirs) {
+  const path = realpathLoose(hookPath);
+  if (isWithin(path, realpathLoose(dirs.gitDir)) || isWithin(path, realpathLoose(dirs.commonDir))) {
+    return "repository";
+  }
+  const primDir = primGitHooksDirectory();
+  if (primDir !== void 0 && isWithin(path, realpathLoose(primDir))) return "prim";
+  const root = realpathLoose(dirs.gitRoot);
+  if (!isWithin(path, root)) return "external";
+  const nested = otherWorktreeRoots(dirs.gitRoot).filter((other) => isWithin(other, root));
+  return nested.some((other) => isWithin(path, other)) ? "external" : "worktree";
+}
+function hooksPathScope(cwd) {
+  try {
+    const scope = execFileSync("git", ["config", "--show-scope", "--get", "core.hooksPath"], {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS
+    }).split("	")[0];
+    return scope === "local" || scope === "worktree" || scope === "global" || scope === "system" || scope === "command" ? scope : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function externalHookRemedy(hookName, cwd) {
+  const snippet = `place \`prim hooks snippet ${hookName}\` there yourself`;
+  switch (hooksPathScope(cwd)) {
+    case "global":
+      return `your global core.hooksPath runs every repository's hooks: ${snippet}, or have prim add it with \`prim hooks install --scope user --global-hooks-path\` (it changes every repository's hooks: an agent must ask the user first)`;
+    case "system":
+      return `the system core.hooksPath is shared by every user on this machine: ${snippet}, or ask its owner`;
+    case "local":
+    case "worktree":
+      return `this repository's core.hooksPath points outside it: ${snippet}, or point core.hooksPath inside the repository`;
+    default:
+      return snippet;
+  }
+}
 function safeGitPath(root, value) {
   if (value.length === 0 || value !== value.trim() || value.includes("\0") || value.includes("\n") || value.includes("\r")) {
     throw new Error("Git returned an unsafe hooks path");
   }
-  return isAbsolute2(value) ? resolve3(value) : resolve3(root, value);
+  return isAbsolute3(value) ? resolve3(value) : resolve3(root, value);
 }
-function resolveEffectiveManagedHook(spec, cwd = process.cwd()) {
+function resolveEffectiveGitHook(hookName, cwd = process.cwd()) {
   const gitRoot = gitToplevel(cwd);
   if (!gitRoot) throw new Error("not a git repository");
-  const value = execFileSync("git", ["rev-parse", "--git-path", "hooks"], {
-    cwd: gitRoot,
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "ignore"],
-    timeout: GIT_TIMEOUT_MS
-  }).replace(/\r?\n$/u, "");
-  const hooksDir = safeGitPath(gitRoot, value);
+  const lines = execFileSync(
+    "git",
+    ["rev-parse", "--git-path", "hooks", "--absolute-git-dir", "--git-common-dir"],
+    {
+      cwd: gitRoot,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS
+    }
+  ).replace(/\r?\n$/u, "").split(/\r?\n/u);
+  if (lines.length !== 3) throw new Error("Git returned unexpected repository paths");
+  const [hooksValue, gitDirValue, commonDirValue] = lines;
+  const hooksDir = safeGitPath(gitRoot, hooksValue);
+  const dirs = {
+    gitRoot,
+    gitDir: safeGitPath(gitRoot, gitDirValue),
+    commonDir: safeGitPath(gitRoot, commonDirValue)
+  };
   if (basename(hooksDir) === "_" && basename(dirname3(hooksDir)) === ".husky") {
+    const hookPath2 = resolve3(dirname3(hooksDir), hookName);
     return {
       gitRoot,
       hooksDir,
-      hookPath: resolve3(dirname3(hooksDir), spec.hookName),
+      hookPath: hookPath2,
       kind: "husky_v9",
-      dispatcherPath: resolve3(hooksDir, spec.hookName)
+      dispatcherPath: resolve3(hooksDir, hookName),
+      location: hookLocation(hookPath2, dirs)
     };
   }
+  const hookPath = resolve3(hooksDir, hookName);
   return {
     gitRoot,
     hooksDir,
-    hookPath: resolve3(hooksDir, spec.hookName),
-    kind: "direct"
+    hookPath,
+    kind: "direct",
+    location: hookLocation(hookPath, dirs)
   };
 }
-function resolveEffectivePostCommitHook(cwd = process.cwd()) {
-  return resolveEffectiveManagedHook(POST_COMMIT_MANAGED_HOOK, cwd);
-}
-function resolveEffectivePostRewriteHook(cwd = process.cwd()) {
-  return resolveEffectiveManagedHook(POST_REWRITE_MANAGED_HOOK, cwd);
-}
 function assertSafeFile(path, spec) {
   if (!existsSync3(path)) return void 0;
   const stat = lstatSync3(path);
@@ -1024,16 +1292,107 @@ function blockRange(content, spec) {
   }
   const start = starts[0];
   const end = ends[0] + endMarker.length;
-  const current = Buffer.from(spec.block());
-  return content.subarray(start, end).equals(current) ? { kind: "current", start, end } : { kind: "stale", start, end };
+  const text = content.subarray(start, end).toString("utf8");
+  if (canonicalHookBlock(text) === canonicalHookBlock(managedHookBlock(spec.hookName))) {
+    return { kind: "current", start, end };
+  }
+  const version = hookBlockContractVersion(text);
+  if (version !== void 0 && version > GIT_HOOK_CONTRACT_VERSION) {
+    return { kind: "newer", start, end };
+  }
+  return { kind: "stale", start, end };
+}
+var HUSKY_V8_SOURCE_RE = /^\.[ \t]+"\$\(dirname(?:[ \t]+--)?[ \t]+"\$0"\)\/_\/husky\.sh"[ \t]*$/mu;
+function blockInsertionPoint(content, allowShebangless, spec, huskyV8) {
+  const shebangEnd = shellInsertionPoint(content, allowShebangless, spec);
+  if (!huskyV8) return shebangEnd;
+  const rest = content.subarray(shebangEnd).toString("utf8");
+  const match = HUSKY_V8_SOURCE_RE.exec(rest);
+  if (!match) return shebangEnd;
+  const lineEnd = match.index + match[0].length;
+  const afterLine = rest[lineEnd] === "\n" ? lineEnd + 1 : lineEnd;
+  return shebangEnd + Buffer.byteLength(rest.slice(0, afterLine), "utf8");
+}
+var HUSKY_SPEC_MAJOR_RE = /^\s*[~^]?=?\s*v?([0-9]+)(?:\.(?:[0-9]+|[xX*])){0,2}(?:-[0-9A-Za-z.-]+)?\s*$/u;
+function declaredHuskyMajor(dir) {
+  for (let current = resolve3(dir); ; ) {
+    const manifest = join4(current, "package.json");
+    if (existsSync3(manifest)) {
+      try {
+        if (lstatSync3(manifest).size > MAX_HOOK_BYTES) return void 0;
+        const parsed = JSON.parse(readFileSync3(manifest, "utf8"));
+        const range = parsed.devDependencies?.husky ?? parsed.dependencies?.husky;
+        const major = typeof range === "string" ? HUSKY_SPEC_MAJOR_RE.exec(range)?.[1] : void 0;
+        return major === void 0 ? void 0 : Number(major);
+      } catch {
+        return void 0;
+      }
+    }
+    const parent = dirname3(current);
+    if (parent === current || existsSync3(join4(current, ".git"))) return void 0;
+    current = parent;
+  }
+}
+function isHuskyV8Hook(hookPath) {
+  const runtime = join4(dirname3(hookPath), "_", "husky.sh");
+  try {
+    const stat = lstatSync3(runtime);
+    return stat.isFile() && stat.size <= MAX_HOOK_BYTES && readFileSync3(runtime, "utf8").includes("husky_skip_init");
+  } catch (error) {
+    if (errorCode(error) !== "ENOENT") return false;
+  }
+  const major = declaredHuskyMajor(dirname3(dirname3(hookPath)));
+  return major !== void 0 && major <= 8;
+}
+var TERMINAL_LINE_RE = /^(?:exit|return)(?:\s|;|$)/u;
+var REDIRECT_OPERATOR_RE = /^[0-9]*(?:<<?|>>?|<&|>&|<>|>\|)$/u;
+var REDIRECT_WORD_RE = /^[0-9]*(?:<|>)/u;
+function isReplacingExec(line) {
+  if (!/^exec(?:\s|$)/u.test(line)) return false;
+  const words = line.slice(4).trim().split(/\s+/u).filter(Boolean);
+  for (let index = 0; index < words.length; index += 1) {
+    const word = words[index];
+    if (word.startsWith("#")) break;
+    if (REDIRECT_OPERATOR_RE.test(word)) {
+      index += 1;
+      continue;
+    }
+    if (!REDIRECT_WORD_RE.test(word)) return true;
+  }
+  return false;
+}
+function terminatesBefore(content, from, offset) {
+  const lines = content.subarray(from, offset).toString("utf8").split("\n");
+  return lines.some((line) => TERMINAL_LINE_RE.test(line) || isReplacingExec(line));
+}
+function mayTerminateBefore(content, from, offset) {
+  return content.subarray(from, offset).toString("utf8").split(/\n|;|&&|\|\||\||[{()]|\b(?:then|do|else)\b/u).some((part) => {
+    const command = part.trim();
+    return TERMINAL_LINE_RE.test(command) || isReplacingExec(command);
+  });
+}
+function withoutRange(content, start, end) {
+  const suffix = content.subarray(end);
+  return Buffer.concat([
+    content.subarray(0, start),
+    suffix.at(0) === 10 ? suffix.subarray(1) : suffix
+  ]);
+}
+function insertBlock(content, at, spec) {
+  return Buffer.concat([
+    content.subarray(0, at),
+    Buffer.from(managedHookBlock(spec.hookName)),
+    Buffer.from("\n"),
+    content.subarray(at)
+  ]);
 }
-function mergedContent(existing, allowShebangless, spec) {
-  const block = Buffer.from(spec.block());
-  if (!existing) {
+function migratedLegacyContent(existing, allowShebangless, spec, huskyV8) {
+  const text = existing.toString("utf8");
+  if (spec.hookName === "pre-commit" && isOwnedStandalonePreCommit(text)) {
     return createdScaffold(spec);
   }
-  const range = blockRange(existing, spec);
-  if (spec.hookName === POST_COMMIT_MANAGED_HOOK.hookName && range.kind === "absent" && existing.toString("utf8").startsWith(`#!/bin/sh
+  if (spec.hookName !== "post-commit") return void 0;
+  if (text.startsWith(`#!/bin/sh
 ${LEGACY_GLOBAL_OWNED_HEADER}
 `)) {
     const gateAt = existing.indexOf(Buffer.from('if [ "$(git config --get prim.active'));
@@ -1048,15 +1407,13 @@ ${LEGACY_GLOBAL_OWNED_HEADER}
       existing.subarray(0, gateAt),
       existing.subarray(chainAt)
     ]);
-    const shebangEnd2 = shellInsertionPoint(withoutLegacyGate, allowShebangless, spec);
-    return Buffer.concat([
-      withoutLegacyGate.subarray(0, shebangEnd2),
-      block,
-      Buffer.from("\n"),
-      withoutLegacyGate.subarray(shebangEnd2)
-    ]);
+    return insertBlock(
+      withoutLegacyGate,
+      blockInsertionPoint(withoutLegacyGate, allowShebangless, spec, huskyV8),
+      spec
+    );
   }
-  if (spec.hookName === POST_COMMIT_MANAGED_HOOK.hookName && range.kind === "absent" && existing.toString("utf8").startsWith(`#!/bin/sh
+  if (text.startsWith(`#!/bin/sh
 ${LEGACY_PRIM_OWNED_HEADER}
 `)) {
     const prefixLength = legacyProjectPrefixLength(existing);
@@ -1065,42 +1422,59 @@ ${LEGACY_PRIM_OWNED_HEADER}
     }
     return Buffer.concat([createdScaffold(spec), existing.subarray(prefixLength)]);
   }
-  if (range.kind !== "absent") {
-    const oldCreatedPrefixes = [
-      Buffer.from(`#!/bin/sh
-# ${spec.createdMark}
-
-`),
-      ...spec.hookName === POST_COMMIT_MANAGED_HOOK.hookName ? [Buffer.from(`#!/bin/sh
-# ${LEGACY_PRIM_CREATED_MARK}
-
-`)] : []
-    ];
-    const oldCreated = oldCreatedPrefixes.some(
+  return void 0;
+}
+function mergedContent(existing, allowShebangless, spec, relocate, huskyV8) {
+  if (!existing) return { content: createdScaffold(spec), migrates: false };
+  const range = blockRange(existing, spec);
+  if (range.kind === "absent") {
+    const migrated = migratedLegacyContent(existing, allowShebangless, spec, huskyV8);
+    if (migrated) return { content: migrated, migrates: true };
+  } else if (range.kind !== "newer") {
+    const oldCreated = oldCreatedPrefixes(spec).some(
       (prefix) => range.start === prefix.length && existing.subarray(0, prefix.length).equals(prefix)
     );
     if (oldCreated) {
       const suffix = existing.subarray(range.end);
       const tail = suffix.at(0) === 10 ? suffix.subarray(1) : suffix;
-      return Buffer.concat([createdScaffold(spec), tail]);
+      return {
+        content: Buffer.concat([createdScaffold(spec), tail]),
+        migrates: range.kind === "stale"
+      };
     }
   }
   const shebangEnd = shellInsertionPoint(existing, allowShebangless, spec);
-  if (range.kind === "current" && range.start === shebangEnd) return existing;
-  let withoutBlock = existing;
-  if (range.kind !== "absent") {
-    const suffix = existing.subarray(range.end);
-    withoutBlock = Buffer.concat([
-      existing.subarray(0, range.start),
-      range.start === shebangEnd && suffix.at(0) === 10 ? suffix.subarray(1) : suffix
-    ]);
+  const insertion = blockInsertionPoint(existing, allowShebangless, spec, huskyV8);
+  switch (range.kind) {
+    case "newer":
+      return { content: existing, migrates: false };
+    case "absent":
+      return { content: insertBlock(existing, insertion, spec), migrates: false };
+    case "current":
+    case "stale": {
+      const misplaced = terminatesBefore(existing, shebangEnd, range.start) || range.start < insertion;
+      if (relocate && misplaced) {
+        const without = withoutRange(existing, range.start, range.end);
+        return {
+          content: insertBlock(
+            without,
+            blockInsertionPoint(without, allowShebangless, spec, huskyV8),
+            spec
+          ),
+          migrates: range.kind === "stale"
+        };
+      }
+      if (range.kind === "current") return { content: existing, migrates: false };
+      return {
+        content: Buffer.concat([
+          existing.subarray(0, range.start),
+          Buffer.from(managedHookBlock(spec.hookName)),
+          existing.subarray(range.end)
+        ]),
+        migrates: true
+      };
+    }
   }
-  return Buffer.concat([
-    withoutBlock.subarray(0, shebangEnd),
-    block,
-    Buffer.from("\n"),
-    withoutBlock.subarray(shebangEnd)
-  ]);
 }
 function errorCode(error) {
   return typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
@@ -1160,137 +1534,143 @@ function unlinkHookUnchanged(path, expected, stat, spec) {
   assertTargetUnchanged(path, expected, spec, stat);
   unlinkSync2(path);
 }
-function ensureEffectivePostCommitHook(cwd = process.cwd()) {
-  const target = resolveEffectivePostCommitHook(cwd);
-  return ensureTarget(target, POST_COMMIT_MANAGED_HOOK);
-}
-function ensureEffectivePostRewriteHook(cwd = process.cwd()) {
-  const target = resolveEffectivePostRewriteHook(cwd);
-  return ensureTarget(target, POST_REWRITE_MANAGED_HOOK);
+function workingLegacyBlock(content, target, spec) {
+  try {
+    const range = blockRange(content, spec);
+    if (range.kind !== "stale") return false;
+    const block = content.subarray(range.start, range.end).toString("utf8");
+    const from = shellInsertionPoint(content, target.kind === "husky_v9", spec);
+    return isRecognizedLegacyBlock(spec.hookName, block) && !mayTerminateBefore(content, from, range.start);
+  } catch {
+    return false;
+  }
 }
-function ensureTarget(target, spec, initialContent) {
+var AMBIENT_LOCATIONS = ["repository", "prim"];
+var EXPLICIT_LOCATIONS = ["repository", "prim", "worktree"];
+function ensureTarget(target, spec, policy) {
+  const result = { hookName: spec.hookName, path: target.hookPath, kind: target.kind };
+  const skip = (outcome) => ({
+    ...result,
+    changed: false,
+    outcome
+  });
   assertUsableHuskyDispatcher(target, spec);
   const stat = assertSafeFile(target.hookPath, spec);
   if (stat && target.kind === "direct" && (stat.mode & 64) === 0) {
     throw new Error(`existing ${spec.hookName} hook is not executable: ${target.hookPath}`);
   }
   const existing = stat ? readHookFile(target.hookPath) : void 0;
-  const next = !existing && initialContent !== void 0 ? Buffer.from(initialContent) : mergedContent(existing, target.kind === "husky_v9", spec);
-  if (!existing && initialContent !== void 0) {
-    const shebangEnd = shellInsertionPoint(next, target.kind === "husky_v9", spec);
-    const range = blockRange(next, spec);
-    if (range.kind !== "current" || range.start !== shebangEnd) {
-      throw new Error(`invalid initial Prim ${spec.hookName} scaffold`);
-    }
-  }
-  const contentChanged = !existing || !next.equals(existing);
-  if (contentChanged) {
-    rewriteHookAtomically(target.hookPath, next, existing, spec, stat);
+  if (policy.repairOnly && (!existing || blockRange(existing, spec).kind === "absent")) {
+    return skip("skipped");
+  }
+  const huskyV8 = isHuskyV8Hook(target.hookPath);
+  const next = mergedContent(existing, target.kind === "husky_v9", spec, policy.relocate, huskyV8);
+  if (existing && next.content.equals(existing)) return skip("unchanged");
+  if (!policy.writable(target.location)) {
+    if (target.location === "worktree") return skip("deferred");
+    return skip(existing && workingLegacyBlock(existing, target, spec) ? "kept" : "external");
+  }
+  if (next.migrates && inspectGitHookEntrypoint() !== "ready") return skip("runtime_missing");
+  rewriteHookAtomically(target.hookPath, next.content, existing, spec, stat);
+  return { ...result, changed: true, outcome: existing ? "updated" : "created" };
+}
+function ensureEffectiveGitHook(hookName, cwd = process.cwd(), options = {}) {
+  const target = resolveEffectiveGitHook(hookName, cwd);
+  if (gitHooksMode({ cwd: target.gitRoot }) === "manual") {
+    return {
+      hookName,
+      path: target.hookPath,
+      kind: target.kind,
+      changed: false,
+      outcome: "manual"
+    };
   }
-  return { path: target.hookPath, changed: contentChanged || !stat, kind: target.kind };
-}
-function ensurePostCommitHookAtPath(hookPath, initialContent) {
-  const absolute = resolve3(hookPath);
-  const result = ensureTarget(
-    {
-      gitRoot: dirname3(dirname3(absolute)),
-      hooksDir: dirname3(absolute),
-      hookPath: absolute,
-      kind: "direct"
-    },
-    POST_COMMIT_MANAGED_HOOK,
-    initialContent
-  );
-  return { ...result, kind: "direct" };
+  const explicit = (options.context ?? "explicit") === "explicit";
+  const allowed = explicit ? EXPLICIT_LOCATIONS : AMBIENT_LOCATIONS;
+  return ensureTarget(target, managedHookSpec(hookName), {
+    writable: (location) => allowed.includes(location),
+    relocate: explicit,
+    repairOnly: options.repairOnly === true
+  });
 }
-function ensurePostRewriteHookAtPath(hookPath, initialContent) {
+function explicitTarget(hookPath, options) {
   const absolute = resolve3(hookPath);
-  const result = ensureTarget(
-    {
-      gitRoot: dirname3(dirname3(absolute)),
-      hooksDir: dirname3(absolute),
-      hookPath: absolute,
-      kind: "direct"
-    },
-    POST_REWRITE_MANAGED_HOOK,
-    initialContent
-  );
-  return { ...result, kind: "direct" };
+  return {
+    gitRoot: dirname3(dirname3(absolute)),
+    hooksDir: dirname3(absolute),
+    hookPath: absolute,
+    // A `.husky/<hook>` file is run by Husky's dispatcher via `sh`, so it needs
+    // neither a shebang nor the executable bit.
+    kind: options.husky ? "husky_v9" : "direct",
+    // The caller chose this exact file (a --target, or a consented global dir).
+    location: "external"
+  };
 }
-function inspectEffectivePostCommitHook(cwd = process.cwd()) {
-  return inspectEffectiveManagedHook(POST_COMMIT_MANAGED_HOOK, cwd);
+function hasCurrentHookBlock(hookName, hookPath) {
+  try {
+    const kind = blockRange(readHookFile(hookPath), managedHookSpec(hookName)).kind;
+    return kind === "current" || kind === "newer";
+  } catch {
+    return false;
+  }
 }
-function inspectEffectivePostRewriteHook(cwd = process.cwd()) {
-  return inspectEffectiveManagedHook(POST_REWRITE_MANAGED_HOOK, cwd);
+function ensureGitHookAtPath(hookName, hookPath, options = {}) {
+  return ensureTarget(explicitTarget(hookPath, options), managedHookSpec(hookName), {
+    writable: () => true,
+    relocate: true,
+    repairOnly: false
+  });
 }
-function inspectEffectiveManagedHook(spec, cwd) {
-  const target = resolveEffectiveManagedHook(spec, cwd);
+function inspectEffectiveGitHook(hookName, cwd = process.cwd()) {
+  const spec = managedHookSpec(hookName);
+  const target = resolveEffectiveGitHook(hookName, cwd);
+  const base = {
+    ...target,
+    hookName,
+    mode: gitHooksMode({ cwd: target.gitRoot }),
+    entrypoint: inspectGitHookEntrypoint()
+  };
+  const uncovered = (reason2, executable2 = false) => ({ ...base, covered: false, executable: executable2, current: false, reason: reason2 });
   try {
     assertUsableHuskyDispatcher(target, spec);
   } catch (error) {
     const missing = error instanceof Error && (error.message.includes("missing or not executable") || error.message.includes("unsafe"));
-    return {
-      ...target,
-      covered: false,
-      executable: false,
-      current: false,
-      reason: missing ? "husky_dispatcher_missing" : "husky_dispatcher_invalid"
-    };
+    return uncovered(missing ? "husky_dispatcher_missing" : "husky_dispatcher_invalid");
   }
   let stat;
   try {
     stat = assertSafeFile(target.hookPath, spec);
   } catch {
-    return {
-      ...target,
-      covered: false,
-      executable: false,
-      current: false,
-      reason: "unsafe_target"
-    };
-  }
-  if (!stat) {
-    return {
-      ...target,
-      covered: false,
-      executable: false,
-      current: false,
-      reason: "missing"
-    };
+    return uncovered("unsafe_target");
   }
+  if (!stat) return uncovered("missing");
   const executable = target.kind === "husky_v9" || (stat.mode & 64) !== 0;
+  let range;
+  let content;
+  let insertion;
   try {
-    const content = readHookFile(target.hookPath);
-    const shebangEnd = shellInsertionPoint(content, target.kind === "husky_v9", spec);
-    const range = blockRange(content, spec);
-    const positioned = range.kind !== "absent" && range.start === shebangEnd;
-    const current = range.kind === "current" && positioned;
-    return {
-      ...target,
-      covered: current && executable,
-      executable,
-      current,
-      reason: range.kind === "current" && !positioned ? "unreachable_block" : !current ? "stale_block" : executable ? void 0 : "not_executable"
-    };
+    content = readHookFile(target.hookPath);
+    insertion = shellInsertionPoint(content, target.kind === "husky_v9", spec);
+    range = blockRange(content, spec);
   } catch (error) {
     const message = error instanceof Error ? error.message : "";
-    const reason = message.includes("binary") ? "binary" : message.includes("unsupported") ? "unsupported_interpreter" : "malformed_markers";
-    return {
-      ...target,
-      covered: false,
-      executable,
-      current: false,
-      reason
-    };
+    return uncovered(
+      message.includes("binary") ? "binary" : message.includes("unsupported") ? "unsupported_interpreter" : "malformed_markers",
+      executable
+    );
   }
-}
-function uninstallEffectivePostCommitHook(cwd = process.cwd()) {
-  const target = resolveEffectivePostCommitHook(cwd);
-  return uninstallTarget(target, POST_COMMIT_MANAGED_HOOK);
-}
-function uninstallEffectivePostRewriteHook(cwd = process.cwd()) {
-  const target = resolveEffectivePostRewriteHook(cwd);
-  return uninstallTarget(target, POST_REWRITE_MANAGED_HOOK);
+  const huskyV8 = isHuskyV8Hook(target.hookPath);
+  const preferred = blockInsertionPoint(content, target.kind === "husky_v9", spec, huskyV8);
+  const current = range.kind === "current" || range.kind === "newer";
+  const legacy = range.kind === "stale" && workingLegacyBlock(content, target, spec);
+  const reason = range.kind === "absent" ? "missing_block" : range.kind === "stale" && !legacy ? "stale_block" : terminatesBefore(content, insertion, range.start) ? "unreachable_block" : !executable ? "not_executable" : legacy ? "legacy_block" : base.entrypoint !== "ready" ? "entrypoint_missing" : range.start < preferred ? "misplaced_block" : void 0;
+  return {
+    ...base,
+    covered: reason === void 0,
+    executable,
+    current,
+    ...reason ? { reason } : {}
+  };
 }
 function projectHooksPathIsConfigured(gitRoot) {
   for (const scope of ["--worktree", "--local"]) {
@@ -1307,45 +1687,53 @@ function projectHooksPathIsConfigured(gitRoot) {
   }
   return false;
 }
-function uninstallProjectPostCommitHook(cwd = process.cwd()) {
-  const gitRoot = gitToplevel(cwd);
-  if (!gitRoot) throw new Error("not a git repository");
-  if (projectHooksPathIsConfigured(gitRoot)) {
-    return uninstallEffectivePostCommitHook(gitRoot);
+function uninstallProjectGitHook(hookName, cwd = process.cwd()) {
+  const target = projectGitHookTarget(hookName, cwd);
+  if (target.location === "external") {
+    return { path: target.hookPath, changed: false, removedFile: false, skipped: "external" };
   }
-  const commonDir = execFileSync("git", ["rev-parse", "--git-common-dir"], {
-    cwd: gitRoot,
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "ignore"],
-    timeout: GIT_TIMEOUT_MS
-  }).replace(/\r?\n$/u, "");
-  return uninstallPostCommitHookAtPath(
-    resolve3(safeGitPath(gitRoot, commonDir), "hooks", "post-commit")
-  );
+  return uninstallTarget(target, managedHookSpec(hookName));
 }
-function uninstallProjectPostRewriteHook(cwd = process.cwd()) {
+function projectGitHookTarget(hookName, cwd = process.cwd()) {
   const gitRoot = gitToplevel(cwd);
   if (!gitRoot) throw new Error("not a git repository");
-  if (projectHooksPathIsConfigured(gitRoot)) {
-    return uninstallEffectivePostRewriteHook(gitRoot);
-  }
+  if (projectHooksPathIsConfigured(gitRoot)) return resolveEffectiveGitHook(hookName, gitRoot);
+  return {
+    ...explicitTarget(resolve3(projectHooksDir(gitRoot), hookName), {}),
+    gitRoot,
+    location: "repository"
+  };
+}
+function projectHooksDir(gitRoot) {
   const commonDir = execFileSync("git", ["rev-parse", "--git-common-dir"], {
     cwd: gitRoot,
     encoding: "utf8",
     stdio: ["ignore", "pipe", "ignore"],
     timeout: GIT_TIMEOUT_MS
   }).replace(/\r?\n$/u, "");
-  return uninstallPostRewriteHookAtPath(
-    resolve3(safeGitPath(gitRoot, commonDir), "hooks", POST_REWRITE_MANAGED_HOOK.hookName)
-  );
+  return resolve3(safeGitPath(gitRoot, commonDir), "hooks");
+}
+function uninstallGitHookAtPath(hookName, hookPath, options = {}) {
+  return uninstallTarget(explicitTarget(hookPath, options), managedHookSpec(hookName));
 }
 function uninstallTarget(target, spec) {
+  const unchanged = { path: target.hookPath, changed: false, removedFile: false };
   const stat = assertSafeFile(target.hookPath, spec);
-  if (!stat) return { path: target.hookPath, changed: false, removedFile: false };
+  if (!stat) return unchanged;
   const existing = readHookFile(target.hookPath);
+  const remove = () => {
+    unlinkHookUnchanged(target.hookPath, existing, stat, spec);
+    return { path: target.hookPath, changed: true, removedFile: true };
+  };
+  const rewrite = (next) => {
+    rewriteHookAtomically(target.hookPath, next, existing, spec, stat);
+    return { path: target.hookPath, changed: true, removedFile: false };
+  };
   const range = blockRange(existing, spec);
   if (range.kind === "absent") {
-    if (spec.hookName === POST_COMMIT_MANAGED_HOOK.hookName && existing.toString("utf8").startsWith(`#!/bin/sh
+    const text = existing.toString("utf8");
+    if (spec.hookName === "pre-commit" && isOwnedStandalonePreCommit(text)) return remove();
+    if (spec.hookName === "post-commit" && text.startsWith(`#!/bin/sh
 ${LEGACY_PRIM_OWNED_HEADER}
 `)) {
       const prefixLength = legacyProjectPrefixLength(existing);
@@ -1353,20 +1741,9 @@ ${LEGACY_PRIM_OWNED_HEADER}
         throw new Error("unrecognized legacy Prim post-commit invocation");
       }
       const tail = existing.subarray(prefixLength);
-      if (tail.length === 0) {
-        unlinkHookUnchanged(target.hookPath, existing, stat, spec);
-        return { path: target.hookPath, changed: true, removedFile: true };
-      }
-      rewriteHookAtomically(
-        target.hookPath,
-        Buffer.concat([Buffer.from("#!/bin/sh\n"), tail]),
-        existing,
-        spec,
-        stat
-      );
-      return { path: target.hookPath, changed: true, removedFile: false };
+      return tail.length === 0 ? remove() : rewrite(Buffer.concat([Buffer.from("#!/bin/sh\n"), tail]));
     }
-    return { path: target.hookPath, changed: false, removedFile: false };
+    return unchanged;
   }
   const shebangEnd = shellInsertionPoint(existing, target.kind === "husky_v9", spec);
   const suffix = existing.subarray(range.end);
@@ -1375,77 +1752,16 @@ ${LEGACY_PRIM_OWNED_HEADER}
 `);
   if (range.start === shebangEnd && suffix.subarray(0, createdSuffix.length).equals(createdSuffix)) {
     const tail = suffix.subarray(createdSuffix.length);
-    if (tail.length === 0) {
-      unlinkHookUnchanged(target.hookPath, existing, stat, spec);
-      return { path: target.hookPath, changed: true, removedFile: true };
-    }
-    rewriteHookAtomically(
-      target.hookPath,
-      Buffer.concat([existing.subarray(0, shebangEnd), tail]),
-      existing,
-      spec,
-      stat
-    );
-    return { path: target.hookPath, changed: true, removedFile: false };
+    return tail.length === 0 ? remove() : rewrite(Buffer.concat([existing.subarray(0, shebangEnd), tail]));
   }
-  const createdPrefixes = [
-    Buffer.from(`#!/bin/sh
-# ${spec.createdMark}
-
-`),
-    ...spec.hookName === POST_COMMIT_MANAGED_HOOK.hookName ? [Buffer.from(`#!/bin/sh
-# ${LEGACY_PRIM_CREATED_MARK}
-
-`)] : []
-  ];
-  const createdPrefix = createdPrefixes.find(
+  const createdPrefix = oldCreatedPrefixes(spec).find(
     (prefix) => range.start === prefix.length && existing.subarray(0, prefix.length).equals(prefix)
   );
   if (createdPrefix) {
     const tail = suffix.at(0) === 10 ? suffix.subarray(1) : suffix;
-    if (tail.length === 0) {
-      unlinkHookUnchanged(target.hookPath, existing, stat, spec);
-      return { path: target.hookPath, changed: true, removedFile: true };
-    }
-    rewriteHookAtomically(
-      target.hookPath,
-      Buffer.concat([Buffer.from("#!/bin/sh\n"), tail]),
-      existing,
-      spec,
-      stat
-    );
-    return { path: target.hookPath, changed: true, removedFile: false };
+    return tail.length === 0 ? remove() : rewrite(Buffer.concat([Buffer.from("#!/bin/sh\n"), tail]));
   }
-  const next = Buffer.concat([
-    existing.subarray(0, range.start),
-    range.start === shebangEnd && suffix.at(0) === 10 ? suffix.subarray(1) : suffix
-  ]);
-  rewriteHookAtomically(target.hookPath, next, existing, spec, stat);
-  return { path: target.hookPath, changed: true, removedFile: false };
-}
-function uninstallPostCommitHookAtPath(hookPath) {
-  const absolute = resolve3(hookPath);
-  return uninstallTarget(
-    {
-      gitRoot: dirname3(dirname3(absolute)),
-      hooksDir: dirname3(absolute),
-      hookPath: absolute,
-      kind: "direct"
-    },
-    POST_COMMIT_MANAGED_HOOK
-  );
-}
-function uninstallPostRewriteHookAtPath(hookPath) {
-  const absolute = resolve3(hookPath);
-  return uninstallTarget(
-    {
-      gitRoot: dirname3(dirname3(absolute)),
-      hooksDir: dirname3(absolute),
-      hookPath: absolute,
-      kind: "direct"
-    },
-    POST_REWRITE_MANAGED_HOOK
-  );
+  return rewrite(withoutRange(existing, range.start, range.end));
 }
 
 // src/lib/repository-binding.ts
@@ -1537,18 +1853,19 @@ function kickDaemonEnsure(options = {}) {
 
 export {
   warmBinCache,
-  postCommitHookBlock,
-  postRewriteHookBlock,
-  ensureEffectivePostCommitHook,
-  ensureEffectivePostRewriteHook,
-  ensurePostCommitHookAtPath,
-  ensurePostRewriteHookAtPath,
-  inspectEffectivePostCommitHook,
-  inspectEffectivePostRewriteHook,
-  uninstallProjectPostCommitHook,
-  uninstallProjectPostRewriteHook,
-  uninstallPostCommitHookAtPath,
-  uninstallPostRewriteHookAtPath,
+  isLegacyOwnedGlobalHook,
+  gitHooksMode,
+  isOwnedStandalonePreCommit,
+  externalHookRemedy,
+  resolveEffectiveGitHook,
+  ensureEffectiveGitHook,
+  hasCurrentHookBlock,
+  ensureGitHookAtPath,
+  inspectEffectiveGitHook,
+  uninstallProjectGitHook,
+  projectGitHookTarget,
+  projectHooksDir,
+  uninstallGitHookAtPath,
   resolveRepositoryBinding,
   bindRepositoryWithClient,
   bindRepository,