@primitive.ai/prim 0.1.0-alpha.94 → 0.1.0-alpha.96

package/README.md

@@ -148,9 +148,12 @@ graph, and presence is reported. Each hook
 self-resolves the CLI at run time (PATH, then a local install, then
 `npx --yes @latest`), so it keeps working with no global install.
 
-Installs into the current project by default — the repo's `.claude/settings.json`,
-`.cursor/hooks.json`, or `.codex/hooks.json`, resolved from the git root (so any subdirectory works);
-pass `--scope user` to install machine-wide. Hermes is the exception: it reads
+Installs into the current project by default — the repo's `.claude/settings.json`
+or `.cursor/hooks.json`, resolved from the git root (so any subdirectory works);
+pass `--scope user` to install machine-wide. Codex defaults to user scope
+(`~/.codex/hooks.json`): Codex reads a project `.codex/hooks.json` only from the
+checkout it lives in and trusts it by absolute path, so a project install covers
+that checkout only, not the repo's other worktrees. Hermes is the exception: it reads
 shell hooks only from the global `~/.hermes/config.yaml`, so `prim hermes install`
 is always user-scoped — and prim merges in place, leaving the rest of that file
 (providers, models, your own hooks) untouched.
@@ -160,7 +163,7 @@ prim claude install                # Install Claude Code hooks (project scope; u
 prim claude install --scope user   # Install machine-wide instead
 prim cursor install                # Install native Cursor hooks (project scope)
 prim cursor install --scope user   # Install hooks, skill, and CLI footer machine-wide
-prim codex install                 # Install OpenAI Codex hooks (project scope)
+prim codex install                 # Install OpenAI Codex hooks (user scope; --scope project for this checkout only)
 prim hermes install                # Install Hermes Agent hooks (global ~/.hermes/config.yaml)
 ```
 

package/dist/{chunk-UKUAAAXE.js → chunk-27ADT6FQ.js}

@@ -2,10 +2,10 @@ import {
   getClient,
   getSiteUrl,
   terminalSafeLine
-} from "./chunk-G2VMA2QO.js";
+} from "./chunk-LY6NJ7KL.js";
 import {
   daemonRequest
-} from "./chunk-OTHKG76J.js";
+} from "./chunk-35FMRWJH.js";
 
 // src/daemon/proxy.ts
 var DAEMON_HTTP_TIMEOUT_MS = 1e4;

package/dist/{chunk-OTHKG76J.js → chunk-35FMRWJH.js}

@@ -2,7 +2,7 @@ import {
   decodeJwtPayload,
   primConfigDirectory,
   resolveAuthCredential
-} from "./chunk-2GP5UFV7.js";
+} from "./chunk-DWRSEC34.js";
 
 // src/daemon/client.ts
 import { createConnection } from "net";

package/dist/{chunk-DXJQR4QI.js → chunk-4GHANPWQ.js}

@@ -1,13 +1,13 @@
 import {
   getSiteUrl
-} from "./chunk-G2VMA2QO.js";
+} from "./chunk-LY6NJ7KL.js";
 import {
   atomicWriteFile,
   ensureDurableDirectory,
   jwtOrganizationId,
   primConfigDirectory,
   resolveAuthCredential
-} from "./chunk-2GP5UFV7.js";
+} from "./chunk-DWRSEC34.js";
 
 // src/journal.ts
 import {

package/dist/{chunk-WUXFLE7X.js → chunk-7KABYYWG.js}

@@ -1,15 +1,10 @@
 import {
   unattendedEnv
 } from "./chunk-OYHYCK4K.js";
-import {
-  isValidRepoSyncId,
-  setRepoSyncId,
-  setRepositoryBindingState
-} from "./chunk-DSWT6BCC.js";
 import {
   HttpError,
   getClient
-} from "./chunk-G2VMA2QO.js";
+} from "./chunk-LY6NJ7KL.js";
 import {
   GIT_HOOK_CONTRACT_VERSION,
   binFile,
@@ -22,49 +17,19 @@ import {
   managedHookBlock,
   pinnedHookCommand,
   pinnedNpxCommand
-} from "./chunk-AXQQMX2U.js";
+} from "./chunk-Y5W4TZM7.js";
 import {
   gitToplevel,
-  githubRepositoryFullName
-} from "./chunk-H4UNYFUC.js";
+  githubRepositoryFullName,
+  isValidRepoSyncId,
+  setRepoSyncId,
+  setRepositoryBindingState
+} from "./chunk-DHOQGHKQ.js";
 import {
   atomicWriteFile,
   primConfigDirectory,
   withFileLock
-} from "./chunk-2GP5UFV7.js";
-
-// src/lib/bin-cache.ts
-import { chmodSync, mkdirSync } from "fs";
-import { homedir } from "os";
-import { join } from "path";
-var GIT_HOOK_CACHE_SHELL_DIR = "${XDG_CACHE_HOME:-$HOME/.cache}/prim/bin";
-var GIT_HOOK_CACHE_TTL_MINUTES = 1440;
-var GIT_HOOK_CACHED_BINS = ["prim-post-commit", "prim-post-rewrite"];
-function binCacheDir() {
-  const base = process.env.XDG_CACHE_HOME || join(homedir(), ".cache");
-  return join(base, "prim", "bin");
-}
-function writeAtomic(path, content) {
-  atomicWriteFile(path, content, { mode: 384 });
-}
-function warmBinCache() {
-  try {
-    if (process.env.PRIM_BIN_CACHE === "0") {
-      return;
-    }
-    const dir = binCacheDir();
-    mkdirSync(dir, { recursive: true, mode: 448 });
-    chmodSync(dir, 448);
-    writeAtomic(join(dir, "node"), process.execPath);
-    for (const bin of GIT_HOOK_CACHED_BINS) {
-      const file = binFile(bin);
-      if (file) {
-        writeAtomic(join(dir, bin), file);
-      }
-    }
-  } catch {
-  }
-}
+} from "./chunk-DWRSEC34.js";
 
 // src/commands/skill.ts
 import { createHash as createHash2 } from "crypto";
@@ -81,8 +46,8 @@ import {
   rmdirSync as rmdirSync2,
   unlinkSync
 } from "fs";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname2, join as join3, resolve as resolve2 } from "path";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname2, join as join2, resolve as resolve2 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { createPatch } from "diff";
 import { parse as parseYaml2 } from "yaml";
@@ -100,7 +65,7 @@ import {
   existsSync,
   fstatSync,
   lstatSync,
-  mkdirSync as mkdirSync2,
+  mkdirSync,
   openSync,
   readFileSync,
   readSync,
@@ -109,8 +74,8 @@ import {
   rmSync,
   rmdirSync
 } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname, isAbsolute, join as join2, relative, resolve, sep } from "path";
+import { homedir } from "os";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "path";
 import { fileURLToPath } from "url";
 import { parse as parseYaml } from "yaml";
 var __dirname = dirname(fileURLToPath(import.meta.url));
@@ -120,8 +85,8 @@ var MAX_SKILL_BYTES = 1024 * 1024;
 var REFRESH_LOCK_TIMEOUT_MS = 150;
 var REFRESH_LOCK_POLL_MS = 10;
 function pluginDirFor(cwd, scope) {
-  const base = scope === "user" ? join2(homedir2(), ".claude") : join2(gitToplevel(cwd) ?? cwd, ".claude");
-  return join2(base, "skills", "prim");
+  const base = scope === "user" ? join(homedir(), ".claude") : join(gitToplevel(cwd) ?? cwd, ".claude");
+  return join(base, "skills", "prim");
 }
 function resolvePluginDir(cwd, scope) {
   if (scope && scope !== "user" && scope !== "project") {
@@ -153,8 +118,8 @@ function removeDirIfEmpty(dir) {
 }
 function pluginPaths(dir) {
   return {
-    manifestPath: join2(dir, ".claude-plugin", "plugin.json"),
-    skillPath: join2(dir, "SKILL.md")
+    manifestPath: join(dir, ".claude-plugin", "plugin.json"),
+    skillPath: join(dir, "SKILL.md")
   };
 }
 function pathIsInside(root, path) {
@@ -219,9 +184,9 @@ function inspectRecognizedInstallation(paths, projectRoot) {
   };
 }
 function refreshLockDir(physicalPluginDir) {
-  const cacheRoot = process.env.XDG_CACHE_HOME || join2(homedir2(), ".cache");
+  const cacheRoot = process.env.XDG_CACHE_HOME || join(homedir(), ".cache");
   const identity = createHash("sha256").update(physicalPluginDir).digest("hex");
-  return join2(cacheRoot, "prim", "skill-refresh-locks", `${identity}.lock`);
+  return join(cacheRoot, "prim", "skill-refresh-locks", `${identity}.lock`);
 }
 async function refreshClaudePlugins(cwd, options = {}) {
   const result = { installed: 0, refreshed: 0 };
@@ -229,7 +194,7 @@ async function refreshClaudePlugins(cwd, options = {}) {
   if (options.includeProject !== false) {
     const projectRoot = options.projectRoot ?? gitToplevel(cwd);
     if (projectRoot !== null && isAbsolute(projectRoot)) {
-      candidates.push({ dir: join2(projectRoot, ".claude", "skills", "prim"), projectRoot });
+      candidates.push({ dir: join(projectRoot, ".claude", "skills", "prim"), projectRoot });
     }
   }
   candidates.push({ dir: pluginDirFor(cwd, "user") });
@@ -305,7 +270,7 @@ function installClaudePlugin(cwd, opts) {
     console.log(`Would write plugin to ${dir} (.claude-plugin/plugin.json + SKILL.md)`);
     return 0;
   }
-  mkdirSync2(join2(dir, ".claude-plugin"), { recursive: true });
+  mkdirSync(join(dir, ".claude-plugin"), { recursive: true });
   atomicWrite(manifestPath, manifest);
   atomicWrite(skillPath, skill);
   console.log(`Installed prim skill plugin at ${dir}`);
@@ -325,7 +290,7 @@ function uninstallClaudePlugin(cwd, opts) {
   }
   rmSync(manifestPath, { force: true });
   rmSync(skillPath, { force: true });
-  removeDirIfEmpty(join2(dir, ".claude-plugin"));
+  removeDirIfEmpty(join(dir, ".claude-plugin"));
   removeDirIfEmpty(dir);
   console.log(`Removed prim skill plugin from ${dir}`);
   return 0;
@@ -380,10 +345,10 @@ function readCodexGuidance(path) {
   }
 }
 function effectiveCodexGuidance(scope) {
-  const override = readCodexGuidance(join3(scope, "AGENTS.override.md"));
+  const override = readCodexGuidance(join2(scope, "AGENTS.override.md"));
   if (override === null) return null;
   if (override !== void 0 && override.toString("utf8").trim().length > 0) return override;
-  const base = readCodexGuidance(join3(scope, "AGENTS.md"));
+  const base = readCodexGuidance(join2(scope, "AGENTS.md"));
   return base ?? null;
 }
 function hasUsablePrimBlock(content, visibleBytes) {
@@ -406,7 +371,7 @@ function hasUsablePrimBlock(content, visibleBytes) {
 }
 function hasUsableCodexGuidance(projectRoot) {
   try {
-    const codexHome = process.env.CODEX_HOME?.trim() ? resolve2(process.env.CODEX_HOME) : join3(homedir3(), ".codex");
+    const codexHome = process.env.CODEX_HOME?.trim() ? resolve2(process.env.CODEX_HOME) : join2(homedir2(), ".codex");
     const scopes = [
       { path: codexHome, visibleBytes: CODEX_GUIDANCE_LIMIT_BYTES },
       { path: projectRoot, visibleBytes: CODEX_DEFAULT_PROJECT_GUIDANCE_BYTES }
@@ -440,14 +405,14 @@ function sha256(content) {
 }
 function cursorSkillDirectory(cwd, scope) {
   const base = scope === "user" ? cursorConfigDirectory() : gitToplevel(cwd) ?? cwd;
-  return join3(base, scope === "user" ? "skills" : ".cursor/skills", "prim");
+  return join2(base, scope === "user" ? "skills" : ".cursor/skills", "prim");
 }
 function cursorSkillPaths(cwd, scope) {
   const directory = cursorSkillDirectory(cwd, scope);
   return {
     directory,
-    skill: join3(directory, "SKILL.md"),
-    manifest: join3(directory, CURSOR_SKILL_MANIFEST)
+    skill: join2(directory, "SKILL.md"),
+    manifest: join2(directory, CURSOR_SKILL_MANIFEST)
   };
 }
 function readCursorSkillManifest(path) {
@@ -535,10 +500,10 @@ function hasUsableCursorSkill(projectRoot) {
   return cursorSkillStatus(projectRoot, "project").installed || cursorSkillStatus(projectRoot, "user").installed;
 }
 function userTargetFor(agent) {
-  if (agent === "claude") return join3(homedir3(), ".claude", "CLAUDE.md");
-  if (agent === "codex") return join3(homedir3(), ".codex", "AGENTS.md");
+  if (agent === "claude") return join2(homedir2(), ".claude", "CLAUDE.md");
+  if (agent === "codex") return join2(homedir2(), ".codex", "AGENTS.md");
   if (agent === "hermes") {
-    return join3(process.env.HERMES_HOME ?? join3(homedir3(), ".hermes"), ".hermes.md");
+    return join2(process.env.HERMES_HOME ?? join2(homedir2(), ".hermes"), ".hermes.md");
   }
   return null;
 }
@@ -709,6 +674,39 @@ function registerSkillCommands(program) {
   });
 }
 
+// src/lib/bin-cache.ts
+import { chmodSync, mkdirSync as mkdirSync2 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join3 } from "path";
+var GIT_HOOK_CACHE_SHELL_DIR = "${XDG_CACHE_HOME:-$HOME/.cache}/prim/bin";
+var GIT_HOOK_CACHE_TTL_MINUTES = 1440;
+var GIT_HOOK_CACHED_BINS = ["prim-post-commit", "prim-post-rewrite"];
+function binCacheDir() {
+  const base = process.env.XDG_CACHE_HOME || join3(homedir3(), ".cache");
+  return join3(base, "prim", "bin");
+}
+function writeAtomic(path, content) {
+  atomicWriteFile(path, content, { mode: 384 });
+}
+function warmBinCache() {
+  try {
+    if (process.env.PRIM_BIN_CACHE === "0") {
+      return;
+    }
+    const dir = binCacheDir();
+    mkdirSync2(dir, { recursive: true, mode: 448 });
+    chmodSync(dir, 448);
+    writeAtomic(join3(dir, "node"), process.execPath);
+    for (const bin of GIT_HOOK_CACHED_BINS) {
+      const file = binFile(bin);
+      if (file) {
+        writeAtomic(join3(dir, bin), file);
+      }
+    }
+  } catch {
+  }
+}
+
 // src/lib/git-hook-legacy.ts
 import { isAbsolute as isAbsolute2 } from "path";
 var PRIM_MANAGED_MARK = "prim-managed-hook";

package/dist/{chunk-LFFLHSQO.js → chunk-CU7RW7XU.js}

@@ -1,18 +1,32 @@
+import {
+  getOrCreateWorkspaceId
+} from "./chunk-EZXEWFDG.js";
 import {
   analyzeShellTargets,
   extractFileTargets
-} from "./chunk-ZB4F75SZ.js";
+} from "./chunk-MXVCP33E.js";
+import {
+  scrubEnvironmentPaths
+} from "./chunk-URLLSALP.js";
 import {
-  canonicalRepositoryPath
-} from "./chunk-H4UNYFUC.js";
+  cachedCollectScopeAdmits
+} from "./chunk-Z6NPNLOT.js";
+import {
+  canonicalRepositoryPath,
+  currentBranch,
+  isRepoActiveForCapture,
+  relatedWorktreeTarget,
+  repoSyncId
+} from "./chunk-DHOQGHKQ.js";
 
 // src/hooks/file-refs.ts
 var MAX_PREFLIGHT_FILE_TARGETS = 25;
 function primitiveMetadataForResolution(resolution) {
-  const shouldAttach = resolution.fileRefs.length > 0 || resolution.rejected.length > 0 || resolution.targetsIncomplete || resolution.targetsTruncated || resolution.shellMutation !== void 0;
+  const shouldAttach = resolution.fileRefs.length > 0 || (resolution.targetCheckouts?.length ?? 0) > 0 || resolution.rejected.length > 0 || resolution.targetsIncomplete || resolution.targetsTruncated || resolution.shellMutation !== void 0;
   if (!shouldAttach) return;
   return {
     fileRefs: [...resolution.fileRefs],
+    ...resolution.targetCheckouts ? { targetCheckouts: resolution.targetCheckouts } : {},
     ...resolution.rejected.length > 0 || resolution.targetsIncomplete ? { fileRefsIncomplete: true } : {},
     ...resolution.targetsTruncated ? { fileRefsTruncated: true } : {},
     ...resolution.shellMutation !== void 0 ? { shellMutation: resolution.shellMutation } : {}
@@ -37,13 +51,55 @@ function resolveHookFileRefs(args) {
   const targetsTruncated = uniqueRawPaths.length > MAX_PREFLIGHT_FILE_TARGETS;
   const fileRefs = /* @__PURE__ */ new Set();
   const rejected = [];
+  const targets = /* @__PURE__ */ new Map();
   for (const path of uniqueRawPaths.slice(0, MAX_PREFLIGHT_FILE_TARGETS)) {
     const canonical = canonicalRepositoryPath(path, args.repository, args.cwd);
     if (canonical.ok) fileRefs.add(canonical.file);
-    else rejected.push({ path, reason: canonical.reason });
+    else {
+      const target = args.captureTargets && canonical.reason === "outside_repository" ? relatedWorktreeTarget(path, args.cwd, args.repository) : null;
+      const resolved = target ? canonicalRepositoryPath(path, target, args.cwd) : null;
+      if (target && resolved?.ok && isRepoActiveForCapture(target.repoRoot) && repoSyncId(target.repoRoot) === args.repository.repoSyncId && args.repository.repoSyncId && cachedCollectScopeAdmits(target.repoRoot, {
+        repository: target.repoFullName,
+        branch: currentBranch(target.repoRoot),
+        agent: args.agent,
+        paths: [resolved.file],
+        pathsComplete: true
+      })) {
+        const group = targets.get(target.repoRoot) ?? { repository: target, fileRefs: [] };
+        group.fileRefs.push(resolved.file);
+        targets.set(target.repoRoot, group);
+      } else rejected.push({ path, reason: canonical.reason });
+    }
+  }
+  const targetCheckouts = [];
+  if (targets.size > 0) {
+    if (fileRefs.size > 0)
+      targets.set(args.repository.repoRoot, {
+        repository: args.repository,
+        fileRefs: [...fileRefs]
+      });
+    for (const { repository, fileRefs: paths } of targets.values()) {
+      const identity = getOrCreateWorkspaceId(repository.repoRoot);
+      const binding = repoSyncId(repository.repoRoot);
+      if (identity.status !== "ready" || !binding) {
+        rejected.push({ path: repository.repoRoot, reason: "invalid_path" });
+        continue;
+      }
+      const root = scrubEnvironmentPaths({
+        cwd: repository.repoRoot,
+        gitRoot: repository.repoRoot
+      }).gitRoot;
+      targetCheckouts.push({
+        gitRoot: root,
+        workspaceId: identity.workspaceId,
+        repoSyncId: binding,
+        fileRefs: paths
+      });
+    }
   }
   return {
     fileRefs: [...fileRefs],
+    ...targetCheckouts.length > 0 ? { targetCheckouts } : {},
     rejected,
     targetsIncomplete: nativeTargets?.complete === false,
     targetsTruncated,
@@ -57,7 +113,8 @@ function enrichHookPayloadWithFileRefs(args) {
     toolInput: args.parsed.tool_input,
     agent: args.agent,
     cwd: args.cwd,
-    repository: args.repository
+    repository: args.repository,
+    captureTargets: true
   });
   const primitive = primitiveMetadataForResolution(resolution);
   if (!primitive) return { parsed: args.parsed, resolution };

package/dist/{chunk-H4UNYFUC.js → chunk-DHOQGHKQ.js}

@@ -18,6 +18,24 @@ function gitToplevel(cwd) {
     return null;
   }
 }
+function mainWorktreeRoot(cwd) {
+  try {
+    const [gitDir, commonDir] = execFileSync(
+      "git",
+      ["rev-parse", "--git-dir", "--git-common-dir"],
+      {
+        cwd,
+        encoding: "utf-8",
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: GIT_TIMEOUT_MS
+      }
+    ).trim().split("\n").map((value) => resolve(cwd ?? process.cwd(), value));
+    if (gitDir === void 0 || commonDir === void 0 || gitDir === commonDir) return null;
+    return basename(commonDir) === ".git" ? dirname(commonDir) : null;
+  } catch {
+    return null;
+  }
+}
 function gitValue(cwd, args) {
   try {
     const value = execFileSync("git", args, {
@@ -56,6 +74,31 @@ function canonicalGitRoot(cwd) {
     return null;
   }
 }
+function relatedWorktreeTarget(path, cwd, origin) {
+  let parent = dirname(resolve(cwd, path));
+  while (true) {
+    try {
+      realpathSync.native(parent);
+      break;
+    } catch {
+      const next = dirname(parent);
+      if (next === parent) return null;
+      parent = next;
+    }
+  }
+  const target = resolveRepositoryContext(parent);
+  if (!target || !target.repoKey || target.repoKey !== origin.repoKey) return null;
+  const common = (root) => {
+    const value = gitValue(root, ["rev-parse", "--git-common-dir"]);
+    try {
+      return value ? realpathSync.native(resolve(root, value)) : void 0;
+    } catch {
+      return void 0;
+    }
+  };
+  const originCommon = common(origin.repoRoot);
+  return originCommon && originCommon === common(target.repoRoot) ? target : null;
+}
 function normalizeOriginRemote(remote) {
   const value = remote.trim();
   if (!value) return void 0;
@@ -186,11 +229,151 @@ function canonicalRepositoryPath(filePath, contextOrCwd, baseDirOrRoot) {
   );
 }
 
+// src/lib/activation.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import { existsSync, readFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+var PRIM_ACTIVE_KEY = "prim.active";
+var PRIM_REPO_SYNC_ID_KEY = "prim.repoSyncId";
+var PRIM_REPO_SYNC_REPOSITORY_KEY = "prim.repoSyncRepository";
+var PRIM_REPO_BINDING_STATE_KEY = "prim.repoBindingState";
+var GIT_TIMEOUT_MS2 = 1e3;
+var REPO_SYNC_ID_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+var PROJECT_INSTALL_FILES = [".claude/settings.json", ".codex/hooks.json", ".cursor/hooks.json"];
+var PRIM_HOOK_BINS = ["prim-hook", "prim-pre-tool-use", "prim-post-tool-use"];
+function repoActiveFlag(cwd) {
+  try {
+    const value = execFileSync2("git", ["config", "--get", PRIM_ACTIVE_KEY], {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS2
+    }).trim();
+    if (value === "true") return "true";
+    if (value === "false") return "false";
+    return void 0;
+  } catch {
+    return void 0;
+  }
+}
+function isRepoActive(cwd) {
+  return repoActiveFlag(cwd) === "true";
+}
+function setRepoActive(cwd, active) {
+  execFileSync2("git", ["config", "--local", PRIM_ACTIVE_KEY, active ? "true" : "false"], {
+    cwd,
+    stdio: ["ignore", "ignore", "pipe"],
+    timeout: GIT_TIMEOUT_MS2
+  });
+}
+function isValidRepoSyncId(value) {
+  return typeof value === "string" && REPO_SYNC_ID_RE.test(value);
+}
+function localGitConfigValue(cwd, key) {
+  try {
+    const value = execFileSync2("git", ["config", "--local", "--get", key], {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: GIT_TIMEOUT_MS2
+    }).trim();
+    return value || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function setLocalGitConfigValue(cwd, key, value) {
+  execFileSync2("git", ["config", "--local", key, value], {
+    cwd,
+    stdio: ["ignore", "ignore", "pipe"],
+    timeout: GIT_TIMEOUT_MS2
+  });
+}
+function repoSyncId(cwd) {
+  const value = localGitConfigValue(cwd, PRIM_REPO_SYNC_ID_KEY);
+  if (!isValidRepoSyncId(value)) return void 0;
+  const repositoryFullName = localGitConfigValue(cwd, PRIM_REPO_SYNC_REPOSITORY_KEY);
+  return repositoryFullName === githubRepositoryFullName(cwd) ? value : void 0;
+}
+function setRepoSyncId(cwd, value, repositoryFullName) {
+  if (!isValidRepoSyncId(value)) {
+    throw new Error("invalid repository binding returned by server");
+  }
+  execFileSync2("git", ["config", "--local", PRIM_REPO_SYNC_ID_KEY, value], {
+    cwd,
+    stdio: ["ignore", "ignore", "pipe"],
+    timeout: GIT_TIMEOUT_MS2
+  });
+  execFileSync2("git", ["config", "--local", PRIM_REPO_SYNC_REPOSITORY_KEY, repositoryFullName], {
+    cwd,
+    stdio: ["ignore", "ignore", "pipe"],
+    timeout: GIT_TIMEOUT_MS2
+  });
+}
+function setRepositoryBindingState(cwd, state) {
+  if (state !== "connected" && state !== "unbound" && state !== "invalid") {
+    throw new Error("invalid repository binding state");
+  }
+  execFileSync2("git", ["config", "--local", PRIM_REPO_BINDING_STATE_KEY, state], {
+    cwd,
+    stdio: ["ignore", "ignore", "pipe"],
+    timeout: GIT_TIMEOUT_MS2
+  });
+}
+function repositoryBindingState(cwd) {
+  const rawId = localGitConfigValue(cwd, PRIM_REPO_SYNC_ID_KEY);
+  const marker = localGitConfigValue(cwd, PRIM_REPO_BINDING_STATE_KEY);
+  if (rawId !== void 0 && !isValidRepoSyncId(rawId)) return "invalid";
+  if (marker === "unbound" || marker === "invalid") return marker;
+  if (marker === "connected") return repoSyncId(cwd) ? "connected" : "invalid";
+  if (marker !== void 0) return "invalid";
+  return rawId === void 0 ? "unbound" : repoSyncId(cwd) ? void 0 : "unbound";
+}
+function hasProjectPrimInstall(cwd) {
+  const root = gitToplevel(cwd);
+  if (root === null || root === homedir()) return false;
+  for (const rel of PROJECT_INSTALL_FILES) {
+    const path = join(root, rel);
+    if (existsSync(path)) {
+      try {
+        const content = readFileSync(path, "utf-8");
+        if (PRIM_HOOK_BINS.some((bin) => content.includes(bin))) return true;
+      } catch {
+      }
+    }
+  }
+  return false;
+}
+function isRepoActiveForCapture(cwd) {
+  const flag = repoActiveFlag(cwd);
+  if (flag === "true") return true;
+  if (flag === "false") return false;
+  return hasProjectPrimInstall(cwd);
+}
+function decisionIngestionStatus(cwd) {
+  return isRepoActiveForCapture(cwd) ? "enabled" : "disabled";
+}
+
 export {
   gitToplevel,
+  mainWorktreeRoot,
   currentBranch,
   githubRepositoryFullName,
   canonicalGitRoot,
+  relatedWorktreeTarget,
   resolveRepositoryContext,
-  canonicalRepositoryPath
+  canonicalRepositoryPath,
+  repoActiveFlag,
+  isRepoActive,
+  setRepoActive,
+  isValidRepoSyncId,
+  localGitConfigValue,
+  setLocalGitConfigValue,
+  repoSyncId,
+  setRepoSyncId,
+  setRepositoryBindingState,
+  repositoryBindingState,
+  isRepoActiveForCapture,
+  decisionIngestionStatus
 };

package/dist/{chunk-2GP5UFV7.js → chunk-DWRSEC34.js}

@@ -24,6 +24,11 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// src/lib/credentials.ts
+import { createHash } from "crypto";
+import { readFileSync } from "fs";
+import { join as join2 } from "path";
+
 // src/lib/paths.ts
 import { homedir } from "os";
 import { isAbsolute, join, normalize } from "path";
@@ -353,9 +358,6 @@ async function pollWorkosDeviceAuthorization(configuration, authorization, optio
 }
 
 // src/lib/credentials.ts
-import { createHash } from "crypto";
-import { readFileSync } from "fs";
-import { join as join2 } from "path";
 var CONFIG_DIRECTORY = primConfigDirectory();
 var TOKEN_FILE_PATH = join2(CONFIG_DIRECTORY, "token");
 var REFRESH_TOKEN_PATH = join2(CONFIG_DIRECTORY, "refresh_token");