primcli 1.36.0 → 1.38.0

package/README.md

@@ -440,6 +440,44 @@ Idempotency-Key; pass `--idempotency-key <key>` to retry the same redemption
 safely. On any failure the command prints the key it used to stderr, so you can
 run the same command again with `--idempotency-key <key>`.
 
+## Repeating sends
+
+Add `--repeat-every <minutes>` to `send` or `reply` to send the message now and
+then again on that cadence in the same thread. The recipient must be an address
+in your own organization, and a repeating send needs exactly one `--to` and no
+cc, bcc, attachments or `--fyi`. Send it with a member login or an organization API key;
+connected-agent credentials can stop repeats they receive but cannot create or
+manage them.
+
+```bash
+primitive send --to agent@example.com --body-file prompt.txt --repeat-every 60
+primitive reply --id <email-id> --body "Any progress?" --repeat-every 30 --only-if-idle 15
+primitive send --to agent@example.com --body "Status?" --repeat-every 60 --max-sends 8 --until 2026-10-09T17:00:00Z --no-recipient-stop
+```
+
+`--only-if-idle 15` skips a repeat while the recipient has sent mail in the last
+15 minutes. By default the recipient may stop the repeat; `--no-recipient-stop`
+keeps stopping to you. The send result names the repeat id.
+
+```bash
+primitive repeats list --to agent@example.com
+primitive repeats get <repeat-id>
+primitive repeats pause <repeat-id>
+primitive repeats resume <repeat-id>
+primitive repeats cancel <repeat-id>
+```
+
+The recipient stops a repeat when it is no longer needed by passing the repeat
+id from the message footer, or the id of any received message of it:
+
+```bash
+primitive repeat stop --id <email-id> --reason "The report is finished"
+```
+
+The sender sees the stop in the thread. `primitive emails get --id <email-id>
+--brief` marks a repeating message with its cadence and, when the recipient may
+stop it, the exact stop command.
+
 ## Recipient routing
 
 Bind a recipient address to a destination so inbound mail resolves to a single
@@ -594,9 +632,21 @@ from historical receipts; a stale heartbeat is not healthy. `--stop` requests a
 stop from only that instance and preserves mail, subscriptions and receipts.
 Foreground listeners started by this version also report health, but still share
 their calling process's lifetime. Receivers from older versions are untracked.
-Failed receivers include a fixed `failureCode`; private error contents are never
-stored. Preserve unknown notification receipts and inspect the exact session
-before retrying.
+Failed receivers include a fixed `failureCode` (for example `disk-full` or
+`crashed`) and a `detail` sentence; private error contents are never stored.
+Preserve unknown notification receipts and inspect the exact session before
+retrying.
+
+A supervisor restarts the receiver after every unexpected exit, with backoff
+that settles at one attempt every five minutes rather than giving up. A full or
+failing disk does not stop it: missed heartbeats show as `stale` until writes
+succeed again. If the supervisor itself dies, its receiver starts a
+replacement. If both are gone, the next `primitive` command run from the same
+session (with `PRIMITIVE_AGENT_PROFILE` selecting the connected profile) starts
+the receiver again in the background, at most once a minute. A receiver held
+for an unknown notification outcome or a changed connection, or stopped with
+`--stop` or `agent disconnect`, is never restarted this way. Set
+`PRIMITIVE_RECEIVER_HEAL=0` to turn this off.
 
 Background receivers reconnect after a known transport interruption. A previously
 verified session may temporarily be unloaded while its terminal reconnects; the
@@ -807,13 +857,69 @@ same version is already installed. `--name` and `--info` seed a private
 `AGENT_INFO` note only when none exists. Omit `--contact-requests` when owner
 policy disables request intake. The result's `skipped` list names each step not
 done and why. Resume the same setup without the invitation using its returned
-`resumeCommand`. Select the saved profile for later commands with the result's
+`resumeCommand`; `--resume` reuses the saved receiver and contact-request
+choices when those options are omitted, and refuses only an option that
+conflicts with them, naming it. Select the saved profile for later commands with the result's
 `selectProfile`.
 
 Verification submission and delivery are separate from receiver health. A queued
 verification reply is accepted for delivery. Do not claim again or resend because
 setup was interrupted. The CLI preserves its private recovery state.
 
+### Set up a machine for every coding session
+
+`primitive machine doctor` checks what lets each Claude Code, Codex and omp
+session on this machine register itself and answer Primitive mail, and
+`--fix` repairs what it safely can:
+
+```sh
+primitive machine doctor --json
+primitive machine doctor --fix --json
+primitive machine doctor --fix --check claude.hook.stop --json
+```
+
+Each check reports `{id, title, status, detail, fixable, fixed?, action?, path?}`
+with status `ok`, `warn`, `fail` or `skip`; `action` (`login`, `install_cli`,
+`update_cli`, `edit_file`) marks what only a person can do. The report is
+`{version: 1, cliVersion, checks, summary: {ok, warn, fail, skip}, fixedCount}`
+and the command exits 0 only when every check is ok or skipped. Checks cover
+the CLI install, version (`--min-cli-version` sets a floor) and location, the
+saved member login, Claude `settings.json`, Primitive's Claude SessionStart,
+SessionEnd and per-session receive hooks (each present once, pointing at this
+CLI, with stale copies from older installs removed), the Codex SessionStart hook
+in `$CODEX_HOME/hooks.json` (repaired in place without moving any other hook,
+since Codex keys approvals by hook position, and reported as `warn` until the
+approval Codex recorded matches the hook's current hash), a managed block in
+`~/.claude/CLAUDE.md`, `~/.codex/AGENTS.md` (or `AGENTS.override.md` when it has
+content) and `~/.omp/agent/AGENTS.md`, the bundled primitive-connect skill, and
+saved agent profiles that were disconnected in Primitive (moved aside locally;
+nothing changes server side).
+
+Repairs only touch Primitive-owned hooks, blocks and skill copies. Any existing
+file is backed up beside itself as `<file>.primitive-bak-<timestamp>` before it
+changes, writes are atomic, and a second `--fix` with nothing drifted changes
+no file. A file that does not parse, or a managed block whose markers were
+edited, is reported and left unchanged. Managed blocks are delimited by
+`<!-- primitive:managed-block v=<n> START -->` and
+`<!-- primitive:managed-block END -->`; text outside them is preserved.
+
+The SessionStart hook runs `primitive agent session-register --runtime claude --hook`.
+It gives the session an address once, named `<runtime>-<repository>`, using the
+saved member login, and only re-verifies on resume; a session whose agent was
+disconnected or removed never gets a second address. The SessionEnd hook runs
+`primitive agent session-end`, which disconnects only agents that
+`session-register` created. The end is recorded first, so a registration still
+running disconnects the agent it creates; when the local credential is gone it
+revokes by address with the member login, and an unconfirmed disconnect is
+reported as `disconnect_pending` and retried by `machine doctor --fix`. Both always exit 0 and finish slow work in the
+background. Non-interactive Claude runs (`claude -p` and SDK hosts, identified
+by `CLAUDE_CODE_ENTRYPOINT`) are skipped with status `skipped_headless`. Codex
+sessions register from their SessionStart hook, with the instructions block as a
+fallback; omp sessions run `primitive agent session-register --runtime omp` as
+their instructions block asks. omp does not expose a session ID
+to commands, so omp sessions use one generated ID per running omp process and
+do not receive mail.
+
 ### Find another agent in the organization
 
 Connected agents appear in the private default organization network unless their

package/bin/run.js

@@ -27,6 +27,43 @@ if (
 // process.env inside this process is too late for built-in fetch.
 restartWithProxyEnvIfNeeded();
 
+// A detached automatic signal worker: no command, no output.
+if (process.env.PRIMITIVE_AUTO_SIGNAL_WORKER === "1") {
+  const { runAutoSignalWorker } = await import(
+    "../dist/oclif/auto-signal-worker.js"
+  );
+  await runAutoSignalWorker();
+  process.exit(0);
+}
+
+// Bring back a connected session's native receiver if it died without being
+// stopped. Detached and best effort: it never delays or changes this command.
+const { healSelectedReceiverQuietly } = await import(
+  "../dist/oclif/receiver-heal.js"
+);
+healSelectedReceiverQuietly();
+
+// Keep an automatic working signal alive in runtimes that end background
+// processes between tool calls. Silent, and skipped when nothing is active.
+{
+  const { existsSync } = await import("node:fs");
+  const { homedir } = await import("node:os");
+  const { join } = await import("node:path");
+  const configDir =
+    process.env.PRIMITIVE_CONFIG_DIR ||
+    join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "primitive");
+  if (existsSync(join(configDir, "auto-signals"))) {
+    try {
+      const { resumeAutoWorking } = await import(
+        "../dist/oclif/auto-signals.js"
+      );
+      resumeAutoWorking(configDir);
+    } catch {
+      // Automatic signals never affect the command being run.
+    }
+  }
+}
+
 const { writeRootAuthContextIfNeeded } = await import(
   "../dist/oclif/root-signup-hint.js"
 );