primcli 1.43.0 → 1.45.0

package/README.md

@@ -923,6 +923,7 @@ session on this machine register itself and answer Primitive mail, and
 primitive machine doctor --json
 primitive machine doctor --fix --json
 primitive machine doctor --fix --check claude.hook.stop --json
+primitive machine doctor --fix --check claude.hook.stop --profile my-agent
 ```
 
 Each check reports `{id, title, status, detail, fixable, fixed?, action?, path?}`
@@ -942,6 +943,17 @@ content) and `~/.omp/agent/AGENTS.md`, the bundled primitive-connect skill, and
 saved agent profiles that were disconnected in Primitive (moved aside locally;
 nothing changes server side).
 
+`claude.hook.stop` names every per-session receive hook a repair would change
+in `items: [{profile, session, hook, state}]`, where `hook` is the Claude event
+(`Stop`, `SessionStart` or `PostToolUse`) and `state` is `missing`, `stale`,
+`duplicate`, `outdated` or `old_address`; `profile` and `session` are null for
+hooks written by old CLI versions that did not record them. After `--fix` it
+also reports `changes`, the same fields plus `action` (`added`, `removed` or
+`updated`), for each hook it changed. `--profile <name>` (repeatable, with
+`--fix`) limits those per-session hook changes to the named profiles; combine it
+with `--check claude.hook.stop` so nothing else is repaired. With `--profile`,
+each item also carries `selected: false` when this run leaves it unchanged.
+
 Repairs only touch Primitive-owned hooks, blocks and skill copies. Any existing
 file is backed up beside itself as `<file>.primitive-bak-<timestamp>` before it
 changes, writes are atomic, and a second `--fix` with nothing drifted changes

package/dist/oclif/index.js

@@ -13069,6 +13069,38 @@ const openapiDocument = {
 						"attachments_download_available": {
 							"type": "boolean",
 							"description": "Whether an inline attachment archive has been successfully retained and is available for download. Download authorization is checked separately; address-bound agent connection keys cannot download archives."
+						},
+						"to_addresses": {
+							"type": ["array", "null"],
+							"items": { "type": "string" },
+							"description": "Every normalized To recipient of the send. Always populated on\nnew sends (a single-recipient send carries a one-element array);\nnull only on records that predate this field. `to_address` keeps\ncarrying the first recipient.\n"
+						},
+						"cc": {
+							"type": ["array", "null"],
+							"items": { "type": "string" },
+							"description": "Normalized Cc address list. Null when the send had no Cc\nrecipients.\n"
+						},
+						"bcc": {
+							"type": ["array", "null"],
+							"items": { "type": "string" },
+							"description": "Normalized Bcc address list, surfaced on the sending\norganization's own record. Bcc recipients are never written\ninto the transmitted message. Null when the send had no Bcc\nrecipients. Also null when the request uses an address-bound\nagent connection key whose address is not the sender, because\nBcc is withheld from recipients.\n"
+						},
+						"reply_to": {
+							"type": ["array", "null"],
+							"items": { "type": "string" },
+							"description": "Normalized Reply-To address list. Null when the send had none.\n"
+						},
+						"tags": {
+							"type": ["array", "null"],
+							"description": "Customer metadata tags stored verbatim at send time. Null when\nthe send had none. Also null when the request uses an\naddress-bound agent connection key whose address is not the\nsender, because tags are withheld from recipients.\n",
+							"items": {
+								"type": "object",
+								"properties": {
+									"name": { "type": "string" },
+									"value": { "type": "string" }
+								},
+								"required": ["name", "value"]
+							}
 						}
 					}
 				}],
@@ -31319,6 +31351,38 @@ const operationManifest = [
 					"attachments_download_available": {
 						"type": "boolean",
 						"description": "Whether an inline attachment archive has been successfully retained and is available for download. Download authorization is checked separately; address-bound agent connection keys cannot download archives."
+					},
+					"to_addresses": {
+						"type": ["array", "null"],
+						"items": { "type": "string" },
+						"description": "Every normalized To recipient of the send. Always populated on\nnew sends (a single-recipient send carries a one-element array);\nnull only on records that predate this field. `to_address` keeps\ncarrying the first recipient.\n"
+					},
+					"cc": {
+						"type": ["array", "null"],
+						"items": { "type": "string" },
+						"description": "Normalized Cc address list. Null when the send had no Cc\nrecipients.\n"
+					},
+					"bcc": {
+						"type": ["array", "null"],
+						"items": { "type": "string" },
+						"description": "Normalized Bcc address list, surfaced on the sending\norganization's own record. Bcc recipients are never written\ninto the transmitted message. Null when the send had no Bcc\nrecipients. Also null when the request uses an address-bound\nagent connection key whose address is not the sender, because\nBcc is withheld from recipients.\n"
+					},
+					"reply_to": {
+						"type": ["array", "null"],
+						"items": { "type": "string" },
+						"description": "Normalized Reply-To address list. Null when the send had none.\n"
+					},
+					"tags": {
+						"type": ["array", "null"],
+						"description": "Customer metadata tags stored verbatim at send time. Null when\nthe send had none. Also null when the request uses an\naddress-bound agent connection key whose address is not the\nsender, because tags are withheld from recipients.\n",
+						"items": {
+							"type": "object",
+							"properties": {
+								"name": { "type": "string" },
+								"value": { "type": "string" }
+							},
+							"required": ["name", "value"]
+						}
 					}
 				}
 			}],
@@ -32022,6 +32086,38 @@ const operationManifest = [
 					"attachments_download_available": {
 						"type": "boolean",
 						"description": "Whether an inline attachment archive has been successfully retained and is available for download. Download authorization is checked separately; address-bound agent connection keys cannot download archives."
+					},
+					"to_addresses": {
+						"type": ["array", "null"],
+						"items": { "type": "string" },
+						"description": "Every normalized To recipient of the send. Always populated on\nnew sends (a single-recipient send carries a one-element array);\nnull only on records that predate this field. `to_address` keeps\ncarrying the first recipient.\n"
+					},
+					"cc": {
+						"type": ["array", "null"],
+						"items": { "type": "string" },
+						"description": "Normalized Cc address list. Null when the send had no Cc\nrecipients.\n"
+					},
+					"bcc": {
+						"type": ["array", "null"],
+						"items": { "type": "string" },
+						"description": "Normalized Bcc address list, surfaced on the sending\norganization's own record. Bcc recipients are never written\ninto the transmitted message. Null when the send had no Bcc\nrecipients. Also null when the request uses an address-bound\nagent connection key whose address is not the sender, because\nBcc is withheld from recipients.\n"
+					},
+					"reply_to": {
+						"type": ["array", "null"],
+						"items": { "type": "string" },
+						"description": "Normalized Reply-To address list. Null when the send had none.\n"
+					},
+					"tags": {
+						"type": ["array", "null"],
+						"description": "Customer metadata tags stored verbatim at send time. Null when\nthe send had none. Also null when the request uses an\naddress-bound agent connection key whose address is not the\nsender, because tags are withheld from recipients.\n",
+						"items": {
+							"type": "object",
+							"properties": {
+								"name": { "type": "string" },
+								"value": { "type": "string" }
+							},
+							"required": ["name", "value"]
+						}
 					}
 				}
 			}],
@@ -33009,6 +33105,38 @@ const operationManifest = [
 					"attachments_download_available": {
 						"type": "boolean",
 						"description": "Whether an inline attachment archive has been successfully retained and is available for download. Download authorization is checked separately; address-bound agent connection keys cannot download archives."
+					},
+					"to_addresses": {
+						"type": ["array", "null"],
+						"items": { "type": "string" },
+						"description": "Every normalized To recipient of the send. Always populated on\nnew sends (a single-recipient send carries a one-element array);\nnull only on records that predate this field. `to_address` keeps\ncarrying the first recipient.\n"
+					},
+					"cc": {
+						"type": ["array", "null"],
+						"items": { "type": "string" },
+						"description": "Normalized Cc address list. Null when the send had no Cc\nrecipients.\n"
+					},
+					"bcc": {
+						"type": ["array", "null"],
+						"items": { "type": "string" },
+						"description": "Normalized Bcc address list, surfaced on the sending\norganization's own record. Bcc recipients are never written\ninto the transmitted message. Null when the send had no Bcc\nrecipients. Also null when the request uses an address-bound\nagent connection key whose address is not the sender, because\nBcc is withheld from recipients.\n"
+					},
+					"reply_to": {
+						"type": ["array", "null"],
+						"items": { "type": "string" },
+						"description": "Normalized Reply-To address list. Null when the send had none.\n"
+					},
+					"tags": {
+						"type": ["array", "null"],
+						"description": "Customer metadata tags stored verbatim at send time. Null when\nthe send had none. Also null when the request uses an\naddress-bound agent connection key whose address is not the\nsender, because tags are withheld from recipients.\n",
+						"items": {
+							"type": "object",
+							"properties": {
+								"name": { "type": "string" },
+								"value": { "type": "string" }
+							},
+							"required": ["name", "value"]
+						}
 					}
 				}
 			}],
@@ -35617,6 +35745,36 @@ function writeClaudeSettings(params) {
 		release();
 	}
 }
+const STATE_PHRASES = {
+	missing: "missing",
+	stale: "session disconnected or removed",
+	duplicate: "duplicate",
+	outdated: "old CLI path",
+	old_address: "old agent address"
+};
+/** "profile my-agent, session 1234...": who a session hook serves. */
+function describeSessionHookOwner(item) {
+	const profile = item.profile ? `profile ${item.profile}` : "a profile an old CLI did not record";
+	return item.session ? `${profile}, session ${item.session}` : profile;
+}
+/** One short line naming a hook, its owner and its state. */
+function describeSessionHookItem(item) {
+	return `${item.hook} hook for ${describeSessionHookOwner(item)}: ${STATE_PHRASES[item.state]}`;
+}
+/** One short line naming what a repair did to a hook. */
+function describeSessionHookChange(change) {
+	return `${change.action === "added" ? "Added" : change.action === "removed" ? "Removed" : "Rewrote"} ${change.hook} hook for ${describeSessionHookOwner(change)} (${STATE_PHRASES[change.state]})`;
+}
+/** Group items by owner, at most `limit` owners, for a one-line detail. */
+function summarizeOwners(items, limit = 3) {
+	const owners = [];
+	for (const item of items) {
+		const owner = describeSessionHookOwner(item);
+		if (!owners.includes(owner)) owners.push(owner);
+	}
+	const shown = owners.slice(0, limit).join("; ");
+	return owners.length > limit ? `${shown}; and ${owners.length - limit} more` : shown;
+}
 const GLOBAL_HOOKS = {
 	"claude.hook.session_start": {
 		event: "SessionStart",
@@ -35804,6 +35962,87 @@ function boundSessionProfiles(configDir) {
 	} catch {}
 	return bound;
 }
+function boundKey(item) {
+	return [
+		resolve(item.configDir),
+		item.profile,
+		item.session
+	].join("\0");
+}
+/**
+* Bound profiles whose receive hooks are entirely absent while the same
+* session receives through another connected profile, or while several profiles are
+* bound to it and none receives. Such a profile is not restored without
+* being named: its hooks were removed on purpose, or it would give the
+* session a second address. A profile that still has any receive hook for
+* the session, or the only profile bound to a session, is restored as usual.
+*/
+/**
+* For each session, the connected profiles it receives as through the
+* per-session receive hooks in `hooks`, keyed like `boundKey`. A hook for a
+* disconnected or removed profile is stale (machine doctor removes it), so
+* the session does not receive through it.
+*/
+function receivingProfilesBySession(hooks, always) {
+	const receiving = /* @__PURE__ */ new Map();
+	for (const event of SESSION_EVENTS) {
+		const entries = hooks[event];
+		if (!Array.isArray(entries)) continue;
+		for (const entry of entries) {
+			if (!record$4(entry) || !Array.isArray(entry.hooks)) continue;
+			for (const hook of entry.hooks) {
+				const parsed = parseSessionHook(hook);
+				if (!parsed?.profile || !parsed.session) continue;
+				const session = parsed.session.toLowerCase();
+				const key = [
+					resolve(parsed.configDir),
+					parsed.profile,
+					session
+				].join("\0");
+				if (key !== always && (!existsSync(parsed.configDir) || !profileStillConnected(parsed.configDir, parsed.profile))) continue;
+				const profiles = receiving.get(session) ?? /* @__PURE__ */ new Set();
+				profiles.add(key);
+				receiving.set(session, profiles);
+			}
+		}
+	}
+	return receiving;
+}
+/**
+* The other connected profiles a session already receives as, when `target`
+* itself has no receive hook for it. Adding `target`'s hooks then would give
+* the session a second address; an empty list means it would not (the
+* session receives as nobody else, or `target` already has hooks there and
+* only needs them repaired). Uses the same rule as machine doctor, so an
+* automatic install never binds a profile doctor would leave alone.
+*/
+function otherSessionReceivers(hooks, target) {
+	const session = target.session.toLowerCase();
+	const own = [
+		resolve(target.configDir),
+		target.profile,
+		session
+	].join("\0");
+	const present = receivingProfilesBySession(hooks, own).get(session) ?? /* @__PURE__ */ new Set();
+	if (present.has(own)) return [];
+	return [...present].map((other) => other.split("\0")[1] ?? "").sort();
+}
+function heldSessionProfiles(hooks, bound, restore) {
+	const receiving = receivingProfilesBySession(hooks);
+	const held = /* @__PURE__ */ new Map();
+	for (const item of bound) {
+		const key = boundKey(item);
+		const present = receiving.get(item.session) ?? /* @__PURE__ */ new Set();
+		if (present.has(key) || restore?.has(item.profile)) continue;
+		const others = [...present].map((other) => other.split("\0")[1] ?? "");
+		const siblings = bound.filter((candidate) => candidate.session === item.session);
+		if (others.length > 0 || siblings.length > 1) held.set(key, {
+			item,
+			receivingAs: others.sort()
+		});
+	}
+	return held;
+}
 /** Receive hooks each bound profile should have and does not. */
 function missingSessionHooks(hooks, bound, node) {
 	return bound.flatMap((item) => SESSION_EVENTS.filter((event) => !hasSessionReceiveHook(hooks, event, item, node)).map((event) => ({
@@ -35811,6 +36050,34 @@ function missingSessionHooks(hooks, bound, node) {
 		bound: item
 	})));
 }
+/** Every hook judged for repair, in settings order, then every missing one. */
+function sessionHookItems(hooks, verdicts, missing) {
+	const items = missing.map(({ event, bound }) => ({
+		profile: bound.profile,
+		session: bound.session,
+		hook: event,
+		state: "missing"
+	}));
+	for (const event of SESSION_EVENTS) {
+		const entries = hooks[event];
+		if (!Array.isArray(entries)) continue;
+		for (const entry of entries) {
+			if (!record$4(entry) || !Array.isArray(entry.hooks)) continue;
+			for (const hook of entry.hooks) {
+				const verdict = verdicts.get(hook);
+				const parsed = parseSessionHook(hook);
+				if (!verdict || verdict === "keep" || !parsed) continue;
+				items.push({
+					profile: parsed.profile,
+					session: parsed.session?.toLowerCase() ?? null,
+					hook: event,
+					state: verdict
+				});
+			}
+		}
+	}
+	return items;
+}
 /** The exact entry `agent connect` and `session-register` install. */
 function sessionHookEntry(event, item, cli) {
 	const pending = SESSION_HOOK_KIND[event] === "pending";
@@ -35884,7 +36151,9 @@ function inspectClaudeHooks(settings, context) {
 		};
 		return findings;
 	}
-	const bound = context.bound ?? [];
+	const held = heldSessionProfiles(hooks, context.bound ?? [], context.restoreProfiles);
+	const bound = (context.bound ?? []).filter((item) => !held.has(boundKey(item)));
+	const heldNote = held.size ? ` Left alone: ${[...held.values()].map(({ item, receivingAs }) => `profile ${item.profile} is bound to session ${item.session}, which ${receivingAs.length ? `receives as ${receivingAs.join(", ")}` : "has several bound profiles and receives as none"}`).join("; ")}. Run \`primitive machine doctor --fix --profile <profile>\` to restore one deliberately.` : "";
 	const counts = {
 		keep: 0,
 		stale: 0,
@@ -35892,8 +36161,11 @@ function inspectClaudeHooks(settings, context) {
 		outdated: 0,
 		old_address: 0
 	};
-	for (const verdict of judgeSessionHooks(hooks, context.cli, bound).values()) counts[verdict]++;
-	const missing = missingSessionHooks(hooks, bound, context.cli?.node ?? process.execPath).length;
+	const verdicts = judgeSessionHooks(hooks, context.cli, bound);
+	for (const verdict of verdicts.values()) counts[verdict]++;
+	const missingHooks = missingSessionHooks(hooks, bound, context.cli?.node ?? process.execPath);
+	const missing = missingHooks.length;
+	const items = sessionHookItems(hooks, verdicts, missingHooks);
 	const problems = [
 		missing ? `${missing} missing for connected sessions` : "",
 		counts.old_address ? `${counts.old_address} naming an old agent address` : "",
@@ -35903,11 +36175,12 @@ function inspectClaudeHooks(settings, context) {
 	].filter(Boolean);
 	findings["claude.hook.stop"] = problems.length ? {
 		status: "fail",
-		detail: `Per-session receive hooks need cleanup: ${problems.join(", ")}.${blockedNote}`,
-		fixable: canFix || counts.outdated === 0 && missing === 0 && context.blocked === null
+		detail: `Per-session receive hooks need cleanup: ${problems.join(", ")}. Affected: ${summarizeOwners(items)}.${blockedNote}${heldNote}`,
+		fixable: canFix || counts.outdated === 0 && missing === 0 && context.blocked === null,
+		items
 	} : {
 		status: "ok",
-		detail: counts.keep ? `${counts.keep} per-session receive hooks, each present once and current.` : "No per-session receive hooks; each registered session adds its own exact-session hooks.",
+		detail: `${counts.keep ? `${counts.keep} per-session receive hooks, each present once and current.` : "No per-session receive hooks; each registered session adds its own exact-session hooks."}${heldNote}`,
 		fixable: false
 	};
 	return findings;
@@ -35939,8 +36212,10 @@ function rewriteEntries(entries, transform) {
 * Primitive-owned hooks are added, rewritten or removed; every other key,
 * entry and sibling hook is carried over unchanged.
 */
-function repairClaudeHooks(settings, context, checks) {
+function repairClaudeHooks(settings, context, checks, options = {}) {
 	const changed = /* @__PURE__ */ new Set();
+	const changes = [];
+	const selected = (profile) => !options.profiles || profile !== null && options.profiles.has(profile);
 	const hooks = record$4(settings.hooks) ? { ...settings.hooks } : {};
 	const cli = context.blocked === null ? context.cli : null;
 	for (const [id, spec] of Object.entries(GLOBAL_HOOKS)) {
@@ -35973,19 +36248,38 @@ function repairClaudeHooks(settings, context, checks) {
 	}
 	if (checks.has("claude.hook.stop") && context.blocked === null) {
 		if (!SESSION_EVENTS.some((event) => eventEntries(hooks, event) === "invalid")) {
-			const bound = context.bound ?? [];
+			const held = heldSessionProfiles(hooks, context.bound ?? [], context.restoreProfiles);
+			const bound = (context.bound ?? []).filter((item) => !held.has(boundKey(item)));
 			const verdicts = judgeSessionHooks(hooks, context.cli, bound);
 			for (const event of SESSION_EVENTS) {
 				const entries = eventEntries(hooks, event);
 				if (entries === "invalid" || entries.length === 0) continue;
 				const result = rewriteEntries(entries, (hook) => {
 					const verdict = verdicts.get(hook);
-					if (verdict === "stale" || verdict === "duplicate" || verdict === "old_address") return void 0;
-					if (verdict !== "outdated" || !cli || !record$4(hook)) return hook;
 					const parsed = parseSessionHook(hook);
+					if (!verdict || verdict === "keep" || !parsed) return hook;
+					if (!selected(parsed.profile)) return hook;
+					const item = {
+						profile: parsed.profile,
+						session: parsed.session?.toLowerCase() ?? null,
+						hook: event,
+						state: verdict
+					};
+					if (verdict === "stale" || verdict === "duplicate" || verdict === "old_address") {
+						changes.push({
+							...item,
+							action: "removed"
+						});
+						return;
+					}
+					if (!cli || !record$4(hook)) return hook;
 					const args = [...hook.args];
-					args[0] = parsed?.kind === "pending" ? cli.pending : cli.wake;
+					args[0] = parsed.kind === "pending" ? cli.pending : cli.wake;
 					args[1] = cli.entry;
+					changes.push({
+						...item,
+						action: "updated"
+					});
 					return {
 						...hook,
 						command: cli.node,
@@ -35998,8 +36292,16 @@ function repairClaudeHooks(settings, context, checks) {
 				}
 			}
 			if (cli) for (const missing of missingSessionHooks(hooks, bound, cli.node)) {
+				if (!selected(missing.bound.profile)) continue;
 				const entries = eventEntries(hooks, missing.event);
 				if (entries === "invalid") continue;
+				changes.push({
+					profile: missing.bound.profile,
+					session: missing.bound.session,
+					hook: missing.event,
+					state: "missing",
+					action: "added"
+				});
 				hooks[missing.event] = [...entries, sessionHookEntry(missing.event, missing.bound, cli)];
 				changed.add("claude.hook.stop");
 			}
@@ -36007,14 +36309,16 @@ function repairClaudeHooks(settings, context, checks) {
 	}
 	if (!changed.size) return {
 		settings,
-		changed
+		changed,
+		changes
 	};
 	return {
 		settings: {
 			...settings,
 			hooks
 		},
-		changed
+		changed,
+		changes
 	};
 }
 //#endregion
@@ -36126,11 +36430,18 @@ function installClaudeWakeHook(options) {
 		const agentAddress = mailAddress(options.agentAddress);
 		if (!SESSION_UUID$1.test(options.sessionId)) return "unavailable";
 		const sessionId = options.sessionId.toLowerCase();
-		return editClaudeSettings(resolve((options.env ?? process.env).CLAUDE_CONFIG_DIR || join(homedir(), ".claude")), (settings) => {
+		const claudeDir = resolve((options.env ?? process.env).CLAUDE_CONFIG_DIR || join(homedir(), ".claude"));
+		let held = false;
+		if (!editClaudeSettings(claudeDir, (settings) => {
 			const hooks = settings.hooks ?? {};
 			if (!record$3(hooks)) throw new Error("Invalid hook settings");
 			for (const event of WAKE_EVENTS) if (!Array.isArray(hooks[event] ?? [])) throw new Error(`Invalid ${event} hooks`);
 			if (!Array.isArray(hooks[PENDING_EVENT] ?? [])) throw new Error(`Invalid ${PENDING_EVENT} hooks`);
+			held = options.yieldToOtherProfiles === true && otherSessionReceivers(hooks, {
+				configDir,
+				profile: profileName,
+				session: sessionId
+			}).length > 0;
 			const hook = {
 				type: "command",
 				command: process.execPath,
@@ -36174,19 +36485,26 @@ function installClaudeWakeHook(options) {
 				}
 			};
 			const nextHooks = { ...hooks };
-			for (const event of WAKE_EVENTS) nextHooks[event] = [...(hooks[event] ?? []).flatMap((entry) => {
-				if (!record$3(entry) || !Array.isArray(entry.hooks)) return [entry];
-				const siblings = entry.hooks.filter((candidate) => !isOwnHook(candidate));
-				if (siblings.length === entry.hooks.length) return [entry];
-				return siblings.length ? [{
-					...entry,
-					hooks: siblings
-				}] : [];
-			}), event === "SessionStart" ? {
-				matcher: "resume",
-				hooks: [hook]
-			} : { hooks: [hook] }];
-			nextHooks[PENDING_EVENT] = [...(hooks[PENDING_EVENT] ?? []).flatMap((entry) => {
+			for (const event of WAKE_EVENTS) {
+				const entries = hooks[event];
+				const retained = (entries ?? []).flatMap((entry) => {
+					if (!record$3(entry) || !Array.isArray(entry.hooks)) return [entry];
+					const siblings = entry.hooks.filter((candidate) => !isOwnHook(candidate));
+					if (siblings.length === entry.hooks.length) return [entry];
+					return siblings.length ? [{
+						...entry,
+						hooks: siblings
+					}] : [];
+				});
+				if (held) {
+					if (entries) nextHooks[event] = retained;
+				} else nextHooks[event] = [...retained, event === "SessionStart" ? {
+					matcher: "resume",
+					hooks: [hook]
+				} : { hooks: [hook] }];
+			}
+			const pendingEntries = hooks[PENDING_EVENT];
+			const pendingRetained = (pendingEntries ?? []).flatMap((entry) => {
 				if (!record$3(entry) || !Array.isArray(entry.hooks)) return [entry];
 				const siblings = entry.hooks.filter((candidate) => !isOwnPendingHook(candidate));
 				if (siblings.length === entry.hooks.length) return [entry];
@@ -36194,12 +36512,17 @@ function installClaudeWakeHook(options) {
 					...entry,
 					hooks: siblings
 				}] : [];
-			}), { hooks: [pendingHook] }];
+			});
+			if (held) {
+				if (pendingEntries) nextHooks[PENDING_EVENT] = pendingRetained;
+			} else nextHooks[PENDING_EVENT] = [...pendingRetained, { hooks: [pendingHook] }];
+			if (held && JSON.stringify(nextHooks) === JSON.stringify(hooks)) return null;
 			return {
 				...settings,
 				hooks: nextHooks
 			};
-		}) ? "installed_unverified" : "unavailable";
+		})) return "unavailable";
+		return held ? "held_for_other_profile" : "installed_unverified";
 	} catch {
 		return "unavailable";
 	}
@@ -39210,6 +39533,7 @@ function withDefined(defaults, overrides) {
 		...Object.fromEntries(Object.entries(overrides ?? {}).filter(([, value]) => value !== void 0))
 	};
 }
+const HELD_DETAIL = "This session already receives as another connected profile, so this profile's receive hooks were not added. Run `primitive machine doctor --fix --profile <profile>` to bind it deliberately.";
 const ENDED_DETAIL = "This session ended, so its agent was disconnected. A new address is never created for the same session.";
 const ENDED_PENDING_DETAIL = "This session ended, but disconnecting its agent has not been confirmed yet; `primitive machine doctor --fix` retries it.";
 /**
@@ -39328,14 +39652,19 @@ async function registerSession(options) {
 				agentInfo: seeded
 			} : current);
 		};
-		const installHook = (profile) => runtime !== "claude" || receiverMode(agentProfileDirectory(options.configDir, profileName)) !== "external" || deps.installClaudeHook({
-			cliPath: options.cliPath,
-			configDir: options.configDir,
-			profileName,
-			agentAddress: profile.agent_address,
-			sessionId,
-			env
-		}) === "installed_unverified";
+		const claudeHook = (agentAddress) => {
+			const outcome = deps.installClaudeHook({
+				cliPath: options.cliPath,
+				configDir: options.configDir,
+				profileName,
+				agentAddress,
+				sessionId,
+				env,
+				yieldToOtherProfiles: true
+			});
+			return outcome === "installed_unverified" ? "installed" : outcome === "held_for_other_profile" ? "held" : "failed";
+		};
+		const installHook = (profile) => runtime !== "claude" || receiverMode(agentProfileDirectory(options.configDir, profileName)) !== "external" ? "installed" : claudeHook(profile.agent_address);
 		const existing = loadConnectedAgentProfile(options.configDir, profileName);
 		if (existing) {
 			record = await updateSessionRecord(options.configDir, sessionId, (current) => current ?? newRecord("existing", existing.agent_address));
@@ -39369,7 +39698,7 @@ async function registerSession(options) {
 					...withAddress,
 					receiving: RECEIVING[runtime],
 					status: "already_registered",
-					detail: hooked ? "This session is already connected." : "This session is already connected, but its receive hook could not be installed. Run `primitive machine doctor`."
+					detail: hooked === "installed" ? "This session is already connected." : hooked === "held" ? HELD_DETAIL : "This session is already connected, but its receive hook could not be installed. Run `primitive machine doctor`."
 				};
 			}
 		} else if (record?.address && record.createdBy === "session-register" && !enrollmentAddress(options.configDir, profileName).exists || record?.createdBy === "existing") return {
@@ -39430,15 +39759,8 @@ async function registerSession(options) {
 		const address = result.identity.agentAddress;
 		const submitted = verificationReplySubmitted(result.verification.state);
 		const status = result.connection.status;
-		let hooked = true;
-		if (runtime === "claude" && submitted && status !== "owner_inactive") hooked = deps.installClaudeHook({
-			cliPath: options.cliPath,
-			configDir: options.configDir,
-			profileName,
-			agentAddress: address,
-			sessionId,
-			env
-		}) === "installed_unverified";
+		let hooked = "installed";
+		if (runtime === "claude" && submitted && status !== "owner_inactive") hooked = claudeHook(address);
 		if (status === "connected") await finishAgentInfo();
 		const withAddress = {
 			...known,
@@ -39448,7 +39770,7 @@ async function registerSession(options) {
 		if (status === "connected") return {
 			...withAddress,
 			status: "registered",
-			detail: hooked ? `Connected as ${address}.` : `Connected as ${address}, but the receive hook could not be installed. Run \`primitive machine doctor\`.`
+			detail: hooked === "installed" ? `Connected as ${address}.` : hooked === "held" ? `Connected as ${address}. ${HELD_DETAIL}` : `Connected as ${address}, but the receive hook could not be installed. Run \`primitive machine doctor\`.`
 		};
 		if (status === "revoked" || status === "owner_inactive") return {
 			...withAddress,
@@ -47192,7 +47514,7 @@ const PRIMITIVE_TEAM_AUTHOR = {
 	url: "https://primitive.dev"
 };
 const SDK_VERSION_RANGE = "^1.34.0";
-const CLI_VERSION_RANGE = "^1.43.0";
+const CLI_VERSION_RANGE = "^1.45.0";
 const ESBUILD_VERSION_RANGE = "^0.27.0";
 function renderHandler() {
 	return `// env.PRIMITIVE_API_KEY, env.PRIMITIVE_WEBHOOK_SECRET, and
@@ -54258,13 +54580,15 @@ async function runMachineDoctor(options) {
 		"claude.hook.stop"
 	];
 	const repairedAhead = /* @__PURE__ */ new Set();
+	const sessionHookChanges = [];
 	let settingsRead = readClaudeSettings(paths.claudeDir);
 	const hookContext = {
 		cli,
 		blocked: hookBlocked,
 		get bound() {
 			return boundSessionProfiles(options.configDir);
-		}
+		},
+		restoreProfiles: options.profiles
 	};
 	const hookCheck = (id) => ({
 		inspect: () => {
@@ -54275,22 +54599,28 @@ async function runMachineDoctor(options) {
 			return check(id, finding.status, finding.detail, {
 				fixable: finding.fixable,
 				path: join(paths.claudeDir, "settings.json"),
-				...finding.status === "fail" && !finding.fixable && hookBlocked ? { action: "install_cli" } : {}
+				...finding.status === "fail" && !finding.fixable && hookBlocked ? { action: "install_cli" } : {},
+				...finding.items?.length ? { items: finding.items.map((item) => options.fix && options.profiles ? {
+					...item,
+					selected: item.profile !== null && options.profiles.has(item.profile)
+				} : item) } : {},
+				...id === "claude.hook.stop" && sessionHookChanges.length ? { changes: [...sessionHookChanges] } : {}
 			});
 		},
 		repair: () => {
 			if (!settingsRead.ok) return false;
 			const findings = inspectClaudeHooks(settingsRead.settings, hookContext);
 			const ids = HOOK_CHECK_IDS.filter((hook) => (hook === id || !options.only || options.only.has(hook)) && findings[hook].status === "fail" && findings[hook].fixable);
-			const repaired = repairClaudeHooks(settingsRead.settings, hookContext, new Set(ids));
+			const repaired = repairClaudeHooks(settingsRead.settings, hookContext, new Set(ids), { profiles: options.profiles });
 			if (!repaired.changed.size) return false;
-			for (const hook of repaired.changed) repairedAhead.add(hook);
 			writeClaudeSettings({
 				claudeDir: paths.claudeDir,
 				read: settingsRead.read,
 				settings: repaired.settings,
 				now
 			});
+			sessionHookChanges.push(...repaired.changes);
+			for (const hook of repaired.changed) repairedAhead.add(hook);
 			settingsRead = readClaudeSettings(paths.claudeDir);
 			return repaired.changed.has(id);
 		}
@@ -54537,7 +54867,7 @@ async function runMachineDoctor(options) {
 					...after,
 					fixed: changed && after.status !== "fail"
 				};
-				if (changed && after.status === "fail") result.detail = `${after.detail} (A repair was applied but did not resolve this.)`;
+				if (changed && after.status === "fail") result.detail = id === "claude.hook.stop" && options.profiles ? `${after.detail} (Only the selected profiles were repaired.)` : `${after.detail} (A repair was applied but did not resolve this.)`;
 			} catch (error) {
 				result = {
 					...result,
@@ -54569,10 +54899,25 @@ async function runMachineDoctor(options) {
 }
 //#endregion
 //#region src/oclif/commands/machine-doctor.ts
+const ITEM_LINES = 10;
+/** At most `limit` indented lines, then "and N more". */
+function capped(lines, limit = ITEM_LINES) {
+	const shown = lines.slice(0, limit).map((line) => `    ${line}`);
+	if (lines.length > limit) shown.push(`    and ${lines.length - limit} more`);
+	return shown;
+}
 function renderCheck(check) {
 	const tag = check.status === "ok" ? "[OK]  " : check.status === "warn" ? "[WARN]" : check.status === "skip" ? "[SKIP]" : "[FAIL]";
 	const fixed = check.fixed ? " (fixed)" : "";
-	return `${tag} ${check.id}${fixed}: ${check.detail}`;
+	const lines = [`${tag} ${check.id}${fixed}: ${check.detail}`];
+	if (check.changes?.length) lines.push("  Changed:", ...capped(check.changes.map(describeSessionHookChange)));
+	if (check.status !== "ok" && check.items?.length) {
+		const selected = check.items.filter((item) => item.selected !== false);
+		const excluded = check.items.filter((item) => item.selected === false);
+		if (selected.length) lines.push(check.changes?.length ? "  Still needing repair:" : "  Would change:", ...capped(selected.map(describeSessionHookItem)));
+		if (excluded.length) lines.push("  Not selected (left unchanged by --profile):", ...capped(excluded.map(describeSessionHookItem)));
+	}
+	return lines.join("\n");
 }
 var MachineDoctorCommand = class MachineDoctorCommand extends Command {
 	static summary = "Check, and optionally repair, this machine's Primitive setup for coding agents";
@@ -54582,6 +54927,7 @@ var MachineDoctorCommand = class MachineDoctorCommand extends Command {
 		"<%= config.bin %> machine doctor --json",
 		"<%= config.bin %> machine doctor --fix --json",
 		"<%= config.bin %> machine doctor --fix --check claude.hook.stop --json",
+		"<%= config.bin %> machine doctor --fix --check claude.hook.stop --profile my-agent",
 		"<%= config.bin %> machine doctor --runtime claude,codex --min-cli-version 1.38.0 --json"
 	];
 	static flags = {
@@ -54591,6 +54937,10 @@ var MachineDoctorCommand = class MachineDoctorCommand extends Command {
 			multiple: true,
 			options: [...DOCTOR_CHECK_IDS]
 		}),
+		profile: Flags.string({
+			description: "With --fix, change per-session receive hooks only for this saved agent profile; repeatable. Naming a profile is also the only way --fix restores hooks for a profile bound to a session that already receives as another profile. Other checks are unaffected, so combine with --check claude.hook.stop to repair nothing else",
+			multiple: true
+		}),
 		runtime: Flags.string({ description: "Comma-separated runtimes to check: claude, codex, omp. Defaults to every runtime found on this machine" }),
 		"min-cli-version": Flags.string({ description: "Report cli.version as failing when this CLI is older than the given version" }),
 		json: Flags.boolean({ description: "Print the report as JSON" })
@@ -54605,9 +54955,11 @@ var MachineDoctorCommand = class MachineDoctorCommand extends Command {
 			runtimes = new Set(names);
 		}
 		if (flags.check?.length && !flags.fix) this.error("--check selects which checks --fix repairs; add --fix.", { exit: 2 });
+		if (flags.profile?.length && !flags.fix) this.error("--profile narrows what --fix repairs; add --fix.", { exit: 2 });
 		const report = await runMachineDoctor({
 			fix: flags.fix,
 			only: flags.check?.length ? new Set(flags.check) : void 0,
+			profiles: flags.profile?.length ? new Set(flags.profile) : void 0,
 			runtimes,
 			configDir: this.config.configDir,
 			home: homedir(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "primcli",
-  "version": "1.43.0",
+  "version": "1.45.0",
   "description": "Official Primitive CLI: deploy Primitive Functions, send and inspect mail, manage endpoints, all from the terminal. Wraps the @primitivedotdev/sdk runtime client with one-shot commands.",
   "type": "module",
   "sideEffects": false,