@coderule/mcp 1.1.0

package/dist/mcp-cli.js

@@ -0,0 +1,1905 @@
+import fs4 from 'fs/promises';
+import path from 'path';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { createHash } from 'crypto';
+import envPaths from 'env-paths';
+import pino from 'pino';
+import Database from 'better-sqlite3';
+import { Qulite, enqueueFsEvent, JobStatus } from '@coderule/qulite';
+import { CoderuleClients, ASTHttpClient, SyncHttpClient } from '@coderule/clients';
+import fs2 from 'fs';
+import { Worker } from 'worker_threads';
+import chokidar from 'chokidar';
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { z } from 'zod';
+
+// src/mcp-cli.ts
+var level = process.env.CODERULE_LOG_LEVEL ?? "info";
+var baseLogger = pino(
+  {
+    level,
+    name: "coderule-scanner",
+    timestamp: pino.stdTimeFunctions.isoTime
+  },
+  process.stderr
+);
+var logger = baseLogger;
+
+// src/config/Defaults.ts
+var DEFAULT_SNAPSHOT_DEBOUNCE_MS = 1e3;
+var DEFAULT_HEARTBEAT_INTERVAL_MS = 6e4;
+var DEFAULT_HEARTBEAT_CHECK_INTERVAL_MS = 5e3;
+var DEFAULT_QUEUE_POLL_INTERVAL_MS = 500;
+var DEFAULT_HASH_BATCH_SIZE = 32;
+var DEFAULT_MAX_SNAPSHOT_ATTEMPTS = 5;
+var DEFAULT_HTTP_TIMEOUT_MS = 3e4;
+
+// src/config/Configurator.ts
+var DEFAULT_RETRIEVAL_FORMATTER = "standard";
+var DEFAULTS = {
+  snapshotDebounceMs: DEFAULT_SNAPSHOT_DEBOUNCE_MS,
+  heartbeatIntervalMs: DEFAULT_HEARTBEAT_INTERVAL_MS,
+  heartbeatCheckIntervalMs: DEFAULT_HEARTBEAT_CHECK_INTERVAL_MS,
+  queuePollIntervalMs: DEFAULT_QUEUE_POLL_INTERVAL_MS,
+  hashBatchSize: DEFAULT_HASH_BATCH_SIZE,
+  maxSnapshotAttempts: DEFAULT_MAX_SNAPSHOT_ATTEMPTS
+};
+function normalizeRoot(root) {
+  const resolved = path.resolve(root);
+  const normalized = path.normalize(resolved);
+  return normalized.split(path.sep).join("/");
+}
+function sha256(input) {
+  return createHash("sha256").update(input).digest("hex");
+}
+function parseInteger(value, fallback) {
+  if (!value) return fallback;
+  const parsed = Number.parseInt(value, 10);
+  if (Number.isNaN(parsed) || parsed <= 0) {
+    throw new Error(`Invalid integer value: ${value}`);
+  }
+  return parsed;
+}
+function parseFormatter(value) {
+  if (!value) return DEFAULT_RETRIEVAL_FORMATTER;
+  const normalized = value.toLowerCase();
+  if (normalized === "standard" || normalized === "compact") {
+    return normalized;
+  }
+  throw new Error(
+    `Invalid CODERULE_RETRIEVAL_FORMATTER: ${value}. Expected "standard" or "compact"`
+  );
+}
+async function resolveConfig({
+  token
+}) {
+  const resolvedToken = token ?? process.env.CODERULE_TOKEN;
+  if (!resolvedToken) {
+    throw new Error(
+      "Missing token: provide params.token or CODERULE_TOKEN env"
+    );
+  }
+  const rootCandidate = process.env.CODERULE_ROOT || process.cwd();
+  const rootPath = path.resolve(rootCandidate);
+  const normalized = normalizeRoot(rootPath);
+  const rootId = sha256(normalized);
+  const dataDir = process.env.CODERULE_DATA_DIR || envPaths("coderule").data;
+  const watchDir = path.join(dataDir, "watch");
+  await fs4.mkdir(watchDir, { recursive: true });
+  const dbPath = path.join(watchDir, `${rootId}.sqlite`);
+  const baseConfig = {
+    token: resolvedToken,
+    rootPath,
+    rootId,
+    dbPath,
+    dataDir,
+    authBaseUrl: process.env.CODERULE_AUTH_URL,
+    astBaseUrl: process.env.CODERULE_AST_URL,
+    syncBaseUrl: process.env.CODERULE_SYNC_URL,
+    retrievalBaseUrl: process.env.CODERULE_RETRIEVAL_URL,
+    httpTimeout: void 0,
+    snapshotDebounceMs: DEFAULTS.snapshotDebounceMs,
+    heartbeatIntervalMs: DEFAULTS.heartbeatIntervalMs,
+    heartbeatCheckIntervalMs: DEFAULTS.heartbeatCheckIntervalMs,
+    queuePollIntervalMs: DEFAULTS.queuePollIntervalMs,
+    hashBatchSize: DEFAULTS.hashBatchSize,
+    maxSnapshotAttempts: DEFAULTS.maxSnapshotAttempts,
+    retrievalFormatter: parseFormatter(
+      process.env.CODERULE_RETRIEVAL_FORMATTER
+    )
+  };
+  if (process.env.CODERULE_SNAPSHOT_DEBOUNCE_MS) {
+    baseConfig.snapshotDebounceMs = parseInteger(
+      process.env.CODERULE_SNAPSHOT_DEBOUNCE_MS,
+      baseConfig.snapshotDebounceMs
+    );
+  }
+  if (process.env.CODERULE_HEARTBEAT_INTERVAL_MS) {
+    baseConfig.heartbeatIntervalMs = parseInteger(
+      process.env.CODERULE_HEARTBEAT_INTERVAL_MS,
+      baseConfig.heartbeatIntervalMs
+    );
+  }
+  if (process.env.CODERULE_HEARTBEAT_CHECK_INTERVAL_MS) {
+    baseConfig.heartbeatCheckIntervalMs = parseInteger(
+      process.env.CODERULE_HEARTBEAT_CHECK_INTERVAL_MS,
+      baseConfig.heartbeatCheckIntervalMs
+    );
+  }
+  if (process.env.CODERULE_QUEUE_POLL_INTERVAL_MS) {
+    baseConfig.queuePollIntervalMs = parseInteger(
+      process.env.CODERULE_QUEUE_POLL_INTERVAL_MS,
+      baseConfig.queuePollIntervalMs
+    );
+  }
+  if (process.env.CODERULE_HASH_BATCH_SIZE) {
+    baseConfig.hashBatchSize = parseInteger(
+      process.env.CODERULE_HASH_BATCH_SIZE,
+      baseConfig.hashBatchSize
+    );
+  }
+  if (process.env.CODERULE_MAX_SNAPSHOT_ATTEMPTS) {
+    baseConfig.maxSnapshotAttempts = parseInteger(
+      process.env.CODERULE_MAX_SNAPSHOT_ATTEMPTS,
+      baseConfig.maxSnapshotAttempts
+    );
+  }
+  baseConfig.httpTimeout = parseInteger(
+    process.env.CODERULE_HTTP_TIMEOUT,
+    DEFAULT_HTTP_TIMEOUT_MS
+  );
+  logger.debug(
+    {
+      rootPath,
+      dbPath,
+      dataDir,
+      authBaseUrl: baseConfig.authBaseUrl,
+      astBaseUrl: baseConfig.astBaseUrl,
+      syncBaseUrl: baseConfig.syncBaseUrl
+    },
+    "Resolved configuration"
+  );
+  return baseConfig;
+}
+
+// src/db/Schema.ts
+var FILES_SCHEMA = `
+CREATE TABLE IF NOT EXISTS files (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  rel_path TEXT NOT NULL,
+  display_path TEXT NOT NULL,
+  size INTEGER NOT NULL,
+  mtime_ns INTEGER NOT NULL,
+  mode INTEGER,
+  ino TEXT,
+  dev TEXT,
+  is_symlink INTEGER NOT NULL DEFAULT 0,
+  target TEXT,
+  content_sha256 TEXT,
+  service_file_hash TEXT,
+  last_seen_ts INTEGER NOT NULL,
+  hash_state TEXT NOT NULL,
+  hash_owner TEXT,
+  hash_lease_expires_at INTEGER,
+  hash_started_at INTEGER,
+  UNIQUE(rel_path)
+);
+CREATE INDEX IF NOT EXISTS idx_files_hash_state ON files(hash_state);
+CREATE INDEX IF NOT EXISTS idx_files_content_sha ON files(content_sha256);
+CREATE INDEX IF NOT EXISTS idx_files_service_hash ON files(service_file_hash);
+`;
+var SNAPSHOTS_SCHEMA = `
+CREATE TABLE IF NOT EXISTS snapshots (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  snapshot_hash TEXT NOT NULL,
+  files_count INTEGER NOT NULL,
+  total_size INTEGER NOT NULL,
+  created_at INTEGER NOT NULL
+);
+`;
+
+// src/db/Database.ts
+function safeAlter(db, sql) {
+  try {
+    db.exec(sql);
+  } catch (error) {
+    if (typeof error?.message === "string" && error.message.includes("duplicate column name")) {
+      return;
+    }
+    throw error;
+  }
+}
+function applyMigrations(db, logger2) {
+  const alterations = [
+    "ALTER TABLE files ADD COLUMN hash_owner TEXT",
+    "ALTER TABLE files ADD COLUMN hash_lease_expires_at INTEGER",
+    "ALTER TABLE files ADD COLUMN hash_started_at INTEGER"
+  ];
+  for (const sql of alterations) {
+    try {
+      safeAlter(db, sql);
+    } catch (error) {
+      logger2.error({ err: error, sql }, "Database migration failed");
+      throw error;
+    }
+  }
+  db.exec(
+    "CREATE INDEX IF NOT EXISTS idx_files_hash_lease ON files(hash_state, hash_lease_expires_at)"
+  );
+}
+function openDatabase(dbPath, logger2) {
+  const db = new Database(dbPath, { verbose: void 0 });
+  logger2.info({ dbPath }, "Opened SQLite database");
+  db.pragma("journal_mode = WAL");
+  db.pragma("synchronous = NORMAL");
+  db.pragma("busy_timeout = 5000");
+  db.pragma("foreign_keys = ON");
+  db.exec("BEGIN");
+  try {
+    db.exec(FILES_SCHEMA);
+    db.exec(SNAPSHOTS_SCHEMA);
+    db.exec("COMMIT");
+  } catch (error) {
+    db.exec("ROLLBACK");
+    db.close();
+    throw error;
+  }
+  applyMigrations(db, logger2);
+  return db;
+}
+
+// src/db/FilesRepo.ts
+var FilesRepo = class {
+  constructor(db) {
+    this.db = db;
+    this.selectByRelPath = this.db.prepare(
+      "SELECT * FROM files WHERE rel_path = ?"
+    );
+    this.insertStmt = this.db.prepare(
+      `INSERT INTO files (
+      rel_path,
+      display_path,
+      size,
+      mtime_ns,
+      mode,
+      ino,
+      dev,
+      is_symlink,
+      target,
+      content_sha256,
+      service_file_hash,
+      last_seen_ts,
+      hash_state,
+      hash_owner,
+      hash_lease_expires_at,
+      hash_started_at
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, NULL, ?, ?, NULL, NULL, NULL)`
+    );
+    this.updateStmt = this.db.prepare(
+      `UPDATE files SET
+      display_path = ?,
+      size = ?,
+      mtime_ns = ?,
+      mode = ?,
+      ino = ?,
+      dev = ?,
+      is_symlink = ?,
+      target = ?,
+      content_sha256 = ?,
+      service_file_hash = ?,
+      last_seen_ts = ?,
+      hash_state = ?,
+      hash_owner = CASE WHEN ? = 'hashing' THEN hash_owner ELSE NULL END,
+      hash_lease_expires_at = CASE WHEN ? = 'hashing' THEN hash_lease_expires_at ELSE NULL END,
+      hash_started_at = CASE WHEN ? = 'hashing' THEN hash_started_at ELSE NULL END
+    WHERE id = ?`
+    );
+    this.markMissingStmt = this.db.prepare(
+      `UPDATE files
+     SET hash_state = 'missing', content_sha256 = NULL, service_file_hash = NULL, last_seen_ts = ?,
+         hash_owner = NULL, hash_lease_expires_at = NULL, hash_started_at = NULL
+     WHERE rel_path = ?`
+    );
+    this.markMissingPrefixStmt = this.db.prepare(
+      `UPDATE files
+     SET hash_state = 'missing', content_sha256 = NULL, service_file_hash = NULL,
+         hash_owner = NULL, hash_lease_expires_at = NULL, hash_started_at = NULL
+     WHERE (rel_path = ? OR rel_path LIKE (? || '/%')) AND hash_state != 'missing'`
+    );
+    this.markDirtyStmt = this.db.prepare(
+      `UPDATE files
+     SET hash_state = 'dirty', last_seen_ts = ?,
+         hash_owner = NULL, hash_lease_expires_at = NULL, hash_started_at = NULL
+     WHERE rel_path = ?`
+    );
+    this.claimDirtyStmt = this.db.prepare(
+      `WITH candidates AS (
+       SELECT id
+       FROM files
+       WHERE hash_state = 'dirty'
+       ORDER BY last_seen_ts ASC, id ASC
+       LIMIT @limit
+     )
+     UPDATE files
+     SET hash_state = 'hashing',
+         hash_owner = @owner,
+         hash_lease_expires_at = @lease_expires_at,
+         hash_started_at = @now
+     WHERE id IN candidates
+     RETURNING *`
+    );
+    this.markDirtyByIdStmt = this.db.prepare(
+      `UPDATE files
+     SET hash_state = 'dirty', hash_owner = NULL, hash_lease_expires_at = NULL, hash_started_at = NULL
+     WHERE id = ?`
+    );
+    this.applyHashesStmt = this.db.prepare(
+      `UPDATE files
+     SET content_sha256 = ?, service_file_hash = ?, hash_state = 'clean',
+         hash_owner = NULL, hash_lease_expires_at = NULL, hash_started_at = NULL
+     WHERE id = ?`
+    );
+    this.requeueExpiredHashingStmt = this.db.prepare(
+      `UPDATE files
+     SET hash_state = 'dirty', hash_owner = NULL, hash_lease_expires_at = NULL, hash_started_at = NULL
+     WHERE hash_state = 'hashing'
+       AND hash_lease_expires_at IS NOT NULL
+       AND hash_lease_expires_at <= ?`
+    );
+    this.resetHashingStmt = this.db.prepare(
+      `UPDATE files
+     SET hash_state = 'dirty', hash_owner = NULL, hash_lease_expires_at = NULL, hash_started_at = NULL
+     WHERE hash_state = 'hashing'`
+    );
+    this.selectCleanSnapshotStmt = this.db.prepare(
+      `SELECT rel_path, service_file_hash, size
+     FROM files
+     WHERE hash_state = 'clean' AND service_file_hash IS NOT NULL
+     ORDER BY rel_path ASC`
+    );
+    this.totalsStmt = this.db.prepare(
+      `SELECT COUNT(*) AS files_count, COALESCE(SUM(size), 0) AS total_size
+     FROM files
+     WHERE hash_state = 'clean' AND service_file_hash IS NOT NULL`
+    );
+    this.markMissingBeforeStmt = this.db.prepare(
+      `UPDATE files
+     SET hash_state = 'missing', content_sha256 = NULL, service_file_hash = NULL,
+         hash_owner = NULL, hash_lease_expires_at = NULL, hash_started_at = NULL
+     WHERE last_seen_ts < ? AND hash_state != 'missing'`
+    );
+    this.countByStateStmt = this.db.prepare(
+      "SELECT COUNT(*) as count FROM files WHERE hash_state = ?"
+    );
+  }
+  getByRelPath(relPath) {
+    return this.selectByRelPath.get(relPath);
+  }
+  upsertFromStat(params) {
+    const now = Date.now();
+    const { relPath, displayPath, stats, isSymlink, symlinkTarget } = params;
+    const existing = this.getByRelPath(relPath);
+    const mtimeNs = Math.trunc(stats.mtimeMs * 1e6);
+    const ino = typeof stats.ino === "number" ? String(stats.ino) : null;
+    const dev = typeof stats.dev === "number" ? String(stats.dev) : null;
+    const mode = typeof stats.mode === "number" ? stats.mode : null;
+    const isSymlinkInt = isSymlink ? 1 : 0;
+    if (!existing) {
+      this.insertStmt.run(
+        relPath,
+        displayPath,
+        stats.size,
+        mtimeNs,
+        mode,
+        ino,
+        dev,
+        isSymlinkInt,
+        symlinkTarget,
+        now,
+        "dirty"
+      );
+      return "dirty";
+    }
+    let nextState = existing.hash_state;
+    let nextContent = existing.content_sha256;
+    let nextServiceHash = existing.service_file_hash;
+    const changed = existing.size !== stats.size || existing.mtime_ns !== mtimeNs || existing.mode !== mode || existing.ino !== ino || existing.dev !== dev || existing.is_symlink !== isSymlinkInt || existing.target !== symlinkTarget;
+    if (changed || existing.hash_state === "missing") {
+      nextState = "dirty";
+      nextContent = null;
+      nextServiceHash = null;
+    }
+    this.updateStmt.run(
+      displayPath,
+      stats.size,
+      mtimeNs,
+      mode,
+      ino,
+      dev,
+      isSymlinkInt,
+      symlinkTarget,
+      nextContent,
+      nextServiceHash,
+      now,
+      nextState,
+      nextState,
+      nextState,
+      nextState,
+      existing.id
+    );
+    return nextState;
+  }
+  markMissing(relPath) {
+    const now = Date.now();
+    const result = this.markMissingStmt.run(now, relPath);
+    return result.changes ?? 0;
+  }
+  markMissingByPrefix(prefix) {
+    const result = this.markMissingPrefixStmt.run(prefix, prefix);
+    return result.changes ?? 0;
+  }
+  markDirty(relPath) {
+    const now = Date.now();
+    this.markDirtyStmt.run(now, relPath);
+  }
+  markMissingBefore(timestamp) {
+    const result = this.markMissingBeforeStmt.run(timestamp);
+    return result.changes ?? 0;
+  }
+  claimDirty(limit, owner, leaseMs) {
+    if (limit <= 0) {
+      return [];
+    }
+    const now = Date.now();
+    return this.claimDirtyStmt.all({
+      limit,
+      owner,
+      lease_expires_at: now + leaseMs,
+      now
+    });
+  }
+  markDirtyByIds(ids) {
+    if (!ids.length) return;
+    const tx = this.db.transaction((batch) => {
+      for (const id of batch) {
+        this.markDirtyByIdStmt.run(id);
+      }
+    });
+    tx(ids);
+  }
+  applyHashResults(results) {
+    if (!results.length) return;
+    const tx = this.db.transaction((batch) => {
+      for (const { id, contentSha256, serviceFileHash } of batch) {
+        this.applyHashesStmt.run(contentSha256, serviceFileHash, id);
+      }
+    });
+    tx(results);
+  }
+  getCleanFilesForSnapshot() {
+    return this.selectCleanSnapshotStmt.all();
+  }
+  getTotalsForSnapshot() {
+    const row = this.totalsStmt.get();
+    return {
+      filesCount: row?.files_count ?? 0,
+      totalSize: row?.total_size ?? 0
+    };
+  }
+  countByState(state) {
+    const row = this.countByStateStmt.get(state);
+    return row?.count ?? 0;
+  }
+  requeueExpiredHashing(now) {
+    const result = this.requeueExpiredHashingStmt.run(now);
+    return result.changes ?? 0;
+  }
+  resetHashingStates() {
+    const result = this.resetHashingStmt.run();
+    return result.changes ?? 0;
+  }
+};
+
+// src/db/SnapshotsRepo.ts
+var SnapshotsRepo = class {
+  constructor(db) {
+    this.db = db;
+    this.insertStmt = this.db.prepare(
+      `INSERT INTO snapshots (snapshot_hash, files_count, total_size, created_at)
+     VALUES (?, ?, ?, ?)`
+    );
+    this.selectLatestStmt = this.db.prepare(
+      `SELECT * FROM snapshots ORDER BY created_at DESC LIMIT 1`
+    );
+  }
+  insert(snapshotHash, filesCount, totalSize, createdAt) {
+    this.insertStmt.run(snapshotHash, filesCount, totalSize, createdAt);
+  }
+  getLatest() {
+    return this.selectLatestStmt.get();
+  }
+};
+var Outbox = class {
+  constructor(db, logger2) {
+    this.log = logger2.child({ scope: "outbox" });
+    this.queue = new Qulite(db, {
+      logger: this.log,
+      defaultLeaseMs: 3e4,
+      defaultMaxAttempts: 10
+    });
+    this.markKindStmt = db.prepare(
+      `UPDATE qulite_jobs SET kind = @kind WHERE dedupe_key = @dedupe_key`
+    );
+    this.purgeLegacyStmt = db.prepare(
+      `DELETE FROM qulite_jobs WHERE type = 'fs_control' AND (kind IS NULL OR kind = '')`
+    );
+    const purged = this.purgeLegacyStmt.run().changes ?? 0;
+    if (purged > 0) {
+      this.log.warn({ purged }, "Purged legacy fs_control jobs without kind");
+    }
+  }
+  getQueue() {
+    return this.queue;
+  }
+  markKind(dedupeKey, kind) {
+    this.markKindStmt.run({ dedupe_key: dedupeKey, kind });
+  }
+  enqueueSnapshot(rootId, delayMs = 0) {
+    const result = enqueueFsEvent(this.queue, {
+      root_id: rootId,
+      rel_path: "",
+      kind: "snapshot",
+      delayMs,
+      maxAttempts: 20,
+      data: { root_id: rootId, kind: "snapshot" }
+    });
+    this.markKind(`snapshot:${rootId}`, "snapshot");
+    if (result.changes > 0) {
+      this.log.debug({ rootId }, "Enqueued snapshot job");
+    }
+  }
+  enqueueHeartbeat(rootId, delayMs = 0) {
+    const result = enqueueFsEvent(this.queue, {
+      root_id: rootId,
+      rel_path: "",
+      kind: "heartbeat",
+      delayMs,
+      maxAttempts: 5,
+      data: { root_id: rootId, kind: "heartbeat" }
+    });
+    this.markKind(`heartbeat:${rootId}`, "heartbeat");
+    if (result.changes > 0) {
+      this.log.debug({ rootId }, "Enqueued heartbeat job");
+    }
+  }
+  claimFsControlJob(leaseOwner, leaseMs = 3e4) {
+    return this.queue.claimNext({ type: "fs_control", leaseOwner, leaseMs });
+  }
+  ack(jobId, leaseOwner) {
+    return this.queue.ack(jobId, leaseOwner);
+  }
+  retry(jobId, leaseOwner, delayMs) {
+    return this.queue.retry(jobId, leaseOwner, delayMs);
+  }
+  fail(jobId, leaseOwner, error) {
+    return this.queue.fail(jobId, leaseOwner, error);
+  }
+  requeueTimedOut() {
+    return this.queue.requeueTimedOut();
+  }
+};
+function serviceConfig(baseUrl, timeout) {
+  if (baseUrl === void 0 && timeout === void 0) {
+    return void 0;
+  }
+  const config = {};
+  if (baseUrl !== void 0) {
+    config.baseUrl = baseUrl;
+  }
+  if (timeout !== void 0) {
+    config.timeout = timeout;
+  }
+  return config;
+}
+function createClients(config, logger2) {
+  const clientLogger = logger2.child({ scope: "clients" });
+  const httpTimeout = config.httpTimeout;
+  const clients = new CoderuleClients({
+    token: config.token,
+    auth: serviceConfig(config.authBaseUrl, httpTimeout),
+    ast: serviceConfig(config.astBaseUrl, httpTimeout),
+    sync: serviceConfig(config.syncBaseUrl, httpTimeout),
+    retrieval: serviceConfig(config.retrievalBaseUrl, httpTimeout),
+    jwtFactory: {
+      onTokenRefreshed: (info) => {
+        clientLogger.debug(
+          {
+            expiresAt: new Date(info.expiresAt).toISOString(),
+            serverUrl: info.serverUrl
+          },
+          "JWT refreshed"
+        );
+      }
+    }
+  });
+  return clients;
+}
+
+// src/rules/RulesFetcher.ts
+async function fetchVisitorRules(clients, logger2) {
+  const fetchLogger = logger2.child({ scope: "rules" });
+  fetchLogger.info("Fetching visitor rules v2 from AST service");
+  const rules = await clients.ast.getVisitorRulesV2();
+  fetchLogger.info(
+    {
+      include_extensions: rules.include_extensions.length,
+      include_filenames: rules.include_filenames.length,
+      exclude_dirnames: rules.exclude_dirnames.length
+    },
+    "Fetched visitor rules"
+  );
+  return rules;
+}
+function toPosix(input) {
+  return input.split(path.sep).join("/");
+}
+function getLowerBasename(input) {
+  const base = input.split("/").pop();
+  return (base ?? "").toLowerCase();
+}
+function getLowerExt(basename) {
+  const idx = basename.lastIndexOf(".");
+  if (idx < 0) return "";
+  return basename.slice(idx).toLowerCase();
+}
+function compileRulesBundle(rules) {
+  const compiled = ASTHttpClient.compileRulesV2(rules);
+  const basePredicate = ASTHttpClient.buildIgnoredPredicate(compiled);
+  const predicate = (fullPath, stats) => {
+    let info = stats;
+    if (!info) {
+      logger.debug({ path: fullPath }, "Predicate fallback lstat");
+      try {
+        info = fs2.lstatSync(fullPath);
+      } catch (error) {
+        logger.warn(
+          { err: error, path: fullPath },
+          "Failed to lstat path for rules predicate"
+        );
+        return false;
+      }
+    }
+    return basePredicate(fullPath, info);
+  };
+  return {
+    rules,
+    compiled,
+    predicate
+  };
+}
+function shouldIncludeFile(relPath, stats, bundle) {
+  if (stats.isDirectory()) return false;
+  const posixRel = toPosix(relPath);
+  if (bundle.compiled.dirRe.test(posixRel)) {
+    return false;
+  }
+  const basename = getLowerBasename(posixRel);
+  if (bundle.compiled.names.has(basename)) {
+    return true;
+  }
+  const ext = getLowerExt(basename);
+  return bundle.compiled.exts.has(ext);
+}
+function shouldPruneDirectory(relPath, bundle) {
+  const posixRel = toPosix(relPath);
+  return bundle.compiled.dirRe.test(posixRel);
+}
+function buildWatcherIgnored(bundle) {
+  return (fullPath, stats) => bundle.predicate(fullPath, stats);
+}
+var HashWorker = class {
+  constructor(logger2) {
+    this.pending = /* @__PURE__ */ new Map();
+    this.nextTaskId = 1;
+    this.terminating = false;
+    this.log = logger2.child({ scope: "hash-worker" });
+    const workerUrl = new URL("./hash/WorkerThread.js", import.meta.url);
+    const execArgv = process.execArgv.filter(
+      (arg) => !arg.startsWith("--input-type")
+    );
+    const workerOptions = {
+      name: "coderule-hasher",
+      execArgv
+    };
+    if (workerUrl.pathname.endsWith(".js")) {
+      workerOptions.type = "module";
+    }
+    this.worker = new Worker(workerUrl, workerOptions);
+    this.worker.on(
+      "message",
+      (message) => this.onMessage(message)
+    );
+    this.worker.on("error", (error) => this.handleWorkerError(error));
+    this.worker.on("exit", (code) => {
+      if (code !== 0 && !this.terminating) {
+        this.handleWorkerError(
+          new Error(`Hasher worker exited with code ${code}`)
+        );
+      }
+    });
+  }
+  async terminate() {
+    this.terminating = true;
+    for (const [, pending] of this.pending) {
+      pending.reject(new Error("Hasher worker terminated"));
+    }
+    this.pending.clear();
+    await this.worker.terminate();
+  }
+  onMessage(message) {
+    const pending = this.pending.get(message.taskId);
+    if (!pending) {
+      this.log.warn(
+        { taskId: message.taskId },
+        "Received message for unknown task"
+      );
+      return;
+    }
+    this.pending.delete(message.taskId);
+    if (message.type === "hash-result") {
+      pending.resolve({
+        contentSha256: message.contentSha256,
+        serviceFileHash: message.serviceFileHash
+      });
+    } else {
+      const error = new Error(message.error);
+      error.code = message.code;
+      pending.reject(error);
+    }
+  }
+  handleWorkerError(error) {
+    this.log.error({ err: error }, "Hasher worker error");
+    for (const [, pending] of this.pending) {
+      pending.reject(error);
+    }
+    this.pending.clear();
+  }
+  compute(absPath, relPath) {
+    const taskId = this.nextTaskId++;
+    const payload = {
+      type: "hash",
+      taskId,
+      absPath,
+      relPath
+    };
+    return new Promise((resolve, reject) => {
+      this.pending.set(taskId, { resolve, reject });
+      this.worker.postMessage(payload);
+    });
+  }
+};
+var Hasher = class {
+  constructor(options) {
+    this.options = options;
+    this.worker = null;
+    this.log = options.logger.child({ scope: "hasher" });
+    this.inlineMode = process.env.CODERULE_HASHER_INLINE === "1";
+    this.ownerId = `hasher-${process.pid}-${Date.now()}`;
+    const leaseFromEnv = process.env.CODERULE_HASH_LEASE_MS ? Number.parseInt(process.env.CODERULE_HASH_LEASE_MS, 10) : Number.NaN;
+    this.leaseDurationMs = Number.isFinite(leaseFromEnv) && leaseFromEnv > 0 ? leaseFromEnv : 3e4;
+    if (!this.inlineMode) {
+      try {
+        this.worker = new HashWorker(this.log);
+      } catch (error) {
+        this.log.warn(
+          { err: error },
+          "Failed to start hasher worker, falling back to inline hashing"
+        );
+        this.worker = null;
+        this.inlineMode = true;
+      }
+    }
+  }
+  async close() {
+    if (this.worker) {
+      await this.worker.terminate();
+    }
+  }
+  resolveAbsolutePath(record) {
+    if (path.isAbsolute(record.display_path)) {
+      return record.display_path;
+    }
+    return path.join(this.options.rootPath, record.rel_path);
+  }
+  async ensureExists(absPath, record) {
+    try {
+      await fs4.access(absPath);
+      return true;
+    } catch (error) {
+      this.log.warn(
+        { err: error, relPath: record.rel_path },
+        "File missing before hashing"
+      );
+      this.options.filesRepo.markMissing(record.rel_path);
+      return false;
+    }
+  }
+  async computeHash(absPath, relPath) {
+    if (this.inlineMode || !this.worker) {
+      return this.hashInline(absPath, relPath);
+    }
+    return this.worker.compute(absPath, relPath);
+  }
+  async hashInline(absPath, relPath) {
+    return new Promise((resolve, reject) => {
+      const content = createHash("sha256");
+      const service = createHash("sha256");
+      service.update(relPath);
+      service.update("\n");
+      const stream = fs2.createReadStream(absPath);
+      stream.on("data", (chunk) => {
+        content.update(chunk);
+        service.update(chunk);
+      });
+      stream.on("error", (error) => {
+        reject(error);
+      });
+      stream.on("end", () => {
+        resolve({
+          contentSha256: content.digest("hex"),
+          serviceFileHash: service.digest("hex")
+        });
+      });
+    });
+  }
+  async processBatch(limit) {
+    const now = Date.now();
+    const requeued = this.options.filesRepo.requeueExpiredHashing(now);
+    if (requeued > 0) {
+      this.log.debug({ requeued }, "Requeued expired hashing leases");
+    }
+    const dirty = this.options.filesRepo.claimDirty(
+      limit,
+      this.ownerId,
+      this.leaseDurationMs
+    );
+    if (dirty.length > 0) {
+      this.log.debug({ count: dirty.length }, "Hashing claimed files");
+    }
+    if (dirty.length === 0) {
+      return false;
+    }
+    const successes = [];
+    const failures = [];
+    for (const record of dirty) {
+      const absPath = this.resolveAbsolutePath(record);
+      const exists = await this.ensureExists(absPath, record);
+      if (!exists) {
+        continue;
+      }
+      try {
+        const result = await this.computeHash(absPath, record.rel_path);
+        successes.push({
+          id: record.id,
+          contentSha256: result.contentSha256,
+          serviceFileHash: result.serviceFileHash
+        });
+      } catch (error) {
+        if (error?.code === "ENOENT") {
+          this.log.debug(
+            { relPath: record.rel_path },
+            "File disappeared during hashing"
+          );
+          this.options.filesRepo.markMissing(record.rel_path);
+        } else {
+          this.log.warn(
+            { err: error, relPath: record.rel_path },
+            "Failed to hash file"
+          );
+          failures.push(record.id);
+        }
+      }
+    }
+    if (successes.length) {
+      this.log.debug({ count: successes.length }, "Hashing succeeded");
+      this.options.filesRepo.applyHashResults(successes);
+    }
+    if (failures.length) {
+      this.log.warn({ count: failures.length }, "Hashing failed for files");
+      this.options.filesRepo.markDirtyByIds(failures);
+    }
+    return true;
+  }
+};
+
+// src/service/Bootstrap.ts
+function createServiceLogger() {
+  return logger.child({ scope: "service" });
+}
+async function bootstrap(params) {
+  const config = await resolveConfig(params);
+  const logger2 = createServiceLogger();
+  const db = openDatabase(config.dbPath, logger2.child({ scope: "db" }));
+  const filesRepo = new FilesRepo(db);
+  const recovered = filesRepo.resetHashingStates();
+  if (recovered > 0) {
+    logger2.info({ recovered }, "Recovered lingering hashing leases");
+  }
+  const snapshotsRepo = new SnapshotsRepo(db);
+  const outbox = new Outbox(db, logger2);
+  const clients = createClients(config, logger2);
+  const rules = await fetchVisitorRules(clients, logger2);
+  const compiled = compileRulesBundle(rules);
+  const hasher = new Hasher({ rootPath: config.rootPath, filesRepo, logger: logger2 });
+  const runtime = {
+    config,
+    logger: logger2,
+    db,
+    outbox,
+    clients,
+    rules: compiled,
+    filesRepo,
+    snapshotsRepo,
+    hasher
+  };
+  return runtime;
+}
+function toPosixRelative(root, target) {
+  const rel = path.relative(root, target);
+  if (!rel || rel === "") return "";
+  return rel.split(path.sep).join("/");
+}
+function isInsideRoot(root, target) {
+  const rel = path.relative(root, target);
+  return rel === "" || !rel.startsWith("..") && !path.isAbsolute(rel);
+}
+
+// src/fs/Walker.ts
+var EMPTY_STATS = {
+  processed: 0,
+  skipped: 0,
+  dirtied: 0,
+  missing: 0
+};
+function cloneStats(stats) {
+  return { ...stats };
+}
+async function readSymlinkTarget(absPath, log) {
+  try {
+    return await fs4.readlink(absPath);
+  } catch (error) {
+    log.warn({ err: error, path: absPath }, "Failed to read symlink target");
+    return null;
+  }
+}
+async function walkDirectory(current, opts, stats) {
+  const dirLogger = opts.logger;
+  let dirents;
+  try {
+    dirents = await fs4.readdir(current, { withFileTypes: true });
+  } catch (error) {
+    dirLogger.warn({ err: error, path: current }, "Failed to read directory");
+    return;
+  }
+  for (const dirent of dirents) {
+    const absPath = path.join(current, dirent.name);
+    const relPath = toPosixRelative(opts.rootPath, absPath);
+    if (dirent.isDirectory()) {
+      if (shouldPruneDirectory(relPath, opts.bundle)) {
+        stats.skipped += 1;
+        continue;
+      }
+      await walkDirectory(absPath, opts, stats);
+      continue;
+    }
+    if (dirent.isSymbolicLink() || dirent.isFile()) {
+      let stat;
+      try {
+        stat = await fs4.lstat(absPath);
+      } catch (error) {
+        dirLogger.warn({ err: error, path: absPath }, "Failed to stat file");
+        continue;
+      }
+      stats.processed += 1;
+      if (!shouldIncludeFile(relPath, stat, opts.bundle)) {
+        stats.skipped += 1;
+        continue;
+      }
+      const target = dirent.isSymbolicLink() ? await readSymlinkTarget(absPath, dirLogger) : null;
+      const state = opts.filesRepo.upsertFromStat({
+        relPath,
+        displayPath: absPath,
+        stats: stat,
+        isSymlink: dirent.isSymbolicLink(),
+        symlinkTarget: target
+      });
+      if (state === "dirty") {
+        stats.dirtied += 1;
+      }
+      continue;
+    }
+    stats.skipped += 1;
+  }
+}
+async function runInventory(opts) {
+  const stats = cloneStats(EMPTY_STATS);
+  const startedAt = Date.now();
+  await walkDirectory(opts.rootPath, opts, stats);
+  const missing = opts.filesRepo.markMissingBefore(startedAt);
+  stats.missing = missing;
+  opts.logger.info({ ...stats }, "Completed initial inventory");
+  return stats;
+}
+async function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function computeSnapshot(filesRepo) {
+  const files = filesRepo.getCleanFilesForSnapshot();
+  const hashes = files.map((file) => file.service_file_hash).filter((hash) => typeof hash === "string");
+  const snapshotHash = SyncHttpClient.calculateSnapshotHash([...hashes].sort());
+  const { filesCount, totalSize } = filesRepo.getTotalsForSnapshot();
+  return {
+    snapshotHash,
+    files: files.map((file) => ({
+      file_path: file.rel_path,
+      file_hash: file.service_file_hash
+    })),
+    filesCount,
+    totalSize
+  };
+}
+async function uploadMissing(rootPath, missing, syncClient, logger2) {
+  if (!missing || missing.length === 0) return;
+  const map = /* @__PURE__ */ new Map();
+  for (const missingFile of missing) {
+    const absPath = path.join(rootPath, missingFile.file_path);
+    try {
+      const buffer = await fs4.readFile(absPath);
+      map.set(missingFile.file_hash, {
+        path: missingFile.file_path,
+        content: buffer
+      });
+    } catch (error) {
+      logger2.warn(
+        { err: error, relPath: missingFile.file_path },
+        "Failed to read missing file content"
+      );
+    }
+  }
+  if (map.size === 0) return;
+  await syncClient.uploadFileContent(map);
+}
+async function ensureSnapshotCreated(rootPath, computation, syncClient, logger2) {
+  const { snapshotHash, files } = computation;
+  let status = await syncClient.checkSnapshotStatus(snapshotHash);
+  if (status.status === "READY") {
+    logger2.info({ snapshotHash }, "Snapshot already READY");
+    return;
+  }
+  if (status.status === "NOT_FOUND" || status.status === "MISSING_CONTENT") {
+    status = await syncClient.createSnapshot(snapshotHash, files);
+  }
+  if (status.status === "MISSING_CONTENT" && status.missing_files?.length) {
+    logger2.info(
+      { missing: status.missing_files.length },
+      "Uploading missing file content"
+    );
+    await uploadMissing(rootPath, status.missing_files, syncClient, logger2);
+    status = await syncClient.createSnapshot(snapshotHash, files);
+  }
+  let attempt = 0;
+  while (status.status !== "READY") {
+    if (status.status === "FAILED") {
+      throw new Error(`Snapshot failed processing: ${JSON.stringify(status)}`);
+    }
+    const delay = Math.min(5e3, 1e3 * Math.max(1, 2 ** attempt));
+    await sleep(delay);
+    attempt += 1;
+    status = await syncClient.checkSnapshotStatus(snapshotHash);
+  }
+  logger2.info({ snapshotHash }, "Snapshot READY");
+}
+async function publishSnapshot(rootPath, filesRepo, snapshotsRepo, syncClient, logger2) {
+  const computation = computeSnapshot(filesRepo);
+  await ensureSnapshotCreated(rootPath, computation, syncClient, logger2);
+  const createdAt = Date.now();
+  snapshotsRepo.insert(
+    computation.snapshotHash,
+    computation.filesCount,
+    computation.totalSize,
+    createdAt
+  );
+  return {
+    snapshotHash: computation.snapshotHash,
+    filesCount: computation.filesCount,
+    totalSize: computation.totalSize,
+    status: "READY",
+    createdAt
+  };
+}
+
+// src/service/InitialSync.ts
+async function runInitialSyncPipeline(runtime) {
+  const inventoryLogger = runtime.logger.child({ scope: "inventory" });
+  await runInventory({
+    rootPath: runtime.config.rootPath,
+    bundle: runtime.rules,
+    filesRepo: runtime.filesRepo,
+    logger: inventoryLogger
+  });
+  const hashLogger = runtime.logger.child({ scope: "hash" });
+  let hadWork = true;
+  while (hadWork) {
+    hadWork = await runtime.hasher.processBatch(runtime.config.hashBatchSize);
+    if (hadWork) {
+      hashLogger.debug("Hasher processed batch");
+    }
+  }
+  const syncLogger = runtime.logger.child({ scope: "snapshot" });
+  const result = await publishSnapshot(
+    runtime.config.rootPath,
+    runtime.filesRepo,
+    runtime.snapshotsRepo,
+    runtime.clients.sync,
+    syncLogger
+  );
+  return result;
+}
+async function createChokidarWatcher(options, usePolling) {
+  const log = options.logger.child({
+    scope: "watcher",
+    mode: usePolling ? "polling" : "native"
+  });
+  const watcher = chokidar.watch(options.rootPath, {
+    ignored: options.ignored,
+    ignoreInitial: true,
+    persistent: true,
+    awaitWriteFinish: {
+      stabilityThreshold: 1500,
+      pollInterval: 100
+    },
+    atomic: true,
+    usePolling,
+    interval: usePolling ? 200 : void 0,
+    binaryInterval: usePolling ? 200 : void 0,
+    alwaysStat: true,
+    cwd: void 0,
+    depth: void 0
+  });
+  await new Promise((resolve, reject) => {
+    const onReady = () => {
+      watcher.off("error", onError);
+      log.info("Watcher ready");
+      resolve();
+    };
+    const onError = (err) => {
+      watcher.off("ready", onReady);
+      reject(err);
+    };
+    watcher.once("ready", onReady);
+    watcher.once("error", onError);
+  });
+  return { watcher, mode: usePolling ? "polling" : "native" };
+}
+function attachHandlers(watcher, options) {
+  const { handlers, logger: logger2 } = options;
+  const handle = (event, filePath, stats) => {
+    logger2.debug({ event, filePath }, "Watcher raw event");
+    Promise.resolve(handlers.onEvent(event, filePath, stats)).catch((error) => {
+      logger2.error(
+        { err: error, event, path: filePath },
+        "Watcher handler failed"
+      );
+    });
+  };
+  watcher.on("add", (filePath, stats) => handle("add", filePath, stats));
+  watcher.on("change", (filePath, stats) => handle("change", filePath, stats));
+  watcher.on("unlink", (filePath) => handle("unlink", filePath));
+  watcher.on("addDir", (dirPath) => handle("addDir", dirPath));
+  watcher.on("unlinkDir", (dirPath) => handle("unlinkDir", dirPath));
+  watcher.on("error", (error) => {
+    logger2.error({ err: error }, "Watcher error");
+  });
+  if (handlers.onReady) {
+    handlers.onReady();
+    logger2.debug("Watcher ready callback executed");
+  }
+}
+async function startWatcher(options) {
+  try {
+    const result = await createChokidarWatcher(options, false);
+    attachHandlers(result.watcher, options);
+    return result;
+  } catch (error) {
+    options.logger.warn(
+      { err: error },
+      "Native watcher failed, falling back to polling"
+    );
+    const result = await createChokidarWatcher(options, true);
+    attachHandlers(result.watcher, options);
+    return result;
+  }
+}
+
+// src/sync/HeartbeatProtocol.ts
+async function sendHeartbeat(rootId, snapshotsRepo, syncClient, logger2) {
+  const latest = snapshotsRepo.getLatest();
+  if (latest) {
+    await syncClient.checkSnapshotStatus(latest.snapshot_hash);
+  }
+  logger2.debug({ rootId }, "Heartbeat sent");
+}
+
+// src/service/State.ts
+var ServiceState = class {
+  constructor() {
+    this.lastChangeAt = Date.now();
+    this.lastSnapshotReadyAt = Date.now();
+    this.lastHeartbeatEnqueuedAt = 0;
+  }
+  updateChange(timestamp = Date.now()) {
+    this.lastChangeAt = timestamp;
+  }
+  updateSnapshotReady(timestamp = Date.now()) {
+    this.lastSnapshotReadyAt = timestamp;
+  }
+  updateHeartbeat(timestamp = Date.now()) {
+    this.lastHeartbeatEnqueuedAt = timestamp;
+  }
+};
+
+// src/service/ServiceLoops.ts
+function safeParse(input) {
+  try {
+    return JSON.parse(input);
+  } catch {
+    return void 0;
+  }
+}
+async function sleep2(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function computeBackoff(attempts) {
+  const base = attempts ?? 0;
+  const delay = 1e3 * 2 ** base;
+  return Math.min(delay, 6e4);
+}
+async function readSymlinkTarget2(absPath) {
+  try {
+    return await fs4.readlink(absPath);
+  } catch {
+    return null;
+  }
+}
+var SnapshotScheduler = class {
+  constructor(rootId, debounceMs, outbox, state) {
+    this.rootId = rootId;
+    this.debounceMs = debounceMs;
+    this.outbox = outbox;
+    this.state = state;
+    this.timer = null;
+  }
+  trigger() {
+    this.state.updateChange();
+    if (this.timer) {
+      clearTimeout(this.timer);
+    }
+    this.timer = setTimeout(() => {
+      this.outbox.enqueueSnapshot(this.rootId);
+      this.timer = null;
+    }, this.debounceMs);
+  }
+  cancel() {
+    if (this.timer) {
+      clearTimeout(this.timer);
+      this.timer = null;
+    }
+  }
+};
+var ServiceRunner = class {
+  constructor(runtime) {
+    this.runtime = runtime;
+    this.state = new ServiceState();
+    this.watcher = null;
+    this.running = false;
+    this.fsControlLeaseOwner = `fs-control-${process.pid}-${Date.now()}`;
+    this.tasks = /* @__PURE__ */ new Set();
+    this.buffering = false;
+    this.bufferedEvents = [];
+    this.scheduler = new SnapshotScheduler(
+      runtime.config.rootId,
+      runtime.config.snapshotDebounceMs,
+      runtime.outbox,
+      this.state
+    );
+    this.ignoredPredicate = buildWatcherIgnored(runtime.rules);
+  }
+  recordInitialSnapshot(timestamp) {
+    this.state.updateSnapshotReady(timestamp);
+    this.state.updateChange(timestamp);
+    this.state.updateHeartbeat(timestamp);
+  }
+  async start() {
+    if (this.running) return;
+    await this.prepareWatcher(false);
+    await this.startLoops();
+  }
+  async stop() {
+    if (!this.running) return;
+    this.running = false;
+    this.scheduler.cancel();
+    if (this.watcher) {
+      await this.watcher.close();
+      this.watcher = null;
+    }
+    await Promise.all([...this.tasks]);
+    await this.runtime.hasher.close();
+    this.runtime.clients.close();
+    this.runtime.db.close();
+  }
+  getServiceStateSnapshot() {
+    return {
+      lastChangeAt: this.state.lastChangeAt,
+      lastSnapshotReadyAt: this.state.lastSnapshotReadyAt,
+      lastHeartbeatEnqueuedAt: this.state.lastHeartbeatEnqueuedAt,
+      watcherReady: this.watcher !== null,
+      buffering: this.buffering
+    };
+  }
+  runBackground(fn) {
+    const task = fn();
+    this.tasks.add(task);
+    task.catch((error) => {
+      if (this.running) {
+        this.runtime.logger.error({ err: error }, "Background task failed");
+      }
+    }).finally(() => {
+      this.tasks.delete(task);
+    });
+  }
+  async prepareWatcher(bufferOnly) {
+    const { rootPath } = this.runtime.config;
+    const logger2 = this.runtime.logger.child({ scope: "watcher" });
+    this.buffering = bufferOnly;
+    const { watcher, mode } = await startWatcher({
+      rootPath,
+      ignored: this.ignoredPredicate,
+      logger: logger2,
+      handlers: {
+        onEvent: (event, absPath, stats) => {
+          logger2.debug({ event, absPath }, "Watcher event received");
+          if (this.buffering) {
+            this.bufferedEvents.push({ event, absPath, stats });
+            return Promise.resolve();
+          }
+          return this.handleEvent(event, absPath, stats);
+        }
+      }
+    });
+    this.watcher = watcher;
+    logger2.debug({ watched: watcher.getWatched() }, "Watcher targets");
+    logger2.info({ mode, buffering: bufferOnly }, "File watcher started");
+  }
+  async enableWatcherProcessing() {
+    if (!this.buffering) {
+      return;
+    }
+    this.buffering = false;
+    this.runtime.logger.debug(
+      { buffered: this.bufferedEvents.length },
+      "Watcher buffering disabled"
+    );
+    if (this.bufferedEvents.length === 0) return;
+    for (const buffered of this.bufferedEvents) {
+      await this.handleEvent(buffered.event, buffered.absPath, buffered.stats);
+    }
+    this.bufferedEvents = [];
+  }
+  async startLoops() {
+    if (this.running) return;
+    this.running = true;
+    this.runBackground(() => this.hashLoop());
+    this.runBackground(() => this.fsControlLoop());
+    this.runBackground(() => this.heartbeatLoop());
+    this.runBackground(() => this.requeueLoop());
+    this.runtime.logger.debug("Background loops started");
+  }
+  async handleEvent(event, absPath, stats) {
+    if (!this.running) return;
+    const root = this.runtime.config.rootPath;
+    const absolute = path.isAbsolute(absPath) ? absPath : path.join(root, absPath);
+    if (!isInsideRoot(root, absolute)) {
+      return;
+    }
+    switch (event) {
+      case "add":
+      case "change":
+        await this.handleAddChange(absolute, stats);
+        break;
+      case "unlink":
+        await this.handleUnlink(absolute);
+        break;
+      case "unlinkDir":
+        await this.handleUnlinkDir(absolute);
+        break;
+    }
+  }
+  async handleAddChange(absPath, _stats) {
+    let fileStats;
+    try {
+      fileStats = await fs4.lstat(absPath);
+    } catch (error) {
+      this.runtime.logger.warn(
+        { err: error, path: absPath },
+        "Failed to lstat path"
+      );
+      return;
+    }
+    const relPath = toPosixRelative(this.runtime.config.rootPath, absPath);
+    if (!shouldIncludeFile(relPath, fileStats, this.runtime.rules)) {
+      this.runtime.logger.debug({ relPath }, "Watcher event ignored by rules");
+      return;
+    }
+    const isSymlink = fileStats.isSymbolicLink();
+    const target = isSymlink ? await readSymlinkTarget2(absPath) : null;
+    const state = this.runtime.filesRepo.upsertFromStat({
+      relPath,
+      displayPath: absPath,
+      stats: fileStats,
+      isSymlink,
+      symlinkTarget: target
+    });
+    if (state === "dirty") {
+      this.scheduler.trigger();
+    }
+  }
+  async handleUnlink(absPath) {
+    const relPath = toPosixRelative(this.runtime.config.rootPath, absPath);
+    const changed = this.runtime.filesRepo.markMissing(relPath);
+    if (changed > 0) {
+      this.scheduler.trigger();
+    }
+  }
+  async handleUnlinkDir(absPath) {
+    const relPath = toPosixRelative(this.runtime.config.rootPath, absPath);
+    const changed = this.runtime.filesRepo.markMissingByPrefix(relPath);
+    if (changed > 0) {
+      this.scheduler.trigger();
+    }
+  }
+  async hashLoop() {
+    while (this.running) {
+      const processed = await this.runtime.hasher.processBatch(
+        this.runtime.config.hashBatchSize
+      );
+      if (!processed) {
+        await sleep2(500);
+      }
+    }
+  }
+  async fsControlLoop() {
+    const log = this.runtime.logger.child({ scope: "fs-control-worker" });
+    while (this.running) {
+      const job = this.runtime.outbox.claimFsControlJob(
+        this.fsControlLeaseOwner
+      );
+      if (!job) {
+        await sleep2(this.runtime.config.queuePollIntervalMs);
+        continue;
+      }
+      const payload = job.data ? safeParse(job.data) ?? {} : {};
+      const jobKind = job.kind ?? (typeof payload.kind === "string" ? payload.kind : void 0);
+      if (!jobKind) {
+        log.warn(
+          { jobId: job.id },
+          "fs_control job missing kind, acknowledging"
+        );
+        this.runtime.outbox.ack(job.id, this.fsControlLeaseOwner);
+        continue;
+      }
+      if (jobKind === "snapshot") {
+        await this.handleSnapshotJob(job, log);
+      } else if (jobKind === "heartbeat") {
+        await this.handleHeartbeatJob(job, log);
+      } else {
+        log.warn({ jobId: job.id, kind: jobKind }, "Unknown fs_control job");
+        this.runtime.outbox.ack(job.id, this.fsControlLeaseOwner);
+      }
+    }
+  }
+  async heartbeatLoop() {
+    const log = this.runtime.logger.child({ scope: "heartbeat-loop" });
+    while (this.running) {
+      const now = Date.now();
+      const sinceChange = now - this.state.lastChangeAt;
+      const sinceHeartbeat = now - this.state.lastHeartbeatEnqueuedAt;
+      if (sinceChange >= this.runtime.config.heartbeatIntervalMs && sinceHeartbeat >= this.runtime.config.heartbeatIntervalMs) {
+        this.runtime.outbox.enqueueHeartbeat(this.runtime.config.rootId);
+        this.state.updateHeartbeat(now);
+        log.debug("Heartbeat enqueued");
+      }
+      await sleep2(this.runtime.config.heartbeatCheckIntervalMs);
+    }
+    log.info("Heartbeat loop stopped");
+  }
+  async requeueLoop() {
+    while (this.running) {
+      const count = this.runtime.outbox.requeueTimedOut();
+      if (count > 0) {
+        this.runtime.logger.info({ count }, "Requeued timed-out jobs");
+      }
+      await sleep2(this.runtime.config.heartbeatCheckIntervalMs);
+    }
+  }
+  async handleSnapshotJob(job, log) {
+    if (this.runtime.filesRepo.countByState("dirty") > 0 || this.runtime.filesRepo.countByState("hashing") > 0) {
+      const delay = computeBackoff(job.attempts);
+      this.runtime.outbox.retry(job.id, this.fsControlLeaseOwner, delay);
+      await sleep2(200);
+      return;
+    }
+    try {
+      const result = await publishSnapshot(
+        this.runtime.config.rootPath,
+        this.runtime.filesRepo,
+        this.runtime.snapshotsRepo,
+        this.runtime.clients.sync,
+        log
+      );
+      this.runtime.outbox.ack(job.id, this.fsControlLeaseOwner);
+      this.state.updateSnapshotReady(result.createdAt);
+      log.info({ snapshotHash: result.snapshotHash }, "Snapshot job completed");
+    } catch (error) {
+      log.warn({ err: error }, "Snapshot job failed");
+      const delay = computeBackoff(job.attempts);
+      this.runtime.outbox.retry(job.id, this.fsControlLeaseOwner, delay);
+      await sleep2(delay);
+    }
+  }
+  async handleHeartbeatJob(job, log) {
+    try {
+      await sendHeartbeat(
+        this.runtime.config.rootId,
+        this.runtime.snapshotsRepo,
+        this.runtime.clients.sync,
+        log
+      );
+      this.runtime.outbox.ack(job.id, this.fsControlLeaseOwner);
+      this.state.updateHeartbeat(Date.now());
+    } catch (error) {
+      const delay = computeBackoff(job.attempts);
+      this.runtime.outbox.retry(job.id, this.fsControlLeaseOwner, delay);
+      log.warn({ err: error }, "Heartbeat failed; retry scheduled");
+    }
+  }
+};
+var HASH_STATES = ["clean", "dirty", "hashing", "missing"];
+function collectIndexingStatus(runtime, runner) {
+  const byState = {};
+  for (const state of HASH_STATES) {
+    byState[state] = runtime.filesRepo.countByState(state);
+  }
+  const total = HASH_STATES.reduce((acc, state) => acc + byState[state], 0);
+  const queue = runtime.outbox.getQueue();
+  const queueCounts = {
+    pending: queue.countByStatus(JobStatus.Pending),
+    processing: queue.countByStatus(JobStatus.Processing),
+    done: queue.countByStatus(JobStatus.Done),
+    failed: queue.countByStatus(JobStatus.Failed)
+  };
+  return {
+    timestamp: Date.now(),
+    root: {
+      id: runtime.config.rootId,
+      path: runtime.config.rootPath
+    },
+    files: {
+      total,
+      byState
+    },
+    latestSnapshot: runtime.snapshotsRepo.getLatest() ?? null,
+    queue: queueCounts,
+    service: runner.getServiceStateSnapshot()
+  };
+}
+
+// src/mcp/server.ts
+var SERVER_NAME = "coderule-scanner-mcp";
+var SERVER_VERSION = process.env.npm_package_version ?? "0.0.0";
+function createMcpServer({
+  runtime,
+  runner
+}) {
+  const server = new McpServer({
+    name: SERVER_NAME,
+    version: SERVER_VERSION,
+    description: "Coderule file indexing MCP server"
+  });
+  server.registerTool(
+    "check",
+    {
+      title: "Indexer status",
+      description: "Inspect the current indexing state, snapshot, and queue metrics",
+      inputSchema: {}
+    },
+    async () => {
+      const status = collectIndexingStatus(runtime, runner);
+      const text = JSON.stringify(status, null, 2);
+      return {
+        content: [{ type: "text", text }]
+      };
+    }
+  );
+  const queryInputSchema = {
+    query: z.string().min(1, "Query text is required"),
+    budgetTokens: z.number().int().positive().optional().describe("Token budget for retrieval (default 3000)")
+  };
+  server.registerTool(
+    "query",
+    {
+      title: "Snapshot retrieval query",
+      description: "Execute a retrieval query against the most recent indexed snapshot",
+      inputSchema: queryInputSchema
+    },
+    async ({
+      query,
+      budgetTokens
+    }) => {
+      const latest = runtime.snapshotsRepo.getLatest();
+      if (!latest) {
+        const message = "No snapshots available yet. Run indexing first.";
+        return {
+          content: [{ type: "text", text: message }],
+          isError: true
+        };
+      }
+      const effectiveBudget = Math.max(100, budgetTokens ?? 3e3);
+      try {
+        const result = await runtime.clients.retrieval.query(
+          latest.snapshot_hash,
+          query,
+          effectiveBudget,
+          {
+            formatter: runtime.config.retrievalFormatter
+          }
+        );
+        const summary = {
+          snapshotHash: latest.snapshot_hash,
+          budgetTokens: effectiveBudget,
+          formatter: runtime.config.retrievalFormatter
+        };
+        return {
+          content: [
+            {
+              type: "text",
+              text: result.formatted_output ?? "(no formatted output)"
+            },
+            {
+              type: "text",
+              text: JSON.stringify({ summary, result }, null, 2)
+            }
+          ]
+        };
+      } catch (error) {
+        const message = error instanceof Error ? error.message : "Unknown retrieval error";
+        runtime.logger.error({ err: error }, "Retrieval query failed");
+        return {
+          content: [{ type: "text", text: `Retrieval error: ${message}` }],
+          isError: true
+        };
+      }
+    }
+  );
+  return server;
+}
+
+// src/mcp-cli.ts
+var ENV_FLAG_MAP = {
+  root: "CODERULE_ROOT",
+  "data-dir": "CODERULE_DATA_DIR",
+  "auth-url": "CODERULE_AUTH_URL",
+  "sync-url": "CODERULE_SYNC_URL",
+  "ast-url": "CODERULE_AST_URL",
+  "retrieval-url": "CODERULE_RETRIEVAL_URL",
+  "retrieval-formatter": "CODERULE_RETRIEVAL_FORMATTER",
+  "http-timeout": "CODERULE_HTTP_TIMEOUT",
+  "snapshot-debounce": "CODERULE_SNAPSHOT_DEBOUNCE_MS",
+  "heartbeat-interval": "CODERULE_HEARTBEAT_INTERVAL_MS",
+  "heartbeat-check": "CODERULE_HEARTBEAT_CHECK_INTERVAL_MS",
+  "queue-poll": "CODERULE_QUEUE_POLL_INTERVAL_MS",
+  "hash-batch": "CODERULE_HASH_BATCH_SIZE",
+  "hash-lease": "CODERULE_HASH_LEASE_MS",
+  "max-snapshot-attempts": "CODERULE_MAX_SNAPSHOT_ATTEMPTS"
+};
+function printUsage() {
+  console.log(`Usage: coderule-mcp-server [token] [options]
+`);
+  console.log("Options:");
+  console.log("  --token <token>              Override CODERULE_TOKEN");
+  console.log(
+    "  --clean, --reindex           Remove existing local state before running"
+  );
+  console.log(
+    "  --inline-hasher              Force inline hashing (debug only)"
+  );
+  console.log("  --root <path>                Override CODERULE_ROOT");
+  console.log("  --data-dir <path>            Override CODERULE_DATA_DIR");
+  console.log("  --auth-url <url>             Override CODERULE_AUTH_URL");
+  console.log("  --sync-url <url>             Override CODERULE_SYNC_URL");
+  console.log("  --ast-url <url>              Override CODERULE_AST_URL");
+  console.log("  --retrieval-url <url>        Override CODERULE_RETRIEVAL_URL");
+  console.log(
+    "  --retrieval-formatter <val>  Override CODERULE_RETRIEVAL_FORMATTER (standard | compact)"
+  );
+  console.log("  --http-timeout <ms>          Override CODERULE_HTTP_TIMEOUT");
+  console.log(
+    "  --snapshot-debounce <ms>     Override CODERULE_SNAPSHOT_DEBOUNCE_MS"
+  );
+  console.log(
+    "  --heartbeat-interval <ms>    Override CODERULE_HEARTBEAT_INTERVAL_MS"
+  );
+  console.log(
+    "  --heartbeat-check <ms>       Override CODERULE_HEARTBEAT_CHECK_INTERVAL_MS"
+  );
+  console.log(
+    "  --queue-poll <ms>            Override CODERULE_QUEUE_POLL_INTERVAL_MS"
+  );
+  console.log(
+    "  --hash-batch <n>             Override CODERULE_HASH_BATCH_SIZE"
+  );
+  console.log("  --hash-lease <ms>            Override CODERULE_HASH_LEASE_MS");
+  console.log(
+    "  --max-snapshot-attempts <n>  Override CODERULE_MAX_SNAPSHOT_ATTEMPTS"
+  );
+  console.log(
+    "  KEY=value                    Set arbitrary environment variable"
+  );
+  console.log("  -h, --help                   Show this help message");
+}
+function parseArgs(argv) {
+  let token = process.env.CODERULE_TOKEN;
+  let clean = false;
+  let inlineHasher = false;
+  const env = {};
+  const args = [...argv];
+  while (args.length > 0) {
+    const arg = args.shift();
+    if (arg === "--help" || arg === "-h") {
+      printUsage();
+      return null;
+    }
+    if (arg === "--clean" || arg === "--reindex") {
+      clean = true;
+      continue;
+    }
+    if (arg === "--inline-hasher") {
+      inlineHasher = true;
+      continue;
+    }
+    if (arg === "--token") {
+      const value = args.shift();
+      if (!value) {
+        throw new Error("Missing value for --token");
+      }
+      token = value;
+      continue;
+    }
+    if (arg.startsWith("--token=")) {
+      token = arg.slice("--token=".length);
+      continue;
+    }
+    if (arg.startsWith("--")) {
+      const flag = arg.slice(2);
+      const envKey = ENV_FLAG_MAP[flag];
+      if (!envKey) {
+        throw new Error(`Unknown option: ${arg}`);
+      }
+      const value = args.shift();
+      if (!value) {
+        throw new Error(`Option ${arg} requires a value`);
+      }
+      env[envKey] = value;
+      continue;
+    }
+    if (arg.includes("=")) {
+      const [key, value] = arg.split("=", 2);
+      if (!key || value === void 0) {
+        throw new Error(`Invalid KEY=value argument: ${arg}`);
+      }
+      env[key] = value;
+      continue;
+    }
+    if (!token) {
+      token = arg;
+      continue;
+    }
+    throw new Error(`Unexpected argument: ${arg}`);
+  }
+  if (!token) {
+    throw new Error(
+      "Missing token. Provide via argument or CODERULE_TOKEN environment variable."
+    );
+  }
+  return { token, clean, inlineHasher, env };
+}
+async function ensureClean(configToken) {
+  const config = await resolveConfig({ token: configToken });
+  const targets = [
+    config.dbPath,
+    `${config.dbPath}-shm`,
+    `${config.dbPath}-wal`
+  ];
+  await Promise.all(targets.map((target) => fs4.rm(target, { force: true })));
+  await fs4.rm(path.join(config.dataDir, "watch", `${config.rootId}.sqlite-shm`), {
+    force: true
+  }).catch(() => {
+  });
+  const dir = path.dirname(config.dbPath);
+  await fs4.mkdir(dir, { recursive: true });
+  console.log(`Removed scanner database at ${config.dbPath}`);
+}
+function awaitShutdownSignals() {
+  return new Promise((resolve) => {
+    const signals = ["SIGINT", "SIGTERM"];
+    const handler = (signal) => {
+      for (const sig of signals) {
+        process.off(sig, handler);
+      }
+      resolve(signal);
+    };
+    for (const sig of signals) {
+      process.on(sig, handler);
+    }
+  });
+}
+async function main() {
+  try {
+    const options = parseArgs(process.argv.slice(2));
+    if (!options) {
+      return;
+    }
+    process.env.CODERULE_TOKEN = options.token;
+    if (options.inlineHasher) {
+      process.env.CODERULE_HASHER_INLINE = "1";
+    }
+    for (const [key, value] of Object.entries(options.env)) {
+      process.env[key] = value;
+    }
+    if (options.clean) {
+      await ensureClean(options.token);
+    }
+    const runtime = await bootstrap({ token: options.token });
+    const runner = new ServiceRunner(runtime);
+    try {
+      await runner.prepareWatcher(true);
+      const initial = await runInitialSyncPipeline(runtime);
+      runtime.logger.info(
+        {
+          snapshotHash: initial.snapshotHash,
+          filesCount: initial.filesCount
+        },
+        "Initial sync completed; starting MCP server"
+      );
+      runner.recordInitialSnapshot(initial.createdAt);
+      await runner.startLoops();
+      await runner.enableWatcherProcessing();
+      const server = createMcpServer({ runtime, runner });
+      const transport = new StdioServerTransport();
+      await server.connect(transport);
+      runtime.logger.info("MCP server connected via stdio");
+      const signal = await awaitShutdownSignals();
+      runtime.logger.info({ signal }, "Shutdown signal received");
+      if (typeof transport.close === "function") {
+        await transport.close();
+      }
+    } finally {
+      await runner.stop();
+    }
+  } catch (error) {
+    console.error("MCP server failed:", error);
+    process.exitCode = 1;
+  }
+}
+void main();
+//# sourceMappingURL=mcp-cli.js.map
+//# sourceMappingURL=mcp-cli.js.map