@contextstream/mcp-server 0.4.81 → 0.4.82

package/dist/index.js

@@ -11,11 +11,20 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
   if (typeof require !== "undefined") return require.apply(this, arguments);
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
 };
 var __commonJS = (cb, mod) => function __require2() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)
@@ -4441,7 +4450,7 @@ function detectUpdateMethod() {
   return "curl";
 }
 async function runUpdate(method) {
-  return new Promise((resolve16, reject) => {
+  return new Promise((resolve17, reject) => {
     let command;
     let args;
     let shell;
@@ -4472,13 +4481,13 @@ async function runUpdate(method) {
     });
     proc.on("close", (code) => {
       if (code === 0) {
-        resolve16();
+        resolve17();
       } else {
         reject(new Error(`Update process exited with code ${code}`));
       }
     });
     proc.unref();
-    setTimeout(() => resolve16(), 1e3);
+    setTimeout(() => resolve17(), 1e3);
   });
 }
 function writeUpdateMarker(previousVersion, newVersion) {
@@ -4665,7 +4674,7 @@ function setActiveModelId(modelId) {
   activeModelId = trimmed ? trimmed : null;
 }
 async function sleep(ms) {
-  return new Promise((resolve16) => setTimeout(resolve16, ms));
+  return new Promise((resolve17) => setTimeout(resolve17, ms));
 }
 async function request(config, path23, options = {}) {
   const { apiUrl, userAgent } = config;
@@ -5330,39 +5339,119 @@ var require_ignore = __commonJS({
 // src/ignore.ts
 import * as fs from "fs";
 import * as path from "path";
+function isInvariantIgnoredPath(pathname) {
+  const normalized = pathname.replace(/\\/g, "/").replace(/^\.\//, "");
+  const segments = normalized.split("/").filter(Boolean);
+  if (segments.some((segment) => INVARIANT_IGNORED_DIRECTORIES.has(segment.toLowerCase()))) {
+    return true;
+  }
+  const basename5 = (segments.at(-1) || "").toLowerCase();
+  if (INVARIANT_SECRET_FILENAMES.has(basename5)) return true;
+  if (INVARIANT_SECRET_SUFFIXES.some((suffix) => basename5.endsWith(suffix))) return true;
+  return (basename5 === ".env" || basename5.startsWith(".env.")) && !ENV_TEMPLATE_ALLOWLIST.has(basename5);
+}
 async function loadIgnorePatterns(projectRoot) {
   const ig = (0, import_ignore.default)();
   const patterns = [...DEFAULT_IGNORE_PATTERNS];
   ig.add(DEFAULT_IGNORE_PATTERNS);
-  const ignoreFilePath = path.join(projectRoot, IGNORE_FILENAME);
   let hasUserPatterns = false;
-  try {
-    const content = await fs.promises.readFile(ignoreFilePath, "utf-8");
-    const userPatterns = content.split("\n").map((line) => line.trim()).filter((line) => line && !line.startsWith("#"));
-    if (userPatterns.length > 0) {
-      ig.add(userPatterns);
-      patterns.push(...userPatterns);
-      hasUserPatterns = true;
+  for (const filename of IGNORE_FILENAMES) {
+    try {
+      const content = await fs.promises.readFile(path.join(projectRoot, filename), "utf-8");
+      const userPatterns = content.split("\n").map((line) => line.trim()).filter((line) => line && !line.startsWith("#"));
+      if (userPatterns.length > 0) {
+        ig.add(userPatterns);
+        patterns.push(...userPatterns);
+        hasUserPatterns = true;
+      }
+    } catch {
+    }
+  }
+  return {
+    ignores: (pathname) => isInvariantIgnoredPath(pathname) || ig.ignores(pathname),
+    patterns,
+    hasUserPatterns
+  };
+}
+function loadIgnorePatternsSync(projectRoot) {
+  const ig = (0, import_ignore.default)();
+  const patterns = [...DEFAULT_IGNORE_PATTERNS];
+  ig.add(DEFAULT_IGNORE_PATTERNS);
+  let hasUserPatterns = false;
+  for (const filename of IGNORE_FILENAMES) {
+    try {
+      const content = fs.readFileSync(path.join(projectRoot, filename), "utf-8");
+      const userPatterns = content.split("\n").map((line) => line.trim()).filter((line) => line && !line.startsWith("#"));
+      if (userPatterns.length > 0) {
+        ig.add(userPatterns);
+        patterns.push(...userPatterns);
+        hasUserPatterns = true;
+      }
+    } catch {
     }
-  } catch {
   }
   return {
-    ignores: (pathname) => ig.ignores(pathname),
+    ignores: (pathname) => isInvariantIgnoredPath(pathname) || ig.ignores(pathname),
     patterns,
     hasUserPatterns
   };
 }
-var import_ignore, IGNORE_FILENAME, DEFAULT_IGNORE_PATTERNS;
+var import_ignore, IGNORE_FILENAMES, INVARIANT_IGNORED_DIRECTORIES, INVARIANT_SECRET_FILENAMES, INVARIANT_SECRET_SUFFIXES, ENV_TEMPLATE_ALLOWLIST, DEFAULT_IGNORE_PATTERNS;
 var init_ignore = __esm({
   "src/ignore.ts"() {
     "use strict";
     import_ignore = __toESM(require_ignore(), 1);
-    IGNORE_FILENAME = ".contextstream/ignore";
+    IGNORE_FILENAMES = [".gitignore", ".contextignore", ".contextstream/ignore"];
+    INVARIANT_IGNORED_DIRECTORIES = /* @__PURE__ */ new Set([
+      ".contextstream",
+      ".claude",
+      ".codex",
+      ".cursor",
+      ".windsurf",
+      ".roo",
+      ".kilocode",
+      ".ssh",
+      ".aws",
+      ".gnupg",
+      ".kube",
+      ".docker"
+    ]);
+    INVARIANT_SECRET_FILENAMES = /* @__PURE__ */ new Set([
+      ".npmrc",
+      ".pypirc",
+      ".netrc",
+      ".pgpass",
+      ".git-credentials",
+      "id_rsa",
+      "id_ed25519",
+      "id_ecdsa",
+      "known_hosts",
+      "credentials.json",
+      "serviceaccountkey.json",
+      "auth.json"
+    ]);
+    INVARIANT_SECRET_SUFFIXES = [".pem", ".key", ".p12", ".pfx", ".jks"];
+    ENV_TEMPLATE_ALLOWLIST = /* @__PURE__ */ new Set([
+      ".env.example",
+      ".env.sample",
+      ".env.template",
+      ".env.dist",
+      ".env.defaults"
+    ]);
     DEFAULT_IGNORE_PATTERNS = [
       // Version control
       ".git/",
       ".svn/",
       ".hg/",
+      // ContextStream and AI editor/agent state. These directories can contain
+      // credentials, generated rules, caches, and nested worktrees.
+      ".contextstream/",
+      ".claude/",
+      ".codex/",
+      ".cursor/",
+      ".windsurf/",
+      ".roo/",
+      ".kilocode/",
       // Package managers / dependencies
       "node_modules/",
       "vendor/",
@@ -5393,6 +5482,12 @@ var init_ignore = __esm({
       ".idea/",
       ".vscode/",
       ".vs/",
+      // Credential stores
+      ".ssh/",
+      ".aws/",
+      ".gnupg/",
+      ".kube/",
+      ".docker/",
       // Coverage
       "coverage/",
       ".coverage/",
@@ -5406,6 +5501,22 @@ var init_ignore = __esm({
       "composer.lock",
       "*.min.js",
       "*.min.css",
+      "*.pem",
+      "*.key",
+      "*.p12",
+      "*.pfx",
+      "*.jks",
+      ".npmrc",
+      ".pypirc",
+      ".netrc",
+      ".pgpass",
+      ".git-credentials",
+      "id_rsa",
+      "id_ed25519",
+      "id_ecdsa",
+      "credentials.json",
+      "serviceAccountKey.json",
+      "auth.json",
       // OS files
       ".DS_Store",
       "Thumbs.db"
@@ -5433,6 +5544,15 @@ import { exec } from "child_process";
 import { promisify } from "util";
 import * as os from "os";
 import * as crypto from "crypto";
+function shouldSkipSensitiveFile(name) {
+  const lower = name.toLowerCase();
+  if (SECRET_FILENAMES.has(lower)) return true;
+  if (SECRET_FILE_SUFFIXES.some((suffix) => lower.endsWith(suffix))) return true;
+  if ((lower === ".env" || lower.startsWith(".env.")) && !ENV_TEMPLATE_ALLOWLIST2.has(lower)) {
+    return true;
+  }
+  return false;
+}
 function getMachineId() {
   const hostname2 = os.hostname();
   const hash = crypto.createHash("sha256").update(hostname2).digest("hex");
@@ -5539,6 +5659,7 @@ function clearGitContextCache() {
   gitContextCache.clear();
 }
 async function readFilesFromDirectory(rootPath, options = {}) {
+  if (isInvariantIgnoredPath(path2.resolve(rootPath))) return [];
   const maxFiles = options.maxFiles ?? MAX_FILES_PER_BATCH;
   const maxFileSize = options.maxFileSize ?? MAX_FILE_SIZE;
   const files = [];
@@ -5563,6 +5684,7 @@ async function readFilesFromDirectory(rootPath, options = {}) {
         await walkDir(fullPath, relPath);
       } else if (entry.isFile()) {
         if (IGNORE_FILES.has(entry.name)) continue;
+        if (shouldSkipSensitiveFile(entry.name)) continue;
         if (ig.ignores(relPath)) continue;
         const ext = entry.name.split(".").pop()?.toLowerCase() ?? "";
         if (!CODE_EXTENSIONS.has(ext)) continue;
@@ -5598,6 +5720,7 @@ async function readFilesFromDirectory(rootPath, options = {}) {
   return files;
 }
 async function* readAllFilesInBatches(rootPath, options = {}) {
+  if (isInvariantIgnoredPath(path2.resolve(rootPath))) return;
   const maxBatchBytes = options.maxBatchBytes ?? MAX_BATCH_BYTES;
   const largeFileThreshold = options.largeFileThreshold ?? LARGE_FILE_THRESHOLD;
   const maxFilesPerBatch = options.maxFilesPerBatch ?? options.batchSize ?? MAX_FILES_PER_BATCH;
@@ -5623,6 +5746,7 @@ async function* readAllFilesInBatches(rootPath, options = {}) {
         yield* walkDir(fullPath, relPath);
       } else if (entry.isFile()) {
         if (IGNORE_FILES.has(entry.name)) continue;
+        if (shouldSkipSensitiveFile(entry.name)) continue;
         if (ig.ignores(relPath)) continue;
         const ext = entry.name.split(".").pop()?.toLowerCase() ?? "";
         if (!CODE_EXTENSIONS.has(ext)) continue;
@@ -5683,6 +5807,7 @@ async function* readAllFilesInBatches(rootPath, options = {}) {
   }
 }
 async function* readChangedFilesInBatches(rootPath, sinceTimestamp, options = {}) {
+  if (isInvariantIgnoredPath(path2.resolve(rootPath))) return;
   const maxBatchBytes = options.maxBatchBytes ?? MAX_BATCH_BYTES;
   const largeFileThreshold = options.largeFileThreshold ?? LARGE_FILE_THRESHOLD;
   const maxFilesPerBatch = options.maxFilesPerBatch ?? options.batchSize ?? MAX_FILES_PER_BATCH;
@@ -5711,6 +5836,7 @@ async function* readChangedFilesInBatches(rootPath, sinceTimestamp, options = {}
         yield* walkDir(fullPath, relPath);
       } else if (entry.isFile()) {
         if (IGNORE_FILES.has(entry.name)) continue;
+        if (shouldSkipSensitiveFile(entry.name)) continue;
         if (ig.ignores(relPath)) continue;
         const ext = entry.name.split(".").pop()?.toLowerCase() ?? "";
         if (!CODE_EXTENSIONS.has(ext)) continue;
@@ -5777,6 +5903,7 @@ async function* readChangedFilesInBatches(rootPath, sinceTimestamp, options = {}
   );
 }
 async function countIndexableFiles(rootPath, options = {}) {
+  if (isInvariantIgnoredPath(path2.resolve(rootPath))) return { count: 0, stopped: false };
   const maxFiles = options.maxFiles ?? 1;
   const maxFileSize = options.maxFileSize ?? MAX_FILE_SIZE;
   const ig = options.ignoreInstance ?? await loadIgnorePatterns(rootPath);
@@ -5807,6 +5934,7 @@ async function countIndexableFiles(rootPath, options = {}) {
         await walkDir(fullPath, relPath);
       } else if (entry.isFile()) {
         if (IGNORE_FILES.has(entry.name)) continue;
+        if (shouldSkipSensitiveFile(entry.name)) continue;
         if (ig.ignores(relPath)) continue;
         const ext = entry.name.split(".").pop()?.toLowerCase() ?? "";
         if (!CODE_EXTENSIONS.has(ext)) continue;
@@ -5891,7 +6019,7 @@ function deleteHashManifest(projectId) {
   } catch {
   }
 }
-var execAsync, CODE_EXTENSIONS, IGNORE_DIRS, IGNORE_FILES, MAX_FILE_SIZE, MAX_BATCH_BYTES, LARGE_FILE_THRESHOLD, MAX_FILES_PER_BATCH, gitContextCache;
+var execAsync, CODE_EXTENSIONS, IGNORE_DIRS, IGNORE_FILES, SECRET_FILENAMES, SECRET_FILE_SUFFIXES, ENV_TEMPLATE_ALLOWLIST2, MAX_FILE_SIZE, MAX_BATCH_BYTES, LARGE_FILE_THRESHOLD, MAX_FILES_PER_BATCH, gitContextCache;
 var init_files = __esm({
   "src/files.ts"() {
     "use strict";
@@ -5967,6 +6095,13 @@ var init_files = __esm({
     IGNORE_DIRS = /* @__PURE__ */ new Set([
       "node_modules",
       ".git",
+      ".contextstream",
+      ".claude",
+      ".codex",
+      ".cursor",
+      ".windsurf",
+      ".roo",
+      ".kilocode",
       ".svn",
       ".hg",
       "target",
@@ -5994,7 +6129,18 @@ var init_files = __esm({
       "obj",
       ".idea",
       ".vscode",
-      ".vs"
+      ".vs",
+      ".npm",
+      ".yarn",
+      ".nyc_output",
+      // Credential directories are invariant exclusions. Their contents often
+      // have ordinary-looking names (config, credentials, known_hosts), so a
+      // filename-only filter is not sufficient.
+      ".ssh",
+      ".aws",
+      ".gnupg",
+      ".kube",
+      ".docker"
     ]);
     IGNORE_FILES = /* @__PURE__ */ new Set([
       ".DS_Store",
@@ -6009,6 +6155,28 @@ var init_files = __esm({
       "Gemfile.lock",
       "composer.lock"
     ]);
+    SECRET_FILENAMES = /* @__PURE__ */ new Set([
+      ".npmrc",
+      ".pypirc",
+      ".netrc",
+      ".pgpass",
+      ".git-credentials",
+      "id_rsa",
+      "id_ed25519",
+      "id_ecdsa",
+      "known_hosts",
+      "credentials.json",
+      "serviceaccountkey.json",
+      "auth.json"
+    ]);
+    SECRET_FILE_SUFFIXES = [".pem", ".key", ".p12", ".pfx", ".jks"];
+    ENV_TEMPLATE_ALLOWLIST2 = /* @__PURE__ */ new Set([
+      ".env.example",
+      ".env.sample",
+      ".env.template",
+      ".env.dist",
+      ".env.defaults"
+    ]);
     MAX_FILE_SIZE = 5 * 1024 * 1024;
     MAX_BATCH_BYTES = 1024 * 1024;
     LARGE_FILE_THRESHOLD = 2 * 1024 * 1024;
@@ -8528,10 +8696,14 @@ function extractIndexTimestamp(result) {
 function apiResultReportsIndexed(result) {
   const candidates = candidateObjects(result);
   const indexed = readBoolean(candidates, "indexed");
-  if (indexed !== void 0) {
-    return indexed;
+  if (indexed === true) {
+    return true;
   }
   const indexedFiles = readNumber(candidates, ["indexed_files", "indexed_file_count"]) ?? 0;
+  const projectIndexState = readString(candidates, "project_index_state")?.toLowerCase();
+  if (indexed === false && projectIndexState !== "ready" && projectIndexState !== "completed") {
+    return false;
+  }
   if (indexedFiles > 0) {
     return true;
   }
@@ -8544,6 +8716,28 @@ function apiResultReportsIndexed(result) {
   }
   return false;
 }
+function apiIndexResultIsSkipped(result) {
+  const status = readString(candidateObjects(result), "status")?.toLowerCase();
+  return status === "skipped";
+}
+function extractIndexedFileCount(result) {
+  const count = readNumber(candidateObjects(result), ["indexed_files", "indexed_file_count"]);
+  return count !== void 0 && count > 0 ? count : void 0;
+}
+function classifyRemoteIndexState(result) {
+  if (apiResultReportsIndexed(result)) return "server_index_ready";
+  if (apiResultIsIndexing(result)) return "server_indexing";
+  return "requires_sync_bridge";
+}
+function apiAllowsPathIngest(apiUrl, explicitOptIn = false) {
+  if (explicitOptIn) return true;
+  try {
+    const hostname2 = new URL(apiUrl).hostname.toLowerCase();
+    return hostname2 === "localhost" || hostname2 === "127.0.0.1" || hostname2 === "::1" || hostname2 === "[::1]";
+  } catch {
+    return false;
+  }
+}
 function apiResultIsIndexing(result) {
   const candidates = candidateObjects(result);
   const projectIndexState = readString(candidates, "project_index_state")?.toLowerCase();
@@ -10334,6 +10528,11 @@ var init_client = __esm({
         };
       }
       async ingestFromPath(projectId, pathStr, opts) {
+        if (!this.canDelegatePathIngest()) {
+          throw new Error(
+            "Hosted APIs cannot read workstation paths. Index from a process with local checkout access or use the ContextStream sync bridge/editor hooks."
+          );
+        }
         return request(this.config, `/projects/${projectId}/files/ingest-from-path`, {
           body: {
             path: pathStr,
@@ -10343,6 +10542,12 @@ var init_client = __esm({
           }
         });
       }
+      canDelegatePathIngest() {
+        return apiAllowsPathIngest(
+          this.config.apiUrl,
+          process.env.CONTEXTSTREAM_ALLOW_API_PATH_INGEST === "1"
+        );
+      }
       /**
        * High-level local ingest: reads files from disk, applies SHA-256 content
        * hash filtering, batches, and sends to the API with cooldown/status handling.
@@ -10365,6 +10570,9 @@ var init_client = __esm({
         let apiSkipped = 0;
         let abortedEarly = false;
         let lastStatus = "completed";
+        let failedBatches = 0;
+        let failedFiles = 0;
+        let lastError;
         const fileSource = sinceTimestamp ? readChangedFilesInBatches(rootPath, sinceTimestamp, {
           batchSize: INGEST_MAX_BATCH_FILES,
           maxFilesPerBatch: INGEST_MAX_BATCH_FILES,
@@ -10377,19 +10585,21 @@ var init_client = __esm({
         for await (const batch of fileSource) {
           if (maxFiles !== void 0 && totalFiles >= maxFiles) break;
           const filteredBatch = [];
+          const changedHashes = /* @__PURE__ */ new Map();
           for (const file of batch) {
             if (maxFiles !== void 0 && totalFiles >= maxFiles) break;
             totalFiles++;
             const hash = sha256Hex(file.content);
-            newHashes.set(file.path, hash);
             if (!force) {
               const oldHash = oldHashes.get(file.path);
               if (oldHash === hash) {
+                newHashes.set(file.path, hash);
                 filesSkippedByHash++;
                 continue;
               }
             }
             filteredBatch.push(file);
+            changedHashes.set(file.path, hash);
           }
           if (filteredBatch.length === 0) continue;
           try {
@@ -10406,6 +10616,11 @@ var init_client = __esm({
                 abortedEarly = true;
                 break;
               }
+              if (data.status !== "partial") {
+                for (const [filePath, hash] of changedHashes) newHashes.set(filePath, hash);
+              }
+            } else {
+              for (const [filePath, hash] of changedHashes) newHashes.set(filePath, hash);
             }
           } catch (e) {
             console.error(`[ContextStream] Batch ingest error (attempt 1):`, e);
@@ -10420,14 +10635,22 @@ var init_client = __esm({
                   abortedEarly = true;
                   break;
                 }
+                if (data.status !== "partial") {
+                  for (const [filePath, hash] of changedHashes) newHashes.set(filePath, hash);
+                }
+              } else {
+                for (const [filePath, hash] of changedHashes) newHashes.set(filePath, hash);
               }
             } catch (retryErr) {
               console.error(`[ContextStream] Batch ingest retry failed:`, retryErr);
+              failedBatches++;
+              failedFiles += filteredBatch.length;
+              lastError = retryErr instanceof Error ? retryErr.message : String(retryErr);
             }
           }
         }
         writeHashManifest(projectId, newHashes);
-        const status = abortedEarly ? lastStatus === "daily_limit_exceeded" ? "daily_limit" : "cooldown" : "success";
+        const status = abortedEarly ? lastStatus === "daily_limit_exceeded" ? "daily_limit" : "cooldown" : failedBatches > 0 && filesIndexed === 0 && totalFiles - filesSkippedByHash > 0 ? "error" : failedBatches > 0 || lastStatus === "partial" ? "partial" : "success";
         return {
           totalFiles,
           filesChanged: totalFiles - filesSkippedByHash,
@@ -10435,7 +10658,10 @@ var init_client = __esm({
           filesSkipped: filesSkippedByHash,
           apiSkipped,
           status,
-          abortedEarly
+          abortedEarly,
+          failedBatches,
+          failedFiles,
+          lastError
         };
       }
       /**
@@ -11019,6 +11245,9 @@ var init_client = __esm({
                         rootPath: rootPathCopy,
                         maxFiles: AUTO_INDEX_FILE_CAP
                       });
+                      if (result.status === "error") {
+                        throw new Error(result.lastError || "all changed-file ingest batches failed");
+                      }
                       console.error(
                         `[ContextStream] Background indexing completed for ${rootPathCopy}: ${result.filesIndexed} indexed, ${result.filesSkipped} unchanged`
                       );
@@ -11194,6 +11423,9 @@ var init_client = __esm({
                     maxFiles: AUTO_INDEX_FILE_CAP,
                     sinceTimestamp: sinceDate
                   });
+                  if (result.status === "error") {
+                    throw new Error(result.lastError || "all changed-file ingest batches failed");
+                  }
                   console.error(
                     `[ContextStream] ${useIncremental ? "Incremental" : "Full"} index refresh completed for ${rootPathCopy}: ${result.filesIndexed} indexed, ${result.filesSkipped} unchanged`
                   );
@@ -12039,6 +12271,9 @@ var init_client = __esm({
                     rootPath: rootPathCopy,
                     maxFiles: AUTO_INDEX_FILE_CAP
                   });
+                  if (result.status === "error") {
+                    throw new Error(result.lastError || "all changed-file ingest batches failed");
+                  }
                   console.error(
                     `[ContextStream] Auto-indexing completed for ${rootPathCopy}: ${result.filesIndexed} indexed, ${result.filesSkipped} unchanged`
                   );
@@ -13383,6 +13618,25 @@ ${context}`;
         uuidSchema.parse(params.task_id);
         return request(this.config, `/tasks/${params.task_id}`, { method: "GET" });
       }
+      /** List completed Daily Recaps for a workspace, newest first. */
+      async listDailyRecaps(params) {
+        uuidSchema.parse(params.workspace_id);
+        const query = new URLSearchParams({ workspace_id: params.workspace_id });
+        query.set("limit", String(Math.min(100, Math.max(1, params.limit ?? 30))));
+        return request(this.config, `/recap/history?${query.toString()}`, { method: "GET" });
+      }
+      /** Queue an asynchronous Daily Recap generation for a workspace. */
+      async triggerDailyRecap(params) {
+        uuidSchema.parse(params.workspace_id);
+        return request(this.config, "/recap/generate", {
+          method: "POST",
+          body: { workspace_id: params.workspace_id }
+        });
+      }
+      /** Get the latest public MCP release metadata. */
+      async getMcpVersion() {
+        return request(this.config, "/mcp/version", { method: "GET" });
+      }
       /**
        * Update an existing task
        */
@@ -14227,7 +14481,7 @@ function generateAllRuleFiles(options) {
     }))
   ).filter((r) => r !== null);
 }
-var DEFAULT_CLAUDE_MCP_SERVER_NAME, RULES_VERSION, CONTEXTSTREAM_TOOL_NAMES, CONTEXTSTREAM_RULES_BOOTSTRAP, CONTEXTSTREAM_RULES_DYNAMIC, CONTEXTSTREAM_RULES_FULL, CONTEXTSTREAM_RULES_MINIMAL, NO_HOOKS_SUPPLEMENT, ANTIGRAVITY_SUPPLEMENT, NO_HOOKS_EDITORS, TEMPLATES;
+var DEFAULT_CLAUDE_MCP_SERVER_NAME, RULES_VERSION, CONTEXTSTREAM_TOOL_NAMES, FAST_DIRECT_READ_LANE, CANONICAL_HANDOFF_RULES, CONTEXTSTREAM_RULES_BOOTSTRAP, CONTEXTSTREAM_RULES_DYNAMIC, CONTEXTSTREAM_RULES_FULL, CONTEXTSTREAM_RULES_MINIMAL, NO_HOOKS_SUPPLEMENT, ANTIGRAVITY_SUPPLEMENT, NO_HOOKS_EDITORS, TEMPLATES;
 var init_rules_templates = __esm({
   "src/rules-templates.ts"() {
     "use strict";
@@ -14274,6 +14528,28 @@ var init_rules_templates = __esm({
       "help"
       // Actions: tools, auth, version, editor_rules, enable_bundle
     ];
+    FAST_DIRECT_READ_LANE = `
+## Fast Direct-Read Lane
+
+After the required first-session \`init(...)\` + \`context(...)\`, these exact read-only calls may run without another grounding preamble only when no state-changing tool has run since the last grounding:
+- \`workspace(action="list"|"get")\`
+- \`memory(action="list_docs"|"list_events"|"list_todos"|"list_tasks"|"list_transcripts"|"list_nodes"|"list_diagrams")\`
+- \`help(action="version"|"tools"|"auth")\`
+- \`project(action="list"|"get"|"index_status")\`
+- \`reminder(action="list"|"active")\`
+
+Do not use this lane for recall, decisions, searches, reading a specific record, media queries, or any create/update/delete/index operation; ground those with \`context(...)\` first.
+`.trim();
+    CANONICAL_HANDOFF_RULES = `
+## Canonical Agent Handoffs
+
+When the user asks to create/prepare a handoff, hand work over, or continue in another agent/session, create the durable record immediately with:
+\`entity(kind="handoff", action="create", body={title, summary, scope, next_steps})\`
+
+- Add \`to_user_id\` only when the recipient is known; never invent it.
+- If a portable bundle, capsule, or share link is requested, also create a session capsule and return both artifacts.
+- \`HANDOFF.md\`, a scratch prompt, a generic doc/event, or prose alone is not the canonical handoff. If a local file is explicitly requested, create the entity first and treat the file as an additional artifact.
+`.trim();
     CONTEXTSTREAM_RULES_BOOTSTRAP = `
 <contextstream_rules>
 | Message | Required |
@@ -14297,6 +14573,10 @@ var init_rules_templates = __esm({
 - "find media" / "search photos/videos/audio/docs" / "what's in this PDF/video/audio?" \u2192 \`media(action="search", query="...", content_types=["document"])\`
 - "index media" / "upload asset" / "read this photo/video/audio/PDF" \u2192 \`media(action="index", file_path="...", content_type="image")\` or \`media(action="index", external_url="...", content_type="document")\`
 
+${FAST_DIRECT_READ_LANE}
+
+${CANONICAL_HANDOFF_RULES}
+
 ## Skills, Docs & Lessons First
 
 Before guessing, improvising, or struggling through a workflow you do not fully know, check whether ContextStream already has guidance for it.
@@ -14326,12 +14606,12 @@ Before guessing, improvising, or struggling through a workflow you do not fully
 
 ## Past Sessions Are Queryable \u2014 USE THEM
 
-Transcripts of every prior session are captured + indexed. Before asking the user what you did last time, or re-deriving context you built together previously, check the transcript + snapshot layer.
+When \`context()\` returns fresh, relevant \`[GROUNDING]\`, read those ranked prior-work hits first. If they are sufficient, stop there\u2014do not immediately call \`session(action="recall")\` for the same request. Escalate to recall only when grounding is absent, thin, stale, off-topic, or the user explicitly requests broader history.
 
 Triggers: user says "last time"/"previous"/"yesterday"/"pick up where we left off", the task is clearly a continuation, or you're about to ask a clarifying question whose answer is likely in a prior session.
 
 Exact calls:
-- Ranked past-session context: \`session(action="recall", query="<what you're continuing>")\`
+- First explicit escalation after insufficient grounding: \`session(action="recall", query="<what you're continuing>")\`
 - Chronological list of recent sessions: \`memory(action="list_transcripts", limit=10)\`
 - Full-text search across ALL past transcripts: \`memory(action="search_transcripts", query="<keyword>")\`
 - Save a snapshot of the current session so the NEXT session can pick up: \`session(action="capture", event_type="session_snapshot", title="...", content="...")\`
@@ -14357,6 +14637,10 @@ v${RULES_VERSION}
 
 Use \`context()\` by default to get task-specific rules, lessons from past mistakes, and relevant decisions.
 
+${FAST_DIRECT_READ_LANE}
+
+${CANONICAL_HANDOFF_RULES}
+
 ---
 
 ## Why Default Context-First
@@ -14890,6 +15174,10 @@ See full documentation: https://contextstream.io/docs/mcp/tools
 **HOOKS: \`<system-reminder>\` tags contain instructions \u2014 FOLLOW THEM**
 </contextstream_protocol>
 
+${FAST_DIRECT_READ_LANE}
+
+${CANONICAL_HANDOFF_RULES}
+
 Rules Version: ${RULES_VERSION}
 
 ---
@@ -15212,7 +15500,7 @@ curl -fsSL https://contextstream.io/scripts/setup.sh | bash
 irm https://contextstream.io/scripts/setup.ps1 | iex
 \`\`\`
 
-**npm (requires Node.js 18+):**
+**npm (requires Node.js 20+):**
 \`\`\`bash
 npm install -g @contextstream/mcp-server@latest
 \`\`\`
@@ -15344,14 +15632,14 @@ Full docs: https://contextstream.io/docs/mcp/tools
 });
 
 // src/credentials.ts
-import * as fs8 from "node:fs/promises";
-import * as path9 from "node:path";
-import { homedir as homedir7 } from "node:os";
+import * as fs7 from "node:fs/promises";
+import * as path8 from "node:path";
+import { homedir as homedir6 } from "node:os";
 function normalizeApiUrl(input) {
   return String(input ?? "").trim().replace(/\/+$/, "");
 }
 function credentialsFilePath() {
-  return path9.join(homedir7(), ".contextstream", "credentials.json");
+  return path8.join(homedir6(), ".contextstream", "credentials.json");
 }
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -15359,7 +15647,7 @@ function isRecord(value) {
 async function readSavedCredentials() {
   const filePath = credentialsFilePath();
   try {
-    const raw = await fs8.readFile(filePath, "utf8");
+    const raw = await fs7.readFile(filePath, "utf8");
     const parsed = JSON.parse(raw);
     if (!isRecord(parsed)) return null;
     const version = parsed.version;
@@ -15385,7 +15673,7 @@ async function readSavedCredentials() {
 }
 async function writeSavedCredentials(input) {
   const filePath = credentialsFilePath();
-  await fs8.mkdir(path9.dirname(filePath), { recursive: true });
+  await fs7.mkdir(path8.dirname(filePath), { recursive: true });
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const existing = await readSavedCredentials();
   const value = {
@@ -15397,9 +15685,9 @@ async function writeSavedCredentials(input) {
     updated_at: now
   };
   const body = JSON.stringify(value, null, 2) + "\n";
-  await fs8.writeFile(filePath, body, { encoding: "utf8", mode: 384 });
+  await fs7.writeFile(filePath, body, { encoding: "utf8", mode: 384 });
   try {
-    await fs8.chmod(filePath, 384);
+    await fs7.chmod(filePath, 384);
   } catch {
   }
   return { path: filePath, value };
@@ -15416,7 +15704,7 @@ __export(doctor_exports, {
   runDoctor: () => runDoctor
 });
 import * as fsSync2 from "node:fs";
-import * as path10 from "node:path";
+import * as path9 from "node:path";
 async function runDoctor() {
   const cwd = process.cwd();
   const lines = [`ContextStream MCP doctor v${VERSION}`, ""];
@@ -15465,7 +15753,7 @@ async function runDoctor() {
   }
   lines.push("", "Local index");
   const status = await readIndexStatus();
-  const entry = status.projects?.[path10.resolve(cwd)];
+  const entry = status.projects?.[path9.resolve(cwd)];
   if (!entry) {
     warn(
       "No local index record for this folder.",
@@ -15507,7 +15795,7 @@ async function runDoctor() {
   lines.push("", "Editor rules");
   let ruleFilesFound = 0;
   for (const [editor, template] of Object.entries(TEMPLATES)) {
-    const filePath = path10.join(cwd, template.filename);
+    const filePath = path9.join(cwd, template.filename);
     if (!fsSync2.existsSync(filePath)) continue;
     ruleFilesFound += 1;
     const content = fsSync2.readFileSync(filePath, "utf-8");
@@ -15529,8 +15817,8 @@ async function runDoctor() {
   }
   lines.push("", "Hooks");
   const hookTargets = [
-    { name: "Claude Code (project)", file: path10.join(cwd, ".claude", "settings.json") },
-    { name: "Cursor (project)", file: path10.join(cwd, ".cursor", "hooks.json") }
+    { name: "Claude Code (project)", file: path9.join(cwd, ".claude", "settings.json") },
+    { name: "Cursor (project)", file: path9.join(cwd, ".cursor", "hooks.json") }
   ];
   let hookConfigsFound = 0;
   for (const target of hookTargets) {
@@ -15573,12 +15861,13 @@ var init_doctor = __esm({
 var setup_exports = {};
 __export(setup_exports, {
   __setupTestUtils: () => __setupTestUtils,
+  isBroadProjectPath: () => isBroadProjectPath,
   runIndexCommand: () => runIndexCommand,
   runSetupWizard: () => runSetupWizard
 });
-import * as fs9 from "node:fs/promises";
-import * as path11 from "node:path";
-import { homedir as homedir8 } from "node:os";
+import * as fs8 from "node:fs/promises";
+import * as path10 from "node:path";
+import { homedir as homedir7 } from "node:os";
 import { stdin, stdout } from "node:process";
 import { createInterface } from "node:readline/promises";
 function supportsProjectMcpConfig(editor) {
@@ -15608,40 +15897,40 @@ function parseNumberList(input, max) {
 }
 async function fileExists(filePath) {
   try {
-    await fs9.stat(filePath);
+    await fs8.stat(filePath);
     return true;
   } catch {
     return false;
   }
 }
-function wrapWithMarkers2(content) {
-  return `${CONTEXTSTREAM_START_MARKER2}
+function wrapWithMarkers(content) {
+  return `${CONTEXTSTREAM_START_MARKER}
 ${content.trim()}
-${CONTEXTSTREAM_END_MARKER2}`;
+${CONTEXTSTREAM_END_MARKER}`;
 }
-function isLegacyContextStreamRules2(content) {
+function isLegacyContextStreamRules(content) {
   const lower = content.toLowerCase();
   if (!lower.includes("contextstream")) return false;
-  if (!LEGACY_CONTEXTSTREAM_HINTS2.some((hint) => lower.includes(hint))) return false;
+  if (!LEGACY_CONTEXTSTREAM_HINTS.some((hint) => lower.includes(hint))) return false;
   const headingRegex = /^#{1,6}\s+(.+)$/gm;
   let hasHeading = false;
   let match;
   while ((match = headingRegex.exec(content)) !== null) {
     hasHeading = true;
     const heading = match[1].trim().toLowerCase();
-    const allowed = LEGACY_CONTEXTSTREAM_ALLOWED_HEADINGS2.some(
+    const allowed = LEGACY_CONTEXTSTREAM_ALLOWED_HEADINGS.some(
       (prefix) => heading.startsWith(prefix)
     );
     if (!allowed) return false;
   }
   return hasHeading;
 }
-function isContextStreamPreamble2(line) {
+function isContextStreamPreamble(line) {
   const trimmed = line.trim();
   if (!trimmed) return false;
-  return CONTEXTSTREAM_PREAMBLE_PATTERNS2.some((pattern) => pattern.test(trimmed));
+  return CONTEXTSTREAM_PREAMBLE_PATTERNS.some((pattern) => pattern.test(trimmed));
 }
-function findContextStreamHeading2(lines) {
+function findContextStreamHeading(lines) {
   const headingRegex = /^(#{1,6})\s+(.+)$/;
   for (let i = 0; i < lines.length; i += 1) {
     const match = headingRegex.exec(lines[i]);
@@ -15652,7 +15941,7 @@ function findContextStreamHeading2(lines) {
   }
   return null;
 }
-function findSectionEnd2(lines, startLine, level) {
+function findSectionEnd(lines, startLine, level) {
   const headingRegex = /^(#{1,6})\s+(.+)$/;
   for (let i = startLine + 1; i < lines.length; i += 1) {
     const match = headingRegex.exec(lines[i]);
@@ -15661,16 +15950,16 @@ function findSectionEnd2(lines, startLine, level) {
   }
   return lines.length;
 }
-function extractContextStreamBlock2(content) {
+function extractContextStreamBlock(content) {
   const lines = content.split(/\r?\n/);
-  const heading = findContextStreamHeading2(lines);
+  const heading = findContextStreamHeading(lines);
   if (!heading) return content.trim();
-  const endLine = findSectionEnd2(lines, heading.index, heading.level);
+  const endLine = findSectionEnd(lines, heading.index, heading.level);
   return lines.slice(heading.index, endLine).join("\n").trim();
 }
-function findLegacyContextStreamSection2(content) {
+function findLegacyContextStreamSection(content) {
   const lines = content.split(/\r?\n/);
-  const heading = findContextStreamHeading2(lines);
+  const heading = findContextStreamHeading(lines);
   if (!heading) return null;
   let startLine = heading.index;
   for (let i = heading.index - 1; i >= 0; i -= 1) {
@@ -15679,39 +15968,39 @@ function findLegacyContextStreamSection2(content) {
       startLine = i;
       continue;
     }
-    if (isContextStreamPreamble2(line)) {
+    if (isContextStreamPreamble(line)) {
       startLine = i;
       continue;
     }
     break;
   }
-  const endLine = findSectionEnd2(lines, heading.index, heading.level);
+  const endLine = findSectionEnd(lines, heading.index, heading.level);
   return { startLine, endLine, contextLine: heading.index };
 }
-function blockHasPreamble2(block) {
+function blockHasPreamble(block) {
   const lines = block.split(/\r?\n/);
   for (const line of lines) {
     const trimmed = line.trim();
     if (!trimmed) continue;
-    if (isContextStreamPreamble2(trimmed)) return true;
+    if (isContextStreamPreamble(trimmed)) return true;
     if (/^#{1,6}\s+/.test(trimmed)) return false;
   }
   return false;
 }
-function replaceContextStreamBlock2(existing, content) {
-  const fullWrapped = wrapWithMarkers2(content);
-  const blockWrapped = wrapWithMarkers2(extractContextStreamBlock2(content));
-  const startIdx = existing.indexOf(CONTEXTSTREAM_START_MARKER2);
-  const endIdx = existing.indexOf(CONTEXTSTREAM_END_MARKER2);
+function replaceContextStreamBlock(existing, content) {
+  const fullWrapped = wrapWithMarkers(content);
+  const blockWrapped = wrapWithMarkers(extractContextStreamBlock(content));
+  const startIdx = existing.indexOf(CONTEXTSTREAM_START_MARKER);
+  const endIdx = existing.indexOf(CONTEXTSTREAM_END_MARKER);
   if (startIdx !== -1 && endIdx !== -1 && endIdx > startIdx) {
-    const existingBlock = existing.slice(startIdx + CONTEXTSTREAM_START_MARKER2.length, endIdx);
-    const replacement = blockHasPreamble2(existingBlock) ? fullWrapped : blockWrapped;
+    const existingBlock = existing.slice(startIdx + CONTEXTSTREAM_START_MARKER.length, endIdx);
+    const replacement = blockHasPreamble(existingBlock) ? fullWrapped : blockWrapped;
     const before = existing.substring(0, startIdx).trimEnd();
-    const after = existing.substring(endIdx + CONTEXTSTREAM_END_MARKER2.length).trimStart();
+    const after = existing.substring(endIdx + CONTEXTSTREAM_END_MARKER.length).trimStart();
     const merged = [before, replacement, after].filter((part) => part.length > 0).join("\n\n");
     return { content: merged.trim() + "\n", status: "updated" };
   }
-  const legacy = findLegacyContextStreamSection2(existing);
+  const legacy = findLegacyContextStreamSection(existing);
   if (legacy) {
     const lines = existing.split(/\r?\n/);
     const before = lines.slice(0, legacy.startLine).join("\n").trimEnd();
@@ -15720,54 +16009,54 @@ function replaceContextStreamBlock2(existing, content) {
     const merged = [before, replacement, after].filter((part) => part.length > 0).join("\n\n");
     return { content: merged.trim() + "\n", status: "updated" };
   }
-  if (isLegacyContextStreamRules2(existing)) {
+  if (isLegacyContextStreamRules(existing)) {
     return { content: fullWrapped + "\n", status: "updated" };
   }
   const appended = existing.trimEnd() + "\n\n" + blockWrapped + "\n";
   return { content: appended, status: "appended" };
 }
 async function upsertTextFile(filePath, content, _marker) {
-  await fs9.mkdir(path11.dirname(filePath), { recursive: true });
+  await fs8.mkdir(path10.dirname(filePath), { recursive: true });
   const exists = await fileExists(filePath);
-  const wrappedContent = wrapWithMarkers2(content);
+  const wrappedContent = wrapWithMarkers(content);
   if (!exists) {
-    await fs9.writeFile(filePath, wrappedContent + "\n", "utf8");
+    await fs8.writeFile(filePath, wrappedContent + "\n", "utf8");
     return "created";
   }
-  const existing = await fs9.readFile(filePath, "utf8").catch(() => "");
+  const existing = await fs8.readFile(filePath, "utf8").catch(() => "");
   if (!existing.trim()) {
-    await fs9.writeFile(filePath, wrappedContent + "\n", "utf8");
+    await fs8.writeFile(filePath, wrappedContent + "\n", "utf8");
     return "updated";
   }
-  const replaced = replaceContextStreamBlock2(existing, content);
-  await fs9.writeFile(filePath, replaced.content, "utf8");
+  const replaced = replaceContextStreamBlock(existing, content);
+  await fs8.writeFile(filePath, replaced.content, "utf8");
   return replaced.status;
 }
 function globalRulesPathForEditor(editor) {
-  const home = homedir8();
+  const home = homedir7();
   switch (editor) {
     case "codex":
-      return path11.join(home, ".codex", "AGENTS.md");
+      return path10.join(home, ".codex", "AGENTS.md");
     case "copilot":
       return null;
     case "opencode":
-      return path11.join(home, ".opencode", "AGENTS.md");
+      return path10.join(home, ".opencode", "AGENTS.md");
     case "claude":
-      return path11.join(home, ".claude", "CLAUDE.md");
+      return path10.join(home, ".claude", "CLAUDE.md");
     case "cline":
-      return path11.join(home, "Documents", "Cline", "Rules", "contextstream.md");
+      return path10.join(home, "Documents", "Cline", "Rules", "contextstream.md");
     case "kilo":
-      return path11.join(kiloConfigDir(), "rules", "contextstream.md");
+      return path10.join(kiloConfigDir(), "rules", "contextstream.md");
     case "roo":
-      return path11.join(home, ".roo", "rules", "contextstream.md");
+      return path10.join(home, ".roo", "rules", "contextstream.md");
     case "aider":
-      return path11.join(home, ".aider.conf.yml");
+      return path10.join(home, ".aider.conf.yml");
     case "antigravity":
-      return path11.join(home, ".gemini", "GEMINI.md");
+      return path10.join(home, ".gemini", "GEMINI.md");
     case "cursor":
       return null;
     case "windsurf":
-      return path11.join(home, ".codeium", "windsurf", "memories", "global_rules.md");
+      return path10.join(home, ".codeium", "windsurf", "memories", "global_rules.md");
     default:
       return null;
   }
@@ -15779,104 +16068,104 @@ async function anyPathExists(paths) {
   return false;
 }
 async function isCodexInstalled() {
-  const home = homedir8();
+  const home = homedir7();
   const envHome = process.env.CODEX_HOME;
   const candidates = [
     envHome,
-    path11.join(home, ".codex"),
-    path11.join(home, ".codex", "config.toml"),
-    path11.join(home, ".config", "codex")
+    path10.join(home, ".codex"),
+    path10.join(home, ".codex", "config.toml"),
+    path10.join(home, ".config", "codex")
   ].filter((candidate) => Boolean(candidate));
   return anyPathExists(candidates);
 }
 function openCodeConfigPath() {
-  const home = homedir8();
+  const home = homedir7();
   const xdgConfigHome = process.env.XDG_CONFIG_HOME;
   if (process.platform === "win32") {
-    const appData = process.env.APPDATA || path11.join(home, "AppData", "Roaming");
-    return path11.join(appData, "opencode", "opencode.json");
+    const appData = process.env.APPDATA || path10.join(home, "AppData", "Roaming");
+    return path10.join(appData, "opencode", "opencode.json");
   }
-  const configRoot = xdgConfigHome || path11.join(home, ".config");
-  return path11.join(configRoot, "opencode", "opencode.json");
+  const configRoot = xdgConfigHome || path10.join(home, ".config");
+  return path10.join(configRoot, "opencode", "opencode.json");
 }
 async function isOpenCodeInstalled() {
   const configPath = openCodeConfigPath();
-  const configDir = path11.dirname(configPath);
-  const home = homedir8();
+  const configDir = path10.dirname(configPath);
+  const home = homedir7();
   const candidates = [
     configDir,
     configPath,
-    path11.join(home, ".bun", "bin", "opencode"),
-    path11.join(home, ".local", "bin", "opencode")
+    path10.join(home, ".bun", "bin", "opencode"),
+    path10.join(home, ".local", "bin", "opencode")
   ];
   return anyPathExists(candidates);
 }
 async function isClaudeInstalled() {
-  const home = homedir8();
-  const candidates = [path11.join(home, ".claude"), path11.join(home, ".config", "claude")];
+  const home = homedir7();
+  const candidates = [path10.join(home, ".claude"), path10.join(home, ".config", "claude")];
   const desktopConfig = claudeDesktopConfigPath();
   if (desktopConfig) candidates.push(desktopConfig);
   if (process.platform === "darwin") {
-    candidates.push(path11.join(home, "Library", "Application Support", "Claude"));
+    candidates.push(path10.join(home, "Library", "Application Support", "Claude"));
   } else if (process.platform === "win32") {
     const appData = process.env.APPDATA;
-    if (appData) candidates.push(path11.join(appData, "Claude"));
+    if (appData) candidates.push(path10.join(appData, "Claude"));
   }
   return anyPathExists(candidates);
 }
 async function isClineInstalled() {
-  const home = homedir8();
+  const home = homedir7();
   const candidates = [
-    path11.join(home, "Documents", "Cline"),
-    path11.join(home, ".cline"),
-    path11.join(home, ".config", "cline")
+    path10.join(home, "Documents", "Cline"),
+    path10.join(home, ".cline"),
+    path10.join(home, ".config", "cline")
   ];
   return anyPathExists(candidates);
 }
 async function isCopilotInstalled() {
-  const home = homedir8();
+  const home = homedir7();
   const candidates = [
-    path11.join(home, ".copilot"),
-    path11.join(home, ".config", "github-copilot"),
-    path11.join(home, ".vscode", "extensions", "github.copilot-chat"),
-    path11.join(home, ".vscode", "extensions", "github.copilot")
+    path10.join(home, ".copilot"),
+    path10.join(home, ".config", "github-copilot"),
+    path10.join(home, ".vscode", "extensions", "github.copilot-chat"),
+    path10.join(home, ".vscode", "extensions", "github.copilot")
   ];
   return anyPathExists(candidates);
 }
 async function isKiloInstalled() {
-  const home = homedir8();
+  const home = homedir7();
   const candidates = [
     kiloConfigDir(),
-    path11.join(home, ".kilocode"),
-    path11.join(home, ".config", "kilocode")
+    path10.join(home, ".kilocode"),
+    path10.join(home, ".config", "kilocode")
   ];
   return anyPathExists(candidates);
 }
 async function isRooInstalled() {
-  const home = homedir8();
-  const candidates = [path11.join(home, ".roo"), path11.join(home, ".config", "roo")];
+  const home = homedir7();
+  const candidates = [path10.join(home, ".roo"), path10.join(home, ".config", "roo")];
   return anyPathExists(candidates);
 }
 async function isAiderInstalled() {
-  const home = homedir8();
-  const candidates = [path11.join(home, ".aider.conf.yml"), path11.join(home, ".config", "aider")];
+  const home = homedir7();
+  const candidates = [path10.join(home, ".aider.conf.yml"), path10.join(home, ".config", "aider")];
   return anyPathExists(candidates);
 }
 async function isCursorInstalled() {
-  const home = homedir8();
-  const candidates = [path11.join(home, ".cursor")];
+  const home = homedir7();
+  const candidates = [path10.join(home, ".cursor")];
   if (process.platform === "darwin") {
     candidates.push("/Applications/Cursor.app");
-    candidates.push(path11.join(home, "Applications", "Cursor.app"));
-    candidates.push(path11.join(home, "Library", "Application Support", "Cursor"));
+    candidates.push(path10.join(home, "Applications", "Cursor.app"));
+    candidates.push(path10.join(home, "Library", "Application Support", "Cursor"));
   } else if (process.platform === "win32") {
     const localApp = process.env.LOCALAPPDATA;
     const programFiles = process.env.ProgramFiles;
     const programFilesX86 = process.env["ProgramFiles(x86)"];
-    if (localApp) candidates.push(path11.join(localApp, "Programs", "Cursor", "Cursor.exe"));
-    if (localApp) candidates.push(path11.join(localApp, "Cursor", "Cursor.exe"));
-    if (programFiles) candidates.push(path11.join(programFiles, "Cursor", "Cursor.exe"));
-    if (programFilesX86) candidates.push(path11.join(programFilesX86, "Cursor", "Cursor.exe"));
+    if (localApp) candidates.push(path10.join(localApp, "Programs", "Cursor", "Cursor.exe"));
+    if (localApp) candidates.push(path10.join(localApp, "Cursor", "Cursor.exe"));
+    if (programFiles) candidates.push(path10.join(programFiles, "Cursor", "Cursor.exe"));
+    if (programFilesX86) candidates.push(path10.join(programFilesX86, "Cursor", "Cursor.exe"));
   } else {
     candidates.push("/usr/bin/cursor");
     candidates.push("/usr/local/bin/cursor");
@@ -15886,20 +16175,20 @@ async function isCursorInstalled() {
   return anyPathExists(candidates);
 }
 async function isWindsurfInstalled() {
-  const home = homedir8();
-  const candidates = [path11.join(home, ".codeium", "windsurf")];
+  const home = homedir7();
+  const candidates = [path10.join(home, ".codeium", "windsurf")];
   if (process.platform === "darwin") {
     candidates.push("/Applications/Windsurf.app");
-    candidates.push(path11.join(home, "Applications", "Windsurf.app"));
-    candidates.push(path11.join(home, "Library", "Application Support", "Windsurf"));
+    candidates.push(path10.join(home, "Applications", "Windsurf.app"));
+    candidates.push(path10.join(home, "Library", "Application Support", "Windsurf"));
   } else if (process.platform === "win32") {
     const localApp = process.env.LOCALAPPDATA;
     const programFiles = process.env.ProgramFiles;
     const programFilesX86 = process.env["ProgramFiles(x86)"];
-    if (localApp) candidates.push(path11.join(localApp, "Programs", "Windsurf", "Windsurf.exe"));
-    if (localApp) candidates.push(path11.join(localApp, "Windsurf", "Windsurf.exe"));
-    if (programFiles) candidates.push(path11.join(programFiles, "Windsurf", "Windsurf.exe"));
-    if (programFilesX86) candidates.push(path11.join(programFilesX86, "Windsurf", "Windsurf.exe"));
+    if (localApp) candidates.push(path10.join(localApp, "Programs", "Windsurf", "Windsurf.exe"));
+    if (localApp) candidates.push(path10.join(localApp, "Windsurf", "Windsurf.exe"));
+    if (programFiles) candidates.push(path10.join(programFiles, "Windsurf", "Windsurf.exe"));
+    if (programFilesX86) candidates.push(path10.join(programFilesX86, "Windsurf", "Windsurf.exe"));
   } else {
     candidates.push("/usr/bin/windsurf");
     candidates.push("/usr/local/bin/windsurf");
@@ -15909,22 +16198,22 @@ async function isWindsurfInstalled() {
   return anyPathExists(candidates);
 }
 async function isAntigravityInstalled() {
-  const home = homedir8();
-  const candidates = [path11.join(home, ".gemini")];
+  const home = homedir7();
+  const candidates = [path10.join(home, ".gemini")];
   if (process.platform === "darwin") {
     candidates.push("/Applications/Antigravity.app");
-    candidates.push(path11.join(home, "Applications", "Antigravity.app"));
-    candidates.push(path11.join(home, "Library", "Application Support", "Antigravity"));
+    candidates.push(path10.join(home, "Applications", "Antigravity.app"));
+    candidates.push(path10.join(home, "Library", "Application Support", "Antigravity"));
   } else if (process.platform === "win32") {
     const localApp = process.env.LOCALAPPDATA;
     const programFiles = process.env.ProgramFiles;
     const programFilesX86 = process.env["ProgramFiles(x86)"];
     if (localApp)
-      candidates.push(path11.join(localApp, "Programs", "Antigravity", "Antigravity.exe"));
-    if (localApp) candidates.push(path11.join(localApp, "Antigravity", "Antigravity.exe"));
-    if (programFiles) candidates.push(path11.join(programFiles, "Antigravity", "Antigravity.exe"));
+      candidates.push(path10.join(localApp, "Programs", "Antigravity", "Antigravity.exe"));
+    if (localApp) candidates.push(path10.join(localApp, "Antigravity", "Antigravity.exe"));
+    if (programFiles) candidates.push(path10.join(programFiles, "Antigravity", "Antigravity.exe"));
     if (programFilesX86)
-      candidates.push(path11.join(programFilesX86, "Antigravity", "Antigravity.exe"));
+      candidates.push(path10.join(programFilesX86, "Antigravity", "Antigravity.exe"));
   } else {
     candidates.push("/usr/bin/antigravity");
     candidates.push("/usr/local/bin/antigravity");
@@ -16103,12 +16392,12 @@ function buildContextStreamOpenCodeRemoteServer() {
   };
 }
 function kiloConfigDir() {
-  const home = homedir8();
+  const home = homedir7();
   if (process.platform === "win32") {
-    const appData = process.env.APPDATA || path11.join(home, "AppData", "Roaming");
-    return path11.join(appData, "kilo");
+    const appData = process.env.APPDATA || path10.join(home, "AppData", "Roaming");
+    return path10.join(appData, "kilo");
   }
-  return path11.join(home, ".config", "kilo");
+  return path10.join(home, ".config", "kilo");
 }
 function buildContextStreamKiloServer(params) {
   const env = buildSetupEnv(params);
@@ -16121,11 +16410,11 @@ function buildContextStreamKiloServer(params) {
   };
 }
 async function upsertKiloMcpConfig(filePath, server) {
-  await fs9.mkdir(path11.dirname(filePath), { recursive: true });
+  await fs8.mkdir(path10.dirname(filePath), { recursive: true });
   const exists = await fileExists(filePath);
   let root = {};
   if (exists) {
-    const raw = await fs9.readFile(filePath, "utf8").catch(() => "");
+    const raw = await fs8.readFile(filePath, "utf8").catch(() => "");
     const parsed = tryParseJsonLike(raw);
     if (!parsed.ok) throw new Error(`Invalid JSON in ${filePath}: ${parsed.error}`);
     root = parsed.value;
@@ -16138,7 +16427,7 @@ async function upsertKiloMcpConfig(filePath, server) {
   const before = JSON.stringify(root.mcp.contextstream ?? null);
   root.mcp.contextstream = server;
   const after = JSON.stringify(root.mcp.contextstream ?? null);
-  await fs9.writeFile(filePath, JSON.stringify(root, null, 2) + "\n", "utf8");
+  await fs8.writeFile(filePath, JSON.stringify(root, null, 2) + "\n", "utf8");
   if (!exists) return "created";
   return before === after ? "skipped" : "updated";
 }
@@ -16161,11 +16450,11 @@ function tryParseJsonLike(raw) {
   }
 }
 async function upsertJsonMcpConfig(filePath, server) {
-  await fs9.mkdir(path11.dirname(filePath), { recursive: true });
+  await fs8.mkdir(path10.dirname(filePath), { recursive: true });
   const exists = await fileExists(filePath);
   let root = {};
   if (exists) {
-    const raw = await fs9.readFile(filePath, "utf8").catch(() => "");
+    const raw = await fs8.readFile(filePath, "utf8").catch(() => "");
     const parsed = tryParseJsonLike(raw);
     if (!parsed.ok) throw new Error(`Invalid JSON in ${filePath}: ${parsed.error}`);
     root = parsed.value;
@@ -16176,16 +16465,16 @@ async function upsertJsonMcpConfig(filePath, server) {
   const before = JSON.stringify(root.mcpServers.contextstream ?? null);
   root.mcpServers.contextstream = server;
   const after = JSON.stringify(root.mcpServers.contextstream ?? null);
-  await fs9.writeFile(filePath, JSON.stringify(root, null, 2) + "\n", "utf8");
+  await fs8.writeFile(filePath, JSON.stringify(root, null, 2) + "\n", "utf8");
   if (!exists) return "created";
   return before === after ? "skipped" : "updated";
 }
 async function upsertJsonVsCodeMcpConfig(filePath, server) {
-  await fs9.mkdir(path11.dirname(filePath), { recursive: true });
+  await fs8.mkdir(path10.dirname(filePath), { recursive: true });
   const exists = await fileExists(filePath);
   let root = {};
   if (exists) {
-    const raw = await fs9.readFile(filePath, "utf8").catch(() => "");
+    const raw = await fs8.readFile(filePath, "utf8").catch(() => "");
     const parsed = tryParseJsonLike(raw);
     if (!parsed.ok) throw new Error(`Invalid JSON in ${filePath}: ${parsed.error}`);
     root = parsed.value;
@@ -16207,16 +16496,16 @@ async function upsertJsonVsCodeMcpConfig(filePath, server) {
     root.servers.contextstream = server;
   }
   const after = JSON.stringify(root.servers.contextstream ?? null);
-  await fs9.writeFile(filePath, JSON.stringify(root, null, 2) + "\n", "utf8");
+  await fs8.writeFile(filePath, JSON.stringify(root, null, 2) + "\n", "utf8");
   if (!exists) return "created";
   return before === after ? "skipped" : "updated";
 }
 async function upsertOpenCodeMcpConfig(filePath, server) {
-  await fs9.mkdir(path11.dirname(filePath), { recursive: true });
+  await fs8.mkdir(path10.dirname(filePath), { recursive: true });
   const exists = await fileExists(filePath);
   let root = {};
   if (exists) {
-    const raw = await fs9.readFile(filePath, "utf8").catch(() => "");
+    const raw = await fs8.readFile(filePath, "utf8").catch(() => "");
     const parsed = tryParseJsonLike(raw);
     if (!parsed.ok) throw new Error(`Invalid JSON in ${filePath}: ${parsed.error}`);
     root = parsed.value;
@@ -16233,14 +16522,14 @@ async function upsertOpenCodeMcpConfig(filePath, server) {
     schema: root.$schema ?? null,
     contextstream: root.mcp.contextstream ?? null
   });
-  await fs9.writeFile(filePath, JSON.stringify(root, null, 2) + "\n", "utf8");
+  await fs8.writeFile(filePath, JSON.stringify(root, null, 2) + "\n", "utf8");
   if (!exists) return "created";
   return before === after ? "skipped" : "updated";
 }
 function claudeDesktopConfigPath() {
-  const home = homedir8();
+  const home = homedir7();
   if (process.platform === "darwin") {
-    return path11.join(
+    return path10.join(
       home,
       "Library",
       "Application Support",
@@ -16249,18 +16538,18 @@ function claudeDesktopConfigPath() {
     );
   }
   if (process.platform === "win32") {
-    const appData = process.env.APPDATA || path11.join(home, "AppData", "Roaming");
-    return path11.join(appData, "Claude", "claude_desktop_config.json");
+    const appData = process.env.APPDATA || path10.join(home, "AppData", "Roaming");
+    return path10.join(appData, "Claude", "claude_desktop_config.json");
   }
   if (process.platform === "linux") {
-    return path11.join(home, ".config", "Claude", "claude_desktop_config.json");
+    return path10.join(home, ".config", "Claude", "claude_desktop_config.json");
   }
   return null;
 }
 async function upsertCodexTomlConfig(filePath, params) {
-  await fs9.mkdir(path11.dirname(filePath), { recursive: true });
+  await fs8.mkdir(path10.dirname(filePath), { recursive: true });
   const exists = await fileExists(filePath);
-  const existing = exists ? await fs9.readFile(filePath, "utf8").catch(() => "") : "";
+  const existing = exists ? await fs8.readFile(filePath, "utf8").catch(() => "") : "";
   const env = buildSetupEnv(params);
   const envLines = formatTomlEnvLines(env);
   const marker = "[mcp_servers.contextstream]";
@@ -16278,15 +16567,15 @@ args = ["--prefer-online", "-y", "@contextstream/mcp-server@latest"]
 [mcp_servers.contextstream.env]
 ` + envLines + "\n";
   if (!exists) {
-    await fs9.writeFile(filePath, block.trimStart(), "utf8");
+    await fs8.writeFile(filePath, block.trimStart(), "utf8");
     return "created";
   }
   if (!existing.includes(marker)) {
-    await fs9.writeFile(filePath, existing.trimEnd() + block, "utf8");
+    await fs8.writeFile(filePath, existing.trimEnd() + block, "utf8");
     return "updated";
   }
   if (!existing.includes(envMarker)) {
-    await fs9.writeFile(
+    await fs8.writeFile(
       filePath,
       existing.trimEnd() + "\n\n" + envMarker + "\n" + envLines + "\n",
       "utf8"
@@ -16336,18 +16625,18 @@ args = ["--prefer-online", "-y", "@contextstream/mcp-server@latest"]
   }
   const updated = out.join("\n");
   if (updated === existing) return "skipped";
-  await fs9.writeFile(filePath, updated, "utf8");
+  await fs8.writeFile(filePath, updated, "utf8");
   return "updated";
 }
 async function discoverProjectsUnderFolder(parentFolder) {
-  const entries = await fs9.readdir(parentFolder, { withFileTypes: true });
-  const candidates = entries.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => path11.join(parentFolder, e.name));
+  const entries = await fs8.readdir(parentFolder, { withFileTypes: true });
+  const candidates = entries.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => path10.join(parentFolder, e.name));
   const projects = [];
   for (const dir of candidates) {
-    const hasGit = await fileExists(path11.join(dir, ".git"));
-    const hasPkg = await fileExists(path11.join(dir, "package.json"));
-    const hasCargo = await fileExists(path11.join(dir, "Cargo.toml"));
-    const hasPyProject = await fileExists(path11.join(dir, "pyproject.toml"));
+    const hasGit = await fileExists(path10.join(dir, ".git"));
+    const hasPkg = await fileExists(path10.join(dir, "package.json"));
+    const hasCargo = await fileExists(path10.join(dir, "Cargo.toml"));
+    const hasPyProject = await fileExists(path10.join(dir, "pyproject.toml"));
     if (hasGit || hasPkg || hasCargo || hasPyProject) projects.push(dir);
   }
   return projects;
@@ -16381,7 +16670,7 @@ async function selectProjectForCurrentDirectory(client, cwd, workspaceId, dryRun
   if (!workspaceId || workspaceId === "dry-run") {
     return void 0;
   }
-  const folderName = path11.basename(cwd) || "project";
+  const folderName = path10.basename(cwd) || "project";
   let projects = [];
   try {
     const result = await client.listProjects({
@@ -16457,15 +16746,34 @@ async function selectProjectForCurrentDirectory(client, cwd, workspaceId, dryRun
   return void 0;
 }
 async function runIndexCommand(targetPath) {
-  const resolvedPath = path11.resolve(targetPath);
+  const resolvedPath = path10.resolve(targetPath);
+  if (isInvariantIgnoredPath(resolvedPath)) {
+    throw new Error(invariantProjectPathMessage(resolvedPath));
+  }
+  if (isBroadProjectPath(resolvedPath) && !broadIngestAllowed()) {
+    throw new Error(broadProjectPathMessage(resolvedPath));
+  }
   const { loadConfig: loadConfig2 } = await Promise.resolve().then(() => (init_config(), config_exports));
   const config = loadConfig2();
   const client = new ContextStreamClient(config);
   const localConfig = readLocalConfig(resolvedPath);
   await indexProjectWithProgress(client, resolvedPath, localConfig?.workspace_id);
 }
+function isBroadProjectPath(candidatePath, homePath = homedir7()) {
+  const resolved = path10.resolve(candidatePath);
+  return resolved === path10.parse(resolved).root || resolved === path10.resolve(homePath);
+}
+function broadIngestAllowed() {
+  return process.env.CONTEXTSTREAM_ALLOW_BROAD_INGEST === "1";
+}
+function broadProjectPathMessage(candidatePath) {
+  return `Refusing to use ${candidatePath} as a project root because it is the filesystem root or home directory. Run from a repository folder or pass a narrower project path. Set CONTEXTSTREAM_ALLOW_BROAD_INGEST=1 only for an intentional broad ingest.`;
+}
+function invariantProjectPathMessage(candidatePath) {
+  return `Refusing to use ${candidatePath} as a project root because it is inside agent state or a credential store. Choose the actual repository checkout instead.`;
+}
 async function indexProjectWithProgress(client, projectPath, workspaceId) {
-  const projectName = path11.basename(projectPath);
+  const projectName = path10.basename(projectPath);
   console.log(`
 ${colors.bright}Updating index for '${projectName}'...${colors.reset}`);
   console.log(`${colors.dim}${projectPath}${colors.reset}
@@ -16571,6 +16879,7 @@ ${colors.bright}Updating index for '${projectName}'...${colors.reset}`);
     return 0;
   };
   let failedBatches = 0;
+  let failedFiles = 0;
   try {
     for await (const batch of readAllFilesInBatches(projectPath, {
       batchSize: 20,
@@ -16584,7 +16893,7 @@ ${colors.bright}Updating index for '${projectName}'...${colors.reset}`);
         batchCount++;
       } catch {
         failedBatches++;
-        filesIndexed += batch.length;
+        failedFiles += batch.length;
       }
       if (filesIndexed > totalFiles) {
         totalFiles = filesIndexed + 100;
@@ -16596,7 +16905,7 @@ ${colors.bright}Updating index for '${projectName}'...${colors.reset}`);
     process.stdout.write("\r" + " ".repeat(120) + "\r");
     if (failedBatches > 0) {
       console.log(
-        `${colors.yellow}\u2713${colors.reset} Index update complete: ${colors.bright}${filesIndexed.toLocaleString()}${colors.reset} files indexed (${finalSize}) in ${elapsed}s (${failedBatches} batches had errors)`
+        `${colors.yellow}!${colors.reset} Index update incomplete: ${colors.bright}${filesIndexed.toLocaleString()}${colors.reset} files indexed, ${failedFiles.toLocaleString()} failed (${finalSize}) in ${elapsed}s (${failedBatches} batches had errors; retry the command)`
       );
     } else {
       console.log(
@@ -16761,10 +17070,10 @@ Code: ${device.user_code}`);
           if (poll && poll.status === "pending") {
             const intervalSeconds = typeof poll.interval === "number" ? poll.interval : 5;
             const waitMs = Math.max(1, intervalSeconds) * 1e3;
-            await new Promise((resolve16) => setTimeout(resolve16, waitMs));
+            await new Promise((resolve17) => setTimeout(resolve17, waitMs));
             continue;
           }
-          await new Promise((resolve16) => setTimeout(resolve16, 1e3));
+          await new Promise((resolve17) => setTimeout(resolve17, 1e3));
         }
         if (!accessToken) {
           throw new Error(
@@ -16811,7 +17120,7 @@ Code: ${device.user_code}`);
       }
     }
     async function startBackgroundIndexing(projectPath) {
-      const projectLabel = path11.basename(projectPath);
+      const projectLabel = path10.basename(projectPath);
       try {
         const { spawn: spawn2 } = await import("node:child_process");
         const entry = process.argv[1];
@@ -17079,7 +17388,7 @@ Editors (from --editors): ${selectedEditors.join(", ")}`);
         if (mcpScope === "project" && editor !== "codex") continue;
         try {
           if (editor === "codex") {
-            const filePath = path11.join(homedir8(), ".codex", "config.toml");
+            const filePath = path10.join(homedir7(), ".codex", "config.toml");
             if (dryRun) {
               writeActions.push({ kind: "mcp-config", target: filePath, status: "dry-run" });
               console.log(`- ${EDITOR_LABELS[editor]}: would update ${filePath}`);
@@ -17095,7 +17404,7 @@ Editors (from --editors): ${selectedEditors.join(", ")}`);
             continue;
           }
           if (editor === "copilot") {
-            const filePath = path11.join(homedir8(), ".copilot", "mcp-config.json");
+            const filePath = path10.join(homedir7(), ".copilot", "mcp-config.json");
             if (dryRun) {
               writeActions.push({ kind: "mcp-config", target: filePath, status: "dry-run" });
               console.log(`- ${EDITOR_LABELS[editor]}: would update ${filePath}`);
@@ -17150,7 +17459,7 @@ Editors (from --editors): ${selectedEditors.join(", ")}`);
             continue;
           }
           if (editor === "cursor") {
-            const filePath = path11.join(homedir8(), ".cursor", "mcp.json");
+            const filePath = path10.join(homedir7(), ".cursor", "mcp.json");
             if (dryRun) {
               writeActions.push({ kind: "mcp-config", target: filePath, status: "dry-run" });
               console.log(`- ${EDITOR_LABELS[editor]}: would update ${filePath}`);
@@ -17162,7 +17471,7 @@ Editors (from --editors): ${selectedEditors.join(", ")}`);
             continue;
           }
           if (editor === "windsurf") {
-            const filePath = path11.join(homedir8(), ".codeium", "windsurf", "mcp_config.json");
+            const filePath = path10.join(homedir7(), ".codeium", "windsurf", "mcp_config.json");
             if (dryRun) {
               writeActions.push({ kind: "mcp-config", target: filePath, status: "dry-run" });
               console.log(`- ${EDITOR_LABELS[editor]}: would update ${filePath}`);
@@ -17180,7 +17489,7 @@ Editors (from --editors): ${selectedEditors.join(", ")}`);
             continue;
           }
           if (editor === "kilo") {
-            const filePath = path11.join(kiloConfigDir(), "kilo.jsonc");
+            const filePath = path10.join(kiloConfigDir(), "kilo.jsonc");
             if (dryRun) {
               writeActions.push({ kind: "mcp-config", target: filePath, status: "dry-run" });
               console.log(`- ${EDITOR_LABELS[editor]}: would update ${filePath}`);
@@ -17246,7 +17555,7 @@ Editors (from --editors): ${selectedEditors.join(", ")}`);
           });
           for (const script of result.installed) {
             writeActions.push({ kind: "hooks", target: script, status: "created" });
-            console.log(`- ${EDITOR_LABELS[editor]}: installed ${path11.basename(script)}`);
+            console.log(`- ${EDITOR_LABELS[editor]}: installed ${path10.basename(script)}`);
           }
           if (editor === "cursor") {
             console.log(
@@ -17318,11 +17627,18 @@ Editors (from --editors): ${selectedEditors.join(", ")}`);
     const needsProjects = scope === "project" || scope === "both" || (mcpScope === "project" || mcpScope === "both") && hasProjectMcpEditors || enforceCopilotCanonicalPair;
     if (needsProjects) {
       console.log("\nProject setup...");
-      const addCwd = normalizeInput(
-        await question(`Add current folder as a project? [Y/n] (${process.cwd()}): `)
-      );
-      if (addCwd.toLowerCase() !== "n" && addCwd.toLowerCase() !== "no") {
-        projectPaths.add(path11.resolve(process.cwd()));
+      const currentFolder = path10.resolve(process.cwd());
+      if (isInvariantIgnoredPath(currentFolder)) {
+        console.log(`- ${invariantProjectPathMessage(currentFolder)}`);
+      } else if (isBroadProjectPath(currentFolder) && !broadIngestAllowed()) {
+        console.log(`- ${broadProjectPathMessage(currentFolder)}`);
+      } else {
+        const addCwd = normalizeInput(
+          await question(`Add current folder as a project? [Y/n] (${currentFolder}): `)
+        );
+        if (addCwd.toLowerCase() !== "n" && addCwd.toLowerCase() !== "no") {
+          projectPaths.add(currentFolder);
+        }
       }
       while (true) {
         console.log("\n  1) Add another project path");
@@ -17332,13 +17648,22 @@ Editors (from --editors): ${selectedEditors.join(", ")}`);
         if (choice === "3") break;
         if (choice === "1") {
           const p = normalizeInput(await question("Project folder path: "));
-          if (p) projectPaths.add(path11.resolve(p));
+          if (p) {
+            const resolved = path10.resolve(p);
+            if (isInvariantIgnoredPath(resolved)) {
+              console.log(`- ${invariantProjectPathMessage(resolved)}`);
+            } else if (isBroadProjectPath(resolved) && !broadIngestAllowed()) {
+              console.log(`- ${broadProjectPathMessage(resolved)}`);
+            } else {
+              projectPaths.add(resolved);
+            }
+          }
           continue;
         }
         if (choice === "2") {
           const parent = normalizeInput(await question("Parent folder path: "));
           if (!parent) continue;
-          const parentAbs = path11.resolve(parent);
+          const parentAbs = path10.resolve(parent);
           const projects2 = await discoverProjectsUnderFolder(parentAbs);
           if (projects2.length === 0) {
             console.log(
@@ -17371,7 +17696,7 @@ Applying to ${projects.length} project(s)...`);
             workspace_id: workspaceId,
             workspace_name: workspaceName,
             create_parent_mapping: createParentMapping,
-            ...path11.resolve(projectPath) === path11.resolve(process.cwd()) && selectedCurrentProject ? {
+            ...path10.resolve(projectPath) === path10.resolve(process.cwd()) && selectedCurrentProject ? {
               project_id: selectedCurrentProject.id,
               project_name: selectedCurrentProject.name
             } : {},
@@ -17383,7 +17708,7 @@ Applying to ${projects.length} project(s)...`);
           });
           writeActions.push({
             kind: "workspace-config",
-            target: path11.join(projectPath, ".contextstream", "config.json"),
+            target: path10.join(projectPath, ".contextstream", "config.json"),
             status: "created"
           });
           console.log(`- Linked workspace in ${projectPath}`);
@@ -17394,11 +17719,11 @@ Applying to ${projects.length} project(s)...`);
       } else if (workspaceId && workspaceId !== "dry-run" && workspaceName && dryRun) {
         writeActions.push({
           kind: "workspace-config",
-          target: path11.join(projectPath, ".contextstream", "config.json"),
+          target: path10.join(projectPath, ".contextstream", "config.json"),
           status: "dry-run"
         });
       }
-      const isCurrentProject = path11.resolve(projectPath) === path11.resolve(process.cwd());
+      const isCurrentProject = path10.resolve(projectPath) === path10.resolve(process.cwd());
       const projectIdForPath = isCurrentProject ? selectedCurrentProject?.id : void 0;
       const projectSetupEnv = {
         apiUrl,
@@ -17417,8 +17742,8 @@ Applying to ${projects.length} project(s)...`);
           if (!shouldWriteProjectMcp) continue;
           try {
             if (editor === "cursor") {
-              const cursorPath = path11.join(projectPath, ".cursor", "mcp.json");
-              const vscodePath = path11.join(projectPath, ".vscode", "mcp.json");
+              const cursorPath = path10.join(projectPath, ".cursor", "mcp.json");
+              const vscodePath = path10.join(projectPath, ".vscode", "mcp.json");
               if (dryRun) {
                 writeActions.push({ kind: "mcp-config", target: cursorPath, status: "dry-run" });
                 writeActions.push({ kind: "mcp-config", target: vscodePath, status: "dry-run" });
@@ -17432,12 +17757,12 @@ Applying to ${projects.length} project(s)...`);
             }
             if (editor === "windsurf") {
               console.log(
-                `- ${EDITOR_LABELS[editor]}: uses global MCP config only (${path11.join(homedir8(), ".codeium", "windsurf", "mcp_config.json")}).`
+                `- ${EDITOR_LABELS[editor]}: uses global MCP config only (${path10.join(homedir7(), ".codeium", "windsurf", "mcp_config.json")}).`
               );
               continue;
             }
             if (editor === "claude") {
-              const mcpPath = path11.join(projectPath, ".mcp.json");
+              const mcpPath = path10.join(projectPath, ".mcp.json");
               if (dryRun) {
                 writeActions.push({ kind: "mcp-config", target: mcpPath, status: "dry-run" });
               } else {
@@ -17447,7 +17772,7 @@ Applying to ${projects.length} project(s)...`);
               continue;
             }
             if (editor === "opencode") {
-              const openCodePath = path11.join(projectPath, "opencode.json");
+              const openCodePath = path10.join(projectPath, "opencode.json");
               if (dryRun) {
                 writeActions.push({
                   kind: "mcp-config",
@@ -17463,7 +17788,7 @@ Applying to ${projects.length} project(s)...`);
               continue;
             }
             if (editor === "copilot") {
-              const vsCodePath = path11.join(projectPath, ".vscode", "mcp.json");
+              const vsCodePath = path10.join(projectPath, ".vscode", "mcp.json");
               if (dryRun) {
                 writeActions.push({ kind: "mcp-config", target: vsCodePath, status: "dry-run" });
               } else {
@@ -17473,7 +17798,7 @@ Applying to ${projects.length} project(s)...`);
               continue;
             }
             if (editor === "kilo") {
-              const kiloPath = path11.join(projectPath, "kilo.jsonc");
+              const kiloPath = path10.join(projectPath, "kilo.jsonc");
               if (dryRun) {
                 writeActions.push({ kind: "mcp-config", target: kiloPath, status: "dry-run" });
               } else {
@@ -17484,7 +17809,7 @@ Applying to ${projects.length} project(s)...`);
               continue;
             }
             if (editor === "roo") {
-              const rooPath = path11.join(projectPath, ".roo", "mcp.json");
+              const rooPath = path10.join(projectPath, ".roo", "mcp.json");
               if (dryRun) {
                 writeActions.push({ kind: "mcp-config", target: rooPath, status: "dry-run" });
               } else {
@@ -17507,11 +17832,11 @@ Applying to ${projects.length} project(s)...`);
         const rule = generateRuleContent(editor, {
           workspaceName,
           workspaceId: workspaceId && workspaceId !== "dry-run" ? workspaceId : void 0,
-          projectName: path11.basename(projectPath),
+          projectName: path10.basename(projectPath),
           mode: getModeForEditor(editor)
         });
         if (!rule) continue;
-        const filePath = path11.join(projectPath, rule.filename);
+        const filePath = path10.join(projectPath, rule.filename);
         if (dryRun) {
           writeActions.push({ kind: "rules", target: filePath, status: "dry-run" });
           continue;
@@ -17666,7 +17991,7 @@ Applying to ${projects.length} project(s)...`);
     rl.close();
   }
 }
-var EDITOR_LABELS, CONTEXTSTREAM_START_MARKER2, CONTEXTSTREAM_END_MARKER2, LEGACY_CONTEXTSTREAM_HINTS2, LEGACY_CONTEXTSTREAM_ALLOWED_HEADINGS2, CONTEXTSTREAM_PREAMBLE_PATTERNS2, IS_WINDOWS, DEFAULT_CONTEXTSTREAM_API_URL, DEFAULT_CONTEXTSTREAM_MCP_URL, DEFAULT_CONTEXTSTREAM_TOOLSET, DEFAULT_CONTEXTSTREAM_OUTPUT_FORMAT, DEFAULT_CONTEXTSTREAM_SEARCH_LIMIT, DEFAULT_CONTEXTSTREAM_SEARCH_MAX_CHARS, DEFAULT_CONTEXTSTREAM_TRANSCRIPTS_ENABLED, DEFAULT_CONTEXTSTREAM_HOOK_TRANSCRIPTS_ENABLED, VSCODE_MCP_MODE_ENV, OPENCODE_CONFIG_SCHEMA_URL, REMOTE_HEADER_TOOLSET, REMOTE_HEADER_OUTPUT_FORMAT, REMOTE_HEADER_SEARCH_LIMIT, REMOTE_HEADER_SEARCH_MAX_CHARS, REMOTE_HEADER_TRANSCRIPTS_ENABLED, REMOTE_HEADER_CONSOLIDATED, __setupTestUtils, colors, spinnerFrames;
+var EDITOR_LABELS, CONTEXTSTREAM_START_MARKER, CONTEXTSTREAM_END_MARKER, LEGACY_CONTEXTSTREAM_HINTS, LEGACY_CONTEXTSTREAM_ALLOWED_HEADINGS, CONTEXTSTREAM_PREAMBLE_PATTERNS, IS_WINDOWS, DEFAULT_CONTEXTSTREAM_API_URL, DEFAULT_CONTEXTSTREAM_MCP_URL, DEFAULT_CONTEXTSTREAM_TOOLSET, DEFAULT_CONTEXTSTREAM_OUTPUT_FORMAT, DEFAULT_CONTEXTSTREAM_SEARCH_LIMIT, DEFAULT_CONTEXTSTREAM_SEARCH_MAX_CHARS, DEFAULT_CONTEXTSTREAM_TRANSCRIPTS_ENABLED, DEFAULT_CONTEXTSTREAM_HOOK_TRANSCRIPTS_ENABLED, VSCODE_MCP_MODE_ENV, OPENCODE_CONFIG_SCHEMA_URL, REMOTE_HEADER_TOOLSET, REMOTE_HEADER_OUTPUT_FORMAT, REMOTE_HEADER_SEARCH_LIMIT, REMOTE_HEADER_SEARCH_MAX_CHARS, REMOTE_HEADER_TRANSCRIPTS_ENABLED, REMOTE_HEADER_CONSOLIDATED, __setupTestUtils, colors, spinnerFrames;
 var init_setup = __esm({
   "src/setup.ts"() {
     "use strict";
@@ -17677,6 +18002,7 @@ var init_setup = __esm({
     init_credentials();
     init_hooks_config();
     init_files();
+    init_ignore();
     init_workspace_config();
     EDITOR_LABELS = {
       codex: "Codex CLI",
@@ -17691,9 +18017,9 @@ var init_setup = __esm({
       aider: "Aider",
       antigravity: "Antigravity (Google)"
     };
-    CONTEXTSTREAM_START_MARKER2 = "<!-- BEGIN ContextStream -->";
-    CONTEXTSTREAM_END_MARKER2 = "<!-- END ContextStream -->";
-    LEGACY_CONTEXTSTREAM_HINTS2 = [
+    CONTEXTSTREAM_START_MARKER = "<!-- BEGIN ContextStream -->";
+    CONTEXTSTREAM_END_MARKER = "<!-- END ContextStream -->";
+    LEGACY_CONTEXTSTREAM_HINTS = [
       "contextstream integration",
       "contextstream v0.4",
       "contextstream v0.3",
@@ -17702,7 +18028,7 @@ var init_setup = __esm({
       "contextstream mcp",
       "contextstream tools"
     ];
-    LEGACY_CONTEXTSTREAM_ALLOWED_HEADINGS2 = [
+    LEGACY_CONTEXTSTREAM_ALLOWED_HEADINGS = [
       "contextstream",
       "tl;dr",
       "required every message",
@@ -17723,7 +18049,7 @@ var init_setup = __esm({
       "plans & tasks",
       "complete action reference"
     ];
-    CONTEXTSTREAM_PREAMBLE_PATTERNS2 = [
+    CONTEXTSTREAM_PREAMBLE_PATTERNS = [
       /^#\s+workspace:/i,
       /^#\s+project:/i,
       /^#\s+workspace id:/i,
@@ -17785,11 +18111,13 @@ var init_setup = __esm({
 // src/hooks/post-write.ts
 var post_write_exports = {};
 __export(post_write_exports, {
-  runPostWriteHook: () => runPostWriteHook
+  runPostWriteHook: () => runPostWriteHook,
+  shouldIgnoreHookPath: () => shouldIgnoreHookPath
 });
 import * as fs10 from "node:fs";
 import * as path12 from "node:path";
 import { homedir as homedir9 } from "node:os";
+import { execFileSync } from "node:child_process";
 function extractFilePath(input) {
   if (input.tool_input) {
     const filePath = input.tool_input.file_path || input.tool_input.notebook_path || input.tool_input.path;
@@ -17895,6 +18223,29 @@ function shouldIndexFile(filePath) {
   }
   return true;
 }
+function shouldIgnoreHookPath(projectRoot, filePath) {
+  const root = path12.resolve(projectRoot);
+  const absolutePath = path12.resolve(filePath);
+  if (isInvariantIgnoredPath(absolutePath)) {
+    return true;
+  }
+  const relativePath = path12.relative(root, absolutePath).replace(/\\/g, "/");
+  if (!relativePath || relativePath === ".." || relativePath.startsWith("../")) {
+    return true;
+  }
+  if (loadIgnorePatternsSync(root).ignores(relativePath)) {
+    return true;
+  }
+  try {
+    execFileSync("git", ["-C", root, "check-ignore", "-q", "--", relativePath], {
+      stdio: "ignore",
+      timeout: 2e3
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
 function detectLanguage2(filePath) {
   const ext = path12.extname(filePath).toLowerCase();
   const langMap = {
@@ -18040,6 +18391,9 @@ async function runPostWriteHook() {
   if (!projectRoot) {
     process.exit(0);
   }
+  if (shouldIgnoreHookPath(projectRoot, absolutePath)) {
+    process.exit(0);
+  }
   const localConfig = findLocalConfig(projectRoot);
   if (!localConfig?.project_id) {
     process.exit(0);
@@ -18058,6 +18412,7 @@ var API_URL, API_KEY, ENABLED, INDEXABLE_EXTENSIONS, MAX_FILE_SIZE2, isDirectRun
 var init_post_write = __esm({
   "src/hooks/post-write.ts"() {
     "use strict";
+    init_ignore();
     API_URL = process.env.CONTEXTSTREAM_API_URL || "https://api.contextstream.io";
     API_KEY = process.env.CONTEXTSTREAM_API_KEY || "";
     ENABLED = process.env.CONTEXTSTREAM_POSTWRITE_ENABLED !== "false";
@@ -20020,9 +20375,10 @@ var init_user_prompt_submit = __esm({
     API_KEY2 = process.env.CONTEXTSTREAM_API_KEY || "";
     WORKSPACE_ID = null;
     PROJECT_ID = null;
-    REMINDER = `[CONTEXTSTREAM] On the first message in every session call mcp__contextstream__init(...), then call mcp__contextstream__context(user_message="...", save_exchange=true, session_id="<session-id>") FIRST before any other tool. On subsequent messages, default to context first. Narrow bypass is allowed only for immediate read-only ContextStream calls when prior context is fresh and no state-changing tool has run. Response contains dynamic rules, lessons, preferences.
+    REMINDER = `[CONTEXTSTREAM] On the first message in every session call mcp__contextstream__init(...), then call mcp__contextstream__context(user_message="...", save_exchange=true, session_id="<session-id>") FIRST before any other tool. On subsequent messages, default to context first. The fresh-context direct-read lane is limited to workspace list/get; memory list_*; help version/tools/auth; project list/get/index_status; and reminder list/active. Recall, decisions, searches, specific reads, writes, and indexing require context first. Fresh [GROUNDING] is the first continuation retrieval; do not immediately duplicate it with recall. Response contains dynamic rules, lessons, preferences.
 SEARCH-FIRST: Use mcp__contextstream__search(mode="auto") before Glob/Grep/Read/Explore/Task/EnterPlanMode. In planning, never use EnterPlanMode or Task(Explore) for file-by-file discovery.
 COMMON MEMORY CALLS: list docs via memory(action="list_docs"), list lessons via session(action="get_lessons"), list plans via session(action="list_plans"), list tasks/todos via memory(action="list_tasks"|"list_todos").
+HANDOFFS: A generic handoff must create entity(kind="handoff", action="create", body={title,summary,scope,next_steps}); add capsule only for a requested portable bundle/share link. HANDOFF.md or prose alone is not the canonical handoff.
 [END]`;
     FULL_REMINDER = `[CONTEXTSTREAM RULES - MANDATORY]
 
@@ -20031,7 +20387,8 @@ COMMON MEMORY CALLS: list docs via memory(action="list_docs"), list lessons via
    - Check response for: [LESSONS_WARNING], [RULES_NOTICE], preferences
    - save_exchange=true saves each conversation turn for later retrieval
    - Use a consistent session_id for the entire conversation (generate once on first message)
-   - On subsequent messages, default to context() first. Narrow bypass: immediate read-only ContextStream calls when context is fresh and no state-changing tool has run.
+   - On subsequent messages, default to context() first. Direct-read bypass is limited to workspace list/get; memory list_*; help version/tools/auth; project list/get/index_status; and reminder list/active when context is fresh and no state-changing tool has run.
+   - Fresh [GROUNDING] is the first continuation retrieval. Do not immediately duplicate sufficient grounding with session(action="recall").
 
 2. FOR CODE SEARCH: Check index status, then search appropriately
    \u2705 Use mcp__contextstream__search(mode="auto", query="...") BEFORE Glob/Grep/Read/Explore/Task/EnterPlanMode
@@ -20049,13 +20406,18 @@ COMMON MEMORY CALLS: list docs via memory(action="list_docs"), list lessons via
    \u274C DO NOT use EnterPlanMode or Task(subagent_type="Explore") for file-by-file discovery
    \u2705 For planning discovery: mcp__contextstream__search(mode="auto", query="...", output_format="paths")
 
-5. CHECK THESE from context() response:
+5. FOR HANDOFFS: Create the canonical durable handoff entity
+   \u2705 mcp__contextstream__entity(kind="handoff", action="create", body={title,summary,scope,next_steps})
+   \u2705 Add a capsule only when a portable bundle or share link is requested
+   \u274C HANDOFF.md, a scratch prompt, or prose alone is not the canonical handoff
+
+6. CHECK THESE from context() response:
    - Lessons: Past mistakes to avoid (shown as warnings)
    - Reminders: Active reminders for this project
    - Preferences: User's coding style and preferences
    - Rules: Dynamic rules matched to current task
 
-6. SKIP CONTEXTSTREAM: If user preference says "skip contextstream", use local tools instead
+7. SKIP CONTEXTSTREAM: If user preference says "skip contextstream", use local tools instead
 [END]`;
     ENHANCED_REMINDER_HEADER = `\u2B21 ContextStream \u2014 Smart Context & Memory
 
@@ -21629,10 +21991,10 @@ init_client();
 init_files();
 init_rules_templates();
 init_version();
-import * as fs7 from "node:fs";
-import * as path8 from "node:path";
+import * as fs9 from "node:fs";
+import * as path11 from "node:path";
 import { execFile as execFile2 } from "node:child_process";
-import { homedir as homedir6 } from "node:os";
+import { homedir as homedir8 } from "node:os";
 import { promisify as promisify3 } from "node:util";
 
 // src/tool-catalog.ts
@@ -22455,6 +22817,71 @@ var HotPathStore = class {
 var globalHotPathStore = new HotPathStore();
 
 // src/tools.ts
+init_setup();
+init_ignore();
+var MCP_RELEASES_URL = "https://github.com/contextstream/mcp-server/releases";
+var ENTITY_TOOL_DESCRIPTION = "Structured taxonomy entities \u2014 tickets, handoffs, incidents, releases, experiments, goals, key_results, sprints, reviews, risks, and backlog views. Use kind=handoff with action=create when the user asks to create or prepare a handoff, hand work over, or continue in another agent/session; include title, summary, scope, and next_steps. Add to_user_id only when the recipient is known; omit to_user_id rather than inventing a recipient. A handoff entity is the canonical durable handoff. A capsule is an optional additional portable artifact when the user explicitly asks for a capsule, bundle, or share link. Never substitute HANDOFF.md, a scratch prompt, a generic document/event, or prose alone. Use memory(create_task) for lightweight tasks, memory(create_doc) for runbooks/docs, and session(capture) for timeline events.";
+var CAPSULE_TOOL_DESCRIPTION = "ContextCapsule creates portable, shareable, hydrate-on-demand context artifacts. Use it when the user explicitly asks for a capsule, portable bundle, share link, team link, external-agent link, bootstrap prompt, share-token graph, or capsule audit. For a generic handoff, first create entity(kind=handoff); if a portable bundle or link is also requested, create both the handoff entity and capsule. A capsule is the artifact, not a replacement for the canonical handoff. Do not use capsule for normal turn-by-turn retrieval; use context instead.";
+function taskUpdateIsStatusOnly(update) {
+  return typeof update.status === "string" && update.status.length > 0 && update.title === void 0 && update.content === void 0 && update.description === void 0 && update.priority === void 0 && update.order === void 0 && update.plan_id === void 0 && update.plan_step_id === void 0 && update.code_refs === void 0 && update.tags === void 0 && update.blocked_reason === void 0;
+}
+function extractTaskStatus(result) {
+  if (!result || typeof result !== "object") return void 0;
+  const value = result;
+  const candidates = [
+    value.status,
+    value.task?.status,
+    value.data?.status,
+    value.data?.task?.status
+  ];
+  return candidates.find((candidate) => typeof candidate === "string");
+}
+function buildMcpVersionInfo(currentVersion, remote) {
+  const wrapped = remote && typeof remote === "object" ? remote : {};
+  const payload = wrapped.data && typeof wrapped.data === "object" ? wrapped.data : wrapped;
+  return {
+    ...payload,
+    name: "contextstream-mcp",
+    runtime_type: "legacy-typescript-mcp",
+    version: currentVersion,
+    latest_version: typeof payload.latest_version === "string" ? payload.latest_version : currentVersion,
+    release_url: typeof payload.release_url === "string" ? payload.release_url : MCP_RELEASES_URL
+  };
+}
+function dailyRecapItems(result) {
+  if (Array.isArray(result)) return result;
+  if (!result || typeof result !== "object") return [];
+  const value = result;
+  const candidates = [
+    value.recaps,
+    value.items,
+    value.data,
+    value.data?.recaps,
+    value.data?.items
+  ];
+  return candidates.find(Array.isArray) || [];
+}
+function formatDailyRecaps(result) {
+  const recaps = dailyRecapItems(result);
+  if (recaps.length === 0) {
+    return `No completed Daily Recaps found for this workspace. Automatic recaps run around 23:00 in the user's configured timezone; use session(action="trigger_recap") to queue one now.`;
+  }
+  const lines = recaps.map((recap) => {
+    const date = typeof recap.recap_date === "string" ? recap.recap_date : "unknown date";
+    const generatedAt = typeof recap.generated_at === "string" ? recap.generated_at : "generation timestamp unavailable";
+    const headline = typeof recap.headline === "string" ? recap.headline.trim() : "";
+    return `- ${date} \u2014 generated ${generatedAt}${headline ? ` \u2014 ${headline}` : ""}`;
+  });
+  return [`Daily Recaps (${recaps.length}), newest first:`, ...lines].join("\n");
+}
+async function loadMcpVersionInfo(client) {
+  try {
+    return buildMcpVersionInfo(VERSION, await client.getMcpVersion());
+  } catch (error) {
+    logDebug(`MCP release metadata unavailable: ${error instanceof Error ? error.message : String(error)}`);
+    return buildMcpVersionInfo(VERSION, void 0);
+  }
+}
 function stringOrArray(itemSchema) {
   return external_exports.union([
     external_exports.array(itemSchema),
@@ -22954,22 +23381,22 @@ async function resolveIdOrPrefix(client, value, fieldName, workspaceId, projectI
 }
 var RULES_NOTICE_CACHE_TTL_MS = 10 * 60 * 1e3;
 var RULES_VERSION_REGEX = /(?:Rules Version:\s*|^v)([0-9][0-9A-Za-z.\-]*)/im;
-var CONTEXTSTREAM_START_MARKER = "<!-- BEGIN ContextStream -->";
-var CONTEXTSTREAM_END_MARKER = "<!-- END ContextStream -->";
+var CONTEXTSTREAM_START_MARKER2 = "<!-- BEGIN ContextStream -->";
+var CONTEXTSTREAM_END_MARKER2 = "<!-- END ContextStream -->";
 var RULES_PROJECT_FILES = {
   codex: "AGENTS.md",
   claude: "CLAUDE.md",
-  copilot: path8.join(".github", "copilot-instructions.md"),
+  copilot: path11.join(".github", "copilot-instructions.md"),
   cursor: ".cursorrules",
   cline: ".clinerules",
-  kilo: path8.join(".kilocode", "rules", "contextstream.md"),
-  roo: path8.join(".roo", "rules", "contextstream.md"),
+  kilo: path11.join(".kilocode", "rules", "contextstream.md"),
+  roo: path11.join(".roo", "rules", "contextstream.md"),
   aider: ".aider.conf.yml"
 };
 var RULES_GLOBAL_FILES = {
-  codex: [path8.join(homedir6(), ".codex", "AGENTS.md")],
-  kilo: [path8.join(homedir6(), ".kilocode", "rules", "contextstream.md")],
-  roo: [path8.join(homedir6(), ".roo", "rules", "contextstream.md")]
+  codex: [path11.join(homedir8(), ".codex", "AGENTS.md")],
+  kilo: [path11.join(homedir8(), ".kilocode", "rules", "contextstream.md")],
+  roo: [path11.join(homedir8(), ".roo", "rules", "contextstream.md")]
 };
 var rulesNoticeCache = /* @__PURE__ */ new Map();
 function compareVersions2(v1, v2) {
@@ -22988,12 +23415,12 @@ function extractRulesVersions(content) {
   return Array.from(content.matchAll(regex)).map((match) => match[1]?.trim()).filter((version) => Boolean(version));
 }
 function extractContextStreamMarkerBlock(content) {
-  const startIdx = content.indexOf(CONTEXTSTREAM_START_MARKER);
-  const endIdx = content.indexOf(CONTEXTSTREAM_END_MARKER);
+  const startIdx = content.indexOf(CONTEXTSTREAM_START_MARKER2);
+  const endIdx = content.indexOf(CONTEXTSTREAM_END_MARKER2);
   if (startIdx === -1 || endIdx === -1 || endIdx <= startIdx) {
     return null;
   }
-  return content.slice(startIdx + CONTEXTSTREAM_START_MARKER.length, endIdx).trim();
+  return content.slice(startIdx + CONTEXTSTREAM_START_MARKER2.length, endIdx).trim();
 }
 function extractRulesVersion(content) {
   const markerBlock = extractContextStreamMarkerBlock(content);
@@ -23021,7 +23448,7 @@ function resolveRulesCandidatePaths(folderPath, editorKey) {
     if (!folderPath) return;
     const rel = RULES_PROJECT_FILES[key];
     if (rel) {
-      candidates.add(path8.join(folderPath, rel));
+      candidates.add(path11.join(folderPath, rel));
     }
   };
   const addGlobal = (key) => {
@@ -23053,7 +23480,7 @@ function resolveFolderPath(inputPath, sessionManager) {
   const indicators = [".git", "package.json", "Cargo.toml", "pyproject.toml", ".contextstream"];
   const hasIndicator = indicators.some((entry) => {
     try {
-      return fs7.existsSync(path8.join(cwd, entry));
+      return fs9.existsSync(path11.join(cwd, entry));
     } catch {
       return false;
     }
@@ -23072,7 +23499,7 @@ function getRulesNotice(folderPath, clientName) {
     return cached.notice;
   }
   const candidates = resolveRulesCandidatePaths(folderPath, editorKey);
-  const existing = candidates.filter((filePath) => fs7.existsSync(filePath));
+  const existing = candidates.filter((filePath) => fs9.existsSync(filePath));
   if (existing.length === 0) {
     const updateCommand2 = "generate_rules()";
     const notice2 = {
@@ -23094,7 +23521,7 @@ function getRulesNotice(folderPath, clientName) {
   const versions = [];
   for (const filePath of existing) {
     try {
-      const content = fs7.readFileSync(filePath, "utf-8");
+      const content = fs9.readFileSync(filePath, "utf-8");
       const version = extractRulesVersion(content);
       if (!version) {
         filesMissingVersion.push(filePath);
@@ -23131,7 +23558,7 @@ function getRulesNotice(folderPath, clientName) {
   rulesNoticeCache.set(cacheKey, { checkedAt: Date.now(), notice });
   return notice;
 }
-var LEGACY_CONTEXTSTREAM_HINTS = [
+var LEGACY_CONTEXTSTREAM_HINTS2 = [
   "contextstream integration",
   "contextstream v0.4",
   "contextstream v0.3",
@@ -23140,7 +23567,7 @@ var LEGACY_CONTEXTSTREAM_HINTS = [
   "contextstream mcp",
   "contextstream tools"
 ];
-var LEGACY_CONTEXTSTREAM_ALLOWED_HEADINGS = [
+var LEGACY_CONTEXTSTREAM_ALLOWED_HEADINGS2 = [
   "contextstream",
   "tl;dr",
   "required every message",
@@ -23161,7 +23588,7 @@ var LEGACY_CONTEXTSTREAM_ALLOWED_HEADINGS = [
   "plans & tasks",
   "complete action reference"
 ];
-var CONTEXTSTREAM_PREAMBLE_PATTERNS = [
+var CONTEXTSTREAM_PREAMBLE_PATTERNS2 = [
   /^#\s+workspace:/i,
   /^#\s+project:/i,
   /^#\s+workspace id:/i,
@@ -23173,34 +23600,34 @@ var CONTEXTSTREAM_PREAMBLE_PATTERNS = [
   /^#\s+roo code rules$/i,
   /^#\s+aider configuration$/i
 ];
-function wrapWithMarkers(content) {
-  return `${CONTEXTSTREAM_START_MARKER}
+function wrapWithMarkers2(content) {
+  return `${CONTEXTSTREAM_START_MARKER2}
 ${content.trim()}
-${CONTEXTSTREAM_END_MARKER}`;
+${CONTEXTSTREAM_END_MARKER2}`;
 }
-function isLegacyContextStreamRules(content) {
+function isLegacyContextStreamRules2(content) {
   const lower = content.toLowerCase();
   if (!lower.includes("contextstream")) return false;
-  if (!LEGACY_CONTEXTSTREAM_HINTS.some((hint) => lower.includes(hint))) return false;
+  if (!LEGACY_CONTEXTSTREAM_HINTS2.some((hint) => lower.includes(hint))) return false;
   const headingRegex = /^#{1,6}\s+(.+)$/gm;
   let hasHeading = false;
   let match;
   while ((match = headingRegex.exec(content)) !== null) {
     hasHeading = true;
     const heading = match[1].trim().toLowerCase();
-    const allowed = LEGACY_CONTEXTSTREAM_ALLOWED_HEADINGS.some(
+    const allowed = LEGACY_CONTEXTSTREAM_ALLOWED_HEADINGS2.some(
       (prefix) => heading.startsWith(prefix)
     );
     if (!allowed) return false;
   }
   return hasHeading;
 }
-function isContextStreamPreamble(line) {
+function isContextStreamPreamble2(line) {
   const trimmed = line.trim();
   if (!trimmed) return false;
-  return CONTEXTSTREAM_PREAMBLE_PATTERNS.some((pattern) => pattern.test(trimmed));
+  return CONTEXTSTREAM_PREAMBLE_PATTERNS2.some((pattern) => pattern.test(trimmed));
 }
-function findContextStreamHeading(lines) {
+function findContextStreamHeading2(lines) {
   const headingRegex = /^(#{1,6})\s+(.+)$/;
   for (let i = 0; i < lines.length; i += 1) {
     const match = headingRegex.exec(lines[i]);
@@ -23211,7 +23638,7 @@ function findContextStreamHeading(lines) {
   }
   return null;
 }
-function findSectionEnd(lines, startLine, level) {
+function findSectionEnd2(lines, startLine, level) {
   const headingRegex = /^(#{1,6})\s+(.+)$/;
   for (let i = startLine + 1; i < lines.length; i += 1) {
     const match = headingRegex.exec(lines[i]);
@@ -23220,16 +23647,16 @@ function findSectionEnd(lines, startLine, level) {
   }
   return lines.length;
 }
-function extractContextStreamBlock(content) {
+function extractContextStreamBlock2(content) {
   const lines = content.split(/\r?\n/);
-  const heading = findContextStreamHeading(lines);
+  const heading = findContextStreamHeading2(lines);
   if (!heading) return content.trim();
-  const endLine = findSectionEnd(lines, heading.index, heading.level);
+  const endLine = findSectionEnd2(lines, heading.index, heading.level);
   return lines.slice(heading.index, endLine).join("\n").trim();
 }
-function findLegacyContextStreamSection(content) {
+function findLegacyContextStreamSection2(content) {
   const lines = content.split(/\r?\n/);
-  const heading = findContextStreamHeading(lines);
+  const heading = findContextStreamHeading2(lines);
   if (!heading) return null;
   let startLine = heading.index;
   for (let i = heading.index - 1; i >= 0; i -= 1) {
@@ -23238,39 +23665,39 @@ function findLegacyContextStreamSection(content) {
       startLine = i;
       continue;
     }
-    if (isContextStreamPreamble(line)) {
+    if (isContextStreamPreamble2(line)) {
       startLine = i;
       continue;
     }
     break;
   }
-  const endLine = findSectionEnd(lines, heading.index, heading.level);
+  const endLine = findSectionEnd2(lines, heading.index, heading.level);
   return { startLine, endLine, contextLine: heading.index };
 }
-function blockHasPreamble(block) {
+function blockHasPreamble2(block) {
   const lines = block.split(/\r?\n/);
   for (const line of lines) {
     const trimmed = line.trim();
     if (!trimmed) continue;
-    if (isContextStreamPreamble(trimmed)) return true;
+    if (isContextStreamPreamble2(trimmed)) return true;
     if (/^#{1,6}\s+/.test(trimmed)) return false;
   }
   return false;
 }
-function replaceContextStreamBlock(existing, content) {
-  const fullWrapped = wrapWithMarkers(content);
-  const blockWrapped = wrapWithMarkers(extractContextStreamBlock(content));
-  const startIdx = existing.indexOf(CONTEXTSTREAM_START_MARKER);
-  const endIdx = existing.indexOf(CONTEXTSTREAM_END_MARKER);
+function replaceContextStreamBlock2(existing, content) {
+  const fullWrapped = wrapWithMarkers2(content);
+  const blockWrapped = wrapWithMarkers2(extractContextStreamBlock2(content));
+  const startIdx = existing.indexOf(CONTEXTSTREAM_START_MARKER2);
+  const endIdx = existing.indexOf(CONTEXTSTREAM_END_MARKER2);
   if (startIdx !== -1 && endIdx !== -1 && endIdx > startIdx) {
-    const existingBlock = existing.slice(startIdx + CONTEXTSTREAM_START_MARKER.length, endIdx);
-    const replacement = blockHasPreamble(existingBlock) ? fullWrapped : blockWrapped;
+    const existingBlock = existing.slice(startIdx + CONTEXTSTREAM_START_MARKER2.length, endIdx);
+    const replacement = blockHasPreamble2(existingBlock) ? fullWrapped : blockWrapped;
     const before = existing.substring(0, startIdx).trimEnd();
-    const after = existing.substring(endIdx + CONTEXTSTREAM_END_MARKER.length).trimStart();
+    const after = existing.substring(endIdx + CONTEXTSTREAM_END_MARKER2.length).trimStart();
     const merged = [before, replacement, after].filter((part) => part.length > 0).join("\n\n");
     return { content: merged.trim() + "\n", status: "updated" };
   }
-  const legacy = findLegacyContextStreamSection(existing);
+  const legacy = findLegacyContextStreamSection2(existing);
   if (legacy) {
     const lines = existing.split(/\r?\n/);
     const before = lines.slice(0, legacy.startLine).join("\n").trimEnd();
@@ -23279,39 +23706,39 @@ function replaceContextStreamBlock(existing, content) {
     const merged = [before, replacement, after].filter((part) => part.length > 0).join("\n\n");
     return { content: merged.trim() + "\n", status: "updated" };
   }
-  if (isLegacyContextStreamRules(existing)) {
+  if (isLegacyContextStreamRules2(existing)) {
     return { content: fullWrapped + "\n", status: "updated" };
   }
   const appended = existing.trimEnd() + "\n\n" + blockWrapped + "\n";
   return { content: appended, status: "appended" };
 }
 async function upsertRuleFile(filePath, content, writeMode = "contextstream_block") {
-  await fs7.promises.mkdir(path8.dirname(filePath), { recursive: true });
+  await fs9.promises.mkdir(path11.dirname(filePath), { recursive: true });
   if (writeMode === "full_file") {
     let existing2 = "";
     try {
-      existing2 = await fs7.promises.readFile(filePath, "utf8");
+      existing2 = await fs9.promises.readFile(filePath, "utf8");
     } catch {
     }
-    await fs7.promises.writeFile(filePath, content.trimEnd() + "\n", "utf8");
+    await fs9.promises.writeFile(filePath, content.trimEnd() + "\n", "utf8");
     return existing2 ? "updated" : "created";
   }
-  const wrappedContent = wrapWithMarkers(content);
+  const wrappedContent = wrapWithMarkers2(content);
   let existing = "";
   try {
-    existing = await fs7.promises.readFile(filePath, "utf8");
+    existing = await fs9.promises.readFile(filePath, "utf8");
   } catch {
   }
   if (!existing) {
-    await fs7.promises.writeFile(filePath, wrappedContent + "\n", "utf8");
+    await fs9.promises.writeFile(filePath, wrappedContent + "\n", "utf8");
     return "created";
   }
   if (!existing.trim()) {
-    await fs7.promises.writeFile(filePath, wrappedContent + "\n", "utf8");
+    await fs9.promises.writeFile(filePath, wrappedContent + "\n", "utf8");
     return "updated";
   }
-  const replaced = replaceContextStreamBlock(existing, content);
-  await fs7.promises.writeFile(filePath, replaced.content, "utf8");
+  const replaced = replaceContextStreamBlock2(existing, content);
+  await fs9.promises.writeFile(filePath, replaced.content, "utf8");
   return replaced.status;
 }
 async function writeEditorRules(options) {
@@ -23330,8 +23757,8 @@ async function writeEditorRules(options) {
       continue;
     }
     for (const rule of ruleFiles) {
-      const filePath = path8.join(options.folderPath, rule.filename);
-      if (fs7.existsSync(filePath) && !options.overwriteExisting) {
+      const filePath = path11.join(options.folderPath, rule.filename);
+      if (fs9.existsSync(filePath) && !options.overwriteExisting) {
         results.push({ editor, filename: rule.filename, status: "skipped (exists)" });
         continue;
       }
@@ -23388,7 +23815,7 @@ async function writeGlobalRules(options) {
       continue;
     }
     for (const filePath of globalPaths) {
-      if (fs7.existsSync(filePath) && !options.overwriteExisting) {
+      if (fs9.existsSync(filePath) && !options.overwriteExisting) {
         results.push({ editor, filename: filePath, status: "skipped (exists)", scope: "global" });
         continue;
       }
@@ -24578,6 +25005,27 @@ function scoreConfidenceBand(score) {
   if (score >= 0.6) return "medium";
   return "low";
 }
+function isExactIdentifierQuery(query) {
+  const trimmed = query.trim();
+  if (!trimmed || trimmed.length < 2 || trimmed.includes(" ")) return false;
+  if (!/^[A-Za-z0-9_:]+$/.test(trimmed)) return false;
+  const hasMixedCase = /[a-z]/.test(trimmed) && /[A-Z]/.test(trimmed);
+  const hasUnderscore = trimmed.includes("_");
+  const isAllCaps = trimmed.length >= 3 && /^[A-Z0-9_]+$/.test(trimmed);
+  return hasMixedCase || hasUnderscore || isAllCaps;
+}
+function exactQuotedLiteral(query) {
+  const trimmed = query.trim();
+  if (trimmed.length < 2) return void 0;
+  const isDoubleQuoted = trimmed.startsWith('"') && trimmed.endsWith('"');
+  const isSingleQuoted = trimmed.startsWith("'") && trimmed.endsWith("'");
+  if (!isDoubleQuoted && !isSingleQuoted) return void 0;
+  const literal = trimmed.slice(1, -1).trim();
+  return literal || void 0;
+}
+function allowBroadSearchFallbacks(modeAutoSelected, query) {
+  return modeAutoSelected && !isExactIdentifierQuery(query) && exactQuotedLiteral(query) === void 0;
+}
 function queryHasCodeIntent(query) {
   const trimmed = query.trim();
   if (!trimmed) return false;
@@ -25114,7 +25562,7 @@ async function resolveTargetProjectId(client, workspaceId, targetProject) {
     const names = [
       project?.name,
       project?.slug,
-      project?.path ? path8.basename(String(project.path)) : void 0
+      project?.path ? path11.basename(String(project.path)) : void 0
     ].filter((item) => typeof item === "string").map((item) => item.trim().toLowerCase());
     return names.includes(normalized);
   });
@@ -26085,7 +26533,7 @@ Hint: Run session_init(folder_path="<your_project_path>") first to establish a s
     );
   }
   function projectScopeRequiredResult(action, workspaceId, folderPath) {
-    const suggestedProjectName = folderPath ? path8.basename(folderPath) || "default-project" : "default-project";
+    const suggestedProjectName = folderPath ? path11.basename(folderPath) || "default-project" : "default-project";
     const createCommand = workspaceId ? folderPath ? `project(action="create", name="${suggestedProjectName}", workspace_id="${workspaceId}", folder_path="${folderPath}")` : `project(action="create", name="${suggestedProjectName}", workspace_id="${workspaceId}")` : folderPath ? `init(folder_path="${folderPath}")` : `init(folder_path="<your_project_path>")`;
     const scopeHint = workspaceId ? "Workspace-only fallback is active for this folder, but this action requires a project scope." : "No workspace/project scope is currently resolved for this folder.";
     return errorResult(
@@ -26270,16 +26718,7 @@ Next step: ${createCommand}`
     return max;
   }
   function extractQuotedLiteral(query) {
-    const trimmed = query.trim();
-    if (trimmed.length < 2) return void 0;
-    const isDoubleQuoted = trimmed.startsWith('"') && trimmed.endsWith('"');
-    const isSingleQuoted = trimmed.startsWith("'") && trimmed.endsWith("'");
-    if (!isDoubleQuoted && !isSingleQuoted) return void 0;
-    const literal = trimmed.slice(1, -1).trim();
-    return literal || void 0;
-  }
-  function escapeRegexLiteral(input) {
-    return input.replace(/[\\.+*?()[\]{}|^$]/g, "\\$&");
+    return exactQuotedLiteral(query);
   }
   const COUNT_QUERY_PREFIXES = ["how many ", "count ", "count of ", "number of ", "total "];
   const ALL_MATCH_KEYWORDS = [
@@ -26315,13 +26754,7 @@ Next step: ${createCommand}`
     return containsCodeIdentifiers(query) || isIdentifierQuery(query) ? 0.04 : SEMANTIC_SWITCH_MIN_IMPROVEMENT;
   }
   function isIdentifierQuery(query) {
-    const trimmed = query.trim();
-    if (!trimmed || trimmed.length < 2 || trimmed.includes(" ")) return false;
-    if (!/^[A-Za-z0-9_:]+$/.test(trimmed)) return false;
-    const hasMixedCase = /[a-z]/.test(trimmed) && /[A-Z]/.test(trimmed);
-    const hasUnderscore = trimmed.includes("_");
-    const isAllCaps = trimmed.length >= 3 && /^[A-Z0-9_]+$/.test(trimmed);
-    return hasMixedCase || hasUnderscore || isAllCaps;
+    return isExactIdentifierQuery(query);
   }
   function hasRegexCharacters(query) {
     const trimmed = query.trim();
@@ -26602,12 +27035,12 @@ Next step: ${createCommand}`
   async function indexedProjectIdForFolder(folderPath) {
     const status = await readIndexStatus();
     const projects = status.projects ?? {};
-    const resolvedFolder = path8.resolve(folderPath);
+    const resolvedFolder = path11.resolve(folderPath);
     let bestMatch;
     let currentRemotePromise;
     for (const [projectPath, info] of Object.entries(projects)) {
-      const resolvedProjectPath = path8.resolve(projectPath);
-      const matches = resolvedFolder === resolvedProjectPath || resolvedFolder.startsWith(`${resolvedProjectPath}${path8.sep}`) || resolvedProjectPath.startsWith(`${resolvedFolder}${path8.sep}`);
+      const resolvedProjectPath = path11.resolve(projectPath);
+      const matches = resolvedFolder === resolvedProjectPath || resolvedFolder.startsWith(`${resolvedProjectPath}${path11.sep}`) || resolvedProjectPath.startsWith(`${resolvedFolder}${path11.sep}`);
       if (!matches) continue;
       if (!info?.indexed_at) continue;
       if (info?.git_remote) {
@@ -26677,10 +27110,22 @@ Next step: ${createCommand}`
     }
   }
   async function validateReadableDirectory(inputPath) {
-    const resolvedPath = path8.resolve(inputPath);
+    const resolvedPath = path11.resolve(inputPath);
+    if (isInvariantIgnoredPath(resolvedPath)) {
+      return {
+        ok: false,
+        error: `Error: refusing to index a path inside agent state or a credential store: ${inputPath}. Pass the actual repository checkout instead.`
+      };
+    }
+    if (isBroadProjectPath(resolvedPath) && process.env.CONTEXTSTREAM_ALLOW_BROAD_INGEST !== "1") {
+      return {
+        ok: false,
+        error: `Error: refusing to index filesystem root or home directory: ${inputPath}. Pass a narrower project path, or set CONTEXTSTREAM_ALLOW_BROAD_INGEST=1 for an intentional broad ingest.`
+      };
+    }
     let stats;
     try {
-      stats = await fs7.promises.stat(resolvedPath);
+      stats = await fs9.promises.stat(resolvedPath);
     } catch (error) {
       if (error?.code === "ENOENT") {
         return { ok: false, error: `Error: path does not exist: ${inputPath}` };
@@ -26694,7 +27139,7 @@ Next step: ${createCommand}`
       return { ok: false, error: `Error: path is not a directory: ${inputPath}` };
     }
     try {
-      await fs7.promises.access(resolvedPath, fs7.constants.R_OK | fs7.constants.X_OK);
+      await fs9.promises.access(resolvedPath, fs9.constants.R_OK | fs9.constants.X_OK);
     } catch (error) {
       return {
         ok: false,
@@ -26703,6 +27148,40 @@ Next step: ${createCommand}`
     }
     return { ok: true, resolvedPath };
   }
+  async function remoteIndexStateResult(action, projectId, requestedPath) {
+    let statusResult = {};
+    try {
+      statusResult = await client.projectIndexStatus(projectId);
+    } catch (error) {
+      if (!isNotFoundError(error)) throw error;
+    }
+    const status = classifyRemoteIndexState(statusResult);
+    const filesIndexed = extractIndexedFileCount(statusResult);
+    const target = requestedPath ? `'${requestedPath}'` : "the project folder";
+    const remoteNote = `This MCP process cannot read ${target}; no workstation files were ingested by this call.`;
+    let message;
+    if (status === "server_index_ready") {
+      const countNote = filesIndexed !== void 0 ? ` (${filesIndexed} files)` : "";
+      message = `Server-side index is ready for project ${projectId}${countNote}. ${remoteNote} Keep local changes current with the ContextStream sync bridge, editor hooks, or ContextStream Desktop, and verify freshness with project(action="index_status").`;
+    } else if (status === "server_indexing") {
+      message = `A server-side index run is already in progress for project ${projectId}. ${remoteNote} Monitor it with project(action="index_status").`;
+    } else {
+      message = `No exact-checkout content upload has completed for project ${projectId}. ${remoteNote} Keep hosted MCP configured and index from a process that can read the checkout, the ContextStream sync bridge, editor hooks, or ContextStream Desktop. Then retry project(action="index") and verify with project(action="index_status").`;
+    }
+    const structured = {
+      status,
+      invoked_action: action,
+      project_id: projectId,
+      path: requestedPath ?? null,
+      local_path_readable: false,
+      files_indexed: filesIndexed ?? null,
+      message
+    };
+    return {
+      content: [{ type: "text", text: message }],
+      structuredContent: structured
+    };
+  }
   function startBackgroundIngest(projectId, resolvedPath, ingestOptions, options2 = {}) {
     void (async () => {
       const [gitHead, gitRemote] = await Promise.all([
@@ -26733,6 +27212,9 @@ Next step: ${createCommand}`
           force: ingestOptions.force,
           ingestOptions
         });
+        if (result.status === "error") {
+          throw new Error(result.lastError || "all changed-file ingest batches failed");
+        }
         logTool(
           "ingest",
           "done",
@@ -27098,9 +27580,10 @@ ${formatContent(result)}`
       inputSchema: external_exports.object({})
     },
     async () => {
-      const result = { name: "contextstream-mcp", version: VERSION };
+      const result = await loadMcpVersionInfo(client);
       return {
-        content: [{ type: "text", text: formatContent(result) }]
+        content: [{ type: "text", text: formatContent(result) }],
+        structuredContent: result
       };
     }
   );
@@ -27695,17 +28178,17 @@ Access: Free`,
       let rulesSkipped = [];
       if (input.folder_path && projectData.id) {
         try {
-          const configDir = path8.join(input.folder_path, ".contextstream");
-          const configPath = path8.join(configDir, "config.json");
-          if (!fs7.existsSync(configDir)) {
-            fs7.mkdirSync(configDir, { recursive: true });
+          const configDir = path11.join(input.folder_path, ".contextstream");
+          const configPath = path11.join(configDir, "config.json");
+          if (!fs9.existsSync(configDir)) {
+            fs9.mkdirSync(configDir, { recursive: true });
           }
           const config = {
             workspace_id: workspaceId,
             project_id: projectData.id,
             project_name: input.name
           };
-          fs7.writeFileSync(configPath, JSON.stringify(config, null, 2));
+          fs9.writeFileSync(configPath, JSON.stringify(config, null, 2));
           if (input.generate_editor_rules) {
             const ruleResults = await writeEditorRules({
               folderPath: input.folder_path,
@@ -29291,7 +29774,7 @@ This does semantic search on the first message. You only need context on subsequ
           formatContent(result)
         ].join("\n");
       } else if (status === "requires_workspace_selection") {
-        const folderName = typeof result.folder_name === "string" ? result.folder_name : typeof input.folder_path === "string" ? path8.basename(input.folder_path) || "this folder" : "this folder";
+        const folderName = typeof result.folder_name === "string" ? result.folder_name : typeof input.folder_path === "string" ? path11.basename(input.folder_path) || "this folder" : "this folder";
         const candidates = Array.isArray(result.workspace_candidates) ? result.workspace_candidates : [];
         const lines = [];
         lines.push(
@@ -29544,7 +30027,17 @@ Behavior:
           "Error: folder_path is required. Provide folder_path or run from a project directory."
         );
       }
-      const folderName = path8.basename(folderPath) || "My Project";
+      if (isInvariantIgnoredPath(folderPath)) {
+        return errorResult(
+          `Refusing to bootstrap a path inside agent state or a credential store: ${folderPath}. Pass the actual repository checkout instead.`
+        );
+      }
+      if (isBroadProjectPath(folderPath) && process.env.CONTEXTSTREAM_ALLOW_BROAD_INGEST !== "1") {
+        return errorResult(
+          `Refusing to bootstrap filesystem root or home directory as a project: ${folderPath}. Pass a narrower repository/project path.`
+        );
+      }
+      const folderName = path11.basename(folderPath) || "My Project";
       let newWorkspace;
       try {
         newWorkspace = await client.createWorkspace({
@@ -32383,6 +32876,10 @@ Output formats: full (default, includes content), paths (file paths only - 80% t
         const modeRecommendation = recommendSearchMode(input.query);
         const modeAutoSelected = modeInput === "auto";
         const requestedMode = modeAutoSelected ? modeRecommendation.mode : modeInput;
+        const broadSearchFallbacksAllowed = allowBroadSearchFallbacks(
+          modeAutoSelected,
+          input.query
+        );
         let workspaceId = resolveWorkspaceId(input.workspace_id);
         const sessionProjectId = resolveProjectId(void 0);
         const requestedExplicitProjectId = normalizeUuid(input.project_id);
@@ -32446,7 +32943,7 @@ Output formats: full (default, includes content), paths (file paths only - 80% t
           crawl: "search_crawl",
           team: "search_hybrid"
         };
-        const runSearchForMode = async (mode, baseParams2) => {
+        const runSearchForMode = async (mode, baseParams2, allowBroadFallbacks) => {
           if (mode === "team") {
             const isTeamPlanForSearch = await client.isTeamPlan();
             if (!isTeamPlanForSearch) {
@@ -32494,8 +32991,26 @@ Output formats: full (default, includes content), paths (file paths only - 80% t
           let result;
           let executedMode = dispatchMode;
           let fallbackNote;
+          const quotedLiteral = dispatchMode === "keyword" ? extractQuotedLiteral(input.query) : void 0;
+          const identifierExhaustiveFastPath = dispatchMode === "keyword" && quotedLiteral === void 0 && baseParams2.include_memory !== true && isIdentifierQuery(baseParams2.query);
+          const primaryParams = quotedLiteral ? { ...baseParams2, query: quotedLiteral } : baseParams2;
           try {
-            result = await executeSearchMode(dispatchMode, baseParams2);
+            if (identifierExhaustiveFastPath) {
+              try {
+                result = await executeSearchMode("exhaustive", baseParams2);
+                executedMode = "exhaustive";
+                fallbackNote = "Exact identifier query used the exhaustive literal fast path.";
+              } catch {
+                result = await executeSearchMode("keyword", baseParams2);
+                executedMode = "keyword";
+                fallbackNote = "Exact identifier exhaustive fast path was unavailable; used keyword search.";
+              }
+            } else {
+              result = await executeSearchMode(dispatchMode, primaryParams);
+              if (quotedLiteral) {
+                fallbackNote = "Normalized surrounding quotes before exact keyword search.";
+              }
+            }
           } catch (execError) {
             const execMsg = execError instanceof Error ? execError.message : String(execError);
             const isEmbedTimeout = execMsg.toLowerCase().includes("embedding timed out") || execMsg.toLowerCase().includes("embedding timeout");
@@ -32507,7 +33022,7 @@ Output formats: full (default, includes content), paths (file paths only - 80% t
               throw execError;
             }
           }
-          if (shouldRetrySemanticFallback(input.query, dispatchMode, result)) {
+          if (allowBroadFallbacks && shouldRetrySemanticFallback(input.query, dispatchMode, result)) {
             try {
               const semanticResult = await executeSearchMode("semantic", baseParams2);
               if (shouldPreferSemanticResults(input.query, result, semanticResult)) {
@@ -32522,63 +33037,38 @@ Output formats: full (default, includes content), paths (file paths only - 80% t
             }
           }
           const currentResults = () => extractSearchEnvelope(result).results;
-          if (dispatchMode === "keyword" && currentResults().length === 0) {
-            const literal = extractQuotedLiteral(input.query);
-            if (literal) {
-              if (literal !== baseParams2.query) {
-                try {
-                  const keywordUnquoted = await executeSearchMode("keyword", {
-                    ...baseParams2,
-                    query: literal
-                  });
-                  if (extractSearchEnvelope(keywordUnquoted).results.length > 0) {
-                    result = keywordUnquoted;
-                    executedMode = "keyword";
-                    fallbackNote = appendNote(
-                      fallbackNote,
-                      "Quoted keyword search returned no results; retried keyword search without quotes."
-                    );
-                  }
-                } catch {
-                }
-              }
-              if (currentResults().length === 0) {
-                try {
-                  const patternResult = await executeSearchMode("pattern", {
-                    ...baseParams2,
-                    query: escapeRegexLiteral(literal)
-                  });
-                  if (extractSearchEnvelope(patternResult).results.length > 0) {
-                    result = patternResult;
-                    executedMode = "pattern";
-                    fallbackNote = appendNote(
-                      fallbackNote,
-                      "Quoted keyword search returned no results; retried literal pattern search."
-                    );
-                  }
-                } catch {
-                }
+          if (quotedLiteral && currentResults().length === 0) {
+            try {
+              const exhaustiveResult = await executeSearchMode("exhaustive", {
+                ...baseParams2,
+                query: quotedLiteral
+              });
+              if (extractSearchEnvelope(exhaustiveResult).results.length > 0) {
+                result = exhaustiveResult;
+                executedMode = "exhaustive";
+                fallbackNote = appendNote(
+                  fallbackNote,
+                  "Exact keyword search returned no results; retried exhaustive search for complete literal coverage."
+                );
               }
-              if (currentResults().length === 0) {
-                try {
-                  const exhaustiveResult = await executeSearchMode("exhaustive", {
-                    ...baseParams2,
-                    query: literal
-                  });
-                  if (extractSearchEnvelope(exhaustiveResult).results.length > 0) {
-                    result = exhaustiveResult;
-                    executedMode = "exhaustive";
-                    fallbackNote = appendNote(
-                      fallbackNote,
-                      "Quoted keyword search returned no results; retried exhaustive search for complete literal coverage."
-                    );
-                  }
-                } catch {
-                }
+            } catch {
+            }
+          }
+          if (identifierExhaustiveFastPath && currentResults().length === 0) {
+            try {
+              const keywordResult = await executeSearchMode("keyword", baseParams2);
+              if (extractSearchEnvelope(keywordResult).results.length > 0) {
+                result = keywordResult;
+                executedMode = "keyword";
+                fallbackNote = appendNote(
+                  fallbackNote,
+                  "Exact identifier exhaustive lookup returned no results; keyword fallback found tokenized matches."
+                );
               }
+            } catch {
             }
           }
-          if ((dispatchMode === "refactor" || dispatchMode === "exhaustive") && currentResults().length === 0) {
+          if (allowBroadFallbacks && (dispatchMode === "refactor" || dispatchMode === "exhaustive") && currentResults().length === 0) {
             try {
               const keywordResult = await executeSearchMode("keyword", baseParams2);
               if (extractSearchEnvelope(keywordResult).results.length > 0) {
@@ -32606,7 +33096,7 @@ Output formats: full (default, includes content), paths (file paths only - 80% t
                 }
               } catch {
               }
-              if (currentResults().length === 0) {
+              if (currentResults().length === 0 && !identifierExhaustiveFastPath) {
                 try {
                   const exhaustiveResult = await executeSearchMode("exhaustive", baseParams2);
                   if (extractSearchEnvelope(exhaustiveResult).results.length > 0) {
@@ -32621,7 +33111,7 @@ Output formats: full (default, includes content), paths (file paths only - 80% t
                 }
               }
             }
-            if (currentResults().length === 0 && shouldRetryKeywordWithSemantic(input.query)) {
+            if (allowBroadFallbacks && currentResults().length === 0 && shouldRetryKeywordWithSemantic(input.query)) {
               try {
                 const semanticResult = await executeSearchMode("semantic", baseParams2);
                 if (extractSearchEnvelope(semanticResult).results.length > 0) {
@@ -32635,7 +33125,7 @@ Output formats: full (default, includes content), paths (file paths only - 80% t
               } catch {
               }
             }
-            if (currentResults().length === 0) {
+            if (allowBroadFallbacks && currentResults().length === 0) {
               try {
                 const hybridResult = await executeSearchMode("hybrid", baseParams2);
                 if (extractSearchEnvelope(hybridResult).results.length > 0) {
@@ -32675,10 +33165,14 @@ Output formats: full (default, includes content), paths (file paths only - 80% t
         }
         if (requestedMode === "team") {
           try {
-            const teamResult = await runSearchForMode("team", {
-              ...baseParams,
-              project_id: void 0
-            });
+            const teamResult = await runSearchForMode(
+              "team",
+              {
+                ...baseParams,
+                project_id: void 0
+              },
+              broadSearchFallbacksAllowed
+            );
             selected = {
               index: 0,
               project_id: void 0,
@@ -32698,7 +33192,11 @@ Output formats: full (default, includes content), paths (file paths only - 80% t
               project_id: candidateProjectId
             };
             try {
-              const modeResult = await runSearchForMode(requestedMode, paramsForCandidate);
+              const modeResult = await runSearchForMode(
+                requestedMode,
+                paramsForCandidate,
+                broadSearchFallbacksAllowed
+              );
               const envelope = extractSearchEnvelope(modeResult.result);
               if (isScopeInvalidResult(modeResult.result)) {
                 if (!selected) {
@@ -32742,7 +33240,11 @@ Output formats: full (default, includes content), paths (file paths only - 80% t
               const isEmbeddingTimeout = errMsg.toLowerCase().includes("embedding timed out") || errMsg.toLowerCase().includes("embedding timeout");
               if (isEmbeddingTimeout && requestedMode !== "keyword" && requestedMode !== "exhaustive") {
                 try {
-                  const keywordFallback = await runSearchForMode("keyword", paramsForCandidate);
+                  const keywordFallback = await runSearchForMode(
+                    "keyword",
+                    paramsForCandidate,
+                    false
+                  );
                   const kwEnvelope = extractSearchEnvelope(keywordFallback.result);
                   selected = {
                     index,
@@ -32842,9 +33344,9 @@ Output formats: full (default, includes content), paths (file paths only - 80% t
           const beforePrune = results.length;
           results = results.filter((r) => {
             if (typeof r?.file_path !== "string" || !r.file_path) return true;
-            if (path8.isAbsolute(r.file_path)) return true;
+            if (path11.isAbsolute(r.file_path)) return true;
             try {
-              return fs7.existsSync(path8.join(folderPath, r.file_path));
+              return fs9.existsSync(path11.join(folderPath, r.file_path));
             } catch {
               return true;
             }
@@ -32857,7 +33359,7 @@ Output formats: full (default, includes content), paths (file paths only - 80% t
           }
           try {
             const indexStatusFile = await readIndexStatus();
-            const indexEntry = indexStatusFile.projects?.[path8.resolve(folderPath)];
+            const indexEntry = indexStatusFile.projects?.[path11.resolve(folderPath)];
             if (indexEntry?.indexed_at) {
               const indexedAtMs = Date.parse(indexEntry.indexed_at);
               const dirtyCount = await countDirtyFilesSince(
@@ -32874,7 +33376,7 @@ Output formats: full (default, includes content), paths (file paths only - 80% t
           } catch {
           }
         }
-        if (results.length === 0 && !scopeInvalid) {
+        if (results.length === 0 && !scopeInvalid && broadSearchFallbacksAllowed) {
           const escalationModes = (() => {
             switch (selected.executedMode) {
               case "semantic":
@@ -32889,16 +33391,23 @@ Output formats: full (default, includes content), paths (file paths only - 80% t
           })();
           for (const escMode of escalationModes) {
             try {
-              const escResult = await runSearchForMode(escMode, {
-                ...baseParams,
-                workspace_id: workspaceId,
-                project_id: selected.project_id
-              });
+              const escResult = await runSearchForMode(
+                escMode,
+                {
+                  ...baseParams,
+                  workspace_id: workspaceId,
+                  project_id: selected.project_id
+                },
+                false
+              );
               const escEnvelope = extractSearchEnvelope(escResult.result);
               if (escEnvelope.results.length > 0) {
                 results = escEnvelope.results;
                 total = escEnvelope.total;
-                modeFallbackNote = appendNote(modeFallbackNote, `${selected.executedMode} returned 0 results; escalated to ${escMode}.`);
+                modeFallbackNote = appendNote(
+                  modeFallbackNote,
+                  `${selected.executedMode} returned 0 results; escalated to ${escMode}.`
+                );
                 break;
               }
             } catch {
@@ -33251,7 +33760,7 @@ ${listing}`
       "session",
       {
         title: "Session",
-        description: `Session and memory management \u2014 NOT for codebase/file search (use the 'search' tool for that). LESSONS LIVE HERE: when a mistake or correction happens, call action='capture_lesson' (NEVER write lessons to ~/.claude/.../memory/, .cursorrules, or other local markdown \u2014 local files are invisible to [LESSONS_WARNING] auto-surfacing on future turns and across sessions). PAST SESSIONS LIVE HERE: use action='recall' FIRST when the user references "last time", "previous", "yesterday", or is continuing prior work \u2014 full-text transcripts are indexed across every prior session. context() may surface [GROUNDING]; use action='ground' with user_message for a one-shot bundle (recall + docs + decisions + lessons + skills) outside context(). Actions: capture (save decision/insight), retro_capture (after-the-fact decision/note/snapshot capture from prior work with source provenance \u2014 title plus content and/or query/transcript_ids), capture_lesson (mistakes/corrections \u2014 title+trigger+impact+prevention), get_lessons (retrieve lessons), update_lesson / delete_lesson (maintain a saved lesson by lesson_id \u2014 UUID or lookup text), recall (retrieve past conversation context via ranked fusion of transcripts/snapshots/docs/decisions), ground (one-shot prior-work bundle), remember (quick save), user_context (get preferences), summary (workspace summary), compress (compress chat), delta (changes since timestamp), smart_search (searches MEMORY/conversation history only, not code), decision_trace (trace decision provenance), restore_context (restore state after compaction). Plan actions: capture_plan, get_plan, update_plan, list_plans. Suggested rules actions: list_suggested_rules, suggested_rule_action, suggested_rules_stats. Team actions: team_decisions, team_lessons, team_plans. Team/personal mode: set_account_mode (team|personal|auto).`,
+        description: `Session and memory management \u2014 NOT for codebase/file search (use the 'search' tool for that). LESSONS LIVE HERE: when a mistake or correction happens, call action='capture_lesson' (NEVER write lessons to ~/.claude/.../memory/, .cursorrules, or other local markdown \u2014 local files are invisible to [LESSONS_WARNING] auto-surfacing on future turns and across sessions). PAST SESSIONS LIVE HERE: use action='recall' FIRST when the user references "last time", "previous", "yesterday", or is continuing prior work \u2014 full-text transcripts are indexed across every prior session. context() may surface [GROUNDING]; use action='ground' with user_message for a one-shot bundle (recall + docs + decisions + lessons + skills) outside context(). Actions: capture (save decision/insight), retro_capture (after-the-fact decision/note/snapshot capture from prior work with source provenance \u2014 title plus content and/or query/transcript_ids), capture_lesson (mistakes/corrections \u2014 title+trigger+impact+prevention), get_lessons (retrieve lessons), update_lesson / delete_lesson (maintain a saved lesson by lesson_id \u2014 UUID or lookup text), recall (retrieve past conversation context via ranked fusion of transcripts/snapshots/docs/decisions), ground (one-shot prior-work bundle), remember (quick save), user_context (get preferences), summary (workspace summary), compress (compress chat), delta (changes since timestamp), smart_search (searches MEMORY/conversation history only, not code), decision_trace (trace decision provenance), list_recaps (timestamped Daily Recap history), trigger_recap (manual asynchronous Daily Recap generation), restore_context (restore state after compaction). Daily Recaps run around 23:00 in the user's timezone, not at MCP session boundaries. Plan actions: capture_plan, get_plan, update_plan, list_plans. Suggested rules actions: list_suggested_rules, suggested_rule_action, suggested_rules_stats. Team actions: team_decisions, team_lessons, team_plans. Team/personal mode: set_account_mode (team|personal|auto).`,
         inputSchema: external_exports.object({
           action: external_exports.enum([
             "capture",
@@ -33270,6 +33779,8 @@ ${listing}`
             "delta",
             "smart_search",
             "decision_trace",
+            "list_recaps",
+            "trigger_recap",
             // Plan actions
             "capture_plan",
             "get_plan",
@@ -34043,6 +34554,32 @@ ${listing}`
               };
             }
           }
+          case "list_recaps": {
+            if (!workspaceId) {
+              return errorResult("list_recaps requires workspace_id. Call init first or pass workspace_id explicitly.");
+            }
+            const result = await client.listDailyRecaps({
+              workspace_id: workspaceId,
+              limit: input.limit
+            });
+            return {
+              content: [{ type: "text", text: formatDailyRecaps(result) }],
+              structuredContent: toStructured(result)
+            };
+          }
+          case "trigger_recap": {
+            if (!workspaceId) {
+              return errorResult("trigger_recap requires workspace_id. Call init first or pass workspace_id explicitly.");
+            }
+            const result = await client.triggerDailyRecap({ workspace_id: workspaceId });
+            return {
+              content: [{
+                type: "text",
+                text: `Daily Recap generation queued. Automatic recaps also run around 23:00 in the user's configured timezone; generation is not tied to MCP session boundaries. Use session(action="list_recaps") to verify the completed recap and its generated_at timestamp.`
+              }],
+              structuredContent: toStructured(result)
+            };
+          }
           // Plan actions
           case "capture_plan": {
             if (!input.title) {
@@ -34503,15 +35040,19 @@ ${formatContent(result)}` : formatContent(result);
     registerTool(
       "entity",
       {
-        title: "Structured Entity Operations",
-        description: "Unified CRUD across taxonomy expansion entities. Kinds: ticket, handoff, backlog_view, incident, release, experiment, goal, key_result, sprint, review, risk. Actions: list, get, create, update, delete. Body is free-form JSON forwarded to the API; workspace_id/project_id default to active scope when omitted.",
+        title: "Structured Handoffs, Tickets, and Workflow Entities",
+        description: ENTITY_TOOL_DESCRIPTION,
         inputSchema: external_exports.object({
-          kind: external_exports.enum(VALID_ENTITY_KINDS).describe("Entity kind"),
+          kind: external_exports.enum(VALID_ENTITY_KINDS).describe(
+            "Entity kind. handoff is the canonical durable agent/session handoff; capsule is an optional additional portable artifact."
+          ),
           action: external_exports.enum(["list", "get", "create", "update", "delete"]).describe("Action to perform"),
           id: external_exports.string().uuid().optional().describe("Entity ID (required for get / update / delete)"),
           workspace_id: external_exports.string().uuid().optional(),
           project_id: external_exports.string().uuid().optional(),
-          body: external_exports.record(external_exports.any()).optional().describe("JSON body for create / update"),
+          body: external_exports.record(external_exports.any()).optional().describe(
+            "JSON body for create/update. For handoff create, include title, summary, scope, and next_steps; omit to_user_id when the recipient is unknown."
+          ),
           query: external_exports.record(external_exports.any()).optional().describe("Filter params for list")
         })
       },
@@ -34584,7 +35125,7 @@ ${formatContent(result)}` }],
       "capsule",
       {
         title: "ContextCapsule",
-        description: "ContextCapsule: portable, shareable, hydrate-on-demand snapshots of project context. Use capsule when the user pastes a /c/<token> link or capsule token, asks for a handoff/share/team/external-agent link, wants to bootstrap a fresh agent with project state, asks for a paste-ready handoff prompt (bootstrap prompt / prompt for another LLM), wants share-token graphs, or wants to list/audit capsules. Do not use capsule for normal turn-by-turn retrieval; use context instead. Team share links are authenticated and reusable by default; external_agent/public_link/support shares are token-gated and single-use by default.",
+        description: CAPSULE_TOOL_DESCRIPTION,
         inputSchema: external_exports.object({
           action: external_exports.enum(CAPSULE_ACTIONS).describe("Action to perform"),
           capsule_id: external_exports.string().optional().describe("ContextCapsule ID"),
@@ -35807,8 +36348,7 @@ Pass the node_id UUID to delete one, or pass delete_all=true to remove ALL exact
               return errorResult("update_task requires: task_id");
             }
             const requestedTaskStatus = input.task_status ?? input.status;
-            const result = await client.updateTask({
-              task_id: input.task_id,
+            const taskUpdate = {
               title: input.title,
               content: input.content,
               description: input.description,
@@ -35820,6 +36360,31 @@ Pass the node_id UUID to delete one, or pass delete_all=true to remove ALL exact
               code_refs: input.code_refs,
               tags: input.tags,
               blocked_reason: input.blocked_reason
+            };
+            if (taskUpdateIsStatusOnly(taskUpdate)) {
+              const current = await client.getTask({ task_id: input.task_id });
+              const currentStatus = extractTaskStatus(current);
+              if (currentStatus?.toLowerCase() === requestedTaskStatus?.toLowerCase()) {
+                const result2 = {
+                  ...current,
+                  operation_status: {
+                    operation: "update_task",
+                    state: "completed",
+                    changed: false,
+                    reason: "already_in_target_status",
+                    status: requestedTaskStatus
+                  },
+                  hint: `Task is already ${requestedTaskStatus}. No changes were needed.`
+                };
+                return {
+                  content: [{ type: "text", text: formatContent(result2) }],
+                  structuredContent: result2
+                };
+              }
+            }
+            const result = await client.updateTask({
+              task_id: input.task_id,
+              ...taskUpdate
             });
             let taskUpdateHint = "Task updated.";
             if (requestedTaskStatus === "completed") {
@@ -36842,6 +37407,41 @@ ${formatContent({
             }
             try {
               const result = await client.indexProject(projectId);
+              if (apiIndexResultIsSkipped(result)) {
+                if (!folderPath) {
+                  return remoteIndexStateResult("index", projectId);
+                }
+                const validPath = await validateReadableDirectory(folderPath);
+                if (!validPath.ok) {
+                  if (isInvariantIgnoredPath(folderPath) || isBroadProjectPath(folderPath) && process.env.CONTEXTSTREAM_ALLOW_BROAD_INGEST !== "1") {
+                    return errorResult(validPath.error);
+                  }
+                  return remoteIndexStateResult("index", projectId, folderPath);
+                }
+                const ingestOptions = {
+                  ...input.write_to_disk !== void 0 && { write_to_disk: input.write_to_disk },
+                  ...input.overwrite !== void 0 && { overwrite: input.overwrite },
+                  ...input.force !== void 0 && { force: input.force }
+                };
+                startBackgroundIngest(projectId, validPath.resolvedPath, ingestOptions);
+                const response = {
+                  status: "started",
+                  message: "Index endpoint skipped this local project type; started local ingest in the background",
+                  project_id: projectId,
+                  path: validPath.resolvedPath,
+                  fallback_action: "ingest_local",
+                  note: "Use 'project' with action 'index_status' to monitor progress."
+                };
+                return {
+                  content: [
+                    {
+                      type: "text",
+                      text: `Index endpoint skipped this local project type. Started local ingest in the background for directory: ${validPath.resolvedPath}. Use 'project' with action 'index_status' to monitor progress.`
+                    }
+                  ],
+                  structuredContent: response
+                };
+              }
               return {
                 content: [{ type: "text", text: formatContent(result) }]
               };
@@ -36850,15 +37450,14 @@ ${formatContent({
                 throw error;
               }
               if (!folderPath) {
-                return errorResult(
-                  'Index endpoint is unavailable for this local project type and no folder context is set. Run project(action="ingest_local", path="<folder>").'
-                );
+                return remoteIndexStateResult("index", projectId);
               }
               const validPath = await validateReadableDirectory(folderPath);
               if (!validPath.ok) {
-                return errorResult(
-                  `Index endpoint is unavailable for this project type and folder context path is invalid: ${folderPath}. ${validPath.error}`
-                );
+                if (isInvariantIgnoredPath(folderPath) || isBroadProjectPath(folderPath) && process.env.CONTEXTSTREAM_ALLOW_BROAD_INGEST !== "1") {
+                  return errorResult(validPath.error);
+                }
+                return remoteIndexStateResult("index", projectId, folderPath);
               }
               const ingestOptions = {
                 ...input.write_to_disk !== void 0 && { write_to_disk: input.write_to_disk },
@@ -37108,18 +37707,26 @@ ${formatContent(response)}`
             }
             const validPath = await validateReadableDirectory(ingestPath);
             if (!validPath.ok) {
-              try {
-                const pathExists = await fs7.promises.stat(ingestPath).then(() => true).catch(() => false);
-                if (!pathExists) {
-                  const apiResult = await client.ingestFromPath(projectId, ingestPath, {
-                    force: input.force
-                  });
-                  return {
-                    content: [{ type: "text", text: `Delegated ingest to API for path: ${ingestPath}
-${formatContent(apiResult)}` }]
-                  };
+              const pathExists = await fs9.promises.stat(ingestPath).then(() => true).catch(() => false);
+              if (!pathExists) {
+                if (client.canDelegatePathIngest()) {
+                  try {
+                    const apiResult = await client.ingestFromPath(projectId, ingestPath, {
+                      force: input.force
+                    });
+                    return {
+                      content: [
+                        {
+                          type: "text",
+                          text: `Delegated ingest to API for path: ${ingestPath}
+${formatContent(apiResult)}`
+                        }
+                      ]
+                    };
+                  } catch {
+                  }
                 }
-              } catch {
+                return remoteIndexStateResult("ingest_local", projectId, ingestPath);
               }
               return errorResult(validPath.error);
             }
@@ -37243,7 +37850,7 @@ Uncommitted changes: ${changes.diff_stat.summary}
             };
           }
           case "forget_local": {
-            const forgetPath = path8.resolve(input.folder_path || folderPath || process.cwd());
+            const forgetPath = path11.resolve(input.folder_path || folderPath || process.cwd());
             const outcome = forgetLocalConfig(forgetPath);
             const lines = [
               outcome.local_config_removed ? `\u2713 Removed local scope binding for ${forgetPath}.` : `No local scope binding found for ${forgetPath} (nothing to remove).`,
@@ -38717,9 +39324,10 @@ Each domain tool has an 'action' parameter for specific operations.` : "";
             };
           }
           case "version": {
-            const result = { name: "contextstream-mcp", version: VERSION };
+            const result = await loadMcpVersionInfo(client);
             return {
-              content: [{ type: "text", text: formatContent(result) }]
+              content: [{ type: "text", text: formatContent(result) }],
+              structuredContent: result
             };
           }
           case "editor_rules": {
@@ -41093,6 +41701,8 @@ Environment variables:
   CONTEXTSTREAM_SEARCH_MAX_CHARS  Max chars per search result content (default: 400)
   CONTEXTSTREAM_CONSOLIDATED  Consolidated domain tools: true|false (default: true in v0.4.x, ~75% token reduction)
   CONTEXTSTREAM_CONTEXT_PACK  Enable Context Pack in context_smart: true|false (default: true)
+  CONTEXTSTREAM_ALLOW_BROAD_INGEST Allow filesystem-root/home indexing only when explicitly set to 1
+  CONTEXTSTREAM_ALLOW_API_PATH_INGEST Allow a non-loopback API to resolve local paths only when explicitly set to 1
   CONTEXTSTREAM_PRO_TOOLS     Optional comma-separated PRO tool names (default: AI tools)
   CONTEXTSTREAM_UPGRADE_URL   Optional upgrade URL shown for PRO tools on Free plan
   CONTEXTSTREAM_ENABLE_PROMPTS Enable MCP prompts list (default: true)