@memoraone/mcp 0.1.34 → 0.1.36

package/dist/index.cjs

@@ -132,6 +132,593 @@ var config2 = {
 
 // src/client/memoraClient.ts
 var crypto = __toESM(require("crypto"), 1);
+
+// src/localState/installationCredentials.ts
+var import_node_crypto2 = require("crypto");
+
+// src/localState/repositoryBindingId.ts
+var import_node_crypto = require("crypto");
+var MRB_PREFIX = "mrb_";
+var MRB_RE = /^mrb_[A-Za-z0-9_-]{43}$/;
+function generateRepositoryBindingId(random = () => (0, import_node_crypto.randomBytes)(32)) {
+  const bytes = random();
+  if (bytes.length !== 32) {
+    throw new Error("[memoraone-mcp] repository binding id requires exactly 32 random bytes");
+  }
+  return `${MRB_PREFIX}${bytes.toString("base64url")}`;
+}
+function isRepositoryBindingId(value) {
+  return MRB_RE.test(value);
+}
+function assertRepositoryBindingId(value) {
+  if (!isRepositoryBindingId(value)) {
+    throw new Error(`[memoraone-mcp] Invalid repository_binding_id: ${value}`);
+  }
+  return value;
+}
+
+// src/localState/keyringStore.ts
+var KEYRING_SERVICE = "MemoraOne Local MCP";
+function keyringAccountForBinding(repositoryBindingId) {
+  return `binding:${assertRepositoryBindingId(repositoryBindingId)}`;
+}
+var KeyringUnavailableError = class extends Error {
+  constructor(message, cause) {
+    super(message);
+    this.name = "KeyringUnavailableError";
+    if (cause !== void 0) {
+      this.cause = cause;
+    }
+  }
+};
+var KeyringOperationError = class extends Error {
+  constructor(message, cause) {
+    super(message);
+    this.name = "KeyringOperationError";
+    if (cause !== void 0) {
+      this.cause = cause;
+    }
+  }
+};
+var cachedModule;
+var loadError;
+async function loadKeyringModule(loader = defaultKeyringLoader) {
+  if (cachedModule) {
+    return cachedModule;
+  }
+  if (cachedModule === null) {
+    throw new KeyringUnavailableError(
+      "[memoraone-mcp] OS keyring unavailable; cannot store or load credentials. No plaintext fallback.",
+      loadError
+    );
+  }
+  try {
+    cachedModule = await loader();
+    return cachedModule;
+  } catch (err) {
+    cachedModule = null;
+    loadError = err;
+    throw new KeyringUnavailableError(
+      "[memoraone-mcp] OS keyring unavailable; cannot store or load credentials. No plaintext fallback.",
+      err
+    );
+  }
+}
+async function defaultKeyringLoader() {
+  const mod = await import("@napi-rs/keyring");
+  if (!mod?.Entry) {
+    throw new Error("Entry export missing from @napi-rs/keyring");
+  }
+  return mod;
+}
+async function keyringSetPassword(repositoryBindingId, password, options = {}) {
+  const mod = await loadKeyringModule(options.loader);
+  const account = keyringAccountForBinding(repositoryBindingId);
+  try {
+    const entry = new mod.Entry(KEYRING_SERVICE, account);
+    entry.setPassword(password);
+  } catch (err) {
+    if (err instanceof KeyringUnavailableError) throw err;
+    throw new KeyringOperationError(
+      `[memoraone-mcp] Failed to write credentials to OS keyring for ${account}`,
+      err
+    );
+  }
+}
+async function keyringGetPassword(repositoryBindingId, options = {}) {
+  const mod = await loadKeyringModule(options.loader);
+  const account = keyringAccountForBinding(repositoryBindingId);
+  try {
+    const entry = new mod.Entry(KEYRING_SERVICE, account);
+    return entry.getPassword();
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (/NoEntry|not found|no entry/i.test(message)) {
+      return null;
+    }
+    if (err instanceof KeyringUnavailableError) throw err;
+    throw new KeyringOperationError(
+      `[memoraone-mcp] Failed to read credentials from OS keyring for ${account}`,
+      err
+    );
+  }
+}
+
+// src/localState/installationCredentials.ts
+function parsePayload(raw, repositoryBindingId) {
+  let parsed2;
+  try {
+    parsed2 = JSON.parse(raw);
+  } catch {
+    throw new Error("[memoraone-mcp] Corrupt keyring credential payload");
+  }
+  if (!parsed2 || typeof parsed2 !== "object" || Array.isArray(parsed2)) {
+    throw new Error("[memoraone-mcp] Corrupt keyring credential payload");
+  }
+  const obj = parsed2;
+  const id = assertRepositoryBindingId(String(obj.repositoryBindingId ?? repositoryBindingId));
+  if (id !== repositoryBindingId) {
+    throw new Error("[memoraone-mcp] Keyring credential payload binding id mismatch");
+  }
+  const payload = {
+    repositoryBindingId: id,
+    updatedAt: typeof obj.updatedAt === "string" ? obj.updatedAt : (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const optionalString = (key) => {
+    const value = obj[key];
+    if (typeof value === "string" && value.trim() !== "") {
+      payload[key] = value;
+    }
+  };
+  optionalString("installationPublicId");
+  optionalString("projectId");
+  optionalString("accessToken");
+  optionalString("refreshToken");
+  optionalString("accessTokenExpiresAt");
+  optionalString("refreshTokenExpiresAt");
+  optionalString("clientRedeemKey");
+  optionalString("clientRefreshKey");
+  return payload;
+}
+async function readInstallationCredentials(repositoryBindingId, options = {}) {
+  const id = assertRepositoryBindingId(repositoryBindingId);
+  const raw = await keyringGetPassword(id, options);
+  if (raw == null || raw.trim() === "") {
+    return null;
+  }
+  return parsePayload(raw, id);
+}
+async function writeInstallationCredentials(payload, options = {}) {
+  const id = assertRepositoryBindingId(payload.repositoryBindingId);
+  const next = {
+    ...payload,
+    repositoryBindingId: id,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await keyringSetPassword(id, JSON.stringify(next), options);
+  return next;
+}
+async function updateInstallationCredentials(repositoryBindingId, patch, options = {}) {
+  const id = assertRepositoryBindingId(repositoryBindingId);
+  const existing = await readInstallationCredentials(id, options) ?? {
+    repositoryBindingId: id,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const merged = {
+    ...existing,
+    ...Object.fromEntries(
+      Object.entries(patch).filter(([, value]) => value !== void 0)
+    ),
+    repositoryBindingId: id
+  };
+  for (const key of options.clearKeys ?? []) {
+    if (key !== "repositoryBindingId" && key !== "updatedAt") {
+      delete merged[key];
+    }
+  }
+  return writeInstallationCredentials(merged, options);
+}
+async function ensureClientRefreshKey(repositoryBindingId, options = {}) {
+  const existing = await readInstallationCredentials(repositoryBindingId, options);
+  if (existing?.clientRefreshKey) {
+    return { payload: existing, clientRefreshKey: existing.clientRefreshKey, created: false };
+  }
+  const clientRefreshKey = (0, import_node_crypto2.randomUUID)();
+  const payload = await updateInstallationCredentials(
+    repositoryBindingId,
+    { clientRefreshKey },
+    options
+  );
+  return { payload, clientRefreshKey, created: true };
+}
+async function clearClientRefreshKey(repositoryBindingId, options = {}) {
+  const existing = await readInstallationCredentials(repositoryBindingId, options);
+  if (!existing?.clientRefreshKey) return;
+  await updateInstallationCredentials(repositoryBindingId, {}, {
+    ...options,
+    clearKeys: ["clientRefreshKey"]
+  });
+}
+function hasUsableAccessToken(payload) {
+  return Boolean(payload?.accessToken && payload.accessToken.startsWith("mia_"));
+}
+
+// src/localState/localLocks.ts
+var fs3 = __toESM(require("fs/promises"), 1);
+
+// src/localState/atomicFs.ts
+var fs2 = __toESM(require("fs/promises"), 1);
+var path2 = __toESM(require("path"), 1);
+var import_node_crypto3 = require("crypto");
+var STATE_DIR_MODE = 448;
+var STATE_FILE_MODE = 384;
+async function ensurePrivateDir(dirPath) {
+  await fs2.mkdir(dirPath, { recursive: true, mode: STATE_DIR_MODE });
+  try {
+    await fs2.chmod(dirPath, STATE_DIR_MODE);
+  } catch {
+  }
+}
+async function writeFileAtomic(filePath, content, options = {}) {
+  const mode = options.mode ?? STATE_FILE_MODE;
+  const dir = path2.dirname(filePath);
+  await ensurePrivateDir(dir);
+  const tmpPath = path2.join(
+    dir,
+    `.${path2.basename(filePath)}.${process.pid}.${(0, import_node_crypto3.randomBytes)(8).toString("hex")}.tmp`
+  );
+  try {
+    await fs2.writeFile(tmpPath, content, { encoding: "utf8", mode });
+    await fs2.rename(tmpPath, filePath);
+    try {
+      await fs2.chmod(filePath, mode);
+    } catch {
+    }
+  } catch (err) {
+    try {
+      await fs2.unlink(tmpPath);
+    } catch {
+    }
+    throw err;
+  }
+}
+async function readJsonFile(filePath) {
+  try {
+    const raw = await fs2.readFile(filePath, "utf8");
+    return JSON.parse(raw);
+  } catch (err) {
+    if (err?.code === "ENOENT") {
+      return null;
+    }
+    if (err instanceof SyntaxError) {
+      throw new Error(`[memoraone-mcp] Corrupt JSON at ${filePath}`);
+    }
+    throw err;
+  }
+}
+async function writeJsonAtomic(filePath, value, options = {}) {
+  await writeFileAtomic(filePath, `${JSON.stringify(value, null, 2)}
+`, options);
+}
+
+// src/localState/statePaths.ts
+var os = __toESM(require("os"), 1);
+var path3 = __toESM(require("path"), 1);
+var MEMORAONE_STATE_DIRNAME = ".memoraone";
+function getMemoraoneStateDir(homeDir = os.homedir()) {
+  return path3.join(homeDir, MEMORAONE_STATE_DIRNAME);
+}
+function getPathIndexPath(homeDir = os.homedir()) {
+  return path3.join(getMemoraoneStateDir(homeDir), "path-index.json");
+}
+function getBindingsDir(homeDir = os.homedir()) {
+  return path3.join(getMemoraoneStateDir(homeDir), "bindings");
+}
+function getBindingFilePath(repositoryBindingId, homeDir = os.homedir()) {
+  return path3.join(getBindingsDir(homeDir), `${repositoryBindingId}.json`);
+}
+function getLocksDir(homeDir = os.homedir()) {
+  return path3.join(getMemoraoneStateDir(homeDir), "locks");
+}
+function getLockPath(lockName, homeDir = os.homedir()) {
+  return path3.join(getLocksDir(homeDir), `${lockName}.lock`);
+}
+
+// src/localState/localLocks.ts
+async function acquireLocalLock(lockName, options = {}) {
+  const homeDir = options.homeDir;
+  const maxRetries = options.maxRetries ?? 40;
+  const retryDelayMs = options.retryDelayMs ?? 50;
+  const maxLockAgeMs = options.maxLockAgeMs ?? 15e3;
+  const lockPath = getLockPath(lockName, homeDir);
+  await ensurePrivateDir(getLocksDir(homeDir));
+  let retries = 0;
+  while (retries <= maxRetries) {
+    try {
+      try {
+        const stat3 = await fs3.stat(lockPath);
+        if (Date.now() - stat3.mtimeMs > maxLockAgeMs) {
+          await fs3.unlink(lockPath);
+        }
+      } catch (err) {
+        if (err?.code !== "ENOENT") {
+          throw err;
+        }
+      }
+      const fd = await fs3.open(lockPath, "wx");
+      await fd.writeFile(
+        JSON.stringify({
+          pid: process.pid,
+          createdAt: (/* @__PURE__ */ new Date()).toISOString()
+        }),
+        "utf8"
+      );
+      await fd.close();
+      return async () => {
+        try {
+          await fs3.unlink(lockPath);
+        } catch (err) {
+          if (err?.code !== "ENOENT") {
+          }
+        }
+      };
+    } catch (err) {
+      if (err?.code === "EEXIST") {
+        retries += 1;
+        if (retries > maxRetries) {
+          throw new Error(
+            `[memoraone-mcp] Failed to acquire lock ${lockName} after ${maxRetries} retries`
+          );
+        }
+        await new Promise((resolve9) => setTimeout(resolve9, retryDelayMs));
+        continue;
+      }
+      throw err;
+    }
+  }
+  throw new Error(`[memoraone-mcp] Failed to acquire lock ${lockName}`);
+}
+async function withLocalLock(lockName, fn, options = {}) {
+  const release = await acquireLocalLock(lockName, options);
+  try {
+    return await fn();
+  } finally {
+    await release();
+  }
+}
+
+// src/localState/localConnectClient.ts
+async function requestJson(baseUrl, method, path14, options = {}) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const url = `${baseUrl.replace(/\/+$/, "")}${path14.startsWith("/") ? path14 : `/${path14}`}`;
+  const res = await fetchImpl(url, {
+    method,
+    headers: {
+      "content-type": "application/json",
+      ...options.headers ?? {}
+    },
+    body: method === "GET" ? void 0 : JSON.stringify(options.body ?? {})
+  });
+  const text = await res.text();
+  let json = null;
+  if (text) {
+    try {
+      json = JSON.parse(text);
+    } catch {
+      json = text;
+    }
+  }
+  if (!res.ok && !options.acceptStatuses?.includes(res.status)) {
+    throw new MemoraOneHttpError(res.status, res.statusText, json);
+  }
+  return { status: res.status, statusText: res.statusText, ok: res.ok, json };
+}
+async function refreshLocalMcpToken(apiUrl, body, options = {}) {
+  const res = await requestJson(apiUrl, "POST", "/v1/local-mcp/token/refresh", {
+    body,
+    fetchImpl: options.fetchImpl
+  });
+  const data = res.json;
+  if (typeof data?.access_token !== "string") {
+    throw new Error("[memoraone-mcp] Invalid refresh response");
+  }
+  return {
+    access_token: data.access_token,
+    refresh_token: typeof data.refresh_token === "string" ? data.refresh_token : void 0,
+    access_token_expires_at: typeof data.access_token_expires_at === "string" ? data.access_token_expires_at : null,
+    refresh_token_expires_at: typeof data.refresh_token_expires_at === "string" ? data.refresh_token_expires_at : null,
+    installation_public_id: typeof data.installation_public_id === "string" ? data.installation_public_id : void 0,
+    project_id: typeof data.project_id === "string" ? data.project_id : void 0,
+    repository_binding_id: typeof data.repository_binding_id === "string" ? data.repository_binding_id : void 0
+  };
+}
+
+// src/localState/tokenRefreshCoordinator.ts
+var ReconnectRequiredError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ReconnectRequiredError";
+  }
+};
+async function refreshInstallationAccessToken(options) {
+  const { repositoryBindingId, apiUrl, homeDir } = options;
+  return withLocalLock(
+    `refresh-${repositoryBindingId}`,
+    async () => {
+      const latest = await readInstallationCredentials(repositoryBindingId, options);
+      if (latest?.accessToken?.startsWith("mia_")) {
+        const expiresAt = latest.accessTokenExpiresAt ? Date.parse(latest.accessTokenExpiresAt) : NaN;
+        if (!Number.isFinite(expiresAt) || expiresAt - Date.now() > 3e4) {
+        }
+      }
+      if (!latest?.refreshToken?.startsWith("mir_")) {
+        throw new ReconnectRequiredError(
+          "[memoraone-mcp] Installation credentials missing refresh token. Run: memoraone-mcp connect <code>"
+        );
+      }
+      const { clientRefreshKey } = await ensureClientRefreshKey(repositoryBindingId, options);
+      try {
+        const refreshed = await refreshLocalMcpToken(
+          apiUrl,
+          {
+            refresh_token: latest.refreshToken,
+            client_refresh_key: clientRefreshKey
+          },
+          { fetchImpl: options.fetchImpl }
+        );
+        await updateInstallationCredentials(
+          repositoryBindingId,
+          {
+            accessToken: refreshed.access_token,
+            refreshToken: refreshed.refresh_token ?? latest.refreshToken,
+            accessTokenExpiresAt: refreshed.access_token_expires_at ?? void 0,
+            refreshTokenExpiresAt: refreshed.refresh_token_expires_at ?? void 0,
+            installationPublicId: refreshed.installation_public_id ?? latest.installationPublicId,
+            projectId: refreshed.project_id ?? latest.projectId,
+            clientRefreshKey: void 0
+          },
+          options
+        );
+        await clearClientRefreshKey(repositoryBindingId, options);
+        return refreshed.access_token;
+      } catch (err) {
+        if (err instanceof MemoraOneHttpError && (err.status === 401 || err.status === 403)) {
+          throw new ReconnectRequiredError(
+            "[memoraone-mcp] Installation revoked or refresh rejected. Run: memoraone-mcp connect <code>"
+          );
+        }
+        throw err;
+      }
+    },
+    { homeDir }
+  );
+}
+
+// src/localState/bindingStore.ts
+var fs4 = __toESM(require("fs/promises"), 1);
+var path4 = __toESM(require("path"), 1);
+
+// src/localState/bindingRecord.ts
+var BINDING_RECORD_VERSION = 1;
+var SECRET_KEYS = [
+  "accessToken",
+  "refreshToken",
+  "access_token",
+  "refresh_token",
+  "apiKey",
+  "api_key",
+  "MEMORAONE_API_KEY",
+  "clientRedeemKey",
+  "client_redeem_key",
+  "clientRefreshKey",
+  "client_refresh_key",
+  "code",
+  "connectCode",
+  "connect_code"
+];
+function assertNoSecretsInBindingRecord(record) {
+  for (const key of SECRET_KEYS) {
+    if (key in record && record[key] != null && record[key] !== "") {
+      throw new Error(`[memoraone-mcp] Binding record must not contain secret field: ${key}`);
+    }
+  }
+}
+function parseBindingRecord(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new Error("[memoraone-mcp] Corrupt binding record");
+  }
+  const obj = raw;
+  assertNoSecretsInBindingRecord(obj);
+  if (obj.v !== BINDING_RECORD_VERSION) {
+    throw new Error(`[memoraone-mcp] Unsupported binding record version: ${String(obj.v)}`);
+  }
+  const repositoryBindingId = assertRepositoryBindingId(String(obj.repositoryBindingId ?? ""));
+  const workspaceRoot = typeof obj.workspaceRoot === "string" ? obj.workspaceRoot : "";
+  if (!workspaceRoot) {
+    throw new Error("[memoraone-mcp] Binding record missing workspaceRoot");
+  }
+  const fsId = obj.filesystemIdentity;
+  if (!fsId || typeof fsId !== "object" || Array.isArray(fsId)) {
+    throw new Error("[memoraone-mcp] Binding record missing filesystemIdentity");
+  }
+  const identity = fsId;
+  const birthtimeMs = Number(identity.birthtimeMs);
+  if (typeof identity.platform !== "string" || typeof identity.deviceId !== "string" || typeof identity.inode !== "string" || !Number.isFinite(birthtimeMs) || birthtimeMs <= 0) {
+    throw new Error("[memoraone-mcp] Binding record has invalid filesystemIdentity");
+  }
+  const status = obj.status;
+  if (status !== "connected" && status !== "reconnect_required" && status !== "pending") {
+    throw new Error("[memoraone-mcp] Binding record has invalid status");
+  }
+  const record = {
+    v: BINDING_RECORD_VERSION,
+    repositoryBindingId,
+    workspaceRoot,
+    filesystemIdentity: {
+      platform: identity.platform,
+      deviceId: identity.deviceId,
+      inode: identity.inode,
+      birthtimeMs
+    },
+    rootFingerprint: typeof obj.rootFingerprint === "string" ? obj.rootFingerprint : "",
+    displayName: typeof obj.displayName === "string" ? obj.displayName : "",
+    environment: typeof obj.environment === "string" ? obj.environment : "local",
+    normalizedGitRemote: obj.normalizedGitRemote === null || typeof obj.normalizedGitRemote === "string" ? obj.normalizedGitRemote : null,
+    status,
+    createdAt: typeof obj.createdAt === "string" ? obj.createdAt : (/* @__PURE__ */ new Date()).toISOString(),
+    updatedAt: typeof obj.updatedAt === "string" ? obj.updatedAt : (/* @__PURE__ */ new Date()).toISOString()
+  };
+  if (typeof obj.apiUrl === "string" && obj.apiUrl.trim()) {
+    record.apiUrl = obj.apiUrl.trim().replace(/\/+$/, "");
+  }
+  if (typeof obj.installationPublicId === "string" && obj.installationPublicId) {
+    record.installationPublicId = obj.installationPublicId;
+  }
+  if (typeof obj.projectId === "string" && obj.projectId) {
+    record.projectId = obj.projectId;
+  }
+  if (obj.packageVersion === null || typeof obj.packageVersion === "string") {
+    record.packageVersion = obj.packageVersion;
+  }
+  if (obj.ideType === null || typeof obj.ideType === "string") {
+    record.ideType = obj.ideType;
+  }
+  return record;
+}
+
+// src/localState/bindingStore.ts
+async function ensureBindingsDir(homeDir) {
+  const dir = getBindingsDir(homeDir);
+  await ensurePrivateDir(dir);
+  return dir;
+}
+async function readBindingRecord(repositoryBindingId, homeDir) {
+  const id = assertRepositoryBindingId(repositoryBindingId);
+  const filePath = getBindingFilePath(id, homeDir);
+  const raw = await readJsonFile(filePath);
+  if (raw == null) {
+    return null;
+  }
+  return parseBindingRecord(raw);
+}
+async function writeBindingRecord(record, homeDir) {
+  assertNoSecretsInBindingRecord(record);
+  const id = assertRepositoryBindingId(record.repositoryBindingId);
+  await ensureBindingsDir(homeDir);
+  const next = {
+    ...record,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await withLocalLock(
+    `binding-${id}`,
+    async () => {
+      await writeJsonAtomic(getBindingFilePath(id, homeDir), next);
+    },
+    { homeDir }
+  );
+}
+
+// src/client/memoraClient.ts
 var PROJECT_ID_HEADER = "x-project-id";
 var uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var parseBooleanFlag2 = (value) => {
@@ -142,7 +729,7 @@ var parseBooleanFlag2 = (value) => {
   return ["1", "true", "yes", "on"].includes(normalized);
 };
 var debugEnabled = parseBooleanFlag2(process.env.MEMORAONE_DEV_MODE);
-async function requestJson(url, method, headers, body) {
+async function requestJson2(url, method, headers, body) {
   const res = await fetch(url, {
     method,
     headers,
@@ -165,13 +752,20 @@ var MemoraOneHttpError = class extends Error {
   }
 };
 var MemoraClient = class {
-  constructor(cfg, projectId, apiKey) {
-    if (!uuidRegex.test(projectId)) {
+  constructor(cfg, auth) {
+    if (!uuidRegex.test(auth.projectId)) {
       throw new Error("[memoraone-mcp] Invalid project_id for MemoraClient");
     }
     this.baseUrl = cfg.apiUrl;
-    this.apiKey = apiKey;
-    this.projectId = projectId;
+    this.projectId = auth.projectId;
+    this.repositoryBindingId = auth.repositoryBindingId;
+    this.credentialOptions = auth.credentialOptions;
+    this.homeDir = auth.homeDir;
+    this.getAccessTokenOverride = auth.getAccessToken;
+    this.refreshAccessTokenOverride = auth.refreshAccessToken;
+  }
+  getRepositoryBindingId() {
+    return this.repositoryBindingId;
   }
   resolveProjectId() {
     const projectId = this.projectId?.trim();
@@ -183,40 +777,71 @@ var MemoraClient = class {
     }
     return projectId;
   }
-  resolveApiKey() {
-    const key = this.apiKey?.trim();
-    if (!key) {
-      throw new Error("[memoraone-mcp] Missing api_key for request");
+  async resolveAccessToken() {
+    if (this.getAccessTokenOverride) {
+      return this.getAccessTokenOverride();
+    }
+    const creds = await readInstallationCredentials(
+      this.repositoryBindingId,
+      this.credentialOptions
+    );
+    const token = creds?.accessToken?.trim();
+    if (!token || !token.startsWith("mia_")) {
+      throw new ReconnectRequiredError(
+        "[memoraone-mcp] Missing installation access token. Run: memoraone-mcp connect <code>"
+      );
     }
-    return key;
+    return token;
   }
-  buildHeaders(options) {
+  async refreshAccessToken() {
+    if (this.refreshAccessTokenOverride) {
+      return this.refreshAccessTokenOverride();
+    }
+    return refreshInstallationAccessToken({
+      apiUrl: this.baseUrl,
+      repositoryBindingId: this.repositoryBindingId,
+      homeDir: this.homeDir,
+      ...this.credentialOptions
+    });
+  }
+  async markReconnectRequired() {
+    try {
+      const record = await readBindingRecord(this.repositoryBindingId, this.homeDir);
+      if (record) {
+        await writeBindingRecord(
+          { ...record, status: "reconnect_required", updatedAt: (/* @__PURE__ */ new Date()).toISOString() },
+          this.homeDir
+        );
+      }
+    } catch {
+    }
+  }
+  async buildHeaders(options) {
     const projectId = this.resolveProjectId();
-    const apiKey = this.resolveApiKey();
+    const accessToken = await this.resolveAccessToken();
     return {
       "content-type": "application/json",
-      "x-api-key": apiKey,
+      Authorization: `Bearer ${accessToken}`,
       [PROJECT_ID_HEADER]: projectId,
       ...options?.headers ?? {}
     };
   }
-  async post(path9, body, options) {
-    console.error(
-      `[memoraone-mcp][info] MemoraClient.post ENTER path=${path9}`
-    );
+  async perform(method, path14, body, options, retried = false) {
     const nonce = crypto.randomBytes(8).toString("hex");
-    const url = `${this.baseUrl}${path9.startsWith("/") ? path9 : `/${path9}`}`;
+    const url = `${this.baseUrl}${path14.startsWith("/") ? path14 : `/${path14}`}`;
     this.resolveProjectId();
     console.error(
-      `[memoraone-mcp][info] requestJson nonce=${nonce} stage=before_fetch method=POST url=${url}`
+      `[memoraone-mcp][info] requestJson nonce=${nonce} stage=before_fetch method=${method} url=${url}`
     );
-    const res = await requestJson(url, "POST", this.buildHeaders(options), body);
+    const headers = await this.buildHeaders(options);
+    delete headers["x-api-key"];
+    const res = await requestJson2(url, method, headers, body);
     if (debugEnabled && options?.log !== false) {
       const snippet = res.text.length > 200 ? `${res.text.slice(0, 200)}...` : res.text;
       console.error(
         `[memoraone-mcp][info] requestJson nonce=${nonce} stage=before_response_log`
       );
-      const line = `[memoraone-mcp][info] http response method=POST url=${url} status=${res.status} body=${snippet}`;
+      const line = `[memoraone-mcp][info] http response method=${method} url=${url} status=${res.status} body=${snippet}`;
       console.error(line);
       console.error(
         `[memoraone-mcp][info] requestJson nonce=${nonce} stage=after_response_log`
@@ -227,157 +852,458 @@ var MemoraClient = class {
       if (accepted) {
         return res.text ? JSON.parse(res.text) : null;
       }
+      if ((res.status === 401 || res.status === 403) && !options?.skipAuthRefresh && !retried) {
+        try {
+          await this.refreshAccessToken();
+          return this.perform(method, path14, body, options, true);
+        } catch (err) {
+          if (err instanceof ReconnectRequiredError) {
+            await this.markReconnectRequired();
+          }
+          throw err;
+        }
+      }
+      if (res.status === 401 || res.status === 403) {
+        await this.markReconnectRequired();
+      }
       const quiet = options?.quietHttpStatuses?.includes(res.status);
       if (!quiet) {
         const snippet = res.text.length > 200 ? `${res.text.slice(0, 200)}...` : res.text;
         process.stderr.write(
-          `[memoraone-mcp][error] http error method=POST url=${url} status=${res.status} body=${snippet}
+          `[memoraone-mcp][error] http error method=${method} url=${url} status=${res.status} body=${snippet}
 `
         );
       }
-      throw new MemoraOneHttpError(res.status, res.statusText, res.text);
+      throw new MemoraOneHttpError(res.status, res.statusText, res.text);
+    }
+    return res.text ? JSON.parse(res.text) : null;
+  }
+  async post(path14, body, options) {
+    console.error(`[memoraone-mcp][info] MemoraClient.post ENTER path=${path14}`);
+    const result = await this.perform("POST", path14, body, options);
+    console.error(`[memoraone-mcp][info] MemoraClient.post EXIT path=${path14}`);
+    return result;
+  }
+  async get(path14, options) {
+    return this.perform("GET", path14, void 0, options);
+  }
+};
+var memoraClient_default = MemoraClient;
+
+// src/projectBinding.ts
+var fs7 = __toESM(require("fs/promises"), 1);
+var path8 = __toESM(require("path"), 1);
+
+// src/localState/resolveLocalBinding.ts
+var fs6 = __toESM(require("fs/promises"), 1);
+var path7 = __toESM(require("path"), 1);
+
+// src/localState/pathIndex.ts
+var path6 = __toESM(require("path"), 1);
+
+// src/localState/rootFilesystemIdentity.ts
+var fs5 = __toESM(require("fs/promises"), 1);
+var os2 = __toESM(require("os"), 1);
+var path5 = __toESM(require("path"), 1);
+var import_node_child_process = require("child_process");
+var import_node_util = require("util");
+var execFileAsync = (0, import_node_util.promisify)(import_node_child_process.execFile);
+function filesystemIdentityKey(identity) {
+  return [
+    identity.platform,
+    identity.deviceId,
+    identity.inode,
+    String(identity.birthtimeMs)
+  ].join("|");
+}
+function identitiesMatch(a, b) {
+  return filesystemIdentityKey(a) === filesystemIdentityKey(b);
+}
+async function readDarwinDeviceId() {
+  const { stdout } = await execFileAsync("ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"]);
+  const match = stdout.match(/"IOPlatformUUID"\s*=\s*"([^"]+)"/);
+  if (!match?.[1]) {
+    throw new Error("[memoraone-mcp] Unable to read macOS IOPlatformUUID");
+  }
+  return match[1].trim();
+}
+async function readLinuxDeviceId() {
+  try {
+    const content = await fs5.readFile("/etc/machine-id", "utf8");
+    const id = content.trim();
+    if (id) return id;
+  } catch {
+  }
+  try {
+    const content = await fs5.readFile("/var/lib/dbus/machine-id", "utf8");
+    const id = content.trim();
+    if (id) return id;
+  } catch {
+  }
+  throw new Error("[memoraone-mcp] Unable to read Linux machine-id");
+}
+async function readWindowsDeviceId() {
+  const { stdout } = await execFileAsync("reg", [
+    "query",
+    "HKLM\\SOFTWARE\\Microsoft\\Cryptography",
+    "/v",
+    "MachineGuid"
+  ]);
+  const match = stdout.match(/MachineGuid\s+REG_SZ\s+(.+)/i);
+  if (!match?.[1]) {
+    throw new Error("[memoraone-mcp] Unable to read Windows MachineGuid");
+  }
+  return match[1].trim();
+}
+async function resolveDeviceId(platform2 = os2.platform()) {
+  if (platform2 === "darwin") return readDarwinDeviceId();
+  if (platform2 === "linux") return readLinuxDeviceId();
+  if (platform2 === "win32") return readWindowsDeviceId();
+  try {
+    const { stdout } = await execFileAsync("hostid", []);
+    const id = stdout.trim();
+    if (id) return id;
+  } catch {
+  }
+  throw new Error(`[memoraone-mcp] Unsupported platform for device ID: ${platform2}`);
+}
+async function captureRootFilesystemIdentity(rootPath, deps = {}) {
+  const resolved = path5.resolve(rootPath);
+  const platform2 = deps.platform ?? os2.platform();
+  const statRoot = deps.statRoot ?? (async (p) => {
+    const st2 = await fs5.stat(p);
+    return {
+      ino: st2.ino,
+      dev: st2.dev,
+      birthtimeMs: st2.birthtimeMs,
+      isDirectory: () => st2.isDirectory()
+    };
+  });
+  const readDeviceId = deps.readDeviceId ?? (() => resolveDeviceId(platform2));
+  const st = await statRoot(resolved);
+  if (!st.isDirectory()) {
+    throw new Error(`[memoraone-mcp] Workspace root is not a directory: ${resolved}`);
+  }
+  const birthtimeMs = Number(st.birthtimeMs);
+  if (!Number.isFinite(birthtimeMs) || birthtimeMs <= 0) {
+    throw new Error(
+      "[memoraone-mcp] Root birth time unavailable; cannot bind this working tree. Reconnect required."
+    );
+  }
+  const inode = typeof st.ino === "bigint" ? st.ino.toString() : String(st.ino);
+  const deviceId = await readDeviceId();
+  if (!deviceId || !inode) {
+    throw new Error(
+      "[memoraone-mcp] Ambiguous filesystem identity; cannot bind this working tree. Reconnect required."
+    );
+  }
+  return {
+    platform: platform2,
+    deviceId,
+    inode,
+    birthtimeMs
+  };
+}
+
+// src/localState/pathIndex.ts
+var PATH_INDEX_VERSION = 1;
+function emptyIndex() {
+  return {
+    v: PATH_INDEX_VERSION,
+    byPath: {},
+    byIdentity: {},
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function parsePathIndex(raw) {
+  if (raw == null) {
+    return emptyIndex();
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new Error("[memoraone-mcp] Corrupt path-index.json");
+  }
+  const obj = raw;
+  if (obj.v !== PATH_INDEX_VERSION) {
+    throw new Error(`[memoraone-mcp] Unsupported path-index version: ${String(obj.v)}`);
+  }
+  const byPath = obj.byPath && typeof obj.byPath === "object" && !Array.isArray(obj.byPath) ? obj.byPath : {};
+  const byIdentity = obj.byIdentity && typeof obj.byIdentity === "object" && !Array.isArray(obj.byIdentity) ? obj.byIdentity : {};
+  return {
+    v: PATH_INDEX_VERSION,
+    byPath: { ...byPath },
+    byIdentity: { ...byIdentity },
+    updatedAt: typeof obj.updatedAt === "string" ? obj.updatedAt : (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+async function loadPathIndex(homeDir) {
+  const filePath = getPathIndexPath(homeDir);
+  try {
+    const raw = await readJsonFile(filePath);
+    return parsePathIndex(raw);
+  } catch (err) {
+    if (err instanceof Error && err.message.includes("Corrupt")) {
+      throw err;
+    }
+    throw err;
+  }
+}
+async function savePathIndex(index, homeDir) {
+  const next = {
+    ...index,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await writeJsonAtomic(getPathIndexPath(homeDir), next);
+}
+function lookupPathIndex(index, workspaceRoot, identity) {
+  const resolved = path6.resolve(workspaceRoot);
+  const byPathId = index.byPath[resolved];
+  if (byPathId) {
+    return { kind: "path", repositoryBindingId: assertRepositoryBindingId(byPathId) };
+  }
+  const identityKey = filesystemIdentityKey(identity);
+  const byIdentityId = index.byIdentity[identityKey];
+  if (!byIdentityId) {
+    return { kind: "none" };
+  }
+  const previousPath = Object.entries(index.byPath).find(([, id]) => id === byIdentityId)?.[0];
+  if (!previousPath) {
+    return {
+      kind: "identity-rename",
+      repositoryBindingId: assertRepositoryBindingId(byIdentityId),
+      previousPath: resolved
+    };
+  }
+  return {
+    kind: "identity-rename",
+    repositoryBindingId: assertRepositoryBindingId(byIdentityId),
+    previousPath
+  };
+}
+async function upsertPathIndexEntry(options) {
+  const repositoryBindingId = assertRepositoryBindingId(options.repositoryBindingId);
+  const resolved = path6.resolve(options.workspaceRoot);
+  const identityKey = filesystemIdentityKey(options.identity);
+  return withLocalLock(
+    "path-index",
+    async () => {
+      const index = await loadPathIndex(options.homeDir);
+      if (options.previousPath && path6.resolve(options.previousPath) !== resolved) {
+        delete index.byPath[path6.resolve(options.previousPath)];
+      }
+      for (const [p, id] of Object.entries(index.byPath)) {
+        if (id === repositoryBindingId && p !== resolved) {
+          delete index.byPath[p];
+        }
+      }
+      for (const [key, id] of Object.entries(index.byIdentity)) {
+        if (id === repositoryBindingId && key !== identityKey) {
+          delete index.byIdentity[key];
+        }
+      }
+      index.byPath[resolved] = repositoryBindingId;
+      index.byIdentity[identityKey] = repositoryBindingId;
+      await savePathIndex(index, options.homeDir);
+      return index;
+    },
+    { homeDir: options.homeDir }
+  );
+}
+function identityMatchesStored(stored, current) {
+  return identitiesMatch(stored, current);
+}
+
+// src/localState/resolveLocalBinding.ts
+async function detectLegacyM1Warning(workspaceRoot) {
+  const candidate = path7.join(path7.resolve(workspaceRoot), CANONICAL_M1_FILENAME);
+  try {
+    await fs6.access(candidate);
+    return candidate;
+  } catch {
+    return void 0;
+  }
+}
+async function ensureRepositoryBindingForRoot(workspaceRoot, options = {}) {
+  const resolved = path7.resolve(workspaceRoot);
+  const identity = await captureRootFilesystemIdentity(resolved, options.identityDeps);
+  const legacyM1WarningPath = await detectLegacyM1Warning(resolved);
+  const index = await loadPathIndex(options.homeDir);
+  const lookup = lookupPathIndex(index, resolved, identity);
+  if (lookup.kind === "path") {
+    const record = await readBindingRecord(lookup.repositoryBindingId, options.homeDir);
+    if (record && identityMatchesStored(record.filesystemIdentity, identity)) {
+      if (path7.resolve(record.workspaceRoot) !== resolved) {
+        const updated = {
+          ...record,
+          workspaceRoot: resolved,
+          updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+        };
+        await writeBindingRecord(updated, options.homeDir);
+        await upsertPathIndexEntry({
+          repositoryBindingId: record.repositoryBindingId,
+          workspaceRoot: resolved,
+          identity,
+          homeDir: options.homeDir,
+          previousPath: record.workspaceRoot
+        });
+      }
+      return {
+        repositoryBindingId: record.repositoryBindingId,
+        identity,
+        created: false,
+        legacyM1WarningPath
+      };
     }
-    console.error(
-      `[memoraone-mcp][info] MemoraClient.post EXIT path=${path9}`
-    );
-    return res.text ? JSON.parse(res.text) : null;
   }
-  async get(path9, options) {
-    const nonce = crypto.randomBytes(8).toString("hex");
-    const url = `${this.baseUrl}${path9.startsWith("/") ? path9 : `/${path9}`}`;
-    this.resolveProjectId();
-    console.error(
-      `[memoraone-mcp][info] requestJson nonce=${nonce} stage=before_fetch method=GET url=${url}`
-    );
-    const res = await requestJson(url, "GET", this.buildHeaders(options));
-    if (debugEnabled && options?.log !== false) {
-      const snippet = res.text.length > 200 ? `${res.text.slice(0, 200)}...` : res.text;
-      console.error(
-        `[memoraone-mcp][info] requestJson nonce=${nonce} stage=before_response_log`
-      );
-      const line = `[memoraone-mcp][info] http response method=GET url=${url} status=${res.status} body=${snippet}`;
-      console.error(line);
-      console.error(
-        `[memoraone-mcp][info] requestJson nonce=${nonce} stage=after_response_log`
-      );
-    }
-    if (!res.ok) {
-      const snippet = res.text.length > 200 ? `${res.text.slice(0, 200)}...` : res.text;
-      process.stderr.write(
-        `[memoraone-mcp][error] http error method=GET url=${url} status=${res.status} body=${snippet}
-`
-      );
-      throw new MemoraOneHttpError(res.status, res.statusText, res.text);
+  if (lookup.kind === "identity-rename") {
+    const record = await readBindingRecord(lookup.repositoryBindingId, options.homeDir);
+    if (record && identityMatchesStored(record.filesystemIdentity, identity)) {
+      const updated = {
+        ...record,
+        workspaceRoot: resolved,
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      await writeBindingRecord(updated, options.homeDir);
+      await upsertPathIndexEntry({
+        repositoryBindingId: record.repositoryBindingId,
+        workspaceRoot: resolved,
+        identity,
+        homeDir: options.homeDir,
+        previousPath: lookup.previousPath
+      });
+      return {
+        repositoryBindingId: record.repositoryBindingId,
+        identity,
+        created: false,
+        renamedFrom: lookup.previousPath,
+        legacyM1WarningPath
+      };
     }
-    return res.text ? JSON.parse(res.text) : null;
   }
-};
-var memoraClient_default = MemoraClient;
-
-// src/initializeBinding.ts
-var path5 = __toESM(require("path"), 1);
-var import_node_url = require("url");
-
-// src/bindingIdentity.ts
-var crypto2 = __toESM(require("crypto"), 1);
-var path2 = __toESM(require("path"), 1);
-var BINDING_SOCKET_HASH_LENGTH = 16;
-function bindingsMatch(a, b) {
-  return a.projectId.trim().toLowerCase() === b.projectId.trim().toLowerCase() && path2.resolve(a.workspaceRoot) === path2.resolve(b.workspaceRoot) && path2.resolve(a.m1Path) === path2.resolve(b.m1Path);
+  if (!options.createIfMissing) {
+    throw new ReconnectRequiredError(
+      `[memoraone-mcp] No local binding for workspace ${resolved}. Run: memoraone-mcp connect <code>`
+    );
+  }
+  const repositoryBindingId = generateRepositoryBindingId();
+  return {
+    repositoryBindingId,
+    identity,
+    created: true,
+    legacyM1WarningPath
+  };
 }
-function formatMissingInitializeWorkspaceError(options) {
-  const lines = [
-    "[memoraone-mcp] Could not resolve workspace from MCP initialize params."
-  ];
-  if (options?.rootsListAttempted) {
-    lines.push(
-      "Cursor initialize lacked workspaceFolders/rootUri; roots/list was attempted but returned no usable repo root."
+async function resolveLocalBinding(workspaceRoot, options = {}) {
+  const resolved = path7.resolve(workspaceRoot);
+  const { repositoryBindingId, legacyM1WarningPath } = await ensureRepositoryBindingForRoot(
+    resolved,
+    { ...options, createIfMissing: false }
+  );
+  const record = await readBindingRecord(repositoryBindingId, options.homeDir);
+  if (!record) {
+    throw new ReconnectRequiredError(
+      `[memoraone-mcp] Binding metadata missing for ${repositoryBindingId}. Run: memoraone-mcp connect <code>`
     );
-    if (options.rootsListUris && options.rootsListUris.length > 0) {
-      lines.push(`roots/list URIs: ${options.rootsListUris.join(", ")}`);
-    }
-    lines.push(
-      "Global Cursor MCP cannot safely bind per-window repos without a workspace signal from Cursor (initialize roots or roots/list)."
+  }
+  const identity = await captureRootFilesystemIdentity(resolved, options.identityDeps);
+  if (!identityMatchesStored(record.filesystemIdentity, identity)) {
+    throw new ReconnectRequiredError(
+      "[memoraone-mcp] Workspace filesystem identity changed. Run: memoraone-mcp connect <code>"
     );
-    lines.push(
-      "Reload MCP in this Cursor window, or ensure this repo has a managed .cursor/mcp.json from setup-ide-files --cursor."
+  }
+  if (record.status === "reconnect_required") {
+    throw new ReconnectRequiredError(
+      "[memoraone-mcp] Installation requires reconnect. Run: memoraone-mcp connect <code>"
     );
-    return lines.join("\n");
   }
-  lines.push(
-    "Reload MCP in this Cursor window so initialize includes workspaceFolders, rootUri, or a usable roots/list response for this repo."
+  const creds = await readInstallationCredentials(
+    repositoryBindingId,
+    options.credentialOptions
   );
-  return lines.join("\n");
+  if (!hasUsableAccessToken(creds) || !creds?.refreshToken) {
+    throw new ReconnectRequiredError(
+      "[memoraone-mcp] Installation credentials missing. Run: memoraone-mcp connect <code>"
+    );
+  }
+  const projectId = record.projectId ?? creds.projectId;
+  if (!projectId) {
+    throw new ReconnectRequiredError(
+      "[memoraone-mcp] Binding missing project id. Run: memoraone-mcp connect <code>"
+    );
+  }
+  return {
+    repositoryBindingId,
+    projectId,
+    workspaceRoot: resolved,
+    installationPublicId: record.installationPublicId ?? creds.installationPublicId,
+    environment: record.environment,
+    bindingSource: "local-binding",
+    status: record.status,
+    legacyM1WarningPath
+  };
 }
 
 // src/projectBinding.ts
-var fs2 = __toESM(require("fs/promises"), 1);
-var path3 = __toESM(require("path"), 1);
-var uuidRegex2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function normalizeEnvironment(raw) {
-  if (raw === void 0 || raw === null || typeof raw !== "string") {
-    return void 0;
-  }
-  const trimmed = raw.trim();
-  return trimmed === "" ? void 0 : trimmed;
+var CANONICAL_M1_FILENAME = "memoraone.m1";
+function toResolvedBinding(local) {
+  return {
+    repositoryBindingId: local.repositoryBindingId,
+    projectId: local.projectId,
+    workspaceRoot: local.workspaceRoot,
+    installationPublicId: local.installationPublicId,
+    environment: local.environment,
+    bindingSource: "local-binding",
+    status: local.status,
+    legacyM1WarningPath: local.legacyM1WarningPath
+  };
 }
-function parseAndValidateM1(content, markerPath) {
-  let parsed2;
+async function warnLegacyM1IfPresent(workspaceRoot) {
+  const candidate = path8.join(path8.resolve(workspaceRoot), CANONICAL_M1_FILENAME);
   try {
-    parsed2 = JSON.parse(content);
+    await fs7.access(candidate);
+    process.stderr.write(
+      `[memoraone-mcp] warning: ignoring legacy ${CANONICAL_M1_FILENAME} (not used for credentials or binding)
+`
+    );
+    return candidate;
   } catch {
-    throw new Error(`[memoraone-mcp] Invalid memoraone.m1 JSON at ${markerPath}`);
-  }
-  const projectId = parsed2?.projectId ?? parsed2?.project_id;
-  if (!projectId || typeof projectId !== "string") {
-    throw new Error(`[memoraone-mcp] memoraone.m1 missing projectId at ${markerPath}`);
-  }
-  if (!uuidRegex2.test(projectId.trim())) {
-    throw new Error(`[memoraone-mcp] memoraone.m1 projectId is not a UUID at ${markerPath}`);
+    return void 0;
   }
-  const apiKeyRaw = parsed2?.MEMORAONE_API_KEY ?? parsed2?.api_key;
-  const apiKey = apiKeyRaw !== void 0 && apiKeyRaw !== null && typeof apiKeyRaw === "string" && apiKeyRaw.trim() !== "" ? apiKeyRaw.trim() : null;
-  const environment = normalizeEnvironment(parsed2?.environment);
-  return environment === void 0 ? { projectId: projectId.trim(), apiKey } : { projectId: projectId.trim(), apiKey, environment };
 }
-async function resolveProjectIdFromExplicitM1Path() {
-  const raw = process.env.MEMORAONE_M1_PATH;
-  if (raw === void 0 || raw.trim() === "") {
-    return null;
-  }
-  const markerPath = path3.resolve(raw);
-  try {
-    const content = await fs2.readFile(markerPath, "utf8");
-    const { projectId, apiKey, environment } = parseAndValidateM1(content, markerPath);
-    return environment === void 0 ? { projectId, apiKey, foundAt: markerPath } : { projectId, apiKey, environment, foundAt: markerPath };
-  } catch (err) {
-    if (err?.code === "ENOENT") {
-      return null;
-    }
-    throw err;
+async function resolveAuthoritativeBinding(workspaceRoot, _options = {}) {
+  const candidates = normalizeWorkspaceSearchRoots(workspaceRoot);
+  if (candidates.length === 0) {
+    throw new ReconnectRequiredError(
+      "[memoraone-mcp] Could not resolve workspace root. Open a connected repository folder.\nRun: memoraone-mcp connect <code>"
+    );
   }
-}
-async function findM1WalkingUp(workspaceRoot) {
-  let current = path3.resolve(workspaceRoot);
-  while (true) {
-    const markerPath = path3.join(current, "memoraone.m1");
+  const bindings = [];
+  for (const root of candidates) {
+    await warnLegacyM1IfPresent(root);
     try {
-      const content = await fs2.readFile(markerPath, "utf8");
-      const { projectId, apiKey, environment } = parseAndValidateM1(content, markerPath);
-      const repoRoot = path3.dirname(markerPath);
-      return environment === void 0 ? { projectId, apiKey, repoRoot, markerPath } : { projectId, apiKey, environment, repoRoot, markerPath };
+      const local = await resolveLocalBinding(root);
+      bindings.push(toResolvedBinding(local));
     } catch (err) {
-      if (err?.code !== "ENOENT") {
-        throw err;
+      if (err instanceof ReconnectRequiredError) {
+        continue;
       }
+      throw err;
     }
-    const parent = path3.dirname(current);
-    if (parent === current) {
-      break;
-    }
-    current = parent;
   }
-  return null;
+  if (bindings.length === 0) {
+    throw new ReconnectRequiredError(
+      "[memoraone-mcp] No local MemoraOne binding for this workspace.\nRun: memoraone-mcp connect <code>"
+    );
+  }
+  const distinctIds = new Set(bindings.map((b) => b.repositoryBindingId));
+  if (distinctIds.size > 1) {
+    const lines = bindings.map(
+      (b) => `  - workspace=${b.workspaceRoot} binding=${b.repositoryBindingId} project=${b.projectId}`
+    );
+    throw new Error(
+      "[memoraone-mcp] Ambiguous workspace binding: multiple open roots map to different repository bindings.\n" + lines.join("\n") + "\nOpen one repo per window."
+    );
+  }
+  return bindings[0];
 }
 function normalizeWorkspaceSearchRoots(workspaceRoot) {
   if (workspaceRoot === void 0) {
@@ -387,14 +1313,10 @@ function normalizeWorkspaceSearchRoots(workspaceRoot) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   for (const raw of list) {
-    if (raw === void 0) {
-      continue;
-    }
+    if (raw === void 0) continue;
     const trimmed = String(raw).trim();
-    if (trimmed === "") {
-      continue;
-    }
-    const resolved = path3.resolve(trimmed);
+    if (trimmed === "") continue;
+    const resolved = path8.resolve(trimmed);
     if (!seen.has(resolved)) {
       seen.add(resolved);
       out.push(resolved);
@@ -402,77 +1324,109 @@ function normalizeWorkspaceSearchRoots(workspaceRoot) {
   }
   return out;
 }
-function resolveApiKeyWithSource(fileApiKey) {
-  const envApiKey = process.env.MEMORAONE_API_KEY?.trim();
-  if (envApiKey) {
-    return { apiKey: envApiKey, apiKeySource: "env" };
-  }
-  const aliasEnvApiKey = process.env.MEMORA_API_KEY?.trim();
-  if (aliasEnvApiKey) {
-    return { apiKey: aliasEnvApiKey, apiKeySource: "env" };
+function bindingRelevantValuesMatch(a, b) {
+  const envA = a.environment ?? void 0;
+  const envB = b.environment ?? void 0;
+  return a.repositoryBindingId === b.repositoryBindingId && a.projectId.trim().toLowerCase() === b.projectId.trim().toLowerCase() && path8.resolve(a.workspaceRoot) === path8.resolve(b.workspaceRoot) && (a.installationPublicId ?? void 0) === (b.installationPublicId ?? void 0) && envA === envB && a.status === b.status;
+}
+async function reconcileResolvedBindingWithDisk(cached) {
+  const repositoryBindingId = assertRepositoryBindingId(cached.repositoryBindingId);
+  const record = await readBindingRecord(repositoryBindingId);
+  if (!record) {
+    throw new ReconnectRequiredError(
+      `[memoraone-mcp] Cached binding missing for ${repositoryBindingId}. Run: memoraone-mcp connect <code>`
+    );
   }
-  if (fileApiKey) {
-    return { apiKey: fileApiKey, apiKeySource: "memoraone.m1" };
+  const workspaceRoot = path8.resolve(record.workspaceRoot);
+  const identity = await captureRootFilesystemIdentity(workspaceRoot);
+  if (!identitiesMatch(record.filesystemIdentity, identity)) {
+    throw new ReconnectRequiredError(
+      "[memoraone-mcp] Workspace filesystem identity changed. Run: memoraone-mcp connect <code>"
+    );
   }
-  return { apiKey: null, apiKeySource: "none" };
-}
-async function resolveAuthoritativeBinding(workspaceRoot, options = {}) {
-  const respectExplicitM1Path = options.respectExplicitM1Path !== false;
-  if (respectExplicitM1Path) {
-    const explicitBinding = await resolveProjectIdFromExplicitM1Path();
-    if (explicitBinding) {
-      const resolved = resolveApiKeyWithSource(explicitBinding.apiKey);
-      return {
-        projectId: explicitBinding.projectId,
-        workspaceRoot: path3.dirname(explicitBinding.foundAt),
-        m1Path: explicitBinding.foundAt,
-        apiKey: resolved.apiKey,
-        ...explicitBinding.environment !== void 0 ? { environment: explicitBinding.environment } : {},
-        bindingSource: "explicit-m1-path",
-        apiKeySource: resolved.apiKeySource
-      };
-    }
+  if (record.status === "reconnect_required" || !record.projectId) {
+    throw new ReconnectRequiredError(
+      "[memoraone-mcp] Installation requires reconnect. Run: memoraone-mcp connect <code>"
+    );
   }
-  const candidates = normalizeWorkspaceSearchRoots(workspaceRoot);
-  if (candidates.length === 0) {
-    throw new Error("Could not find memoraone.m1 in workspace.\nOpen a folder containing memoraone.m1.");
+  const fresh = {
+    repositoryBindingId,
+    projectId: record.projectId,
+    workspaceRoot,
+    installationPublicId: record.installationPublicId,
+    environment: record.environment,
+    bindingSource: "local-binding",
+    status: record.status
+  };
+  if (bindingRelevantValuesMatch(cached, fresh)) {
+    return { binding: fresh, cacheRefreshed: false };
   }
-  const bindings = [];
-  for (const root of candidates) {
-    const binding = await findM1WalkingUp(root);
-    if (binding) {
-      const resolved = resolveApiKeyWithSource(binding.apiKey);
-      bindings.push({
-        projectId: binding.projectId,
-        workspaceRoot: binding.repoRoot,
-        m1Path: binding.markerPath,
-        apiKey: resolved.apiKey,
-        ...binding.environment !== void 0 ? { environment: binding.environment } : {},
-        bindingSource: "workspace-search",
-        apiKeySource: resolved.apiKeySource
-      });
+  return { binding: fresh, cacheRefreshed: true };
+}
+function encodeResolvedBinding(binding) {
+  const payload = {
+    repositoryBindingId: binding.repositoryBindingId,
+    projectId: binding.projectId,
+    workspaceRoot: binding.workspaceRoot,
+    installationPublicId: binding.installationPublicId,
+    environment: binding.environment,
+    bindingSource: binding.bindingSource,
+    status: binding.status
+  };
+  return Buffer.from(JSON.stringify(payload), "utf8").toString("base64");
+}
+
+// src/initializeBinding.ts
+var path11 = __toESM(require("path"), 1);
+var import_node_url = require("url");
+
+// src/bindingIdentity.ts
+var crypto2 = __toESM(require("crypto"), 1);
+var path9 = __toESM(require("path"), 1);
+var BINDING_SOCKET_HASH_LENGTH = 16;
+function hashBindingIdentity(repositoryBindingId, workspaceRoot, ideType) {
+  const input = [
+    repositoryBindingId.trim(),
+    path9.resolve(workspaceRoot),
+    ideType
+  ].join("|");
+  return crypto2.createHash("sha256").update(input).digest("hex").slice(0, BINDING_SOCKET_HASH_LENGTH);
+}
+function bindingsMatch(a, b) {
+  const envA = a.environment ?? void 0;
+  const envB = b.environment ?? void 0;
+  return a.repositoryBindingId === b.repositoryBindingId && a.projectId.trim().toLowerCase() === b.projectId.trim().toLowerCase() && path9.resolve(a.workspaceRoot) === path9.resolve(b.workspaceRoot) && (a.installationPublicId ?? void 0) === (b.installationPublicId ?? void 0) && envA === envB && a.status === b.status;
+}
+function formatMissingInitializeWorkspaceError(options) {
+  const lines = [
+    "[memoraone-mcp] Could not resolve workspace from MCP initialize params."
+  ];
+  if (options?.rootsListAttempted) {
+    lines.push(
+      "Cursor initialize lacked workspaceFolders/rootUri; roots/list was attempted but returned no usable repo root."
+    );
+    if (options.rootsListUris && options.rootsListUris.length > 0) {
+      lines.push(`roots/list URIs: ${options.rootsListUris.join(", ")}`);
     }
-  }
-  if (bindings.length === 0) {
-    throw new Error("Could not find memoraone.m1 in workspace.\nOpen a folder containing memoraone.m1.");
-  }
-  const distinctProjectIds = new Set(bindings.map((b) => b.projectId));
-  if (distinctProjectIds.size > 1) {
-    const lines = bindings.map(
-      (b) => `  - workspace=${b.workspaceRoot} project=${b.projectId} m1=${b.m1Path}`
+    lines.push(
+      "Global Cursor MCP cannot safely bind per-window repos without a workspace signal from Cursor (initialize roots or roots/list)."
     );
-    throw new Error(
-      "[memoraone-mcp] Ambiguous workspace binding: multiple open roots map to different MemoraOne projects.\n" + lines.join("\n") + "\nOpen one repo per Cursor window, or use repo-scoped .cursor/mcp.json from setup-ide-files --cursor."
+    lines.push(
+      "Reload MCP in this Cursor window, or ensure this repo has a managed .cursor/mcp.json from setup-ide-files --cursor."
     );
+    return lines.join("\n");
   }
-  return bindings[0];
+  lines.push(
+    "Reload MCP in this Cursor window so initialize includes workspaceFolders, rootUri, or a usable roots/list response for this repo."
+  );
+  return lines.join("\n");
 }
 
 // src/socketPaths.ts
-var os = __toESM(require("os"), 1);
-var path4 = __toESM(require("path"), 1);
-var fs3 = __toESM(require("fs"), 1);
-var BASE_DIR = process.env.MEMORAONE_MCP_LOCK_DIR || path4.join(os.homedir(), ".memoraone-mcp");
+var os3 = __toESM(require("os"), 1);
+var path10 = __toESM(require("path"), 1);
+var fs8 = __toESM(require("fs"), 1);
+var BASE_DIR = process.env.MEMORAONE_MCP_LOCK_DIR || path10.join(os3.homedir(), ".memoraone-mcp");
 var HASH_SOCKET_FILENAME_RE = new RegExp(
   `^mcp-[0-9a-f]{${BINDING_SOCKET_HASH_LENGTH}}\\.sock$`,
   "i"
@@ -488,6 +1442,17 @@ function parseIdeType(value) {
 function resolveIdeTypeFromEnv(env2 = process.env) {
   return parseIdeType(env2.MEMORAONE_IDE_TYPE);
 }
+function resolveBindingIdeType(env2 = process.env) {
+  return resolveIdeTypeFromEnv(env2) ?? "";
+}
+function getBindingSocketFilename(binding, env2 = process.env) {
+  const ideType = resolveBindingIdeType(env2);
+  const hash = hashBindingIdentity(binding.repositoryBindingId, binding.workspaceRoot, ideType);
+  return `mcp-${hash}.sock`;
+}
+function getBindingSocketPath(binding, env2 = process.env) {
+  return path10.join(BASE_DIR, getBindingSocketFilename(binding, env2));
+}
 
 // src/initializeBinding.ts
 var MEMORAONE_WORKSPACE_ROOT_ENV = "MEMORAONE_WORKSPACE_ROOT";
@@ -508,8 +1473,8 @@ function getEnvWorkspaceRootCandidates() {
   const raw = process.env.WORKSPACE_FOLDER_PATHS;
   const parts = [];
   if (raw !== void 0 && raw.trim() !== "") {
-    for (const p of raw.split(path5.delimiter).map((s) => s.trim()).filter(Boolean)) {
-      parts.push(path5.resolve(p));
+    for (const p of raw.split(path11.delimiter).map((s) => s.trim()).filter(Boolean)) {
+      parts.push(path11.resolve(p));
     }
   }
   parts.push(process.cwd());
@@ -533,7 +1498,7 @@ function extractWorkspaceRootsFromInitialize(params) {
     if (uri === void 0 || uri.trim() === "") {
       return;
     }
-    const resolved = path5.resolve(uriToPath(uri));
+    const resolved = path11.resolve(uriToPath(uri));
     if (!seen.has(resolved)) {
       seen.add(resolved);
       roots.push(resolved);
@@ -555,11 +1520,11 @@ function getRepoScopedWorkspaceHint(env2 = process.env) {
   if (raw === void 0 || raw.trim() === "") {
     return null;
   }
-  return path5.resolve(raw.trim());
+  return path11.resolve(raw.trim());
 }
 function formatWorkspaceAmbiguityError(bindings) {
   const lines = bindings.map(
-    (b) => `  - workspace=${b.workspaceRoot} project=${b.projectId} m1=${b.m1Path}`
+    (b) => `  - workspace=${b.workspaceRoot} binding=${b.repositoryBindingId} project=${b.projectId}`
   );
   return "[memoraone-mcp] Ambiguous workspace binding: multiple open roots map to different MemoraOne projects.\n" + lines.join("\n") + `
 Open one repo per Cursor window, or ensure this repo's managed .cursor/mcp.json includes ${MEMORAONE_WORKSPACE_ROOT_ENV} from setup-ide-files --cursor.`;
@@ -567,7 +1532,7 @@ Open one repo per Cursor window, or ensure this repo's managed .cursor/mcp.json
 function formatRepoHintInitializeMismatchError(repoHintRoot, initializeBinding) {
   return `[memoraone-mcp] Repo-scoped workspace hint conflicts with MCP initialize workspace.
   ${MEMORAONE_WORKSPACE_ROOT_ENV}: ${repoHintRoot}
-  initialize: project=${initializeBinding.projectId} workspace=${initializeBinding.workspaceRoot} m1=${initializeBinding.m1Path}
+  initialize: binding=${initializeBinding.repositoryBindingId} project=${initializeBinding.projectId} workspace=${initializeBinding.workspaceRoot}
 Reload MCP in the Cursor window for this repo, or re-run setup-ide-files --cursor here if the hint is stale.`;
 }
 function formatRepoHintNotInRootsListError(repoHintRoot, rootsListPaths) {
@@ -578,13 +1543,16 @@ Reload MCP in the Cursor window for this repo, or re-run setup-ide-files --curso
 }
 function formatBindingMismatchError(daemonHint, sessionBinding) {
   return `[memoraone-mcp] Project binding mismatch between daemon and MCP initialize workspace.
-  daemon: project=${daemonHint.projectId} workspace=${daemonHint.workspaceRoot} m1=${daemonHint.m1Path}
-  initialize: project=${sessionBinding.projectId} workspace=${sessionBinding.workspaceRoot} m1=${sessionBinding.m1Path}
-Reconnect or reload the MCP server in this IDE window so the bridge can bind to the correct project.`;
+  daemon: binding=${daemonHint.repositoryBindingId} project=${daemonHint.projectId} workspace=${daemonHint.workspaceRoot}
+  initialize: binding=${sessionBinding.repositoryBindingId} project=${sessionBinding.projectId} workspace=${sessionBinding.workspaceRoot}
+Reconnect or reload the MCP server in this IDE window so the bridge can bind to the correct project.
+If this workspace is not connected, run: memoraone-mcp connect <code>`;
 }
 async function resolveBindingFromWorkspaceRoots(workspaceRoots, options = {}) {
   if (workspaceRoots.length === 0) {
-    throw new Error("Could not find memoraone.m1 in workspace.\nOpen a folder containing memoraone.m1.");
+    throw new Error(
+      "[memoraone-mcp] No local MemoraOne binding for this workspace.\nRun: memoraone-mcp connect <code>"
+    );
   }
   const bindings = [];
   for (const root of workspaceRoots) {
@@ -595,14 +1563,16 @@ async function resolveBindingFromWorkspaceRoots(workspaceRoots, options = {}) {
         })
       );
     } catch (err) {
-      if (err instanceof Error && err.message.includes("Could not find memoraone.m1")) {
+      if (err instanceof Error && (err.message.includes("No local MemoraOne binding") || err.message.includes("memoraone-mcp connect") || err.name === "ReconnectRequiredError")) {
         continue;
       }
       throw err;
     }
   }
   if (bindings.length === 0) {
-    throw new Error("Could not find memoraone.m1 in workspace.\nOpen a folder containing memoraone.m1.");
+    throw new Error(
+      "[memoraone-mcp] No local MemoraOne binding for this workspace.\nRun: memoraone-mcp connect <code>"
+    );
   }
   const distinctProjectIds = new Set(bindings.map((b) => b.projectId));
   if (distinctProjectIds.size > 1) {
@@ -633,108 +1603,67 @@ async function resolveBindingFromInitializeParams(params, options = {}) {
   const rootsListUris = options.rootsListUris ?? [];
   const rootsListPaths = rootsListUris.map((uri) => uriToPath(uri)).filter(Boolean);
   if (rootsListPaths.length > 1 && repoHint !== null) {
-    const hintResolved = path5.resolve(repoHint);
-    const matchingRoot = rootsListPaths.find((root) => path5.resolve(root) === hintResolved);
+    const hintResolved = path11.resolve(repoHint);
+    const matchingRoot = rootsListPaths.find((root) => path11.resolve(root) === hintResolved);
     if (!matchingRoot) {
       throw new Error(formatRepoHintNotInRootsListError(repoHint, rootsListPaths));
     }
-    return resolveAuthoritativeBinding(repoHint, { respectExplicitM1Path: false });
-  }
-  if (rootsListPaths.length > 0) {
-    return resolveBindingFromWorkspaceRoots(rootsListPaths, resolveOpts);
-  }
-  if (repoHint !== null) {
-    return resolveAuthoritativeBinding(repoHint, { respectExplicitM1Path: false });
-  }
-  if (options.allowEnvWorkspaceFallback === false) {
-    throw new Error(
-      formatMissingInitializeWorkspaceError({
-        rootsListAttempted: options.rootsListAttempted === true,
-        rootsListUris
-      })
-    );
-  }
-  const fallbackRoots = options.fallbackWorkspaceRoots ?? getEnvWorkspaceRootCandidates();
-  return resolveAuthoritativeBinding(fallbackRoots, {
-    respectExplicitM1Path: options.respectExplicitM1Path
-  });
-}
-
-// src/bridgeClientRoots.ts
-var readline = __toESM(require("readline"), 1);
-var TRUTHY = /* @__PURE__ */ new Set(["1", "true", "yes", "on"]);
-function isInitializeDebugEnabled(env2 = process.env) {
-  return TRUTHY.has(String(env2.MEMORAONE_DEBUG_INIT ?? "").trim().toLowerCase());
-}
-
-// src/sourceRegistration.ts
-var path6 = __toESM(require("path"), 1);
-var import_node_url2 = require("url");
-var LOG_PREFIX = "[memoraone-mcp][source-registration]";
-function buildRepoSourcePayload(normalizedRepoPath, ideType) {
-  const body = {
-    kind: "repo",
-    label: path6.basename(normalizedRepoPath),
-    uri: (0, import_node_url2.pathToFileURL)(normalizedRepoPath).href
-  };
-  if (ideType) {
-    body.metadata = {
-      ide_type: ideType
-    };
-  }
-  return body;
-}
-async function registerRepoSource(client, projectId, repoPath, ideType) {
-  try {
-    if (repoPath === void 0 || repoPath === null || String(repoPath).trim() === "") {
-      process.stderr.write(
-        `${LOG_PREFIX} skipped: empty repoPath (cannot register workspace)
-`
-      );
-      return;
-    }
-    const normalizedRepoPath = path6.resolve(String(repoPath));
-    const body = buildRepoSourcePayload(normalizedRepoPath, ideType);
-    const primaryPath = `/v1/projects/${projectId}/sources`;
-    const alternatePath = `/v1/projects/${projectId}/sources/register`;
-    process.stderr.write(
-      `${LOG_PREFIX} registering projectId=${projectId} path=${normalizedRepoPath} ideType=${ideType ?? "(none)"}
-`
-    );
-    try {
-      await client.post(primaryPath, body, {
-        acceptStatuses: [409],
-        log: false,
-        quietHttpStatuses: [404, 405, 501]
-      });
-      process.stderr.write(`${LOG_PREFIX} ok: POST ${primaryPath}
-`);
-      return;
-    } catch (err) {
-      if (err instanceof MemoraOneHttpError && (err.status === 404 || err.status === 405 || err.status === 501)) {
-        process.stderr.write(
-          `${LOG_PREFIX} primary route returned ${err.status}; retrying POST ${alternatePath}
-`
-        );
-        await client.post(alternatePath, body, { acceptStatuses: [409], log: false });
-        process.stderr.write(`${LOG_PREFIX} ok: POST ${alternatePath}
-`);
-        return;
-      }
-      throw err;
-    }
-  } catch (err) {
-    const msg = String(err?.message ?? err);
-    process.stderr.write(`${LOG_PREFIX} failed: ${msg}
-`);
-    if (err instanceof MemoraOneHttpError) {
-      const bodyStr = typeof err.body === "string" ? err.body : JSON.stringify(err.body ?? null);
-      process.stderr.write(
-        `${LOG_PREFIX} http status=${err.status} body=${bodyStr.length > 500 ? bodyStr.slice(0, 500) + "..." : bodyStr}
-`
-      );
-    }
+    return resolveAuthoritativeBinding(repoHint, { respectExplicitM1Path: false });
+  }
+  if (rootsListPaths.length > 0) {
+    return resolveBindingFromWorkspaceRoots(rootsListPaths, resolveOpts);
+  }
+  if (repoHint !== null) {
+    return resolveAuthoritativeBinding(repoHint, { respectExplicitM1Path: false });
+  }
+  if (options.allowEnvWorkspaceFallback === false) {
+    throw new Error(
+      formatMissingInitializeWorkspaceError({
+        rootsListAttempted: options.rootsListAttempted === true,
+        rootsListUris
+      })
+    );
+  }
+  const fallbackRoots = options.fallbackWorkspaceRoots ?? getEnvWorkspaceRootCandidates();
+  return resolveAuthoritativeBinding(fallbackRoots, {
+    respectExplicitM1Path: options.respectExplicitM1Path
+  });
+}
+
+// src/bindingSidecar.ts
+var fs9 = __toESM(require("fs"), 1);
+var path12 = __toESM(require("path"), 1);
+function bindingSidecarPath(socketPath) {
+  if (socketPath.endsWith(".sock")) {
+    return `${socketPath.slice(0, -".sock".length)}.binding.json`;
+  }
+  return `${socketPath}.binding.json`;
+}
+function writeBindingSidecar(socketPath, binding, ideType = resolveBindingIdeType()) {
+  const payload = encodeResolvedBinding(binding);
+  if (/accessToken|refreshToken|apiKey|mia_|mir_|sk_/.test(payload)) {
+    throw new Error("[memoraone-mcp] Refusing to write sidecar containing secrets");
+  }
+  const record = {
+    v: 3,
+    ...ideType ? { ideType } : {},
+    repositoryBindingId: binding.repositoryBindingId,
+    projectId: binding.projectId,
+    workspaceRoot: binding.workspaceRoot,
+    binding: payload
+  };
+  const text = JSON.stringify(record);
+  if (/["']?(accessToken|refreshToken|apiKey|clientRedeemKey|clientRefreshKey)["']?\s*:/.test(text)) {
+    throw new Error("[memoraone-mcp] Refusing to write sidecar containing secrets");
   }
+  fs9.writeFileSync(bindingSidecarPath(socketPath), text, "utf8");
+}
+
+// src/bridgeClientRoots.ts
+var readline = __toESM(require("readline"), 1);
+var TRUTHY = /* @__PURE__ */ new Set(["1", "true", "yes", "on"]);
+function isInitializeDebugEnabled(env2 = process.env) {
+  return TRUTHY.has(String(env2.MEMORAONE_DEBUG_INIT ?? "").trim().toLowerCase());
 }
 
 // src/tools/postEvent.ts
@@ -838,21 +1767,11 @@ var logCommandShape = {
   stats: import_v410.z.record(import_v410.z.string(), import_v410.z.any()).optional()
 };
 
-// src/tools/listProjects.ts
-var listProjectsShape = {};
-
-// src/tools/setProject.ts
-var import_v411 = require("zod/v4");
-var setProjectShape = {
-  projectKey: import_v411.z.string().min(1).optional(),
-  projectId: import_v411.z.string().min(1).optional()
-};
-
 // src/tools/bindingStatus.ts
 var bindingStatusShape = {};
 
 // src/tools/handlers/postEvent.ts
-var import_v412 = require("zod/v4");
+var import_v411 = require("zod/v4");
 var crypto4 = __toESM(require("crypto"), 1);
 
 // src/runContext.ts
@@ -885,9 +1804,6 @@ function getBoundProjectId() {
 function setBoundProjectId(id) {
   getSessionContext().boundProjectId = id;
 }
-function setBoundApiKey(key) {
-  getSessionContext().boundApiKey = key;
-}
 function getCurrentRunId() {
   return getSessionContext().currentRunId;
 }
@@ -900,9 +1816,6 @@ function getCurrentProjectId() {
 function setCurrentProjectId(id) {
   getSessionContext().currentProjectId = id;
 }
-function setCurrentApiKey(key) {
-  getSessionContext().currentApiKey = key;
-}
 function resolveRunId(passed) {
   if (passed) {
     return passed;
@@ -914,14 +1827,14 @@ function generateRunId() {
 }
 
 // src/tools/handlers/postEvent.ts
-var postEventInputSchema = import_v412.z.object({
-  kind: import_v412.z.string().min(1),
-  actor: import_v412.z.object({
-    identifier: import_v412.z.string().min(1),
-    id: import_v412.z.string().min(1).optional()
+var postEventInputSchema = import_v411.z.object({
+  kind: import_v411.z.string().min(1),
+  actor: import_v411.z.object({
+    identifier: import_v411.z.string().min(1),
+    id: import_v411.z.string().min(1).optional()
   }),
-  content: import_v412.z.record(import_v412.z.string(), import_v412.z.any()),
-  metadata: import_v412.z.record(import_v412.z.string(), import_v412.z.any()).optional()
+  content: import_v411.z.record(import_v411.z.string(), import_v411.z.any()),
+  metadata: import_v411.z.record(import_v411.z.string(), import_v411.z.any()).optional()
 });
 function buildPostEventContentFields(content) {
   if (typeof content.message === "string") {
@@ -957,7 +1870,9 @@ async function handlePostEvent(client, args) {
   const parsed2 = postEventInputSchema.parse(args ?? {});
   const projectKey = getCurrentProjectId();
   if (!projectKey) {
-    throw new Error("No project selected. Use memora_list_projects and memora_set_project to select a project.");
+    throw new Error(
+      "No active repository binding. Reconnect this repository through MemoraOne Studio or run the generated connect command."
+    );
   }
   const content = parsed2.content ?? {};
   const { message, new_value } = buildPostEventContentFields(content);
@@ -991,16 +1906,18 @@ async function handlePostEvent(client, args) {
 }
 
 // src/tools/handlers/createFact.ts
-var import_v413 = require("zod/v4");
-var createFactInputSchema = import_v413.z.object({
-  content: import_v413.z.string().min(1),
-  metadata: import_v413.z.record(import_v413.z.string(), import_v413.z.any()).optional()
+var import_v412 = require("zod/v4");
+var createFactInputSchema = import_v412.z.object({
+  content: import_v412.z.string().min(1),
+  metadata: import_v412.z.record(import_v412.z.string(), import_v412.z.any()).optional()
 });
 async function handleCreateFact(client, args) {
   const parsed2 = createFactInputSchema.parse(args ?? {});
   const projectKey = getCurrentProjectId();
   if (!projectKey) {
-    throw new Error("No project selected. Use memora_list_projects and memora_set_project to select a project.");
+    throw new Error(
+      "No active repository binding. Reconnect this repository through MemoraOne Studio or run the generated connect command."
+    );
   }
   const content = parsed2.content.trim();
   if (!content) {
@@ -1037,13 +1954,13 @@ async function handleCreateFact(client, args) {
 }
 
 // src/tools/handlers/addPersonalContext.ts
-var import_v414 = require("zod/v4");
-var addPersonalContextInputSchema = import_v414.z.object({
-  content: import_v414.z.string().min(1),
-  category: import_v414.z.string().optional(),
-  tags: import_v414.z.array(import_v414.z.string()).optional(),
-  scope_type: import_v414.z.enum(["general", "project"]).optional(),
-  scope_id: import_v414.z.string().optional()
+var import_v413 = require("zod/v4");
+var addPersonalContextInputSchema = import_v413.z.object({
+  content: import_v413.z.string().min(1),
+  category: import_v413.z.string().optional(),
+  tags: import_v413.z.array(import_v413.z.string()).optional(),
+  scope_type: import_v413.z.enum(["general", "project"]).optional(),
+  scope_id: import_v413.z.string().optional()
 });
 async function handleAddPersonalContext(client, args) {
   const parsed2 = addPersonalContextInputSchema.parse(args ?? {});
@@ -1079,12 +1996,12 @@ async function handleAddPersonalContext(client, args) {
 }
 
 // src/tools/handlers/getPersonalContext.ts
-var import_v415 = require("zod/v4");
-var getPersonalContextInputSchema = import_v415.z.object({
-  query: import_v415.z.string().optional(),
-  scope_type: import_v415.z.enum(["general", "project"]).optional(),
-  scope_id: import_v415.z.string().optional(),
-  limit: import_v415.z.number().int().positive().optional()
+var import_v414 = require("zod/v4");
+var getPersonalContextInputSchema = import_v414.z.object({
+  query: import_v414.z.string().optional(),
+  scope_type: import_v414.z.enum(["general", "project"]).optional(),
+  scope_id: import_v414.z.string().optional(),
+  limit: import_v414.z.number().int().positive().optional()
 });
 function buildPersonalContextPath(parsed2) {
   const params = new URLSearchParams();
@@ -1105,9 +2022,9 @@ function buildPersonalContextPath(parsed2) {
 }
 async function handleGetPersonalContext(client, args) {
   const parsed2 = getPersonalContextInputSchema.parse(args ?? {});
-  const path9 = buildPersonalContextPath(parsed2);
+  const path14 = buildPersonalContextPath(parsed2);
   try {
-    const result = await client.get(path9);
+    const result = await client.get(path14);
     return { ok: true, result };
   } catch (err) {
     if (err instanceof MemoraOneHttpError) {
@@ -1121,13 +2038,13 @@ async function handleGetPersonalContext(client, args) {
 }
 
 // src/tools/handlers/askWithMemory.ts
-var import_v416 = require("zod/v4");
-var askWithMemoryInputSchema = import_v416.z.object({
-  question: import_v416.z.string().min(1),
-  code_context: import_v416.z.object({
-    file_path: import_v416.z.string().optional(),
-    selected_text: import_v416.z.string().optional(),
-    language: import_v416.z.string().optional()
+var import_v415 = require("zod/v4");
+var askWithMemoryInputSchema = import_v415.z.object({
+  question: import_v415.z.string().min(1),
+  code_context: import_v415.z.object({
+    file_path: import_v415.z.string().optional(),
+    selected_text: import_v415.z.string().optional(),
+    language: import_v415.z.string().optional()
   }).optional()
 });
 function isAskWithMemoryResponse(value) {
@@ -1137,7 +2054,9 @@ async function handleAskWithMemory(client, args) {
   const parsed2 = askWithMemoryInputSchema.parse(args ?? {});
   const projectKey = getCurrentProjectId();
   if (!projectKey) {
-    throw new Error("No project selected. Use memora_list_projects and memora_set_project to select a project.");
+    throw new Error(
+      "No active repository binding. Reconnect this repository through MemoraOne Studio or run the generated connect command."
+    );
   }
   const payload = {
     question: parsed2.question,
@@ -1161,19 +2080,21 @@ async function handleAskWithMemory(client, args) {
 }
 
 // src/tools/handlers/logIntent.ts
-var import_v417 = require("zod/v4");
-var logIntentInputSchema = import_v417.z.object({
-  intent: import_v417.z.enum(["task", "decision"]),
-  message: import_v417.z.string().min(1),
-  context: import_v417.z.record(import_v417.z.string(), import_v417.z.any()).optional(),
-  intent_source: import_v417.z.string().optional().default("cursor_chat"),
-  run_id: import_v417.z.string().min(1).optional()
+var import_v416 = require("zod/v4");
+var logIntentInputSchema = import_v416.z.object({
+  intent: import_v416.z.enum(["task", "decision"]),
+  message: import_v416.z.string().min(1),
+  context: import_v416.z.record(import_v416.z.string(), import_v416.z.any()).optional(),
+  intent_source: import_v416.z.string().optional().default("cursor_chat"),
+  run_id: import_v416.z.string().min(1).optional()
 });
 async function handleLogIntent(client, args) {
   const parsed2 = logIntentInputSchema.parse(args ?? {});
   const projectKey = getCurrentProjectId();
   if (!projectKey) {
-    throw new Error("No project selected. Use memora_list_projects and memora_set_project to select a project.");
+    throw new Error(
+      "No active repository binding. Reconnect this repository through MemoraOne Studio or run the generated connect command."
+    );
   }
   const intent = parsed2.intent;
   const message = parsed2.message.trim();
@@ -1207,525 +2128,188 @@ async function handleLogIntent(client, args) {
 }
 
 // src/tools/handlers/logChangeSummary.ts
-var import_v418 = require("zod/v4");
-var logChangeSummaryInputSchema = import_v418.z.object({
-  summary: import_v418.z.string().min(1),
-  scope: import_v418.z.string().min(1).optional(),
-  files: import_v418.z.array(import_v418.z.string().min(1)).optional(),
-  stats: import_v418.z.object({
-    files: import_v418.z.number().int().nonnegative().optional(),
-    add: import_v418.z.number().int().nonnegative().optional(),
-    del: import_v418.z.number().int().nonnegative().optional()
+var import_v417 = require("zod/v4");
+var logChangeSummaryInputSchema = import_v417.z.object({
+  summary: import_v417.z.string().min(1),
+  scope: import_v417.z.string().min(1).optional(),
+  files: import_v417.z.array(import_v417.z.string().min(1)).optional(),
+  stats: import_v417.z.object({
+    files: import_v417.z.number().int().nonnegative().optional(),
+    add: import_v417.z.number().int().nonnegative().optional(),
+    del: import_v417.z.number().int().nonnegative().optional()
   }).optional(),
-  commit: import_v418.z.string().min(1).optional(),
-  run_id: import_v418.z.string().min(1).optional()
+  commit: import_v417.z.string().min(1).optional(),
+  run_id: import_v417.z.string().min(1).optional()
 });
 async function handleLogChangeSummary(client, args) {
   const parsed2 = logChangeSummaryInputSchema.parse(args ?? {});
-  const projectKey = getCurrentProjectId();
-  if (!projectKey) {
-    throw new Error("No project selected. Use memora_list_projects and memora_set_project to select a project.");
-  }
-  const { summary, scope, files, stats, commit } = parsed2;
-  const message = summary.startsWith("CHANGE:") ? summary : `CHANGE: ${scope ?? "code"} \u2014 ${summary}`;
-  const run_id = resolveRunId(parsed2.run_id);
-  const body = {
-    kind: "note",
-    concept: "concept:change_summary",
-    actor: { type: config2.agentType, name: config2.agentName },
-    message,
-    projectKey,
-    metadata: {
-      source: config2.source,
-      purpose: "change_summary",
-      tool: "memora_log_change_summary",
-      ...scope ? { scope } : {},
-      ...files ? { files } : {},
-      ...stats ? { stats } : {},
-      ...commit ? { commit } : {},
-      ...run_id ? { run_id } : {}
-    }
-  };
-  await client.post("/timeline/events", body);
-  return { ok: true };
-}
-
-// src/tools/handlers/logToolResult.ts
-var import_v419 = require("zod/v4");
-var logToolResultInputSchema = import_v419.z.object({
-  tool: import_v419.z.string().min(1),
-  status: import_v419.z.enum(["ok", "error", "partial"]),
-  summary: import_v419.z.string().min(1),
-  run_id: import_v419.z.string().min(1).optional(),
-  duration_ms: import_v419.z.number().int().nonnegative().optional(),
-  error_code: import_v419.z.string().min(1).optional(),
-  error_message: import_v419.z.string().min(1).optional(),
-  error_kind: import_v419.z.enum(["infra", "logic", "auth", "rate_limit", "validation", "unknown"]).optional(),
-  stats: import_v419.z.record(import_v419.z.string(), import_v419.z.any()).optional()
-});
-async function handleLogToolResult(client, args) {
-  const parsed2 = logToolResultInputSchema.parse(args ?? {});
-  const projectKey = getCurrentProjectId();
-  if (!projectKey) {
-    throw new Error("No project selected. Use memora_list_projects and memora_set_project to select a project.");
-  }
-  const { tool, status, summary, duration_ms, error_code, error_message, error_kind, stats } = parsed2;
-  const message = summary.startsWith("RESULT:") ? summary : `RESULT: ${tool} \u2014 ${status} \u2014 ${summary}`;
-  const run_id = resolveRunId(parsed2.run_id);
-  const body = {
-    kind: "note",
-    concept: "concept:tool_result",
-    actor: { type: config2.agentType, name: config2.agentName },
-    message,
-    projectKey,
-    metadata: {
-      source: config2.source,
-      purpose: "tool_result",
-      tool: "memora_log_tool_result",
-      tool_name: tool,
-      status,
-      ...run_id ? { run_id } : {},
-      ...duration_ms ? { duration_ms } : {},
-      ...error_code ? { error_code } : {},
-      ...error_message ? { error_message } : {},
-      ...error_kind ? { error_kind } : {},
-      ...stats ? { stats } : {}
-    }
-  };
-  await client.post("/timeline/events", body);
-  return { ok: true };
-}
-
-// src/tools/handlers/logCommand.ts
-var import_v420 = require("zod/v4");
-var logCommandInputSchema = import_v420.z.object({
-  cmd: import_v420.z.string().min(1),
-  summary: import_v420.z.string().min(1),
-  cwd: import_v420.z.string().min(1).optional(),
-  exit_code: import_v420.z.number().int().optional(),
-  duration_ms: import_v420.z.number().int().nonnegative().optional(),
-  run_id: import_v420.z.string().min(1).optional(),
-  stats: import_v420.z.record(import_v420.z.string(), import_v420.z.any()).optional()
-});
-async function handleLogCommand(client, args) {
-  const parsed2 = logCommandInputSchema.parse(args ?? {});
-  const projectKey = getCurrentProjectId();
-  if (!projectKey) {
-    throw new Error("No project selected. Use memora_list_projects and memora_set_project to select a project.");
-  }
-  const { cmd, summary, cwd: cwd2, exit_code, duration_ms, stats } = parsed2;
-  const message = summary.startsWith("COMMAND:") ? summary : `COMMAND: ${cmd} \u2014 ${summary}`;
-  const run_id = resolveRunId(parsed2.run_id);
-  const body = {
-    kind: "note",
-    concept: "concept:command",
-    actor: { type: config2.agentType, name: config2.agentName },
-    message,
-    projectKey,
-    metadata: {
-      source: config2.source,
-      purpose: "command",
-      tool: "memora_log_command",
-      cmd,
-      ...cwd2 ? { cwd: cwd2 } : {},
-      ...exit_code !== void 0 ? { exit_code } : {},
-      ...duration_ms !== void 0 ? { duration_ms } : {},
-      ...run_id ? { run_id } : {},
-      ...stats ? { stats } : {}
-    }
-  };
-  await client.post("/timeline/events", body);
-  return { ok: true };
-}
-
-// src/tools/handlers/listProjects.ts
-async function handleListProjects(client) {
-  const res = await client.get("/v1/projects");
-  return res ?? { items: [] };
-}
-
-// src/tools/handlers/setProject.ts
-var import_v421 = require("zod/v4");
-
-// src/repoFingerprint.ts
-var fs4 = __toESM(require("fs"), 1);
-var path7 = __toESM(require("path"), 1);
-var crypto5 = __toESM(require("crypto"), 1);
-var parseBooleanFlag3 = (value) => {
-  if (!value) {
-    return false;
-  }
-  const normalized = value.trim().toLowerCase();
-  return ["1", "true", "yes", "on"].includes(normalized);
-};
-var debugEnabled2 = parseBooleanFlag3(process.env.MEMORAONE_DEV_MODE);
-var debugLog = (message) => {
-  if (!debugEnabled2) {
-    return;
-  }
-  process.stderr.write(`[memoraone-mcp][debug] ${message}
-`);
-};
-var normalizeRemoteUrl = (remoteUrl) => {
-  let normalized = remoteUrl.trim();
-  normalized = normalized.replace(/^[a-z]+:\/\//i, "");
-  normalized = normalized.replace(/^git@([^:]+):/i, "$1/");
-  normalized = normalized.replace(/\.git$/i, "");
-  normalized = normalized.replace(/\/+$/, "");
-  return normalized.toLowerCase();
-};
-var sha256 = (value) => {
-  return crypto5.createHash("sha256").update(value).digest("hex");
-};
-var resolveGitDir = (gitPath) => {
-  try {
-    const stat2 = fs4.statSync(gitPath);
-    if (stat2.isDirectory()) {
-      return gitPath;
-    }
-    if (stat2.isFile()) {
-      const content = fs4.readFileSync(gitPath, "utf8");
-      const match = content.match(/^gitdir:\s*(.+)$/m);
-      if (match) {
-        const gitDir = match[1].trim();
-        return path7.resolve(path7.dirname(gitPath), gitDir);
-      }
-    }
-  } catch {
-    return null;
-  }
-  return null;
-};
-var findGitRoot = (start) => {
-  let current = path7.resolve(start);
-  while (true) {
-    const gitPath = path7.join(current, ".git");
-    if (fs4.existsSync(gitPath)) {
-      const gitDir = resolveGitDir(gitPath);
-      if (gitDir) {
-        return { gitRoot: current, gitDir };
-      }
-    }
-    const parent = path7.dirname(current);
-    if (parent === current) {
-      break;
-    }
-    current = parent;
-  }
-  return null;
-};
-var readOriginRemote = (gitDir) => {
-  const configPath = path7.join(gitDir, "config");
-  try {
-    const content = fs4.readFileSync(configPath, "utf8");
-    const lines = content.split(/\r?\n/);
-    let inOrigin = false;
-    for (const line of lines) {
-      const sectionMatch = line.match(/^\s*\[(.+)]\s*$/);
-      if (sectionMatch) {
-        inOrigin = sectionMatch[1].trim() === 'remote "origin"';
-        continue;
-      }
-      if (inOrigin) {
-        const urlMatch = line.match(/^\s*url\s*=\s*(.+)\s*$/);
-        if (urlMatch) {
-          return urlMatch[1].trim();
-        }
-      }
-    }
-  } catch {
-    return null;
-  }
-  return null;
-};
-function resolveRepoFingerprint(cwd2) {
-  const found = findGitRoot(cwd2);
-  if (!found) {
-    const fallbackPath = path7.resolve(cwd2);
-    const fingerprint2 = sha256(fallbackPath);
-    debugLog(`repo fingerprint=${fingerprint2} source=path-fallback`);
-    return {
-      fingerprint: fingerprint2,
-      gitRoot: fallbackPath,
-      source: "path-fallback"
-    };
-  }
-  const { gitRoot, gitDir } = found;
-  const remoteUrl = readOriginRemote(gitDir);
-  if (remoteUrl) {
-    const normalized = normalizeRemoteUrl(remoteUrl);
-    const fingerprint2 = sha256(normalized);
-    debugLog(`repo fingerprint=${fingerprint2} source=git-remote`);
-    return {
-      fingerprint: fingerprint2,
-      gitRoot,
-      remoteUrl,
-      source: "git-remote"
-    };
-  }
-  const fingerprint = sha256(path7.resolve(gitRoot));
-  debugLog(`repo fingerprint=${fingerprint} source=path-fallback`);
-  return {
-    fingerprint,
-    gitRoot,
-    source: "path-fallback"
-  };
-}
-
-// src/workspaceMap.ts
-var fs5 = __toESM(require("fs/promises"), 1);
-var path8 = __toESM(require("path"), 1);
-var import_node_os = __toESM(require("os"), 1);
-var parseBooleanFlag4 = (value) => {
-  if (!value) {
-    return false;
-  }
-  const normalized = value.trim().toLowerCase();
-  return ["1", "true", "yes", "on"].includes(normalized);
-};
-var debugEnabled3 = parseBooleanFlag4(process.env.MEMORAONE_DEV_MODE);
-var debugLog2 = (message) => {
-  if (!debugEnabled3) {
-    return;
-  }
-  process.stderr.write(`[memoraone-mcp][debug] ${message}
-`);
-};
-var fingerprintRegex = /^[0-9a-f]{64}$/i;
-function getWorkspaceMapPath() {
-  return path8.join(import_node_os.default.homedir(), ".memoraone", "workspaces.json");
-}
-var ensureWorkspaceDir = async () => {
-  const dir = path8.dirname(getWorkspaceMapPath());
-  await fs5.mkdir(dir, { recursive: true });
-};
-async function acquireWorkspaceMapLock() {
-  const filePath = getWorkspaceMapPath();
-  const lockPath = `${filePath}.lock`;
-  const maxRetries = 10;
-  const retryDelayMs = 50;
-  const maxLockAgeMs = 5e3;
-  await ensureWorkspaceDir();
-  let lockAcquired = false;
-  let retries = 0;
-  while (!lockAcquired && retries < maxRetries) {
-    try {
-      try {
-        const stat2 = await fs5.stat(lockPath);
-        const ageMs = Date.now() - stat2.mtimeMs;
-        if (ageMs > maxLockAgeMs) {
-          await fs5.unlink(lockPath);
-          debugLog2(`removed stale workspace map lock (age: ${ageMs}ms)`);
-        }
-      } catch (err) {
-        if (err?.code !== "ENOENT") {
-          throw err;
-        }
-      }
-      const fd = await fs5.open(lockPath, "wx");
-      await fd.close();
-      lockAcquired = true;
-    } catch (err) {
-      if (err?.code === "EEXIST") {
-        retries++;
-        if (retries < maxRetries) {
-          await new Promise((resolve7) => setTimeout(resolve7, retryDelayMs));
-          continue;
-        }
-        throw new Error(
-          `[memoraone-mcp] Failed to acquire workspace map lock after ${maxRetries} retries`
-        );
-      }
-      throw err;
-    }
-  }
-  return async () => {
-    try {
-      await fs5.unlink(lockPath);
-    } catch (err) {
-      if (err?.code !== "ENOENT") {
-        debugLog2(`failed to release workspace map lock: ${String(err)}`);
-      }
-    }
-  };
-}
-var validateWorkspaceMap = (map, filePath) => {
-  if (!map || typeof map !== "object" || Array.isArray(map)) {
+  const projectKey = getCurrentProjectId();
+  if (!projectKey) {
     throw new Error(
-      `[memoraone-mcp] Invalid workspace map schema in ${filePath}`
+      "No active repository binding. Reconnect this repository through MemoraOne Studio or run the generated connect command."
     );
   }
-  for (const [fingerprint, entry] of Object.entries(map)) {
-    if (!fingerprintRegex.test(fingerprint)) {
-      throw new Error(
-        `[memoraone-mcp] Invalid workspace fingerprint in ${filePath}`
-      );
-    }
-    if (typeof entry === "string") {
-      if (!entry.trim()) {
-        throw new Error(
-          `[memoraone-mcp] Invalid workspace projectKey in ${filePath}`
-        );
-      }
-      continue;
-    }
-    if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
-      throw new Error(
-        `[memoraone-mcp] Invalid workspace projectKey in ${filePath}`
-      );
-    }
-    const projectKey = entry.projectKey ?? entry.project_id;
-    if (!projectKey || !projectKey.trim()) {
-      throw new Error(
-        `[memoraone-mcp] Invalid workspace projectKey in ${filePath}`
-      );
-    }
-    const source = entry.source;
-    if (source !== void 0 && typeof source !== "string") {
-      throw new Error(
-        `[memoraone-mcp] Invalid workspace source in ${filePath}`
-      );
-    }
-    const linkedAt = entry.linked_at;
-    if (linkedAt !== void 0 && typeof linkedAt !== "string") {
-      throw new Error(
-        `[memoraone-mcp] Invalid workspace linked_at in ${filePath}`
-      );
-    }
-  }
-};
-async function readWorkspaceMap() {
-  const filePath = getWorkspaceMapPath();
-  try {
-    const content = await fs5.readFile(filePath, "utf8");
-    const parsed2 = JSON.parse(content);
-    validateWorkspaceMap(parsed2, filePath);
-    const typed = parsed2;
-    let migrated = false;
-    const normalized = {};
-    for (const [fingerprint, entry] of Object.entries(typed)) {
-      if (typeof entry === "string") {
-        normalized[fingerprint] = entry;
-        continue;
-      }
-      const projectKey = entry.projectKey ?? entry.project_id ?? "";
-      if (entry.project_id && !entry.projectKey) {
-        migrated = true;
-      }
-      normalized[fingerprint] = {
-        ...projectKey ? { projectKey } : {},
-        ...entry.source ? { source: entry.source } : {},
-        ...entry.linked_at ? { linked_at: entry.linked_at } : {}
-      };
-    }
-    debugLog2(
-      `workspace map loaded path=${filePath} entries=${Object.keys(normalized).length}`
-    );
-    return { map: normalized, needsMigration: migrated };
-  } catch (err) {
-    if (err?.code === "ENOENT") {
-      const emptyMap = {};
-      debugLog2(`workspace map loaded path=${filePath} entries=0`);
-      return { map: emptyMap, needsMigration: false };
-    }
-    if (err instanceof SyntaxError) {
-      throw new Error(
-        `[memoraone-mcp] Failed to parse workspace map at ${filePath}`
-      );
+  const { summary, scope, files, stats, commit } = parsed2;
+  const message = summary.startsWith("CHANGE:") ? summary : `CHANGE: ${scope ?? "code"} \u2014 ${summary}`;
+  const run_id = resolveRunId(parsed2.run_id);
+  const body = {
+    kind: "note",
+    concept: "concept:change_summary",
+    actor: { type: config2.agentType, name: config2.agentName },
+    message,
+    projectKey,
+    metadata: {
+      source: config2.source,
+      purpose: "change_summary",
+      tool: "memora_log_change_summary",
+      ...scope ? { scope } : {},
+      ...files ? { files } : {},
+      ...stats ? { stats } : {},
+      ...commit ? { commit } : {},
+      ...run_id ? { run_id } : {}
     }
-    throw err;
-  }
-}
-async function writeWorkspaceMap(map) {
-  const filePath = getWorkspaceMapPath();
-  validateWorkspaceMap(map, filePath);
-  await ensureWorkspaceDir();
-  const tempPath = `${filePath}.tmp`;
-  const content = JSON.stringify(map, null, 2);
-  await fs5.writeFile(tempPath, content, "utf8");
-  await fs5.rename(tempPath, filePath);
+  };
+  await client.post("/timeline/events", body);
+  return { ok: true };
 }
-async function setProjectIdForFingerprint(args) {
-  const { fingerprint, projectKey, source, linked_at } = args;
-  if (!fingerprintRegex.test(fingerprint)) {
-    throw new Error("[memoraone-mcp] Invalid fingerprint");
-  }
-  if (!projectKey.trim()) {
-    throw new Error("[memoraone-mcp] Invalid projectKey");
-  }
-  const releaseLock = await acquireWorkspaceMapLock();
-  try {
-    const { map, needsMigration } = await readWorkspaceMap();
-    if (needsMigration) {
-      await writeWorkspaceMap(map);
-    }
-    map[fingerprint] = {
-      projectKey,
-      ...source ? { source } : {},
-      linked_at: linked_at ?? (/* @__PURE__ */ new Date()).toISOString()
-    };
-    await writeWorkspaceMap(map);
-    debugLog2(
-      `workspace map set fingerprint=${fingerprint} projectKey=${projectKey}`
+
+// src/tools/handlers/logToolResult.ts
+var import_v418 = require("zod/v4");
+var logToolResultInputSchema = import_v418.z.object({
+  tool: import_v418.z.string().min(1),
+  status: import_v418.z.enum(["ok", "error", "partial"]),
+  summary: import_v418.z.string().min(1),
+  run_id: import_v418.z.string().min(1).optional(),
+  duration_ms: import_v418.z.number().int().nonnegative().optional(),
+  error_code: import_v418.z.string().min(1).optional(),
+  error_message: import_v418.z.string().min(1).optional(),
+  error_kind: import_v418.z.enum(["infra", "logic", "auth", "rate_limit", "validation", "unknown"]).optional(),
+  stats: import_v418.z.record(import_v418.z.string(), import_v418.z.any()).optional()
+});
+async function handleLogToolResult(client, args) {
+  const parsed2 = logToolResultInputSchema.parse(args ?? {});
+  const projectKey = getCurrentProjectId();
+  if (!projectKey) {
+    throw new Error(
+      "No active repository binding. Reconnect this repository through MemoraOne Studio or run the generated connect command."
     );
-  } finally {
-    await releaseLock();
   }
+  const { tool, status, summary, duration_ms, error_code, error_message, error_kind, stats } = parsed2;
+  const message = summary.startsWith("RESULT:") ? summary : `RESULT: ${tool} \u2014 ${status} \u2014 ${summary}`;
+  const run_id = resolveRunId(parsed2.run_id);
+  const body = {
+    kind: "note",
+    concept: "concept:tool_result",
+    actor: { type: config2.agentType, name: config2.agentName },
+    message,
+    projectKey,
+    metadata: {
+      source: config2.source,
+      purpose: "tool_result",
+      tool: "memora_log_tool_result",
+      tool_name: tool,
+      status,
+      ...run_id ? { run_id } : {},
+      ...duration_ms ? { duration_ms } : {},
+      ...error_code ? { error_code } : {},
+      ...error_message ? { error_message } : {},
+      ...error_kind ? { error_kind } : {},
+      ...stats ? { stats } : {}
+    }
+  };
+  await client.post("/timeline/events", body);
+  return { ok: true };
 }
 
-// src/tools/handlers/setProject.ts
-var setProjectInputSchema = import_v421.z.object({
-  projectKey: import_v421.z.string().min(1).optional(),
-  projectId: import_v421.z.string().min(1).optional()
+// src/tools/handlers/logCommand.ts
+var import_v419 = require("zod/v4");
+var logCommandInputSchema = import_v419.z.object({
+  cmd: import_v419.z.string().min(1),
+  summary: import_v419.z.string().min(1),
+  cwd: import_v419.z.string().min(1).optional(),
+  exit_code: import_v419.z.number().int().optional(),
+  duration_ms: import_v419.z.number().int().nonnegative().optional(),
+  run_id: import_v419.z.string().min(1).optional(),
+  stats: import_v419.z.record(import_v419.z.string(), import_v419.z.any()).optional()
 });
-async function handleSetProject(args) {
-  const parsed2 = setProjectInputSchema.parse(args ?? {});
-  const resolvedProjectKey = parsed2.projectKey ?? parsed2.projectId;
-  if (!resolvedProjectKey) {
-    throw new Error("projectKey is required");
-  }
-  const requested = resolvedProjectKey.trim();
-  const bound = getBoundProjectId();
-  if (bound !== null && requested !== bound) {
+async function handleLogCommand(client, args) {
+  const parsed2 = logCommandInputSchema.parse(args ?? {});
+  const projectKey = getCurrentProjectId();
+  if (!projectKey) {
     throw new Error(
-      `Project switching is disabled (Option A). This MCP process is bound to ${bound}. Start a separate MCP instance/window for ${requested}.`
+      "No active repository binding. Reconnect this repository through MemoraOne Studio or run the generated connect command."
     );
   }
-  setCurrentProjectId(resolvedProjectKey);
-  const repo = resolveRepoFingerprint(process.cwd());
-  await setProjectIdForFingerprint({
-    fingerprint: repo.fingerprint,
-    projectKey: resolvedProjectKey,
-    source: "manual"
-  });
-  return { ok: true, projectKey: resolvedProjectKey };
+  const { cmd, summary, cwd: cwd2, exit_code, duration_ms, stats } = parsed2;
+  const message = summary.startsWith("COMMAND:") ? summary : `COMMAND: ${cmd} \u2014 ${summary}`;
+  const run_id = resolveRunId(parsed2.run_id);
+  const body = {
+    kind: "note",
+    concept: "concept:command",
+    actor: { type: config2.agentType, name: config2.agentName },
+    message,
+    projectKey,
+    metadata: {
+      source: config2.source,
+      purpose: "command",
+      tool: "memora_log_command",
+      cmd,
+      ...cwd2 ? { cwd: cwd2 } : {},
+      ...exit_code !== void 0 ? { exit_code } : {},
+      ...duration_ms !== void 0 ? { duration_ms } : {},
+      ...run_id ? { run_id } : {},
+      ...stats ? { stats } : {}
+    }
+  };
+  await client.post("/timeline/events", body);
+  return { ok: true };
 }
 
 // src/tools/handlers/bindingStatus.ts
-function buildBindingStatus(binding) {
+function buildBindingStatus(binding, options = {}) {
   const status = {
+    repositoryBindingId: binding.repositoryBindingId,
     projectId: binding.projectId,
     workspaceRoot: binding.workspaceRoot,
-    m1Path: binding.m1Path,
     bindingSource: binding.bindingSource,
-    apiKeySource: binding.apiKeySource
+    status: binding.status,
+    credentialSource: "keyring",
+    cacheRefreshed: options.cacheRefreshed === true
   };
   if (binding.environment !== void 0) {
     status.environment = binding.environment;
   }
+  if (binding.installationPublicId !== void 0) {
+    status.installationPublicId = binding.installationPublicId;
+  }
   return status;
 }
-function handleBindingStatus(binding) {
+function handleBindingStatus(binding, options = {}) {
   if (!binding) {
     throw new Error("[memoraone-mcp] Binding status unavailable (not initialized)");
   }
-  return buildBindingStatus(binding);
+  return buildBindingStatus(binding, options);
+}
+
+// src/heartbeat.ts
+var crypto5 = __toESM(require("crypto"), 1);
+var fs10 = __toESM(require("fs"), 1);
+var path13 = __toESM(require("path"), 1);
+
+// src/localState/mcpSessionId.ts
+var import_node_crypto4 = require("crypto");
+var MCS_PREFIX = "mcs_";
+function generateMcpSessionId(random = () => (0, import_node_crypto4.randomBytes)(32)) {
+  const bytes = random();
+  if (bytes.length !== 32) {
+    throw new Error("[memoraone-mcp] mcp session id requires exactly 32 random bytes");
+  }
+  return `${MCS_PREFIX}${bytes.toString("base64url")}`;
 }
 
 // src/heartbeat.ts
-var crypto6 = __toESM(require("crypto"), 1);
-function fingerprintApiKey(apiKey) {
-  return crypto6.createHash("sha256").update(apiKey).digest("hex").slice(0, 12);
+function fingerprintAccessToken(accessToken) {
+  return crypto5.createHash("sha256").update(accessToken).digest("hex").slice(0, 12);
 }
 function isHeartbeatDebugEnabled() {
   const value = String(process.env.MEMORAONE_DEBUG_HEARTBEAT ?? "").trim().toLowerCase();
@@ -1734,12 +2318,80 @@ function isHeartbeatDebugEnabled() {
 function resolveHeartbeatIntervalMs() {
   return Number.isFinite(config2.heartbeatIntervalMs) ? Math.max(1e3, config2.heartbeatIntervalMs) : 3e4;
 }
+function redactSensitiveText(text) {
+  return text.replace(/mcs_[A-Za-z0-9_-]+/g, "mcs_[redacted]").replace(/mia_[A-Za-z0-9_-]+/g, "mia_[redacted]").replace(/mir_[A-Za-z0-9_-]+/g, "mir_[redacted]").replace(/mcc_[A-Za-z0-9_-]+/g, "mcc_[redacted]").replace(/Bearer\s+\S+/gi, "Bearer [redacted]");
+}
+function resolvePackageVersion() {
+  const fromEnv = process.env.npm_package_version?.trim();
+  if (fromEnv) return fromEnv;
+  const moduleDir = typeof __dirname !== "undefined" ? __dirname : void 0;
+  const candidates = [
+    ...moduleDir ? [path13.join(moduleDir, "..", "package.json"), path13.join(moduleDir, "package.json")] : [],
+    path13.join(process.cwd(), "package.json"),
+    path13.join(process.cwd(), "packages", "mcp", "package.json")
+  ];
+  for (const candidate of candidates) {
+    try {
+      const pkg = JSON.parse(fs10.readFileSync(candidate, "utf8"));
+      if (typeof pkg.version === "string" && pkg.version.trim()) {
+        return pkg.version.trim();
+      }
+    } catch {
+    }
+  }
+  return void 0;
+}
+function parseActiveFlag(payload) {
+  if (!payload || typeof payload !== "object") return null;
+  const active = payload.active;
+  if (typeof active === "boolean") return active;
+  return null;
+}
+async function announceIdeSession(client, ctx) {
+  const body = {
+    session_id: ctx.sessionId,
+    ide_type: ctx.ideType
+  };
+  if (ctx.packageVersion) {
+    body.package_version = ctx.packageVersion;
+  }
+  let lastErr;
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      const raw = await client.post("/v1/local-mcp/session/announce", body, { log: false });
+      const data = raw ?? {};
+      if (data.ok !== true || typeof data.active !== "boolean" || typeof data.ide_type !== "string") {
+        throw new Error("[memoraone-mcp] Invalid session announce response");
+      }
+      return {
+        ok: true,
+        active: data.active,
+        ideType: data.ide_type,
+        announcedAt: typeof data.announced_at === "string" ? data.announced_at : ""
+      };
+    } catch (err) {
+      lastErr = err;
+      if (err instanceof MemoraOneHttpError && (err.status === 404 || err.status === 405)) {
+        throw new Error(
+          "[memoraone-mcp] Session announce endpoint is not supported by this API (POST /v1/local-mcp/session/announce)"
+        );
+      }
+      const msg = String(err);
+      const transient = /fetch failed|ECONNRESET|ETIMEDOUT|ENOTFOUND|network|socket/i.test(msg) && !(err instanceof MemoraOneHttpError && err.status >= 400 && err.status < 500);
+      if (!transient || attempt === 1) {
+        break;
+      }
+    }
+  }
+  const safe = redactSensitiveText(String(lastErr));
+  throw new Error(`[memoraone-mcp] Session announce failed: ${safe}`);
+}
 async function sendProjectHeartbeat(client, ctx) {
   try {
     const pid = ctx.projectId?.trim();
     if (isHeartbeatDebugEnabled()) {
       process.stderr.write(
-        `[memoraone-mcp][diag] heartbeat projectId=${pid ?? "unknown"} apiKeySource=${ctx.apiKeySource ?? "unknown"} apiKeyFingerprint=${ctx.apiKeyFingerprint ?? "unknown"} ideType=${ctx.ideType ?? "unknown"}
+        `[memoraone-mcp][diag] heartbeat projectId=${pid ?? "unknown"} binding=${ctx.repositoryBindingId} credentialSource=${ctx.credentialSource ?? "keyring"} accessTokenFingerprint=${ctx.accessTokenFingerprint ?? "unknown"} ideType=${ctx.ideType ?? "unknown"}
 `
       );
     }
@@ -1748,18 +2400,183 @@ async function sendProjectHeartbeat(client, ctx) {
     }
     const body = {};
     if (ctx.ideType) body.ide_type = ctx.ideType;
-    await client.post(`/v1/projects/${pid}/heartbeat`, body, {
-      log: false,
-      headers: {
-        "x-project-id": pid
-      }
-    });
+    if (ctx.sessionId) body.session_id = ctx.sessionId;
+    const raw = await client.post("/v1/local-mcp/heartbeat", body, { log: false });
+    return { active: parseActiveFlag(raw) };
   } catch (err) {
+    if (err instanceof ReconnectRequiredError) {
+      try {
+        const record = await readBindingRecord(ctx.repositoryBindingId);
+        if (record) {
+          await writeBindingRecord({
+            ...record,
+            status: "reconnect_required",
+            updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+          });
+        }
+      } catch {
+      }
+    }
     process.stderr.write(
-      `[memoraone-mcp][info] heartbeat error (silent) ${String(err)}
+      `[memoraone-mcp][info] heartbeat error (silent) ${redactSensitiveText(String(err))}
 `
     );
-  }
+    return { active: null };
+  }
+}
+function createDaemonHeartbeat(opts) {
+  let interval = null;
+  let client = null;
+  let announced = false;
+  let studioActive = null;
+  let starting = false;
+  let waitingForIdeType = false;
+  const sessionId = opts.sessionId ?? generateMcpSessionId();
+  const packageVersion = opts.packageVersion ?? resolvePackageVersion();
+  const ctx = {
+    projectId: opts.binding.projectId,
+    repositoryBindingId: opts.binding.repositoryBindingId,
+    ideType: opts.ideType,
+    sessionId,
+    credentialSource: "keyring",
+    accessTokenFingerprint: null
+  };
+  const log = opts.onLog ?? ((msg) => {
+    process.stderr.write(`[memoraone-mcp][daemon-heartbeat] ${redactSensitiveText(msg)}
+`);
+  });
+  const ensureClient = async () => {
+    if (client) return client;
+    const creds = await readInstallationCredentials(opts.binding.repositoryBindingId);
+    if (!creds?.accessToken) {
+      log("cannot start: no access token in keyring");
+      return null;
+    }
+    ctx.accessTokenFingerprint = fingerprintAccessToken(creds.accessToken);
+    client = opts.createClient?.(opts.binding) ?? new memoraClient_default(config2, {
+      repositoryBindingId: opts.binding.repositoryBindingId,
+      projectId: opts.binding.projectId
+    });
+    return client;
+  };
+  const ensureAnnounced = async (activeClient) => {
+    if (announced) return true;
+    if (!ctx.ideType) {
+      waitingForIdeType = true;
+      log("waiting for ide type before session announce");
+      return false;
+    }
+    waitingForIdeType = false;
+    try {
+      const result = await announceIdeSession(activeClient, {
+        sessionId,
+        ideType: ctx.ideType,
+        packageVersion
+      });
+      announced = true;
+      studioActive = result.active;
+      log(`session announced ideType=${ctx.ideType} active=${String(result.active)}`);
+      return true;
+    } catch (err) {
+      studioActive = false;
+      log(`session announce failed: ${redactSensitiveText(String(err))}`);
+      return false;
+    }
+  };
+  const applyHeartbeatOutcome = (outcome) => {
+    if (outcome.active === null) return;
+    if (outcome.active === false && studioActive !== false) {
+      studioActive = false;
+      log("session superseded (active=false); continuing to serve MCP without re-announce");
+      return;
+    }
+    if (outcome.active === true) {
+      studioActive = true;
+    }
+  };
+  const tick = async () => {
+    if (!client) return;
+    const outcome = await sendProjectHeartbeat(client, ctx);
+    applyHeartbeatOutcome(outcome);
+  };
+  const beginInterval = () => {
+    if (interval) return;
+    const intervalMs = resolveHeartbeatIntervalMs();
+    log(
+      `daemon owns heartbeat for binding=${opts.binding.repositoryBindingId} project=${opts.binding.projectId} ideType=${ctx.ideType ?? "unknown"} interval=${intervalMs}ms`
+    );
+    void tick();
+    interval = setInterval(() => {
+      void tick();
+    }, intervalMs);
+  };
+  const start = async () => {
+    if (!config2.heartbeatEnabled) {
+      log("disabled by config");
+      return;
+    }
+    if (interval) {
+      log("already running (skipped duplicate start)");
+      return;
+    }
+    if (starting) {
+      log("already starting (skipped duplicate start)");
+      return;
+    }
+    starting = true;
+    try {
+      const activeClient = await ensureClient();
+      if (!activeClient) return;
+      const ok = await ensureAnnounced(activeClient);
+      if (!ok) {
+        return;
+      }
+      beginInterval();
+    } finally {
+      starting = false;
+      if (waitingForIdeType && !announced && !interval && ctx.ideType && config2.heartbeatEnabled) {
+        waitingForIdeType = false;
+        void start();
+      }
+    }
+  };
+  const stop = () => {
+    if (interval) {
+      clearInterval(interval);
+      interval = null;
+    }
+    log(`daemon released heartbeat for binding=${opts.binding.repositoryBindingId}`);
+  };
+  const isRunning = () => interval !== null;
+  const setIdeType = (ideType) => {
+    const previous = ctx.ideType;
+    if (previous === ideType) {
+      return;
+    }
+    ctx.ideType = ideType;
+    log(`daemon heartbeat ideType updated to ${ideType}`);
+    if (!announced) {
+      void start();
+      return;
+    }
+    if (client && interval) {
+      void tick();
+    }
+  };
+  const getIdeType = () => ctx.ideType;
+  const getSessionId = () => sessionId;
+  const isStudioActive = () => studioActive;
+  const hasAnnounced = () => announced;
+  return {
+    start,
+    stop,
+    isRunning,
+    setIdeType,
+    getIdeType,
+    getSessionId,
+    isStudioActive,
+    hasAnnounced
+  };
 }
 
 // src/ideType.ts
@@ -1888,8 +2705,8 @@ function registerToolWithWorklog(server, runtime, sessionContext, toolName, desc
 async function main(opts = {}) {
   let bindingReadyResolve = null;
   let bindingReadyReject = null;
-  const bindingReady = new Promise((resolve7, reject) => {
-    bindingReadyResolve = resolve7;
+  const bindingReady = new Promise((resolve9, reject) => {
+    bindingReadyResolve = resolve9;
     bindingReadyReject = reject;
   });
   const devMode = Boolean(config2.devMode);
@@ -1898,9 +2715,11 @@ async function main(opts = {}) {
   const runtime = {
     client: null,
     projectId: null,
-    apiKeySource: null,
-    apiKeyFingerprint: null,
+    repositoryBindingId: null,
+    credentialSource: null,
+    accessTokenFingerprint: null,
     authoritativeBinding: null,
+    bindingCacheRefreshed: false,
     ideType: void 0
   };
   let workspaceRoot;
@@ -1913,10 +2732,25 @@ async function main(opts = {}) {
     if (initializeRoots.length === 0 && opts.daemonBindingHint) {
       if (isInitializeDebugEnabled()) {
         console.error(
-          "[memoraone-mcp][init-debug] Workspace resolution strategy: daemonBindingHint (bridge pre-resolved)"
+          "[memoraone-mcp][init-debug] Workspace resolution strategy: daemonBindingHint (bridge pre-resolved, reconciled from disk)"
+        );
+      }
+      const reconciled = await reconcileResolvedBindingWithDisk(opts.daemonBindingHint);
+      runtime.bindingCacheRefreshed = reconciled.cacheRefreshed;
+      if (reconciled.cacheRefreshed) {
+        console.error(
+          `[memoraone-mcp] refreshed stale cached binding ${reconciled.binding.repositoryBindingId}: project=${reconciled.binding.projectId}`
         );
+        try {
+          const socketPath = getBindingSocketPath(opts.daemonBindingHint);
+          writeBindingSidecar(socketPath, reconciled.binding, runtime.ideType ?? "");
+        } catch (err) {
+          console.error(
+            `[memoraone-mcp] warning: could not rewrite binding sidecar after refresh: ${String(err)}`
+          );
+        }
       }
-      return opts.daemonBindingHint;
+      return reconciled.binding;
     }
     let rootsListUris;
     let rootsListAttempted = false;
@@ -2011,39 +2845,15 @@ async function main(opts = {}) {
     })
   );
   registeredToolNames.push("memora_get_personal_context");
-  server.tool(
-    "memora_list_projects",
-    "List projects available to the current API key",
-    listProjectsShape,
-    async () => runWithSessionContext(sessionContext, async () => {
-      if (!runtime.client || !runtime.projectId) return notInitializedResult;
-      const result = await handleListProjects(runtime.client);
-      return {
-        content: [{ type: "text", text: JSON.stringify(result) }]
-      };
-    })
-  );
-  registeredToolNames.push("memora_list_projects");
-  server.tool(
-    "memora_set_project",
-    "Set the current project key for subsequent tool calls",
-    setProjectShape,
-    async (args) => runWithSessionContext(sessionContext, async () => {
-      if (!runtime.client || !runtime.projectId) return notInitializedResult;
-      const result = await handleSetProject(args);
-      return {
-        content: [{ type: "text", text: JSON.stringify(result) }]
-      };
-    })
-  );
-  registeredToolNames.push("memora_set_project");
   server.tool(
     "memora_status",
     "Return non-secret project binding metadata for this MCP session",
     bindingStatusShape,
     async () => runWithSessionContext(sessionContext, async () => {
       if (!runtime.authoritativeBinding) return notInitializedResult;
-      const result = handleBindingStatus(runtime.authoritativeBinding);
+      const result = handleBindingStatus(runtime.authoritativeBinding, {
+        cacheRefreshed: runtime.bindingCacheRefreshed
+      });
       return {
         content: [{ type: "text", text: JSON.stringify(result) }]
       };
@@ -2165,72 +2975,79 @@ async function main(opts = {}) {
         const debugAuth = ["1", "true", "yes", "on"].includes(
           String(process.env.MEMORAONE_DEBUG_AUTH ?? "").trim().toLowerCase()
         );
-        const debugLog3 = config2.devMode || debugAuth;
+        const debugLog = config2.devMode || debugAuth;
         const binding = await resolveSessionBindingFromInitialize(params);
-        if (opts.daemonBindingHint && !bindingsMatch(opts.daemonBindingHint, binding)) {
+        if (opts.daemonBindingHint && opts.daemonBindingHint.repositoryBindingId !== binding.repositoryBindingId) {
           const errMsg = formatBindingMismatchError(opts.daemonBindingHint, binding);
           console.error(`[memoraone-mcp][ERROR] ${errMsg}`);
           bindingReadyReject?.(new Error(errMsg));
           throw new Error(errMsg);
         }
-        const apiKeyToUse = binding.apiKey;
-        if (!apiKeyToUse) {
-          throw new Error(
-            "[memoraone-mcp] No actor key. Set MEMORAONE_API_KEY or MEMORA_API_KEY, or add MEMORAONE_API_KEY/api_key to memoraone.m1"
+        if (binding.status === "reconnect_required") {
+          throw new ReconnectRequiredError(
+            "[memoraone-mcp] Installation requires reconnect. Run: memoraone-mcp connect <code>"
+          );
+        }
+        const creds = await readInstallationCredentials(binding.repositoryBindingId);
+        if (!creds?.accessToken?.startsWith("mia_")) {
+          throw new ReconnectRequiredError(
+            "[memoraone-mcp] Missing installation credentials. Run: memoraone-mcp connect <code>"
           );
         }
-        if (debugLog3) {
+        if (debugLog) {
+          console.error("[memoraone-mcp][debug] Resolved installation credentials from OS keyring");
+        }
+        if (binding.legacyM1WarningPath) {
           console.error(
-            "[memoraone-mcp][debug] Resolved actor key from " + (binding.apiKeySource === "env" ? "ENV" : "memoraone.m1")
+            `[memoraone-mcp] warning: ignoring legacy memoraone.m1 at ${binding.legacyM1WarningPath}`
           );
         }
         const projectId = binding.projectId;
         const existing = getBoundProjectId();
         if (existing !== null && existing !== projectId) {
-          const requestedRoot = binding.workspaceRoot ?? workspaceRoot ?? process.cwd();
-          const action = "Open this repo in a separate window or configure a separate MCP server instance per root.";
-          const errMsg = `[memoraone-mcp] This MCP process is already bound to project ${existing}. Open a new IDE window or start a separate MCP instance for a different project.`;
-          console.error(
-            `[memoraone-mcp][ERROR] Option A conflict: boundProjectId=${existing} requestedProjectId=${projectId} workspaceRoot=${requestedRoot}. ${action}`
-          );
-          bindingReadyReject?.(new Error(errMsg));
-          setImmediate(() => process.exit(1));
-          throw new Error(errMsg);
+          if (runtime.bindingCacheRefreshed) {
+            setBoundProjectId(projectId);
+            console.error(
+              `[memoraone-mcp] ${sessionLabel} rebound to project ${projectId} after local binding refresh (was ${existing})`
+            );
+          } else {
+            const requestedRoot = binding.workspaceRoot ?? workspaceRoot ?? process.cwd();
+            const action = "Open this repo in a separate window or configure a separate MCP server instance per root.";
+            const errMsg = `[memoraone-mcp] This MCP process is already bound to project ${existing}. Open a new IDE window or start a separate MCP instance for a different project.`;
+            console.error(
+              `[memoraone-mcp][ERROR] Option A conflict: boundProjectId=${existing} requestedProjectId=${projectId} workspaceRoot=${requestedRoot}. ${action}`
+            );
+            bindingReadyReject?.(new Error(errMsg));
+            setImmediate(() => process.exit(1));
+            throw new Error(errMsg);
+          }
         }
         if (existing === null) {
           setBoundProjectId(projectId);
-          setBoundApiKey(apiKeyToUse);
           console.error(
             `[memoraone-mcp] ${sessionLabel} bound to project ${projectId} (Option A: single-project binding)`
           );
         }
         setCurrentProjectId(projectId);
-        setCurrentApiKey(apiKeyToUse);
         runtime.projectId = projectId;
-        runtime.apiKeySource = binding.apiKeySource;
-        runtime.apiKeyFingerprint = fingerprintApiKey(apiKeyToUse);
+        runtime.repositoryBindingId = binding.repositoryBindingId;
+        runtime.credentialSource = "keyring";
+        runtime.accessTokenFingerprint = fingerprintAccessToken(creds.accessToken);
         runtime.authoritativeBinding = binding;
-        runtime.client = new memoraClient_default(config2, projectId, apiKeyToUse);
+        runtime.client = new memoraClient_default(config2, {
+          repositoryBindingId: binding.repositoryBindingId,
+          projectId
+        });
         workspaceRoot = binding.workspaceRoot;
-        const environmentLog = binding.environment !== void 0 ? ` environment=${binding.environment}` : "";
-        process.stderr.write(
-          `[memoraone-mcp] registering workspace source bindingSource=${binding.bindingSource} workspaceRoot=${workspaceRoot ?? "(unset)"} m1Path=${binding.m1Path}${environmentLog}
-`
-        );
-        await registerRepoSource(
-          runtime.client,
-          runtime.projectId,
-          binding.workspaceRoot,
-          runtime.ideType
-        );
         if (debugAuth) {
           console.error("[memoraone-mcp][auth] repo root:", binding.workspaceRoot);
           console.error("[memoraone-mcp][auth] project_id:", projectId);
-          console.error("[memoraone-mcp][auth] api_key source:", binding.apiKeySource);
+          console.error("[memoraone-mcp][auth] repository_binding_id:", binding.repositoryBindingId);
+          console.error("[memoraone-mcp][auth] credential source: keyring");
         }
         const bindingEnvironmentLog = binding.environment !== void 0 ? ` environment=${binding.environment}` : "";
         console.error(
-          `[memoraone-mcp] ${sessionLabel} authoritative binding: project=${binding.projectId} workspace=${binding.workspaceRoot} m1=${binding.m1Path} source=${binding.bindingSource} apiKeySource=${binding.apiKeySource}${bindingEnvironmentLog}`
+          `[memoraone-mcp] ${sessionLabel} authoritative binding: binding=${binding.repositoryBindingId} project=${binding.projectId} workspace=${binding.workspaceRoot} source=${binding.bindingSource}${bindingEnvironmentLog}`
         );
         bindingReadyResolve?.(runtime.client);
         return server.server._oninitialize(request);
@@ -2246,37 +3063,34 @@ async function main(opts = {}) {
   const transport = opts.transport ?? new import_stdio.StdioServerTransport();
   await server.connect(transport);
   const activeClient = await bindingReady;
-  let heartbeatInterval = null;
+  let ownedHeartbeat = null;
   const daemonSession = Boolean(opts.sessionSocket);
   if (config2.heartbeatEnabled && daemonSession) {
     console.error(
       `[memoraone-mcp] ${sessionLabel} defers heartbeat to daemon for project ${runtime.projectId}`
     );
-  } else if (config2.heartbeatEnabled) {
-    const intervalMs = resolveHeartbeatIntervalMs();
-    const heartbeatCtx = {
-      projectId: runtime.projectId,
-      ideType: runtime.ideType,
-      apiKeySource: runtime.apiKeySource,
-      apiKeyFingerprint: runtime.apiKeyFingerprint
-    };
+  } else if (config2.heartbeatEnabled && runtime.authoritativeBinding) {
+    ownedHeartbeat = createDaemonHeartbeat({
+      binding: runtime.authoritativeBinding,
+      ideType: runtime.ideType ?? config2.ideType,
+      createClient: () => activeClient,
+      onLog: (msg) => {
+        console.error(`[memoraone-mcp][session-heartbeat] ${msg}`);
+      }
+    });
     console.error(
-      `[memoraone-mcp] ${sessionLabel} owns heartbeat for project ${runtime.projectId} interval=${intervalMs}ms`
+      `[memoraone-mcp] ${sessionLabel} owns heartbeat for project ${runtime.projectId}`
     );
-    await sendProjectHeartbeat(activeClient, heartbeatCtx);
-    heartbeatInterval = setInterval(() => {
-      sendProjectHeartbeat(activeClient, heartbeatCtx).catch(() => {
-      });
-    }, intervalMs);
+    await ownedHeartbeat.start();
   }
   const onSigInt = () => shutdown("SIGINT");
   const onSigTerm = () => shutdown("SIGTERM");
   const shutdown = (signal, exitProcess = true) => {
     process.off("SIGINT", onSigInt);
     process.off("SIGTERM", onSigTerm);
-    if (heartbeatInterval) {
-      clearInterval(heartbeatInterval);
-      heartbeatInterval = null;
+    if (ownedHeartbeat?.isRunning()) {
+      ownedHeartbeat.stop();
+      ownedHeartbeat = null;
       if (runtime.projectId) {
         console.error(
           `[memoraone-mcp] ${sessionLabel} released session heartbeat for project ${runtime.projectId}`
@@ -2296,10 +3110,10 @@ async function main(opts = {}) {
     console.error("[memoraone-mcp] MCP server ready");
   }
   if (opts.sessionSocket) {
-    await new Promise((resolve7) => {
+    await new Promise((resolve9) => {
       opts.sessionSocket.once("close", () => {
         shutdown("session closed", false);
-        resolve7();
+        resolve9();
       });
     });
   }