@memoraone/mcp 0.1.35 → 0.1.37

package/dist/cli.cjs

@@ -30,7 +30,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@memoraone/mcp",
-      version: "0.1.35",
+      version: "0.1.37",
       type: "module",
       main: "dist/index.cjs",
       bin: {
@@ -54,6 +54,7 @@ var require_package = __commonJS({
       },
       dependencies: {
         "@modelcontextprotocol/sdk": "^1.25.1",
+        "@napi-rs/keyring": "1.3.0",
         dotenv: "^16.4.5",
         zod: "^4.0.0"
       },
@@ -69,15 +70,15 @@ var require_package = __commonJS({
 // src/bridgeProxy.ts
 var net = __toESM(require("net"), 1);
 var readline3 = __toESM(require("readline"), 1);
-var import_node_child_process3 = require("child_process");
+var import_node_child_process4 = require("child_process");
 
 // src/bindingIdentity.ts
 var crypto = __toESM(require("crypto"), 1);
 var path = __toESM(require("path"), 1);
 var BINDING_SOCKET_HASH_LENGTH = 16;
-function hashBindingIdentity(projectId, workspaceRoot, ideType) {
+function hashBindingIdentity(repositoryBindingId, workspaceRoot, ideType) {
   const input2 = [
-    projectId.trim().toLowerCase(),
+    repositoryBindingId.trim(),
     path.resolve(workspaceRoot),
     ideType
   ].join("|");
@@ -86,7 +87,7 @@ function hashBindingIdentity(projectId, workspaceRoot, ideType) {
 function bindingsMatch(a, b) {
   const envA = a.environment ?? void 0;
   const envB = b.environment ?? void 0;
-  return a.projectId.trim().toLowerCase() === b.projectId.trim().toLowerCase() && path.resolve(a.workspaceRoot) === path.resolve(b.workspaceRoot) && path.resolve(a.m1Path) === path.resolve(b.m1Path) && (a.apiKey ?? null) === (b.apiKey ?? null) && envA === envB;
+  return a.repositoryBindingId === b.repositoryBindingId && a.projectId.trim().toLowerCase() === b.projectId.trim().toLowerCase() && path.resolve(a.workspaceRoot) === path.resolve(b.workspaceRoot) && (a.installationPublicId ?? void 0) === (b.installationPublicId ?? void 0) && envA === envB && a.status === b.status;
 }
 function formatMissingInitializeWorkspaceError(options) {
   const lines = [
@@ -114,203 +115,1084 @@ function formatMissingInitializeWorkspaceError(options) {
 }
 
 // src/bindingSidecar.ts
-var fs3 = __toESM(require("fs"), 1);
-var path4 = __toESM(require("path"), 1);
+var fs8 = __toESM(require("fs"), 1);
+var path10 = __toESM(require("path"), 1);
 
 // src/projectBinding.ts
+var fs6 = __toESM(require("fs/promises"), 1);
+var path8 = __toESM(require("path"), 1);
+
+// src/localState/resolveLocalBinding.ts
+var fs5 = __toESM(require("fs/promises"), 1);
+var path7 = __toESM(require("path"), 1);
+
+// src/localState/bindingStore.ts
+var fs3 = __toESM(require("fs/promises"), 1);
+var path4 = __toESM(require("path"), 1);
+
+// src/localState/atomicFs.ts
 var fs = __toESM(require("fs/promises"), 1);
 var path2 = __toESM(require("path"), 1);
-var uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-var CANONICAL_M1_FILENAME = "memoraone.m1";
-function isCanonicalM1Path(m1Path) {
-  return path2.basename(m1Path) === CANONICAL_M1_FILENAME;
+var import_node_crypto = require("crypto");
+var STATE_DIR_MODE = 448;
+var STATE_FILE_MODE = 384;
+async function ensurePrivateDir(dirPath) {
+  await fs.mkdir(dirPath, { recursive: true, mode: STATE_DIR_MODE });
+  try {
+    await fs.chmod(dirPath, STATE_DIR_MODE);
+  } catch {
+  }
 }
-function normalizeEnvironment(raw) {
-  if (raw === void 0 || raw === null || typeof raw !== "string") {
-    return void 0;
+async function writeFileAtomic(filePath, content, options = {}) {
+  const mode = options.mode ?? STATE_FILE_MODE;
+  const dir = path2.dirname(filePath);
+  await ensurePrivateDir(dir);
+  const tmpPath = path2.join(
+    dir,
+    `.${path2.basename(filePath)}.${process.pid}.${(0, import_node_crypto.randomBytes)(8).toString("hex")}.tmp`
+  );
+  try {
+    await fs.writeFile(tmpPath, content, { encoding: "utf8", mode });
+    await fs.rename(tmpPath, filePath);
+    try {
+      await fs.chmod(filePath, mode);
+    } catch {
+    }
+  } catch (err) {
+    try {
+      await fs.unlink(tmpPath);
+    } catch {
+    }
+    throw err;
   }
-  const trimmed = raw.trim();
-  return trimmed === "" ? void 0 : trimmed;
 }
-function parseAndValidateM1(content, markerPath) {
-  let parsed;
+async function readJsonFile(filePath) {
   try {
-    parsed = JSON.parse(content);
-  } catch {
-    throw new Error(`[memoraone-mcp] Invalid memoraone.m1 JSON at ${markerPath}`);
+    const raw = await fs.readFile(filePath, "utf8");
+    return JSON.parse(raw);
+  } catch (err) {
+    if (err?.code === "ENOENT") {
+      return null;
+    }
+    if (err instanceof SyntaxError) {
+      throw new Error(`[memoraone-mcp] Corrupt JSON at ${filePath}`);
+    }
+    throw err;
+  }
+}
+async function writeJsonAtomic(filePath, value, options = {}) {
+  await writeFileAtomic(filePath, `${JSON.stringify(value, null, 2)}
+`, options);
+}
+
+// src/localState/repositoryBindingId.ts
+var import_node_crypto2 = require("crypto");
+var MRB_PREFIX = "mrb_";
+var MRB_RE = /^mrb_[A-Za-z0-9_-]{43}$/;
+function generateRepositoryBindingId(random = () => (0, import_node_crypto2.randomBytes)(32)) {
+  const bytes = random();
+  if (bytes.length !== 32) {
+    throw new Error("[memoraone-mcp] repository binding id requires exactly 32 random bytes");
   }
-  const projectId = parsed?.projectId ?? parsed?.project_id;
-  if (!projectId || typeof projectId !== "string") {
-    throw new Error(`[memoraone-mcp] memoraone.m1 missing projectId at ${markerPath}`);
+  return `${MRB_PREFIX}${bytes.toString("base64url")}`;
+}
+function isRepositoryBindingId(value) {
+  return MRB_RE.test(value);
+}
+function assertRepositoryBindingId(value) {
+  if (!isRepositoryBindingId(value)) {
+    throw new Error(`[memoraone-mcp] Invalid repository_binding_id: ${value}`);
   }
-  if (!uuidRegex.test(projectId.trim())) {
-    throw new Error(`[memoraone-mcp] memoraone.m1 projectId is not a UUID at ${markerPath}`);
+  return value;
+}
+
+// src/localState/bindingRecord.ts
+var BINDING_RECORD_VERSION = 1;
+var SECRET_KEYS = [
+  "accessToken",
+  "refreshToken",
+  "access_token",
+  "refresh_token",
+  "apiKey",
+  "api_key",
+  "MEMORAONE_API_KEY",
+  "clientRedeemKey",
+  "client_redeem_key",
+  "clientRefreshKey",
+  "client_refresh_key",
+  "code",
+  "connectCode",
+  "connect_code"
+];
+function assertNoSecretsInBindingRecord(record) {
+  for (const key of SECRET_KEYS) {
+    if (key in record && record[key] != null && record[key] !== "") {
+      throw new Error(`[memoraone-mcp] Binding record must not contain secret field: ${key}`);
+    }
   }
-  const apiKeyRaw = parsed?.MEMORAONE_API_KEY ?? parsed?.api_key;
-  const apiKey = apiKeyRaw !== void 0 && apiKeyRaw !== null && typeof apiKeyRaw === "string" && apiKeyRaw.trim() !== "" ? apiKeyRaw.trim() : null;
-  const environment = normalizeEnvironment(parsed?.environment);
-  return environment === void 0 ? { projectId: projectId.trim(), apiKey } : { projectId: projectId.trim(), apiKey, environment };
 }
-async function resolveProjectIdFromExplicitM1Path() {
-  const raw = process.env.MEMORAONE_M1_PATH;
-  if (raw === void 0 || raw.trim() === "") {
+function parseBindingRecord(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new Error("[memoraone-mcp] Corrupt binding record");
+  }
+  const obj = raw;
+  assertNoSecretsInBindingRecord(obj);
+  if (obj.v !== BINDING_RECORD_VERSION) {
+    throw new Error(`[memoraone-mcp] Unsupported binding record version: ${String(obj.v)}`);
+  }
+  const repositoryBindingId = assertRepositoryBindingId(String(obj.repositoryBindingId ?? ""));
+  const workspaceRoot = typeof obj.workspaceRoot === "string" ? obj.workspaceRoot : "";
+  if (!workspaceRoot) {
+    throw new Error("[memoraone-mcp] Binding record missing workspaceRoot");
+  }
+  const fsId = obj.filesystemIdentity;
+  if (!fsId || typeof fsId !== "object" || Array.isArray(fsId)) {
+    throw new Error("[memoraone-mcp] Binding record missing filesystemIdentity");
+  }
+  const identity = fsId;
+  const birthtimeMs = Number(identity.birthtimeMs);
+  if (typeof identity.platform !== "string" || typeof identity.deviceId !== "string" || typeof identity.inode !== "string" || !Number.isFinite(birthtimeMs) || birthtimeMs <= 0) {
+    throw new Error("[memoraone-mcp] Binding record has invalid filesystemIdentity");
+  }
+  const status = obj.status;
+  if (status !== "connected" && status !== "reconnect_required" && status !== "pending") {
+    throw new Error("[memoraone-mcp] Binding record has invalid status");
+  }
+  const record = {
+    v: BINDING_RECORD_VERSION,
+    repositoryBindingId,
+    workspaceRoot,
+    filesystemIdentity: {
+      platform: identity.platform,
+      deviceId: identity.deviceId,
+      inode: identity.inode,
+      birthtimeMs
+    },
+    rootFingerprint: typeof obj.rootFingerprint === "string" ? obj.rootFingerprint : "",
+    displayName: typeof obj.displayName === "string" ? obj.displayName : "",
+    environment: typeof obj.environment === "string" ? obj.environment : "local",
+    normalizedGitRemote: obj.normalizedGitRemote === null || typeof obj.normalizedGitRemote === "string" ? obj.normalizedGitRemote : null,
+    status,
+    createdAt: typeof obj.createdAt === "string" ? obj.createdAt : (/* @__PURE__ */ new Date()).toISOString(),
+    updatedAt: typeof obj.updatedAt === "string" ? obj.updatedAt : (/* @__PURE__ */ new Date()).toISOString()
+  };
+  if (typeof obj.apiUrl === "string" && obj.apiUrl.trim()) {
+    record.apiUrl = obj.apiUrl.trim().replace(/\/+$/, "");
+  }
+  if (typeof obj.installationPublicId === "string" && obj.installationPublicId) {
+    record.installationPublicId = obj.installationPublicId;
+  }
+  if (typeof obj.projectId === "string" && obj.projectId) {
+    record.projectId = obj.projectId;
+  }
+  if (obj.packageVersion === null || typeof obj.packageVersion === "string") {
+    record.packageVersion = obj.packageVersion;
+  }
+  if (obj.ideType === null || typeof obj.ideType === "string") {
+    record.ideType = obj.ideType;
+  }
+  return record;
+}
+
+// src/localState/localLocks.ts
+var fs2 = __toESM(require("fs/promises"), 1);
+
+// src/localState/statePaths.ts
+var os = __toESM(require("os"), 1);
+var path3 = __toESM(require("path"), 1);
+var MEMORAONE_STATE_DIRNAME = ".memoraone";
+function getMemoraoneStateDir(homeDir = os.homedir()) {
+  return path3.join(homeDir, MEMORAONE_STATE_DIRNAME);
+}
+function getPathIndexPath(homeDir = os.homedir()) {
+  return path3.join(getMemoraoneStateDir(homeDir), "path-index.json");
+}
+function getBindingsDir(homeDir = os.homedir()) {
+  return path3.join(getMemoraoneStateDir(homeDir), "bindings");
+}
+function getBindingFilePath(repositoryBindingId, homeDir = os.homedir()) {
+  return path3.join(getBindingsDir(homeDir), `${repositoryBindingId}.json`);
+}
+function getLocksDir(homeDir = os.homedir()) {
+  return path3.join(getMemoraoneStateDir(homeDir), "locks");
+}
+function getLockPath(lockName, homeDir = os.homedir()) {
+  return path3.join(getLocksDir(homeDir), `${lockName}.lock`);
+}
+
+// src/localState/localLocks.ts
+async function acquireLocalLock(lockName, options = {}) {
+  const homeDir = options.homeDir;
+  const maxRetries = options.maxRetries ?? 40;
+  const retryDelayMs = options.retryDelayMs ?? 50;
+  const maxLockAgeMs = options.maxLockAgeMs ?? 15e3;
+  const lockPath = getLockPath(lockName, homeDir);
+  await ensurePrivateDir(getLocksDir(homeDir));
+  let retries = 0;
+  while (retries <= maxRetries) {
+    try {
+      try {
+        const stat4 = await fs2.stat(lockPath);
+        if (Date.now() - stat4.mtimeMs > maxLockAgeMs) {
+          await fs2.unlink(lockPath);
+        }
+      } catch (err) {
+        if (err?.code !== "ENOENT") {
+          throw err;
+        }
+      }
+      const fd = await fs2.open(lockPath, "wx");
+      await fd.writeFile(
+        JSON.stringify({
+          pid: process.pid,
+          createdAt: (/* @__PURE__ */ new Date()).toISOString()
+        }),
+        "utf8"
+      );
+      await fd.close();
+      return async () => {
+        try {
+          await fs2.unlink(lockPath);
+        } catch (err) {
+          if (err?.code !== "ENOENT") {
+          }
+        }
+      };
+    } catch (err) {
+      if (err?.code === "EEXIST") {
+        retries += 1;
+        if (retries > maxRetries) {
+          throw new Error(
+            `[memoraone-mcp] Failed to acquire lock ${lockName} after ${maxRetries} retries`
+          );
+        }
+        await new Promise((resolve17) => setTimeout(resolve17, retryDelayMs));
+        continue;
+      }
+      throw err;
+    }
+  }
+  throw new Error(`[memoraone-mcp] Failed to acquire lock ${lockName}`);
+}
+async function withLocalLock(lockName, fn, options = {}) {
+  const release = await acquireLocalLock(lockName, options);
+  try {
+    return await fn();
+  } finally {
+    await release();
+  }
+}
+
+// src/localState/bindingStore.ts
+async function ensureBindingsDir(homeDir) {
+  const dir = getBindingsDir(homeDir);
+  await ensurePrivateDir(dir);
+  return dir;
+}
+async function readBindingRecord(repositoryBindingId, homeDir) {
+  const id = assertRepositoryBindingId(repositoryBindingId);
+  const filePath = getBindingFilePath(id, homeDir);
+  const raw = await readJsonFile(filePath);
+  if (raw == null) {
     return null;
   }
-  const markerPath = path2.resolve(raw);
+  return parseBindingRecord(raw);
+}
+async function writeBindingRecord(record, homeDir) {
+  assertNoSecretsInBindingRecord(record);
+  const id = assertRepositoryBindingId(record.repositoryBindingId);
+  await ensureBindingsDir(homeDir);
+  const next = {
+    ...record,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await withLocalLock(
+    `binding-${id}`,
+    async () => {
+      await writeJsonAtomic(getBindingFilePath(id, homeDir), next);
+    },
+    { homeDir }
+  );
+}
+async function listBindingRecords(homeDir) {
+  const dir = await ensureBindingsDir(homeDir);
+  let names;
   try {
-    const content = await fs.readFile(markerPath, "utf8");
-    const { projectId, apiKey, environment } = parseAndValidateM1(content, markerPath);
-    return environment === void 0 ? { projectId, apiKey, foundAt: markerPath } : { projectId, apiKey, environment, foundAt: markerPath };
+    names = await fs3.readdir(dir);
   } catch (err) {
-    if (err?.code === "ENOENT") {
+    if (err?.code === "ENOENT") return [];
+    throw err;
+  }
+  const out = [];
+  for (const name of names) {
+    if (!name.endsWith(".json") || name.startsWith(".")) continue;
+    const id = name.slice(0, -".json".length);
+    try {
+      const record = await readBindingRecord(id, homeDir);
+      if (record) out.push(record);
+    } catch {
+    }
+  }
+  return out;
+}
+async function findBindingRecordByWorkspaceRoot(workspaceRoot, homeDir) {
+  const resolved = path4.resolve(workspaceRoot);
+  const records = await listBindingRecords(homeDir);
+  return records.find((r) => path4.resolve(r.workspaceRoot) === resolved) ?? null;
+}
+
+// src/localState/installationCredentials.ts
+var import_node_crypto3 = require("crypto");
+
+// src/localState/keyringStore.ts
+var KEYRING_SERVICE = "MemoraOne Local MCP";
+function keyringAccountForBinding(repositoryBindingId) {
+  return `binding:${assertRepositoryBindingId(repositoryBindingId)}`;
+}
+var KeyringUnavailableError = class extends Error {
+  constructor(message, cause) {
+    super(message);
+    this.name = "KeyringUnavailableError";
+    if (cause !== void 0) {
+      this.cause = cause;
+    }
+  }
+};
+var KeyringOperationError = class extends Error {
+  constructor(message, cause) {
+    super(message);
+    this.name = "KeyringOperationError";
+    if (cause !== void 0) {
+      this.cause = cause;
+    }
+  }
+};
+var cachedModule;
+var loadError;
+async function loadKeyringModule(loader = defaultKeyringLoader) {
+  if (cachedModule) {
+    return cachedModule;
+  }
+  if (cachedModule === null) {
+    throw new KeyringUnavailableError(
+      "[memoraone-mcp] OS keyring unavailable; cannot store or load credentials. No plaintext fallback.",
+      loadError
+    );
+  }
+  try {
+    cachedModule = await loader();
+    return cachedModule;
+  } catch (err) {
+    cachedModule = null;
+    loadError = err;
+    throw new KeyringUnavailableError(
+      "[memoraone-mcp] OS keyring unavailable; cannot store or load credentials. No plaintext fallback.",
+      err
+    );
+  }
+}
+async function defaultKeyringLoader() {
+  const mod = await import("@napi-rs/keyring");
+  if (!mod?.Entry) {
+    throw new Error("Entry export missing from @napi-rs/keyring");
+  }
+  return mod;
+}
+async function keyringSetPassword(repositoryBindingId, password, options = {}) {
+  const mod = await loadKeyringModule(options.loader);
+  const account = keyringAccountForBinding(repositoryBindingId);
+  try {
+    const entry = new mod.Entry(KEYRING_SERVICE, account);
+    entry.setPassword(password);
+  } catch (err) {
+    if (err instanceof KeyringUnavailableError) throw err;
+    throw new KeyringOperationError(
+      `[memoraone-mcp] Failed to write credentials to OS keyring for ${account}`,
+      err
+    );
+  }
+}
+async function keyringGetPassword(repositoryBindingId, options = {}) {
+  const mod = await loadKeyringModule(options.loader);
+  const account = keyringAccountForBinding(repositoryBindingId);
+  try {
+    const entry = new mod.Entry(KEYRING_SERVICE, account);
+    return entry.getPassword();
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (/NoEntry|not found|no entry/i.test(message)) {
       return null;
     }
+    if (err instanceof KeyringUnavailableError) throw err;
+    throw new KeyringOperationError(
+      `[memoraone-mcp] Failed to read credentials from OS keyring for ${account}`,
+      err
+    );
+  }
+}
+
+// src/localState/installationCredentials.ts
+function parsePayload(raw, repositoryBindingId) {
+  let parsed2;
+  try {
+    parsed2 = JSON.parse(raw);
+  } catch {
+    throw new Error("[memoraone-mcp] Corrupt keyring credential payload");
+  }
+  if (!parsed2 || typeof parsed2 !== "object" || Array.isArray(parsed2)) {
+    throw new Error("[memoraone-mcp] Corrupt keyring credential payload");
+  }
+  const obj = parsed2;
+  const id = assertRepositoryBindingId(String(obj.repositoryBindingId ?? repositoryBindingId));
+  if (id !== repositoryBindingId) {
+    throw new Error("[memoraone-mcp] Keyring credential payload binding id mismatch");
+  }
+  const payload = {
+    repositoryBindingId: id,
+    updatedAt: typeof obj.updatedAt === "string" ? obj.updatedAt : (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const optionalString = (key) => {
+    const value = obj[key];
+    if (typeof value === "string" && value.trim() !== "") {
+      payload[key] = value;
+    }
+  };
+  optionalString("installationPublicId");
+  optionalString("projectId");
+  optionalString("accessToken");
+  optionalString("refreshToken");
+  optionalString("accessTokenExpiresAt");
+  optionalString("refreshTokenExpiresAt");
+  optionalString("clientRedeemKey");
+  optionalString("clientRefreshKey");
+  return payload;
+}
+async function readInstallationCredentials(repositoryBindingId, options = {}) {
+  const id = assertRepositoryBindingId(repositoryBindingId);
+  const raw = await keyringGetPassword(id, options);
+  if (raw == null || raw.trim() === "") {
+    return null;
+  }
+  return parsePayload(raw, id);
+}
+async function writeInstallationCredentials(payload, options = {}) {
+  const id = assertRepositoryBindingId(payload.repositoryBindingId);
+  const next = {
+    ...payload,
+    repositoryBindingId: id,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await keyringSetPassword(id, JSON.stringify(next), options);
+  return next;
+}
+async function updateInstallationCredentials(repositoryBindingId, patch, options = {}) {
+  const id = assertRepositoryBindingId(repositoryBindingId);
+  const existing = await readInstallationCredentials(id, options) ?? {
+    repositoryBindingId: id,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const merged = {
+    ...existing,
+    ...Object.fromEntries(
+      Object.entries(patch).filter(([, value]) => value !== void 0)
+    ),
+    repositoryBindingId: id
+  };
+  for (const key of options.clearKeys ?? []) {
+    if (key !== "repositoryBindingId" && key !== "updatedAt") {
+      delete merged[key];
+    }
+  }
+  return writeInstallationCredentials(merged, options);
+}
+async function ensureClientRedeemKey(repositoryBindingId, options = {}) {
+  const existing = await readInstallationCredentials(repositoryBindingId, options);
+  if (existing?.clientRedeemKey) {
+    return { payload: existing, clientRedeemKey: existing.clientRedeemKey, created: false };
+  }
+  const clientRedeemKey = (0, import_node_crypto3.randomUUID)();
+  const payload = await updateInstallationCredentials(
+    repositoryBindingId,
+    { clientRedeemKey },
+    options
+  );
+  return { payload, clientRedeemKey, created: true };
+}
+function hasUsableAccessToken(payload) {
+  return Boolean(payload?.accessToken && payload.accessToken.startsWith("mia_"));
+}
+
+// src/localState/pathIndex.ts
+var path6 = __toESM(require("path"), 1);
+
+// src/localState/rootFilesystemIdentity.ts
+var fs4 = __toESM(require("fs/promises"), 1);
+var os2 = __toESM(require("os"), 1);
+var path5 = __toESM(require("path"), 1);
+var import_node_child_process = require("child_process");
+var import_node_util = require("util");
+var execFileAsync = (0, import_node_util.promisify)(import_node_child_process.execFile);
+function filesystemIdentityKey(identity) {
+  return [
+    identity.platform,
+    identity.deviceId,
+    identity.inode,
+    String(identity.birthtimeMs)
+  ].join("|");
+}
+function identitiesMatch(a, b) {
+  return filesystemIdentityKey(a) === filesystemIdentityKey(b);
+}
+async function readDarwinDeviceId() {
+  const { stdout } = await execFileAsync("ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"]);
+  const match = stdout.match(/"IOPlatformUUID"\s*=\s*"([^"]+)"/);
+  if (!match?.[1]) {
+    throw new Error("[memoraone-mcp] Unable to read macOS IOPlatformUUID");
+  }
+  return match[1].trim();
+}
+async function readLinuxDeviceId() {
+  try {
+    const content = await fs4.readFile("/etc/machine-id", "utf8");
+    const id = content.trim();
+    if (id) return id;
+  } catch {
+  }
+  try {
+    const content = await fs4.readFile("/var/lib/dbus/machine-id", "utf8");
+    const id = content.trim();
+    if (id) return id;
+  } catch {
+  }
+  throw new Error("[memoraone-mcp] Unable to read Linux machine-id");
+}
+async function readWindowsDeviceId() {
+  const { stdout } = await execFileAsync("reg", [
+    "query",
+    "HKLM\\SOFTWARE\\Microsoft\\Cryptography",
+    "/v",
+    "MachineGuid"
+  ]);
+  const match = stdout.match(/MachineGuid\s+REG_SZ\s+(.+)/i);
+  if (!match?.[1]) {
+    throw new Error("[memoraone-mcp] Unable to read Windows MachineGuid");
+  }
+  return match[1].trim();
+}
+async function resolveDeviceId(platform2 = os2.platform()) {
+  if (platform2 === "darwin") return readDarwinDeviceId();
+  if (platform2 === "linux") return readLinuxDeviceId();
+  if (platform2 === "win32") return readWindowsDeviceId();
+  try {
+    const { stdout } = await execFileAsync("hostid", []);
+    const id = stdout.trim();
+    if (id) return id;
+  } catch {
+  }
+  throw new Error(`[memoraone-mcp] Unsupported platform for device ID: ${platform2}`);
+}
+async function captureRootFilesystemIdentity(rootPath, deps = {}) {
+  const resolved = path5.resolve(rootPath);
+  const platform2 = deps.platform ?? os2.platform();
+  const statRoot = deps.statRoot ?? (async (p) => {
+    const st2 = await fs4.stat(p);
+    return {
+      ino: st2.ino,
+      dev: st2.dev,
+      birthtimeMs: st2.birthtimeMs,
+      isDirectory: () => st2.isDirectory()
+    };
+  });
+  const readDeviceId = deps.readDeviceId ?? (() => resolveDeviceId(platform2));
+  const st = await statRoot(resolved);
+  if (!st.isDirectory()) {
+    throw new Error(`[memoraone-mcp] Workspace root is not a directory: ${resolved}`);
+  }
+  const birthtimeMs = Number(st.birthtimeMs);
+  if (!Number.isFinite(birthtimeMs) || birthtimeMs <= 0) {
+    throw new Error(
+      "[memoraone-mcp] Root birth time unavailable; cannot bind this working tree. Reconnect required."
+    );
+  }
+  const inode = typeof st.ino === "bigint" ? st.ino.toString() : String(st.ino);
+  const deviceId = await readDeviceId();
+  if (!deviceId || !inode) {
+    throw new Error(
+      "[memoraone-mcp] Ambiguous filesystem identity; cannot bind this working tree. Reconnect required."
+    );
+  }
+  return {
+    platform: platform2,
+    deviceId,
+    inode,
+    birthtimeMs
+  };
+}
+
+// src/localState/pathIndex.ts
+var PATH_INDEX_VERSION = 1;
+function emptyIndex() {
+  return {
+    v: PATH_INDEX_VERSION,
+    byPath: {},
+    byIdentity: {},
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function parsePathIndex(raw) {
+  if (raw == null) {
+    return emptyIndex();
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new Error("[memoraone-mcp] Corrupt path-index.json");
+  }
+  const obj = raw;
+  if (obj.v !== PATH_INDEX_VERSION) {
+    throw new Error(`[memoraone-mcp] Unsupported path-index version: ${String(obj.v)}`);
+  }
+  const byPath = obj.byPath && typeof obj.byPath === "object" && !Array.isArray(obj.byPath) ? obj.byPath : {};
+  const byIdentity = obj.byIdentity && typeof obj.byIdentity === "object" && !Array.isArray(obj.byIdentity) ? obj.byIdentity : {};
+  return {
+    v: PATH_INDEX_VERSION,
+    byPath: { ...byPath },
+    byIdentity: { ...byIdentity },
+    updatedAt: typeof obj.updatedAt === "string" ? obj.updatedAt : (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+async function loadPathIndex(homeDir) {
+  const filePath = getPathIndexPath(homeDir);
+  try {
+    const raw = await readJsonFile(filePath);
+    return parsePathIndex(raw);
+  } catch (err) {
+    if (err instanceof Error && err.message.includes("Corrupt")) {
+      throw err;
+    }
     throw err;
   }
 }
-async function findM1WalkingUp(workspaceRoot) {
-  let current = path2.resolve(workspaceRoot);
-  while (true) {
-    const markerPath = path2.join(current, CANONICAL_M1_FILENAME);
-    try {
-      const content = await fs.readFile(markerPath, "utf8");
-      const { projectId, apiKey, environment } = parseAndValidateM1(content, markerPath);
-      const repoRoot = path2.dirname(markerPath);
-      return environment === void 0 ? { projectId, apiKey, repoRoot, markerPath } : { projectId, apiKey, environment, repoRoot, markerPath };
-    } catch (err) {
-      if (err?.code !== "ENOENT") {
-        throw err;
+async function savePathIndex(index, homeDir) {
+  const next = {
+    ...index,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await writeJsonAtomic(getPathIndexPath(homeDir), next);
+}
+function lookupPathIndex(index, workspaceRoot, identity) {
+  const resolved = path6.resolve(workspaceRoot);
+  const byPathId = index.byPath[resolved];
+  if (byPathId) {
+    return { kind: "path", repositoryBindingId: assertRepositoryBindingId(byPathId) };
+  }
+  const identityKey = filesystemIdentityKey(identity);
+  const byIdentityId = index.byIdentity[identityKey];
+  if (!byIdentityId) {
+    return { kind: "none" };
+  }
+  const previousPath = Object.entries(index.byPath).find(([, id]) => id === byIdentityId)?.[0];
+  if (!previousPath) {
+    return {
+      kind: "identity-rename",
+      repositoryBindingId: assertRepositoryBindingId(byIdentityId),
+      previousPath: resolved
+    };
+  }
+  return {
+    kind: "identity-rename",
+    repositoryBindingId: assertRepositoryBindingId(byIdentityId),
+    previousPath
+  };
+}
+async function upsertPathIndexEntry(options) {
+  const repositoryBindingId = assertRepositoryBindingId(options.repositoryBindingId);
+  const resolved = path6.resolve(options.workspaceRoot);
+  const identityKey = filesystemIdentityKey(options.identity);
+  return withLocalLock(
+    "path-index",
+    async () => {
+      const index = await loadPathIndex(options.homeDir);
+      if (options.previousPath && path6.resolve(options.previousPath) !== resolved) {
+        delete index.byPath[path6.resolve(options.previousPath)];
+      }
+      for (const [p, id] of Object.entries(index.byPath)) {
+        if (id === repositoryBindingId && p !== resolved) {
+          delete index.byPath[p];
+        }
+      }
+      for (const [key, id] of Object.entries(index.byIdentity)) {
+        if (id === repositoryBindingId && key !== identityKey) {
+          delete index.byIdentity[key];
+        }
       }
+      index.byPath[resolved] = repositoryBindingId;
+      index.byIdentity[identityKey] = repositoryBindingId;
+      await savePathIndex(index, options.homeDir);
+      return index;
+    },
+    { homeDir: options.homeDir }
+  );
+}
+function identityMatchesStored(stored, current) {
+  return identitiesMatch(stored, current);
+}
+
+// src/client/memoraClient.ts
+var parseBooleanFlag = (value) => {
+  if (!value) {
+    return false;
+  }
+  const normalized = value.trim().toLowerCase();
+  return ["1", "true", "yes", "on"].includes(normalized);
+};
+var debugEnabled = parseBooleanFlag(process.env.MEMORAONE_DEV_MODE);
+var MemoraOneHttpError = class extends Error {
+  constructor(status, statusText, body) {
+    super(`MemoraOne request failed: ${status} ${statusText}`);
+    this.name = "MemoraOneHttpError";
+    this.status = status;
+    this.body = body;
+  }
+};
+
+// src/localState/localConnectClient.ts
+async function requestJson(baseUrl, method, path21, options = {}) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const url = `${baseUrl.replace(/\/+$/, "")}${path21.startsWith("/") ? path21 : `/${path21}`}`;
+  const res = await fetchImpl(url, {
+    method,
+    headers: {
+      "content-type": "application/json",
+      ...options.headers ?? {}
+    },
+    body: method === "GET" ? void 0 : JSON.stringify(options.body ?? {})
+  });
+  const text = await res.text();
+  let json = null;
+  if (text) {
+    try {
+      json = JSON.parse(text);
+    } catch {
+      json = text;
     }
-    const parent = path2.dirname(current);
-    if (parent === current) {
-      break;
+  }
+  if (!res.ok && !options.acceptStatuses?.includes(res.status)) {
+    throw new MemoraOneHttpError(res.status, res.statusText, json);
+  }
+  return { status: res.status, statusText: res.statusText, ok: res.ok, json };
+}
+function assertSafeRedeemBody(body) {
+  if ("canonical_root" in body) {
+    throw new Error("[memoraone-mcp] redeem body must not include canonical_root");
+  }
+  for (const key of [
+    "workspace_root",
+    "absolute_path",
+    "filesystem_identity",
+    "device_id",
+    "inode",
+    "birthtime_ms",
+    "birthtimeMs"
+  ]) {
+    if (key in body) {
+      throw new Error(`[memoraone-mcp] redeem body must not include ${key}`);
     }
-    current = parent;
   }
-  return null;
 }
-function normalizeWorkspaceSearchRoots(workspaceRoot) {
-  if (workspaceRoot === void 0) {
-    return [];
+async function redeemLocalConnectCode(apiUrl, body, options = {}) {
+  assertSafeRedeemBody(body);
+  const res = await requestJson(apiUrl, "POST", "/v1/local-connect/redeem", {
+    body,
+    fetchImpl: options.fetchImpl
+  });
+  const data = res.json;
+  const accessToken = data?.access_token;
+  const refreshToken = data?.refresh_token;
+  const installationPublicId = data?.installation_public_id;
+  const projectId = data?.project_id;
+  const repositoryBindingId = data?.repository_binding_id;
+  if (typeof accessToken !== "string" || typeof refreshToken !== "string" || typeof installationPublicId !== "string" || typeof projectId !== "string" || typeof repositoryBindingId !== "string") {
+    throw new Error("[memoraone-mcp] Invalid redeem response");
+  }
+  let sourceId = null;
+  if (data.source_id === null) {
+    sourceId = null;
+  } else if (typeof data.source_id === "string") {
+    sourceId = data.source_id;
   }
-  const list = Array.isArray(workspaceRoot) ? workspaceRoot : [workspaceRoot];
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const raw of list) {
-    if (raw === void 0) {
-      continue;
-    }
-    const trimmed = String(raw).trim();
-    if (trimmed === "") {
-      continue;
+  return {
+    access_token: accessToken,
+    refresh_token: refreshToken,
+    access_token_expires_at: typeof data.access_token_expires_at === "string" ? data.access_token_expires_at : null,
+    refresh_token_expires_at: typeof data.refresh_token_expires_at === "string" ? data.refresh_token_expires_at : null,
+    installation_public_id: installationPublicId,
+    project_id: projectId,
+    repository_binding_id: repositoryBindingId,
+    source_id: sourceId,
+    recovered: Boolean(data.recovered)
+  };
+}
+
+// src/localState/tokenRefreshCoordinator.ts
+var ReconnectRequiredError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ReconnectRequiredError";
+  }
+};
+
+// src/localState/resolveLocalBinding.ts
+async function detectLegacyM1Warning(workspaceRoot) {
+  const candidate = path7.join(path7.resolve(workspaceRoot), CANONICAL_M1_FILENAME);
+  try {
+    await fs5.access(candidate);
+    return candidate;
+  } catch {
+    return void 0;
+  }
+}
+async function ensureRepositoryBindingForRoot(workspaceRoot, options = {}) {
+  const resolved = path7.resolve(workspaceRoot);
+  const identity = await captureRootFilesystemIdentity(resolved, options.identityDeps);
+  const legacyM1WarningPath = await detectLegacyM1Warning(resolved);
+  const index = await loadPathIndex(options.homeDir);
+  const lookup = lookupPathIndex(index, resolved, identity);
+  if (lookup.kind === "path") {
+    const record = await readBindingRecord(lookup.repositoryBindingId, options.homeDir);
+    if (record && identityMatchesStored(record.filesystemIdentity, identity)) {
+      if (path7.resolve(record.workspaceRoot) !== resolved) {
+        const updated = {
+          ...record,
+          workspaceRoot: resolved,
+          updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+        };
+        await writeBindingRecord(updated, options.homeDir);
+        await upsertPathIndexEntry({
+          repositoryBindingId: record.repositoryBindingId,
+          workspaceRoot: resolved,
+          identity,
+          homeDir: options.homeDir,
+          previousPath: record.workspaceRoot
+        });
+      }
+      return {
+        repositoryBindingId: record.repositoryBindingId,
+        identity,
+        created: false,
+        legacyM1WarningPath
+      };
     }
-    const resolved = path2.resolve(trimmed);
-    if (!seen.has(resolved)) {
-      seen.add(resolved);
-      out.push(resolved);
+  }
+  if (lookup.kind === "identity-rename") {
+    const record = await readBindingRecord(lookup.repositoryBindingId, options.homeDir);
+    if (record && identityMatchesStored(record.filesystemIdentity, identity)) {
+      const updated = {
+        ...record,
+        workspaceRoot: resolved,
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      await writeBindingRecord(updated, options.homeDir);
+      await upsertPathIndexEntry({
+        repositoryBindingId: record.repositoryBindingId,
+        workspaceRoot: resolved,
+        identity,
+        homeDir: options.homeDir,
+        previousPath: lookup.previousPath
+      });
+      return {
+        repositoryBindingId: record.repositoryBindingId,
+        identity,
+        created: false,
+        renamedFrom: lookup.previousPath,
+        legacyM1WarningPath
+      };
     }
   }
-  return out;
+  if (!options.createIfMissing) {
+    throw new ReconnectRequiredError(
+      `[memoraone-mcp] No local binding for workspace ${resolved}. Run: memoraone-mcp connect <code>`
+    );
+  }
+  const repositoryBindingId = generateRepositoryBindingId();
+  return {
+    repositoryBindingId,
+    identity,
+    created: true,
+    legacyM1WarningPath
+  };
 }
-function resolveApiKeyWithSource(fileApiKey) {
-  const envApiKey = process.env.MEMORAONE_API_KEY?.trim();
-  if (envApiKey) {
-    return { apiKey: envApiKey, apiKeySource: "env" };
+async function resolveLocalBinding(workspaceRoot, options = {}) {
+  const resolved = path7.resolve(workspaceRoot);
+  const { repositoryBindingId, legacyM1WarningPath } = await ensureRepositoryBindingForRoot(
+    resolved,
+    { ...options, createIfMissing: false }
+  );
+  const record = await readBindingRecord(repositoryBindingId, options.homeDir);
+  if (!record) {
+    throw new ReconnectRequiredError(
+      `[memoraone-mcp] Binding metadata missing for ${repositoryBindingId}. Run: memoraone-mcp connect <code>`
+    );
+  }
+  const identity = await captureRootFilesystemIdentity(resolved, options.identityDeps);
+  if (!identityMatchesStored(record.filesystemIdentity, identity)) {
+    throw new ReconnectRequiredError(
+      "[memoraone-mcp] Workspace filesystem identity changed. Run: memoraone-mcp connect <code>"
+    );
+  }
+  if (record.status === "reconnect_required") {
+    throw new ReconnectRequiredError(
+      "[memoraone-mcp] Installation requires reconnect. Run: memoraone-mcp connect <code>"
+    );
   }
-  const aliasEnvApiKey = process.env.MEMORA_API_KEY?.trim();
-  if (aliasEnvApiKey) {
-    return { apiKey: aliasEnvApiKey, apiKeySource: "env" };
+  const creds = await readInstallationCredentials(
+    repositoryBindingId,
+    options.credentialOptions
+  );
+  if (!hasUsableAccessToken(creds) || !creds?.refreshToken) {
+    throw new ReconnectRequiredError(
+      "[memoraone-mcp] Installation credentials missing. Run: memoraone-mcp connect <code>"
+    );
   }
-  if (fileApiKey) {
-    return { apiKey: fileApiKey, apiKeySource: "memoraone.m1" };
+  const projectId = record.projectId ?? creds.projectId;
+  if (!projectId) {
+    throw new ReconnectRequiredError(
+      "[memoraone-mcp] Binding missing project id. Run: memoraone-mcp connect <code>"
+    );
+  }
+  return {
+    repositoryBindingId,
+    projectId,
+    workspaceRoot: resolved,
+    installationPublicId: record.installationPublicId ?? creds.installationPublicId,
+    environment: record.environment,
+    bindingSource: "local-binding",
+    status: record.status,
+    legacyM1WarningPath
+  };
+}
+
+// src/projectBinding.ts
+var uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var CANONICAL_M1_FILENAME = "memoraone.m1";
+function normalizeEnvironment(raw) {
+  if (raw === void 0 || raw === null || typeof raw !== "string") {
+    return void 0;
+  }
+  const trimmed = raw.trim();
+  return trimmed === "" ? void 0 : trimmed;
+}
+function toResolvedBinding(local) {
+  return {
+    repositoryBindingId: local.repositoryBindingId,
+    projectId: local.projectId,
+    workspaceRoot: local.workspaceRoot,
+    installationPublicId: local.installationPublicId,
+    environment: local.environment,
+    bindingSource: "local-binding",
+    status: local.status,
+    legacyM1WarningPath: local.legacyM1WarningPath
+  };
+}
+async function warnLegacyM1IfPresent(workspaceRoot) {
+  const candidate = path8.join(path8.resolve(workspaceRoot), CANONICAL_M1_FILENAME);
+  try {
+    await fs6.access(candidate);
+    process.stderr.write(
+      `[memoraone-mcp] warning: ignoring legacy ${CANONICAL_M1_FILENAME} (not used for credentials or binding)
+`
+    );
+    return candidate;
+  } catch {
+    return void 0;
   }
-  return { apiKey: null, apiKeySource: "none" };
 }
-async function resolveAuthoritativeBinding(workspaceRoot, options = {}) {
-  const respectExplicitM1Path = options.respectExplicitM1Path !== false;
-  if (respectExplicitM1Path) {
-    const explicitBinding = await resolveProjectIdFromExplicitM1Path();
-    if (explicitBinding) {
-      const resolved = resolveApiKeyWithSource(explicitBinding.apiKey);
-      return {
-        projectId: explicitBinding.projectId,
-        workspaceRoot: path2.dirname(explicitBinding.foundAt),
-        m1Path: explicitBinding.foundAt,
-        apiKey: resolved.apiKey,
-        ...explicitBinding.environment !== void 0 ? { environment: explicitBinding.environment } : {},
-        bindingSource: "explicit-m1-path",
-        apiKeySource: resolved.apiKeySource
-      };
-    }
-  }
+async function resolveAuthoritativeBinding(workspaceRoot, _options = {}) {
   const candidates = normalizeWorkspaceSearchRoots(workspaceRoot);
   if (candidates.length === 0) {
-    throw new Error("Could not find memoraone.m1 in workspace.\nOpen a folder containing memoraone.m1.");
+    throw new ReconnectRequiredError(
+      "[memoraone-mcp] Could not resolve workspace root. Open a connected repository folder.\nRun: memoraone-mcp connect <code>"
+    );
   }
   const bindings = [];
   for (const root of candidates) {
-    const binding = await findM1WalkingUp(root);
-    if (binding) {
-      const resolved = resolveApiKeyWithSource(binding.apiKey);
-      bindings.push({
-        projectId: binding.projectId,
-        workspaceRoot: binding.repoRoot,
-        m1Path: binding.markerPath,
-        apiKey: resolved.apiKey,
-        ...binding.environment !== void 0 ? { environment: binding.environment } : {},
-        bindingSource: "workspace-search",
-        apiKeySource: resolved.apiKeySource
-      });
+    await warnLegacyM1IfPresent(root);
+    try {
+      const local = await resolveLocalBinding(root);
+      bindings.push(toResolvedBinding(local));
+    } catch (err) {
+      if (err instanceof ReconnectRequiredError) {
+        continue;
+      }
+      throw err;
     }
   }
   if (bindings.length === 0) {
-    throw new Error("Could not find memoraone.m1 in workspace.\nOpen a folder containing memoraone.m1.");
+    throw new ReconnectRequiredError(
+      "[memoraone-mcp] No local MemoraOne binding for this workspace.\nRun: memoraone-mcp connect <code>"
+    );
   }
-  const distinctProjectIds = new Set(bindings.map((b) => b.projectId));
-  if (distinctProjectIds.size > 1) {
+  const distinctIds = new Set(bindings.map((b) => b.repositoryBindingId));
+  if (distinctIds.size > 1) {
     const lines = bindings.map(
-      (b) => `  - workspace=${b.workspaceRoot} project=${b.projectId} m1=${b.m1Path}`
+      (b) => `  - workspace=${b.workspaceRoot} binding=${b.repositoryBindingId} project=${b.projectId}`
     );
     throw new Error(
-      "[memoraone-mcp] Ambiguous workspace binding: multiple open roots map to different MemoraOne projects.\n" + lines.join("\n") + "\nOpen one repo per Cursor window, or use repo-scoped .cursor/mcp.json from setup-ide-files --cursor."
+      "[memoraone-mcp] Ambiguous workspace binding: multiple open roots map to different repository bindings.\n" + lines.join("\n") + "\nOpen one repo per window."
     );
   }
   return bindings[0];
 }
+function normalizeWorkspaceSearchRoots(workspaceRoot) {
+  if (workspaceRoot === void 0) {
+    return [];
+  }
+  const list = Array.isArray(workspaceRoot) ? workspaceRoot : [workspaceRoot];
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const raw of list) {
+    if (raw === void 0) continue;
+    const trimmed = String(raw).trim();
+    if (trimmed === "") continue;
+    const resolved = path8.resolve(trimmed);
+    if (!seen.has(resolved)) {
+      seen.add(resolved);
+      out.push(resolved);
+    }
+  }
+  return out;
+}
 function bindingRelevantValuesMatch(a, b) {
   const envA = a.environment ?? void 0;
   const envB = b.environment ?? void 0;
-  return a.projectId.trim().toLowerCase() === b.projectId.trim().toLowerCase() && path2.resolve(a.workspaceRoot) === path2.resolve(b.workspaceRoot) && path2.resolve(a.m1Path) === path2.resolve(b.m1Path) && (a.apiKey ?? null) === (b.apiKey ?? null) && envA === envB;
+  return a.repositoryBindingId === b.repositoryBindingId && a.projectId.trim().toLowerCase() === b.projectId.trim().toLowerCase() && path8.resolve(a.workspaceRoot) === path8.resolve(b.workspaceRoot) && (a.installationPublicId ?? void 0) === (b.installationPublicId ?? void 0) && envA === envB && a.status === b.status;
 }
 async function reconcileResolvedBindingWithDisk(cached) {
-  const m1Path = path2.resolve(cached.m1Path);
-  if (cached.bindingSource !== "explicit-m1-path" && !isCanonicalM1Path(m1Path)) {
-    throw new Error(
-      `[memoraone-mcp] Cached binding m1Path is not the canonical ${CANONICAL_M1_FILENAME}: ${m1Path}`
+  const repositoryBindingId = assertRepositoryBindingId(cached.repositoryBindingId);
+  const record = await readBindingRecord(repositoryBindingId);
+  if (!record) {
+    throw new ReconnectRequiredError(
+      `[memoraone-mcp] Cached binding missing for ${repositoryBindingId}. Run: memoraone-mcp connect <code>`
     );
   }
-  let content;
-  try {
-    content = await fs.readFile(m1Path, "utf8");
-  } catch (err) {
-    if (err?.code === "ENOENT") {
-      throw new Error(
-        `[memoraone-mcp] Cached binding file missing at ${m1Path}. Open a folder containing ${CANONICAL_M1_FILENAME}.`
-      );
-    }
-    throw err;
+  const workspaceRoot = path8.resolve(record.workspaceRoot);
+  const identity = await captureRootFilesystemIdentity(workspaceRoot);
+  if (!identitiesMatch(record.filesystemIdentity, identity)) {
+    throw new ReconnectRequiredError(
+      "[memoraone-mcp] Workspace filesystem identity changed. Run: memoraone-mcp connect <code>"
+    );
+  }
+  if (record.status === "reconnect_required" || !record.projectId) {
+    throw new ReconnectRequiredError(
+      "[memoraone-mcp] Installation requires reconnect. Run: memoraone-mcp connect <code>"
+    );
   }
-  const parsed = parseAndValidateM1(content, m1Path);
-  const resolved = resolveApiKeyWithSource(parsed.apiKey);
   const fresh = {
-    projectId: parsed.projectId,
-    workspaceRoot: path2.resolve(path2.dirname(m1Path)),
-    m1Path,
-    apiKey: resolved.apiKey,
-    ...parsed.environment !== void 0 ? { environment: parsed.environment } : {},
-    bindingSource: cached.bindingSource,
-    apiKeySource: resolved.apiKeySource
+    repositoryBindingId,
+    projectId: record.projectId,
+    workspaceRoot,
+    installationPublicId: record.installationPublicId,
+    environment: record.environment,
+    bindingSource: "local-binding",
+    status: record.status
   };
   if (bindingRelevantValuesMatch(cached, fresh)) {
     return { binding: fresh, cacheRefreshed: false };
@@ -318,59 +1200,68 @@ async function reconcileResolvedBindingWithDisk(cached) {
   return { binding: fresh, cacheRefreshed: true };
 }
 function encodeResolvedBinding(binding) {
-  return Buffer.from(JSON.stringify(binding), "utf8").toString("base64");
+  const payload = {
+    repositoryBindingId: binding.repositoryBindingId,
+    projectId: binding.projectId,
+    workspaceRoot: binding.workspaceRoot,
+    installationPublicId: binding.installationPublicId,
+    environment: binding.environment,
+    bindingSource: binding.bindingSource,
+    status: binding.status
+  };
+  return Buffer.from(JSON.stringify(payload), "utf8").toString("base64");
 }
 function decodeResolvedBinding(value) {
   if (!value) {
     return null;
   }
-  let parsed;
+  let parsed2;
   try {
-    parsed = JSON.parse(Buffer.from(value, "base64").toString("utf8"));
+    parsed2 = JSON.parse(Buffer.from(value, "base64").toString("utf8"));
   } catch {
     throw new Error("[memoraone-mcp] Invalid encoded binding payload");
   }
-  const projectId = parsed?.projectId;
-  const workspaceRoot = parsed?.workspaceRoot;
-  const m1Path = parsed?.m1Path;
-  const apiKey = parsed?.apiKey;
-  const environment = normalizeEnvironment(parsed?.environment);
-  const bindingSource = parsed?.bindingSource;
-  const apiKeySource = parsed?.apiKeySource;
+  if (parsed2?.apiKey || parsed2?.accessToken || parsed2?.refreshToken || parsed2?.m1Path) {
+    throw new Error(
+      "[memoraone-mcp] Rejected legacy daemon binding payload containing secrets or .m1 path"
+    );
+  }
+  const repositoryBindingId = parsed2?.repositoryBindingId;
+  const projectId = parsed2?.projectId;
+  const workspaceRoot = parsed2?.workspaceRoot;
+  const environment = normalizeEnvironment(parsed2?.environment);
+  const status = parsed2?.status;
+  if (!repositoryBindingId || !isRepositoryBindingId(String(repositoryBindingId))) {
+    throw new Error("[memoraone-mcp] Invalid binding repositoryBindingId");
+  }
   if (!projectId || typeof projectId !== "string" || !uuidRegex.test(projectId.trim())) {
     throw new Error("[memoraone-mcp] Invalid binding projectId");
   }
   if (!workspaceRoot || typeof workspaceRoot !== "string") {
     throw new Error("[memoraone-mcp] Invalid binding workspaceRoot");
   }
-  if (!m1Path || typeof m1Path !== "string") {
-    throw new Error("[memoraone-mcp] Invalid binding m1Path");
-  }
-  if (apiKey !== null && apiKey !== void 0 && typeof apiKey !== "string") {
-    throw new Error("[memoraone-mcp] Invalid binding apiKey");
+  if (status !== "connected" && status !== "reconnect_required" && status !== "pending") {
+    throw new Error("[memoraone-mcp] Invalid binding status");
   }
-  if (bindingSource !== "explicit-m1-path" && bindingSource !== "workspace-search") {
+  if (parsed2?.bindingSource !== "local-binding") {
     throw new Error("[memoraone-mcp] Invalid binding source");
   }
-  if (apiKeySource !== "env" && apiKeySource !== "memoraone.m1" && apiKeySource !== "none") {
-    throw new Error("[memoraone-mcp] Invalid binding apiKeySource");
-  }
   return {
+    repositoryBindingId: String(repositoryBindingId),
     projectId: projectId.trim(),
     workspaceRoot,
-    m1Path,
-    apiKey: typeof apiKey === "string" && apiKey.trim() !== "" ? apiKey.trim() : null,
+    installationPublicId: typeof parsed2?.installationPublicId === "string" ? parsed2.installationPublicId : void 0,
     ...environment !== void 0 ? { environment } : {},
-    bindingSource,
-    apiKeySource
+    bindingSource: "local-binding",
+    status
   };
 }
 
 // src/socketPaths.ts
-var os = __toESM(require("os"), 1);
-var path3 = __toESM(require("path"), 1);
-var fs2 = __toESM(require("fs"), 1);
-var BASE_DIR = process.env.MEMORAONE_MCP_LOCK_DIR || path3.join(os.homedir(), ".memoraone-mcp");
+var os3 = __toESM(require("os"), 1);
+var path9 = __toESM(require("path"), 1);
+var fs7 = __toESM(require("fs"), 1);
+var BASE_DIR = process.env.MEMORAONE_MCP_LOCK_DIR || path9.join(os3.homedir(), ".memoraone-mcp");
 var HASH_SOCKET_FILENAME_RE = new RegExp(
   `^mcp-[0-9a-f]{${BINDING_SOCKET_HASH_LENGTH}}\\.sock$`,
   "i"
@@ -388,48 +1279,48 @@ function parseIdeType(value) {
   }
   return value;
 }
-function resolveIdeTypeFromEnv(env = process.env) {
-  return parseIdeType(env.MEMORAONE_IDE_TYPE);
+function resolveIdeTypeFromEnv(env2 = process.env) {
+  return parseIdeType(env2.MEMORAONE_IDE_TYPE);
 }
 function parseIdeTypeFromCommandLine(commandLine) {
   const match = commandLine.match(/--ide\s+(cursor|copilot-vscode|jetbrains)(?:\s|$)/);
   return match ? match[1] : void 0;
 }
-function buildDaemonSpawnArgs(scriptPath, projectId, env = process.env) {
-  const args2 = [scriptPath, "--daemon", "--project-id", projectId];
-  const ideType = resolveIdeTypeFromEnv(env);
+function buildDaemonSpawnArgs(scriptPath, repositoryBindingId, env2 = process.env) {
+  const args2 = [scriptPath, "--daemon", "--binding-id", repositoryBindingId];
+  const ideType = resolveIdeTypeFromEnv(env2);
   if (ideType) {
     args2.push("--ide", ideType);
   }
   return args2;
 }
-function resolveBindingIdeType(env = process.env) {
-  return resolveIdeTypeFromEnv(env) ?? "";
+function resolveBindingIdeType(env2 = process.env) {
+  return resolveIdeTypeFromEnv(env2) ?? "";
 }
-function getBindingSocketFilename(binding, env = process.env) {
-  const ideType = resolveBindingIdeType(env);
-  const hash = hashBindingIdentity(binding.projectId, binding.workspaceRoot, ideType);
+function getBindingSocketFilename(binding, env2 = process.env) {
+  const ideType = resolveBindingIdeType(env2);
+  const hash = hashBindingIdentity(binding.repositoryBindingId, binding.workspaceRoot, ideType);
   return `mcp-${hash}.sock`;
 }
-function getBindingSocketPath(binding, env = process.env) {
-  return path3.join(BASE_DIR, getBindingSocketFilename(binding, env));
+function getBindingSocketPath(binding, env2 = process.env) {
+  return path9.join(BASE_DIR, getBindingSocketFilename(binding, env2));
 }
 function ensureBaseDir() {
-  fs2.mkdirSync(BASE_DIR, { recursive: true });
+  fs7.mkdirSync(BASE_DIR, { recursive: true });
   return BASE_DIR;
 }
 function isHashSocketFilename(filename) {
-  return HASH_SOCKET_FILENAME_RE.test(path3.basename(filename));
+  return HASH_SOCKET_FILENAME_RE.test(path9.basename(filename));
 }
 function isLegacySocketFilename(filename) {
-  return LEGACY_SOCKET_FILENAME_RE.test(path3.basename(filename));
+  return LEGACY_SOCKET_FILENAME_RE.test(path9.basename(filename));
 }
 function isMemoraoneSocketFilename(filename) {
-  const base = path3.basename(filename);
+  const base = path9.basename(filename);
   return HASH_SOCKET_FILENAME_RE.test(base) || LEGACY_SOCKET_PROJECT_ID_RE.test(base);
 }
 function extractProjectIdFromSocketFilename(filename) {
-  const match = path3.basename(filename).match(LEGACY_SOCKET_PROJECT_ID_RE);
+  const match = path9.basename(filename).match(LEGACY_SOCKET_PROJECT_ID_RE);
   return match ? match[1].toLowerCase() : null;
 }
 function isSocketFilenameForProject(filename, projectId) {
@@ -437,7 +1328,7 @@ function isSocketFilenameForProject(filename, projectId) {
   return extracted !== null && extracted === projectId.trim().toLowerCase();
 }
 function extractIdeTypeFromSocketFilename(filename) {
-  const match = path3.basename(filename).match(LEGACY_SOCKET_FILENAME_RE);
+  const match = path9.basename(filename).match(LEGACY_SOCKET_FILENAME_RE);
   if (!match) return null;
   const ide = match[3];
   if (ide === void 0) return "legacy";
@@ -464,18 +1355,22 @@ function bindingSidecarPath(socketPath) {
 }
 function parseSidecarRecord(raw) {
   try {
-    const parsed = JSON.parse(raw);
-    if (!parsed?.binding) {
+    const parsed2 = JSON.parse(raw);
+    if (!parsed2?.binding) {
       return null;
     }
-    const binding = decodeResolvedBinding(parsed.binding);
+    if (parsed2.m1Path) {
+      throw new Error("[memoraone-mcp] Rejected legacy sidecar with m1Path");
+    }
+    const binding = decodeResolvedBinding(parsed2.binding);
+    if (!binding) return null;
     return {
-      v: typeof parsed.v === "number" ? parsed.v : 1,
-      ...parsed.ideType ? { ideType: parsed.ideType } : {},
-      projectId: parsed.projectId ?? binding.projectId,
-      workspaceRoot: parsed.workspaceRoot ?? binding.workspaceRoot,
-      m1Path: parsed.m1Path ?? binding.m1Path,
-      binding: parsed.binding
+      v: typeof parsed2.v === "number" ? parsed2.v : 3,
+      ...parsed2.ideType ? { ideType: parsed2.ideType } : {},
+      repositoryBindingId: parsed2.repositoryBindingId ?? binding.repositoryBindingId,
+      projectId: parsed2.projectId ?? binding.projectId,
+      workspaceRoot: parsed2.workspaceRoot ?? binding.workspaceRoot,
+      binding: parsed2.binding
     };
   } catch {
     return null;
@@ -483,7 +1378,7 @@ function parseSidecarRecord(raw) {
 }
 function readBindingSidecarRecord(socketPath) {
   try {
-    const raw = fs3.readFileSync(bindingSidecarPath(socketPath), "utf8");
+    const raw = fs8.readFileSync(bindingSidecarPath(socketPath), "utf8");
     return parseSidecarRecord(raw);
   } catch {
     return null;
@@ -498,14 +1393,14 @@ function readBindingSidecar(socketPath) {
 }
 function removeBindingSidecar(socketPath) {
   try {
-    fs3.unlinkSync(bindingSidecarPath(socketPath));
+    fs8.unlinkSync(bindingSidecarPath(socketPath));
   } catch {
   }
 }
 function removeDaemonSocketArtifacts(socketPath) {
   removeBindingSidecar(socketPath);
   try {
-    fs3.unlinkSync(socketPath);
+    fs8.unlinkSync(socketPath);
   } catch {
   }
 }
@@ -514,26 +1409,29 @@ function isDaemonBindingMismatchError(err) {
 }
 function formatBindingMismatchError(socketPath, sidecar, expected, detail) {
   const lines = [
-    `[memoraone-mcp] Daemon socket binding mismatch at ${path4.basename(socketPath)}.`,
-    `  socket: project=${sidecar.projectId} workspace=${sidecar.workspaceRoot} m1=${sidecar.m1Path}`,
-    `  session: project=${expected.projectId} workspace=${expected.workspaceRoot} m1=${expected.m1Path}`
+    `[memoraone-mcp] Daemon socket binding mismatch at ${path10.basename(socketPath)}.`,
+    `  socket: binding=${sidecar.repositoryBindingId} project=${sidecar.projectId} workspace=${sidecar.workspaceRoot}`,
+    `  session: binding=${expected.repositoryBindingId} project=${expected.projectId} workspace=${expected.workspaceRoot}`
   ];
   if (detail) {
     lines.push(`  ${detail}`);
   }
-  lines.push("The bridge will replace this stale daemon automatically from the current memoraone.m1.");
+  lines.push("The bridge will replace this stale daemon automatically from local binding state.");
   return lines.join("\n");
 }
-function verifyDaemonSidecarBinding(socketPath, expected, env = process.env) {
+function verifyDaemonSidecarBinding(socketPath, expected, env2 = process.env) {
   const record = readBindingSidecarRecord(socketPath);
   if (!record) {
     return null;
   }
   const sidecar = decodeResolvedBinding(record.binding);
+  if (!sidecar) {
+    return null;
+  }
   if (!bindingsMatch(sidecar, expected)) {
     throw new Error(formatBindingMismatchError(socketPath, sidecar, expected));
   }
-  const expectedIdeType = resolveBindingIdeType(env);
+  const expectedIdeType = resolveBindingIdeType(env2);
   if (record.ideType !== void 0 && record.ideType !== expectedIdeType) {
     throw new Error(
       formatBindingMismatchError(
@@ -550,11 +1448,11 @@ function verifyDaemonSidecarBinding(socketPath, expected, env = process.env) {
 // src/bridgeClientRoots.ts
 var readline = __toESM(require("readline"), 1);
 var TRUTHY = /* @__PURE__ */ new Set(["1", "true", "yes", "on"]);
-function isInitializeDebugEnabled(env = process.env) {
-  return TRUTHY.has(String(env.MEMORAONE_DEBUG_INIT ?? "").trim().toLowerCase());
+function isInitializeDebugEnabled(env2 = process.env) {
+  return TRUTHY.has(String(env2.MEMORAONE_DEBUG_INIT ?? "").trim().toLowerCase());
 }
-function logInitializeDebug(log, env, msg) {
-  if (isInitializeDebugEnabled(env)) {
+function logInitializeDebug(log, env2, msg) {
+  if (isInitializeDebugEnabled(env2)) {
     log(`[init-debug] ${msg}`);
   }
 }
@@ -630,8 +1528,8 @@ var StdioLineReader = class {
     if (this.closed) {
       return null;
     }
-    return new Promise((resolve9) => {
-      this.waiters.push(resolve9);
+    return new Promise((resolve17) => {
+      this.waiters.push(resolve17);
     });
   }
   /** Re-queue lines read during an intermediate protocol step (e.g. roots/list) for the main bridge loop. */
@@ -649,7 +1547,7 @@ var StdioLineReader = class {
 };
 var nextBridgeRequestId = 1e5;
 async function requestClientRootsListUris(options) {
-  const env = options.env ?? process.env;
+  const env2 = options.env ?? process.env;
   const log = options.log ?? (() => {
   });
   const requestId = nextBridgeRequestId++;
@@ -662,7 +1560,7 @@ async function requestClientRootsListUris(options) {
   };
   logInitializeDebug(
     log,
-    env,
+    env2,
     `sending roots/list id=${requestId} clientDeclaresRoots=${clientDeclaresRootsCapability(options.initializeParams)}`
   );
   options.stdout.write(`${JSON.stringify(request)}
@@ -680,13 +1578,13 @@ async function requestClientRootsListUris(options) {
     try {
       message = JSON.parse(trimmed);
     } catch (err) {
-      logInitializeDebug(log, env, `ignored non-JSON line while waiting for roots/list: ${String(err)}`);
+      logInitializeDebug(log, env2, `ignored non-JSON line while waiting for roots/list: ${String(err)}`);
       continue;
     }
     if (message.id !== requestId) {
       logInitializeDebug(
         log,
-        env,
+        env2,
         `deferred JSON-RPC while waiting for roots/list id=${requestId}: ${trimmed.slice(0, 200)}`
       );
       deferredLines.push(trimmed);
@@ -698,32 +1596,32 @@ async function requestClientRootsListUris(options) {
       );
     }
     const uris = extractRootsUrisFromListResult(message.result);
-    logInitializeDebug(log, env, `roots/list id=${requestId} returned ${uris.length}: ${JSON.stringify(uris)}`);
+    logInitializeDebug(log, env2, `roots/list id=${requestId} returned ${uris.length}: ${JSON.stringify(uris)}`);
     return { uris, deferredLines };
   }
 }
 
 // src/cleanup.ts
-var fs5 = __toESM(require("fs/promises"), 1);
-var path7 = __toESM(require("path"), 1);
+var fs11 = __toESM(require("fs/promises"), 1);
+var path15 = __toESM(require("path"), 1);
 var readline2 = __toESM(require("readline/promises"), 1);
-var import_node_child_process2 = require("child_process");
-var import_node_util2 = require("util");
+var import_node_child_process3 = require("child_process");
+var import_node_util3 = require("util");
 var import_node_process = require("process");
 
 // src/cursorGlobalMcpConfig.ts
-var fs4 = __toESM(require("fs/promises"), 1);
-var os2 = __toESM(require("os"), 1);
-var path6 = __toESM(require("path"), 1);
-var import_node_child_process = require("child_process");
-var import_node_util = require("util");
+var fs10 = __toESM(require("fs/promises"), 1);
+var os4 = __toESM(require("os"), 1);
+var path14 = __toESM(require("path"), 1);
+var import_node_child_process2 = require("child_process");
+var import_node_util2 = require("util");
 
 // src/initializeBinding.ts
-var path5 = __toESM(require("path"), 1);
+var path11 = __toESM(require("path"), 1);
 var import_node_url = require("url");
 var MEMORAONE_WORKSPACE_ROOT_ENV = "MEMORAONE_WORKSPACE_ROOT";
-function getBridgeBindingResolveOptions(env = process.env) {
-  const ideType = resolveIdeTypeFromEnv(env);
+function getBridgeBindingResolveOptions(env2 = process.env) {
+  const ideType = resolveIdeTypeFromEnv(env2);
   if (ideType === "cursor") {
     return { respectExplicitM1Path: false, allowEnvWorkspaceFallback: false };
   }
@@ -739,8 +1637,8 @@ function getEnvWorkspaceRootCandidates() {
   const raw = process.env.WORKSPACE_FOLDER_PATHS;
   const parts = [];
   if (raw !== void 0 && raw.trim() !== "") {
-    for (const p of raw.split(path5.delimiter).map((s) => s.trim()).filter(Boolean)) {
-      parts.push(path5.resolve(p));
+    for (const p of raw.split(path11.delimiter).map((s) => s.trim()).filter(Boolean)) {
+      parts.push(path11.resolve(p));
     }
   }
   parts.push(process.cwd());
@@ -764,7 +1662,7 @@ function extractWorkspaceRootsFromInitialize(params) {
     if (uri === void 0 || uri.trim() === "") {
       return;
     }
-    const resolved = path5.resolve(uriToPath(uri));
+    const resolved = path11.resolve(uriToPath(uri));
     if (!seen.has(resolved)) {
       seen.add(resolved);
       roots.push(resolved);
@@ -781,16 +1679,16 @@ function extractWorkspaceRootsFromInitialize(params) {
   }
   return roots;
 }
-function getRepoScopedWorkspaceHint(env = process.env) {
-  const raw = env[MEMORAONE_WORKSPACE_ROOT_ENV];
+function getRepoScopedWorkspaceHint(env2 = process.env) {
+  const raw = env2[MEMORAONE_WORKSPACE_ROOT_ENV];
   if (raw === void 0 || raw.trim() === "") {
     return null;
   }
-  return path5.resolve(raw.trim());
+  return path11.resolve(raw.trim());
 }
 function formatWorkspaceAmbiguityError(bindings) {
   const lines = bindings.map(
-    (b) => `  - workspace=${b.workspaceRoot} project=${b.projectId} m1=${b.m1Path}`
+    (b) => `  - workspace=${b.workspaceRoot} binding=${b.repositoryBindingId} project=${b.projectId}`
   );
   return "[memoraone-mcp] Ambiguous workspace binding: multiple open roots map to different MemoraOne projects.\n" + lines.join("\n") + `
 Open one repo per Cursor window, or ensure this repo's managed .cursor/mcp.json includes ${MEMORAONE_WORKSPACE_ROOT_ENV} from setup-ide-files --cursor.`;
@@ -798,7 +1696,7 @@ Open one repo per Cursor window, or ensure this repo's managed .cursor/mcp.json
 function formatRepoHintInitializeMismatchError(repoHintRoot, initializeBinding) {
   return `[memoraone-mcp] Repo-scoped workspace hint conflicts with MCP initialize workspace.
   ${MEMORAONE_WORKSPACE_ROOT_ENV}: ${repoHintRoot}
-  initialize: project=${initializeBinding.projectId} workspace=${initializeBinding.workspaceRoot} m1=${initializeBinding.m1Path}
+  initialize: binding=${initializeBinding.repositoryBindingId} project=${initializeBinding.projectId} workspace=${initializeBinding.workspaceRoot}
 Reload MCP in the Cursor window for this repo, or re-run setup-ide-files --cursor here if the hint is stale.`;
 }
 function formatRepoHintNotInRootsListError(repoHintRoot, rootsListPaths) {
@@ -809,7 +1707,9 @@ Reload MCP in the Cursor window for this repo, or re-run setup-ide-files --curso
 }
 async function resolveBindingFromWorkspaceRoots(workspaceRoots, options = {}) {
   if (workspaceRoots.length === 0) {
-    throw new Error("Could not find memoraone.m1 in workspace.\nOpen a folder containing memoraone.m1.");
+    throw new Error(
+      "[memoraone-mcp] No local MemoraOne binding for this workspace.\nRun: memoraone-mcp connect <code>"
+    );
   }
   const bindings = [];
   for (const root of workspaceRoots) {
@@ -820,14 +1720,16 @@ async function resolveBindingFromWorkspaceRoots(workspaceRoots, options = {}) {
         })
       );
     } catch (err) {
-      if (err instanceof Error && err.message.includes("Could not find memoraone.m1")) {
+      if (err instanceof Error && (err.message.includes("No local MemoraOne binding") || err.message.includes("memoraone-mcp connect") || err.name === "ReconnectRequiredError")) {
         continue;
       }
       throw err;
     }
   }
   if (bindings.length === 0) {
-    throw new Error("Could not find memoraone.m1 in workspace.\nOpen a folder containing memoraone.m1.");
+    throw new Error(
+      "[memoraone-mcp] No local MemoraOne binding for this workspace.\nRun: memoraone-mcp connect <code>"
+    );
   }
   const distinctProjectIds = new Set(bindings.map((b) => b.projectId));
   if (distinctProjectIds.size > 1) {
@@ -836,12 +1738,12 @@ async function resolveBindingFromWorkspaceRoots(workspaceRoots, options = {}) {
   return bindings[0];
 }
 async function resolveBindingFromInitializeParams(params, options = {}) {
-  const env = options.env ?? process.env;
+  const env2 = options.env ?? process.env;
   const resolveOpts = {
     respectExplicitM1Path: options.respectExplicitM1Path,
     allowEnvWorkspaceFallback: options.allowEnvWorkspaceFallback
   };
-  const repoHint = getRepoScopedWorkspaceHint(env);
+  const repoHint = getRepoScopedWorkspaceHint(env2);
   const initializeRoots = extractWorkspaceRootsFromInitialize(params);
   if (initializeRoots.length > 0) {
     const binding = await resolveBindingFromWorkspaceRoots(initializeRoots, resolveOpts);
@@ -858,8 +1760,8 @@ async function resolveBindingFromInitializeParams(params, options = {}) {
   const rootsListUris = options.rootsListUris ?? [];
   const rootsListPaths = rootsListUris.map((uri) => uriToPath(uri)).filter(Boolean);
   if (rootsListPaths.length > 1 && repoHint !== null) {
-    const hintResolved = path5.resolve(repoHint);
-    const matchingRoot = rootsListPaths.find((root) => path5.resolve(root) === hintResolved);
+    const hintResolved = path11.resolve(repoHint);
+    const matchingRoot = rootsListPaths.find((root) => path11.resolve(root) === hintResolved);
     if (!matchingRoot) {
       throw new Error(formatRepoHintNotInRootsListError(repoHint, rootsListPaths));
     }
@@ -885,24 +1787,206 @@ async function resolveBindingFromInitializeParams(params, options = {}) {
   });
 }
 
+// src/packageExecutionMode.ts
+var path13 = __toESM(require("path"), 1);
+
+// src/resolveBuiltCliPath.ts
+var fs9 = __toESM(require("fs/promises"), 1);
+var path12 = __toESM(require("path"), 1);
+var MONOREPO_CLI_REL = path12.join("packages", "mcp", "dist", "cli.cjs");
+async function pathExists(filePath) {
+  try {
+    await fs9.access(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function findMonorepoCliFrom(startDir) {
+  let current = path12.resolve(startDir);
+  const root = path12.parse(current).root;
+  while (true) {
+    const candidate = path12.join(current, MONOREPO_CLI_REL);
+    if (await pathExists(candidate)) {
+      return path12.resolve(candidate);
+    }
+    if (current === root) break;
+    current = path12.dirname(current);
+  }
+  return null;
+}
+async function resolveFromRunningScript() {
+  if (!process.argv[1]) return null;
+  const script = path12.resolve(process.argv[1]);
+  const base = path12.basename(script);
+  if ((base === "cli.cjs" || base === "cli.ts" || base === "memoraone-mcp.cjs") && await pathExists(script)) {
+    return script;
+  }
+  const here = path12.dirname(script);
+  const candidates = [
+    path12.join(here, "cli.cjs"),
+    path12.join(here, "..", "dist", "cli.cjs"),
+    path12.join(here, "..", "..", "dist", "cli.cjs")
+  ];
+  for (const candidate of candidates) {
+    if (await pathExists(candidate)) {
+      return path12.resolve(candidate);
+    }
+  }
+  return null;
+}
+async function resolveBuiltCliPathAsync(options) {
+  const preferRunning = options?.preferRunningScript !== false;
+  if (preferRunning) {
+    const fromRunning = await resolveFromRunningScript();
+    if (fromRunning) return fromRunning;
+  }
+  const searchDirs = [];
+  if (options?.searchFrom !== void 0) {
+    const dirs = Array.isArray(options.searchFrom) ? options.searchFrom : [options.searchFrom];
+    searchDirs.push(...dirs);
+  }
+  searchDirs.push(process.cwd());
+  const seen = /* @__PURE__ */ new Set();
+  for (const dir of searchDirs) {
+    const key = path12.resolve(dir);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    const found = await findMonorepoCliFrom(key);
+    if (found) return found;
+  }
+  if (!preferRunning) {
+    return resolveFromRunningScript();
+  }
+  return null;
+}
+
+// src/packageExecutionMode.ts
+var PROD_API_URL = "https://api.memoraone.com";
+var STAGING_API_URL = "https://memora-api-staging-phbtrzocjq-uk.a.run.app";
+var STAGING_API_URL_PREFIX = "https://memora-api-staging-";
+function normalizeApiUrl(url) {
+  return url.trim().replace(/\/+$/, "");
+}
+function memoraoneNpmPackageSpec(channel) {
+  return channel === "staging" ? "@memoraone/mcp@staging" : "@memoraone/mcp@latest";
+}
+function isMemoraoneNpmPackageSpec(value) {
+  return value === "@memoraone/mcp@staging" || value === "@memoraone/mcp@latest";
+}
+function npmPackageChannelFromEnvironment(environment) {
+  return environment === "staging" ? "staging" : "latest";
+}
+function cursorEnvironmentFromPackageExecutionMode(mode) {
+  if (mode.kind === "local") return "local";
+  return mode.channel === "staging" ? "staging" : "production";
+}
+function npmPackageChannelFromApiUrl(apiUrl) {
+  if (!apiUrl) return "latest";
+  const normalized = normalizeApiUrl(apiUrl);
+  if (normalized === STAGING_API_URL || normalized.startsWith(STAGING_API_URL_PREFIX)) {
+    return "staging";
+  }
+  if (normalized === PROD_API_URL) return "latest";
+  return "latest";
+}
+function looksLikeLocalMonorepoCliPath(scriptPath) {
+  const normalized = scriptPath.replace(/\\/g, "/");
+  if (normalized.includes("/node_modules/@memoraone/mcp/")) return false;
+  if (normalized.includes("/.npm/_npx/")) return false;
+  if (normalized.includes("/_npx/")) return false;
+  const base = path13.basename(normalized);
+  if (base === "cli.ts" || base === "cli.cjs" || base === "memoraone-mcp.cjs") {
+    if (normalized.includes("/packages/mcp/dist/") || normalized.includes("/packages/mcp/dist-bin/") || normalized.includes("/packages/mcp/src/")) {
+      return true;
+    }
+  }
+  return false;
+}
+function looksLikePublishedPackagePath(scriptPath) {
+  const normalized = scriptPath.replace(/\\/g, "/");
+  return normalized.includes("/node_modules/@memoraone/mcp/") || normalized.includes("/.npm/_npx/") || /\/_npx\//.test(normalized);
+}
+function channelFromEnv(env2) {
+  const explicit = env2.MEMORAONE_NPM_CHANNEL?.trim().toLowerCase() || env2.npm_config_tag?.trim().toLowerCase();
+  if (explicit === "staging") return "staging";
+  if (explicit === "latest") return "latest";
+  return void 0;
+}
+async function resolvePackageExecutionMode(options = {}) {
+  if (options.executionMode) return options.executionMode;
+  const env2 = options.env ?? process.env;
+  const scriptPath = options.scriptPath !== void 0 ? options.scriptPath : process.argv[1] ? path13.resolve(process.argv[1]) : null;
+  if (scriptPath && looksLikePublishedPackagePath(scriptPath)) {
+    const channel2 = channelFromEnv(env2) ?? npmPackageChannelFromApiUrl(options.apiUrl);
+    return { kind: "published", channel: channel2 };
+  }
+  if (scriptPath && looksLikeLocalMonorepoCliPath(scriptPath)) {
+    return { kind: "local", cliPath: scriptPath };
+  }
+  if (options.cliPath) {
+    return { kind: "local", cliPath: path13.resolve(options.cliPath) };
+  }
+  const resolveCli = options.resolveBuiltCliPath ?? resolveBuiltCliPathAsync;
+  const builtCli = await resolveCli();
+  if (builtCli && looksLikeLocalMonorepoCliPath(builtCli) && !(scriptPath && looksLikePublishedPackagePath(scriptPath))) {
+    return { kind: "local", cliPath: builtCli };
+  }
+  const channel = channelFromEnv(env2) ?? npmPackageChannelFromApiUrl(options.apiUrl);
+  return { kind: "published", channel };
+}
+function setupOptionsFromPackageExecutionMode(mode) {
+  if (mode.kind === "local") {
+    return {
+      cursorEnvironment: "local",
+      devMode: true,
+      npmPackageChannel: "latest",
+      cursorLocalCliPathOverride: mode.cliPath,
+      cliPathOverride: mode.cliPath
+    };
+  }
+  return {
+    cursorEnvironment: cursorEnvironmentFromPackageExecutionMode(mode),
+    devMode: false,
+    npmPackageChannel: mode.channel,
+    cursorLocalCliPathOverride: null,
+    cliPathOverride: null
+  };
+}
+function formatIdeSetupRepairHint(workspaceRoot, mode) {
+  if (mode.kind === "local") {
+    return `Repair with (no new connect code): node ${mode.cliPath} setup-ide-files --all --local --dev --force --workspace-root ${workspaceRoot}`;
+  }
+  const spec = memoraoneNpmPackageSpec(mode.channel);
+  const stagingFlag = mode.channel === "staging" ? " --staging" : "";
+  return `Repair with (no new connect code): npx -y ${spec} setup-ide-files --all${stagingFlag} --force --workspace-root ${workspaceRoot}`;
+}
+
 // src/cursorGlobalMcpConfig.ts
-var execFileAsync = (0, import_node_util.promisify)(import_node_child_process.execFile);
+var execFileAsync2 = (0, import_node_util2.promisify)(import_node_child_process2.execFile);
 var MEMORAONE_PROD_API_URL = "https://api.memoraone.com";
 var MEMORAONE_LOCAL_API_URL = "http://localhost:3001";
 var MEMORAONE_STAGING_API_URL = "https://memora-api-staging-phbtrzocjq-uk.a.run.app";
 var MEMORAONE_STAGING_API_URL_PREFIX = "https://memora-api-staging-";
-function cursorMcpApiUrl(environment) {
-  if (environment === "local") return MEMORAONE_LOCAL_API_URL;
-  if (environment === "staging") return MEMORAONE_STAGING_API_URL;
-  return MEMORAONE_PROD_API_URL;
+function normalizeApiUrl2(url) {
+  return url.trim().replace(/\/+$/, "");
+}
+function resolveIdeApiUrl(options) {
+  if (options.apiUrl) return normalizeApiUrl2(options.apiUrl);
+  if (options.environment === "staging") return MEMORAONE_STAGING_API_URL;
+  if (options.environment === "production") return MEMORAONE_PROD_API_URL;
+  return MEMORAONE_LOCAL_API_URL;
 }
 function buildMemoraoneCursorMcpServer(options) {
-  const env = {
-    MEMORAONE_API_URL: cursorMcpApiUrl(options.environment),
+  const env2 = {
+    MEMORAONE_API_URL: resolveIdeApiUrl({
+      environment: options.environment,
+      apiUrl: options.apiUrl
+    }),
     MEMORAONE_IDE_TYPE: "cursor"
   };
   if (options.workspaceRoot !== void 0) {
-    env[MEMORAONE_WORKSPACE_ROOT_ENV] = path6.resolve(options.workspaceRoot);
+    env2[MEMORAONE_WORKSPACE_ROOT_ENV] = path14.resolve(options.workspaceRoot);
   }
   if (options.environment === "local") {
     if (!options.cliPath) {
@@ -911,21 +1995,22 @@ function buildMemoraoneCursorMcpServer(options) {
     return {
       command: "node",
       args: [options.cliPath],
-      env
+      env: env2
     };
   }
   if (!options.npxPath) {
     throw new Error("[setup-ide-files] Cursor MCP config requires a resolved npx path.");
   }
+  const channel = options.npmPackageChannel ?? npmPackageChannelFromEnvironment(options.environment);
   return {
     command: options.npxPath,
-    args: ["-y", "@memoraone/mcp@latest"],
-    env
+    args: ["-y", memoraoneNpmPackageSpec(channel)],
+    env: env2
   };
 }
-async function pathExists(filePath) {
+async function pathExists2(filePath) {
   try {
-    await fs4.access(filePath);
+    await fs10.access(filePath);
     return true;
   } catch {
     return false;
@@ -935,17 +2020,17 @@ function stripLeadingLineComments(text) {
   return text.split("\n").filter((line) => !/^\s*\/\//.test(line)).join("\n");
 }
 function getKnownCursorGlobalMcpConfigCandidates(homeDir) {
-  return [path6.join(homeDir, ".cursor", "mcp.json")];
+  return [path14.join(homeDir, ".cursor", "mcp.json")];
 }
 async function detectCursorGlobalMcpConfig(options) {
   if (options?.explicitPath) {
-    return { ok: true, path: options.explicitPath, detectedExisting: await pathExists(options.explicitPath) };
+    return { ok: true, path: options.explicitPath, detectedExisting: await pathExists2(options.explicitPath) };
   }
-  const homeDir = options?.homeDir ?? os2.homedir();
+  const homeDir = options?.homeDir ?? os4.homedir();
   const candidates = getKnownCursorGlobalMcpConfigCandidates(homeDir);
   const existing = [];
   for (const candidate of candidates) {
-    if (await pathExists(candidate)) existing.push(candidate);
+    if (await pathExists2(candidate)) existing.push(candidate);
   }
   if (existing.length > 1) {
     return {
@@ -973,15 +2058,15 @@ function formatBackupTimestamp(d = /* @__PURE__ */ new Date()) {
 }
 async function isWorkingNpx(npxPath) {
   try {
-    if (!await pathExists(npxPath)) return false;
+    if (!await pathExists2(npxPath)) return false;
     if (process.platform !== "win32") {
       try {
-        await fs4.access(npxPath, fs4.constants.X_OK);
+        await fs10.access(npxPath, fs10.constants.X_OK);
       } catch {
         return false;
       }
     }
-    await execFileAsync(npxPath, ["--version"], { timeout: 1e4 });
+    await execFileAsync2(npxPath, ["--version"], { timeout: 1e4 });
     return true;
   } catch {
     return false;
@@ -998,18 +2083,18 @@ async function resolveNpxPath() {
   const pathSep = process.platform === "win32" ? ";" : ":";
   for (const dir of (process.env.PATH ?? "").split(pathSep)) {
     if (!dir) continue;
-    candidates.push(path6.join(dir, npxName));
+    candidates.push(path14.join(dir, npxName));
   }
   try {
     const lookupCmd = process.platform === "win32" ? "where" : "which";
-    const { stdout } = await execFileAsync(lookupCmd, [npxName], { timeout: 5e3 });
+    const { stdout } = await execFileAsync2(lookupCmd, [npxName], { timeout: 5e3 });
     const first = stdout.trim().split(/\r?\n/).map((line) => line.trim()).find(Boolean);
     if (first) candidates.unshift(first);
   } catch {
   }
   const seen = /* @__PURE__ */ new Set();
   for (const candidate of candidates) {
-    const abs = path6.isAbsolute(candidate) ? candidate : path6.resolve(candidate);
+    const abs = path14.isAbsolute(candidate) ? candidate : path14.resolve(candidate);
     const key = process.platform === "win32" ? abs.toLowerCase() : abs;
     if (seen.has(key)) continue;
     seen.add(key);
@@ -1021,11 +2106,14 @@ function mergeCursorRepoMcpConfigObject(existing, writeOptions) {
   const environment = writeOptions.environment ?? "production";
   const base = existing && typeof existing === "object" ? { ...existing } : { mcpServers: {} };
   const mcpServers = typeof base.mcpServers === "object" && base.mcpServers !== null && !Array.isArray(base.mcpServers) ? { ...base.mcpServers } : {};
+  delete mcpServers.memoraone;
   mcpServers.memoraone = buildMemoraoneCursorMcpServer({
     environment,
     npxPath: writeOptions.npxPath,
     cliPath: writeOptions.cliPath,
-    workspaceRoot: writeOptions.repoRoot
+    workspaceRoot: writeOptions.repoRoot,
+    apiUrl: writeOptions.apiUrl,
+    npmPackageChannel: writeOptions.npmPackageChannel
   });
   return { ...base, mcpServers };
 }
@@ -1039,26 +2127,26 @@ function isManagedMemoraoneCursorServer(server) {
   if (!server || typeof server !== "object") return false;
   const s = server;
   if (!Array.isArray(s.args) || s.args.length !== 2) return false;
-  if (s.args[0] !== "-y" || s.args[1] !== "@memoraone/mcp@latest") return false;
-  const env = s.env;
-  if (!env || typeof env !== "object") return false;
-  return memoraoneEnvMatchesManagedCleanupShape(env);
-}
-function cursorConfigHasManagedMemoraone(parsed) {
-  if (!parsed || typeof parsed !== "object") return false;
-  const mcpServers = parsed.mcpServers;
+  if (s.args[0] !== "-y" || !isMemoraoneNpmPackageSpec(s.args[1])) return false;
+  const env2 = s.env;
+  if (!env2 || typeof env2 !== "object") return false;
+  return memoraoneEnvMatchesManagedCleanupShape(env2);
+}
+function cursorConfigHasManagedMemoraone(parsed2) {
+  if (!parsed2 || typeof parsed2 !== "object") return false;
+  const mcpServers = parsed2.mcpServers;
   if (!mcpServers || typeof mcpServers !== "object" || Array.isArray(mcpServers)) return false;
   return isManagedMemoraoneCursorServer(mcpServers.memoraone);
 }
-function memoraoneEnvMatchesManagedCleanupShape(env) {
-  return env.MEMORAONE_IDE_TYPE === "cursor" && isMemoraoneManagedApiUrl(env.MEMORAONE_API_URL);
+function memoraoneEnvMatchesManagedCleanupShape(env2) {
+  return env2.MEMORAONE_IDE_TYPE === "cursor" && isMemoraoneManagedApiUrl(env2.MEMORAONE_API_URL);
 }
 function getCursorRepoMcpConfigPath(repoRoot) {
-  return path6.join(repoRoot, ".cursor", "mcp.json");
+  return path14.join(repoRoot, ".cursor", "mcp.json");
 }
 async function readCursorMcpConfigObject(configPath) {
   try {
-    const raw = await fs4.readFile(configPath, "utf8");
+    const raw = await fs10.readFile(configPath, "utf8");
     return JSON.parse(stripLeadingLineComments(raw));
   } catch (err) {
     const code = err && typeof err === "object" && "code" in err ? err.code : void 0;
@@ -1068,36 +2156,36 @@ async function readCursorMcpConfigObject(configPath) {
 }
 async function removeMemoraoneFromCursorGlobalConfig(options) {
   const { configPath, dryRun } = options;
-  const parsed = await readCursorMcpConfigObject(configPath);
-  if (!parsed || !cursorConfigHasManagedMemoraone(parsed)) {
+  const parsed2 = await readCursorMcpConfigObject(configPath);
+  if (!parsed2 || !cursorConfigHasManagedMemoraone(parsed2)) {
     return { changed: false };
   }
   if (dryRun) {
     return { changed: true, backupPath: `${configPath}.backup-<timestamp>` };
   }
   const backupPath = `${configPath}.backup-${formatBackupTimestamp()}`;
-  await fs4.copyFile(configPath, backupPath);
-  const mcpServers = typeof parsed.mcpServers === "object" && parsed.mcpServers !== null && !Array.isArray(parsed.mcpServers) ? { ...parsed.mcpServers } : {};
+  await fs10.copyFile(configPath, backupPath);
+  const mcpServers = typeof parsed2.mcpServers === "object" && parsed2.mcpServers !== null && !Array.isArray(parsed2.mcpServers) ? { ...parsed2.mcpServers } : {};
   delete mcpServers.memoraone;
   const hasOtherServers = Object.keys(mcpServers).length > 0;
   if (!hasOtherServers) {
-    await fs4.unlink(configPath);
+    await fs10.unlink(configPath);
     return { changed: true, backupPath };
   }
-  const next = { ...parsed, mcpServers };
-  await fs4.mkdir(path6.dirname(configPath), { recursive: true });
-  await fs4.writeFile(configPath, JSON.stringify(next, null, 2) + "\n", "utf8");
+  const next = { ...parsed2, mcpServers };
+  await fs10.mkdir(path14.dirname(configPath), { recursive: true });
+  await fs10.writeFile(configPath, JSON.stringify(next, null, 2) + "\n", "utf8");
   return { changed: true, backupPath };
 }
 async function auditCursorMcpConfig(options) {
-  const repoRoot = path6.resolve(options?.repoRoot ?? process.cwd());
+  const repoRoot = path14.resolve(options?.repoRoot ?? process.cwd());
   const repoConfigPath = getCursorRepoMcpConfigPath(repoRoot);
   const globalDetection = await detectCursorGlobalMcpConfig({
     homeDir: options?.homeDir,
     explicitPath: options?.explicitGlobalPath
   });
   const globalConfigPath = globalDetection.ok ? globalDetection.path : getKnownCursorGlobalMcpConfigCandidates(
-    options?.homeDir ?? os2.homedir()
+    options?.homeDir ?? os4.homedir()
   )[0];
   let repoHasManagedMemoraone = false;
   try {
@@ -1193,11 +2281,11 @@ function logCursorMcpCliSummary(info, dryRun, opts) {
 }
 
 // src/cleanup.ts
-var execFileAsync2 = (0, import_node_util2.promisify)(import_node_child_process2.execFile);
+var execFileAsync3 = (0, import_node_util3.promisify)(import_node_child_process3.execFile);
 var DAEMON_PROJECT_ID_RE = /--project-id\s+([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})/i;
 var PROJECT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var MEMORAONE_MCP_COMMAND_RE = /memoraone-mcp|memoraOne-mcp|@memoraone\/mcp/;
-var CLEANUP_PROJECT_ID_REQUIRED_ERROR = "Provide --project-id <id> or run from a folder containing memoraone.m1.";
+var CLEANUP_PROJECT_ID_REQUIRED_ERROR = "Provide --project-id <id> or run from a connected workspace (memoraone-mcp connect).";
 function isMemoraoneMcpCommandLine(commandLine) {
   return MEMORAONE_MCP_COMMAND_RE.test(commandLine);
 }
@@ -1258,7 +2346,7 @@ function normalizeCleanupProjectId(projectId) {
   return trimmed.toLowerCase();
 }
 async function defaultListDaemonProcesses() {
-  const { stdout } = await execFileAsync2("ps", ["-eo", "pid=,args="], {
+  const { stdout } = await execFileAsync3("ps", ["-eo", "pid=,args="], {
     maxBuffer: 10 * 1024 * 1024
   });
   return parseDaemonProcessLines(stdout.split("\n"));
@@ -1267,7 +2355,7 @@ async function defaultListSocketPaths(projectId) {
   const baseDir = getMcpBaseDir();
   let entries;
   try {
-    entries = await fs5.readdir(baseDir);
+    entries = await fs11.readdir(baseDir);
   } catch (err) {
     const code = err && typeof err === "object" && "code" in err ? err.code : void 0;
     if (code === "ENOENT") {
@@ -1280,7 +2368,7 @@ async function defaultListSocketPaths(projectId) {
     if (!name.endsWith(".sock") || !isMemoraoneSocketFilename(name)) {
       continue;
     }
-    const socketPath = path7.join(baseDir, name);
+    const socketPath = path15.join(baseDir, name);
     if (projectId === null) {
       paths.push(socketPath);
       continue;
@@ -1299,12 +2387,12 @@ async function defaultListSocketPaths(projectId) {
   }
   return paths.sort();
 }
-async function defaultListSocketPathsForM1Path(m1Path) {
-  const resolvedM1 = path7.resolve(m1Path);
+async function defaultListSocketPathsForWorkspaceRoot(workspaceRoot) {
+  const resolvedRoot = path15.resolve(workspaceRoot);
   const baseDir = getMcpBaseDir();
   let entries;
   try {
-    entries = await fs5.readdir(baseDir);
+    entries = await fs11.readdir(baseDir);
   } catch (err) {
     const code = err && typeof err === "object" && "code" in err ? err.code : void 0;
     if (code === "ENOENT") {
@@ -1317,34 +2405,34 @@ async function defaultListSocketPathsForM1Path(m1Path) {
     if (!name.endsWith(".sock") || !isHashSocketFilename(name)) {
       continue;
     }
-    const socketPath = path7.join(baseDir, name);
+    const socketPath = path15.join(baseDir, name);
     const record = readBindingSidecarRecord(socketPath);
-    if (!record?.m1Path) continue;
-    if (path7.resolve(record.m1Path) === resolvedM1) {
+    if (!record?.workspaceRoot) continue;
+    if (path15.resolve(record.workspaceRoot) === resolvedRoot) {
       paths.push(socketPath);
     }
   }
   return paths.sort();
 }
-async function filterSocketPathsByIdeForCleanup(socketPaths, projectId, ide, m1Path) {
+async function filterSocketPathsByIdeForCleanup(socketPaths, projectId, ide, workspaceRoot) {
   if (ide === void 0) return socketPaths;
   const normalizedProjectId = projectId.trim().toLowerCase();
-  const resolvedM1 = m1Path ? path7.resolve(m1Path) : null;
+  const resolvedRoot = workspaceRoot ? path15.resolve(workspaceRoot) : null;
   const filtered = [];
   for (const socketPath of socketPaths) {
-    const basename5 = path7.basename(socketPath);
-    if (isLegacySocketFilename(basename5)) {
-      if (isSocketFilenameForProjectAndIde(basename5, normalizedProjectId, ide)) {
+    const basename11 = path15.basename(socketPath);
+    if (isLegacySocketFilename(basename11)) {
+      if (isSocketFilenameForProjectAndIde(basename11, normalizedProjectId, ide)) {
         filtered.push(socketPath);
       }
       continue;
     }
-    if (isHashSocketFilename(basename5)) {
+    if (isHashSocketFilename(basename11)) {
       const record = readBindingSidecarRecord(socketPath);
       if (!record || record.ideType !== ide) continue;
       const sameProject = record.projectId.trim().toLowerCase() === normalizedProjectId;
-      const sameM1 = resolvedM1 !== null && path7.resolve(record.m1Path) === resolvedM1;
-      if (sameProject || sameM1) {
+      const sameWorkspace = resolvedRoot !== null && path15.resolve(record.workspaceRoot) === resolvedRoot;
+      if (sameProject || sameWorkspace) {
         filtered.push(socketPath);
       }
     }
@@ -1355,9 +2443,9 @@ async function defaultKillProcess(pid) {
   process.kill(pid, "SIGTERM");
 }
 async function defaultRemoveSocket(socketPath) {
-  await fs5.unlink(socketPath);
+  await fs11.unlink(socketPath);
   try {
-    await fs5.unlink(bindingSidecarPath(socketPath));
+    await fs11.unlink(bindingSidecarPath(socketPath));
   } catch {
   }
 }
@@ -1373,12 +2461,12 @@ async function defaultConfirm(message) {
     rl.close();
   }
 }
-async function resolveCleanupTarget(cwd) {
+async function resolveCleanupTarget(cwd2) {
   try {
-    const binding = await resolveAuthoritativeBinding([path7.resolve(cwd)]);
+    const binding = await resolveAuthoritativeBinding([path15.resolve(cwd2)]);
     return {
       workspaceRoot: binding.workspaceRoot,
-      m1Path: binding.m1Path,
+      repositoryBindingId: binding.repositoryBindingId,
       projectId: binding.projectId
     };
   } catch {
@@ -1435,7 +2523,7 @@ async function runCleanup(opts) {
   const prefix = logPrefix(opts.dryRun);
   let targetProjectId = null;
   let workspaceRoot;
-  let m1Path;
+  let repositoryBindingId;
   if (opts.allProjects) {
     if (opts.projectId) {
       return {
@@ -1468,9 +2556,9 @@ async function runCleanup(opts) {
     }
     targetProjectId = target.projectId;
     workspaceRoot = target.workspaceRoot;
-    m1Path = target.m1Path;
+    repositoryBindingId = target.repositoryBindingId;
     cleanupLog(opts, `${prefix} Workspace root: ${workspaceRoot}`);
-    cleanupLog(opts, `${prefix} memoraone.m1: ${m1Path}`);
+    cleanupLog(opts, `${prefix} Repository binding: ${repositoryBindingId}`);
     cleanupLog(opts, `${prefix} Project id: ${targetProjectId}`);
     if (opts.ide) {
       cleanupLog(opts, `${prefix} IDE filter: ${opts.ide}`);
@@ -1515,10 +2603,10 @@ async function runCleanup(opts) {
     }
   }
   let allSocketPaths = await listSocketPaths(targetProjectId);
-  if (m1Path && !opts.allProjects) {
-    const m1Sockets = await defaultListSocketPathsForM1Path(m1Path);
+  if (workspaceRoot && !opts.allProjects) {
+    const workspaceSockets = await defaultListSocketPathsForWorkspaceRoot(workspaceRoot);
     const seen = new Set(allSocketPaths);
-    for (const socketPath of m1Sockets) {
+    for (const socketPath of workspaceSockets) {
       if (!seen.has(socketPath)) {
         seen.add(socketPath);
         allSocketPaths.push(socketPath);
@@ -1533,7 +2621,7 @@ async function runCleanup(opts) {
             processesToStop.push(proc);
             cleanupLog(
               opts,
-              `${prefix} Including stale daemon pid=${proc.pid} project=${staleProjectId} (sidecar m1=${m1Path})`
+              `${prefix} Including stale daemon pid=${proc.pid} project=${staleProjectId} (sidecar workspace=${workspaceRoot})`
             );
           }
         }
@@ -1541,14 +2629,19 @@ async function runCleanup(opts) {
     }
     allSocketPaths = [...seen].sort();
   }
-  const socketPaths = targetProjectId === null ? allSocketPaths : await filterSocketPathsByIdeForCleanup(allSocketPaths, targetProjectId, opts.ide, m1Path);
+  const socketPaths = targetProjectId === null ? allSocketPaths : await filterSocketPathsByIdeForCleanup(
+    allSocketPaths,
+    targetProjectId,
+    opts.ide,
+    workspaceRoot
+  );
   if (opts.allProjects) {
     const projectIds = /* @__PURE__ */ new Set();
     for (const proc of processesToStop) {
       projectIds.add(proc.projectId);
     }
     for (const socketPath of socketPaths) {
-      const id = extractProjectIdFromSocketFilename(path7.basename(socketPath));
+      const id = extractProjectIdFromSocketFilename(path15.basename(socketPath));
       if (id) {
         projectIds.add(id);
         continue;
@@ -1595,7 +2688,7 @@ async function runCleanup(opts) {
       return {
         exitCode: 1,
         workspaceRoot,
-        m1Path,
+        repositoryBindingId,
         projectId: targetProjectId ?? void 0,
         killedPids: [],
         removedSockets: [],
@@ -1611,7 +2704,7 @@ async function runCleanup(opts) {
     return {
       exitCode: 0,
       workspaceRoot,
-      m1Path,
+      repositoryBindingId,
       projectId: targetProjectId ?? void 0,
       killedPids: processesToStop.map((p) => p.pid),
       removedSockets: socketPaths,
@@ -1646,7 +2739,7 @@ async function runCleanup(opts) {
   return {
     exitCode: 0,
     workspaceRoot,
-    m1Path,
+    repositoryBindingId,
     projectId: targetProjectId ?? void 0,
     killedPids,
     removedSockets,
@@ -1734,9 +2827,9 @@ function summarizeJsonRpcMethod(line) {
   }
 }
 function connectWithRetry(socketPath, log, maxRetries, retryDelayMs, connect2) {
-  return new Promise((resolve9, reject) => {
+  return new Promise((resolve17, reject) => {
     const tryConnect = (attempt) => {
-      connect2(socketPath).then(resolve9).catch((err) => {
+      connect2(socketPath).then(resolve17).catch((err) => {
         if (attempt >= maxRetries) {
           reject(err);
           return;
@@ -1748,18 +2841,18 @@ function connectWithRetry(socketPath, log, maxRetries, retryDelayMs, connect2) {
     tryConnect(0);
   });
 }
-async function resolveBridgeSessionBinding(params, env = process.env, options = {}) {
-  const bridgeOptions = getBridgeBindingResolveOptions(env);
+async function resolveBridgeSessionBinding(params, env2 = process.env, options = {}) {
+  const bridgeOptions = getBridgeBindingResolveOptions(env2);
   return resolveBindingFromInitializeParams(params, {
-    env,
+    env: env2,
     fallbackWorkspaceRoots: getEnvWorkspaceRootCandidates(),
     rootsListUris: options.rootsListUris,
     rootsListAttempted: options.rootsListAttempted,
     ...bridgeOptions
   });
 }
-async function stopDaemonsForStaleBinding(stale, env, log) {
-  const ideType = resolveBindingIdeType(env);
+async function stopDaemonsForStaleBinding(stale, env2, log) {
+  const ideType = resolveBindingIdeType(env2);
   let processes;
   try {
     processes = await defaultListDaemonProcesses();
@@ -1783,7 +2876,7 @@ async function connectOrSpawnDaemonForBinding(binding, opts) {
   const sessionBinding = reconciled.binding;
   if (reconciled.cacheRefreshed) {
     opts.log(
-      `refreshed stale binding from ${sessionBinding.m1Path}: project=${sessionBinding.projectId}`
+      `refreshed stale binding ${sessionBinding.repositoryBindingId}: project=${sessionBinding.projectId}`
     );
   }
   const socketPath = getBindingSocketPath(sessionBinding, opts.env);
@@ -1811,7 +2904,7 @@ async function connectOrSpawnDaemonForBinding(binding, opts) {
       socket = void 0;
     }
     if (isDaemonBindingMismatchError(err)) {
-      opts.log("stale daemon binding detected; replacing daemon for current memoraone.m1");
+      opts.log("stale daemon binding detected; replacing daemon for current local binding");
       const staleSidecar = readBindingSidecar(socketPath);
       if (staleSidecar) {
         await stopDaemonsForStaleBinding(staleSidecar, opts.env, opts.log);
@@ -1852,19 +2945,20 @@ var BridgeDaemonRouter = class {
     this.maxRetries = options.maxRetries ?? 5;
     this.retryDelayMs = options.retryDelayMs ?? 200;
     this.lineReader = options.lineReader ?? null;
-    this.connectImpl = options.connect ?? ((socketPath) => new Promise((resolve9, reject) => {
-      const socket = net.connect(socketPath, () => resolve9(socket));
+    this.connectImpl = options.connect ?? ((socketPath) => new Promise((resolve17, reject) => {
+      const socket = net.connect(socketPath, () => resolve17(socket));
       socket.on("error", reject);
     }));
     this.spawnDaemonImpl = options.spawnDaemon ?? (async (binding) => {
-      const child = (0, import_node_child_process3.spawn)(
+      const child = (0, import_node_child_process4.spawn)(
         process.execPath,
-        buildDaemonSpawnArgs(this.cliPath, binding.projectId, this.env),
+        buildDaemonSpawnArgs(this.cliPath, binding.repositoryBindingId, this.env),
         {
           detached: true,
           stdio: "ignore",
           env: {
             ...this.env,
+            // Secret-free handoff only; tokens stay in the OS keyring.
             MEMORAONE_DAEMON_BINDING_B64: encodeResolvedBinding(binding)
           }
         }
@@ -1927,7 +3021,7 @@ var BridgeDaemonRouter = class {
     });
     const environmentLog = binding.environment !== void 0 ? ` environment=${binding.environment}` : "";
     this.log(
-      `session binding project=${binding.projectId} workspace=${binding.workspaceRoot} m1=${binding.m1Path} source=${binding.bindingSource} apiKeySource=${binding.apiKeySource}${environmentLog}`
+      `session binding binding=${binding.repositoryBindingId} project=${binding.projectId} workspace=${binding.workspaceRoot} source=${binding.bindingSource}${environmentLog}`
     );
     if (this.activeBinding && bindingsMatch(this.activeBinding, binding) && this.activeSocket) {
       return;
@@ -2062,6 +3156,17 @@ var BridgeDaemonRouter = class {
       this.socketLineReader = null;
     }
   }
+  /** Tear down the daemon socket when the IDE stdio transport ends. */
+  close() {
+    this.detachSocketReader();
+    if (this.activeSocket) {
+      try {
+        this.activeSocket.destroy();
+      } catch {
+      }
+      this.activeSocket = null;
+    }
+  }
 };
 async function runBridgeProxy(options) {
   ensureBaseDir();
@@ -2070,49 +3175,70 @@ async function runBridgeProxy(options) {
   const log = options.log ?? defaultLog;
   const lineReader = options.lineReader ?? new StdioLineReader(stdin);
   const router = new BridgeDaemonRouter({ ...options, stdout, lineReader });
-  while (true) {
-    const line = await lineReader.readLine();
-    if (line === null) {
-      break;
-    }
-    const trimmed = line.trim();
-    if (trimmed === "") {
-      continue;
-    }
-    let message;
-    try {
-      message = JSON.parse(trimmed);
-    } catch (err) {
-      throw new Error(`[memoraone-mcp] Invalid JSON-RPC on stdin: ${String(err)}`);
-    }
-    if (message.method === "initialize") {
-      log("resolve binding from initialize request before daemon connect");
-      const params = message.params ?? {};
-      await router.ensureDaemonForInitialize(params);
-      await router.forwardInitializeToDaemon(trimmed);
-      await router.replayDeferredClientMessages();
-      continue;
+  try {
+    while (true) {
+      const line = await lineReader.readLine();
+      if (line === null) {
+        log("stdin EOF; closing daemon socket");
+        break;
+      }
+      const trimmed = line.trim();
+      if (trimmed === "") {
+        continue;
+      }
+      let message;
+      try {
+        message = JSON.parse(trimmed);
+      } catch (err) {
+        throw new Error(`[memoraone-mcp] Invalid JSON-RPC on stdin: ${String(err)}`);
+      }
+      if (message.method === "initialize") {
+        log("resolve binding from initialize request before daemon connect");
+        const params = message.params ?? {};
+        await router.ensureDaemonForInitialize(params);
+        await router.forwardInitializeToDaemon(trimmed);
+        await router.replayDeferredClientMessages();
+        continue;
+      }
+      await router.writeToDaemon(trimmed);
     }
-    await router.writeToDaemon(trimmed);
+  } finally {
+    router.close();
   }
 }
 
 // src/setupIdeFiles.ts
-var fs8 = __toESM(require("fs/promises"), 1);
-var os4 = __toESM(require("os"), 1);
-var path10 = __toESM(require("path"), 1);
+var fs13 = __toESM(require("fs/promises"), 1);
+var os6 = __toESM(require("os"), 1);
+var path17 = __toESM(require("path"), 1);
+var import_node_crypto5 = require("crypto");
 
 // src/jetbrainsMcpConfig.ts
-var fs6 = __toESM(require("fs/promises"), 1);
-var os3 = __toESM(require("os"), 1);
-var path8 = __toESM(require("path"), 1);
-var import_node_child_process4 = require("child_process");
+var fs12 = __toESM(require("fs/promises"), 1);
+var os5 = __toESM(require("os"), 1);
+var path16 = __toESM(require("path"), 1);
+var import_node_crypto4 = require("crypto");
+var import_node_child_process5 = require("child_process");
 
 // src/configUtils.ts
+var DEFAULT_API_URL = "http://localhost:3001";
 var DEV_API_URL = "http://localhost:3001";
+function resolveApiUrl(env2) {
+  const explicitUrl = env2.MEMORAONE_API_URL?.trim();
+  if (explicitUrl) {
+    return explicitUrl;
+  }
+  const aliasUrl = env2.MEMORA_API_URL?.trim();
+  if (aliasUrl) {
+    return aliasUrl;
+  }
+  if (env2.MEMORAONE_DEV_MODE === "1") {
+    return DEV_API_URL;
+  }
+  return DEFAULT_API_URL;
+}
 
 // src/jetbrainsMcpConfig.ts
-var PROD_API_URL = "https://api.memoraone.com";
 var JETBRAINS_DEBUG_ENV_VARS = [
   "MEMORAONE_DEBUG_INIT",
   "MEMORAONE_DEBUG_MINIMAL_TOOLS",
@@ -2122,9 +3248,9 @@ var JETBRAINS_DEBUG_ENV_VARS = [
 function stripLeadingLineComments2(text) {
   return text.split("\n").filter((line) => !/^\s*\/\//.test(line)).join("\n");
 }
-async function pathExists2(filePath) {
+async function pathExists3(filePath) {
   try {
-    await fs6.access(filePath);
+    await fs12.access(filePath);
     return true;
   } catch {
     return false;
@@ -2135,12 +3261,12 @@ function formatJetBrainsBackupTimestamp(d = /* @__PURE__ */ new Date()) {
   return `${d.getFullYear()}${pad(d.getMonth() + 1)}${pad(d.getDate())}-${pad(d.getHours())}${pad(d.getMinutes())}${pad(d.getSeconds())}`;
 }
 function getJetBrainsGlobalMcpConfigPath(homeDir) {
-  return path8.join(homeDir, ".ai", "mcp", "mcp.json");
+  return path16.join(homeDir, ".ai", "mcp", "mcp.json");
 }
 function getJetBrainsProjectMcpConfigPaths(repoRoot) {
   return [
-    { kind: "project-ai", path: path8.join(repoRoot, ".ai", "mcp", "mcp.json") },
-    { kind: "project-ij", path: path8.join(repoRoot, ".ij", "mcp", "mcp.json") }
+    { kind: "project-ai", path: path16.join(repoRoot, ".ai", "mcp", "mcp.json") },
+    { kind: "project-ij", path: path16.join(repoRoot, ".ij", "mcp", "mcp.json") }
   ];
 }
 function getKnownJetBrainsMcpConfigLocations(homeDir, repoRoot) {
@@ -2150,31 +3276,57 @@ function getKnownJetBrainsMcpConfigLocations(homeDir, repoRoot) {
   ];
 }
 async function isZeroByteConfigFile(filePath) {
-  if (!await pathExists2(filePath)) return false;
-  const stat2 = await fs6.stat(filePath);
-  return stat2.size === 0;
+  if (!await pathExists3(filePath)) return false;
+  const stat4 = await fs12.stat(filePath);
+  return stat4.size === 0;
 }
 function buildMemoraoneJetBrainsMcpServer(options) {
-  const env = {
-    MEMORAONE_API_URL: options.devMode ? DEV_API_URL : PROD_API_URL,
+  const environment = options.environment ?? (options.devMode ? "local" : "production");
+  const env2 = {
+    MEMORAONE_API_URL: resolveIdeApiUrl({
+      environment,
+      apiUrl: options.apiUrl ?? (environment === "local" ? DEV_API_URL : void 0)
+    }),
     MEMORAONE_IDE_TYPE: "jetbrains",
-    MEMORAONE_M1_PATH: options.m1Path
+    [MEMORAONE_WORKSPACE_ROOT_ENV]: path16.resolve(options.workspaceRoot)
   };
-  if (options.devMode) {
-    env.MEMORAONE_DEV_MODE = "1";
+  if (environment === "local" || options.devMode) {
+    env2.MEMORAONE_DEV_MODE = "1";
+  }
+  if ("MEMORAONE_M1_PATH" in env2 || "MEMORAONE_API_KEY" in env2) {
+    throw new Error("[setup-ide-files] JetBrains MCP config must not include credentials or .m1 paths");
   }
   return {
     command: options.command,
     args: options.args,
-    env
+    env: env2
   };
 }
 function mergeJetBrainsMcpConfigObject(existing, memoraone) {
   const base = existing && typeof existing === "object" ? { ...existing } : { mcpServers: {} };
   const mcpServers = typeof base.mcpServers === "object" && base.mcpServers !== null && !Array.isArray(base.mcpServers) ? { ...base.mcpServers } : {};
+  delete mcpServers.memoraone;
   mcpServers.memoraone = memoraone;
   return { ...base, mcpServers };
 }
+async function writeJetBrainsMcpJsonAtomic(filePath, content) {
+  const dir = path16.dirname(filePath);
+  await fs12.mkdir(dir, { recursive: true });
+  const tmpPath = path16.join(
+    dir,
+    `.${path16.basename(filePath)}.${process.pid}.${(0, import_node_crypto4.randomBytes)(8).toString("hex")}.tmp`
+  );
+  try {
+    await fs12.writeFile(tmpPath, content, "utf8");
+    await fs12.rename(tmpPath, filePath);
+  } catch (err) {
+    try {
+      await fs12.unlink(tmpPath);
+    } catch {
+    }
+    throw err;
+  }
+}
 function memoraoneServerMatches(server, expected) {
   if (!server || typeof server !== "object") return false;
   const s = server;
@@ -2183,9 +3335,9 @@ function memoraoneServerMatches(server, expected) {
   for (let i = 0; i < expected.args.length; i += 1) {
     if (s.args[i] !== expected.args[i]) return false;
   }
-  const env = s.env;
-  if (!env || typeof env !== "object") return false;
-  const e = env;
+  const env2 = s.env;
+  if (!env2 || typeof env2 !== "object") return false;
+  const e = env2;
   for (const [key, value] of Object.entries(expected.env)) {
     if (e[key] !== value) return false;
   }
@@ -2194,11 +3346,11 @@ function memoraoneServerMatches(server, expected) {
   }
   return true;
 }
-function validateJetBrainsMcpConfig(parsed, expected) {
-  if (!parsed || typeof parsed !== "object") {
+function validateJetBrainsMcpConfig(parsed2, expected) {
+  if (!parsed2 || typeof parsed2 !== "object") {
     throw new Error("[setup-ide-files] JetBrains MCP config must be a JSON object.");
   }
-  const mcpServers = parsed.mcpServers;
+  const mcpServers = parsed2.mcpServers;
   if (!mcpServers || typeof mcpServers !== "object" || Array.isArray(mcpServers)) {
     throw new Error("[setup-ide-files] JetBrains MCP config missing mcpServers object.");
   }
@@ -2210,13 +3362,13 @@ function validateJetBrainsMcpConfig(parsed, expected) {
   }
 }
 async function readJsonConfig(filePath) {
-  const raw = await fs6.readFile(filePath, "utf8");
+  const raw = await fs12.readFile(filePath, "utf8");
   if (raw.trim() === "") return null;
   return JSON.parse(stripLeadingLineComments2(raw));
 }
 async function backupConfigFile(filePath) {
   const backupPath = `${filePath}.bak-${formatJetBrainsBackupTimestamp()}`;
-  await fs6.copyFile(filePath, backupPath);
+  await fs12.copyFile(filePath, backupPath);
   return backupPath;
 }
 async function repairZeroByteConfigFile(filePath, dryRun) {
@@ -2227,61 +3379,62 @@ async function repairZeroByteConfigFile(filePath, dryRun) {
     return { repaired: true, backupPath: `${filePath}.bak-<timestamp>` };
   }
   const backupPath = await backupConfigFile(filePath);
-  await fs6.unlink(filePath);
+  await fs12.unlink(filePath);
   return { repaired: true, backupPath };
 }
-function configHasMemoraone(parsed) {
-  if (!parsed) return false;
-  const mcpServers = parsed.mcpServers;
+function configHasMemoraone(parsed2) {
+  if (!parsed2) return false;
+  const mcpServers = parsed2.mcpServers;
   if (!mcpServers || typeof mcpServers !== "object" || Array.isArray(mcpServers)) return false;
   return Boolean(mcpServers.memoraone);
 }
 async function removeMemoraoneFromProjectConfig(options) {
   const { configPath, dryRun } = options;
-  if (!await pathExists2(configPath)) {
+  if (!await pathExists3(configPath)) {
     return { changed: false };
   }
-  let parsed = null;
+  let parsed2 = null;
   try {
-    parsed = await readJsonConfig(configPath);
+    parsed2 = await readJsonConfig(configPath);
   } catch {
     return { changed: false };
   }
-  if (!configHasMemoraone(parsed)) {
+  if (!configHasMemoraone(parsed2)) {
     return { changed: false };
   }
   if (dryRun) {
     return { changed: true, backupPath: `${configPath}.bak-<timestamp>` };
   }
   const backupPath = await backupConfigFile(configPath);
-  const mcpServers = parsed && typeof parsed.mcpServers === "object" && parsed.mcpServers !== null && !Array.isArray(parsed.mcpServers) ? { ...parsed.mcpServers } : {};
+  const mcpServers = parsed2 && typeof parsed2.mcpServers === "object" && parsed2.mcpServers !== null && !Array.isArray(parsed2.mcpServers) ? { ...parsed2.mcpServers } : {};
   delete mcpServers.memoraone;
   const hasOtherServers = Object.keys(mcpServers).length > 0;
   if (!hasOtherServers) {
-    await fs6.unlink(configPath);
+    await fs12.unlink(configPath);
     return { changed: true, backupPath };
   }
-  const next = { ...parsed, mcpServers };
-  await fs6.mkdir(path8.dirname(configPath), { recursive: true });
-  await fs6.writeFile(configPath, JSON.stringify(next, null, 2) + "\n", "utf8");
+  const next = { ...parsed2, mcpServers };
+  await fs12.mkdir(path16.dirname(configPath), { recursive: true });
+  await fs12.writeFile(configPath, JSON.stringify(next, null, 2) + "\n", "utf8");
   return { changed: true, backupPath };
 }
 async function resolveLocalCliPathAsync() {
-  const here = process.argv[1] ? path8.dirname(path8.resolve(process.argv[1])) : process.cwd();
+  const here = process.argv[1] ? path16.dirname(path16.resolve(process.argv[1])) : process.cwd();
   const candidates = [
-    path8.join(here, "cli.cjs"),
-    path8.join(here, "..", "dist", "cli.cjs"),
-    path8.join(here, "..", "..", "dist", "cli.cjs")
+    path16.join(here, "cli.cjs"),
+    path16.join(here, "..", "dist", "cli.cjs"),
+    path16.join(here, "..", "..", "dist", "cli.cjs")
   ];
   for (const candidate of candidates) {
-    if (await pathExists2(candidate)) {
-      return path8.resolve(candidate);
+    if (await pathExists3(candidate)) {
+      return path16.resolve(candidate);
     }
   }
   return null;
 }
 async function buildJetBrainsMemoraoneServer(options) {
-  if (options.devMode) {
+  const environment = options.environment ?? (options.devMode ? "local" : "production");
+  if (environment === "local" || options.devMode) {
     let cliPath = options.cliPathOverride;
     if (cliPath === void 0) {
       cliPath = await resolveLocalCliPathAsync();
@@ -2294,8 +3447,10 @@ async function buildJetBrainsMemoraoneServer(options) {
     return buildMemoraoneJetBrainsMcpServer({
       command: process.execPath,
       args: [cliPath],
-      m1Path: options.m1Path,
-      devMode: true
+      workspaceRoot: options.workspaceRoot,
+      environment: "local",
+      devMode: true,
+      apiUrl: options.apiUrl
     });
   }
   let npxPath = options.npxPathOverride;
@@ -2307,17 +3462,20 @@ async function buildJetBrainsMemoraoneServer(options) {
       "[setup-ide-files] Could not resolve a working npx executable. Install Node.js/npm or ensure npx is on PATH before configuring JetBrains MCP."
     );
   }
+  const channel = options.npmPackageChannel ?? npmPackageChannelFromEnvironment(environment);
   return buildMemoraoneJetBrainsMcpServer({
     command: npxPath,
-    args: ["-y", "@memoraone/mcp@latest"],
-    m1Path: options.m1Path,
-    devMode: false
+    args: ["-y", memoraoneNpmPackageSpec(channel)],
+    workspaceRoot: options.workspaceRoot,
+    environment,
+    devMode: false,
+    apiUrl: options.apiUrl
   });
 }
 async function verifyJetBrainsMcpHandshake(options) {
   const timeoutMs = options.timeoutMs ?? 15e3;
   const { server } = options;
-  return new Promise((resolve9) => {
+  return new Promise((resolve17) => {
     let settled = false;
     const finish = (ok, detail) => {
       if (settled) return;
@@ -2327,9 +3485,9 @@ async function verifyJetBrainsMcpHandshake(options) {
         child.kill();
       } catch {
       }
-      resolve9({ ok, detail });
+      resolve17({ ok, detail });
     };
-    const child = (0, import_node_child_process4.spawn)(server.command, [...server.args], {
+    const child = (0, import_node_child_process5.spawn)(server.command, [...server.args], {
       env: { ...process.env, ...server.env },
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -2394,13 +3552,13 @@ async function verifyJetBrainsMcpHandshake(options) {
   });
 }
 async function setupJetBrainsMcpConfig(options) {
-  const homeDir = options.homeDir ?? os3.homedir();
+  const homeDir = options.homeDir ?? os5.homedir();
   const globalPath = options.globalConfigPath ?? getJetBrainsGlobalMcpConfigPath(homeDir);
-  const m1Path = path8.join(path8.resolve(options.repoRoot), "memoraone.m1");
+  const workspaceRoot = path16.resolve(options.repoRoot);
   const repairActions = [];
   const allLocations = getKnownJetBrainsMcpConfigLocations(homeDir, options.repoRoot);
   for (const location of allLocations) {
-    if (await pathExists2(location.path)) {
+    if (await pathExists3(location.path)) {
       repairActions.push({ type: "found-config", location });
     }
   }
@@ -2415,8 +3573,11 @@ async function setupJetBrainsMcpConfig(options) {
     }
   }
   const memoraone = await buildJetBrainsMemoraoneServer({
-    m1Path,
+    workspaceRoot,
     devMode: options.devMode,
+    environment: options.environment,
+    npmPackageChannel: options.npmPackageChannel,
+    apiUrl: options.apiUrl,
     npxPathOverride: options.npxPathOverride,
     cliPathOverride: options.cliPathOverride
   });
@@ -2436,24 +3597,15 @@ async function setupJetBrainsMcpConfig(options) {
       repairActions.push({ type: "removed-project-memoraone", path: location.path });
     }
   }
-  const existed = await pathExists2(globalPath);
+  const existed = await pathExists3(globalPath);
   let existing = null;
   if (existed) {
     try {
       existing = await readJsonConfig(globalPath);
     } catch {
-      if (options.dryRun) {
-        existing = null;
-      } else {
-        const backupPath2 = await backupConfigFile(globalPath);
-        repairActions.push({
-          type: "repaired-zero-byte",
-          path: globalPath,
-          backupPath: backupPath2
-        });
-        await fs6.unlink(globalPath);
-        existing = null;
-      }
+      throw new Error(
+        `[setup-ide-files] Invalid JSON in shared JetBrains MCP config (file preserved, not modified): ${globalPath}. Fix or remove the file, then re-run setup-ide-files.`
+      );
     }
   }
   const merged = mergeJetBrainsMcpConfigObject(existing, memoraone);
@@ -2474,9 +3626,8 @@ async function setupJetBrainsMcpConfig(options) {
   if (existed) {
     backupPath = await backupConfigFile(globalPath);
   }
-  await fs6.mkdir(path8.dirname(globalPath), { recursive: true });
-  await fs6.writeFile(globalPath, body, "utf8");
-  const verifyRaw = await fs6.readFile(globalPath, "utf8");
+  await writeJetBrainsMcpJsonAtomic(globalPath, body);
+  const verifyRaw = await fs12.readFile(globalPath, "utf8");
   const verifyParsed = JSON.parse(stripLeadingLineComments2(verifyRaw));
   validateJetBrainsMcpConfig(verifyParsed, memoraone);
   const outcome = existed ? "updated" : "created";
@@ -2519,76 +3670,22 @@ function logJetBrainsMcpCliSummary(info, dryRun) {
   } else {
     console.log(`[setup-ide-files] JetBrains global MCP config unchanged: ${info.activeConfigPath}`);
   }
-  if (info.backupPath) {
-    console.log(`[setup-ide-files] JetBrains global MCP config backup: ${info.backupPath}`);
-  }
-  if (info.npxPath) {
-    console.log(`[setup-ide-files] Resolved npx: ${info.npxPath}`);
-  }
-  console.log(`[setup-ide-files] Final active JetBrains MCP config: ${info.activeConfigPath}`);
-  console.log(
-    "[setup-ide-files] Fully quit JetBrains IDE and reopen this repo for MCP changes to take effect."
-  );
-}
-
-// src/resolveBuiltCliPath.ts
-var fs7 = __toESM(require("fs/promises"), 1);
-var path9 = __toESM(require("path"), 1);
-var MONOREPO_CLI_REL = path9.join("packages", "mcp", "dist", "cli.cjs");
-async function pathExists3(filePath) {
-  try {
-    await fs7.access(filePath);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function findMonorepoCliFrom(startDir) {
-  let current = path9.resolve(startDir);
-  const root = path9.parse(current).root;
-  while (true) {
-    const candidate = path9.join(current, MONOREPO_CLI_REL);
-    if (await pathExists3(candidate)) {
-      return path9.resolve(candidate);
-    }
-    if (current === root) break;
-    current = path9.dirname(current);
-  }
-  return null;
-}
-async function resolveBuiltCliPathAsync(options) {
-  const searchDirs = [];
-  if (options?.searchFrom !== void 0) {
-    const dirs = Array.isArray(options.searchFrom) ? options.searchFrom : [options.searchFrom];
-    searchDirs.push(...dirs);
-  }
-  searchDirs.push(process.cwd());
-  const seen = /* @__PURE__ */ new Set();
-  for (const dir of searchDirs) {
-    const key = path9.resolve(dir);
-    if (seen.has(key)) continue;
-    seen.add(key);
-    const found = await findMonorepoCliFrom(key);
-    if (found) return found;
+  if (info.backupPath) {
+    console.log(`[setup-ide-files] JetBrains global MCP config backup: ${info.backupPath}`);
   }
-  const here = process.argv[1] ? path9.dirname(path9.resolve(process.argv[1])) : process.cwd();
-  const candidates = [
-    path9.join(here, "cli.cjs"),
-    path9.join(here, "..", "dist", "cli.cjs"),
-    path9.join(here, "..", "..", "dist", "cli.cjs")
-  ];
-  for (const candidate of candidates) {
-    if (await pathExists3(candidate)) {
-      return path9.resolve(candidate);
-    }
+  if (info.npxPath) {
+    console.log(`[setup-ide-files] Resolved npx: ${info.npxPath}`);
   }
-  return null;
+  console.log(`[setup-ide-files] Final active JetBrains MCP config: ${info.activeConfigPath}`);
+  console.log(
+    "[setup-ide-files] Fully quit JetBrains IDE and reopen this repo for MCP changes to take effect."
+  );
 }
 
 // src/openCursorMcpSettings.ts
-var import_node_child_process5 = require("child_process");
+var import_node_child_process6 = require("child_process");
 var readline4 = __toESM(require("readline/promises"), 1);
-var import_node_util3 = require("util");
+var import_node_util4 = require("util");
 
 // src/terminalPresentation.ts
 var ANSI = {
@@ -2599,34 +3696,34 @@ var ANSI = {
   yellow: "\x1B[33m",
   cyan: "\x1B[36m"
 };
-function isCiLikeEnv(env = process.env) {
-  if (env.CI === "true" || env.CI === "1") return true;
-  if (env.GITHUB_ACTIONS === "true" || env.GITHUB_ACTIONS === "1") return true;
-  if (env.GITLAB_CI === "true" || env.GITLAB_CI === "1") return true;
-  if (env.CIRCLECI === "true" || env.CIRCLECI === "1") return true;
-  if (env.BUILDKITE === "true" || env.BUILDKITE === "1") return true;
-  if (typeof env.CI === "string" && env.CI.trim() !== "" && env.CI !== "0" && env.CI !== "false") {
+function isCiLikeEnv(env2 = process.env) {
+  if (env2.CI === "true" || env2.CI === "1") return true;
+  if (env2.GITHUB_ACTIONS === "true" || env2.GITHUB_ACTIONS === "1") return true;
+  if (env2.GITLAB_CI === "true" || env2.GITLAB_CI === "1") return true;
+  if (env2.CIRCLECI === "true" || env2.CIRCLECI === "1") return true;
+  if (env2.BUILDKITE === "true" || env2.BUILDKITE === "1") return true;
+  if (typeof env2.CI === "string" && env2.CI.trim() !== "" && env2.CI !== "0" && env2.CI !== "false") {
     return true;
   }
   return false;
 }
 function shouldEnableAnsiColor(opts = {}) {
   if (typeof opts.color === "boolean") return opts.color;
-  const env = opts.env ?? process.env;
-  if (env.NO_COLOR !== void 0) return false;
-  if (isCiLikeEnv(env)) return false;
+  const env2 = opts.env ?? process.env;
+  if (env2.NO_COLOR !== void 0) return false;
+  if (isCiLikeEnv(env2)) return false;
   const tty = opts.stdoutIsTty ?? process.stdout.isTTY === true;
   return tty;
 }
 function shouldUseUnicodeSymbols(opts = {}) {
   if (typeof opts.unicode === "boolean") return opts.unicode;
-  const env = opts.env ?? process.env;
+  const env2 = opts.env ?? process.env;
   const tty = opts.stdoutIsTty ?? process.stdout.isTTY === true;
   if (!tty) return false;
-  if (env.TERM === "dumb") return false;
+  if (env2.TERM === "dumb") return false;
   if (process.platform === "win32") {
     return Boolean(
-      env.WT_SESSION || env.WT_PROFILE_ID || env.ConEmuANSI === "ON" || env.TERM_PROGRAM === "vscode" || env.TERM_PROGRAM === "cursor" || typeof env.TERM === "string" && env.TERM !== "" && env.TERM !== "dumb"
+      env2.WT_SESSION || env2.WT_PROFILE_ID || env2.ConEmuANSI === "ON" || env2.TERM_PROGRAM === "vscode" || env2.TERM_PROGRAM === "cursor" || typeof env2.TERM === "string" && env2.TERM !== "" && env2.TERM !== "dumb"
     );
   }
   return true;
@@ -2661,7 +3758,7 @@ function createTerminalPresentation(opts = {}) {
 }
 
 // src/openCursorMcpSettings.ts
-var execFileAsync3 = (0, import_node_util3.promisify)(import_node_child_process5.execFile);
+var execFileAsync4 = (0, import_node_util4.promisify)(import_node_child_process6.execFile);
 var OPEN_CURSOR_MCP_SETTINGS_PROMPT = "Open Cursor MCP settings now? [Y/n] ";
 function resolvePresentation(deps) {
   if (deps.presentation) return deps.presentation;
@@ -2756,13 +3853,13 @@ function macosOpenCursorMcpSettingsAppleScript() {
     "end tell"
   ].join("\n");
 }
-async function openCursorMcpSettingsViaOsascript(execFileImpl = execFileAsync3) {
+async function openCursorMcpSettingsViaOsascript(execFileImpl = execFileAsync4) {
   await execFileImpl("osascript", ["-e", macosOpenCursorMcpSettingsAppleScript()], {
     timeout: 3e4
   });
 }
-function manualCursorMcpSettingsSteps(platform) {
-  const chord = platform === "darwin" ? "Command + Shift + P" : "Ctrl + Shift + P";
+function manualCursorMcpSettingsSteps(platform2) {
+  const chord = platform2 === "darwin" ? "Command + Shift + P" : "Ctrl + Shift + P";
   return [
     "To finish setup manually:",
     "1. Open this repository in Cursor.",
@@ -2773,8 +3870,8 @@ function manualCursorMcpSettingsSteps(platform) {
     "6. Return to MemoraOne Studio and refresh Sources."
   ];
 }
-function printManualCursorMcpSettingsSteps(platform, println = console.log) {
-  for (const line of manualCursorMcpSettingsSteps(platform)) {
+function printManualCursorMcpSettingsSteps(platform2, println = console.log) {
+  for (const line of manualCursorMcpSettingsSteps(platform2)) {
     println(line);
   }
 }
@@ -2782,7 +3879,7 @@ function formatOpenCursorMcpSettingsPrompt(presentation = createTerminalPresenta
   return `${presentation.indent(OPEN_CURSOR_MCP_SETTINGS_PROMPT.trimEnd())} `;
 }
 async function runOpenCursorMcpSettingsFlow(deps = {}) {
-  const platform = deps.platform ?? process.platform;
+  const platform2 = deps.platform ?? process.platform;
   const println = deps.println ?? console.log;
   const tp = resolvePresentation(deps);
   const confirm = deps.confirm ?? ((question) => confirmYesDefault(question));
@@ -2790,14 +3887,14 @@ async function runOpenCursorMcpSettingsFlow(deps = {}) {
   println(tp.heading("Next"));
   const yes = await confirm(formatOpenCursorMcpSettingsPrompt(tp));
   if (!yes) {
-    printManualCursorMcpSettingsSteps(platform, println);
+    printManualCursorMcpSettingsSteps(platform2, println);
     return;
   }
-  if (platform === "darwin") {
+  if (platform2 === "darwin") {
     println(tp.warningLine("macOS may request Automation or Accessibility permission."));
     try {
-      const open = deps.openViaOsascript ?? (() => openCursorMcpSettingsViaOsascript(deps.execFile ?? execFileAsync3));
-      await open();
+      const open2 = deps.openViaOsascript ?? (() => openCursorMcpSettingsViaOsascript(deps.execFile ?? execFileAsync4));
+      await open2();
       println(tp.successLine('Confirm "memoraone" is enabled and green'));
       println(tp.nextActionLine("Return to MemoraOne Studio and refresh Sources"));
     } catch (err) {
@@ -2810,85 +3907,68 @@ async function runOpenCursorMcpSettingsFlow(deps = {}) {
     }
     return;
   }
-  printManualCursorMcpSettingsSteps(platform, println);
+  printManualCursorMcpSettingsSteps(platform2, println);
 }
 
 // src/setupIdeFiles.ts
 var MANAGED_MARKER = "<!-- MemoraOne managed IDE helper -->";
-var GITIGNORE_MEMORAONE_COMMENT = "# MemoraOne local project binding / API key";
-var GITIGNORE_MEMORAONE_ENTRY = "memoraone.m1";
-function buildMemoraoneMcpServer(ideType, command = "npx") {
-  return {
-    command,
-    args: ["-y", "@memoraone/mcp@latest"],
-    env: {
-      MEMORAONE_API_URL: "https://api.memoraone.com",
-      MEMORAONE_IDE_TYPE: ideType
+function buildMemoraoneMcpServer(ideType, options = {}) {
+  const environment = options.environment ?? "production";
+  const env2 = {
+    MEMORAONE_API_URL: resolveIdeApiUrl({ environment, apiUrl: options.apiUrl }),
+    MEMORAONE_IDE_TYPE: ideType
+  };
+  if (environment === "local") {
+    if (!options.cliPath) {
+      throw new Error("[setup-ide-files] Local VS Code MCP config requires a built CLI path.");
+    }
+    if (options.workspaceRoot !== void 0) {
+      env2[MEMORAONE_WORKSPACE_ROOT_ENV] = path17.resolve(options.workspaceRoot);
     }
+    return {
+      command: "node",
+      args: [options.cliPath],
+      env: env2
+    };
+  }
+  const channel = options.npmPackageChannel ?? npmPackageChannelFromEnvironment(environment);
+  return {
+    command: options.command ?? "npx",
+    args: ["-y", memoraoneNpmPackageSpec(channel)],
+    env: env2
   };
 }
 function assertUnderRepoRoot(repoRoot, absPath) {
-  const normRoot = path10.resolve(repoRoot) + path10.sep;
-  const normPath = path10.resolve(absPath);
-  if (normPath !== path10.resolve(repoRoot) && !normPath.startsWith(normRoot)) {
+  const normRoot = path17.resolve(repoRoot) + path17.sep;
+  const normPath = path17.resolve(absPath);
+  if (normPath !== path17.resolve(repoRoot) && !normPath.startsWith(normRoot)) {
     throw new Error(`[setup-ide-files] Refusing to write outside repo root: ${absPath}`);
   }
 }
 async function pathExists4(filePath) {
   try {
-    await fs8.access(filePath);
+    await fs13.access(filePath);
     return true;
   } catch {
     return false;
   }
 }
-function gitignoreAlreadyIgnoresMemoraoneM1(content) {
-  for (const line of content.split(/\r?\n/)) {
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith("#")) continue;
-    if (/^\/?memoraone\.m1\s*$/.test(trimmed)) return true;
-  }
-  return false;
-}
-function memoraoneGitignoreBlock() {
-  return `${GITIGNORE_MEMORAONE_COMMENT}
-${GITIGNORE_MEMORAONE_ENTRY}
-`;
-}
-async function ensureGitignoreMemoraone(repoRoot, opts) {
-  if (opts.noGitignore) return "skipped";
-  const abs = path10.join(repoRoot, ".gitignore");
-  assertUnderRepoRoot(repoRoot, abs);
-  let prior = "";
-  let existed = false;
-  try {
-    prior = await fs8.readFile(abs, "utf8");
-    existed = true;
-  } catch (err) {
-    const code = err && typeof err === "object" && "code" in err ? err.code : void 0;
-    if (code !== "ENOENT") throw err;
-  }
-  if (gitignoreAlreadyIgnoresMemoraoneM1(prior)) return "skipped";
-  const block = memoraoneGitignoreBlock();
-  const separator = existed && prior.length > 0 ? prior.endsWith("\n") ? "\n" : "\n\n" : "";
-  const next = (existed ? prior : "") + separator + block;
-  if (opts.dryRun) return existed ? "updated" : "created";
-  await fs8.writeFile(abs, next, "utf8");
-  return existed ? "updated" : "created";
+async function ensureGitignoreMemoraone(_repoRoot, _opts) {
+  return "skipped";
 }
 async function findRepoRoot(startDir) {
-  let current = path10.resolve(startDir);
-  const root = path10.parse(current).root;
+  let current = path17.resolve(startDir);
+  const root = path17.parse(current).root;
   while (true) {
-    const gitPath = path10.join(current, ".git");
-    const m1Path = path10.join(current, "memoraone.m1");
+    const gitPath = path17.join(current, ".git");
+    const m1Path = path17.join(current, "memoraone.m1");
     if (await pathExists4(gitPath) || await pathExists4(m1Path)) {
       return current;
     }
     if (current === root) {
       return null;
     }
-    current = path10.dirname(current);
+    current = path17.dirname(current);
   }
 }
 function stripLeadingLineComments3(text) {
@@ -2934,54 +4014,82 @@ function mcpJsonHeader() {
   return `// ${MANAGED_MARKER}
 `;
 }
-function buildVscodeMcpJsonBody(existing) {
+function buildVscodeMcpJsonBody(existing, options = {}) {
   const base = existing && typeof existing === "object" ? { ...existing } : { servers: {} };
   const servers = typeof base.servers === "object" && base.servers !== null && !Array.isArray(base.servers) ? { ...base.servers } : {};
-  servers.memoraone = buildMemoraoneMcpServer("copilot-vscode");
+  delete servers.memoraone;
+  servers.memoraone = buildMemoraoneMcpServer("copilot-vscode", options);
   const merged = { ...base, servers };
   return mcpJsonHeader() + JSON.stringify(merged, null, 2) + "\n";
 }
+async function writeSharedMcpJsonAtomic(filePath, content) {
+  const dir = path17.dirname(filePath);
+  await fs13.mkdir(dir, { recursive: true });
+  const tmpPath = path17.join(
+    dir,
+    `.${path17.basename(filePath)}.${process.pid}.${(0, import_node_crypto5.randomBytes)(8).toString("hex")}.tmp`
+  );
+  try {
+    await fs13.writeFile(tmpPath, content, "utf8");
+    await fs13.rename(tmpPath, filePath);
+  } catch (err) {
+    try {
+      await fs13.unlink(tmpPath);
+    } catch {
+    }
+    throw err;
+  }
+}
+var SharedMcpJsonParseError = class extends Error {
+  constructor(configPath) {
+    super(
+      `[setup-ide-files] Invalid JSON in shared MCP config (file preserved, not modified): ${configPath}. Fix or remove the file, then re-run setup-ide-files.`
+    );
+    this.name = "SharedMcpJsonParseError";
+    this.configPath = configPath;
+  }
+};
 function buildCursorMcpJsonBody(existing, writeOptions) {
   const merged = mergeCursorRepoMcpConfigObject(existing, writeOptions);
   return mcpJsonHeader() + JSON.stringify(merged, null, 2) + "\n";
 }
 async function writeManagedMarkdown(repoRoot, relPath, fullContent, opts) {
-  const abs = path10.join(repoRoot, relPath);
+  const abs = path17.join(repoRoot, relPath);
   assertUnderRepoRoot(repoRoot, abs);
   let prior = "";
   let existed = false;
   try {
-    prior = await fs8.readFile(abs, "utf8");
+    prior = await fs13.readFile(abs, "utf8");
     existed = true;
   } catch (err) {
     if (err?.code !== "ENOENT") throw err;
   }
   if (!existed) {
     if (opts.dryRun) return "created";
-    await fs8.mkdir(path10.dirname(abs), { recursive: true });
-    await fs8.writeFile(abs, fullContent, "utf8");
+    await fs13.mkdir(path17.dirname(abs), { recursive: true });
+    await fs13.writeFile(abs, fullContent, "utf8");
     return "created";
   }
   if (prior.includes(MANAGED_MARKER)) {
     if (prior === fullContent) return "skipped";
     if (opts.dryRun) return "updated";
-    await fs8.mkdir(path10.dirname(abs), { recursive: true });
-    await fs8.writeFile(abs, fullContent, "utf8");
+    await fs13.mkdir(path17.dirname(abs), { recursive: true });
+    await fs13.writeFile(abs, fullContent, "utf8");
     return "updated";
   }
   if (!opts.force) return "skipped-untracked";
   if (opts.dryRun) return "updated";
-  await fs8.mkdir(path10.dirname(abs), { recursive: true });
-  await fs8.writeFile(abs, fullContent, "utf8");
+  await fs13.mkdir(path17.dirname(abs), { recursive: true });
+  await fs13.writeFile(abs, fullContent, "utf8");
   return "updated";
 }
 async function writeIdeMcpJson(repoRoot, relPath, buildBody, opts) {
-  const abs = path10.join(repoRoot, relPath);
+  const abs = path17.join(repoRoot, relPath);
   assertUnderRepoRoot(repoRoot, abs);
   let raw = "";
   let existed = false;
   try {
-    raw = await fs8.readFile(abs, "utf8");
+    raw = await fs13.readFile(abs, "utf8");
     existed = true;
   } catch (err) {
     if (err?.code !== "ENOENT") throw err;
@@ -2989,24 +4097,24 @@ async function writeIdeMcpJson(repoRoot, relPath, buildBody, opts) {
   if (!existed) {
     const body = buildBody(null);
     if (opts.dryRun) return "created";
-    await fs8.mkdir(path10.dirname(abs), { recursive: true });
-    await fs8.writeFile(abs, body, "utf8");
+    await writeSharedMcpJsonAtomic(abs, body);
     return "created";
   }
   const managed = raw.includes(MANAGED_MARKER);
   if (!managed && !opts.force) return "skipped-untracked";
-  let parsed = null;
+  let parsed2;
   try {
-    parsed = JSON.parse(stripLeadingLineComments3(raw));
+    parsed2 = JSON.parse(stripLeadingLineComments3(raw));
   } catch {
-    parsed = null;
+    throw new SharedMcpJsonParseError(abs);
   }
-  if (!parsed && !opts.force) return "skipped-untracked";
-  const next = buildBody(parsed);
+  if (!parsed2 || typeof parsed2 !== "object" || Array.isArray(parsed2)) {
+    throw new SharedMcpJsonParseError(abs);
+  }
+  const next = buildBody(parsed2);
   if (managed && next === raw) return "skipped";
   if (opts.dryRun) return "updated";
-  await fs8.mkdir(path10.dirname(abs), { recursive: true });
-  await fs8.writeFile(abs, next, "utf8");
+  await writeSharedMcpJsonAtomic(abs, next);
   return "updated";
 }
 function parseSetupIdeFlags(argv) {
@@ -3022,8 +4130,12 @@ function parseSetupIdeFlags(argv) {
   let repair = false;
   let local = false;
   let staging = false;
+  let workspaceRoot;
+  let apiUrl;
   const unknown = [];
-  for (const a of argv) {
+  let flagError;
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
     if (a === "--cursor") cursor = true;
     else if (a === "--vscode") vscode = true;
     else if (a === "--jetbrains") jetbrains = true;
@@ -3036,7 +4148,35 @@ function parseSetupIdeFlags(argv) {
     else if (a === "--repair") repair = true;
     else if (a === "--local") local = true;
     else if (a === "--staging") staging = true;
-    else if (a.startsWith("-")) unknown.push(a);
+    else if (a === "--workspace-root") {
+      const value = argv[++i];
+      if (!value || value.startsWith("-")) {
+        flagError = "[setup-ide-files] --workspace-root requires a path argument.";
+      } else {
+        workspaceRoot = value;
+      }
+    } else if (a.startsWith("--workspace-root=")) {
+      const value = a.slice("--workspace-root=".length);
+      if (!value) {
+        flagError = "[setup-ide-files] --workspace-root requires a path argument.";
+      } else {
+        workspaceRoot = value;
+      }
+    } else if (a === "--api-url") {
+      const value = argv[++i];
+      if (!value || value.startsWith("-")) {
+        flagError = "[setup-ide-files] --api-url requires a URL argument.";
+      } else {
+        apiUrl = value;
+      }
+    } else if (a.startsWith("--api-url=")) {
+      const value = a.slice("--api-url=".length);
+      if (!value) {
+        flagError = "[setup-ide-files] --api-url requires a URL argument.";
+      } else {
+        apiUrl = value;
+      }
+    } else if (a.startsWith("-")) unknown.push(a);
   }
   const specific = cursor || vscode || jetbrains;
   let targets;
@@ -3045,10 +4185,12 @@ function parseSetupIdeFlags(argv) {
   } else {
     targets = { cursor, vscode, jetbrains };
   }
-  let flagError;
-  if (local && staging) {
+  if (!flagError && local && staging) {
     flagError = "[setup-ide-files] --local and --staging are mutually exclusive.";
   }
+  if (!flagError && apiUrl && !local && !devMode && !staging) {
+    flagError = "[setup-ide-files] --api-url is developer-only and requires --local, --dev, or --staging.";
+  }
   return {
     targets,
     force,
@@ -3060,11 +4202,34 @@ function parseSetupIdeFlags(argv) {
     local,
     staging,
     all,
+    workspaceRoot,
+    apiUrl,
     explicitCursor: cursor,
     unknown,
     flagError
   };
 }
+async function resolveSetupApiUrl(o, repoRoot) {
+  if (o.apiUrl) return normalizeApiUrl2(o.apiUrl);
+  const binding = await findBindingRecordByWorkspaceRoot(repoRoot, o.homeDir);
+  if (binding?.apiUrl) return normalizeApiUrl2(binding.apiUrl);
+  return void 0;
+}
+async function persistBindingApiUrl(repoRoot, apiUrl, homeDir, dryRun) {
+  if (dryRun) return;
+  const binding = await findBindingRecordByWorkspaceRoot(repoRoot, homeDir);
+  if (!binding) return;
+  const normalized = normalizeApiUrl2(apiUrl);
+  if (binding.apiUrl === normalized) return;
+  await writeBindingRecord(
+    {
+      ...binding,
+      apiUrl: normalized,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    },
+    homeDir
+  );
+}
 function cursorEnvironmentFromFlags(local, staging) {
   if (local) return "local";
   if (staging) return "staging";
@@ -3172,7 +4337,7 @@ async function runSetupIdeDaemonCleanup(opts) {
   if ("error" in target) {
     return {
       skipped: true,
-      skipReason: "no-m1",
+      skipReason: "no-binding",
       foundDaemonCount: 0,
       stoppedDaemonCount: 0,
       removedSocketCount: 0,
@@ -3229,13 +4394,13 @@ async function runSetupIdeFiles(o) {
   const outcomes = {};
   let cursorMcp;
   let jetbrainsMcp;
-  const repoRoot = await findRepoRoot(o.cwd);
+  const repoRoot = o.workspaceRoot !== void 0 && o.workspaceRoot !== "" ? path17.resolve(o.workspaceRoot) : await findRepoRoot(o.cwd);
   if (!repoRoot) {
     return {
       exitCode: 1,
       repoRoot: null,
       outcomes,
-      error: "[setup-ide-files] No repo root found (looked for .git or memoraone.m1)."
+      error: "[setup-ide-files] No repo root found (looked for .git or memoraone.m1). Pass --workspace-root <path> for a fileless bound workspace."
     };
   }
   let daemonCleanup;
@@ -3263,19 +4428,29 @@ async function runSetupIdeFiles(o) {
     dryRun: o.dryRun,
     noGitignore: o.noGitignore ?? false
   });
+  const cursorEnvironment = o.cursorEnvironment ?? "production";
+  const localOrDev = cursorEnvironment === "local" || Boolean(o.devMode);
+  const npmPackageChannel = o.npmPackageChannel ?? npmPackageChannelFromEnvironment(cursorEnvironment);
+  const resolvedApiUrl2 = await resolveSetupApiUrl(o, repoRoot);
+  const effectiveApiUrl = resolveIdeApiUrl({
+    environment: localOrDev ? "local" : cursorEnvironment,
+    apiUrl: resolvedApiUrl2
+  });
+  if (!o.dryRun && resolvedApiUrl2) {
+    await persistBindingApiUrl(repoRoot, effectiveApiUrl, o.homeDir, o.dryRun);
+  }
   const cursorContent = `---
 description: MemoraOne MCP \u2014 IDE agent instructions
 ---
 
 ` + cursorRuleBody();
   if (o.targets.cursor) {
-    const cursorEnvironment = o.cursorEnvironment ?? "production";
     let npxPath = null;
     let cliPath;
     if (cursorEnvironment === "local") {
       let resolvedCliPath = o.cursorLocalCliPathOverride;
       if (resolvedCliPath === void 0) {
-        resolvedCliPath = await resolveBuiltCliPathAsync({ searchFrom: [repoRoot, o.cwd] });
+        resolvedCliPath = await resolveBuiltCliPathAsync();
       }
       if (!resolvedCliPath) {
         return {
@@ -3305,7 +4480,9 @@ description: MemoraOne MCP \u2014 IDE agent instructions
       environment: cursorEnvironment,
       npxPath: npxPath ?? void 0,
       cliPath,
-      repoRoot
+      repoRoot,
+      apiUrl: resolvedApiUrl2,
+      npmPackageChannel
     };
     outcomes[".cursor/rules/memoraone-mcp.mdc"] = await writeManagedMarkdown(
       repoRoot,
@@ -3313,12 +4490,22 @@ description: MemoraOne MCP \u2014 IDE agent instructions
       cursorContent,
       { force: o.force, dryRun: o.dryRun }
     );
-    outcomes[".cursor/mcp.json"] = await writeIdeMcpJson(
-      repoRoot,
-      ".cursor/mcp.json",
-      (existing) => buildCursorMcpJsonBody(existing, cursorWriteOptions),
-      { force: o.force, dryRun: o.dryRun }
-    );
+    try {
+      outcomes[".cursor/mcp.json"] = await writeIdeMcpJson(
+        repoRoot,
+        ".cursor/mcp.json",
+        (existing) => buildCursorMcpJsonBody(existing, cursorWriteOptions),
+        { force: o.force, dryRun: o.dryRun }
+      );
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      return {
+        exitCode: 1,
+        repoRoot,
+        outcomes,
+        error: message
+      };
+    }
     const repoConfigPath = getCursorRepoMcpConfigPath(repoRoot);
     const repoOutcome = outcomes[".cursor/mcp.json"] ?? "skipped";
     let globalConfigPath;
@@ -3367,15 +4554,53 @@ description: MemoraOne MCP \u2014 IDE agent instructions
     };
   }
   if (o.targets.vscode) {
-    outcomes[".vscode/mcp.json"] = await writeIdeMcpJson(
-      repoRoot,
-      ".vscode/mcp.json",
-      buildVscodeMcpJsonBody,
-      {
-        force: o.force,
-        dryRun: o.dryRun
+    const vscodeEnvironment = localOrDev ? "local" : cursorEnvironment === "staging" ? "staging" : "production";
+    let vscodeCliPath;
+    if (vscodeEnvironment === "local") {
+      let resolvedCliPath = o.cursorLocalCliPathOverride;
+      if (resolvedCliPath === void 0) {
+        resolvedCliPath = o.cliPathOverride;
       }
-    );
+      if (resolvedCliPath === void 0) {
+        resolvedCliPath = await resolveBuiltCliPathAsync();
+      }
+      if (!resolvedCliPath) {
+        return {
+          exitCode: 1,
+          repoRoot,
+          outcomes,
+          cursorMcp,
+          error: "[setup-ide-files] Local mode requires a built CLI at packages/mcp/dist/cli.cjs. Run pnpm build first."
+        };
+      }
+      vscodeCliPath = resolvedCliPath;
+    }
+    try {
+      outcomes[".vscode/mcp.json"] = await writeIdeMcpJson(
+        repoRoot,
+        ".vscode/mcp.json",
+        (existing) => buildVscodeMcpJsonBody(existing, {
+          environment: vscodeEnvironment,
+          apiUrl: resolvedApiUrl2,
+          cliPath: vscodeCliPath,
+          workspaceRoot: vscodeEnvironment === "local" ? repoRoot : void 0,
+          npmPackageChannel
+        }),
+        {
+          force: o.force,
+          dryRun: o.dryRun
+        }
+      );
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      return {
+        exitCode: 1,
+        repoRoot,
+        outcomes,
+        cursorMcp,
+        error: message
+      };
+    }
     outcomes[".github/copilot-instructions.md"] = await writeManagedMarkdown(
       repoRoot,
       ".github/copilot-instructions.md",
@@ -3391,14 +4616,19 @@ description: MemoraOne MCP \u2014 IDE agent instructions
       { force: o.force, dryRun: o.dryRun }
     );
     try {
-      const homeDir = o.jetbrainsHomeDir ?? os4.homedir();
+      const homeDir = o.jetbrainsHomeDir ?? os6.homedir();
       const activePath = o.jetbrainsGlobalMcpConfigPath ?? getJetBrainsGlobalMcpConfigPath(homeDir);
       const jetbrainsSetup = await setupJetBrainsMcpConfig({
         homeDir,
         repoRoot,
         globalConfigPath: activePath,
         dryRun: o.dryRun,
-        devMode: o.devMode,
+        // Local dogfood: --dev / local environment → node + built CLI.
+        // Published staging/production: npx + channel-specific package spec.
+        devMode: localOrDev,
+        environment: localOrDev ? "local" : cursorEnvironment,
+        npmPackageChannel,
+        apiUrl: resolvedApiUrl2,
         repair: o.repair ?? false,
         verify: o.verifyHandshake ?? !o.dryRun,
         npxPathOverride: o.npxPathOverride,
@@ -3439,6 +4669,8 @@ async function cliSetupIdeFiles(argv, options = {}) {
     local,
     staging,
     all,
+    workspaceRoot,
+    apiUrl,
     explicitCursor,
     unknown,
     flagError
@@ -3451,26 +4683,30 @@ async function cliSetupIdeFiles(argv, options = {}) {
     console.error(`[setup-ide-files] Unknown option(s): ${unknown.join(", ")}`);
     return 1;
   }
-  const cwd = options.cwd ?? process.cwd();
+  const cwd2 = options.cwd ?? process.cwd();
   const openDeps = options.openCursorMcpSettings ?? {};
   const stdinIsTty = openDeps.stdinIsTty ?? process.stdin.isTTY === true;
-  const env = openDeps.env ?? process.env;
+  const env2 = openDeps.env ?? process.env;
   const promptOpenCursorSettings = shouldPromptOpenCursorMcpSettings({
     explicitCursor,
     all,
     dryRun,
     stdinIsTty,
-    env
+    env: env2
   });
+  const cursorEnvironment = cursorEnvironmentFromFlags(local, staging);
   const result = await runSetupIdeFiles({
-    cwd,
+    cwd: cwd2,
+    workspaceRoot,
     targets,
     force,
     dryRun,
     noGitignore: options.setupOverrides?.noGitignore ?? noGitignore,
     devMode,
     repair,
-    cursorEnvironment: cursorEnvironmentFromFlags(local, staging),
+    cursorEnvironment,
+    npmPackageChannel: npmPackageChannelFromEnvironment(cursorEnvironment),
+    apiUrl,
     ...options.setupOverrides
   });
   if (result.error) {
@@ -3497,7 +4733,7 @@ async function cliSetupIdeFiles(argv, options = {}) {
   }
   if (promptOpenCursorSettings && result.repoRoot) {
     const presentation = openDeps.presentation ?? createTerminalPresentation({
-      env,
+      env: env2,
       stdoutIsTty: openDeps.stdoutIsTty ?? process.stdout.isTTY === true,
       color: openDeps.color,
       unicode: openDeps.unicode
@@ -3510,7 +4746,7 @@ async function cliSetupIdeFiles(argv, options = {}) {
     await runOpenCursorMcpSettingsFlow({
       ...openDeps,
       stdinIsTty,
-      env,
+      env: env2,
       presentation
     });
   } else {
@@ -3526,7 +4762,7 @@ async function cliSetupIdeFiles(argv, options = {}) {
   if (cleanup) {
     console.log("[setup-ide-files] Running additional full-project cleanup (--cleanup)...");
     const cleanupResult = await runCleanup({
-      cwd,
+      cwd: cwd2,
       dryRun,
       allProjects: false,
       assumeYes: true
@@ -3539,6 +4775,455 @@ async function cliSetupIdeFiles(argv, options = {}) {
   return 0;
 }
 
+// src/localState/connectCommand.ts
+var path20 = __toESM(require("path"), 1);
+var os7 = __toESM(require("os"), 1);
+
+// src/config.ts
+var process2 = __toESM(require("process"), 1);
+var fs14 = __toESM(require("fs"), 1);
+var path18 = __toESM(require("path"), 1);
+var dotenv = __toESM(require("dotenv"), 1);
+var import_v4 = require("zod/v4");
+var dotenvPath = path18.resolve(process2.cwd(), ".env");
+if (fs14.existsSync(dotenvPath)) {
+  try {
+    dotenv.config({ path: dotenvPath });
+  } catch (err) {
+    process2.stderr.write("[memoraone-mcp] Failed to load .env: " + String(err) + "\n");
+  }
+}
+var EnvSchema = import_v4.z.object({
+  MEMORAONE_API_URL: import_v4.z.string().url().optional(),
+  MEMORAONE_API_KEY: import_v4.z.string().min(1).optional(),
+  MEMORAONE_DEV_MODE: import_v4.z.string().min(1).optional(),
+  MEMORAONE_AGENT_NAME: import_v4.z.string().min(1).optional(),
+  MEMORAONE_AGENT_TYPE: import_v4.z.string().min(1).optional(),
+  MEMORAONE_SOURCE: import_v4.z.string().min(1).optional(),
+  MEMORAONE_IDE_TYPE: import_v4.z.enum(["cursor", "copilot-vscode", "jetbrains"]).optional(),
+  MEMORAONE_WORKLOG: import_v4.z.string().min(1).optional(),
+  MEMORAONE_HEARTBEAT: import_v4.z.string().min(1).optional(),
+  MEMORAONE_HEARTBEAT_INTERVAL_MS: import_v4.z.string().min(1).optional()
+});
+var requiredEnvVars = [];
+var missingEnvVars = requiredEnvVars.filter((key) => {
+  const value = process2.env[key];
+  return value === void 0 || value.trim() === "";
+});
+if (missingEnvVars.length > 0) {
+  for (const key of missingEnvVars) {
+    process2.stderr.write(`Missing ${key}
+`);
+  }
+  process2.exit(1);
+}
+var parsed = EnvSchema.safeParse(process2.env);
+var resolvedApiUrl = resolveApiUrl(process2.env);
+if (!parsed.success) {
+  const formatted = parsed.error.format();
+  process2.stderr.write(
+    "[memoraone-mcp] Invalid environment variables " + JSON.stringify(formatted) + "\n"
+  );
+  throw new Error("Config validation failed");
+}
+var parseBooleanFlag2 = (value, defaultValue) => {
+  if (value === void 0) {
+    return defaultValue;
+  }
+  const normalized = value.trim().toLowerCase();
+  if (["1", "true", "yes", "on"].includes(normalized)) {
+    return true;
+  }
+  if (["0", "false", "no", "off"].includes(normalized)) {
+    return false;
+  }
+  return defaultValue;
+};
+var config2 = {
+  apiUrl: resolvedApiUrl.replace(/\/+$/, ""),
+  apiKey: parsed.data.MEMORAONE_API_KEY,
+  agentName: parsed.data.MEMORAONE_AGENT_NAME ?? "cursor",
+  agentType: parsed.data.MEMORAONE_AGENT_TYPE ?? "agent",
+  source: parsed.data.MEMORAONE_SOURCE ?? "cursor",
+  ideType: parsed.data.MEMORAONE_IDE_TYPE,
+  devMode: parseBooleanFlag2(parsed.data.MEMORAONE_DEV_MODE, false),
+  worklogEnabled: parseBooleanFlag2(parsed.data.MEMORAONE_WORKLOG, true),
+  heartbeatEnabled: parseBooleanFlag2(parsed.data.MEMORAONE_HEARTBEAT, true),
+  heartbeatIntervalMs: Number.parseInt(parsed.data.MEMORAONE_HEARTBEAT_INTERVAL_MS ?? "30000", 10)
+};
+
+// src/repoFingerprint.ts
+var fs15 = __toESM(require("fs"), 1);
+var path19 = __toESM(require("path"), 1);
+var crypto2 = __toESM(require("crypto"), 1);
+var parseBooleanFlag3 = (value) => {
+  if (!value) {
+    return false;
+  }
+  const normalized = value.trim().toLowerCase();
+  return ["1", "true", "yes", "on"].includes(normalized);
+};
+var debugEnabled2 = parseBooleanFlag3(process.env.MEMORAONE_DEV_MODE);
+var debugLog = (message) => {
+  if (!debugEnabled2) {
+    return;
+  }
+  process.stderr.write(`[memoraone-mcp][debug] ${message}
+`);
+};
+var normalizeRemoteUrl = (remoteUrl) => {
+  let normalized = remoteUrl.trim();
+  normalized = normalized.replace(/^[a-z]+:\/\//i, "");
+  normalized = normalized.replace(/^git@([^:]+):/i, "$1/");
+  normalized = normalized.replace(/\.git$/i, "");
+  normalized = normalized.replace(/\/+$/, "");
+  return normalized.toLowerCase();
+};
+var sha256 = (value) => {
+  return crypto2.createHash("sha256").update(value).digest("hex");
+};
+var resolveGitDir = (gitPath) => {
+  try {
+    const stat4 = fs15.statSync(gitPath);
+    if (stat4.isDirectory()) {
+      return gitPath;
+    }
+    if (stat4.isFile()) {
+      const content = fs15.readFileSync(gitPath, "utf8");
+      const match = content.match(/^gitdir:\s*(.+)$/m);
+      if (match) {
+        const gitDir = match[1].trim();
+        return path19.resolve(path19.dirname(gitPath), gitDir);
+      }
+    }
+  } catch {
+    return null;
+  }
+  return null;
+};
+var findGitRoot = (start) => {
+  let current = path19.resolve(start);
+  while (true) {
+    const gitPath = path19.join(current, ".git");
+    if (fs15.existsSync(gitPath)) {
+      const gitDir = resolveGitDir(gitPath);
+      if (gitDir) {
+        return { gitRoot: current, gitDir };
+      }
+    }
+    const parent = path19.dirname(current);
+    if (parent === current) {
+      break;
+    }
+    current = parent;
+  }
+  return null;
+};
+var readOriginRemote = (gitDir) => {
+  const configPath = path19.join(gitDir, "config");
+  try {
+    const content = fs15.readFileSync(configPath, "utf8");
+    const lines = content.split(/\r?\n/);
+    let inOrigin = false;
+    for (const line of lines) {
+      const sectionMatch = line.match(/^\s*\[(.+)]\s*$/);
+      if (sectionMatch) {
+        inOrigin = sectionMatch[1].trim() === 'remote "origin"';
+        continue;
+      }
+      if (inOrigin) {
+        const urlMatch = line.match(/^\s*url\s*=\s*(.+)\s*$/);
+        if (urlMatch) {
+          return urlMatch[1].trim();
+        }
+      }
+    }
+  } catch {
+    return null;
+  }
+  return null;
+};
+function resolveRepoFingerprint(cwd2) {
+  const found = findGitRoot(cwd2);
+  if (!found) {
+    const fallbackPath = path19.resolve(cwd2);
+    const fingerprint2 = sha256(fallbackPath);
+    debugLog(`repo fingerprint=${fingerprint2} source=path-fallback`);
+    return {
+      fingerprint: fingerprint2,
+      gitRoot: fallbackPath,
+      source: "path-fallback"
+    };
+  }
+  const { gitRoot, gitDir } = found;
+  const remoteUrl = readOriginRemote(gitDir);
+  if (remoteUrl) {
+    const normalized = normalizeRemoteUrl(remoteUrl);
+    const fingerprint2 = sha256(normalized);
+    debugLog(`repo fingerprint=${fingerprint2} source=git-remote`);
+    return {
+      fingerprint: fingerprint2,
+      gitRoot,
+      remoteUrl,
+      source: "git-remote"
+    };
+  }
+  const fingerprint = sha256(path19.resolve(gitRoot));
+  debugLog(`repo fingerprint=${fingerprint} source=path-fallback`);
+  return {
+    fingerprint,
+    gitRoot,
+    source: "path-fallback"
+  };
+}
+
+// src/localState/connectCommand.ts
+function normalizeConnectCode(code) {
+  const trimmed = code.trim();
+  if (!trimmed.startsWith("mcc_")) {
+    throw new Error("[memoraone-mcp] Connect code must start with mcc_");
+  }
+  return trimmed;
+}
+function normalizeGitRemote(remoteUrl) {
+  if (!remoteUrl) return null;
+  let normalized = remoteUrl.trim();
+  normalized = normalized.replace(/^[a-z]+:\/\//i, "");
+  normalized = normalized.replace(/^git@([^:]+):/i, "$1/");
+  normalized = normalized.replace(/\.git$/i, "");
+  normalized = normalized.replace(/\/+$/, "");
+  return normalized.toLowerCase() || null;
+}
+async function runConnectCommand(options) {
+  const code = normalizeConnectCode(options.code);
+  const cwd2 = path20.resolve(options.cwd ?? process.cwd());
+  const apiUrl = (options.apiUrl ?? config2.apiUrl).replace(/\/+$/, "");
+  const homeDir = options.homeDir ?? os7.homedir();
+  const environment = "local";
+  const executionMode = await resolvePackageExecutionMode({
+    executionMode: options.executionMode,
+    // Only honor an explicit caller cliPath; never auto-resolve before mode detection
+    // (published installs must not be forced into local monorepo mode).
+    cliPath: options.cliPath,
+    apiUrl,
+    scriptPath: options.scriptPath,
+    env: options.env,
+    resolveBuiltCliPath: resolveBuiltCliPathAsync
+  });
+  let resolvedMode = executionMode;
+  if (resolvedMode.kind === "local" && !resolvedMode.cliPath) {
+    const cliPath = await resolveBuiltCliPathAsync();
+    if (!cliPath) {
+      throw new Error(
+        "[memoraone-mcp] Local connect requires a built CLI at packages/mcp/dist/cli.cjs. Run pnpm build first."
+      );
+    }
+    resolvedMode = { kind: "local", cliPath };
+  }
+  const ensured = await ensureRepositoryBindingForRoot(cwd2, {
+    homeDir,
+    identityDeps: options.identityDeps,
+    createIfMissing: true
+  });
+  if (ensured.legacyM1WarningPath) {
+    process.stderr.write(
+      `[memoraone-mcp] warning: ignoring legacy ${path20.basename(ensured.legacyM1WarningPath)} at ${ensured.legacyM1WarningPath} (credentials and binding are package-managed)
+`
+    );
+  }
+  const fingerprint = resolveRepoFingerprint(cwd2);
+  const displayName = cwd2;
+  const normalizedGitRemote = normalizeGitRemote(fingerprint.remoteUrl);
+  const { clientRedeemKey } = await ensureClientRedeemKey(
+    ensured.repositoryBindingId,
+    options.credentialOptions
+  );
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const pendingRecord = {
+    v: 1,
+    repositoryBindingId: ensured.repositoryBindingId,
+    workspaceRoot: cwd2,
+    filesystemIdentity: ensured.identity,
+    rootFingerprint: fingerprint.fingerprint,
+    displayName,
+    environment,
+    apiUrl,
+    normalizedGitRemote,
+    status: "pending",
+    createdAt: now,
+    updatedAt: now,
+    packageVersion: options.packageVersion ?? null,
+    ideType: options.ideType ?? null
+  };
+  await writeBindingRecord(pendingRecord, homeDir);
+  await upsertPathIndexEntry({
+    repositoryBindingId: ensured.repositoryBindingId,
+    workspaceRoot: cwd2,
+    identity: ensured.identity,
+    homeDir,
+    previousPath: ensured.renamedFrom
+  });
+  const redeemed = await redeemLocalConnectCode(
+    apiUrl,
+    {
+      code,
+      client_redeem_key: clientRedeemKey,
+      repository_binding_id: ensured.repositoryBindingId,
+      root_fingerprint: fingerprint.fingerprint,
+      display_name: displayName,
+      environment,
+      normalized_git_remote: normalizedGitRemote,
+      platform: ensured.identity.platform,
+      package_version: options.packageVersion ?? null,
+      ide_type: options.ideType ?? null
+    },
+    { fetchImpl: options.fetchImpl }
+  );
+  await updateInstallationCredentials(
+    ensured.repositoryBindingId,
+    {
+      accessToken: redeemed.access_token,
+      refreshToken: redeemed.refresh_token,
+      accessTokenExpiresAt: redeemed.access_token_expires_at ?? void 0,
+      refreshTokenExpiresAt: redeemed.refresh_token_expires_at ?? void 0,
+      installationPublicId: redeemed.installation_public_id,
+      projectId: redeemed.project_id
+    },
+    { ...options.credentialOptions, clearKeys: ["clientRedeemKey"] }
+  );
+  const connectedRecord = {
+    ...pendingRecord,
+    installationPublicId: redeemed.installation_public_id,
+    projectId: redeemed.project_id,
+    status: "connected",
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await writeBindingRecord(connectedRecord, homeDir);
+  const baseSuccess = `Connected repository binding ${ensured.repositoryBindingId}` + (redeemed.recovered ? " (recovered)" : "") + ` to project ${redeemed.project_id}.`;
+  if (options.configureIdes !== false) {
+    const targets = { cursor: true, vscode: true, jetbrains: true };
+    const setup = options.setupIdeFiles ?? runSetupIdeFiles;
+    const modeSetup = setupOptionsFromPackageExecutionMode(resolvedMode);
+    let setupResult;
+    try {
+      setupResult = await setup({
+        cwd: cwd2,
+        // Use the exact bound workspace root — do not rediscover via .git / .m1.
+        workspaceRoot: cwd2,
+        targets,
+        force: true,
+        dryRun: false,
+        noGitignore: true,
+        skipDaemonCleanup: true,
+        homeDir,
+        // Propagate the redeemed binding API URL (backend only — not execution mode).
+        apiUrl,
+        ...modeSetup,
+        ...options.setupIdeOptions
+      });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      setupResult = {
+        exitCode: 1,
+        repoRoot: cwd2,
+        outcomes: {},
+        error: message
+      };
+    }
+    if (setupResult.exitCode !== 0) {
+      const detail = setupResult.error ?? "unknown IDE setup error";
+      const repair = formatIdeSetupRepairHint(cwd2, resolvedMode);
+      return {
+        exitCode: 1,
+        repositoryBindingId: ensured.repositoryBindingId,
+        projectId: redeemed.project_id,
+        installationPublicId: redeemed.installation_public_id,
+        recovered: redeemed.recovered,
+        createdBinding: ensured.created,
+        legacyM1WarningPath: ensured.legacyM1WarningPath,
+        ideSetupError: detail,
+        executionMode: resolvedMode,
+        message: `Repository connection exists for binding ${ensured.repositoryBindingId} (project ${redeemed.project_id}), but IDE configuration failed: ${detail}. Credentials and binding were kept. ${repair}`
+      };
+    }
+  }
+  return {
+    exitCode: 0,
+    repositoryBindingId: ensured.repositoryBindingId,
+    projectId: redeemed.project_id,
+    installationPublicId: redeemed.installation_public_id,
+    recovered: redeemed.recovered,
+    createdBinding: ensured.created,
+    legacyM1WarningPath: ensured.legacyM1WarningPath,
+    executionMode: resolvedMode,
+    message: baseSuccess
+  };
+}
+function parseConnectArgv(argv) {
+  let code;
+  let apiUrl;
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--api-url") {
+      const value = argv[++i];
+      if (!value || value.startsWith("-")) {
+        return { error: "Usage: memoraone-mcp connect <code> [--api-url <url>]" };
+      }
+      apiUrl = value;
+      continue;
+    }
+    if (a.startsWith("--api-url=")) {
+      const value = a.slice("--api-url=".length);
+      if (!value) {
+        return { error: "Usage: memoraone-mcp connect <code> [--api-url <url>]" };
+      }
+      apiUrl = value;
+      continue;
+    }
+    if (a.startsWith("-")) {
+      return { error: `Unknown connect option: ${a}` };
+    }
+    if (!code) {
+      code = a;
+      continue;
+    }
+    return { error: "Usage: memoraone-mcp connect <code> [--api-url <url>]" };
+  }
+  return { code, apiUrl };
+}
+async function cliConnect(argv) {
+  const parsed2 = parseConnectArgv(argv);
+  if (parsed2.error) {
+    process.stderr.write(`${parsed2.error}
+`);
+    return 1;
+  }
+  if (!parsed2.code) {
+    process.stderr.write("Usage: memoraone-mcp connect <code> [--api-url <url>]\n");
+    return 1;
+  }
+  try {
+    const result = await runConnectCommand({
+      code: parsed2.code,
+      cwd: process.cwd(),
+      apiUrl: parsed2.apiUrl,
+      packageVersion: process.env.npm_package_version ?? null
+    });
+    if (result.exitCode === 0) {
+      process.stdout.write(`${result.message}
+`);
+    } else {
+      process.stderr.write(`[memoraone-mcp] ${result.message}
+`);
+    }
+    return result.exitCode;
+  } catch (err) {
+    process.stderr.write(`[memoraone-mcp] connect failed: ${String(err)}
+`);
+    return 1;
+  }
+}
+
 // src/cli.ts
 var { version } = require_package();
 var args = process.argv.slice(2);
@@ -3548,7 +5233,7 @@ if (args.includes("--version") || args.includes("-v")) {
 }
 if (args.includes("--help") || args.includes("-h")) {
   console.log(
-    "Usage: memoraone-mcp [--version] [--help] [--daemon --project-id <uuid> [--ide cursor|copilot-vscode|jetbrains]]\n       memoraone-mcp setup-ide-files [--all|--cursor|--vscode|--jetbrains] [--force] [--dry-run] [--no-gitignore] [--cleanup] [--dev] [--repair]\n         Cursor API environment (with --cursor or --all): --local (node + built cli.cjs + localhost) | --staging (npx + staging API)\n       memoraone-mcp cleanup [--project-id <uuid>] [--ide cursor|copilot-vscode|jetbrains] [--dry-run] [--all-projects] [--yes]"
+    "Usage: memoraone-mcp [--version] [--help]\n       memoraone-mcp connect <code> [--api-url <url>]\n       memoraone-mcp [--daemon --binding-id <mrb_\u2026> [--ide cursor|copilot-vscode|jetbrains]]\n       memoraone-mcp setup-ide-files [--all|--cursor|--vscode|--jetbrains] [--force] [--dry-run] [--no-gitignore] [--cleanup] [--dev] [--repair] [--workspace-root <path>] [--api-url <url>]\n         Cursor API environment (with --cursor or --all): --local (node + built cli.cjs + local API) | --staging (npx + staging API)\n         --workspace-root: configure an explicit bound workspace (skips .git discovery; for fileless Local MCP repair)\n         --api-url: developer-only local/dev API endpoint (defaults from binding or http://localhost:3001; never Studio :3000)\n       memoraone-mcp cleanup [--project-id <uuid>] [--ide cursor|copilot-vscode|jetbrains] [--dry-run] [--all-projects] [--yes]"
   );
   process.exit(0);
 }
@@ -3558,6 +5243,12 @@ if (args[0] === "cleanup") {
 `);
     process.exit(1);
   });
+} else if (args[0] === "connect") {
+  cliConnect(args.slice(1)).then((code) => process.exit(code)).catch((err) => {
+    process.stderr.write(`[memoraone-mcp] connect fatal: ${String(err)}
+`);
+    process.exit(1);
+  });
 } else if (args[0] === "setup-ide-files") {
   cliSetupIdeFiles(args.slice(1)).then((code) => process.exit(code)).catch((err) => {
     process.stderr.write(`[memoraone-mcp] setup-ide-files fatal: ${String(err)}
@@ -3571,7 +5262,9 @@ if (args[0] === "cleanup") {
     process.exit(1);
   });
 } else {
-  runBridgeProxy({ cliPath: process.argv[1] }).catch((err) => {
+  runBridgeProxy({ cliPath: process.argv[1] }).then(() => {
+    process.exit(0);
+  }).catch((err) => {
     process.stderr.write(`[memoraone-mcp][bridge] fatal: ${String(err)}
 `);
     process.exit(1);