@neat.is/core 0.10.1-dev.20260927 → 0.10.1

package/dist/cli.cjs

@@ -61,8 +61,8 @@ function mountBearerAuth(app, opts) {
   ]);
   const publicRead = opts.publicRead === true;
   app.addHook("preHandler", (req, reply, done) => {
-    const path98 = (req.url.split("?")[0] ?? "").replace(/\/+$/, "");
-    if (exactUnauthPaths.has(path98) || PROJECT_SCOPED_UNAUTH_PATTERN.test(path98)) {
+    const path100 = (req.url.split("?")[0] ?? "").replace(/\/+$/, "");
+    if (exactUnauthPaths.has(path100) || PROJECT_SCOPED_UNAUTH_PATTERN.test(path100)) {
       done();
       return;
     }
@@ -415,8 +415,8 @@ function websocketChannelPathOf(attrs) {
     const v = attrs[key];
     if (typeof v === "string" && v.length > 0) {
       const q = v.indexOf("?");
-      const path98 = q === -1 ? v : v.slice(0, q);
-      if (path98.length > 0) return path98;
+      const path100 = q === -1 ? v : v.slice(0, q);
+      if (path100.length > 0) return path100;
     }
   }
   return void 0;
@@ -789,6 +789,7 @@ __export(cli_exports, {
   QUERY_VERBS: () => QUERY_VERBS,
   UnknownProfileError: () => UnknownProfileError,
   commandPrefix: () => commandPrefix,
+  isLoopbackEndpoint: () => isLoopbackEndpoint,
   isNpxInvocation: () => isNpxInvocation,
   main: () => main,
   parseArgs: () => parseArgs,
@@ -805,9 +806,9 @@ __export(cli_exports, {
 });
 module.exports = __toCommonJS(cli_exports);
 init_cjs_shims();
-var import_node_path98 = __toESM(require("path"), 1);
+var import_node_path100 = __toESM(require("path"), 1);
 var import_node_os11 = __toESM(require("os"), 1);
-var import_node_fs59 = require("fs");
+var import_node_fs61 = require("fs");
 
 // src/banner.ts
 init_cjs_shims();
@@ -1490,19 +1491,19 @@ function confidenceFromMix(edges, now = Date.now()) {
 function longestIncomingWalk(graph, start, maxDepth) {
   let best = { path: [start], edges: [] };
   const visited = /* @__PURE__ */ new Set([start]);
-  function step(node, path98, edges) {
-    if (path98.length > best.path.length) {
-      best = { path: [...path98], edges: [...edges] };
+  function step(node, path100, edges) {
+    if (path100.length > best.path.length) {
+      best = { path: [...path100], edges: [...edges] };
     }
-    if (path98.length - 1 >= maxDepth) return;
+    if (path100.length - 1 >= maxDepth) return;
     const incoming = bestEdgeBySource(graph, graph.inboundEdges(node));
     for (const [srcId, edge] of incoming) {
       if (visited.has(srcId)) continue;
       visited.add(srcId);
-      path98.push(srcId);
+      path100.push(srcId);
       edges.push(edge);
-      step(srcId, path98, edges);
-      path98.pop();
+      step(srcId, path100, edges);
+      path100.pop();
       edges.pop();
       visited.delete(srcId);
     }
@@ -1717,20 +1718,20 @@ function dominantFailingCall(graph, serviceId17, visited) {
   return best;
 }
 function followFailingCallChain(graph, originServiceId, maxDepth) {
-  const path98 = [originServiceId];
+  const path100 = [originServiceId];
   const edges = [];
   const visited = /* @__PURE__ */ new Set([originServiceId]);
   let current = originServiceId;
   for (let depth = 0; depth < maxDepth; depth++) {
     const hop = dominantFailingCall(graph, current, visited);
     if (!hop) break;
-    path98.push(hop.nextService);
+    path100.push(hop.nextService);
     edges.push(hop.edge);
     visited.add(hop.nextService);
     current = hop.nextService;
   }
   if (edges.length === 0) return null;
-  return { path: path98, edges, culprit: current };
+  return { path: path100, edges, culprit: current };
 }
 function isStaleCallEdge(e) {
   return e.type === import_types2.EdgeType.CALLS && e.provenance === import_types2.Provenance.STALE;
@@ -1766,26 +1767,26 @@ function dominantStaleCall(graph, serviceId17, visited) {
   return best;
 }
 function followStaleCallChain(graph, originServiceId, maxDepth) {
-  const path98 = [originServiceId];
+  const path100 = [originServiceId];
   const edges = [];
   const visited = /* @__PURE__ */ new Set([originServiceId]);
   let current = originServiceId;
   for (let depth = 0; depth < maxDepth; depth++) {
     const hop = dominantStaleCall(graph, current, visited);
     if (!hop) break;
-    path98.push(hop.nextService);
+    path100.push(hop.nextService);
     edges.push(hop.edge);
     visited.add(hop.nextService);
     current = hop.nextService;
   }
   if (edges.length === 0) return null;
-  return { path: path98, edges, culprit: current };
+  return { path: path100, edges, culprit: current };
 }
 function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   const chain = followFailingCallChain(graph, originId, ROOT_CAUSE_MAX_DEPTH);
   if (!chain) return null;
   const culprit = chain.culprit;
-  const path98 = [...chain.path];
+  const path100 = [...chain.path];
   const edgeProvenances = chain.edges.map((e) => e.provenance);
   const baseConfidence = confidenceFromMix(chain.edges);
   const confidence = Math.max(0, Math.min(1, baseConfidence * INCIDENT_ROOT_CAUSE_CONFIDENCE));
@@ -1793,14 +1794,14 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   if (loc) {
     let rootCauseNode = culprit;
     if (loc.fileNode) {
-      path98.push(loc.fileNode);
+      path100.push(loc.fileNode);
       edgeProvenances.push(import_types2.Provenance.OBSERVED);
       rootCauseNode = loc.fileNode;
     }
     return import_types2.RootCauseResultSchema.parse({
       rootCauseNode,
       rootCauseReason: loc.rootCauseReason,
-      traversalPath: path98,
+      traversalPath: path100,
       edgeProvenances,
       confidence,
       ...loc.fixRecommendation ? { fixRecommendation: loc.fixRecommendation } : {}
@@ -1812,7 +1813,7 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   return import_types2.RootCauseResultSchema.parse({
     rootCauseNode: culprit,
     rootCauseReason: `${culpritName} is failing downstream calls (${errs} observed error${errs === 1 ? "" : "s"})`,
-    traversalPath: path98,
+    traversalPath: path100,
     edgeProvenances,
     confidence,
     fixRecommendation: `Inspect ${culpritName}'s failing handler`
@@ -2465,10 +2466,10 @@ function enrichWithNavigation(graph, errorNodeId, tagged, incidents, now) {
     traversalPath = staleChain.path;
     edgeProvenances = staleChain.edges.map((e) => e.provenance);
   } else if (top.node !== seedNode) {
-    const path98 = findPath(graph, errorNodeId, top.node, "up", ROOT_CAUSE_MAX_DEPTH);
-    if (path98) {
-      traversalPath = path98.nodes;
-      edgeProvenances = path98.edges.map((e) => e.provenance);
+    const path100 = findPath(graph, errorNodeId, top.node, "up", ROOT_CAUSE_MAX_DEPTH);
+    if (path100) {
+      traversalPath = path100.nodes;
+      edgeProvenances = path100.edges.map((e) => e.provenance);
     } else {
       traversalPath = [errorNodeId, top.node];
       edgeProvenances = [top.provenance ?? import_types2.Provenance.OBSERVED];
@@ -3919,8 +3920,8 @@ function chiRoutesFromSource(source, parser) {
   chiWalk(tree.rootNode, "", out);
   return out;
 }
-function stripChiRegex(path98) {
-  return path98.replace(/\{([^{}:]+):[^{}]*\}/g, "{$1}");
+function stripChiRegex(path100) {
+  return path100.replace(/\{([^{}:]+):[^{}]*\}/g, "{$1}");
 }
 function chiWalk(node, prefix, out) {
   for (let i = 0; i < node.namedChildCount; i++) {
@@ -4592,9 +4593,9 @@ function rubyRocketRoute(args) {
     if (!pair || pair.type !== "pair") continue;
     const k = pair.childForFieldName("key");
     if (k?.type !== "string") continue;
-    const path98 = rubyLiteral(k);
-    if (path98 === null) continue;
-    return { path: path98, target: rubyLiteral(pair.childForFieldName("value")) };
+    const path100 = rubyLiteral(k);
+    if (path100 === null) continue;
+    return { path: path100, target: rubyLiteral(pair.childForFieldName("value")) };
   }
   return null;
 }
@@ -12002,13 +12003,16 @@ function objectKeys(obj) {
 var MODULAR_WRITES = /* @__PURE__ */ new Set(["addDoc", "setDoc", "updateDoc"]);
 var NAMESPACED_WRITES = /* @__PURE__ */ new Set(["add", "set", "update"]);
 var READ_CLAUSES = /* @__PURE__ */ new Set(["where", "orderBy"]);
-function firestoreEndpointsFromFile(file, serviceDir) {
+function firestoreEndpointsFromFile(file, serviceDir, imported) {
   const hasClient = FIRESTORE_CLIENT_IMPORT_RE.test(file.content);
   const hasAdmin = FIRESTORE_ADMIN_IMPORT_RE.test(file.content);
-  if (!hasClient && !hasAdmin) return [];
-  const fileSdk = hasClient && !hasAdmin ? "client" : hasAdmin && !hasClient ? "admin" : null;
+  const importedNames = imported?.names ?? /* @__PURE__ */ new Set();
+  if (!hasClient && !hasAdmin && importedNames.size === 0) return [];
+  const ownSdk = hasClient && !hasAdmin ? "client" : hasAdmin && !hasClient ? "admin" : null;
+  const fileSdk = !hasClient && !hasAdmin ? imported?.sdk ?? null : ownSdk;
   const tree = parseSource3(parserForExt2(import_node_path45.default.extname(file.path)), file.content);
   const clientVars = firestoreClientVars(tree.rootNode);
+  for (const n of importedNames) clientVars.add(n);
   const collLine = /* @__PURE__ */ new Map();
   const writes = /* @__PURE__ */ new Map();
   const reads = /* @__PURE__ */ new Map();
@@ -12119,6 +12123,99 @@ function firestoreEndpointsFromFile(file, serviceDir) {
   }
   return out;
 }
+function exportedFirestoreClients(root) {
+  const out = /* @__PURE__ */ new Set();
+  const collect = (node) => {
+    if (node.type === "variable_declarator") {
+      const name = node.childForFieldName("name");
+      let value = node.childForFieldName("value");
+      if (value?.type === "await_expression") value = namedChildren(value)[0] ?? null;
+      if (name?.type === "identifier" && isFirestoreClientFactory(value)) out.add(name.text);
+    }
+    for (const c of namedChildren(node)) collect(c);
+  };
+  const walk11 = (node) => {
+    if (node.type === "export_statement") collect(node);
+    else for (const c of namedChildren(node)) walk11(c);
+  };
+  walk11(root);
+  return out;
+}
+function namedImportBindings(root) {
+  const out = [];
+  const walk11 = (node) => {
+    if (node.type === "import_statement") {
+      const src = node.childForFieldName("source");
+      const specifier = src ? src.text.slice(1, -1) : "";
+      if (specifier.length > 0) {
+        const stack = [node];
+        while (stack.length > 0) {
+          const n = stack.pop();
+          if (n.type === "import_specifier") {
+            const nameNode = n.childForFieldName("name");
+            const aliasNode = n.childForFieldName("alias");
+            const importedName = nameNode?.text;
+            if (importedName) {
+              out.push({ local: aliasNode?.text ?? importedName, imported: importedName, specifier });
+            }
+            continue;
+          }
+          for (const c of namedChildren(n)) stack.push(c);
+        }
+      }
+    }
+    for (const c of namedChildren(node)) walk11(c);
+  };
+  walk11(root);
+  return out;
+}
+function sdkOf(content) {
+  const hasClient = FIRESTORE_CLIENT_IMPORT_RE.test(content);
+  const hasAdmin = FIRESTORE_ADMIN_IMPORT_RE.test(content);
+  return hasClient && !hasAdmin ? "client" : hasAdmin && !hasClient ? "admin" : null;
+}
+function parseOrNull(file) {
+  const ext = import_node_path45.default.extname(file.path);
+  if (!(ext in GRAMMAR_BY_EXT)) return null;
+  try {
+    return parseSource3(parserForExt2(ext), file.content).rootNode;
+  } catch {
+    return null;
+  }
+}
+async function firestoreCrossFileEndpoints(files, serviceDir) {
+  const registry = /* @__PURE__ */ new Map();
+  for (const f of files) {
+    if (sdkOf(f.content) === null && !FIRESTORE_CLIENT_IMPORT_RE.test(f.content)) continue;
+    const root = parseOrNull(f);
+    if (!root) continue;
+    const names = exportedFirestoreClients(root);
+    if (names.size === 0) continue;
+    registry.set(toPosix(import_node_path45.default.relative(serviceDir, f.path)), { names, sdk: sdkOf(f.content) });
+  }
+  if (registry.size === 0) return [];
+  const out = [];
+  for (const f of files) {
+    const root = parseOrNull(f);
+    if (!root) continue;
+    if (firestoreClientVars(root).size > 0) continue;
+    const bindings = namedImportBindings(root);
+    if (bindings.length === 0) continue;
+    const names = /* @__PURE__ */ new Set();
+    let sdk = null;
+    for (const b of bindings) {
+      const rel = await resolveJsImport(b.specifier, import_node_path45.default.dirname(f.path), serviceDir, null);
+      if (!rel) continue;
+      const entry2 = registry.get(rel);
+      if (!entry2 || !entry2.names.has(b.imported)) continue;
+      names.add(b.local);
+      sdk ??= entry2.sdk;
+    }
+    if (names.size === 0) continue;
+    out.push(...firestoreEndpointsFromFile(f, serviceDir, { names, sdk }));
+  }
+  return out;
+}
 
 // src/extract/calls/mongoose.ts
 init_cjs_shims();
@@ -14928,6 +15025,7 @@ async function addExternalEndpointEdges(graph, services) {
         recordExtractionError("python socket call extraction", file.path, err);
       }
     }
+    endpoints.push(...await firestoreCrossFileEndpoints(maskedFiles, service.dir));
     endpoints.push(...await mongooseCrossFileEndpoints(maskedFiles, service.dir));
     endpoints.push(...pythonOrmCrossFileEndpoints(maskedFiles, service.dir));
     endpoints.push(...await prismaColumnEndpoints(service.dir));
@@ -16223,6 +16321,9 @@ function stripComments(src) {
 function segmentsFromMatchPath(pathToken) {
   return pathToken.split("/").filter((s) => s.length > 0);
 }
+function isRecursiveWildcard(seg) {
+  return /^\{[^}]*=\s*\*\*\}$/.test(seg);
+}
 function collectionKeyFromSegments(segments) {
   let segs = segments;
   if (segs.length >= 3 && segs[0] === "databases" && /^\{.*\}$/.test(segs[1]) && segs[2] === "documents") {
@@ -16235,10 +16336,11 @@ function collectionKeyFromName(name) {
 }
 function fieldsFromCondition(cond) {
   const out = [];
-  const callRe = /\b(?:hasAll|hasOnly|hasAny)\s*\(\s*\[([^\]]*)\]\s*\)/g;
+  const callRe = /(!\s*)?\b(?:hasAll|hasOnly|hasAny)\s*\(\s*\[([^\]]*)\]\s*\)/g;
   let m;
   while ((m = callRe.exec(cond)) !== null) {
-    const inner = m[1];
+    if (m[1] !== void 0 || isNegatedAt(cond, m.index)) continue;
+    const inner = m[2];
     const litRe = /'([^']*)'|"([^"]*)"/g;
     let lm;
     while ((lm = litRe.exec(inner)) !== null) {
@@ -16248,6 +16350,28 @@ function fieldsFromCondition(cond) {
   }
   return out;
 }
+function isNegatedAt(cond, idx) {
+  let i = idx - 1;
+  while (i >= 0) {
+    const ch = cond[i];
+    if (ch === ")") {
+      let depth = 1;
+      i--;
+      while (i >= 0 && depth > 0) {
+        if (cond[i] === ")") depth++;
+        else if (cond[i] === "(") depth--;
+        i--;
+      }
+      continue;
+    }
+    if (/[A-Za-z0-9_$.\]['"]/.test(ch) || ch === " ") {
+      i--;
+      continue;
+    }
+    return ch === "!";
+  }
+  return false;
+}
 function parseFirestoreRules(content) {
   const src = stripComments(content);
   const tokenRe = /match\s+((?:\/(?:\{[^}]*\}|[^\s/{}]+))+)\s*\{|allow\b([^;{}]*);|(\{)|(\})/g;
@@ -16260,7 +16384,8 @@ function parseFirestoreRules(content) {
   while ((m = tokenRe.exec(src)) !== null) {
     if (m[1] !== void 0) {
       depth++;
-      matchStack.push({ depth, segs: segmentsFromMatchPath(m[1]) });
+      const segs = segmentsFromMatchPath(m[1]);
+      matchStack.push({ depth, segs, recursive: segs.some(isRecursiveWildcard) });
       continue;
     }
     if (m[2] !== void 0) {
@@ -16271,6 +16396,10 @@ function parseFirestoreRules(content) {
       if (!methods.some((mm) => WRITE_METHODS.has(mm))) continue;
       const key = currentKey();
       if (key.length === 0) continue;
+      if (matchStack.some((f) => f.recursive)) {
+        indeterminate.add(key);
+        continue;
+      }
       const cond = colon === -1 ? "" : body.slice(colon + 1);
       const fields = fieldsFromCondition(cond);
       if (fields.length > 0) {
@@ -20325,10 +20454,10 @@ var SUPABASE_RPC_TARGET_KIND = "supabase-rpc";
 // src/connectors/supabase/map.ts
 var REST_RPC_PATH_RE = /^\/rest\/v1\/rpc\/([^/?]+)/;
 var REST_TABLE_PATH_RE = /^\/rest\/v1\/([^/?]+)/;
-function targetFromRestPath(path98) {
-  const rpcMatch = REST_RPC_PATH_RE.exec(path98);
+function targetFromRestPath(path100) {
+  const rpcMatch = REST_RPC_PATH_RE.exec(path100);
   if (rpcMatch) return { targetKind: SUPABASE_RPC_TARGET_KIND, name: rpcMatch[1] };
-  const tableMatch = REST_TABLE_PATH_RE.exec(path98);
+  const tableMatch = REST_TABLE_PATH_RE.exec(path100);
   if (tableMatch) return { targetKind: SUPABASE_TABLE_TARGET_KIND, name: tableMatch[1] };
   return null;
 }
@@ -20932,9 +21061,9 @@ function parseFirebaseTargetName(targetName) {
   const secondSep = rest.indexOf(FIELD_SEP);
   if (secondSep === -1) return null;
   const method = rest.slice(0, secondSep);
-  const path98 = rest.slice(secondSep + 1);
-  if (!resourceName || !method || !path98) return null;
-  return { resourceName, method, path: path98 };
+  const path100 = rest.slice(secondSep + 1);
+  if (!resourceName || !method || !path100) return null;
+  return { resourceName, method, path: path100 };
 }
 function resourceNameFor(type, labels) {
   if (!labels) return null;
@@ -20972,14 +21101,14 @@ function mapLogEntryToSignal(entry2) {
   if (!req) return null;
   if (typeof req.requestMethod !== "string" || req.requestMethod.length === 0) return null;
   const method = req.requestMethod.toUpperCase();
-  const path98 = pathFromRequestUrl(req.requestUrl);
-  if (path98 === null) return null;
+  const path100 = pathFromRequestUrl(req.requestUrl);
+  if (path100 === null) return null;
   const timestamp = entry2.timestamp;
   if (typeof timestamp !== "string" || timestamp.length === 0) return null;
   const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD2;
   return {
     targetKind: resourceType,
-    targetName: packFirebaseTargetName({ resourceName, method, path: path98 }),
+    targetName: packFirebaseTargetName({ resourceName, method, path: path100 }),
     callCount: 1,
     errorCount: isError ? 1 : 0,
     lastObservedIso: timestamp
@@ -21004,9 +21133,9 @@ var import_types73 = require("@neat.is/types");
 function normalizeName(name) {
   return name.toLowerCase().replace(/[^a-z0-9]/g, "");
 }
-function inferServiceName(graph, resourceName, method, path98) {
+function inferServiceName(graph, resourceName, method, path100) {
   const wantedMethod = method.toUpperCase();
-  const wantedPath = normalizePathTemplate(path98);
+  const wantedPath = normalizePathTemplate(path100);
   const services = [];
   const owners = /* @__PURE__ */ new Set();
   graph.forEachNode((_id, attrs) => {
@@ -21223,7 +21352,7 @@ function mapEventToSignal(event) {
   if (Number.isNaN(observedAt.getTime())) return null;
   const statusCode = metadata?.statusCode;
   const isError = typeof statusCode === "number" && statusCode >= ERROR_STATUS_THRESHOLD3;
-  const path98 = metadata?.trigger ? parsePathFromTrigger(metadata.trigger) : void 0;
+  const path100 = metadata?.trigger ? parsePathFromTrigger(metadata.trigger) : void 0;
   return {
     targetKind: CLOUDFLARE_TARGET_KIND,
     targetName: scriptName,
@@ -21231,7 +21360,7 @@ function mapEventToSignal(event) {
     errorCount: isError ? 1 : 0,
     lastObservedIso: observedAt.toISOString(),
     method,
-    ...path98 ? { path: path98 } : {},
+    ...path100 ? { path: path100 } : {},
     ...typeof statusCode === "number" ? { statusCode } : {},
     ...typeof metadata?.duration === "number" ? { duration: metadata.duration } : {}
   };
@@ -21277,8 +21406,8 @@ function findTaggedWorkerFileNode(graph, workerName) {
   });
   return found;
 }
-function findMatchingRouteNode(graph, serviceName, method, path98) {
-  const normalizedPath = normalizePathTemplate(path98);
+function findMatchingRouteNode(graph, serviceName, method, path100) {
+  const normalizedPath = normalizePathTemplate(path100);
   let found = null;
   graph.forEachNode((id, attrs) => {
     if (found) return;
@@ -21295,10 +21424,10 @@ function createCloudflareResolveTarget(config, graph) {
   return (signal) => {
     if (signal.targetKind !== CLOUDFLARE_TARGET_KIND) return null;
     const scriptName = signal.targetName;
-    const { method, path: path98 } = signal;
+    const { method, path: path100 } = signal;
     const resolveRouteGrain = (serviceName, wholeFileId) => {
-      if (!method || !path98) return wholeFileId;
-      return findMatchingRouteNode(graph, serviceName, method, path98) ?? wholeFileId;
+      if (!method || !path100) return wholeFileId;
+      return findMatchingRouteNode(graph, serviceName, method, path100) ?? wholeFileId;
     };
     const mapping = config.workers?.[scriptName];
     if (mapping) {
@@ -21650,9 +21779,9 @@ function parseCloudRunTargetName(targetName) {
   const secondSep = rest.indexOf(FIELD_SEP2);
   if (secondSep === -1) return null;
   const method = rest.slice(0, secondSep);
-  const path98 = rest.slice(secondSep + 1);
-  if (!serviceName || !method || !path98) return null;
-  return { serviceName, method, path: path98 };
+  const path100 = rest.slice(secondSep + 1);
+  if (!serviceName || !method || !path100) return null;
+  return { serviceName, method, path: path100 };
 }
 
 // src/connectors/cloud-run/map.ts
@@ -21681,14 +21810,14 @@ function mapLogEntryToSignal2(entry2) {
   if (!req) return null;
   if (typeof req.requestMethod !== "string" || req.requestMethod.length === 0) return null;
   const method = req.requestMethod.toUpperCase();
-  const path98 = pathFromRequestUrl2(req.requestUrl);
-  if (path98 === null) return null;
+  const path100 = pathFromRequestUrl2(req.requestUrl);
+  if (path100 === null) return null;
   const timestamp = entry2.timestamp;
   if (typeof timestamp !== "string" || timestamp.length === 0) return null;
   const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD4;
   return {
     targetKind: CLOUD_RUN_TARGET_KIND,
-    targetName: packCloudRunTargetName({ serviceName, method, path: path98 }),
+    targetName: packCloudRunTargetName({ serviceName, method, path: path100 }),
     callCount: 1,
     errorCount: isError ? 1 : 0,
     lastObservedIso: timestamp
@@ -21727,14 +21856,14 @@ function createCloudRunResolveTarget(graph, config) {
     if (signal.targetKind !== CLOUD_RUN_TARGET_KIND) return null;
     const identity = parseCloudRunTargetName(signal.targetName);
     if (!identity) return null;
-    const { serviceName: gcpServiceName, method, path: path98 } = identity;
-    const mappedService = config.serviceMap?.[gcpServiceName] ?? (config.inferServices ? inferServiceName(graph, gcpServiceName, method, path98) ?? void 0 : void 0);
+    const { serviceName: gcpServiceName, method, path: path100 } = identity;
+    const mappedService = config.serviceMap?.[gcpServiceName] ?? (config.inferServices ? inferServiceName(graph, gcpServiceName, method, path100) ?? void 0 : void 0);
     if (mappedService) {
       const routeNodeId = findMatchingRouteNode2(
         graph,
         mappedService,
         method,
-        normalizePathTemplate(path98)
+        normalizePathTemplate(path100)
       );
       if (routeNodeId) {
         return { targetNodeId: routeNodeId, serviceName: mappedService, edgeType: import_types84.EdgeType.CALLS };
@@ -21870,9 +21999,9 @@ function parseGcpLbTargetName(targetName) {
   const secondSep = rest.indexOf(FIELD_SEP3);
   if (secondSep === -1) return null;
   const method = rest.slice(0, secondSep);
-  const path98 = rest.slice(secondSep + 1);
-  if (!backendServiceName || !method || !path98) return null;
-  return { backendServiceName, method, path: path98 };
+  const path100 = rest.slice(secondSep + 1);
+  if (!backendServiceName || !method || !path100) return null;
+  return { backendServiceName, method, path: path100 };
 }
 
 // src/connectors/gcp-lb/map.ts
@@ -21901,14 +22030,14 @@ function mapLogEntryToSignal3(entry2) {
   if (!req) return null;
   if (typeof req.requestMethod !== "string" || req.requestMethod.length === 0) return null;
   const method = req.requestMethod.toUpperCase();
-  const path98 = pathFromRequestUrl3(req.requestUrl);
-  if (path98 === null) return null;
+  const path100 = pathFromRequestUrl3(req.requestUrl);
+  if (path100 === null) return null;
   const timestamp = entry2.timestamp;
   if (typeof timestamp !== "string" || timestamp.length === 0) return null;
   const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD5;
   return {
     targetKind: GCP_LB_TARGET_KIND,
-    targetName: packGcpLbTargetName({ backendServiceName, method, path: path98 }),
+    targetName: packGcpLbTargetName({ backendServiceName, method, path: path100 }),
     callCount: 1,
     errorCount: isError ? 1 : 0,
     lastObservedIso: timestamp
@@ -21947,14 +22076,14 @@ function createGcpLbResolveTarget(graph, config) {
     if (signal.targetKind !== GCP_LB_TARGET_KIND) return null;
     const identity = parseGcpLbTargetName(signal.targetName);
     if (!identity) return null;
-    const { backendServiceName, method, path: path98 } = identity;
-    const mappedService = config.backendServiceMap?.[backendServiceName] ?? (config.inferServices ? inferServiceName(graph, backendServiceName, method, path98) ?? void 0 : void 0);
+    const { backendServiceName, method, path: path100 } = identity;
+    const mappedService = config.backendServiceMap?.[backendServiceName] ?? (config.inferServices ? inferServiceName(graph, backendServiceName, method, path100) ?? void 0 : void 0);
     if (mappedService) {
       const routeNodeId = findMatchingRouteNode3(
         graph,
         mappedService,
         method,
-        normalizePathTemplate(path98)
+        normalizePathTemplate(path100)
       );
       if (routeNodeId) {
         return { targetNodeId: routeNodeId, serviceName: mappedService, edgeType: import_types88.EdgeType.CALLS };
@@ -24346,9 +24475,9 @@ function makeK8sFetchImpl(transport) {
     req.end();
   }));
 }
-async function listResource(transport, namespace, path98, opts = {}) {
+async function listResource(transport, namespace, path100, opts = {}) {
   const base = opts.apiUrl ?? transport.server;
-  const url = `${base.replace(/\/$/, "")}${path98}`;
+  const url = `${base.replace(/\/$/, "")}${path100}`;
   const fetchImpl = opts.fetchImpl ?? makeK8sFetchImpl(transport);
   const res = await junctionFetch(
     url,
@@ -24358,7 +24487,7 @@ async function listResource(transport, namespace, path98, opts = {}) {
     { provider: "kubernetes", accountKey: `${safeHost(transport.server)}/${namespace}`, fetchImpl }
   );
   if (!res.ok) {
-    throw new Error(`kubernetes ${path98} failed: ${res.status} ${res.statusText}`);
+    throw new Error(`kubernetes ${path100} failed: ${res.status} ${res.statusText}`);
   }
   const json = await res.json();
   return Array.isArray(json.items) ? json.items : [];
@@ -29249,7 +29378,8 @@ async function runOrchestrator(opts) {
   } catch (err) {
     if (!(err instanceof ProjectNameCollisionError)) throw err;
     console.error(`neat: ${err.message}`);
-    console.error("pass --project <other-name> to register under a different name.");
+    console.error(`neat: run \`neat <path> --project <other-name>\` to register it under a different name,`);
+    console.error(`neat: or \`neat uninstall ${opts.project}\` if the old registration is stale.`);
     result.exitCode = 1;
     return result;
   }
@@ -29828,12 +29958,12 @@ async function runConnectorCommand(rawArgs, deps = {}) {
 
 // src/hosted-connect-cli.ts
 init_cjs_shims();
-var import_node_child_process5 = require("child_process");
+var import_node_child_process6 = require("child_process");
 
 // src/login-sso.ts
 init_cjs_shims();
 var import_node_http2 = require("http");
-var import_node_child_process4 = require("child_process");
+var import_node_child_process5 = require("child_process");
 var import_node_crypto7 = require("crypto");
 
 // src/profiles.ts
@@ -30046,8 +30176,200 @@ async function clearActiveProfile(home = neatHome3()) {
   });
 }
 
+// src/daemon-probe.ts
+init_cjs_shims();
+var PROBE_ATTEMPT_TIMEOUT_MS = 3e4;
+var PROBE_TOTAL_BUDGET_MS = 12e4;
+var PROBE_RETRY_PAUSE_MS = 2e3;
+function isTimeoutError(err) {
+  const name = err?.name;
+  return name === "TimeoutError" || name === "AbortError";
+}
+async function probeOnce(fetchImpl, root, token, timeoutMs) {
+  let res;
+  try {
+    res = await fetchImpl(`${root}/health`, {
+      headers: { authorization: `Bearer ${token}` },
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+  } catch (err) {
+    if (isTimeoutError(err)) return { kind: "timeout" };
+    return { kind: "unreachable", detail: err.message };
+  }
+  if (res.status === 401 || res.status === 403) return { kind: "unauthorized", status: res.status };
+  if (!res.ok) return { kind: "not-neat", status: res.status };
+  const contentType = res.headers.get("content-type") ?? "";
+  if (!contentType.includes("json")) return { kind: "not-neat", status: res.status };
+  return { kind: "ok" };
+}
+async function probeDaemon(fetchImpl, endpoint2, token, hooks) {
+  const root = endpoint2.replace(/\/$/, "");
+  const deadline = hooks.now() + PROBE_TOTAL_BUDGET_MS;
+  let warned = false;
+  for (; ; ) {
+    const result = await probeOnce(fetchImpl, root, token, PROBE_ATTEMPT_TIMEOUT_MS);
+    if (result.kind !== "timeout") return result;
+    if (!warned) {
+      hooks.onWaiting();
+      warned = true;
+    }
+    if (hooks.now() >= deadline) {
+      return { kind: "unreachable", detail: `no response after ${Math.round(PROBE_TOTAL_BUDGET_MS / 1e3)}s` };
+    }
+    await hooks.sleep(PROBE_RETRY_PAUSE_MS);
+  }
+}
+
+// src/login-connect.ts
+init_cjs_shims();
+var import_node_child_process4 = require("child_process");
+var import_node_util = require("util");
+var import_node_fs54 = require("fs");
+var import_node_path92 = __toESM(require("path"), 1);
+var execFileAsync = (0, import_node_util.promisify)(import_node_child_process4.execFile);
+async function hasLocalSnapshot(cwd) {
+  try {
+    await import_node_fs54.promises.access(import_node_path92.default.join(cwd, "neat-out", "graph.json"));
+    return true;
+  } catch {
+    return false;
+  }
+}
+var POLL_INTERVAL_MS = 3e3;
+var POLL_BUDGET_MS = 10 * 6e4;
+var CP_TIMEOUT_MS = 1e4;
+async function detectGitHubRepo(cwd) {
+  const read = async (args) => {
+    try {
+      const { stdout } = await execFileAsync("git", args, { cwd, timeout: 5e3 });
+      return stdout.trim();
+    } catch {
+      return null;
+    }
+  };
+  let url = await read(["remote", "get-url", "origin"]);
+  if (!url) {
+    const names = await read(["remote"]);
+    const first = names?.split(/\r?\n/).find((l) => l.trim().length > 0)?.trim();
+    if (!first) return null;
+    url = await read(["remote", "get-url", first]);
+  }
+  if (!url) return null;
+  return parseGitHubRemote(url);
+}
+function parseGitHubRemote(url) {
+  const trimmed = url.trim().replace(/\.git$/, "");
+  const m = trimmed.match(/^https?:\/\/(?:[^@/]+@)?github\.com\/([^/]+)\/([^/]+)$/) ?? trimmed.match(/^git@github\.com:([^/]+)\/([^/]+)$/) ?? trimmed.match(/^ssh:\/\/git@github\.com\/([^/]+)\/([^/]+)$/);
+  if (!m) return null;
+  const owner = m[1];
+  const name = m[2];
+  if (!owner || !name) return null;
+  return { owner, name };
+}
+async function cpGetJson(fetchImpl, cpUrl, path100, accessToken) {
+  try {
+    const res = await fetchImpl(`${cpUrl}${path100}`, {
+      headers: { authorization: `Bearer ${accessToken}`, accept: "application/json" },
+      signal: AbortSignal.timeout(CP_TIMEOUT_MS)
+    });
+    if (!res.ok) return { ok: false };
+    return { ok: true, body: await res.json() };
+  } catch {
+    return { ok: false };
+  }
+}
+async function listBoundRepos(fetchImpl, cpUrl, accessToken, projectId) {
+  const res = await cpGetJson(
+    fetchImpl,
+    cpUrl,
+    `/me/projects/${encodeURIComponent(projectId)}/repos`,
+    accessToken
+  );
+  if (!res.ok || !Array.isArray(res.body)) return null;
+  return res.body;
+}
+async function waitForFirstProject(fetchImpl, cpUrl, accessToken, deps) {
+  const pollMs = deps.pollMs ?? POLL_INTERVAL_MS;
+  const deadline = deps.now() + (deps.budgetMs ?? POLL_BUDGET_MS);
+  for (; ; ) {
+    if (deps.signal?.aborted) return { kind: "aborted" };
+    const me = await cpGetJson(fetchImpl, cpUrl, "/me", accessToken);
+    if (me.ok) {
+      const running = (me.body.projects ?? []).find((p) => p.status === "running");
+      if (running) return { kind: "project", project: running };
+    }
+    if (deps.now() >= deadline) return { kind: "timeout" };
+    await deps.sleep(pollMs);
+    if (deps.signal?.aborted) return { kind: "aborted" };
+  }
+}
+function bindUrl(webUrl, projectId) {
+  return `${webUrl}/config/repos?project=${encodeURIComponent(projectId)}`;
+}
+function onboardingUrl(webUrl) {
+  return `${webUrl}/onboarding`;
+}
+async function runPostLoginConnect(input) {
+  const d = input.deps;
+  const out = d.out ?? ((line) => console.log(line));
+  const fetchImpl = d.fetchImpl ?? fetch;
+  const cwd = d.cwd ?? process.cwd();
+  const detect6 = d.detectRepo ?? detectGitHubRepo;
+  const readLine = d.readLine;
+  const repo = await detect6(cwd);
+  out("");
+  if (!repo) {
+    out("This directory has no GitHub remote, so it can't be bound to the project.");
+    out(`  Push its graph instead:      neat sync --to ${input.project.name}`);
+    out(`  Manage projects and repos:   ${input.webUrl}`);
+    return;
+  }
+  const slug = `${repo.owner}/${repo.name}`;
+  const bound = await listBoundRepos(fetchImpl, input.cpUrl, input.accessToken, input.project.id);
+  const match = bound?.find((r) => r.owner === repo.owner && r.name === repo.name);
+  if (match) {
+    const state = match.syncStatus ? ` (${match.syncStatus})` : "";
+    out(`${slug} is bound to ${input.project.name}${state} \u2014 hosted NEAT extracts it for you.`);
+    out(`  See the graph:  ${input.webUrl}`);
+    return;
+  }
+  out(`${slug} isn't part of ${input.project.name} yet \u2014 logging in connected your account, not this repo.`);
+  out("");
+  const installed = input.me?.github?.installed;
+  const bindLine = installed === false ? "1) Install the GitHub App and bind this repo \u2014 hosted NEAT keeps it in sync" : installed === true ? "1) Bind this repo \u2014 hosted NEAT clones and extracts it, and keeps it in sync" : "1) Bind this repo through the console \u2014 hosted NEAT keeps it in sync";
+  out(bindLine);
+  out(`2) Push the graph on this machine now \u2014 a snapshot, not a subscription`);
+  out("3) Neither, for now");
+  const answer = readLine ? (await readLine("Choose 1, 2 or 3 (Enter skips): "))?.trim() : void 0;
+  if (answer === "1") {
+    const url = bindUrl(input.webUrl, input.project.id);
+    const opened = (d.openBrowser ?? (() => false))(url);
+    out("");
+    out(opened ? `Opened ${url}` : `Open this to bind the repo:
+  ${url}`);
+    return;
+  }
+  if (answer === "2") {
+    const hasGraph = await (d.hasLocalGraph ?? hasLocalSnapshot)(cwd);
+    out("");
+    if (!hasGraph) {
+      out("There is no local graph to push yet. Build one, then push it:");
+      out("  neat");
+      out(`  neat sync --to ${input.project.name}`);
+      return;
+    }
+    out("Push the local graph with:");
+    out(`  neat sync --to ${input.project.name}`);
+    return;
+  }
+  out("");
+  out("No problem \u2014 when you want this repo in the graph:");
+  out(`  Bind it:        ${bindUrl(input.webUrl, input.project.id)}`);
+  out(`  Or push it:     neat sync --to ${input.project.name}`);
+}
+
 // src/login-sso.ts
-var DEFAULT_CP_URL = "https://neat-control-plane-bg5yqctn2q-nw.a.run.app";
+var DEFAULT_CP_URL = "https://api.neat.is";
 var DEFAULT_WEB_URL = "https://app.neat.is";
 var CALLBACK_TIMEOUT_MS = 5 * 6e4;
 function resolveCpUrl(env = process.env, override) {
@@ -30071,6 +30393,7 @@ function pickProject(projects, want) {
     return {
       error: {
         code: 1,
+        kind: "no-project",
         message: `no running project to connect to \u2014 create + provision one in the console first${listed}`
       }
     };
@@ -30121,14 +30444,14 @@ async function exchangeCredential(cpUrl, accessToken, opts, deps) {
   if (!cred.endpoint || !cred.authToken) {
     return { error: { code: 1, message: "the credential response was missing endpoint/authToken" } };
   }
-  return { project, cred };
+  return { project, cred, me };
 }
 function defaultOpenBrowser(url) {
   const platform = process.platform;
   const cmd = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
   const args = platform === "win32" ? ["/c", "start", "", url] : [url];
   try {
-    const child = (0, import_node_child_process4.spawn)(cmd, args, { detached: true, stdio: "ignore" });
+    const child = (0, import_node_child_process5.spawn)(cmd, args, { detached: true, stdio: "ignore" });
     child.on("error", () => {
     });
     child.unref();
@@ -30203,12 +30526,50 @@ async function runSsoLogin(opts, deps) {
     }
     accessToken = lb.token;
   }
-  const ex = await exchangeCredential(opts.cpUrl, accessToken, { project: opts.project }, deps);
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const now = deps.now ?? Date.now;
+  let ex = await exchangeCredential(opts.cpUrl, accessToken, { project: opts.project }, deps);
+  if ("error" in ex && ex.error.kind === "no-project" && !opts.json) {
+    const url = onboardingUrl(opts.webUrl);
+    out("");
+    out("You don't have a project yet \u2014 let's make one.");
+    const opened = (deps.openBrowser ?? defaultOpenBrowser)(url);
+    out(opened ? `Opened ${url}` : `Open this to create your first project:
+  ${url}`);
+    out("Waiting for it to come up \u2014 Ctrl-C to stop and finish later.");
+    const waited = await waitForFirstProject(fetchImpl, opts.cpUrl, accessToken, {
+      sleep: sleep2,
+      now,
+      ...deps.signal ? { signal: deps.signal } : {}
+    });
+    if (waited.kind === "aborted") {
+      out("Stopped. Run `neat login` again once your project is up.");
+      return 130;
+    }
+    if (waited.kind === "timeout") {
+      err("neat login: no project came up while waiting \u2014 run `neat login` again once it does");
+      return 1;
+    }
+    out(`${waited.project.name} is up.`);
+    ex = await exchangeCredential(opts.cpUrl, accessToken, { project: opts.project }, deps);
+  }
   if ("error" in ex) {
     err(`neat login: ${ex.error.message}`);
     return ex.error.code;
   }
-  const { project, cred } = ex;
+  const { project, cred, me } = ex;
+  const probe = await probeDaemon(fetchImpl, cred.endpoint, cred.authToken, {
+    sleep: sleep2,
+    now,
+    onWaiting: () => err("Waking the hosted daemon \u2014 a cold instance can take up to a minute\u2026")
+  });
+  if (probe.kind !== "ok") {
+    const why = probe.kind === "unreachable" ? probe.detail : probe.kind === "unauthorized" ? `it rejected the credential (HTTP ${probe.status})` : `it answered HTTP ${probe.status} and doesn't look like NEAT`;
+    err(`neat login: "${project.name}" is provisioned, but its daemon isn't answering \u2014 ${why}.`);
+    err(`Nothing was changed. Check the project at ${opts.webUrl} and run \`neat login\` again.`);
+    return probe.kind === "unreachable" ? 3 : 1;
+  }
   await upsertProfile(
     { name: opts.name, endpoint: cred.endpoint, authToken: cred.authToken },
     { makeActive: true, ...deps.home ? { home: deps.home } : {} }
@@ -30236,6 +30597,21 @@ async function runSsoLogin(opts, deps) {
       out(`  OTEL_EXPORTER_OTLP_ENDPOINT=${cred.ingestEndpoint}`);
       out(`  OTEL_EXPORTER_OTLP_HEADERS=Authorization=Bearer ${cred.otelToken}`);
     }
+    await runPostLoginConnect({
+      cpUrl: opts.cpUrl,
+      webUrl: opts.webUrl,
+      accessToken,
+      project: { id: project.id, name: project.name },
+      me,
+      deps: {
+        fetchImpl,
+        out,
+        ...deps.readLine ? { readLine: deps.readLine } : {},
+        ...deps.openBrowser ? { openBrowser: deps.openBrowser } : { openBrowser: defaultOpenBrowser },
+        ...deps.connect ?? {}
+      }
+    });
+    out("");
     out("Run `neat logout` to switch back to your local daemon.");
   }
   return 0;
@@ -30247,7 +30623,7 @@ function defaultOpenBrowser2(url) {
   const cmd = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
   const args = platform === "win32" ? ["/c", "start", "", url] : [url];
   try {
-    const child = (0, import_node_child_process5.spawn)(cmd, args, { detached: true, stdio: "ignore" });
+    const child = (0, import_node_child_process6.spawn)(cmd, args, { detached: true, stdio: "ignore" });
     child.on("error", () => {
     });
     child.unref();
@@ -30342,8 +30718,8 @@ async function runConnectCommand(rawArgs, deps = {}) {
 
 // src/doctor-cli.ts
 init_cjs_shims();
-var import_node_fs54 = require("fs");
-var import_node_path92 = __toESM(require("path"), 1);
+var import_node_fs55 = require("fs");
+var import_node_path93 = __toESM(require("path"), 1);
 
 // src/cli-client.ts
 init_cjs_shims();
@@ -30372,10 +30748,10 @@ function createHttpClient(baseUrl, bearerToken, fetchImpl = fetch) {
   const root = baseUrl.replace(/\/$/, "");
   const authHeader = bearerToken && bearerToken.length > 0 ? { authorization: `Bearer ${bearerToken}` } : {};
   return {
-    async get(path98) {
+    async get(path100) {
       let res;
       try {
-        res = await fetchImpl(`${root}${path98}`, {
+        res = await fetchImpl(`${root}${path100}`, {
           headers: { ...authHeader }
         });
       } catch (err) {
@@ -30387,16 +30763,16 @@ function createHttpClient(baseUrl, bearerToken, fetchImpl = fetch) {
         const body = await res.text().catch(() => "");
         throw new HttpError(
           res.status,
-          `${res.status} ${res.statusText} on GET ${path98}: ${body}`,
+          `${res.status} ${res.statusText} on GET ${path100}: ${body}`,
           body
         );
       }
       return await res.json();
     },
-    async post(path98, body) {
+    async post(path100, body) {
       let res;
       try {
-        res = await fetchImpl(`${root}${path98}`, {
+        res = await fetchImpl(`${root}${path100}`, {
           method: "POST",
           headers: { "content-type": "application/json", ...authHeader },
           body: JSON.stringify(body)
@@ -30410,7 +30786,7 @@ function createHttpClient(baseUrl, bearerToken, fetchImpl = fetch) {
         const text = await res.text().catch(() => "");
         throw new HttpError(
           res.status,
-          `${res.status} ${res.statusText} on POST ${path98}: ${text}`,
+          `${res.status} ${res.statusText} on POST ${path100}: ${text}`,
           text
         );
       }
@@ -30424,12 +30800,12 @@ function projectPath(project, suffix) {
 }
 async function runRootCause(client, input) {
   const qs = input.errorId ? `?errorId=${encodeURIComponent(input.errorId)}` : "";
-  const path98 = projectPath(
+  const path100 = projectPath(
     input.project,
     `/graph/root-cause/${encodeURIComponent(input.errorNode)}${qs}`
   );
   try {
-    const result = await client.get(path98);
+    const result = await client.get(path100);
     const arrowPath = result.traversalPath.join(" \u2190 ");
     const provenances = result.edgeProvenances.length ? result.edgeProvenances.join(", ") : "(direct, no edges traversed)";
     const summary = `Root cause for ${input.errorNode} is ${result.rootCauseNode}. ` + result.rootCauseReason + (result.fixRecommendation ? ` Recommended fix: ${result.fixRecommendation}.` : "");
@@ -30455,12 +30831,12 @@ async function runRootCause(client, input) {
 }
 async function runBlastRadius(client, input) {
   const qs = input.depth !== void 0 ? `?depth=${input.depth}` : "";
-  const path98 = projectPath(
+  const path100 = projectPath(
     input.project,
     `/graph/blast-radius/${encodeURIComponent(input.nodeId)}${qs}`
   );
   try {
-    const result = await client.get(path98);
+    const result = await client.get(path100);
     if (result.totalAffected === 0) {
       return {
         summary: `${result.origin} has no dependents. Nothing else would break if it failed.`
@@ -30494,12 +30870,12 @@ function formatBlastEntry(n) {
 }
 async function runDependencies(client, input) {
   const depth = input.depth ?? 3;
-  const path98 = projectPath(
+  const path100 = projectPath(
     input.project,
     `/graph/dependencies/${encodeURIComponent(input.nodeId)}?depth=${depth}`
   );
   try {
-    const result = await client.get(path98);
+    const result = await client.get(path100);
     if (result.total === 0) {
       return {
         summary: depth === 1 ? `${input.nodeId} has no direct dependencies in the graph.` : `${input.nodeId} has no dependencies (BFS to depth ${depth}).`
@@ -30591,9 +30967,9 @@ function formatDuration(ms) {
   return `${Math.round(h / 24)}d`;
 }
 async function runIncidents(client, input) {
-  const path98 = input.nodeId ? projectPath(input.project, `/incidents/${encodeURIComponent(input.nodeId)}`) : projectPath(input.project, "/incidents");
+  const path100 = input.nodeId ? projectPath(input.project, `/incidents/${encodeURIComponent(input.nodeId)}`) : projectPath(input.project, "/incidents");
   try {
-    const body = await client.get(path98);
+    const body = await client.get(path100);
     const events = body.events;
     if (events.length === 0) {
       return {
@@ -30957,7 +31333,7 @@ function checkNode(nodeVersion) {
 }
 async function neatOutExists(cwd) {
   try {
-    const st = await import_node_fs54.promises.stat(import_node_path92.default.join(cwd, "neat-out"));
+    const st = await import_node_fs55.promises.stat(import_node_path93.default.join(cwd, "neat-out"));
     return st.isDirectory();
   } catch {
     return false;
@@ -31077,9 +31453,6 @@ async function runDoctorCommand(argv, deps = {}) {
 // src/login-cli.ts
 init_cjs_shims();
 var import_promises4 = __toESM(require("readline/promises"), 1);
-var PROBE_ATTEMPT_TIMEOUT_MS = 3e4;
-var PROBE_TOTAL_BUDGET_MS = 12e4;
-var PROBE_RETRY_PAUSE_MS = 2e3;
 var DEFAULT_PROFILE_NAME = "hosted";
 function readFlagValue(argv, i) {
   const arg = argv[i];
@@ -31144,44 +31517,6 @@ function printLoginHelp(out) {
   out('  the profile (default "hosted"); the paste token can also come from NEAT_LOGIN_TOKEN.');
   out("  Exit 0 on success, 1 rejected/needs-action, 2 misuse, 3 unreachable.");
 }
-function isTimeoutError(err) {
-  const name = err?.name;
-  return name === "TimeoutError" || name === "AbortError";
-}
-async function probeOnce(fetchImpl, root, token, timeoutMs) {
-  let res;
-  try {
-    res = await fetchImpl(`${root}/health`, {
-      headers: { authorization: `Bearer ${token}` },
-      signal: AbortSignal.timeout(timeoutMs)
-    });
-  } catch (err) {
-    if (isTimeoutError(err)) return { kind: "timeout" };
-    return { kind: "unreachable", detail: err.message };
-  }
-  if (res.status === 401 || res.status === 403) return { kind: "unauthorized", status: res.status };
-  if (!res.ok) return { kind: "not-neat", status: res.status };
-  const contentType = res.headers.get("content-type") ?? "";
-  if (!contentType.includes("json")) return { kind: "not-neat", status: res.status };
-  return { kind: "ok" };
-}
-async function probeDaemon(fetchImpl, endpoint2, token, hooks) {
-  const root = endpoint2.replace(/\/$/, "");
-  const deadline = hooks.now() + PROBE_TOTAL_BUDGET_MS;
-  let warned = false;
-  for (; ; ) {
-    const result = await probeOnce(fetchImpl, root, token, PROBE_ATTEMPT_TIMEOUT_MS);
-    if (result.kind !== "timeout") return result;
-    if (!warned) {
-      hooks.onWaiting();
-      warned = true;
-    }
-    if (hooks.now() >= deadline) {
-      return { kind: "unreachable", detail: `no response after ${Math.round(PROBE_TOTAL_BUDGET_MS / 1e3)}s` };
-    }
-    await hooks.sleep(PROBE_RETRY_PAUSE_MS);
-  }
-}
 async function runLoginCommand(argv, deps = {}) {
   const out = deps.out ?? ((line) => console.log(line));
   const err = deps.err ?? ((line) => console.error(line));
@@ -31214,8 +31549,13 @@ async function runLoginCommand(argv, deps = {}) {
         fetchImpl,
         out,
         err,
+        readLine,
+        sleep: sleep2,
+        now,
         ...deps.openBrowser ? { openBrowser: deps.openBrowser } : {},
-        ...deps.home ? { home: deps.home } : {}
+        ...deps.home ? { home: deps.home } : {},
+        ...deps.signal ? { signal: deps.signal } : {},
+        ...deps.connect ? { connect: deps.connect } : {}
       }
     );
   }
@@ -31372,6 +31712,8 @@ async function defaultReadSecret(prompt) {
 
 // src/welcome.ts
 init_cjs_shims();
+var import_node_fs56 = require("fs");
+var import_node_path94 = __toESM(require("path"), 1);
 var import_promises5 = __toESM(require("readline/promises"), 1);
 var WORDMARK = [
   "\u2588\u2588\u2588\u2557   \u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557",
@@ -31404,29 +31746,146 @@ function printHeader(out) {
 }
 async function runWelcome(deps = {}) {
   const out = deps.out ?? ((line) => console.log(line));
+  try {
+    return await runFrontDoor(deps, out);
+  } catch (err) {
+    if (isPromptCancelled(err)) {
+      out("");
+      return 130;
+    }
+    throw err;
+  }
+}
+var PromptCancelled = class extends Error {
+  constructor() {
+    super("prompt cancelled");
+    this.name = "PromptCancelled";
+  }
+};
+function isPromptCancelled(err) {
+  if (err instanceof PromptCancelled) return true;
+  const e = err;
+  return e?.code === "ABORT_ERR" || e?.name === "AbortError";
+}
+async function runFrontDoor(deps, out) {
   const readLine = deps.readLine ?? defaultReadLine2;
   const login = deps.login ?? (() => Promise.resolve(0));
   const orchestrator = deps.orchestrator ?? (() => Promise.resolve(0));
   const cwd = deps.cwd ?? process.cwd();
+  const flagGiven = deps.instrumentFlagGiven ?? false;
+  const readRegistry2 = deps.readRegistry ?? (() => readRegistry());
   printHeader(out);
   out("Welcome to NEAT. Let's get you a graph of this system.");
   out("");
-  out("  1) I have a NEAT account \u2014 log in");
-  out("  2) Self-hosted \u2014 set up NEAT on this machine");
+  const keyReader = deps.readKey !== void 0 ? { read: deps.readKey, done: () => {
+  } } : createKeyReader();
+  const picked = keyReader !== null ? await selectOption(out, keyReader, deps.moveCursorUp ?? defaultMoveCursorUp) : await selectByNumber(out, readLine);
+  if (picked === void 0) return runSelfHosted(out, readLine, orchestrator, cwd, readRegistry2, flagGiven);
+  if (picked === 0) return login(["--browser"]);
+  return runSelfHosted(out, readLine, orchestrator, cwd, readRegistry2, flagGiven);
+}
+var MENU_OPTIONS = [
+  "Log me into Hosted Neat",
+  "I'd like to self-host or use it locally (copy a prompt)"
+];
+async function selectOption(out, reader, moveCursorUp) {
+  let cursor = 0;
+  const render = () => {
+    for (const [i, label] of MENU_OPTIONS.entries()) {
+      out(i === cursor ? `  \u276F ${i + 1}) ${label}` : `    ${i + 1}) ${label}`);
+    }
+  };
+  try {
+    render();
+    out("");
+    out("  \u2191/\u2193 to move \xB7 Enter to choose \xB7 1 or 2 to jump");
+    for (; ; ) {
+      const key = await reader.read();
+      if (key === void 0) return void 0;
+      if (key === "cancel") throw new PromptCancelled();
+      if (key === "enter") return cursor;
+      if (key === "select-1") return 0;
+      if (key === "select-2") return 1;
+      if (key === "up") cursor = (cursor + MENU_OPTIONS.length - 1) % MENU_OPTIONS.length;
+      else if (key === "down") cursor = (cursor + 1) % MENU_OPTIONS.length;
+      else continue;
+      moveCursorUp(MENU_OPTIONS.length + 2);
+      render();
+      out("");
+      out("  \u2191/\u2193 to move \xB7 Enter to choose \xB7 1 or 2 to jump");
+    }
+  } finally {
+    reader.done();
+  }
+}
+async function selectByNumber(out, readLine) {
+  for (const [i, label] of MENU_OPTIONS.entries()) out(`  ${i + 1}) ${label}`);
   out("");
   for (; ; ) {
     const choice = (await readLine("Choose 1 or 2 (default 2): "))?.trim();
-    if (choice === void 0) return runSelfHosted(out, readLine, orchestrator, cwd);
-    if (choice === "1") {
-      return login(["--browser"]);
-    }
-    if (choice === "2" || choice === "") {
-      return runSelfHosted(out, readLine, orchestrator, cwd);
-    }
-    out(`"${choice}" isn't 1 or 2 \u2014 try again, or press Enter for self-hosted.`);
+    if (choice === void 0) return void 0;
+    if (choice === "1") return 0;
+    if (choice === "2" || choice === "") return 1;
+    out(`"${choice}" isn't 1 or 2 \u2014 try again, or press Enter for the local path.`);
   }
 }
-async function runSelfHosted(out, readLine, orchestrator, cwd) {
+function createKeyReader() {
+  const stdin = process.stdin;
+  if (!stdin.isTTY || typeof stdin.setRawMode !== "function") return null;
+  stdin.setRawMode(true);
+  stdin.resume();
+  let closed = false;
+  let ended = false;
+  const markEnded = () => {
+    ended = true;
+  };
+  stdin.once("end", markEnded);
+  stdin.once("close", markEnded);
+  return {
+    read: () => new Promise((resolve) => {
+      if (ended) {
+        resolve(void 0);
+        return;
+      }
+      const finish = (value) => {
+        stdin.removeListener("data", onData);
+        stdin.removeListener("end", onClosed);
+        stdin.removeListener("close", onClosed);
+        resolve(value);
+      };
+      const onData = (buf) => finish(decodeKey(buf));
+      const onClosed = () => {
+        ended = true;
+        finish(void 0);
+      };
+      stdin.on("data", onData);
+      stdin.once("end", onClosed);
+      stdin.once("close", onClosed);
+    }),
+    done: () => {
+      if (closed) return;
+      closed = true;
+      stdin.removeListener("end", markEnded);
+      stdin.removeListener("close", markEnded);
+      stdin.setRawMode(false);
+      stdin.pause();
+    }
+  };
+}
+function decodeKey(buf) {
+  const s = buf.toString("utf8");
+  if (s === "\x1B[A" || s === "k") return "up";
+  if (s === "\x1B[B" || s === "j") return "down";
+  if (s === "\r" || s === "\n") return "enter";
+  if (s === "1") return "select-1";
+  if (s === "2") return "select-2";
+  if (s === "" || s === "\x1B") return "cancel";
+  return "ignore";
+}
+function defaultMoveCursorUp(rows) {
+  if (rows > 0) process.stdout.write(`\x1B[${rows}A`);
+}
+async function runSelfHosted(out, readLine, orchestrator, cwd, readRegistry2, instrumentFlagGiven) {
   const wantsPrompt = (await readLine("Print a copy-paste setup prompt for your coding agent? [Y/n]: "))?.trim().toLowerCase();
   if (wantsPrompt !== "n" && wantsPrompt !== "no") {
     out("");
@@ -31437,18 +31896,91 @@ async function runSelfHosted(out, readLine, orchestrator, cwd) {
     out("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
     out("");
   }
+  const project = await resolveProjectName(out, readLine, cwd, readRegistry2);
+  const declined = instrumentFlagGiven ? void 0 : await askToInstrument(out, readLine);
   out("Building your local graph now\u2026");
   out("");
-  return orchestrator(cwd);
+  const overrides = {
+    ...project !== void 0 ? { project } : {},
+    ...declined === void 0 ? {} : declined ? { noInstrument: true } : { yes: true }
+  };
+  return orchestrator(cwd, Object.keys(overrides).length > 0 ? overrides : void 0);
+}
+async function askToInstrument(out, readLine) {
+  out("Instrument the services for OpenTelemetry now?");
+  out("This edits package.json / requirements.txt / go.mod and runs the package manager.");
+  const answer = (await readLine("[Y/n]: "))?.trim().toLowerCase();
+  const declined = answer === "n" || answer === "no";
+  if (declined) {
+    out("");
+    out("Skipping instrumentation \u2014 the graph will hold the declared side only.");
+    out("Run `neat init . --apply` when you want the runtime half.");
+  }
+  out("");
+  return declined;
+}
+async function resolveProjectName(out, readLine, cwd, readRegistry2) {
+  const here = import_node_path94.default.resolve(cwd);
+  const base = import_node_path94.default.basename(here);
+  let taken;
+  try {
+    const { projects } = await readRegistry2();
+    taken = new Map(projects.map((p) => [p.name, p.path]));
+  } catch {
+    return void 0;
+  }
+  const clash = taken.get(base);
+  if (clash === void 0 || import_node_path94.default.resolve(clash) === here) return void 0;
+  out("");
+  out(`A project named \`${base}\` is already registered (${clash}).`);
+  const suggested = firstFreeName(base, taken);
+  for (; ; ) {
+    const answer = (await readLine(`Name this one: [${suggested}] `))?.trim();
+    if (answer === void 0) return suggested;
+    const chosen = answer.length === 0 ? suggested : answer;
+    if (!isUsableProjectName(chosen)) {
+      out(`"${chosen}" won't work as a project name \u2014 letters, digits, dot, dash and underscore.`);
+      continue;
+    }
+    const other = taken.get(chosen);
+    if (other !== void 0 && import_node_path94.default.resolve(other) !== here) {
+      out(`\`${chosen}\` is registered too (${other}).`);
+      continue;
+    }
+    out("");
+    return chosen;
+  }
+}
+function firstFreeName(base, taken) {
+  for (let n = 2; ; n++) {
+    const candidate = `${base}-${n}`;
+    if (!taken.has(candidate)) return candidate;
+  }
+}
+function isUsableProjectName(name) {
+  return name.length > 0 && name !== "." && name !== ".." && /^[A-Za-z0-9._-]+$/.test(name);
 }
 async function shouldShowWelcome(deps = {}) {
   const stdinTTY = deps.stdinIsTTY ?? Boolean(process.stdin.isTTY);
   const stdoutTTY = deps.stdoutIsTTY ?? Boolean(process.stdout.isTTY);
   if (!stdinTTY || !stdoutTTY) return false;
-  const readProfiles = deps.readProfiles ?? (() => readProfilesConfig());
+  const cwd = deps.cwd ?? process.cwd();
+  const readRegistry2 = deps.readRegistry ?? (() => readRegistry());
+  const hasSnapshot = deps.hasSnapshot ?? defaultHasSnapshot;
+  try {
+    const here = import_node_path94.default.resolve(cwd);
+    const { projects } = await readRegistry2();
+    if (projects.some((p) => import_node_path94.default.resolve(p.path) === here)) return false;
+    if (await hasSnapshot(here)) return false;
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function defaultHasSnapshot(cwd) {
   try {
-    const { profiles } = await readProfiles();
-    return profiles.length === 0;
+    const entries = await import_node_fs56.promises.readdir(import_node_path94.default.join(cwd, "neat-out"));
+    return entries.some((e) => e.endsWith(".json"));
   } catch {
     return false;
   }
@@ -31465,27 +31997,27 @@ async function defaultReadLine2(prompt) {
 
 // src/hooks-cli.ts
 init_cjs_shims();
-var import_node_path93 = __toESM(require("path"), 1);
+var import_node_path95 = __toESM(require("path"), 1);
 var import_node_os8 = __toESM(require("os"), 1);
-var import_node_fs55 = require("fs");
+var import_node_fs57 = require("fs");
 var import_node_url5 = require("url");
 var HOOK_FILENAME = "neat-search-nudge.mjs";
 var GUIDE_FILENAME = "GRAPH_FIRST.md";
 var GUIDE_INSTALL_NAME = "neat-graph-first.md";
 var HOOK_MATCHER = "Grep|Glob|Bash";
 function moduleDir() {
-  return typeof __dirname !== "undefined" ? __dirname : import_node_path93.default.dirname((0, import_node_url5.fileURLToPath)(importMetaUrl));
+  return typeof __dirname !== "undefined" ? __dirname : import_node_path95.default.dirname((0, import_node_url5.fileURLToPath)(importMetaUrl));
 }
 async function readSkillAsset(rel) {
   const here = moduleDir();
   const candidates = [
-    import_node_path93.default.resolve(here, "../../claude-skill", rel),
-    import_node_path93.default.resolve(here, "../../../claude-skill", rel),
-    import_node_path93.default.resolve(here, "../claude-skill", rel)
+    import_node_path95.default.resolve(here, "../../claude-skill", rel),
+    import_node_path95.default.resolve(here, "../../../claude-skill", rel),
+    import_node_path95.default.resolve(here, "../claude-skill", rel)
   ];
   for (const candidate of candidates) {
     try {
-      return await import_node_fs55.promises.readFile(candidate, "utf8");
+      return await import_node_fs57.promises.readFile(candidate, "utf8");
     } catch {
     }
   }
@@ -31495,20 +32027,20 @@ async function readSkillAsset(rel) {
 }
 function neatHome4() {
   const override = process.env.NEAT_HOME;
-  if (override && override.length > 0) return import_node_path93.default.resolve(override);
-  return import_node_path93.default.join(import_node_os8.default.homedir(), ".neat");
+  if (override && override.length > 0) return import_node_path95.default.resolve(override);
+  return import_node_path95.default.join(import_node_os8.default.homedir(), ".neat");
 }
 function claudeSettingsPath() {
   const override = process.env.NEAT_CLAUDE_SETTINGS;
-  if (override && override.length > 0) return import_node_path93.default.resolve(override);
+  if (override && override.length > 0) return import_node_path95.default.resolve(override);
   const home = process.env.HOME ?? process.env.USERPROFILE ?? import_node_os8.default.homedir();
-  return import_node_path93.default.join(home, ".claude", "settings.json");
+  return import_node_path95.default.join(home, ".claude", "settings.json");
 }
 function installedHookPath() {
-  return import_node_path93.default.join(neatHome4(), "hooks", HOOK_FILENAME);
+  return import_node_path95.default.join(neatHome4(), "hooks", HOOK_FILENAME);
 }
 function gateFlagPath() {
-  return import_node_path93.default.join(neatHome4(), "hooks", "gate-enabled");
+  return import_node_path95.default.join(neatHome4(), "hooks", "gate-enabled");
 }
 function isNeatSearchEntry(entry2) {
   return (entry2.hooks ?? []).some(
@@ -31541,14 +32073,14 @@ async function runHooks(opts) {
     const hookScript = await readSkillAsset(`hooks/${HOOK_FILENAME}`);
     const guide = await readSkillAsset(GUIDE_FILENAME);
     const scriptPath = installedHookPath();
-    await import_node_fs55.promises.mkdir(import_node_path93.default.dirname(scriptPath), { recursive: true });
-    await import_node_fs55.promises.writeFile(scriptPath, hookScript, { mode: 493 });
-    const guidePath = import_node_path93.default.join(neatHome4(), GUIDE_INSTALL_NAME);
-    await import_node_fs55.promises.writeFile(guidePath, guide, "utf8");
+    await import_node_fs57.promises.mkdir(import_node_path95.default.dirname(scriptPath), { recursive: true });
+    await import_node_fs57.promises.writeFile(scriptPath, hookScript, { mode: 493 });
+    const guidePath = import_node_path95.default.join(neatHome4(), GUIDE_INSTALL_NAME);
+    await import_node_fs57.promises.writeFile(guidePath, guide, "utf8");
     const settingsFile = claudeSettingsPath();
     let settings = {};
     try {
-      settings = JSON.parse(await import_node_fs55.promises.readFile(settingsFile, "utf8"));
+      settings = JSON.parse(await import_node_fs57.promises.readFile(settingsFile, "utf8"));
     } catch (err) {
       if (err.code !== "ENOENT") {
         console.error(
@@ -31570,14 +32102,14 @@ async function runHooks(opts) {
       ...settings,
       hooks: { ...hooks, PreToolUse: preToolUse }
     };
-    await import_node_fs55.promises.mkdir(import_node_path93.default.dirname(settingsFile), { recursive: true });
-    await import_node_fs55.promises.writeFile(settingsFile, JSON.stringify(merged, null, 2) + "\n", "utf8");
+    await import_node_fs57.promises.mkdir(import_node_path95.default.dirname(settingsFile), { recursive: true });
+    await import_node_fs57.promises.writeFile(settingsFile, JSON.stringify(merged, null, 2) + "\n", "utf8");
     const flag = gateFlagPath();
     if (opts.gate) {
-      await import_node_fs55.promises.mkdir(import_node_path93.default.dirname(flag), { recursive: true });
-      await import_node_fs55.promises.writeFile(flag, "1\n", "utf8");
+      await import_node_fs57.promises.mkdir(import_node_path95.default.dirname(flag), { recursive: true });
+      await import_node_fs57.promises.writeFile(flag, "1\n", "utf8");
     } else {
-      await import_node_fs55.promises.rm(flag, { force: true });
+      await import_node_fs57.promises.rm(flag, { force: true });
     }
     const mode = opts.gate ? "GATE (deny search until you ask the graph)" : "nudge (search still runs)";
     console.log(`neat hooks: installed the search hook in ${opts.gate ? "gate" : "nudge"} mode`);
@@ -31667,8 +32199,8 @@ async function runHooksCommand(args) {
 
 // src/claude-cli.ts
 init_cjs_shims();
-var import_node_path94 = __toESM(require("path"), 1);
-var import_node_fs56 = require("fs");
+var import_node_path96 = __toESM(require("path"), 1);
+var import_node_fs58 = require("fs");
 var NEAT_SECTION_HEADING = "## neat";
 var NEAT_DIRECTIVE_BODY = `This project has NEAT wired in: a live, fused semantic graph of the system \u2014
 code and runtime behaviour (OpenTelemetry) in one model, every fact tagged with
@@ -31702,8 +32234,8 @@ ${NEAT_DIRECTIVE_BODY}
 }
 function claudeMdPath() {
   const override = process.env.NEAT_CLAUDE_MD;
-  if (override && override.length > 0) return import_node_path94.default.resolve(override);
-  return import_node_path94.default.join(process.cwd(), "CLAUDE.md");
+  if (override && override.length > 0) return import_node_path96.default.resolve(override);
+  return import_node_path96.default.join(process.cwd(), "CLAUDE.md");
 }
 function splitAroundSection(raw) {
   const lines = raw.split("\n");
@@ -31731,7 +32263,7 @@ function compose(before, after) {
 }
 async function readIfExists2(file) {
   try {
-    return await import_node_fs56.promises.readFile(file, "utf8");
+    return await import_node_fs58.promises.readFile(file, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return null;
     throw err;
@@ -31742,8 +32274,8 @@ async function runInstall() {
   const raw = await readIfExists2(file) ?? "";
   const { before, after, found } = splitAroundSection(raw);
   const next = compose(before, after);
-  await import_node_fs56.promises.mkdir(import_node_path94.default.dirname(file), { recursive: true });
-  await import_node_fs56.promises.writeFile(file, next, "utf8");
+  await import_node_fs58.promises.mkdir(import_node_path96.default.dirname(file), { recursive: true });
+  await import_node_fs58.promises.writeFile(file, next, "utf8");
   const verb = raw.length === 0 ? "created" : found ? "refreshed" : "added";
   console.log(`neat claude: ${verb} the \`${NEAT_SECTION_HEADING}\` section in ${file}`);
   console.log("Your agent will now reach for `neat ask` before Read/Grep/Bash. Restart the");
@@ -31764,7 +32296,7 @@ async function runUninstall() {
   }
   const remaining = [before, after].filter((s) => s.length > 0).join("\n\n");
   const next = remaining.length > 0 ? remaining.replace(/\n*$/, "") + "\n" : "";
-  await import_node_fs56.promises.writeFile(file, next, "utf8");
+  await import_node_fs58.promises.writeFile(file, next, "utf8");
   console.log(`neat claude: removed the \`${NEAT_SECTION_HEADING}\` section from ${file}.`);
   return { exitCode: 0 };
 }
@@ -31807,10 +32339,10 @@ async function runClaudeCommand(args) {
 
 // src/codex-cli.ts
 init_cjs_shims();
-var import_node_path95 = __toESM(require("path"), 1);
+var import_node_path97 = __toESM(require("path"), 1);
 var import_node_os9 = __toESM(require("os"), 1);
-var import_node_fs57 = require("fs");
-var import_node_util = require("util");
+var import_node_fs59 = require("fs");
+var import_node_util2 = require("util");
 var import_smol_toml6 = require("smol-toml");
 var CODEX_MCP_SERVER = {
   command: "npx",
@@ -31827,14 +32359,14 @@ var NEAT_GRAPH_FIRST_START = "<!-- neat:graph-first -->";
 var NEAT_GRAPH_FIRST_END = "<!-- /neat:graph-first -->";
 function codexConfigPath() {
   const override = process.env.NEAT_CODEX_CONFIG;
-  if (override && override.length > 0) return import_node_path95.default.resolve(override);
+  if (override && override.length > 0) return import_node_path97.default.resolve(override);
   const home = process.env.HOME ?? process.env.USERPROFILE ?? import_node_os9.default.homedir();
-  return import_node_path95.default.join(home, ".codex", "config.toml");
+  return import_node_path97.default.join(home, ".codex", "config.toml");
 }
 function agentsFilePath() {
   const override = process.env.NEAT_CODEX_AGENTS;
-  if (override && override.length > 0) return import_node_path95.default.resolve(override);
-  return import_node_path95.default.join(process.cwd(), "AGENTS.md");
+  if (override && override.length > 0) return import_node_path97.default.resolve(override);
+  return import_node_path97.default.join(process.cwd(), "AGENTS.md");
 }
 function isTableHeader(line) {
   return /^\s*\[\[?[^\]]+\]\]?\s*$/.test(line);
@@ -31911,17 +32443,17 @@ function verifyPreserved(raw, spliced, original) {
   }
   const origServers = original.mcp_servers ?? {};
   const nextServers = next.mcp_servers ?? {};
-  if (!(0, import_node_util.isDeepStrictEqual)(nextServers.neat, CODEX_MCP_SERVER)) return false;
+  if (!(0, import_node_util2.isDeepStrictEqual)(nextServers.neat, CODEX_MCP_SERVER)) return false;
   for (const name of Object.keys(origServers)) {
     if (name === "neat") continue;
-    if (!(0, import_node_util.isDeepStrictEqual)(nextServers[name], origServers[name])) return false;
+    if (!(0, import_node_util2.isDeepStrictEqual)(nextServers[name], origServers[name])) return false;
   }
   for (const name of Object.keys(nextServers)) {
     if (name !== "neat" && !(name in origServers)) return false;
   }
   for (const key of Object.keys(original)) {
     if (key === "mcp_servers") continue;
-    if (!(0, import_node_util.isDeepStrictEqual)(next[key], original[key])) return false;
+    if (!(0, import_node_util2.isDeepStrictEqual)(next[key], original[key])) return false;
   }
   for (const key of Object.keys(next)) {
     if (key !== "mcp_servers" && !(key in original)) return false;
@@ -31968,7 +32500,7 @@ async function runCodex(opts) {
   const agentsPath = agentsFilePath();
   let configRaw = "";
   try {
-    configRaw = await import_node_fs57.promises.readFile(configPath, "utf8");
+    configRaw = await import_node_fs59.promises.readFile(configPath, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") {
       console.error(`neat codex: failed to read ${configPath} \u2014 ${err.message}`);
@@ -31977,7 +32509,7 @@ async function runCodex(opts) {
   }
   let agentsRaw = "";
   try {
-    agentsRaw = await import_node_fs57.promises.readFile(agentsPath, "utf8");
+    agentsRaw = await import_node_fs59.promises.readFile(agentsPath, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") {
       console.error(`neat codex: failed to read ${agentsPath} \u2014 ${err.message}`);
@@ -32017,15 +32549,15 @@ async function runCodex(opts) {
     return { exitCode: 0 };
   }
   if (config.changed) {
-    await import_node_fs57.promises.mkdir(import_node_path95.default.dirname(configPath), { recursive: true });
-    await import_node_fs57.promises.writeFile(configPath, config.text, "utf8");
+    await import_node_fs59.promises.mkdir(import_node_path97.default.dirname(configPath), { recursive: true });
+    await import_node_fs59.promises.writeFile(configPath, config.text, "utf8");
     console.log(`neat codex: wrote [mcp_servers.neat] to ${configPath}`);
   } else {
     console.log(`neat codex: ${configPath} already has NEAT's MCP server`);
   }
   if (agents.changed) {
-    await import_node_fs57.promises.mkdir(import_node_path95.default.dirname(agentsPath), { recursive: true });
-    await import_node_fs57.promises.writeFile(agentsPath, agents.text, "utf8");
+    await import_node_fs59.promises.mkdir(import_node_path97.default.dirname(agentsPath), { recursive: true });
+    await import_node_fs59.promises.writeFile(agentsPath, agents.text, "utf8");
     console.log(`neat codex: wrote the graph-first block to ${agentsPath}`);
   } else {
     console.log(`neat codex: ${agentsPath} already has the graph-first block`);
@@ -32082,10 +32614,10 @@ async function runCodexCommand(args) {
 
 // src/editors-cli.ts
 init_cjs_shims();
-var import_node_path96 = __toESM(require("path"), 1);
+var import_node_path98 = __toESM(require("path"), 1);
 var import_node_os10 = __toESM(require("os"), 1);
-var import_node_fs58 = require("fs");
-var import_node_util2 = require("util");
+var import_node_fs60 = require("fs");
+var import_node_util3 = require("util");
 var jsonc = __toESM(require("jsonc-parser"), 1);
 var NEAT_MCP_SERVER = {
   command: "npx",
@@ -32108,17 +32640,17 @@ function homeDir() {
 }
 function xdgConfigDir() {
   const xdg = process.env.XDG_CONFIG_HOME;
-  return xdg && xdg.length > 0 ? import_node_path96.default.resolve(xdg) : import_node_path96.default.join(homeDir(), ".config");
+  return xdg && xdg.length > 0 ? import_node_path98.default.resolve(xdg) : import_node_path98.default.join(homeDir(), ".config");
 }
 function envOverride(name) {
   const v = process.env[name];
-  return v && v.length > 0 ? import_node_path96.default.resolve(v) : void 0;
+  return v && v.length > 0 ? import_node_path98.default.resolve(v) : void 0;
 }
 var CURSOR_CLIENT = {
   id: "cursor",
   label: "Cursor",
   docsUrl: "https://docs.cursor.com/context/mcp",
-  mcpConfigPath: () => envOverride("NEAT_CURSOR_CONFIG") ?? import_node_path96.default.join(homeDir(), ".cursor", "mcp.json"),
+  mcpConfigPath: () => envOverride("NEAT_CURSOR_CONFIG") ?? import_node_path98.default.join(homeDir(), ".cursor", "mcp.json"),
   mcpContainerKey: "mcpServers",
   format: "json",
   // Cursor still reads a single `.cursorrules` at the project root (the modern
@@ -32130,7 +32662,7 @@ var DEVIN_CLIENT = {
   id: "devin",
   label: "Devin Desktop (Cascade)",
   docsUrl: "https://docs.devin.ai/desktop/cascade/mcp",
-  mcpConfigPath: () => envOverride("NEAT_DEVIN_CONFIG") ?? import_node_path96.default.join(homeDir(), ".codeium", "windsurf", "mcp_config.json"),
+  mcpConfigPath: () => envOverride("NEAT_DEVIN_CONFIG") ?? import_node_path98.default.join(homeDir(), ".codeium", "windsurf", "mcp_config.json"),
   mcpContainerKey: "mcpServers",
   format: "json",
   rulesFileName: ".windsurfrules"
@@ -32139,7 +32671,7 @@ var GEMINI_CLIENT = {
   id: "gemini",
   label: "Gemini CLI",
   docsUrl: "https://github.com/google-gemini/gemini-cli/blob/main/docs/tools/mcp-server.md",
-  mcpConfigPath: () => envOverride("NEAT_GEMINI_CONFIG") ?? import_node_path96.default.join(homeDir(), ".gemini", "settings.json"),
+  mcpConfigPath: () => envOverride("NEAT_GEMINI_CONFIG") ?? import_node_path98.default.join(homeDir(), ".gemini", "settings.json"),
   mcpContainerKey: "mcpServers",
   format: "json",
   rulesFileName: "GEMINI.md"
@@ -32148,7 +32680,7 @@ var QWEN_CLIENT = {
   id: "qwen",
   label: "Qwen Code",
   docsUrl: "https://qwenlm.github.io/qwen-code-docs/en/users/features/mcp/",
-  mcpConfigPath: () => envOverride("NEAT_QWEN_CONFIG") ?? import_node_path96.default.join(homeDir(), ".qwen", "settings.json"),
+  mcpConfigPath: () => envOverride("NEAT_QWEN_CONFIG") ?? import_node_path98.default.join(homeDir(), ".qwen", "settings.json"),
   mcpContainerKey: "mcpServers",
   format: "json",
   rulesFileName: "QWEN.md"
@@ -32157,7 +32689,7 @@ var AMAZONQ_CLIENT = {
   id: "amazonq",
   label: "Amazon Q Developer CLI",
   docsUrl: "https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/command-line-mcp-configuration.html",
-  mcpConfigPath: () => envOverride("NEAT_AMAZONQ_CONFIG") ?? import_node_path96.default.join(homeDir(), ".aws", "amazonq", "mcp.json"),
+  mcpConfigPath: () => envOverride("NEAT_AMAZONQ_CONFIG") ?? import_node_path98.default.join(homeDir(), ".aws", "amazonq", "mcp.json"),
   mcpContainerKey: "mcpServers",
   format: "json"
 };
@@ -32165,7 +32697,7 @@ var ROOCODE_CLIENT = {
   id: "roocode",
   label: "Roo Code",
   docsUrl: "https://roocodeinc.github.io/Roo-Code/features/mcp/using-mcp-in-roo",
-  mcpConfigPath: () => envOverride("NEAT_ROOCODE_CONFIG") ?? import_node_path96.default.join(process.cwd(), ".roo", "mcp.json"),
+  mcpConfigPath: () => envOverride("NEAT_ROOCODE_CONFIG") ?? import_node_path98.default.join(process.cwd(), ".roo", "mcp.json"),
   mcpContainerKey: "mcpServers",
   format: "json"
 };
@@ -32178,9 +32710,9 @@ var ZED_CLIENT = {
     if (override) return override;
     if (process.platform === "win32") {
       const appData = process.env.APPDATA;
-      if (appData && appData.length > 0) return import_node_path96.default.join(appData, "Zed", "settings.json");
+      if (appData && appData.length > 0) return import_node_path98.default.join(appData, "Zed", "settings.json");
     }
-    return import_node_path96.default.join(homeDir(), ".config", "zed", "settings.json");
+    return import_node_path98.default.join(homeDir(), ".config", "zed", "settings.json");
   },
   mcpContainerKey: "context_servers",
   format: "jsonc",
@@ -32190,7 +32722,7 @@ var OPENCODE_CLIENT = {
   id: "opencode",
   label: "OpenCode",
   docsUrl: "https://opencode.ai/docs/mcp-servers/",
-  mcpConfigPath: () => envOverride("NEAT_OPENCODE_CONFIG") ?? import_node_path96.default.join(xdgConfigDir(), "opencode", "opencode.json"),
+  mcpConfigPath: () => envOverride("NEAT_OPENCODE_CONFIG") ?? import_node_path98.default.join(xdgConfigDir(), "opencode", "opencode.json"),
   mcpContainerKey: "mcp",
   format: "json",
   serverEntry: NEAT_OPENCODE_SERVER,
@@ -32200,7 +32732,7 @@ var CRUSH_CLIENT = {
   id: "crush",
   label: "Crush",
   docsUrl: "https://charmbracelet-crush.mintlify.app/configuration/mcp",
-  mcpConfigPath: () => envOverride("NEAT_CRUSH_CONFIG") ?? import_node_path96.default.join(xdgConfigDir(), "crush", "crush.json"),
+  mcpConfigPath: () => envOverride("NEAT_CRUSH_CONFIG") ?? import_node_path98.default.join(xdgConfigDir(), "crush", "crush.json"),
   mcpContainerKey: "mcp",
   format: "json",
   serverEntry: NEAT_CRUSH_SERVER,
@@ -32219,7 +32751,7 @@ var CLIENTS = {
 };
 function mergeJsonMcp(existing, containerKey, serverEntry) {
   const servers = existing[containerKey] ?? {};
-  const already = (0, import_node_util2.isDeepStrictEqual)(servers.neat, serverEntry);
+  const already = (0, import_node_util3.isDeepStrictEqual)(servers.neat, serverEntry);
   const merged = {
     ...existing,
     [containerKey]: { ...servers, neat: serverEntry }
@@ -32230,7 +32762,7 @@ function mergeJsoncMcp(raw, containerKey, serverEntry) {
   const base = raw.trim().length > 0 ? raw : "{}";
   const parsed = jsonc.parse(base) ?? {};
   const servers = parsed[containerKey] ?? {};
-  if ((0, import_node_util2.isDeepStrictEqual)(servers.neat, serverEntry)) {
+  if ((0, import_node_util3.isDeepStrictEqual)(servers.neat, serverEntry)) {
     return { text: raw, changed: false };
   }
   const edits = jsonc.modify(base, [containerKey, "neat"], serverEntry, {
@@ -32263,7 +32795,7 @@ async function planMcp(client, mcpPath) {
   const serverEntry = client.serverEntry ?? NEAT_MCP_SERVER;
   let raw = "";
   try {
-    raw = await import_node_fs58.promises.readFile(mcpPath, "utf8");
+    raw = await import_node_fs60.promises.readFile(mcpPath, "utf8");
   } catch (err) {
     const e = err;
     if (e.code === "ENOENT") {
@@ -32305,7 +32837,7 @@ async function runEditorInstall(client, opts) {
   const mcpPath = client.mcpConfigPath();
   const serverEntry = client.serverEntry ?? NEAT_MCP_SERVER;
   const hasRules = typeof client.rulesFileName === "string";
-  const rulesPath = hasRules ? import_node_path96.default.join(opts.projectDir, client.rulesFileName) : "";
+  const rulesPath = hasRules ? import_node_path98.default.join(opts.projectDir, client.rulesFileName) : "";
   const mcp = await planMcp(client, mcpPath);
   if (mcp === null) return { exitCode: 1 };
   let existingRules = "";
@@ -32314,7 +32846,7 @@ async function runEditorInstall(client, opts) {
   let block = "";
   if (hasRules) {
     try {
-      existingRules = await import_node_fs58.promises.readFile(rulesPath, "utf8");
+      existingRules = await import_node_fs60.promises.readFile(rulesPath, "utf8");
     } catch (err) {
       if (err.code !== "ENOENT") {
         console.error(`neat ${client.id}: failed to read ${rulesPath} \u2014 ${err.message}`);
@@ -32348,11 +32880,11 @@ async function runEditorInstall(client, opts) {
     );
     return { exitCode: 0 };
   }
-  await import_node_fs58.promises.mkdir(import_node_path96.default.dirname(mcpPath), { recursive: true });
-  await import_node_fs58.promises.writeFile(mcpPath, mcp.text, "utf8");
+  await import_node_fs60.promises.mkdir(import_node_path98.default.dirname(mcpPath), { recursive: true });
+  await import_node_fs60.promises.writeFile(mcpPath, mcp.text, "utf8");
   if (hasRules) {
-    await import_node_fs58.promises.mkdir(import_node_path96.default.dirname(rulesPath), { recursive: true });
-    await import_node_fs58.promises.writeFile(rulesPath, newRules, "utf8");
+    await import_node_fs60.promises.mkdir(import_node_path98.default.dirname(rulesPath), { recursive: true });
+    await import_node_fs60.promises.writeFile(rulesPath, newRules, "utf8");
   }
   console.log(`neat ${client.id}: wired NEAT into ${client.label}`);
   console.log(`  MCP server: ${mcpPath} (${client.mcpContainerKey}.neat \u2192 npx -y @neat.is/mcp)`);
@@ -32854,7 +33386,7 @@ function sleep(ms, signal) {
 
 // src/cli-verbs.ts
 init_cjs_shims();
-var import_node_path97 = __toESM(require("path"), 1);
+var import_node_path99 = __toESM(require("path"), 1);
 async function resolveProjectEntry(opts) {
   const entries = await listProjects();
   if (opts.project) {
@@ -32864,7 +33396,7 @@ async function resolveProjectEntry(opts) {
   const cwd = opts.cwd ?? process.cwd();
   const resolvedCwd = await normalizeProjectPath(cwd);
   for (const entry2 of entries) {
-    if (resolvedCwd === entry2.path || resolvedCwd.startsWith(`${entry2.path}${import_node_path97.default.sep}`)) {
+    if (resolvedCwd === entry2.path || resolvedCwd.startsWith(`${entry2.path}${import_node_path99.default.sep}`)) {
       return entry2;
     }
   }
@@ -33039,6 +33571,7 @@ async function runSync(opts) {
 
 // src/cli.ts
 var import_types112 = require("@neat.is/types");
+init_auth();
 function usage5() {
   const neat = commandPrefix();
   console.log("Installed via npx? Prefix commands with `npx neat.is`, or install once: `npm i -g neat.is`.");
@@ -33441,7 +33974,7 @@ async function buildPatchSections(services, project) {
 }
 async function runInit(opts) {
   const written = [];
-  const stat = await import_node_fs59.promises.stat(opts.scanPath).catch(() => null);
+  const stat = await import_node_fs61.promises.stat(opts.scanPath).catch(() => null);
   if (!stat || !stat.isDirectory()) {
     console.error(`neat init: ${opts.scanPath} is not a directory`);
     return { exitCode: 2, writtenFiles: written };
@@ -33450,13 +33983,13 @@ async function runInit(opts) {
   printDiscoveryReport(opts, services);
   const sections = opts.noInstall ? [] : await buildPatchSections(services, opts.project);
   const patch = renderPatch(sections);
-  const patchPath = import_node_path98.default.join(opts.scanPath, "neat.patch");
+  const patchPath = import_node_path100.default.join(opts.scanPath, "neat.patch");
   if (opts.dryRun) {
-    await import_node_fs59.promises.writeFile(patchPath, patch, "utf8");
+    await import_node_fs61.promises.writeFile(patchPath, patch, "utf8");
     written.push(patchPath);
     console.log(`dry-run: patch written to ${patchPath}`);
-    const gitignorePath = import_node_path98.default.join(opts.scanPath, ".gitignore");
-    const gitignoreExists = await import_node_fs59.promises.stat(gitignorePath).then(() => true).catch(() => false);
+    const gitignorePath = import_node_path100.default.join(opts.scanPath, ".gitignore");
+    const gitignoreExists = await import_node_fs61.promises.stat(gitignorePath).then(() => true).catch(() => false);
     const verb = gitignoreExists ? "append" : "create";
     console.log(`dry-run: would ${verb} ${gitignorePath} (add neat-out/)`);
     console.log("rerun without --dry-run to register and snapshot.");
@@ -33467,9 +34000,9 @@ async function runInit(opts) {
   const graph = getGraph(graphKey);
   const projectPaths = pathsForProject(
     graphKey,
-    import_node_path98.default.join(opts.scanPath, "neat-out")
+    import_node_path100.default.join(opts.scanPath, "neat-out")
   );
-  const errorsPath = import_node_path98.default.join(import_node_path98.default.dirname(opts.outPath), import_node_path98.default.basename(projectPaths.errorsPath));
+  const errorsPath = import_node_path100.default.join(import_node_path100.default.dirname(opts.outPath), import_node_path100.default.basename(projectPaths.errorsPath));
   const result = await extractFromDirectory(graph, opts.scanPath, { errorsPath });
   await saveGraphToDisk(graph, opts.outPath);
   written.push(opts.outPath);
@@ -33548,7 +34081,7 @@ async function runInit(opts) {
         console.log("Run `npm install` (or your language equivalent) to refresh lockfiles.");
       }
     } else {
-      await import_node_fs59.promises.writeFile(patchPath, patch, "utf8");
+      await import_node_fs61.promises.writeFile(patchPath, patch, "utf8");
       written.push(patchPath);
     }
   }
@@ -33589,9 +34122,9 @@ var CLAUDE_SKILL_CONFIG = {
 };
 function claudeConfigPath() {
   const override = process.env.NEAT_CLAUDE_CONFIG;
-  if (override && override.length > 0) return import_node_path98.default.resolve(override);
+  if (override && override.length > 0) return import_node_path100.default.resolve(override);
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return import_node_path98.default.join(home, ".claude.json");
+  return import_node_path100.default.join(home, ".claude.json");
 }
 async function runSkill(opts) {
   const snippet2 = JSON.stringify(CLAUDE_SKILL_CONFIG, null, 2) + "\n";
@@ -33603,7 +34136,7 @@ async function runSkill(opts) {
     const target = claudeConfigPath();
     let existing = {};
     try {
-      existing = JSON.parse(await import_node_fs59.promises.readFile(target, "utf8"));
+      existing = JSON.parse(await import_node_fs61.promises.readFile(target, "utf8"));
     } catch (err) {
       if (err.code !== "ENOENT") {
         console.error(`neat skill: failed to read ${target} \u2014 ${err.message}`);
@@ -33615,8 +34148,8 @@ async function runSkill(opts) {
       ...existing,
       mcpServers: { ...mcp, neat: CLAUDE_SKILL_CONFIG.mcpServers.neat }
     };
-    await import_node_fs59.promises.mkdir(import_node_path98.default.dirname(target), { recursive: true });
-    await import_node_fs59.promises.writeFile(target, JSON.stringify(merged, null, 2) + "\n", "utf8");
+    await import_node_fs61.promises.mkdir(import_node_path100.default.dirname(target), { recursive: true });
+    await import_node_fs61.promises.writeFile(target, JSON.stringify(merged, null, 2) + "\n", "utf8");
     console.log(`neat skill: wrote mcpServers.neat to ${target}`);
     console.log("restart Claude Code to pick up the new MCP server.");
     console.log("");
@@ -33642,7 +34175,7 @@ async function runSkill(opts) {
 async function main() {
   const argv = process.argv.slice(2);
   const cmd0 = argv[0];
-  if (cmd0 === "-h" || cmd0 === "--help") {
+  if (argv.some((a) => a === "-h" || a === "--help")) {
     usage5();
     process.exit(0);
   }
@@ -33737,12 +34270,12 @@ async function main() {
       console.error("neat init: --apply and --dry-run are mutually exclusive");
       process.exit(2);
     }
-    const scanPath = import_node_path98.default.resolve(target);
+    const scanPath = import_node_path100.default.resolve(target);
     const projectExplicit = parsed.project !== null;
-    const projectName = projectExplicit ? project : import_node_path98.default.basename(scanPath);
+    const projectName = projectExplicit ? project : import_node_path100.default.basename(scanPath);
     const projectKey = projectExplicit ? project : DEFAULT_PROJECT;
-    const fallback = pathsForProject(projectKey, import_node_path98.default.join(scanPath, "neat-out")).snapshotPath;
-    const outPath = import_node_path98.default.resolve(process.env.NEAT_OUT_PATH ?? fallback);
+    const fallback = pathsForProject(projectKey, import_node_path100.default.join(scanPath, "neat-out")).snapshotPath;
+    const outPath = import_node_path100.default.resolve(process.env.NEAT_OUT_PATH ?? fallback);
     const result = await runInit({
       scanPath,
       outPath,
@@ -33763,21 +34296,21 @@ async function main() {
       usage5();
       process.exit(2);
     }
-    const scanPath = import_node_path98.default.resolve(target);
-    const stat = await import_node_fs59.promises.stat(scanPath).catch(() => null);
+    const scanPath = import_node_path100.default.resolve(target);
+    const stat = await import_node_fs61.promises.stat(scanPath).catch(() => null);
     if (!stat || !stat.isDirectory()) {
       console.error(`neat watch: ${scanPath} is not a directory`);
       process.exit(2);
     }
-    const projectPaths = pathsForProject(project, import_node_path98.default.join(scanPath, "neat-out"));
-    const outPath = import_node_path98.default.resolve(process.env.NEAT_OUT_PATH ?? projectPaths.snapshotPath);
-    const errorsPath = import_node_path98.default.resolve(
-      process.env.NEAT_ERRORS_PATH ?? import_node_path98.default.join(import_node_path98.default.dirname(outPath), import_node_path98.default.basename(projectPaths.errorsPath))
+    const projectPaths = pathsForProject(project, import_node_path100.default.join(scanPath, "neat-out"));
+    const outPath = import_node_path100.default.resolve(process.env.NEAT_OUT_PATH ?? projectPaths.snapshotPath);
+    const errorsPath = import_node_path100.default.resolve(
+      process.env.NEAT_ERRORS_PATH ?? import_node_path100.default.join(import_node_path100.default.dirname(outPath), import_node_path100.default.basename(projectPaths.errorsPath))
     );
-    const staleEventsPath = import_node_path98.default.resolve(
-      process.env.NEAT_STALE_EVENTS_PATH ?? import_node_path98.default.join(import_node_path98.default.dirname(outPath), import_node_path98.default.basename(projectPaths.staleEventsPath))
+    const staleEventsPath = import_node_path100.default.resolve(
+      process.env.NEAT_STALE_EVENTS_PATH ?? import_node_path100.default.join(import_node_path100.default.dirname(outPath), import_node_path100.default.basename(projectPaths.staleEventsPath))
     );
-    const embeddingsCachePath = process.env.NEAT_EMBEDDINGS_CACHE_PATH ? import_node_path98.default.resolve(process.env.NEAT_EMBEDDINGS_CACHE_PATH) : void 0;
+    const embeddingsCachePath = process.env.NEAT_EMBEDDINGS_CACHE_PATH ? import_node_path100.default.resolve(process.env.NEAT_EMBEDDINGS_CACHE_PATH) : void 0;
     const handle = await startWatch(getGraph(project), {
       scanPath,
       outPath,
@@ -33786,7 +34319,7 @@ async function main() {
       project,
       // Resolve NEAT_HOME so a `neat watch` picks up connectors added to
       // ~/.neat/connectors.json (#871). Same resolution the rest of the CLI uses.
-      neatHome: process.env.NEAT_HOME ? import_node_path98.default.resolve(process.env.NEAT_HOME) : import_node_path98.default.join(import_node_os11.default.homedir(), ".neat"),
+      neatHome: process.env.NEAT_HOME ? import_node_path100.default.resolve(process.env.NEAT_HOME) : import_node_path100.default.join(import_node_os11.default.homedir(), ".neat"),
       ...embeddingsCachePath ? { embeddingsCachePath } : {},
       host: process.env.HOST ?? "0.0.0.0",
       port: Number(process.env.PORT ?? 8080),
@@ -33968,11 +34501,11 @@ async function main() {
   process.exit(1);
 }
 async function tryOrchestrator(cmd, parsed) {
-  const scanPath = import_node_path98.default.resolve(cmd);
-  const stat = await import_node_fs59.promises.stat(scanPath).catch(() => null);
+  const scanPath = import_node_path100.default.resolve(cmd);
+  const stat = await import_node_fs61.promises.stat(scanPath).catch(() => null);
   if (!stat || !stat.isDirectory()) return null;
   const projectExplicit = parsed.project !== null;
-  const projectName = projectExplicit ? parsed.project : import_node_path98.default.basename(scanPath);
+  const projectName = projectExplicit ? parsed.project : import_node_path100.default.basename(scanPath);
   const result = await runOrchestrator({
     scanPath,
     project: projectName,
@@ -33987,7 +34520,18 @@ async function tryOrchestrator(cmd, parsed) {
 async function runWelcomeFlow(parsed) {
   return runWelcome({
     login: (loginArgv) => runLoginCommand(loginArgv),
-    orchestrator: async (cwd) => await tryOrchestrator(cwd, parsed) ?? 0
+    // What the person chose at the door reaches the orchestrator as the flags they
+    // stand for: the name as `--project`, the instrument answer as `--no-instrument`
+    // or as `yes` (which keeps the orchestrator's own prompt quiet, since the door
+    // already asked).
+    orchestrator: async (cwd, opts) => await tryOrchestrator(cwd, {
+      ...parsed,
+      ...opts?.project !== void 0 ? { project: opts.project } : {},
+      ...opts?.noInstrument !== void 0 ? { noInstrument: opts.noInstrument } : {},
+      ...opts?.yes !== void 0 ? { yes: opts.yes } : {}
+    }) ?? 0,
+    // An explicit flag is an answer; don't ask again.
+    instrumentFlagGiven: parsed.noInstrument || parsed.dryRun
   });
 }
 var QUERY_VERBS = /* @__PURE__ */ new Set([
@@ -34020,6 +34564,13 @@ var ProjectResolutionError = class extends Error {
   }
   exitCode;
 };
+function isLoopbackEndpoint(endpoint2) {
+  try {
+    return isLoopbackHost2(new URL(endpoint2).hostname.replace(/^\[|\]$/g, ""));
+  } catch {
+    return false;
+  }
+}
 async function resolveProjectForVerb(client, parsed) {
   const explicit = resolveProjectFlag(parsed);
   if (explicit) return explicit;
@@ -34250,6 +34801,9 @@ async function runQueryVerb(cmd, parsed) {
       console.error(`neat ${cmd}: ${detail.trim()}`);
     } else if (err instanceof TransportError) {
       console.error(`neat ${cmd}: ${err.message}. Is the daemon running? (endpoint=${target.endpoint})`);
+      if (isLoopbackEndpoint(target.endpoint)) {
+        console.error(`neat ${cmd}: start one with \`neat watch .\`, or \`neat\` to extract and start in one step.`);
+      }
     } else {
       console.error(`neat ${cmd}: ${err.message}`);
     }
@@ -34306,6 +34860,7 @@ if (/[\\/](?:cli\.(?:cjs|js)|cli|neat|neat\.is)$/.test(entry)) {
   QUERY_VERBS,
   UnknownProfileError,
   commandPrefix,
+  isLoopbackEndpoint,
   isNpxInvocation,
   main,
   parseArgs,