@neat.is/core 0.10.1-dev.20260928 → 0.10.1

package/dist/cli.cjs

@@ -61,8 +61,8 @@ function mountBearerAuth(app, opts) {
   ]);
   const publicRead = opts.publicRead === true;
   app.addHook("preHandler", (req, reply, done) => {
-    const path99 = (req.url.split("?")[0] ?? "").replace(/\/+$/, "");
-    if (exactUnauthPaths.has(path99) || PROJECT_SCOPED_UNAUTH_PATTERN.test(path99)) {
+    const path100 = (req.url.split("?")[0] ?? "").replace(/\/+$/, "");
+    if (exactUnauthPaths.has(path100) || PROJECT_SCOPED_UNAUTH_PATTERN.test(path100)) {
       done();
       return;
     }
@@ -415,8 +415,8 @@ function websocketChannelPathOf(attrs) {
     const v = attrs[key];
     if (typeof v === "string" && v.length > 0) {
       const q = v.indexOf("?");
-      const path99 = q === -1 ? v : v.slice(0, q);
-      if (path99.length > 0) return path99;
+      const path100 = q === -1 ? v : v.slice(0, q);
+      if (path100.length > 0) return path100;
     }
   }
   return void 0;
@@ -789,6 +789,7 @@ __export(cli_exports, {
   QUERY_VERBS: () => QUERY_VERBS,
   UnknownProfileError: () => UnknownProfileError,
   commandPrefix: () => commandPrefix,
+  isLoopbackEndpoint: () => isLoopbackEndpoint,
   isNpxInvocation: () => isNpxInvocation,
   main: () => main,
   parseArgs: () => parseArgs,
@@ -805,9 +806,9 @@ __export(cli_exports, {
 });
 module.exports = __toCommonJS(cli_exports);
 init_cjs_shims();
-var import_node_path99 = __toESM(require("path"), 1);
+var import_node_path100 = __toESM(require("path"), 1);
 var import_node_os11 = __toESM(require("os"), 1);
-var import_node_fs60 = require("fs");
+var import_node_fs61 = require("fs");
 
 // src/banner.ts
 init_cjs_shims();
@@ -1490,19 +1491,19 @@ function confidenceFromMix(edges, now = Date.now()) {
 function longestIncomingWalk(graph, start, maxDepth) {
   let best = { path: [start], edges: [] };
   const visited = /* @__PURE__ */ new Set([start]);
-  function step(node, path99, edges) {
-    if (path99.length > best.path.length) {
-      best = { path: [...path99], edges: [...edges] };
+  function step(node, path100, edges) {
+    if (path100.length > best.path.length) {
+      best = { path: [...path100], edges: [...edges] };
     }
-    if (path99.length - 1 >= maxDepth) return;
+    if (path100.length - 1 >= maxDepth) return;
     const incoming = bestEdgeBySource(graph, graph.inboundEdges(node));
     for (const [srcId, edge] of incoming) {
       if (visited.has(srcId)) continue;
       visited.add(srcId);
-      path99.push(srcId);
+      path100.push(srcId);
       edges.push(edge);
-      step(srcId, path99, edges);
-      path99.pop();
+      step(srcId, path100, edges);
+      path100.pop();
       edges.pop();
       visited.delete(srcId);
     }
@@ -1717,20 +1718,20 @@ function dominantFailingCall(graph, serviceId17, visited) {
   return best;
 }
 function followFailingCallChain(graph, originServiceId, maxDepth) {
-  const path99 = [originServiceId];
+  const path100 = [originServiceId];
   const edges = [];
   const visited = /* @__PURE__ */ new Set([originServiceId]);
   let current = originServiceId;
   for (let depth = 0; depth < maxDepth; depth++) {
     const hop = dominantFailingCall(graph, current, visited);
     if (!hop) break;
-    path99.push(hop.nextService);
+    path100.push(hop.nextService);
     edges.push(hop.edge);
     visited.add(hop.nextService);
     current = hop.nextService;
   }
   if (edges.length === 0) return null;
-  return { path: path99, edges, culprit: current };
+  return { path: path100, edges, culprit: current };
 }
 function isStaleCallEdge(e) {
   return e.type === import_types2.EdgeType.CALLS && e.provenance === import_types2.Provenance.STALE;
@@ -1766,26 +1767,26 @@ function dominantStaleCall(graph, serviceId17, visited) {
   return best;
 }
 function followStaleCallChain(graph, originServiceId, maxDepth) {
-  const path99 = [originServiceId];
+  const path100 = [originServiceId];
   const edges = [];
   const visited = /* @__PURE__ */ new Set([originServiceId]);
   let current = originServiceId;
   for (let depth = 0; depth < maxDepth; depth++) {
     const hop = dominantStaleCall(graph, current, visited);
     if (!hop) break;
-    path99.push(hop.nextService);
+    path100.push(hop.nextService);
     edges.push(hop.edge);
     visited.add(hop.nextService);
     current = hop.nextService;
   }
   if (edges.length === 0) return null;
-  return { path: path99, edges, culprit: current };
+  return { path: path100, edges, culprit: current };
 }
 function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   const chain = followFailingCallChain(graph, originId, ROOT_CAUSE_MAX_DEPTH);
   if (!chain) return null;
   const culprit = chain.culprit;
-  const path99 = [...chain.path];
+  const path100 = [...chain.path];
   const edgeProvenances = chain.edges.map((e) => e.provenance);
   const baseConfidence = confidenceFromMix(chain.edges);
   const confidence = Math.max(0, Math.min(1, baseConfidence * INCIDENT_ROOT_CAUSE_CONFIDENCE));
@@ -1793,14 +1794,14 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   if (loc) {
     let rootCauseNode = culprit;
     if (loc.fileNode) {
-      path99.push(loc.fileNode);
+      path100.push(loc.fileNode);
       edgeProvenances.push(import_types2.Provenance.OBSERVED);
       rootCauseNode = loc.fileNode;
     }
     return import_types2.RootCauseResultSchema.parse({
       rootCauseNode,
       rootCauseReason: loc.rootCauseReason,
-      traversalPath: path99,
+      traversalPath: path100,
       edgeProvenances,
       confidence,
       ...loc.fixRecommendation ? { fixRecommendation: loc.fixRecommendation } : {}
@@ -1812,7 +1813,7 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   return import_types2.RootCauseResultSchema.parse({
     rootCauseNode: culprit,
     rootCauseReason: `${culpritName} is failing downstream calls (${errs} observed error${errs === 1 ? "" : "s"})`,
-    traversalPath: path99,
+    traversalPath: path100,
     edgeProvenances,
     confidence,
     fixRecommendation: `Inspect ${culpritName}'s failing handler`
@@ -2465,10 +2466,10 @@ function enrichWithNavigation(graph, errorNodeId, tagged, incidents, now) {
     traversalPath = staleChain.path;
     edgeProvenances = staleChain.edges.map((e) => e.provenance);
   } else if (top.node !== seedNode) {
-    const path99 = findPath(graph, errorNodeId, top.node, "up", ROOT_CAUSE_MAX_DEPTH);
-    if (path99) {
-      traversalPath = path99.nodes;
-      edgeProvenances = path99.edges.map((e) => e.provenance);
+    const path100 = findPath(graph, errorNodeId, top.node, "up", ROOT_CAUSE_MAX_DEPTH);
+    if (path100) {
+      traversalPath = path100.nodes;
+      edgeProvenances = path100.edges.map((e) => e.provenance);
     } else {
       traversalPath = [errorNodeId, top.node];
       edgeProvenances = [top.provenance ?? import_types2.Provenance.OBSERVED];
@@ -3919,8 +3920,8 @@ function chiRoutesFromSource(source, parser) {
   chiWalk(tree.rootNode, "", out);
   return out;
 }
-function stripChiRegex(path99) {
-  return path99.replace(/\{([^{}:]+):[^{}]*\}/g, "{$1}");
+function stripChiRegex(path100) {
+  return path100.replace(/\{([^{}:]+):[^{}]*\}/g, "{$1}");
 }
 function chiWalk(node, prefix, out) {
   for (let i = 0; i < node.namedChildCount; i++) {
@@ -4592,9 +4593,9 @@ function rubyRocketRoute(args) {
     if (!pair || pair.type !== "pair") continue;
     const k = pair.childForFieldName("key");
     if (k?.type !== "string") continue;
-    const path99 = rubyLiteral(k);
-    if (path99 === null) continue;
-    return { path: path99, target: rubyLiteral(pair.childForFieldName("value")) };
+    const path100 = rubyLiteral(k);
+    if (path100 === null) continue;
+    return { path: path100, target: rubyLiteral(pair.childForFieldName("value")) };
   }
   return null;
 }
@@ -20453,10 +20454,10 @@ var SUPABASE_RPC_TARGET_KIND = "supabase-rpc";
 // src/connectors/supabase/map.ts
 var REST_RPC_PATH_RE = /^\/rest\/v1\/rpc\/([^/?]+)/;
 var REST_TABLE_PATH_RE = /^\/rest\/v1\/([^/?]+)/;
-function targetFromRestPath(path99) {
-  const rpcMatch = REST_RPC_PATH_RE.exec(path99);
+function targetFromRestPath(path100) {
+  const rpcMatch = REST_RPC_PATH_RE.exec(path100);
   if (rpcMatch) return { targetKind: SUPABASE_RPC_TARGET_KIND, name: rpcMatch[1] };
-  const tableMatch = REST_TABLE_PATH_RE.exec(path99);
+  const tableMatch = REST_TABLE_PATH_RE.exec(path100);
   if (tableMatch) return { targetKind: SUPABASE_TABLE_TARGET_KIND, name: tableMatch[1] };
   return null;
 }
@@ -21060,9 +21061,9 @@ function parseFirebaseTargetName(targetName) {
   const secondSep = rest.indexOf(FIELD_SEP);
   if (secondSep === -1) return null;
   const method = rest.slice(0, secondSep);
-  const path99 = rest.slice(secondSep + 1);
-  if (!resourceName || !method || !path99) return null;
-  return { resourceName, method, path: path99 };
+  const path100 = rest.slice(secondSep + 1);
+  if (!resourceName || !method || !path100) return null;
+  return { resourceName, method, path: path100 };
 }
 function resourceNameFor(type, labels) {
   if (!labels) return null;
@@ -21100,14 +21101,14 @@ function mapLogEntryToSignal(entry2) {
   if (!req) return null;
   if (typeof req.requestMethod !== "string" || req.requestMethod.length === 0) return null;
   const method = req.requestMethod.toUpperCase();
-  const path99 = pathFromRequestUrl(req.requestUrl);
-  if (path99 === null) return null;
+  const path100 = pathFromRequestUrl(req.requestUrl);
+  if (path100 === null) return null;
   const timestamp = entry2.timestamp;
   if (typeof timestamp !== "string" || timestamp.length === 0) return null;
   const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD2;
   return {
     targetKind: resourceType,
-    targetName: packFirebaseTargetName({ resourceName, method, path: path99 }),
+    targetName: packFirebaseTargetName({ resourceName, method, path: path100 }),
     callCount: 1,
     errorCount: isError ? 1 : 0,
     lastObservedIso: timestamp
@@ -21132,9 +21133,9 @@ var import_types73 = require("@neat.is/types");
 function normalizeName(name) {
   return name.toLowerCase().replace(/[^a-z0-9]/g, "");
 }
-function inferServiceName(graph, resourceName, method, path99) {
+function inferServiceName(graph, resourceName, method, path100) {
   const wantedMethod = method.toUpperCase();
-  const wantedPath = normalizePathTemplate(path99);
+  const wantedPath = normalizePathTemplate(path100);
   const services = [];
   const owners = /* @__PURE__ */ new Set();
   graph.forEachNode((_id, attrs) => {
@@ -21351,7 +21352,7 @@ function mapEventToSignal(event) {
   if (Number.isNaN(observedAt.getTime())) return null;
   const statusCode = metadata?.statusCode;
   const isError = typeof statusCode === "number" && statusCode >= ERROR_STATUS_THRESHOLD3;
-  const path99 = metadata?.trigger ? parsePathFromTrigger(metadata.trigger) : void 0;
+  const path100 = metadata?.trigger ? parsePathFromTrigger(metadata.trigger) : void 0;
   return {
     targetKind: CLOUDFLARE_TARGET_KIND,
     targetName: scriptName,
@@ -21359,7 +21360,7 @@ function mapEventToSignal(event) {
     errorCount: isError ? 1 : 0,
     lastObservedIso: observedAt.toISOString(),
     method,
-    ...path99 ? { path: path99 } : {},
+    ...path100 ? { path: path100 } : {},
     ...typeof statusCode === "number" ? { statusCode } : {},
     ...typeof metadata?.duration === "number" ? { duration: metadata.duration } : {}
   };
@@ -21405,8 +21406,8 @@ function findTaggedWorkerFileNode(graph, workerName) {
   });
   return found;
 }
-function findMatchingRouteNode(graph, serviceName, method, path99) {
-  const normalizedPath = normalizePathTemplate(path99);
+function findMatchingRouteNode(graph, serviceName, method, path100) {
+  const normalizedPath = normalizePathTemplate(path100);
   let found = null;
   graph.forEachNode((id, attrs) => {
     if (found) return;
@@ -21423,10 +21424,10 @@ function createCloudflareResolveTarget(config, graph) {
   return (signal) => {
     if (signal.targetKind !== CLOUDFLARE_TARGET_KIND) return null;
     const scriptName = signal.targetName;
-    const { method, path: path99 } = signal;
+    const { method, path: path100 } = signal;
     const resolveRouteGrain = (serviceName, wholeFileId) => {
-      if (!method || !path99) return wholeFileId;
-      return findMatchingRouteNode(graph, serviceName, method, path99) ?? wholeFileId;
+      if (!method || !path100) return wholeFileId;
+      return findMatchingRouteNode(graph, serviceName, method, path100) ?? wholeFileId;
     };
     const mapping = config.workers?.[scriptName];
     if (mapping) {
@@ -21778,9 +21779,9 @@ function parseCloudRunTargetName(targetName) {
   const secondSep = rest.indexOf(FIELD_SEP2);
   if (secondSep === -1) return null;
   const method = rest.slice(0, secondSep);
-  const path99 = rest.slice(secondSep + 1);
-  if (!serviceName || !method || !path99) return null;
-  return { serviceName, method, path: path99 };
+  const path100 = rest.slice(secondSep + 1);
+  if (!serviceName || !method || !path100) return null;
+  return { serviceName, method, path: path100 };
 }
 
 // src/connectors/cloud-run/map.ts
@@ -21809,14 +21810,14 @@ function mapLogEntryToSignal2(entry2) {
   if (!req) return null;
   if (typeof req.requestMethod !== "string" || req.requestMethod.length === 0) return null;
   const method = req.requestMethod.toUpperCase();
-  const path99 = pathFromRequestUrl2(req.requestUrl);
-  if (path99 === null) return null;
+  const path100 = pathFromRequestUrl2(req.requestUrl);
+  if (path100 === null) return null;
   const timestamp = entry2.timestamp;
   if (typeof timestamp !== "string" || timestamp.length === 0) return null;
   const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD4;
   return {
     targetKind: CLOUD_RUN_TARGET_KIND,
-    targetName: packCloudRunTargetName({ serviceName, method, path: path99 }),
+    targetName: packCloudRunTargetName({ serviceName, method, path: path100 }),
     callCount: 1,
     errorCount: isError ? 1 : 0,
     lastObservedIso: timestamp
@@ -21855,14 +21856,14 @@ function createCloudRunResolveTarget(graph, config) {
     if (signal.targetKind !== CLOUD_RUN_TARGET_KIND) return null;
     const identity = parseCloudRunTargetName(signal.targetName);
     if (!identity) return null;
-    const { serviceName: gcpServiceName, method, path: path99 } = identity;
-    const mappedService = config.serviceMap?.[gcpServiceName] ?? (config.inferServices ? inferServiceName(graph, gcpServiceName, method, path99) ?? void 0 : void 0);
+    const { serviceName: gcpServiceName, method, path: path100 } = identity;
+    const mappedService = config.serviceMap?.[gcpServiceName] ?? (config.inferServices ? inferServiceName(graph, gcpServiceName, method, path100) ?? void 0 : void 0);
     if (mappedService) {
       const routeNodeId = findMatchingRouteNode2(
         graph,
         mappedService,
         method,
-        normalizePathTemplate(path99)
+        normalizePathTemplate(path100)
       );
       if (routeNodeId) {
         return { targetNodeId: routeNodeId, serviceName: mappedService, edgeType: import_types84.EdgeType.CALLS };
@@ -21998,9 +21999,9 @@ function parseGcpLbTargetName(targetName) {
   const secondSep = rest.indexOf(FIELD_SEP3);
   if (secondSep === -1) return null;
   const method = rest.slice(0, secondSep);
-  const path99 = rest.slice(secondSep + 1);
-  if (!backendServiceName || !method || !path99) return null;
-  return { backendServiceName, method, path: path99 };
+  const path100 = rest.slice(secondSep + 1);
+  if (!backendServiceName || !method || !path100) return null;
+  return { backendServiceName, method, path: path100 };
 }
 
 // src/connectors/gcp-lb/map.ts
@@ -22029,14 +22030,14 @@ function mapLogEntryToSignal3(entry2) {
   if (!req) return null;
   if (typeof req.requestMethod !== "string" || req.requestMethod.length === 0) return null;
   const method = req.requestMethod.toUpperCase();
-  const path99 = pathFromRequestUrl3(req.requestUrl);
-  if (path99 === null) return null;
+  const path100 = pathFromRequestUrl3(req.requestUrl);
+  if (path100 === null) return null;
   const timestamp = entry2.timestamp;
   if (typeof timestamp !== "string" || timestamp.length === 0) return null;
   const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD5;
   return {
     targetKind: GCP_LB_TARGET_KIND,
-    targetName: packGcpLbTargetName({ backendServiceName, method, path: path99 }),
+    targetName: packGcpLbTargetName({ backendServiceName, method, path: path100 }),
     callCount: 1,
     errorCount: isError ? 1 : 0,
     lastObservedIso: timestamp
@@ -22075,14 +22076,14 @@ function createGcpLbResolveTarget(graph, config) {
     if (signal.targetKind !== GCP_LB_TARGET_KIND) return null;
     const identity = parseGcpLbTargetName(signal.targetName);
     if (!identity) return null;
-    const { backendServiceName, method, path: path99 } = identity;
-    const mappedService = config.backendServiceMap?.[backendServiceName] ?? (config.inferServices ? inferServiceName(graph, backendServiceName, method, path99) ?? void 0 : void 0);
+    const { backendServiceName, method, path: path100 } = identity;
+    const mappedService = config.backendServiceMap?.[backendServiceName] ?? (config.inferServices ? inferServiceName(graph, backendServiceName, method, path100) ?? void 0 : void 0);
     if (mappedService) {
       const routeNodeId = findMatchingRouteNode3(
         graph,
         mappedService,
         method,
-        normalizePathTemplate(path99)
+        normalizePathTemplate(path100)
       );
       if (routeNodeId) {
         return { targetNodeId: routeNodeId, serviceName: mappedService, edgeType: import_types88.EdgeType.CALLS };
@@ -24474,9 +24475,9 @@ function makeK8sFetchImpl(transport) {
     req.end();
   }));
 }
-async function listResource(transport, namespace, path99, opts = {}) {
+async function listResource(transport, namespace, path100, opts = {}) {
   const base = opts.apiUrl ?? transport.server;
-  const url = `${base.replace(/\/$/, "")}${path99}`;
+  const url = `${base.replace(/\/$/, "")}${path100}`;
   const fetchImpl = opts.fetchImpl ?? makeK8sFetchImpl(transport);
   const res = await junctionFetch(
     url,
@@ -24486,7 +24487,7 @@ async function listResource(transport, namespace, path99, opts = {}) {
     { provider: "kubernetes", accountKey: `${safeHost(transport.server)}/${namespace}`, fetchImpl }
   );
   if (!res.ok) {
-    throw new Error(`kubernetes ${path99} failed: ${res.status} ${res.statusText}`);
+    throw new Error(`kubernetes ${path100} failed: ${res.status} ${res.statusText}`);
   }
   const json = await res.json();
   return Array.isArray(json.items) ? json.items : [];
@@ -29377,7 +29378,8 @@ async function runOrchestrator(opts) {
   } catch (err) {
     if (!(err instanceof ProjectNameCollisionError)) throw err;
     console.error(`neat: ${err.message}`);
-    console.error("pass --project <other-name> to register under a different name.");
+    console.error(`neat: run \`neat <path> --project <other-name>\` to register it under a different name,`);
+    console.error(`neat: or \`neat uninstall ${opts.project}\` if the old registration is stale.`);
     result.exitCode = 1;
     return result;
   }
@@ -29956,12 +29958,12 @@ async function runConnectorCommand(rawArgs, deps = {}) {
 
 // src/hosted-connect-cli.ts
 init_cjs_shims();
-var import_node_child_process5 = require("child_process");
+var import_node_child_process6 = require("child_process");
 
 // src/login-sso.ts
 init_cjs_shims();
 var import_node_http2 = require("http");
-var import_node_child_process4 = require("child_process");
+var import_node_child_process5 = require("child_process");
 var import_node_crypto7 = require("crypto");
 
 // src/profiles.ts
@@ -30174,6 +30176,198 @@ async function clearActiveProfile(home = neatHome3()) {
   });
 }
 
+// src/daemon-probe.ts
+init_cjs_shims();
+var PROBE_ATTEMPT_TIMEOUT_MS = 3e4;
+var PROBE_TOTAL_BUDGET_MS = 12e4;
+var PROBE_RETRY_PAUSE_MS = 2e3;
+function isTimeoutError(err) {
+  const name = err?.name;
+  return name === "TimeoutError" || name === "AbortError";
+}
+async function probeOnce(fetchImpl, root, token, timeoutMs) {
+  let res;
+  try {
+    res = await fetchImpl(`${root}/health`, {
+      headers: { authorization: `Bearer ${token}` },
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+  } catch (err) {
+    if (isTimeoutError(err)) return { kind: "timeout" };
+    return { kind: "unreachable", detail: err.message };
+  }
+  if (res.status === 401 || res.status === 403) return { kind: "unauthorized", status: res.status };
+  if (!res.ok) return { kind: "not-neat", status: res.status };
+  const contentType = res.headers.get("content-type") ?? "";
+  if (!contentType.includes("json")) return { kind: "not-neat", status: res.status };
+  return { kind: "ok" };
+}
+async function probeDaemon(fetchImpl, endpoint2, token, hooks) {
+  const root = endpoint2.replace(/\/$/, "");
+  const deadline = hooks.now() + PROBE_TOTAL_BUDGET_MS;
+  let warned = false;
+  for (; ; ) {
+    const result = await probeOnce(fetchImpl, root, token, PROBE_ATTEMPT_TIMEOUT_MS);
+    if (result.kind !== "timeout") return result;
+    if (!warned) {
+      hooks.onWaiting();
+      warned = true;
+    }
+    if (hooks.now() >= deadline) {
+      return { kind: "unreachable", detail: `no response after ${Math.round(PROBE_TOTAL_BUDGET_MS / 1e3)}s` };
+    }
+    await hooks.sleep(PROBE_RETRY_PAUSE_MS);
+  }
+}
+
+// src/login-connect.ts
+init_cjs_shims();
+var import_node_child_process4 = require("child_process");
+var import_node_util = require("util");
+var import_node_fs54 = require("fs");
+var import_node_path92 = __toESM(require("path"), 1);
+var execFileAsync = (0, import_node_util.promisify)(import_node_child_process4.execFile);
+async function hasLocalSnapshot(cwd) {
+  try {
+    await import_node_fs54.promises.access(import_node_path92.default.join(cwd, "neat-out", "graph.json"));
+    return true;
+  } catch {
+    return false;
+  }
+}
+var POLL_INTERVAL_MS = 3e3;
+var POLL_BUDGET_MS = 10 * 6e4;
+var CP_TIMEOUT_MS = 1e4;
+async function detectGitHubRepo(cwd) {
+  const read = async (args) => {
+    try {
+      const { stdout } = await execFileAsync("git", args, { cwd, timeout: 5e3 });
+      return stdout.trim();
+    } catch {
+      return null;
+    }
+  };
+  let url = await read(["remote", "get-url", "origin"]);
+  if (!url) {
+    const names = await read(["remote"]);
+    const first = names?.split(/\r?\n/).find((l) => l.trim().length > 0)?.trim();
+    if (!first) return null;
+    url = await read(["remote", "get-url", first]);
+  }
+  if (!url) return null;
+  return parseGitHubRemote(url);
+}
+function parseGitHubRemote(url) {
+  const trimmed = url.trim().replace(/\.git$/, "");
+  const m = trimmed.match(/^https?:\/\/(?:[^@/]+@)?github\.com\/([^/]+)\/([^/]+)$/) ?? trimmed.match(/^git@github\.com:([^/]+)\/([^/]+)$/) ?? trimmed.match(/^ssh:\/\/git@github\.com\/([^/]+)\/([^/]+)$/);
+  if (!m) return null;
+  const owner = m[1];
+  const name = m[2];
+  if (!owner || !name) return null;
+  return { owner, name };
+}
+async function cpGetJson(fetchImpl, cpUrl, path100, accessToken) {
+  try {
+    const res = await fetchImpl(`${cpUrl}${path100}`, {
+      headers: { authorization: `Bearer ${accessToken}`, accept: "application/json" },
+      signal: AbortSignal.timeout(CP_TIMEOUT_MS)
+    });
+    if (!res.ok) return { ok: false };
+    return { ok: true, body: await res.json() };
+  } catch {
+    return { ok: false };
+  }
+}
+async function listBoundRepos(fetchImpl, cpUrl, accessToken, projectId) {
+  const res = await cpGetJson(
+    fetchImpl,
+    cpUrl,
+    `/me/projects/${encodeURIComponent(projectId)}/repos`,
+    accessToken
+  );
+  if (!res.ok || !Array.isArray(res.body)) return null;
+  return res.body;
+}
+async function waitForFirstProject(fetchImpl, cpUrl, accessToken, deps) {
+  const pollMs = deps.pollMs ?? POLL_INTERVAL_MS;
+  const deadline = deps.now() + (deps.budgetMs ?? POLL_BUDGET_MS);
+  for (; ; ) {
+    if (deps.signal?.aborted) return { kind: "aborted" };
+    const me = await cpGetJson(fetchImpl, cpUrl, "/me", accessToken);
+    if (me.ok) {
+      const running = (me.body.projects ?? []).find((p) => p.status === "running");
+      if (running) return { kind: "project", project: running };
+    }
+    if (deps.now() >= deadline) return { kind: "timeout" };
+    await deps.sleep(pollMs);
+    if (deps.signal?.aborted) return { kind: "aborted" };
+  }
+}
+function bindUrl(webUrl, projectId) {
+  return `${webUrl}/config/repos?project=${encodeURIComponent(projectId)}`;
+}
+function onboardingUrl(webUrl) {
+  return `${webUrl}/onboarding`;
+}
+async function runPostLoginConnect(input) {
+  const d = input.deps;
+  const out = d.out ?? ((line) => console.log(line));
+  const fetchImpl = d.fetchImpl ?? fetch;
+  const cwd = d.cwd ?? process.cwd();
+  const detect6 = d.detectRepo ?? detectGitHubRepo;
+  const readLine = d.readLine;
+  const repo = await detect6(cwd);
+  out("");
+  if (!repo) {
+    out("This directory has no GitHub remote, so it can't be bound to the project.");
+    out(`  Push its graph instead:      neat sync --to ${input.project.name}`);
+    out(`  Manage projects and repos:   ${input.webUrl}`);
+    return;
+  }
+  const slug = `${repo.owner}/${repo.name}`;
+  const bound = await listBoundRepos(fetchImpl, input.cpUrl, input.accessToken, input.project.id);
+  const match = bound?.find((r) => r.owner === repo.owner && r.name === repo.name);
+  if (match) {
+    const state = match.syncStatus ? ` (${match.syncStatus})` : "";
+    out(`${slug} is bound to ${input.project.name}${state} \u2014 hosted NEAT extracts it for you.`);
+    out(`  See the graph:  ${input.webUrl}`);
+    return;
+  }
+  out(`${slug} isn't part of ${input.project.name} yet \u2014 logging in connected your account, not this repo.`);
+  out("");
+  const installed = input.me?.github?.installed;
+  const bindLine = installed === false ? "1) Install the GitHub App and bind this repo \u2014 hosted NEAT keeps it in sync" : installed === true ? "1) Bind this repo \u2014 hosted NEAT clones and extracts it, and keeps it in sync" : "1) Bind this repo through the console \u2014 hosted NEAT keeps it in sync";
+  out(bindLine);
+  out(`2) Push the graph on this machine now \u2014 a snapshot, not a subscription`);
+  out("3) Neither, for now");
+  const answer = readLine ? (await readLine("Choose 1, 2 or 3 (Enter skips): "))?.trim() : void 0;
+  if (answer === "1") {
+    const url = bindUrl(input.webUrl, input.project.id);
+    const opened = (d.openBrowser ?? (() => false))(url);
+    out("");
+    out(opened ? `Opened ${url}` : `Open this to bind the repo:
+  ${url}`);
+    return;
+  }
+  if (answer === "2") {
+    const hasGraph = await (d.hasLocalGraph ?? hasLocalSnapshot)(cwd);
+    out("");
+    if (!hasGraph) {
+      out("There is no local graph to push yet. Build one, then push it:");
+      out("  neat");
+      out(`  neat sync --to ${input.project.name}`);
+      return;
+    }
+    out("Push the local graph with:");
+    out(`  neat sync --to ${input.project.name}`);
+    return;
+  }
+  out("");
+  out("No problem \u2014 when you want this repo in the graph:");
+  out(`  Bind it:        ${bindUrl(input.webUrl, input.project.id)}`);
+  out(`  Or push it:     neat sync --to ${input.project.name}`);
+}
+
 // src/login-sso.ts
 var DEFAULT_CP_URL = "https://api.neat.is";
 var DEFAULT_WEB_URL = "https://app.neat.is";
@@ -30199,6 +30393,7 @@ function pickProject(projects, want) {
     return {
       error: {
         code: 1,
+        kind: "no-project",
         message: `no running project to connect to \u2014 create + provision one in the console first${listed}`
       }
     };
@@ -30249,14 +30444,14 @@ async function exchangeCredential(cpUrl, accessToken, opts, deps) {
   if (!cred.endpoint || !cred.authToken) {
     return { error: { code: 1, message: "the credential response was missing endpoint/authToken" } };
   }
-  return { project, cred };
+  return { project, cred, me };
 }
 function defaultOpenBrowser(url) {
   const platform = process.platform;
   const cmd = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
   const args = platform === "win32" ? ["/c", "start", "", url] : [url];
   try {
-    const child = (0, import_node_child_process4.spawn)(cmd, args, { detached: true, stdio: "ignore" });
+    const child = (0, import_node_child_process5.spawn)(cmd, args, { detached: true, stdio: "ignore" });
     child.on("error", () => {
     });
     child.unref();
@@ -30331,12 +30526,50 @@ async function runSsoLogin(opts, deps) {
     }
     accessToken = lb.token;
   }
-  const ex = await exchangeCredential(opts.cpUrl, accessToken, { project: opts.project }, deps);
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const now = deps.now ?? Date.now;
+  let ex = await exchangeCredential(opts.cpUrl, accessToken, { project: opts.project }, deps);
+  if ("error" in ex && ex.error.kind === "no-project" && !opts.json) {
+    const url = onboardingUrl(opts.webUrl);
+    out("");
+    out("You don't have a project yet \u2014 let's make one.");
+    const opened = (deps.openBrowser ?? defaultOpenBrowser)(url);
+    out(opened ? `Opened ${url}` : `Open this to create your first project:
+  ${url}`);
+    out("Waiting for it to come up \u2014 Ctrl-C to stop and finish later.");
+    const waited = await waitForFirstProject(fetchImpl, opts.cpUrl, accessToken, {
+      sleep: sleep2,
+      now,
+      ...deps.signal ? { signal: deps.signal } : {}
+    });
+    if (waited.kind === "aborted") {
+      out("Stopped. Run `neat login` again once your project is up.");
+      return 130;
+    }
+    if (waited.kind === "timeout") {
+      err("neat login: no project came up while waiting \u2014 run `neat login` again once it does");
+      return 1;
+    }
+    out(`${waited.project.name} is up.`);
+    ex = await exchangeCredential(opts.cpUrl, accessToken, { project: opts.project }, deps);
+  }
   if ("error" in ex) {
     err(`neat login: ${ex.error.message}`);
     return ex.error.code;
   }
-  const { project, cred } = ex;
+  const { project, cred, me } = ex;
+  const probe = await probeDaemon(fetchImpl, cred.endpoint, cred.authToken, {
+    sleep: sleep2,
+    now,
+    onWaiting: () => err("Waking the hosted daemon \u2014 a cold instance can take up to a minute\u2026")
+  });
+  if (probe.kind !== "ok") {
+    const why = probe.kind === "unreachable" ? probe.detail : probe.kind === "unauthorized" ? `it rejected the credential (HTTP ${probe.status})` : `it answered HTTP ${probe.status} and doesn't look like NEAT`;
+    err(`neat login: "${project.name}" is provisioned, but its daemon isn't answering \u2014 ${why}.`);
+    err(`Nothing was changed. Check the project at ${opts.webUrl} and run \`neat login\` again.`);
+    return probe.kind === "unreachable" ? 3 : 1;
+  }
   await upsertProfile(
     { name: opts.name, endpoint: cred.endpoint, authToken: cred.authToken },
     { makeActive: true, ...deps.home ? { home: deps.home } : {} }
@@ -30364,10 +30597,20 @@ async function runSsoLogin(opts, deps) {
       out(`  OTEL_EXPORTER_OTLP_ENDPOINT=${cred.ingestEndpoint}`);
       out(`  OTEL_EXPORTER_OTLP_HEADERS=Authorization=Bearer ${cred.otelToken}`);
     }
-    out("");
-    out("This directory isn't part of that graph yet \u2014 logging in connected your account,");
-    out("not this repo, and nothing here has been uploaded.");
-    out(`  Manage projects and repos:  ${opts.webUrl}`);
+    await runPostLoginConnect({
+      cpUrl: opts.cpUrl,
+      webUrl: opts.webUrl,
+      accessToken,
+      project: { id: project.id, name: project.name },
+      me,
+      deps: {
+        fetchImpl,
+        out,
+        ...deps.readLine ? { readLine: deps.readLine } : {},
+        ...deps.openBrowser ? { openBrowser: deps.openBrowser } : { openBrowser: defaultOpenBrowser },
+        ...deps.connect ?? {}
+      }
+    });
     out("");
     out("Run `neat logout` to switch back to your local daemon.");
   }
@@ -30380,7 +30623,7 @@ function defaultOpenBrowser2(url) {
   const cmd = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
   const args = platform === "win32" ? ["/c", "start", "", url] : [url];
   try {
-    const child = (0, import_node_child_process5.spawn)(cmd, args, { detached: true, stdio: "ignore" });
+    const child = (0, import_node_child_process6.spawn)(cmd, args, { detached: true, stdio: "ignore" });
     child.on("error", () => {
     });
     child.unref();
@@ -30475,8 +30718,8 @@ async function runConnectCommand(rawArgs, deps = {}) {
 
 // src/doctor-cli.ts
 init_cjs_shims();
-var import_node_fs54 = require("fs");
-var import_node_path92 = __toESM(require("path"), 1);
+var import_node_fs55 = require("fs");
+var import_node_path93 = __toESM(require("path"), 1);
 
 // src/cli-client.ts
 init_cjs_shims();
@@ -30505,10 +30748,10 @@ function createHttpClient(baseUrl, bearerToken, fetchImpl = fetch) {
   const root = baseUrl.replace(/\/$/, "");
   const authHeader = bearerToken && bearerToken.length > 0 ? { authorization: `Bearer ${bearerToken}` } : {};
   return {
-    async get(path99) {
+    async get(path100) {
       let res;
       try {
-        res = await fetchImpl(`${root}${path99}`, {
+        res = await fetchImpl(`${root}${path100}`, {
           headers: { ...authHeader }
         });
       } catch (err) {
@@ -30520,16 +30763,16 @@ function createHttpClient(baseUrl, bearerToken, fetchImpl = fetch) {
         const body = await res.text().catch(() => "");
         throw new HttpError(
           res.status,
-          `${res.status} ${res.statusText} on GET ${path99}: ${body}`,
+          `${res.status} ${res.statusText} on GET ${path100}: ${body}`,
           body
         );
       }
       return await res.json();
     },
-    async post(path99, body) {
+    async post(path100, body) {
       let res;
       try {
-        res = await fetchImpl(`${root}${path99}`, {
+        res = await fetchImpl(`${root}${path100}`, {
           method: "POST",
           headers: { "content-type": "application/json", ...authHeader },
           body: JSON.stringify(body)
@@ -30543,7 +30786,7 @@ function createHttpClient(baseUrl, bearerToken, fetchImpl = fetch) {
         const text = await res.text().catch(() => "");
         throw new HttpError(
           res.status,
-          `${res.status} ${res.statusText} on POST ${path99}: ${text}`,
+          `${res.status} ${res.statusText} on POST ${path100}: ${text}`,
           text
         );
       }
@@ -30557,12 +30800,12 @@ function projectPath(project, suffix) {
 }
 async function runRootCause(client, input) {
   const qs = input.errorId ? `?errorId=${encodeURIComponent(input.errorId)}` : "";
-  const path99 = projectPath(
+  const path100 = projectPath(
     input.project,
     `/graph/root-cause/${encodeURIComponent(input.errorNode)}${qs}`
   );
   try {
-    const result = await client.get(path99);
+    const result = await client.get(path100);
     const arrowPath = result.traversalPath.join(" \u2190 ");
     const provenances = result.edgeProvenances.length ? result.edgeProvenances.join(", ") : "(direct, no edges traversed)";
     const summary = `Root cause for ${input.errorNode} is ${result.rootCauseNode}. ` + result.rootCauseReason + (result.fixRecommendation ? ` Recommended fix: ${result.fixRecommendation}.` : "");
@@ -30588,12 +30831,12 @@ async function runRootCause(client, input) {
 }
 async function runBlastRadius(client, input) {
   const qs = input.depth !== void 0 ? `?depth=${input.depth}` : "";
-  const path99 = projectPath(
+  const path100 = projectPath(
     input.project,
     `/graph/blast-radius/${encodeURIComponent(input.nodeId)}${qs}`
   );
   try {
-    const result = await client.get(path99);
+    const result = await client.get(path100);
     if (result.totalAffected === 0) {
       return {
         summary: `${result.origin} has no dependents. Nothing else would break if it failed.`
@@ -30627,12 +30870,12 @@ function formatBlastEntry(n) {
 }
 async function runDependencies(client, input) {
   const depth = input.depth ?? 3;
-  const path99 = projectPath(
+  const path100 = projectPath(
     input.project,
     `/graph/dependencies/${encodeURIComponent(input.nodeId)}?depth=${depth}`
   );
   try {
-    const result = await client.get(path99);
+    const result = await client.get(path100);
     if (result.total === 0) {
       return {
         summary: depth === 1 ? `${input.nodeId} has no direct dependencies in the graph.` : `${input.nodeId} has no dependencies (BFS to depth ${depth}).`
@@ -30724,9 +30967,9 @@ function formatDuration(ms) {
   return `${Math.round(h / 24)}d`;
 }
 async function runIncidents(client, input) {
-  const path99 = input.nodeId ? projectPath(input.project, `/incidents/${encodeURIComponent(input.nodeId)}`) : projectPath(input.project, "/incidents");
+  const path100 = input.nodeId ? projectPath(input.project, `/incidents/${encodeURIComponent(input.nodeId)}`) : projectPath(input.project, "/incidents");
   try {
-    const body = await client.get(path99);
+    const body = await client.get(path100);
     const events = body.events;
     if (events.length === 0) {
       return {
@@ -31090,7 +31333,7 @@ function checkNode(nodeVersion) {
 }
 async function neatOutExists(cwd) {
   try {
-    const st = await import_node_fs54.promises.stat(import_node_path92.default.join(cwd, "neat-out"));
+    const st = await import_node_fs55.promises.stat(import_node_path93.default.join(cwd, "neat-out"));
     return st.isDirectory();
   } catch {
     return false;
@@ -31210,9 +31453,6 @@ async function runDoctorCommand(argv, deps = {}) {
 // src/login-cli.ts
 init_cjs_shims();
 var import_promises4 = __toESM(require("readline/promises"), 1);
-var PROBE_ATTEMPT_TIMEOUT_MS = 3e4;
-var PROBE_TOTAL_BUDGET_MS = 12e4;
-var PROBE_RETRY_PAUSE_MS = 2e3;
 var DEFAULT_PROFILE_NAME = "hosted";
 function readFlagValue(argv, i) {
   const arg = argv[i];
@@ -31277,44 +31517,6 @@ function printLoginHelp(out) {
   out('  the profile (default "hosted"); the paste token can also come from NEAT_LOGIN_TOKEN.');
   out("  Exit 0 on success, 1 rejected/needs-action, 2 misuse, 3 unreachable.");
 }
-function isTimeoutError(err) {
-  const name = err?.name;
-  return name === "TimeoutError" || name === "AbortError";
-}
-async function probeOnce(fetchImpl, root, token, timeoutMs) {
-  let res;
-  try {
-    res = await fetchImpl(`${root}/health`, {
-      headers: { authorization: `Bearer ${token}` },
-      signal: AbortSignal.timeout(timeoutMs)
-    });
-  } catch (err) {
-    if (isTimeoutError(err)) return { kind: "timeout" };
-    return { kind: "unreachable", detail: err.message };
-  }
-  if (res.status === 401 || res.status === 403) return { kind: "unauthorized", status: res.status };
-  if (!res.ok) return { kind: "not-neat", status: res.status };
-  const contentType = res.headers.get("content-type") ?? "";
-  if (!contentType.includes("json")) return { kind: "not-neat", status: res.status };
-  return { kind: "ok" };
-}
-async function probeDaemon(fetchImpl, endpoint2, token, hooks) {
-  const root = endpoint2.replace(/\/$/, "");
-  const deadline = hooks.now() + PROBE_TOTAL_BUDGET_MS;
-  let warned = false;
-  for (; ; ) {
-    const result = await probeOnce(fetchImpl, root, token, PROBE_ATTEMPT_TIMEOUT_MS);
-    if (result.kind !== "timeout") return result;
-    if (!warned) {
-      hooks.onWaiting();
-      warned = true;
-    }
-    if (hooks.now() >= deadline) {
-      return { kind: "unreachable", detail: `no response after ${Math.round(PROBE_TOTAL_BUDGET_MS / 1e3)}s` };
-    }
-    await hooks.sleep(PROBE_RETRY_PAUSE_MS);
-  }
-}
 async function runLoginCommand(argv, deps = {}) {
   const out = deps.out ?? ((line) => console.log(line));
   const err = deps.err ?? ((line) => console.error(line));
@@ -31347,8 +31549,13 @@ async function runLoginCommand(argv, deps = {}) {
         fetchImpl,
         out,
         err,
+        readLine,
+        sleep: sleep2,
+        now,
         ...deps.openBrowser ? { openBrowser: deps.openBrowser } : {},
-        ...deps.home ? { home: deps.home } : {}
+        ...deps.home ? { home: deps.home } : {},
+        ...deps.signal ? { signal: deps.signal } : {},
+        ...deps.connect ? { connect: deps.connect } : {}
       }
     );
   }
@@ -31505,8 +31712,8 @@ async function defaultReadSecret(prompt) {
 
 // src/welcome.ts
 init_cjs_shims();
-var import_node_fs55 = require("fs");
-var import_node_path93 = __toESM(require("path"), 1);
+var import_node_fs56 = require("fs");
+var import_node_path94 = __toESM(require("path"), 1);
 var import_promises5 = __toESM(require("readline/promises"), 1);
 var WORDMARK = [
   "\u2588\u2588\u2588\u2557   \u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557",
@@ -31565,15 +31772,17 @@ async function runFrontDoor(deps, out) {
   const login = deps.login ?? (() => Promise.resolve(0));
   const orchestrator = deps.orchestrator ?? (() => Promise.resolve(0));
   const cwd = deps.cwd ?? process.cwd();
+  const flagGiven = deps.instrumentFlagGiven ?? false;
+  const readRegistry2 = deps.readRegistry ?? (() => readRegistry());
   printHeader(out);
   out("Welcome to NEAT. Let's get you a graph of this system.");
   out("");
   const keyReader = deps.readKey !== void 0 ? { read: deps.readKey, done: () => {
   } } : createKeyReader();
   const picked = keyReader !== null ? await selectOption(out, keyReader, deps.moveCursorUp ?? defaultMoveCursorUp) : await selectByNumber(out, readLine);
-  if (picked === void 0) return runSelfHosted(out, readLine, orchestrator, cwd);
+  if (picked === void 0) return runSelfHosted(out, readLine, orchestrator, cwd, readRegistry2, flagGiven);
   if (picked === 0) return login(["--browser"]);
-  return runSelfHosted(out, readLine, orchestrator, cwd);
+  return runSelfHosted(out, readLine, orchestrator, cwd, readRegistry2, flagGiven);
 }
 var MENU_OPTIONS = [
   "Log me into Hosted Neat",
@@ -31676,7 +31885,7 @@ function decodeKey(buf) {
 function defaultMoveCursorUp(rows) {
   if (rows > 0) process.stdout.write(`\x1B[${rows}A`);
 }
-async function runSelfHosted(out, readLine, orchestrator, cwd) {
+async function runSelfHosted(out, readLine, orchestrator, cwd, readRegistry2, instrumentFlagGiven) {
   const wantsPrompt = (await readLine("Print a copy-paste setup prompt for your coding agent? [Y/n]: "))?.trim().toLowerCase();
   if (wantsPrompt !== "n" && wantsPrompt !== "no") {
     out("");
@@ -31687,9 +31896,69 @@ async function runSelfHosted(out, readLine, orchestrator, cwd) {
     out("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
     out("");
   }
+  const project = await resolveProjectName(out, readLine, cwd, readRegistry2);
+  const declined = instrumentFlagGiven ? void 0 : await askToInstrument(out, readLine);
   out("Building your local graph now\u2026");
   out("");
-  return orchestrator(cwd);
+  const overrides = {
+    ...project !== void 0 ? { project } : {},
+    ...declined === void 0 ? {} : declined ? { noInstrument: true } : { yes: true }
+  };
+  return orchestrator(cwd, Object.keys(overrides).length > 0 ? overrides : void 0);
+}
+async function askToInstrument(out, readLine) {
+  out("Instrument the services for OpenTelemetry now?");
+  out("This edits package.json / requirements.txt / go.mod and runs the package manager.");
+  const answer = (await readLine("[Y/n]: "))?.trim().toLowerCase();
+  const declined = answer === "n" || answer === "no";
+  if (declined) {
+    out("");
+    out("Skipping instrumentation \u2014 the graph will hold the declared side only.");
+    out("Run `neat init . --apply` when you want the runtime half.");
+  }
+  out("");
+  return declined;
+}
+async function resolveProjectName(out, readLine, cwd, readRegistry2) {
+  const here = import_node_path94.default.resolve(cwd);
+  const base = import_node_path94.default.basename(here);
+  let taken;
+  try {
+    const { projects } = await readRegistry2();
+    taken = new Map(projects.map((p) => [p.name, p.path]));
+  } catch {
+    return void 0;
+  }
+  const clash = taken.get(base);
+  if (clash === void 0 || import_node_path94.default.resolve(clash) === here) return void 0;
+  out("");
+  out(`A project named \`${base}\` is already registered (${clash}).`);
+  const suggested = firstFreeName(base, taken);
+  for (; ; ) {
+    const answer = (await readLine(`Name this one: [${suggested}] `))?.trim();
+    if (answer === void 0) return suggested;
+    const chosen = answer.length === 0 ? suggested : answer;
+    if (!isUsableProjectName(chosen)) {
+      out(`"${chosen}" won't work as a project name \u2014 letters, digits, dot, dash and underscore.`);
+      continue;
+    }
+    const other = taken.get(chosen);
+    if (other !== void 0 && import_node_path94.default.resolve(other) !== here) {
+      out(`\`${chosen}\` is registered too (${other}).`);
+      continue;
+    }
+    out("");
+    return chosen;
+  }
+}
+function firstFreeName(base, taken) {
+  for (let n = 2; ; n++) {
+    const candidate = `${base}-${n}`;
+    if (!taken.has(candidate)) return candidate;
+  }
+}
+function isUsableProjectName(name) {
+  return name.length > 0 && name !== "." && name !== ".." && /^[A-Za-z0-9._-]+$/.test(name);
 }
 async function shouldShowWelcome(deps = {}) {
   const stdinTTY = deps.stdinIsTTY ?? Boolean(process.stdin.isTTY);
@@ -31699,9 +31968,9 @@ async function shouldShowWelcome(deps = {}) {
   const readRegistry2 = deps.readRegistry ?? (() => readRegistry());
   const hasSnapshot = deps.hasSnapshot ?? defaultHasSnapshot;
   try {
-    const here = import_node_path93.default.resolve(cwd);
+    const here = import_node_path94.default.resolve(cwd);
     const { projects } = await readRegistry2();
-    if (projects.some((p) => import_node_path93.default.resolve(p.path) === here)) return false;
+    if (projects.some((p) => import_node_path94.default.resolve(p.path) === here)) return false;
     if (await hasSnapshot(here)) return false;
     return true;
   } catch {
@@ -31710,7 +31979,7 @@ async function shouldShowWelcome(deps = {}) {
 }
 async function defaultHasSnapshot(cwd) {
   try {
-    const entries = await import_node_fs55.promises.readdir(import_node_path93.default.join(cwd, "neat-out"));
+    const entries = await import_node_fs56.promises.readdir(import_node_path94.default.join(cwd, "neat-out"));
     return entries.some((e) => e.endsWith(".json"));
   } catch {
     return false;
@@ -31728,27 +31997,27 @@ async function defaultReadLine2(prompt) {
 
 // src/hooks-cli.ts
 init_cjs_shims();
-var import_node_path94 = __toESM(require("path"), 1);
+var import_node_path95 = __toESM(require("path"), 1);
 var import_node_os8 = __toESM(require("os"), 1);
-var import_node_fs56 = require("fs");
+var import_node_fs57 = require("fs");
 var import_node_url5 = require("url");
 var HOOK_FILENAME = "neat-search-nudge.mjs";
 var GUIDE_FILENAME = "GRAPH_FIRST.md";
 var GUIDE_INSTALL_NAME = "neat-graph-first.md";
 var HOOK_MATCHER = "Grep|Glob|Bash";
 function moduleDir() {
-  return typeof __dirname !== "undefined" ? __dirname : import_node_path94.default.dirname((0, import_node_url5.fileURLToPath)(importMetaUrl));
+  return typeof __dirname !== "undefined" ? __dirname : import_node_path95.default.dirname((0, import_node_url5.fileURLToPath)(importMetaUrl));
 }
 async function readSkillAsset(rel) {
   const here = moduleDir();
   const candidates = [
-    import_node_path94.default.resolve(here, "../../claude-skill", rel),
-    import_node_path94.default.resolve(here, "../../../claude-skill", rel),
-    import_node_path94.default.resolve(here, "../claude-skill", rel)
+    import_node_path95.default.resolve(here, "../../claude-skill", rel),
+    import_node_path95.default.resolve(here, "../../../claude-skill", rel),
+    import_node_path95.default.resolve(here, "../claude-skill", rel)
   ];
   for (const candidate of candidates) {
     try {
-      return await import_node_fs56.promises.readFile(candidate, "utf8");
+      return await import_node_fs57.promises.readFile(candidate, "utf8");
     } catch {
     }
   }
@@ -31758,20 +32027,20 @@ async function readSkillAsset(rel) {
 }
 function neatHome4() {
   const override = process.env.NEAT_HOME;
-  if (override && override.length > 0) return import_node_path94.default.resolve(override);
-  return import_node_path94.default.join(import_node_os8.default.homedir(), ".neat");
+  if (override && override.length > 0) return import_node_path95.default.resolve(override);
+  return import_node_path95.default.join(import_node_os8.default.homedir(), ".neat");
 }
 function claudeSettingsPath() {
   const override = process.env.NEAT_CLAUDE_SETTINGS;
-  if (override && override.length > 0) return import_node_path94.default.resolve(override);
+  if (override && override.length > 0) return import_node_path95.default.resolve(override);
   const home = process.env.HOME ?? process.env.USERPROFILE ?? import_node_os8.default.homedir();
-  return import_node_path94.default.join(home, ".claude", "settings.json");
+  return import_node_path95.default.join(home, ".claude", "settings.json");
 }
 function installedHookPath() {
-  return import_node_path94.default.join(neatHome4(), "hooks", HOOK_FILENAME);
+  return import_node_path95.default.join(neatHome4(), "hooks", HOOK_FILENAME);
 }
 function gateFlagPath() {
-  return import_node_path94.default.join(neatHome4(), "hooks", "gate-enabled");
+  return import_node_path95.default.join(neatHome4(), "hooks", "gate-enabled");
 }
 function isNeatSearchEntry(entry2) {
   return (entry2.hooks ?? []).some(
@@ -31804,14 +32073,14 @@ async function runHooks(opts) {
     const hookScript = await readSkillAsset(`hooks/${HOOK_FILENAME}`);
     const guide = await readSkillAsset(GUIDE_FILENAME);
     const scriptPath = installedHookPath();
-    await import_node_fs56.promises.mkdir(import_node_path94.default.dirname(scriptPath), { recursive: true });
-    await import_node_fs56.promises.writeFile(scriptPath, hookScript, { mode: 493 });
-    const guidePath = import_node_path94.default.join(neatHome4(), GUIDE_INSTALL_NAME);
-    await import_node_fs56.promises.writeFile(guidePath, guide, "utf8");
+    await import_node_fs57.promises.mkdir(import_node_path95.default.dirname(scriptPath), { recursive: true });
+    await import_node_fs57.promises.writeFile(scriptPath, hookScript, { mode: 493 });
+    const guidePath = import_node_path95.default.join(neatHome4(), GUIDE_INSTALL_NAME);
+    await import_node_fs57.promises.writeFile(guidePath, guide, "utf8");
     const settingsFile = claudeSettingsPath();
     let settings = {};
     try {
-      settings = JSON.parse(await import_node_fs56.promises.readFile(settingsFile, "utf8"));
+      settings = JSON.parse(await import_node_fs57.promises.readFile(settingsFile, "utf8"));
     } catch (err) {
       if (err.code !== "ENOENT") {
         console.error(
@@ -31833,14 +32102,14 @@ async function runHooks(opts) {
       ...settings,
       hooks: { ...hooks, PreToolUse: preToolUse }
     };
-    await import_node_fs56.promises.mkdir(import_node_path94.default.dirname(settingsFile), { recursive: true });
-    await import_node_fs56.promises.writeFile(settingsFile, JSON.stringify(merged, null, 2) + "\n", "utf8");
+    await import_node_fs57.promises.mkdir(import_node_path95.default.dirname(settingsFile), { recursive: true });
+    await import_node_fs57.promises.writeFile(settingsFile, JSON.stringify(merged, null, 2) + "\n", "utf8");
     const flag = gateFlagPath();
     if (opts.gate) {
-      await import_node_fs56.promises.mkdir(import_node_path94.default.dirname(flag), { recursive: true });
-      await import_node_fs56.promises.writeFile(flag, "1\n", "utf8");
+      await import_node_fs57.promises.mkdir(import_node_path95.default.dirname(flag), { recursive: true });
+      await import_node_fs57.promises.writeFile(flag, "1\n", "utf8");
     } else {
-      await import_node_fs56.promises.rm(flag, { force: true });
+      await import_node_fs57.promises.rm(flag, { force: true });
     }
     const mode = opts.gate ? "GATE (deny search until you ask the graph)" : "nudge (search still runs)";
     console.log(`neat hooks: installed the search hook in ${opts.gate ? "gate" : "nudge"} mode`);
@@ -31930,8 +32199,8 @@ async function runHooksCommand(args) {
 
 // src/claude-cli.ts
 init_cjs_shims();
-var import_node_path95 = __toESM(require("path"), 1);
-var import_node_fs57 = require("fs");
+var import_node_path96 = __toESM(require("path"), 1);
+var import_node_fs58 = require("fs");
 var NEAT_SECTION_HEADING = "## neat";
 var NEAT_DIRECTIVE_BODY = `This project has NEAT wired in: a live, fused semantic graph of the system \u2014
 code and runtime behaviour (OpenTelemetry) in one model, every fact tagged with
@@ -31965,8 +32234,8 @@ ${NEAT_DIRECTIVE_BODY}
 }
 function claudeMdPath() {
   const override = process.env.NEAT_CLAUDE_MD;
-  if (override && override.length > 0) return import_node_path95.default.resolve(override);
-  return import_node_path95.default.join(process.cwd(), "CLAUDE.md");
+  if (override && override.length > 0) return import_node_path96.default.resolve(override);
+  return import_node_path96.default.join(process.cwd(), "CLAUDE.md");
 }
 function splitAroundSection(raw) {
   const lines = raw.split("\n");
@@ -31994,7 +32263,7 @@ function compose(before, after) {
 }
 async function readIfExists2(file) {
   try {
-    return await import_node_fs57.promises.readFile(file, "utf8");
+    return await import_node_fs58.promises.readFile(file, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return null;
     throw err;
@@ -32005,8 +32274,8 @@ async function runInstall() {
   const raw = await readIfExists2(file) ?? "";
   const { before, after, found } = splitAroundSection(raw);
   const next = compose(before, after);
-  await import_node_fs57.promises.mkdir(import_node_path95.default.dirname(file), { recursive: true });
-  await import_node_fs57.promises.writeFile(file, next, "utf8");
+  await import_node_fs58.promises.mkdir(import_node_path96.default.dirname(file), { recursive: true });
+  await import_node_fs58.promises.writeFile(file, next, "utf8");
   const verb = raw.length === 0 ? "created" : found ? "refreshed" : "added";
   console.log(`neat claude: ${verb} the \`${NEAT_SECTION_HEADING}\` section in ${file}`);
   console.log("Your agent will now reach for `neat ask` before Read/Grep/Bash. Restart the");
@@ -32027,7 +32296,7 @@ async function runUninstall() {
   }
   const remaining = [before, after].filter((s) => s.length > 0).join("\n\n");
   const next = remaining.length > 0 ? remaining.replace(/\n*$/, "") + "\n" : "";
-  await import_node_fs57.promises.writeFile(file, next, "utf8");
+  await import_node_fs58.promises.writeFile(file, next, "utf8");
   console.log(`neat claude: removed the \`${NEAT_SECTION_HEADING}\` section from ${file}.`);
   return { exitCode: 0 };
 }
@@ -32070,10 +32339,10 @@ async function runClaudeCommand(args) {
 
 // src/codex-cli.ts
 init_cjs_shims();
-var import_node_path96 = __toESM(require("path"), 1);
+var import_node_path97 = __toESM(require("path"), 1);
 var import_node_os9 = __toESM(require("os"), 1);
-var import_node_fs58 = require("fs");
-var import_node_util = require("util");
+var import_node_fs59 = require("fs");
+var import_node_util2 = require("util");
 var import_smol_toml6 = require("smol-toml");
 var CODEX_MCP_SERVER = {
   command: "npx",
@@ -32090,14 +32359,14 @@ var NEAT_GRAPH_FIRST_START = "<!-- neat:graph-first -->";
 var NEAT_GRAPH_FIRST_END = "<!-- /neat:graph-first -->";
 function codexConfigPath() {
   const override = process.env.NEAT_CODEX_CONFIG;
-  if (override && override.length > 0) return import_node_path96.default.resolve(override);
+  if (override && override.length > 0) return import_node_path97.default.resolve(override);
   const home = process.env.HOME ?? process.env.USERPROFILE ?? import_node_os9.default.homedir();
-  return import_node_path96.default.join(home, ".codex", "config.toml");
+  return import_node_path97.default.join(home, ".codex", "config.toml");
 }
 function agentsFilePath() {
   const override = process.env.NEAT_CODEX_AGENTS;
-  if (override && override.length > 0) return import_node_path96.default.resolve(override);
-  return import_node_path96.default.join(process.cwd(), "AGENTS.md");
+  if (override && override.length > 0) return import_node_path97.default.resolve(override);
+  return import_node_path97.default.join(process.cwd(), "AGENTS.md");
 }
 function isTableHeader(line) {
   return /^\s*\[\[?[^\]]+\]\]?\s*$/.test(line);
@@ -32174,17 +32443,17 @@ function verifyPreserved(raw, spliced, original) {
   }
   const origServers = original.mcp_servers ?? {};
   const nextServers = next.mcp_servers ?? {};
-  if (!(0, import_node_util.isDeepStrictEqual)(nextServers.neat, CODEX_MCP_SERVER)) return false;
+  if (!(0, import_node_util2.isDeepStrictEqual)(nextServers.neat, CODEX_MCP_SERVER)) return false;
   for (const name of Object.keys(origServers)) {
     if (name === "neat") continue;
-    if (!(0, import_node_util.isDeepStrictEqual)(nextServers[name], origServers[name])) return false;
+    if (!(0, import_node_util2.isDeepStrictEqual)(nextServers[name], origServers[name])) return false;
   }
   for (const name of Object.keys(nextServers)) {
     if (name !== "neat" && !(name in origServers)) return false;
   }
   for (const key of Object.keys(original)) {
     if (key === "mcp_servers") continue;
-    if (!(0, import_node_util.isDeepStrictEqual)(next[key], original[key])) return false;
+    if (!(0, import_node_util2.isDeepStrictEqual)(next[key], original[key])) return false;
   }
   for (const key of Object.keys(next)) {
     if (key !== "mcp_servers" && !(key in original)) return false;
@@ -32231,7 +32500,7 @@ async function runCodex(opts) {
   const agentsPath = agentsFilePath();
   let configRaw = "";
   try {
-    configRaw = await import_node_fs58.promises.readFile(configPath, "utf8");
+    configRaw = await import_node_fs59.promises.readFile(configPath, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") {
       console.error(`neat codex: failed to read ${configPath} \u2014 ${err.message}`);
@@ -32240,7 +32509,7 @@ async function runCodex(opts) {
   }
   let agentsRaw = "";
   try {
-    agentsRaw = await import_node_fs58.promises.readFile(agentsPath, "utf8");
+    agentsRaw = await import_node_fs59.promises.readFile(agentsPath, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") {
       console.error(`neat codex: failed to read ${agentsPath} \u2014 ${err.message}`);
@@ -32280,15 +32549,15 @@ async function runCodex(opts) {
     return { exitCode: 0 };
   }
   if (config.changed) {
-    await import_node_fs58.promises.mkdir(import_node_path96.default.dirname(configPath), { recursive: true });
-    await import_node_fs58.promises.writeFile(configPath, config.text, "utf8");
+    await import_node_fs59.promises.mkdir(import_node_path97.default.dirname(configPath), { recursive: true });
+    await import_node_fs59.promises.writeFile(configPath, config.text, "utf8");
     console.log(`neat codex: wrote [mcp_servers.neat] to ${configPath}`);
   } else {
     console.log(`neat codex: ${configPath} already has NEAT's MCP server`);
   }
   if (agents.changed) {
-    await import_node_fs58.promises.mkdir(import_node_path96.default.dirname(agentsPath), { recursive: true });
-    await import_node_fs58.promises.writeFile(agentsPath, agents.text, "utf8");
+    await import_node_fs59.promises.mkdir(import_node_path97.default.dirname(agentsPath), { recursive: true });
+    await import_node_fs59.promises.writeFile(agentsPath, agents.text, "utf8");
     console.log(`neat codex: wrote the graph-first block to ${agentsPath}`);
   } else {
     console.log(`neat codex: ${agentsPath} already has the graph-first block`);
@@ -32345,10 +32614,10 @@ async function runCodexCommand(args) {
 
 // src/editors-cli.ts
 init_cjs_shims();
-var import_node_path97 = __toESM(require("path"), 1);
+var import_node_path98 = __toESM(require("path"), 1);
 var import_node_os10 = __toESM(require("os"), 1);
-var import_node_fs59 = require("fs");
-var import_node_util2 = require("util");
+var import_node_fs60 = require("fs");
+var import_node_util3 = require("util");
 var jsonc = __toESM(require("jsonc-parser"), 1);
 var NEAT_MCP_SERVER = {
   command: "npx",
@@ -32371,17 +32640,17 @@ function homeDir() {
 }
 function xdgConfigDir() {
   const xdg = process.env.XDG_CONFIG_HOME;
-  return xdg && xdg.length > 0 ? import_node_path97.default.resolve(xdg) : import_node_path97.default.join(homeDir(), ".config");
+  return xdg && xdg.length > 0 ? import_node_path98.default.resolve(xdg) : import_node_path98.default.join(homeDir(), ".config");
 }
 function envOverride(name) {
   const v = process.env[name];
-  return v && v.length > 0 ? import_node_path97.default.resolve(v) : void 0;
+  return v && v.length > 0 ? import_node_path98.default.resolve(v) : void 0;
 }
 var CURSOR_CLIENT = {
   id: "cursor",
   label: "Cursor",
   docsUrl: "https://docs.cursor.com/context/mcp",
-  mcpConfigPath: () => envOverride("NEAT_CURSOR_CONFIG") ?? import_node_path97.default.join(homeDir(), ".cursor", "mcp.json"),
+  mcpConfigPath: () => envOverride("NEAT_CURSOR_CONFIG") ?? import_node_path98.default.join(homeDir(), ".cursor", "mcp.json"),
   mcpContainerKey: "mcpServers",
   format: "json",
   // Cursor still reads a single `.cursorrules` at the project root (the modern
@@ -32393,7 +32662,7 @@ var DEVIN_CLIENT = {
   id: "devin",
   label: "Devin Desktop (Cascade)",
   docsUrl: "https://docs.devin.ai/desktop/cascade/mcp",
-  mcpConfigPath: () => envOverride("NEAT_DEVIN_CONFIG") ?? import_node_path97.default.join(homeDir(), ".codeium", "windsurf", "mcp_config.json"),
+  mcpConfigPath: () => envOverride("NEAT_DEVIN_CONFIG") ?? import_node_path98.default.join(homeDir(), ".codeium", "windsurf", "mcp_config.json"),
   mcpContainerKey: "mcpServers",
   format: "json",
   rulesFileName: ".windsurfrules"
@@ -32402,7 +32671,7 @@ var GEMINI_CLIENT = {
   id: "gemini",
   label: "Gemini CLI",
   docsUrl: "https://github.com/google-gemini/gemini-cli/blob/main/docs/tools/mcp-server.md",
-  mcpConfigPath: () => envOverride("NEAT_GEMINI_CONFIG") ?? import_node_path97.default.join(homeDir(), ".gemini", "settings.json"),
+  mcpConfigPath: () => envOverride("NEAT_GEMINI_CONFIG") ?? import_node_path98.default.join(homeDir(), ".gemini", "settings.json"),
   mcpContainerKey: "mcpServers",
   format: "json",
   rulesFileName: "GEMINI.md"
@@ -32411,7 +32680,7 @@ var QWEN_CLIENT = {
   id: "qwen",
   label: "Qwen Code",
   docsUrl: "https://qwenlm.github.io/qwen-code-docs/en/users/features/mcp/",
-  mcpConfigPath: () => envOverride("NEAT_QWEN_CONFIG") ?? import_node_path97.default.join(homeDir(), ".qwen", "settings.json"),
+  mcpConfigPath: () => envOverride("NEAT_QWEN_CONFIG") ?? import_node_path98.default.join(homeDir(), ".qwen", "settings.json"),
   mcpContainerKey: "mcpServers",
   format: "json",
   rulesFileName: "QWEN.md"
@@ -32420,7 +32689,7 @@ var AMAZONQ_CLIENT = {
   id: "amazonq",
   label: "Amazon Q Developer CLI",
   docsUrl: "https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/command-line-mcp-configuration.html",
-  mcpConfigPath: () => envOverride("NEAT_AMAZONQ_CONFIG") ?? import_node_path97.default.join(homeDir(), ".aws", "amazonq", "mcp.json"),
+  mcpConfigPath: () => envOverride("NEAT_AMAZONQ_CONFIG") ?? import_node_path98.default.join(homeDir(), ".aws", "amazonq", "mcp.json"),
   mcpContainerKey: "mcpServers",
   format: "json"
 };
@@ -32428,7 +32697,7 @@ var ROOCODE_CLIENT = {
   id: "roocode",
   label: "Roo Code",
   docsUrl: "https://roocodeinc.github.io/Roo-Code/features/mcp/using-mcp-in-roo",
-  mcpConfigPath: () => envOverride("NEAT_ROOCODE_CONFIG") ?? import_node_path97.default.join(process.cwd(), ".roo", "mcp.json"),
+  mcpConfigPath: () => envOverride("NEAT_ROOCODE_CONFIG") ?? import_node_path98.default.join(process.cwd(), ".roo", "mcp.json"),
   mcpContainerKey: "mcpServers",
   format: "json"
 };
@@ -32441,9 +32710,9 @@ var ZED_CLIENT = {
     if (override) return override;
     if (process.platform === "win32") {
       const appData = process.env.APPDATA;
-      if (appData && appData.length > 0) return import_node_path97.default.join(appData, "Zed", "settings.json");
+      if (appData && appData.length > 0) return import_node_path98.default.join(appData, "Zed", "settings.json");
     }
-    return import_node_path97.default.join(homeDir(), ".config", "zed", "settings.json");
+    return import_node_path98.default.join(homeDir(), ".config", "zed", "settings.json");
   },
   mcpContainerKey: "context_servers",
   format: "jsonc",
@@ -32453,7 +32722,7 @@ var OPENCODE_CLIENT = {
   id: "opencode",
   label: "OpenCode",
   docsUrl: "https://opencode.ai/docs/mcp-servers/",
-  mcpConfigPath: () => envOverride("NEAT_OPENCODE_CONFIG") ?? import_node_path97.default.join(xdgConfigDir(), "opencode", "opencode.json"),
+  mcpConfigPath: () => envOverride("NEAT_OPENCODE_CONFIG") ?? import_node_path98.default.join(xdgConfigDir(), "opencode", "opencode.json"),
   mcpContainerKey: "mcp",
   format: "json",
   serverEntry: NEAT_OPENCODE_SERVER,
@@ -32463,7 +32732,7 @@ var CRUSH_CLIENT = {
   id: "crush",
   label: "Crush",
   docsUrl: "https://charmbracelet-crush.mintlify.app/configuration/mcp",
-  mcpConfigPath: () => envOverride("NEAT_CRUSH_CONFIG") ?? import_node_path97.default.join(xdgConfigDir(), "crush", "crush.json"),
+  mcpConfigPath: () => envOverride("NEAT_CRUSH_CONFIG") ?? import_node_path98.default.join(xdgConfigDir(), "crush", "crush.json"),
   mcpContainerKey: "mcp",
   format: "json",
   serverEntry: NEAT_CRUSH_SERVER,
@@ -32482,7 +32751,7 @@ var CLIENTS = {
 };
 function mergeJsonMcp(existing, containerKey, serverEntry) {
   const servers = existing[containerKey] ?? {};
-  const already = (0, import_node_util2.isDeepStrictEqual)(servers.neat, serverEntry);
+  const already = (0, import_node_util3.isDeepStrictEqual)(servers.neat, serverEntry);
   const merged = {
     ...existing,
     [containerKey]: { ...servers, neat: serverEntry }
@@ -32493,7 +32762,7 @@ function mergeJsoncMcp(raw, containerKey, serverEntry) {
   const base = raw.trim().length > 0 ? raw : "{}";
   const parsed = jsonc.parse(base) ?? {};
   const servers = parsed[containerKey] ?? {};
-  if ((0, import_node_util2.isDeepStrictEqual)(servers.neat, serverEntry)) {
+  if ((0, import_node_util3.isDeepStrictEqual)(servers.neat, serverEntry)) {
     return { text: raw, changed: false };
   }
   const edits = jsonc.modify(base, [containerKey, "neat"], serverEntry, {
@@ -32526,7 +32795,7 @@ async function planMcp(client, mcpPath) {
   const serverEntry = client.serverEntry ?? NEAT_MCP_SERVER;
   let raw = "";
   try {
-    raw = await import_node_fs59.promises.readFile(mcpPath, "utf8");
+    raw = await import_node_fs60.promises.readFile(mcpPath, "utf8");
   } catch (err) {
     const e = err;
     if (e.code === "ENOENT") {
@@ -32568,7 +32837,7 @@ async function runEditorInstall(client, opts) {
   const mcpPath = client.mcpConfigPath();
   const serverEntry = client.serverEntry ?? NEAT_MCP_SERVER;
   const hasRules = typeof client.rulesFileName === "string";
-  const rulesPath = hasRules ? import_node_path97.default.join(opts.projectDir, client.rulesFileName) : "";
+  const rulesPath = hasRules ? import_node_path98.default.join(opts.projectDir, client.rulesFileName) : "";
   const mcp = await planMcp(client, mcpPath);
   if (mcp === null) return { exitCode: 1 };
   let existingRules = "";
@@ -32577,7 +32846,7 @@ async function runEditorInstall(client, opts) {
   let block = "";
   if (hasRules) {
     try {
-      existingRules = await import_node_fs59.promises.readFile(rulesPath, "utf8");
+      existingRules = await import_node_fs60.promises.readFile(rulesPath, "utf8");
     } catch (err) {
       if (err.code !== "ENOENT") {
         console.error(`neat ${client.id}: failed to read ${rulesPath} \u2014 ${err.message}`);
@@ -32611,11 +32880,11 @@ async function runEditorInstall(client, opts) {
     );
     return { exitCode: 0 };
   }
-  await import_node_fs59.promises.mkdir(import_node_path97.default.dirname(mcpPath), { recursive: true });
-  await import_node_fs59.promises.writeFile(mcpPath, mcp.text, "utf8");
+  await import_node_fs60.promises.mkdir(import_node_path98.default.dirname(mcpPath), { recursive: true });
+  await import_node_fs60.promises.writeFile(mcpPath, mcp.text, "utf8");
   if (hasRules) {
-    await import_node_fs59.promises.mkdir(import_node_path97.default.dirname(rulesPath), { recursive: true });
-    await import_node_fs59.promises.writeFile(rulesPath, newRules, "utf8");
+    await import_node_fs60.promises.mkdir(import_node_path98.default.dirname(rulesPath), { recursive: true });
+    await import_node_fs60.promises.writeFile(rulesPath, newRules, "utf8");
   }
   console.log(`neat ${client.id}: wired NEAT into ${client.label}`);
   console.log(`  MCP server: ${mcpPath} (${client.mcpContainerKey}.neat \u2192 npx -y @neat.is/mcp)`);
@@ -33117,7 +33386,7 @@ function sleep(ms, signal) {
 
 // src/cli-verbs.ts
 init_cjs_shims();
-var import_node_path98 = __toESM(require("path"), 1);
+var import_node_path99 = __toESM(require("path"), 1);
 async function resolveProjectEntry(opts) {
   const entries = await listProjects();
   if (opts.project) {
@@ -33127,7 +33396,7 @@ async function resolveProjectEntry(opts) {
   const cwd = opts.cwd ?? process.cwd();
   const resolvedCwd = await normalizeProjectPath(cwd);
   for (const entry2 of entries) {
-    if (resolvedCwd === entry2.path || resolvedCwd.startsWith(`${entry2.path}${import_node_path98.default.sep}`)) {
+    if (resolvedCwd === entry2.path || resolvedCwd.startsWith(`${entry2.path}${import_node_path99.default.sep}`)) {
       return entry2;
     }
   }
@@ -33302,6 +33571,7 @@ async function runSync(opts) {
 
 // src/cli.ts
 var import_types112 = require("@neat.is/types");
+init_auth();
 function usage5() {
   const neat = commandPrefix();
   console.log("Installed via npx? Prefix commands with `npx neat.is`, or install once: `npm i -g neat.is`.");
@@ -33704,7 +33974,7 @@ async function buildPatchSections(services, project) {
 }
 async function runInit(opts) {
   const written = [];
-  const stat = await import_node_fs60.promises.stat(opts.scanPath).catch(() => null);
+  const stat = await import_node_fs61.promises.stat(opts.scanPath).catch(() => null);
   if (!stat || !stat.isDirectory()) {
     console.error(`neat init: ${opts.scanPath} is not a directory`);
     return { exitCode: 2, writtenFiles: written };
@@ -33713,13 +33983,13 @@ async function runInit(opts) {
   printDiscoveryReport(opts, services);
   const sections = opts.noInstall ? [] : await buildPatchSections(services, opts.project);
   const patch = renderPatch(sections);
-  const patchPath = import_node_path99.default.join(opts.scanPath, "neat.patch");
+  const patchPath = import_node_path100.default.join(opts.scanPath, "neat.patch");
   if (opts.dryRun) {
-    await import_node_fs60.promises.writeFile(patchPath, patch, "utf8");
+    await import_node_fs61.promises.writeFile(patchPath, patch, "utf8");
     written.push(patchPath);
     console.log(`dry-run: patch written to ${patchPath}`);
-    const gitignorePath = import_node_path99.default.join(opts.scanPath, ".gitignore");
-    const gitignoreExists = await import_node_fs60.promises.stat(gitignorePath).then(() => true).catch(() => false);
+    const gitignorePath = import_node_path100.default.join(opts.scanPath, ".gitignore");
+    const gitignoreExists = await import_node_fs61.promises.stat(gitignorePath).then(() => true).catch(() => false);
     const verb = gitignoreExists ? "append" : "create";
     console.log(`dry-run: would ${verb} ${gitignorePath} (add neat-out/)`);
     console.log("rerun without --dry-run to register and snapshot.");
@@ -33730,9 +34000,9 @@ async function runInit(opts) {
   const graph = getGraph(graphKey);
   const projectPaths = pathsForProject(
     graphKey,
-    import_node_path99.default.join(opts.scanPath, "neat-out")
+    import_node_path100.default.join(opts.scanPath, "neat-out")
   );
-  const errorsPath = import_node_path99.default.join(import_node_path99.default.dirname(opts.outPath), import_node_path99.default.basename(projectPaths.errorsPath));
+  const errorsPath = import_node_path100.default.join(import_node_path100.default.dirname(opts.outPath), import_node_path100.default.basename(projectPaths.errorsPath));
   const result = await extractFromDirectory(graph, opts.scanPath, { errorsPath });
   await saveGraphToDisk(graph, opts.outPath);
   written.push(opts.outPath);
@@ -33811,7 +34081,7 @@ async function runInit(opts) {
         console.log("Run `npm install` (or your language equivalent) to refresh lockfiles.");
       }
     } else {
-      await import_node_fs60.promises.writeFile(patchPath, patch, "utf8");
+      await import_node_fs61.promises.writeFile(patchPath, patch, "utf8");
       written.push(patchPath);
     }
   }
@@ -33852,9 +34122,9 @@ var CLAUDE_SKILL_CONFIG = {
 };
 function claudeConfigPath() {
   const override = process.env.NEAT_CLAUDE_CONFIG;
-  if (override && override.length > 0) return import_node_path99.default.resolve(override);
+  if (override && override.length > 0) return import_node_path100.default.resolve(override);
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return import_node_path99.default.join(home, ".claude.json");
+  return import_node_path100.default.join(home, ".claude.json");
 }
 async function runSkill(opts) {
   const snippet2 = JSON.stringify(CLAUDE_SKILL_CONFIG, null, 2) + "\n";
@@ -33866,7 +34136,7 @@ async function runSkill(opts) {
     const target = claudeConfigPath();
     let existing = {};
     try {
-      existing = JSON.parse(await import_node_fs60.promises.readFile(target, "utf8"));
+      existing = JSON.parse(await import_node_fs61.promises.readFile(target, "utf8"));
     } catch (err) {
       if (err.code !== "ENOENT") {
         console.error(`neat skill: failed to read ${target} \u2014 ${err.message}`);
@@ -33878,8 +34148,8 @@ async function runSkill(opts) {
       ...existing,
       mcpServers: { ...mcp, neat: CLAUDE_SKILL_CONFIG.mcpServers.neat }
     };
-    await import_node_fs60.promises.mkdir(import_node_path99.default.dirname(target), { recursive: true });
-    await import_node_fs60.promises.writeFile(target, JSON.stringify(merged, null, 2) + "\n", "utf8");
+    await import_node_fs61.promises.mkdir(import_node_path100.default.dirname(target), { recursive: true });
+    await import_node_fs61.promises.writeFile(target, JSON.stringify(merged, null, 2) + "\n", "utf8");
     console.log(`neat skill: wrote mcpServers.neat to ${target}`);
     console.log("restart Claude Code to pick up the new MCP server.");
     console.log("");
@@ -34000,12 +34270,12 @@ async function main() {
       console.error("neat init: --apply and --dry-run are mutually exclusive");
       process.exit(2);
     }
-    const scanPath = import_node_path99.default.resolve(target);
+    const scanPath = import_node_path100.default.resolve(target);
     const projectExplicit = parsed.project !== null;
-    const projectName = projectExplicit ? project : import_node_path99.default.basename(scanPath);
+    const projectName = projectExplicit ? project : import_node_path100.default.basename(scanPath);
     const projectKey = projectExplicit ? project : DEFAULT_PROJECT;
-    const fallback = pathsForProject(projectKey, import_node_path99.default.join(scanPath, "neat-out")).snapshotPath;
-    const outPath = import_node_path99.default.resolve(process.env.NEAT_OUT_PATH ?? fallback);
+    const fallback = pathsForProject(projectKey, import_node_path100.default.join(scanPath, "neat-out")).snapshotPath;
+    const outPath = import_node_path100.default.resolve(process.env.NEAT_OUT_PATH ?? fallback);
     const result = await runInit({
       scanPath,
       outPath,
@@ -34026,21 +34296,21 @@ async function main() {
       usage5();
       process.exit(2);
     }
-    const scanPath = import_node_path99.default.resolve(target);
-    const stat = await import_node_fs60.promises.stat(scanPath).catch(() => null);
+    const scanPath = import_node_path100.default.resolve(target);
+    const stat = await import_node_fs61.promises.stat(scanPath).catch(() => null);
     if (!stat || !stat.isDirectory()) {
       console.error(`neat watch: ${scanPath} is not a directory`);
       process.exit(2);
     }
-    const projectPaths = pathsForProject(project, import_node_path99.default.join(scanPath, "neat-out"));
-    const outPath = import_node_path99.default.resolve(process.env.NEAT_OUT_PATH ?? projectPaths.snapshotPath);
-    const errorsPath = import_node_path99.default.resolve(
-      process.env.NEAT_ERRORS_PATH ?? import_node_path99.default.join(import_node_path99.default.dirname(outPath), import_node_path99.default.basename(projectPaths.errorsPath))
+    const projectPaths = pathsForProject(project, import_node_path100.default.join(scanPath, "neat-out"));
+    const outPath = import_node_path100.default.resolve(process.env.NEAT_OUT_PATH ?? projectPaths.snapshotPath);
+    const errorsPath = import_node_path100.default.resolve(
+      process.env.NEAT_ERRORS_PATH ?? import_node_path100.default.join(import_node_path100.default.dirname(outPath), import_node_path100.default.basename(projectPaths.errorsPath))
     );
-    const staleEventsPath = import_node_path99.default.resolve(
-      process.env.NEAT_STALE_EVENTS_PATH ?? import_node_path99.default.join(import_node_path99.default.dirname(outPath), import_node_path99.default.basename(projectPaths.staleEventsPath))
+    const staleEventsPath = import_node_path100.default.resolve(
+      process.env.NEAT_STALE_EVENTS_PATH ?? import_node_path100.default.join(import_node_path100.default.dirname(outPath), import_node_path100.default.basename(projectPaths.staleEventsPath))
     );
-    const embeddingsCachePath = process.env.NEAT_EMBEDDINGS_CACHE_PATH ? import_node_path99.default.resolve(process.env.NEAT_EMBEDDINGS_CACHE_PATH) : void 0;
+    const embeddingsCachePath = process.env.NEAT_EMBEDDINGS_CACHE_PATH ? import_node_path100.default.resolve(process.env.NEAT_EMBEDDINGS_CACHE_PATH) : void 0;
     const handle = await startWatch(getGraph(project), {
       scanPath,
       outPath,
@@ -34049,7 +34319,7 @@ async function main() {
       project,
       // Resolve NEAT_HOME so a `neat watch` picks up connectors added to
       // ~/.neat/connectors.json (#871). Same resolution the rest of the CLI uses.
-      neatHome: process.env.NEAT_HOME ? import_node_path99.default.resolve(process.env.NEAT_HOME) : import_node_path99.default.join(import_node_os11.default.homedir(), ".neat"),
+      neatHome: process.env.NEAT_HOME ? import_node_path100.default.resolve(process.env.NEAT_HOME) : import_node_path100.default.join(import_node_os11.default.homedir(), ".neat"),
       ...embeddingsCachePath ? { embeddingsCachePath } : {},
       host: process.env.HOST ?? "0.0.0.0",
       port: Number(process.env.PORT ?? 8080),
@@ -34231,11 +34501,11 @@ async function main() {
   process.exit(1);
 }
 async function tryOrchestrator(cmd, parsed) {
-  const scanPath = import_node_path99.default.resolve(cmd);
-  const stat = await import_node_fs60.promises.stat(scanPath).catch(() => null);
+  const scanPath = import_node_path100.default.resolve(cmd);
+  const stat = await import_node_fs61.promises.stat(scanPath).catch(() => null);
   if (!stat || !stat.isDirectory()) return null;
   const projectExplicit = parsed.project !== null;
-  const projectName = projectExplicit ? parsed.project : import_node_path99.default.basename(scanPath);
+  const projectName = projectExplicit ? parsed.project : import_node_path100.default.basename(scanPath);
   const result = await runOrchestrator({
     scanPath,
     project: projectName,
@@ -34250,7 +34520,18 @@ async function tryOrchestrator(cmd, parsed) {
 async function runWelcomeFlow(parsed) {
   return runWelcome({
     login: (loginArgv) => runLoginCommand(loginArgv),
-    orchestrator: async (cwd) => await tryOrchestrator(cwd, parsed) ?? 0
+    // What the person chose at the door reaches the orchestrator as the flags they
+    // stand for: the name as `--project`, the instrument answer as `--no-instrument`
+    // or as `yes` (which keeps the orchestrator's own prompt quiet, since the door
+    // already asked).
+    orchestrator: async (cwd, opts) => await tryOrchestrator(cwd, {
+      ...parsed,
+      ...opts?.project !== void 0 ? { project: opts.project } : {},
+      ...opts?.noInstrument !== void 0 ? { noInstrument: opts.noInstrument } : {},
+      ...opts?.yes !== void 0 ? { yes: opts.yes } : {}
+    }) ?? 0,
+    // An explicit flag is an answer; don't ask again.
+    instrumentFlagGiven: parsed.noInstrument || parsed.dryRun
   });
 }
 var QUERY_VERBS = /* @__PURE__ */ new Set([
@@ -34283,6 +34564,13 @@ var ProjectResolutionError = class extends Error {
   }
   exitCode;
 };
+function isLoopbackEndpoint(endpoint2) {
+  try {
+    return isLoopbackHost2(new URL(endpoint2).hostname.replace(/^\[|\]$/g, ""));
+  } catch {
+    return false;
+  }
+}
 async function resolveProjectForVerb(client, parsed) {
   const explicit = resolveProjectFlag(parsed);
   if (explicit) return explicit;
@@ -34513,6 +34801,9 @@ async function runQueryVerb(cmd, parsed) {
       console.error(`neat ${cmd}: ${detail.trim()}`);
     } else if (err instanceof TransportError) {
       console.error(`neat ${cmd}: ${err.message}. Is the daemon running? (endpoint=${target.endpoint})`);
+      if (isLoopbackEndpoint(target.endpoint)) {
+        console.error(`neat ${cmd}: start one with \`neat watch .\`, or \`neat\` to extract and start in one step.`);
+      }
     } else {
       console.error(`neat ${cmd}: ${err.message}`);
     }
@@ -34569,6 +34860,7 @@ if (/[\\/](?:cli\.(?:cjs|js)|cli|neat|neat\.is)$/.test(entry)) {
   QUERY_VERBS,
   UnknownProfileError,
   commandPrefix,
+  isLoopbackEndpoint,
   isNpxInvocation,
   main,
   parseArgs,