@neat.is/core 0.10.1-dev.20260928 → 0.10.1

package/dist/cli.js

@@ -8,7 +8,7 @@ import {
   resolveNeatVersion,
   startK8sSubstratePolling,
   writeDaemonRecord
-} from "./chunk-HVBD4ULO.js";
+} from "./chunk-AWIK6T3G.js";
 import {
   buildSearchIndex
 } from "./chunk-BC53SCT7.js";
@@ -78,23 +78,24 @@ import {
   startStalenessLoop,
   upsertConnectorEntry,
   validateConnectorEntry
-} from "./chunk-CNOJ4T6I.js";
+} from "./chunk-E3YFFIHE.js";
 import {
   startOtelGrpcReceiver
-} from "./chunk-ERE47MCR.js";
+} from "./chunk-5SJHA5ZH.js";
 import {
   __dirname,
   __require,
   assertBindAuthority,
   buildOtelReceiver,
+  isLoopbackHost,
   listenSteppingOtlp,
   readAuthEnv
-} from "./chunk-GDGUY4T6.js";
+} from "./chunk-M7CGATVC.js";
 
 // src/cli.ts
-import path19 from "path";
+import path20 from "path";
 import os5 from "os";
-import { promises as fs17 } from "fs";
+import { promises as fs18 } from "fs";
 
 // src/banner.ts
 import path from "path";
@@ -4452,7 +4453,8 @@ async function runOrchestrator(opts) {
   } catch (err) {
     if (!(err instanceof ProjectNameCollisionError)) throw err;
     console.error(`neat: ${err.message}`);
-    console.error("pass --project <other-name> to register under a different name.");
+    console.error(`neat: run \`neat <path> --project <other-name>\` to register it under a different name,`);
+    console.error(`neat: or \`neat uninstall ${opts.project}\` if the old registration is stale.`);
     result.exitCode = 1;
     return result;
   }
@@ -5245,6 +5247,196 @@ async function clearActiveProfile(home = neatHome()) {
   });
 }
 
+// src/daemon-probe.ts
+var PROBE_ATTEMPT_TIMEOUT_MS = 3e4;
+var PROBE_TOTAL_BUDGET_MS = 12e4;
+var PROBE_RETRY_PAUSE_MS = 2e3;
+function isTimeoutError(err) {
+  const name = err?.name;
+  return name === "TimeoutError" || name === "AbortError";
+}
+async function probeOnce(fetchImpl, root, token, timeoutMs) {
+  let res;
+  try {
+    res = await fetchImpl(`${root}/health`, {
+      headers: { authorization: `Bearer ${token}` },
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+  } catch (err) {
+    if (isTimeoutError(err)) return { kind: "timeout" };
+    return { kind: "unreachable", detail: err.message };
+  }
+  if (res.status === 401 || res.status === 403) return { kind: "unauthorized", status: res.status };
+  if (!res.ok) return { kind: "not-neat", status: res.status };
+  const contentType = res.headers.get("content-type") ?? "";
+  if (!contentType.includes("json")) return { kind: "not-neat", status: res.status };
+  return { kind: "ok" };
+}
+async function probeDaemon(fetchImpl, endpoint, token, hooks) {
+  const root = endpoint.replace(/\/$/, "");
+  const deadline = hooks.now() + PROBE_TOTAL_BUDGET_MS;
+  let warned = false;
+  for (; ; ) {
+    const result = await probeOnce(fetchImpl, root, token, PROBE_ATTEMPT_TIMEOUT_MS);
+    if (result.kind !== "timeout") return result;
+    if (!warned) {
+      hooks.onWaiting();
+      warned = true;
+    }
+    if (hooks.now() >= deadline) {
+      return { kind: "unreachable", detail: `no response after ${Math.round(PROBE_TOTAL_BUDGET_MS / 1e3)}s` };
+    }
+    await hooks.sleep(PROBE_RETRY_PAUSE_MS);
+  }
+}
+
+// src/login-connect.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+import { promises as fs11 } from "fs";
+import path12 from "path";
+var execFileAsync = promisify(execFile);
+async function hasLocalSnapshot(cwd) {
+  try {
+    await fs11.access(path12.join(cwd, "neat-out", "graph.json"));
+    return true;
+  } catch {
+    return false;
+  }
+}
+var POLL_INTERVAL_MS = 3e3;
+var POLL_BUDGET_MS = 10 * 6e4;
+var CP_TIMEOUT_MS = 1e4;
+async function detectGitHubRepo(cwd) {
+  const read = async (args) => {
+    try {
+      const { stdout } = await execFileAsync("git", args, { cwd, timeout: 5e3 });
+      return stdout.trim();
+    } catch {
+      return null;
+    }
+  };
+  let url = await read(["remote", "get-url", "origin"]);
+  if (!url) {
+    const names = await read(["remote"]);
+    const first = names?.split(/\r?\n/).find((l) => l.trim().length > 0)?.trim();
+    if (!first) return null;
+    url = await read(["remote", "get-url", first]);
+  }
+  if (!url) return null;
+  return parseGitHubRemote(url);
+}
+function parseGitHubRemote(url) {
+  const trimmed = url.trim().replace(/\.git$/, "");
+  const m = trimmed.match(/^https?:\/\/(?:[^@/]+@)?github\.com\/([^/]+)\/([^/]+)$/) ?? trimmed.match(/^git@github\.com:([^/]+)\/([^/]+)$/) ?? trimmed.match(/^ssh:\/\/git@github\.com\/([^/]+)\/([^/]+)$/);
+  if (!m) return null;
+  const owner = m[1];
+  const name = m[2];
+  if (!owner || !name) return null;
+  return { owner, name };
+}
+async function cpGetJson(fetchImpl, cpUrl, path21, accessToken) {
+  try {
+    const res = await fetchImpl(`${cpUrl}${path21}`, {
+      headers: { authorization: `Bearer ${accessToken}`, accept: "application/json" },
+      signal: AbortSignal.timeout(CP_TIMEOUT_MS)
+    });
+    if (!res.ok) return { ok: false };
+    return { ok: true, body: await res.json() };
+  } catch {
+    return { ok: false };
+  }
+}
+async function listBoundRepos(fetchImpl, cpUrl, accessToken, projectId) {
+  const res = await cpGetJson(
+    fetchImpl,
+    cpUrl,
+    `/me/projects/${encodeURIComponent(projectId)}/repos`,
+    accessToken
+  );
+  if (!res.ok || !Array.isArray(res.body)) return null;
+  return res.body;
+}
+async function waitForFirstProject(fetchImpl, cpUrl, accessToken, deps) {
+  const pollMs = deps.pollMs ?? POLL_INTERVAL_MS;
+  const deadline = deps.now() + (deps.budgetMs ?? POLL_BUDGET_MS);
+  for (; ; ) {
+    if (deps.signal?.aborted) return { kind: "aborted" };
+    const me = await cpGetJson(fetchImpl, cpUrl, "/me", accessToken);
+    if (me.ok) {
+      const running = (me.body.projects ?? []).find((p) => p.status === "running");
+      if (running) return { kind: "project", project: running };
+    }
+    if (deps.now() >= deadline) return { kind: "timeout" };
+    await deps.sleep(pollMs);
+    if (deps.signal?.aborted) return { kind: "aborted" };
+  }
+}
+function bindUrl(webUrl, projectId) {
+  return `${webUrl}/config/repos?project=${encodeURIComponent(projectId)}`;
+}
+function onboardingUrl(webUrl) {
+  return `${webUrl}/onboarding`;
+}
+async function runPostLoginConnect(input) {
+  const d = input.deps;
+  const out = d.out ?? ((line) => console.log(line));
+  const fetchImpl = d.fetchImpl ?? fetch;
+  const cwd = d.cwd ?? process.cwd();
+  const detect6 = d.detectRepo ?? detectGitHubRepo;
+  const readLine = d.readLine;
+  const repo = await detect6(cwd);
+  out("");
+  if (!repo) {
+    out("This directory has no GitHub remote, so it can't be bound to the project.");
+    out(`  Push its graph instead:      neat sync --to ${input.project.name}`);
+    out(`  Manage projects and repos:   ${input.webUrl}`);
+    return;
+  }
+  const slug = `${repo.owner}/${repo.name}`;
+  const bound = await listBoundRepos(fetchImpl, input.cpUrl, input.accessToken, input.project.id);
+  const match = bound?.find((r) => r.owner === repo.owner && r.name === repo.name);
+  if (match) {
+    const state = match.syncStatus ? ` (${match.syncStatus})` : "";
+    out(`${slug} is bound to ${input.project.name}${state} \u2014 hosted NEAT extracts it for you.`);
+    out(`  See the graph:  ${input.webUrl}`);
+    return;
+  }
+  out(`${slug} isn't part of ${input.project.name} yet \u2014 logging in connected your account, not this repo.`);
+  out("");
+  const installed = input.me?.github?.installed;
+  const bindLine = installed === false ? "1) Install the GitHub App and bind this repo \u2014 hosted NEAT keeps it in sync" : installed === true ? "1) Bind this repo \u2014 hosted NEAT clones and extracts it, and keeps it in sync" : "1) Bind this repo through the console \u2014 hosted NEAT keeps it in sync";
+  out(bindLine);
+  out(`2) Push the graph on this machine now \u2014 a snapshot, not a subscription`);
+  out("3) Neither, for now");
+  const answer = readLine ? (await readLine("Choose 1, 2 or 3 (Enter skips): "))?.trim() : void 0;
+  if (answer === "1") {
+    const url = bindUrl(input.webUrl, input.project.id);
+    const opened = (d.openBrowser ?? (() => false))(url);
+    out("");
+    out(opened ? `Opened ${url}` : `Open this to bind the repo:
+  ${url}`);
+    return;
+  }
+  if (answer === "2") {
+    const hasGraph = await (d.hasLocalGraph ?? hasLocalSnapshot)(cwd);
+    out("");
+    if (!hasGraph) {
+      out("There is no local graph to push yet. Build one, then push it:");
+      out("  neat");
+      out(`  neat sync --to ${input.project.name}`);
+      return;
+    }
+    out("Push the local graph with:");
+    out(`  neat sync --to ${input.project.name}`);
+    return;
+  }
+  out("");
+  out("No problem \u2014 when you want this repo in the graph:");
+  out(`  Bind it:        ${bindUrl(input.webUrl, input.project.id)}`);
+  out(`  Or push it:     neat sync --to ${input.project.name}`);
+}
+
 // src/login-sso.ts
 var DEFAULT_CP_URL = "https://api.neat.is";
 var DEFAULT_WEB_URL = "https://app.neat.is";
@@ -5270,6 +5462,7 @@ function pickProject(projects, want) {
     return {
       error: {
         code: 1,
+        kind: "no-project",
         message: `no running project to connect to \u2014 create + provision one in the console first${listed}`
       }
     };
@@ -5320,7 +5513,7 @@ async function exchangeCredential(cpUrl, accessToken, opts, deps) {
   if (!cred.endpoint || !cred.authToken) {
     return { error: { code: 1, message: "the credential response was missing endpoint/authToken" } };
   }
-  return { project, cred };
+  return { project, cred, me };
 }
 function defaultOpenBrowser(url) {
   const platform = process.platform;
@@ -5402,12 +5595,50 @@ async function runSsoLogin(opts, deps) {
     }
     accessToken = lb.token;
   }
-  const ex = await exchangeCredential(opts.cpUrl, accessToken, { project: opts.project }, deps);
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const now = deps.now ?? Date.now;
+  let ex = await exchangeCredential(opts.cpUrl, accessToken, { project: opts.project }, deps);
+  if ("error" in ex && ex.error.kind === "no-project" && !opts.json) {
+    const url = onboardingUrl(opts.webUrl);
+    out("");
+    out("You don't have a project yet \u2014 let's make one.");
+    const opened = (deps.openBrowser ?? defaultOpenBrowser)(url);
+    out(opened ? `Opened ${url}` : `Open this to create your first project:
+  ${url}`);
+    out("Waiting for it to come up \u2014 Ctrl-C to stop and finish later.");
+    const waited = await waitForFirstProject(fetchImpl, opts.cpUrl, accessToken, {
+      sleep: sleep2,
+      now,
+      ...deps.signal ? { signal: deps.signal } : {}
+    });
+    if (waited.kind === "aborted") {
+      out("Stopped. Run `neat login` again once your project is up.");
+      return 130;
+    }
+    if (waited.kind === "timeout") {
+      err("neat login: no project came up while waiting \u2014 run `neat login` again once it does");
+      return 1;
+    }
+    out(`${waited.project.name} is up.`);
+    ex = await exchangeCredential(opts.cpUrl, accessToken, { project: opts.project }, deps);
+  }
   if ("error" in ex) {
     err(`neat login: ${ex.error.message}`);
     return ex.error.code;
   }
-  const { project, cred } = ex;
+  const { project, cred, me } = ex;
+  const probe = await probeDaemon(fetchImpl, cred.endpoint, cred.authToken, {
+    sleep: sleep2,
+    now,
+    onWaiting: () => err("Waking the hosted daemon \u2014 a cold instance can take up to a minute\u2026")
+  });
+  if (probe.kind !== "ok") {
+    const why = probe.kind === "unreachable" ? probe.detail : probe.kind === "unauthorized" ? `it rejected the credential (HTTP ${probe.status})` : `it answered HTTP ${probe.status} and doesn't look like NEAT`;
+    err(`neat login: "${project.name}" is provisioned, but its daemon isn't answering \u2014 ${why}.`);
+    err(`Nothing was changed. Check the project at ${opts.webUrl} and run \`neat login\` again.`);
+    return probe.kind === "unreachable" ? 3 : 1;
+  }
   await upsertProfile(
     { name: opts.name, endpoint: cred.endpoint, authToken: cred.authToken },
     { makeActive: true, ...deps.home ? { home: deps.home } : {} }
@@ -5435,10 +5666,20 @@ async function runSsoLogin(opts, deps) {
       out(`  OTEL_EXPORTER_OTLP_ENDPOINT=${cred.ingestEndpoint}`);
       out(`  OTEL_EXPORTER_OTLP_HEADERS=Authorization=Bearer ${cred.otelToken}`);
     }
-    out("");
-    out("This directory isn't part of that graph yet \u2014 logging in connected your account,");
-    out("not this repo, and nothing here has been uploaded.");
-    out(`  Manage projects and repos:  ${opts.webUrl}`);
+    await runPostLoginConnect({
+      cpUrl: opts.cpUrl,
+      webUrl: opts.webUrl,
+      accessToken,
+      project: { id: project.id, name: project.name },
+      me,
+      deps: {
+        fetchImpl,
+        out,
+        ...deps.readLine ? { readLine: deps.readLine } : {},
+        ...deps.openBrowser ? { openBrowser: deps.openBrowser } : { openBrowser: defaultOpenBrowser },
+        ...deps.connect ?? {}
+      }
+    });
     out("");
     out("Run `neat logout` to switch back to your local daemon.");
   }
@@ -5545,8 +5786,8 @@ async function runConnectCommand(rawArgs, deps = {}) {
 }
 
 // src/doctor-cli.ts
-import { promises as fs11 } from "fs";
-import path12 from "path";
+import { promises as fs12 } from "fs";
+import path13 from "path";
 
 // src/cli-client.ts
 import { Provenance as Provenance3 } from "@neat.is/types";
@@ -5574,10 +5815,10 @@ function createHttpClient(baseUrl, bearerToken, fetchImpl = fetch) {
   const root = baseUrl.replace(/\/$/, "");
   const authHeader = bearerToken && bearerToken.length > 0 ? { authorization: `Bearer ${bearerToken}` } : {};
   return {
-    async get(path20) {
+    async get(path21) {
       let res;
       try {
-        res = await fetchImpl(`${root}${path20}`, {
+        res = await fetchImpl(`${root}${path21}`, {
           headers: { ...authHeader }
         });
       } catch (err) {
@@ -5589,16 +5830,16 @@ function createHttpClient(baseUrl, bearerToken, fetchImpl = fetch) {
         const body = await res.text().catch(() => "");
         throw new HttpError(
           res.status,
-          `${res.status} ${res.statusText} on GET ${path20}: ${body}`,
+          `${res.status} ${res.statusText} on GET ${path21}: ${body}`,
           body
         );
       }
       return await res.json();
     },
-    async post(path20, body) {
+    async post(path21, body) {
       let res;
       try {
-        res = await fetchImpl(`${root}${path20}`, {
+        res = await fetchImpl(`${root}${path21}`, {
           method: "POST",
           headers: { "content-type": "application/json", ...authHeader },
           body: JSON.stringify(body)
@@ -5612,7 +5853,7 @@ function createHttpClient(baseUrl, bearerToken, fetchImpl = fetch) {
         const text = await res.text().catch(() => "");
         throw new HttpError(
           res.status,
-          `${res.status} ${res.statusText} on POST ${path20}: ${text}`,
+          `${res.status} ${res.statusText} on POST ${path21}: ${text}`,
           text
         );
       }
@@ -5626,12 +5867,12 @@ function projectPath(project, suffix) {
 }
 async function runRootCause(client, input) {
   const qs = input.errorId ? `?errorId=${encodeURIComponent(input.errorId)}` : "";
-  const path20 = projectPath(
+  const path21 = projectPath(
     input.project,
     `/graph/root-cause/${encodeURIComponent(input.errorNode)}${qs}`
   );
   try {
-    const result = await client.get(path20);
+    const result = await client.get(path21);
     const arrowPath = result.traversalPath.join(" \u2190 ");
     const provenances = result.edgeProvenances.length ? result.edgeProvenances.join(", ") : "(direct, no edges traversed)";
     const summary = `Root cause for ${input.errorNode} is ${result.rootCauseNode}. ` + result.rootCauseReason + (result.fixRecommendation ? ` Recommended fix: ${result.fixRecommendation}.` : "");
@@ -5657,12 +5898,12 @@ async function runRootCause(client, input) {
 }
 async function runBlastRadius(client, input) {
   const qs = input.depth !== void 0 ? `?depth=${input.depth}` : "";
-  const path20 = projectPath(
+  const path21 = projectPath(
     input.project,
     `/graph/blast-radius/${encodeURIComponent(input.nodeId)}${qs}`
   );
   try {
-    const result = await client.get(path20);
+    const result = await client.get(path21);
     if (result.totalAffected === 0) {
       return {
         summary: `${result.origin} has no dependents. Nothing else would break if it failed.`
@@ -5696,12 +5937,12 @@ function formatBlastEntry(n) {
 }
 async function runDependencies(client, input) {
   const depth = input.depth ?? 3;
-  const path20 = projectPath(
+  const path21 = projectPath(
     input.project,
     `/graph/dependencies/${encodeURIComponent(input.nodeId)}?depth=${depth}`
   );
   try {
-    const result = await client.get(path20);
+    const result = await client.get(path21);
     if (result.total === 0) {
       return {
         summary: depth === 1 ? `${input.nodeId} has no direct dependencies in the graph.` : `${input.nodeId} has no dependencies (BFS to depth ${depth}).`
@@ -5793,9 +6034,9 @@ function formatDuration(ms) {
   return `${Math.round(h / 24)}d`;
 }
 async function runIncidents(client, input) {
-  const path20 = input.nodeId ? projectPath(input.project, `/incidents/${encodeURIComponent(input.nodeId)}`) : projectPath(input.project, "/incidents");
+  const path21 = input.nodeId ? projectPath(input.project, `/incidents/${encodeURIComponent(input.nodeId)}`) : projectPath(input.project, "/incidents");
   try {
-    const body = await client.get(path20);
+    const body = await client.get(path21);
     const events = body.events;
     if (events.length === 0) {
       return {
@@ -6159,7 +6400,7 @@ function checkNode(nodeVersion) {
 }
 async function neatOutExists(cwd) {
   try {
-    const st = await fs11.stat(path12.join(cwd, "neat-out"));
+    const st = await fs12.stat(path13.join(cwd, "neat-out"));
     return st.isDirectory();
   } catch {
     return false;
@@ -6278,9 +6519,6 @@ async function runDoctorCommand(argv, deps = {}) {
 
 // src/login-cli.ts
 import readline3 from "readline/promises";
-var PROBE_ATTEMPT_TIMEOUT_MS = 3e4;
-var PROBE_TOTAL_BUDGET_MS = 12e4;
-var PROBE_RETRY_PAUSE_MS = 2e3;
 var DEFAULT_PROFILE_NAME = "hosted";
 function readFlagValue(argv, i) {
   const arg = argv[i];
@@ -6345,44 +6583,6 @@ function printLoginHelp(out) {
   out('  the profile (default "hosted"); the paste token can also come from NEAT_LOGIN_TOKEN.');
   out("  Exit 0 on success, 1 rejected/needs-action, 2 misuse, 3 unreachable.");
 }
-function isTimeoutError(err) {
-  const name = err?.name;
-  return name === "TimeoutError" || name === "AbortError";
-}
-async function probeOnce(fetchImpl, root, token, timeoutMs) {
-  let res;
-  try {
-    res = await fetchImpl(`${root}/health`, {
-      headers: { authorization: `Bearer ${token}` },
-      signal: AbortSignal.timeout(timeoutMs)
-    });
-  } catch (err) {
-    if (isTimeoutError(err)) return { kind: "timeout" };
-    return { kind: "unreachable", detail: err.message };
-  }
-  if (res.status === 401 || res.status === 403) return { kind: "unauthorized", status: res.status };
-  if (!res.ok) return { kind: "not-neat", status: res.status };
-  const contentType = res.headers.get("content-type") ?? "";
-  if (!contentType.includes("json")) return { kind: "not-neat", status: res.status };
-  return { kind: "ok" };
-}
-async function probeDaemon(fetchImpl, endpoint, token, hooks) {
-  const root = endpoint.replace(/\/$/, "");
-  const deadline = hooks.now() + PROBE_TOTAL_BUDGET_MS;
-  let warned = false;
-  for (; ; ) {
-    const result = await probeOnce(fetchImpl, root, token, PROBE_ATTEMPT_TIMEOUT_MS);
-    if (result.kind !== "timeout") return result;
-    if (!warned) {
-      hooks.onWaiting();
-      warned = true;
-    }
-    if (hooks.now() >= deadline) {
-      return { kind: "unreachable", detail: `no response after ${Math.round(PROBE_TOTAL_BUDGET_MS / 1e3)}s` };
-    }
-    await hooks.sleep(PROBE_RETRY_PAUSE_MS);
-  }
-}
 async function runLoginCommand(argv, deps = {}) {
   const out = deps.out ?? ((line) => console.log(line));
   const err = deps.err ?? ((line) => console.error(line));
@@ -6415,8 +6615,13 @@ async function runLoginCommand(argv, deps = {}) {
         fetchImpl,
         out,
         err,
+        readLine,
+        sleep: sleep2,
+        now,
         ...deps.openBrowser ? { openBrowser: deps.openBrowser } : {},
-        ...deps.home ? { home: deps.home } : {}
+        ...deps.home ? { home: deps.home } : {},
+        ...deps.signal ? { signal: deps.signal } : {},
+        ...deps.connect ? { connect: deps.connect } : {}
       }
     );
   }
@@ -6572,8 +6777,8 @@ async function defaultReadSecret(prompt) {
 }
 
 // src/welcome.ts
-import { promises as fs12 } from "fs";
-import path13 from "path";
+import { promises as fs13 } from "fs";
+import path14 from "path";
 import readline4 from "readline/promises";
 var WORDMARK = [
   "\u2588\u2588\u2588\u2557   \u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557",
@@ -6632,15 +6837,17 @@ async function runFrontDoor(deps, out) {
   const login = deps.login ?? (() => Promise.resolve(0));
   const orchestrator = deps.orchestrator ?? (() => Promise.resolve(0));
   const cwd = deps.cwd ?? process.cwd();
+  const flagGiven = deps.instrumentFlagGiven ?? false;
+  const readRegistry2 = deps.readRegistry ?? (() => readRegistry());
   printHeader(out);
   out("Welcome to NEAT. Let's get you a graph of this system.");
   out("");
   const keyReader = deps.readKey !== void 0 ? { read: deps.readKey, done: () => {
   } } : createKeyReader();
   const picked = keyReader !== null ? await selectOption(out, keyReader, deps.moveCursorUp ?? defaultMoveCursorUp) : await selectByNumber(out, readLine);
-  if (picked === void 0) return runSelfHosted(out, readLine, orchestrator, cwd);
+  if (picked === void 0) return runSelfHosted(out, readLine, orchestrator, cwd, readRegistry2, flagGiven);
   if (picked === 0) return login(["--browser"]);
-  return runSelfHosted(out, readLine, orchestrator, cwd);
+  return runSelfHosted(out, readLine, orchestrator, cwd, readRegistry2, flagGiven);
 }
 var MENU_OPTIONS = [
   "Log me into Hosted Neat",
@@ -6743,7 +6950,7 @@ function decodeKey(buf) {
 function defaultMoveCursorUp(rows) {
   if (rows > 0) process.stdout.write(`\x1B[${rows}A`);
 }
-async function runSelfHosted(out, readLine, orchestrator, cwd) {
+async function runSelfHosted(out, readLine, orchestrator, cwd, readRegistry2, instrumentFlagGiven) {
   const wantsPrompt = (await readLine("Print a copy-paste setup prompt for your coding agent? [Y/n]: "))?.trim().toLowerCase();
   if (wantsPrompt !== "n" && wantsPrompt !== "no") {
     out("");
@@ -6754,9 +6961,69 @@ async function runSelfHosted(out, readLine, orchestrator, cwd) {
     out("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
     out("");
   }
+  const project = await resolveProjectName(out, readLine, cwd, readRegistry2);
+  const declined = instrumentFlagGiven ? void 0 : await askToInstrument(out, readLine);
   out("Building your local graph now\u2026");
   out("");
-  return orchestrator(cwd);
+  const overrides = {
+    ...project !== void 0 ? { project } : {},
+    ...declined === void 0 ? {} : declined ? { noInstrument: true } : { yes: true }
+  };
+  return orchestrator(cwd, Object.keys(overrides).length > 0 ? overrides : void 0);
+}
+async function askToInstrument(out, readLine) {
+  out("Instrument the services for OpenTelemetry now?");
+  out("This edits package.json / requirements.txt / go.mod and runs the package manager.");
+  const answer = (await readLine("[Y/n]: "))?.trim().toLowerCase();
+  const declined = answer === "n" || answer === "no";
+  if (declined) {
+    out("");
+    out("Skipping instrumentation \u2014 the graph will hold the declared side only.");
+    out("Run `neat init . --apply` when you want the runtime half.");
+  }
+  out("");
+  return declined;
+}
+async function resolveProjectName(out, readLine, cwd, readRegistry2) {
+  const here = path14.resolve(cwd);
+  const base = path14.basename(here);
+  let taken;
+  try {
+    const { projects } = await readRegistry2();
+    taken = new Map(projects.map((p) => [p.name, p.path]));
+  } catch {
+    return void 0;
+  }
+  const clash = taken.get(base);
+  if (clash === void 0 || path14.resolve(clash) === here) return void 0;
+  out("");
+  out(`A project named \`${base}\` is already registered (${clash}).`);
+  const suggested = firstFreeName(base, taken);
+  for (; ; ) {
+    const answer = (await readLine(`Name this one: [${suggested}] `))?.trim();
+    if (answer === void 0) return suggested;
+    const chosen = answer.length === 0 ? suggested : answer;
+    if (!isUsableProjectName(chosen)) {
+      out(`"${chosen}" won't work as a project name \u2014 letters, digits, dot, dash and underscore.`);
+      continue;
+    }
+    const other = taken.get(chosen);
+    if (other !== void 0 && path14.resolve(other) !== here) {
+      out(`\`${chosen}\` is registered too (${other}).`);
+      continue;
+    }
+    out("");
+    return chosen;
+  }
+}
+function firstFreeName(base, taken) {
+  for (let n = 2; ; n++) {
+    const candidate = `${base}-${n}`;
+    if (!taken.has(candidate)) return candidate;
+  }
+}
+function isUsableProjectName(name) {
+  return name.length > 0 && name !== "." && name !== ".." && /^[A-Za-z0-9._-]+$/.test(name);
 }
 async function shouldShowWelcome(deps = {}) {
   const stdinTTY = deps.stdinIsTTY ?? Boolean(process.stdin.isTTY);
@@ -6766,9 +7033,9 @@ async function shouldShowWelcome(deps = {}) {
   const readRegistry2 = deps.readRegistry ?? (() => readRegistry());
   const hasSnapshot = deps.hasSnapshot ?? defaultHasSnapshot;
   try {
-    const here = path13.resolve(cwd);
+    const here = path14.resolve(cwd);
     const { projects } = await readRegistry2();
-    if (projects.some((p) => path13.resolve(p.path) === here)) return false;
+    if (projects.some((p) => path14.resolve(p.path) === here)) return false;
     if (await hasSnapshot(here)) return false;
     return true;
   } catch {
@@ -6777,7 +7044,7 @@ async function shouldShowWelcome(deps = {}) {
 }
 async function defaultHasSnapshot(cwd) {
   try {
-    const entries = await fs12.readdir(path13.join(cwd, "neat-out"));
+    const entries = await fs13.readdir(path14.join(cwd, "neat-out"));
     return entries.some((e) => e.endsWith(".json"));
   } catch {
     return false;
@@ -6794,27 +7061,27 @@ async function defaultReadLine2(prompt) {
 }
 
 // src/hooks-cli.ts
-import path14 from "path";
+import path15 from "path";
 import os2 from "os";
-import { promises as fs13 } from "fs";
+import { promises as fs14 } from "fs";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var HOOK_FILENAME = "neat-search-nudge.mjs";
 var GUIDE_FILENAME = "GRAPH_FIRST.md";
 var GUIDE_INSTALL_NAME = "neat-graph-first.md";
 var HOOK_MATCHER = "Grep|Glob|Bash";
 function moduleDir() {
-  return typeof __dirname !== "undefined" ? __dirname : path14.dirname(fileURLToPath3(import.meta.url));
+  return typeof __dirname !== "undefined" ? __dirname : path15.dirname(fileURLToPath3(import.meta.url));
 }
 async function readSkillAsset(rel) {
   const here = moduleDir();
   const candidates = [
-    path14.resolve(here, "../../claude-skill", rel),
-    path14.resolve(here, "../../../claude-skill", rel),
-    path14.resolve(here, "../claude-skill", rel)
+    path15.resolve(here, "../../claude-skill", rel),
+    path15.resolve(here, "../../../claude-skill", rel),
+    path15.resolve(here, "../claude-skill", rel)
   ];
   for (const candidate of candidates) {
     try {
-      return await fs13.readFile(candidate, "utf8");
+      return await fs14.readFile(candidate, "utf8");
     } catch {
     }
   }
@@ -6824,20 +7091,20 @@ async function readSkillAsset(rel) {
 }
 function neatHome2() {
   const override = process.env.NEAT_HOME;
-  if (override && override.length > 0) return path14.resolve(override);
-  return path14.join(os2.homedir(), ".neat");
+  if (override && override.length > 0) return path15.resolve(override);
+  return path15.join(os2.homedir(), ".neat");
 }
 function claudeSettingsPath() {
   const override = process.env.NEAT_CLAUDE_SETTINGS;
-  if (override && override.length > 0) return path14.resolve(override);
+  if (override && override.length > 0) return path15.resolve(override);
   const home = process.env.HOME ?? process.env.USERPROFILE ?? os2.homedir();
-  return path14.join(home, ".claude", "settings.json");
+  return path15.join(home, ".claude", "settings.json");
 }
 function installedHookPath() {
-  return path14.join(neatHome2(), "hooks", HOOK_FILENAME);
+  return path15.join(neatHome2(), "hooks", HOOK_FILENAME);
 }
 function gateFlagPath() {
-  return path14.join(neatHome2(), "hooks", "gate-enabled");
+  return path15.join(neatHome2(), "hooks", "gate-enabled");
 }
 function isNeatSearchEntry(entry2) {
   return (entry2.hooks ?? []).some(
@@ -6870,14 +7137,14 @@ async function runHooks(opts) {
     const hookScript = await readSkillAsset(`hooks/${HOOK_FILENAME}`);
     const guide = await readSkillAsset(GUIDE_FILENAME);
     const scriptPath = installedHookPath();
-    await fs13.mkdir(path14.dirname(scriptPath), { recursive: true });
-    await fs13.writeFile(scriptPath, hookScript, { mode: 493 });
-    const guidePath = path14.join(neatHome2(), GUIDE_INSTALL_NAME);
-    await fs13.writeFile(guidePath, guide, "utf8");
+    await fs14.mkdir(path15.dirname(scriptPath), { recursive: true });
+    await fs14.writeFile(scriptPath, hookScript, { mode: 493 });
+    const guidePath = path15.join(neatHome2(), GUIDE_INSTALL_NAME);
+    await fs14.writeFile(guidePath, guide, "utf8");
     const settingsFile = claudeSettingsPath();
     let settings = {};
     try {
-      settings = JSON.parse(await fs13.readFile(settingsFile, "utf8"));
+      settings = JSON.parse(await fs14.readFile(settingsFile, "utf8"));
     } catch (err) {
       if (err.code !== "ENOENT") {
         console.error(
@@ -6899,14 +7166,14 @@ async function runHooks(opts) {
       ...settings,
       hooks: { ...hooks, PreToolUse: preToolUse }
     };
-    await fs13.mkdir(path14.dirname(settingsFile), { recursive: true });
-    await fs13.writeFile(settingsFile, JSON.stringify(merged, null, 2) + "\n", "utf8");
+    await fs14.mkdir(path15.dirname(settingsFile), { recursive: true });
+    await fs14.writeFile(settingsFile, JSON.stringify(merged, null, 2) + "\n", "utf8");
     const flag = gateFlagPath();
     if (opts.gate) {
-      await fs13.mkdir(path14.dirname(flag), { recursive: true });
-      await fs13.writeFile(flag, "1\n", "utf8");
+      await fs14.mkdir(path15.dirname(flag), { recursive: true });
+      await fs14.writeFile(flag, "1\n", "utf8");
     } else {
-      await fs13.rm(flag, { force: true });
+      await fs14.rm(flag, { force: true });
     }
     const mode = opts.gate ? "GATE (deny search until you ask the graph)" : "nudge (search still runs)";
     console.log(`neat hooks: installed the search hook in ${opts.gate ? "gate" : "nudge"} mode`);
@@ -6995,8 +7262,8 @@ async function runHooksCommand(args) {
 }
 
 // src/claude-cli.ts
-import path15 from "path";
-import { promises as fs14 } from "fs";
+import path16 from "path";
+import { promises as fs15 } from "fs";
 var NEAT_SECTION_HEADING = "## neat";
 var NEAT_DIRECTIVE_BODY = `This project has NEAT wired in: a live, fused semantic graph of the system \u2014
 code and runtime behaviour (OpenTelemetry) in one model, every fact tagged with
@@ -7030,8 +7297,8 @@ ${NEAT_DIRECTIVE_BODY}
 }
 function claudeMdPath() {
   const override = process.env.NEAT_CLAUDE_MD;
-  if (override && override.length > 0) return path15.resolve(override);
-  return path15.join(process.cwd(), "CLAUDE.md");
+  if (override && override.length > 0) return path16.resolve(override);
+  return path16.join(process.cwd(), "CLAUDE.md");
 }
 function splitAroundSection(raw) {
   const lines = raw.split("\n");
@@ -7059,7 +7326,7 @@ function compose(before, after) {
 }
 async function readIfExists(file) {
   try {
-    return await fs14.readFile(file, "utf8");
+    return await fs15.readFile(file, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return null;
     throw err;
@@ -7070,8 +7337,8 @@ async function runInstall() {
   const raw = await readIfExists(file) ?? "";
   const { before, after, found } = splitAroundSection(raw);
   const next = compose(before, after);
-  await fs14.mkdir(path15.dirname(file), { recursive: true });
-  await fs14.writeFile(file, next, "utf8");
+  await fs15.mkdir(path16.dirname(file), { recursive: true });
+  await fs15.writeFile(file, next, "utf8");
   const verb = raw.length === 0 ? "created" : found ? "refreshed" : "added";
   console.log(`neat claude: ${verb} the \`${NEAT_SECTION_HEADING}\` section in ${file}`);
   console.log("Your agent will now reach for `neat ask` before Read/Grep/Bash. Restart the");
@@ -7092,7 +7359,7 @@ async function runUninstall() {
   }
   const remaining = [before, after].filter((s) => s.length > 0).join("\n\n");
   const next = remaining.length > 0 ? remaining.replace(/\n*$/, "") + "\n" : "";
-  await fs14.writeFile(file, next, "utf8");
+  await fs15.writeFile(file, next, "utf8");
   console.log(`neat claude: removed the \`${NEAT_SECTION_HEADING}\` section from ${file}.`);
   return { exitCode: 0 };
 }
@@ -7134,9 +7401,9 @@ async function runClaudeCommand(args) {
 }
 
 // src/codex-cli.ts
-import path16 from "path";
+import path17 from "path";
 import os3 from "os";
-import { promises as fs15 } from "fs";
+import { promises as fs16 } from "fs";
 import { isDeepStrictEqual } from "util";
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
 var CODEX_MCP_SERVER = {
@@ -7154,14 +7421,14 @@ var NEAT_GRAPH_FIRST_START = "<!-- neat:graph-first -->";
 var NEAT_GRAPH_FIRST_END = "<!-- /neat:graph-first -->";
 function codexConfigPath() {
   const override = process.env.NEAT_CODEX_CONFIG;
-  if (override && override.length > 0) return path16.resolve(override);
+  if (override && override.length > 0) return path17.resolve(override);
   const home = process.env.HOME ?? process.env.USERPROFILE ?? os3.homedir();
-  return path16.join(home, ".codex", "config.toml");
+  return path17.join(home, ".codex", "config.toml");
 }
 function agentsFilePath() {
   const override = process.env.NEAT_CODEX_AGENTS;
-  if (override && override.length > 0) return path16.resolve(override);
-  return path16.join(process.cwd(), "AGENTS.md");
+  if (override && override.length > 0) return path17.resolve(override);
+  return path17.join(process.cwd(), "AGENTS.md");
 }
 function isTableHeader(line) {
   return /^\s*\[\[?[^\]]+\]\]?\s*$/.test(line);
@@ -7295,7 +7562,7 @@ async function runCodex(opts) {
   const agentsPath = agentsFilePath();
   let configRaw = "";
   try {
-    configRaw = await fs15.readFile(configPath, "utf8");
+    configRaw = await fs16.readFile(configPath, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") {
       console.error(`neat codex: failed to read ${configPath} \u2014 ${err.message}`);
@@ -7304,7 +7571,7 @@ async function runCodex(opts) {
   }
   let agentsRaw = "";
   try {
-    agentsRaw = await fs15.readFile(agentsPath, "utf8");
+    agentsRaw = await fs16.readFile(agentsPath, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") {
       console.error(`neat codex: failed to read ${agentsPath} \u2014 ${err.message}`);
@@ -7344,15 +7611,15 @@ async function runCodex(opts) {
     return { exitCode: 0 };
   }
   if (config.changed) {
-    await fs15.mkdir(path16.dirname(configPath), { recursive: true });
-    await fs15.writeFile(configPath, config.text, "utf8");
+    await fs16.mkdir(path17.dirname(configPath), { recursive: true });
+    await fs16.writeFile(configPath, config.text, "utf8");
     console.log(`neat codex: wrote [mcp_servers.neat] to ${configPath}`);
   } else {
     console.log(`neat codex: ${configPath} already has NEAT's MCP server`);
   }
   if (agents.changed) {
-    await fs15.mkdir(path16.dirname(agentsPath), { recursive: true });
-    await fs15.writeFile(agentsPath, agents.text, "utf8");
+    await fs16.mkdir(path17.dirname(agentsPath), { recursive: true });
+    await fs16.writeFile(agentsPath, agents.text, "utf8");
     console.log(`neat codex: wrote the graph-first block to ${agentsPath}`);
   } else {
     console.log(`neat codex: ${agentsPath} already has the graph-first block`);
@@ -7408,9 +7675,9 @@ async function runCodexCommand(args) {
 }
 
 // src/editors-cli.ts
-import path17 from "path";
+import path18 from "path";
 import os4 from "os";
-import { promises as fs16 } from "fs";
+import { promises as fs17 } from "fs";
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
 import * as jsonc from "jsonc-parser";
 var NEAT_MCP_SERVER = {
@@ -7434,17 +7701,17 @@ function homeDir() {
 }
 function xdgConfigDir() {
   const xdg = process.env.XDG_CONFIG_HOME;
-  return xdg && xdg.length > 0 ? path17.resolve(xdg) : path17.join(homeDir(), ".config");
+  return xdg && xdg.length > 0 ? path18.resolve(xdg) : path18.join(homeDir(), ".config");
 }
 function envOverride(name) {
   const v = process.env[name];
-  return v && v.length > 0 ? path17.resolve(v) : void 0;
+  return v && v.length > 0 ? path18.resolve(v) : void 0;
 }
 var CURSOR_CLIENT = {
   id: "cursor",
   label: "Cursor",
   docsUrl: "https://docs.cursor.com/context/mcp",
-  mcpConfigPath: () => envOverride("NEAT_CURSOR_CONFIG") ?? path17.join(homeDir(), ".cursor", "mcp.json"),
+  mcpConfigPath: () => envOverride("NEAT_CURSOR_CONFIG") ?? path18.join(homeDir(), ".cursor", "mcp.json"),
   mcpContainerKey: "mcpServers",
   format: "json",
   // Cursor still reads a single `.cursorrules` at the project root (the modern
@@ -7456,7 +7723,7 @@ var DEVIN_CLIENT = {
   id: "devin",
   label: "Devin Desktop (Cascade)",
   docsUrl: "https://docs.devin.ai/desktop/cascade/mcp",
-  mcpConfigPath: () => envOverride("NEAT_DEVIN_CONFIG") ?? path17.join(homeDir(), ".codeium", "windsurf", "mcp_config.json"),
+  mcpConfigPath: () => envOverride("NEAT_DEVIN_CONFIG") ?? path18.join(homeDir(), ".codeium", "windsurf", "mcp_config.json"),
   mcpContainerKey: "mcpServers",
   format: "json",
   rulesFileName: ".windsurfrules"
@@ -7465,7 +7732,7 @@ var GEMINI_CLIENT = {
   id: "gemini",
   label: "Gemini CLI",
   docsUrl: "https://github.com/google-gemini/gemini-cli/blob/main/docs/tools/mcp-server.md",
-  mcpConfigPath: () => envOverride("NEAT_GEMINI_CONFIG") ?? path17.join(homeDir(), ".gemini", "settings.json"),
+  mcpConfigPath: () => envOverride("NEAT_GEMINI_CONFIG") ?? path18.join(homeDir(), ".gemini", "settings.json"),
   mcpContainerKey: "mcpServers",
   format: "json",
   rulesFileName: "GEMINI.md"
@@ -7474,7 +7741,7 @@ var QWEN_CLIENT = {
   id: "qwen",
   label: "Qwen Code",
   docsUrl: "https://qwenlm.github.io/qwen-code-docs/en/users/features/mcp/",
-  mcpConfigPath: () => envOverride("NEAT_QWEN_CONFIG") ?? path17.join(homeDir(), ".qwen", "settings.json"),
+  mcpConfigPath: () => envOverride("NEAT_QWEN_CONFIG") ?? path18.join(homeDir(), ".qwen", "settings.json"),
   mcpContainerKey: "mcpServers",
   format: "json",
   rulesFileName: "QWEN.md"
@@ -7483,7 +7750,7 @@ var AMAZONQ_CLIENT = {
   id: "amazonq",
   label: "Amazon Q Developer CLI",
   docsUrl: "https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/command-line-mcp-configuration.html",
-  mcpConfigPath: () => envOverride("NEAT_AMAZONQ_CONFIG") ?? path17.join(homeDir(), ".aws", "amazonq", "mcp.json"),
+  mcpConfigPath: () => envOverride("NEAT_AMAZONQ_CONFIG") ?? path18.join(homeDir(), ".aws", "amazonq", "mcp.json"),
   mcpContainerKey: "mcpServers",
   format: "json"
 };
@@ -7491,7 +7758,7 @@ var ROOCODE_CLIENT = {
   id: "roocode",
   label: "Roo Code",
   docsUrl: "https://roocodeinc.github.io/Roo-Code/features/mcp/using-mcp-in-roo",
-  mcpConfigPath: () => envOverride("NEAT_ROOCODE_CONFIG") ?? path17.join(process.cwd(), ".roo", "mcp.json"),
+  mcpConfigPath: () => envOverride("NEAT_ROOCODE_CONFIG") ?? path18.join(process.cwd(), ".roo", "mcp.json"),
   mcpContainerKey: "mcpServers",
   format: "json"
 };
@@ -7504,9 +7771,9 @@ var ZED_CLIENT = {
     if (override) return override;
     if (process.platform === "win32") {
       const appData = process.env.APPDATA;
-      if (appData && appData.length > 0) return path17.join(appData, "Zed", "settings.json");
+      if (appData && appData.length > 0) return path18.join(appData, "Zed", "settings.json");
     }
-    return path17.join(homeDir(), ".config", "zed", "settings.json");
+    return path18.join(homeDir(), ".config", "zed", "settings.json");
   },
   mcpContainerKey: "context_servers",
   format: "jsonc",
@@ -7516,7 +7783,7 @@ var OPENCODE_CLIENT = {
   id: "opencode",
   label: "OpenCode",
   docsUrl: "https://opencode.ai/docs/mcp-servers/",
-  mcpConfigPath: () => envOverride("NEAT_OPENCODE_CONFIG") ?? path17.join(xdgConfigDir(), "opencode", "opencode.json"),
+  mcpConfigPath: () => envOverride("NEAT_OPENCODE_CONFIG") ?? path18.join(xdgConfigDir(), "opencode", "opencode.json"),
   mcpContainerKey: "mcp",
   format: "json",
   serverEntry: NEAT_OPENCODE_SERVER,
@@ -7526,7 +7793,7 @@ var CRUSH_CLIENT = {
   id: "crush",
   label: "Crush",
   docsUrl: "https://charmbracelet-crush.mintlify.app/configuration/mcp",
-  mcpConfigPath: () => envOverride("NEAT_CRUSH_CONFIG") ?? path17.join(xdgConfigDir(), "crush", "crush.json"),
+  mcpConfigPath: () => envOverride("NEAT_CRUSH_CONFIG") ?? path18.join(xdgConfigDir(), "crush", "crush.json"),
   mcpContainerKey: "mcp",
   format: "json",
   serverEntry: NEAT_CRUSH_SERVER,
@@ -7589,7 +7856,7 @@ async function planMcp(client, mcpPath) {
   const serverEntry = client.serverEntry ?? NEAT_MCP_SERVER;
   let raw = "";
   try {
-    raw = await fs16.readFile(mcpPath, "utf8");
+    raw = await fs17.readFile(mcpPath, "utf8");
   } catch (err) {
     const e = err;
     if (e.code === "ENOENT") {
@@ -7631,7 +7898,7 @@ async function runEditorInstall(client, opts) {
   const mcpPath = client.mcpConfigPath();
   const serverEntry = client.serverEntry ?? NEAT_MCP_SERVER;
   const hasRules = typeof client.rulesFileName === "string";
-  const rulesPath = hasRules ? path17.join(opts.projectDir, client.rulesFileName) : "";
+  const rulesPath = hasRules ? path18.join(opts.projectDir, client.rulesFileName) : "";
   const mcp = await planMcp(client, mcpPath);
   if (mcp === null) return { exitCode: 1 };
   let existingRules = "";
@@ -7640,7 +7907,7 @@ async function runEditorInstall(client, opts) {
   let block = "";
   if (hasRules) {
     try {
-      existingRules = await fs16.readFile(rulesPath, "utf8");
+      existingRules = await fs17.readFile(rulesPath, "utf8");
     } catch (err) {
       if (err.code !== "ENOENT") {
         console.error(`neat ${client.id}: failed to read ${rulesPath} \u2014 ${err.message}`);
@@ -7674,11 +7941,11 @@ async function runEditorInstall(client, opts) {
     );
     return { exitCode: 0 };
   }
-  await fs16.mkdir(path17.dirname(mcpPath), { recursive: true });
-  await fs16.writeFile(mcpPath, mcp.text, "utf8");
+  await fs17.mkdir(path18.dirname(mcpPath), { recursive: true });
+  await fs17.writeFile(mcpPath, mcp.text, "utf8");
   if (hasRules) {
-    await fs16.mkdir(path17.dirname(rulesPath), { recursive: true });
-    await fs16.writeFile(rulesPath, newRules, "utf8");
+    await fs17.mkdir(path18.dirname(rulesPath), { recursive: true });
+    await fs17.writeFile(rulesPath, newRules, "utf8");
   }
   console.log(`neat ${client.id}: wired NEAT into ${client.label}`);
   console.log(`  MCP server: ${mcpPath} (${client.mcpContainerKey}.neat \u2192 npx -y @neat.is/mcp)`);
@@ -8178,7 +8445,7 @@ function sleep(ms, signal) {
 }
 
 // src/cli-verbs.ts
-import path18 from "path";
+import path19 from "path";
 async function resolveProjectEntry(opts) {
   const entries = await listProjects();
   if (opts.project) {
@@ -8188,7 +8455,7 @@ async function resolveProjectEntry(opts) {
   const cwd = opts.cwd ?? process.cwd();
   const resolvedCwd = await normalizeProjectPath(cwd);
   for (const entry2 of entries) {
-    if (resolvedCwd === entry2.path || resolvedCwd.startsWith(`${entry2.path}${path18.sep}`)) {
+    if (resolvedCwd === entry2.path || resolvedCwd.startsWith(`${entry2.path}${path19.sep}`)) {
       return entry2;
     }
   }
@@ -8765,7 +9032,7 @@ async function buildPatchSections(services, project) {
 }
 async function runInit(opts) {
   const written = [];
-  const stat = await fs17.stat(opts.scanPath).catch(() => null);
+  const stat = await fs18.stat(opts.scanPath).catch(() => null);
   if (!stat || !stat.isDirectory()) {
     console.error(`neat init: ${opts.scanPath} is not a directory`);
     return { exitCode: 2, writtenFiles: written };
@@ -8774,13 +9041,13 @@ async function runInit(opts) {
   printDiscoveryReport(opts, services);
   const sections = opts.noInstall ? [] : await buildPatchSections(services, opts.project);
   const patch = renderPatch(sections);
-  const patchPath = path19.join(opts.scanPath, "neat.patch");
+  const patchPath = path20.join(opts.scanPath, "neat.patch");
   if (opts.dryRun) {
-    await fs17.writeFile(patchPath, patch, "utf8");
+    await fs18.writeFile(patchPath, patch, "utf8");
     written.push(patchPath);
     console.log(`dry-run: patch written to ${patchPath}`);
-    const gitignorePath = path19.join(opts.scanPath, ".gitignore");
-    const gitignoreExists = await fs17.stat(gitignorePath).then(() => true).catch(() => false);
+    const gitignorePath = path20.join(opts.scanPath, ".gitignore");
+    const gitignoreExists = await fs18.stat(gitignorePath).then(() => true).catch(() => false);
     const verb = gitignoreExists ? "append" : "create";
     console.log(`dry-run: would ${verb} ${gitignorePath} (add neat-out/)`);
     console.log("rerun without --dry-run to register and snapshot.");
@@ -8791,9 +9058,9 @@ async function runInit(opts) {
   const graph = getGraph(graphKey);
   const projectPaths = pathsForProject(
     graphKey,
-    path19.join(opts.scanPath, "neat-out")
+    path20.join(opts.scanPath, "neat-out")
   );
-  const errorsPath = path19.join(path19.dirname(opts.outPath), path19.basename(projectPaths.errorsPath));
+  const errorsPath = path20.join(path20.dirname(opts.outPath), path20.basename(projectPaths.errorsPath));
   const result = await extractFromDirectory(graph, opts.scanPath, { errorsPath });
   await saveGraphToDisk(graph, opts.outPath);
   written.push(opts.outPath);
@@ -8872,7 +9139,7 @@ async function runInit(opts) {
         console.log("Run `npm install` (or your language equivalent) to refresh lockfiles.");
       }
     } else {
-      await fs17.writeFile(patchPath, patch, "utf8");
+      await fs18.writeFile(patchPath, patch, "utf8");
       written.push(patchPath);
     }
   }
@@ -8913,9 +9180,9 @@ var CLAUDE_SKILL_CONFIG = {
 };
 function claudeConfigPath() {
   const override = process.env.NEAT_CLAUDE_CONFIG;
-  if (override && override.length > 0) return path19.resolve(override);
+  if (override && override.length > 0) return path20.resolve(override);
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return path19.join(home, ".claude.json");
+  return path20.join(home, ".claude.json");
 }
 async function runSkill(opts) {
   const snippet = JSON.stringify(CLAUDE_SKILL_CONFIG, null, 2) + "\n";
@@ -8927,7 +9194,7 @@ async function runSkill(opts) {
     const target = claudeConfigPath();
     let existing = {};
     try {
-      existing = JSON.parse(await fs17.readFile(target, "utf8"));
+      existing = JSON.parse(await fs18.readFile(target, "utf8"));
     } catch (err) {
       if (err.code !== "ENOENT") {
         console.error(`neat skill: failed to read ${target} \u2014 ${err.message}`);
@@ -8939,8 +9206,8 @@ async function runSkill(opts) {
       ...existing,
       mcpServers: { ...mcp, neat: CLAUDE_SKILL_CONFIG.mcpServers.neat }
     };
-    await fs17.mkdir(path19.dirname(target), { recursive: true });
-    await fs17.writeFile(target, JSON.stringify(merged, null, 2) + "\n", "utf8");
+    await fs18.mkdir(path20.dirname(target), { recursive: true });
+    await fs18.writeFile(target, JSON.stringify(merged, null, 2) + "\n", "utf8");
     console.log(`neat skill: wrote mcpServers.neat to ${target}`);
     console.log("restart Claude Code to pick up the new MCP server.");
     console.log("");
@@ -9061,12 +9328,12 @@ async function main() {
       console.error("neat init: --apply and --dry-run are mutually exclusive");
       process.exit(2);
     }
-    const scanPath = path19.resolve(target);
+    const scanPath = path20.resolve(target);
     const projectExplicit = parsed.project !== null;
-    const projectName = projectExplicit ? project : path19.basename(scanPath);
+    const projectName = projectExplicit ? project : path20.basename(scanPath);
     const projectKey = projectExplicit ? project : DEFAULT_PROJECT;
-    const fallback = pathsForProject(projectKey, path19.join(scanPath, "neat-out")).snapshotPath;
-    const outPath = path19.resolve(process.env.NEAT_OUT_PATH ?? fallback);
+    const fallback = pathsForProject(projectKey, path20.join(scanPath, "neat-out")).snapshotPath;
+    const outPath = path20.resolve(process.env.NEAT_OUT_PATH ?? fallback);
     const result = await runInit({
       scanPath,
       outPath,
@@ -9087,21 +9354,21 @@ async function main() {
       usage5();
       process.exit(2);
     }
-    const scanPath = path19.resolve(target);
-    const stat = await fs17.stat(scanPath).catch(() => null);
+    const scanPath = path20.resolve(target);
+    const stat = await fs18.stat(scanPath).catch(() => null);
     if (!stat || !stat.isDirectory()) {
       console.error(`neat watch: ${scanPath} is not a directory`);
       process.exit(2);
     }
-    const projectPaths = pathsForProject(project, path19.join(scanPath, "neat-out"));
-    const outPath = path19.resolve(process.env.NEAT_OUT_PATH ?? projectPaths.snapshotPath);
-    const errorsPath = path19.resolve(
-      process.env.NEAT_ERRORS_PATH ?? path19.join(path19.dirname(outPath), path19.basename(projectPaths.errorsPath))
+    const projectPaths = pathsForProject(project, path20.join(scanPath, "neat-out"));
+    const outPath = path20.resolve(process.env.NEAT_OUT_PATH ?? projectPaths.snapshotPath);
+    const errorsPath = path20.resolve(
+      process.env.NEAT_ERRORS_PATH ?? path20.join(path20.dirname(outPath), path20.basename(projectPaths.errorsPath))
     );
-    const staleEventsPath = path19.resolve(
-      process.env.NEAT_STALE_EVENTS_PATH ?? path19.join(path19.dirname(outPath), path19.basename(projectPaths.staleEventsPath))
+    const staleEventsPath = path20.resolve(
+      process.env.NEAT_STALE_EVENTS_PATH ?? path20.join(path20.dirname(outPath), path20.basename(projectPaths.staleEventsPath))
     );
-    const embeddingsCachePath = process.env.NEAT_EMBEDDINGS_CACHE_PATH ? path19.resolve(process.env.NEAT_EMBEDDINGS_CACHE_PATH) : void 0;
+    const embeddingsCachePath = process.env.NEAT_EMBEDDINGS_CACHE_PATH ? path20.resolve(process.env.NEAT_EMBEDDINGS_CACHE_PATH) : void 0;
     const handle = await startWatch(getGraph(project), {
       scanPath,
       outPath,
@@ -9110,7 +9377,7 @@ async function main() {
       project,
       // Resolve NEAT_HOME so a `neat watch` picks up connectors added to
       // ~/.neat/connectors.json (#871). Same resolution the rest of the CLI uses.
-      neatHome: process.env.NEAT_HOME ? path19.resolve(process.env.NEAT_HOME) : path19.join(os5.homedir(), ".neat"),
+      neatHome: process.env.NEAT_HOME ? path20.resolve(process.env.NEAT_HOME) : path20.join(os5.homedir(), ".neat"),
       ...embeddingsCachePath ? { embeddingsCachePath } : {},
       host: process.env.HOST ?? "0.0.0.0",
       port: Number(process.env.PORT ?? 8080),
@@ -9292,11 +9559,11 @@ async function main() {
   process.exit(1);
 }
 async function tryOrchestrator(cmd, parsed) {
-  const scanPath = path19.resolve(cmd);
-  const stat = await fs17.stat(scanPath).catch(() => null);
+  const scanPath = path20.resolve(cmd);
+  const stat = await fs18.stat(scanPath).catch(() => null);
   if (!stat || !stat.isDirectory()) return null;
   const projectExplicit = parsed.project !== null;
-  const projectName = projectExplicit ? parsed.project : path19.basename(scanPath);
+  const projectName = projectExplicit ? parsed.project : path20.basename(scanPath);
   const result = await runOrchestrator({
     scanPath,
     project: projectName,
@@ -9311,7 +9578,18 @@ async function tryOrchestrator(cmd, parsed) {
 async function runWelcomeFlow(parsed) {
   return runWelcome({
     login: (loginArgv) => runLoginCommand(loginArgv),
-    orchestrator: async (cwd) => await tryOrchestrator(cwd, parsed) ?? 0
+    // What the person chose at the door reaches the orchestrator as the flags they
+    // stand for: the name as `--project`, the instrument answer as `--no-instrument`
+    // or as `yes` (which keeps the orchestrator's own prompt quiet, since the door
+    // already asked).
+    orchestrator: async (cwd, opts) => await tryOrchestrator(cwd, {
+      ...parsed,
+      ...opts?.project !== void 0 ? { project: opts.project } : {},
+      ...opts?.noInstrument !== void 0 ? { noInstrument: opts.noInstrument } : {},
+      ...opts?.yes !== void 0 ? { yes: opts.yes } : {}
+    }) ?? 0,
+    // An explicit flag is an answer; don't ask again.
+    instrumentFlagGiven: parsed.noInstrument || parsed.dryRun
   });
 }
 var QUERY_VERBS = /* @__PURE__ */ new Set([
@@ -9344,6 +9622,13 @@ var ProjectResolutionError = class extends Error {
   }
   exitCode;
 };
+function isLoopbackEndpoint(endpoint) {
+  try {
+    return isLoopbackHost(new URL(endpoint).hostname.replace(/^\[|\]$/g, ""));
+  } catch {
+    return false;
+  }
+}
 async function resolveProjectForVerb(client, parsed) {
   const explicit = resolveProjectFlag(parsed);
   if (explicit) return explicit;
@@ -9574,6 +9859,9 @@ async function runQueryVerb(cmd, parsed) {
       console.error(`neat ${cmd}: ${detail.trim()}`);
     } else if (err instanceof TransportError) {
       console.error(`neat ${cmd}: ${err.message}. Is the daemon running? (endpoint=${target.endpoint})`);
+      if (isLoopbackEndpoint(target.endpoint)) {
+        console.error(`neat ${cmd}: start one with \`neat watch .\`, or \`neat\` to extract and start in one step.`);
+      }
     } else {
       console.error(`neat ${cmd}: ${err.message}`);
     }
@@ -9629,6 +9917,7 @@ export {
   QUERY_VERBS,
   UnknownProfileError,
   commandPrefix,
+  isLoopbackEndpoint,
   isNpxInvocation,
   main,
   parseArgs,