@neat.is/core 0.9.15-dev.20260907 → 0.9.15-dev.20260909

package/dist/cli.js

@@ -91,9 +91,9 @@ import {
 } from "./chunk-GDGUY4T6.js";
 
 // src/cli.ts
-import path17 from "path";
-import os4 from "os";
-import { promises as fs15 } from "fs";
+import path18 from "path";
+import os5 from "os";
+import { promises as fs16 } from "fs";
 
 // src/banner.ts
 import path from "path";
@@ -4871,10 +4871,10 @@ function createHttpClient(baseUrl, bearerToken) {
   const root = baseUrl.replace(/\/$/, "");
   const authHeader = bearerToken && bearerToken.length > 0 ? { authorization: `Bearer ${bearerToken}` } : {};
   return {
-    async get(path18) {
+    async get(path19) {
       let res;
       try {
-        res = await fetch(`${root}${path18}`, {
+        res = await fetch(`${root}${path19}`, {
           headers: { ...authHeader }
         });
       } catch (err) {
@@ -4886,16 +4886,16 @@ function createHttpClient(baseUrl, bearerToken) {
         const body = await res.text().catch(() => "");
         throw new HttpError(
           res.status,
-          `${res.status} ${res.statusText} on GET ${path18}: ${body}`,
+          `${res.status} ${res.statusText} on GET ${path19}: ${body}`,
           body
         );
       }
       return await res.json();
     },
-    async post(path18, body) {
+    async post(path19, body) {
       let res;
       try {
-        res = await fetch(`${root}${path18}`, {
+        res = await fetch(`${root}${path19}`, {
           method: "POST",
           headers: { "content-type": "application/json", ...authHeader },
           body: JSON.stringify(body)
@@ -4909,7 +4909,7 @@ function createHttpClient(baseUrl, bearerToken) {
         const text = await res.text().catch(() => "");
         throw new HttpError(
           res.status,
-          `${res.status} ${res.statusText} on POST ${path18}: ${text}`,
+          `${res.status} ${res.statusText} on POST ${path19}: ${text}`,
           text
         );
       }
@@ -4923,12 +4923,12 @@ function projectPath(project, suffix) {
 }
 async function runRootCause(client, input) {
   const qs = input.errorId ? `?errorId=${encodeURIComponent(input.errorId)}` : "";
-  const path18 = projectPath(
+  const path19 = projectPath(
     input.project,
     `/graph/root-cause/${encodeURIComponent(input.errorNode)}${qs}`
   );
   try {
-    const result = await client.get(path18);
+    const result = await client.get(path19);
     const arrowPath = result.traversalPath.join(" \u2190 ");
     const provenances = result.edgeProvenances.length ? result.edgeProvenances.join(", ") : "(direct, no edges traversed)";
     const summary = `Root cause for ${input.errorNode} is ${result.rootCauseNode}. ` + result.rootCauseReason + (result.fixRecommendation ? ` Recommended fix: ${result.fixRecommendation}.` : "");
@@ -4954,12 +4954,12 @@ async function runRootCause(client, input) {
 }
 async function runBlastRadius(client, input) {
   const qs = input.depth !== void 0 ? `?depth=${input.depth}` : "";
-  const path18 = projectPath(
+  const path19 = projectPath(
     input.project,
     `/graph/blast-radius/${encodeURIComponent(input.nodeId)}${qs}`
   );
   try {
-    const result = await client.get(path18);
+    const result = await client.get(path19);
     if (result.totalAffected === 0) {
       return {
         summary: `${result.origin} has no dependents. Nothing else would break if it failed.`
@@ -4993,12 +4993,12 @@ function formatBlastEntry(n) {
 }
 async function runDependencies(client, input) {
   const depth = input.depth ?? 3;
-  const path18 = projectPath(
+  const path19 = projectPath(
     input.project,
     `/graph/dependencies/${encodeURIComponent(input.nodeId)}?depth=${depth}`
   );
   try {
-    const result = await client.get(path18);
+    const result = await client.get(path19);
     if (result.total === 0) {
       return {
         summary: depth === 1 ? `${input.nodeId} has no direct dependencies in the graph.` : `${input.nodeId} has no dependencies (BFS to depth ${depth}).`
@@ -5090,9 +5090,9 @@ function formatDuration(ms) {
   return `${Math.round(h / 24)}d`;
 }
 async function runIncidents(client, input) {
-  const path18 = input.nodeId ? projectPath(input.project, `/incidents/${encodeURIComponent(input.nodeId)}`) : projectPath(input.project, "/incidents");
+  const path19 = input.nodeId ? projectPath(input.project, `/incidents/${encodeURIComponent(input.nodeId)}`) : projectPath(input.project, "/incidents");
   try {
-    const body = await client.get(path18);
+    const body = await client.get(path19);
     const events = body.events;
     if (events.length === 0) {
       return {
@@ -5563,28 +5563,462 @@ async function runDoctorCommand(argv, deps = {}) {
   return checks.every((c) => c.ok) ? 0 : 1;
 }
 
-// src/hooks-cli.ts
-import path12 from "path";
-import os from "os";
+// src/login-cli.ts
+import readline3 from "readline/promises";
+
+// src/profiles.ts
 import { promises as fs11 } from "fs";
+import os from "os";
+import path12 from "path";
+var PROFILES_CONFIG_VERSION = 1;
+function neatHome() {
+  const override = process.env.NEAT_HOME;
+  if (override && override.length > 0) return path12.resolve(override);
+  return path12.join(os.homedir(), ".neat");
+}
+function profilesConfigPath(home = neatHome()) {
+  return path12.join(home, "profiles.json");
+}
+function profilesConfigLockPath(home = neatHome()) {
+  return path12.join(home, "profiles.json.lock");
+}
+var MODE_MASK_LOOSER_THAN_0600 = 63;
+async function warnIfModeLooserThan0600(file) {
+  if (process.platform === "win32") return;
+  try {
+    const stat = await fs11.stat(file);
+    if ((stat.mode & MODE_MASK_LOOSER_THAN_0600) !== 0) {
+      const mode = (stat.mode & 511).toString(8).padStart(3, "0");
+      console.warn(
+        `[neat] ${file} is mode 0${mode}, looser than the 0600 this file's token calls for \u2014 run \`chmod 600 ${file}\``
+      );
+    }
+  } catch {
+  }
+}
+async function readProfilesConfig(home = neatHome()) {
+  const file = profilesConfigPath(home);
+  let raw;
+  try {
+    raw = await fs11.readFile(file, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return { version: PROFILES_CONFIG_VERSION, profiles: [] };
+    }
+    throw err;
+  }
+  await warnIfModeLooserThan0600(file);
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`${file} is not valid JSON: ${err.message}`);
+  }
+  return validateConfig(parsed, file);
+}
+function validateConfig(parsed, file) {
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error(`${file} must be a JSON object with a "profiles" array`);
+  }
+  const obj = parsed;
+  const version = obj.version === void 0 ? PROFILES_CONFIG_VERSION : obj.version;
+  if (typeof version !== "number" || !Number.isInteger(version)) {
+    throw new Error(`${file}: "version" must be an integer`);
+  }
+  const rawProfiles = obj.profiles;
+  if (!Array.isArray(rawProfiles)) {
+    throw new Error(`${file}: "profiles" must be an array`);
+  }
+  const profiles = rawProfiles.map((entry2, i) => validateEntry(entry2, i, file));
+  const seen = /* @__PURE__ */ new Set();
+  for (const p of profiles) {
+    if (seen.has(p.name)) throw new Error(`${file}: duplicate profile name "${p.name}"`);
+    seen.add(p.name);
+  }
+  let active;
+  if (obj.active !== void 0) {
+    if (typeof obj.active !== "string" || obj.active.length === 0) {
+      throw new Error(`${file}: "active" must be a non-empty string when present`);
+    }
+    active = seen.has(obj.active) ? obj.active : void 0;
+  }
+  return { version, ...active ? { active } : {}, profiles };
+}
+function validateEntry(entry2, index, file) {
+  const where = `${file}: profiles[${index}]`;
+  if (typeof entry2 !== "object" || entry2 === null || Array.isArray(entry2)) {
+    throw new Error(`${where} must be an object`);
+  }
+  const e = entry2;
+  const name = e.name;
+  if (typeof name !== "string" || name.length === 0) {
+    throw new Error(`${where}.name must be a non-empty string`);
+  }
+  const endpoint = e.endpoint;
+  if (typeof endpoint !== "string" || endpoint.length === 0) {
+    throw new Error(`${where}.endpoint must be a non-empty string`);
+  }
+  let parsedUrl;
+  try {
+    parsedUrl = new URL(endpoint);
+  } catch {
+    throw new Error(`${where}.endpoint must be an absolute URL (got "${endpoint}")`);
+  }
+  if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") {
+    throw new Error(`${where}.endpoint must be an http(s) URL (got "${parsedUrl.protocol}")`);
+  }
+  if (e.authToken !== void 0 && (typeof e.authToken !== "string" || e.authToken.length === 0)) {
+    throw new Error(`${where}.authToken must be a non-empty string when present`);
+  }
+  return {
+    name,
+    endpoint,
+    ...typeof e.authToken === "string" ? { authToken: e.authToken } : {}
+  };
+}
+async function resolveProfile(name, home = neatHome()) {
+  const { profiles } = await readProfilesConfig(home);
+  return profiles.find((p) => p.name === name);
+}
+async function getActiveProfile(home = neatHome()) {
+  const { active, profiles } = await readProfilesConfig(home);
+  if (!active) return void 0;
+  return profiles.find((p) => p.name === active);
+}
+function serialize(config) {
+  const names = new Set(config.profiles.map((p) => p.name));
+  const active = config.active && names.has(config.active) ? config.active : void 0;
+  const out = {
+    version: config.version ?? PROFILES_CONFIG_VERSION,
+    ...active ? { active } : {},
+    profiles: config.profiles
+  };
+  return `${JSON.stringify(out, null, 2)}
+`;
+}
+async function writeConfigAtomic(config, home) {
+  const file = profilesConfigPath(home);
+  await fs11.mkdir(path12.dirname(file), { recursive: true });
+  const tmp = `${file}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+  const fd = await fs11.open(tmp, "w", 384);
+  try {
+    await fd.writeFile(serialize(config), "utf8");
+    await fd.sync();
+  } finally {
+    await fd.close();
+  }
+  await fs11.rename(tmp, file);
+}
+var LOCK_RETRY_MS = 50;
+var LOCK_TIMEOUT_MS = 5e3;
+async function acquireLock(lockPath) {
+  await fs11.mkdir(path12.dirname(lockPath), { recursive: true });
+  const deadline = Date.now() + LOCK_TIMEOUT_MS;
+  for (; ; ) {
+    try {
+      const fd = await fs11.open(lockPath, "wx");
+      await fd.writeFile(`${process.pid}
+`, "utf8");
+      await fd.close();
+      return;
+    } catch (err) {
+      if (err.code !== "EEXIST") throw err;
+      if (Date.now() >= deadline) {
+        throw new Error(
+          `timed out acquiring ${lockPath} after ${LOCK_TIMEOUT_MS}ms \u2014 if no other neat process is running, remove the stale lock file`
+        );
+      }
+      await new Promise((resolve) => setTimeout(resolve, LOCK_RETRY_MS));
+    }
+  }
+}
+async function releaseLock(lockPath) {
+  await fs11.rm(lockPath, { force: true });
+}
+async function withProfilesLock(home, fn) {
+  const lockPath = profilesConfigLockPath(home);
+  await acquireLock(lockPath);
+  try {
+    return await fn();
+  } finally {
+    await releaseLock(lockPath);
+  }
+}
+async function upsertProfile(profile, opts = {}) {
+  const home = opts.home ?? neatHome();
+  const validated = validateEntry(profile, 0, profilesConfigPath(home));
+  await withProfilesLock(home, async () => {
+    const config = await readProfilesConfig(home);
+    const others = config.profiles.filter((p) => p.name !== validated.name);
+    const profiles = [...others, validated];
+    const makeActive = opts.makeActive ?? config.profiles.length === 0;
+    const active = makeActive ? validated.name : config.active;
+    await writeConfigAtomic({ version: config.version, ...active ? { active } : {}, profiles }, home);
+  });
+}
+async function removeProfile(name, home = neatHome()) {
+  return withProfilesLock(home, async () => {
+    const config = await readProfilesConfig(home);
+    const profiles = config.profiles.filter((p) => p.name !== name);
+    if (profiles.length === config.profiles.length) return false;
+    const active = config.active === name ? void 0 : config.active;
+    await writeConfigAtomic({ version: config.version, ...active ? { active } : {}, profiles }, home);
+    return true;
+  });
+}
+async function clearActiveProfile(home = neatHome()) {
+  return withProfilesLock(home, async () => {
+    const config = await readProfilesConfig(home);
+    if (!config.active) return false;
+    await writeConfigAtomic({ version: config.version, profiles: config.profiles }, home);
+    return true;
+  });
+}
+
+// src/login-cli.ts
+var HEALTH_TIMEOUT_MS2 = 5e3;
+var DEFAULT_PROFILE_NAME = "hosted";
+function readFlagValue(argv, i) {
+  const arg = argv[i];
+  const eq = arg.indexOf("=");
+  if (eq !== -1) return { value: arg.slice(eq + 1), next: i };
+  return { value: argv[i + 1], next: i + 1 };
+}
+function parseLoginArgs(argv) {
+  const parsed = { name: DEFAULT_PROFILE_NAME, json: false, help: false };
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "-h" || arg === "--help") parsed.help = true;
+    else if (arg === "--json") parsed.json = true;
+    else if (arg === "--endpoint" || arg.startsWith("--endpoint=")) {
+      const { value, next } = readFlagValue(argv, i);
+      parsed.endpoint = value;
+      i = next;
+    } else if (arg === "--token" || arg.startsWith("--token=")) {
+      const { value, next } = readFlagValue(argv, i);
+      parsed.token = value;
+      i = next;
+    } else if (arg === "--name" || arg.startsWith("--name=")) {
+      const { value, next } = readFlagValue(argv, i);
+      if (value && value.length > 0) parsed.name = value;
+      i = next;
+    } else {
+      parsed.error = `unknown argument "${arg}"`;
+      break;
+    }
+  }
+  return parsed;
+}
+function printLoginHelp(out) {
+  out("usage: neat login [--endpoint <url>] [--token <token>] [--name <name>] [--json]");
+  out("  Connect this machine to a hosted NEAT and make it the default for the");
+  out("  neat CLI and the MCP server. Omit --endpoint / --token to be prompted");
+  out("  (the token is read without echo). --name labels the profile (default");
+  out('  "hosted"). The token can also come from NEAT_LOGIN_TOKEN.');
+  out("  Exit 0 on success, 1 rejected token/endpoint, 2 misuse, 3 unreachable.");
+}
+async function probeDaemon(fetchImpl, endpoint, token) {
+  const root = endpoint.replace(/\/$/, "");
+  let res;
+  try {
+    res = await fetchImpl(`${root}/health`, {
+      headers: { authorization: `Bearer ${token}` },
+      signal: AbortSignal.timeout(HEALTH_TIMEOUT_MS2)
+    });
+  } catch (err) {
+    return { kind: "unreachable", detail: err.message };
+  }
+  if (res.status === 401 || res.status === 403) return { kind: "unauthorized", status: res.status };
+  if (!res.ok) return { kind: "not-neat", status: res.status };
+  const contentType = res.headers.get("content-type") ?? "";
+  if (!contentType.includes("json")) return { kind: "not-neat", status: res.status };
+  return { kind: "ok" };
+}
+async function runLoginCommand(argv, deps = {}) {
+  const out = deps.out ?? ((line) => console.log(line));
+  const err = deps.err ?? ((line) => console.error(line));
+  const env = deps.env ?? process.env;
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const readLine = deps.readLine ?? defaultReadLine;
+  const readSecret = deps.readSecret ?? defaultReadSecret;
+  const args = parseLoginArgs(argv);
+  if (args.help) {
+    printLoginHelp(out);
+    return 0;
+  }
+  if (args.error) {
+    err(`neat login: ${args.error}`);
+    return 2;
+  }
+  let endpoint = args.endpoint;
+  if (!endpoint) endpoint = (await readLine("Hosted NEAT endpoint (https://\u2026): "))?.trim();
+  if (!endpoint) {
+    err("neat login: an endpoint is required \u2014 pass --endpoint <url> or run interactively");
+    return 2;
+  }
+  let url;
+  try {
+    url = new URL(endpoint);
+  } catch {
+    err(`neat login: --endpoint must be an absolute URL (got "${endpoint}")`);
+    return 2;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    err(`neat login: --endpoint must be an http(s) URL (got "${url.protocol}")`);
+    return 2;
+  }
+  const envToken = env.NEAT_LOGIN_TOKEN;
+  let token = args.token ?? (envToken && envToken.length > 0 ? envToken : void 0);
+  if (!token) token = (await readSecret("Daemon token: "))?.trim();
+  if (!token) {
+    err("neat login: a token is required \u2014 pass --token, set NEAT_LOGIN_TOKEN, or run interactively");
+    return 2;
+  }
+  const probe = await probeDaemon(fetchImpl, endpoint, token);
+  if (probe.kind === "unreachable") {
+    err(`neat login: can't reach ${endpoint} \u2014 ${probe.detail}`);
+    return 3;
+  }
+  if (probe.kind === "unauthorized") {
+    err(`neat login: ${endpoint} rejected the token (HTTP ${probe.status}). Check the token and try again.`);
+    return 1;
+  }
+  if (probe.kind === "not-neat") {
+    err(`neat login: ${endpoint} answered but does not look like a NEAT daemon (HTTP ${probe.status}).`);
+    return 1;
+  }
+  await upsertProfile(
+    { name: args.name, endpoint, authToken: token },
+    { makeActive: true, ...deps.home ? { home: deps.home } : {} }
+  );
+  if (args.json) {
+    out(JSON.stringify({ status: "logged-in", profile: args.name, endpoint }, null, 2));
+  } else {
+    out(`Logged in \u2014 profile "${args.name}" \u2192 ${endpoint}`);
+    out("The neat CLI and the MCP server now read this hosted graph by default.");
+    out("Run `neat logout` to switch back to your local daemon.");
+  }
+  return 0;
+}
+function parseLogoutArgs(argv) {
+  const parsed = { help: false };
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "-h" || arg === "--help") parsed.help = true;
+    else if (arg === "--name" || arg.startsWith("--name=")) {
+      const { value, next } = readFlagValue(argv, i);
+      parsed.name = value;
+      i = next;
+    } else {
+      parsed.error = `unknown argument "${arg}"`;
+      break;
+    }
+  }
+  return parsed;
+}
+async function runLogoutCommand(argv, deps = {}) {
+  const out = deps.out ?? ((line) => console.log(line));
+  const err = deps.err ?? ((line) => console.error(line));
+  const home = deps.home;
+  const args = parseLogoutArgs(argv);
+  if (args.help) {
+    out("usage: neat logout [--name <name>]");
+    out("  With no argument, clears the active hosted profile so the CLI and MCP");
+    out("  server go back to your local daemon (the stored profile is kept).");
+    out("  --name <name> removes that profile from ~/.neat/profiles.json entirely.");
+    return 0;
+  }
+  if (args.error) {
+    err(`neat logout: ${args.error}`);
+    return 2;
+  }
+  if (args.name !== void 0) {
+    if (args.name.length === 0) {
+      err("neat logout: --name needs a profile name");
+      return 2;
+    }
+    const removed = await removeProfile(args.name, home ?? void 0);
+    if (!removed) {
+      err(`neat logout: no profile named "${args.name}"`);
+      return 1;
+    }
+    out(`Removed profile "${args.name}".`);
+    return 0;
+  }
+  const active = await getActiveProfile(home ?? void 0);
+  if (!active) {
+    out("Not logged in to a hosted NEAT \u2014 the CLI is already using your local daemon.");
+    return 0;
+  }
+  await clearActiveProfile(home ?? void 0);
+  out(`Logged out of "${active.name}" (${active.endpoint}). The CLI is back on your local daemon.`);
+  return 0;
+}
+async function defaultReadLine(prompt) {
+  if (!process.stdin.isTTY) return void 0;
+  const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return await rl.question(prompt);
+  } finally {
+    rl.close();
+  }
+}
+async function defaultReadSecret(prompt) {
+  const stdin = process.stdin;
+  if (!stdin.isTTY) return void 0;
+  process.stdout.write(prompt);
+  return new Promise((resolve) => {
+    const chars = [];
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.setEncoding("utf8");
+    const cleanup = () => {
+      stdin.setRawMode(false);
+      stdin.pause();
+      stdin.off("data", onData);
+    };
+    const onData = (ch) => {
+      const code = ch.charCodeAt(0);
+      if (ch === "\n" || ch === "\r" || code === 4) {
+        cleanup();
+        process.stdout.write("\n");
+        resolve(chars.join(""));
+      } else if (code === 3) {
+        cleanup();
+        process.stdout.write("\n");
+        process.exit(130);
+      } else if (code === 127 || ch === "\b") {
+        chars.pop();
+      } else {
+        chars.push(ch);
+      }
+    };
+    stdin.on("data", onData);
+  });
+}
+
+// src/hooks-cli.ts
+import path13 from "path";
+import os2 from "os";
+import { promises as fs12 } from "fs";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var HOOK_FILENAME = "neat-search-nudge.mjs";
 var GUIDE_FILENAME = "GRAPH_FIRST.md";
 var GUIDE_INSTALL_NAME = "neat-graph-first.md";
 var HOOK_MATCHER = "Grep|Glob|Bash";
 function moduleDir() {
-  return typeof __dirname !== "undefined" ? __dirname : path12.dirname(fileURLToPath3(import.meta.url));
+  return typeof __dirname !== "undefined" ? __dirname : path13.dirname(fileURLToPath3(import.meta.url));
 }
 async function readSkillAsset(rel) {
   const here = moduleDir();
   const candidates = [
-    path12.resolve(here, "../../claude-skill", rel),
-    path12.resolve(here, "../../../claude-skill", rel),
-    path12.resolve(here, "../claude-skill", rel)
+    path13.resolve(here, "../../claude-skill", rel),
+    path13.resolve(here, "../../../claude-skill", rel),
+    path13.resolve(here, "../claude-skill", rel)
   ];
   for (const candidate of candidates) {
     try {
-      return await fs11.readFile(candidate, "utf8");
+      return await fs12.readFile(candidate, "utf8");
     } catch {
     }
   }
@@ -5592,22 +6026,22 @@ async function readSkillAsset(rel) {
     `neat hooks: could not find @neat.is/claude-skill/${rel} \u2014 is the package installed?`
   );
 }
-function neatHome() {
+function neatHome2() {
   const override = process.env.NEAT_HOME;
-  if (override && override.length > 0) return path12.resolve(override);
-  return path12.join(os.homedir(), ".neat");
+  if (override && override.length > 0) return path13.resolve(override);
+  return path13.join(os2.homedir(), ".neat");
 }
 function claudeSettingsPath() {
   const override = process.env.NEAT_CLAUDE_SETTINGS;
-  if (override && override.length > 0) return path12.resolve(override);
-  const home = process.env.HOME ?? process.env.USERPROFILE ?? os.homedir();
-  return path12.join(home, ".claude", "settings.json");
+  if (override && override.length > 0) return path13.resolve(override);
+  const home = process.env.HOME ?? process.env.USERPROFILE ?? os2.homedir();
+  return path13.join(home, ".claude", "settings.json");
 }
 function installedHookPath() {
-  return path12.join(neatHome(), "hooks", HOOK_FILENAME);
+  return path13.join(neatHome2(), "hooks", HOOK_FILENAME);
 }
 function gateFlagPath() {
-  return path12.join(neatHome(), "hooks", "gate-enabled");
+  return path13.join(neatHome2(), "hooks", "gate-enabled");
 }
 function isNeatSearchEntry(entry2) {
   return (entry2.hooks ?? []).some(
@@ -5640,14 +6074,14 @@ async function runHooks(opts) {
     const hookScript = await readSkillAsset(`hooks/${HOOK_FILENAME}`);
     const guide = await readSkillAsset(GUIDE_FILENAME);
     const scriptPath = installedHookPath();
-    await fs11.mkdir(path12.dirname(scriptPath), { recursive: true });
-    await fs11.writeFile(scriptPath, hookScript, { mode: 493 });
-    const guidePath = path12.join(neatHome(), GUIDE_INSTALL_NAME);
-    await fs11.writeFile(guidePath, guide, "utf8");
+    await fs12.mkdir(path13.dirname(scriptPath), { recursive: true });
+    await fs12.writeFile(scriptPath, hookScript, { mode: 493 });
+    const guidePath = path13.join(neatHome2(), GUIDE_INSTALL_NAME);
+    await fs12.writeFile(guidePath, guide, "utf8");
     const settingsFile = claudeSettingsPath();
     let settings = {};
     try {
-      settings = JSON.parse(await fs11.readFile(settingsFile, "utf8"));
+      settings = JSON.parse(await fs12.readFile(settingsFile, "utf8"));
     } catch (err) {
       if (err.code !== "ENOENT") {
         console.error(
@@ -5669,14 +6103,14 @@ async function runHooks(opts) {
       ...settings,
       hooks: { ...hooks, PreToolUse: preToolUse }
     };
-    await fs11.mkdir(path12.dirname(settingsFile), { recursive: true });
-    await fs11.writeFile(settingsFile, JSON.stringify(merged, null, 2) + "\n", "utf8");
+    await fs12.mkdir(path13.dirname(settingsFile), { recursive: true });
+    await fs12.writeFile(settingsFile, JSON.stringify(merged, null, 2) + "\n", "utf8");
     const flag = gateFlagPath();
     if (opts.gate) {
-      await fs11.mkdir(path12.dirname(flag), { recursive: true });
-      await fs11.writeFile(flag, "1\n", "utf8");
+      await fs12.mkdir(path13.dirname(flag), { recursive: true });
+      await fs12.writeFile(flag, "1\n", "utf8");
     } else {
-      await fs11.rm(flag, { force: true });
+      await fs12.rm(flag, { force: true });
     }
     const mode = opts.gate ? "GATE (deny search until you ask the graph)" : "nudge (search still runs)";
     console.log(`neat hooks: installed the search hook in ${opts.gate ? "gate" : "nudge"} mode`);
@@ -5765,8 +6199,8 @@ async function runHooksCommand(args) {
 }
 
 // src/claude-cli.ts
-import path13 from "path";
-import { promises as fs12 } from "fs";
+import path14 from "path";
+import { promises as fs13 } from "fs";
 var NEAT_SECTION_HEADING = "## neat";
 var NEAT_DIRECTIVE_BODY = `This project has NEAT wired in: a live, fused semantic graph of the system \u2014
 code and runtime behaviour (OpenTelemetry) in one model, every fact tagged with
@@ -5800,8 +6234,8 @@ ${NEAT_DIRECTIVE_BODY}
 }
 function claudeMdPath() {
   const override = process.env.NEAT_CLAUDE_MD;
-  if (override && override.length > 0) return path13.resolve(override);
-  return path13.join(process.cwd(), "CLAUDE.md");
+  if (override && override.length > 0) return path14.resolve(override);
+  return path14.join(process.cwd(), "CLAUDE.md");
 }
 function splitAroundSection(raw) {
   const lines = raw.split("\n");
@@ -5829,7 +6263,7 @@ function compose(before, after) {
 }
 async function readIfExists(file) {
   try {
-    return await fs12.readFile(file, "utf8");
+    return await fs13.readFile(file, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return null;
     throw err;
@@ -5840,8 +6274,8 @@ async function runInstall() {
   const raw = await readIfExists(file) ?? "";
   const { before, after, found } = splitAroundSection(raw);
   const next = compose(before, after);
-  await fs12.mkdir(path13.dirname(file), { recursive: true });
-  await fs12.writeFile(file, next, "utf8");
+  await fs13.mkdir(path14.dirname(file), { recursive: true });
+  await fs13.writeFile(file, next, "utf8");
   const verb = raw.length === 0 ? "created" : found ? "refreshed" : "added";
   console.log(`neat claude: ${verb} the \`${NEAT_SECTION_HEADING}\` section in ${file}`);
   console.log("Your agent will now reach for `neat ask` before Read/Grep/Bash. Restart the");
@@ -5862,7 +6296,7 @@ async function runUninstall() {
   }
   const remaining = [before, after].filter((s) => s.length > 0).join("\n\n");
   const next = remaining.length > 0 ? remaining.replace(/\n*$/, "") + "\n" : "";
-  await fs12.writeFile(file, next, "utf8");
+  await fs13.writeFile(file, next, "utf8");
   console.log(`neat claude: removed the \`${NEAT_SECTION_HEADING}\` section from ${file}.`);
   return { exitCode: 0 };
 }
@@ -5904,9 +6338,9 @@ async function runClaudeCommand(args) {
 }
 
 // src/codex-cli.ts
-import path14 from "path";
-import os2 from "os";
-import { promises as fs13 } from "fs";
+import path15 from "path";
+import os3 from "os";
+import { promises as fs14 } from "fs";
 import { isDeepStrictEqual } from "util";
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
 var CODEX_MCP_SERVER = {
@@ -5924,14 +6358,14 @@ var NEAT_GRAPH_FIRST_START = "<!-- neat:graph-first -->";
 var NEAT_GRAPH_FIRST_END = "<!-- /neat:graph-first -->";
 function codexConfigPath() {
   const override = process.env.NEAT_CODEX_CONFIG;
-  if (override && override.length > 0) return path14.resolve(override);
-  const home = process.env.HOME ?? process.env.USERPROFILE ?? os2.homedir();
-  return path14.join(home, ".codex", "config.toml");
+  if (override && override.length > 0) return path15.resolve(override);
+  const home = process.env.HOME ?? process.env.USERPROFILE ?? os3.homedir();
+  return path15.join(home, ".codex", "config.toml");
 }
 function agentsFilePath() {
   const override = process.env.NEAT_CODEX_AGENTS;
-  if (override && override.length > 0) return path14.resolve(override);
-  return path14.join(process.cwd(), "AGENTS.md");
+  if (override && override.length > 0) return path15.resolve(override);
+  return path15.join(process.cwd(), "AGENTS.md");
 }
 function isTableHeader(line) {
   return /^\s*\[\[?[^\]]+\]\]?\s*$/.test(line);
@@ -6065,7 +6499,7 @@ async function runCodex(opts) {
   const agentsPath = agentsFilePath();
   let configRaw = "";
   try {
-    configRaw = await fs13.readFile(configPath, "utf8");
+    configRaw = await fs14.readFile(configPath, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") {
       console.error(`neat codex: failed to read ${configPath} \u2014 ${err.message}`);
@@ -6074,7 +6508,7 @@ async function runCodex(opts) {
   }
   let agentsRaw = "";
   try {
-    agentsRaw = await fs13.readFile(agentsPath, "utf8");
+    agentsRaw = await fs14.readFile(agentsPath, "utf8");
   } catch (err) {
     if (err.code !== "ENOENT") {
       console.error(`neat codex: failed to read ${agentsPath} \u2014 ${err.message}`);
@@ -6114,15 +6548,15 @@ async function runCodex(opts) {
     return { exitCode: 0 };
   }
   if (config.changed) {
-    await fs13.mkdir(path14.dirname(configPath), { recursive: true });
-    await fs13.writeFile(configPath, config.text, "utf8");
+    await fs14.mkdir(path15.dirname(configPath), { recursive: true });
+    await fs14.writeFile(configPath, config.text, "utf8");
     console.log(`neat codex: wrote [mcp_servers.neat] to ${configPath}`);
   } else {
     console.log(`neat codex: ${configPath} already has NEAT's MCP server`);
   }
   if (agents.changed) {
-    await fs13.mkdir(path14.dirname(agentsPath), { recursive: true });
-    await fs13.writeFile(agentsPath, agents.text, "utf8");
+    await fs14.mkdir(path15.dirname(agentsPath), { recursive: true });
+    await fs14.writeFile(agentsPath, agents.text, "utf8");
     console.log(`neat codex: wrote the graph-first block to ${agentsPath}`);
   } else {
     console.log(`neat codex: ${agentsPath} already has the graph-first block`);
@@ -6178,9 +6612,9 @@ async function runCodexCommand(args) {
 }
 
 // src/editors-cli.ts
-import path15 from "path";
-import os3 from "os";
-import { promises as fs14 } from "fs";
+import path16 from "path";
+import os4 from "os";
+import { promises as fs15 } from "fs";
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
 import * as jsonc from "jsonc-parser";
 var NEAT_MCP_SERVER = {
@@ -6200,21 +6634,21 @@ var NEAT_CRUSH_SERVER = {
 var GRAPH_FIRST_MARKER_OPEN = "<!-- neat:graph-first -->";
 var GRAPH_FIRST_MARKER_CLOSE = "<!-- /neat:graph-first -->";
 function homeDir() {
-  return process.env.HOME ?? process.env.USERPROFILE ?? os3.homedir();
+  return process.env.HOME ?? process.env.USERPROFILE ?? os4.homedir();
 }
 function xdgConfigDir() {
   const xdg = process.env.XDG_CONFIG_HOME;
-  return xdg && xdg.length > 0 ? path15.resolve(xdg) : path15.join(homeDir(), ".config");
+  return xdg && xdg.length > 0 ? path16.resolve(xdg) : path16.join(homeDir(), ".config");
 }
 function envOverride(name) {
   const v = process.env[name];
-  return v && v.length > 0 ? path15.resolve(v) : void 0;
+  return v && v.length > 0 ? path16.resolve(v) : void 0;
 }
 var CURSOR_CLIENT = {
   id: "cursor",
   label: "Cursor",
   docsUrl: "https://docs.cursor.com/context/mcp",
-  mcpConfigPath: () => envOverride("NEAT_CURSOR_CONFIG") ?? path15.join(homeDir(), ".cursor", "mcp.json"),
+  mcpConfigPath: () => envOverride("NEAT_CURSOR_CONFIG") ?? path16.join(homeDir(), ".cursor", "mcp.json"),
   mcpContainerKey: "mcpServers",
   format: "json",
   // Cursor still reads a single `.cursorrules` at the project root (the modern
@@ -6226,7 +6660,7 @@ var DEVIN_CLIENT = {
   id: "devin",
   label: "Devin Desktop (Cascade)",
   docsUrl: "https://docs.devin.ai/desktop/cascade/mcp",
-  mcpConfigPath: () => envOverride("NEAT_DEVIN_CONFIG") ?? path15.join(homeDir(), ".codeium", "windsurf", "mcp_config.json"),
+  mcpConfigPath: () => envOverride("NEAT_DEVIN_CONFIG") ?? path16.join(homeDir(), ".codeium", "windsurf", "mcp_config.json"),
   mcpContainerKey: "mcpServers",
   format: "json",
   rulesFileName: ".windsurfrules"
@@ -6235,7 +6669,7 @@ var GEMINI_CLIENT = {
   id: "gemini",
   label: "Gemini CLI",
   docsUrl: "https://github.com/google-gemini/gemini-cli/blob/main/docs/tools/mcp-server.md",
-  mcpConfigPath: () => envOverride("NEAT_GEMINI_CONFIG") ?? path15.join(homeDir(), ".gemini", "settings.json"),
+  mcpConfigPath: () => envOverride("NEAT_GEMINI_CONFIG") ?? path16.join(homeDir(), ".gemini", "settings.json"),
   mcpContainerKey: "mcpServers",
   format: "json",
   rulesFileName: "GEMINI.md"
@@ -6244,7 +6678,7 @@ var QWEN_CLIENT = {
   id: "qwen",
   label: "Qwen Code",
   docsUrl: "https://qwenlm.github.io/qwen-code-docs/en/users/features/mcp/",
-  mcpConfigPath: () => envOverride("NEAT_QWEN_CONFIG") ?? path15.join(homeDir(), ".qwen", "settings.json"),
+  mcpConfigPath: () => envOverride("NEAT_QWEN_CONFIG") ?? path16.join(homeDir(), ".qwen", "settings.json"),
   mcpContainerKey: "mcpServers",
   format: "json",
   rulesFileName: "QWEN.md"
@@ -6253,7 +6687,7 @@ var AMAZONQ_CLIENT = {
   id: "amazonq",
   label: "Amazon Q Developer CLI",
   docsUrl: "https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/command-line-mcp-configuration.html",
-  mcpConfigPath: () => envOverride("NEAT_AMAZONQ_CONFIG") ?? path15.join(homeDir(), ".aws", "amazonq", "mcp.json"),
+  mcpConfigPath: () => envOverride("NEAT_AMAZONQ_CONFIG") ?? path16.join(homeDir(), ".aws", "amazonq", "mcp.json"),
   mcpContainerKey: "mcpServers",
   format: "json"
 };
@@ -6261,7 +6695,7 @@ var ROOCODE_CLIENT = {
   id: "roocode",
   label: "Roo Code",
   docsUrl: "https://roocodeinc.github.io/Roo-Code/features/mcp/using-mcp-in-roo",
-  mcpConfigPath: () => envOverride("NEAT_ROOCODE_CONFIG") ?? path15.join(process.cwd(), ".roo", "mcp.json"),
+  mcpConfigPath: () => envOverride("NEAT_ROOCODE_CONFIG") ?? path16.join(process.cwd(), ".roo", "mcp.json"),
   mcpContainerKey: "mcpServers",
   format: "json"
 };
@@ -6274,9 +6708,9 @@ var ZED_CLIENT = {
     if (override) return override;
     if (process.platform === "win32") {
       const appData = process.env.APPDATA;
-      if (appData && appData.length > 0) return path15.join(appData, "Zed", "settings.json");
+      if (appData && appData.length > 0) return path16.join(appData, "Zed", "settings.json");
     }
-    return path15.join(homeDir(), ".config", "zed", "settings.json");
+    return path16.join(homeDir(), ".config", "zed", "settings.json");
   },
   mcpContainerKey: "context_servers",
   format: "jsonc",
@@ -6286,7 +6720,7 @@ var OPENCODE_CLIENT = {
   id: "opencode",
   label: "OpenCode",
   docsUrl: "https://opencode.ai/docs/mcp-servers/",
-  mcpConfigPath: () => envOverride("NEAT_OPENCODE_CONFIG") ?? path15.join(xdgConfigDir(), "opencode", "opencode.json"),
+  mcpConfigPath: () => envOverride("NEAT_OPENCODE_CONFIG") ?? path16.join(xdgConfigDir(), "opencode", "opencode.json"),
   mcpContainerKey: "mcp",
   format: "json",
   serverEntry: NEAT_OPENCODE_SERVER,
@@ -6296,7 +6730,7 @@ var CRUSH_CLIENT = {
   id: "crush",
   label: "Crush",
   docsUrl: "https://charmbracelet-crush.mintlify.app/configuration/mcp",
-  mcpConfigPath: () => envOverride("NEAT_CRUSH_CONFIG") ?? path15.join(xdgConfigDir(), "crush", "crush.json"),
+  mcpConfigPath: () => envOverride("NEAT_CRUSH_CONFIG") ?? path16.join(xdgConfigDir(), "crush", "crush.json"),
   mcpContainerKey: "mcp",
   format: "json",
   serverEntry: NEAT_CRUSH_SERVER,
@@ -6359,7 +6793,7 @@ async function planMcp(client, mcpPath) {
   const serverEntry = client.serverEntry ?? NEAT_MCP_SERVER;
   let raw = "";
   try {
-    raw = await fs14.readFile(mcpPath, "utf8");
+    raw = await fs15.readFile(mcpPath, "utf8");
   } catch (err) {
     const e = err;
     if (e.code === "ENOENT") {
@@ -6401,7 +6835,7 @@ async function runEditorInstall(client, opts) {
   const mcpPath = client.mcpConfigPath();
   const serverEntry = client.serverEntry ?? NEAT_MCP_SERVER;
   const hasRules = typeof client.rulesFileName === "string";
-  const rulesPath = hasRules ? path15.join(opts.projectDir, client.rulesFileName) : "";
+  const rulesPath = hasRules ? path16.join(opts.projectDir, client.rulesFileName) : "";
   const mcp = await planMcp(client, mcpPath);
   if (mcp === null) return { exitCode: 1 };
   let existingRules = "";
@@ -6410,7 +6844,7 @@ async function runEditorInstall(client, opts) {
   let block = "";
   if (hasRules) {
     try {
-      existingRules = await fs14.readFile(rulesPath, "utf8");
+      existingRules = await fs15.readFile(rulesPath, "utf8");
     } catch (err) {
       if (err.code !== "ENOENT") {
         console.error(`neat ${client.id}: failed to read ${rulesPath} \u2014 ${err.message}`);
@@ -6444,11 +6878,11 @@ async function runEditorInstall(client, opts) {
     );
     return { exitCode: 0 };
   }
-  await fs14.mkdir(path15.dirname(mcpPath), { recursive: true });
-  await fs14.writeFile(mcpPath, mcp.text, "utf8");
+  await fs15.mkdir(path16.dirname(mcpPath), { recursive: true });
+  await fs15.writeFile(mcpPath, mcp.text, "utf8");
   if (hasRules) {
-    await fs14.mkdir(path15.dirname(rulesPath), { recursive: true });
-    await fs14.writeFile(rulesPath, newRules, "utf8");
+    await fs15.mkdir(path16.dirname(rulesPath), { recursive: true });
+    await fs15.writeFile(rulesPath, newRules, "utf8");
   }
   console.log(`neat ${client.id}: wired NEAT into ${client.label}`);
   console.log(`  MCP server: ${mcpPath} (${client.mcpContainerKey}.neat \u2192 npx -y @neat.is/mcp)`);
@@ -6939,7 +7373,7 @@ function sleep(ms, signal) {
 }
 
 // src/cli-verbs.ts
-import path16 from "path";
+import path17 from "path";
 async function resolveProjectEntry(opts) {
   const entries = await listProjects();
   if (opts.project) {
@@ -6949,7 +7383,7 @@ async function resolveProjectEntry(opts) {
   const cwd = opts.cwd ?? process.cwd();
   const resolvedCwd = await normalizeProjectPath(cwd);
   for (const entry2 of entries) {
-    if (resolvedCwd === entry2.path || resolvedCwd.startsWith(`${entry2.path}${path16.sep}`)) {
+    if (resolvedCwd === entry2.path || resolvedCwd.startsWith(`${entry2.path}${path17.sep}`)) {
       return entry2;
     }
   }
@@ -7254,6 +7688,12 @@ function usage5() {
   console.log("  doctor         Preflight this directory's setup \u2014 Node version, project,");
   console.log("                 and daemon reachability \u2014 and print a fix for anything down.");
   console.log("                 Flags: --json. Exits 0 when all pass, 1 when a check fails.");
+  console.log("  login          Connect this machine to a hosted NEAT and make it the default");
+  console.log("                 for the CLI and the MCP server. Paste the daemon endpoint +");
+  console.log("                 token, or run interactively (the token is read without echo).");
+  console.log("                 Flags: --endpoint <url>, --token <token>, --name <name>, --json.");
+  console.log("  logout         Clear the active hosted profile (back to your local daemon);");
+  console.log("                 --name <name> removes that profile entirely.");
   console.log("");
   console.log("query commands (mirror the MCP tools, ADR-050):");
   console.log("  ask <question>                   Plain-language door: resolves the question to");
@@ -7304,6 +7744,7 @@ function usage5() {
 }
 var STRING_FLAGS = [
   ["--project", "project"],
+  ["--profile", "profile"],
   ["--depth", "depth"],
   ["--limit", "limit"],
   ["--edge-type", "edgeType"],
@@ -7321,6 +7762,7 @@ function parseArgs(rest) {
   const positional = [];
   const out = {
     project: null,
+    profile: null,
     apply: false,
     dryRun: false,
     noInstall: false,
@@ -7479,7 +7921,7 @@ async function buildPatchSections(services, project) {
 }
 async function runInit(opts) {
   const written = [];
-  const stat = await fs15.stat(opts.scanPath).catch(() => null);
+  const stat = await fs16.stat(opts.scanPath).catch(() => null);
   if (!stat || !stat.isDirectory()) {
     console.error(`neat init: ${opts.scanPath} is not a directory`);
     return { exitCode: 2, writtenFiles: written };
@@ -7488,13 +7930,13 @@ async function runInit(opts) {
   printDiscoveryReport(opts, services);
   const sections = opts.noInstall ? [] : await buildPatchSections(services, opts.project);
   const patch = renderPatch(sections);
-  const patchPath = path17.join(opts.scanPath, "neat.patch");
+  const patchPath = path18.join(opts.scanPath, "neat.patch");
   if (opts.dryRun) {
-    await fs15.writeFile(patchPath, patch, "utf8");
+    await fs16.writeFile(patchPath, patch, "utf8");
     written.push(patchPath);
     console.log(`dry-run: patch written to ${patchPath}`);
-    const gitignorePath = path17.join(opts.scanPath, ".gitignore");
-    const gitignoreExists = await fs15.stat(gitignorePath).then(() => true).catch(() => false);
+    const gitignorePath = path18.join(opts.scanPath, ".gitignore");
+    const gitignoreExists = await fs16.stat(gitignorePath).then(() => true).catch(() => false);
     const verb = gitignoreExists ? "append" : "create";
     console.log(`dry-run: would ${verb} ${gitignorePath} (add neat-out/)`);
     console.log("rerun without --dry-run to register and snapshot.");
@@ -7505,9 +7947,9 @@ async function runInit(opts) {
   const graph = getGraph(graphKey);
   const projectPaths = pathsForProject(
     graphKey,
-    path17.join(opts.scanPath, "neat-out")
+    path18.join(opts.scanPath, "neat-out")
   );
-  const errorsPath = path17.join(path17.dirname(opts.outPath), path17.basename(projectPaths.errorsPath));
+  const errorsPath = path18.join(path18.dirname(opts.outPath), path18.basename(projectPaths.errorsPath));
   const result = await extractFromDirectory(graph, opts.scanPath, { errorsPath });
   await saveGraphToDisk(graph, opts.outPath);
   written.push(opts.outPath);
@@ -7586,7 +8028,7 @@ async function runInit(opts) {
         console.log("Run `npm install` (or your language equivalent) to refresh lockfiles.");
       }
     } else {
-      await fs15.writeFile(patchPath, patch, "utf8");
+      await fs16.writeFile(patchPath, patch, "utf8");
       written.push(patchPath);
     }
   }
@@ -7627,9 +8069,9 @@ var CLAUDE_SKILL_CONFIG = {
 };
 function claudeConfigPath() {
   const override = process.env.NEAT_CLAUDE_CONFIG;
-  if (override && override.length > 0) return path17.resolve(override);
+  if (override && override.length > 0) return path18.resolve(override);
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return path17.join(home, ".claude.json");
+  return path18.join(home, ".claude.json");
 }
 async function runSkill(opts) {
   const snippet = JSON.stringify(CLAUDE_SKILL_CONFIG, null, 2) + "\n";
@@ -7641,7 +8083,7 @@ async function runSkill(opts) {
     const target = claudeConfigPath();
     let existing = {};
     try {
-      existing = JSON.parse(await fs15.readFile(target, "utf8"));
+      existing = JSON.parse(await fs16.readFile(target, "utf8"));
     } catch (err) {
       if (err.code !== "ENOENT") {
         console.error(`neat skill: failed to read ${target} \u2014 ${err.message}`);
@@ -7653,8 +8095,8 @@ async function runSkill(opts) {
       ...existing,
       mcpServers: { ...mcp, neat: CLAUDE_SKILL_CONFIG.mcpServers.neat }
     };
-    await fs15.mkdir(path17.dirname(target), { recursive: true });
-    await fs15.writeFile(target, JSON.stringify(merged, null, 2) + "\n", "utf8");
+    await fs16.mkdir(path18.dirname(target), { recursive: true });
+    await fs16.writeFile(target, JSON.stringify(merged, null, 2) + "\n", "utf8");
     console.log(`neat skill: wrote mcpServers.neat to ${target}`);
     console.log("restart Claude Code to pick up the new MCP server.");
     console.log("");
@@ -7698,6 +8140,16 @@ async function main() {
     if (code !== 0) process.exit(code);
     return;
   }
+  if (cmd0 === "login") {
+    const code = await runLoginCommand(argv.slice(1));
+    if (code !== 0) process.exit(code);
+    return;
+  }
+  if (cmd0 === "logout") {
+    const code = await runLogoutCommand(argv.slice(1));
+    if (code !== 0) process.exit(code);
+    return;
+  }
   if (cmd0 === "hooks") {
     const code = await runHooksCommand(argv.slice(1));
     if (code !== 0) process.exit(code);
@@ -7750,12 +8202,12 @@ async function main() {
       console.error("neat init: --apply and --dry-run are mutually exclusive");
       process.exit(2);
     }
-    const scanPath = path17.resolve(target);
+    const scanPath = path18.resolve(target);
     const projectExplicit = parsed.project !== null;
-    const projectName = projectExplicit ? project : path17.basename(scanPath);
+    const projectName = projectExplicit ? project : path18.basename(scanPath);
     const projectKey = projectExplicit ? project : DEFAULT_PROJECT;
-    const fallback = pathsForProject(projectKey, path17.join(scanPath, "neat-out")).snapshotPath;
-    const outPath = path17.resolve(process.env.NEAT_OUT_PATH ?? fallback);
+    const fallback = pathsForProject(projectKey, path18.join(scanPath, "neat-out")).snapshotPath;
+    const outPath = path18.resolve(process.env.NEAT_OUT_PATH ?? fallback);
     const result = await runInit({
       scanPath,
       outPath,
@@ -7776,21 +8228,21 @@ async function main() {
       usage5();
       process.exit(2);
     }
-    const scanPath = path17.resolve(target);
-    const stat = await fs15.stat(scanPath).catch(() => null);
+    const scanPath = path18.resolve(target);
+    const stat = await fs16.stat(scanPath).catch(() => null);
     if (!stat || !stat.isDirectory()) {
       console.error(`neat watch: ${scanPath} is not a directory`);
       process.exit(2);
     }
-    const projectPaths = pathsForProject(project, path17.join(scanPath, "neat-out"));
-    const outPath = path17.resolve(process.env.NEAT_OUT_PATH ?? projectPaths.snapshotPath);
-    const errorsPath = path17.resolve(
-      process.env.NEAT_ERRORS_PATH ?? path17.join(path17.dirname(outPath), path17.basename(projectPaths.errorsPath))
+    const projectPaths = pathsForProject(project, path18.join(scanPath, "neat-out"));
+    const outPath = path18.resolve(process.env.NEAT_OUT_PATH ?? projectPaths.snapshotPath);
+    const errorsPath = path18.resolve(
+      process.env.NEAT_ERRORS_PATH ?? path18.join(path18.dirname(outPath), path18.basename(projectPaths.errorsPath))
     );
-    const staleEventsPath = path17.resolve(
-      process.env.NEAT_STALE_EVENTS_PATH ?? path17.join(path17.dirname(outPath), path17.basename(projectPaths.staleEventsPath))
+    const staleEventsPath = path18.resolve(
+      process.env.NEAT_STALE_EVENTS_PATH ?? path18.join(path18.dirname(outPath), path18.basename(projectPaths.staleEventsPath))
     );
-    const embeddingsCachePath = process.env.NEAT_EMBEDDINGS_CACHE_PATH ? path17.resolve(process.env.NEAT_EMBEDDINGS_CACHE_PATH) : void 0;
+    const embeddingsCachePath = process.env.NEAT_EMBEDDINGS_CACHE_PATH ? path18.resolve(process.env.NEAT_EMBEDDINGS_CACHE_PATH) : void 0;
     const handle = await startWatch(getGraph(project), {
       scanPath,
       outPath,
@@ -7799,7 +8251,7 @@ async function main() {
       project,
       // Resolve NEAT_HOME so a `neat watch` picks up connectors added to
       // ~/.neat/connectors.json (#871). Same resolution the rest of the CLI uses.
-      neatHome: process.env.NEAT_HOME ? path17.resolve(process.env.NEAT_HOME) : path17.join(os4.homedir(), ".neat"),
+      neatHome: process.env.NEAT_HOME ? path18.resolve(process.env.NEAT_HOME) : path18.join(os5.homedir(), ".neat"),
       ...embeddingsCachePath ? { embeddingsCachePath } : {},
       host: process.env.HOST ?? "0.0.0.0",
       port: Number(process.env.PORT ?? 8080),
@@ -7981,11 +8433,11 @@ async function main() {
   process.exit(1);
 }
 async function tryOrchestrator(cmd, parsed) {
-  const scanPath = path17.resolve(cmd);
-  const stat = await fs15.stat(scanPath).catch(() => null);
+  const scanPath = path18.resolve(cmd);
+  const stat = await fs16.stat(scanPath).catch(() => null);
   if (!stat || !stat.isDirectory()) return null;
   const projectExplicit = parsed.project !== null;
-  const projectName = projectExplicit ? parsed.project : path17.basename(scanPath);
+  const projectName = projectExplicit ? parsed.project : path18.basename(scanPath);
   const result = await runOrchestrator({
     scanPath,
     project: projectName,
@@ -8048,19 +8500,50 @@ Pass --project <name> to choose:
 ${names}`
   );
 }
-async function resolveDaemonUrl(project) {
-  const explicit = process.env.NEAT_API_URL ?? process.env.NEAT_CORE_URL;
-  if (explicit) return explicit;
-  if (project) {
-    const daemon = await findDaemonByProject(project);
-    if (daemon) return `http://localhost:${daemon.record.ports.rest}`;
+var UnknownProfileError = class extends Error {
+  constructor(name) {
+    super(
+      `no profile named "${name}" in ~/.neat/profiles.json \u2014 run \`neat login\` first, or drop --profile / NEAT_PROFILE`
+    );
+    this.name = "UnknownProfileError";
   }
-  return "http://localhost:8080";
+};
+async function resolveClientTarget(opts = {}) {
+  const named = opts.profile ?? process.env.NEAT_PROFILE;
+  if (named && named.length > 0) {
+    const profile = await resolveProfile(named);
+    if (!profile) throw new UnknownProfileError(named);
+    return { endpoint: profile.endpoint, authToken: profile.authToken, source: "profile" };
+  }
+  const pin = process.env.NEAT_API_URL ?? process.env.NEAT_CORE_URL;
+  if (pin) return { endpoint: pin, authToken: resolveAuthToken(), source: "env" };
+  const active = await getActiveProfile().catch(() => void 0);
+  if (active) return { endpoint: active.endpoint, authToken: active.authToken, source: "active" };
+  if (opts.project) {
+    const daemon = await findDaemonByProject(opts.project);
+    if (daemon) {
+      return { endpoint: `http://localhost:${daemon.record.ports.rest}`, source: "daemon-record" };
+    }
+  }
+  return { endpoint: "http://localhost:8080", source: "default" };
+}
+async function resolveDaemonUrl(project, profile) {
+  return (await resolveClientTarget({ project, profile })).endpoint;
 }
 async function runQueryVerb(cmd, parsed) {
   const requestedProject = resolveProjectFlag(parsed);
-  const baseUrl = await resolveDaemonUrl(requestedProject);
-  const client = createHttpClient(baseUrl, resolveAuthToken());
+  let target;
+  try {
+    target = await resolveClientTarget({ project: requestedProject, profile: parsed.profile ?? void 0 });
+  } catch (err) {
+    if (err instanceof UnknownProfileError) {
+      process.stderr.write(`${err.message}
+`);
+      return 2;
+    }
+    throw err;
+  }
+  const client = createHttpClient(target.endpoint, target.authToken);
   const positional = parsed.positional;
   let makeWork;
   switch (cmd) {
@@ -8224,7 +8707,7 @@ async function runQueryVerb(cmd, parsed) {
       const detail = err.responseBody.length > 0 ? err.responseBody : err.message;
       console.error(`neat ${cmd}: ${detail.trim()}`);
     } else if (err instanceof TransportError) {
-      console.error(`neat ${cmd}: ${err.message}. Is the daemon running? (endpoint=${baseUrl})`);
+      console.error(`neat ${cmd}: ${err.message}. Is the daemon running? (endpoint=${target.endpoint})`);
     } else {
       console.error(`neat ${cmd}: ${err.message}`);
     }
@@ -8233,9 +8716,14 @@ async function runQueryVerb(cmd, parsed) {
 }
 async function runMonitorVerb(parsed) {
   const requestedProject = resolveProjectFlag(parsed);
-  const baseUrl = await resolveDaemonUrl(requestedProject);
-  const token = resolveAuthToken();
-  const client = createHttpClient(baseUrl, token);
+  let target;
+  try {
+    target = await resolveClientTarget({ project: requestedProject, profile: parsed.profile ?? void 0 });
+  } catch (err) {
+    if (err instanceof UnknownProfileError) return 0;
+    throw err;
+  }
+  const client = createHttpClient(target.endpoint, target.authToken);
   let project;
   try {
     project = await resolveProjectForVerb(client, parsed);
@@ -8251,10 +8739,10 @@ async function runMonitorVerb(parsed) {
   process.once("SIGTERM", onSignal);
   try {
     return await runMonitor({
-      baseUrl,
+      baseUrl: target.endpoint,
       project,
       json: parsed.json,
-      authToken: token,
+      authToken: target.authToken,
       signal: controller.signal
     });
   } finally {
@@ -8273,12 +8761,14 @@ export {
   CLAUDE_SKILL_CONFIG,
   ProjectResolutionError,
   QUERY_VERBS,
+  UnknownProfileError,
   commandPrefix,
   isNpxInvocation,
   main,
   parseArgs,
   printBanner,
   readPackageVersion,
+  resolveClientTarget,
   resolveDaemonUrl,
   resolveProjectForVerb,
   runInit,