@neat.is/core 0.9.18 → 0.9.19

package/dist/neatd.cjs

@@ -61,8 +61,8 @@ function mountBearerAuth(app, opts) {
   ]);
   const publicRead = opts.publicRead === true;
   app.addHook("preHandler", (req2, reply, done) => {
-    const path80 = (req2.url.split("?")[0] ?? "").replace(/\/+$/, "");
-    if (exactUnauthPaths.has(path80) || PROJECT_SCOPED_UNAUTH_PATTERN.test(path80)) {
+    const path81 = (req2.url.split("?")[0] ?? "").replace(/\/+$/, "");
+    if (exactUnauthPaths.has(path81) || PROJECT_SCOPED_UNAUTH_PATTERN.test(path81)) {
       done();
       return;
     }
@@ -415,8 +415,8 @@ function websocketChannelPathOf(attrs) {
     const v = attrs[key];
     if (typeof v === "string" && v.length > 0) {
       const q = v.indexOf("?");
-      const path80 = q === -1 ? v : v.slice(0, q);
-      if (path80.length > 0) return path80;
+      const path81 = q === -1 ? v : v.slice(0, q);
+      if (path81.length > 0) return path81;
     }
   }
   return void 0;
@@ -789,13 +789,13 @@ __export(neatd_exports, {
 module.exports = __toCommonJS(neatd_exports);
 init_cjs_shims();
 var import_node_fs43 = require("fs");
-var import_node_path79 = __toESM(require("path"), 1);
+var import_node_path80 = __toESM(require("path"), 1);
 var import_node_module2 = require("module");
 
 // src/daemon.ts
 init_cjs_shims();
 var import_node_fs41 = require("fs");
-var import_node_path77 = __toESM(require("path"), 1);
+var import_node_path78 = __toESM(require("path"), 1);
 var import_node_module = require("module");
 
 // src/graph.ts
@@ -1337,19 +1337,19 @@ function confidenceFromMix(edges, now = Date.now()) {
 function longestIncomingWalk(graph, start, maxDepth) {
   let best = { path: [start], edges: [] };
   const visited = /* @__PURE__ */ new Set([start]);
-  function step(node, path80, edges) {
-    if (path80.length > best.path.length) {
-      best = { path: [...path80], edges: [...edges] };
+  function step(node, path81, edges) {
+    if (path81.length > best.path.length) {
+      best = { path: [...path81], edges: [...edges] };
     }
-    if (path80.length - 1 >= maxDepth) return;
+    if (path81.length - 1 >= maxDepth) return;
     const incoming = bestEdgeBySource(graph, graph.inboundEdges(node));
     for (const [srcId, edge] of incoming) {
       if (visited.has(srcId)) continue;
       visited.add(srcId);
-      path80.push(srcId);
+      path81.push(srcId);
       edges.push(edge);
-      step(srcId, path80, edges);
-      path80.pop();
+      step(srcId, path81, edges);
+      path81.pop();
       edges.pop();
       visited.delete(srcId);
     }
@@ -1564,20 +1564,20 @@ function dominantFailingCall(graph, serviceId17, visited) {
   return best;
 }
 function followFailingCallChain(graph, originServiceId, maxDepth) {
-  const path80 = [originServiceId];
+  const path81 = [originServiceId];
   const edges = [];
   const visited = /* @__PURE__ */ new Set([originServiceId]);
   let current = originServiceId;
   for (let depth = 0; depth < maxDepth; depth++) {
     const hop = dominantFailingCall(graph, current, visited);
     if (!hop) break;
-    path80.push(hop.nextService);
+    path81.push(hop.nextService);
     edges.push(hop.edge);
     visited.add(hop.nextService);
     current = hop.nextService;
   }
   if (edges.length === 0) return null;
-  return { path: path80, edges, culprit: current };
+  return { path: path81, edges, culprit: current };
 }
 function isStaleCallEdge(e) {
   return e.type === import_types.EdgeType.CALLS && e.provenance === import_types.Provenance.STALE;
@@ -1613,26 +1613,26 @@ function dominantStaleCall(graph, serviceId17, visited) {
   return best;
 }
 function followStaleCallChain(graph, originServiceId, maxDepth) {
-  const path80 = [originServiceId];
+  const path81 = [originServiceId];
   const edges = [];
   const visited = /* @__PURE__ */ new Set([originServiceId]);
   let current = originServiceId;
   for (let depth = 0; depth < maxDepth; depth++) {
     const hop = dominantStaleCall(graph, current, visited);
     if (!hop) break;
-    path80.push(hop.nextService);
+    path81.push(hop.nextService);
     edges.push(hop.edge);
     visited.add(hop.nextService);
     current = hop.nextService;
   }
   if (edges.length === 0) return null;
-  return { path: path80, edges, culprit: current };
+  return { path: path81, edges, culprit: current };
 }
 function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   const chain = followFailingCallChain(graph, originId, ROOT_CAUSE_MAX_DEPTH);
   if (!chain) return null;
   const culprit = chain.culprit;
-  const path80 = [...chain.path];
+  const path81 = [...chain.path];
   const edgeProvenances = chain.edges.map((e) => e.provenance);
   const baseConfidence = confidenceFromMix(chain.edges);
   const confidence = Math.max(0, Math.min(1, baseConfidence * INCIDENT_ROOT_CAUSE_CONFIDENCE));
@@ -1640,14 +1640,14 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   if (loc) {
     let rootCauseNode = culprit;
     if (loc.fileNode) {
-      path80.push(loc.fileNode);
+      path81.push(loc.fileNode);
       edgeProvenances.push(import_types.Provenance.OBSERVED);
       rootCauseNode = loc.fileNode;
     }
     return import_types.RootCauseResultSchema.parse({
       rootCauseNode,
       rootCauseReason: loc.rootCauseReason,
-      traversalPath: path80,
+      traversalPath: path81,
       edgeProvenances,
       confidence,
       ...loc.fixRecommendation ? { fixRecommendation: loc.fixRecommendation } : {}
@@ -1659,7 +1659,7 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   return import_types.RootCauseResultSchema.parse({
     rootCauseNode: culprit,
     rootCauseReason: `${culpritName} is failing downstream calls (${errs} observed error${errs === 1 ? "" : "s"})`,
-    traversalPath: path80,
+    traversalPath: path81,
     edgeProvenances,
     confidence,
     fixRecommendation: `Inspect ${culpritName}'s failing handler`
@@ -2312,10 +2312,10 @@ function enrichWithNavigation(graph, errorNodeId, tagged, incidents, now) {
     traversalPath = staleChain.path;
     edgeProvenances = staleChain.edges.map((e) => e.provenance);
   } else if (top.node !== seedNode) {
-    const path80 = findPath(graph, errorNodeId, top.node, "up", ROOT_CAUSE_MAX_DEPTH);
-    if (path80) {
-      traversalPath = path80.nodes;
-      edgeProvenances = path80.edges.map((e) => e.provenance);
+    const path81 = findPath(graph, errorNodeId, top.node, "up", ROOT_CAUSE_MAX_DEPTH);
+    if (path81) {
+      traversalPath = path81.nodes;
+      edgeProvenances = path81.edges.map((e) => e.provenance);
     } else {
       traversalPath = [errorNodeId, top.node];
       edgeProvenances = [top.provenance ?? import_types.Provenance.OBSERVED];
@@ -3754,8 +3754,8 @@ function chiRoutesFromSource(source, parser) {
   chiWalk(tree.rootNode, "", out);
   return out;
 }
-function stripChiRegex(path80) {
-  return path80.replace(/\{([^{}:]+):[^{}]*\}/g, "{$1}");
+function stripChiRegex(path81) {
+  return path81.replace(/\{([^{}:]+):[^{}]*\}/g, "{$1}");
 }
 function chiWalk(node, prefix, out) {
   for (let i = 0; i < node.namedChildCount; i++) {
@@ -4427,9 +4427,9 @@ function rubyRocketRoute(args) {
     if (!pair || pair.type !== "pair") continue;
     const k = pair.childForFieldName("key");
     if (k?.type !== "string") continue;
-    const path80 = rubyLiteral(k);
-    if (path80 === null) continue;
-    return { path: path80, target: rubyLiteral(pair.childForFieldName("value")) };
+    const path81 = rubyLiteral(k);
+    if (path81 === null) continue;
+    return { path: path81, target: rubyLiteral(pair.childForFieldName("value")) };
   }
   return null;
 }
@@ -10648,10 +10648,10 @@ function grpcMethodsFromProto(content, fqPackage) {
     }
     const body = content.slice(bodyStart, i - 1);
     const rpcRe = /\brpc\s+([A-Za-z_][A-Za-z0-9_]*)\s*\(/g;
-    let rm;
-    while ((rm = rpcRe.exec(body)) !== null) {
-      const rpcMethod = rm[1];
-      const line = lineAt(content, bodyStart + rm.index);
+    let rm2;
+    while ((rm2 = rpcRe.exec(body)) !== null) {
+      const rpcMethod = rm2[1];
+      const line = lineAt(content, bodyStart + rm2.index);
       out.push({ rpcService, rpcMethod, line });
     }
     serviceRe.lastIndex = i;
@@ -19475,10 +19475,10 @@ var SUPABASE_RPC_TARGET_KIND = "supabase-rpc";
 // src/connectors/supabase/map.ts
 var REST_RPC_PATH_RE = /^\/rest\/v1\/rpc\/([^/?]+)/;
 var REST_TABLE_PATH_RE = /^\/rest\/v1\/([^/?]+)/;
-function targetFromRestPath(path80) {
-  const rpcMatch = REST_RPC_PATH_RE.exec(path80);
+function targetFromRestPath(path81) {
+  const rpcMatch = REST_RPC_PATH_RE.exec(path81);
   if (rpcMatch) return { targetKind: SUPABASE_RPC_TARGET_KIND, name: rpcMatch[1] };
-  const tableMatch = REST_TABLE_PATH_RE.exec(path80);
+  const tableMatch = REST_TABLE_PATH_RE.exec(path81);
   if (tableMatch) return { targetKind: SUPABASE_TABLE_TARGET_KIND, name: tableMatch[1] };
   return null;
 }
@@ -20082,9 +20082,9 @@ function parseFirebaseTargetName(targetName) {
   const secondSep = rest.indexOf(FIELD_SEP);
   if (secondSep === -1) return null;
   const method = rest.slice(0, secondSep);
-  const path80 = rest.slice(secondSep + 1);
-  if (!resourceName || !method || !path80) return null;
-  return { resourceName, method, path: path80 };
+  const path81 = rest.slice(secondSep + 1);
+  if (!resourceName || !method || !path81) return null;
+  return { resourceName, method, path: path81 };
 }
 function resourceNameFor(type, labels) {
   if (!labels) return null;
@@ -20122,14 +20122,14 @@ function mapLogEntryToSignal(entry2) {
   if (!req2) return null;
   if (typeof req2.requestMethod !== "string" || req2.requestMethod.length === 0) return null;
   const method = req2.requestMethod.toUpperCase();
-  const path80 = pathFromRequestUrl(req2.requestUrl);
-  if (path80 === null) return null;
+  const path81 = pathFromRequestUrl(req2.requestUrl);
+  if (path81 === null) return null;
   const timestamp = entry2.timestamp;
   if (typeof timestamp !== "string" || timestamp.length === 0) return null;
   const isError = typeof req2.status === "number" && req2.status >= ERROR_STATUS_THRESHOLD2;
   return {
     targetKind: resourceType,
-    targetName: packFirebaseTargetName({ resourceName, method, path: path80 }),
+    targetName: packFirebaseTargetName({ resourceName, method, path: path81 }),
     callCount: 1,
     errorCount: isError ? 1 : 0,
     lastObservedIso: timestamp
@@ -20336,7 +20336,7 @@ function mapEventToSignal(event) {
   if (Number.isNaN(observedAt.getTime())) return null;
   const statusCode = metadata?.statusCode;
   const isError = typeof statusCode === "number" && statusCode >= ERROR_STATUS_THRESHOLD3;
-  const path80 = metadata?.trigger ? parsePathFromTrigger(metadata.trigger) : void 0;
+  const path81 = metadata?.trigger ? parsePathFromTrigger(metadata.trigger) : void 0;
   return {
     targetKind: CLOUDFLARE_TARGET_KIND,
     targetName: scriptName,
@@ -20344,7 +20344,7 @@ function mapEventToSignal(event) {
     errorCount: isError ? 1 : 0,
     lastObservedIso: observedAt.toISOString(),
     method,
-    ...path80 ? { path: path80 } : {},
+    ...path81 ? { path: path81 } : {},
     ...typeof statusCode === "number" ? { statusCode } : {},
     ...typeof metadata?.duration === "number" ? { duration: metadata.duration } : {}
   };
@@ -20390,8 +20390,8 @@ function findTaggedWorkerFileNode(graph, workerName) {
   });
   return found;
 }
-function findMatchingRouteNode(graph, serviceName, method, path80) {
-  const normalizedPath = normalizePathTemplate(path80);
+function findMatchingRouteNode(graph, serviceName, method, path81) {
+  const normalizedPath = normalizePathTemplate(path81);
   let found = null;
   graph.forEachNode((id, attrs) => {
     if (found) return;
@@ -20408,10 +20408,10 @@ function createCloudflareResolveTarget(config, graph) {
   return (signal) => {
     if (signal.targetKind !== CLOUDFLARE_TARGET_KIND) return null;
     const scriptName = signal.targetName;
-    const { method, path: path80 } = signal;
+    const { method, path: path81 } = signal;
     const resolveRouteGrain = (serviceName, wholeFileId) => {
-      if (!method || !path80) return wholeFileId;
-      return findMatchingRouteNode(graph, serviceName, method, path80) ?? wholeFileId;
+      if (!method || !path81) return wholeFileId;
+      return findMatchingRouteNode(graph, serviceName, method, path81) ?? wholeFileId;
     };
     const mapping = config.workers?.[scriptName];
     if (mapping) {
@@ -20763,9 +20763,9 @@ function parseCloudRunTargetName(targetName) {
   const secondSep = rest.indexOf(FIELD_SEP2);
   if (secondSep === -1) return null;
   const method = rest.slice(0, secondSep);
-  const path80 = rest.slice(secondSep + 1);
-  if (!serviceName || !method || !path80) return null;
-  return { serviceName, method, path: path80 };
+  const path81 = rest.slice(secondSep + 1);
+  if (!serviceName || !method || !path81) return null;
+  return { serviceName, method, path: path81 };
 }
 
 // src/connectors/cloud-run/map.ts
@@ -20794,14 +20794,14 @@ function mapLogEntryToSignal2(entry2) {
   if (!req2) return null;
   if (typeof req2.requestMethod !== "string" || req2.requestMethod.length === 0) return null;
   const method = req2.requestMethod.toUpperCase();
-  const path80 = pathFromRequestUrl2(req2.requestUrl);
-  if (path80 === null) return null;
+  const path81 = pathFromRequestUrl2(req2.requestUrl);
+  if (path81 === null) return null;
   const timestamp = entry2.timestamp;
   if (typeof timestamp !== "string" || timestamp.length === 0) return null;
   const isError = typeof req2.status === "number" && req2.status >= ERROR_STATUS_THRESHOLD4;
   return {
     targetKind: CLOUD_RUN_TARGET_KIND,
-    targetName: packCloudRunTargetName({ serviceName, method, path: path80 }),
+    targetName: packCloudRunTargetName({ serviceName, method, path: path81 }),
     callCount: 1,
     errorCount: isError ? 1 : 0,
     lastObservedIso: timestamp
@@ -20840,14 +20840,14 @@ function createCloudRunResolveTarget(graph, config) {
     if (signal.targetKind !== CLOUD_RUN_TARGET_KIND) return null;
     const identity = parseCloudRunTargetName(signal.targetName);
     if (!identity) return null;
-    const { serviceName: gcpServiceName, method, path: path80 } = identity;
+    const { serviceName: gcpServiceName, method, path: path81 } = identity;
     const mappedService = config.serviceMap?.[gcpServiceName];
     if (mappedService) {
       const routeNodeId = findMatchingRouteNode2(
         graph,
         mappedService,
         method,
-        normalizePathTemplate(path80)
+        normalizePathTemplate(path81)
       );
       if (routeNodeId) {
         return { targetNodeId: routeNodeId, serviceName: mappedService, edgeType: import_types81.EdgeType.CALLS };
@@ -20983,9 +20983,9 @@ function parseGcpLbTargetName(targetName) {
   const secondSep = rest.indexOf(FIELD_SEP3);
   if (secondSep === -1) return null;
   const method = rest.slice(0, secondSep);
-  const path80 = rest.slice(secondSep + 1);
-  if (!backendServiceName || !method || !path80) return null;
-  return { backendServiceName, method, path: path80 };
+  const path81 = rest.slice(secondSep + 1);
+  if (!backendServiceName || !method || !path81) return null;
+  return { backendServiceName, method, path: path81 };
 }
 
 // src/connectors/gcp-lb/map.ts
@@ -21014,14 +21014,14 @@ function mapLogEntryToSignal3(entry2) {
   if (!req2) return null;
   if (typeof req2.requestMethod !== "string" || req2.requestMethod.length === 0) return null;
   const method = req2.requestMethod.toUpperCase();
-  const path80 = pathFromRequestUrl3(req2.requestUrl);
-  if (path80 === null) return null;
+  const path81 = pathFromRequestUrl3(req2.requestUrl);
+  if (path81 === null) return null;
   const timestamp = entry2.timestamp;
   if (typeof timestamp !== "string" || timestamp.length === 0) return null;
   const isError = typeof req2.status === "number" && req2.status >= ERROR_STATUS_THRESHOLD5;
   return {
     targetKind: GCP_LB_TARGET_KIND,
-    targetName: packGcpLbTargetName({ backendServiceName, method, path: path80 }),
+    targetName: packGcpLbTargetName({ backendServiceName, method, path: path81 }),
     callCount: 1,
     errorCount: isError ? 1 : 0,
     lastObservedIso: timestamp
@@ -21060,14 +21060,14 @@ function createGcpLbResolveTarget(graph, config) {
     if (signal.targetKind !== GCP_LB_TARGET_KIND) return null;
     const identity = parseGcpLbTargetName(signal.targetName);
     if (!identity) return null;
-    const { backendServiceName, method, path: path80 } = identity;
+    const { backendServiceName, method, path: path81 } = identity;
     const mappedService = config.backendServiceMap?.[backendServiceName];
     if (mappedService) {
       const routeNodeId = findMatchingRouteNode3(
         graph,
         mappedService,
         method,
-        normalizePathTemplate(path80)
+        normalizePathTemplate(path81)
       );
       if (routeNodeId) {
         return { targetNodeId: routeNodeId, serviceName: mappedService, edgeType: import_types85.EdgeType.CALLS };
@@ -23301,13 +23301,13 @@ async function reconcileFrontierSurfaces(graph, errorsPath) {
 init_cjs_shims();
 var CREDENTIAL_REFRESH_SKEW_MS = 6e4;
 var CP_REQUEST_TIMEOUT_MS = 1e4;
-async function cpGet(path80, deps) {
+async function cpGet(path81, deps) {
   const f = deps.fetchImpl ?? fetch;
-  const res = await f(`${deps.cpUrl.replace(/\/+$/, "")}${path80}`, {
+  const res = await f(`${deps.cpUrl.replace(/\/+$/, "")}${path81}`, {
     headers: { authorization: `Bearer ${deps.daemonToken}`, accept: "application/json" },
     signal: AbortSignal.timeout(CP_REQUEST_TIMEOUT_MS)
   });
-  if (!res.ok) throw new Error(`control plane ${path80} \u2192 HTTP ${res.status}`);
+  if (!res.ok) throw new Error(`control plane ${path81} \u2192 HTTP ${res.status}`);
   return await res.json();
 }
 function credentialRecord(provider, cred) {
@@ -23413,6 +23413,156 @@ async function maybeStartHostedConnectors(input) {
   });
 }
 
+// src/connectors/hosted-repos.ts
+init_cjs_shims();
+var import_node_os5 = __toESM(require("os"), 1);
+var import_node_path75 = __toESM(require("path"), 1);
+var import_promises = require("fs/promises");
+var CP_REQUEST_TIMEOUT_MS2 = 1e4;
+var DEFAULT_SYNC_INTERVAL_MS = 5 * 6e4;
+var CLONE_TIMEOUT_MS = 5 * 6e4;
+function scrubToken(s) {
+  return s.replace(/x-access-token:[^@\s]+@/g, "x-access-token:***@");
+}
+async function cpGet2(pathname, deps) {
+  const f = deps.fetchImpl ?? fetch;
+  const res = await f(`${deps.cpUrl.replace(/\/+$/, "")}${pathname}`, {
+    headers: { authorization: `Bearer ${deps.daemonToken}`, accept: "application/json" },
+    signal: AbortSignal.timeout(CP_REQUEST_TIMEOUT_MS2)
+  });
+  if (!res.ok) throw new Error(`control plane ${pathname} \u2192 HTTP ${res.status}`);
+  return await res.json();
+}
+async function cpPostStatus(deps, owner, name, body) {
+  const f = deps.fetchImpl ?? fetch;
+  const url = `${deps.cpUrl.replace(/\/+$/, "")}/internal/projects/${deps.projectId}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}/status`;
+  const res = await f(url, {
+    method: "POST",
+    headers: { authorization: `Bearer ${deps.daemonToken}`, "content-type": "application/json" },
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(CP_REQUEST_TIMEOUT_MS2)
+  });
+  if (!res.ok && res.status !== 404) throw new Error(`control plane status POST \u2192 HTTP ${res.status}`);
+}
+var defaultCloneRepo = async (cloneUrl, ref, destDir) => {
+  const [{ default: git }, httpMod, fs41] = await Promise.all([
+    import("isomorphic-git"),
+    import("isomorphic-git/http/node"),
+    import("fs")
+  ]);
+  const http = httpMod.default ?? httpMod;
+  const parsed = new URL(cloneUrl);
+  const password = parsed.password || parsed.username;
+  const username = parsed.password ? parsed.username : "x-access-token";
+  const cleanUrl = `${parsed.protocol}//${parsed.host}${parsed.pathname}`;
+  const clone = git.clone({
+    fs: fs41,
+    http,
+    dir: destDir,
+    url: cleanUrl,
+    // Absent ref → isomorphic-git clones the remote's default branch.
+    ...ref ? { ref } : {},
+    singleBranch: true,
+    depth: 1,
+    onAuth: () => ({ username, password })
+  });
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(new Error(`clone timed out after ${CLONE_TIMEOUT_MS}ms`)), CLONE_TIMEOUT_MS);
+  });
+  try {
+    await Promise.race([clone, timeout]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+};
+function needsSync(r) {
+  return r.syncStatus === void 0 || r.syncStatus === "syncing";
+}
+async function syncOneRepo(r, input) {
+  const { deps, graph } = input;
+  const cloneRepo = input.cloneRepo ?? defaultCloneRepo;
+  const extract = input.extract ?? extractFromDirectory;
+  const label = `${r.owner}/${r.name}`;
+  const tmpRoot = input.tmpRoot ?? import_node_os5.default.tmpdir();
+  let dir;
+  try {
+    dir = await (0, import_promises.mkdtemp)(import_node_path75.default.join(tmpRoot, "neat-repo-"));
+    await cloneRepo(r.cloneUrl, r.defaultBranch, dir);
+    await extract(graph, dir);
+    await cpPostStatus(deps, r.owner, r.name, {
+      syncStatus: "synced",
+      lastSyncAt: new Date(input.now?.() ?? Date.now()).toISOString()
+    });
+  } catch (err) {
+    input.onError?.(label, err);
+    await cpPostStatus(deps, r.owner, r.name, {
+      syncStatus: "failed",
+      detail: scrubToken(err.message).slice(0, 300)
+    }).catch(() => {
+    });
+  } finally {
+    if (dir) await (0, import_promises.rm)(dir, { recursive: true, force: true }).catch(() => {
+    });
+  }
+}
+async function runRepoSyncPass(input) {
+  let repos;
+  try {
+    repos = await cpGet2(`/internal/projects/${input.deps.projectId}/repos`, input.deps);
+  } catch (err) {
+    input.onSkip?.("(all)", `control plane repo list unreadable \u2014 ${err.message}`);
+    return;
+  }
+  if (!Array.isArray(repos)) return;
+  for (const r of repos) {
+    if (!needsSync(r)) continue;
+    await syncOneRepo(r, input);
+  }
+}
+async function startRepoSync(input) {
+  const intervalMs = input.intervalMs ?? DEFAULT_SYNC_INTERVAL_MS;
+  let stopped = false;
+  let running = false;
+  const tick = async () => {
+    if (stopped || running) return;
+    running = true;
+    try {
+      await runRepoSyncPass(input);
+    } finally {
+      running = false;
+    }
+  };
+  void tick();
+  const timer = setInterval(() => {
+    void tick();
+  }, intervalMs);
+  if (typeof timer.unref === "function") timer.unref();
+  return () => {
+    stopped = true;
+    clearInterval(timer);
+  };
+}
+async function maybeStartRepoSync(input) {
+  const env = input.env ?? process.env;
+  const cpUrl = env.NEAT_CP_URL;
+  const projectId = env.NEAT_CP_PROJECT_ID;
+  const daemonToken = env.NEAT_AUTH_TOKEN;
+  if (!cpUrl || !projectId || !daemonToken) return () => {
+  };
+  return startRepoSync({
+    deps: { cpUrl, projectId, daemonToken, ...input.fetchImpl ? { fetchImpl: input.fetchImpl } : {} },
+    graph: input.graph,
+    project: input.project,
+    ...input.cloneRepo ? { cloneRepo: input.cloneRepo } : {},
+    ...input.extract ? { extract: input.extract } : {},
+    ...input.intervalMs !== void 0 ? { intervalMs: input.intervalMs } : {},
+    ...input.tmpRoot ? { tmpRoot: input.tmpRoot } : {},
+    ...input.onSkip ? { onSkip: input.onSkip } : {},
+    ...input.onError ? { onError: input.onError } : {}
+  });
+}
+
 // src/connectors/kubernetes/index.ts
 init_cjs_shims();
 
@@ -23466,9 +23616,9 @@ function makeK8sFetchImpl(transport) {
     req2.end();
   }));
 }
-async function listResource(transport, namespace, path80, opts = {}) {
+async function listResource(transport, namespace, path81, opts = {}) {
   const base = opts.apiUrl ?? transport.server;
-  const url = `${base.replace(/\/$/, "")}${path80}`;
+  const url = `${base.replace(/\/$/, "")}${path81}`;
   const fetchImpl = opts.fetchImpl ?? makeK8sFetchImpl(transport);
   const res = await junctionFetch(
     url,
@@ -23478,7 +23628,7 @@ async function listResource(transport, namespace, path80, opts = {}) {
     { provider: "kubernetes", accountKey: `${safeHost(transport.server)}/${namespace}`, fetchImpl }
   );
   if (!res.ok) {
-    throw new Error(`kubernetes ${path80} failed: ${res.status} ${res.statusText}`);
+    throw new Error(`kubernetes ${path81} failed: ${res.status} ${res.statusText}`);
   }
   const json = await res.json();
   return Array.isArray(json.items) ? json.items : [];
@@ -23780,21 +23930,21 @@ function createK8sResolveTarget(graph) {
 
 // src/connectors/kubernetes/substrate.ts
 init_cjs_shims();
-var import_promises = require("fs/promises");
-var import_node_os5 = __toESM(require("os"), 1);
-var import_node_path75 = __toESM(require("path"), 1);
+var import_promises2 = require("fs/promises");
+var import_node_os6 = __toESM(require("os"), 1);
+var import_node_path76 = __toESM(require("path"), 1);
 function defaultHome() {
   const override = process.env.NEAT_HOME;
-  if (override && override.length > 0) return import_node_path75.default.resolve(override);
-  return import_node_path75.default.join(import_node_os5.default.homedir(), ".neat");
+  if (override && override.length > 0) return import_node_path76.default.resolve(override);
+  return import_node_path76.default.join(import_node_os6.default.homedir(), ".neat");
 }
 function k8sSubstrateConfigPath(home = defaultHome()) {
-  return import_node_path75.default.join(home, "k8s.json");
+  return import_node_path76.default.join(home, "k8s.json");
 }
 async function readK8sSubstrateConfig(home = defaultHome()) {
   let raw;
   try {
-    raw = await (0, import_promises.readFile)(k8sSubstrateConfigPath(home), "utf8");
+    raw = await (0, import_promises2.readFile)(k8sSubstrateConfigPath(home), "utf8");
   } catch {
     return { version: 1, deployments: [] };
   }
@@ -23889,7 +24039,7 @@ init_auth();
 // src/unrouted.ts
 init_cjs_shims();
 var import_node_fs40 = require("fs");
-var import_node_path76 = __toESM(require("path"), 1);
+var import_node_path77 = __toESM(require("path"), 1);
 function buildUnroutedSpanRecord(serviceName, traceId, now = /* @__PURE__ */ new Date()) {
   return {
     timestamp: now.toISOString(),
@@ -23899,34 +24049,34 @@ function buildUnroutedSpanRecord(serviceName, traceId, now = /* @__PURE__ */ new
   };
 }
 async function appendUnroutedSpan(neatHome4, record) {
-  const target = import_node_path76.default.join(neatHome4, "errors.ndjson");
+  const target = import_node_path77.default.join(neatHome4, "errors.ndjson");
   await import_node_fs40.promises.mkdir(neatHome4, { recursive: true });
   await import_node_fs40.promises.appendFile(target, JSON.stringify(record) + "\n", "utf8");
 }
 function unroutedErrorsPath(neatHome4) {
-  return import_node_path76.default.join(neatHome4, "errors.ndjson");
+  return import_node_path77.default.join(neatHome4, "errors.ndjson");
 }
 
 // src/daemon.ts
 var import_types106 = require("@neat.is/types");
 function daemonJsonPath(scanPath) {
-  return import_node_path77.default.join(scanPath, "neat-out", "daemon.json");
+  return import_node_path78.default.join(scanPath, "neat-out", "daemon.json");
 }
 function daemonsDiscoveryDir(home) {
   const base = home && home.length > 0 ? home : neatHomeFromEnv();
-  return import_node_path77.default.join(base, "daemons");
+  return import_node_path78.default.join(base, "daemons");
 }
 function daemonDiscoveryPath(project, home) {
-  return import_node_path77.default.join(daemonsDiscoveryDir(home), `${sanitizeDiscoveryName(project)}.json`);
+  return import_node_path78.default.join(daemonsDiscoveryDir(home), `${sanitizeDiscoveryName(project)}.json`);
 }
 function sanitizeDiscoveryName(project) {
   return project.replace(/[^A-Za-z0-9._-]/g, "_");
 }
 function neatHomeFromEnv() {
   const env = process.env.NEAT_HOME;
-  if (env && env.length > 0) return import_node_path77.default.resolve(env);
+  if (env && env.length > 0) return import_node_path78.default.resolve(env);
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return import_node_path77.default.join(home, ".neat");
+  return import_node_path78.default.join(home, ".neat");
 }
 function resolveNeatVersion() {
   if (process.env.NEAT_LOCAL_VERSION && process.env.NEAT_LOCAL_VERSION.length > 0) {
@@ -23997,17 +24147,21 @@ function teardownSlot(slot) {
     slot.stopK8sSubstrate();
   } catch {
   }
+  try {
+    slot.stopRepoSync();
+  } catch {
+  }
   try {
     slot.detachEvents();
   } catch {
   }
 }
 function neatHomeFor(opts) {
-  if (opts.neatHome && opts.neatHome.length > 0) return import_node_path77.default.resolve(opts.neatHome);
+  if (opts.neatHome && opts.neatHome.length > 0) return import_node_path78.default.resolve(opts.neatHome);
   const env = process.env.NEAT_HOME;
-  if (env && env.length > 0) return import_node_path77.default.resolve(env);
+  if (env && env.length > 0) return import_node_path78.default.resolve(env);
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return import_node_path77.default.join(home, ".neat");
+  return import_node_path78.default.join(home, ".neat");
 }
 function routeSpanToProject(serviceName, projects) {
   if (!serviceName) return DEFAULT_PROJECT;
@@ -24059,7 +24213,7 @@ function spanBelongsToSingleProject(graph, project, serviceName) {
   );
 }
 async function bootstrapProject(entry2, connectors = [], neatHome4) {
-  const paths = pathsForProject(entry2.name, import_node_path77.default.join(entry2.path, "neat-out"));
+  const paths = pathsForProject(entry2.name, import_node_path78.default.join(entry2.path, "neat-out"));
   try {
     const stat = await import_node_fs41.promises.stat(entry2.path);
     if (!stat.isDirectory()) {
@@ -24085,6 +24239,8 @@ async function bootstrapProject(entry2, connectors = [], neatHome4) {
       },
       stopK8sSubstrate: () => {
       },
+      stopRepoSync: () => {
+      },
       detachEvents: () => {
       },
       status: "broken",
@@ -24136,6 +24292,12 @@ async function bootstrapProject(entry2, connectors = [], neatHome4) {
       ...neatHome4 ? { home: neatHome4 } : {},
       onSkip: (skipped, reason) => console.warn(`neatd: k8s substrate "${skipped.id}" skipped for project "${entry2.name}" \u2014 ${reason}`)
     });
+    const stopRepoSync = await maybeStartRepoSync({
+      project: entry2.name,
+      graph,
+      onSkip: (repo, reason) => console.warn(`neatd: repo-sync "${repo}" skipped for project "${entry2.name}" \u2014 ${reason}`),
+      onError: (repo, err) => console.warn(`neatd: repo-sync "${repo}" failed for project "${entry2.name}" \u2014 ${err.message}`)
+    });
     await touchLastSeen(entry2.name).catch(() => {
     });
     return {
@@ -24148,6 +24310,7 @@ async function bootstrapProject(entry2, connectors = [], neatHome4) {
       stopConnectors,
       stopHostedConnectors,
       stopK8sSubstrate,
+      stopRepoSync,
       detachEvents,
       status: "active"
     };
@@ -24204,7 +24367,7 @@ async function startDaemon(opts = {}) {
   const projectArg = typeof opts.project === "string" && opts.project.length > 0 ? opts.project : process.env.NEAT_PROJECT && process.env.NEAT_PROJECT.length > 0 ? process.env.NEAT_PROJECT : null;
   const projectPathArg = opts.projectPath && opts.projectPath.length > 0 ? opts.projectPath : process.env.NEAT_PROJECT_PATH && process.env.NEAT_PROJECT_PATH.length > 0 ? process.env.NEAT_PROJECT_PATH : null;
   const singleProject = projectArg;
-  const singleProjectPath = singleProject && projectPathArg ? import_node_path77.default.resolve(projectPathArg) : null;
+  const singleProjectPath = singleProject && projectPathArg ? import_node_path78.default.resolve(projectPathArg) : null;
   if (singleProject && !singleProjectPath) {
     throw new Error(
       `neatd: project "${singleProject}" given without a projectPath; pass NEAT_PROJECT_PATH alongside NEAT_PROJECT.`
@@ -24219,7 +24382,7 @@ async function startDaemon(opts = {}) {
       );
     }
   }
-  const pidPath = import_node_path77.default.join(home, "neatd.pid");
+  const pidPath = import_node_path78.default.join(home, "neatd.pid");
   await writeAtomically(pidPath, `${process.pid}
 `);
   const slots = /* @__PURE__ */ new Map();
@@ -24691,8 +24854,8 @@ async function startDaemon(opts = {}) {
   let registryWatcher = null;
   let reloadTimer = null;
   if (!singleProject) try {
-    const regDir = import_node_path77.default.dirname(regPath);
-    const regBase = import_node_path77.default.basename(regPath);
+    const regDir = import_node_path78.default.dirname(regPath);
+    const regBase = import_node_path78.default.basename(regPath);
     registryWatcher = (0, import_node_fs41.watch)(regDir, (_eventType, filename) => {
       if (filename !== null && filename !== regBase) return;
       if (reloadTimer) clearTimeout(reloadTimer);
@@ -24767,7 +24930,7 @@ init_cjs_shims();
 var import_node_child_process2 = require("child_process");
 var import_node_fs42 = require("fs");
 var import_node_net = __toESM(require("net"), 1);
-var import_node_path78 = __toESM(require("path"), 1);
+var import_node_path79 = __toESM(require("path"), 1);
 var DEFAULT_WEB_PORT = 6328;
 var DEFAULT_REST_PORT = 8080;
 function asValidPort(value) {
@@ -24776,11 +24939,11 @@ function asValidPort(value) {
 }
 function projectRoot() {
   const fromEnv = process.env.NEAT_SCAN_PATH;
-  return import_node_path78.default.resolve(fromEnv && fromEnv.length > 0 ? fromEnv : process.cwd());
+  return import_node_path79.default.resolve(fromEnv && fromEnv.length > 0 ? fromEnv : process.cwd());
 }
 async function readDaemonPorts(root) {
   try {
-    const raw = await import_node_fs42.promises.readFile(import_node_path78.default.join(root, "neat-out", "daemon.json"), "utf8");
+    const raw = await import_node_fs42.promises.readFile(import_node_path79.default.join(root, "neat-out", "daemon.json"), "utf8");
     const parsed = JSON.parse(raw);
     const ports = parsed?.ports ?? {};
     return { web: asValidPort(ports.web), rest: asValidPort(ports.rest) };
@@ -24825,10 +24988,10 @@ function resolveWebPackageDir() {
     eval("require")
   );
   const pkgJsonPath = req.resolve("@neat.is/web/package.json");
-  return import_node_path78.default.dirname(pkgJsonPath);
+  return import_node_path79.default.dirname(pkgJsonPath);
 }
 function resolveStandaloneServerEntry(webDir) {
-  return import_node_path78.default.join(webDir, ".next/standalone/packages/web/server.js");
+  return import_node_path79.default.join(webDir, ".next/standalone/packages/web/server.js");
 }
 async function pickInternalPort() {
   return new Promise((resolve, reject) => {
@@ -24881,7 +25044,7 @@ async function spawnWebUI(restPort, opts = {}) {
         NEAT_API_URL: apiUrl
       };
       child = (0, import_node_child_process2.spawn)(process.execPath, [serverEntry], {
-        cwd: import_node_path78.default.dirname(serverEntry),
+        cwd: import_node_path79.default.dirname(serverEntry),
         env,
         stdio: ["ignore", "inherit", "inherit"],
         detached: false
@@ -24980,13 +25143,13 @@ async function waitForListening(port, timeoutMs = 15e3) {
 
 // src/version-skew.ts
 init_cjs_shims();
-var import_promises2 = require("timers/promises");
+var import_promises3 = require("timers/promises");
 var NPM_REGISTRY_URL = "https://registry.npmjs.org/neat.is/latest";
 var DEFAULT_TIMEOUT_MS = 2e3;
 async function fetchRegistryVersion(url, timeoutMs, fetchImpl) {
   const controller = new AbortController();
   let timedOut = false;
-  const timer = (0, import_promises2.setTimeout)(timeoutMs).then(() => {
+  const timer = (0, import_promises3.setTimeout)(timeoutMs).then(() => {
     timedOut = true;
     controller.abort();
   });
@@ -25057,14 +25220,14 @@ function localVersion() {
 }
 function neatHome3() {
   if (process.env.NEAT_HOME && process.env.NEAT_HOME.length > 0) {
-    return import_node_path79.default.resolve(process.env.NEAT_HOME);
+    return import_node_path80.default.resolve(process.env.NEAT_HOME);
   }
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return import_node_path79.default.join(home, ".neat");
+  return import_node_path80.default.join(home, ".neat");
 }
 async function readPid() {
   try {
-    const raw = await import_node_fs43.promises.readFile(import_node_path79.default.join(neatHome3(), "neatd.pid"), "utf8");
+    const raw = await import_node_fs43.promises.readFile(import_node_path80.default.join(neatHome3(), "neatd.pid"), "utf8");
     const n = Number.parseInt(raw.trim(), 10);
     return Number.isFinite(n) ? n : null;
   } catch {