@neat.is/core 0.9.18 → 0.9.20-dev.20260919

package/dist/index.cjs

@@ -60,8 +60,8 @@ function mountBearerAuth(app, opts) {
   ]);
   const publicRead = opts.publicRead === true;
   app.addHook("preHandler", (req, reply, done) => {
-    const path78 = (req.url.split("?")[0] ?? "").replace(/\/+$/, "");
-    if (exactUnauthPaths.has(path78) || PROJECT_SCOPED_UNAUTH_PATTERN.test(path78)) {
+    const path79 = (req.url.split("?")[0] ?? "").replace(/\/+$/, "");
+    if (exactUnauthPaths.has(path79) || PROJECT_SCOPED_UNAUTH_PATTERN.test(path79)) {
       done();
       return;
     }
@@ -414,8 +414,8 @@ function websocketChannelPathOf(attrs) {
     const v = attrs[key];
     if (typeof v === "string" && v.length > 0) {
       const q = v.indexOf("?");
-      const path78 = q === -1 ? v : v.slice(0, q);
-      if (path78.length > 0) return path78;
+      const path79 = q === -1 ? v : v.slice(0, q);
+      if (path79.length > 0) return path79;
     }
   }
   return void 0;
@@ -1374,19 +1374,19 @@ function confidenceFromMix(edges, now = Date.now()) {
 function longestIncomingWalk(graph, start, maxDepth) {
   let best = { path: [start], edges: [] };
   const visited = /* @__PURE__ */ new Set([start]);
-  function step(node, path78, edges) {
-    if (path78.length > best.path.length) {
-      best = { path: [...path78], edges: [...edges] };
+  function step(node, path79, edges) {
+    if (path79.length > best.path.length) {
+      best = { path: [...path79], edges: [...edges] };
     }
-    if (path78.length - 1 >= maxDepth) return;
+    if (path79.length - 1 >= maxDepth) return;
     const incoming = bestEdgeBySource(graph, graph.inboundEdges(node));
     for (const [srcId, edge] of incoming) {
       if (visited.has(srcId)) continue;
       visited.add(srcId);
-      path78.push(srcId);
+      path79.push(srcId);
       edges.push(edge);
-      step(srcId, path78, edges);
-      path78.pop();
+      step(srcId, path79, edges);
+      path79.pop();
       edges.pop();
       visited.delete(srcId);
     }
@@ -1601,20 +1601,20 @@ function dominantFailingCall(graph, serviceId17, visited) {
   return best;
 }
 function followFailingCallChain(graph, originServiceId, maxDepth) {
-  const path78 = [originServiceId];
+  const path79 = [originServiceId];
   const edges = [];
   const visited = /* @__PURE__ */ new Set([originServiceId]);
   let current = originServiceId;
   for (let depth = 0; depth < maxDepth; depth++) {
     const hop = dominantFailingCall(graph, current, visited);
     if (!hop) break;
-    path78.push(hop.nextService);
+    path79.push(hop.nextService);
     edges.push(hop.edge);
     visited.add(hop.nextService);
     current = hop.nextService;
   }
   if (edges.length === 0) return null;
-  return { path: path78, edges, culprit: current };
+  return { path: path79, edges, culprit: current };
 }
 function isStaleCallEdge(e) {
   return e.type === import_types.EdgeType.CALLS && e.provenance === import_types.Provenance.STALE;
@@ -1650,26 +1650,26 @@ function dominantStaleCall(graph, serviceId17, visited) {
   return best;
 }
 function followStaleCallChain(graph, originServiceId, maxDepth) {
-  const path78 = [originServiceId];
+  const path79 = [originServiceId];
   const edges = [];
   const visited = /* @__PURE__ */ new Set([originServiceId]);
   let current = originServiceId;
   for (let depth = 0; depth < maxDepth; depth++) {
     const hop = dominantStaleCall(graph, current, visited);
     if (!hop) break;
-    path78.push(hop.nextService);
+    path79.push(hop.nextService);
     edges.push(hop.edge);
     visited.add(hop.nextService);
     current = hop.nextService;
   }
   if (edges.length === 0) return null;
-  return { path: path78, edges, culprit: current };
+  return { path: path79, edges, culprit: current };
 }
 function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   const chain = followFailingCallChain(graph, originId, ROOT_CAUSE_MAX_DEPTH);
   if (!chain) return null;
   const culprit = chain.culprit;
-  const path78 = [...chain.path];
+  const path79 = [...chain.path];
   const edgeProvenances = chain.edges.map((e) => e.provenance);
   const baseConfidence = confidenceFromMix(chain.edges);
   const confidence = Math.max(0, Math.min(1, baseConfidence * INCIDENT_ROOT_CAUSE_CONFIDENCE));
@@ -1677,14 +1677,14 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   if (loc) {
     let rootCauseNode = culprit;
     if (loc.fileNode) {
-      path78.push(loc.fileNode);
+      path79.push(loc.fileNode);
       edgeProvenances.push(import_types.Provenance.OBSERVED);
       rootCauseNode = loc.fileNode;
     }
     return import_types.RootCauseResultSchema.parse({
       rootCauseNode,
       rootCauseReason: loc.rootCauseReason,
-      traversalPath: path78,
+      traversalPath: path79,
       edgeProvenances,
       confidence,
       ...loc.fixRecommendation ? { fixRecommendation: loc.fixRecommendation } : {}
@@ -1696,7 +1696,7 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   return import_types.RootCauseResultSchema.parse({
     rootCauseNode: culprit,
     rootCauseReason: `${culpritName} is failing downstream calls (${errs} observed error${errs === 1 ? "" : "s"})`,
-    traversalPath: path78,
+    traversalPath: path79,
     edgeProvenances,
     confidence,
     fixRecommendation: `Inspect ${culpritName}'s failing handler`
@@ -2349,10 +2349,10 @@ function enrichWithNavigation(graph, errorNodeId, tagged, incidents, now) {
     traversalPath = staleChain.path;
     edgeProvenances = staleChain.edges.map((e) => e.provenance);
   } else if (top.node !== seedNode) {
-    const path78 = findPath(graph, errorNodeId, top.node, "up", ROOT_CAUSE_MAX_DEPTH);
-    if (path78) {
-      traversalPath = path78.nodes;
-      edgeProvenances = path78.edges.map((e) => e.provenance);
+    const path79 = findPath(graph, errorNodeId, top.node, "up", ROOT_CAUSE_MAX_DEPTH);
+    if (path79) {
+      traversalPath = path79.nodes;
+      edgeProvenances = path79.edges.map((e) => e.provenance);
     } else {
       traversalPath = [errorNodeId, top.node];
       edgeProvenances = [top.provenance ?? import_types.Provenance.OBSERVED];
@@ -3791,8 +3791,8 @@ function chiRoutesFromSource(source, parser) {
   chiWalk(tree.rootNode, "", out);
   return out;
 }
-function stripChiRegex(path78) {
-  return path78.replace(/\{([^{}:]+):[^{}]*\}/g, "{$1}");
+function stripChiRegex(path79) {
+  return path79.replace(/\{([^{}:]+):[^{}]*\}/g, "{$1}");
 }
 function chiWalk(node, prefix, out) {
   for (let i = 0; i < node.namedChildCount; i++) {
@@ -4464,9 +4464,9 @@ function rubyRocketRoute(args) {
     if (!pair || pair.type !== "pair") continue;
     const k = pair.childForFieldName("key");
     if (k?.type !== "string") continue;
-    const path78 = rubyLiteral(k);
-    if (path78 === null) continue;
-    return { path: path78, target: rubyLiteral(pair.childForFieldName("value")) };
+    const path79 = rubyLiteral(k);
+    if (path79 === null) continue;
+    return { path: path79, target: rubyLiteral(pair.childForFieldName("value")) };
   }
   return null;
 }
@@ -10688,10 +10688,10 @@ function grpcMethodsFromProto(content, fqPackage) {
     }
     const body = content.slice(bodyStart, i - 1);
     const rpcRe = /\brpc\s+([A-Za-z_][A-Za-z0-9_]*)\s*\(/g;
-    let rm;
-    while ((rm = rpcRe.exec(body)) !== null) {
-      const rpcMethod = rm[1];
-      const line = lineAt(content, bodyStart + rm.index);
+    let rm2;
+    while ((rm2 = rpcRe.exec(body)) !== null) {
+      const rpcMethod = rm2[1];
+      const line = lineAt(content, bodyStart + rm2.index);
       out.push({ rpcService, rpcMethod, line });
     }
     serviceRe.lastIndex = i;
@@ -19573,10 +19573,10 @@ var SUPABASE_RPC_TARGET_KIND = "supabase-rpc";
 // src/connectors/supabase/map.ts
 var REST_RPC_PATH_RE = /^\/rest\/v1\/rpc\/([^/?]+)/;
 var REST_TABLE_PATH_RE = /^\/rest\/v1\/([^/?]+)/;
-function targetFromRestPath(path78) {
-  const rpcMatch = REST_RPC_PATH_RE.exec(path78);
+function targetFromRestPath(path79) {
+  const rpcMatch = REST_RPC_PATH_RE.exec(path79);
   if (rpcMatch) return { targetKind: SUPABASE_RPC_TARGET_KIND, name: rpcMatch[1] };
-  const tableMatch = REST_TABLE_PATH_RE.exec(path78);
+  const tableMatch = REST_TABLE_PATH_RE.exec(path79);
   if (tableMatch) return { targetKind: SUPABASE_TABLE_TARGET_KIND, name: tableMatch[1] };
   return null;
 }
@@ -20180,9 +20180,9 @@ function parseFirebaseTargetName(targetName) {
   const secondSep = rest.indexOf(FIELD_SEP);
   if (secondSep === -1) return null;
   const method = rest.slice(0, secondSep);
-  const path78 = rest.slice(secondSep + 1);
-  if (!resourceName || !method || !path78) return null;
-  return { resourceName, method, path: path78 };
+  const path79 = rest.slice(secondSep + 1);
+  if (!resourceName || !method || !path79) return null;
+  return { resourceName, method, path: path79 };
 }
 function resourceNameFor(type, labels) {
   if (!labels) return null;
@@ -20220,14 +20220,14 @@ function mapLogEntryToSignal(entry) {
   if (!req) return null;
   if (typeof req.requestMethod !== "string" || req.requestMethod.length === 0) return null;
   const method = req.requestMethod.toUpperCase();
-  const path78 = pathFromRequestUrl(req.requestUrl);
-  if (path78 === null) return null;
+  const path79 = pathFromRequestUrl(req.requestUrl);
+  if (path79 === null) return null;
   const timestamp = entry.timestamp;
   if (typeof timestamp !== "string" || timestamp.length === 0) return null;
   const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD2;
   return {
     targetKind: resourceType,
-    targetName: packFirebaseTargetName({ resourceName, method, path: path78 }),
+    targetName: packFirebaseTargetName({ resourceName, method, path: path79 }),
     callCount: 1,
     errorCount: isError ? 1 : 0,
     lastObservedIso: timestamp
@@ -20434,7 +20434,7 @@ function mapEventToSignal(event) {
   if (Number.isNaN(observedAt.getTime())) return null;
   const statusCode = metadata?.statusCode;
   const isError = typeof statusCode === "number" && statusCode >= ERROR_STATUS_THRESHOLD3;
-  const path78 = metadata?.trigger ? parsePathFromTrigger(metadata.trigger) : void 0;
+  const path79 = metadata?.trigger ? parsePathFromTrigger(metadata.trigger) : void 0;
   return {
     targetKind: CLOUDFLARE_TARGET_KIND,
     targetName: scriptName,
@@ -20442,7 +20442,7 @@ function mapEventToSignal(event) {
     errorCount: isError ? 1 : 0,
     lastObservedIso: observedAt.toISOString(),
     method,
-    ...path78 ? { path: path78 } : {},
+    ...path79 ? { path: path79 } : {},
     ...typeof statusCode === "number" ? { statusCode } : {},
     ...typeof metadata?.duration === "number" ? { duration: metadata.duration } : {}
   };
@@ -20488,8 +20488,8 @@ function findTaggedWorkerFileNode(graph, workerName) {
   });
   return found;
 }
-function findMatchingRouteNode(graph, serviceName, method, path78) {
-  const normalizedPath = normalizePathTemplate(path78);
+function findMatchingRouteNode(graph, serviceName, method, path79) {
+  const normalizedPath = normalizePathTemplate(path79);
   let found = null;
   graph.forEachNode((id, attrs) => {
     if (found) return;
@@ -20506,10 +20506,10 @@ function createCloudflareResolveTarget(config, graph) {
   return (signal) => {
     if (signal.targetKind !== CLOUDFLARE_TARGET_KIND) return null;
     const scriptName = signal.targetName;
-    const { method, path: path78 } = signal;
+    const { method, path: path79 } = signal;
     const resolveRouteGrain = (serviceName, wholeFileId) => {
-      if (!method || !path78) return wholeFileId;
-      return findMatchingRouteNode(graph, serviceName, method, path78) ?? wholeFileId;
+      if (!method || !path79) return wholeFileId;
+      return findMatchingRouteNode(graph, serviceName, method, path79) ?? wholeFileId;
     };
     const mapping = config.workers?.[scriptName];
     if (mapping) {
@@ -20861,9 +20861,9 @@ function parseCloudRunTargetName(targetName) {
   const secondSep = rest.indexOf(FIELD_SEP2);
   if (secondSep === -1) return null;
   const method = rest.slice(0, secondSep);
-  const path78 = rest.slice(secondSep + 1);
-  if (!serviceName || !method || !path78) return null;
-  return { serviceName, method, path: path78 };
+  const path79 = rest.slice(secondSep + 1);
+  if (!serviceName || !method || !path79) return null;
+  return { serviceName, method, path: path79 };
 }
 
 // src/connectors/cloud-run/map.ts
@@ -20892,14 +20892,14 @@ function mapLogEntryToSignal2(entry) {
   if (!req) return null;
   if (typeof req.requestMethod !== "string" || req.requestMethod.length === 0) return null;
   const method = req.requestMethod.toUpperCase();
-  const path78 = pathFromRequestUrl2(req.requestUrl);
-  if (path78 === null) return null;
+  const path79 = pathFromRequestUrl2(req.requestUrl);
+  if (path79 === null) return null;
   const timestamp = entry.timestamp;
   if (typeof timestamp !== "string" || timestamp.length === 0) return null;
   const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD4;
   return {
     targetKind: CLOUD_RUN_TARGET_KIND,
-    targetName: packCloudRunTargetName({ serviceName, method, path: path78 }),
+    targetName: packCloudRunTargetName({ serviceName, method, path: path79 }),
     callCount: 1,
     errorCount: isError ? 1 : 0,
     lastObservedIso: timestamp
@@ -20938,14 +20938,14 @@ function createCloudRunResolveTarget(graph, config) {
     if (signal.targetKind !== CLOUD_RUN_TARGET_KIND) return null;
     const identity = parseCloudRunTargetName(signal.targetName);
     if (!identity) return null;
-    const { serviceName: gcpServiceName, method, path: path78 } = identity;
+    const { serviceName: gcpServiceName, method, path: path79 } = identity;
     const mappedService = config.serviceMap?.[gcpServiceName];
     if (mappedService) {
       const routeNodeId = findMatchingRouteNode2(
         graph,
         mappedService,
         method,
-        normalizePathTemplate(path78)
+        normalizePathTemplate(path79)
       );
       if (routeNodeId) {
         return { targetNodeId: routeNodeId, serviceName: mappedService, edgeType: import_types81.EdgeType.CALLS };
@@ -21081,9 +21081,9 @@ function parseGcpLbTargetName(targetName) {
   const secondSep = rest.indexOf(FIELD_SEP3);
   if (secondSep === -1) return null;
   const method = rest.slice(0, secondSep);
-  const path78 = rest.slice(secondSep + 1);
-  if (!backendServiceName || !method || !path78) return null;
-  return { backendServiceName, method, path: path78 };
+  const path79 = rest.slice(secondSep + 1);
+  if (!backendServiceName || !method || !path79) return null;
+  return { backendServiceName, method, path: path79 };
 }
 
 // src/connectors/gcp-lb/map.ts
@@ -21112,14 +21112,14 @@ function mapLogEntryToSignal3(entry) {
   if (!req) return null;
   if (typeof req.requestMethod !== "string" || req.requestMethod.length === 0) return null;
   const method = req.requestMethod.toUpperCase();
-  const path78 = pathFromRequestUrl3(req.requestUrl);
-  if (path78 === null) return null;
+  const path79 = pathFromRequestUrl3(req.requestUrl);
+  if (path79 === null) return null;
   const timestamp = entry.timestamp;
   if (typeof timestamp !== "string" || timestamp.length === 0) return null;
   const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD5;
   return {
     targetKind: GCP_LB_TARGET_KIND,
-    targetName: packGcpLbTargetName({ backendServiceName, method, path: path78 }),
+    targetName: packGcpLbTargetName({ backendServiceName, method, path: path79 }),
     callCount: 1,
     errorCount: isError ? 1 : 0,
     lastObservedIso: timestamp
@@ -21158,14 +21158,14 @@ function createGcpLbResolveTarget(graph, config) {
     if (signal.targetKind !== GCP_LB_TARGET_KIND) return null;
     const identity = parseGcpLbTargetName(signal.targetName);
     if (!identity) return null;
-    const { backendServiceName, method, path: path78 } = identity;
+    const { backendServiceName, method, path: path79 } = identity;
     const mappedService = config.backendServiceMap?.[backendServiceName];
     if (mappedService) {
       const routeNodeId = findMatchingRouteNode3(
         graph,
         mappedService,
         method,
-        normalizePathTemplate(path78)
+        normalizePathTemplate(path79)
       );
       if (routeNodeId) {
         return { targetNodeId: routeNodeId, serviceName: mappedService, edgeType: import_types85.EdgeType.CALLS };
@@ -23369,7 +23369,7 @@ init_otel_grpc();
 // src/daemon.ts
 init_cjs_shims();
 var import_node_fs41 = require("fs");
-var import_node_path77 = __toESM(require("path"), 1);
+var import_node_path78 = __toESM(require("path"), 1);
 var import_node_module = require("module");
 init_otel();
 
@@ -23407,13 +23407,13 @@ async function reconcileFrontierSurfaces(graph, errorsPath) {
 init_cjs_shims();
 var CREDENTIAL_REFRESH_SKEW_MS = 6e4;
 var CP_REQUEST_TIMEOUT_MS = 1e4;
-async function cpGet(path78, deps) {
+async function cpGet(path79, deps) {
   const f = deps.fetchImpl ?? fetch;
-  const res = await f(`${deps.cpUrl.replace(/\/+$/, "")}${path78}`, {
+  const res = await f(`${deps.cpUrl.replace(/\/+$/, "")}${path79}`, {
     headers: { authorization: `Bearer ${deps.daemonToken}`, accept: "application/json" },
     signal: AbortSignal.timeout(CP_REQUEST_TIMEOUT_MS)
   });
-  if (!res.ok) throw new Error(`control plane ${path78} \u2192 HTTP ${res.status}`);
+  if (!res.ok) throw new Error(`control plane ${path79} \u2192 HTTP ${res.status}`);
   return await res.json();
 }
 function credentialRecord(provider, cred) {
@@ -23519,6 +23519,156 @@ async function maybeStartHostedConnectors(input) {
   });
 }
 
+// src/connectors/hosted-repos.ts
+init_cjs_shims();
+var import_node_os5 = __toESM(require("os"), 1);
+var import_node_path75 = __toESM(require("path"), 1);
+var import_promises = require("fs/promises");
+var CP_REQUEST_TIMEOUT_MS2 = 1e4;
+var DEFAULT_SYNC_INTERVAL_MS = 5 * 6e4;
+var CLONE_TIMEOUT_MS = 5 * 6e4;
+function scrubToken(s) {
+  return s.replace(/x-access-token:[^@\s]+@/g, "x-access-token:***@");
+}
+async function cpGet2(pathname, deps) {
+  const f = deps.fetchImpl ?? fetch;
+  const res = await f(`${deps.cpUrl.replace(/\/+$/, "")}${pathname}`, {
+    headers: { authorization: `Bearer ${deps.daemonToken}`, accept: "application/json" },
+    signal: AbortSignal.timeout(CP_REQUEST_TIMEOUT_MS2)
+  });
+  if (!res.ok) throw new Error(`control plane ${pathname} \u2192 HTTP ${res.status}`);
+  return await res.json();
+}
+async function cpPostStatus(deps, owner, name, body) {
+  const f = deps.fetchImpl ?? fetch;
+  const url = `${deps.cpUrl.replace(/\/+$/, "")}/internal/projects/${deps.projectId}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}/status`;
+  const res = await f(url, {
+    method: "POST",
+    headers: { authorization: `Bearer ${deps.daemonToken}`, "content-type": "application/json" },
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(CP_REQUEST_TIMEOUT_MS2)
+  });
+  if (!res.ok && res.status !== 404) throw new Error(`control plane status POST \u2192 HTTP ${res.status}`);
+}
+var defaultCloneRepo = async (cloneUrl, ref, destDir) => {
+  const [{ default: git }, httpMod, fs40] = await Promise.all([
+    import("isomorphic-git"),
+    import("isomorphic-git/http/node"),
+    import("fs")
+  ]);
+  const http = httpMod.default ?? httpMod;
+  const parsed = new URL(cloneUrl);
+  const password = parsed.password || parsed.username;
+  const username = parsed.password ? parsed.username : "x-access-token";
+  const cleanUrl = `${parsed.protocol}//${parsed.host}${parsed.pathname}`;
+  const clone = git.clone({
+    fs: fs40,
+    http,
+    dir: destDir,
+    url: cleanUrl,
+    // Absent ref → isomorphic-git clones the remote's default branch.
+    ...ref ? { ref } : {},
+    singleBranch: true,
+    depth: 1,
+    onAuth: () => ({ username, password })
+  });
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(new Error(`clone timed out after ${CLONE_TIMEOUT_MS}ms`)), CLONE_TIMEOUT_MS);
+  });
+  try {
+    await Promise.race([clone, timeout]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+};
+function needsSync(r) {
+  return r.syncStatus === void 0 || r.syncStatus === "syncing";
+}
+async function syncOneRepo(r, input) {
+  const { deps, graph } = input;
+  const cloneRepo = input.cloneRepo ?? defaultCloneRepo;
+  const extract = input.extract ?? extractFromDirectory;
+  const label = `${r.owner}/${r.name}`;
+  const tmpRoot = input.tmpRoot ?? import_node_os5.default.tmpdir();
+  let dir;
+  try {
+    dir = await (0, import_promises.mkdtemp)(import_node_path75.default.join(tmpRoot, "neat-repo-"));
+    await cloneRepo(r.cloneUrl, r.defaultBranch, dir);
+    await extract(graph, dir);
+    await cpPostStatus(deps, r.owner, r.name, {
+      syncStatus: "synced",
+      lastSyncAt: new Date(input.now?.() ?? Date.now()).toISOString()
+    });
+  } catch (err) {
+    input.onError?.(label, err);
+    await cpPostStatus(deps, r.owner, r.name, {
+      syncStatus: "failed",
+      detail: scrubToken(err.message).slice(0, 300)
+    }).catch(() => {
+    });
+  } finally {
+    if (dir) await (0, import_promises.rm)(dir, { recursive: true, force: true }).catch(() => {
+    });
+  }
+}
+async function runRepoSyncPass(input) {
+  let repos;
+  try {
+    repos = await cpGet2(`/internal/projects/${input.deps.projectId}/repos`, input.deps);
+  } catch (err) {
+    input.onSkip?.("(all)", `control plane repo list unreadable \u2014 ${err.message}`);
+    return;
+  }
+  if (!Array.isArray(repos)) return;
+  for (const r of repos) {
+    if (!needsSync(r)) continue;
+    await syncOneRepo(r, input);
+  }
+}
+async function startRepoSync(input) {
+  const intervalMs = input.intervalMs ?? DEFAULT_SYNC_INTERVAL_MS;
+  let stopped = false;
+  let running = false;
+  const tick = async () => {
+    if (stopped || running) return;
+    running = true;
+    try {
+      await runRepoSyncPass(input);
+    } finally {
+      running = false;
+    }
+  };
+  void tick();
+  const timer = setInterval(() => {
+    void tick();
+  }, intervalMs);
+  if (typeof timer.unref === "function") timer.unref();
+  return () => {
+    stopped = true;
+    clearInterval(timer);
+  };
+}
+async function maybeStartRepoSync(input) {
+  const env = input.env ?? process.env;
+  const cpUrl = env.NEAT_CP_URL;
+  const projectId = env.NEAT_CP_PROJECT_ID;
+  const daemonToken = env.NEAT_AUTH_TOKEN;
+  if (!cpUrl || !projectId || !daemonToken) return () => {
+  };
+  return startRepoSync({
+    deps: { cpUrl, projectId, daemonToken, ...input.fetchImpl ? { fetchImpl: input.fetchImpl } : {} },
+    graph: input.graph,
+    project: input.project,
+    ...input.cloneRepo ? { cloneRepo: input.cloneRepo } : {},
+    ...input.extract ? { extract: input.extract } : {},
+    ...input.intervalMs !== void 0 ? { intervalMs: input.intervalMs } : {},
+    ...input.tmpRoot ? { tmpRoot: input.tmpRoot } : {},
+    ...input.onSkip ? { onSkip: input.onSkip } : {},
+    ...input.onError ? { onError: input.onError } : {}
+  });
+}
+
 // src/connectors/kubernetes/index.ts
 init_cjs_shims();
 
@@ -23572,9 +23722,9 @@ function makeK8sFetchImpl(transport) {
     req.end();
   }));
 }
-async function listResource(transport, namespace, path78, opts = {}) {
+async function listResource(transport, namespace, path79, opts = {}) {
   const base = opts.apiUrl ?? transport.server;
-  const url = `${base.replace(/\/$/, "")}${path78}`;
+  const url = `${base.replace(/\/$/, "")}${path79}`;
   const fetchImpl = opts.fetchImpl ?? makeK8sFetchImpl(transport);
   const res = await junctionFetch(
     url,
@@ -23584,7 +23734,7 @@ async function listResource(transport, namespace, path78, opts = {}) {
     { provider: "kubernetes", accountKey: `${safeHost(transport.server)}/${namespace}`, fetchImpl }
   );
   if (!res.ok) {
-    throw new Error(`kubernetes ${path78} failed: ${res.status} ${res.statusText}`);
+    throw new Error(`kubernetes ${path79} failed: ${res.status} ${res.statusText}`);
   }
   const json = await res.json();
   return Array.isArray(json.items) ? json.items : [];
@@ -23886,21 +24036,21 @@ function createK8sResolveTarget(graph) {
 
 // src/connectors/kubernetes/substrate.ts
 init_cjs_shims();
-var import_promises = require("fs/promises");
-var import_node_os5 = __toESM(require("os"), 1);
-var import_node_path75 = __toESM(require("path"), 1);
+var import_promises2 = require("fs/promises");
+var import_node_os6 = __toESM(require("os"), 1);
+var import_node_path76 = __toESM(require("path"), 1);
 function defaultHome() {
   const override = process.env.NEAT_HOME;
-  if (override && override.length > 0) return import_node_path75.default.resolve(override);
-  return import_node_path75.default.join(import_node_os5.default.homedir(), ".neat");
+  if (override && override.length > 0) return import_node_path76.default.resolve(override);
+  return import_node_path76.default.join(import_node_os6.default.homedir(), ".neat");
 }
 function k8sSubstrateConfigPath(home = defaultHome()) {
-  return import_node_path75.default.join(home, "k8s.json");
+  return import_node_path76.default.join(home, "k8s.json");
 }
 async function readK8sSubstrateConfig(home = defaultHome()) {
   let raw;
   try {
-    raw = await (0, import_promises.readFile)(k8sSubstrateConfigPath(home), "utf8");
+    raw = await (0, import_promises2.readFile)(k8sSubstrateConfigPath(home), "utf8");
   } catch {
     return { version: 1, deployments: [] };
   }
@@ -23995,7 +24145,7 @@ init_auth();
 // src/unrouted.ts
 init_cjs_shims();
 var import_node_fs40 = require("fs");
-var import_node_path76 = __toESM(require("path"), 1);
+var import_node_path77 = __toESM(require("path"), 1);
 function buildUnroutedSpanRecord(serviceName, traceId, now = /* @__PURE__ */ new Date()) {
   return {
     timestamp: now.toISOString(),
@@ -24005,34 +24155,34 @@ function buildUnroutedSpanRecord(serviceName, traceId, now = /* @__PURE__ */ new
   };
 }
 async function appendUnroutedSpan(neatHome3, record) {
-  const target = import_node_path76.default.join(neatHome3, "errors.ndjson");
+  const target = import_node_path77.default.join(neatHome3, "errors.ndjson");
   await import_node_fs40.promises.mkdir(neatHome3, { recursive: true });
   await import_node_fs40.promises.appendFile(target, JSON.stringify(record) + "\n", "utf8");
 }
 function unroutedErrorsPath(neatHome3) {
-  return import_node_path76.default.join(neatHome3, "errors.ndjson");
+  return import_node_path77.default.join(neatHome3, "errors.ndjson");
 }
 
 // src/daemon.ts
 var import_types106 = require("@neat.is/types");
 function daemonJsonPath(scanPath) {
-  return import_node_path77.default.join(scanPath, "neat-out", "daemon.json");
+  return import_node_path78.default.join(scanPath, "neat-out", "daemon.json");
 }
 function daemonsDiscoveryDir(home) {
   const base = home && home.length > 0 ? home : neatHomeFromEnv();
-  return import_node_path77.default.join(base, "daemons");
+  return import_node_path78.default.join(base, "daemons");
 }
 function daemonDiscoveryPath(project, home) {
-  return import_node_path77.default.join(daemonsDiscoveryDir(home), `${sanitizeDiscoveryName(project)}.json`);
+  return import_node_path78.default.join(daemonsDiscoveryDir(home), `${sanitizeDiscoveryName(project)}.json`);
 }
 function sanitizeDiscoveryName(project) {
   return project.replace(/[^A-Za-z0-9._-]/g, "_");
 }
 function neatHomeFromEnv() {
   const env = process.env.NEAT_HOME;
-  if (env && env.length > 0) return import_node_path77.default.resolve(env);
+  if (env && env.length > 0) return import_node_path78.default.resolve(env);
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return import_node_path77.default.join(home, ".neat");
+  return import_node_path78.default.join(home, ".neat");
 }
 function resolveNeatVersion() {
   if (process.env.NEAT_LOCAL_VERSION && process.env.NEAT_LOCAL_VERSION.length > 0) {
@@ -24089,17 +24239,21 @@ function teardownSlot(slot) {
     slot.stopK8sSubstrate();
   } catch {
   }
+  try {
+    slot.stopRepoSync();
+  } catch {
+  }
   try {
     slot.detachEvents();
   } catch {
   }
 }
 function neatHomeFor(opts) {
-  if (opts.neatHome && opts.neatHome.length > 0) return import_node_path77.default.resolve(opts.neatHome);
+  if (opts.neatHome && opts.neatHome.length > 0) return import_node_path78.default.resolve(opts.neatHome);
   const env = process.env.NEAT_HOME;
-  if (env && env.length > 0) return import_node_path77.default.resolve(env);
+  if (env && env.length > 0) return import_node_path78.default.resolve(env);
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return import_node_path77.default.join(home, ".neat");
+  return import_node_path78.default.join(home, ".neat");
 }
 function routeSpanToProject(serviceName, projects) {
   if (!serviceName) return DEFAULT_PROJECT;
@@ -24151,7 +24305,7 @@ function spanBelongsToSingleProject(graph, project, serviceName) {
   );
 }
 async function bootstrapProject(entry, connectors = [], neatHome3) {
-  const paths = pathsForProject(entry.name, import_node_path77.default.join(entry.path, "neat-out"));
+  const paths = pathsForProject(entry.name, import_node_path78.default.join(entry.path, "neat-out"));
   try {
     const stat = await import_node_fs41.promises.stat(entry.path);
     if (!stat.isDirectory()) {
@@ -24177,6 +24331,8 @@ async function bootstrapProject(entry, connectors = [], neatHome3) {
       },
       stopK8sSubstrate: () => {
       },
+      stopRepoSync: () => {
+      },
       detachEvents: () => {
       },
       status: "broken",
@@ -24228,6 +24384,12 @@ async function bootstrapProject(entry, connectors = [], neatHome3) {
       ...neatHome3 ? { home: neatHome3 } : {},
       onSkip: (skipped, reason) => console.warn(`neatd: k8s substrate "${skipped.id}" skipped for project "${entry.name}" \u2014 ${reason}`)
     });
+    const stopRepoSync = await maybeStartRepoSync({
+      project: entry.name,
+      graph,
+      onSkip: (repo, reason) => console.warn(`neatd: repo-sync "${repo}" skipped for project "${entry.name}" \u2014 ${reason}`),
+      onError: (repo, err) => console.warn(`neatd: repo-sync "${repo}" failed for project "${entry.name}" \u2014 ${err.message}`)
+    });
     await touchLastSeen(entry.name).catch(() => {
     });
     return {
@@ -24240,6 +24402,7 @@ async function bootstrapProject(entry, connectors = [], neatHome3) {
       stopConnectors,
       stopHostedConnectors,
       stopK8sSubstrate,
+      stopRepoSync,
       detachEvents,
       status: "active"
     };
@@ -24296,7 +24459,7 @@ async function startDaemon(opts = {}) {
   const projectArg = typeof opts.project === "string" && opts.project.length > 0 ? opts.project : process.env.NEAT_PROJECT && process.env.NEAT_PROJECT.length > 0 ? process.env.NEAT_PROJECT : null;
   const projectPathArg = opts.projectPath && opts.projectPath.length > 0 ? opts.projectPath : process.env.NEAT_PROJECT_PATH && process.env.NEAT_PROJECT_PATH.length > 0 ? process.env.NEAT_PROJECT_PATH : null;
   const singleProject = projectArg;
-  const singleProjectPath = singleProject && projectPathArg ? import_node_path77.default.resolve(projectPathArg) : null;
+  const singleProjectPath = singleProject && projectPathArg ? import_node_path78.default.resolve(projectPathArg) : null;
   if (singleProject && !singleProjectPath) {
     throw new Error(
       `neatd: project "${singleProject}" given without a projectPath; pass NEAT_PROJECT_PATH alongside NEAT_PROJECT.`
@@ -24311,7 +24474,7 @@ async function startDaemon(opts = {}) {
       );
     }
   }
-  const pidPath = import_node_path77.default.join(home, "neatd.pid");
+  const pidPath = import_node_path78.default.join(home, "neatd.pid");
   await writeAtomically(pidPath, `${process.pid}
 `);
   const slots = /* @__PURE__ */ new Map();
@@ -24783,8 +24946,8 @@ async function startDaemon(opts = {}) {
   let registryWatcher = null;
   let reloadTimer = null;
   if (!singleProject) try {
-    const regDir = import_node_path77.default.dirname(regPath);
-    const regBase = import_node_path77.default.basename(regPath);
+    const regDir = import_node_path78.default.dirname(regPath);
+    const regBase = import_node_path78.default.basename(regPath);
     registryWatcher = (0, import_node_fs41.watch)(regDir, (_eventType, filename) => {
       if (filename !== null && filename !== regBase) return;
       if (reloadTimer) clearTimeout(reloadTimer);