@neat.is/core 0.9.5-dev.20260825 → 0.9.5

package/dist/cli.cjs

@@ -61,8 +61,8 @@ function mountBearerAuth(app, opts) {
   ]);
   const publicRead = opts.publicRead === true;
   app.addHook("preHandler", (req, reply, done) => {
-    const path93 = (req.url.split("?")[0] ?? "").replace(/\/+$/, "");
-    if (exactUnauthPaths.has(path93) || PROJECT_SCOPED_UNAUTH_PATTERN.test(path93)) {
+    const path94 = (req.url.split("?")[0] ?? "").replace(/\/+$/, "");
+    if (exactUnauthPaths.has(path94) || PROJECT_SCOPED_UNAUTH_PATTERN.test(path94)) {
       done();
       return;
     }
@@ -415,8 +415,8 @@ function websocketChannelPathOf(attrs) {
     const v = attrs[key];
     if (typeof v === "string" && v.length > 0) {
       const q = v.indexOf("?");
-      const path93 = q === -1 ? v : v.slice(0, q);
-      if (path93.length > 0) return path93;
+      const path94 = q === -1 ? v : v.slice(0, q);
+      if (path94.length > 0) return path94;
     }
   }
   return void 0;
@@ -803,9 +803,9 @@ __export(cli_exports, {
 });
 module.exports = __toCommonJS(cli_exports);
 init_cjs_shims();
-var import_node_path92 = __toESM(require("path"), 1);
+var import_node_path93 = __toESM(require("path"), 1);
 var import_node_os8 = __toESM(require("os"), 1);
-var import_node_fs56 = require("fs");
+var import_node_fs57 = require("fs");
 
 // src/banner.ts
 init_cjs_shims();
@@ -1373,19 +1373,19 @@ function confidenceFromMix(edges, now = Date.now()) {
 function longestIncomingWalk(graph, start, maxDepth) {
   let best = { path: [start], edges: [] };
   const visited = /* @__PURE__ */ new Set([start]);
-  function step(node, path93, edges) {
-    if (path93.length > best.path.length) {
-      best = { path: [...path93], edges: [...edges] };
+  function step(node, path94, edges) {
+    if (path94.length > best.path.length) {
+      best = { path: [...path94], edges: [...edges] };
     }
-    if (path93.length - 1 >= maxDepth) return;
+    if (path94.length - 1 >= maxDepth) return;
     const incoming = bestEdgeBySource(graph, graph.inboundEdges(node));
     for (const [srcId, edge] of incoming) {
       if (visited.has(srcId)) continue;
       visited.add(srcId);
-      path93.push(srcId);
+      path94.push(srcId);
       edges.push(edge);
-      step(srcId, path93, edges);
-      path93.pop();
+      step(srcId, path94, edges);
+      path94.pop();
       edges.pop();
       visited.delete(srcId);
     }
@@ -1600,20 +1600,20 @@ function dominantFailingCall(graph, serviceId16, visited) {
   return best;
 }
 function followFailingCallChain(graph, originServiceId, maxDepth) {
-  const path93 = [originServiceId];
+  const path94 = [originServiceId];
   const edges = [];
   const visited = /* @__PURE__ */ new Set([originServiceId]);
   let current = originServiceId;
   for (let depth = 0; depth < maxDepth; depth++) {
     const hop = dominantFailingCall(graph, current, visited);
     if (!hop) break;
-    path93.push(hop.nextService);
+    path94.push(hop.nextService);
     edges.push(hop.edge);
     visited.add(hop.nextService);
     current = hop.nextService;
   }
   if (edges.length === 0) return null;
-  return { path: path93, edges, culprit: current };
+  return { path: path94, edges, culprit: current };
 }
 function isStaleCallEdge(e) {
   return e.type === import_types.EdgeType.CALLS && e.provenance === import_types.Provenance.STALE;
@@ -1649,26 +1649,26 @@ function dominantStaleCall(graph, serviceId16, visited) {
   return best;
 }
 function followStaleCallChain(graph, originServiceId, maxDepth) {
-  const path93 = [originServiceId];
+  const path94 = [originServiceId];
   const edges = [];
   const visited = /* @__PURE__ */ new Set([originServiceId]);
   let current = originServiceId;
   for (let depth = 0; depth < maxDepth; depth++) {
     const hop = dominantStaleCall(graph, current, visited);
     if (!hop) break;
-    path93.push(hop.nextService);
+    path94.push(hop.nextService);
     edges.push(hop.edge);
     visited.add(hop.nextService);
     current = hop.nextService;
   }
   if (edges.length === 0) return null;
-  return { path: path93, edges, culprit: current };
+  return { path: path94, edges, culprit: current };
 }
 function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   const chain = followFailingCallChain(graph, originId, ROOT_CAUSE_MAX_DEPTH);
   if (!chain) return null;
   const culprit = chain.culprit;
-  const path93 = [...chain.path];
+  const path94 = [...chain.path];
   const edgeProvenances = chain.edges.map((e) => e.provenance);
   const baseConfidence = confidenceFromMix(chain.edges);
   const confidence = Math.max(0, Math.min(1, baseConfidence * INCIDENT_ROOT_CAUSE_CONFIDENCE));
@@ -1676,14 +1676,14 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   if (loc) {
     let rootCauseNode = culprit;
     if (loc.fileNode) {
-      path93.push(loc.fileNode);
+      path94.push(loc.fileNode);
       edgeProvenances.push(import_types.Provenance.OBSERVED);
       rootCauseNode = loc.fileNode;
     }
     return import_types.RootCauseResultSchema.parse({
       rootCauseNode,
       rootCauseReason: loc.rootCauseReason,
-      traversalPath: path93,
+      traversalPath: path94,
       edgeProvenances,
       confidence,
       ...loc.fixRecommendation ? { fixRecommendation: loc.fixRecommendation } : {}
@@ -1695,7 +1695,7 @@ function crossServiceRootCause(graph, originId, incidents, errorEvent) {
   return import_types.RootCauseResultSchema.parse({
     rootCauseNode: culprit,
     rootCauseReason: `${culpritName} is failing downstream calls (${errs} observed error${errs === 1 ? "" : "s"})`,
-    traversalPath: path93,
+    traversalPath: path94,
     edgeProvenances,
     confidence,
     fixRecommendation: `Inspect ${culpritName}'s failing handler`
@@ -2200,10 +2200,10 @@ function enrichWithNavigation(graph, errorNodeId, tagged, incidents, now) {
     traversalPath = staleChain.path;
     edgeProvenances = staleChain.edges.map((e) => e.provenance);
   } else if (top.node !== seedNode) {
-    const path93 = findPath(graph, errorNodeId, top.node, "up", ROOT_CAUSE_MAX_DEPTH);
-    if (path93) {
-      traversalPath = path93.nodes;
-      edgeProvenances = path93.edges.map((e) => e.provenance);
+    const path94 = findPath(graph, errorNodeId, top.node, "up", ROOT_CAUSE_MAX_DEPTH);
+    if (path94) {
+      traversalPath = path94.nodes;
+      edgeProvenances = path94.edges.map((e) => e.provenance);
     } else {
       traversalPath = [errorNodeId, top.node];
       edgeProvenances = [top.provenance ?? import_types.Provenance.OBSERVED];
@@ -3651,8 +3651,8 @@ function chiRoutesFromSource(source, parser) {
   chiWalk(tree.rootNode, "", out);
   return out;
 }
-function stripChiRegex(path93) {
-  return path93.replace(/\{([^{}:]+):[^{}]*\}/g, "{$1}");
+function stripChiRegex(path94) {
+  return path94.replace(/\{([^{}:]+):[^{}]*\}/g, "{$1}");
 }
 function chiWalk(node, prefix, out) {
   for (let i = 0; i < node.namedChildCount; i++) {
@@ -4324,9 +4324,9 @@ function rubyRocketRoute(args) {
     if (!pair || pair.type !== "pair") continue;
     const k = pair.childForFieldName("key");
     if (k?.type !== "string") continue;
-    const path93 = rubyLiteral(k);
-    if (path93 === null) continue;
-    return { path: path93, target: rubyLiteral(pair.childForFieldName("value")) };
+    const path94 = rubyLiteral(k);
+    if (path94 === null) continue;
+    return { path: path94, target: rubyLiteral(pair.childForFieldName("value")) };
   }
   return null;
 }
@@ -16686,7 +16686,7 @@ var import_chokidar = __toESM(require("chokidar"), 1);
 init_cjs_shims();
 var import_fastify2 = __toESM(require("fastify"), 1);
 var import_cors = __toESM(require("@fastify/cors"), 1);
-var import_types94 = require("@neat.is/types");
+var import_types98 = require("@neat.is/types");
 
 // src/extend/index.ts
 init_cjs_shims();
@@ -19135,10 +19135,10 @@ var SUPABASE_RPC_TARGET_KIND = "supabase-rpc";
 // src/connectors/supabase/map.ts
 var REST_RPC_PATH_RE = /^\/rest\/v1\/rpc\/([^/?]+)/;
 var REST_TABLE_PATH_RE = /^\/rest\/v1\/([^/?]+)/;
-function targetFromRestPath(path93) {
-  const rpcMatch = REST_RPC_PATH_RE.exec(path93);
+function targetFromRestPath(path94) {
+  const rpcMatch = REST_RPC_PATH_RE.exec(path94);
   if (rpcMatch) return { targetKind: SUPABASE_RPC_TARGET_KIND, name: rpcMatch[1] };
-  const tableMatch = REST_TABLE_PATH_RE.exec(path93);
+  const tableMatch = REST_TABLE_PATH_RE.exec(path94);
   if (tableMatch) return { targetKind: SUPABASE_TABLE_TARGET_KIND, name: tableMatch[1] };
   return null;
 }
@@ -19742,9 +19742,9 @@ function parseFirebaseTargetName(targetName) {
   const secondSep = rest.indexOf(FIELD_SEP);
   if (secondSep === -1) return null;
   const method = rest.slice(0, secondSep);
-  const path93 = rest.slice(secondSep + 1);
-  if (!resourceName || !method || !path93) return null;
-  return { resourceName, method, path: path93 };
+  const path94 = rest.slice(secondSep + 1);
+  if (!resourceName || !method || !path94) return null;
+  return { resourceName, method, path: path94 };
 }
 function resourceNameFor(type, labels) {
   if (!labels) return null;
@@ -19782,14 +19782,14 @@ function mapLogEntryToSignal(entry2) {
   if (!req) return null;
   if (typeof req.requestMethod !== "string" || req.requestMethod.length === 0) return null;
   const method = req.requestMethod.toUpperCase();
-  const path93 = pathFromRequestUrl(req.requestUrl);
-  if (path93 === null) return null;
+  const path94 = pathFromRequestUrl(req.requestUrl);
+  if (path94 === null) return null;
   const timestamp = entry2.timestamp;
   if (typeof timestamp !== "string" || timestamp.length === 0) return null;
   const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD2;
   return {
     targetKind: resourceType,
-    targetName: packFirebaseTargetName({ resourceName, method, path: path93 }),
+    targetName: packFirebaseTargetName({ resourceName, method, path: path94 }),
     callCount: 1,
     errorCount: isError ? 1 : 0,
     lastObservedIso: timestamp
@@ -19996,7 +19996,7 @@ function mapEventToSignal(event) {
   if (Number.isNaN(observedAt.getTime())) return null;
   const statusCode = metadata?.statusCode;
   const isError = typeof statusCode === "number" && statusCode >= ERROR_STATUS_THRESHOLD3;
-  const path93 = metadata?.trigger ? parsePathFromTrigger(metadata.trigger) : void 0;
+  const path94 = metadata?.trigger ? parsePathFromTrigger(metadata.trigger) : void 0;
   return {
     targetKind: CLOUDFLARE_TARGET_KIND,
     targetName: scriptName,
@@ -20004,7 +20004,7 @@ function mapEventToSignal(event) {
     errorCount: isError ? 1 : 0,
     lastObservedIso: observedAt.toISOString(),
     method,
-    ...path93 ? { path: path93 } : {},
+    ...path94 ? { path: path94 } : {},
     ...typeof statusCode === "number" ? { statusCode } : {},
     ...typeof metadata?.duration === "number" ? { duration: metadata.duration } : {}
   };
@@ -20050,8 +20050,8 @@ function findTaggedWorkerFileNode(graph, workerName) {
   });
   return found;
 }
-function findMatchingRouteNode(graph, serviceName, method, path93) {
-  const normalizedPath = normalizePathTemplate(path93);
+function findMatchingRouteNode(graph, serviceName, method, path94) {
+  const normalizedPath = normalizePathTemplate(path94);
   let found = null;
   graph.forEachNode((id, attrs) => {
     if (found) return;
@@ -20068,10 +20068,10 @@ function createCloudflareResolveTarget(config, graph) {
   return (signal) => {
     if (signal.targetKind !== CLOUDFLARE_TARGET_KIND) return null;
     const scriptName = signal.targetName;
-    const { method, path: path93 } = signal;
+    const { method, path: path94 } = signal;
     const resolveRouteGrain = (serviceName, wholeFileId) => {
-      if (!method || !path93) return wholeFileId;
-      return findMatchingRouteNode(graph, serviceName, method, path93) ?? wholeFileId;
+      if (!method || !path94) return wholeFileId;
+      return findMatchingRouteNode(graph, serviceName, method, path94) ?? wholeFileId;
     };
     const mapping = config.workers?.[scriptName];
     if (mapping) {
@@ -20423,9 +20423,9 @@ function parseCloudRunTargetName(targetName) {
   const secondSep = rest.indexOf(FIELD_SEP2);
   if (secondSep === -1) return null;
   const method = rest.slice(0, secondSep);
-  const path93 = rest.slice(secondSep + 1);
-  if (!serviceName || !method || !path93) return null;
-  return { serviceName, method, path: path93 };
+  const path94 = rest.slice(secondSep + 1);
+  if (!serviceName || !method || !path94) return null;
+  return { serviceName, method, path: path94 };
 }
 
 // src/connectors/cloud-run/map.ts
@@ -20454,14 +20454,14 @@ function mapLogEntryToSignal2(entry2) {
   if (!req) return null;
   if (typeof req.requestMethod !== "string" || req.requestMethod.length === 0) return null;
   const method = req.requestMethod.toUpperCase();
-  const path93 = pathFromRequestUrl2(req.requestUrl);
-  if (path93 === null) return null;
+  const path94 = pathFromRequestUrl2(req.requestUrl);
+  if (path94 === null) return null;
   const timestamp = entry2.timestamp;
   if (typeof timestamp !== "string" || timestamp.length === 0) return null;
   const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD4;
   return {
     targetKind: CLOUD_RUN_TARGET_KIND,
-    targetName: packCloudRunTargetName({ serviceName, method, path: path93 }),
+    targetName: packCloudRunTargetName({ serviceName, method, path: path94 }),
     callCount: 1,
     errorCount: isError ? 1 : 0,
     lastObservedIso: timestamp
@@ -20500,14 +20500,14 @@ function createCloudRunResolveTarget(graph, config) {
     if (signal.targetKind !== CLOUD_RUN_TARGET_KIND) return null;
     const identity = parseCloudRunTargetName(signal.targetName);
     if (!identity) return null;
-    const { serviceName: gcpServiceName, method, path: path93 } = identity;
+    const { serviceName: gcpServiceName, method, path: path94 } = identity;
     const mappedService = config.serviceMap?.[gcpServiceName];
     if (mappedService) {
       const routeNodeId = findMatchingRouteNode2(
         graph,
         mappedService,
         method,
-        normalizePathTemplate(path93)
+        normalizePathTemplate(path94)
       );
       if (routeNodeId) {
         return { targetNodeId: routeNodeId, serviceName: mappedService, edgeType: import_types79.EdgeType.CALLS };
@@ -20555,9 +20555,229 @@ function createCloudRunConnector(graph, config = {}) {
   };
 }
 
+// src/connectors/gcp-lb/index.ts
+init_cjs_shims();
+
+// src/connectors/gcp-lb/client.ts
+init_cjs_shims();
+function gcpLbRequestLogName(projectId) {
+  return `projects/${projectId}/logs/requests`;
+}
+function buildGcpLbEntriesFilter(projectId, sinceIso) {
+  return [
+    `logName = "${gcpLbRequestLogName(projectId)}"`,
+    `resource.type = "${GCP_LB_RESOURCE_TYPE}"`,
+    'httpRequest.requestMethod != ""',
+    `timestamp >= "${sinceIso}"`
+  ].join(" AND ");
+}
+var GCP_LB_RESOURCE_TYPE = "http_load_balancer";
+var DEFAULT_LOOKBACK_MS3 = 24 * 60 * 60 * 1e3;
+var ENTRIES_LIST_URL3 = "https://logging.googleapis.com/v2/entries:list";
+var PAGE_SIZE3 = 1e3;
+var MAX_PAGES3 = 20;
+async function fetchGcpLbRequestLogEntries(creds, sinceIso, apiUrl = ENTRIES_LIST_URL3) {
+  const filter = buildGcpLbEntriesFilter(creds.projectId, sinceIso);
+  const out = [];
+  let pageToken;
+  for (let page = 0; page < MAX_PAGES3; page++) {
+    const body = {
+      resourceNames: [`projects/${creds.projectId}`],
+      filter,
+      orderBy: "timestamp asc",
+      pageSize: PAGE_SIZE3,
+      ...pageToken ? { pageToken } : {}
+    };
+    const res = await junctionFetch(
+      apiUrl,
+      {
+        method: "POST",
+        headers: {
+          ...bearerAuthHeader(creds.accessToken),
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify(body)
+      },
+      // accountKey: the GCP project id — one customer's Cloud Logging quota is
+      // scoped per GCP project (ADR-131's per-(provider, accountKey) rate-limit
+      // bucket), the same key Cloud Run's and Firebase's connectors use.
+      { provider: "gcp-lb", accountKey: creds.projectId }
+    );
+    if (!res.ok) {
+      throw new Error(`Cloud Logging entries.list failed: ${res.status} ${res.statusText}`);
+    }
+    const json = await res.json();
+    if (Array.isArray(json.entries)) out.push(...json.entries);
+    if (!json.nextPageToken) break;
+    pageToken = json.nextPageToken;
+  }
+  return out;
+}
+
+// src/connectors/gcp-lb/map.ts
+init_cjs_shims();
+
+// src/connectors/gcp-lb/types.ts
+init_cjs_shims();
+function readGcpLbCredentials(raw) {
+  const projectId = raw["projectId"];
+  const accessToken = raw["accessToken"];
+  if (typeof projectId !== "string" || projectId.length === 0) {
+    throw new Error("gcp-lb connector: credentials.projectId must be a non-empty string");
+  }
+  if (typeof accessToken !== "string" || accessToken.length === 0) {
+    throw new Error("gcp-lb connector: credentials.accessToken must be a non-empty string");
+  }
+  return { projectId, accessToken };
+}
+var GCP_LB_TARGET_KIND = "http_load_balancer";
+var FIELD_SEP3 = "\0";
+function packGcpLbTargetName(identity) {
+  return [identity.backendServiceName, identity.method, identity.path].join(FIELD_SEP3);
+}
+function parseGcpLbTargetName(targetName) {
+  const firstSep = targetName.indexOf(FIELD_SEP3);
+  if (firstSep === -1) return null;
+  const backendServiceName = targetName.slice(0, firstSep);
+  const rest = targetName.slice(firstSep + 1);
+  const secondSep = rest.indexOf(FIELD_SEP3);
+  if (secondSep === -1) return null;
+  const method = rest.slice(0, secondSep);
+  const path94 = rest.slice(secondSep + 1);
+  if (!backendServiceName || !method || !path94) return null;
+  return { backendServiceName, method, path: path94 };
+}
+
+// src/connectors/gcp-lb/map.ts
+var GCP_LB_RESOURCE_TYPE2 = "http_load_balancer";
+function pathFromRequestUrl3(requestUrl) {
+  if (typeof requestUrl !== "string" || requestUrl.length === 0) return null;
+  if (requestUrl.startsWith("/")) {
+    const withoutQuery = requestUrl.split("?")[0];
+    return withoutQuery && withoutQuery.length > 0 ? withoutQuery : "/";
+  }
+  try {
+    const candidate = requestUrl.startsWith("//") ? `https:${requestUrl}` : requestUrl;
+    const parsed = new URL(candidate);
+    return parsed.pathname || "/";
+  } catch {
+    return null;
+  }
+}
+var ERROR_STATUS_THRESHOLD5 = 500;
+function mapLogEntryToSignal3(entry2) {
+  if (!entry2 || typeof entry2 !== "object") return null;
+  if (entry2.resource?.type !== GCP_LB_RESOURCE_TYPE2) return null;
+  const backendServiceName = entry2.resource?.labels?.["backend_service_name"];
+  if (typeof backendServiceName !== "string" || backendServiceName.length === 0) return null;
+  const req = entry2.httpRequest;
+  if (!req) return null;
+  if (typeof req.requestMethod !== "string" || req.requestMethod.length === 0) return null;
+  const method = req.requestMethod.toUpperCase();
+  const path94 = pathFromRequestUrl3(req.requestUrl);
+  if (path94 === null) return null;
+  const timestamp = entry2.timestamp;
+  if (typeof timestamp !== "string" || timestamp.length === 0) return null;
+  const isError = typeof req.status === "number" && req.status >= ERROR_STATUS_THRESHOLD5;
+  return {
+    targetKind: GCP_LB_TARGET_KIND,
+    targetName: packGcpLbTargetName({ backendServiceName, method, path: path94 }),
+    callCount: 1,
+    errorCount: isError ? 1 : 0,
+    lastObservedIso: timestamp
+  };
+}
+function mapLogEntriesToSignals3(entries) {
+  const out = [];
+  for (const entry2 of entries) {
+    const signal = mapLogEntryToSignal3(entry2);
+    if (signal) out.push(signal);
+  }
+  return out;
+}
+
+// src/connectors/gcp-lb/resolve.ts
+init_cjs_shims();
+var import_types83 = require("@neat.is/types");
+var GCP_LB_BACKEND_INFRA_KIND = "gcp-lb-backend";
+function findMatchingRouteNode3(graph, serviceName, method, normalizedPath) {
+  let found = null;
+  graph.forEachNode((_id, attrs) => {
+    if (found) return;
+    const node = attrs;
+    if (node.type !== import_types83.NodeType.RouteNode) return;
+    const route = attrs;
+    if (route.service !== serviceName || !route.pathTemplate) return;
+    if (normalizePathTemplate(route.pathTemplate) !== normalizedPath) return;
+    const routeMethod = route.method.toUpperCase();
+    if (routeMethod !== "ALL" && routeMethod !== method) return;
+    found = route.id;
+  });
+  return found;
+}
+function createGcpLbResolveTarget(graph, config) {
+  return (signal) => {
+    if (signal.targetKind !== GCP_LB_TARGET_KIND) return null;
+    const identity = parseGcpLbTargetName(signal.targetName);
+    if (!identity) return null;
+    const { backendServiceName, method, path: path94 } = identity;
+    const mappedService = config.backendServiceMap?.[backendServiceName];
+    if (mappedService) {
+      const routeNodeId = findMatchingRouteNode3(
+        graph,
+        mappedService,
+        method,
+        normalizePathTemplate(path94)
+      );
+      if (routeNodeId) {
+        return { targetNodeId: routeNodeId, serviceName: mappedService, edgeType: import_types83.EdgeType.CALLS };
+      }
+    }
+    return {
+      targetNodeId: (0, import_types83.infraId)(GCP_LB_BACKEND_INFRA_KIND, backendServiceName),
+      serviceName: mappedService ?? backendServiceName,
+      edgeType: import_types83.EdgeType.CALLS,
+      ensureInfraNode: {
+        kind: GCP_LB_BACKEND_INFRA_KIND,
+        name: backendServiceName,
+        provider: "gcp-lb"
+      }
+    };
+  };
+}
+
+// src/connectors/gcp-lb/index.ts
+var GcpLbConnector = class {
+  constructor(config = {}) {
+    this.config = config;
+  }
+  config;
+  provider = "gcp-lb";
+  async poll(ctx) {
+    const creds = readGcpLbCredentials(ctx.credentials);
+    const maxLookbackMs = this.config.maxLookbackMs ?? DEFAULT_LOOKBACK_MS3;
+    const sinceIso = boundedSinceIso2(ctx.since, /* @__PURE__ */ new Date(), maxLookbackMs);
+    const entries = await fetchGcpLbRequestLogEntries(creds, sinceIso, this.config.apiUrl);
+    return mapLogEntriesToSignals3(entries);
+  }
+};
+function boundedSinceIso2(since, now, maxLookbackMs) {
+  const floor = new Date(now.getTime() - maxLookbackMs);
+  if (!since) return floor.toISOString();
+  const sinceMs = new Date(since).getTime();
+  if (Number.isNaN(sinceMs)) return floor.toISOString();
+  return sinceMs < floor.getTime() ? floor.toISOString() : new Date(sinceMs).toISOString();
+}
+function createGcpLbConnector(graph, config = {}) {
+  return {
+    connector: new GcpLbConnector(config),
+    resolveTarget: createGcpLbResolveTarget(graph, config)
+  };
+}
+
 // src/connectors/render/index.ts
 init_cjs_shims();
-var import_types82 = require("@neat.is/types");
+var import_types86 = require("@neat.is/types");
 
 // src/connectors/render/types.ts
 init_cjs_shims();
@@ -20635,7 +20855,7 @@ function buildRenderRouteIndex(graph, serviceName) {
   const out = [];
   graph.forEachNode((_id, attrs) => {
     const node = attrs;
-    if (node.type !== import_types82.NodeType.RouteNode) return;
+    if (node.type !== import_types86.NodeType.RouteNode) return;
     const route = attrs;
     if (route.service !== serviceName) return;
     out.push({
@@ -20720,7 +20940,7 @@ function mapRenderRequestLogsToSignals(entries, routeIndex) {
 function createRenderResolveTarget(config) {
   return (signal) => {
     if (signal.targetKind === ROUTE_TARGET_KIND2) {
-      return { targetNodeId: signal.targetName, serviceName: config.serviceName, edgeType: import_types82.EdgeType.CALLS };
+      return { targetNodeId: signal.targetName, serviceName: config.serviceName, edgeType: import_types86.EdgeType.CALLS };
     }
     return null;
   };
@@ -20858,21 +21078,21 @@ function mapInsightsToSignals(rows, observedAtIso) {
 
 // src/connectors/planetscale/resolve.ts
 init_cjs_shims();
-var import_types86 = require("@neat.is/types");
+var import_types90 = require("@neat.is/types");
 var PLANETSCALE_DATABASE_KIND = "planetscale-database";
 function createPlanetscaleResolveTarget(graph, config) {
   const databaseName = `${config.organization}/${config.database}`;
   return (signal, _ctx) => {
     if (signal.targetKind !== PLANETSCALE_SQL_TABLE_TARGET_KIND || !signal.targetName) return null;
-    const tableId = (0, import_types86.infraId)("sql-table", signal.targetName);
+    const tableId = (0, import_types90.infraId)("sql-table", signal.targetName);
     if (graph.hasNode(tableId)) {
-      return { targetNodeId: tableId, serviceName: config.serviceName, edgeType: import_types86.EdgeType.CALLS };
+      return { targetNodeId: tableId, serviceName: config.serviceName, edgeType: import_types90.EdgeType.CALLS };
     }
-    const providerId = (0, import_types86.infraId)(PLANETSCALE_DATABASE_KIND, databaseName);
+    const providerId = (0, import_types90.infraId)(PLANETSCALE_DATABASE_KIND, databaseName);
     return {
       targetNodeId: providerId,
       serviceName: config.serviceName,
-      edgeType: import_types86.EdgeType.CALLS,
+      edgeType: import_types90.EdgeType.CALLS,
       ensureInfraNode: { kind: PLANETSCALE_DATABASE_KIND, name: databaseName, provider: "planetscale" }
     };
   };
@@ -20938,13 +21158,13 @@ function isTransientFailure(err) {
   if (code && INTERNAL_ERROR_CODE.test(code)) return true;
   return false;
 }
-var FIELD_SEP3 = "\0";
+var FIELD_SEP4 = "\0";
 var EAS_TARGET_KIND = "eas-build";
 function packEasTargetName(identity) {
-  return [identity.serviceName, identity.phase].join(FIELD_SEP3);
+  return [identity.serviceName, identity.phase].join(FIELD_SEP4);
 }
 function parseEasTargetName(targetName) {
-  const sep = targetName.indexOf(FIELD_SEP3);
+  const sep = targetName.indexOf(FIELD_SEP4);
   if (sep === -1) return null;
   const serviceName = targetName.slice(0, sep);
   const phase = targetName.slice(sep + 1);
@@ -21137,7 +21357,7 @@ function mapBuildsToSignals(builds, serviceName) {
 
 // src/connectors/eas/resolve.ts
 init_cjs_shims();
-var import_types91 = require("@neat.is/types");
+var import_types95 = require("@neat.is/types");
 var NO_ENV2 = "unknown";
 var EAS_JSON_PHASES = /* @__PURE__ */ new Set(["READ_EAS_JSON"]);
 var APP_CONFIG_PHASES = /* @__PURE__ */ new Set([
@@ -21153,8 +21373,8 @@ function configBasenamesForPhase(phase) {
 function configNodeService(graph, configNodeId) {
   for (const edgeId of graph.inboundEdges(configNodeId)) {
     const edge = graph.getEdgeAttributes(edgeId);
-    if (edge.type !== import_types91.EdgeType.CONFIGURED_BY) continue;
-    const parsed = (0, import_types91.parseFileId)(edge.source);
+    if (edge.type !== import_types95.EdgeType.CONFIGURED_BY) continue;
+    const parsed = (0, import_types95.parseFileId)(edge.source);
     if (parsed) return parsed.service;
   }
   return null;
@@ -21165,7 +21385,7 @@ function findConfigNode(graph, basenames, serviceName) {
   graph.forEachNode((id, attrs) => {
     if (scoped) return;
     const node = attrs;
-    if (node.type !== import_types91.NodeType.ConfigNode) return;
+    if (node.type !== import_types95.NodeType.ConfigNode) return;
     if (typeof node.name !== "string" || !basenames.includes(node.name)) return;
     if (anyMatch === null) anyMatch = id;
     if (configNodeService(graph, id) === serviceName) scoped = id;
@@ -21182,13 +21402,13 @@ function createEasResolveTarget(graph) {
     if (basenames.length > 0) {
       const configNodeId = findConfigNode(graph, basenames, serviceName);
       if (configNodeId) {
-        return { targetNodeId: configNodeId, serviceName, edgeType: import_types91.EdgeType.CALLS };
+        return { targetNodeId: configNodeId, serviceName, edgeType: import_types95.EdgeType.CALLS };
       }
     }
     return {
       targetNodeId: resolveFusedServiceId(graph, serviceName, NO_ENV2),
       serviceName,
-      edgeType: import_types91.EdgeType.CALLS
+      edgeType: import_types95.EdgeType.CALLS
     };
   };
 }
@@ -21200,7 +21420,7 @@ function isBuildSince(build, sinceIso) {
   if (Number.isNaN(t) || Number.isNaN(s)) return true;
   return t > s;
 }
-function boundedSinceIso2(since, now, maxLookbackMs) {
+function boundedSinceIso3(since, now, maxLookbackMs) {
   const floor = new Date(now.getTime() - maxLookbackMs);
   if (!since) return floor.toISOString();
   const sinceMs = new Date(since).getTime();
@@ -21219,7 +21439,7 @@ var EasConnector = class {
     const creds = readEasCredentials(ctx.credentials);
     const serviceName = this.config.serviceName ?? this.config.appId;
     const maxLookbackMs = this.config.maxLookbackMs ?? DEFAULT_MAX_LOOKBACK_MS6;
-    const sinceIso = boundedSinceIso2(ctx.since, /* @__PURE__ */ new Date(), maxLookbackMs);
+    const sinceIso = boundedSinceIso3(ctx.since, /* @__PURE__ */ new Date(), maxLookbackMs);
     const builds = await fetchErroredBuilds(creds.token, this.config, this.fetchImpl);
     const fresh = builds.filter((b) => isBuildSince(b, sinceIso));
     const maxLogBytes = this.config.maxLogBytes ?? DEFAULT_MAX_LOG_BYTES;
@@ -21450,6 +21670,40 @@ var PROVIDER_DISPATCH = {
       });
     }
   },
+  "gcp-lb": {
+    provider: "gcp-lb",
+    // Like cloud-run, gcp-lb reads both projectId and accessToken from the
+    // credential; the single-string form maps to the secret (the token), and the
+    // required-fields check below catches a projectId that was never supplied.
+    primaryCredentialKey: "accessToken",
+    requiredCredentialFields: ["projectId", "accessToken"],
+    requiredOptionFields: [],
+    build(graph, options) {
+      return createGcpLbConnector(graph, options);
+    },
+    // POST entries:list with pageSize 1 — the exact surface poll() reads, so the
+    // probe checks the actual `logging.logEntries.list` permission the connector
+    // needs. This is the same Cloud Logging read-verdict cloud-run's validate
+    // uses (a lighter GET on logs.list would instead check `logging.logs.list`,
+    // falsely rejecting a correctly-scoped custom role carrying only
+    // `logging.logEntries.list`). A 2xx means the token can list log entries;
+    // 401/403 means the provider rejected it.
+    validate({ credentials, fetchImpl }) {
+      const projectId = String(credentials.projectId ?? "");
+      return authProbe({
+        provider: "gcp-lb",
+        accountKey: projectId || "validate",
+        url: "https://logging.googleapis.com/v2/entries:list",
+        token: String(credentials.accessToken ?? ""),
+        init: {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ resourceNames: [`projects/${projectId}`], pageSize: 1 })
+        },
+        ...fetchImpl ? { fetchImpl } : {}
+      });
+    }
+  },
   render: {
     provider: "render",
     primaryCredentialKey: "token",
@@ -21994,11 +22248,11 @@ function registerRoutes(scope, ctx) {
       const candidates = req.query.type.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
       const parsed = [];
       for (const c of candidates) {
-        const r = import_types94.DivergenceTypeSchema.safeParse(c);
+        const r = import_types98.DivergenceTypeSchema.safeParse(c);
         if (!r.success) {
           return reply.code(400).send({
             error: `unknown divergence type "${c}"`,
-            allowed: import_types94.DivergenceTypeSchema.options
+            allowed: import_types98.DivergenceTypeSchema.options
           });
         }
         parsed.push(r.data);
@@ -22360,7 +22614,7 @@ function registerRoutes(scope, ctx) {
     const log = new PolicyViolationsLog(proj.paths.policyViolationsPath);
     let violations = await log.readAll();
     if (req.query.severity) {
-      const sev = import_types94.PolicySeveritySchema.safeParse(req.query.severity);
+      const sev = import_types98.PolicySeveritySchema.safeParse(req.query.severity);
       if (!sev.success) {
         return reply.code(400).send({
           error: "invalid severity",
@@ -22399,7 +22653,7 @@ function registerRoutes(scope, ctx) {
   scope.post("/policies/check", async (req, reply) => {
     const proj = resolveProject(registry, req, reply, ctx.bootstrap, ctx.singleProject);
     if (!proj) return;
-    const parsed = import_types94.PoliciesCheckBodySchema.safeParse(req.body ?? {});
+    const parsed = import_types98.PoliciesCheckBodySchema.safeParse(req.body ?? {});
     if (!parsed.success) {
       return reply.code(400).send({
         error: "invalid /policies/check body",
@@ -22732,7 +22986,7 @@ var import_node_fs41 = require("fs");
 var import_node_path76 = __toESM(require("path"), 1);
 
 // src/daemon.ts
-var import_types95 = require("@neat.is/types");
+var import_types99 = require("@neat.is/types");
 function daemonJsonPath(scanPath) {
   return import_node_path77.default.join(scanPath, "neat-out", "daemon.json");
 }
@@ -27742,949 +27996,911 @@ async function runConnectorCommand(rawArgs, deps = {}) {
   }
 }
 
-// src/hooks-cli.ts
+// src/doctor-cli.ts
 init_cjs_shims();
-var import_node_path87 = __toESM(require("path"), 1);
-var import_node_os5 = __toESM(require("os"), 1);
 var import_node_fs52 = require("fs");
-var import_node_url5 = require("url");
-var HOOK_FILENAME = "neat-search-nudge.mjs";
-var GUIDE_FILENAME = "GRAPH_FIRST.md";
-var GUIDE_INSTALL_NAME = "neat-graph-first.md";
-var HOOK_MATCHER = "Grep|Glob|Bash";
-function moduleDir() {
-  return typeof __dirname !== "undefined" ? __dirname : import_node_path87.default.dirname((0, import_node_url5.fileURLToPath)(importMetaUrl));
-}
-async function readSkillAsset(rel) {
-  const here = moduleDir();
-  const candidates = [
-    import_node_path87.default.resolve(here, "../../claude-skill", rel),
-    import_node_path87.default.resolve(here, "../../../claude-skill", rel),
-    import_node_path87.default.resolve(here, "../claude-skill", rel)
-  ];
-  for (const candidate of candidates) {
-    try {
-      return await import_node_fs52.promises.readFile(candidate, "utf8");
-    } catch {
-    }
-  }
-  throw new Error(
-    `neat hooks: could not find @neat.is/claude-skill/${rel} \u2014 is the package installed?`
-  );
-}
-function neatHome3() {
-  const override = process.env.NEAT_HOME;
-  if (override && override.length > 0) return import_node_path87.default.resolve(override);
-  return import_node_path87.default.join(import_node_os5.default.homedir(), ".neat");
-}
-function claudeSettingsPath() {
-  const override = process.env.NEAT_CLAUDE_SETTINGS;
-  if (override && override.length > 0) return import_node_path87.default.resolve(override);
-  const home = process.env.HOME ?? process.env.USERPROFILE ?? import_node_os5.default.homedir();
-  return import_node_path87.default.join(home, ".claude", "settings.json");
-}
-function installedHookPath() {
-  return import_node_path87.default.join(neatHome3(), "hooks", HOOK_FILENAME);
-}
-function gateFlagPath() {
-  return import_node_path87.default.join(neatHome3(), "hooks", "gate-enabled");
-}
-function isNeatSearchEntry(entry2) {
-  return (entry2.hooks ?? []).some(
-    (h) => typeof h.command === "string" && h.command.includes(HOOK_FILENAME)
-  );
-}
-function neatHookEntry(command) {
-  return { matcher: HOOK_MATCHER, hooks: [{ type: "command", command }] };
-}
-function hookCommand(scriptPath) {
-  return `node "${scriptPath}"`;
-}
-async function runHooks(opts) {
-  if (opts.printHook) {
-    process.stdout.write(await readSkillAsset(`hooks/${HOOK_FILENAME}`));
-    return { exitCode: 0 };
-  }
-  if (opts.printGuide) {
-    process.stdout.write(await readSkillAsset(GUIDE_FILENAME));
-    return { exitCode: 0 };
+var import_node_path87 = __toESM(require("path"), 1);
+
+// src/cli-client.ts
+init_cjs_shims();
+var import_types100 = require("@neat.is/types");
+var HttpError = class extends Error {
+  constructor(status2, message, responseBody = "") {
+    super(message);
+    this.status = status2;
+    this.responseBody = responseBody;
+    this.name = "HttpError";
   }
-  if (opts.printSettings) {
-    const block = {
-      hooks: { PreToolUse: [neatHookEntry(hookCommand(installedHookPath()))] }
-    };
-    process.stdout.write(JSON.stringify(block, null, 2) + "\n");
-    return { exitCode: 0 };
+  status;
+  responseBody;
+};
+var TransportError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TransportError";
   }
-  if (opts.apply) {
-    const hookScript = await readSkillAsset(`hooks/${HOOK_FILENAME}`);
-    const guide = await readSkillAsset(GUIDE_FILENAME);
-    const scriptPath = installedHookPath();
-    await import_node_fs52.promises.mkdir(import_node_path87.default.dirname(scriptPath), { recursive: true });
-    await import_node_fs52.promises.writeFile(scriptPath, hookScript, { mode: 493 });
-    const guidePath = import_node_path87.default.join(neatHome3(), GUIDE_INSTALL_NAME);
-    await import_node_fs52.promises.writeFile(guidePath, guide, "utf8");
-    const settingsFile = claudeSettingsPath();
-    let settings = {};
-    try {
-      settings = JSON.parse(await import_node_fs52.promises.readFile(settingsFile, "utf8"));
-    } catch (err) {
-      if (err.code !== "ENOENT") {
-        console.error(
-          `neat hooks: failed to read ${settingsFile} \u2014 ${err.message}`
+};
+function resolveAuthToken(env = process.env) {
+  const t = env.NEAT_AUTH_TOKEN;
+  return t && t.length > 0 ? t : void 0;
+}
+function createHttpClient(baseUrl, bearerToken) {
+  const root = baseUrl.replace(/\/$/, "");
+  const authHeader = bearerToken && bearerToken.length > 0 ? { authorization: `Bearer ${bearerToken}` } : {};
+  return {
+    async get(path94) {
+      let res;
+      try {
+        res = await fetch(`${root}${path94}`, {
+          headers: { ...authHeader }
+        });
+      } catch (err) {
+        throw new TransportError(
+          `cannot reach neat-core at ${root}: ${err.message}`
         );
-        return { exitCode: 1 };
       }
+      if (!res.ok) {
+        const body = await res.text().catch(() => "");
+        throw new HttpError(
+          res.status,
+          `${res.status} ${res.statusText} on GET ${path94}: ${body}`,
+          body
+        );
+      }
+      return await res.json();
+    },
+    async post(path94, body) {
+      let res;
+      try {
+        res = await fetch(`${root}${path94}`, {
+          method: "POST",
+          headers: { "content-type": "application/json", ...authHeader },
+          body: JSON.stringify(body)
+        });
+      } catch (err) {
+        throw new TransportError(
+          `cannot reach neat-core at ${root}: ${err.message}`
+        );
+      }
+      if (!res.ok) {
+        const text = await res.text().catch(() => "");
+        throw new HttpError(
+          res.status,
+          `${res.status} ${res.statusText} on POST ${path94}: ${text}`,
+          text
+        );
+      }
+      return await res.json();
     }
-    const hooks = settings.hooks ?? {};
-    const preToolUse = Array.isArray(hooks.PreToolUse) ? [...hooks.PreToolUse] : [];
-    const command = hookCommand(scriptPath);
-    const existingIdx = preToolUse.findIndex(isNeatSearchEntry);
-    if (existingIdx >= 0) {
-      preToolUse[existingIdx] = neatHookEntry(command);
-    } else {
-      preToolUse.push(neatHookEntry(command));
-    }
-    const merged = {
-      ...settings,
-      hooks: { ...hooks, PreToolUse: preToolUse }
+  };
+}
+function projectPath(project, suffix) {
+  if (!project) return suffix;
+  return `/projects/${encodeURIComponent(project)}${suffix}`;
+}
+async function runRootCause(client, input) {
+  const qs = input.errorId ? `?errorId=${encodeURIComponent(input.errorId)}` : "";
+  const path94 = projectPath(
+    input.project,
+    `/graph/root-cause/${encodeURIComponent(input.errorNode)}${qs}`
+  );
+  try {
+    const result = await client.get(path94);
+    const arrowPath = result.traversalPath.join(" \u2190 ");
+    const provenances = result.edgeProvenances.length ? result.edgeProvenances.join(", ") : "(direct, no edges traversed)";
+    const summary = `Root cause for ${input.errorNode} is ${result.rootCauseNode}. ` + result.rootCauseReason + (result.fixRecommendation ? ` Recommended fix: ${result.fixRecommendation}.` : "");
+    const blockLines = [
+      `Traversal path: ${arrowPath}`,
+      `Edge provenances: ${provenances}`
+    ];
+    if (result.fixRecommendation) blockLines.push(`Recommended fix: ${result.fixRecommendation}`);
+    return {
+      summary,
+      block: blockLines.join("\n"),
+      confidence: result.confidence,
+      provenance: result.edgeProvenances.length ? result.edgeProvenances : void 0
     };
-    await import_node_fs52.promises.mkdir(import_node_path87.default.dirname(settingsFile), { recursive: true });
-    await import_node_fs52.promises.writeFile(settingsFile, JSON.stringify(merged, null, 2) + "\n", "utf8");
-    const flag = gateFlagPath();
-    if (opts.gate) {
-      await import_node_fs52.promises.mkdir(import_node_path87.default.dirname(flag), { recursive: true });
-      await import_node_fs52.promises.writeFile(flag, "1\n", "utf8");
-    } else {
-      await import_node_fs52.promises.rm(flag, { force: true });
-    }
-    const mode = opts.gate ? "GATE (deny search until you ask the graph)" : "nudge (search still runs)";
-    console.log(`neat hooks: installed the search hook in ${opts.gate ? "gate" : "nudge"} mode`);
-    console.log(`  script:   ${scriptPath}`);
-    console.log(`  settings: ${settingsFile} (PreToolUse \u2192 ${HOOK_MATCHER})`);
-    console.log(`  guidance: ${guidePath}`);
-    console.log(`  mode:     ${mode}`);
-    console.log("");
-    if (opts.gate) {
-      console.log("restart Claude Code to load the hook. A Grep/Glob or Bash grep is now DENIED");
-      console.log('until you run `neat ask "<question>"` (or the ask MCP tool) once this session;');
-      console.log("after that, search is allowed as a fallback. Set NEAT_SEARCH_GATE=0 to fall");
-      console.log("back to nudge-only without re-running.");
-    } else {
-      console.log("restart Claude Code to load the hook. On a Grep/Glob or a Bash grep,");
-      console.log("your agent will now be nudged to query NEAT first (the search still runs).");
-      console.log("Re-run with --gate to hard-force the graph-first orientation.");
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 404) {
+      return {
+        summary: `No root cause found for ${input.errorNode}. The node may be healthy, or it may not exist in the graph.`
+      };
     }
-    console.log("");
-    console.log("The hook is Claude-Code-specific. For agents on other harnesses, paste");
-    console.log(`the guidance above into your project instructions (CLAUDE.md / AGENTS.md).`);
-    return { exitCode: 0 };
+    throw err;
   }
-  usage();
-  return { exitCode: 0 };
-}
-function usage() {
-  console.log("neat hooks \u2014 wire NEAT into your agent so it queries the graph before grepping");
-  console.log("");
-  console.log("  --apply          install the Claude Code search hook and write the");
-  console.log("                   graph-first guidance to ~/.neat/, merging into");
-  console.log("                   ~/.claude/settings.json without touching your other hooks");
-  console.log("  --gate           with --apply, enable hard-gate mode: DENY Grep/Glob/grep-Bash");
-  console.log("                   until `neat ask` has run this session (default is nudge-only).");
-  console.log("                   Toggle off at run time with NEAT_SEARCH_GATE=0.");
-  console.log("  --print-hook     print the hook script to stdout");
-  console.log("  --print-guide    print the agent-agnostic graph-first guidance to stdout");
-  console.log("  --print-settings print the settings.json PreToolUse block --apply would add");
-  console.log("");
-  console.log("By default the hook is a gentle, non-blocking nudge \u2014 searches still run.");
-  console.log("--gate turns it into a hard forcing mechanism. It is Claude-Code-specific;");
-  console.log("other harnesses get the same steer from the graph-first guidance.");
 }
-async function runHooksCommand(args) {
-  const opts = {
-    apply: false,
-    printHook: false,
-    printGuide: false,
-    printSettings: false,
-    gate: false
-  };
-  for (const arg of args) {
-    switch (arg) {
-      case "--apply":
-        opts.apply = true;
-        break;
-      case "--gate":
-        opts.gate = true;
-        break;
-      case "--print-hook":
-        opts.printHook = true;
-        break;
-      case "--print-guide":
-        opts.printGuide = true;
-        break;
-      case "--print-settings":
-        opts.printSettings = true;
-        break;
-      case "-h":
-      case "--help":
-        usage();
-        return 0;
-      default:
-        console.error(`neat hooks: unknown flag "${arg}"`);
-        usage();
-        return 2;
+async function runBlastRadius(client, input) {
+  const qs = input.depth !== void 0 ? `?depth=${input.depth}` : "";
+  const path94 = projectPath(
+    input.project,
+    `/graph/blast-radius/${encodeURIComponent(input.nodeId)}${qs}`
+  );
+  try {
+    const result = await client.get(path94);
+    if (result.totalAffected === 0) {
+      return {
+        summary: `${result.origin} has no dependents. Nothing else would break if it failed.`
+      };
+    }
+    const sorted = [...result.affectedNodes].sort(
+      (a, b) => a.distance - b.distance || a.nodeId.localeCompare(b.nodeId)
+    );
+    const blockLines = sorted.map(formatBlastEntry);
+    const minConfidence = sorted.reduce(
+      (m, n) => Math.min(m, n.confidence),
+      Number.POSITIVE_INFINITY
+    );
+    const provenances = [...new Set(sorted.map((n) => n.edgeProvenance))];
+    return {
+      summary: `Blast radius for ${result.origin}: ${result.totalAffected} dependent node${result.totalAffected === 1 ? "" : "s"} would break if it changed.`,
+      block: blockLines.join("\n"),
+      confidence: Number.isFinite(minConfidence) ? minConfidence : void 0,
+      provenance: provenances.length ? provenances : void 0
+    };
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 404) {
+      return { summary: `Node ${input.nodeId} not found in the graph.` };
     }
+    throw err;
   }
+}
+function formatBlastEntry(n) {
+  const tag = n.edgeProvenance === import_types100.Provenance.STALE ? " [STALE \u2014 last seen too long ago]" : "";
+  return `  \u2022 ${n.nodeId} (distance ${n.distance}, ${n.edgeProvenance})${tag}`;
+}
+async function runDependencies(client, input) {
+  const depth = input.depth ?? 3;
+  const path94 = projectPath(
+    input.project,
+    `/graph/dependencies/${encodeURIComponent(input.nodeId)}?depth=${depth}`
+  );
   try {
-    const { exitCode } = await runHooks(opts);
-    return exitCode;
+    const result = await client.get(path94);
+    if (result.total === 0) {
+      return {
+        summary: depth === 1 ? `${input.nodeId} has no direct dependencies in the graph.` : `${input.nodeId} has no dependencies (BFS to depth ${depth}).`
+      };
+    }
+    const byDistance = /* @__PURE__ */ new Map();
+    for (const dep of result.dependencies) {
+      const ring = byDistance.get(dep.distance) ?? [];
+      ring.push(dep);
+      byDistance.set(dep.distance, ring);
+    }
+    const blockLines = [];
+    for (const distance of [...byDistance.keys()].sort((a, b) => a - b)) {
+      const label = distance === 1 ? "Direct (distance 1)" : `Distance ${distance}`;
+      blockLines.push(`${label}:`);
+      for (const dep of byDistance.get(distance)) {
+        blockLines.push(`  \u2022 ${dep.nodeId} \u2014 ${dep.edgeType} (${dep.provenance})`);
+      }
+    }
+    const provenances = [...new Set(result.dependencies.map((d) => d.provenance))];
+    const directCount = byDistance.get(1)?.length ?? 0;
+    const summary = depth === 1 ? `${input.nodeId} has ${directCount} direct dependenc${directCount === 1 ? "y" : "ies"}.` : `${input.nodeId} has ${result.total} dependenc${result.total === 1 ? "y" : "ies"} reachable to depth ${depth} (${directCount} direct).`;
+    return { summary, block: blockLines.join("\n"), provenance: provenances };
   } catch (err) {
-    console.error(err.message);
-    return 1;
+    if (err instanceof HttpError && err.status === 404) {
+      return { summary: `Node ${input.nodeId} not found in the graph.` };
+    }
+    throw err;
   }
 }
-
-// src/claude-cli.ts
-init_cjs_shims();
-var import_node_path88 = __toESM(require("path"), 1);
-var import_node_fs53 = require("fs");
-var NEAT_SECTION_HEADING = "## neat";
-var NEAT_DIRECTIVE_BODY = `This project has NEAT wired in: a live, fused semantic graph of the system \u2014
-code and runtime behaviour (OpenTelemetry) in one model, every fact tagged with
-its provenance (EXTRACTED / OBSERVED / INFERRED / STALE) and a confidence.
-
-For ANY question about this system's behaviour, dependencies, failures, root
-cause, or blast radius, call \`neat ask\` FIRST \u2014 before Read, Grep, Glob, or Bash:
-
-    neat ask "why is checkout failing?"
-    neat ask "what breaks if I change the orders table?"
-    neat ask "what does the payments service depend on at runtime?"
-
-\`ask\` resolves your question to graph nodes and routes it to the right traversal
-\u2014 root cause, dependencies, observed runtime calls, incidents, divergences,
-blast radius \u2014 and returns one compact, provenance-tagged answer. The same door
-is the \`ask\` MCP tool (\`mcp__neat__ask\`) when NEAT's MCP server is wired in.
-
-The graph is live and fused: it is faster and more accurate than scanning files,
-and it can tell you what the system actually does at runtime, not only what the
-source declares. Fall back to Read/Grep only when the graph does not have what
-you need \u2014 comments, string literals, config minutiae. Ask the graph first,
-then scan.
-
-If \`neat ask\` errors, the daemon may not be running (\`neat list\`) \u2014 start it
-with \`neat <path>\`, then re-ask.`;
-function neatSection() {
-  return `${NEAT_SECTION_HEADING}
-
-${NEAT_DIRECTIVE_BODY}
-`;
-}
-function claudeMdPath() {
-  const override = process.env.NEAT_CLAUDE_MD;
-  if (override && override.length > 0) return import_node_path88.default.resolve(override);
-  return import_node_path88.default.join(process.cwd(), "CLAUDE.md");
+function observedDepLine(nodeId, e) {
+  const via = e.source !== nodeId ? ` (via ${e.source})` : "";
+  return `  \u2022 ${e.target} \u2014 ${e.type}${via}${edgeMeta(e)}`;
 }
-function splitAroundSection(raw) {
-  const lines = raw.split("\n");
-  const startIdx = lines.findIndex((l) => l.replace(/\s+$/, "") === NEAT_SECTION_HEADING);
-  if (startIdx === -1) {
-    return { before: raw.replace(/\n*$/, ""), after: "", found: false };
+async function runObservedDependencies(client, input) {
+  try {
+    const result = await client.get(
+      projectPath(
+        input.project,
+        `/graph/observed-dependencies/${encodeURIComponent(input.nodeId)}`
+      )
+    );
+    if (result.dependencies.length === 0) {
+      if (result.observed) {
+        return {
+          summary: `${input.nodeId} makes no outbound runtime calls, but OTel has observed it receiving traffic on ${result.inboundObservedCount} inbound call path${result.inboundObservedCount === 1 ? "" : "s"} \u2014 it's a pure receiver.`,
+          provenance: import_types100.Provenance.OBSERVED
+        };
+      }
+      const note = result.hasExtractedOutbound ? " Static (EXTRACTED) dependencies exist but no runtime traffic has been seen \u2014 is OTel running?" : "";
+      return { summary: `No OBSERVED dependencies for ${input.nodeId}.${note}` };
+    }
+    const blockLines = result.dependencies.map((e) => observedDepLine(input.nodeId, e));
+    return {
+      summary: `${input.nodeId} has ${result.dependencies.length} runtime dependenc${result.dependencies.length === 1 ? "y" : "ies"} confirmed by OTel.`,
+      block: blockLines.join("\n"),
+      provenance: import_types100.Provenance.OBSERVED
+    };
+  } catch (err) {
+    if (err instanceof HttpError && err.status === 404) {
+      return { summary: `Node ${input.nodeId} not found in the graph.` };
+    }
+    throw err;
   }
-  let endIdx = lines.length;
-  for (let i = startIdx + 1; i < lines.length; i++) {
-    if (/^#{1,2}\s+/.test(lines[i] ?? "")) {
-      endIdx = i;
-      break;
+}
+function edgeMeta(e) {
+  const bits = [];
+  if (e.signal) {
+    bits.push(`spans=${e.signal.spanCount}`);
+    if (e.signal.errorCount > 0) bits.push(`errors=${e.signal.errorCount}`);
+    if (e.signal.lastObservedAgeMs !== void 0) {
+      bits.push(`age=${formatDuration(e.signal.lastObservedAgeMs)}`);
     }
+  } else if (e.callCount !== void 0) {
+    bits.push(`callCount=${e.callCount}`);
   }
-  const before = lines.slice(0, startIdx).join("\n").replace(/\n*$/, "");
-  const after = lines.slice(endIdx).join("\n").replace(/^\n*/, "");
-  return { before, after, found: true };
+  if (e.lastObserved) bits.push(`lastObserved=${e.lastObserved}`);
+  if (e.confidence !== void 0) bits.push(`confidence=${e.confidence}`);
+  return bits.length ? ` [${bits.join(", ")}]` : "";
 }
-function compose(before, after) {
-  const parts = [];
-  if (before.length > 0) parts.push(before);
-  parts.push(neatSection().replace(/\n+$/, ""));
-  if (after.length > 0) parts.push(after);
-  return parts.join("\n\n").replace(/\n*$/, "") + "\n";
+function formatDuration(ms) {
+  if (ms < 1e3) return `${Math.round(ms)}ms`;
+  const s = Math.round(ms / 1e3);
+  if (s < 60) return `${s}s`;
+  const m = Math.round(s / 60);
+  if (m < 60) return `${m}m`;
+  const h = Math.round(m / 60);
+  if (h < 48) return `${h}h`;
+  return `${Math.round(h / 24)}d`;
 }
-async function readIfExists2(file) {
+async function runIncidents(client, input) {
+  const path94 = input.nodeId ? projectPath(input.project, `/incidents/${encodeURIComponent(input.nodeId)}`) : projectPath(input.project, "/incidents");
   try {
-    return await import_node_fs53.promises.readFile(file, "utf8");
+    const body = await client.get(path94);
+    const events = body.events;
+    if (events.length === 0) {
+      return {
+        summary: input.nodeId ? `No incidents recorded against ${input.nodeId}.` : "No incidents recorded."
+      };
+    }
+    const ordered = [...events].reverse().slice(0, input.limit ?? 20);
+    const blockLines = [];
+    for (const ev of ordered) {
+      blockLines.push(`  ${ev.timestamp} \u2014 ${ev.service}: ${ev.errorMessage}`);
+      blockLines.push(`    trace=${ev.traceId} span=${ev.spanId}`);
+    }
+    const target = input.nodeId ?? "the project";
+    return {
+      summary: `${target} has ${body.total} recorded incident${body.total === 1 ? "" : "s"}; showing the ${ordered.length} most recent.`,
+      block: blockLines.join("\n"),
+      provenance: import_types100.Provenance.OBSERVED
+    };
   } catch (err) {
-    if (err.code === "ENOENT") return null;
+    if (err instanceof HttpError && err.status === 404) {
+      return { summary: `Node ${input.nodeId ?? ""} not found in the graph.` };
+    }
     throw err;
   }
 }
-async function runInstall() {
-  const file = claudeMdPath();
-  const raw = await readIfExists2(file) ?? "";
-  const { before, after, found } = splitAroundSection(raw);
-  const next = compose(before, after);
-  await import_node_fs53.promises.mkdir(import_node_path88.default.dirname(file), { recursive: true });
-  await import_node_fs53.promises.writeFile(file, next, "utf8");
-  const verb = raw.length === 0 ? "created" : found ? "refreshed" : "added";
-  console.log(`neat claude: ${verb} the \`${NEAT_SECTION_HEADING}\` section in ${file}`);
-  console.log("Your agent will now reach for `neat ask` before Read/Grep/Bash. Restart the");
-  console.log("session (or reload CLAUDE.md) to pick it up.");
-  return { exitCode: 0 };
-}
-async function runUninstall() {
-  const file = claudeMdPath();
-  const raw = await readIfExists2(file);
-  if (raw === null) {
-    console.log(`neat claude: no CLAUDE.md at ${file} \u2014 nothing to remove.`);
-    return { exitCode: 0 };
+async function runSearch(client, input) {
+  const result = await client.get(
+    projectPath(input.project, `/search?q=${encodeURIComponent(input.query)}`)
+  );
+  if (result.matches.length === 0) {
+    return { summary: `No matches for "${input.query}".` };
   }
-  const { before, after, found } = splitAroundSection(raw);
-  if (!found) {
-    console.log(`neat claude: no \`${NEAT_SECTION_HEADING}\` section in ${file} \u2014 nothing to remove.`);
-    return { exitCode: 0 };
+  const provider = result.provider ?? "substring";
+  const blockLines = [];
+  let topScore;
+  for (const n of result.matches) {
+    const score = provider !== "substring" && typeof n.score === "number" ? n.score : void 0;
+    const scoreBit = score !== void 0 ? ` [score=${score.toFixed(2)}]` : "";
+    if (score !== void 0 && (topScore === void 0 || score > topScore)) topScore = score;
+    blockLines.push(
+      `  \u2022 ${n.id} (${n.type}) \u2014 ${n.name ?? n.id}${scoreBit}`
+    );
   }
-  const remaining = [before, after].filter((s) => s.length > 0).join("\n\n");
-  const next = remaining.length > 0 ? remaining.replace(/\n*$/, "") + "\n" : "";
-  await import_node_fs53.promises.writeFile(file, next, "utf8");
-  console.log(`neat claude: removed the \`${NEAT_SECTION_HEADING}\` section from ${file}.`);
-  return { exitCode: 0 };
-}
-function usage2() {
-  console.log("neat claude \u2014 make the query-first directive always-on in Claude Code");
-  console.log("");
-  console.log("  install     write (or refresh) a `## neat` section in ./CLAUDE.md so your");
-  console.log("              agent reaches for `neat ask` before Read/Grep/Bash");
-  console.log("  uninstall   remove the `## neat` section from ./CLAUDE.md");
-  console.log("  print       print the directive block to stdout (for a manual paste)");
-  console.log("");
-  console.log("Idempotent: re-running install replaces its own section, never duplicates it.");
-  console.log("Target file overridable via NEAT_CLAUDE_MD.");
+  return {
+    summary: `Found ${result.matches.length} match${result.matches.length === 1 ? "" : "es"} for "${input.query}" via ${provider} provider.`,
+    block: blockLines.join("\n"),
+    confidence: topScore
+  };
 }
-async function runClaudeCommand(args) {
-  const sub = args[0];
-  if (sub === "-h" || sub === "--help" || sub === void 0) {
-    usage2();
-    return sub === void 0 ? 2 : 0;
+async function runDiff(client, input) {
+  const result = await client.get(
+    projectPath(
+      input.project,
+      `/graph/diff?against=${encodeURIComponent(input.againstSnapshot)}`
+    )
+  );
+  const total = result.added.nodes.length + result.added.edges.length + result.removed.nodes.length + result.removed.edges.length + result.changed.nodes.length + result.changed.edges.length;
+  const baseLabel = result.base.exportedAt ?? "unknown";
+  if (total === 0) {
+    return {
+      summary: `No differences between the current graph and ${input.againstSnapshot} (base exportedAt=${baseLabel}).`
+    };
   }
-  try {
-    switch (sub) {
-      case "install":
-        return (await runInstall()).exitCode;
-      case "uninstall":
-        return (await runUninstall()).exitCode;
-      case "print":
-        process.stdout.write(neatSection());
-        return 0;
-      default:
-        console.error(`neat claude: unknown subcommand "${sub}"`);
-        usage2();
-        return 2;
+  const blockLines = [
+    `  base exportedAt:    ${baseLabel}`,
+    `  current exportedAt: ${result.current.exportedAt}`,
+    ""
+  ];
+  if (result.added.nodes.length || result.added.edges.length) {
+    blockLines.push("Added:");
+    for (const n of result.added.nodes) blockLines.push(`  + node ${n.id} (${n.type})`);
+    for (const e of result.added.edges)
+      blockLines.push(`  + edge ${e.id} \u2014 ${e.source} -> ${e.target} (${e.type}, ${e.provenance})`);
+    blockLines.push("");
+  }
+  if (result.removed.nodes.length || result.removed.edges.length) {
+    blockLines.push("Removed:");
+    for (const n of result.removed.nodes) blockLines.push(`  - node ${n.id} (${n.type})`);
+    for (const e of result.removed.edges)
+      blockLines.push(`  - edge ${e.id} \u2014 ${e.source} -> ${e.target} (${e.type}, ${e.provenance})`);
+    blockLines.push("");
+  }
+  if (result.changed.nodes.length || result.changed.edges.length) {
+    blockLines.push("Changed:");
+    for (const c of result.changed.nodes) {
+      blockLines.push(`  ~ node ${c.id} \u2014 ${summariseAttrDiff(c.before, c.after)}`);
+    }
+    for (const c of result.changed.edges) {
+      const provBit = c.before.provenance !== c.after.provenance ? `provenance ${c.before.provenance} \u2192 ${c.after.provenance}` : summariseAttrDiff(c.before, c.after);
+      blockLines.push(`  ~ edge ${c.id} \u2014 ${provBit}`);
     }
-  } catch (err) {
-    console.error(`neat claude: ${err.message}`);
-    return 1;
   }
+  return {
+    summary: `Diff against ${input.againstSnapshot}: ${total} change${total === 1 ? "" : "s"} between the snapshot and the live graph.`,
+    block: blockLines.join("\n").trimEnd()
+  };
 }
-
-// src/codex-cli.ts
-init_cjs_shims();
-var import_node_path89 = __toESM(require("path"), 1);
-var import_node_os6 = __toESM(require("os"), 1);
-var import_node_fs54 = require("fs");
-var import_node_util = require("util");
-var import_smol_toml6 = require("smol-toml");
-var CODEX_MCP_SERVER = {
-  command: "npx",
-  args: ["-y", "@neat.is/mcp"],
-  env: { NEAT_CORE_URL: "http://localhost:8080" }
-};
-var CODEX_NEAT_BLOCK = [
-  "[mcp_servers.neat]",
-  'command = "npx"',
-  'args = ["-y", "@neat.is/mcp"]',
-  'env = { NEAT_CORE_URL = "http://localhost:8080" }'
-].join("\n");
-var NEAT_GRAPH_FIRST_START = "<!-- neat:graph-first -->";
-var NEAT_GRAPH_FIRST_END = "<!-- /neat:graph-first -->";
-function codexConfigPath() {
-  const override = process.env.NEAT_CODEX_CONFIG;
-  if (override && override.length > 0) return import_node_path89.default.resolve(override);
-  const home = process.env.HOME ?? process.env.USERPROFILE ?? import_node_os6.default.homedir();
-  return import_node_path89.default.join(home, ".codex", "config.toml");
-}
-function agentsFilePath() {
-  const override = process.env.NEAT_CODEX_AGENTS;
-  if (override && override.length > 0) return import_node_path89.default.resolve(override);
-  return import_node_path89.default.join(process.cwd(), "AGENTS.md");
-}
-function isTableHeader(line) {
-  return /^\s*\[\[?[^\]]+\]\]?\s*$/.test(line);
-}
-function tableName(line) {
-  return line.trim().replace(/^\[\[?/, "").replace(/\]\]?$/, "").trim();
-}
-function isNeatHeader(line) {
-  return isTableHeader(line) && tableName(line) === "mcp_servers.neat";
+function summariseAttrDiff(before, after) {
+  const keys = /* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(after)]);
+  const changed = [];
+  for (const k of keys) {
+    if (JSON.stringify(before[k]) !== JSON.stringify(after[k])) changed.push(k);
+  }
+  return changed.length === 0 ? "attributes differ" : `fields changed: ${changed.sort().join(", ")}`;
 }
-function isNeatChildHeader(line) {
-  if (!isTableHeader(line)) return false;
-  const name = tableName(line);
-  return name === "mcp_servers.neat" || name.startsWith("mcp_servers.neat.");
+async function runStaleEdges(client, input) {
+  const params = new URLSearchParams();
+  if (input.limit !== void 0) params.set("limit", String(input.limit));
+  if (input.edgeType) params.set("edgeType", input.edgeType);
+  const qs = params.size > 0 ? `?${params.toString()}` : "";
+  const body = await client.get(
+    projectPath(input.project, `/stale-events${qs}`)
+  );
+  const events = body.events;
+  if (events.length === 0) {
+    return {
+      summary: input.edgeType ? `No stale ${input.edgeType} edges recorded.` : "No stale-edge transitions recorded yet."
+    };
+  }
+  const blockLines = events.map(
+    (e) => `  ${e.transitionedAt} \u2014 ${e.source} -[${e.edgeType}]-> ${e.target} (last seen ${e.lastObserved}, threshold ${formatDuration(e.thresholdMs)})`
+  );
+  return {
+    summary: `${events.length} stale-edge transition${events.length === 1 ? "" : "s"} recorded${input.edgeType ? ` for ${input.edgeType}` : ""}.`,
+    block: blockLines.join("\n"),
+    provenance: import_types100.Provenance.STALE
+  };
 }
-function upsertCodexConfig(raw) {
-  const trimmed = raw.trim();
-  const parsed = trimmed.length > 0 ? (0, import_smol_toml6.parse)(raw) : {};
-  const existingServers = parsed.mcp_servers ?? {};
-  const spliced = spliceNeatBlock(raw);
-  let text;
-  if (verifyPreserved(raw, spliced, parsed)) {
-    text = spliced;
+async function runPolicies(client, input) {
+  let violations;
+  let allowed = true;
+  let hypothetical;
+  if (input.hypotheticalAction) {
+    if (typeof client.post !== "function") {
+      throw new Error("HttpClient does not support POST \u2014 required for policies dry-run");
+    }
+    const body = await client.post(
+      projectPath(input.project, "/policies/check"),
+      { hypotheticalAction: input.hypotheticalAction }
+    );
+    violations = body.violations;
+    allowed = body.allowed;
+    hypothetical = body.hypotheticalAction;
   } else {
-    const merged = {
-      ...parsed,
-      mcp_servers: { ...existingServers, neat: CODEX_MCP_SERVER }
+    const params = new URLSearchParams();
+    if (input.policyId) params.set("policyId", input.policyId);
+    const qs = params.size > 0 ? `?${params.toString()}` : "";
+    const body = await client.get(
+      projectPath(input.project, `/policies/violations${qs}`)
+    );
+    violations = body.violations;
+    allowed = violations.every((v) => v.onViolation !== "block");
+  }
+  if (input.nodeId) {
+    violations = violations.filter(
+      (v) => v.subject.nodeId === input.nodeId || v.subject.path?.includes(input.nodeId)
+    );
+  }
+  if (violations.length === 0) {
+    return {
+      summary: hypothetical ? `No violations would result from the hypothetical action (${hypothetical.kind}).` : "No policy violations recorded."
     };
-    text = (0, import_smol_toml6.stringify)(merged);
-    if (!text.endsWith("\n")) text += "\n";
   }
-  return { text, changed: text !== raw };
-}
-function spliceNeatBlock(raw) {
-  const block = CODEX_NEAT_BLOCK;
-  const lines = raw.length > 0 ? raw.split("\n") : [];
-  const start = lines.findIndex(isNeatHeader);
-  if (start === -1) {
-    const base = raw.replace(/\n+$/, "");
-    return base.length > 0 ? `${base}
-
-${block}
-` : `${block}
-`;
+  const blockCount = violations.filter((v) => v.onViolation === "block").length;
+  const summaryParts = [];
+  if (hypothetical) {
+    summaryParts.push(
+      `Hypothetical ${hypothetical.kind} would surface ${violations.length} violation${violations.length === 1 ? "" : "s"}`
+    );
+  } else {
+    summaryParts.push(
+      `${violations.length} policy violation${violations.length === 1 ? "" : "s"} currently recorded`
+    );
   }
-  let end = start + 1;
-  for (; ; ) {
-    while (end < lines.length && !isTableHeader(lines[end])) end++;
-    if (end < lines.length && isNeatChildHeader(lines[end])) {
-      end++;
-      continue;
+  if (blockCount > 0) summaryParts.push(`${blockCount} of which block`);
+  if (!allowed && hypothetical) summaryParts.push("action denied");
+  const summary = summaryParts.join("; ") + ".";
+  const blockLines = violations.map((v) => {
+    const subject = v.subject.nodeId ?? v.subject.edgeId ?? v.subject.path?.[0] ?? "(global)";
+    return `  \u2022 [${v.severity}/${v.onViolation}] ${v.policyName}: ${v.message} \u2014 ${subject}`;
+  });
+  const severities = [...new Set(violations.map((v) => v.severity))];
+  return {
+    summary,
+    block: blockLines.join("\n"),
+    confidence: hypothetical ? 0.7 : 1,
+    provenance: severities.join(" ")
+  };
+}
+function formatDivergenceLine(d) {
+  switch (d.type) {
+    case "missing-observed":
+    case "missing-extracted":
+      if (d.column) {
+        return `  \u2022 [${d.type}] ${d.table ?? d.source} column ${d.column} \u2014 confidence ${d.confidence.toFixed(2)}`;
+      }
+      return `  \u2022 [${d.type}] ${d.source} \u2192 ${d.target} (${d.edgeType}) \u2014 confidence ${d.confidence.toFixed(2)}`;
+    case "version-mismatch":
+      return `  \u2022 [${d.type}] ${d.source} \u2192 ${d.target} \u2014 declared ${d.extractedVersion}, observed engine ${d.observedVersion} (${d.compatibility})`;
+    case "host-mismatch":
+      return `  \u2022 [${d.type}] ${d.source} \u2192 ${d.target} \u2014 declared host ${d.extractedHost}, observed host ${d.observedHost}`;
+    case "compat-violation":
+      return `  \u2022 [${d.type}] ${d.source} \u2192 ${d.target} \u2014 ${d.rule.kind}${d.rule.package ? ` (${d.rule.package})` : ""}`;
+    case "observed-symbol-mismatch": {
+      const at = d.location ? ` at ${d.location}` : "";
+      const member = d.symbol ? ` ${d.symbol}` : "";
+      return `  \u2022 [${d.type}] ${d.source}${member}${at} (${d.mismatchKind}) \u2014 confidence ${d.confidence.toFixed(2)}`;
     }
-    break;
   }
-  const before = lines.slice(0, start).join("\n").replace(/\n*$/, "");
-  const after = lines.slice(end).join("\n").replace(/^\n*/, "");
-  let text = "";
-  if (before.length > 0) text += `${before}
-
-`;
-  text += `${block}
-`;
-  if (after.length > 0) text += `
-${after}`;
-  return `${text.replace(/\n*$/, "")}
-`;
 }
-function verifyPreserved(raw, spliced, original) {
-  let next;
-  try {
-    next = (0, import_smol_toml6.parse)(spliced);
-  } catch {
-    return false;
+async function runDivergences(client, input) {
+  const params = new URLSearchParams();
+  if (input.type && input.type.length > 0) params.set("type", input.type.join(","));
+  if (input.minConfidence !== void 0) {
+    params.set("minConfidence", String(input.minConfidence));
   }
-  const origServers = original.mcp_servers ?? {};
-  const nextServers = next.mcp_servers ?? {};
-  if (!(0, import_node_util.isDeepStrictEqual)(nextServers.neat, CODEX_MCP_SERVER)) return false;
-  for (const name of Object.keys(origServers)) {
-    if (name === "neat") continue;
-    if (!(0, import_node_util.isDeepStrictEqual)(nextServers[name], origServers[name])) return false;
+  if (input.node) params.set("node", input.node);
+  const qs = params.size > 0 ? `?${params.toString()}` : "";
+  const result = await client.get(
+    projectPath(input.project, `/graph/divergences${qs}`)
+  );
+  if (result.totalAffected === 0) {
+    return {
+      summary: "No divergences found between the declared (EXTRACTED) and observed (OBSERVED) views of the graph."
+    };
   }
-  for (const name of Object.keys(nextServers)) {
-    if (name !== "neat" && !(name in origServers)) return false;
+  const headline = result.divergences[0];
+  const summary = `Found ${result.totalAffected} divergence${result.totalAffected === 1 ? "" : "s"} between code and production. Highest-confidence: ${headline.type} on ${headline.source} \u2192 ${headline.target}. ${headline.reason}`;
+  const blockLines = [];
+  for (const d of result.divergences) {
+    blockLines.push(formatDivergenceLine(d));
+    blockLines.push(`    reason: ${d.reason}`);
+    blockLines.push(`    recommendation: ${d.recommendation}`);
   }
-  for (const key of Object.keys(original)) {
-    if (key === "mcp_servers") continue;
-    if (!(0, import_node_util.isDeepStrictEqual)(next[key], original[key])) return false;
+  const maxConfidence = result.divergences.reduce(
+    (m, d) => Math.max(m, d.confidence),
+    0
+  );
+  return {
+    summary,
+    block: blockLines.join("\n"),
+    confidence: maxConfidence,
+    provenance: "composite (EXTRACTED + OBSERVED)"
+  };
+}
+async function runAsk(client, input) {
+  const result = await client.get(
+    projectPath(input.project, `/graph/ask?q=${encodeURIComponent(input.question)}`)
+  );
+  const blockLines = [];
+  if (result.matched.length > 0) {
+    blockLines.push(
+      `Matched: ${result.matched.map((m) => `${m.nodeId} [${m.via} ${m.score.toFixed(2)}]`).join(", ")}`
+    );
+    blockLines.push(`Intent: ${result.intent}`);
+  } else if (result.scope === "global") {
+    blockLines.push(`Graph-wide answer (${result.intent}) \u2014 no entity named.`);
   }
-  for (const key of Object.keys(next)) {
-    if (key !== "mcp_servers" && !(key in original)) return false;
+  for (const section of result.sections) {
+    blockLines.push("", section.heading + ":");
+    for (const fact of section.facts) {
+      const tag = fact.provenance ? ` [${fact.provenance}${fact.confidence !== void 0 ? ` ${fact.confidence.toFixed(2)}` : ""}]` : fact.confidence !== void 0 ? ` [confidence ${fact.confidence.toFixed(2)}]` : "";
+      blockLines.push(`  \u2022 ${fact.text}${tag}`);
+    }
   }
-  return true;
-}
-function agentsBlock(guide) {
-  return `${NEAT_GRAPH_FIRST_START}
-${guide.replace(/\s+$/, "")}
-${NEAT_GRAPH_FIRST_END}
-`;
+  return {
+    summary: result.answer,
+    block: blockLines.join("\n").trim(),
+    ...result.confidence !== void 0 ? { confidence: result.confidence } : {},
+    ...result.provenance.length > 0 ? { provenance: result.provenance } : {}
+  };
 }
-function upsertAgents(raw, guide) {
-  const block = agentsBlock(guide);
-  if (raw.length === 0) return { text: block, changed: true };
-  const startIdx = raw.indexOf(NEAT_GRAPH_FIRST_START);
-  const endIdx = raw.indexOf(NEAT_GRAPH_FIRST_END);
-  if (startIdx !== -1 && endIdx !== -1 && endIdx > startIdx) {
-    const before = raw.slice(0, startIdx);
-    const after = raw.slice(endIdx + NEAT_GRAPH_FIRST_END.length);
-    const text2 = `${before}${block.replace(/\n+$/, "")}${after}`;
-    return { text: text2, changed: text2 !== raw };
+function formatFooter(confidence, provenance) {
+  const c = confidence === void 0 ? "n/a" : confidence.toFixed(2);
+  const p = provenance === void 0 ? "n/a" : Array.isArray(provenance) ? [...new Set(provenance)].join(", ") : provenance;
+  return `confidence: ${c} \xB7 provenance: ${p}`;
+}
+function formatHuman(result) {
+  const sections = [result.summary.trim()];
+  if (result.block && result.block.trim().length > 0) sections.push(result.block.trimEnd());
+  sections.push(formatFooter(result.confidence, result.provenance));
+  return sections.join("\n\n");
+}
+function formatJson(result) {
+  return JSON.stringify(
+    {
+      summary: result.summary,
+      block: result.block ?? "",
+      confidence: result.confidence ?? null,
+      provenance: result.provenance ?? null
+    },
+    null,
+    2
+  );
+}
+function exitCodeForError(err) {
+  if (err instanceof TransportError) return 3;
+  if (err instanceof HttpError) return 1;
+  return 1;
+}
+function createSnapshotPushClient(baseUrl, token) {
+  return createHttpClient(baseUrl, token && token.length > 0 ? token : void 0);
+}
+async function pushSnapshotToRemote(input) {
+  const client = createSnapshotPushClient(input.baseUrl, input.token);
+  if (typeof client.post !== "function") {
+    throw new Error("HttpClient does not support POST \u2014 required for snapshot push");
   }
-  const base = raw.replace(/\n+$/, "");
-  const text = base.length > 0 ? `${base}
+  return client.post(
+    `/projects/${encodeURIComponent(input.project)}/snapshot`,
+    { snapshot: input.snapshot }
+  );
+}
 
-${block}` : block;
-  return { text, changed: text !== raw };
+// src/doctor-cli.ts
+function resolveDeps2(deps) {
+  return {
+    cwd: deps.cwd ?? process.cwd(),
+    env: deps.env ?? process.env,
+    nodeVersion: deps.nodeVersion ?? process.versions.node,
+    fetchImpl: deps.fetchImpl ?? fetch,
+    readRecord: deps.readRecord ?? readDaemonRecord,
+    out: deps.out ?? ((line) => console.log(line))
+  };
 }
-async function readGuide() {
-  return readSkillAsset(GUIDE_FILENAME);
+var NODE_FLOOR = 20;
+var HEALTH_TIMEOUT_MS = 3e3;
+function checkNode(nodeVersion) {
+  const major = Number.parseInt(nodeVersion.split(".")[0] ?? "", 10);
+  const ok = Number.isFinite(major) && major >= NODE_FLOOR;
+  return ok ? { name: "node", ok, detail: `v${nodeVersion} (>= ${NODE_FLOOR} required)` } : {
+    name: "node",
+    ok,
+    detail: `v${nodeVersion} \u2014 NEAT needs Node ${NODE_FLOOR} or newer`,
+    fix: `install Node ${NODE_FLOOR}.x (e.g. \`nvm install ${NODE_FLOOR}\`) and re-run`
+  };
 }
-async function runCodex(opts) {
-  if (opts.printConfig) {
-    process.stdout.write(`${CODEX_NEAT_BLOCK}
-`);
-    return { exitCode: 0 };
+async function neatOutExists(cwd) {
+  try {
+    const st = await import_node_fs52.promises.stat(import_node_path87.default.join(cwd, "neat-out"));
+    return st.isDirectory();
+  } catch {
+    return false;
   }
-  if (opts.printGuide) {
-    process.stdout.write(agentsBlock(await readGuide()));
-    return { exitCode: 0 };
+}
+async function checkProject(cwd, record) {
+  if (record) {
+    return {
+      name: "project",
+      ok: true,
+      detail: `"${record.project}" \u2014 set up in this directory (daemon record on REST ${record.ports.rest})`
+    };
   }
-  const configPath = codexConfigPath();
-  const agentsPath = agentsFilePath();
-  let configRaw = "";
-  try {
-    configRaw = await import_node_fs54.promises.readFile(configPath, "utf8");
-  } catch (err) {
-    if (err.code !== "ENOENT") {
-      console.error(`neat codex: failed to read ${configPath} \u2014 ${err.message}`);
-      return { exitCode: 1 };
-    }
+  if (await neatOutExists(cwd)) {
+    return {
+      name: "project",
+      ok: true,
+      detail: "set up in this directory (no live daemon record \u2014 it may be stopped)"
+    };
   }
-  let agentsRaw = "";
+  return {
+    name: "project",
+    ok: false,
+    detail: "no NEAT project in this directory",
+    fix: "set one up: `neat .`"
+  };
+}
+function resolveHealthUrl(env, record) {
+  const explicit = env.NEAT_API_URL ?? env.NEAT_CORE_URL;
+  if (explicit && explicit.length > 0) return explicit.replace(/\/$/, "");
+  if (record) return `http://localhost:${record.ports.rest}`;
+  return "http://localhost:8080";
+}
+function summariseHealth(url, body) {
+  const projects = body.projects ?? [];
+  const nodes = projects.reduce((n, p) => n + (p.nodeCount ?? 0), 0);
+  const edges = projects.reduce((n, p) => n + (p.edgeCount ?? 0), 0);
+  const proj = body.project ?? projects[0]?.name;
+  const graph = projects.length > 0 ? ` \u2014 ${nodes} nodes / ${edges} edges` : "";
+  return `up at ${url}${proj ? ` (project "${proj}"${graph})` : ""}`;
+}
+async function checkDaemon(deps, record) {
+  const url = resolveHealthUrl(deps.env, record);
+  const token = resolveAuthToken(deps.env);
+  const headers = token ? { authorization: `Bearer ${token}` } : {};
   try {
-    agentsRaw = await import_node_fs54.promises.readFile(agentsPath, "utf8");
-  } catch (err) {
-    if (err.code !== "ENOENT") {
-      console.error(`neat codex: failed to read ${agentsPath} \u2014 ${err.message}`);
-      return { exitCode: 1 };
+    const res = await deps.fetchImpl(`${url}/health`, {
+      headers,
+      signal: AbortSignal.timeout(HEALTH_TIMEOUT_MS)
+    });
+    if (res.status === 401 || res.status === 403) {
+      return {
+        name: "daemon",
+        ok: false,
+        detail: `up at ${url}, but rejected the request (${res.status})`,
+        fix: "set NEAT_AUTH_TOKEN to the daemon's token"
+      };
     }
-  }
-  let config;
-  try {
-    config = upsertCodexConfig(configRaw);
-  } catch (err) {
-    console.error(
-      `neat codex: ${configPath} is not valid TOML \u2014 ${err.message}`
-    );
-    console.error("neat codex: fix the file and re-run; nothing was written.");
-    return { exitCode: 1 };
-  }
-  const guide = await readGuide();
-  const agents = upsertAgents(agentsRaw, guide);
-  if (!opts.apply) {
-    console.log("neat codex \u2014 plan (nothing written; re-run with --apply to write)");
-    console.log("");
-    console.log(`  Codex MCP config: ${configPath}`);
-    console.log(
-      config.changed ? `    ${configRaw ? "update" : "create"} the [mcp_servers.neat] table:` : "    already up to date \u2014 [mcp_servers.neat] matches"
-    );
-    if (config.changed) {
-      for (const line of CODEX_NEAT_BLOCK.split("\n")) console.log(`      ${line}`);
+    if (!res.ok) {
+      return {
+        name: "daemon",
+        ok: false,
+        detail: `reachable at ${url} but /health returned ${res.status}`,
+        fix: "check the daemon logs"
+      };
     }
-    console.log("");
-    console.log(`  Project instructions: ${agentsPath}`);
-    console.log(
-      agents.changed ? `    ${agentsRaw ? "update" : "create"} the graph-first block (between ${NEAT_GRAPH_FIRST_START} markers)` : "    already up to date \u2014 graph-first block matches"
-    );
-    console.log("");
-    console.log("The MCP server reads NEAT_CORE_URL for the daemon URL \u2014 edit that value in");
-    console.log("the generated table to point Codex at a non-default daemon.");
-    return { exitCode: 0 };
-  }
-  if (config.changed) {
-    await import_node_fs54.promises.mkdir(import_node_path89.default.dirname(configPath), { recursive: true });
-    await import_node_fs54.promises.writeFile(configPath, config.text, "utf8");
-    console.log(`neat codex: wrote [mcp_servers.neat] to ${configPath}`);
-  } else {
-    console.log(`neat codex: ${configPath} already has NEAT's MCP server`);
-  }
-  if (agents.changed) {
-    await import_node_fs54.promises.mkdir(import_node_path89.default.dirname(agentsPath), { recursive: true });
-    await import_node_fs54.promises.writeFile(agentsPath, agents.text, "utf8");
-    console.log(`neat codex: wrote the graph-first block to ${agentsPath}`);
-  } else {
-    console.log(`neat codex: ${agentsPath} already has the graph-first block`);
+    const body = await res.json().catch(() => ({}));
+    return { name: "daemon", ok: true, detail: summariseHealth(url, body) };
+  } catch {
+    return {
+      name: "daemon",
+      ok: false,
+      detail: `down \u2014 nothing answering at ${url}`,
+      fix: "start it: `neat .`  (or `neat watch`)"
+    };
   }
-  console.log("");
-  console.log("restart Codex to pick up the new MCP server. NEAT_CORE_URL in the table");
-  console.log("points the server at the local daemon \u2014 edit it for a non-default one.");
-  return { exitCode: 0 };
-}
-function usage3() {
-  console.log("neat codex \u2014 install NEAT into the OpenAI Codex CLI (MCP server + AGENTS.md)");
-  console.log("");
-  console.log("  (no flag)        plan: print what would change, write nothing");
-  console.log("  --apply          add [mcp_servers.neat] to ~/.codex/config.toml and write");
-  console.log("                   the graph-first block into ./AGENTS.md, merging into both");
-  console.log("                   without touching your other servers or instructions");
-  console.log("  --print-config   print the [mcp_servers.neat] TOML block to stdout");
-  console.log("  --print-guide    print the AGENTS.md graph-first block to stdout");
-  console.log("");
-  console.log("Existing config is preserved and a re-run is a no-op. A malformed");
-  console.log("config.toml is a clear error with no partial write.");
 }
-async function runCodexCommand(args) {
-  const opts = { apply: false, printConfig: false, printGuide: false };
-  for (const arg of args) {
-    switch (arg) {
-      case "--apply":
-        opts.apply = true;
-        break;
-      case "--print-config":
-        opts.printConfig = true;
-        break;
-      case "--print-guide":
-        opts.printGuide = true;
-        break;
-      case "-h":
-      case "--help":
-        usage3();
-        return 0;
-      default:
-        console.error(`neat codex: unknown flag "${arg}"`);
-        usage3();
-        return 2;
+async function runDoctorChecks(deps = {}) {
+  const d = resolveDeps2(deps);
+  const record = await d.readRecord(d.cwd).catch(() => null);
+  return [checkNode(d.nodeVersion), await checkProject(d.cwd, record), await checkDaemon(d, record)];
+}
+var NAME_COL = "project".length;
+function renderHuman(checks, out) {
+  out("neat doctor \u2014 checking this project's setup");
+  out("");
+  for (const c of checks) {
+    const mark = c.ok ? "\u2713" : "\u2717";
+    out(`  ${mark}  ${c.name.padEnd(NAME_COL)}  ${c.detail}`);
+    if (!c.ok && c.fix) out(`  ${" ".repeat(NAME_COL + 3)}fix: ${c.fix}`);
+  }
+  out("");
+  const failed = checks.filter((c) => !c.ok).length;
+  out(failed === 0 ? "all good." : `${failed} check${failed === 1 ? "" : "s"} failed.`);
+}
+async function runDoctorCommand(argv, deps = {}) {
+  const out = deps.out ?? ((line) => console.log(line));
+  let json = false;
+  for (const arg of argv) {
+    if (arg === "--json") json = true;
+    else if (arg === "-h" || arg === "--help") {
+      out("usage: neat doctor [--json]");
+      out("  Probe this directory's NEAT setup: Node version, project, daemon.");
+      out("  Exit 0 when every check passes, 1 when any fails.");
+      return 0;
+    } else {
+      out(`neat doctor: unknown argument "${arg}"`);
+      return 2;
     }
   }
-  try {
-    const { exitCode } = await runCodex(opts);
-    return exitCode;
-  } catch (err) {
-    console.error(err.message);
-    return 1;
-  }
+  const checks = await runDoctorChecks(deps);
+  if (json) out(JSON.stringify({ ok: checks.every((c) => c.ok), checks }, null, 2));
+  else renderHuman(checks, out);
+  return checks.every((c) => c.ok) ? 0 : 1;
 }
 
-// src/editors-cli.ts
+// src/hooks-cli.ts
 init_cjs_shims();
-var import_node_path90 = __toESM(require("path"), 1);
-var import_node_os7 = __toESM(require("os"), 1);
-var import_node_fs55 = require("fs");
-var import_node_util2 = require("util");
-var jsonc = __toESM(require("jsonc-parser"), 1);
-var NEAT_MCP_SERVER = {
-  command: "npx",
-  args: ["-y", "@neat.is/mcp"]
-};
-var NEAT_OPENCODE_SERVER = {
-  type: "local",
-  command: ["npx", "-y", "@neat.is/mcp"],
-  enabled: true
-};
-var NEAT_CRUSH_SERVER = {
-  type: "stdio",
-  command: "npx",
-  args: ["-y", "@neat.is/mcp"]
-};
-var GRAPH_FIRST_MARKER_OPEN = "<!-- neat:graph-first -->";
-var GRAPH_FIRST_MARKER_CLOSE = "<!-- /neat:graph-first -->";
-function homeDir() {
-  return process.env.HOME ?? process.env.USERPROFILE ?? import_node_os7.default.homedir();
+var import_node_path88 = __toESM(require("path"), 1);
+var import_node_os5 = __toESM(require("os"), 1);
+var import_node_fs53 = require("fs");
+var import_node_url5 = require("url");
+var HOOK_FILENAME = "neat-search-nudge.mjs";
+var GUIDE_FILENAME = "GRAPH_FIRST.md";
+var GUIDE_INSTALL_NAME = "neat-graph-first.md";
+var HOOK_MATCHER = "Grep|Glob|Bash";
+function moduleDir() {
+  return typeof __dirname !== "undefined" ? __dirname : import_node_path88.default.dirname((0, import_node_url5.fileURLToPath)(importMetaUrl));
 }
-function xdgConfigDir() {
-  const xdg = process.env.XDG_CONFIG_HOME;
-  return xdg && xdg.length > 0 ? import_node_path90.default.resolve(xdg) : import_node_path90.default.join(homeDir(), ".config");
+async function readSkillAsset(rel) {
+  const here = moduleDir();
+  const candidates = [
+    import_node_path88.default.resolve(here, "../../claude-skill", rel),
+    import_node_path88.default.resolve(here, "../../../claude-skill", rel),
+    import_node_path88.default.resolve(here, "../claude-skill", rel)
+  ];
+  for (const candidate of candidates) {
+    try {
+      return await import_node_fs53.promises.readFile(candidate, "utf8");
+    } catch {
+    }
+  }
+  throw new Error(
+    `neat hooks: could not find @neat.is/claude-skill/${rel} \u2014 is the package installed?`
+  );
 }
-function envOverride(name) {
-  const v = process.env[name];
-  return v && v.length > 0 ? import_node_path90.default.resolve(v) : void 0;
+function neatHome3() {
+  const override = process.env.NEAT_HOME;
+  if (override && override.length > 0) return import_node_path88.default.resolve(override);
+  return import_node_path88.default.join(import_node_os5.default.homedir(), ".neat");
 }
-var CURSOR_CLIENT = {
-  id: "cursor",
-  label: "Cursor",
-  docsUrl: "https://docs.cursor.com/context/mcp",
-  mcpConfigPath: () => envOverride("NEAT_CURSOR_CONFIG") ?? import_node_path90.default.join(homeDir(), ".cursor", "mcp.json"),
-  mcpContainerKey: "mcpServers",
-  format: "json",
-  // Cursor still reads a single `.cursorrules` at the project root (the modern
-  // `.cursor/rules/*.mdc` split is one-rule-per-file with frontmatter — a worse
-  // fit for a marker-fenced block). GRAPH_FIRST.md names this file directly.
-  rulesFileName: ".cursorrules"
-};
-var DEVIN_CLIENT = {
-  id: "devin",
-  label: "Devin Desktop (Cascade)",
-  docsUrl: "https://docs.devin.ai/desktop/cascade/mcp",
-  mcpConfigPath: () => envOverride("NEAT_DEVIN_CONFIG") ?? import_node_path90.default.join(homeDir(), ".codeium", "windsurf", "mcp_config.json"),
-  mcpContainerKey: "mcpServers",
-  format: "json",
-  rulesFileName: ".windsurfrules"
-};
-var GEMINI_CLIENT = {
-  id: "gemini",
-  label: "Gemini CLI",
-  docsUrl: "https://github.com/google-gemini/gemini-cli/blob/main/docs/tools/mcp-server.md",
-  mcpConfigPath: () => envOverride("NEAT_GEMINI_CONFIG") ?? import_node_path90.default.join(homeDir(), ".gemini", "settings.json"),
-  mcpContainerKey: "mcpServers",
-  format: "json",
-  rulesFileName: "GEMINI.md"
-};
-var QWEN_CLIENT = {
-  id: "qwen",
-  label: "Qwen Code",
-  docsUrl: "https://qwenlm.github.io/qwen-code-docs/en/users/features/mcp/",
-  mcpConfigPath: () => envOverride("NEAT_QWEN_CONFIG") ?? import_node_path90.default.join(homeDir(), ".qwen", "settings.json"),
-  mcpContainerKey: "mcpServers",
-  format: "json",
-  rulesFileName: "QWEN.md"
-};
-var AMAZONQ_CLIENT = {
-  id: "amazonq",
-  label: "Amazon Q Developer CLI",
-  docsUrl: "https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/command-line-mcp-configuration.html",
-  mcpConfigPath: () => envOverride("NEAT_AMAZONQ_CONFIG") ?? import_node_path90.default.join(homeDir(), ".aws", "amazonq", "mcp.json"),
-  mcpContainerKey: "mcpServers",
-  format: "json"
-};
-var ROOCODE_CLIENT = {
-  id: "roocode",
-  label: "Roo Code",
-  docsUrl: "https://roocodeinc.github.io/Roo-Code/features/mcp/using-mcp-in-roo",
-  mcpConfigPath: () => envOverride("NEAT_ROOCODE_CONFIG") ?? import_node_path90.default.join(process.cwd(), ".roo", "mcp.json"),
-  mcpContainerKey: "mcpServers",
-  format: "json"
-};
-var ZED_CLIENT = {
-  id: "zed",
-  label: "Zed",
-  docsUrl: "https://zed.dev/docs/ai/mcp",
-  mcpConfigPath: () => {
-    const override = envOverride("NEAT_ZED_CONFIG");
-    if (override) return override;
-    if (process.platform === "win32") {
-      const appData = process.env.APPDATA;
-      if (appData && appData.length > 0) return import_node_path90.default.join(appData, "Zed", "settings.json");
-    }
-    return import_node_path90.default.join(homeDir(), ".config", "zed", "settings.json");
-  },
-  mcpContainerKey: "context_servers",
-  format: "jsonc",
-  rulesFileName: ".rules"
-};
-var OPENCODE_CLIENT = {
-  id: "opencode",
-  label: "OpenCode",
-  docsUrl: "https://opencode.ai/docs/mcp-servers/",
-  mcpConfigPath: () => envOverride("NEAT_OPENCODE_CONFIG") ?? import_node_path90.default.join(xdgConfigDir(), "opencode", "opencode.json"),
-  mcpContainerKey: "mcp",
-  format: "json",
-  serverEntry: NEAT_OPENCODE_SERVER,
-  rulesFileName: "AGENTS.md"
-};
-var CRUSH_CLIENT = {
-  id: "crush",
-  label: "Crush",
-  docsUrl: "https://charmbracelet-crush.mintlify.app/configuration/mcp",
-  mcpConfigPath: () => envOverride("NEAT_CRUSH_CONFIG") ?? import_node_path90.default.join(xdgConfigDir(), "crush", "crush.json"),
-  mcpContainerKey: "mcp",
-  format: "json",
-  serverEntry: NEAT_CRUSH_SERVER,
-  rulesFileName: "AGENTS.md"
-};
-var CLIENTS = {
-  cursor: CURSOR_CLIENT,
-  devin: DEVIN_CLIENT,
-  gemini: GEMINI_CLIENT,
-  qwen: QWEN_CLIENT,
-  amazonq: AMAZONQ_CLIENT,
-  roocode: ROOCODE_CLIENT,
-  zed: ZED_CLIENT,
-  opencode: OPENCODE_CLIENT,
-  crush: CRUSH_CLIENT
-};
-function mergeJsonMcp(existing, containerKey, serverEntry) {
-  const servers = existing[containerKey] ?? {};
-  const already = (0, import_node_util2.isDeepStrictEqual)(servers.neat, serverEntry);
-  const merged = {
-    ...existing,
-    [containerKey]: { ...servers, neat: serverEntry }
-  };
-  return { merged, changed: !already };
-}
-function mergeJsoncMcp(raw, containerKey, serverEntry) {
-  const base = raw.trim().length > 0 ? raw : "{}";
-  const parsed = jsonc.parse(base) ?? {};
-  const servers = parsed[containerKey] ?? {};
-  if ((0, import_node_util2.isDeepStrictEqual)(servers.neat, serverEntry)) {
-    return { text: raw, changed: false };
-  }
-  const edits = jsonc.modify(base, [containerKey, "neat"], serverEntry, {
-    formattingOptions: { tabSize: 2, insertSpaces: true }
-  });
-  let text = jsonc.applyEdits(base, edits);
-  if (!text.endsWith("\n")) text += "\n";
-  return { text, changed: text !== raw };
+function claudeSettingsPath() {
+  const override = process.env.NEAT_CLAUDE_SETTINGS;
+  if (override && override.length > 0) return import_node_path88.default.resolve(override);
+  const home = process.env.HOME ?? process.env.USERPROFILE ?? import_node_os5.default.homedir();
+  return import_node_path88.default.join(home, ".claude", "settings.json");
 }
-function escapeRegExp(s) {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function installedHookPath() {
+  return import_node_path88.default.join(neatHome3(), "hooks", HOOK_FILENAME);
 }
-function buildGuidanceBlock(guide) {
-  return `${GRAPH_FIRST_MARKER_OPEN}
-${guide.trim()}
-${GRAPH_FIRST_MARKER_CLOSE}
-`;
+function gateFlagPath() {
+  return import_node_path88.default.join(neatHome3(), "hooks", "gate-enabled");
 }
-function mergeRulesFile(existing, block) {
-  const region = new RegExp(
-    `${escapeRegExp(GRAPH_FIRST_MARKER_OPEN)}[\\s\\S]*?${escapeRegExp(GRAPH_FIRST_MARKER_CLOSE)}\\n?`
+function isNeatSearchEntry(entry2) {
+  return (entry2.hooks ?? []).some(
+    (h) => typeof h.command === "string" && h.command.includes(HOOK_FILENAME)
   );
-  if (region.test(existing)) return existing.replace(region, block);
-  if (existing.trim().length === 0) return block;
-  return `${existing.replace(/\s+$/, "")}
-
-${block}`;
 }
-async function planMcp(client, mcpPath) {
-  const serverEntry = client.serverEntry ?? NEAT_MCP_SERVER;
-  let raw = "";
-  try {
-    raw = await import_node_fs55.promises.readFile(mcpPath, "utf8");
-  } catch (err) {
-    const e = err;
-    if (e.code === "ENOENT") {
-      raw = "";
-    } else {
-      console.error(`neat ${client.id}: failed to read ${mcpPath} \u2014 ${e.message}`);
-      return null;
-    }
+function neatHookEntry(command) {
+  return { matcher: HOOK_MATCHER, hooks: [{ type: "command", command }] };
+}
+function hookCommand(scriptPath) {
+  return `node "${scriptPath}"`;
+}
+async function runHooks(opts) {
+  if (opts.printHook) {
+    process.stdout.write(await readSkillAsset(`hooks/${HOOK_FILENAME}`));
+    return { exitCode: 0 };
   }
-  if (client.format === "jsonc") {
-    if (raw.trim().length > 0) {
-      const errors = [];
-      jsonc.parse(raw, errors, { allowTrailingComma: true });
-      if (errors.length > 0) {
-        const first = errors[0];
-        console.error(
-          `neat ${client.id}: ${mcpPath} is not valid JSONC \u2014 ${jsonc.printParseErrorCode(first.error)} at offset ${first.offset}. Fix it (or move it aside) and re-run; nothing was written.`
-        );
-        return null;
-      }
-    }
-    return mergeJsoncMcp(raw, client.mcpContainerKey, serverEntry);
+  if (opts.printGuide) {
+    process.stdout.write(await readSkillAsset(GUIDE_FILENAME));
+    return { exitCode: 0 };
   }
-  let existing = {};
-  if (raw.trim().length > 0) {
-    try {
-      existing = JSON.parse(raw);
-    } catch (err) {
-      console.error(
-        `neat ${client.id}: ${mcpPath} is not valid JSON \u2014 ${err.message}. Fix it (or move it aside) and re-run; nothing was written.`
-      );
-      return null;
-    }
+  if (opts.printSettings) {
+    const block = {
+      hooks: { PreToolUse: [neatHookEntry(hookCommand(installedHookPath()))] }
+    };
+    process.stdout.write(JSON.stringify(block, null, 2) + "\n");
+    return { exitCode: 0 };
   }
-  const { merged, changed } = mergeJsonMcp(existing, client.mcpContainerKey, serverEntry);
-  return { text: JSON.stringify(merged, null, 2) + "\n", changed };
-}
-async function runEditorInstall(client, opts) {
-  const mcpPath = client.mcpConfigPath();
-  const serverEntry = client.serverEntry ?? NEAT_MCP_SERVER;
-  const hasRules = typeof client.rulesFileName === "string";
-  const rulesPath = hasRules ? import_node_path90.default.join(opts.projectDir, client.rulesFileName) : "";
-  const mcp = await planMcp(client, mcpPath);
-  if (mcp === null) return { exitCode: 1 };
-  let existingRules = "";
-  let newRules = "";
-  let rulesChanged = false;
-  let block = "";
-  if (hasRules) {
+  if (opts.apply) {
+    const hookScript = await readSkillAsset(`hooks/${HOOK_FILENAME}`);
+    const guide = await readSkillAsset(GUIDE_FILENAME);
+    const scriptPath = installedHookPath();
+    await import_node_fs53.promises.mkdir(import_node_path88.default.dirname(scriptPath), { recursive: true });
+    await import_node_fs53.promises.writeFile(scriptPath, hookScript, { mode: 493 });
+    const guidePath = import_node_path88.default.join(neatHome3(), GUIDE_INSTALL_NAME);
+    await import_node_fs53.promises.writeFile(guidePath, guide, "utf8");
+    const settingsFile = claudeSettingsPath();
+    let settings = {};
     try {
-      existingRules = await import_node_fs55.promises.readFile(rulesPath, "utf8");
+      settings = JSON.parse(await import_node_fs53.promises.readFile(settingsFile, "utf8"));
     } catch (err) {
       if (err.code !== "ENOENT") {
-        console.error(`neat ${client.id}: failed to read ${rulesPath} \u2014 ${err.message}`);
+        console.error(
+          `neat hooks: failed to read ${settingsFile} \u2014 ${err.message}`
+        );
         return { exitCode: 1 };
       }
     }
-    const guide = await readSkillAsset(GUIDE_FILENAME);
-    block = buildGuidanceBlock(guide);
-    newRules = mergeRulesFile(existingRules, block);
-    rulesChanged = newRules !== existingRules;
-  }
-  if (!opts.apply) {
-    console.log(`neat ${client.id} \u2014 wire NEAT into ${client.label} (plan; nothing written)`);
-    console.log("");
-    console.log(`MCP server \u2192 ${mcpPath}`);
-    console.log(
-      mcp.changed ? `  would add ${client.mcpContainerKey}.neat:` : `  ${client.mcpContainerKey}.neat already present and current \u2014 no change:`
-    );
-    console.log(indent(JSON.stringify({ neat: serverEntry }, null, 2)));
-    if (hasRules) {
-      console.log("");
-      console.log(`Graph-first guidance \u2192 ${rulesPath}`);
-      console.log(
-        rulesChanged ? existingRules.includes(GRAPH_FIRST_MARKER_OPEN) ? "  would refresh the neat:graph-first block:" : "  would add the neat:graph-first block:" : "  neat:graph-first block already present and current \u2014 no change."
-      );
-      if (rulesChanged) console.log(indent(block.trimEnd()));
+    const hooks = settings.hooks ?? {};
+    const preToolUse = Array.isArray(hooks.PreToolUse) ? [...hooks.PreToolUse] : [];
+    const command = hookCommand(scriptPath);
+    const existingIdx = preToolUse.findIndex(isNeatSearchEntry);
+    if (existingIdx >= 0) {
+      preToolUse[existingIdx] = neatHookEntry(command);
+    } else {
+      preToolUse.push(neatHookEntry(command));
     }
+    const merged = {
+      ...settings,
+      hooks: { ...hooks, PreToolUse: preToolUse }
+    };
+    await import_node_fs53.promises.mkdir(import_node_path88.default.dirname(settingsFile), { recursive: true });
+    await import_node_fs53.promises.writeFile(settingsFile, JSON.stringify(merged, null, 2) + "\n", "utf8");
+    const flag = gateFlagPath();
+    if (opts.gate) {
+      await import_node_fs53.promises.mkdir(import_node_path88.default.dirname(flag), { recursive: true });
+      await import_node_fs53.promises.writeFile(flag, "1\n", "utf8");
+    } else {
+      await import_node_fs53.promises.rm(flag, { force: true });
+    }
+    const mode = opts.gate ? "GATE (deny search until you ask the graph)" : "nudge (search still runs)";
+    console.log(`neat hooks: installed the search hook in ${opts.gate ? "gate" : "nudge"} mode`);
+    console.log(`  script:   ${scriptPath}`);
+    console.log(`  settings: ${settingsFile} (PreToolUse \u2192 ${HOOK_MATCHER})`);
+    console.log(`  guidance: ${guidePath}`);
+    console.log(`  mode:     ${mode}`);
     console.log("");
-    console.log(
-      hasRules ? `Re-run with --apply to write both files. Existing servers and rules are kept.` : `Re-run with --apply to write the config. Existing servers are kept.`
-    );
+    if (opts.gate) {
+      console.log("restart Claude Code to load the hook. A Grep/Glob or Bash grep is now DENIED");
+      console.log('until you run `neat ask "<question>"` (or the ask MCP tool) once this session;');
+      console.log("after that, search is allowed as a fallback. Set NEAT_SEARCH_GATE=0 to fall");
+      console.log("back to nudge-only without re-running.");
+    } else {
+      console.log("restart Claude Code to load the hook. On a Grep/Glob or a Bash grep,");
+      console.log("your agent will now be nudged to query NEAT first (the search still runs).");
+      console.log("Re-run with --gate to hard-force the graph-first orientation.");
+    }
+    console.log("");
+    console.log("The hook is Claude-Code-specific. For agents on other harnesses, paste");
+    console.log(`the guidance above into your project instructions (CLAUDE.md / AGENTS.md).`);
     return { exitCode: 0 };
   }
-  await import_node_fs55.promises.mkdir(import_node_path90.default.dirname(mcpPath), { recursive: true });
-  await import_node_fs55.promises.writeFile(mcpPath, mcp.text, "utf8");
-  if (hasRules) {
-    await import_node_fs55.promises.mkdir(import_node_path90.default.dirname(rulesPath), { recursive: true });
-    await import_node_fs55.promises.writeFile(rulesPath, newRules, "utf8");
-  }
-  console.log(`neat ${client.id}: wired NEAT into ${client.label}`);
-  console.log(`  MCP server: ${mcpPath} (${client.mcpContainerKey}.neat \u2192 npx -y @neat.is/mcp)`);
-  if (hasRules) console.log(`  guidance:   ${rulesPath} (neat:graph-first block)`);
-  console.log("");
-  console.log(`restart ${client.label} to pick up the MCP server. Point it at a non-default`);
-  console.log(`daemon by setting NEAT_CORE_URL in the neat server's env in that config.`);
+  usage();
   return { exitCode: 0 };
 }
-function indent(text) {
-  return text.split("\n").map((line) => line.length > 0 ? `    ${line}` : line).join("\n");
-}
-function usage4(client) {
-  const hasRules = typeof client.rulesFileName === "string";
-  console.log(
-    hasRules ? `neat ${client.id} \u2014 install NEAT's MCP server + graph-first guidance into ${client.label}` : `neat ${client.id} \u2014 install NEAT's MCP server into ${client.label}`
-  );
-  console.log("");
-  console.log(
-    hasRules ? "  --apply   write the MCP config and the rules file (default: plan only)" : "  --apply   write the MCP config (default: plan only)"
-  );
+function usage() {
+  console.log("neat hooks \u2014 wire NEAT into your agent so it queries the graph before grepping");
   console.log("");
-  console.log("Writes NEAT's stdio MCP server (npx -y @neat.is/mcp) into");
-  console.log(`  ${client.mcpConfigPath()}`);
-  if (hasRules) {
-    console.log(`and the graph-first guidance block into ./${client.rulesFileName}, both`);
-    console.log("additively \u2014 existing servers and rules are preserved, a re-run is a no-op.");
-  } else {
-    console.log("additively \u2014 existing servers are preserved, a re-run is a no-op.");
-  }
+  console.log("  --apply          install the Claude Code search hook and write the");
+  console.log("                   graph-first guidance to ~/.neat/, merging into");
+  console.log("                   ~/.claude/settings.json without touching your other hooks");
+  console.log("  --gate           with --apply, enable hard-gate mode: DENY Grep/Glob/grep-Bash");
+  console.log("                   until `neat ask` has run this session (default is nudge-only).");
+  console.log("                   Toggle off at run time with NEAT_SEARCH_GATE=0.");
+  console.log("  --print-hook     print the hook script to stdout");
+  console.log("  --print-guide    print the agent-agnostic graph-first guidance to stdout");
+  console.log("  --print-settings print the settings.json PreToolUse block --apply would add");
   console.log("");
-  console.log(`See ${client.docsUrl} for ${client.label}'s MCP config format.`);
+  console.log("By default the hook is a gentle, non-blocking nudge \u2014 searches still run.");
+  console.log("--gate turns it into a hard forcing mechanism. It is Claude-Code-specific;");
+  console.log("other harnesses get the same steer from the graph-first guidance.");
 }
-async function runEditorCommand(clientId, args, projectDir = process.cwd()) {
-  const client = CLIENTS[clientId];
-  let apply6 = false;
+async function runHooksCommand(args) {
+  const opts = {
+    apply: false,
+    printHook: false,
+    printGuide: false,
+    printSettings: false,
+    gate: false
+  };
   for (const arg of args) {
     switch (arg) {
       case "--apply":
-        apply6 = true;
+        opts.apply = true;
+        break;
+      case "--gate":
+        opts.gate = true;
+        break;
+      case "--print-hook":
+        opts.printHook = true;
+        break;
+      case "--print-guide":
+        opts.printGuide = true;
+        break;
+      case "--print-settings":
+        opts.printSettings = true;
         break;
       case "-h":
       case "--help":
-        usage4(client);
+        usage();
         return 0;
       default:
-        console.error(`neat ${client.id}: unknown flag "${arg}"`);
-        usage4(client);
+        console.error(`neat hooks: unknown flag "${arg}"`);
+        usage();
         return 2;
     }
   }
   try {
-    const { exitCode } = await runEditorInstall(client, { apply: apply6, projectDir });
+    const { exitCode } = await runHooks(opts);
     return exitCode;
   } catch (err) {
     console.error(err.message);
@@ -28692,579 +28908,762 @@ async function runEditorCommand(clientId, args, projectDir = process.cwd()) {
   }
 }
 
-// src/monitor.ts
+// src/claude-cli.ts
 init_cjs_shims();
-var import_types97 = require("@neat.is/types");
+var import_node_path89 = __toESM(require("path"), 1);
+var import_node_fs54 = require("fs");
+var NEAT_SECTION_HEADING = "## neat";
+var NEAT_DIRECTIVE_BODY = `This project has NEAT wired in: a live, fused semantic graph of the system \u2014
+code and runtime behaviour (OpenTelemetry) in one model, every fact tagged with
+its provenance (EXTRACTED / OBSERVED / INFERRED / STALE) and a confidence.
 
-// src/cli-client.ts
-init_cjs_shims();
-var import_types96 = require("@neat.is/types");
-var HttpError = class extends Error {
-  constructor(status2, message, responseBody = "") {
-    super(message);
-    this.status = status2;
-    this.responseBody = responseBody;
-    this.name = "HttpError";
-  }
-  status;
-  responseBody;
-};
-var TransportError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "TransportError";
-  }
-};
-function resolveAuthToken(env = process.env) {
-  const t = env.NEAT_AUTH_TOKEN;
-  return t && t.length > 0 ? t : void 0;
+For ANY question about this system's behaviour, dependencies, failures, root
+cause, or blast radius, call \`neat ask\` FIRST \u2014 before Read, Grep, Glob, or Bash:
+
+    neat ask "why is checkout failing?"
+    neat ask "what breaks if I change the orders table?"
+    neat ask "what does the payments service depend on at runtime?"
+
+\`ask\` resolves your question to graph nodes and routes it to the right traversal
+\u2014 root cause, dependencies, observed runtime calls, incidents, divergences,
+blast radius \u2014 and returns one compact, provenance-tagged answer. The same door
+is the \`ask\` MCP tool (\`mcp__neat__ask\`) when NEAT's MCP server is wired in.
+
+The graph is live and fused: it is faster and more accurate than scanning files,
+and it can tell you what the system actually does at runtime, not only what the
+source declares. Fall back to Read/Grep only when the graph does not have what
+you need \u2014 comments, string literals, config minutiae. Ask the graph first,
+then scan.
+
+If \`neat ask\` errors, the daemon may not be running (\`neat list\`) \u2014 start it
+with \`neat <path>\`, then re-ask.`;
+function neatSection() {
+  return `${NEAT_SECTION_HEADING}
+
+${NEAT_DIRECTIVE_BODY}
+`;
 }
-function createHttpClient(baseUrl, bearerToken) {
-  const root = baseUrl.replace(/\/$/, "");
-  const authHeader = bearerToken && bearerToken.length > 0 ? { authorization: `Bearer ${bearerToken}` } : {};
-  return {
-    async get(path93) {
-      let res;
-      try {
-        res = await fetch(`${root}${path93}`, {
-          headers: { ...authHeader }
-        });
-      } catch (err) {
-        throw new TransportError(
-          `cannot reach neat-core at ${root}: ${err.message}`
-        );
-      }
-      if (!res.ok) {
-        const body = await res.text().catch(() => "");
-        throw new HttpError(
-          res.status,
-          `${res.status} ${res.statusText} on GET ${path93}: ${body}`,
-          body
-        );
-      }
-      return await res.json();
-    },
-    async post(path93, body) {
-      let res;
-      try {
-        res = await fetch(`${root}${path93}`, {
-          method: "POST",
-          headers: { "content-type": "application/json", ...authHeader },
-          body: JSON.stringify(body)
-        });
-      } catch (err) {
-        throw new TransportError(
-          `cannot reach neat-core at ${root}: ${err.message}`
-        );
-      }
-      if (!res.ok) {
-        const text = await res.text().catch(() => "");
-        throw new HttpError(
-          res.status,
-          `${res.status} ${res.statusText} on POST ${path93}: ${text}`,
-          text
-        );
-      }
-      return await res.json();
+function claudeMdPath() {
+  const override = process.env.NEAT_CLAUDE_MD;
+  if (override && override.length > 0) return import_node_path89.default.resolve(override);
+  return import_node_path89.default.join(process.cwd(), "CLAUDE.md");
+}
+function splitAroundSection(raw) {
+  const lines = raw.split("\n");
+  const startIdx = lines.findIndex((l) => l.replace(/\s+$/, "") === NEAT_SECTION_HEADING);
+  if (startIdx === -1) {
+    return { before: raw.replace(/\n*$/, ""), after: "", found: false };
+  }
+  let endIdx = lines.length;
+  for (let i = startIdx + 1; i < lines.length; i++) {
+    if (/^#{1,2}\s+/.test(lines[i] ?? "")) {
+      endIdx = i;
+      break;
     }
-  };
+  }
+  const before = lines.slice(0, startIdx).join("\n").replace(/\n*$/, "");
+  const after = lines.slice(endIdx).join("\n").replace(/^\n*/, "");
+  return { before, after, found: true };
 }
-function projectPath(project, suffix) {
-  if (!project) return suffix;
-  return `/projects/${encodeURIComponent(project)}${suffix}`;
+function compose(before, after) {
+  const parts = [];
+  if (before.length > 0) parts.push(before);
+  parts.push(neatSection().replace(/\n+$/, ""));
+  if (after.length > 0) parts.push(after);
+  return parts.join("\n\n").replace(/\n*$/, "") + "\n";
 }
-async function runRootCause(client, input) {
-  const qs = input.errorId ? `?errorId=${encodeURIComponent(input.errorId)}` : "";
-  const path93 = projectPath(
-    input.project,
-    `/graph/root-cause/${encodeURIComponent(input.errorNode)}${qs}`
-  );
+async function readIfExists2(file) {
   try {
-    const result = await client.get(path93);
-    const arrowPath = result.traversalPath.join(" \u2190 ");
-    const provenances = result.edgeProvenances.length ? result.edgeProvenances.join(", ") : "(direct, no edges traversed)";
-    const summary = `Root cause for ${input.errorNode} is ${result.rootCauseNode}. ` + result.rootCauseReason + (result.fixRecommendation ? ` Recommended fix: ${result.fixRecommendation}.` : "");
-    const blockLines = [
-      `Traversal path: ${arrowPath}`,
-      `Edge provenances: ${provenances}`
-    ];
-    if (result.fixRecommendation) blockLines.push(`Recommended fix: ${result.fixRecommendation}`);
-    return {
-      summary,
-      block: blockLines.join("\n"),
-      confidence: result.confidence,
-      provenance: result.edgeProvenances.length ? result.edgeProvenances : void 0
-    };
+    return await import_node_fs54.promises.readFile(file, "utf8");
   } catch (err) {
-    if (err instanceof HttpError && err.status === 404) {
-      return {
-        summary: `No root cause found for ${input.errorNode}. The node may be healthy, or it may not exist in the graph.`
-      };
-    }
+    if (err.code === "ENOENT") return null;
     throw err;
   }
 }
-async function runBlastRadius(client, input) {
-  const qs = input.depth !== void 0 ? `?depth=${input.depth}` : "";
-  const path93 = projectPath(
-    input.project,
-    `/graph/blast-radius/${encodeURIComponent(input.nodeId)}${qs}`
-  );
-  try {
-    const result = await client.get(path93);
-    if (result.totalAffected === 0) {
-      return {
-        summary: `${result.origin} has no dependents. Nothing else would break if it failed.`
-      };
-    }
-    const sorted = [...result.affectedNodes].sort(
-      (a, b) => a.distance - b.distance || a.nodeId.localeCompare(b.nodeId)
-    );
-    const blockLines = sorted.map(formatBlastEntry);
-    const minConfidence = sorted.reduce(
-      (m, n) => Math.min(m, n.confidence),
-      Number.POSITIVE_INFINITY
-    );
-    const provenances = [...new Set(sorted.map((n) => n.edgeProvenance))];
-    return {
-      summary: `Blast radius for ${result.origin}: ${result.totalAffected} dependent node${result.totalAffected === 1 ? "" : "s"} would break if it changed.`,
-      block: blockLines.join("\n"),
-      confidence: Number.isFinite(minConfidence) ? minConfidence : void 0,
-      provenance: provenances.length ? provenances : void 0
-    };
-  } catch (err) {
-    if (err instanceof HttpError && err.status === 404) {
-      return { summary: `Node ${input.nodeId} not found in the graph.` };
-    }
-    throw err;
+async function runInstall() {
+  const file = claudeMdPath();
+  const raw = await readIfExists2(file) ?? "";
+  const { before, after, found } = splitAroundSection(raw);
+  const next = compose(before, after);
+  await import_node_fs54.promises.mkdir(import_node_path89.default.dirname(file), { recursive: true });
+  await import_node_fs54.promises.writeFile(file, next, "utf8");
+  const verb = raw.length === 0 ? "created" : found ? "refreshed" : "added";
+  console.log(`neat claude: ${verb} the \`${NEAT_SECTION_HEADING}\` section in ${file}`);
+  console.log("Your agent will now reach for `neat ask` before Read/Grep/Bash. Restart the");
+  console.log("session (or reload CLAUDE.md) to pick it up.");
+  return { exitCode: 0 };
+}
+async function runUninstall() {
+  const file = claudeMdPath();
+  const raw = await readIfExists2(file);
+  if (raw === null) {
+    console.log(`neat claude: no CLAUDE.md at ${file} \u2014 nothing to remove.`);
+    return { exitCode: 0 };
+  }
+  const { before, after, found } = splitAroundSection(raw);
+  if (!found) {
+    console.log(`neat claude: no \`${NEAT_SECTION_HEADING}\` section in ${file} \u2014 nothing to remove.`);
+    return { exitCode: 0 };
   }
+  const remaining = [before, after].filter((s) => s.length > 0).join("\n\n");
+  const next = remaining.length > 0 ? remaining.replace(/\n*$/, "") + "\n" : "";
+  await import_node_fs54.promises.writeFile(file, next, "utf8");
+  console.log(`neat claude: removed the \`${NEAT_SECTION_HEADING}\` section from ${file}.`);
+  return { exitCode: 0 };
 }
-function formatBlastEntry(n) {
-  const tag = n.edgeProvenance === import_types96.Provenance.STALE ? " [STALE \u2014 last seen too long ago]" : "";
-  return `  \u2022 ${n.nodeId} (distance ${n.distance}, ${n.edgeProvenance})${tag}`;
+function usage2() {
+  console.log("neat claude \u2014 make the query-first directive always-on in Claude Code");
+  console.log("");
+  console.log("  install     write (or refresh) a `## neat` section in ./CLAUDE.md so your");
+  console.log("              agent reaches for `neat ask` before Read/Grep/Bash");
+  console.log("  uninstall   remove the `## neat` section from ./CLAUDE.md");
+  console.log("  print       print the directive block to stdout (for a manual paste)");
+  console.log("");
+  console.log("Idempotent: re-running install replaces its own section, never duplicates it.");
+  console.log("Target file overridable via NEAT_CLAUDE_MD.");
 }
-async function runDependencies(client, input) {
-  const depth = input.depth ?? 3;
-  const path93 = projectPath(
-    input.project,
-    `/graph/dependencies/${encodeURIComponent(input.nodeId)}?depth=${depth}`
-  );
+async function runClaudeCommand(args) {
+  const sub = args[0];
+  if (sub === "-h" || sub === "--help" || sub === void 0) {
+    usage2();
+    return sub === void 0 ? 2 : 0;
+  }
   try {
-    const result = await client.get(path93);
-    if (result.total === 0) {
-      return {
-        summary: depth === 1 ? `${input.nodeId} has no direct dependencies in the graph.` : `${input.nodeId} has no dependencies (BFS to depth ${depth}).`
-      };
-    }
-    const byDistance = /* @__PURE__ */ new Map();
-    for (const dep of result.dependencies) {
-      const ring = byDistance.get(dep.distance) ?? [];
-      ring.push(dep);
-      byDistance.set(dep.distance, ring);
-    }
-    const blockLines = [];
-    for (const distance of [...byDistance.keys()].sort((a, b) => a - b)) {
-      const label = distance === 1 ? "Direct (distance 1)" : `Distance ${distance}`;
-      blockLines.push(`${label}:`);
-      for (const dep of byDistance.get(distance)) {
-        blockLines.push(`  \u2022 ${dep.nodeId} \u2014 ${dep.edgeType} (${dep.provenance})`);
-      }
+    switch (sub) {
+      case "install":
+        return (await runInstall()).exitCode;
+      case "uninstall":
+        return (await runUninstall()).exitCode;
+      case "print":
+        process.stdout.write(neatSection());
+        return 0;
+      default:
+        console.error(`neat claude: unknown subcommand "${sub}"`);
+        usage2();
+        return 2;
     }
-    const provenances = [...new Set(result.dependencies.map((d) => d.provenance))];
-    const directCount = byDistance.get(1)?.length ?? 0;
-    const summary = depth === 1 ? `${input.nodeId} has ${directCount} direct dependenc${directCount === 1 ? "y" : "ies"}.` : `${input.nodeId} has ${result.total} dependenc${result.total === 1 ? "y" : "ies"} reachable to depth ${depth} (${directCount} direct).`;
-    return { summary, block: blockLines.join("\n"), provenance: provenances };
   } catch (err) {
-    if (err instanceof HttpError && err.status === 404) {
-      return { summary: `Node ${input.nodeId} not found in the graph.` };
-    }
-    throw err;
+    console.error(`neat claude: ${err.message}`);
+    return 1;
   }
 }
-function observedDepLine(nodeId, e) {
-  const via = e.source !== nodeId ? ` (via ${e.source})` : "";
-  return `  \u2022 ${e.target} \u2014 ${e.type}${via}${edgeMeta(e)}`;
+
+// src/codex-cli.ts
+init_cjs_shims();
+var import_node_path90 = __toESM(require("path"), 1);
+var import_node_os6 = __toESM(require("os"), 1);
+var import_node_fs55 = require("fs");
+var import_node_util = require("util");
+var import_smol_toml6 = require("smol-toml");
+var CODEX_MCP_SERVER = {
+  command: "npx",
+  args: ["-y", "@neat.is/mcp"],
+  env: { NEAT_CORE_URL: "http://localhost:8080" }
+};
+var CODEX_NEAT_BLOCK = [
+  "[mcp_servers.neat]",
+  'command = "npx"',
+  'args = ["-y", "@neat.is/mcp"]',
+  'env = { NEAT_CORE_URL = "http://localhost:8080" }'
+].join("\n");
+var NEAT_GRAPH_FIRST_START = "<!-- neat:graph-first -->";
+var NEAT_GRAPH_FIRST_END = "<!-- /neat:graph-first -->";
+function codexConfigPath() {
+  const override = process.env.NEAT_CODEX_CONFIG;
+  if (override && override.length > 0) return import_node_path90.default.resolve(override);
+  const home = process.env.HOME ?? process.env.USERPROFILE ?? import_node_os6.default.homedir();
+  return import_node_path90.default.join(home, ".codex", "config.toml");
 }
-async function runObservedDependencies(client, input) {
-  try {
-    const result = await client.get(
-      projectPath(
-        input.project,
-        `/graph/observed-dependencies/${encodeURIComponent(input.nodeId)}`
-      )
-    );
-    if (result.dependencies.length === 0) {
-      if (result.observed) {
-        return {
-          summary: `${input.nodeId} makes no outbound runtime calls, but OTel has observed it receiving traffic on ${result.inboundObservedCount} inbound call path${result.inboundObservedCount === 1 ? "" : "s"} \u2014 it's a pure receiver.`,
-          provenance: import_types96.Provenance.OBSERVED
-        };
-      }
-      const note = result.hasExtractedOutbound ? " Static (EXTRACTED) dependencies exist but no runtime traffic has been seen \u2014 is OTel running?" : "";
-      return { summary: `No OBSERVED dependencies for ${input.nodeId}.${note}` };
-    }
-    const blockLines = result.dependencies.map((e) => observedDepLine(input.nodeId, e));
-    return {
-      summary: `${input.nodeId} has ${result.dependencies.length} runtime dependenc${result.dependencies.length === 1 ? "y" : "ies"} confirmed by OTel.`,
-      block: blockLines.join("\n"),
-      provenance: import_types96.Provenance.OBSERVED
-    };
-  } catch (err) {
-    if (err instanceof HttpError && err.status === 404) {
-      return { summary: `Node ${input.nodeId} not found in the graph.` };
-    }
-    throw err;
-  }
+function agentsFilePath() {
+  const override = process.env.NEAT_CODEX_AGENTS;
+  if (override && override.length > 0) return import_node_path90.default.resolve(override);
+  return import_node_path90.default.join(process.cwd(), "AGENTS.md");
 }
-function edgeMeta(e) {
-  const bits = [];
-  if (e.signal) {
-    bits.push(`spans=${e.signal.spanCount}`);
-    if (e.signal.errorCount > 0) bits.push(`errors=${e.signal.errorCount}`);
-    if (e.signal.lastObservedAgeMs !== void 0) {
-      bits.push(`age=${formatDuration(e.signal.lastObservedAgeMs)}`);
-    }
-  } else if (e.callCount !== void 0) {
-    bits.push(`callCount=${e.callCount}`);
-  }
-  if (e.lastObserved) bits.push(`lastObserved=${e.lastObserved}`);
-  if (e.confidence !== void 0) bits.push(`confidence=${e.confidence}`);
-  return bits.length ? ` [${bits.join(", ")}]` : "";
+function isTableHeader(line) {
+  return /^\s*\[\[?[^\]]+\]\]?\s*$/.test(line);
 }
-function formatDuration(ms) {
-  if (ms < 1e3) return `${Math.round(ms)}ms`;
-  const s = Math.round(ms / 1e3);
-  if (s < 60) return `${s}s`;
-  const m = Math.round(s / 60);
-  if (m < 60) return `${m}m`;
-  const h = Math.round(m / 60);
-  if (h < 48) return `${h}h`;
-  return `${Math.round(h / 24)}d`;
+function tableName(line) {
+  return line.trim().replace(/^\[\[?/, "").replace(/\]\]?$/, "").trim();
 }
-async function runIncidents(client, input) {
-  const path93 = input.nodeId ? projectPath(input.project, `/incidents/${encodeURIComponent(input.nodeId)}`) : projectPath(input.project, "/incidents");
-  try {
-    const body = await client.get(path93);
-    const events = body.events;
-    if (events.length === 0) {
-      return {
-        summary: input.nodeId ? `No incidents recorded against ${input.nodeId}.` : "No incidents recorded."
-      };
-    }
-    const ordered = [...events].reverse().slice(0, input.limit ?? 20);
-    const blockLines = [];
-    for (const ev of ordered) {
-      blockLines.push(`  ${ev.timestamp} \u2014 ${ev.service}: ${ev.errorMessage}`);
-      blockLines.push(`    trace=${ev.traceId} span=${ev.spanId}`);
-    }
-    const target = input.nodeId ?? "the project";
-    return {
-      summary: `${target} has ${body.total} recorded incident${body.total === 1 ? "" : "s"}; showing the ${ordered.length} most recent.`,
-      block: blockLines.join("\n"),
-      provenance: import_types96.Provenance.OBSERVED
+function isNeatHeader(line) {
+  return isTableHeader(line) && tableName(line) === "mcp_servers.neat";
+}
+function isNeatChildHeader(line) {
+  if (!isTableHeader(line)) return false;
+  const name = tableName(line);
+  return name === "mcp_servers.neat" || name.startsWith("mcp_servers.neat.");
+}
+function upsertCodexConfig(raw) {
+  const trimmed = raw.trim();
+  const parsed = trimmed.length > 0 ? (0, import_smol_toml6.parse)(raw) : {};
+  const existingServers = parsed.mcp_servers ?? {};
+  const spliced = spliceNeatBlock(raw);
+  let text;
+  if (verifyPreserved(raw, spliced, parsed)) {
+    text = spliced;
+  } else {
+    const merged = {
+      ...parsed,
+      mcp_servers: { ...existingServers, neat: CODEX_MCP_SERVER }
     };
-  } catch (err) {
-    if (err instanceof HttpError && err.status === 404) {
-      return { summary: `Node ${input.nodeId ?? ""} not found in the graph.` };
-    }
-    throw err;
+    text = (0, import_smol_toml6.stringify)(merged);
+    if (!text.endsWith("\n")) text += "\n";
   }
+  return { text, changed: text !== raw };
 }
-async function runSearch(client, input) {
-  const result = await client.get(
-    projectPath(input.project, `/search?q=${encodeURIComponent(input.query)}`)
-  );
-  if (result.matches.length === 0) {
-    return { summary: `No matches for "${input.query}".` };
+function spliceNeatBlock(raw) {
+  const block = CODEX_NEAT_BLOCK;
+  const lines = raw.length > 0 ? raw.split("\n") : [];
+  const start = lines.findIndex(isNeatHeader);
+  if (start === -1) {
+    const base = raw.replace(/\n+$/, "");
+    return base.length > 0 ? `${base}
+
+${block}
+` : `${block}
+`;
   }
-  const provider = result.provider ?? "substring";
-  const blockLines = [];
-  let topScore;
-  for (const n of result.matches) {
-    const score = provider !== "substring" && typeof n.score === "number" ? n.score : void 0;
-    const scoreBit = score !== void 0 ? ` [score=${score.toFixed(2)}]` : "";
-    if (score !== void 0 && (topScore === void 0 || score > topScore)) topScore = score;
-    blockLines.push(
-      `  \u2022 ${n.id} (${n.type}) \u2014 ${n.name ?? n.id}${scoreBit}`
-    );
+  let end = start + 1;
+  for (; ; ) {
+    while (end < lines.length && !isTableHeader(lines[end])) end++;
+    if (end < lines.length && isNeatChildHeader(lines[end])) {
+      end++;
+      continue;
+    }
+    break;
   }
-  return {
-    summary: `Found ${result.matches.length} match${result.matches.length === 1 ? "" : "es"} for "${input.query}" via ${provider} provider.`,
-    block: blockLines.join("\n"),
-    confidence: topScore
-  };
+  const before = lines.slice(0, start).join("\n").replace(/\n*$/, "");
+  const after = lines.slice(end).join("\n").replace(/^\n*/, "");
+  let text = "";
+  if (before.length > 0) text += `${before}
+
+`;
+  text += `${block}
+`;
+  if (after.length > 0) text += `
+${after}`;
+  return `${text.replace(/\n*$/, "")}
+`;
 }
-async function runDiff(client, input) {
-  const result = await client.get(
-    projectPath(
-      input.project,
-      `/graph/diff?against=${encodeURIComponent(input.againstSnapshot)}`
-    )
-  );
-  const total = result.added.nodes.length + result.added.edges.length + result.removed.nodes.length + result.removed.edges.length + result.changed.nodes.length + result.changed.edges.length;
-  const baseLabel = result.base.exportedAt ?? "unknown";
-  if (total === 0) {
-    return {
-      summary: `No differences between the current graph and ${input.againstSnapshot} (base exportedAt=${baseLabel}).`
-    };
+function verifyPreserved(raw, spliced, original) {
+  let next;
+  try {
+    next = (0, import_smol_toml6.parse)(spliced);
+  } catch {
+    return false;
   }
-  const blockLines = [
-    `  base exportedAt:    ${baseLabel}`,
-    `  current exportedAt: ${result.current.exportedAt}`,
-    ""
-  ];
-  if (result.added.nodes.length || result.added.edges.length) {
-    blockLines.push("Added:");
-    for (const n of result.added.nodes) blockLines.push(`  + node ${n.id} (${n.type})`);
-    for (const e of result.added.edges)
-      blockLines.push(`  + edge ${e.id} \u2014 ${e.source} -> ${e.target} (${e.type}, ${e.provenance})`);
-    blockLines.push("");
+  const origServers = original.mcp_servers ?? {};
+  const nextServers = next.mcp_servers ?? {};
+  if (!(0, import_node_util.isDeepStrictEqual)(nextServers.neat, CODEX_MCP_SERVER)) return false;
+  for (const name of Object.keys(origServers)) {
+    if (name === "neat") continue;
+    if (!(0, import_node_util.isDeepStrictEqual)(nextServers[name], origServers[name])) return false;
   }
-  if (result.removed.nodes.length || result.removed.edges.length) {
-    blockLines.push("Removed:");
-    for (const n of result.removed.nodes) blockLines.push(`  - node ${n.id} (${n.type})`);
-    for (const e of result.removed.edges)
-      blockLines.push(`  - edge ${e.id} \u2014 ${e.source} -> ${e.target} (${e.type}, ${e.provenance})`);
-    blockLines.push("");
+  for (const name of Object.keys(nextServers)) {
+    if (name !== "neat" && !(name in origServers)) return false;
   }
-  if (result.changed.nodes.length || result.changed.edges.length) {
-    blockLines.push("Changed:");
-    for (const c of result.changed.nodes) {
-      blockLines.push(`  ~ node ${c.id} \u2014 ${summariseAttrDiff(c.before, c.after)}`);
-    }
-    for (const c of result.changed.edges) {
-      const provBit = c.before.provenance !== c.after.provenance ? `provenance ${c.before.provenance} \u2192 ${c.after.provenance}` : summariseAttrDiff(c.before, c.after);
-      blockLines.push(`  ~ edge ${c.id} \u2014 ${provBit}`);
-    }
+  for (const key of Object.keys(original)) {
+    if (key === "mcp_servers") continue;
+    if (!(0, import_node_util.isDeepStrictEqual)(next[key], original[key])) return false;
   }
-  return {
-    summary: `Diff against ${input.againstSnapshot}: ${total} change${total === 1 ? "" : "s"} between the snapshot and the live graph.`,
-    block: blockLines.join("\n").trimEnd()
-  };
-}
-function summariseAttrDiff(before, after) {
-  const keys = /* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(after)]);
-  const changed = [];
-  for (const k of keys) {
-    if (JSON.stringify(before[k]) !== JSON.stringify(after[k])) changed.push(k);
+  for (const key of Object.keys(next)) {
+    if (key !== "mcp_servers" && !(key in original)) return false;
   }
-  return changed.length === 0 ? "attributes differ" : `fields changed: ${changed.sort().join(", ")}`;
+  return true;
 }
-async function runStaleEdges(client, input) {
-  const params = new URLSearchParams();
-  if (input.limit !== void 0) params.set("limit", String(input.limit));
-  if (input.edgeType) params.set("edgeType", input.edgeType);
-  const qs = params.size > 0 ? `?${params.toString()}` : "";
-  const body = await client.get(
-    projectPath(input.project, `/stale-events${qs}`)
-  );
-  const events = body.events;
-  if (events.length === 0) {
-    return {
-      summary: input.edgeType ? `No stale ${input.edgeType} edges recorded.` : "No stale-edge transitions recorded yet."
-    };
+function agentsBlock(guide) {
+  return `${NEAT_GRAPH_FIRST_START}
+${guide.replace(/\s+$/, "")}
+${NEAT_GRAPH_FIRST_END}
+`;
+}
+function upsertAgents(raw, guide) {
+  const block = agentsBlock(guide);
+  if (raw.length === 0) return { text: block, changed: true };
+  const startIdx = raw.indexOf(NEAT_GRAPH_FIRST_START);
+  const endIdx = raw.indexOf(NEAT_GRAPH_FIRST_END);
+  if (startIdx !== -1 && endIdx !== -1 && endIdx > startIdx) {
+    const before = raw.slice(0, startIdx);
+    const after = raw.slice(endIdx + NEAT_GRAPH_FIRST_END.length);
+    const text2 = `${before}${block.replace(/\n+$/, "")}${after}`;
+    return { text: text2, changed: text2 !== raw };
   }
-  const blockLines = events.map(
-    (e) => `  ${e.transitionedAt} \u2014 ${e.source} -[${e.edgeType}]-> ${e.target} (last seen ${e.lastObserved}, threshold ${formatDuration(e.thresholdMs)})`
-  );
-  return {
-    summary: `${events.length} stale-edge transition${events.length === 1 ? "" : "s"} recorded${input.edgeType ? ` for ${input.edgeType}` : ""}.`,
-    block: blockLines.join("\n"),
-    provenance: import_types96.Provenance.STALE
-  };
+  const base = raw.replace(/\n+$/, "");
+  const text = base.length > 0 ? `${base}
+
+${block}` : block;
+  return { text, changed: text !== raw };
 }
-async function runPolicies(client, input) {
-  let violations;
-  let allowed = true;
-  let hypothetical;
-  if (input.hypotheticalAction) {
-    if (typeof client.post !== "function") {
-      throw new Error("HttpClient does not support POST \u2014 required for policies dry-run");
+async function readGuide() {
+  return readSkillAsset(GUIDE_FILENAME);
+}
+async function runCodex(opts) {
+  if (opts.printConfig) {
+    process.stdout.write(`${CODEX_NEAT_BLOCK}
+`);
+    return { exitCode: 0 };
+  }
+  if (opts.printGuide) {
+    process.stdout.write(agentsBlock(await readGuide()));
+    return { exitCode: 0 };
+  }
+  const configPath = codexConfigPath();
+  const agentsPath = agentsFilePath();
+  let configRaw = "";
+  try {
+    configRaw = await import_node_fs55.promises.readFile(configPath, "utf8");
+  } catch (err) {
+    if (err.code !== "ENOENT") {
+      console.error(`neat codex: failed to read ${configPath} \u2014 ${err.message}`);
+      return { exitCode: 1 };
     }
-    const body = await client.post(
-      projectPath(input.project, "/policies/check"),
-      { hypotheticalAction: input.hypotheticalAction }
-    );
-    violations = body.violations;
-    allowed = body.allowed;
-    hypothetical = body.hypotheticalAction;
-  } else {
-    const params = new URLSearchParams();
-    if (input.policyId) params.set("policyId", input.policyId);
-    const qs = params.size > 0 ? `?${params.toString()}` : "";
-    const body = await client.get(
-      projectPath(input.project, `/policies/violations${qs}`)
+  }
+  let agentsRaw = "";
+  try {
+    agentsRaw = await import_node_fs55.promises.readFile(agentsPath, "utf8");
+  } catch (err) {
+    if (err.code !== "ENOENT") {
+      console.error(`neat codex: failed to read ${agentsPath} \u2014 ${err.message}`);
+      return { exitCode: 1 };
+    }
+  }
+  let config;
+  try {
+    config = upsertCodexConfig(configRaw);
+  } catch (err) {
+    console.error(
+      `neat codex: ${configPath} is not valid TOML \u2014 ${err.message}`
     );
-    violations = body.violations;
-    allowed = violations.every((v) => v.onViolation !== "block");
+    console.error("neat codex: fix the file and re-run; nothing was written.");
+    return { exitCode: 1 };
   }
-  if (input.nodeId) {
-    violations = violations.filter(
-      (v) => v.subject.nodeId === input.nodeId || v.subject.path?.includes(input.nodeId)
+  const guide = await readGuide();
+  const agents = upsertAgents(agentsRaw, guide);
+  if (!opts.apply) {
+    console.log("neat codex \u2014 plan (nothing written; re-run with --apply to write)");
+    console.log("");
+    console.log(`  Codex MCP config: ${configPath}`);
+    console.log(
+      config.changed ? `    ${configRaw ? "update" : "create"} the [mcp_servers.neat] table:` : "    already up to date \u2014 [mcp_servers.neat] matches"
     );
+    if (config.changed) {
+      for (const line of CODEX_NEAT_BLOCK.split("\n")) console.log(`      ${line}`);
+    }
+    console.log("");
+    console.log(`  Project instructions: ${agentsPath}`);
+    console.log(
+      agents.changed ? `    ${agentsRaw ? "update" : "create"} the graph-first block (between ${NEAT_GRAPH_FIRST_START} markers)` : "    already up to date \u2014 graph-first block matches"
+    );
+    console.log("");
+    console.log("The MCP server reads NEAT_CORE_URL for the daemon URL \u2014 edit that value in");
+    console.log("the generated table to point Codex at a non-default daemon.");
+    return { exitCode: 0 };
   }
-  if (violations.length === 0) {
-    return {
-      summary: hypothetical ? `No violations would result from the hypothetical action (${hypothetical.kind}).` : "No policy violations recorded."
-    };
+  if (config.changed) {
+    await import_node_fs55.promises.mkdir(import_node_path90.default.dirname(configPath), { recursive: true });
+    await import_node_fs55.promises.writeFile(configPath, config.text, "utf8");
+    console.log(`neat codex: wrote [mcp_servers.neat] to ${configPath}`);
+  } else {
+    console.log(`neat codex: ${configPath} already has NEAT's MCP server`);
   }
-  const blockCount = violations.filter((v) => v.onViolation === "block").length;
-  const summaryParts = [];
-  if (hypothetical) {
-    summaryParts.push(
-      `Hypothetical ${hypothetical.kind} would surface ${violations.length} violation${violations.length === 1 ? "" : "s"}`
-    );
+  if (agents.changed) {
+    await import_node_fs55.promises.mkdir(import_node_path90.default.dirname(agentsPath), { recursive: true });
+    await import_node_fs55.promises.writeFile(agentsPath, agents.text, "utf8");
+    console.log(`neat codex: wrote the graph-first block to ${agentsPath}`);
   } else {
-    summaryParts.push(
-      `${violations.length} policy violation${violations.length === 1 ? "" : "s"} currently recorded`
-    );
+    console.log(`neat codex: ${agentsPath} already has the graph-first block`);
   }
-  if (blockCount > 0) summaryParts.push(`${blockCount} of which block`);
-  if (!allowed && hypothetical) summaryParts.push("action denied");
-  const summary = summaryParts.join("; ") + ".";
-  const blockLines = violations.map((v) => {
-    const subject = v.subject.nodeId ?? v.subject.edgeId ?? v.subject.path?.[0] ?? "(global)";
-    return `  \u2022 [${v.severity}/${v.onViolation}] ${v.policyName}: ${v.message} \u2014 ${subject}`;
-  });
-  const severities = [...new Set(violations.map((v) => v.severity))];
-  return {
-    summary,
-    block: blockLines.join("\n"),
-    confidence: hypothetical ? 0.7 : 1,
-    provenance: severities.join(" ")
-  };
+  console.log("");
+  console.log("restart Codex to pick up the new MCP server. NEAT_CORE_URL in the table");
+  console.log("points the server at the local daemon \u2014 edit it for a non-default one.");
+  return { exitCode: 0 };
 }
-function formatDivergenceLine(d) {
-  switch (d.type) {
-    case "missing-observed":
-    case "missing-extracted":
-      if (d.column) {
-        return `  \u2022 [${d.type}] ${d.table ?? d.source} column ${d.column} \u2014 confidence ${d.confidence.toFixed(2)}`;
-      }
-      return `  \u2022 [${d.type}] ${d.source} \u2192 ${d.target} (${d.edgeType}) \u2014 confidence ${d.confidence.toFixed(2)}`;
-    case "version-mismatch":
-      return `  \u2022 [${d.type}] ${d.source} \u2192 ${d.target} \u2014 declared ${d.extractedVersion}, observed engine ${d.observedVersion} (${d.compatibility})`;
-    case "host-mismatch":
-      return `  \u2022 [${d.type}] ${d.source} \u2192 ${d.target} \u2014 declared host ${d.extractedHost}, observed host ${d.observedHost}`;
-    case "compat-violation":
-      return `  \u2022 [${d.type}] ${d.source} \u2192 ${d.target} \u2014 ${d.rule.kind}${d.rule.package ? ` (${d.rule.package})` : ""}`;
-    case "observed-symbol-mismatch": {
-      const at = d.location ? ` at ${d.location}` : "";
-      const member = d.symbol ? ` ${d.symbol}` : "";
-      return `  \u2022 [${d.type}] ${d.source}${member}${at} (${d.mismatchKind}) \u2014 confidence ${d.confidence.toFixed(2)}`;
+function usage3() {
+  console.log("neat codex \u2014 install NEAT into the OpenAI Codex CLI (MCP server + AGENTS.md)");
+  console.log("");
+  console.log("  (no flag)        plan: print what would change, write nothing");
+  console.log("  --apply          add [mcp_servers.neat] to ~/.codex/config.toml and write");
+  console.log("                   the graph-first block into ./AGENTS.md, merging into both");
+  console.log("                   without touching your other servers or instructions");
+  console.log("  --print-config   print the [mcp_servers.neat] TOML block to stdout");
+  console.log("  --print-guide    print the AGENTS.md graph-first block to stdout");
+  console.log("");
+  console.log("Existing config is preserved and a re-run is a no-op. A malformed");
+  console.log("config.toml is a clear error with no partial write.");
+}
+async function runCodexCommand(args) {
+  const opts = { apply: false, printConfig: false, printGuide: false };
+  for (const arg of args) {
+    switch (arg) {
+      case "--apply":
+        opts.apply = true;
+        break;
+      case "--print-config":
+        opts.printConfig = true;
+        break;
+      case "--print-guide":
+        opts.printGuide = true;
+        break;
+      case "-h":
+      case "--help":
+        usage3();
+        return 0;
+      default:
+        console.error(`neat codex: unknown flag "${arg}"`);
+        usage3();
+        return 2;
+    }
+  }
+  try {
+    const { exitCode } = await runCodex(opts);
+    return exitCode;
+  } catch (err) {
+    console.error(err.message);
+    return 1;
+  }
+}
+
+// src/editors-cli.ts
+init_cjs_shims();
+var import_node_path91 = __toESM(require("path"), 1);
+var import_node_os7 = __toESM(require("os"), 1);
+var import_node_fs56 = require("fs");
+var import_node_util2 = require("util");
+var jsonc = __toESM(require("jsonc-parser"), 1);
+var NEAT_MCP_SERVER = {
+  command: "npx",
+  args: ["-y", "@neat.is/mcp"]
+};
+var NEAT_OPENCODE_SERVER = {
+  type: "local",
+  command: ["npx", "-y", "@neat.is/mcp"],
+  enabled: true
+};
+var NEAT_CRUSH_SERVER = {
+  type: "stdio",
+  command: "npx",
+  args: ["-y", "@neat.is/mcp"]
+};
+var GRAPH_FIRST_MARKER_OPEN = "<!-- neat:graph-first -->";
+var GRAPH_FIRST_MARKER_CLOSE = "<!-- /neat:graph-first -->";
+function homeDir() {
+  return process.env.HOME ?? process.env.USERPROFILE ?? import_node_os7.default.homedir();
+}
+function xdgConfigDir() {
+  const xdg = process.env.XDG_CONFIG_HOME;
+  return xdg && xdg.length > 0 ? import_node_path91.default.resolve(xdg) : import_node_path91.default.join(homeDir(), ".config");
+}
+function envOverride(name) {
+  const v = process.env[name];
+  return v && v.length > 0 ? import_node_path91.default.resolve(v) : void 0;
+}
+var CURSOR_CLIENT = {
+  id: "cursor",
+  label: "Cursor",
+  docsUrl: "https://docs.cursor.com/context/mcp",
+  mcpConfigPath: () => envOverride("NEAT_CURSOR_CONFIG") ?? import_node_path91.default.join(homeDir(), ".cursor", "mcp.json"),
+  mcpContainerKey: "mcpServers",
+  format: "json",
+  // Cursor still reads a single `.cursorrules` at the project root (the modern
+  // `.cursor/rules/*.mdc` split is one-rule-per-file with frontmatter — a worse
+  // fit for a marker-fenced block). GRAPH_FIRST.md names this file directly.
+  rulesFileName: ".cursorrules"
+};
+var DEVIN_CLIENT = {
+  id: "devin",
+  label: "Devin Desktop (Cascade)",
+  docsUrl: "https://docs.devin.ai/desktop/cascade/mcp",
+  mcpConfigPath: () => envOverride("NEAT_DEVIN_CONFIG") ?? import_node_path91.default.join(homeDir(), ".codeium", "windsurf", "mcp_config.json"),
+  mcpContainerKey: "mcpServers",
+  format: "json",
+  rulesFileName: ".windsurfrules"
+};
+var GEMINI_CLIENT = {
+  id: "gemini",
+  label: "Gemini CLI",
+  docsUrl: "https://github.com/google-gemini/gemini-cli/blob/main/docs/tools/mcp-server.md",
+  mcpConfigPath: () => envOverride("NEAT_GEMINI_CONFIG") ?? import_node_path91.default.join(homeDir(), ".gemini", "settings.json"),
+  mcpContainerKey: "mcpServers",
+  format: "json",
+  rulesFileName: "GEMINI.md"
+};
+var QWEN_CLIENT = {
+  id: "qwen",
+  label: "Qwen Code",
+  docsUrl: "https://qwenlm.github.io/qwen-code-docs/en/users/features/mcp/",
+  mcpConfigPath: () => envOverride("NEAT_QWEN_CONFIG") ?? import_node_path91.default.join(homeDir(), ".qwen", "settings.json"),
+  mcpContainerKey: "mcpServers",
+  format: "json",
+  rulesFileName: "QWEN.md"
+};
+var AMAZONQ_CLIENT = {
+  id: "amazonq",
+  label: "Amazon Q Developer CLI",
+  docsUrl: "https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/command-line-mcp-configuration.html",
+  mcpConfigPath: () => envOverride("NEAT_AMAZONQ_CONFIG") ?? import_node_path91.default.join(homeDir(), ".aws", "amazonq", "mcp.json"),
+  mcpContainerKey: "mcpServers",
+  format: "json"
+};
+var ROOCODE_CLIENT = {
+  id: "roocode",
+  label: "Roo Code",
+  docsUrl: "https://roocodeinc.github.io/Roo-Code/features/mcp/using-mcp-in-roo",
+  mcpConfigPath: () => envOverride("NEAT_ROOCODE_CONFIG") ?? import_node_path91.default.join(process.cwd(), ".roo", "mcp.json"),
+  mcpContainerKey: "mcpServers",
+  format: "json"
+};
+var ZED_CLIENT = {
+  id: "zed",
+  label: "Zed",
+  docsUrl: "https://zed.dev/docs/ai/mcp",
+  mcpConfigPath: () => {
+    const override = envOverride("NEAT_ZED_CONFIG");
+    if (override) return override;
+    if (process.platform === "win32") {
+      const appData = process.env.APPDATA;
+      if (appData && appData.length > 0) return import_node_path91.default.join(appData, "Zed", "settings.json");
     }
+    return import_node_path91.default.join(homeDir(), ".config", "zed", "settings.json");
+  },
+  mcpContainerKey: "context_servers",
+  format: "jsonc",
+  rulesFileName: ".rules"
+};
+var OPENCODE_CLIENT = {
+  id: "opencode",
+  label: "OpenCode",
+  docsUrl: "https://opencode.ai/docs/mcp-servers/",
+  mcpConfigPath: () => envOverride("NEAT_OPENCODE_CONFIG") ?? import_node_path91.default.join(xdgConfigDir(), "opencode", "opencode.json"),
+  mcpContainerKey: "mcp",
+  format: "json",
+  serverEntry: NEAT_OPENCODE_SERVER,
+  rulesFileName: "AGENTS.md"
+};
+var CRUSH_CLIENT = {
+  id: "crush",
+  label: "Crush",
+  docsUrl: "https://charmbracelet-crush.mintlify.app/configuration/mcp",
+  mcpConfigPath: () => envOverride("NEAT_CRUSH_CONFIG") ?? import_node_path91.default.join(xdgConfigDir(), "crush", "crush.json"),
+  mcpContainerKey: "mcp",
+  format: "json",
+  serverEntry: NEAT_CRUSH_SERVER,
+  rulesFileName: "AGENTS.md"
+};
+var CLIENTS = {
+  cursor: CURSOR_CLIENT,
+  devin: DEVIN_CLIENT,
+  gemini: GEMINI_CLIENT,
+  qwen: QWEN_CLIENT,
+  amazonq: AMAZONQ_CLIENT,
+  roocode: ROOCODE_CLIENT,
+  zed: ZED_CLIENT,
+  opencode: OPENCODE_CLIENT,
+  crush: CRUSH_CLIENT
+};
+function mergeJsonMcp(existing, containerKey, serverEntry) {
+  const servers = existing[containerKey] ?? {};
+  const already = (0, import_node_util2.isDeepStrictEqual)(servers.neat, serverEntry);
+  const merged = {
+    ...existing,
+    [containerKey]: { ...servers, neat: serverEntry }
+  };
+  return { merged, changed: !already };
+}
+function mergeJsoncMcp(raw, containerKey, serverEntry) {
+  const base = raw.trim().length > 0 ? raw : "{}";
+  const parsed = jsonc.parse(base) ?? {};
+  const servers = parsed[containerKey] ?? {};
+  if ((0, import_node_util2.isDeepStrictEqual)(servers.neat, serverEntry)) {
+    return { text: raw, changed: false };
   }
+  const edits = jsonc.modify(base, [containerKey, "neat"], serverEntry, {
+    formattingOptions: { tabSize: 2, insertSpaces: true }
+  });
+  let text = jsonc.applyEdits(base, edits);
+  if (!text.endsWith("\n")) text += "\n";
+  return { text, changed: text !== raw };
 }
-async function runDivergences(client, input) {
-  const params = new URLSearchParams();
-  if (input.type && input.type.length > 0) params.set("type", input.type.join(","));
-  if (input.minConfidence !== void 0) {
-    params.set("minConfidence", String(input.minConfidence));
-  }
-  if (input.node) params.set("node", input.node);
-  const qs = params.size > 0 ? `?${params.toString()}` : "";
-  const result = await client.get(
-    projectPath(input.project, `/graph/divergences${qs}`)
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function buildGuidanceBlock(guide) {
+  return `${GRAPH_FIRST_MARKER_OPEN}
+${guide.trim()}
+${GRAPH_FIRST_MARKER_CLOSE}
+`;
+}
+function mergeRulesFile(existing, block) {
+  const region = new RegExp(
+    `${escapeRegExp(GRAPH_FIRST_MARKER_OPEN)}[\\s\\S]*?${escapeRegExp(GRAPH_FIRST_MARKER_CLOSE)}\\n?`
   );
-  if (result.totalAffected === 0) {
-    return {
-      summary: "No divergences found between the declared (EXTRACTED) and observed (OBSERVED) views of the graph."
-    };
+  if (region.test(existing)) return existing.replace(region, block);
+  if (existing.trim().length === 0) return block;
+  return `${existing.replace(/\s+$/, "")}
+
+${block}`;
+}
+async function planMcp(client, mcpPath) {
+  const serverEntry = client.serverEntry ?? NEAT_MCP_SERVER;
+  let raw = "";
+  try {
+    raw = await import_node_fs56.promises.readFile(mcpPath, "utf8");
+  } catch (err) {
+    const e = err;
+    if (e.code === "ENOENT") {
+      raw = "";
+    } else {
+      console.error(`neat ${client.id}: failed to read ${mcpPath} \u2014 ${e.message}`);
+      return null;
+    }
   }
-  const headline = result.divergences[0];
-  const summary = `Found ${result.totalAffected} divergence${result.totalAffected === 1 ? "" : "s"} between code and production. Highest-confidence: ${headline.type} on ${headline.source} \u2192 ${headline.target}. ${headline.reason}`;
-  const blockLines = [];
-  for (const d of result.divergences) {
-    blockLines.push(formatDivergenceLine(d));
-    blockLines.push(`    reason: ${d.reason}`);
-    blockLines.push(`    recommendation: ${d.recommendation}`);
+  if (client.format === "jsonc") {
+    if (raw.trim().length > 0) {
+      const errors = [];
+      jsonc.parse(raw, errors, { allowTrailingComma: true });
+      if (errors.length > 0) {
+        const first = errors[0];
+        console.error(
+          `neat ${client.id}: ${mcpPath} is not valid JSONC \u2014 ${jsonc.printParseErrorCode(first.error)} at offset ${first.offset}. Fix it (or move it aside) and re-run; nothing was written.`
+        );
+        return null;
+      }
+    }
+    return mergeJsoncMcp(raw, client.mcpContainerKey, serverEntry);
   }
-  const maxConfidence = result.divergences.reduce(
-    (m, d) => Math.max(m, d.confidence),
-    0
-  );
-  return {
-    summary,
-    block: blockLines.join("\n"),
-    confidence: maxConfidence,
-    provenance: "composite (EXTRACTED + OBSERVED)"
-  };
+  let existing = {};
+  if (raw.trim().length > 0) {
+    try {
+      existing = JSON.parse(raw);
+    } catch (err) {
+      console.error(
+        `neat ${client.id}: ${mcpPath} is not valid JSON \u2014 ${err.message}. Fix it (or move it aside) and re-run; nothing was written.`
+      );
+      return null;
+    }
+  }
+  const { merged, changed } = mergeJsonMcp(existing, client.mcpContainerKey, serverEntry);
+  return { text: JSON.stringify(merged, null, 2) + "\n", changed };
 }
-async function runAsk(client, input) {
-  const result = await client.get(
-    projectPath(input.project, `/graph/ask?q=${encodeURIComponent(input.question)}`)
-  );
-  const blockLines = [];
-  if (result.matched.length > 0) {
-    blockLines.push(
-      `Matched: ${result.matched.map((m) => `${m.nodeId} [${m.via} ${m.score.toFixed(2)}]`).join(", ")}`
-    );
-    blockLines.push(`Intent: ${result.intent}`);
-  } else if (result.scope === "global") {
-    blockLines.push(`Graph-wide answer (${result.intent}) \u2014 no entity named.`);
+async function runEditorInstall(client, opts) {
+  const mcpPath = client.mcpConfigPath();
+  const serverEntry = client.serverEntry ?? NEAT_MCP_SERVER;
+  const hasRules = typeof client.rulesFileName === "string";
+  const rulesPath = hasRules ? import_node_path91.default.join(opts.projectDir, client.rulesFileName) : "";
+  const mcp = await planMcp(client, mcpPath);
+  if (mcp === null) return { exitCode: 1 };
+  let existingRules = "";
+  let newRules = "";
+  let rulesChanged = false;
+  let block = "";
+  if (hasRules) {
+    try {
+      existingRules = await import_node_fs56.promises.readFile(rulesPath, "utf8");
+    } catch (err) {
+      if (err.code !== "ENOENT") {
+        console.error(`neat ${client.id}: failed to read ${rulesPath} \u2014 ${err.message}`);
+        return { exitCode: 1 };
+      }
+    }
+    const guide = await readSkillAsset(GUIDE_FILENAME);
+    block = buildGuidanceBlock(guide);
+    newRules = mergeRulesFile(existingRules, block);
+    rulesChanged = newRules !== existingRules;
   }
-  for (const section of result.sections) {
-    blockLines.push("", section.heading + ":");
-    for (const fact of section.facts) {
-      const tag = fact.provenance ? ` [${fact.provenance}${fact.confidence !== void 0 ? ` ${fact.confidence.toFixed(2)}` : ""}]` : fact.confidence !== void 0 ? ` [confidence ${fact.confidence.toFixed(2)}]` : "";
-      blockLines.push(`  \u2022 ${fact.text}${tag}`);
+  if (!opts.apply) {
+    console.log(`neat ${client.id} \u2014 wire NEAT into ${client.label} (plan; nothing written)`);
+    console.log("");
+    console.log(`MCP server \u2192 ${mcpPath}`);
+    console.log(
+      mcp.changed ? `  would add ${client.mcpContainerKey}.neat:` : `  ${client.mcpContainerKey}.neat already present and current \u2014 no change:`
+    );
+    console.log(indent(JSON.stringify({ neat: serverEntry }, null, 2)));
+    if (hasRules) {
+      console.log("");
+      console.log(`Graph-first guidance \u2192 ${rulesPath}`);
+      console.log(
+        rulesChanged ? existingRules.includes(GRAPH_FIRST_MARKER_OPEN) ? "  would refresh the neat:graph-first block:" : "  would add the neat:graph-first block:" : "  neat:graph-first block already present and current \u2014 no change."
+      );
+      if (rulesChanged) console.log(indent(block.trimEnd()));
     }
+    console.log("");
+    console.log(
+      hasRules ? `Re-run with --apply to write both files. Existing servers and rules are kept.` : `Re-run with --apply to write the config. Existing servers are kept.`
+    );
+    return { exitCode: 0 };
   }
-  return {
-    summary: result.answer,
-    block: blockLines.join("\n").trim(),
-    ...result.confidence !== void 0 ? { confidence: result.confidence } : {},
-    ...result.provenance.length > 0 ? { provenance: result.provenance } : {}
-  };
-}
-function formatFooter(confidence, provenance) {
-  const c = confidence === void 0 ? "n/a" : confidence.toFixed(2);
-  const p = provenance === void 0 ? "n/a" : Array.isArray(provenance) ? [...new Set(provenance)].join(", ") : provenance;
-  return `confidence: ${c} \xB7 provenance: ${p}`;
+  await import_node_fs56.promises.mkdir(import_node_path91.default.dirname(mcpPath), { recursive: true });
+  await import_node_fs56.promises.writeFile(mcpPath, mcp.text, "utf8");
+  if (hasRules) {
+    await import_node_fs56.promises.mkdir(import_node_path91.default.dirname(rulesPath), { recursive: true });
+    await import_node_fs56.promises.writeFile(rulesPath, newRules, "utf8");
+  }
+  console.log(`neat ${client.id}: wired NEAT into ${client.label}`);
+  console.log(`  MCP server: ${mcpPath} (${client.mcpContainerKey}.neat \u2192 npx -y @neat.is/mcp)`);
+  if (hasRules) console.log(`  guidance:   ${rulesPath} (neat:graph-first block)`);
+  console.log("");
+  console.log(`restart ${client.label} to pick up the MCP server. Point it at a non-default`);
+  console.log(`daemon by setting NEAT_CORE_URL in the neat server's env in that config.`);
+  return { exitCode: 0 };
 }
-function formatHuman(result) {
-  const sections = [result.summary.trim()];
-  if (result.block && result.block.trim().length > 0) sections.push(result.block.trimEnd());
-  sections.push(formatFooter(result.confidence, result.provenance));
-  return sections.join("\n\n");
+function indent(text) {
+  return text.split("\n").map((line) => line.length > 0 ? `    ${line}` : line).join("\n");
 }
-function formatJson(result) {
-  return JSON.stringify(
-    {
-      summary: result.summary,
-      block: result.block ?? "",
-      confidence: result.confidence ?? null,
-      provenance: result.provenance ?? null
-    },
-    null,
-    2
+function usage4(client) {
+  const hasRules = typeof client.rulesFileName === "string";
+  console.log(
+    hasRules ? `neat ${client.id} \u2014 install NEAT's MCP server + graph-first guidance into ${client.label}` : `neat ${client.id} \u2014 install NEAT's MCP server into ${client.label}`
   );
+  console.log("");
+  console.log(
+    hasRules ? "  --apply   write the MCP config and the rules file (default: plan only)" : "  --apply   write the MCP config (default: plan only)"
+  );
+  console.log("");
+  console.log("Writes NEAT's stdio MCP server (npx -y @neat.is/mcp) into");
+  console.log(`  ${client.mcpConfigPath()}`);
+  if (hasRules) {
+    console.log(`and the graph-first guidance block into ./${client.rulesFileName}, both`);
+    console.log("additively \u2014 existing servers and rules are preserved, a re-run is a no-op.");
+  } else {
+    console.log("additively \u2014 existing servers are preserved, a re-run is a no-op.");
+  }
+  console.log("");
+  console.log(`See ${client.docsUrl} for ${client.label}'s MCP config format.`);
 }
-function exitCodeForError(err) {
-  if (err instanceof TransportError) return 3;
-  if (err instanceof HttpError) return 1;
-  return 1;
-}
-function createSnapshotPushClient(baseUrl, token) {
-  return createHttpClient(baseUrl, token && token.length > 0 ? token : void 0);
-}
-async function pushSnapshotToRemote(input) {
-  const client = createSnapshotPushClient(input.baseUrl, input.token);
-  if (typeof client.post !== "function") {
-    throw new Error("HttpClient does not support POST \u2014 required for snapshot push");
+async function runEditorCommand(clientId, args, projectDir = process.cwd()) {
+  const client = CLIENTS[clientId];
+  let apply6 = false;
+  for (const arg of args) {
+    switch (arg) {
+      case "--apply":
+        apply6 = true;
+        break;
+      case "-h":
+      case "--help":
+        usage4(client);
+        return 0;
+      default:
+        console.error(`neat ${client.id}: unknown flag "${arg}"`);
+        usage4(client);
+        return 2;
+    }
+  }
+  try {
+    const { exitCode } = await runEditorInstall(client, { apply: apply6, projectDir });
+    return exitCode;
+  } catch (err) {
+    console.error(err.message);
+    return 1;
   }
-  return client.post(
-    `/projects/${encodeURIComponent(input.project)}/snapshot`,
-    { snapshot: input.snapshot }
-  );
 }
 
 // src/monitor.ts
+init_cjs_shims();
+var import_types101 = require("@neat.is/types");
 var OBSERVED_DEP_EDGE_TYPES = /* @__PURE__ */ new Set([
-  import_types97.EdgeType.CALLS,
-  import_types97.EdgeType.CONNECTS_TO,
-  import_types97.EdgeType.PUBLISHES_TO,
-  import_types97.EdgeType.CONSUMES_FROM
+  import_types101.EdgeType.CALLS,
+  import_types101.EdgeType.CONNECTS_TO,
+  import_types101.EdgeType.PUBLISHES_TO,
+  import_types101.EdgeType.CONSUMES_FROM
 ]);
 function divergenceKey(d) {
   const column = "column" in d && d.column ? d.column : "";
@@ -29314,7 +29713,7 @@ function formatDivergenceLine2(d) {
   }
 }
 function formatStaleLine(edgeId) {
-  const parsed = (0, import_types97.parseEdgeId)(edgeId);
+  const parsed = (0, import_types101.parseEdgeId)(edgeId);
   if (parsed) {
     return `\u22EF stale  ${parsed.source} \u2192 ${parsed.target}  (observed edge went quiet)`;
   }
@@ -29327,7 +29726,7 @@ function divergenceJson(d) {
   return JSON.stringify({ kind: "divergence", ...d });
 }
 function staleJson(edgeId) {
-  const parsed = (0, import_types97.parseEdgeId)(edgeId);
+  const parsed = (0, import_types101.parseEdgeId)(edgeId);
   return JSON.stringify({
     kind: "stale",
     edgeId,
@@ -29397,7 +29796,7 @@ var MonitorEmitter = class {
   // ignores non-OBSERVED edges and non-dependency edge types (structural
   // ownership), so only real runtime dependencies reach stdout.
   emitObservedEdge(edge) {
-    if (edge.provenance !== import_types97.Provenance.OBSERVED) return false;
+    if (edge.provenance !== import_types101.Provenance.OBSERVED) return false;
     if (!OBSERVED_DEP_EDGE_TYPES.has(edge.type)) return false;
     const key = `edge|${edge.id}`;
     if (this.seen.has(key)) return false;
@@ -29555,7 +29954,7 @@ async function runMonitor(opts) {
       case "edge-added": {
         const payload = safeParse(frame.data);
         const edge = payload?.edge;
-        if (edge && edge.provenance === import_types97.Provenance.OBSERVED) {
+        if (edge && edge.provenance === import_types101.Provenance.OBSERVED) {
           emitter.emitObservedEdge(edge);
           divergences.schedule();
         }
@@ -29635,7 +30034,7 @@ function sleep(ms, signal) {
 
 // src/cli-verbs.ts
 init_cjs_shims();
-var import_node_path91 = __toESM(require("path"), 1);
+var import_node_path92 = __toESM(require("path"), 1);
 async function resolveProjectEntry(opts) {
   const entries = await listProjects();
   if (opts.project) {
@@ -29645,7 +30044,7 @@ async function resolveProjectEntry(opts) {
   const cwd = opts.cwd ?? process.cwd();
   const resolvedCwd = await normalizeProjectPath(cwd);
   for (const entry2 of entries) {
-    if (resolvedCwd === entry2.path || resolvedCwd.startsWith(`${entry2.path}${import_node_path91.default.sep}`)) {
+    if (resolvedCwd === entry2.path || resolvedCwd.startsWith(`${entry2.path}${import_node_path92.default.sep}`)) {
       return entry2;
     }
   }
@@ -29798,7 +30197,7 @@ async function runSync(opts) {
 }
 
 // src/cli.ts
-var import_types98 = require("@neat.is/types");
+var import_types102 = require("@neat.is/types");
 function isNpxInvocation() {
   if (process.env.npm_command === "exec") return true;
   const execpath = process.env.npm_execpath ?? "";
@@ -29947,6 +30346,9 @@ function usage5() {
   console.log("                   test <id>        re-check an existing connector's credential");
   console.log("                 Credentials default to an env-var reference ($VAR) resolved at");
   console.log("                 run time; the config file is written owner-only (0600).");
+  console.log("  doctor         Preflight this directory's setup \u2014 Node version, project,");
+  console.log("                 and daemon reachability \u2014 and print a fix for anything down.");
+  console.log("                 Flags: --json. Exits 0 when all pass, 1 when a check fails.");
   console.log("");
   console.log("query commands (mirror the MCP tools, ADR-050):");
   console.log("  ask <question>                   Plain-language door: resolves the question to");
@@ -30172,7 +30574,7 @@ async function buildPatchSections(services, project) {
 }
 async function runInit(opts) {
   const written = [];
-  const stat = await import_node_fs56.promises.stat(opts.scanPath).catch(() => null);
+  const stat = await import_node_fs57.promises.stat(opts.scanPath).catch(() => null);
   if (!stat || !stat.isDirectory()) {
     console.error(`neat init: ${opts.scanPath} is not a directory`);
     return { exitCode: 2, writtenFiles: written };
@@ -30181,13 +30583,13 @@ async function runInit(opts) {
   printDiscoveryReport(opts, services);
   const sections = opts.noInstall ? [] : await buildPatchSections(services, opts.project);
   const patch = renderPatch(sections);
-  const patchPath = import_node_path92.default.join(opts.scanPath, "neat.patch");
+  const patchPath = import_node_path93.default.join(opts.scanPath, "neat.patch");
   if (opts.dryRun) {
-    await import_node_fs56.promises.writeFile(patchPath, patch, "utf8");
+    await import_node_fs57.promises.writeFile(patchPath, patch, "utf8");
     written.push(patchPath);
     console.log(`dry-run: patch written to ${patchPath}`);
-    const gitignorePath = import_node_path92.default.join(opts.scanPath, ".gitignore");
-    const gitignoreExists = await import_node_fs56.promises.stat(gitignorePath).then(() => true).catch(() => false);
+    const gitignorePath = import_node_path93.default.join(opts.scanPath, ".gitignore");
+    const gitignoreExists = await import_node_fs57.promises.stat(gitignorePath).then(() => true).catch(() => false);
     const verb = gitignoreExists ? "append" : "create";
     console.log(`dry-run: would ${verb} ${gitignorePath} (add neat-out/)`);
     console.log("rerun without --dry-run to register and snapshot.");
@@ -30198,9 +30600,9 @@ async function runInit(opts) {
   const graph = getGraph(graphKey);
   const projectPaths = pathsForProject(
     graphKey,
-    import_node_path92.default.join(opts.scanPath, "neat-out")
+    import_node_path93.default.join(opts.scanPath, "neat-out")
   );
-  const errorsPath = import_node_path92.default.join(import_node_path92.default.dirname(opts.outPath), import_node_path92.default.basename(projectPaths.errorsPath));
+  const errorsPath = import_node_path93.default.join(import_node_path93.default.dirname(opts.outPath), import_node_path93.default.basename(projectPaths.errorsPath));
   const result = await extractFromDirectory(graph, opts.scanPath, { errorsPath });
   await saveGraphToDisk(graph, opts.outPath);
   written.push(opts.outPath);
@@ -30279,7 +30681,7 @@ async function runInit(opts) {
         console.log("Run `npm install` (or your language equivalent) to refresh lockfiles.");
       }
     } else {
-      await import_node_fs56.promises.writeFile(patchPath, patch, "utf8");
+      await import_node_fs57.promises.writeFile(patchPath, patch, "utf8");
       written.push(patchPath);
     }
   }
@@ -30320,9 +30722,9 @@ var CLAUDE_SKILL_CONFIG = {
 };
 function claudeConfigPath() {
   const override = process.env.NEAT_CLAUDE_CONFIG;
-  if (override && override.length > 0) return import_node_path92.default.resolve(override);
+  if (override && override.length > 0) return import_node_path93.default.resolve(override);
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return import_node_path92.default.join(home, ".claude.json");
+  return import_node_path93.default.join(home, ".claude.json");
 }
 async function runSkill(opts) {
   const snippet2 = JSON.stringify(CLAUDE_SKILL_CONFIG, null, 2) + "\n";
@@ -30334,7 +30736,7 @@ async function runSkill(opts) {
     const target = claudeConfigPath();
     let existing = {};
     try {
-      existing = JSON.parse(await import_node_fs56.promises.readFile(target, "utf8"));
+      existing = JSON.parse(await import_node_fs57.promises.readFile(target, "utf8"));
     } catch (err) {
       if (err.code !== "ENOENT") {
         console.error(`neat skill: failed to read ${target} \u2014 ${err.message}`);
@@ -30346,8 +30748,8 @@ async function runSkill(opts) {
       ...existing,
       mcpServers: { ...mcp, neat: CLAUDE_SKILL_CONFIG.mcpServers.neat }
     };
-    await import_node_fs56.promises.mkdir(import_node_path92.default.dirname(target), { recursive: true });
-    await import_node_fs56.promises.writeFile(target, JSON.stringify(merged, null, 2) + "\n", "utf8");
+    await import_node_fs57.promises.mkdir(import_node_path93.default.dirname(target), { recursive: true });
+    await import_node_fs57.promises.writeFile(target, JSON.stringify(merged, null, 2) + "\n", "utf8");
     console.log(`neat skill: wrote mcpServers.neat to ${target}`);
     console.log("restart Claude Code to pick up the new MCP server.");
     console.log("");
@@ -30386,6 +30788,11 @@ async function main() {
     if (code !== 0) process.exit(code);
     return;
   }
+  if (cmd0 === "doctor") {
+    const code = await runDoctorCommand(argv.slice(1));
+    if (code !== 0) process.exit(code);
+    return;
+  }
   if (cmd0 === "hooks") {
     const code = await runHooksCommand(argv.slice(1));
     if (code !== 0) process.exit(code);
@@ -30438,12 +30845,12 @@ async function main() {
       console.error("neat init: --apply and --dry-run are mutually exclusive");
       process.exit(2);
     }
-    const scanPath = import_node_path92.default.resolve(target);
+    const scanPath = import_node_path93.default.resolve(target);
     const projectExplicit = parsed.project !== null;
-    const projectName = projectExplicit ? project : import_node_path92.default.basename(scanPath);
+    const projectName = projectExplicit ? project : import_node_path93.default.basename(scanPath);
     const projectKey = projectExplicit ? project : DEFAULT_PROJECT;
-    const fallback = pathsForProject(projectKey, import_node_path92.default.join(scanPath, "neat-out")).snapshotPath;
-    const outPath = import_node_path92.default.resolve(process.env.NEAT_OUT_PATH ?? fallback);
+    const fallback = pathsForProject(projectKey, import_node_path93.default.join(scanPath, "neat-out")).snapshotPath;
+    const outPath = import_node_path93.default.resolve(process.env.NEAT_OUT_PATH ?? fallback);
     const result = await runInit({
       scanPath,
       outPath,
@@ -30464,21 +30871,21 @@ async function main() {
       usage5();
       process.exit(2);
     }
-    const scanPath = import_node_path92.default.resolve(target);
-    const stat = await import_node_fs56.promises.stat(scanPath).catch(() => null);
+    const scanPath = import_node_path93.default.resolve(target);
+    const stat = await import_node_fs57.promises.stat(scanPath).catch(() => null);
     if (!stat || !stat.isDirectory()) {
       console.error(`neat watch: ${scanPath} is not a directory`);
       process.exit(2);
     }
-    const projectPaths = pathsForProject(project, import_node_path92.default.join(scanPath, "neat-out"));
-    const outPath = import_node_path92.default.resolve(process.env.NEAT_OUT_PATH ?? projectPaths.snapshotPath);
-    const errorsPath = import_node_path92.default.resolve(
-      process.env.NEAT_ERRORS_PATH ?? import_node_path92.default.join(import_node_path92.default.dirname(outPath), import_node_path92.default.basename(projectPaths.errorsPath))
+    const projectPaths = pathsForProject(project, import_node_path93.default.join(scanPath, "neat-out"));
+    const outPath = import_node_path93.default.resolve(process.env.NEAT_OUT_PATH ?? projectPaths.snapshotPath);
+    const errorsPath = import_node_path93.default.resolve(
+      process.env.NEAT_ERRORS_PATH ?? import_node_path93.default.join(import_node_path93.default.dirname(outPath), import_node_path93.default.basename(projectPaths.errorsPath))
     );
-    const staleEventsPath = import_node_path92.default.resolve(
-      process.env.NEAT_STALE_EVENTS_PATH ?? import_node_path92.default.join(import_node_path92.default.dirname(outPath), import_node_path92.default.basename(projectPaths.staleEventsPath))
+    const staleEventsPath = import_node_path93.default.resolve(
+      process.env.NEAT_STALE_EVENTS_PATH ?? import_node_path93.default.join(import_node_path93.default.dirname(outPath), import_node_path93.default.basename(projectPaths.staleEventsPath))
     );
-    const embeddingsCachePath = process.env.NEAT_EMBEDDINGS_CACHE_PATH ? import_node_path92.default.resolve(process.env.NEAT_EMBEDDINGS_CACHE_PATH) : void 0;
+    const embeddingsCachePath = process.env.NEAT_EMBEDDINGS_CACHE_PATH ? import_node_path93.default.resolve(process.env.NEAT_EMBEDDINGS_CACHE_PATH) : void 0;
     const handle = await startWatch(getGraph(project), {
       scanPath,
       outPath,
@@ -30487,7 +30894,7 @@ async function main() {
       project,
       // Resolve NEAT_HOME so a `neat watch` picks up connectors added to
       // ~/.neat/connectors.json (#871). Same resolution the rest of the CLI uses.
-      neatHome: process.env.NEAT_HOME ? import_node_path92.default.resolve(process.env.NEAT_HOME) : import_node_path92.default.join(import_node_os8.default.homedir(), ".neat"),
+      neatHome: process.env.NEAT_HOME ? import_node_path93.default.resolve(process.env.NEAT_HOME) : import_node_path93.default.join(import_node_os8.default.homedir(), ".neat"),
       ...embeddingsCachePath ? { embeddingsCachePath } : {},
       host: process.env.HOST ?? "0.0.0.0",
       port: Number(process.env.PORT ?? 8080),
@@ -30669,11 +31076,11 @@ async function main() {
   process.exit(1);
 }
 async function tryOrchestrator(cmd, parsed) {
-  const scanPath = import_node_path92.default.resolve(cmd);
-  const stat = await import_node_fs56.promises.stat(scanPath).catch(() => null);
+  const scanPath = import_node_path93.default.resolve(cmd);
+  const stat = await import_node_fs57.promises.stat(scanPath).catch(() => null);
   if (!stat || !stat.isDirectory()) return null;
   const projectExplicit = parsed.project !== null;
-  const projectName = projectExplicit ? parsed.project : import_node_path92.default.basename(scanPath);
+  const projectName = projectExplicit ? parsed.project : import_node_path93.default.basename(scanPath);
   const result = await runOrchestrator({
     scanPath,
     project: projectName,
@@ -30874,10 +31281,10 @@ async function runQueryVerb(cmd, parsed) {
         const parts = parsed.type.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
         const out = [];
         for (const p of parts) {
-          const r = import_types98.DivergenceTypeSchema.safeParse(p);
+          const r = import_types102.DivergenceTypeSchema.safeParse(p);
           if (!r.success) {
             console.error(
-              `neat divergences: unknown --type "${p}". allowed: ${import_types98.DivergenceTypeSchema.options.join(", ")}`
+              `neat divergences: unknown --type "${p}". allowed: ${import_types102.DivergenceTypeSchema.options.join(", ")}`
             );
             return 2;
           }