repowisestage 0.0.70 → 0.0.72

package/dist/bin/repowise.js

@@ -508,19 +508,19 @@ var init_src = __esm({
 // ../listener/dist/process-manager.js
 import { spawn } from "child_process";
 import { openSync, closeSync } from "fs";
-import { readFile as readFile6, writeFile as writeFile7, mkdir as mkdir7, unlink as unlink5 } from "fs/promises";
+import { readFile as readFile7, writeFile as writeFile8, mkdir as mkdir7, unlink as unlink6 } from "fs/promises";
 import { homedir as homedir2 } from "os";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 import { createRequire } from "module";
 import { fileURLToPath } from "url";
 function repowiseDir() {
   return getConfigDir();
 }
 function pidPath() {
-  return join10(repowiseDir(), "listener.pid");
+  return join11(repowiseDir(), "listener.pid");
 }
 function logDirPath() {
-  return join10(repowiseDir(), "logs");
+  return join11(repowiseDir(), "logs");
 }
 function resolveListenerCommand() {
   try {
@@ -534,7 +534,7 @@ function resolveListenerCommand() {
 }
 async function readPid() {
   try {
-    const content = await readFile6(pidPath(), "utf-8");
+    const content = await readFile7(pidPath(), "utf-8");
     const pid = parseInt(content.trim(), 10);
     return Number.isNaN(pid) ? null : pid;
   } catch (err) {
@@ -560,8 +560,8 @@ async function startBackground() {
   const logDir2 = logDirPath();
   await mkdir7(logDir2, { recursive: true });
   const cmd = resolveListenerCommand();
-  const stdoutFd = openSync(join10(logDir2, "listener-stdout.log"), "a");
-  const stderrFd = openSync(join10(logDir2, "listener-stderr.log"), "a");
+  const stdoutFd = openSync(join11(logDir2, "listener-stdout.log"), "a");
+  const stderrFd = openSync(join11(logDir2, "listener-stderr.log"), "a");
   const child = spawn(process.execPath, [cmd.script, ...cmd.args], {
     detached: true,
     stdio: ["ignore", stdoutFd, stderrFd],
@@ -574,7 +574,7 @@ async function startBackground() {
   const pid = child.pid;
   if (!pid)
     throw new Error("Failed to spawn listener process");
-  await writeFile7(pidPath(), String(pid));
+  await writeFile8(pidPath(), String(pid));
   return pid;
 }
 async function stopProcess() {
@@ -609,7 +609,7 @@ async function isRunning() {
 }
 async function removePidFile() {
   try {
-    await unlink5(pidPath());
+    await unlink6(pidPath());
   } catch {
   }
 }
@@ -1170,12 +1170,12 @@ import { createGunzip } from "zlib";
 import { spawn as spawn3 } from "child_process";
 import { pipeline } from "stream/promises";
 import { createHash as createHash3 } from "crypto";
-import { join as join13, dirname as dirname5 } from "path";
+import { join as join14, dirname as dirname5 } from "path";
 function getNativeLspDir() {
-  return join13(getLspInstallDir(), "native");
+  return join14(getLspInstallDir(), "native");
 }
 function getNativeLspBinDir() {
-  return join13(getNativeLspDir(), "bin");
+  return join14(getNativeLspDir(), "bin");
 }
 async function ensureNativeLspInstalled(lspKey) {
   const entry = NATIVE_LSP_VERSIONS[lspKey];
@@ -1201,15 +1201,15 @@ async function ensureNativeLspInstalled(lspKey) {
     }
   }
   const usesWrapper = Boolean(asset.launcherJarGlob && asset.wrapperBinaryName);
-  const versionDir = join13(getNativeLspDir(), lspKey, entry.version);
+  const versionDir = join14(getNativeLspDir(), lspKey, entry.version);
   if (usesWrapper && asset.launcherJarGlob && asset.wrapperBinaryName) {
     const jarPath = await resolveGlobInsideDir(versionDir, asset.launcherJarGlob);
-    const shimPath = join13(getNativeLspBinDir(), asset.wrapperBinaryName);
+    const shimPath = join14(getNativeLspBinDir(), asset.wrapperBinaryName);
     if (jarPath && await pathExists(shimPath)) {
       return { installed: false, alreadyPresent: true, binaryPath: shimPath };
     }
   } else {
-    const installedBinary = join13(versionDir, asset.binaryPath);
+    const installedBinary = join14(versionDir, asset.binaryPath);
     if (await pathExists(installedBinary)) {
       await ensureSymlinkInBin(lspKey, installedBinary, asset.binaryPath);
       return { installed: false, alreadyPresent: true, binaryPath: installedBinary };
@@ -1217,7 +1217,7 @@ async function ensureNativeLspInstalled(lspKey) {
   }
   try {
     await fs.mkdir(versionDir, { recursive: true });
-    const tmpDownload = join13(versionDir, `.${asset.filename}.download`);
+    const tmpDownload = join14(versionDir, `.${asset.filename}.download`);
     const downloadUrl = entry.source.kind === "github-release" ? `https://github.com/${entry.source.repo}/releases/download/${entry.version}/${asset.filename}` : asset.url ?? "";
     if (!downloadUrl) {
       return {
@@ -1259,7 +1259,7 @@ async function ensureNativeLspInstalled(lspKey) {
       await pruneStaleVersions(lspKey, entry.version);
       return { installed: true, alreadyPresent: false, binaryPath: shimPath };
     }
-    const installedBinary = join13(versionDir, asset.binaryPath);
+    const installedBinary = join14(versionDir, asset.binaryPath);
     if (!await pathExists(installedBinary)) {
       return {
         installed: false,
@@ -1283,7 +1283,7 @@ async function resolveGlobInsideDir(versionDir, glob) {
   const parts = glob.split("/");
   let dir = versionDir;
   for (let i = 0; i < parts.length - 1; i += 1) {
-    dir = join13(dir, parts[i]);
+    dir = join14(dir, parts[i]);
   }
   const pattern = parts[parts.length - 1];
   const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
@@ -1296,10 +1296,10 @@ async function resolveGlobInsideDir(versionDir, glob) {
   }
   const matches = entries.filter((e) => re.test(e)).sort();
   const last = matches[matches.length - 1];
-  return last ? join13(dir, last) : null;
+  return last ? join14(dir, last) : null;
 }
 async function pruneStaleVersions(lspKey, currentVersion) {
-  const lspDir = join13(getNativeLspDir(), lspKey);
+  const lspDir = join14(getNativeLspDir(), lspKey);
   let entries;
   try {
     entries = await fs.readdir(lspDir);
@@ -1308,7 +1308,7 @@ async function pruneStaleVersions(lspKey, currentVersion) {
   }
   await Promise.all(entries.filter((name) => name !== currentVersion).map(async (name) => {
     try {
-      await fs.rm(join13(lspDir, name), { recursive: true, force: true });
+      await fs.rm(join14(lspDir, name), { recursive: true, force: true });
     } catch {
     }
   }));
@@ -1322,9 +1322,9 @@ function cmdQuote(value) {
 async function writeJdtlsWrapper(input) {
   const binDir = getNativeLspBinDir();
   await fs.mkdir(binDir, { recursive: true });
-  const shimPath = join13(binDir, input.binaryName);
+  const shimPath = join14(binDir, input.binaryName);
   const platformCfgDir = process.platform === "darwin" ? "config_mac" : process.platform === "win32" ? "config_win" : "config_linux";
-  const workspaceBase = join13(input.versionDir, "workspaces");
+  const workspaceBase = join14(input.versionDir, "workspaces");
   const qLauncher = shQuote(input.launcherJarPath);
   const qConfig = shQuote(`${input.versionDir}/${platformCfgDir}`);
   const qWorkspaceBase = shQuote(workspaceBase);
@@ -1384,7 +1384,7 @@ async function ensureSymlinkInBin(lspKey, target, sourceAssetPath) {
   await fs.mkdir(binDir, { recursive: true });
   const winExtMatch = process.platform === "win32" && sourceAssetPath ? /\.(exe|bat|cmd|ps1)$/i.exec(sourceAssetPath) : null;
   const linkName = winExtMatch ? `${lspKey}${winExtMatch[0].toLowerCase()}` : lspKey;
-  const linkPath = join13(binDir, linkName);
+  const linkPath = join14(binDir, linkName);
   try {
     await fs.unlink(linkPath);
   } catch {
@@ -1433,12 +1433,12 @@ async function extractAsset(source, destDir, asset) {
     return;
   }
   if (filename.endsWith(".gz")) {
-    const outPath = join13(destDir, asset.binaryPath);
+    const outPath = join14(destDir, asset.binaryPath);
     await fs.mkdir(dirname5(outPath), { recursive: true });
     await pipeline((await fs.open(source)).createReadStream(), createGunzip(), createWriteStream(outPath));
     return;
   }
-  await fs.copyFile(source, join13(destDir, asset.binaryPath));
+  await fs.copyFile(source, join14(destDir, asset.binaryPath));
 }
 async function runExternal(cmd, args) {
   return new Promise((resolve5, reject) => {
@@ -1476,9 +1476,9 @@ var init_native_installer = __esm({
 // ../listener/dist/lsp/coursier-installer.js
 import { promises as fs2 } from "fs";
 import { spawn as spawn4 } from "child_process";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 function getCoursierBinDir() {
-  return join14(getLspInstallDir(), "coursier-bin");
+  return join15(getLspInstallDir(), "coursier-bin");
 }
 async function ensureCoursierLspInstalled(key) {
   const entry = COURSIER_LSPS[key];
@@ -1486,8 +1486,8 @@ async function ensureCoursierLspInstalled(key) {
     return { installed: false, alreadyPresent: false, skipped: "no-coursier-entry" };
   }
   const binDir = getCoursierBinDir();
-  const binaryPath = join14(binDir, entry.appName);
-  const binaryPathExe = join14(binDir, `${entry.appName}.bat`);
+  const binaryPath = join15(binDir, entry.appName);
+  const binaryPathExe = join15(binDir, `${entry.appName}.bat`);
   if (await pathExists2(binaryPath) || await pathExists2(binaryPathExe)) {
     return { installed: false, alreadyPresent: true, binaryPath };
   }
@@ -1500,8 +1500,8 @@ async function ensureCoursierLspInstalled(key) {
       error: csBootstrap.error ?? csBootstrap.skipped
     };
   }
-  const csPath = join14(getNativeLspBinDir(), "coursier");
-  const csPathExe = join14(getNativeLspBinDir(), "coursier.exe");
+  const csPath = join15(getNativeLspBinDir(), "coursier");
+  const csPathExe = join15(getNativeLspBinDir(), "coursier.exe");
   const cs = await pathExists2(csPath) ? csPath : await pathExists2(csPathExe) ? csPathExe : null;
   if (!cs) {
     return {
@@ -1567,7 +1567,7 @@ var init_coursier_installer = __esm({
 import { spawn as spawn5 } from "child_process";
 import { promises as fs3 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 async function ensureToolchainLspInstalled(key) {
   const entry = TOOLCHAIN_LSPS[key];
   if (!entry) {
@@ -1615,7 +1615,7 @@ async function ensureToolchainLspInstalled(key) {
       error: err instanceof Error ? err.message : String(err)
     };
   }
-  const binaryPath = join15(binDir, entry.binaryName);
+  const binaryPath = join16(binDir, entry.binaryName);
   if (!await pathExists3(binaryPath)) {
     return {
       installed: false,
@@ -1632,14 +1632,14 @@ async function resolveToolchainBinDir(entry) {
   }
   if (entry.toolchainBinDir) {
     if (entry.toolchain === "go") {
-      const gopath = process.env["GOPATH"] ?? join15(homedir3(), "go");
-      return join15(gopath, "bin");
+      const gopath = process.env["GOPATH"] ?? join16(homedir3(), "go");
+      return join16(gopath, "bin");
     }
-    return join15(homedir3(), entry.toolchainBinDir);
+    return join16(homedir3(), entry.toolchainBinDir);
   }
   if (entry.toolchain === "gem") {
     const userdir = await captureStdout("gem", ["env", "userdir"]);
-    return join15(userdir.trim(), "bin");
+    return join16(userdir.trim(), "bin");
   }
   throw new Error(`no bin-dir resolution for toolchain ${entry.toolchain}`);
 }
@@ -1649,10 +1649,10 @@ function getToolchainBinDirs() {
     if (entry.bundled || !entry.toolchain || !entry.toolchainBinDir)
       continue;
     if (entry.toolchain === "go") {
-      const gopath = process.env["GOPATH"] ?? join15(homedir3(), "go");
-      dirs.add(join15(gopath, "bin"));
+      const gopath = process.env["GOPATH"] ?? join16(homedir3(), "go");
+      dirs.add(join16(gopath, "bin"));
     } else {
-      dirs.add(join15(homedir3(), entry.toolchainBinDir));
+      dirs.add(join16(homedir3(), entry.toolchainBinDir));
     }
   }
   return [...dirs];
@@ -1720,20 +1720,20 @@ var init_toolchain_installer = __esm({
 
 // ../listener/dist/lsp/installer.js
 import { promises as fs4 } from "fs";
-import { join as join16, dirname as dirname6 } from "path";
+import { join as join17, dirname as dirname6 } from "path";
 import { spawn as spawn6 } from "child_process";
-import lockfile3 from "proper-lockfile";
+import lockfile4 from "proper-lockfile";
 function getLspInstallDir() {
-  return join16(getConfigDir(), "lsp-servers");
+  return join17(getConfigDir(), "lsp-servers");
 }
 function getLspBinDir() {
-  return join16(getLspInstallDir(), "node_modules", ".bin");
+  return join17(getLspInstallDir(), "node_modules", ".bin");
 }
 async function ensureNpmLspInstalled(config2) {
   if (!config2.npmPackage)
     return { installed: false, skipped: "no-npm-package" };
   const installDir = getLspInstallDir();
-  const binPath = join16(installDir, "node_modules", ".bin", config2.command);
+  const binPath = join17(installDir, "node_modules", ".bin", config2.command);
   if (await pathExists4(binPath)) {
     return { installed: false, skipped: "already-present" };
   }
@@ -1741,7 +1741,7 @@ async function ensureNpmLspInstalled(config2) {
     await fs4.mkdir(installDir, { recursive: true });
     let release = null;
     try {
-      release = await lockfile3.lock(installDir, {
+      release = await lockfile4.lock(installDir, {
         stale: 18e4,
         retries: { retries: 20, factor: 1.5, minTimeout: 500, maxTimeout: 5e3 },
         realpath: false
@@ -1755,7 +1755,7 @@ async function ensureNpmLspInstalled(config2) {
       if (await pathExists4(binPath)) {
         return { installed: false, skipped: "already-present" };
       }
-      const pkgJsonPath = join16(installDir, "package.json");
+      const pkgJsonPath = join17(installDir, "package.json");
       if (!await pathExists4(pkgJsonPath)) {
         await fs4.writeFile(pkgJsonPath, JSON.stringify({ name: "repowise-lsp-servers", private: true, version: "0.0.0" }, null, 2), "utf-8");
       }
@@ -1784,7 +1784,7 @@ async function ensureNpmLspInstalled(config2) {
 }
 async function resolveNpmCommand() {
   const nodeDir = dirname6(process.execPath);
-  for (const candidate of [join16(nodeDir, "npm"), join16(nodeDir, "npm.cmd")]) {
+  for (const candidate of [join17(nodeDir, "npm"), join17(nodeDir, "npm.cmd")]) {
     try {
       await fs4.access(candidate);
       return candidate;
@@ -1875,7 +1875,7 @@ async function detectRepoLanguages(repoRoot) {
       continue;
     if (name === "node_modules" || name === "dist" || name === "build")
       continue;
-    const sub = join16(repoRoot, name);
+    const sub = join17(repoRoot, name);
     try {
       const stat8 = await fs4.stat(sub);
       if (stat8.isDirectory())
@@ -1991,7 +1991,7 @@ var init_installer = __esm({
 
 // ../listener/dist/lsp/daemon-path.js
 import { homedir as homedir4 } from "os";
-import { delimiter, dirname as dirname7, join as join17 } from "path";
+import { delimiter, dirname as dirname7, join as join18 } from "path";
 function commonBinDirs() {
   const home = homedir4();
   return [
@@ -2004,13 +2004,13 @@ function commonBinDirs() {
     "/bin",
     "/usr/sbin",
     "/sbin",
-    join17(home, ".local", "bin"),
+    join18(home, ".local", "bin"),
     // pipx / pip --user / uv
-    join17(home, ".npm-global", "bin"),
+    join18(home, ".npm-global", "bin"),
     // common npm global prefix
-    join17(home, "go", "bin"),
+    join18(home, "go", "bin"),
     // gopls
-    join17(home, ".cargo", "bin")
+    join18(home, ".cargo", "bin")
     // rust-analyzer via cargo
   ];
 }
@@ -2046,9 +2046,9 @@ __export(service_installer_exports, {
   uninstall: () => uninstall
 });
 import { execFile as execFile4 } from "child_process";
-import { writeFile as writeFile8, mkdir as mkdir8, unlink as unlink6 } from "fs/promises";
+import { writeFile as writeFile9, mkdir as mkdir8, unlink as unlink7 } from "fs/promises";
 import { homedir as homedir5 } from "os";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 function exec(cmd, args) {
   return new Promise((resolve5, reject) => {
     execFile4(cmd, args, (err, stdout) => {
@@ -2067,10 +2067,10 @@ function sanitizeEnvValue(value) {
   return Array.from(value).filter((ch) => ch.charCodeAt(0) >= 32).join("");
 }
 function plistPath() {
-  return join18(homedir5(), "Library", "LaunchAgents", `${PLIST_LABEL}.plist`);
+  return join19(homedir5(), "Library", "LaunchAgents", `${PLIST_LABEL}.plist`);
 }
 function logDir() {
-  return join18(getConfigDir(), "logs");
+  return join19(getConfigDir(), "logs");
 }
 function buildPlist() {
   const cmd = resolveListenerCommand();
@@ -2104,9 +2104,9 @@ ${programArgs}
         <string>${xmlEscape(buildDaemonPath())}</string>
     </dict>
     <key>StandardOutPath</key>
-    <string>${xmlEscape(join18(logs, "listener-stdout.log"))}</string>
+    <string>${xmlEscape(join19(logs, "listener-stdout.log"))}</string>
     <key>StandardErrorPath</key>
-    <string>${xmlEscape(join18(logs, "listener-stderr.log"))}</string>
+    <string>${xmlEscape(join19(logs, "listener-stderr.log"))}</string>
     <key>ProcessType</key>
     <string>Background</string>
     <!--
@@ -2135,12 +2135,12 @@ ${programArgs}
 }
 async function darwinInstall() {
   await mkdir8(logDir(), { recursive: true });
-  await mkdir8(join18(homedir5(), "Library", "LaunchAgents"), { recursive: true });
+  await mkdir8(join19(homedir5(), "Library", "LaunchAgents"), { recursive: true });
   try {
     await exec("launchctl", ["unload", plistPath()]);
   } catch {
   }
-  await writeFile8(plistPath(), buildPlist());
+  await writeFile9(plistPath(), buildPlist());
   await exec("launchctl", ["load", plistPath()]);
 }
 async function darwinUninstall() {
@@ -2149,7 +2149,7 @@ async function darwinUninstall() {
   } catch {
   }
   try {
-    await unlink6(plistPath());
+    await unlink7(plistPath());
   } catch {
   }
 }
@@ -2162,7 +2162,7 @@ async function darwinIsInstalled() {
   }
 }
 function unitPath() {
-  return join18(homedir5(), ".config", "systemd", "user", `${SYSTEMD_SERVICE}.service`);
+  return join19(homedir5(), ".config", "systemd", "user", `${SYSTEMD_SERVICE}.service`);
 }
 function buildUnit() {
   const cmd = resolveListenerCommand();
@@ -2182,16 +2182,16 @@ Environment=PATH=${sanitizeEnvValue(buildDaemonPath())}
 ExecStart=${execStart}
 Restart=always
 RestartSec=10
-StandardOutput=append:${join18(logs, "listener-stdout.log")}
-StandardError=append:${join18(logs, "listener-stderr.log")}
+StandardOutput=append:${join19(logs, "listener-stdout.log")}
+StandardError=append:${join19(logs, "listener-stderr.log")}
 
 [Install]
 WantedBy=default.target`;
 }
 async function linuxInstall() {
   await mkdir8(logDir(), { recursive: true });
-  await mkdir8(join18(homedir5(), ".config", "systemd", "user"), { recursive: true });
-  await writeFile8(unitPath(), buildUnit());
+  await mkdir8(join19(homedir5(), ".config", "systemd", "user"), { recursive: true });
+  await writeFile9(unitPath(), buildUnit());
   await exec("systemctl", ["--user", "daemon-reload"]);
   await exec("systemctl", ["--user", "enable", SYSTEMD_SERVICE]);
   await exec("systemctl", ["--user", "start", SYSTEMD_SERVICE]);
@@ -2206,7 +2206,7 @@ async function linuxUninstall() {
   } catch {
   }
   try {
-    await unlink6(unitPath());
+    await unlink7(unitPath());
   } catch {
   }
   try {
@@ -2385,8 +2385,8 @@ __export(sidecar_cache_exports, {
   persistMergedSidecar: () => persistMergedSidecar,
   sidecarCachePaths: () => sidecarCachePaths
 });
-import { mkdir as mkdir9, readFile as readFile8, readdir as readdir3, stat as stat2, unlink as unlink8, writeFile as writeFile9 } from "fs/promises";
-import { dirname as dirname9, join as join20 } from "path";
+import { mkdir as mkdir9, readFile as readFile9, readdir as readdir3, stat as stat2, unlink as unlink9, writeFile as writeFile10 } from "fs/promises";
+import { dirname as dirname9, join as join21 } from "path";
 function repoIdSafe(repoId) {
   return /^[A-Za-z0-9_.-]{1,128}$/.test(repoId) && !repoId.startsWith(".");
 }
@@ -2400,17 +2400,17 @@ function sidecarCachePaths(repoId, commitSha) {
   if (!commitShaSafe(commitSha)) {
     throw new Error(`unsafe commitSha: ${commitSha}`);
   }
-  const repoDir = join20(getConfigDir(), "typed-resolution", repoId);
-  const fullPath = join20(repoDir, `${commitSha}.jsonl`);
+  const repoDir = join21(getConfigDir(), "typed-resolution", repoId);
+  const fullPath = join21(repoDir, `${commitSha}.jsonl`);
   return { fullPath, repoDir };
 }
 async function persistMergedSidecar(repoId, commitSha, sidecar) {
   const { fullPath, repoDir } = sidecarCachePaths(repoId, commitSha);
   await mkdir9(repoDir, { recursive: true });
   const tmpPath = `${fullPath}.tmp`;
-  await writeFile9(tmpPath, JSON.stringify(sidecar), "utf-8");
-  const { rename: rename5 } = await import("fs/promises");
-  await rename5(tmpPath, fullPath);
+  await writeFile10(tmpPath, JSON.stringify(sidecar), "utf-8");
+  const { rename: rename8 } = await import("fs/promises");
+  await rename8(tmpPath, fullPath);
   try {
     await sweepSidecarDir(repoDir);
   } catch {
@@ -2424,7 +2424,7 @@ async function sweepSidecarDir(repoDir) {
   const withMtime = [];
   for (const name of jsonlFiles) {
     try {
-      const s = await stat2(join20(repoDir, name));
+      const s = await stat2(join21(repoDir, name));
       withMtime.push({ name, mtimeMs: s.mtimeMs });
     } catch {
     }
@@ -2435,7 +2435,7 @@ async function sweepSidecarDir(repoDir) {
   for (const { name, mtimeMs } of candidates) {
     if (now - mtimeMs >= SWEEP_MAX_AGE_MS) {
       try {
-        await unlink8(join20(repoDir, name));
+        await unlink9(join21(repoDir, name));
       } catch {
       }
     }
@@ -2461,7 +2461,7 @@ async function loadMergedSidecar(repoId, commitSha) {
   let body;
   try {
     const { fullPath } = sidecarCachePaths(repoId, commitSha);
-    body = await readFile8(fullPath, "utf-8");
+    body = await readFile9(fullPath, "utf-8");
   } catch {
     return null;
   }
@@ -3133,15 +3133,15 @@ var init_telemetry = __esm({
 // bin/repowise.ts
 import { readFileSync as readFileSync3 } from "fs";
 import { fileURLToPath as fileURLToPath4 } from "url";
-import { dirname as dirname23, join as join61 } from "path";
+import { dirname as dirname23, join as join63 } from "path";
 import { Command } from "commander";
 
 // ../listener/dist/main.js
 init_config_dir();
-import { readFile as readFile13, writeFile as writeFile15, mkdir as mkdir16, stat as fsStat } from "fs/promises";
-import { join as join41, dirname as dirname17 } from "path";
+import { readFile as readFile14, writeFile as writeFile16, mkdir as mkdir16, stat as fsStat } from "fs/promises";
+import { join as join42, dirname as dirname17 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import lockfile4 from "proper-lockfile";
+import lockfile5 from "proper-lockfile";
 
 // ../../packages/shared/dist/lib/ai-tools.js
 import { readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2, readdir, stat, unlink as unlink2 } from "fs/promises";
@@ -4391,8 +4391,53 @@ function migrateState(state, oldId, newId) {
 
 // ../listener/dist/lib/auth.js
 init_config_dir();
-import { readFile as readFile5, writeFile as writeFile5, mkdir as mkdir5, chmod as chmod3 } from "fs/promises";
+import { readFile as readFile5, writeFile as writeFile5, mkdir as mkdir5, chmod as chmod3, rename as rename3, open as open3, unlink as unlink5 } from "fs/promises";
 import { join as join7 } from "path";
+
+// ../../packages/shared/dist/lib/creds.js
+function isCredsHardExpired(creds) {
+  if (!creds || typeof creds.expiresAt !== "number")
+    return true;
+  return Date.now() >= creds.expiresAt;
+}
+function classifyRefreshFailure(status2, body) {
+  if (status2 === 400 && body != null && /invalid_grant/i.test(body))
+    return "terminal";
+  return "transient";
+}
+var RefreshTokenError = class extends Error {
+  kind;
+  status;
+  constructor(kind, message, status2 = null) {
+    super(message);
+    this.name = "RefreshTokenError";
+    this.kind = kind;
+    this.status = status2;
+  }
+};
+
+// ../listener/dist/lib/auth.js
+import lockfile3 from "proper-lockfile";
+
+// ../listener/dist/lib/http.js
+async function fetchWithTimeout(url, init, timeoutMs) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    return await fetch(url, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// ../listener/dist/lib/auth.js
+var TOKEN_ENDPOINT_TIMEOUT_MS = 3e4;
+var REFRESH_MAX_ATTEMPTS = 3;
+var lastRefreshOutcome = "none";
+function getLastRefreshOutcome() {
+  return lastRefreshOutcome;
+}
+var sleepMs = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
 function getTokenUrl(creds) {
   const cognito = creds?.cognito;
   const domain = process.env["REPOWISE_COGNITO_DOMAIN"] ?? cognito?.domain ?? "auth-repowise-dev";
@@ -4406,24 +4451,33 @@ function getClientId(creds) {
 async function refreshTokens(refreshToken, creds) {
   const clientId = getClientId(creds);
   if (!clientId) {
-    throw new Error("No Cognito client ID available. Run `repowise login` first.");
+    throw new RefreshTokenError("terminal", "No Cognito client ID available. Run `repowise login` first.", null);
+  }
+  let response;
+  try {
+    response = await fetchWithTimeout(getTokenUrl(creds), {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "refresh_token",
+        client_id: clientId,
+        refresh_token: refreshToken
+      })
+    }, TOKEN_ENDPOINT_TIMEOUT_MS);
+  } catch (err) {
+    throw new RefreshTokenError("transient", `Token refresh network error: ${err instanceof Error ? err.message : String(err)}`, null);
   }
-  const response = await fetch(getTokenUrl(creds), {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "refresh_token",
-      client_id: clientId,
-      refresh_token: refreshToken
-    })
-  });
   if (!response.ok) {
-    throw new Error(`Token refresh failed: ${response.status}`);
+    const body = await response.text().catch(() => "");
+    throw new RefreshTokenError(classifyRefreshFailure(response.status, body), `Token refresh failed: ${response.status}`, response.status);
   }
   const data = await response.json();
   return {
     accessToken: data.access_token,
-    refreshToken,
+    // Carry forward a rotated refresh token when Cognito returns one; otherwise
+    // reuse the current token (rotation disabled today). Required before
+    // enabling refresh-token rotation server-side.
+    refreshToken: data.refresh_token ?? refreshToken,
     idToken: data.id_token,
     expiresAt: Date.now() + data.expires_in * 1e3,
     cognito: creds.cognito
@@ -4445,30 +4499,89 @@ async function storeCredentials(credentials) {
   const dir = getConfigDir();
   const credPath = join7(dir, "credentials.json");
   await mkdir5(dir, { recursive: true, mode: 448 });
-  await writeFile5(credPath, JSON.stringify(credentials, null, 2));
-  await chmod3(credPath, 384);
+  try {
+    await writeFile5(credPath, "", { flag: "a", mode: 384 });
+  } catch {
+  }
+  let release = null;
+  try {
+    release = await lockfile3.lock(credPath, { stale: 1e4, retries: 3, realpath: false });
+    const tmpPath = credPath + ".tmp";
+    try {
+      await writeFile5(tmpPath, JSON.stringify(credentials, null, 2), { mode: 384 });
+      let fh;
+      try {
+        fh = await open3(tmpPath, "r+");
+        await fh.datasync();
+      } finally {
+        await fh?.close();
+      }
+      await rename3(tmpPath, credPath);
+      await chmod3(credPath, 384);
+    } catch (err) {
+      try {
+        await unlink5(tmpPath);
+      } catch {
+      }
+      throw err;
+    }
+  } finally {
+    if (release) {
+      try {
+        await release();
+      } catch {
+      }
+    }
+  }
 }
+var refreshInFlight = null;
 async function getValidCredentials(options) {
   const creds = await getStoredCredentials();
-  if (!creds)
+  if (!creds) {
+    lastRefreshOutcome = "no-creds";
     return null;
+  }
   const now = Date.now();
   const needsRefresh = options?.forceRefresh || now > creds.expiresAt - 5 * 60 * 1e3;
-  if (needsRefresh) {
+  if (!needsRefresh) {
+    lastRefreshOutcome = "success";
+    return creds;
+  }
+  if (!refreshInFlight) {
+    refreshInFlight = doRefresh(creds).finally(() => {
+      refreshInFlight = null;
+    });
+  }
+  return refreshInFlight;
+}
+async function doRefresh(creds) {
+  for (let attempt = 1; attempt <= REFRESH_MAX_ATTEMPTS; attempt++) {
     try {
       const refreshed = await refreshTokens(creds.refreshToken, creds);
       await storeCredentials(refreshed);
+      lastRefreshOutcome = "success";
       return refreshed;
     } catch (err) {
+      const kind = err instanceof RefreshTokenError ? err.kind : "transient";
       const message = err instanceof Error ? err.message : String(err);
-      console.warn(`Token refresh failed: ${message}`);
-      if (now < creds.expiresAt) {
-        return creds;
+      if (kind === "terminal") {
+        lastRefreshOutcome = "terminal";
+        console.warn(`Token refresh rejected (terminal): ${message}`);
+        return null;
+      }
+      if (attempt < REFRESH_MAX_ATTEMPTS) {
+        const backoffBase = Number(process.env["REPOWISE_REFRESH_BACKOFF_MS"] ?? 1e3);
+        await sleepMs(backoffBase * attempt);
+        continue;
       }
+      lastRefreshOutcome = "transient";
+      console.warn(`Token refresh failed (transient, ${REFRESH_MAX_ATTEMPTS} attempts): ${message}`);
+      if (Date.now() < creds.expiresAt)
+        return creds;
       return null;
     }
   }
-  return creds;
+  return null;
 }
 
 // ../listener/dist/poll-client.js
@@ -4593,6 +4706,17 @@ function notifyContextUpdated(repoId, fileCount) {
   } catch {
   }
 }
+function notifyDocsReady(repoId) {
+  try {
+    notify({
+      title: TITLE,
+      // Start a NEW session (not just /mcp): an open AI session snapshots its
+      // instructions at start, and /mcp only reloads MCP connections.
+      message: `Full context docs are ready for ${repoId} \u2014 start a new AI session (or restart your AI tool) to use them.`
+    });
+  } catch {
+  }
+}
 
 // ../listener/dist/context-fetcher.js
 import { execFile as execFile2 } from "child_process";
@@ -4613,6 +4737,7 @@ async function verifyContextFolder(localPath) {
 }
 
 // ../listener/dist/context-fetcher.js
+var CONTEXT_FETCH_TIMEOUT_MS = 3e4;
 var execFileAsync = promisify(execFile2);
 async function fetchContextUpdates(localPath) {
   try {
@@ -4668,7 +4793,10 @@ async function fetchContextFromServer(repoId, localPath, apiUrl) {
     let listRes;
     for (let attempt = 1; attempt <= 3; attempt++) {
       try {
-        listRes = await fetch(`${apiUrl}/v1/repos/${repoId}/context`, { headers });
+        listRes = await fetch(`${apiUrl}/v1/repos/${repoId}/context`, {
+          headers,
+          signal: AbortSignal.timeout(CONTEXT_FETCH_TIMEOUT_MS)
+        });
         if (listRes.status === 401 || listRes.status === 403) {
           console.error(`Context list auth error (${listRes.status}) for repo ${repoId}`);
           return { success: false, updatedFiles: [] };
@@ -4700,7 +4828,8 @@ async function fetchContextFromServer(repoId, localPath, apiUrl) {
       if (file.fileName.includes(".."))
         continue;
       const urlRes = await fetch(`${apiUrl}/v1/repos/${repoId}/context/files/${file.fileName}`, {
-        headers
+        headers,
+        signal: AbortSignal.timeout(CONTEXT_FETCH_TIMEOUT_MS)
       });
       if (!urlRes.ok) {
         console.error(`Context fetch for ${repoId}: failed to get URL for ${file.fileName} (${urlRes.status})`);
@@ -4712,7 +4841,9 @@ async function fetchContextFromServer(repoId, localPath, apiUrl) {
         console.error(`Context fetch for ${repoId}: no presigned URL returned for ${file.fileName}`);
         continue;
       }
-      const contentRes = await fetch(presignedUrl);
+      const contentRes = await fetch(presignedUrl, {
+        signal: AbortSignal.timeout(CONTEXT_FETCH_TIMEOUT_MS)
+      });
       if (!contentRes.ok) {
         console.error(`Context fetch for ${repoId}: download failed for ${file.fileName} (${contentRes.status})`);
         continue;
@@ -4733,6 +4864,53 @@ async function fetchContextFromServer(repoId, localPath, apiUrl) {
   }
 }
 
+// ../listener/dist/docs-marker.js
+import { join as join10 } from "path";
+import { readFile as readFile6, writeFile as writeFile7, rename as rename4 } from "fs/promises";
+var DOCS_MARKER_NAME = ".repowise-meta.json";
+async function readDocsMarker(localPath, contextFolder) {
+  try {
+    const raw = await readFile6(join10(localPath, contextFolder, DOCS_MARKER_NAME), "utf-8");
+    const m = JSON.parse(raw);
+    if (typeof m.fileCount !== "number")
+      return null;
+    return {
+      commitSha: typeof m.commitSha === "string" ? m.commitSha : null,
+      fileCount: m.fileCount,
+      updatedAt: typeof m.updatedAt === "string" ? m.updatedAt : ""
+    };
+  } catch {
+    return null;
+  }
+}
+async function writeDocsMarker(localPath, contextFolder, commitSha, fileCount) {
+  const marker = {
+    commitSha,
+    fileCount,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const finalPath = join10(localPath, contextFolder, DOCS_MARKER_NAME);
+  const tmpPath = `${finalPath}.tmp`;
+  try {
+    await writeFile7(tmpPath, JSON.stringify(marker, null, 2), "utf-8");
+    await rename4(tmpPath, finalPath);
+  } catch (err) {
+    console.warn(`[docs-marker] failed to write provenance marker (${commitSha ?? "unknown commit"}): ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+function effectiveToolVariant(graphOnly, docsPresent, marker, lastSyncCommitSha) {
+  if (graphOnly)
+    return "graph";
+  if (!docsPresent)
+    return "graph";
+  if (!marker)
+    return "full";
+  if (lastSyncCommitSha && marker.commitSha && marker.commitSha !== lastSyncCommitSha) {
+    return "graph";
+  }
+  return "full";
+}
+
 // ../listener/dist/main.js
 init_process_manager();
 
@@ -4740,7 +4918,7 @@ init_process_manager();
 import { execFile as execFile3 } from "child_process";
 import { readFileSync } from "fs";
 import { access as access2, constants, realpath } from "fs/promises";
-import { dirname as dirname4, join as join11 } from "path";
+import { dirname as dirname4, join as join12 } from "path";
 import { promisify as promisify2 } from "util";
 var execFileAsync2 = promisify2(execFile3);
 var installInFlight = false;
@@ -4764,12 +4942,12 @@ async function installUpdate(currentVersion, packageName, targetVersion) {
   }
   installInFlight = true;
   try {
-    const npmWrapper = join11(dirname4(process.execPath), "npm");
+    const npmWrapper = join12(dirname4(process.execPath), "npm");
     const npmScript = await realpath(npmWrapper);
     const runNpm = (args) => execFileAsync2(process.execPath, [npmScript, ...args], { timeout: 6e4 });
     try {
       const { stdout: prefix } = await runNpm(["prefix", "-g"]);
-      const npmDir = join11(prefix.trim(), "lib", "node_modules");
+      const npmDir = join12(prefix.trim(), "lib", "node_modules");
       const checkDir = process.platform === "win32" ? prefix.trim() : npmDir;
       await access2(checkDir, constants.W_OK);
     } catch (err) {
@@ -4787,7 +4965,7 @@ async function installUpdate(currentVersion, packageName, targetVersion) {
     }
     try {
       const { stdout: prefix } = await runNpm(["prefix", "-g"]);
-      const installedPkgJson = join11(prefix.trim(), "lib", "node_modules", packageName, "package.json");
+      const installedPkgJson = join12(prefix.trim(), "lib", "node_modules", packageName, "package.json");
       const installedVersion = JSON.parse(readFileSync(installedPkgJson, "utf-8")).version;
       if (installedVersion !== targetVersion) {
         const msg = `post-install check failed: expected ${targetVersion}, found ${installedVersion ?? "unknown"}`;
@@ -4856,11 +5034,11 @@ function comparePrerelease(a, b) {
 
 // ../listener/dist/lib/binary-integrity.js
 import { createHash as createHash2 } from "crypto";
-import { lstat, open as open3, readdir as readdir2 } from "fs/promises";
+import { lstat, open as open4, readdir as readdir2 } from "fs/promises";
 import { constants as fsConstants } from "fs";
-import { join as join12, resolve as pathResolve } from "path";
+import { join as join13, resolve as pathResolve } from "path";
 async function verifyBinary(check) {
-  const fh = await open3(check.path, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
+  const fh = await open4(check.path, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
   const hash = createHash2("sha256");
   try {
     const stream = fh.createReadStream();
@@ -4908,7 +5086,7 @@ async function auditNativeBindings(rootDir, expected) {
       return;
     }
     for (const entryName of entries) {
-      const full = pathResolve(join12(dir, entryName));
+      const full = pathResolve(join13(dir, entryName));
       const entryStat = await lstat(full).catch(() => null);
       if (!entryStat)
         continue;
@@ -4949,8 +5127,8 @@ async function auditNativeBindings(rootDir, expected) {
 init_config_dir();
 init_process_manager();
 init_service_installer();
-import { unlink as unlink7 } from "fs/promises";
-import { join as join19 } from "path";
+import { unlink as unlink8 } from "fs/promises";
+import { join as join20 } from "path";
 async function getListenerStatus() {
   const pid = await readPid();
   if (pid !== null) {
@@ -4959,7 +5137,7 @@ async function getListenerStatus() {
       return { running: true, method: "pid", pid, serviceInstalled: serviceInstalled2 };
     }
     try {
-      await unlink7(join19(getConfigDir(), "listener.pid"));
+      await unlink8(join20(getConfigDir(), "listener.pid"));
     } catch {
     }
   }
@@ -5004,11 +5182,11 @@ async function stopListener() {
 
 // ../listener/dist/mcp/bootstrap.js
 init_config_dir();
-import { join as join23 } from "path";
+import { join as join24 } from "path";
 
 // ../listener/dist/lsp/workspace-session.js
 import { pathToFileURL } from "url";
-import { readFile as readFile7 } from "fs/promises";
+import { readFile as readFile8 } from "fs/promises";
 import { resolve as pathResolve2, sep as pathSep, dirname as dirname8, delimiter as delimiter2 } from "path";
 
 // ../listener/dist/lsp/lsp-client.js
@@ -5445,7 +5623,7 @@ var WorkspaceManager = class {
     }
     const absolute = this.joinPath(session.repoRoot, repoRelativePath);
     const p = (async () => {
-      const text = await readFile7(absolute, "utf-8");
+      const text = await readFile8(absolute, "utf-8");
       session.client.notify("textDocument/didOpen", {
         textDocument: {
           uri,
@@ -5720,8 +5898,8 @@ function buildLspSpawnPath(basePath, nodeDir, lspBinDirs) {
 
 // ../listener/dist/mcp/graph-cache.js
 init_config_dir();
-import { readFile as readFile9, stat as stat3 } from "fs/promises";
-import { join as join21 } from "path";
+import { readFile as readFile10, stat as stat3 } from "fs/promises";
+import { join as join22 } from "path";
 var EVICT_DEBOUNCE_MS = 6e4;
 function assertSafeRepoId(repoId) {
   if (!repoId || typeof repoId !== "string") {
@@ -5736,13 +5914,13 @@ function assertSafeRepoId(repoId) {
 }
 function createGraphCache(options = {}) {
   const evictMs = options.evictDebounceMs ?? EVICT_DEBOUNCE_MS;
-  const resolvePath = options.resolveGraphPath ?? ((repoId) => join21(defaultRepoWiseHome(), "graphs", `${repoId}.json`));
+  const resolvePath = options.resolveGraphPath ?? ((repoId) => join22(defaultRepoWiseHome(), "graphs", `${repoId}.json`));
   const entries = /* @__PURE__ */ new Map();
   const inFlight = /* @__PURE__ */ new Map();
   async function loadFromDisk(repoId) {
     const graphPath = resolvePath(repoId);
     const s = await stat3(graphPath);
-    const body = await readFile9(graphPath, "utf-8");
+    const body = await readFile10(graphPath, "utf-8");
     const graph = JSON.parse(body);
     if (graph.commitSha && Array.isArray(graph.edges)) {
       try {
@@ -5829,8 +6007,54 @@ function defaultRepoWiseHome() {
 }
 
 // ../listener/dist/mcp/graph-downloader.js
-import { mkdir as mkdir10, rename as rename3, writeFile as writeFile10 } from "fs/promises";
+import { mkdir as mkdir10, rename as rename5, writeFile as writeFile11 } from "fs/promises";
 import { dirname as dirname10 } from "path";
+var GRAPH_DOWNLOAD_TIMEOUT_MS = 45e3;
+var GRAPH_IDLE_TIMEOUT_MS = 6e4;
+async function fetchTextWithIdleTimeout(fetchFn, url, init, idleMs) {
+  const controller = new AbortController();
+  let timer = null;
+  const arm = () => {
+    if (timer)
+      clearTimeout(timer);
+    timer = setTimeout(() => controller.abort(), idleMs);
+  };
+  const disarm = () => {
+    if (timer)
+      clearTimeout(timer);
+    timer = null;
+  };
+  arm();
+  try {
+    const res = await fetchFn(url, { ...init, signal: controller.signal });
+    if (!res.ok) {
+      disarm();
+      return { res, text: "" };
+    }
+    const stream = res.body;
+    if (!stream || typeof stream.getReader !== "function") {
+      const text = await res.text();
+      disarm();
+      return { res, text };
+    }
+    const reader = stream.getReader();
+    const chunks = [];
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      if (value) {
+        chunks.push(value);
+        arm();
+      }
+    }
+    disarm();
+    return { res, text: Buffer.concat(chunks).toString("utf-8") };
+  } catch (err) {
+    disarm();
+    throw err;
+  }
+}
 function createGraphDownloader(options) {
   const fetchFn = options.fetchImpl ?? fetch;
   let lastSha = null;
@@ -5840,7 +6064,8 @@ function createGraphDownloader(options) {
     let repoRes;
     try {
       repoRes = await fetchFn(`${options.apiBaseUrl}/v1/repos/${options.repoId}`, {
-        headers: { Authorization: `Bearer ${token}` }
+        headers: { Authorization: `Bearer ${token}` },
+        signal: AbortSignal.timeout(GRAPH_DOWNLOAD_TIMEOUT_MS)
       });
     } catch (err) {
       return {
@@ -5864,15 +6089,23 @@ function createGraphDownloader(options) {
       return { state: "no-graph" };
     if (serverSha === lastSha)
       return { state: "unchanged", sha: serverSha };
-    const graphRes = await fetchFn(`${options.apiBaseUrl}/v1/repos/${options.repoId}/graph`, {
-      headers: { Authorization: `Bearer ${token}` }
-    });
+    let graphRes;
+    let body;
+    try {
+      const r = await fetchTextWithIdleTimeout(fetchFn, `${options.apiBaseUrl}/v1/repos/${options.repoId}/graph`, { headers: { Authorization: `Bearer ${token}` } }, GRAPH_IDLE_TIMEOUT_MS);
+      graphRes = r.res;
+      body = r.text;
+    } catch (err) {
+      return {
+        state: "error",
+        message: `graph fetch: ${err instanceof Error ? err.message : String(err)}`
+      };
+    }
     if (graphRes.status === 404)
       return { state: "no-graph" };
     if (!graphRes.ok) {
       return { state: "error", message: `graph status ${graphRes.status}` };
     }
-    const body = await graphRes.text();
     try {
       JSON.parse(body);
     } catch (err) {
@@ -5883,8 +6116,8 @@ function createGraphDownloader(options) {
     }
     await mkdir10(dirname10(options.targetPath), { recursive: true });
     const tmpPath = `${options.targetPath}.${Date.now()}.tmp`;
-    await writeFile10(tmpPath, body, { encoding: "utf-8", mode: 384 });
-    await rename3(tmpPath, options.targetPath);
+    await writeFile11(tmpPath, body, { encoding: "utf-8", mode: 384 });
+    await rename5(tmpPath, options.targetPath);
     options.graphCache.invalidate(options.repoId);
     lastSha = serverSha;
     return { state: "downloaded", sha: serverSha };
@@ -5904,9 +6137,112 @@ function createGraphDownloader(options) {
   };
 }
 
+// ../listener/dist/mcp/heartbeat.js
+import { setTimeout as delay2 } from "timers/promises";
+var DEFAULT_WINDOW = 60 * 60 * 1e3;
+function emptyStatusCounts() {
+  return { ok: 0, error: 0, timeout: 0, rejected: 0 };
+}
+function emptyHealthCounters() {
+  return {
+    graphNotLoaded: 0,
+    unknownRepo: 0,
+    lspDisabled: 0,
+    lspUnavailable: 0,
+    connectFail: 0,
+    preAuthFail: 0
+  };
+}
+function createHeartbeatEmitter(opts) {
+  const windowMs = opts.windowMs ?? DEFAULT_WINDOW;
+  const now = opts.now ?? (() => Date.now());
+  let bucketStart = Math.floor(now() / windowMs) * windowMs;
+  let toolCounts = /* @__PURE__ */ new Map();
+  let missCounts = /* @__PURE__ */ new Map();
+  let statusCounts = emptyStatusCounts();
+  let healthCounters = emptyHealthCounters();
+  function hasData() {
+    if (toolCounts.size > 0 || missCounts.size > 0)
+      return true;
+    for (const k of Object.keys(statusCounts)) {
+      if (statusCounts[k] > 0)
+        return true;
+    }
+    for (const k of Object.keys(healthCounters)) {
+      if (healthCounters[k] > 0)
+        return true;
+    }
+    return false;
+  }
+  function buildPayload() {
+    return {
+      listenerVersion: opts.listenerVersion,
+      windowStartsAt: new Date(bucketStart).toISOString(),
+      toolCounts: Object.fromEntries(toolCounts),
+      statusCounts,
+      missCounts: Object.fromEntries(missCounts),
+      healthCounters
+    };
+  }
+  function clearCounters() {
+    toolCounts = /* @__PURE__ */ new Map();
+    missCounts = /* @__PURE__ */ new Map();
+    statusCounts = emptyStatusCounts();
+    healthCounters = emptyHealthCounters();
+  }
+  async function flushIfDue(currentBucket) {
+    if (currentBucket === bucketStart)
+      return;
+    const payload = buildPayload();
+    bucketStart = currentBucket;
+    clearCounters();
+    try {
+      await opts.sink.post(payload);
+    } catch {
+    }
+  }
+  return {
+    record(tool, outcome) {
+      toolCounts.set(tool, (toolCounts.get(tool) ?? 0) + 1);
+      if ("health" in outcome) {
+        healthCounters[outcome.health] += 1;
+      } else {
+        statusCounts[outcome.status] += 1;
+        if (outcome.miss)
+          missCounts.set(tool, (missCounts.get(tool) ?? 0) + 1);
+      }
+    },
+    recordHealth(kind) {
+      healthCounters[kind] += 1;
+    },
+    async tick(nowOverride) {
+      const current = Math.floor((nowOverride ?? now()) / windowMs) * windowMs;
+      await flushIfDue(current);
+    },
+    async flush() {
+      if (!hasData())
+        return;
+      const payload = buildPayload();
+      clearCounters();
+      try {
+        await opts.sink.post(payload);
+      } catch {
+      }
+    }
+  };
+}
+async function runHeartbeatLoop(emitter, opts = {}) {
+  const tickMs = opts.tickMs ?? 6e4;
+  while (!opts.signal?.aborted) {
+    await emitter.tick();
+    await delay2(tickMs, void 0, { signal: opts.signal }).catch(() => {
+    });
+  }
+}
+
 // ../listener/dist/mcp/log-encryption.js
 import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
-import { mkdir as mkdir11, readFile as readFile10, stat as stat4, writeFile as writeFile11 } from "fs/promises";
+import { mkdir as mkdir11, readFile as readFile11, stat as stat4, writeFile as writeFile12 } from "fs/promises";
 import { dirname as dirname11 } from "path";
 var KEY_BYTES = 32;
 var IV_BYTES = 12;
@@ -5934,7 +6270,7 @@ function createFileKeyStore(keyPath) {
         return cached;
       let parsed = null;
       try {
-        const body = await readFile10(keyPath, "utf-8");
+        const body = await readFile11(keyPath, "utf-8");
         const decoded = Buffer.from(body.trim(), "base64");
         if (decoded.length === KEY_BYTES)
           parsed = decoded;
@@ -5956,12 +6292,12 @@ function createFileKeyStore(keyPath) {
       const fresh = randomBytes(KEY_BYTES);
       await mkdir11(dirname11(keyPath), { recursive: true });
       const tmp = `${keyPath}.tmp`;
-      await writeFile11(tmp, fresh.toString("base64") + "\n", {
+      await writeFile12(tmp, fresh.toString("base64") + "\n", {
         encoding: "utf-8",
         mode: 384
       });
-      const { rename: rename5 } = await import("fs/promises");
-      await rename5(tmp, keyPath);
+      const { rename: rename8 } = await import("fs/promises");
+      await rename8(tmp, keyPath);
       cached = fresh;
       try {
         const s = await stat4(keyPath);
@@ -5995,7 +6331,7 @@ function decryptLine(encoded, key) {
 }
 
 // ../listener/dist/mcp/mcp-logger.js
-import { appendFile, mkdir as mkdir12, stat as stat5, unlink as unlink9, writeFile as writeFile12, readFile as readFile11 } from "fs/promises";
+import { appendFile, mkdir as mkdir12, stat as stat5, unlink as unlink10, writeFile as writeFile13, readFile as readFile12 } from "fs/promises";
 import { dirname as dirname12 } from "path";
 var DEFAULT_MAX_BYTES = 100 * 1024 * 1024;
 function createMcpLogger(options) {
@@ -6010,7 +6346,7 @@ function createMcpLogger(options) {
     if (legacyPath === options.filePath)
       return;
     try {
-      await unlink9(legacyPath);
+      await unlink10(legacyPath);
       console.log(`[mcp-logger] removed legacy plaintext log at ${legacyPath} (one-time migration)`);
     } catch {
     }
@@ -6041,19 +6377,20 @@ function createMcpLogger(options) {
 }
 async function rotate(path, size) {
   const dropAt = Math.floor(size * 0.25);
-  const body = await readFile11(path, "utf-8");
+  const body = await readFile12(path, "utf-8");
   const idx = body.indexOf("\n", dropAt);
   if (idx < 0) {
-    await writeFile12(path, "", { encoding: "utf-8", mode: 384 });
+    await writeFile13(path, "", { encoding: "utf-8", mode: 384 });
     return;
   }
-  await writeFile12(path, body.slice(idx + 1), { encoding: "utf-8", mode: 384 });
+  await writeFile13(path, body.slice(idx + 1), { encoding: "utf-8", mode: 384 });
 }
 
 // ../listener/dist/mcp/mcp-log-uploader.js
 import { randomUUID } from "crypto";
-import { readFile as readFile12, writeFile as writeFile13, mkdir as mkdir13 } from "fs/promises";
+import { readFile as readFile13, writeFile as writeFile14, mkdir as mkdir13 } from "fs/promises";
 import { dirname as dirname13 } from "path";
+var MCP_LOG_UPLOAD_TIMEOUT_MS = 3e4;
 var DEFAULT_MAX_ENTRIES = 5e3;
 var DEFAULT_MAX_BYTES2 = 1 * 1024 * 1024;
 function createMcpLogUploader(options) {
@@ -6078,7 +6415,7 @@ function createMcpLogUploader(options) {
       }
       let body;
       try {
-        body = await readFile12(options.logFilePath, "utf-8");
+        body = await readFile13(options.logFilePath, "utf-8");
       } catch (err) {
         if (err.code === "ENOENT") {
           return { uploaded: 0, bytesAdvanced: 0 };
@@ -6150,7 +6487,8 @@ function createMcpLogUploader(options) {
           "Content-Type": "application/json",
           Authorization: `Bearer ${token}`
         },
-        body: uploadBody
+        body: uploadBody,
+        signal: AbortSignal.timeout(MCP_LOG_UPLOAD_TIMEOUT_MS)
       });
       if (res.status === 401 && options.getAuthTokenForceRefresh) {
         try {
@@ -6161,7 +6499,8 @@ function createMcpLogUploader(options) {
               "Content-Type": "application/json",
               Authorization: `Bearer ${freshToken}`
             },
-            body: uploadBody
+            body: uploadBody,
+            signal: AbortSignal.timeout(MCP_LOG_UPLOAD_TIMEOUT_MS)
           });
         } catch {
         }
@@ -6195,7 +6534,7 @@ function pendingPath(watermarkPath) {
 }
 async function readPendingBatch(watermarkPath) {
   try {
-    const body = await readFile12(pendingPath(watermarkPath), "utf-8");
+    const body = await readFile13(pendingPath(watermarkPath), "utf-8");
     const trimmed = body.trim();
     return /^[A-Za-z0-9-]{8,128}$/.test(trimmed) ? trimmed : null;
   } catch {
@@ -6204,18 +6543,18 @@ async function readPendingBatch(watermarkPath) {
 }
 async function writePendingBatch(watermarkPath, batchId) {
   await mkdir13(dirname13(watermarkPath), { recursive: true });
-  await writeFile13(pendingPath(watermarkPath), batchId, { encoding: "utf-8", mode: 384 });
+  await writeFile14(pendingPath(watermarkPath), batchId, { encoding: "utf-8", mode: 384 });
 }
 async function clearPendingBatch(watermarkPath) {
-  const { unlink: unlink12 } = await import("fs/promises");
+  const { unlink: unlink14 } = await import("fs/promises");
   try {
-    await unlink12(pendingPath(watermarkPath));
+    await unlink14(pendingPath(watermarkPath));
   } catch {
   }
 }
 async function readWatermark(path) {
   try {
-    const body = await readFile12(path, "utf-8");
+    const body = await readFile13(path, "utf-8");
     const parsed = Number.parseInt(body.trim(), 10);
     return Number.isFinite(parsed) && parsed >= 0 ? parsed : 0;
   } catch (err) {
@@ -6227,13 +6566,13 @@ async function readWatermark(path) {
 async function writeWatermark(path, offset) {
   await mkdir13(dirname13(path), { recursive: true });
   const tmp = `${path}.tmp`;
-  await writeFile13(tmp, offset.toString() + "\n", { encoding: "utf-8", mode: 384 });
-  const { rename: rename5 } = await import("fs/promises");
-  await rename5(tmp, path);
+  await writeFile14(tmp, offset.toString() + "\n", { encoding: "utf-8", mode: 384 });
+  const { rename: rename8 } = await import("fs/promises");
+  await rename8(tmp, path);
 }
 async function isLocallyConsented(flagPath2) {
   try {
-    const body = await readFile12(flagPath2, "utf-8");
+    const body = await readFile13(flagPath2, "utf-8");
     const parsed = JSON.parse(body);
     return parsed.enabled !== false;
   } catch {
@@ -6244,8 +6583,8 @@ async function isLocallyConsented(flagPath2) {
 // ../listener/dist/mcp/mcp-server.js
 init_config_dir();
 import { createServer } from "http";
-import { mkdir as mkdir14, writeFile as writeFile14 } from "fs/promises";
-import { dirname as dirname14, join as join22 } from "path";
+import { mkdir as mkdir14, writeFile as writeFile15, unlink as unlink11 } from "fs/promises";
+import { dirname as dirname14, join as join23 } from "path";
 import { createHash as createHash4, randomUUID as randomUUID2 } from "crypto";
 
 // ../listener/dist/mcp/sanitize.js
@@ -7309,7 +7648,16 @@ async function startMcpServer(options) {
     secret: secretState.value.current,
     close: () => new Promise((resolve5, reject) => {
       server.close((err) => err ? reject(err) : resolve5());
-    })
+    }),
+    suspendEndpoint: async () => {
+      try {
+        await unlink11(endpointFilePath);
+      } catch (err) {
+        if (err.code !== "ENOENT")
+          throw err;
+      }
+    },
+    resumeEndpoint: () => writeEndpointFile(endpointFilePath, endpoint, secretState.value.current)
   };
 }
 function handleRequest(req, res, options, sessions, secretCtx) {
@@ -7333,11 +7681,13 @@ function handleRequest(req, res, options, sessions, secretCtx) {
     const rawHost = req.headers.host;
     const hostHeader = typeof rawHost === "string" ? rawHost : Array.isArray(rawHost) && typeof rawHost[0] === "string" ? rawHost[0] : void 0;
     if (!isHostAllowed(hostHeader)) {
+      options.heartbeat?.recordHealth("preAuthFail");
       sendJson(res, 403, { error: "invalid_host" });
       return;
     }
     const bearer = extractBearer(req.headers.authorization);
     if (!isTokenValid(bearer, secretCtx.getSecret(), secretCtx.clock())) {
+      options.heartbeat?.recordHealth("preAuthFail");
       sendJson(res, 401, { error: "invalid_token" });
       return;
     }
@@ -7355,6 +7705,7 @@ function handleRequest(req, res, options, sessions, secretCtx) {
       const rawMsg = err instanceof Error ? err.message : String(err);
       const safeMsg = stripAbsolutePaths(rawMsg);
       if (err?.code === "ENOENT") {
+        options.heartbeat?.recordHealth("connectFail");
         return sendJson(res, 404, { error: "unknown_repo" });
       }
       sendJson(res, 500, { error: safeMsg });
@@ -7529,7 +7880,7 @@ function handleRequest(req, res, options, sessions, secretCtx) {
   })();
   if (method === "POST" && lspDispatch[url]) {
     const lspHandler = lspDispatch[url];
-    dispatchSessionTool(req, res, url, sessions, options.mcpLogger, async (session, body) => {
+    dispatchSessionTool(req, res, url, sessions, options.mcpLogger, options.heartbeat, async (session, body) => {
       if (options.getLspEnabled && options.getLspEnabled() === false) {
         return {
           ok: true,
@@ -7551,14 +7902,17 @@ function handleRequest(req, res, options, sessions, secretCtx) {
           }
         };
       }
-      const value = await Promise.race([lspHandler(body, root), timeoutAfter(TOOL_TIMEOUT_MS_LSP)]);
+      const value = await Promise.race([
+        lspHandler(body, root),
+        timeoutAfter(TOOL_TIMEOUT_MS_LSP)
+      ]);
       return { ok: true, value };
     });
     return;
   }
   if (method === "POST" && toolDispatch[url]) {
     const handler = toolDispatch[url];
-    dispatchSessionTool(req, res, url, sessions, options.mcpLogger, async (session, body) => {
+    dispatchSessionTool(req, res, url, sessions, options.mcpLogger, options.heartbeat, async (session, body) => {
       const graph = options.graphCache.peek(session.repoId);
       if (!graph) {
         return {
@@ -7591,7 +7945,7 @@ function handleRequest(req, res, options, sessions, secretCtx) {
   }
   sendJson(res, 404, { error: "not_found" });
 }
-function dispatchSessionTool(req, res, url, sessions, logger, handler) {
+function dispatchSessionTool(req, res, url, sessions, logger, heartbeat, handler) {
   const tool = url.replace("/mcp/tools/", "");
   const startedAt = Date.now();
   void readJson(req).then(async (body) => {
@@ -7610,6 +7964,7 @@ function dispatchSessionTool(req, res, url, sessions, logger, handler) {
         error: "unknown_session"
       });
       logToStdout("rejected", tool, null, Date.now() - startedAt, "unknown_session");
+      heartbeat?.record(tool, { status: "rejected" });
       return sendJson(res, 404, { error: "unknown_session" });
     }
     try {
@@ -7625,6 +7980,8 @@ function dispatchSessionTool(req, res, url, sessions, logger, handler) {
           latencyMs: Date.now() - startedAt
         });
         logToStdout("ok", tool, session.repoId, Date.now() - startedAt);
+        const classification = classifyToolResult(tool, result.value);
+        heartbeat?.record(tool, classification.kind === "health" ? { health: classification.health } : { status: classification.status, miss: classification.miss });
         return sendJson(res, 200, result.value);
       }
       const rejectErr = typeof result.body["error"] === "string" ? result.body["error"] : "tool_rejected";
@@ -7639,9 +7996,11 @@ function dispatchSessionTool(req, res, url, sessions, logger, handler) {
         error: rejectErr
       });
       logToStdout("rejected", tool, session.repoId, Date.now() - startedAt, rejectErr);
+      heartbeat?.record(tool, { status: "rejected" });
       return sendJson(res, result.status, result.body);
     } catch (err) {
-      const isTimeout = err instanceof ToolTimeoutError;
+      const thrown = classifyThrow(err);
+      const isTimeout = thrown.status === "timeout";
       const rawMsg = err instanceof Error ? err.message : String(err);
       const safeMsg = stripAbsolutePaths(rawMsg);
       recordLog(logger, {
@@ -7655,6 +8014,7 @@ function dispatchSessionTool(req, res, url, sessions, logger, handler) {
         error: safeMsg
       });
       logToStdout("error", tool, session.repoId, Date.now() - startedAt, safeMsg);
+      heartbeat?.record(tool, { status: thrown.status });
       if (isTimeout) {
         return sendJson(res, 200, {
           error: `tool-timeout: ${tool} exceeded its execution budget`,
@@ -7731,6 +8091,73 @@ var ToolTimeoutError = class extends Error {
     this.timeoutMs = ms;
   }
 };
+function asRecord(value) {
+  return typeof value === "object" && value !== null ? value : void 0;
+}
+function arrayLen(rec, key) {
+  const val = rec?.[key];
+  return Array.isArray(val) ? val.length : void 0;
+}
+function nested(rec, key) {
+  return asRecord(rec?.[key]);
+}
+var MISS_PREDICATES = {
+  find_symbol: (v) => arrayLen(v, "matches") === 0,
+  search_pattern: (v) => arrayLen(v, "matches") === 0,
+  get_symbol: (v) => v?.["symbol"] === null,
+  find_callers: (v) => arrayLen(v, "callers") === 0,
+  find_references: (v) => arrayLen(v, "references") === 0,
+  get_deps: (v) => arrayLen(v, "dependencies") === 0,
+  find_tests_for_symbol: (v) => arrayLen(v, "tests") === 0,
+  get_impact: (v) => arrayLen(v, "impacted") === 0,
+  list_edges: (v) => nested(v, "coverage")?.["filteredEdges"] === 0,
+  get_call_graph: (v) => arrayLen(nested(v, "subgraph"), "edges") === 0,
+  lsp_definition: (v) => arrayLen(v, "locations") === 0,
+  lsp_implementation: (v) => arrayLen(v, "locations") === 0,
+  lsp_references: (v) => arrayLen(v, "locations") === 0,
+  lsp_hover: (v) => !v?.["contents"],
+  lsp_workspace_symbol: (v) => arrayLen(v, "symbols") === 0,
+  lsp_document_symbol: (v) => arrayLen(v, "symbols") === 0,
+  lsp_call_hierarchy: (v) => arrayLen(v, "edges") === 0,
+  lsp_type_hierarchy: (v) => arrayLen(v, "entries") === 0
+};
+function isMiss(tool, value) {
+  const pred = MISS_PREDICATES[tool];
+  if (!pred)
+    return false;
+  try {
+    return pred(asRecord(value));
+  } catch {
+    return false;
+  }
+}
+function classifyToolResult(tool, value) {
+  const v = asRecord(value);
+  if (v && v["isError"] === true) {
+    const err = typeof v["error"] === "string" ? v["error"] : "";
+    if (err === "graph_not_loaded")
+      return { kind: "health", health: "graphNotLoaded" };
+    if (err === "unknown_repo")
+      return { kind: "health", health: "unknownRepo" };
+    if (err === "lsp_disabled")
+      return { kind: "health", health: "lspDisabled" };
+    if (err.startsWith("no-server-available") || err.startsWith("unsupported-language")) {
+      return { kind: "health", health: "lspUnavailable" };
+    }
+    if (v["invalidPattern"] === true || v["unsafePattern"] === true || / required \(/.test(err)) {
+      return { kind: "status", status: "rejected", miss: false };
+    }
+    return { kind: "status", status: "error", miss: false };
+  }
+  return { kind: "status", status: "ok", miss: isMiss(tool, value) };
+}
+function classifyThrow(err) {
+  return {
+    kind: "status",
+    status: err instanceof ToolTimeoutError ? "timeout" : "error",
+    miss: false
+  };
+}
 function stripAbsolutePaths(msg) {
   return msg.replace(/(?:^|(?<=\s|[:(,]))\/[\w.\-/]+/g, "<redacted-path>");
 }
@@ -7764,7 +8191,7 @@ async function readJson(req) {
 }
 async function writeEndpointFile(path, endpoint, secret) {
   await mkdir14(dirname14(path), { recursive: true });
-  await writeFile14(path, formatEndpointFile({ endpoint, secret }), {
+  await writeFile15(path, formatEndpointFile({ endpoint, secret }), {
     encoding: "utf-8",
     mode: 384
   });
@@ -7777,7 +8204,7 @@ function extractBearer(header) {
   return m ? m[1] : null;
 }
 function defaultEndpointFile() {
-  return join22(getConfigDir(), "listener.endpoint");
+  return join23(getConfigDir(), "listener.endpoint");
 }
 
 // ../listener/dist/mcp/bootstrap.js
@@ -7785,7 +8212,7 @@ async function startMcp(options) {
   const disabled = process.env.REPOWISE_MCP_DISABLED === "true";
   const graphsDir = options.graphsDir ?? defaultGraphsDir();
   const graphCache = createGraphCache({
-    resolveGraphPath: (repoId) => join23(graphsDir, `${repoId}.json`)
+    resolveGraphPath: (repoId) => join24(graphsDir, `${repoId}.json`)
   });
   if (disabled) {
     return {
@@ -7807,13 +8234,14 @@ async function startMcp(options) {
       repoIdToRoot.set(repo.repoId, repo.localPath);
   }
   const firstRepoLocal = options.repos.find((r) => r.localPath)?.localPath;
+  const rawMcpLogEnabled = process.env["REPOWISE_MCP_LOG_RAW_ENABLED"] === "true";
   const mcpHome = defaultMcpHome();
-  const logFilePath = join23(mcpHome, "mcp-log.jsonl.enc");
-  const keyStore = createFileKeyStore(join23(mcpHome, "mcp-log.key"));
-  const mcpLogger = createMcpLogger({ filePath: logFilePath, keyStore });
-  const flagFilePath = join23(mcpHome, "mcp-log.flag");
-  const watermarkFilePath = join23(mcpHome, "mcp-log.watermark");
-  const consentSentMarkerPath = join23(mcpHome, "mcp-log.consent-sent");
+  const logFilePath = join24(mcpHome, "mcp-log.jsonl.enc");
+  const keyStore = createFileKeyStore(join24(mcpHome, "mcp-log.key"));
+  const mcpLogger = rawMcpLogEnabled ? createMcpLogger({ filePath: logFilePath, keyStore }) : void 0;
+  const flagFilePath = join24(mcpHome, "mcp-log.flag");
+  const watermarkFilePath = join24(mcpHome, "mcp-log.watermark");
+  const consentSentMarkerPath = join24(mcpHome, "mcp-log.consent-sent");
   let uploader = null;
   let lastConsentState = false;
   let serverConsentEnsuredThisProcess = false;
@@ -7835,6 +8263,18 @@ async function startMcp(options) {
     });
     return uploader;
   }
+  const heartbeatEnabled = process.env["REPOWISE_MCP_HEARTBEAT_DISABLED"] !== "true";
+  const heartbeatApiUrl = options.repos.find((r) => Boolean(r.apiUrl))?.apiUrl ?? options.repos[0]?.apiUrl ?? "";
+  const heartbeatEmitter = heartbeatEnabled ? createHeartbeatEmitter({
+    listenerVersion: options.listenerVersion ?? "",
+    sink: createHeartbeatSink({
+      apiUrl: heartbeatApiUrl,
+      getAuthToken: options.getAuthToken,
+      flagFilePath,
+      ...options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}
+    })
+  }) : null;
+  const heartbeatAbort = heartbeatEmitter ? new AbortController() : null;
   const server = await startMcpServer({
     graphCache,
     ...lspWorkspaces ? { lspWorkspaces } : {},
@@ -7842,8 +8282,14 @@ async function startMcp(options) {
     repoIdToRoot: () => repoIdToRoot,
     ...options.getLspOverrides ? { getLspOverrides: options.getLspOverrides } : {},
     ...options.getLspEnabled ? { getLspEnabled: options.getLspEnabled } : {},
-    mcpLogger
+    ...heartbeatEmitter ? { heartbeat: heartbeatEmitter } : {},
+    // T11 — undefined unless the raw-log escape hatch is set; recordLog
+    // no-ops on an undefined logger so dispatch is unaffected.
+    ...mcpLogger ? { mcpLogger } : {}
   });
+  if (heartbeatEmitter && heartbeatAbort) {
+    void runHeartbeatLoop(heartbeatEmitter, { signal: heartbeatAbort.signal });
+  }
   const reapInterval = lspWorkspaces ? setInterval(() => {
     void lspWorkspaces.reapIdle().catch((err) => {
       console.warn(`[lsp] reapIdle failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -7860,7 +8306,7 @@ async function startMcp(options) {
       apiBaseUrl: repo.apiUrl,
       getAuthToken: options.getAuthToken,
       repoId: repo.repoId,
-      targetPath: join23(graphsDir, `${repo.repoId}.json`),
+      targetPath: join24(graphsDir, `${repo.repoId}.json`),
       graphCache,
       ...options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}
     }));
@@ -7886,6 +8332,9 @@ async function startMcp(options) {
       return results;
     },
     async runMcpLogUpload() {
+      if (!rawMcpLogEnabled) {
+        return { uploaded: 0, skipped: "no-consent" };
+      }
       if (process.env["REPOWISE_MCP_LOG_UPLOAD_DISABLED"] === "true") {
         return { uploaded: 0, skipped: "no-consent" };
       }
@@ -7945,7 +8394,7 @@ async function startMcp(options) {
           apiBaseUrl: repo.apiUrl,
           getAuthToken: options.getAuthToken,
           repoId: repo.repoId,
-          targetPath: join23(graphsDir, `${repo.repoId}.json`),
+          targetPath: join24(graphsDir, `${repo.repoId}.json`),
           graphCache,
           ...options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}
         }));
@@ -7954,6 +8403,10 @@ async function startMcp(options) {
     async close() {
       if (reapInterval)
         clearInterval(reapInterval);
+      if (heartbeatAbort)
+        heartbeatAbort.abort();
+      if (heartbeatEmitter)
+        await heartbeatEmitter.flush();
       await server.close();
       if (lspWorkspaces) {
         try {
@@ -7965,8 +8418,40 @@ async function startMcp(options) {
     }
   };
 }
+function createHeartbeatSink(deps) {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  return {
+    async post(payload) {
+      if (process.env["REPOWISE_MCP_HEARTBEAT_DISABLED"] === "true")
+        return;
+      if (!deps.apiUrl)
+        return;
+      if (!await isLocallyConsented(deps.flagFilePath))
+        return;
+      let token;
+      try {
+        token = await deps.getAuthToken();
+      } catch {
+        return;
+      }
+      if (!token)
+        return;
+      const res = await fetchImpl(`${deps.apiUrl}/v1/listeners/mcp-heartbeat`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${token}`
+        },
+        body: JSON.stringify(payload)
+      });
+      if (res && !res.ok) {
+        console.warn(`[mcp-heartbeat] upload rejected (HTTP ${res.status}) \u2014 possible payload/contract drift`);
+      }
+    }
+  };
+}
 function defaultGraphsDir() {
-  return join23(getConfigDir(), "graphs");
+  return join24(getConfigDir(), "graphs");
 }
 function defaultMcpHome() {
   return getConfigDir();
@@ -7984,8 +8469,8 @@ async function ensureServerConsent(opts) {
   if (!opts.apiUrl)
     return;
   try {
-    const { readFile: readFile18 } = await import("fs/promises");
-    await readFile18(opts.markerPath, "utf-8");
+    const { readFile: readFile19 } = await import("fs/promises");
+    await readFile19(opts.markerPath, "utf-8");
     return;
   } catch {
   }
@@ -8007,10 +8492,10 @@ async function ensureServerConsent(opts) {
     });
     if (!res.ok)
       return;
-    const fs30 = await import("fs/promises");
+    const fs31 = await import("fs/promises");
     const path = await import("path");
-    await fs30.mkdir(path.dirname(opts.markerPath), { recursive: true });
-    await fs30.writeFile(opts.markerPath, (/* @__PURE__ */ new Date()).toISOString() + "\n", {
+    await fs31.mkdir(path.dirname(opts.markerPath), { recursive: true });
+    await fs31.writeFile(opts.markerPath, (/* @__PURE__ */ new Date()).toISOString() + "\n", {
       encoding: "utf-8",
       mode: 384
     });
@@ -8024,7 +8509,7 @@ import { basename as basename3 } from "path";
 
 // ../listener/dist/mcp/auto-config/writers/claude-code.js
 import { promises as fs6 } from "fs";
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 
 // ../listener/dist/mcp/auto-config/markers.js
 import { promises as fs5 } from "fs";
@@ -8104,10 +8589,10 @@ function safeExistingContent(path, current) {
 var claudeCodeWriter = {
   tool: "claude-code",
   async detect(repoRoot, home) {
-    return await fileExists2(join24(repoRoot, "CLAUDE.md")) || await hasClaudeBinary(home);
+    return await fileExists2(join25(repoRoot, "CLAUDE.md")) || await hasClaudeBinary(home);
   },
   async write(ctx) {
-    const path = join24(ctx.repoRoot, ".mcp.json");
+    const path = join25(ctx.repoRoot, ".mcp.json");
     await removeFromConfig(path, `repowise-${ctx.repoId}`);
     const status2 = await writeMergedConfig({
       path,
@@ -8117,7 +8602,7 @@ var claudeCodeWriter = {
     return { status: status2, path };
   },
   async remove(ctx) {
-    const path = join24(ctx.repoRoot, ".mcp.json");
+    const path = join25(ctx.repoRoot, ".mcp.json");
     await removeFromConfig(path, `RepoWise MCP for ${ctx.repoName}`);
     await removeFromConfig(path, `repowise-${ctx.repoId}`);
   }
@@ -8131,20 +8616,20 @@ async function fileExists2(path) {
   }
 }
 async function hasClaudeBinary(home) {
-  return fileExists2(join24(home, ".claude", "claude.json"));
+  return fileExists2(join25(home, ".claude", "claude.json"));
 }
 
 // ../listener/dist/mcp/auto-config/writers/claude-code-hooks.js
 import { promises as fs7 } from "fs";
-import { join as join25 } from "path";
+import { join as join26 } from "path";
 var claudeCodeHooksWriter = {
   tool: "claude-code-hooks",
   async detect(repoRoot, home) {
-    return await fileExists3(join25(repoRoot, "CLAUDE.md")) || await fileExists3(join25(home, ".claude.json"));
+    return await fileExists3(join26(repoRoot, "CLAUDE.md")) || await fileExists3(join26(home, ".claude.json"));
   },
   async write(ctx) {
     const result = await writeClaudeHooksToRepo(ctx.repoRoot, ctx.contextFolder ?? "repowise-context", ctx.variant);
-    return { status: result.status, path: join25(ctx.repoRoot, result.relPath) };
+    return { status: result.status, path: join26(ctx.repoRoot, result.relPath) };
   },
   async remove(ctx) {
     await removeClaudeHooksFromRepo(ctx.repoRoot);
@@ -8161,14 +8646,14 @@ async function fileExists3(path) {
 
 // ../listener/dist/mcp/auto-config/writers/cline.js
 import { promises as fs8 } from "fs";
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 var clineWriter = {
   tool: "cline",
   async detect(repoRoot, home) {
-    return await fileExists4(join26(repoRoot, ".clinerules")) || await fileExists4(join26(home, ".cline"));
+    return await fileExists4(join27(repoRoot, ".clinerules")) || await fileExists4(join27(home, ".cline"));
   },
   async write(ctx) {
-    const path = join26(ctx.home, ".cline", "mcp.json");
+    const path = join27(ctx.home, ".cline", "mcp.json");
     await removeFromConfig(path, `repowise-${ctx.repoId}`);
     const status2 = await writeMergedConfig({
       path,
@@ -8178,7 +8663,7 @@ var clineWriter = {
     return { status: status2, path };
   },
   async remove(ctx) {
-    const path = join26(ctx.home, ".cline", "mcp.json");
+    const path = join27(ctx.home, ".cline", "mcp.json");
     await removeFromConfig(path, `RepoWise MCP for ${ctx.repoName}`);
     await removeFromConfig(path, `repowise-${ctx.repoId}`);
   }
@@ -8194,13 +8679,13 @@ async function fileExists4(path) {
 
 // ../listener/dist/mcp/auto-config/writers/cline-hooks.js
 import { promises as fs9 } from "fs";
-import { join as join27 } from "path";
+import { join as join28 } from "path";
 var SCRIPT_REL = ".clinerules/hooks/UserPromptSubmit";
 var OWNERSHIP_MARKER = "managed by RepoWise";
 var clineHooksWriter = {
   tool: "cline-hooks",
   async detect(repoRoot) {
-    return fileExists5(join27(repoRoot, ".clinerules"));
+    return fileExists5(join28(repoRoot, ".clinerules"));
   },
   async write(ctx) {
     if (await isGitTracked(ctx.repoRoot, SCRIPT_REL)) {
@@ -8210,7 +8695,7 @@ var clineHooksWriter = {
         reason: `${SCRIPT_REL} is git-tracked; update it manually to opt in`
       };
     }
-    const path = join27(ctx.repoRoot, SCRIPT_REL);
+    const path = join28(ctx.repoRoot, SCRIPT_REL);
     const next = buildClineHookScript({
       repoName: ctx.repoName,
       contextFolder: ctx.contextFolder ?? "repowise-context",
@@ -8227,14 +8712,14 @@ var clineHooksWriter = {
       await ensureExecutable(path);
       return { status: "unchanged", path };
     }
-    await fs9.mkdir(join27(ctx.repoRoot, ".clinerules", "hooks"), { recursive: true });
+    await fs9.mkdir(join28(ctx.repoRoot, ".clinerules", "hooks"), { recursive: true });
     await fs9.writeFile(path, next, { encoding: "utf-8", mode: 493 });
     await ensureExecutable(path);
     await applyGitignoreChanges(ctx.repoRoot, { add: [SCRIPT_REL] });
     return { status: "written", path };
   },
   async remove(ctx) {
-    const path = join27(ctx.repoRoot, SCRIPT_REL);
+    const path = join28(ctx.repoRoot, SCRIPT_REL);
     const existing = await readOrNull(path);
     if (existing !== null && existing.includes(OWNERSHIP_MARKER)) {
       await fs9.unlink(path);
@@ -8269,14 +8754,14 @@ async function readOrNull(path) {
 
 // ../listener/dist/mcp/auto-config/writers/codex.js
 import { promises as fs10 } from "fs";
-import { join as join28 } from "path";
+import { join as join29 } from "path";
 var codexWriter = {
   tool: "codex",
   async detect(_repoRoot, home) {
-    return fileExists6(join28(home, ".codex"));
+    return fileExists6(join29(home, ".codex"));
   },
   async write(ctx) {
-    const path = join28(ctx.home, ".codex", "mcp.json");
+    const path = join29(ctx.home, ".codex", "mcp.json");
     await removeFromConfig(path, `repowise-${ctx.repoId}`);
     const status2 = await writeMergedConfig({
       path,
@@ -8286,7 +8771,7 @@ var codexWriter = {
     return { status: status2, path };
   },
   async remove(ctx) {
-    const path = join28(ctx.home, ".codex", "mcp.json");
+    const path = join29(ctx.home, ".codex", "mcp.json");
     await removeFromConfig(path, `RepoWise MCP for ${ctx.repoName}`);
     await removeFromConfig(path, `repowise-${ctx.repoId}`);
   }
@@ -8302,15 +8787,15 @@ async function fileExists6(path) {
 
 // ../listener/dist/mcp/auto-config/writers/codex-hooks.js
 import { promises as fs11 } from "fs";
-import { join as join29 } from "path";
+import { join as join30 } from "path";
 var HOOKS_REL = ".codex/hooks.json";
 var codexHooksWriter = {
   tool: "codex-hooks",
   async detect(repoRoot, home) {
-    return await fileExists7(join29(home, ".codex")) || await fileExists7(join29(repoRoot, ".codex"));
+    return await fileExists7(join30(home, ".codex")) || await fileExists7(join30(repoRoot, ".codex"));
   },
   async write(ctx) {
-    const repoSignal = await fileExists7(join29(ctx.repoRoot, ".codex"));
+    const repoSignal = await fileExists7(join30(ctx.repoRoot, ".codex"));
     const selected = ctx.selectedTools?.includes("codex") ?? false;
     if (!repoSignal && !selected) {
       return { status: "skipped", reason: "no repo-scoped Codex signal and not selected" };
@@ -8322,7 +8807,7 @@ var codexHooksWriter = {
         reason: `${HOOKS_REL} is git-tracked; add the RepoWise UserPromptSubmit hook manually to opt in`
       };
     }
-    const path = join29(ctx.repoRoot, HOOKS_REL);
+    const path = join30(ctx.repoRoot, HOOKS_REL);
     const existing = await readOrNull2(path);
     const merged = mergeCodexHookSettings(existing, {
       repoName: ctx.repoName,
@@ -8332,13 +8817,13 @@ var codexHooksWriter = {
     if (merged === existing) {
       return { status: "unchanged", path };
     }
-    await fs11.mkdir(join29(ctx.repoRoot, ".codex"), { recursive: true });
+    await fs11.mkdir(join30(ctx.repoRoot, ".codex"), { recursive: true });
     await fs11.writeFile(path, merged, "utf-8");
     await applyGitignoreChanges(ctx.repoRoot, { add: [HOOKS_REL] });
     return { status: "written", path };
   },
   async remove(ctx) {
-    const path = join29(ctx.repoRoot, HOOKS_REL);
+    const path = join30(ctx.repoRoot, HOOKS_REL);
     const existing = await readOrNull2(path);
     if (existing !== null) {
       const next = removeCodexHookSettings(existing);
@@ -8369,14 +8854,14 @@ async function readOrNull2(path) {
 
 // ../listener/dist/mcp/auto-config/writers/copilot.js
 import { promises as fs12 } from "fs";
-import { join as join30 } from "path";
+import { join as join31 } from "path";
 var copilotWriter = {
   tool: "copilot",
   async detect(repoRoot) {
-    return fileExists8(join30(repoRoot, ".vscode"));
+    return fileExists8(join31(repoRoot, ".vscode"));
   },
   async write(ctx) {
-    const path = join30(ctx.repoRoot, ".vscode", "mcp.json");
+    const path = join31(ctx.repoRoot, ".vscode", "mcp.json");
     await removeFromConfig(path, `repowise-${ctx.repoId}`);
     const status2 = await writeMergedConfig({
       path,
@@ -8386,7 +8871,7 @@ var copilotWriter = {
     return { status: status2, path };
   },
   async remove(ctx) {
-    const path = join30(ctx.repoRoot, ".vscode", "mcp.json");
+    const path = join31(ctx.repoRoot, ".vscode", "mcp.json");
     await removeFromConfig(path, `RepoWise MCP for ${ctx.repoName}`);
     await removeFromConfig(path, `repowise-${ctx.repoId}`);
   }
@@ -8402,15 +8887,15 @@ async function fileExists8(path) {
 
 // ../listener/dist/mcp/auto-config/writers/copilot-hooks.js
 import { promises as fs13 } from "fs";
-import { join as join31 } from "path";
+import { join as join32 } from "path";
 var HOOKS_REL2 = ".github/hooks/repowise.json";
 var copilotHooksWriter = {
   tool: "copilot-hooks",
   async detect(repoRoot) {
-    return fileExists9(join31(repoRoot, ".github", "copilot-instructions.md"));
+    return fileExists9(join32(repoRoot, ".github", "copilot-instructions.md"));
   },
   async write(ctx) {
-    const path = join31(ctx.repoRoot, HOOKS_REL2);
+    const path = join32(ctx.repoRoot, HOOKS_REL2);
     const next = buildCopilotHooksFile({
       repoName: ctx.repoName,
       contextFolder: ctx.contextFolder ?? "repowise-context",
@@ -8430,14 +8915,14 @@ var copilotHooksWriter = {
     if (existing === next) {
       return { status: "unchanged", path };
     }
-    await fs13.mkdir(join31(ctx.repoRoot, ".github", "hooks"), { recursive: true });
+    await fs13.mkdir(join32(ctx.repoRoot, ".github", "hooks"), { recursive: true });
     await fs13.writeFile(path, next, "utf-8");
     const userSelected = ctx.selectedTools?.includes("copilot") ?? false;
     await applyGitignoreChanges(ctx.repoRoot, userSelected ? { remove: [HOOKS_REL2] } : { add: [HOOKS_REL2] });
     return { status: "written", path };
   },
   async remove(ctx) {
-    const path = join31(ctx.repoRoot, HOOKS_REL2);
+    const path = join32(ctx.repoRoot, HOOKS_REL2);
     if (!await isGitTracked(ctx.repoRoot, HOOKS_REL2)) {
       await fs13.unlink(path).catch(() => {
       });
@@ -8463,14 +8948,14 @@ async function readOrNull3(path) {
 
 // ../listener/dist/mcp/auto-config/writers/cursor.js
 import { promises as fs14 } from "fs";
-import { join as join32 } from "path";
+import { join as join33 } from "path";
 var cursorWriter = {
   tool: "cursor",
   async detect(repoRoot) {
-    return await fileExists10(join32(repoRoot, ".cursor")) || await fileExists10(join32(repoRoot, ".cursorrules"));
+    return await fileExists10(join33(repoRoot, ".cursor")) || await fileExists10(join33(repoRoot, ".cursorrules"));
   },
   async write(ctx) {
-    const path = join32(ctx.repoRoot, ".cursor", "mcp.json");
+    const path = join33(ctx.repoRoot, ".cursor", "mcp.json");
     await removeFromConfig(path, `repowise-${ctx.repoId}`);
     const status2 = await writeMergedConfig({
       path,
@@ -8480,7 +8965,7 @@ var cursorWriter = {
     return { status: status2, path };
   },
   async remove(ctx) {
-    const path = join32(ctx.repoRoot, ".cursor", "mcp.json");
+    const path = join33(ctx.repoRoot, ".cursor", "mcp.json");
     await removeFromConfig(path, `RepoWise MCP for ${ctx.repoName}`);
     await removeFromConfig(path, `repowise-${ctx.repoId}`);
   }
@@ -8496,14 +8981,14 @@ async function fileExists10(path) {
 
 // ../listener/dist/mcp/auto-config/writers/gemini-cli.js
 import { promises as fs15 } from "fs";
-import { join as join33 } from "path";
+import { join as join34 } from "path";
 var geminiCliWriter = {
   tool: "gemini-cli",
   async detect(_repoRoot, home) {
-    return fileExists11(join33(home, ".gemini"));
+    return fileExists11(join34(home, ".gemini"));
   },
   async write(ctx) {
-    const path = join33(ctx.home, ".gemini", "settings.json");
+    const path = join34(ctx.home, ".gemini", "settings.json");
     await removeFromConfig(path, `repowise-${ctx.repoId}`);
     const status2 = await writeMergedConfig({
       path,
@@ -8513,7 +8998,7 @@ var geminiCliWriter = {
     return { status: status2, path };
   },
   async remove(ctx) {
-    const path = join33(ctx.home, ".gemini", "settings.json");
+    const path = join34(ctx.home, ".gemini", "settings.json");
     await removeFromConfig(path, `RepoWise MCP for ${ctx.repoName}`);
     await removeFromConfig(path, `repowise-${ctx.repoId}`);
   }
@@ -8529,15 +9014,15 @@ async function fileExists11(path) {
 
 // ../listener/dist/mcp/auto-config/writers/gemini-hooks.js
 import { promises as fs16 } from "fs";
-import { join as join34 } from "path";
+import { join as join35 } from "path";
 var SETTINGS_REL = ".gemini/settings.json";
 var geminiHooksWriter = {
   tool: "gemini-hooks",
   async detect(repoRoot, home) {
-    return await fileExists12(join34(home, ".gemini")) || await fileExists12(join34(repoRoot, ".gemini"));
+    return await fileExists12(join35(home, ".gemini")) || await fileExists12(join35(repoRoot, ".gemini"));
   },
   async write(ctx) {
-    const repoSignal = await fileExists12(join34(ctx.repoRoot, ".gemini")) || await fileExists12(join34(ctx.repoRoot, "GEMINI.md"));
+    const repoSignal = await fileExists12(join35(ctx.repoRoot, ".gemini")) || await fileExists12(join35(ctx.repoRoot, "GEMINI.md"));
     const selected = ctx.selectedTools?.includes("gemini") ?? false;
     if (!repoSignal && !selected) {
       return { status: "skipped", reason: "no repo-scoped Gemini signal and not selected" };
@@ -8549,7 +9034,7 @@ var geminiHooksWriter = {
         reason: `${SETTINGS_REL} is git-tracked; add the RepoWise BeforeAgent hook manually to opt in`
       };
     }
-    const path = join34(ctx.repoRoot, SETTINGS_REL);
+    const path = join35(ctx.repoRoot, SETTINGS_REL);
     const existing = await readOrNull4(path);
     const merged = mergeGeminiHookSettings(existing, {
       repoName: ctx.repoName,
@@ -8559,13 +9044,13 @@ var geminiHooksWriter = {
     if (merged === existing) {
       return { status: "unchanged", path };
     }
-    await fs16.mkdir(join34(ctx.repoRoot, ".gemini"), { recursive: true });
+    await fs16.mkdir(join35(ctx.repoRoot, ".gemini"), { recursive: true });
     await fs16.writeFile(path, merged, "utf-8");
     await applyGitignoreChanges(ctx.repoRoot, { add: [SETTINGS_REL] });
     return { status: "written", path };
   },
   async remove(ctx) {
-    const path = join34(ctx.repoRoot, SETTINGS_REL);
+    const path = join35(ctx.repoRoot, SETTINGS_REL);
     const existing = await readOrNull4(path);
     if (existing !== null) {
       const next = removeGeminiHookSettings(existing);
@@ -8596,14 +9081,14 @@ async function readOrNull4(path) {
 
 // ../listener/dist/mcp/auto-config/writers/roo.js
 import { promises as fs17 } from "fs";
-import { join as join35 } from "path";
+import { join as join36 } from "path";
 var rooWriter = {
   tool: "roo",
   async detect(repoRoot, home) {
-    return await fileExists13(join35(repoRoot, ".roo")) || await fileExists13(join35(home, ".roo"));
+    return await fileExists13(join36(repoRoot, ".roo")) || await fileExists13(join36(home, ".roo"));
   },
   async write(ctx) {
-    const repoConfig = join35(ctx.repoRoot, ".roo", "mcp.json");
+    const repoConfig = join36(ctx.repoRoot, ".roo", "mcp.json");
     const before = await readOrNull5(repoConfig);
     await this.remove(ctx);
     const after = await readOrNull5(repoConfig);
@@ -8613,9 +9098,9 @@ var rooWriter = {
     };
   },
   async remove(ctx) {
-    const repoConfig = join35(ctx.repoRoot, ".roo", "mcp.json");
-    const homeConfig = join35(ctx.home, ".roo", "mcp.json");
-    const homeSettings = join35(ctx.home, ".roo", "settings.json");
+    const repoConfig = join36(ctx.repoRoot, ".roo", "mcp.json");
+    const homeConfig = join36(ctx.home, ".roo", "mcp.json");
+    const homeSettings = join36(ctx.home, ".roo", "settings.json");
     for (const path of [repoConfig, homeConfig, homeSettings]) {
       await removeFromConfig(path, `RepoWise MCP for ${ctx.repoName}`).catch(() => {
       });
@@ -8642,14 +9127,14 @@ async function readOrNull5(path) {
 
 // ../listener/dist/mcp/auto-config/writers/windsurf.js
 import { promises as fs18 } from "fs";
-import { join as join36 } from "path";
+import { join as join37 } from "path";
 var windsurfWriter = {
   tool: "windsurf",
   async detect(_repoRoot, home) {
-    return fileExists14(join36(home, ".codeium", "windsurf"));
+    return fileExists14(join37(home, ".codeium", "windsurf"));
   },
   async write(ctx) {
-    const path = join36(ctx.home, ".codeium", "windsurf", "mcp_config.json");
+    const path = join37(ctx.home, ".codeium", "windsurf", "mcp_config.json");
     await removeFromConfig(path, `repowise-${ctx.repoId}`);
     const status2 = await writeMergedConfig({
       path,
@@ -8659,7 +9144,7 @@ var windsurfWriter = {
     return { status: status2, path };
   },
   async remove(ctx) {
-    const path = join36(ctx.home, ".codeium", "windsurf", "mcp_config.json");
+    const path = join37(ctx.home, ".codeium", "windsurf", "mcp_config.json");
     await removeFromConfig(path, `RepoWise MCP for ${ctx.repoName}`);
     await removeFromConfig(path, `repowise-${ctx.repoId}`);
   }
@@ -8741,7 +9226,7 @@ init_installer();
 init_registry();
 init_lsp_tools();
 import { promises as fs19 } from "fs";
-import { join as join37 } from "path";
+import { join as join38 } from "path";
 async function collectRepresentativeFiles(repoRoot) {
   const reps = /* @__PURE__ */ new Map();
   let inspected = 0;
@@ -8782,7 +9267,7 @@ async function collectRepresentativeFiles(repoRoot) {
       continue;
     if (name === "node_modules" || name === "dist" || name === "build")
       continue;
-    const sub = join37(repoRoot, name);
+    const sub = join38(repoRoot, name);
     try {
       const stat8 = await fs19.stat(sub);
       if (stat8.isDirectory())
@@ -8830,7 +9315,7 @@ init_config_dir();
 import { promises as fs20 } from "fs";
 import { spawn as spawn9, execFile as execFile5 } from "child_process";
 import { createWriteStream as createWriteStream2 } from "fs";
-import { join as join38 } from "path";
+import { join as join39 } from "path";
 import { promisify as promisify3 } from "util";
 var execFileAsync3 = promisify3(execFile5);
 async function isCommandOnPath2(cmd) {
@@ -8894,7 +9379,7 @@ async function maybeWriteClangdStub(repoRoot, repoId) {
       if (e.isDirectory()) {
         if (skip.has(e.name) || e.name.startsWith("."))
           continue;
-        await rec(join38(dir, e.name));
+        await rec(join39(dir, e.name));
         continue;
       }
       const dot = e.name.lastIndexOf(".");
@@ -8903,7 +9388,7 @@ async function maybeWriteClangdStub(repoRoot, repoId) {
       const ext = e.name.slice(dot);
       if (!C_EXTS.has(ext) && !CPP_EXTS.has(ext))
         continue;
-      sources.push({ path: join38(dir, e.name), ext });
+      sources.push({ path: join39(dir, e.name), ext });
     }
   }
   await rec(repoRoot);
@@ -8919,9 +9404,9 @@ async function maybeWriteClangdStub(repoRoot, repoId) {
       command: `${driver} ${std} -I. -I./include -c "${src}"`
     };
   });
-  const outDir = join38(repoRoot, ".repowise");
+  const outDir = join39(repoRoot, ".repowise");
   await fs20.mkdir(outDir, { recursive: true });
-  const outPath = join38(outDir, "compile_commands.json");
+  const outPath = join39(outDir, "compile_commands.json");
   await fs20.writeFile(outPath, JSON.stringify(entries, null, 2));
   const capHit = sources.length >= MAX_STUB_SOURCES;
   console.log(`[workspace-prep] ${repoId}: wrote ${entries.length.toString()}-entry compile_commands stub to .repowise/${capHit ? " (cap reached \u2014 additional sources truncated)" : ""}`);
@@ -8930,7 +9415,7 @@ async function maybeWriteClangdStub(repoRoot, repoId) {
 var DEFAULT_TIMEOUT_MS = 10 * 60 * 1e3;
 async function fileExists15(repoRoot, name) {
   try {
-    await fs20.access(join38(repoRoot, name));
+    await fs20.access(join39(repoRoot, name));
     return true;
   } catch {
     return false;
@@ -8941,7 +9426,7 @@ async function detectWorkspaceDeps(repoRoot) {
   if (await fileExists15(repoRoot, "package.json")) {
     let pkgRaw = "";
     try {
-      pkgRaw = await fs20.readFile(join38(repoRoot, "package.json"), "utf8");
+      pkgRaw = await fs20.readFile(join39(repoRoot, "package.json"), "utf8");
     } catch {
     }
     if (pkgRaw) {
@@ -9044,7 +9529,7 @@ async function runWorkspacePreps(opts) {
   if (opts.missing.length === 0)
     return [];
   const safeRepoId = opts.repoId.replace(/[^a-zA-Z0-9_-]/g, "_");
-  const logPath2 = join38(getConfigDir(), `install-log.${safeRepoId}.txt`);
+  const logPath2 = join39(getConfigDir(), `install-log.${safeRepoId}.txt`);
   await fs20.mkdir(getConfigDir(), { recursive: true });
   const stream = opts.logStream ?? createWriteStream2(logPath2, { flags: "a" });
   stream.on("error", () => {
@@ -9195,7 +9680,7 @@ async function prepareWorkspaceDepsForRepos(repos) {
 init_registry();
 import { execFile as execFileCb, spawn as spawn10 } from "child_process";
 import { access as access3, readdir as readdir4 } from "fs/promises";
-import { join as join39 } from "path";
+import { join as join40 } from "path";
 import { promisify as promisify4 } from "util";
 var execFile6 = promisify4(execFileCb);
 var DEFAULT_BUILD_TIMEOUT_MS = 10 * 60 * 1e3;
@@ -9248,7 +9733,7 @@ async function ensureIndexable(indexRoot, language, options = {}) {
     }
   }
   try {
-    await access3(join39(indexRoot, spec.indexStoreProbe));
+    await access3(join40(indexRoot, spec.indexStoreProbe));
     return { ready: true, built: false };
   } catch {
   }
@@ -9982,13 +10467,13 @@ init_config_dir();
 import { execFile as execFileCb3 } from "child_process";
 import { createHash as createHash5 } from "crypto";
 import { mkdir as mkdir15, readdir as readdir5, rm, stat as stat6 } from "fs/promises";
-import { join as join40 } from "path";
+import { join as join41 } from "path";
 import { promisify as promisify6 } from "util";
 var execFile8 = promisify6(execFileCb3);
 var GIT_OP_TIMEOUT_MS = 6e4;
 var MAX_CONCURRENT_WORKTREES = 3;
 function worktreeBaseDir() {
-  return join40(getConfigDir(), "lsp-worktrees");
+  return join41(getConfigDir(), "lsp-worktrees");
 }
 async function reapOrphanWorktrees(maxAgeMs = 24 * 60 * 60 * 1e3, base = worktreeBaseDir()) {
   let reaped = 0;
@@ -10000,7 +10485,7 @@ async function reapOrphanWorktrees(maxAgeMs = 24 * 60 * 60 * 1e3, base = worktre
   }
   const cutoff = Date.now() - maxAgeMs;
   for (const entry of entries) {
-    const dir = join40(base, entry);
+    const dir = join41(base, entry);
     try {
       const info = await stat6(dir);
       if (!info.isDirectory() || info.mtimeMs > cutoff)
@@ -10033,7 +10518,7 @@ async function prepareCommittedTree(repoRoot, commitSha, options = {}) {
   }
   const base = options.worktreeBase ?? worktreeBaseDir();
   const dirName = createHash5("sha256").update(`${repoRoot}\0${commitSha}`).digest("hex").slice(0, 16) + "-" + commitSha.slice(0, 12);
-  const worktreePath = join40(base, dirName);
+  const worktreePath = join41(base, dirName);
   try {
     await mkdir15(base, { recursive: true });
     await git(["-C", repoRoot, "worktree", "prune"]).catch(() => void 0);
@@ -10369,8 +10854,8 @@ var CRASH_LOOP_WINDOW_MS = 3e4;
 var CRASH_LOOP_THRESHOLD = 3;
 async function readRawToolConfig() {
   try {
-    const configPath = join41(getConfigDir(), "config.json");
-    const data = await readFile13(configPath, "utf-8");
+    const configPath = join42(getConfigDir(), "config.json");
+    const data = await readFile14(configPath, "utf-8");
     const raw = JSON.parse(data);
     return {
       aiTools: Array.isArray(raw["aiTools"]) ? raw["aiTools"] : void 0,
@@ -10396,10 +10881,9 @@ async function updateToolConfigsForRepo(localPath, config2, state, repoId) {
   }
   await migrateRooToKilo(localPath).catch(() => {
   });
-  const variant = config2.graphOnly ? "graph" : "full";
   const contextFiles = await scanLocalContextFiles(localPath, contextFolder);
-  if (contextFiles.length === 0 && variant === "full")
-    return;
+  const marker = await readDocsMarker(localPath, contextFolder);
+  const variant = effectiveToolVariant(!!config2.graphOnly, contextFiles.length > 0, marker, state.repos[repoId]?.lastSyncCommitSha);
   const hash = JSON.stringify({
     rev: AI_TOOLS_REFERENCE_REV,
     block: AGENT_INSTRUCTIONS_HASH,
@@ -10426,10 +10910,15 @@ async function updateToolConfigsForRepo(localPath, config2, state, repoId) {
   if (!written.has("AGENTS.md")) {
     await updateToolConfig(localPath, "codex", repoName, contextFolder, contextFiles, variant);
   }
+  const prevToolVariant = state.repos[repoId]?.lastToolVariant;
   if (!state.repos[repoId]) {
     state.repos[repoId] = { lastSyncTimestamp: (/* @__PURE__ */ new Date()).toISOString(), lastSyncCommitSha: null };
   }
   state.repos[repoId].lastToolConfigHash = hash;
+  state.repos[repoId].lastToolVariant = variant;
+  if (!config2.graphOnly && variant === "full" && prevToolVariant === "graph") {
+    notifyDocsReady(repoId);
+  }
   console.log(`[ai-tools] Updated tool configs for ${repoId}`);
 }
 var running = false;
@@ -10446,8 +10935,8 @@ function resolveAuditRoots() {
   const out = /* @__PURE__ */ new Set();
   let dir = dirname17(process.execPath);
   for (let i = 0; i < 8; i += 1) {
-    out.add(join41(dir, "node_modules"));
-    out.add(join41(dir, "lib", "node_modules"));
+    out.add(join42(dir, "node_modules"));
+    out.add(join42(dir, "lib", "node_modules"));
     const parent = dirname17(dir);
     if (parent === dir)
       break;
@@ -10510,15 +10999,72 @@ function sleep(ms) {
     }, ms);
   });
 }
-function decodeEmailFromIdToken(idToken) {
+async function waitForCredentials(isRunning2) {
+  let changed = false;
+  let watcher = null;
   try {
-    const payload = JSON.parse(Buffer.from(idToken.split(".")[1], "base64url").toString());
-    return typeof payload.email === "string" ? payload.email : null;
+    const fs31 = await import("fs");
+    watcher = fs31.watch(getConfigDir(), (_event, filename) => {
+      if (!filename || filename === "credentials.json")
+        changed = true;
+    });
   } catch {
-    return null;
   }
-}
-async function handleSyncCompleted(notif, ctx) {
+  try {
+    while (isRunning2()) {
+      await sleep(changed ? 0 : 1e4);
+      changed = false;
+      if (!isRunning2())
+        break;
+      const fresh = await getValidCredentials({ forceRefresh: true });
+      if (fresh)
+        return fresh;
+    }
+    return null;
+  } finally {
+    if (watcher)
+      watcher.close();
+  }
+}
+async function waitForCredentialsOrTerminal(isRunning2) {
+  let changed = false;
+  let watcher = null;
+  try {
+    const fs31 = await import("fs");
+    watcher = fs31.watch(getConfigDir(), (_event, filename) => {
+      if (!filename || filename === "credentials.json")
+        changed = true;
+    });
+  } catch {
+  }
+  try {
+    while (isRunning2()) {
+      await sleep(changed ? 0 : 1e4);
+      changed = false;
+      if (!isRunning2())
+        break;
+      const fresh = await getValidCredentials({ forceRefresh: true });
+      if (fresh)
+        return { kind: "recovered", creds: fresh };
+      const oc = getLastRefreshOutcome();
+      if (oc === "terminal" || oc === "no-creds")
+        return { kind: "terminal" };
+    }
+    return { kind: "stopped" };
+  } finally {
+    if (watcher)
+      watcher.close();
+  }
+}
+function decodeEmailFromIdToken(idToken) {
+  try {
+    const payload = JSON.parse(Buffer.from(idToken.split(".")[1], "base64url").toString());
+    return typeof payload.email === "string" ? payload.email : null;
+  } catch {
+    return null;
+  }
+}
+async function handleSyncCompleted(notif, ctx) {
   if (!notif.commitSha) {
     console.warn(`sync.completed for ${notif.repoId} has no commitSha`);
   }
@@ -10537,13 +11083,14 @@ async function handleSyncCompleted(notif, ctx) {
     return { stateUpdated: false };
   }
   notifyContextUpdated(notif.repoId, result.updatedFiles.length);
-  invalidateLspBuffersOnce(notif, localPath, ctx);
-  await refreshAiToolConfigs(notif, localPath, ctx);
+  await writeDocsMarker(localPath, "repowise-context", notif.commitSha ?? null, result.updatedFiles.length);
   ctx.state.repos[notif.repoId] = {
     ...ctx.state.repos[notif.repoId],
     lastSyncTimestamp: notif.createdAt,
     lastSyncCommitSha: notif.commitSha ?? ctx.state.repos[notif.repoId]?.lastSyncCommitSha ?? null
   };
+  invalidateLspBuffersOnce(notif, localPath, ctx);
+  await refreshAiToolConfigs(notif, localPath, ctx);
   await runProducerHook(notif, localPath, ctx);
   return { stateUpdated: true };
 }
@@ -10712,14 +11259,14 @@ async function checkStaleContext(repos, state, groups) {
     if (group?.offline.isOffline)
       continue;
     const { statSync: statSync2, readdirSync: readdirSync2 } = await import("fs");
-    const contextPath = join41(repo.localPath, "repowise-context");
+    const contextPath = join42(repo.localPath, "repowise-context");
     let isMissingOrEmpty = false;
     try {
       const s = statSync2(contextPath);
       if (!s.isDirectory()) {
         isMissingOrEmpty = true;
       } else {
-        const entries = readdirSync2(contextPath);
+        const entries = readdirSync2(contextPath).filter((e) => !e.startsWith("."));
         isMissingOrEmpty = entries.length === 0;
       }
     } catch {
@@ -10735,16 +11282,19 @@ async function checkStaleContext(repos, state, groups) {
       const result = await fetchContextFromServer(repo.repoId, repo.localPath, apiUrl);
       if (result.success && result.updatedFiles.length > 0) {
         console.log(`[self-heal] Re-downloaded ${result.updatedFiles.length} files for ${repo.repoId}`);
+        await writeDocsMarker(repo.localPath, "repowise-context", repoState.lastSyncCommitSha ?? null, result.updatedFiles.length);
         notifyContextUpdated(repo.repoId, result.updatedFiles.length);
       }
     }
   }
   return dirty;
 }
+function mcpAiToolsKey(aiTools) {
+  return JSON.stringify([...aiTools ?? []].sort());
+}
 async function reconcileMcpConfigs(repos, packageName) {
   const shimCmd = packageName;
   const { contextFolder, aiTools, graphOnly } = await readRawToolConfig();
-  const variant = graphOnly ? "graph" : "full";
   for (const repo of repos) {
     if (!repo.localPath)
       continue;
@@ -10755,6 +11305,8 @@ async function reconcileMcpConfigs(repos, packageName) {
     } catch {
       continue;
     }
+    const docsPresent = (await scanLocalContextFiles(repo.localPath, contextFolder ?? "repowise-context")).length > 0;
+    const variant = effectiveToolVariant(!!graphOnly, docsPresent, null, null);
     try {
       const results = await runAutoConfig({
         repoRoot: repo.localPath,
@@ -10777,10 +11329,10 @@ async function reconcileAgentInstructions(repos) {
   const { graphOnly } = await readRawToolConfig();
   const variant = graphOnly ? "graph" : "full";
   for (const repo of repos) {
-    const path = join41(repo.localPath, "repowise-context", "project-overview.md");
+    const path = join42(repo.localPath, "repowise-context", "project-overview.md");
     let content;
     try {
-      content = await readFile13(path, "utf-8");
+      content = await readFile14(path, "utf-8");
     } catch (err) {
       const code = err?.code;
       if (code === "ENOENT" || code === "ENOTDIR" || code === "EACCES" || code === "EPERM" || code === "EISDIR") {
@@ -10793,7 +11345,7 @@ async function reconcileAgentInstructions(repos) {
     if (injected === content)
       continue;
     try {
-      await writeFile15(path, injected, "utf-8");
+      await writeFile16(path, injected, "utf-8");
       console.log(`[reconcile] Reconciled agent instructions for ${repo.repoId}`);
     } catch (err) {
       console.warn(`[reconcile] write failed for ${repo.repoId}:`, err instanceof Error ? err.message : String(err));
@@ -10861,11 +11413,11 @@ async function startListener() {
   }
   const configDir = getConfigDir();
   await mkdir16(configDir, { recursive: true });
-  const lockPath = join41(configDir, "listener.lock");
-  await writeFile15(lockPath, "", { flag: "a" });
+  const lockPath = join42(configDir, "listener.lock");
+  await writeFile16(lockPath, "", { flag: "a" });
   let lockIsHeld = false;
   try {
-    lockIsHeld = await lockfile4.check(lockPath, { stale: 3e4, realpath: false });
+    lockIsHeld = await lockfile5.check(lockPath, { stale: 3e4, realpath: false });
   } catch {
   }
   if (!lockIsHeld) {
@@ -10879,7 +11431,7 @@ async function startListener() {
     }
   }
   try {
-    releaseLock = await lockfile4.lock(lockPath, { stale: 3e4, realpath: false });
+    releaseLock = await lockfile5.lock(lockPath, { stale: 3e4, realpath: false });
   } catch {
     console.error(`Listener already running. Stop it first with \`${true ? "repowisestage" : "repowise"} stop\`.`);
     process.exitCode = 1;
@@ -10904,17 +11456,20 @@ async function startListener() {
     return;
   }
   if (config2.repos.length === 0 && !config2.autoDiscoverRepos) {
-    console.error(`No repos configured. Add repos to ${join41(configDir, "config.json")}`);
+    console.error(`No repos configured. Add repos to ${join42(configDir, "config.json")}`);
     await releaseLockAndExit();
     process.exitCode = 1;
     return;
   }
-  const credentials = await getValidCredentials();
+  let credentials = await getValidCredentials();
   if (!credentials) {
-    console.error("Not logged in. Run `repowise login` first.");
-    await releaseLockAndExit();
-    process.exitCode = 1;
-    return;
+    console.warn("Not logged in. Run `repowise login` \u2014 the listener will start automatically once you sign in.");
+    credentials = await waitForCredentials(() => running);
+    if (!credentials) {
+      await releaseLockAndExit();
+      return;
+    }
+    console.log("Logged in \u2014 starting RepoWise listener.");
   }
   let state;
   try {
@@ -10972,8 +11527,8 @@ async function startListener() {
   let currentVersion = "";
   try {
     const selfDir = dirname17(fileURLToPath3(import.meta.url));
-    const pkgJsonPath = join41(selfDir, "..", "..", "package.json");
-    const pkgJson = JSON.parse(await readFile13(pkgJsonPath, "utf-8"));
+    const pkgJsonPath = join42(selfDir, "..", "..", "package.json");
+    const pkgJson = JSON.parse(await readFile14(pkgJsonPath, "utf-8"));
     currentVersion = pkgJson.version;
   } catch (err) {
     console.log(`[auto-update] Version detection failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -10981,6 +11536,7 @@ async function startListener() {
   let pollIntervalMs = 5e3;
   let pollCycleCount = 0;
   const RECONCILE_EVERY_N_CYCLES = 60;
+  let lastMcpAiToolsKey = null;
   const origLog = console.log.bind(console);
   const origError = console.error.bind(console);
   const origWarn = console.warn.bind(console);
@@ -10994,6 +11550,8 @@ async function startListener() {
   console.warn = (...args) => origWarn(`[${ts()}]`, ...args);
   console.log(`RepoWise Listener started \u2014 watching ${allRepoIds.length} repo(s)`);
   let mcpRuntime = null;
+  let proactiveRefreshTimer = null;
+  const PROACTIVE_REFRESH_MS = 10 * 60 * 1e3;
   try {
     mcpRuntime = await startMcp({
       repos: config2.repos.map((r) => ({
@@ -11001,6 +11559,8 @@ async function startListener() {
         apiUrl: r.apiUrl ?? config2.defaultApiUrl,
         ...r.localPath ? { localPath: r.localPath } : {}
       })),
+      // Rides the anonymous MCP-usage heartbeat for fleet version spread.
+      listenerVersion: currentVersion,
       getAuthToken: async () => {
         const fresh = await getValidCredentials();
         if (!fresh)
@@ -11134,6 +11694,10 @@ async function startListener() {
   const shutdown = async () => {
     console.log("Shutting down...");
     stop();
+    if (proactiveRefreshTimer) {
+      clearInterval(proactiveRefreshTimer);
+      proactiveRefreshTimer = null;
+    }
     if (mcpRuntime) {
       try {
         await mcpRuntime.close();
@@ -11164,7 +11728,22 @@ async function startListener() {
       }).finally(() => process.exit(0));
     });
   }
+  if (!proactiveRefreshTimer) {
+    proactiveRefreshTimer = setInterval(() => {
+      void getValidCredentials().catch(() => {
+      });
+    }, PROACTIVE_REFRESH_MS);
+    proactiveRefreshTimer.unref();
+  }
+  let lastCycleAt = Date.now();
   while (running) {
+    const wakeDrift = Date.now() - lastCycleAt;
+    if (wakeDrift > pollIntervalMs + 6e4) {
+      console.log(`[wake] ~${Math.round(wakeDrift / 1e3).toString()}s gap detected (likely sleep) \u2014 refreshing credentials`);
+      await getValidCredentials({ forceRefresh: true }).catch(() => {
+      });
+    }
+    lastCycleAt = Date.now();
     let anyAuthError = null;
     let authErrorGroup = null;
     let minPollInterval = pollIntervalMs;
@@ -11207,6 +11786,16 @@ async function startListener() {
           console.warn("[mcp-config] front-load for newly-registered repo(s) failed:", err instanceof Error ? err.message : String(err));
         });
       }
+      const aiToolsKey = mcpAiToolsKey((await readRawToolConfig()).aiTools);
+      if (lastMcpAiToolsKey === null) {
+        lastMcpAiToolsKey = aiToolsKey;
+      } else if (aiToolsKey !== lastMcpAiToolsKey) {
+        lastMcpAiToolsKey = aiToolsKey;
+        console.log("[config-sync] AI-tool selection changed \u2014 front-loading MCP config");
+        void reconcileMcpConfigs(freshRepos, packageName).catch((err) => {
+          console.warn("[mcp-config] front-load for aiTools change failed:", err instanceof Error ? err.message : String(err));
+        });
+      }
     } catch {
     }
     for (const group of groups) {
@@ -11371,10 +11960,10 @@ async function startListener() {
           }
         }
         group.offline.attemptCount++;
-        const delay2 = group.backoff.nextDelay();
-        group.offline.nextRetryAt = Date.now() + delay2;
+        const delay3 = group.backoff.nextDelay();
+        group.offline.nextRetryAt = Date.now() + delay3;
         const message = err instanceof Error ? err.message : "Unknown error";
-        console.error(`Poll failed for ${group.apiUrl} (attempt ${group.offline.attemptCount}): ${message}. Retrying in ${Math.round(delay2 / 1e3)}s`);
+        console.error(`Poll failed for ${group.apiUrl} (attempt ${group.offline.attemptCount}): ${message}. Retrying in ${Math.round(delay3 / 1e3)}s`);
       }
     }
     if (shouldReconcile) {
@@ -11451,13 +12040,14 @@ async function startListener() {
     }
     if (anyAuthError) {
       let recovered = false;
-      for (let attempt = 1; attempt <= 3; attempt++) {
-        console.warn(`Auth error \u2014 retrying credentials (attempt ${attempt}/3)...`);
-        await sleep(5e3);
+      const backoffs = [5e3, 1e4, 2e4];
+      for (let attempt = 0; attempt < backoffs.length; attempt++) {
+        console.warn(`Auth error \u2014 retrying credentials (attempt ${(attempt + 1).toString()}/${backoffs.length.toString()})...`);
+        await sleep(backoffs[attempt]);
         if (!running)
           break;
-        const fresh = await getValidCredentials({ forceRefresh: true });
-        if (fresh) {
+        const fresh2 = await getValidCredentials({ forceRefresh: true });
+        if (fresh2) {
           console.log("Credentials recovered \u2014 resuming listener");
           recovered = true;
           break;
@@ -11465,42 +12055,47 @@ async function startListener() {
       }
       if (recovered)
         continue;
-      console.error("Session expired after 3 retries. Sending notification email and waiting for re-authentication...");
+      const outcome = getLastRefreshOutcome();
+      let terminal = outcome === "terminal" || outcome === "no-creds";
+      if (!terminal) {
+        console.warn("[auth] Refresh still failing (transient/offline) \u2014 keeping MCP up, waiting for connectivity...");
+        const waited = await waitForCredentialsOrTerminal(() => running);
+        if (waited.kind === "stopped")
+          continue;
+        if (waited.kind === "recovered") {
+          console.log("Reconnected \u2014 resuming listener");
+          continue;
+        }
+        console.warn("[auth] Session became terminal during the offline wait \u2014 prompting re-login");
+        terminal = true;
+      }
+      console.error("Session expired (refresh token rejected). Prompting re-login and waiting...");
+      try {
+        await mcpRuntime?.server?.suspendEndpoint();
+      } catch (err) {
+        console.warn("[mcp] suspendEndpoint failed:", err instanceof Error ? err.message : String(err));
+      }
       const creds = await getStoredCredentials();
       const email = creds?.idToken ? decodeEmailFromIdToken(creds.idToken) : null;
       if (email && authErrorGroup) {
         try {
-          await fetch(`${authErrorGroup.apiUrl}/v1/public/notify-auth-expired`, {
+          await fetchWithTimeout(`${authErrorGroup.apiUrl}/v1/public/notify-auth-expired`, {
             method: "POST",
             headers: { "Content-Type": "application/json" },
             body: JSON.stringify({ email })
-          });
+          }, 5e3);
         } catch {
         }
       }
-      const credentialsPath = join41(getConfigDir(), "credentials.json");
-      let credentialsChanged = false;
-      let watcher = null;
-      try {
-        const fs30 = await import("fs");
-        watcher = fs30.watch(credentialsPath, () => {
-          credentialsChanged = true;
-        });
-      } catch {
-      }
-      while (running) {
-        await sleep(credentialsChanged ? 0 : 1e4);
-        credentialsChanged = false;
-        if (!running)
-          break;
-        const fresh = await getValidCredentials({ forceRefresh: true });
-        if (fresh) {
-          console.log("Re-authenticated \u2014 resuming listener");
-          break;
+      const fresh = await waitForCredentials(() => running);
+      if (fresh) {
+        console.log("Re-authenticated \u2014 resuming listener");
+        try {
+          await mcpRuntime?.server?.resumeEndpoint();
+        } catch (err) {
+          console.warn("[mcp] resumeEndpoint failed:", err instanceof Error ? err.message : String(err));
         }
       }
-      if (watcher)
-        watcher.close();
       continue;
     }
     pollIntervalMs = minPollInterval;
@@ -11524,7 +12119,7 @@ if (isDirectRun) {
 
 // src/lib/env.ts
 import { homedir as homedir7 } from "os";
-import { join as join42 } from "path";
+import { join as join43 } from "path";
 var IS_STAGING2 = true ? true : false;
 var PRODUCTION = {
   apiUrl: "https://api.repowise.ai",
@@ -11544,7 +12139,7 @@ function getEnvConfig() {
   return IS_STAGING2 ? STAGING : PRODUCTION;
 }
 function getConfigDir2() {
-  return join42(homedir7(), IS_STAGING2 ? ".repowise-staging" : ".repowise");
+  return join43(homedir7(), IS_STAGING2 ? ".repowise-staging" : ".repowise");
 }
 function getPackageName() {
   return true ? "repowisestage" : "repowise";
@@ -11554,12 +12149,12 @@ function getPackageName() {
 import chalk from "chalk";
 
 // src/lib/config.ts
-import { readFile as readFile14, writeFile as writeFile16, mkdir as mkdir17, rename as rename4, unlink as unlink10 } from "fs/promises";
-import { join as join43 } from "path";
-import lockfile5 from "proper-lockfile";
+import { readFile as readFile15, writeFile as writeFile17, mkdir as mkdir17, rename as rename6, unlink as unlink12 } from "fs/promises";
+import { join as join44 } from "path";
+import lockfile6 from "proper-lockfile";
 async function getConfig() {
   try {
-    const data = await readFile14(join43(getConfigDir2(), "config.json"), "utf-8");
+    const data = await readFile15(join44(getConfigDir2(), "config.json"), "utf-8");
     return JSON.parse(data);
   } catch {
     return {};
@@ -11567,15 +12162,15 @@ async function getConfig() {
 }
 async function saveConfig(config2) {
   const dir = getConfigDir2();
-  const path = join43(dir, "config.json");
+  const path = join44(dir, "config.json");
   await mkdir17(dir, { recursive: true });
   const tmpPath = path + ".tmp";
   try {
-    await writeFile16(tmpPath, JSON.stringify(config2, null, 2));
-    await rename4(tmpPath, path);
+    await writeFile17(tmpPath, JSON.stringify(config2, null, 2));
+    await rename6(tmpPath, path);
   } catch (err) {
     try {
-      await unlink10(tmpPath);
+      await unlink12(tmpPath);
     } catch {
     }
     throw err;
@@ -11583,18 +12178,18 @@ async function saveConfig(config2) {
 }
 async function mergeAndSaveConfig(updates) {
   const dir = getConfigDir2();
-  const path = join43(dir, "config.json");
+  const path = join44(dir, "config.json");
   await mkdir17(dir, { recursive: true });
   try {
-    await writeFile16(path, "", { flag: "a" });
+    await writeFile17(path, "", { flag: "a" });
   } catch {
   }
   let release = null;
   try {
-    release = await lockfile5.lock(path, { stale: 1e4, retries: 3, realpath: false });
+    release = await lockfile6.lock(path, { stale: 1e4, retries: 3, realpath: false });
     let raw = {};
     try {
-      raw = JSON.parse(await readFile14(path, "utf-8"));
+      raw = JSON.parse(await readFile15(path, "utf-8"));
     } catch {
     }
     const merged = { ...raw, ...updates };
@@ -11654,18 +12249,33 @@ async function showWelcome(currentVersion) {
 
 // src/commands/create.ts
 import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync3 } from "fs";
-import { dirname as dirname19, join as join49 } from "path";
+import { dirname as dirname19, join as join51 } from "path";
 init_src();
 import chalk8 from "chalk";
 import ora from "ora";
 
 // src/lib/auth.ts
 import { createHash as createHash6, randomBytes as randomBytes3 } from "crypto";
-import { readFile as readFile15, writeFile as writeFile17, mkdir as mkdir18, chmod as chmod4, unlink as unlink11 } from "fs/promises";
+import { readFile as readFile16, writeFile as writeFile18, mkdir as mkdir18, chmod as chmod4, unlink as unlink13, rename as rename7, open as open5 } from "fs/promises";
 import http from "http";
-import { join as join44 } from "path";
+import { join as join45 } from "path";
+import lockfile7 from "proper-lockfile";
+
+// src/lib/http.ts
+async function fetchWithTimeout2(url, init, timeoutMs) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    return await fetch(url, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// src/lib/auth.ts
 var CLI_CALLBACK_PORT = 19876;
 var CALLBACK_TIMEOUT_MS = 12e4;
+var TOKEN_ENDPOINT_TIMEOUT_MS2 = 3e4;
 function getCognitoConfigForStorage() {
   const { domain, clientId, region, customDomain } = getCognitoConfig();
   return { domain, clientId, region, customDomain };
@@ -11806,31 +12416,65 @@ async function exchangeCodeForTokens(code, codeVerifier) {
   };
 }
 async function refreshTokens2(refreshToken) {
-  const response = await fetch(getTokenUrl2(), {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "refresh_token",
-      client_id: getCognitoConfig().clientId,
-      refresh_token: refreshToken
-    })
-  });
+  let response;
+  try {
+    response = await fetchWithTimeout2(
+      getTokenUrl2(),
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          grant_type: "refresh_token",
+          client_id: getCognitoConfig().clientId,
+          refresh_token: refreshToken
+        })
+      },
+      TOKEN_ENDPOINT_TIMEOUT_MS2
+    );
+  } catch (err) {
+    throw new RefreshTokenError(
+      "transient",
+      `Token refresh network error: ${err instanceof Error ? err.message : String(err)}`,
+      null
+    );
+  }
   if (!response.ok) {
-    throw new Error(`Token refresh failed: ${response.status}`);
+    const body = await response.text().catch(() => "");
+    throw new RefreshTokenError(
+      classifyRefreshFailure(response.status, body),
+      `Token refresh failed: ${response.status}`,
+      response.status
+    );
   }
   const data = await response.json();
   return {
     accessToken: data.access_token,
-    refreshToken,
-    // Cognito does not return a new refresh token
+    // Carry forward a rotated refresh token when Cognito returns one (rotation
+    // enabled); otherwise reuse the current token (rotation disabled today).
+    // Persisting the newest token is the hard prerequisite for enabling
+    // refresh-token rotation server-side.
+    refreshToken: data.refresh_token ?? refreshToken,
     idToken: data.id_token,
     expiresAt: Date.now() + data.expires_in * 1e3
   };
 }
+async function revokeRefreshToken(refreshToken) {
+  const { clientId } = getCognitoConfig();
+  if (!clientId || !refreshToken) return;
+  await fetchWithTimeout2(
+    `${getCognitoBaseUrl()}/oauth2/revoke`,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({ token: refreshToken, client_id: clientId })
+    },
+    TOKEN_ENDPOINT_TIMEOUT_MS2
+  );
+}
 async function getStoredCredentials2() {
   try {
-    const credPath = join44(getConfigDir2(), "credentials.json");
-    const data = await readFile15(credPath, "utf-8");
+    const credPath = join45(getConfigDir2(), "credentials.json");
+    const data = await readFile16(credPath, "utf-8");
     return JSON.parse(data);
   } catch (err) {
     if (err.code === "ENOENT" || err instanceof SyntaxError) {
@@ -11841,37 +12485,78 @@ async function getStoredCredentials2() {
 }
 async function storeCredentials2(credentials) {
   const dir = getConfigDir2();
-  const credPath = join44(dir, "credentials.json");
+  const credPath = join45(dir, "credentials.json");
   await mkdir18(dir, { recursive: true, mode: 448 });
-  await writeFile17(credPath, JSON.stringify(credentials, null, 2));
-  await chmod4(credPath, 384);
+  try {
+    await writeFile18(credPath, "", { flag: "a", mode: 384 });
+  } catch {
+  }
+  let release = null;
+  try {
+    release = await lockfile7.lock(credPath, { stale: 1e4, retries: 3, realpath: false });
+    const tmpPath = credPath + ".tmp";
+    try {
+      await writeFile18(tmpPath, JSON.stringify(credentials, null, 2), { mode: 384 });
+      let fh;
+      try {
+        fh = await open5(tmpPath, "r+");
+        await fh.datasync();
+      } finally {
+        await fh?.close();
+      }
+      await rename7(tmpPath, credPath);
+      await chmod4(credPath, 384);
+    } catch (err) {
+      try {
+        await unlink13(tmpPath);
+      } catch {
+      }
+      throw err;
+    }
+  } finally {
+    if (release) {
+      try {
+        await release();
+      } catch {
+      }
+    }
+  }
 }
 async function clearCredentials() {
   try {
-    await unlink11(join44(getConfigDir2(), "credentials.json"));
+    await unlink13(join45(getConfigDir2(), "credentials.json"));
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
   }
 }
+var refreshInFlight2 = null;
 async function getValidCredentials2(opts) {
   const creds = await getStoredCredentials2();
   if (!creds) return null;
   const needsRefresh = opts?.forceRefresh || Date.now() > creds.expiresAt - 5 * 60 * 1e3;
-  if (needsRefresh) {
-    try {
-      const refreshed = await refreshTokens2(creds.refreshToken);
-      refreshed.cognito = creds.cognito;
-      await storeCredentials2(refreshed);
-      return refreshed;
-    } catch {
-      if (Date.now() < creds.expiresAt) {
-        return creds;
-      }
+  if (!needsRefresh) return creds;
+  if (!refreshInFlight2) {
+    refreshInFlight2 = doRefresh2(creds).finally(() => {
+      refreshInFlight2 = null;
+    });
+  }
+  return refreshInFlight2;
+}
+async function doRefresh2(creds) {
+  try {
+    const refreshed = await refreshTokens2(creds.refreshToken);
+    refreshed.cognito = creds.cognito;
+    await storeCredentials2(refreshed);
+    return refreshed;
+  } catch (err) {
+    const kind = err instanceof RefreshTokenError ? err.kind : "transient";
+    if (kind === "terminal") {
       await clearCredentials();
       return null;
     }
+    if (Date.now() < creds.expiresAt) return creds;
+    return null;
   }
-  return creds;
 }
 async function performLogin() {
   const codeVerifier = generateCodeVerifier();
@@ -11880,8 +12565,8 @@ async function performLogin() {
   const authorizeUrl = getAuthorizeUrl(codeChallenge, state);
   const callbackPromise = startCallbackServer();
   try {
-    const open4 = (await import("open")).default;
-    await open4(authorizeUrl);
+    const open6 = (await import("open")).default;
+    await open6(authorizeUrl);
   } catch {
     console.log(`
 Open this URL in your browser to authenticate:
@@ -11979,7 +12664,6 @@ async function apiRequest(path, options) {
       });
     }
     if (!refreshed || response.status === 401) {
-      await clearCredentials();
       throw new Error("Session expired. Run `repowise login` again.");
     }
   }
@@ -12013,25 +12697,26 @@ async function apiRequest(path, options) {
 // src/lib/prompts.ts
 import { checkbox, confirm, Separator } from "@inquirer/prompts";
 import chalk2 from "chalk";
-async function selectAiTools() {
+async function selectAiTools(opts) {
+  const checkedSet = new Set(opts?.defaults ?? []);
   const choices = [
     new Separator(chalk2.dim("\u2500\u2500 Popular \u2500\u2500")),
-    { name: "Cursor", value: "cursor" },
-    { name: "Claude Code", value: "claude-code" },
-    { name: "GitHub Copilot", value: "copilot" },
-    { name: "Windsurf", value: "windsurf" },
+    { name: "Cursor", value: "cursor", checked: checkedSet.has("cursor") },
+    { name: "Claude Code", value: "claude-code", checked: checkedSet.has("claude-code") },
+    { name: "GitHub Copilot", value: "copilot", checked: checkedSet.has("copilot") },
+    { name: "Windsurf", value: "windsurf", checked: checkedSet.has("windsurf") },
     new Separator(chalk2.dim("\u2500\u2500 More Tools \u2500\u2500")),
-    { name: "Cline", value: "cline" },
-    { name: "Codex", value: "codex" },
+    { name: "Cline", value: "cline", checked: checkedSet.has("cline") },
+    { name: "Codex", value: "codex", checked: checkedSet.has("codex") },
     // Roo Code shut down 2026-05-15; Kilo Code is the community successor.
-    { name: "Kilo Code", value: "kilo" },
-    { name: "Gemini CLI", value: "gemini" },
+    { name: "Kilo Code", value: "kilo", checked: checkedSet.has("kilo") },
+    { name: "Gemini CLI", value: "gemini", checked: checkedSet.has("gemini") },
     new Separator(chalk2.dim("\u2500\u2500 Cloud Agents \u2500\u2500")),
-    { name: "Warp", value: "warp" },
-    { name: "JetBrains Junie", value: "junie" },
-    { name: "Google Jules", value: "jules" },
-    { name: "Amp", value: "amp" },
-    { name: "Devin", value: "devin" },
+    { name: "Warp", value: "warp", checked: checkedSet.has("warp") },
+    { name: "JetBrains Junie", value: "junie", checked: checkedSet.has("junie") },
+    { name: "Google Jules", value: "jules", checked: checkedSet.has("jules") },
+    { name: "Amp", value: "amp", checked: checkedSet.has("amp") },
+    { name: "Devin", value: "devin", checked: checkedSet.has("devin") },
     new Separator(chalk2.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500")),
     { name: "Other (manual setup)", value: "other" }
   ];
@@ -12054,11 +12739,126 @@ async function selectAiTools() {
   }
 }
 
+// src/lib/setup-tools.ts
+async function writeToolConfigsForRepo(opts) {
+  const { repoRoot, tools, repoName, contextFolder, contextFiles, variant, migrateLegacy } = opts;
+  const results = [];
+  const written = /* @__PURE__ */ new Set();
+  for (const tool of tools) {
+    const config2 = AI_TOOL_CONFIG[tool];
+    if (written.has(config2.filePath)) continue;
+    written.add(config2.filePath);
+    if (migrateLegacy && config2.legacyFilePath) {
+      await migrateToolConfig(repoRoot, tool, repoName, contextFolder, contextFiles, variant);
+    }
+    const { created } = await updateToolConfig(
+      repoRoot,
+      tool,
+      repoName,
+      contextFolder,
+      contextFiles,
+      variant
+    );
+    results.push(`${created ? "Created" : "Updated"} ${config2.filePath}`);
+  }
+  if (!written.has("AGENTS.md")) {
+    const { created } = await updateToolConfig(
+      repoRoot,
+      "codex",
+      repoName,
+      contextFolder,
+      contextFiles,
+      variant
+    );
+    results.push(`${created ? "Created" : "Updated"} AGENTS.md`);
+  }
+  if (tools.includes("claude-code")) {
+    const { relPath } = await writeClaudeHooksToRepo(repoRoot, contextFolder, variant);
+    results.push(`Configured ${relPath} (RepoWise-first + SubagentStart hooks, local-only)`);
+  }
+  return results;
+}
+
+// src/lib/mcp-resolver.ts
+import { basename as basename4, join as join46 } from "path";
+import { promises as fs21 } from "fs";
+var MCP_WRITER_TOOLS = /* @__PURE__ */ new Set([
+  "claude-code",
+  "cursor",
+  "copilot",
+  "codex",
+  "windsurf",
+  "cline",
+  "gemini"
+]);
+function mcpPathFor(tool, repoRoot, home) {
+  switch (tool) {
+    case "claude-code":
+      return { path: join46(repoRoot, ".mcp.json"), scope: "repo" };
+    case "cursor":
+      return { path: join46(repoRoot, ".cursor", "mcp.json"), scope: "repo" };
+    case "copilot":
+      return { path: join46(repoRoot, ".vscode", "mcp.json"), scope: "repo" };
+    case "codex":
+      return { path: join46(home, ".codex", "mcp.json"), scope: "global" };
+    case "windsurf":
+      return { path: join46(home, ".codeium", "windsurf", "mcp_config.json"), scope: "global" };
+    case "cline":
+      return { path: join46(home, ".cline", "mcp.json"), scope: "global" };
+    case "gemini":
+      return { path: join46(home, ".gemini", "settings.json"), scope: "global" };
+    default:
+      return null;
+  }
+}
+function mcpServerKeyFor(repoRoot) {
+  return `RepoWise MCP for ${basename4(repoRoot)}`;
+}
+function mcpConfigTargetForTool(tool, opts) {
+  const loc = mcpPathFor(tool, opts.repoRoot, opts.home);
+  if (!loc) return null;
+  return { tool, path: loc.path, scope: loc.scope, serverKey: mcpServerKeyFor(opts.repoRoot) };
+}
+async function mcpConfigState(target) {
+  let raw;
+  try {
+    raw = await fs21.readFile(target.path, "utf-8");
+  } catch {
+    return "absent";
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    return parsed.mcpServers && target.serverKey in parsed.mcpServers ? "configured" : "pending";
+  } catch {
+    return "absent";
+  }
+}
+function mcpActivationHint(tool, repoName) {
+  if (!MCP_WRITER_TOOLS.has(tool)) return null;
+  if (tool === "claude-code") {
+    return `In Claude Code, run \`/mcp\` and approve the "RepoWise MCP for ${repoName}" server.`;
+  }
+  return `Reload your AI tool and approve the "RepoWise MCP for ${repoName}" server when prompted.`;
+}
+async function mcpStatusForRepo(opts) {
+  const repoName = basename4(opts.repoRoot);
+  const out = [];
+  for (const tool of opts.aiTools) {
+    const target = mcpConfigTargetForTool(tool, { repoRoot: opts.repoRoot, home: opts.home });
+    if (!target) continue;
+    const state = await mcpConfigState(target);
+    if (state === "absent") continue;
+    const configured = state === "configured";
+    out.push({ tool, configured, hint: configured ? null : mcpActivationHint(tool, repoName) });
+  }
+  return out;
+}
+
 // src/lib/gitignore.ts
 import { readFileSync as readFileSync2, writeFileSync, existsSync as existsSync2 } from "fs";
-import { join as join45 } from "path";
+import { join as join47 } from "path";
 function ensureGitignore(repoRoot, entry) {
-  const gitignorePath = join45(repoRoot, ".gitignore");
+  const gitignorePath = join47(repoRoot, ".gitignore");
   if (existsSync2(gitignorePath)) {
     const content = readFileSync2(gitignorePath, "utf-8");
     const lines = content.split("\n").map((l) => l.trim());
@@ -12075,7 +12875,7 @@ function ensureGitignore(repoRoot, entry) {
 // src/lib/graph-cache.ts
 init_config_dir();
 import { mkdirSync, writeFileSync as writeFileSync2, renameSync, unlinkSync } from "fs";
-import { dirname as dirname18, join as join46 } from "path";
+import { dirname as dirname18, join as join48 } from "path";
 var SAFE_REPO_ID = /^[A-Za-z0-9_.-]{1,128}$/;
 function assertSafeRepoId2(repoId) {
   if (!repoId || typeof repoId !== "string" || !SAFE_REPO_ID.test(repoId) || repoId === "." || repoId === ".." || repoId.startsWith(".")) {
@@ -12084,7 +12884,7 @@ function assertSafeRepoId2(repoId) {
 }
 function graphCachePath(repoId) {
   assertSafeRepoId2(repoId);
-  return join46(getConfigDir(), "graphs", `${repoId}.json`);
+  return join48(getConfigDir(), "graphs", `${repoId}.json`);
 }
 function isUsableGraph(parsed) {
   if (typeof parsed !== "object" || parsed === null) return false;
@@ -12513,19 +13313,17 @@ var ProgressRenderer = class {
     });
   }
   /**
-   * Coffee-and-context message shown once, after the user-driven interview
-   * completes. This is the gate between user input and the long
-   * machine-driven scan/generate/validate phases.
+   * Latch marking the end of the user-driven interview and the start of the
+   * long machine-driven scan/generate/validate phases. The post-interview
+   * "coffee" line now rides with the paid "RepoWise MCP is live" message
+   * (create.ts), emitted once the knowledge graph is actually downloadable \u2014
+   * so it no longer fires here. The stop/start keeps the spinner cadence
+   * stable across the interview\u2192scan handoff.
    */
   renderInterviewComplete(spinner) {
     if (this.interviewCompleteShown) return;
     this.interviewCompleteShown = true;
     spinner.stop();
-    console.log("");
-    console.log(
-      chalk4.cyan("  \u2615 Sit back and grab a coffee \u2014 we'll handle the rest from here.")
-    );
-    console.log("");
     spinner.start();
   }
   renderScanProgress(progress, spinner) {
@@ -12700,17 +13498,27 @@ var ProgressRenderer = class {
         if (generating) {
           const genBaseName = generating.fileName.split("/").pop() ?? generating.fileName;
           const isCore = CORE_FILES.has(genBaseName);
-          const sectionFiles = gp.fileStatuses.filter((f) => {
+          const sectionFiles2 = gp.fileStatuses.filter((f) => {
             const bn = f.fileName.split("/").pop() ?? f.fileName;
             return isCore ? CORE_FILES.has(bn) : !CORE_FILES.has(bn);
           });
-          const sectionCompleted = sectionFiles.filter((f) => f.status === "completed").length;
-          return `${generating.fileName} (${sectionCompleted}/${sectionFiles.length}) ${chalk4.dim(`(${overallPct}%)`)}`;
+          const sectionCompleted = sectionFiles2.filter((f) => f.status === "completed").length;
+          return `${generating.fileName} (${sectionCompleted}/${sectionFiles2.length}) ${chalk4.dim(`(${overallPct}%)`)}`;
         }
         const allDone = gp.fileStatuses.every((f) => f.status === "completed");
         if (allDone) {
           return `${stepLabel}... ${chalk4.dim(`(${overallPct}%)`)}`;
         }
+        const baseNameOf = (f) => f.fileName.split("/").pop() ?? f.fileName;
+        const coreFiles = gp.fileStatuses.filter((f) => CORE_FILES.has(baseNameOf(f)));
+        const optionalFiles = gp.fileStatuses.filter((f) => !CORE_FILES.has(baseNameOf(f)));
+        const coreDone = coreFiles.length > 0 && coreFiles.every((f) => f.status === "completed");
+        const sectionFiles = coreDone && optionalFiles.length > 0 ? optionalFiles : coreFiles;
+        if (sectionFiles.length > 0) {
+          const sectionCompleted = sectionFiles.filter((f) => f.status === "completed").length;
+          const name = gp.currentFileName || stepLabel;
+          return `${name} (${sectionCompleted}/${sectionFiles.length}) ${chalk4.dim(`(${overallPct}%)`)}`;
+        }
       }
     }
     return `${stepLabel}... ${chalk4.dim(`(${overallPct}%)`)}`;
@@ -12801,8 +13609,8 @@ async function promptDepInstallConsent(missing, opts) {
 import chalk6 from "chalk";
 
 // src/lib/dep-installer.ts
-import { promises as fs21 } from "fs";
-import { join as join47 } from "path";
+import { promises as fs22 } from "fs";
+import { join as join49 } from "path";
 var SUPPORTED_DEP_LANGUAGES = /* @__PURE__ */ new Set([
   "typescript",
   "javascript",
@@ -12812,14 +13620,14 @@ var SUPPORTED_DEP_LANGUAGES = /* @__PURE__ */ new Set([
 ]);
 var exists = async (p) => {
   try {
-    await fs21.access(p);
+    await fs22.access(p);
     return true;
   } catch {
     return false;
   }
 };
 async function fileExists16(repoRoot, name) {
-  return exists(join47(repoRoot, name));
+  return exists(join49(repoRoot, name));
 }
 async function detectNodePackageManager(repoRoot) {
   if (await fileExists16(repoRoot, "pnpm-lock.yaml")) {
@@ -12896,13 +13704,13 @@ async function detectMissingDeps(repoRoot, scopedLanguages) {
 // src/lib/dep-installer-runner.ts
 import { spawn as spawn11 } from "child_process";
 import { createWriteStream as createWriteStream3 } from "fs";
-import { promises as fs22 } from "fs";
-import { join as join48 } from "path";
+import { promises as fs23 } from "fs";
+import { join as join50 } from "path";
 var DEFAULT_INSTALL_TIMEOUT_MS = 10 * 60 * 1e3;
 async function runMissingDepInstalls(opts) {
   const safeRepoId = opts.repoId.replace(/[^a-zA-Z0-9_-]/g, "_");
-  const logPath2 = join48(getConfigDir2(), `install-log.${safeRepoId}.txt`);
-  await fs22.mkdir(getConfigDir2(), { recursive: true });
+  const logPath2 = join50(getConfigDir2(), `install-log.${safeRepoId}.txt`);
+  await fs23.mkdir(getConfigDir2(), { recursive: true });
   const stream = opts.logStream ?? createWriteStream3(logPath2, { flags: "a" });
   stream.on("error", () => {
   });
@@ -12948,7 +13756,7 @@ async function runOne2(dep, repoRoot, stream, timeoutMs) {
 }
 async function runPipFlow(repoRoot, stream, timeoutMs) {
   await runSimple(["python3", "-m", "venv", ".venv"], repoRoot, stream, timeoutMs);
-  const venvPip = process.platform === "win32" ? join48(".venv", "Scripts", "pip.exe") : join48(".venv", "bin", "pip");
+  const venvPip = process.platform === "win32" ? join50(".venv", "Scripts", "pip.exe") : join50(".venv", "bin", "pip");
   await runSimple([venvPip, "install", "-r", "requirements.txt"], repoRoot, stream, timeoutMs);
 }
 function runSimple(cmd, repoRoot, stream, timeoutMs) {
@@ -13107,13 +13915,15 @@ function reportLspInstallOutcomes(results) {
 // src/commands/create.ts
 function formatElapsed(ms) {
   const totalSeconds = Math.round(ms / 1e3);
-  const minutes = Math.floor(totalSeconds / 60);
+  const hours = Math.floor(totalSeconds / 3600);
+  const minutes = Math.floor(totalSeconds % 3600 / 60);
   const seconds = totalSeconds % 60;
+  if (hours > 0) return minutes > 0 ? `${hours}h ${minutes}m` : `${hours}h`;
   if (minutes === 0) return `${seconds}s`;
   return seconds > 0 ? `${minutes}m ${seconds}s` : `${minutes}m`;
 }
 var POLL_INTERVAL_MS = 3e3;
-var MAX_POLL_ATTEMPTS = 7200;
+var MAX_POLL_ATTEMPTS = 14600;
 var DEFAULT_CONTEXT_FOLDER = "repowise-context";
 function buildWatchedRepoEntry(args) {
   const entry = {
@@ -13286,9 +14096,7 @@ async function create() {
     }
     if (tools.length === 0 && !hasOther) {
       console.log(
-        chalk8.yellow(
-          "\nNo AI tools selected. You can configure them later with `repowise config`."
-        )
+        chalk8.yellow("\nNo AI tools selected. You can set them up later with `repowise tools`.")
       );
     }
     if (repoRoot) {
@@ -13358,6 +14166,8 @@ async function create() {
     }
     let pollAttempts = 0;
     let pollErrors = 0;
+    let graphEarlyWriteDone = false;
+    let nonAwaitingPolls = 0;
     const MAX_POLL_ERRORS = 5;
     const progressRenderer = new ProgressRenderer();
     let depInstallShown = false;
@@ -13428,8 +14238,17 @@ async function create() {
         if (!interviewComplete && graphOnly) {
           interviewComplete = true;
           progressRenderer.setInterviewComplete(spinner);
+          spinner.stop();
+          console.log(
+            chalk8.cyan(
+              "  \u2615 Building your code graph \u2014 MCP will be live in a moment (Free plan: graph + MCP)."
+            )
+          );
+          spinner.start();
         }
         progressRenderer.update(syncResult, spinner);
+        if (syncResult.status === "awaiting_input") nonAwaitingPolls = 0;
+        else nonAwaitingPolls += 1;
         if (!graphOnly && syncResult.status === "in_progress") {
           if (syncResult.lspWaitState === "awaiting" || syncResult.lspWaitState === "analyzing") {
             lspWaitStartedAt ??= Date.now();
@@ -13443,6 +14262,45 @@ async function create() {
             spinner.start();
           }
         }
+        const interviewPhaseOver = interviewComplete || nonAwaitingPolls >= 3;
+        if (!graphOnly && !graphEarlyWriteDone && syncResult.graphReady === true && syncResult.status !== "awaiting_input" && interviewPhaseOver && repoRoot) {
+          const earlyCreds = await getValidCredentials2();
+          if (earlyCreds) {
+            graphEarlyWriteDone = true;
+            if (!interviewComplete) {
+              interviewComplete = true;
+              progressRenderer.setInterviewComplete(spinner);
+            }
+            spinner.stop();
+            await ensureGraphDownloaded({
+              repoId,
+              accessToken: earlyCreds.accessToken,
+              apiUrl: getEnvConfig().apiUrl
+            });
+            await writeToolConfigsForRepo({
+              repoRoot,
+              tools,
+              repoName,
+              contextFolder: DEFAULT_CONTEXT_FOLDER,
+              contextFiles: [],
+              variant: "graph",
+              migrateLegacy: true
+            });
+            if (!sigintBusy) {
+              console.log("");
+              console.log(
+                chalk8.green("  \u2714 RepoWise MCP is live \u2014 start exploring your codebase now.")
+              );
+              console.log(
+                chalk8.cyan(
+                  "  \u2615 Full docs are still generating in the background \u2014 your AI tools auto-upgrade when they're ready (graph precision keeps improving too)."
+                )
+              );
+              console.log("");
+              spinner.start();
+            }
+          }
+        }
         if (syncResult.status === "awaiting_input") {
           seenAwaitingInput = true;
         }
@@ -13521,7 +14379,7 @@ async function create() {
         const listResult = await apiRequest(`/v1/repos/${repoId}/context`);
         const files = listResult.data?.files ?? listResult.files ?? [];
         if (files.length > 0) {
-          const contextDir = join49(repoRoot, DEFAULT_CONTEXT_FOLDER);
+          const contextDir = join51(repoRoot, DEFAULT_CONTEXT_FOLDER);
           mkdirSync2(contextDir, { recursive: true });
           let downloadedCount = 0;
           let failedCount = 0;
@@ -13535,7 +14393,7 @@ async function create() {
             const response = await fetch(presignedUrl);
             if (response.ok) {
               const content = await response.text();
-              const filePath = join49(contextDir, file.fileName);
+              const filePath = join51(contextDir, file.fileName);
               mkdirSync2(dirname19(filePath), { recursive: true });
               writeFileSync3(filePath, content, "utf-8");
               downloadedCount++;
@@ -13619,51 +14477,24 @@ Files are stored on our servers (not in git). Retry when online.`
     }
     if (repoRoot) {
       spinner.start("Configuring AI tools...");
-      const results = [];
-      const written = /* @__PURE__ */ new Set();
-      const toolVariant = graphOnly ? "graph" : "full";
-      for (const tool of tools) {
-        const config2 = AI_TOOL_CONFIG[tool];
-        if (written.has(config2.filePath)) continue;
-        written.add(config2.filePath);
-        if (config2.legacyFilePath) {
-          await migrateToolConfig(
-            repoRoot,
-            tool,
-            repoName,
-            contextFolder,
-            contextFiles,
-            toolVariant
-          );
-        }
-        const { created: wasCreated } = await updateToolConfig(
-          repoRoot,
-          tool,
-          repoName,
-          contextFolder,
-          contextFiles,
-          toolVariant
-        );
-        const action = wasCreated ? "Created" : "Updated";
-        results.push(`  ${action} ${config2.filePath}`);
-      }
-      if (!written.has("AGENTS.md")) {
-        const { created: wasCreated } = await updateToolConfig(
-          repoRoot,
-          "codex",
-          repoName,
-          contextFolder,
-          contextFiles,
-          toolVariant
+      const results = await writeToolConfigsForRepo({
+        repoRoot,
+        tools,
+        repoName,
+        contextFolder,
+        contextFiles,
+        variant: graphOnly ? "graph" : "full",
+        migrateLegacy: true
+      });
+      spinner.succeed("AI tools configured");
+      console.log(chalk8.dim(results.map((r) => `  ${r}`).join("\n")));
+      if (!graphOnly && contextFiles.length > 0) {
+        console.log(
+          chalk8.cyan(
+            "  \u2728 Full context docs are ready \u2014 start a new AI session (or restart your AI tool) to pick up the upgraded instructions."
+          )
         );
-        results.push(`  ${wasCreated ? "Created" : "Updated"} AGENTS.md`);
-      }
-      if (tools.includes("claude-code")) {
-        const { relPath } = await writeClaudeHooksToRepo(repoRoot, contextFolder, toolVariant);
-        results.push(`  Configured ${relPath} (RepoWise-first + SubagentStart hooks, local-only)`);
       }
-      spinner.succeed("AI tools configured");
-      console.log(chalk8.dim(results.join("\n")));
     }
     const priorAutoInstall = await getPriorConsent(repoId);
     const updatedRepos = [];
@@ -13772,6 +14603,11 @@ Files are stored on our servers (not in git). Retry when online.`
     console.log(
       `    ${chalk8.cyan("\u2022")} Open Claude Code / Cursor and ask: "What does this repo do?"`
     );
+    if (tools.some((t) => MCP_WRITER_TOOLS.has(t))) {
+      console.log(
+        `    ${chalk8.cyan("\u2022")} If your AI tool asks to approve the "RepoWise MCP" server, approve it (in Claude Code, run ${chalk8.cyan("/mcp")}) \u2014 it can take a minute to appear.`
+      );
+    }
     console.log(
       `    ${chalk8.cyan("\u2022")} Head to the dashboard \u2192 "Complete Onboarding" to explore quality scores and gaps.`
     );
@@ -13786,7 +14622,7 @@ Files are stored on our servers (not in git). Retry when online.`
 
 // src/commands/member.ts
 import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname20, join as join50, resolve, sep } from "path";
+import { dirname as dirname20, join as join52, resolve, sep } from "path";
 import chalk9 from "chalk";
 import ora2 from "ora";
 var DEFAULT_CONTEXT_FOLDER2 = "repowise-context";
@@ -13940,7 +14776,7 @@ async function member() {
     spinner.succeed(`Found ${chalk9.bold(files.length)} context files on server`);
     const { tools } = await selectAiTools();
     spinner.start("Downloading context files...");
-    const contextDir = join50(repoRoot, DEFAULT_CONTEXT_FOLDER2);
+    const contextDir = join52(repoRoot, DEFAULT_CONTEXT_FOLDER2);
     mkdirSync3(contextDir, { recursive: true });
     let downloadedCount = 0;
     let failedCount = 0;
@@ -13985,35 +14821,14 @@ async function member() {
     {
       spinner.start("Configuring AI tools...");
       const contextFiles = await scanLocalContextFiles(repoRoot, DEFAULT_CONTEXT_FOLDER2);
-      const configured = [];
-      const written = /* @__PURE__ */ new Set();
-      for (const tool of tools) {
-        const config2 = AI_TOOL_CONFIG[tool];
-        if (written.has(config2.filePath)) continue;
-        written.add(config2.filePath);
-        const { created } = await updateToolConfig(
-          repoRoot,
-          tool,
-          repoName,
-          DEFAULT_CONTEXT_FOLDER2,
-          contextFiles
-        );
-        configured.push(`${created ? "Created" : "Updated"} ${config2.filePath}`);
-      }
-      if (!written.has("AGENTS.md")) {
-        const { created } = await updateToolConfig(
-          repoRoot,
-          "codex",
-          repoName,
-          DEFAULT_CONTEXT_FOLDER2,
-          contextFiles
-        );
-        configured.push(`${created ? "Created" : "Updated"} AGENTS.md`);
-      }
-      if (tools.includes("claude-code")) {
-        const { relPath } = await writeClaudeHooksToRepo(repoRoot, DEFAULT_CONTEXT_FOLDER2);
-        configured.push(`Configured ${relPath} (RepoWise-first + SubagentStart hooks, local-only)`);
-      }
+      const configured = await writeToolConfigsForRepo({
+        repoRoot,
+        tools,
+        repoName,
+        contextFolder: DEFAULT_CONTEXT_FOLDER2,
+        contextFiles
+        // member historically passed no variant and did not migrate legacy paths.
+      });
       spinner.succeed("AI tools configured");
       for (const msg of configured) {
         console.log(chalk9.dim(`  ${msg}`));
@@ -14134,19 +14949,20 @@ async function member() {
 }
 
 // src/commands/login.ts
+import { homedir as homedir9 } from "os";
 import chalk10 from "chalk";
 import ora3 from "ora";
 
 // src/lib/tenant-graph-purge.ts
-import { promises as fs23 } from "fs";
+import { promises as fs24 } from "fs";
 import { homedir as homedir8 } from "os";
-import { join as join51 } from "path";
+import { join as join53 } from "path";
 async function purgeForeignGraphs(validRepoIds, home = homedir8()) {
-  const graphsDir = join51(home, ".repowise", "graphs");
+  const graphsDir = join53(home, ".repowise", "graphs");
   const result = { kept: [], removed: [] };
   let entries;
   try {
-    entries = await fs23.readdir(graphsDir);
+    entries = await fs24.readdir(graphsDir);
   } catch (err) {
     if (err.code === "ENOENT") return result;
     throw err;
@@ -14160,15 +14976,15 @@ async function purgeForeignGraphs(validRepoIds, home = homedir8()) {
       result.kept.push(entry);
       continue;
     }
-    const path = join51(graphsDir, entry);
+    const path = join53(graphsDir, entry);
     try {
-      const stat8 = await fs23.lstat(path);
+      const stat8 = await fs24.lstat(path);
       if (stat8.isSymbolicLink()) {
-        await fs23.unlink(path);
+        await fs24.unlink(path);
         result.removed.push(entry);
         continue;
       }
-      await fs23.rm(path, { recursive: true, force: true });
+      await fs24.rm(path, { recursive: true, force: true });
       result.removed.push(entry);
     } catch {
     }
@@ -14196,8 +15012,8 @@ Waiting for authentication...`);
     } else {
       spinner.text = "Opening browser for authentication...";
       try {
-        const open4 = (await import("open")).default;
-        await open4(authorizeUrl);
+        const open6 = (await import("open")).default;
+        await open6(authorizeUrl);
         spinner.text = "Waiting for authentication in browser...";
       } catch {
         spinner.stop();
@@ -14232,6 +15048,23 @@ Waiting for authentication...`);
       }
     } catch {
     }
+    try {
+      const repoRoot = detectRepoRoot();
+      const cfg = await getConfig();
+      const registered = (cfg.repos ?? []).some((r) => r.localPath === repoRoot);
+      const tools = cfg.aiTools ?? [];
+      if (registered && tools.length > 0) {
+        const pending = (await mcpStatusForRepo({ repoRoot, home: homedir9(), aiTools: tools })).filter((s) => !s.configured);
+        if (pending.length > 0) {
+          console.log("");
+          console.log(chalk10.dim("  To finish enabling RepoWise in your AI tools:"));
+          for (const p of pending) {
+            if (p.hint) console.log(chalk10.dim(`    \u2022 ${p.hint}`));
+          }
+        }
+      }
+    } catch {
+    }
   } catch (err) {
     const message = err instanceof Error ? err.message : "Login failed";
     spinner.fail(chalk10.red(message));
@@ -14247,20 +15080,25 @@ async function logout() {
     console.log(chalk11.yellow("Not logged in."));
     return;
   }
+  try {
+    await revokeRefreshToken(creds.refreshToken);
+  } catch {
+  }
   await clearCredentials();
   console.log(chalk11.green("Logged out successfully."));
 }
 
 // src/commands/status.ts
-import { readFile as readFile16 } from "fs/promises";
-import { basename as basename4, join as join52 } from "path";
+import { readFile as readFile17 } from "fs/promises";
+import { basename as basename5, join as join54 } from "path";
+import { homedir as homedir10 } from "os";
 async function status() {
   const configDir = getConfigDir2();
-  const STATE_PATH = join52(configDir, "listener-state.json");
-  const CONFIG_PATH = join52(configDir, "config.json");
+  const STATE_PATH = join54(configDir, "listener-state.json");
+  const CONFIG_PATH = join54(configDir, "config.json");
   let state = null;
   try {
-    const data = await readFile16(STATE_PATH, "utf-8");
+    const data = await readFile17(STATE_PATH, "utf-8");
     state = JSON.parse(data);
   } catch {
   }
@@ -14279,42 +15117,85 @@ async function status() {
   } else {
     console.log("Auto-start: disabled");
   }
+  let creds = null;
+  try {
+    creds = await getStoredCredentials2();
+  } catch {
+  }
+  if (isCredsHardExpired(creds)) {
+    console.log("Authentication: not logged in \u2014 run `repowise login`");
+  } else {
+    let email = null;
+    try {
+      const decoded = creds?.idToken ? decodeIdToken(creds.idToken).email : null;
+      email = decoded && decoded !== "unknown" ? decoded : null;
+    } catch {
+    }
+    console.log(`Authentication: logged in${email ? ` as ${email}` : ""}`);
+  }
   console.log("");
   if (!state || Object.keys(state.repos).length === 0) {
     console.log("No sync history. Run `repowise listen` to start syncing.");
     return;
   }
   const repoNames = /* @__PURE__ */ new Map();
+  const repoPaths = /* @__PURE__ */ new Map();
+  let aiTools = [];
   try {
-    const configData = await readFile16(CONFIG_PATH, "utf-8");
+    const configData = await readFile17(CONFIG_PATH, "utf-8");
     const config2 = JSON.parse(configData);
     for (const repo of config2.repos ?? []) {
-      repoNames.set(repo.repoId, basename4(repo.localPath));
+      repoNames.set(repo.repoId, basename5(repo.localPath));
+      repoPaths.set(repo.repoId, repo.localPath);
     }
+    aiTools = config2.aiTools ?? [];
   } catch {
   }
   console.log("Watched Repos:");
+  const home = homedir10();
   for (const [repoId, repoState] of Object.entries(state.repos)) {
     const name = repoNames.get(repoId);
     const label = name ? `${name} (${repoId.slice(0, 8)})` : repoId;
     const syncTime = repoState.lastSyncTimestamp ? new Date(repoState.lastSyncTimestamp).toLocaleString() : "never";
     const commit = repoState.lastSyncCommitSha ? repoState.lastSyncCommitSha.slice(0, 7) : "none";
     console.log(`  ${label}: last sync ${syncTime} (commit: ${commit})`);
+    const localPath = repoPaths.get(repoId);
+    if (localPath && aiTools.length > 0) {
+      try {
+        const statuses = await mcpStatusForRepo({ repoRoot: localPath, home, aiTools });
+        if (statuses.length > 0) {
+          const pending = statuses.filter((s) => !s.configured);
+          if (pending.length === 0) {
+            console.log(`    MCP: active in all ${statuses.length} tool(s)`);
+          } else {
+            console.log(
+              `    MCP: ${statuses.length - pending.length}/${statuses.length} tool(s) active \u2014 to finish:`
+            );
+            for (const p of pending) {
+              if (p.hint) console.log(`      \u2022 ${p.hint}`);
+            }
+          }
+        }
+      } catch {
+      }
+    }
   }
 }
 
 // src/commands/sync.ts
 import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname21, join as join53 } from "path";
+import { dirname as dirname21, join as join55 } from "path";
 import chalk12 from "chalk";
 import ora4 from "ora";
 var POLL_INTERVAL_MS2 = 3e3;
-var MAX_POLL_ATTEMPTS2 = 7200;
+var MAX_POLL_ATTEMPTS2 = 14600;
 var DEFAULT_CONTEXT_FOLDER3 = "repowise-context";
 function formatElapsed3(ms) {
   const totalSeconds = Math.round(ms / 1e3);
-  const minutes = Math.floor(totalSeconds / 60);
+  const hours = Math.floor(totalSeconds / 3600);
+  const minutes = Math.floor(totalSeconds % 3600 / 60);
   const seconds = totalSeconds % 60;
+  if (hours > 0) return minutes > 0 ? `${hours}h ${minutes}m` : `${hours}h`;
   if (minutes === 0) return `${seconds}s`;
   return seconds > 0 ? `${minutes}m ${seconds}s` : `${minutes}m`;
 }
@@ -14454,7 +15335,7 @@ async function sync() {
       const listResult = await apiRequest(`/v1/repos/${repoId}/context`);
       const files = listResult.data?.files ?? listResult.files ?? [];
       if (files.length > 0) {
-        const contextDir = join53(repoRoot, DEFAULT_CONTEXT_FOLDER3);
+        const contextDir = join55(repoRoot, DEFAULT_CONTEXT_FOLDER3);
         mkdirSync4(contextDir, { recursive: true });
         let downloadedCount = 0;
         let failedCount = 0;
@@ -14468,7 +15349,7 @@ async function sync() {
           const response = await fetch(presignedUrl);
           if (response.ok) {
             const content = await response.text();
-            const filePath = join53(contextDir, file.fileName);
+            const filePath = join55(contextDir, file.fileName);
             mkdirSync4(dirname21(filePath), { recursive: true });
             writeFileSync5(filePath, content, "utf-8");
             downloadedCount++;
@@ -14721,10 +15602,158 @@ async function config() {
   }
 }
 
+// src/commands/tools.ts
+import { basename as basename6 } from "path";
+import chalk14 from "chalk";
+import ora6 from "ora";
+var DEFAULT_CONTEXT_FOLDER4 = "repowise-context";
+var VALID_TOOLS = Object.keys(AI_TOOL_CONFIG);
+async function resolveRepoOrExit() {
+  let creds = null;
+  try {
+    creds = await getValidCredentials2();
+  } catch {
+    creds = null;
+  }
+  if (!creds) {
+    console.error(chalk14.red("Not logged in. Run `repowise login` first."));
+    process.exitCode = 1;
+    return null;
+  }
+  let repoRoot;
+  try {
+    repoRoot = detectRepoRoot();
+  } catch {
+    console.error(chalk14.red("Not inside a git repository \u2014 `cd` into your repo first."));
+    process.exitCode = 1;
+    return null;
+  }
+  const config2 = await getConfig();
+  const registered = (config2.repos ?? []).some((r) => r.localPath === repoRoot);
+  if (!registered) {
+    console.error(
+      chalk14.red("This repo isn't set up with RepoWise yet. Run `repowise create` first.")
+    );
+    process.exitCode = 1;
+    return null;
+  }
+  return {
+    repoRoot,
+    repoName: detectRepoName(repoRoot),
+    current: config2.aiTools ?? [],
+    contextFolder: config2.contextFolder ?? DEFAULT_CONTEXT_FOLDER4,
+    variant: config2.graphOnly ? "graph" : "full"
+  };
+}
+async function applyToolSelection(ctx, next) {
+  const added = next.filter((t) => !ctx.current.includes(t));
+  const spinner = ora6("Configuring AI tools...").start();
+  const contextFiles = await scanLocalContextFiles(ctx.repoRoot, ctx.contextFolder);
+  const results = await writeToolConfigsForRepo({
+    repoRoot: ctx.repoRoot,
+    tools: next,
+    repoName: ctx.repoName,
+    contextFolder: ctx.contextFolder,
+    contextFiles,
+    variant: ctx.variant,
+    migrateLegacy: true
+  });
+  await mergeAndSaveConfig({ aiTools: next });
+  spinner.succeed("AI tools configured");
+  console.log(chalk14.dim(results.map((r) => `  ${r}`).join("\n")));
+  try {
+    await ensureListenerRunning();
+  } catch {
+  }
+  const serverRepoName = basename6(ctx.repoRoot);
+  const newMcp = added.filter((t) => MCP_WRITER_TOOLS.has(t));
+  if (newMcp.length > 0) {
+    console.log("");
+    console.log(
+      chalk14.dim(
+        "  The listener will wire these into your AI tools' MCP within a few seconds, then:"
+      )
+    );
+    for (const t of newMcp) {
+      const hint = mcpActivationHint(t, serverRepoName);
+      if (hint) console.log(chalk14.dim(`    \u2022 ${hint}`));
+    }
+  }
+}
+async function pickUnion(ctx) {
+  const { tools: picked, hasOther } = await selectAiTools({ defaults: ctx.current });
+  const removed = ctx.current.filter((t) => !picked.includes(t));
+  if (removed.length > 0) {
+    console.log(
+      chalk14.yellow(`Note: removing tools isn't supported yet \u2014 keeping ${removed.join(", ")}.`)
+    );
+  }
+  return { next: Array.from(/* @__PURE__ */ new Set([...ctx.current, ...picked])), hasOther };
+}
+function reportNothingNew(hasOther) {
+  if (hasOther) {
+    console.log(
+      chalk14.dim(
+        "For tools not listed, the instruction files work with any tool that reads the filesystem.\nTo request full support for a new AI tool, email support@repowise.ai"
+      )
+    );
+  } else {
+    console.log(chalk14.dim("No new tools added."));
+  }
+}
+async function toolsPick() {
+  const ctx = await resolveRepoOrExit();
+  if (!ctx) return;
+  const { next, hasOther } = await pickUnion(ctx);
+  if (next.length === ctx.current.length) {
+    reportNothingNew(hasOther);
+    return;
+  }
+  await applyToolSelection(ctx, next);
+}
+async function toolsAdd(list) {
+  const ctx = await resolveRepoOrExit();
+  if (!ctx) return;
+  let next;
+  let hasOther = false;
+  if (list.length === 0) {
+    ({ next, hasOther } = await pickUnion(ctx));
+  } else {
+    const invalid = list.filter((t) => !VALID_TOOLS.includes(t));
+    if (invalid.length > 0) {
+      console.error(chalk14.red(`Unknown tool(s): ${invalid.join(", ")}`));
+      console.error(chalk14.dim(`Valid tools: ${VALID_TOOLS.join(", ")}`));
+      process.exitCode = 1;
+      return;
+    }
+    next = Array.from(/* @__PURE__ */ new Set([...ctx.current, ...list]));
+  }
+  if (next.length === ctx.current.length) {
+    if (list.length === 0) reportNothingNew(hasOther);
+    else console.log(chalk14.dim("Nothing new to add \u2014 those tools are already configured."));
+    return;
+  }
+  await applyToolSelection(ctx, next);
+}
+async function toolsList() {
+  const ctx = await resolveRepoOrExit();
+  if (!ctx) return;
+  if (ctx.current.length === 0) {
+    console.log("No AI tools configured. Run `repowise tools` to add some.");
+    return;
+  }
+  console.log(chalk14.bold("Configured AI tools:"));
+  for (const t of ctx.current) {
+    const label = AI_TOOL_CONFIG[t]?.label ?? t;
+    const suffix = MCP_WRITER_TOOLS.has(t) ? "" : chalk14.dim(" (instruction files only)");
+    console.log(`  \u2022 ${label}${suffix}`);
+  }
+}
+
 // src/commands/mcp-log.ts
 import { createDecipheriv as createDecipheriv2 } from "crypto";
-import { mkdir as mkdir19, readFile as readFile17, stat as stat7, writeFile as writeFile18 } from "fs/promises";
-import { dirname as dirname22, join as join54 } from "path";
+import { mkdir as mkdir19, readFile as readFile18, stat as stat7, writeFile as writeFile19 } from "fs/promises";
+import { dirname as dirname22, join as join56 } from "path";
 var FLAG_FILE = "mcp-log.flag";
 var LOG_FILE = "mcp-log.jsonl.enc";
 var KEY_FILE = "mcp-log.key";
@@ -14732,20 +15761,20 @@ var ENDPOINT_FILE = "listener.endpoint";
 var IV_BYTES2 = 12;
 var TAG_BYTES2 = 16;
 function flagPath() {
-  return join54(getConfigDir2(), FLAG_FILE);
+  return join56(getConfigDir2(), FLAG_FILE);
 }
 function logPath() {
-  return join54(getConfigDir2(), LOG_FILE);
+  return join56(getConfigDir2(), LOG_FILE);
 }
 async function writeFlag(flag) {
   const path = flagPath();
   await mkdir19(dirname22(path), { recursive: true });
-  await writeFile18(path, JSON.stringify(flag, null, 2), { encoding: "utf-8", mode: 384 });
+  await writeFile19(path, JSON.stringify(flag, null, 2), { encoding: "utf-8", mode: 384 });
 }
 async function mcpLogOn() {
   let flagOnDisk = null;
   try {
-    flagOnDisk = JSON.parse(await readFile17(flagPath(), "utf-8"));
+    flagOnDisk = JSON.parse(await readFile18(flagPath(), "utf-8"));
   } catch {
     flagOnDisk = null;
   }
@@ -14755,11 +15784,10 @@ async function mcpLogOn() {
       enabled: true
     };
     await writeFlag(next);
-    process.stderr.write(`MCP logging re-enabled. Log file: ${logPath()}
-`);
+    process.stderr.write("MCP telemetry re-enabled. The anonymous usage heartbeat will resume.\n");
     return;
   }
-  process.stderr.write("MCP logging is already enabled.\n");
+  process.stderr.write("MCP telemetry is already enabled.\n");
   if (!flagOnDisk || !flagOnDisk.consentSentToServer) {
     const synced = await trySendConsentToServer();
     if (synced) {
@@ -14776,14 +15804,14 @@ async function trySendConsentToServer() {
   let apiUrl = null;
   let token = null;
   try {
-    const body = await readFile17(join54(getConfigDir2(), "config.json"), "utf-8");
+    const body = await readFile18(join56(getConfigDir2(), "config.json"), "utf-8");
     const parsed = JSON.parse(body);
     apiUrl = parsed.repos?.find((r) => Boolean(r.apiUrl))?.apiUrl ?? parsed.defaultApiUrl ?? null;
   } catch {
     return false;
   }
   try {
-    const body = await readFile17(join54(getConfigDir2(), "credentials.json"), "utf-8");
+    const body = await readFile18(join56(getConfigDir2(), "credentials.json"), "utf-8");
     const parsed = JSON.parse(body);
     token = parsed.idToken ?? null;
   } catch {
@@ -14806,12 +15834,12 @@ async function trySendConsentToServer() {
 async function mcpLogOff() {
   let flagOnDisk = null;
   try {
-    flagOnDisk = JSON.parse(await readFile17(flagPath(), "utf-8"));
+    flagOnDisk = JSON.parse(await readFile18(flagPath(), "utf-8"));
   } catch {
     flagOnDisk = null;
   }
   if (flagOnDisk && flagOnDisk.enabled === false) {
-    process.stderr.write("MCP logging is already disabled.\n");
+    process.stderr.write("MCP telemetry is already disabled.\n");
     process.exitCode = 1;
     return;
   }
@@ -14822,38 +15850,38 @@ async function mcpLogOff() {
   };
   await writeFlag(next);
   process.stderr.write(
-    "MCP logging disabled. Local log file is preserved; consent record is NOT revoked.\n"
+    "MCP telemetry disabled. The anonymous usage heartbeat is now off; the server-side consent record is NOT revoked (GDPR Art. 7(1) audit trail).\n"
   );
 }
 async function mcpLogStatus() {
   let flagOnDisk = null;
   try {
-    flagOnDisk = JSON.parse(await readFile17(flagPath(), "utf-8"));
+    flagOnDisk = JSON.parse(await readFile18(flagPath(), "utf-8"));
   } catch {
     flagOnDisk = null;
   }
   const enabled = !flagOnDisk || flagOnDisk.enabled !== false;
   const enabledLabel = flagOnDisk == null ? "yes (default)" : flagOnDisk.enabled ? "yes" : "no";
   void enabled;
-  process.stderr.write("MCP Log Status\n");
-  process.stderr.write("==============\n");
-  process.stderr.write(`Enabled:         ${enabledLabel}
+  process.stderr.write("MCP Telemetry Status\n");
+  process.stderr.write("====================\n");
+  process.stderr.write(`Heartbeat enabled: ${enabledLabel}
 `);
-  process.stderr.write(`Consent granted: ${flagOnDisk?.consentGrantedAt ?? "never"}
-`);
-  process.stderr.write(`Log file:        ${logPath()}
+  process.stderr.write(`Opt-in since:      ${flagOnDisk?.consentGrantedAt ?? "never"}
 `);
+  process.stderr.write("Raw local logging: disabled (heartbeat only)\n");
   try {
     const s = await stat7(logPath());
-    process.stderr.write(
-      `Log size:        ${formatBytes(s.size)} (last modified ${s.mtime.toISOString()})
+    if (s.size > 0) {
+      process.stderr.write(
+        `Raw log file:      ${logPath()} \u2014 ${formatBytes(s.size)} (escape hatch enabled)
 `
-    );
+      );
+    }
   } catch {
-    process.stderr.write("Log size:        no file yet\n");
   }
   try {
-    const endpointBody = await readFile17(join54(getConfigDir2(), ENDPOINT_FILE), "utf-8");
+    const endpointBody = await readFile18(join56(getConfigDir2(), ENDPOINT_FILE), "utf-8");
     const match = /endpoint=([^\n]+)/.exec(endpointBody);
     process.stderr.write(`MCP endpoint:    ${match?.[1] ?? "(malformed endpoint file)"}
 `);
@@ -14869,13 +15897,13 @@ function formatBytes(n) {
 async function mcpLogViewingFlags(flags = {}) {
   let flagOnDisk = null;
   try {
-    flagOnDisk = JSON.parse(await readFile17(flagPath(), "utf-8"));
+    flagOnDisk = JSON.parse(await readFile18(flagPath(), "utf-8"));
   } catch {
     flagOnDisk = null;
   }
   if (flagOnDisk && flagOnDisk.enabled === false) {
     process.stderr.write(
-      `MCP logging is disabled. Run \`repowise mcp-log on\` to re-enable and view logs.
+      `MCP telemetry is disabled. Run \`repowise mcp-log on\` to re-enable.
 `
     );
     return;
@@ -14884,7 +15912,7 @@ async function mcpLogViewingFlags(flags = {}) {
   const key = await readKey();
   if (!key) {
     process.stderr.write(
-      `No encryption key at ${join54(getConfigDir2(), KEY_FILE)} \u2014 listener may not have started yet.
+      `No encryption key at ${join56(getConfigDir2(), KEY_FILE)} \u2014 listener may not have started yet.
 `
     );
     return;
@@ -14912,7 +15940,7 @@ async function mcpLogViewingFlags(flags = {}) {
     }
   };
   try {
-    const raw = await readFile17(path, "utf-8");
+    const raw = await readFile18(path, "utf-8");
     const decoded = [];
     for (const line of raw.split("\n")) {
       const r = filter(line);
@@ -14936,7 +15964,7 @@ async function mcpLogViewingFlags(flags = {}) {
         try {
           const s = await stat7(path);
           if (s.size > lastSize) {
-            const fresh = await readFile17(path, "utf-8");
+            const fresh = await readFile18(path, "utf-8");
             const tail = fresh.slice(lastSize);
             for (const line of tail.split("\n")) {
               const r = filter(line);
@@ -14960,7 +15988,7 @@ async function mcpLogViewingFlags(flags = {}) {
 }
 async function readKey() {
   try {
-    const body = await readFile17(join54(getConfigDir2(), KEY_FILE), "utf-8");
+    const body = await readFile18(join56(getConfigDir2(), KEY_FILE), "utf-8");
     const parsed = Buffer.from(body.trim(), "base64");
     if (parsed.length !== 32) return null;
     return parsed;
@@ -15000,11 +16028,11 @@ async function mcpLog(subcommand, flags = {}) {
 }
 
 // src/commands/query/_shared.ts
-import chalk14 from "chalk";
+import chalk15 from "chalk";
 
 // src/lib/graph-loader.ts
-import { promises as fs24 } from "fs";
-import { join as join55, resolve as resolve2 } from "path";
+import { promises as fs25 } from "fs";
+import { join as join57, resolve as resolve2 } from "path";
 import { gunzipSync } from "zlib";
 var RELATIVE_GRAPH_PATH = "repowise-context/.meta/dependency-graph.json";
 var GZIPPED_GRAPH_PATH = "repowise-context/.meta/dependency-graph.json.gz";
@@ -15021,8 +16049,8 @@ var GraphNotFoundError = class extends Error {
 var cache = /* @__PURE__ */ new Map();
 async function loadGraph(repoRoot = process.cwd()) {
   const root = resolve2(repoRoot);
-  const gzPath = join55(root, GZIPPED_GRAPH_PATH);
-  const plainPath = join55(root, RELATIVE_GRAPH_PATH);
+  const gzPath = join57(root, GZIPPED_GRAPH_PATH);
+  const plainPath = join57(root, RELATIVE_GRAPH_PATH);
   const cached = cache.get(root);
   if (cached) {
     return { graph: cached, path: plainPath, bytes: 0, parseMs: 0, fromCache: true };
@@ -15030,14 +16058,14 @@ async function loadGraph(repoRoot = process.cwd()) {
   let graphPath = null;
   let raw = null;
   try {
-    raw = await fs24.readFile(gzPath);
+    raw = await fs25.readFile(gzPath);
     graphPath = gzPath;
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
   }
   if (!raw) {
     try {
-      raw = await fs24.readFile(plainPath);
+      raw = await fs25.readFile(plainPath);
       graphPath = plainPath;
     } catch (err) {
       if (err.code === "ENOENT") {
@@ -15240,7 +16268,7 @@ async function loadService() {
     return createGraphQueryService(graph);
   } catch (err) {
     if (err instanceof GraphNotFoundError) {
-      process.stderr.write(chalk14.red(`\u2717 ${err.message}
+      process.stderr.write(chalk15.red(`\u2717 ${err.message}
 `));
       process.exit(err.exitCode);
     }
@@ -15436,14 +16464,14 @@ function registerQueryCommand(program2) {
 }
 
 // src/commands/uninstall.ts
-import { promises as fs28 } from "fs";
-import { homedir as homedir10 } from "os";
-import { join as join59 } from "path";
-import chalk15 from "chalk";
+import { promises as fs29 } from "fs";
+import { homedir as homedir12 } from "os";
+import { join as join61 } from "path";
+import chalk16 from "chalk";
 
 // src/lib/cleanup/marker-blocks.ts
-import { promises as fs25 } from "fs";
-import { join as join56 } from "path";
+import { promises as fs26 } from "fs";
+import { join as join58 } from "path";
 var MARKER_START = "<!-- repowise-start -->";
 var MARKER_END = "<!-- repowise-end -->";
 var CONTEXT_FILES = [
@@ -15459,7 +16487,7 @@ var CONTEXT_FILES = [
 async function stripMarkerBlock(filePath) {
   let raw;
   try {
-    raw = await fs25.readFile(filePath, "utf-8");
+    raw = await fs26.readFile(filePath, "utf-8");
   } catch (err) {
     if (err.code === "ENOENT")
       return { path: filePath, status: "missing" };
@@ -15474,16 +16502,16 @@ async function stripMarkerBlock(filePath) {
   const after = raw.slice(endIdx + MARKER_END.length).replace(/^\n+/, "");
   const stripped = (before + (before && after ? "\n\n" : "") + after).trim();
   if (stripped.length === 0) {
-    await fs25.unlink(filePath);
+    await fs26.unlink(filePath);
     return { path: filePath, status: "deleted" };
   }
-  await fs25.writeFile(filePath, stripped + "\n", "utf-8");
+  await fs26.writeFile(filePath, stripped + "\n", "utf-8");
   return { path: filePath, status: "stripped" };
 }
 async function stripAllMarkerBlocks(repoRoot) {
   const out = [];
   for (const relative of CONTEXT_FILES) {
-    const full = join56(repoRoot, relative);
+    const full = join58(repoRoot, relative);
     const result = await stripMarkerBlock(full).catch((err) => ({
       path: full,
       status: "untouched",
@@ -15495,25 +16523,25 @@ async function stripAllMarkerBlocks(repoRoot) {
 }
 
 // src/lib/cleanup/mcp-configs.ts
-import { promises as fs26 } from "fs";
-import { join as join57 } from "path";
+import { promises as fs27 } from "fs";
+import { join as join59 } from "path";
 function mcpConfigPaths(repoRoot, home) {
   return [
-    join57(repoRoot, ".mcp.json"),
-    join57(repoRoot, ".cursor", "mcp.json"),
-    join57(repoRoot, ".vscode", "mcp.json"),
-    join57(repoRoot, ".roo", "mcp.json"),
-    join57(home, ".cline", "mcp.json"),
-    join57(home, ".codeium", "windsurf", "mcp_config.json"),
-    join57(home, ".gemini", "settings.json"),
-    join57(home, ".codex", "mcp.json"),
-    join57(home, ".roo", "mcp.json")
+    join59(repoRoot, ".mcp.json"),
+    join59(repoRoot, ".cursor", "mcp.json"),
+    join59(repoRoot, ".vscode", "mcp.json"),
+    join59(repoRoot, ".roo", "mcp.json"),
+    join59(home, ".cline", "mcp.json"),
+    join59(home, ".codeium", "windsurf", "mcp_config.json"),
+    join59(home, ".gemini", "settings.json"),
+    join59(home, ".codex", "mcp.json"),
+    join59(home, ".roo", "mcp.json")
   ];
 }
 async function removeRepowiseFromConfig(path, serverName) {
   let raw;
   try {
-    raw = await fs26.readFile(path, "utf-8");
+    raw = await fs27.readFile(path, "utf-8");
   } catch (err) {
     if (err.code === "ENOENT") return { path, status: "not-found" };
     return { path, status: "error", error: err.message };
@@ -15533,7 +16561,7 @@ async function removeRepowiseFromConfig(path, serverName) {
   } else {
     next.mcpServers = servers;
   }
-  await fs26.writeFile(path, JSON.stringify(next, null, 2) + "\n", "utf-8");
+  await fs27.writeFile(path, JSON.stringify(next, null, 2) + "\n", "utf-8");
   return { path, status: "removed" };
 }
 async function removeAllMcpEntries(repoRoot, home, repoId) {
@@ -15546,17 +16574,17 @@ async function removeAllMcpEntries(repoRoot, home, repoId) {
 }
 
 // src/lib/cleanup/local-state.ts
-import { promises as fs27 } from "fs";
-import { homedir as homedir9 } from "os";
-import { join as join58, resolve as resolve3 } from "path";
+import { promises as fs28 } from "fs";
+import { homedir as homedir11 } from "os";
+import { join as join60, resolve as resolve3 } from "path";
 async function clearLocalState(homeOverride) {
-  const home = homeOverride ?? homedir9();
-  const target = resolve3(join58(home, ".repowise"));
+  const home = homeOverride ?? homedir11();
+  const target = resolve3(join60(home, ".repowise"));
   if (target === resolve3(home) || !target.startsWith(resolve3(home))) {
     return { path: target, status: "error", error: "refused: not under home" };
   }
   try {
-    await fs27.rm(target, { recursive: true, force: false });
+    await fs28.rm(target, { recursive: true, force: false });
     return { path: target, status: "removed" };
   } catch (err) {
     if (err.code === "ENOENT")
@@ -15586,7 +16614,7 @@ async function stopAndUninstallService(uninstaller) {
 // src/commands/uninstall.ts
 async function uninstall2(opts = {}) {
   const tier = opts.tier ?? "uninstall";
-  const home = opts.home ?? homedir10();
+  const home = opts.home ?? homedir12();
   const repoRoot = opts.repoRoot ?? process.cwd();
   const loadRepoIds = opts.loadRepoIds ?? defaultLoadRepoIds;
   const report = { tier, removed: [], preserved: [], skipped: [] };
@@ -15595,7 +16623,7 @@ async function uninstall2(opts = {}) {
   else if (svc.error) report.skipped.push({ path: "listener service", reason: svc.error });
   if (tier === "stop") return report;
   try {
-    await fs28.unlink(join59(home, ".repowise", "credentials.json"));
+    await fs29.unlink(join61(home, ".repowise", "credentials.json"));
     report.removed.push("credentials");
   } catch (err) {
     if (err.code !== "ENOENT") {
@@ -15622,7 +16650,7 @@ async function uninstall2(opts = {}) {
   const allPaths = mcpConfigPaths(repoRoot, home);
   for (const p of allPaths) {
     try {
-      await fs28.access(p);
+      await fs29.access(p);
     } catch {
     }
   }
@@ -15634,7 +16662,7 @@ async function uninstall2(opts = {}) {
 }
 async function defaultLoadRepoIds(home) {
   try {
-    const raw = await fs28.readFile(join59(home, ".repowise", "config.json"), "utf-8");
+    const raw = await fs29.readFile(join61(home, ".repowise", "config.json"), "utf-8");
     const parsed = JSON.parse(raw);
     return (parsed.repos ?? []).map((r) => r.repoId);
   } catch {
@@ -15651,29 +16679,29 @@ async function uninstallCommand(opts = {}) {
         default: false
       });
       if (!proceed) {
-        process.stderr.write(chalk15.yellow("Uninstall cancelled.\n"));
+        process.stderr.write(chalk16.yellow("Uninstall cancelled.\n"));
         process.exitCode = 1;
         return;
       }
     }
   }
-  process.stderr.write(chalk15.bold(`RepoWise ${tier}
+  process.stderr.write(chalk16.bold(`RepoWise ${tier}
 `));
   const report = await uninstall2({ ...opts, tier });
   for (const p of report.removed) {
-    process.stderr.write(chalk15.green(`  \u2713 removed: ${p}
+    process.stderr.write(chalk16.green(`  \u2713 removed: ${p}
 `));
   }
   for (const p of report.preserved) {
-    process.stderr.write(chalk15.gray(`  \xB7 preserved: ${p}
+    process.stderr.write(chalk16.gray(`  \xB7 preserved: ${p}
 `));
   }
   for (const s of report.skipped) {
-    process.stderr.write(chalk15.yellow(`  ! skipped: ${s.path} (${s.reason})
+    process.stderr.write(chalk16.yellow(`  ! skipped: ${s.path} (${s.reason})
 `));
   }
   process.stderr.write(
-    chalk15.bold(`
+    chalk16.bold(`
 Done \u2014 ${report.removed.length} removed, ${report.skipped.length} skipped.
 `)
   );
@@ -15681,12 +16709,14 @@ Done \u2014 ${report.removed.length} removed, ${report.skipped.length} skipped.
 
 // src/commands/mcp-shim.ts
 init_config_dir();
-import { promises as fs29 } from "fs";
+import { promises as fs30 } from "fs";
 import { createInterface as createInterface2 } from "readline";
-import { join as join60 } from "path";
+import { join as join62 } from "path";
 var DEFAULT_MAX = 200 * 1024;
+var SHIM_REQUEST_TIMEOUT_MS = 45e3;
 async function mcpShim(opts) {
-  const endpointPath = opts.endpointFile ?? join60(getConfigDir(), "listener.endpoint");
+  const endpointPath = opts.endpointFile ?? join62(getConfigDir(), "listener.endpoint");
+  const credsPath = opts.credentialsFile ?? join62(getConfigDir(), "credentials.json");
   const stdin = opts.stdin ?? process.stdin;
   const stdout = opts.stdout ?? process.stdout;
   const stderr = opts.stderr ?? process.stderr;
@@ -15721,12 +16751,16 @@ async function mcpShim(opts) {
     }
     const info = await readEndpoint(endpointPath);
     if (!info) {
+      const authState = await readAuthState(credsPath);
+      const message = authState === "logged-out" ? (
+        // Agent-directed: the calling LLM can run this itself for a smoother UX
+        // (it auto-opens the browser; the user still completes sign-in). The
+        // command is a fixed, argument-free string (nothing injectable).
+        "RepoWise isn't authenticated (this is rare \u2014 the session lasts about a year). To fix it, run the shell command `repowise login` on the user's behalf \u2014 it opens a browser for them to sign in and blocks until they finish. Run it once, wait for it to complete, then retry this request. Do not repeat the command."
+      ) : "listener endpoint unavailable \u2014 is the listener running?";
       writeJson(stdout, {
         jsonrpc: "2.0",
-        error: {
-          code: -32e3,
-          message: "listener endpoint unavailable \u2014 is the listener running?"
-        }
+        error: { code: -32e3, message }
       });
       continue;
     }
@@ -15746,12 +16780,19 @@ async function mcpShim(opts) {
     } catch (err) {
       stderr.write(`mcp-shim: ${err.message}
 `);
+      const name = err.name;
+      const detail = err.message;
+      const isTimeout = name === "TimeoutError" || name === "AbortError" || /timeout|aborted|abort/i.test(detail);
       writeJson(stdout, {
         jsonrpc: "2.0",
-        error: {
+        error: isTimeout ? {
+          code: -32001,
+          message: "RepoWise listener did not respond in time \u2014 it may be stuck. Restart it with `repowise restart`, then retry.",
+          data: { detail }
+        } : {
           code: -32001,
           message: "listener request failed",
-          data: { detail: err.message }
+          data: { detail }
         }
       });
     }
@@ -15759,7 +16800,7 @@ async function mcpShim(opts) {
 }
 async function readEndpoint(path) {
   try {
-    const raw = (await fs29.readFile(path, "utf-8")).trim();
+    const raw = (await fs30.readFile(path, "utf-8")).trim();
     if (!raw) return null;
     if (raw.startsWith("http://") || raw.startsWith("https://")) {
       return { endpoint: raw.split("\n")[0].trim(), secret: null };
@@ -15777,6 +16818,22 @@ async function readEndpoint(path) {
     throw err;
   }
 }
+async function readAuthState(credsPath) {
+  let raw;
+  try {
+    raw = await fs30.readFile(credsPath, "utf-8");
+  } catch (err) {
+    if (err.code === "ENOENT") return "logged-out";
+    return "unknown";
+  }
+  let creds;
+  try {
+    creds = JSON.parse(raw);
+  } catch {
+    return "unknown";
+  }
+  return isCredsHardExpired(creds) ? "logged-out" : "authenticated";
+}
 function writeJson(stream, value) {
   stream.write(`${JSON.stringify(value)}
 `);
@@ -15872,7 +16929,8 @@ async function defaultPostJson(url, body, headers = { "content-type": "applicati
   const res = await fetch(url, {
     method: "POST",
     headers,
-    body: JSON.stringify(body)
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(SHIM_REQUEST_TIMEOUT_MS)
   });
   if (!res.ok) {
     let detail = "";
@@ -15886,7 +16944,11 @@ async function defaultPostJson(url, body, headers = { "content-type": "applicati
   return await res.json();
 }
 async function defaultGetJson(url, headers = {}) {
-  const res = await fetch(url, { method: "GET", headers });
+  const res = await fetch(url, {
+    method: "GET",
+    headers,
+    signal: AbortSignal.timeout(SHIM_REQUEST_TIMEOUT_MS)
+  });
   if (!res.ok) {
     let detail = "";
     try {
@@ -16001,7 +17063,7 @@ init_coursier_installer();
 init_toolchain_installer();
 import { spawn as spawn12 } from "child_process";
 import { resolve as resolve4 } from "path";
-import chalk16 from "chalk";
+import chalk17 from "chalk";
 async function isOnPath(command) {
   if (/[^\w./+-]/.test(command)) return false;
   const isWin = process.platform === "win32";
@@ -16019,14 +17081,14 @@ async function isOnPath(command) {
 async function lspDoctor() {
   const noColor = Boolean(process.env.NO_COLOR) || !process.stdout.isTTY;
   if (noColor) {
-    chalk16.level = 0;
+    chalk17.level = 0;
   }
-  const okGlyph = noColor ? "[OK]" : chalk16.green("\u2713");
-  const missingGlyph = noColor ? "[MISSING]" : chalk16.yellow("\u2717");
-  console.log(chalk16.bold("RepoWise LSP doctor"));
-  console.log(chalk16.dim("Probing PATH for language servers used by the listener."));
+  const okGlyph = noColor ? "[OK]" : chalk17.green("\u2713");
+  const missingGlyph = noColor ? "[MISSING]" : chalk17.yellow("\u2717");
+  console.log(chalk17.bold("RepoWise LSP doctor"));
+  console.log(chalk17.dim("Probing PATH for language servers used by the listener."));
   console.log(
-    chalk16.dim(
+    chalk17.dim(
       "Type-aware resolution covers 9 languages: Go, Python, Rust, Java, Ruby, Dart, Kotlin, PHP, Scala (Phase 7L + 7L++ + 7L+)."
     )
   );
@@ -16058,21 +17120,21 @@ async function lspDoctor() {
   const missing = reports.filter((r) => r.status === "missing").length;
   for (const r of reports) {
     const head = r.status === "found" ? okGlyph : missingGlyph;
-    const cmd = r.command ? chalk16.cyan(r.command) : chalk16.dim(r.candidates.join(" / "));
+    const cmd = r.command ? chalk17.cyan(r.command) : chalk17.dim(r.candidates.join(" / "));
     const effectiveConfigs = getEffectiveConfigList(r.language, process.env, lspOverrides);
     const method = describeInstallMethod(effectiveConfigs);
-    console.log(`  ${head} ${r.language.padEnd(12)} ${cmd} ${chalk16.dim(`[${method}]`)}`);
+    console.log(`  ${head} ${r.language.padEnd(12)} ${cmd} ${chalk17.dim(`[${method}]`)}`);
     if (r.status === "missing" && r.hint) {
-      console.log(`      ${chalk16.dim("install:")} ${r.hint}`);
+      console.log(`      ${chalk17.dim("install:")} ${r.hint}`);
     }
   }
   console.log();
   console.log(
-    `${chalk16.green(found.toString())} found, ${chalk16.yellow(missing.toString())} missing of ${reports.length.toString()} languages.`
+    `${chalk17.green(found.toString())} found, ${chalk17.yellow(missing.toString())} missing of ${reports.length.toString()} languages.`
   );
   if (missing > 0) {
     console.log(
-      chalk16.dim(
+      chalk17.dim(
         "Missing servers degrade LSP-backed MCP tools to AST-only fallback. Run `repowise lsp install` to auto-install."
       )
     );
@@ -16089,15 +17151,15 @@ function describeInstallMethod(configs) {
 }
 async function lspInstall(language) {
   const noColor = Boolean(process.env.NO_COLOR) || !process.stdout.isTTY;
-  if (noColor) chalk16.level = 0;
-  console.log(chalk16.bold("RepoWise LSP install"));
+  if (noColor) chalk17.level = 0;
+  console.log(chalk17.bold("RepoWise LSP install"));
   const cliConfig = await getConfig();
   const lspOverrides = cliConfig.lspOverrides;
   const targets = language ? [language] : Object.keys(LSP_REGISTRY);
   for (const lang of targets) {
     const configs = getEffectiveConfigList(lang, process.env, lspOverrides);
     if (!configs || configs.length === 0) {
-      console.log(`  ${chalk16.red("\u2717")} ${lang} ${chalk16.dim("(unknown language)")}`);
+      console.log(`  ${chalk17.red("\u2717")} ${lang} ${chalk17.dim("(unknown language)")}`);
       continue;
     }
     const result = await installOneLanguage(configs);
@@ -16165,11 +17227,11 @@ async function installOneLanguage(configs) {
   };
 }
 function formatInstallLine(lang, outcome) {
-  const glyph = outcome.ok ? chalk16.green("\u2713") : chalk16.yellow("\u2717");
-  const tag = chalk16.dim(`[${outcome.method}]`);
+  const glyph = outcome.ok ? chalk17.green("\u2713") : chalk17.yellow("\u2717");
+  const tag = chalk17.dim(`[${outcome.method}]`);
   console.log(`  ${glyph} ${lang.padEnd(12)} ${tag} ${outcome.detail}`);
   if (!outcome.ok && outcome.hint) {
-    console.log(`      ${chalk16.dim("install:")} ${outcome.hint}`);
+    console.log(`      ${chalk17.dim("install:")} ${outcome.hint}`);
   }
 }
 var MAX_KEEP_WARM_MINUTES = 240;
@@ -16207,42 +17269,42 @@ async function autoDetectLanguages(cwd) {
 async function lspWarm(opts = {}) {
   const cwd = resolve4(opts.cwd ?? process.cwd());
   const noColor = Boolean(process.env.NO_COLOR) || !process.stdout.isTTY;
-  if (noColor) chalk16.level = 0;
+  if (noColor) chalk17.level = 0;
   let languages;
   if (opts.lang && opts.lang.length > 0) {
     const valid = Object.keys(LSP_REGISTRY);
     languages = opts.lang.filter((l) => valid.includes(l));
     const invalid = opts.lang.filter((l) => !valid.includes(l));
     if (invalid.length > 0) {
-      console.log(chalk16.yellow(`[lsp warm] unknown languages skipped: ${invalid.join(", ")}`));
+      console.log(chalk17.yellow(`[lsp warm] unknown languages skipped: ${invalid.join(", ")}`));
     }
   } else {
     languages = await autoDetectLanguages(cwd);
     if (languages.length === 0) {
       console.log(
-        chalk16.yellow(
+        chalk17.yellow(
           "[lsp warm] no recognised source files in this repo \u2014 pass --lang <id> to force a server."
         )
       );
       return;
     }
-    console.log(chalk16.dim(`[lsp warm] auto-detected languages: ${languages.join(", ")}`));
+    console.log(chalk17.dim(`[lsp warm] auto-detected languages: ${languages.join(", ")}`));
   }
   let keepWarmMinutes = 0;
   if (typeof opts.keepWarm === "number" && opts.keepWarm > 0) {
     keepWarmMinutes = Math.min(opts.keepWarm, MAX_KEEP_WARM_MINUTES);
     if (opts.keepWarm > MAX_KEEP_WARM_MINUTES) {
       console.log(
-        chalk16.yellow(
+        chalk17.yellow(
           `[lsp warm] --keep-warm clipped to ${MAX_KEEP_WARM_MINUTES.toString()} minutes (hard cap per Phase 7L plan).`
         )
       );
     }
   }
-  console.log(chalk16.bold("RepoWise LSP warm \u2014 preview"));
-  console.log(chalk16.dim(`Workspace: ${cwd}`));
+  console.log(chalk17.bold("RepoWise LSP warm \u2014 preview"));
+  console.log(chalk17.dim(`Workspace: ${cwd}`));
   console.log(
-    chalk16.dim(
+    chalk17.dim(
       "LSP sessions live inside the listener (lazy-by-default, idle-evict after 5 min). The CLI cannot currently trigger a remote spawn \u2014 this preview shows which servers would be used."
     )
   );
@@ -16258,23 +17320,23 @@ async function lspWarm(opts = {}) {
     if (onPath) {
       foundCount += 1;
       console.log(
-        chalk16.green(`  \u2713 ${lang.padEnd(12)} ${config2.displayName} (${config2.command}) on PATH`)
+        chalk17.green(`  \u2713 ${lang.padEnd(12)} ${config2.displayName} (${config2.command}) on PATH`)
       );
     } else {
       missingCount += 1;
-      console.log(chalk16.yellow(`  \u2717 ${lang.padEnd(12)} ${config2.displayName} not on PATH`));
+      console.log(chalk17.yellow(`  \u2717 ${lang.padEnd(12)} ${config2.displayName} not on PATH`));
       if (config2.installHint) {
-        console.log(chalk16.dim(`      install: ${config2.installHint}`));
+        console.log(chalk17.dim(`      install: ${config2.installHint}`));
       }
     }
   }
   console.log();
   console.log(
-    `${chalk16.green(foundCount.toString())} ready, ${chalk16.yellow(missingCount.toString())} missing.`
+    `${chalk17.green(foundCount.toString())} ready, ${chalk17.yellow(missingCount.toString())} missing.`
   );
   if (keepWarmMinutes > 0) {
     console.log(
-      chalk16.dim(
+      chalk17.dim(
         `Holding for ${keepWarmMinutes.toString()} minute(s) so the listener has time to spawn on its next sync.completed; Ctrl-C to exit early.`
       )
     );
@@ -16291,20 +17353,20 @@ async function lspWarm(opts = {}) {
 }
 function lspStatus() {
   const noColor = Boolean(process.env.NO_COLOR) || !process.stdout.isTTY;
-  if (noColor) chalk16.level = 0;
-  console.log(chalk16.bold("RepoWise LSP status"));
+  if (noColor) chalk17.level = 0;
+  console.log(chalk17.bold("RepoWise LSP status"));
   console.log(
-    chalk16.dim(
+    chalk17.dim(
       "Active LSP sessions live inside the listener (not the CLI). Sessions are lazy-by-default: spawn on first MCP tool / receiver query, idle-evict after 5 minutes. Scala sessions also evict their paired Bloop daemon (Phase 7L+)."
     )
   );
   console.log();
-  console.log(chalk16.dim("See `repowise lsp doctor` for PATH probe + install hints."));
+  console.log(chalk17.dim("See `repowise lsp doctor` for PATH probe + install hints."));
 }
 function lspStop() {
-  console.log(chalk16.bold("RepoWise LSP stop \u2014 preview"));
+  console.log(chalk17.bold("RepoWise LSP stop \u2014 preview"));
   console.log(
-    chalk16.dim(
+    chalk17.dim(
       "No CLI-owned warm sessions exist. Listener-owned LSP sessions evict automatically after 5 minutes of idle (Phase 7L) and under the RSS soft-cap LRU when memory pressure rises. Explicit listener-side stop IPC is a future follow-up."
     )
   );
@@ -16327,29 +17389,29 @@ var ENABLE_TARGETS = {
 };
 async function lspEnable(target) {
   const noColor = Boolean(process.env.NO_COLOR) || !process.stdout.isTTY;
-  if (noColor) chalk16.level = 0;
+  if (noColor) chalk17.level = 0;
   if (!target) {
-    console.error(chalk16.red("Usage: repowise lsp enable <target>"));
-    console.error(chalk16.dim(`  Supported targets: ${Object.keys(ENABLE_TARGETS).join(", ")}`));
+    console.error(chalk17.red("Usage: repowise lsp enable <target>"));
+    console.error(chalk17.dim(`  Supported targets: ${Object.keys(ENABLE_TARGETS).join(", ")}`));
     process.exitCode = 1;
     return;
   }
   const spec = ENABLE_TARGETS[target];
   if (!spec) {
-    console.error(chalk16.red(`\u2716 Unknown LSP override target: ${target}`));
-    console.error(chalk16.dim(`  Supported: ${Object.keys(ENABLE_TARGETS).join(", ")}`));
+    console.error(chalk17.red(`\u2716 Unknown LSP override target: ${target}`));
+    console.error(chalk17.dim(`  Supported: ${Object.keys(ENABLE_TARGETS).join(", ")}`));
     process.exitCode = 1;
     return;
   }
   const config2 = await getConfig();
   const existing = config2.lspOverrides?.[spec.language];
   if (existing === spec.name) {
-    console.log(chalk16.green(`\u2714 ${spec.displayName} is already enabled.`));
-    console.log(chalk16.dim(`  ${spec.postAcceptTip}`));
+    console.log(chalk17.green(`\u2714 ${spec.displayName} is already enabled.`));
+    console.log(chalk17.dim(`  ${spec.postAcceptTip}`));
     return;
   }
   console.log();
-  console.log(chalk16.cyan.bold(`  \u2500\u2500 Enable ${spec.displayName} \u2500\u2500`));
+  console.log(chalk17.cyan.bold(`  \u2500\u2500 Enable ${spec.displayName} \u2500\u2500`));
   for (const line of spec.consentLines) {
     console.log(`  ${line}`);
   }
@@ -16361,7 +17423,7 @@ async function lspEnable(target) {
   });
   if (!proceed) {
     console.log(
-      chalk16.dim(
+      chalk17.dim(
         `  Cancelled. ${spec.language.toUpperCase()} will continue using ${spec.revertDisplay}.`
       )
     );
@@ -16370,32 +17432,32 @@ async function lspEnable(target) {
   const nextOverrides = { ...config2.lspOverrides ?? {}, [spec.language]: spec.name };
   await mergeAndSaveConfig({ lspOverrides: nextOverrides });
   console.log(
-    chalk16.green(
+    chalk17.green(
       `  \u2714 ${spec.displayName} enabled \u2014 listener will use it within ~5 min (reconcile cycle) or on next session restart.`
     )
   );
-  console.log(chalk16.dim(`  \u2139 ${spec.postAcceptTip}`));
+  console.log(chalk17.dim(`  \u2139 ${spec.postAcceptTip}`));
 }
 async function lspDisable(target) {
   const noColor = Boolean(process.env.NO_COLOR) || !process.stdout.isTTY;
-  if (noColor) chalk16.level = 0;
+  if (noColor) chalk17.level = 0;
   if (!target) {
-    console.error(chalk16.red("Usage: repowise lsp disable <target>"));
-    console.error(chalk16.dim(`  Supported targets: ${Object.keys(ENABLE_TARGETS).join(", ")}`));
+    console.error(chalk17.red("Usage: repowise lsp disable <target>"));
+    console.error(chalk17.dim(`  Supported targets: ${Object.keys(ENABLE_TARGETS).join(", ")}`));
     process.exitCode = 1;
     return;
   }
   const spec = ENABLE_TARGETS[target];
   if (!spec) {
-    console.error(chalk16.red(`\u2716 Unknown LSP override target: ${target}`));
-    console.error(chalk16.dim(`  Supported: ${Object.keys(ENABLE_TARGETS).join(", ")}`));
+    console.error(chalk17.red(`\u2716 Unknown LSP override target: ${target}`));
+    console.error(chalk17.dim(`  Supported: ${Object.keys(ENABLE_TARGETS).join(", ")}`));
     process.exitCode = 1;
     return;
   }
   const config2 = await getConfig();
   const current = config2.lspOverrides?.[spec.language];
   if (current !== spec.name) {
-    console.log(chalk16.dim(`  ${spec.displayName} is not enabled \u2014 nothing to do.`));
+    console.log(chalk17.dim(`  ${spec.displayName} is not enabled \u2014 nothing to do.`));
     return;
   }
   const { [spec.language]: _removed, ...rest } = config2.lspOverrides ?? {};
@@ -16405,28 +17467,28 @@ async function lspDisable(target) {
     ...nextOverrides ? { lspOverrides: nextOverrides } : { lspOverrides: void 0 }
   });
   console.log(
-    chalk16.green(
+    chalk17.green(
       `  \u2714 ${spec.displayName} disabled \u2014 listener will revert to ${spec.revertDisplay} within ~5 min or on next session restart.`
     )
   );
 }
 async function lspOff() {
   const noColor = Boolean(process.env.NO_COLOR) || !process.stdout.isTTY;
-  if (noColor) chalk16.level = 0;
+  if (noColor) chalk17.level = 0;
   await mergeAndSaveConfig({ lspEnabled: false });
   console.log(
-    chalk16.green(
+    chalk17.green(
       "  \u2714 LSP subsystem disabled. The listener will stop spawning language servers and `lsp_*` tools will report disabled within ~5 min (reconcile) or on next restart."
     )
   );
-  console.log(chalk16.dim("    Re-enable with: repowise lsp on"));
+  console.log(chalk17.dim("    Re-enable with: repowise lsp on"));
 }
 async function lspOn() {
   const noColor = Boolean(process.env.NO_COLOR) || !process.stdout.isTTY;
-  if (noColor) chalk16.level = 0;
+  if (noColor) chalk17.level = 0;
   await mergeAndSaveConfig({ lspEnabled: true });
   console.log(
-    chalk16.green(
+    chalk17.green(
       "  \u2714 LSP subsystem enabled. The listener will install + warm language servers for your repos within ~5 min (reconcile) or on next restart."
     )
   );
@@ -16435,7 +17497,7 @@ async function lspOn() {
 // bin/repowise.ts
 var __filename = fileURLToPath4(import.meta.url);
 var __dirname = dirname23(__filename);
-var pkg = JSON.parse(readFileSync3(join61(__dirname, "..", "..", "package.json"), "utf-8"));
+var pkg = JSON.parse(readFileSync3(join63(__dirname, "..", "..", "package.json"), "utf-8"));
 var program = new Command();
 program.name(getPackageName()).description("AI-optimized codebase context generator").version(pkg.version).hook("preAction", async () => {
   await showWelcome(pkg.version);
@@ -16511,6 +17573,15 @@ lspCommand.command("off").description("Disable the LSP subsystem entirely (kill-
 lspCommand.command("on").description("Re-enable the LSP subsystem after `lsp off`").action(async () => {
   await lspOn();
 });
+var toolsCommand = program.command("tools").description("Add RepoWise to your AI tools (Claude Code, Cursor, \u2026) after install").action(async () => {
+  await toolsPick();
+});
+toolsCommand.command("add [tools...]").description("Add named AI tools (or open the picker with no args)").action(async (list) => {
+  await toolsAdd(list ?? []);
+});
+toolsCommand.command("list").description("List the AI tools RepoWise is configured for").action(async () => {
+  await toolsList();
+});
 program.command("uninstall").description("Remove RepoWise from this machine (3 tiers: stop | logout | uninstall)").option("--tier <tier>", "Cleanup tier: stop | logout | uninstall", "uninstall").option("--yes", "Skip confirm prompt", false).action(async (options) => {
   const tier = options.tier ?? "uninstall";
   await uninstallCommand({ tier, yes: options.yes });