repowisestage 0.0.71 → 0.0.73

package/dist/bin/repowise.js

@@ -508,19 +508,19 @@ var init_src = __esm({
 // ../listener/dist/process-manager.js
 import { spawn } from "child_process";
 import { openSync, closeSync } from "fs";
-import { readFile as readFile6, writeFile as writeFile7, mkdir as mkdir7, unlink as unlink5 } from "fs/promises";
+import { readFile as readFile7, writeFile as writeFile8, mkdir as mkdir7, unlink as unlink6 } from "fs/promises";
 import { homedir as homedir2 } from "os";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 import { createRequire } from "module";
 import { fileURLToPath } from "url";
 function repowiseDir() {
   return getConfigDir();
 }
 function pidPath() {
-  return join10(repowiseDir(), "listener.pid");
+  return join11(repowiseDir(), "listener.pid");
 }
 function logDirPath() {
-  return join10(repowiseDir(), "logs");
+  return join11(repowiseDir(), "logs");
 }
 function resolveListenerCommand() {
   try {
@@ -534,7 +534,7 @@ function resolveListenerCommand() {
 }
 async function readPid() {
   try {
-    const content = await readFile6(pidPath(), "utf-8");
+    const content = await readFile7(pidPath(), "utf-8");
     const pid = parseInt(content.trim(), 10);
     return Number.isNaN(pid) ? null : pid;
   } catch (err) {
@@ -560,8 +560,8 @@ async function startBackground() {
   const logDir2 = logDirPath();
   await mkdir7(logDir2, { recursive: true });
   const cmd = resolveListenerCommand();
-  const stdoutFd = openSync(join10(logDir2, "listener-stdout.log"), "a");
-  const stderrFd = openSync(join10(logDir2, "listener-stderr.log"), "a");
+  const stdoutFd = openSync(join11(logDir2, "listener-stdout.log"), "a");
+  const stderrFd = openSync(join11(logDir2, "listener-stderr.log"), "a");
   const child = spawn(process.execPath, [cmd.script, ...cmd.args], {
     detached: true,
     stdio: ["ignore", stdoutFd, stderrFd],
@@ -574,7 +574,7 @@ async function startBackground() {
   const pid = child.pid;
   if (!pid)
     throw new Error("Failed to spawn listener process");
-  await writeFile7(pidPath(), String(pid));
+  await writeFile8(pidPath(), String(pid));
   return pid;
 }
 async function stopProcess() {
@@ -609,7 +609,7 @@ async function isRunning() {
 }
 async function removePidFile() {
   try {
-    await unlink5(pidPath());
+    await unlink6(pidPath());
   } catch {
   }
 }
@@ -1170,12 +1170,12 @@ import { createGunzip } from "zlib";
 import { spawn as spawn3 } from "child_process";
 import { pipeline } from "stream/promises";
 import { createHash as createHash3 } from "crypto";
-import { join as join13, dirname as dirname5 } from "path";
+import { join as join14, dirname as dirname5 } from "path";
 function getNativeLspDir() {
-  return join13(getLspInstallDir(), "native");
+  return join14(getLspInstallDir(), "native");
 }
 function getNativeLspBinDir() {
-  return join13(getNativeLspDir(), "bin");
+  return join14(getNativeLspDir(), "bin");
 }
 async function ensureNativeLspInstalled(lspKey) {
   const entry = NATIVE_LSP_VERSIONS[lspKey];
@@ -1201,15 +1201,15 @@ async function ensureNativeLspInstalled(lspKey) {
     }
   }
   const usesWrapper = Boolean(asset.launcherJarGlob && asset.wrapperBinaryName);
-  const versionDir = join13(getNativeLspDir(), lspKey, entry.version);
+  const versionDir = join14(getNativeLspDir(), lspKey, entry.version);
   if (usesWrapper && asset.launcherJarGlob && asset.wrapperBinaryName) {
     const jarPath = await resolveGlobInsideDir(versionDir, asset.launcherJarGlob);
-    const shimPath = join13(getNativeLspBinDir(), asset.wrapperBinaryName);
+    const shimPath = join14(getNativeLspBinDir(), asset.wrapperBinaryName);
     if (jarPath && await pathExists(shimPath)) {
       return { installed: false, alreadyPresent: true, binaryPath: shimPath };
     }
   } else {
-    const installedBinary = join13(versionDir, asset.binaryPath);
+    const installedBinary = join14(versionDir, asset.binaryPath);
     if (await pathExists(installedBinary)) {
       await ensureSymlinkInBin(lspKey, installedBinary, asset.binaryPath);
       return { installed: false, alreadyPresent: true, binaryPath: installedBinary };
@@ -1217,7 +1217,7 @@ async function ensureNativeLspInstalled(lspKey) {
   }
   try {
     await fs.mkdir(versionDir, { recursive: true });
-    const tmpDownload = join13(versionDir, `.${asset.filename}.download`);
+    const tmpDownload = join14(versionDir, `.${asset.filename}.download`);
     const downloadUrl = entry.source.kind === "github-release" ? `https://github.com/${entry.source.repo}/releases/download/${entry.version}/${asset.filename}` : asset.url ?? "";
     if (!downloadUrl) {
       return {
@@ -1259,7 +1259,7 @@ async function ensureNativeLspInstalled(lspKey) {
       await pruneStaleVersions(lspKey, entry.version);
       return { installed: true, alreadyPresent: false, binaryPath: shimPath };
     }
-    const installedBinary = join13(versionDir, asset.binaryPath);
+    const installedBinary = join14(versionDir, asset.binaryPath);
     if (!await pathExists(installedBinary)) {
       return {
         installed: false,
@@ -1283,7 +1283,7 @@ async function resolveGlobInsideDir(versionDir, glob) {
   const parts = glob.split("/");
   let dir = versionDir;
   for (let i = 0; i < parts.length - 1; i += 1) {
-    dir = join13(dir, parts[i]);
+    dir = join14(dir, parts[i]);
   }
   const pattern = parts[parts.length - 1];
   const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
@@ -1296,10 +1296,10 @@ async function resolveGlobInsideDir(versionDir, glob) {
   }
   const matches = entries.filter((e) => re.test(e)).sort();
   const last = matches[matches.length - 1];
-  return last ? join13(dir, last) : null;
+  return last ? join14(dir, last) : null;
 }
 async function pruneStaleVersions(lspKey, currentVersion) {
-  const lspDir = join13(getNativeLspDir(), lspKey);
+  const lspDir = join14(getNativeLspDir(), lspKey);
   let entries;
   try {
     entries = await fs.readdir(lspDir);
@@ -1308,7 +1308,7 @@ async function pruneStaleVersions(lspKey, currentVersion) {
   }
   await Promise.all(entries.filter((name) => name !== currentVersion).map(async (name) => {
     try {
-      await fs.rm(join13(lspDir, name), { recursive: true, force: true });
+      await fs.rm(join14(lspDir, name), { recursive: true, force: true });
     } catch {
     }
   }));
@@ -1322,9 +1322,9 @@ function cmdQuote(value) {
 async function writeJdtlsWrapper(input) {
   const binDir = getNativeLspBinDir();
   await fs.mkdir(binDir, { recursive: true });
-  const shimPath = join13(binDir, input.binaryName);
+  const shimPath = join14(binDir, input.binaryName);
   const platformCfgDir = process.platform === "darwin" ? "config_mac" : process.platform === "win32" ? "config_win" : "config_linux";
-  const workspaceBase = join13(input.versionDir, "workspaces");
+  const workspaceBase = join14(input.versionDir, "workspaces");
   const qLauncher = shQuote(input.launcherJarPath);
   const qConfig = shQuote(`${input.versionDir}/${platformCfgDir}`);
   const qWorkspaceBase = shQuote(workspaceBase);
@@ -1384,7 +1384,7 @@ async function ensureSymlinkInBin(lspKey, target, sourceAssetPath) {
   await fs.mkdir(binDir, { recursive: true });
   const winExtMatch = process.platform === "win32" && sourceAssetPath ? /\.(exe|bat|cmd|ps1)$/i.exec(sourceAssetPath) : null;
   const linkName = winExtMatch ? `${lspKey}${winExtMatch[0].toLowerCase()}` : lspKey;
-  const linkPath = join13(binDir, linkName);
+  const linkPath = join14(binDir, linkName);
   try {
     await fs.unlink(linkPath);
   } catch {
@@ -1433,12 +1433,12 @@ async function extractAsset(source, destDir, asset) {
     return;
   }
   if (filename.endsWith(".gz")) {
-    const outPath = join13(destDir, asset.binaryPath);
+    const outPath = join14(destDir, asset.binaryPath);
     await fs.mkdir(dirname5(outPath), { recursive: true });
     await pipeline((await fs.open(source)).createReadStream(), createGunzip(), createWriteStream(outPath));
     return;
   }
-  await fs.copyFile(source, join13(destDir, asset.binaryPath));
+  await fs.copyFile(source, join14(destDir, asset.binaryPath));
 }
 async function runExternal(cmd, args) {
   return new Promise((resolve5, reject) => {
@@ -1476,9 +1476,9 @@ var init_native_installer = __esm({
 // ../listener/dist/lsp/coursier-installer.js
 import { promises as fs2 } from "fs";
 import { spawn as spawn4 } from "child_process";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 function getCoursierBinDir() {
-  return join14(getLspInstallDir(), "coursier-bin");
+  return join15(getLspInstallDir(), "coursier-bin");
 }
 async function ensureCoursierLspInstalled(key) {
   const entry = COURSIER_LSPS[key];
@@ -1486,8 +1486,8 @@ async function ensureCoursierLspInstalled(key) {
     return { installed: false, alreadyPresent: false, skipped: "no-coursier-entry" };
   }
   const binDir = getCoursierBinDir();
-  const binaryPath = join14(binDir, entry.appName);
-  const binaryPathExe = join14(binDir, `${entry.appName}.bat`);
+  const binaryPath = join15(binDir, entry.appName);
+  const binaryPathExe = join15(binDir, `${entry.appName}.bat`);
   if (await pathExists2(binaryPath) || await pathExists2(binaryPathExe)) {
     return { installed: false, alreadyPresent: true, binaryPath };
   }
@@ -1500,8 +1500,8 @@ async function ensureCoursierLspInstalled(key) {
       error: csBootstrap.error ?? csBootstrap.skipped
     };
   }
-  const csPath = join14(getNativeLspBinDir(), "coursier");
-  const csPathExe = join14(getNativeLspBinDir(), "coursier.exe");
+  const csPath = join15(getNativeLspBinDir(), "coursier");
+  const csPathExe = join15(getNativeLspBinDir(), "coursier.exe");
   const cs = await pathExists2(csPath) ? csPath : await pathExists2(csPathExe) ? csPathExe : null;
   if (!cs) {
     return {
@@ -1567,7 +1567,7 @@ var init_coursier_installer = __esm({
 import { spawn as spawn5 } from "child_process";
 import { promises as fs3 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 async function ensureToolchainLspInstalled(key) {
   const entry = TOOLCHAIN_LSPS[key];
   if (!entry) {
@@ -1615,7 +1615,7 @@ async function ensureToolchainLspInstalled(key) {
       error: err instanceof Error ? err.message : String(err)
     };
   }
-  const binaryPath = join15(binDir, entry.binaryName);
+  const binaryPath = join16(binDir, entry.binaryName);
   if (!await pathExists3(binaryPath)) {
     return {
       installed: false,
@@ -1632,14 +1632,14 @@ async function resolveToolchainBinDir(entry) {
   }
   if (entry.toolchainBinDir) {
     if (entry.toolchain === "go") {
-      const gopath = process.env["GOPATH"] ?? join15(homedir3(), "go");
-      return join15(gopath, "bin");
+      const gopath = process.env["GOPATH"] ?? join16(homedir3(), "go");
+      return join16(gopath, "bin");
     }
-    return join15(homedir3(), entry.toolchainBinDir);
+    return join16(homedir3(), entry.toolchainBinDir);
   }
   if (entry.toolchain === "gem") {
     const userdir = await captureStdout("gem", ["env", "userdir"]);
-    return join15(userdir.trim(), "bin");
+    return join16(userdir.trim(), "bin");
   }
   throw new Error(`no bin-dir resolution for toolchain ${entry.toolchain}`);
 }
@@ -1649,10 +1649,10 @@ function getToolchainBinDirs() {
     if (entry.bundled || !entry.toolchain || !entry.toolchainBinDir)
       continue;
     if (entry.toolchain === "go") {
-      const gopath = process.env["GOPATH"] ?? join15(homedir3(), "go");
-      dirs.add(join15(gopath, "bin"));
+      const gopath = process.env["GOPATH"] ?? join16(homedir3(), "go");
+      dirs.add(join16(gopath, "bin"));
     } else {
-      dirs.add(join15(homedir3(), entry.toolchainBinDir));
+      dirs.add(join16(homedir3(), entry.toolchainBinDir));
     }
   }
   return [...dirs];
@@ -1720,20 +1720,20 @@ var init_toolchain_installer = __esm({
 
 // ../listener/dist/lsp/installer.js
 import { promises as fs4 } from "fs";
-import { join as join16, dirname as dirname6 } from "path";
+import { join as join17, dirname as dirname6 } from "path";
 import { spawn as spawn6 } from "child_process";
-import lockfile3 from "proper-lockfile";
+import lockfile4 from "proper-lockfile";
 function getLspInstallDir() {
-  return join16(getConfigDir(), "lsp-servers");
+  return join17(getConfigDir(), "lsp-servers");
 }
 function getLspBinDir() {
-  return join16(getLspInstallDir(), "node_modules", ".bin");
+  return join17(getLspInstallDir(), "node_modules", ".bin");
 }
 async function ensureNpmLspInstalled(config2) {
   if (!config2.npmPackage)
     return { installed: false, skipped: "no-npm-package" };
   const installDir = getLspInstallDir();
-  const binPath = join16(installDir, "node_modules", ".bin", config2.command);
+  const binPath = join17(installDir, "node_modules", ".bin", config2.command);
   if (await pathExists4(binPath)) {
     return { installed: false, skipped: "already-present" };
   }
@@ -1741,7 +1741,7 @@ async function ensureNpmLspInstalled(config2) {
     await fs4.mkdir(installDir, { recursive: true });
     let release = null;
     try {
-      release = await lockfile3.lock(installDir, {
+      release = await lockfile4.lock(installDir, {
         stale: 18e4,
         retries: { retries: 20, factor: 1.5, minTimeout: 500, maxTimeout: 5e3 },
         realpath: false
@@ -1755,7 +1755,7 @@ async function ensureNpmLspInstalled(config2) {
       if (await pathExists4(binPath)) {
         return { installed: false, skipped: "already-present" };
       }
-      const pkgJsonPath = join16(installDir, "package.json");
+      const pkgJsonPath = join17(installDir, "package.json");
       if (!await pathExists4(pkgJsonPath)) {
         await fs4.writeFile(pkgJsonPath, JSON.stringify({ name: "repowise-lsp-servers", private: true, version: "0.0.0" }, null, 2), "utf-8");
       }
@@ -1784,7 +1784,7 @@ async function ensureNpmLspInstalled(config2) {
 }
 async function resolveNpmCommand() {
   const nodeDir = dirname6(process.execPath);
-  for (const candidate of [join16(nodeDir, "npm"), join16(nodeDir, "npm.cmd")]) {
+  for (const candidate of [join17(nodeDir, "npm"), join17(nodeDir, "npm.cmd")]) {
     try {
       await fs4.access(candidate);
       return candidate;
@@ -1875,7 +1875,7 @@ async function detectRepoLanguages(repoRoot) {
       continue;
     if (name === "node_modules" || name === "dist" || name === "build")
       continue;
-    const sub = join16(repoRoot, name);
+    const sub = join17(repoRoot, name);
     try {
       const stat8 = await fs4.stat(sub);
       if (stat8.isDirectory())
@@ -1991,7 +1991,7 @@ var init_installer = __esm({
 
 // ../listener/dist/lsp/daemon-path.js
 import { homedir as homedir4 } from "os";
-import { delimiter, dirname as dirname7, join as join17 } from "path";
+import { delimiter, dirname as dirname7, join as join18 } from "path";
 function commonBinDirs() {
   const home = homedir4();
   return [
@@ -2004,13 +2004,13 @@ function commonBinDirs() {
     "/bin",
     "/usr/sbin",
     "/sbin",
-    join17(home, ".local", "bin"),
+    join18(home, ".local", "bin"),
     // pipx / pip --user / uv
-    join17(home, ".npm-global", "bin"),
+    join18(home, ".npm-global", "bin"),
     // common npm global prefix
-    join17(home, "go", "bin"),
+    join18(home, "go", "bin"),
     // gopls
-    join17(home, ".cargo", "bin")
+    join18(home, ".cargo", "bin")
     // rust-analyzer via cargo
   ];
 }
@@ -2046,9 +2046,9 @@ __export(service_installer_exports, {
   uninstall: () => uninstall
 });
 import { execFile as execFile4 } from "child_process";
-import { writeFile as writeFile8, mkdir as mkdir8, unlink as unlink6 } from "fs/promises";
+import { writeFile as writeFile9, mkdir as mkdir8, unlink as unlink7 } from "fs/promises";
 import { homedir as homedir5 } from "os";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 function exec(cmd, args) {
   return new Promise((resolve5, reject) => {
     execFile4(cmd, args, (err, stdout) => {
@@ -2067,10 +2067,10 @@ function sanitizeEnvValue(value) {
   return Array.from(value).filter((ch) => ch.charCodeAt(0) >= 32).join("");
 }
 function plistPath() {
-  return join18(homedir5(), "Library", "LaunchAgents", `${PLIST_LABEL}.plist`);
+  return join19(homedir5(), "Library", "LaunchAgents", `${PLIST_LABEL}.plist`);
 }
 function logDir() {
-  return join18(getConfigDir(), "logs");
+  return join19(getConfigDir(), "logs");
 }
 function buildPlist() {
   const cmd = resolveListenerCommand();
@@ -2104,9 +2104,9 @@ ${programArgs}
         <string>${xmlEscape(buildDaemonPath())}</string>
     </dict>
     <key>StandardOutPath</key>
-    <string>${xmlEscape(join18(logs, "listener-stdout.log"))}</string>
+    <string>${xmlEscape(join19(logs, "listener-stdout.log"))}</string>
     <key>StandardErrorPath</key>
-    <string>${xmlEscape(join18(logs, "listener-stderr.log"))}</string>
+    <string>${xmlEscape(join19(logs, "listener-stderr.log"))}</string>
     <key>ProcessType</key>
     <string>Background</string>
     <!--
@@ -2135,12 +2135,12 @@ ${programArgs}
 }
 async function darwinInstall() {
   await mkdir8(logDir(), { recursive: true });
-  await mkdir8(join18(homedir5(), "Library", "LaunchAgents"), { recursive: true });
+  await mkdir8(join19(homedir5(), "Library", "LaunchAgents"), { recursive: true });
   try {
     await exec("launchctl", ["unload", plistPath()]);
   } catch {
   }
-  await writeFile8(plistPath(), buildPlist());
+  await writeFile9(plistPath(), buildPlist());
   await exec("launchctl", ["load", plistPath()]);
 }
 async function darwinUninstall() {
@@ -2149,7 +2149,7 @@ async function darwinUninstall() {
   } catch {
   }
   try {
-    await unlink6(plistPath());
+    await unlink7(plistPath());
   } catch {
   }
 }
@@ -2162,7 +2162,7 @@ async function darwinIsInstalled() {
   }
 }
 function unitPath() {
-  return join18(homedir5(), ".config", "systemd", "user", `${SYSTEMD_SERVICE}.service`);
+  return join19(homedir5(), ".config", "systemd", "user", `${SYSTEMD_SERVICE}.service`);
 }
 function buildUnit() {
   const cmd = resolveListenerCommand();
@@ -2182,16 +2182,16 @@ Environment=PATH=${sanitizeEnvValue(buildDaemonPath())}
 ExecStart=${execStart}
 Restart=always
 RestartSec=10
-StandardOutput=append:${join18(logs, "listener-stdout.log")}
-StandardError=append:${join18(logs, "listener-stderr.log")}
+StandardOutput=append:${join19(logs, "listener-stdout.log")}
+StandardError=append:${join19(logs, "listener-stderr.log")}
 
 [Install]
 WantedBy=default.target`;
 }
 async function linuxInstall() {
   await mkdir8(logDir(), { recursive: true });
-  await mkdir8(join18(homedir5(), ".config", "systemd", "user"), { recursive: true });
-  await writeFile8(unitPath(), buildUnit());
+  await mkdir8(join19(homedir5(), ".config", "systemd", "user"), { recursive: true });
+  await writeFile9(unitPath(), buildUnit());
   await exec("systemctl", ["--user", "daemon-reload"]);
   await exec("systemctl", ["--user", "enable", SYSTEMD_SERVICE]);
   await exec("systemctl", ["--user", "start", SYSTEMD_SERVICE]);
@@ -2206,7 +2206,7 @@ async function linuxUninstall() {
   } catch {
   }
   try {
-    await unlink6(unitPath());
+    await unlink7(unitPath());
   } catch {
   }
   try {
@@ -2385,8 +2385,8 @@ __export(sidecar_cache_exports, {
   persistMergedSidecar: () => persistMergedSidecar,
   sidecarCachePaths: () => sidecarCachePaths
 });
-import { mkdir as mkdir9, readFile as readFile8, readdir as readdir3, stat as stat2, unlink as unlink8, writeFile as writeFile9 } from "fs/promises";
-import { dirname as dirname9, join as join20 } from "path";
+import { mkdir as mkdir9, readFile as readFile9, readdir as readdir3, stat as stat2, unlink as unlink9, writeFile as writeFile10 } from "fs/promises";
+import { dirname as dirname9, join as join21 } from "path";
 function repoIdSafe(repoId) {
   return /^[A-Za-z0-9_.-]{1,128}$/.test(repoId) && !repoId.startsWith(".");
 }
@@ -2400,17 +2400,17 @@ function sidecarCachePaths(repoId, commitSha) {
   if (!commitShaSafe(commitSha)) {
     throw new Error(`unsafe commitSha: ${commitSha}`);
   }
-  const repoDir = join20(getConfigDir(), "typed-resolution", repoId);
-  const fullPath = join20(repoDir, `${commitSha}.jsonl`);
+  const repoDir = join21(getConfigDir(), "typed-resolution", repoId);
+  const fullPath = join21(repoDir, `${commitSha}.jsonl`);
   return { fullPath, repoDir };
 }
 async function persistMergedSidecar(repoId, commitSha, sidecar) {
   const { fullPath, repoDir } = sidecarCachePaths(repoId, commitSha);
   await mkdir9(repoDir, { recursive: true });
   const tmpPath = `${fullPath}.tmp`;
-  await writeFile9(tmpPath, JSON.stringify(sidecar), "utf-8");
-  const { rename: rename5 } = await import("fs/promises");
-  await rename5(tmpPath, fullPath);
+  await writeFile10(tmpPath, JSON.stringify(sidecar), "utf-8");
+  const { rename: rename8 } = await import("fs/promises");
+  await rename8(tmpPath, fullPath);
   try {
     await sweepSidecarDir(repoDir);
   } catch {
@@ -2424,7 +2424,7 @@ async function sweepSidecarDir(repoDir) {
   const withMtime = [];
   for (const name of jsonlFiles) {
     try {
-      const s = await stat2(join20(repoDir, name));
+      const s = await stat2(join21(repoDir, name));
       withMtime.push({ name, mtimeMs: s.mtimeMs });
     } catch {
     }
@@ -2435,7 +2435,7 @@ async function sweepSidecarDir(repoDir) {
   for (const { name, mtimeMs } of candidates) {
     if (now - mtimeMs >= SWEEP_MAX_AGE_MS) {
       try {
-        await unlink8(join20(repoDir, name));
+        await unlink9(join21(repoDir, name));
       } catch {
       }
     }
@@ -2461,7 +2461,7 @@ async function loadMergedSidecar(repoId, commitSha) {
   let body;
   try {
     const { fullPath } = sidecarCachePaths(repoId, commitSha);
-    body = await readFile8(fullPath, "utf-8");
+    body = await readFile9(fullPath, "utf-8");
   } catch {
     return null;
   }
@@ -3133,15 +3133,15 @@ var init_telemetry = __esm({
 // bin/repowise.ts
 import { readFileSync as readFileSync3 } from "fs";
 import { fileURLToPath as fileURLToPath4 } from "url";
-import { dirname as dirname23, join as join62 } from "path";
+import { dirname as dirname23, join as join63 } from "path";
 import { Command } from "commander";
 
 // ../listener/dist/main.js
 init_config_dir();
-import { readFile as readFile13, writeFile as writeFile15, mkdir as mkdir16, stat as fsStat } from "fs/promises";
-import { join as join41, dirname as dirname17 } from "path";
+import { readFile as readFile14, writeFile as writeFile16, mkdir as mkdir16, stat as fsStat } from "fs/promises";
+import { join as join42, dirname as dirname17 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import lockfile4 from "proper-lockfile";
+import lockfile5 from "proper-lockfile";
 
 // ../../packages/shared/dist/lib/ai-tools.js
 import { readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2, readdir, stat, unlink as unlink2 } from "fs/promises";
@@ -4391,8 +4391,53 @@ function migrateState(state, oldId, newId) {
 
 // ../listener/dist/lib/auth.js
 init_config_dir();
-import { readFile as readFile5, writeFile as writeFile5, mkdir as mkdir5, chmod as chmod3 } from "fs/promises";
+import { readFile as readFile5, writeFile as writeFile5, mkdir as mkdir5, chmod as chmod3, rename as rename3, open as open3, unlink as unlink5 } from "fs/promises";
 import { join as join7 } from "path";
+
+// ../../packages/shared/dist/lib/creds.js
+function isCredsHardExpired(creds) {
+  if (!creds || typeof creds.expiresAt !== "number")
+    return true;
+  return Date.now() >= creds.expiresAt;
+}
+function classifyRefreshFailure(status2, body) {
+  if (status2 === 400 && body != null && /invalid_grant/i.test(body))
+    return "terminal";
+  return "transient";
+}
+var RefreshTokenError = class extends Error {
+  kind;
+  status;
+  constructor(kind, message, status2 = null) {
+    super(message);
+    this.name = "RefreshTokenError";
+    this.kind = kind;
+    this.status = status2;
+  }
+};
+
+// ../listener/dist/lib/auth.js
+import lockfile3 from "proper-lockfile";
+
+// ../listener/dist/lib/http.js
+async function fetchWithTimeout(url, init, timeoutMs) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    return await fetch(url, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// ../listener/dist/lib/auth.js
+var TOKEN_ENDPOINT_TIMEOUT_MS = 3e4;
+var REFRESH_MAX_ATTEMPTS = 3;
+var lastRefreshOutcome = "none";
+function getLastRefreshOutcome() {
+  return lastRefreshOutcome;
+}
+var sleepMs = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
 function getTokenUrl(creds) {
   const cognito = creds?.cognito;
   const domain = process.env["REPOWISE_COGNITO_DOMAIN"] ?? cognito?.domain ?? "auth-repowise-dev";
@@ -4406,24 +4451,33 @@ function getClientId(creds) {
 async function refreshTokens(refreshToken, creds) {
   const clientId = getClientId(creds);
   if (!clientId) {
-    throw new Error("No Cognito client ID available. Run `repowise login` first.");
+    throw new RefreshTokenError("terminal", "No Cognito client ID available. Run `repowise login` first.", null);
+  }
+  let response;
+  try {
+    response = await fetchWithTimeout(getTokenUrl(creds), {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "refresh_token",
+        client_id: clientId,
+        refresh_token: refreshToken
+      })
+    }, TOKEN_ENDPOINT_TIMEOUT_MS);
+  } catch (err) {
+    throw new RefreshTokenError("transient", `Token refresh network error: ${err instanceof Error ? err.message : String(err)}`, null);
   }
-  const response = await fetch(getTokenUrl(creds), {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "refresh_token",
-      client_id: clientId,
-      refresh_token: refreshToken
-    })
-  });
   if (!response.ok) {
-    throw new Error(`Token refresh failed: ${response.status}`);
+    const body = await response.text().catch(() => "");
+    throw new RefreshTokenError(classifyRefreshFailure(response.status, body), `Token refresh failed: ${response.status}`, response.status);
   }
   const data = await response.json();
   return {
     accessToken: data.access_token,
-    refreshToken,
+    // Carry forward a rotated refresh token when Cognito returns one; otherwise
+    // reuse the current token (rotation disabled today). Required before
+    // enabling refresh-token rotation server-side.
+    refreshToken: data.refresh_token ?? refreshToken,
     idToken: data.id_token,
     expiresAt: Date.now() + data.expires_in * 1e3,
     cognito: creds.cognito
@@ -4445,30 +4499,89 @@ async function storeCredentials(credentials) {
   const dir = getConfigDir();
   const credPath = join7(dir, "credentials.json");
   await mkdir5(dir, { recursive: true, mode: 448 });
-  await writeFile5(credPath, JSON.stringify(credentials, null, 2));
-  await chmod3(credPath, 384);
+  try {
+    await writeFile5(credPath, "", { flag: "a", mode: 384 });
+  } catch {
+  }
+  let release = null;
+  try {
+    release = await lockfile3.lock(credPath, { stale: 1e4, retries: 3, realpath: false });
+    const tmpPath = credPath + ".tmp";
+    try {
+      await writeFile5(tmpPath, JSON.stringify(credentials, null, 2), { mode: 384 });
+      let fh;
+      try {
+        fh = await open3(tmpPath, "r+");
+        await fh.datasync();
+      } finally {
+        await fh?.close();
+      }
+      await rename3(tmpPath, credPath);
+      await chmod3(credPath, 384);
+    } catch (err) {
+      try {
+        await unlink5(tmpPath);
+      } catch {
+      }
+      throw err;
+    }
+  } finally {
+    if (release) {
+      try {
+        await release();
+      } catch {
+      }
+    }
+  }
 }
+var refreshInFlight = null;
 async function getValidCredentials(options) {
   const creds = await getStoredCredentials();
-  if (!creds)
+  if (!creds) {
+    lastRefreshOutcome = "no-creds";
     return null;
+  }
   const now = Date.now();
   const needsRefresh = options?.forceRefresh || now > creds.expiresAt - 5 * 60 * 1e3;
-  if (needsRefresh) {
+  if (!needsRefresh) {
+    lastRefreshOutcome = "success";
+    return creds;
+  }
+  if (!refreshInFlight) {
+    refreshInFlight = doRefresh(creds).finally(() => {
+      refreshInFlight = null;
+    });
+  }
+  return refreshInFlight;
+}
+async function doRefresh(creds) {
+  for (let attempt = 1; attempt <= REFRESH_MAX_ATTEMPTS; attempt++) {
     try {
       const refreshed = await refreshTokens(creds.refreshToken, creds);
       await storeCredentials(refreshed);
+      lastRefreshOutcome = "success";
       return refreshed;
     } catch (err) {
+      const kind = err instanceof RefreshTokenError ? err.kind : "transient";
       const message = err instanceof Error ? err.message : String(err);
-      console.warn(`Token refresh failed: ${message}`);
-      if (now < creds.expiresAt) {
-        return creds;
+      if (kind === "terminal") {
+        lastRefreshOutcome = "terminal";
+        console.warn(`Token refresh rejected (terminal): ${message}`);
+        return null;
       }
+      if (attempt < REFRESH_MAX_ATTEMPTS) {
+        const backoffBase = Number(process.env["REPOWISE_REFRESH_BACKOFF_MS"] ?? 1e3);
+        await sleepMs(backoffBase * attempt);
+        continue;
+      }
+      lastRefreshOutcome = "transient";
+      console.warn(`Token refresh failed (transient, ${REFRESH_MAX_ATTEMPTS} attempts): ${message}`);
+      if (Date.now() < creds.expiresAt)
+        return creds;
       return null;
     }
   }
-  return creds;
+  return null;
 }
 
 // ../listener/dist/poll-client.js
@@ -4593,6 +4706,17 @@ function notifyContextUpdated(repoId, fileCount) {
   } catch {
   }
 }
+function notifyDocsReady(repoId) {
+  try {
+    notify({
+      title: TITLE,
+      // Start a NEW session (not just /mcp): an open AI session snapshots its
+      // instructions at start, and /mcp only reloads MCP connections.
+      message: `Full context docs are ready for ${repoId} \u2014 start a new AI session (or restart your AI tool) to use them.`
+    });
+  } catch {
+  }
+}
 
 // ../listener/dist/context-fetcher.js
 import { execFile as execFile2 } from "child_process";
@@ -4613,6 +4737,7 @@ async function verifyContextFolder(localPath) {
 }
 
 // ../listener/dist/context-fetcher.js
+var CONTEXT_FETCH_TIMEOUT_MS = 3e4;
 var execFileAsync = promisify(execFile2);
 async function fetchContextUpdates(localPath) {
   try {
@@ -4668,7 +4793,10 @@ async function fetchContextFromServer(repoId, localPath, apiUrl) {
     let listRes;
     for (let attempt = 1; attempt <= 3; attempt++) {
       try {
-        listRes = await fetch(`${apiUrl}/v1/repos/${repoId}/context`, { headers });
+        listRes = await fetch(`${apiUrl}/v1/repos/${repoId}/context`, {
+          headers,
+          signal: AbortSignal.timeout(CONTEXT_FETCH_TIMEOUT_MS)
+        });
         if (listRes.status === 401 || listRes.status === 403) {
           console.error(`Context list auth error (${listRes.status}) for repo ${repoId}`);
           return { success: false, updatedFiles: [] };
@@ -4700,7 +4828,8 @@ async function fetchContextFromServer(repoId, localPath, apiUrl) {
       if (file.fileName.includes(".."))
         continue;
       const urlRes = await fetch(`${apiUrl}/v1/repos/${repoId}/context/files/${file.fileName}`, {
-        headers
+        headers,
+        signal: AbortSignal.timeout(CONTEXT_FETCH_TIMEOUT_MS)
       });
       if (!urlRes.ok) {
         console.error(`Context fetch for ${repoId}: failed to get URL for ${file.fileName} (${urlRes.status})`);
@@ -4712,7 +4841,9 @@ async function fetchContextFromServer(repoId, localPath, apiUrl) {
         console.error(`Context fetch for ${repoId}: no presigned URL returned for ${file.fileName}`);
         continue;
       }
-      const contentRes = await fetch(presignedUrl);
+      const contentRes = await fetch(presignedUrl, {
+        signal: AbortSignal.timeout(CONTEXT_FETCH_TIMEOUT_MS)
+      });
       if (!contentRes.ok) {
         console.error(`Context fetch for ${repoId}: download failed for ${file.fileName} (${contentRes.status})`);
         continue;
@@ -4733,6 +4864,53 @@ async function fetchContextFromServer(repoId, localPath, apiUrl) {
   }
 }
 
+// ../listener/dist/docs-marker.js
+import { join as join10 } from "path";
+import { readFile as readFile6, writeFile as writeFile7, rename as rename4 } from "fs/promises";
+var DOCS_MARKER_NAME = ".repowise-meta.json";
+async function readDocsMarker(localPath, contextFolder) {
+  try {
+    const raw = await readFile6(join10(localPath, contextFolder, DOCS_MARKER_NAME), "utf-8");
+    const m = JSON.parse(raw);
+    if (typeof m.fileCount !== "number")
+      return null;
+    return {
+      commitSha: typeof m.commitSha === "string" ? m.commitSha : null,
+      fileCount: m.fileCount,
+      updatedAt: typeof m.updatedAt === "string" ? m.updatedAt : ""
+    };
+  } catch {
+    return null;
+  }
+}
+async function writeDocsMarker(localPath, contextFolder, commitSha, fileCount) {
+  const marker = {
+    commitSha,
+    fileCount,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const finalPath = join10(localPath, contextFolder, DOCS_MARKER_NAME);
+  const tmpPath = `${finalPath}.tmp`;
+  try {
+    await writeFile7(tmpPath, JSON.stringify(marker, null, 2), "utf-8");
+    await rename4(tmpPath, finalPath);
+  } catch (err) {
+    console.warn(`[docs-marker] failed to write provenance marker (${commitSha ?? "unknown commit"}): ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+function effectiveToolVariant(graphOnly, docsPresent, marker, lastSyncCommitSha) {
+  if (graphOnly)
+    return "graph";
+  if (!docsPresent)
+    return "graph";
+  if (!marker)
+    return "full";
+  if (lastSyncCommitSha && marker.commitSha && marker.commitSha !== lastSyncCommitSha) {
+    return "graph";
+  }
+  return "full";
+}
+
 // ../listener/dist/main.js
 init_process_manager();
 
@@ -4740,7 +4918,7 @@ init_process_manager();
 import { execFile as execFile3 } from "child_process";
 import { readFileSync } from "fs";
 import { access as access2, constants, realpath } from "fs/promises";
-import { dirname as dirname4, join as join11 } from "path";
+import { dirname as dirname4, join as join12 } from "path";
 import { promisify as promisify2 } from "util";
 var execFileAsync2 = promisify2(execFile3);
 var installInFlight = false;
@@ -4764,12 +4942,12 @@ async function installUpdate(currentVersion, packageName, targetVersion) {
   }
   installInFlight = true;
   try {
-    const npmWrapper = join11(dirname4(process.execPath), "npm");
+    const npmWrapper = join12(dirname4(process.execPath), "npm");
     const npmScript = await realpath(npmWrapper);
     const runNpm = (args) => execFileAsync2(process.execPath, [npmScript, ...args], { timeout: 6e4 });
     try {
       const { stdout: prefix } = await runNpm(["prefix", "-g"]);
-      const npmDir = join11(prefix.trim(), "lib", "node_modules");
+      const npmDir = join12(prefix.trim(), "lib", "node_modules");
       const checkDir = process.platform === "win32" ? prefix.trim() : npmDir;
       await access2(checkDir, constants.W_OK);
     } catch (err) {
@@ -4787,7 +4965,7 @@ async function installUpdate(currentVersion, packageName, targetVersion) {
     }
     try {
       const { stdout: prefix } = await runNpm(["prefix", "-g"]);
-      const installedPkgJson = join11(prefix.trim(), "lib", "node_modules", packageName, "package.json");
+      const installedPkgJson = join12(prefix.trim(), "lib", "node_modules", packageName, "package.json");
       const installedVersion = JSON.parse(readFileSync(installedPkgJson, "utf-8")).version;
       if (installedVersion !== targetVersion) {
         const msg = `post-install check failed: expected ${targetVersion}, found ${installedVersion ?? "unknown"}`;
@@ -4856,11 +5034,11 @@ function comparePrerelease(a, b) {
 
 // ../listener/dist/lib/binary-integrity.js
 import { createHash as createHash2 } from "crypto";
-import { lstat, open as open3, readdir as readdir2 } from "fs/promises";
+import { lstat, open as open4, readdir as readdir2 } from "fs/promises";
 import { constants as fsConstants } from "fs";
-import { join as join12, resolve as pathResolve } from "path";
+import { join as join13, resolve as pathResolve } from "path";
 async function verifyBinary(check) {
-  const fh = await open3(check.path, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
+  const fh = await open4(check.path, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
   const hash = createHash2("sha256");
   try {
     const stream = fh.createReadStream();
@@ -4908,7 +5086,7 @@ async function auditNativeBindings(rootDir, expected) {
       return;
     }
     for (const entryName of entries) {
-      const full = pathResolve(join12(dir, entryName));
+      const full = pathResolve(join13(dir, entryName));
       const entryStat = await lstat(full).catch(() => null);
       if (!entryStat)
         continue;
@@ -4949,8 +5127,8 @@ async function auditNativeBindings(rootDir, expected) {
 init_config_dir();
 init_process_manager();
 init_service_installer();
-import { unlink as unlink7 } from "fs/promises";
-import { join as join19 } from "path";
+import { unlink as unlink8 } from "fs/promises";
+import { join as join20 } from "path";
 async function getListenerStatus() {
   const pid = await readPid();
   if (pid !== null) {
@@ -4959,7 +5137,7 @@ async function getListenerStatus() {
       return { running: true, method: "pid", pid, serviceInstalled: serviceInstalled2 };
     }
     try {
-      await unlink7(join19(getConfigDir(), "listener.pid"));
+      await unlink8(join20(getConfigDir(), "listener.pid"));
     } catch {
     }
   }
@@ -5004,11 +5182,11 @@ async function stopListener() {
 
 // ../listener/dist/mcp/bootstrap.js
 init_config_dir();
-import { join as join23 } from "path";
+import { join as join24 } from "path";
 
 // ../listener/dist/lsp/workspace-session.js
 import { pathToFileURL } from "url";
-import { readFile as readFile7 } from "fs/promises";
+import { readFile as readFile8 } from "fs/promises";
 import { resolve as pathResolve2, sep as pathSep, dirname as dirname8, delimiter as delimiter2 } from "path";
 
 // ../listener/dist/lsp/lsp-client.js
@@ -5445,7 +5623,7 @@ var WorkspaceManager = class {
     }
     const absolute = this.joinPath(session.repoRoot, repoRelativePath);
     const p = (async () => {
-      const text = await readFile7(absolute, "utf-8");
+      const text = await readFile8(absolute, "utf-8");
       session.client.notify("textDocument/didOpen", {
         textDocument: {
           uri,
@@ -5720,8 +5898,8 @@ function buildLspSpawnPath(basePath, nodeDir, lspBinDirs) {
 
 // ../listener/dist/mcp/graph-cache.js
 init_config_dir();
-import { readFile as readFile9, stat as stat3 } from "fs/promises";
-import { join as join21 } from "path";
+import { readFile as readFile10, stat as stat3 } from "fs/promises";
+import { join as join22 } from "path";
 var EVICT_DEBOUNCE_MS = 6e4;
 function assertSafeRepoId(repoId) {
   if (!repoId || typeof repoId !== "string") {
@@ -5736,13 +5914,13 @@ function assertSafeRepoId(repoId) {
 }
 function createGraphCache(options = {}) {
   const evictMs = options.evictDebounceMs ?? EVICT_DEBOUNCE_MS;
-  const resolvePath = options.resolveGraphPath ?? ((repoId) => join21(defaultRepoWiseHome(), "graphs", `${repoId}.json`));
+  const resolvePath = options.resolveGraphPath ?? ((repoId) => join22(defaultRepoWiseHome(), "graphs", `${repoId}.json`));
   const entries = /* @__PURE__ */ new Map();
   const inFlight = /* @__PURE__ */ new Map();
   async function loadFromDisk(repoId) {
     const graphPath = resolvePath(repoId);
     const s = await stat3(graphPath);
-    const body = await readFile9(graphPath, "utf-8");
+    const body = await readFile10(graphPath, "utf-8");
     const graph = JSON.parse(body);
     if (graph.commitSha && Array.isArray(graph.edges)) {
       try {
@@ -5829,8 +6007,54 @@ function defaultRepoWiseHome() {
 }
 
 // ../listener/dist/mcp/graph-downloader.js
-import { mkdir as mkdir10, rename as rename3, writeFile as writeFile10 } from "fs/promises";
+import { mkdir as mkdir10, rename as rename5, writeFile as writeFile11 } from "fs/promises";
 import { dirname as dirname10 } from "path";
+var GRAPH_DOWNLOAD_TIMEOUT_MS = 45e3;
+var GRAPH_IDLE_TIMEOUT_MS = 6e4;
+async function fetchTextWithIdleTimeout(fetchFn, url, init, idleMs) {
+  const controller = new AbortController();
+  let timer = null;
+  const arm = () => {
+    if (timer)
+      clearTimeout(timer);
+    timer = setTimeout(() => controller.abort(), idleMs);
+  };
+  const disarm = () => {
+    if (timer)
+      clearTimeout(timer);
+    timer = null;
+  };
+  arm();
+  try {
+    const res = await fetchFn(url, { ...init, signal: controller.signal });
+    if (!res.ok) {
+      disarm();
+      return { res, text: "" };
+    }
+    const stream = res.body;
+    if (!stream || typeof stream.getReader !== "function") {
+      const text = await res.text();
+      disarm();
+      return { res, text };
+    }
+    const reader = stream.getReader();
+    const chunks = [];
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      if (value) {
+        chunks.push(value);
+        arm();
+      }
+    }
+    disarm();
+    return { res, text: Buffer.concat(chunks).toString("utf-8") };
+  } catch (err) {
+    disarm();
+    throw err;
+  }
+}
 function createGraphDownloader(options) {
   const fetchFn = options.fetchImpl ?? fetch;
   let lastSha = null;
@@ -5840,7 +6064,8 @@ function createGraphDownloader(options) {
     let repoRes;
     try {
       repoRes = await fetchFn(`${options.apiBaseUrl}/v1/repos/${options.repoId}`, {
-        headers: { Authorization: `Bearer ${token}` }
+        headers: { Authorization: `Bearer ${token}` },
+        signal: AbortSignal.timeout(GRAPH_DOWNLOAD_TIMEOUT_MS)
       });
     } catch (err) {
       return {
@@ -5864,15 +6089,23 @@ function createGraphDownloader(options) {
       return { state: "no-graph" };
     if (serverSha === lastSha)
       return { state: "unchanged", sha: serverSha };
-    const graphRes = await fetchFn(`${options.apiBaseUrl}/v1/repos/${options.repoId}/graph`, {
-      headers: { Authorization: `Bearer ${token}` }
-    });
+    let graphRes;
+    let body;
+    try {
+      const r = await fetchTextWithIdleTimeout(fetchFn, `${options.apiBaseUrl}/v1/repos/${options.repoId}/graph`, { headers: { Authorization: `Bearer ${token}` } }, GRAPH_IDLE_TIMEOUT_MS);
+      graphRes = r.res;
+      body = r.text;
+    } catch (err) {
+      return {
+        state: "error",
+        message: `graph fetch: ${err instanceof Error ? err.message : String(err)}`
+      };
+    }
     if (graphRes.status === 404)
       return { state: "no-graph" };
     if (!graphRes.ok) {
       return { state: "error", message: `graph status ${graphRes.status}` };
     }
-    const body = await graphRes.text();
     try {
       JSON.parse(body);
     } catch (err) {
@@ -5883,8 +6116,8 @@ function createGraphDownloader(options) {
     }
     await mkdir10(dirname10(options.targetPath), { recursive: true });
     const tmpPath = `${options.targetPath}.${Date.now()}.tmp`;
-    await writeFile10(tmpPath, body, { encoding: "utf-8", mode: 384 });
-    await rename3(tmpPath, options.targetPath);
+    await writeFile11(tmpPath, body, { encoding: "utf-8", mode: 384 });
+    await rename5(tmpPath, options.targetPath);
     options.graphCache.invalidate(options.repoId);
     lastSha = serverSha;
     return { state: "downloaded", sha: serverSha };
@@ -5904,9 +6137,112 @@ function createGraphDownloader(options) {
   };
 }
 
+// ../listener/dist/mcp/heartbeat.js
+import { setTimeout as delay2 } from "timers/promises";
+var DEFAULT_WINDOW = 60 * 60 * 1e3;
+function emptyStatusCounts() {
+  return { ok: 0, error: 0, timeout: 0, rejected: 0 };
+}
+function emptyHealthCounters() {
+  return {
+    graphNotLoaded: 0,
+    unknownRepo: 0,
+    lspDisabled: 0,
+    lspUnavailable: 0,
+    connectFail: 0,
+    preAuthFail: 0
+  };
+}
+function createHeartbeatEmitter(opts) {
+  const windowMs = opts.windowMs ?? DEFAULT_WINDOW;
+  const now = opts.now ?? (() => Date.now());
+  let bucketStart = Math.floor(now() / windowMs) * windowMs;
+  let toolCounts = /* @__PURE__ */ new Map();
+  let missCounts = /* @__PURE__ */ new Map();
+  let statusCounts = emptyStatusCounts();
+  let healthCounters = emptyHealthCounters();
+  function hasData() {
+    if (toolCounts.size > 0 || missCounts.size > 0)
+      return true;
+    for (const k of Object.keys(statusCounts)) {
+      if (statusCounts[k] > 0)
+        return true;
+    }
+    for (const k of Object.keys(healthCounters)) {
+      if (healthCounters[k] > 0)
+        return true;
+    }
+    return false;
+  }
+  function buildPayload() {
+    return {
+      listenerVersion: opts.listenerVersion,
+      windowStartsAt: new Date(bucketStart).toISOString(),
+      toolCounts: Object.fromEntries(toolCounts),
+      statusCounts,
+      missCounts: Object.fromEntries(missCounts),
+      healthCounters
+    };
+  }
+  function clearCounters() {
+    toolCounts = /* @__PURE__ */ new Map();
+    missCounts = /* @__PURE__ */ new Map();
+    statusCounts = emptyStatusCounts();
+    healthCounters = emptyHealthCounters();
+  }
+  async function flushIfDue(currentBucket) {
+    if (currentBucket === bucketStart)
+      return;
+    const payload = buildPayload();
+    bucketStart = currentBucket;
+    clearCounters();
+    try {
+      await opts.sink.post(payload);
+    } catch {
+    }
+  }
+  return {
+    record(tool, outcome) {
+      toolCounts.set(tool, (toolCounts.get(tool) ?? 0) + 1);
+      if ("health" in outcome) {
+        healthCounters[outcome.health] += 1;
+      } else {
+        statusCounts[outcome.status] += 1;
+        if (outcome.miss)
+          missCounts.set(tool, (missCounts.get(tool) ?? 0) + 1);
+      }
+    },
+    recordHealth(kind) {
+      healthCounters[kind] += 1;
+    },
+    async tick(nowOverride) {
+      const current = Math.floor((nowOverride ?? now()) / windowMs) * windowMs;
+      await flushIfDue(current);
+    },
+    async flush() {
+      if (!hasData())
+        return;
+      const payload = buildPayload();
+      clearCounters();
+      try {
+        await opts.sink.post(payload);
+      } catch {
+      }
+    }
+  };
+}
+async function runHeartbeatLoop(emitter, opts = {}) {
+  const tickMs = opts.tickMs ?? 6e4;
+  while (!opts.signal?.aborted) {
+    await emitter.tick();
+    await delay2(tickMs, void 0, { signal: opts.signal }).catch(() => {
+    });
+  }
+}
+
 // ../listener/dist/mcp/log-encryption.js
 import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
-import { mkdir as mkdir11, readFile as readFile10, stat as stat4, writeFile as writeFile11 } from "fs/promises";
+import { mkdir as mkdir11, readFile as readFile11, stat as stat4, writeFile as writeFile12 } from "fs/promises";
 import { dirname as dirname11 } from "path";
 var KEY_BYTES = 32;
 var IV_BYTES = 12;
@@ -5934,7 +6270,7 @@ function createFileKeyStore(keyPath) {
         return cached;
       let parsed = null;
       try {
-        const body = await readFile10(keyPath, "utf-8");
+        const body = await readFile11(keyPath, "utf-8");
         const decoded = Buffer.from(body.trim(), "base64");
         if (decoded.length === KEY_BYTES)
           parsed = decoded;
@@ -5956,12 +6292,12 @@ function createFileKeyStore(keyPath) {
       const fresh = randomBytes(KEY_BYTES);
       await mkdir11(dirname11(keyPath), { recursive: true });
       const tmp = `${keyPath}.tmp`;
-      await writeFile11(tmp, fresh.toString("base64") + "\n", {
+      await writeFile12(tmp, fresh.toString("base64") + "\n", {
         encoding: "utf-8",
         mode: 384
       });
-      const { rename: rename5 } = await import("fs/promises");
-      await rename5(tmp, keyPath);
+      const { rename: rename8 } = await import("fs/promises");
+      await rename8(tmp, keyPath);
       cached = fresh;
       try {
         const s = await stat4(keyPath);
@@ -5995,7 +6331,7 @@ function decryptLine(encoded, key) {
 }
 
 // ../listener/dist/mcp/mcp-logger.js
-import { appendFile, mkdir as mkdir12, stat as stat5, unlink as unlink9, writeFile as writeFile12, readFile as readFile11 } from "fs/promises";
+import { appendFile, mkdir as mkdir12, stat as stat5, unlink as unlink10, writeFile as writeFile13, readFile as readFile12 } from "fs/promises";
 import { dirname as dirname12 } from "path";
 var DEFAULT_MAX_BYTES = 100 * 1024 * 1024;
 function createMcpLogger(options) {
@@ -6010,7 +6346,7 @@ function createMcpLogger(options) {
     if (legacyPath === options.filePath)
       return;
     try {
-      await unlink9(legacyPath);
+      await unlink10(legacyPath);
       console.log(`[mcp-logger] removed legacy plaintext log at ${legacyPath} (one-time migration)`);
     } catch {
     }
@@ -6041,19 +6377,20 @@ function createMcpLogger(options) {
 }
 async function rotate(path, size) {
   const dropAt = Math.floor(size * 0.25);
-  const body = await readFile11(path, "utf-8");
+  const body = await readFile12(path, "utf-8");
   const idx = body.indexOf("\n", dropAt);
   if (idx < 0) {
-    await writeFile12(path, "", { encoding: "utf-8", mode: 384 });
+    await writeFile13(path, "", { encoding: "utf-8", mode: 384 });
     return;
   }
-  await writeFile12(path, body.slice(idx + 1), { encoding: "utf-8", mode: 384 });
+  await writeFile13(path, body.slice(idx + 1), { encoding: "utf-8", mode: 384 });
 }
 
 // ../listener/dist/mcp/mcp-log-uploader.js
 import { randomUUID } from "crypto";
-import { readFile as readFile12, writeFile as writeFile13, mkdir as mkdir13 } from "fs/promises";
+import { readFile as readFile13, writeFile as writeFile14, mkdir as mkdir13 } from "fs/promises";
 import { dirname as dirname13 } from "path";
+var MCP_LOG_UPLOAD_TIMEOUT_MS = 3e4;
 var DEFAULT_MAX_ENTRIES = 5e3;
 var DEFAULT_MAX_BYTES2 = 1 * 1024 * 1024;
 function createMcpLogUploader(options) {
@@ -6078,7 +6415,7 @@ function createMcpLogUploader(options) {
       }
       let body;
       try {
-        body = await readFile12(options.logFilePath, "utf-8");
+        body = await readFile13(options.logFilePath, "utf-8");
       } catch (err) {
         if (err.code === "ENOENT") {
           return { uploaded: 0, bytesAdvanced: 0 };
@@ -6150,7 +6487,8 @@ function createMcpLogUploader(options) {
           "Content-Type": "application/json",
           Authorization: `Bearer ${token}`
         },
-        body: uploadBody
+        body: uploadBody,
+        signal: AbortSignal.timeout(MCP_LOG_UPLOAD_TIMEOUT_MS)
       });
       if (res.status === 401 && options.getAuthTokenForceRefresh) {
         try {
@@ -6161,7 +6499,8 @@ function createMcpLogUploader(options) {
               "Content-Type": "application/json",
               Authorization: `Bearer ${freshToken}`
             },
-            body: uploadBody
+            body: uploadBody,
+            signal: AbortSignal.timeout(MCP_LOG_UPLOAD_TIMEOUT_MS)
           });
         } catch {
         }
@@ -6195,7 +6534,7 @@ function pendingPath(watermarkPath) {
 }
 async function readPendingBatch(watermarkPath) {
   try {
-    const body = await readFile12(pendingPath(watermarkPath), "utf-8");
+    const body = await readFile13(pendingPath(watermarkPath), "utf-8");
     const trimmed = body.trim();
     return /^[A-Za-z0-9-]{8,128}$/.test(trimmed) ? trimmed : null;
   } catch {
@@ -6204,18 +6543,18 @@ async function readPendingBatch(watermarkPath) {
 }
 async function writePendingBatch(watermarkPath, batchId) {
   await mkdir13(dirname13(watermarkPath), { recursive: true });
-  await writeFile13(pendingPath(watermarkPath), batchId, { encoding: "utf-8", mode: 384 });
+  await writeFile14(pendingPath(watermarkPath), batchId, { encoding: "utf-8", mode: 384 });
 }
 async function clearPendingBatch(watermarkPath) {
-  const { unlink: unlink12 } = await import("fs/promises");
+  const { unlink: unlink14 } = await import("fs/promises");
   try {
-    await unlink12(pendingPath(watermarkPath));
+    await unlink14(pendingPath(watermarkPath));
   } catch {
   }
 }
 async function readWatermark(path) {
   try {
-    const body = await readFile12(path, "utf-8");
+    const body = await readFile13(path, "utf-8");
     const parsed = Number.parseInt(body.trim(), 10);
     return Number.isFinite(parsed) && parsed >= 0 ? parsed : 0;
   } catch (err) {
@@ -6227,13 +6566,13 @@ async function readWatermark(path) {
 async function writeWatermark(path, offset) {
   await mkdir13(dirname13(path), { recursive: true });
   const tmp = `${path}.tmp`;
-  await writeFile13(tmp, offset.toString() + "\n", { encoding: "utf-8", mode: 384 });
-  const { rename: rename5 } = await import("fs/promises");
-  await rename5(tmp, path);
+  await writeFile14(tmp, offset.toString() + "\n", { encoding: "utf-8", mode: 384 });
+  const { rename: rename8 } = await import("fs/promises");
+  await rename8(tmp, path);
 }
 async function isLocallyConsented(flagPath2) {
   try {
-    const body = await readFile12(flagPath2, "utf-8");
+    const body = await readFile13(flagPath2, "utf-8");
     const parsed = JSON.parse(body);
     return parsed.enabled !== false;
   } catch {
@@ -6244,8 +6583,8 @@ async function isLocallyConsented(flagPath2) {
 // ../listener/dist/mcp/mcp-server.js
 init_config_dir();
 import { createServer } from "http";
-import { mkdir as mkdir14, writeFile as writeFile14 } from "fs/promises";
-import { dirname as dirname14, join as join22 } from "path";
+import { mkdir as mkdir14, writeFile as writeFile15, unlink as unlink11 } from "fs/promises";
+import { dirname as dirname14, join as join23 } from "path";
 import { createHash as createHash4, randomUUID as randomUUID2 } from "crypto";
 
 // ../listener/dist/mcp/sanitize.js
@@ -7309,7 +7648,16 @@ async function startMcpServer(options) {
     secret: secretState.value.current,
     close: () => new Promise((resolve5, reject) => {
       server.close((err) => err ? reject(err) : resolve5());
-    })
+    }),
+    suspendEndpoint: async () => {
+      try {
+        await unlink11(endpointFilePath);
+      } catch (err) {
+        if (err.code !== "ENOENT")
+          throw err;
+      }
+    },
+    resumeEndpoint: () => writeEndpointFile(endpointFilePath, endpoint, secretState.value.current)
   };
 }
 function handleRequest(req, res, options, sessions, secretCtx) {
@@ -7333,11 +7681,13 @@ function handleRequest(req, res, options, sessions, secretCtx) {
     const rawHost = req.headers.host;
     const hostHeader = typeof rawHost === "string" ? rawHost : Array.isArray(rawHost) && typeof rawHost[0] === "string" ? rawHost[0] : void 0;
     if (!isHostAllowed(hostHeader)) {
+      options.heartbeat?.recordHealth("preAuthFail");
       sendJson(res, 403, { error: "invalid_host" });
       return;
     }
     const bearer = extractBearer(req.headers.authorization);
     if (!isTokenValid(bearer, secretCtx.getSecret(), secretCtx.clock())) {
+      options.heartbeat?.recordHealth("preAuthFail");
       sendJson(res, 401, { error: "invalid_token" });
       return;
     }
@@ -7355,6 +7705,7 @@ function handleRequest(req, res, options, sessions, secretCtx) {
       const rawMsg = err instanceof Error ? err.message : String(err);
       const safeMsg = stripAbsolutePaths(rawMsg);
       if (err?.code === "ENOENT") {
+        options.heartbeat?.recordHealth("connectFail");
         return sendJson(res, 404, { error: "unknown_repo" });
       }
       sendJson(res, 500, { error: safeMsg });
@@ -7529,7 +7880,7 @@ function handleRequest(req, res, options, sessions, secretCtx) {
   })();
   if (method === "POST" && lspDispatch[url]) {
     const lspHandler = lspDispatch[url];
-    dispatchSessionTool(req, res, url, sessions, options.mcpLogger, async (session, body) => {
+    dispatchSessionTool(req, res, url, sessions, options.mcpLogger, options.heartbeat, async (session, body) => {
       if (options.getLspEnabled && options.getLspEnabled() === false) {
         return {
           ok: true,
@@ -7551,14 +7902,17 @@ function handleRequest(req, res, options, sessions, secretCtx) {
           }
         };
       }
-      const value = await Promise.race([lspHandler(body, root), timeoutAfter(TOOL_TIMEOUT_MS_LSP)]);
+      const value = await Promise.race([
+        lspHandler(body, root),
+        timeoutAfter(TOOL_TIMEOUT_MS_LSP)
+      ]);
       return { ok: true, value };
     });
     return;
   }
   if (method === "POST" && toolDispatch[url]) {
     const handler = toolDispatch[url];
-    dispatchSessionTool(req, res, url, sessions, options.mcpLogger, async (session, body) => {
+    dispatchSessionTool(req, res, url, sessions, options.mcpLogger, options.heartbeat, async (session, body) => {
       const graph = options.graphCache.peek(session.repoId);
       if (!graph) {
         return {
@@ -7591,7 +7945,7 @@ function handleRequest(req, res, options, sessions, secretCtx) {
   }
   sendJson(res, 404, { error: "not_found" });
 }
-function dispatchSessionTool(req, res, url, sessions, logger, handler) {
+function dispatchSessionTool(req, res, url, sessions, logger, heartbeat, handler) {
   const tool = url.replace("/mcp/tools/", "");
   const startedAt = Date.now();
   void readJson(req).then(async (body) => {
@@ -7610,6 +7964,7 @@ function dispatchSessionTool(req, res, url, sessions, logger, handler) {
         error: "unknown_session"
       });
       logToStdout("rejected", tool, null, Date.now() - startedAt, "unknown_session");
+      heartbeat?.record(tool, { status: "rejected" });
       return sendJson(res, 404, { error: "unknown_session" });
     }
     try {
@@ -7625,6 +7980,8 @@ function dispatchSessionTool(req, res, url, sessions, logger, handler) {
           latencyMs: Date.now() - startedAt
         });
         logToStdout("ok", tool, session.repoId, Date.now() - startedAt);
+        const classification = classifyToolResult(tool, result.value);
+        heartbeat?.record(tool, classification.kind === "health" ? { health: classification.health } : { status: classification.status, miss: classification.miss });
         return sendJson(res, 200, result.value);
       }
       const rejectErr = typeof result.body["error"] === "string" ? result.body["error"] : "tool_rejected";
@@ -7639,9 +7996,11 @@ function dispatchSessionTool(req, res, url, sessions, logger, handler) {
         error: rejectErr
       });
       logToStdout("rejected", tool, session.repoId, Date.now() - startedAt, rejectErr);
+      heartbeat?.record(tool, { status: "rejected" });
       return sendJson(res, result.status, result.body);
     } catch (err) {
-      const isTimeout = err instanceof ToolTimeoutError;
+      const thrown = classifyThrow(err);
+      const isTimeout = thrown.status === "timeout";
       const rawMsg = err instanceof Error ? err.message : String(err);
       const safeMsg = stripAbsolutePaths(rawMsg);
       recordLog(logger, {
@@ -7655,6 +8014,7 @@ function dispatchSessionTool(req, res, url, sessions, logger, handler) {
         error: safeMsg
       });
       logToStdout("error", tool, session.repoId, Date.now() - startedAt, safeMsg);
+      heartbeat?.record(tool, { status: thrown.status });
       if (isTimeout) {
         return sendJson(res, 200, {
           error: `tool-timeout: ${tool} exceeded its execution budget`,
@@ -7731,6 +8091,73 @@ var ToolTimeoutError = class extends Error {
     this.timeoutMs = ms;
   }
 };
+function asRecord(value) {
+  return typeof value === "object" && value !== null ? value : void 0;
+}
+function arrayLen(rec, key) {
+  const val = rec?.[key];
+  return Array.isArray(val) ? val.length : void 0;
+}
+function nested(rec, key) {
+  return asRecord(rec?.[key]);
+}
+var MISS_PREDICATES = {
+  find_symbol: (v) => arrayLen(v, "matches") === 0,
+  search_pattern: (v) => arrayLen(v, "matches") === 0,
+  get_symbol: (v) => v?.["symbol"] === null,
+  find_callers: (v) => arrayLen(v, "callers") === 0,
+  find_references: (v) => arrayLen(v, "references") === 0,
+  get_deps: (v) => arrayLen(v, "dependencies") === 0,
+  find_tests_for_symbol: (v) => arrayLen(v, "tests") === 0,
+  get_impact: (v) => arrayLen(v, "impacted") === 0,
+  list_edges: (v) => nested(v, "coverage")?.["filteredEdges"] === 0,
+  get_call_graph: (v) => arrayLen(nested(v, "subgraph"), "edges") === 0,
+  lsp_definition: (v) => arrayLen(v, "locations") === 0,
+  lsp_implementation: (v) => arrayLen(v, "locations") === 0,
+  lsp_references: (v) => arrayLen(v, "locations") === 0,
+  lsp_hover: (v) => !v?.["contents"],
+  lsp_workspace_symbol: (v) => arrayLen(v, "symbols") === 0,
+  lsp_document_symbol: (v) => arrayLen(v, "symbols") === 0,
+  lsp_call_hierarchy: (v) => arrayLen(v, "edges") === 0,
+  lsp_type_hierarchy: (v) => arrayLen(v, "entries") === 0
+};
+function isMiss(tool, value) {
+  const pred = MISS_PREDICATES[tool];
+  if (!pred)
+    return false;
+  try {
+    return pred(asRecord(value));
+  } catch {
+    return false;
+  }
+}
+function classifyToolResult(tool, value) {
+  const v = asRecord(value);
+  if (v && v["isError"] === true) {
+    const err = typeof v["error"] === "string" ? v["error"] : "";
+    if (err === "graph_not_loaded")
+      return { kind: "health", health: "graphNotLoaded" };
+    if (err === "unknown_repo")
+      return { kind: "health", health: "unknownRepo" };
+    if (err === "lsp_disabled")
+      return { kind: "health", health: "lspDisabled" };
+    if (err.startsWith("no-server-available") || err.startsWith("unsupported-language")) {
+      return { kind: "health", health: "lspUnavailable" };
+    }
+    if (v["invalidPattern"] === true || v["unsafePattern"] === true || / required \(/.test(err)) {
+      return { kind: "status", status: "rejected", miss: false };
+    }
+    return { kind: "status", status: "error", miss: false };
+  }
+  return { kind: "status", status: "ok", miss: isMiss(tool, value) };
+}
+function classifyThrow(err) {
+  return {
+    kind: "status",
+    status: err instanceof ToolTimeoutError ? "timeout" : "error",
+    miss: false
+  };
+}
 function stripAbsolutePaths(msg) {
   return msg.replace(/(?:^|(?<=\s|[:(,]))\/[\w.\-/]+/g, "<redacted-path>");
 }
@@ -7764,7 +8191,7 @@ async function readJson(req) {
 }
 async function writeEndpointFile(path, endpoint, secret) {
   await mkdir14(dirname14(path), { recursive: true });
-  await writeFile14(path, formatEndpointFile({ endpoint, secret }), {
+  await writeFile15(path, formatEndpointFile({ endpoint, secret }), {
     encoding: "utf-8",
     mode: 384
   });
@@ -7777,7 +8204,7 @@ function extractBearer(header) {
   return m ? m[1] : null;
 }
 function defaultEndpointFile() {
-  return join22(getConfigDir(), "listener.endpoint");
+  return join23(getConfigDir(), "listener.endpoint");
 }
 
 // ../listener/dist/mcp/bootstrap.js
@@ -7785,7 +8212,7 @@ async function startMcp(options) {
   const disabled = process.env.REPOWISE_MCP_DISABLED === "true";
   const graphsDir = options.graphsDir ?? defaultGraphsDir();
   const graphCache = createGraphCache({
-    resolveGraphPath: (repoId) => join23(graphsDir, `${repoId}.json`)
+    resolveGraphPath: (repoId) => join24(graphsDir, `${repoId}.json`)
   });
   if (disabled) {
     return {
@@ -7807,13 +8234,14 @@ async function startMcp(options) {
       repoIdToRoot.set(repo.repoId, repo.localPath);
   }
   const firstRepoLocal = options.repos.find((r) => r.localPath)?.localPath;
+  const rawMcpLogEnabled = process.env["REPOWISE_MCP_LOG_RAW_ENABLED"] === "true";
   const mcpHome = defaultMcpHome();
-  const logFilePath = join23(mcpHome, "mcp-log.jsonl.enc");
-  const keyStore = createFileKeyStore(join23(mcpHome, "mcp-log.key"));
-  const mcpLogger = createMcpLogger({ filePath: logFilePath, keyStore });
-  const flagFilePath = join23(mcpHome, "mcp-log.flag");
-  const watermarkFilePath = join23(mcpHome, "mcp-log.watermark");
-  const consentSentMarkerPath = join23(mcpHome, "mcp-log.consent-sent");
+  const logFilePath = join24(mcpHome, "mcp-log.jsonl.enc");
+  const keyStore = createFileKeyStore(join24(mcpHome, "mcp-log.key"));
+  const mcpLogger = rawMcpLogEnabled ? createMcpLogger({ filePath: logFilePath, keyStore }) : void 0;
+  const flagFilePath = join24(mcpHome, "mcp-log.flag");
+  const watermarkFilePath = join24(mcpHome, "mcp-log.watermark");
+  const consentSentMarkerPath = join24(mcpHome, "mcp-log.consent-sent");
   let uploader = null;
   let lastConsentState = false;
   let serverConsentEnsuredThisProcess = false;
@@ -7835,6 +8263,18 @@ async function startMcp(options) {
     });
     return uploader;
   }
+  const heartbeatEnabled = process.env["REPOWISE_MCP_HEARTBEAT_DISABLED"] !== "true";
+  const heartbeatApiUrl = options.repos.find((r) => Boolean(r.apiUrl))?.apiUrl ?? options.repos[0]?.apiUrl ?? "";
+  const heartbeatEmitter = heartbeatEnabled ? createHeartbeatEmitter({
+    listenerVersion: options.listenerVersion ?? "",
+    sink: createHeartbeatSink({
+      apiUrl: heartbeatApiUrl,
+      getAuthToken: options.getAuthToken,
+      flagFilePath,
+      ...options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}
+    })
+  }) : null;
+  const heartbeatAbort = heartbeatEmitter ? new AbortController() : null;
   const server = await startMcpServer({
     graphCache,
     ...lspWorkspaces ? { lspWorkspaces } : {},
@@ -7842,8 +8282,14 @@ async function startMcp(options) {
     repoIdToRoot: () => repoIdToRoot,
     ...options.getLspOverrides ? { getLspOverrides: options.getLspOverrides } : {},
     ...options.getLspEnabled ? { getLspEnabled: options.getLspEnabled } : {},
-    mcpLogger
+    ...heartbeatEmitter ? { heartbeat: heartbeatEmitter } : {},
+    // T11 — undefined unless the raw-log escape hatch is set; recordLog
+    // no-ops on an undefined logger so dispatch is unaffected.
+    ...mcpLogger ? { mcpLogger } : {}
   });
+  if (heartbeatEmitter && heartbeatAbort) {
+    void runHeartbeatLoop(heartbeatEmitter, { signal: heartbeatAbort.signal });
+  }
   const reapInterval = lspWorkspaces ? setInterval(() => {
     void lspWorkspaces.reapIdle().catch((err) => {
       console.warn(`[lsp] reapIdle failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -7860,7 +8306,7 @@ async function startMcp(options) {
       apiBaseUrl: repo.apiUrl,
       getAuthToken: options.getAuthToken,
       repoId: repo.repoId,
-      targetPath: join23(graphsDir, `${repo.repoId}.json`),
+      targetPath: join24(graphsDir, `${repo.repoId}.json`),
       graphCache,
       ...options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}
     }));
@@ -7886,6 +8332,9 @@ async function startMcp(options) {
       return results;
     },
     async runMcpLogUpload() {
+      if (!rawMcpLogEnabled) {
+        return { uploaded: 0, skipped: "no-consent" };
+      }
       if (process.env["REPOWISE_MCP_LOG_UPLOAD_DISABLED"] === "true") {
         return { uploaded: 0, skipped: "no-consent" };
       }
@@ -7945,7 +8394,7 @@ async function startMcp(options) {
           apiBaseUrl: repo.apiUrl,
           getAuthToken: options.getAuthToken,
           repoId: repo.repoId,
-          targetPath: join23(graphsDir, `${repo.repoId}.json`),
+          targetPath: join24(graphsDir, `${repo.repoId}.json`),
           graphCache,
           ...options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}
         }));
@@ -7954,6 +8403,10 @@ async function startMcp(options) {
     async close() {
       if (reapInterval)
         clearInterval(reapInterval);
+      if (heartbeatAbort)
+        heartbeatAbort.abort();
+      if (heartbeatEmitter)
+        await heartbeatEmitter.flush();
       await server.close();
       if (lspWorkspaces) {
         try {
@@ -7965,8 +8418,40 @@ async function startMcp(options) {
     }
   };
 }
+function createHeartbeatSink(deps) {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  return {
+    async post(payload) {
+      if (process.env["REPOWISE_MCP_HEARTBEAT_DISABLED"] === "true")
+        return;
+      if (!deps.apiUrl)
+        return;
+      if (!await isLocallyConsented(deps.flagFilePath))
+        return;
+      let token;
+      try {
+        token = await deps.getAuthToken();
+      } catch {
+        return;
+      }
+      if (!token)
+        return;
+      const res = await fetchImpl(`${deps.apiUrl}/v1/listeners/mcp-heartbeat`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${token}`
+        },
+        body: JSON.stringify(payload)
+      });
+      if (res && !res.ok) {
+        console.warn(`[mcp-heartbeat] upload rejected (HTTP ${res.status}) \u2014 possible payload/contract drift`);
+      }
+    }
+  };
+}
 function defaultGraphsDir() {
-  return join23(getConfigDir(), "graphs");
+  return join24(getConfigDir(), "graphs");
 }
 function defaultMcpHome() {
   return getConfigDir();
@@ -7984,8 +8469,8 @@ async function ensureServerConsent(opts) {
   if (!opts.apiUrl)
     return;
   try {
-    const { readFile: readFile18 } = await import("fs/promises");
-    await readFile18(opts.markerPath, "utf-8");
+    const { readFile: readFile19 } = await import("fs/promises");
+    await readFile19(opts.markerPath, "utf-8");
     return;
   } catch {
   }
@@ -8024,7 +8509,7 @@ import { basename as basename3 } from "path";
 
 // ../listener/dist/mcp/auto-config/writers/claude-code.js
 import { promises as fs6 } from "fs";
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 
 // ../listener/dist/mcp/auto-config/markers.js
 import { promises as fs5 } from "fs";
@@ -8104,10 +8589,10 @@ function safeExistingContent(path, current) {
 var claudeCodeWriter = {
   tool: "claude-code",
   async detect(repoRoot, home) {
-    return await fileExists2(join24(repoRoot, "CLAUDE.md")) || await hasClaudeBinary(home);
+    return await fileExists2(join25(repoRoot, "CLAUDE.md")) || await hasClaudeBinary(home);
   },
   async write(ctx) {
-    const path = join24(ctx.repoRoot, ".mcp.json");
+    const path = join25(ctx.repoRoot, ".mcp.json");
     await removeFromConfig(path, `repowise-${ctx.repoId}`);
     const status2 = await writeMergedConfig({
       path,
@@ -8117,7 +8602,7 @@ var claudeCodeWriter = {
     return { status: status2, path };
   },
   async remove(ctx) {
-    const path = join24(ctx.repoRoot, ".mcp.json");
+    const path = join25(ctx.repoRoot, ".mcp.json");
     await removeFromConfig(path, `RepoWise MCP for ${ctx.repoName}`);
     await removeFromConfig(path, `repowise-${ctx.repoId}`);
   }
@@ -8131,20 +8616,20 @@ async function fileExists2(path) {
   }
 }
 async function hasClaudeBinary(home) {
-  return fileExists2(join24(home, ".claude", "claude.json"));
+  return fileExists2(join25(home, ".claude", "claude.json"));
 }
 
 // ../listener/dist/mcp/auto-config/writers/claude-code-hooks.js
 import { promises as fs7 } from "fs";
-import { join as join25 } from "path";
+import { join as join26 } from "path";
 var claudeCodeHooksWriter = {
   tool: "claude-code-hooks",
   async detect(repoRoot, home) {
-    return await fileExists3(join25(repoRoot, "CLAUDE.md")) || await fileExists3(join25(home, ".claude.json"));
+    return await fileExists3(join26(repoRoot, "CLAUDE.md")) || await fileExists3(join26(home, ".claude.json"));
   },
   async write(ctx) {
     const result = await writeClaudeHooksToRepo(ctx.repoRoot, ctx.contextFolder ?? "repowise-context", ctx.variant);
-    return { status: result.status, path: join25(ctx.repoRoot, result.relPath) };
+    return { status: result.status, path: join26(ctx.repoRoot, result.relPath) };
   },
   async remove(ctx) {
     await removeClaudeHooksFromRepo(ctx.repoRoot);
@@ -8161,14 +8646,14 @@ async function fileExists3(path) {
 
 // ../listener/dist/mcp/auto-config/writers/cline.js
 import { promises as fs8 } from "fs";
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 var clineWriter = {
   tool: "cline",
   async detect(repoRoot, home) {
-    return await fileExists4(join26(repoRoot, ".clinerules")) || await fileExists4(join26(home, ".cline"));
+    return await fileExists4(join27(repoRoot, ".clinerules")) || await fileExists4(join27(home, ".cline"));
   },
   async write(ctx) {
-    const path = join26(ctx.home, ".cline", "mcp.json");
+    const path = join27(ctx.home, ".cline", "mcp.json");
     await removeFromConfig(path, `repowise-${ctx.repoId}`);
     const status2 = await writeMergedConfig({
       path,
@@ -8178,7 +8663,7 @@ var clineWriter = {
     return { status: status2, path };
   },
   async remove(ctx) {
-    const path = join26(ctx.home, ".cline", "mcp.json");
+    const path = join27(ctx.home, ".cline", "mcp.json");
     await removeFromConfig(path, `RepoWise MCP for ${ctx.repoName}`);
     await removeFromConfig(path, `repowise-${ctx.repoId}`);
   }
@@ -8194,13 +8679,13 @@ async function fileExists4(path) {
 
 // ../listener/dist/mcp/auto-config/writers/cline-hooks.js
 import { promises as fs9 } from "fs";
-import { join as join27 } from "path";
+import { join as join28 } from "path";
 var SCRIPT_REL = ".clinerules/hooks/UserPromptSubmit";
 var OWNERSHIP_MARKER = "managed by RepoWise";
 var clineHooksWriter = {
   tool: "cline-hooks",
   async detect(repoRoot) {
-    return fileExists5(join27(repoRoot, ".clinerules"));
+    return fileExists5(join28(repoRoot, ".clinerules"));
   },
   async write(ctx) {
     if (await isGitTracked(ctx.repoRoot, SCRIPT_REL)) {
@@ -8210,7 +8695,7 @@ var clineHooksWriter = {
         reason: `${SCRIPT_REL} is git-tracked; update it manually to opt in`
       };
     }
-    const path = join27(ctx.repoRoot, SCRIPT_REL);
+    const path = join28(ctx.repoRoot, SCRIPT_REL);
     const next = buildClineHookScript({
       repoName: ctx.repoName,
       contextFolder: ctx.contextFolder ?? "repowise-context",
@@ -8227,14 +8712,14 @@ var clineHooksWriter = {
       await ensureExecutable(path);
       return { status: "unchanged", path };
     }
-    await fs9.mkdir(join27(ctx.repoRoot, ".clinerules", "hooks"), { recursive: true });
+    await fs9.mkdir(join28(ctx.repoRoot, ".clinerules", "hooks"), { recursive: true });
     await fs9.writeFile(path, next, { encoding: "utf-8", mode: 493 });
     await ensureExecutable(path);
     await applyGitignoreChanges(ctx.repoRoot, { add: [SCRIPT_REL] });
     return { status: "written", path };
   },
   async remove(ctx) {
-    const path = join27(ctx.repoRoot, SCRIPT_REL);
+    const path = join28(ctx.repoRoot, SCRIPT_REL);
     const existing = await readOrNull(path);
     if (existing !== null && existing.includes(OWNERSHIP_MARKER)) {
       await fs9.unlink(path);
@@ -8269,14 +8754,14 @@ async function readOrNull(path) {
 
 // ../listener/dist/mcp/auto-config/writers/codex.js
 import { promises as fs10 } from "fs";
-import { join as join28 } from "path";
+import { join as join29 } from "path";
 var codexWriter = {
   tool: "codex",
   async detect(_repoRoot, home) {
-    return fileExists6(join28(home, ".codex"));
+    return fileExists6(join29(home, ".codex"));
   },
   async write(ctx) {
-    const path = join28(ctx.home, ".codex", "mcp.json");
+    const path = join29(ctx.home, ".codex", "mcp.json");
     await removeFromConfig(path, `repowise-${ctx.repoId}`);
     const status2 = await writeMergedConfig({
       path,
@@ -8286,7 +8771,7 @@ var codexWriter = {
     return { status: status2, path };
   },
   async remove(ctx) {
-    const path = join28(ctx.home, ".codex", "mcp.json");
+    const path = join29(ctx.home, ".codex", "mcp.json");
     await removeFromConfig(path, `RepoWise MCP for ${ctx.repoName}`);
     await removeFromConfig(path, `repowise-${ctx.repoId}`);
   }
@@ -8302,15 +8787,15 @@ async function fileExists6(path) {
 
 // ../listener/dist/mcp/auto-config/writers/codex-hooks.js
 import { promises as fs11 } from "fs";
-import { join as join29 } from "path";
+import { join as join30 } from "path";
 var HOOKS_REL = ".codex/hooks.json";
 var codexHooksWriter = {
   tool: "codex-hooks",
   async detect(repoRoot, home) {
-    return await fileExists7(join29(home, ".codex")) || await fileExists7(join29(repoRoot, ".codex"));
+    return await fileExists7(join30(home, ".codex")) || await fileExists7(join30(repoRoot, ".codex"));
   },
   async write(ctx) {
-    const repoSignal = await fileExists7(join29(ctx.repoRoot, ".codex"));
+    const repoSignal = await fileExists7(join30(ctx.repoRoot, ".codex"));
     const selected = ctx.selectedTools?.includes("codex") ?? false;
     if (!repoSignal && !selected) {
       return { status: "skipped", reason: "no repo-scoped Codex signal and not selected" };
@@ -8322,7 +8807,7 @@ var codexHooksWriter = {
         reason: `${HOOKS_REL} is git-tracked; add the RepoWise UserPromptSubmit hook manually to opt in`
       };
     }
-    const path = join29(ctx.repoRoot, HOOKS_REL);
+    const path = join30(ctx.repoRoot, HOOKS_REL);
     const existing = await readOrNull2(path);
     const merged = mergeCodexHookSettings(existing, {
       repoName: ctx.repoName,
@@ -8332,13 +8817,13 @@ var codexHooksWriter = {
     if (merged === existing) {
       return { status: "unchanged", path };
     }
-    await fs11.mkdir(join29(ctx.repoRoot, ".codex"), { recursive: true });
+    await fs11.mkdir(join30(ctx.repoRoot, ".codex"), { recursive: true });
     await fs11.writeFile(path, merged, "utf-8");
     await applyGitignoreChanges(ctx.repoRoot, { add: [HOOKS_REL] });
     return { status: "written", path };
   },
   async remove(ctx) {
-    const path = join29(ctx.repoRoot, HOOKS_REL);
+    const path = join30(ctx.repoRoot, HOOKS_REL);
     const existing = await readOrNull2(path);
     if (existing !== null) {
       const next = removeCodexHookSettings(existing);
@@ -8369,14 +8854,14 @@ async function readOrNull2(path) {
 
 // ../listener/dist/mcp/auto-config/writers/copilot.js
 import { promises as fs12 } from "fs";
-import { join as join30 } from "path";
+import { join as join31 } from "path";
 var copilotWriter = {
   tool: "copilot",
   async detect(repoRoot) {
-    return fileExists8(join30(repoRoot, ".vscode"));
+    return fileExists8(join31(repoRoot, ".vscode"));
   },
   async write(ctx) {
-    const path = join30(ctx.repoRoot, ".vscode", "mcp.json");
+    const path = join31(ctx.repoRoot, ".vscode", "mcp.json");
     await removeFromConfig(path, `repowise-${ctx.repoId}`);
     const status2 = await writeMergedConfig({
       path,
@@ -8386,7 +8871,7 @@ var copilotWriter = {
     return { status: status2, path };
   },
   async remove(ctx) {
-    const path = join30(ctx.repoRoot, ".vscode", "mcp.json");
+    const path = join31(ctx.repoRoot, ".vscode", "mcp.json");
     await removeFromConfig(path, `RepoWise MCP for ${ctx.repoName}`);
     await removeFromConfig(path, `repowise-${ctx.repoId}`);
   }
@@ -8402,15 +8887,15 @@ async function fileExists8(path) {
 
 // ../listener/dist/mcp/auto-config/writers/copilot-hooks.js
 import { promises as fs13 } from "fs";
-import { join as join31 } from "path";
+import { join as join32 } from "path";
 var HOOKS_REL2 = ".github/hooks/repowise.json";
 var copilotHooksWriter = {
   tool: "copilot-hooks",
   async detect(repoRoot) {
-    return fileExists9(join31(repoRoot, ".github", "copilot-instructions.md"));
+    return fileExists9(join32(repoRoot, ".github", "copilot-instructions.md"));
   },
   async write(ctx) {
-    const path = join31(ctx.repoRoot, HOOKS_REL2);
+    const path = join32(ctx.repoRoot, HOOKS_REL2);
     const next = buildCopilotHooksFile({
       repoName: ctx.repoName,
       contextFolder: ctx.contextFolder ?? "repowise-context",
@@ -8430,14 +8915,14 @@ var copilotHooksWriter = {
     if (existing === next) {
       return { status: "unchanged", path };
     }
-    await fs13.mkdir(join31(ctx.repoRoot, ".github", "hooks"), { recursive: true });
+    await fs13.mkdir(join32(ctx.repoRoot, ".github", "hooks"), { recursive: true });
     await fs13.writeFile(path, next, "utf-8");
     const userSelected = ctx.selectedTools?.includes("copilot") ?? false;
     await applyGitignoreChanges(ctx.repoRoot, userSelected ? { remove: [HOOKS_REL2] } : { add: [HOOKS_REL2] });
     return { status: "written", path };
   },
   async remove(ctx) {
-    const path = join31(ctx.repoRoot, HOOKS_REL2);
+    const path = join32(ctx.repoRoot, HOOKS_REL2);
     if (!await isGitTracked(ctx.repoRoot, HOOKS_REL2)) {
       await fs13.unlink(path).catch(() => {
       });
@@ -8463,14 +8948,14 @@ async function readOrNull3(path) {
 
 // ../listener/dist/mcp/auto-config/writers/cursor.js
 import { promises as fs14 } from "fs";
-import { join as join32 } from "path";
+import { join as join33 } from "path";
 var cursorWriter = {
   tool: "cursor",
   async detect(repoRoot) {
-    return await fileExists10(join32(repoRoot, ".cursor")) || await fileExists10(join32(repoRoot, ".cursorrules"));
+    return await fileExists10(join33(repoRoot, ".cursor")) || await fileExists10(join33(repoRoot, ".cursorrules"));
   },
   async write(ctx) {
-    const path = join32(ctx.repoRoot, ".cursor", "mcp.json");
+    const path = join33(ctx.repoRoot, ".cursor", "mcp.json");
     await removeFromConfig(path, `repowise-${ctx.repoId}`);
     const status2 = await writeMergedConfig({
       path,
@@ -8480,7 +8965,7 @@ var cursorWriter = {
     return { status: status2, path };
   },
   async remove(ctx) {
-    const path = join32(ctx.repoRoot, ".cursor", "mcp.json");
+    const path = join33(ctx.repoRoot, ".cursor", "mcp.json");
     await removeFromConfig(path, `RepoWise MCP for ${ctx.repoName}`);
     await removeFromConfig(path, `repowise-${ctx.repoId}`);
   }
@@ -8496,14 +8981,14 @@ async function fileExists10(path) {
 
 // ../listener/dist/mcp/auto-config/writers/gemini-cli.js
 import { promises as fs15 } from "fs";
-import { join as join33 } from "path";
+import { join as join34 } from "path";
 var geminiCliWriter = {
   tool: "gemini-cli",
   async detect(_repoRoot, home) {
-    return fileExists11(join33(home, ".gemini"));
+    return fileExists11(join34(home, ".gemini"));
   },
   async write(ctx) {
-    const path = join33(ctx.home, ".gemini", "settings.json");
+    const path = join34(ctx.home, ".gemini", "settings.json");
     await removeFromConfig(path, `repowise-${ctx.repoId}`);
     const status2 = await writeMergedConfig({
       path,
@@ -8513,7 +8998,7 @@ var geminiCliWriter = {
     return { status: status2, path };
   },
   async remove(ctx) {
-    const path = join33(ctx.home, ".gemini", "settings.json");
+    const path = join34(ctx.home, ".gemini", "settings.json");
     await removeFromConfig(path, `RepoWise MCP for ${ctx.repoName}`);
     await removeFromConfig(path, `repowise-${ctx.repoId}`);
   }
@@ -8529,15 +9014,15 @@ async function fileExists11(path) {
 
 // ../listener/dist/mcp/auto-config/writers/gemini-hooks.js
 import { promises as fs16 } from "fs";
-import { join as join34 } from "path";
+import { join as join35 } from "path";
 var SETTINGS_REL = ".gemini/settings.json";
 var geminiHooksWriter = {
   tool: "gemini-hooks",
   async detect(repoRoot, home) {
-    return await fileExists12(join34(home, ".gemini")) || await fileExists12(join34(repoRoot, ".gemini"));
+    return await fileExists12(join35(home, ".gemini")) || await fileExists12(join35(repoRoot, ".gemini"));
   },
   async write(ctx) {
-    const repoSignal = await fileExists12(join34(ctx.repoRoot, ".gemini")) || await fileExists12(join34(ctx.repoRoot, "GEMINI.md"));
+    const repoSignal = await fileExists12(join35(ctx.repoRoot, ".gemini")) || await fileExists12(join35(ctx.repoRoot, "GEMINI.md"));
     const selected = ctx.selectedTools?.includes("gemini") ?? false;
     if (!repoSignal && !selected) {
       return { status: "skipped", reason: "no repo-scoped Gemini signal and not selected" };
@@ -8549,7 +9034,7 @@ var geminiHooksWriter = {
         reason: `${SETTINGS_REL} is git-tracked; add the RepoWise BeforeAgent hook manually to opt in`
       };
     }
-    const path = join34(ctx.repoRoot, SETTINGS_REL);
+    const path = join35(ctx.repoRoot, SETTINGS_REL);
     const existing = await readOrNull4(path);
     const merged = mergeGeminiHookSettings(existing, {
       repoName: ctx.repoName,
@@ -8559,13 +9044,13 @@ var geminiHooksWriter = {
     if (merged === existing) {
       return { status: "unchanged", path };
     }
-    await fs16.mkdir(join34(ctx.repoRoot, ".gemini"), { recursive: true });
+    await fs16.mkdir(join35(ctx.repoRoot, ".gemini"), { recursive: true });
     await fs16.writeFile(path, merged, "utf-8");
     await applyGitignoreChanges(ctx.repoRoot, { add: [SETTINGS_REL] });
     return { status: "written", path };
   },
   async remove(ctx) {
-    const path = join34(ctx.repoRoot, SETTINGS_REL);
+    const path = join35(ctx.repoRoot, SETTINGS_REL);
     const existing = await readOrNull4(path);
     if (existing !== null) {
       const next = removeGeminiHookSettings(existing);
@@ -8596,14 +9081,14 @@ async function readOrNull4(path) {
 
 // ../listener/dist/mcp/auto-config/writers/roo.js
 import { promises as fs17 } from "fs";
-import { join as join35 } from "path";
+import { join as join36 } from "path";
 var rooWriter = {
   tool: "roo",
   async detect(repoRoot, home) {
-    return await fileExists13(join35(repoRoot, ".roo")) || await fileExists13(join35(home, ".roo"));
+    return await fileExists13(join36(repoRoot, ".roo")) || await fileExists13(join36(home, ".roo"));
   },
   async write(ctx) {
-    const repoConfig = join35(ctx.repoRoot, ".roo", "mcp.json");
+    const repoConfig = join36(ctx.repoRoot, ".roo", "mcp.json");
     const before = await readOrNull5(repoConfig);
     await this.remove(ctx);
     const after = await readOrNull5(repoConfig);
@@ -8613,9 +9098,9 @@ var rooWriter = {
     };
   },
   async remove(ctx) {
-    const repoConfig = join35(ctx.repoRoot, ".roo", "mcp.json");
-    const homeConfig = join35(ctx.home, ".roo", "mcp.json");
-    const homeSettings = join35(ctx.home, ".roo", "settings.json");
+    const repoConfig = join36(ctx.repoRoot, ".roo", "mcp.json");
+    const homeConfig = join36(ctx.home, ".roo", "mcp.json");
+    const homeSettings = join36(ctx.home, ".roo", "settings.json");
     for (const path of [repoConfig, homeConfig, homeSettings]) {
       await removeFromConfig(path, `RepoWise MCP for ${ctx.repoName}`).catch(() => {
       });
@@ -8642,14 +9127,14 @@ async function readOrNull5(path) {
 
 // ../listener/dist/mcp/auto-config/writers/windsurf.js
 import { promises as fs18 } from "fs";
-import { join as join36 } from "path";
+import { join as join37 } from "path";
 var windsurfWriter = {
   tool: "windsurf",
   async detect(_repoRoot, home) {
-    return fileExists14(join36(home, ".codeium", "windsurf"));
+    return fileExists14(join37(home, ".codeium", "windsurf"));
   },
   async write(ctx) {
-    const path = join36(ctx.home, ".codeium", "windsurf", "mcp_config.json");
+    const path = join37(ctx.home, ".codeium", "windsurf", "mcp_config.json");
     await removeFromConfig(path, `repowise-${ctx.repoId}`);
     const status2 = await writeMergedConfig({
       path,
@@ -8659,7 +9144,7 @@ var windsurfWriter = {
     return { status: status2, path };
   },
   async remove(ctx) {
-    const path = join36(ctx.home, ".codeium", "windsurf", "mcp_config.json");
+    const path = join37(ctx.home, ".codeium", "windsurf", "mcp_config.json");
     await removeFromConfig(path, `RepoWise MCP for ${ctx.repoName}`);
     await removeFromConfig(path, `repowise-${ctx.repoId}`);
   }
@@ -8741,7 +9226,7 @@ init_installer();
 init_registry();
 init_lsp_tools();
 import { promises as fs19 } from "fs";
-import { join as join37 } from "path";
+import { join as join38 } from "path";
 async function collectRepresentativeFiles(repoRoot) {
   const reps = /* @__PURE__ */ new Map();
   let inspected = 0;
@@ -8782,7 +9267,7 @@ async function collectRepresentativeFiles(repoRoot) {
       continue;
     if (name === "node_modules" || name === "dist" || name === "build")
       continue;
-    const sub = join37(repoRoot, name);
+    const sub = join38(repoRoot, name);
     try {
       const stat8 = await fs19.stat(sub);
       if (stat8.isDirectory())
@@ -8830,7 +9315,7 @@ init_config_dir();
 import { promises as fs20 } from "fs";
 import { spawn as spawn9, execFile as execFile5 } from "child_process";
 import { createWriteStream as createWriteStream2 } from "fs";
-import { join as join38 } from "path";
+import { join as join39 } from "path";
 import { promisify as promisify3 } from "util";
 var execFileAsync3 = promisify3(execFile5);
 async function isCommandOnPath2(cmd) {
@@ -8894,7 +9379,7 @@ async function maybeWriteClangdStub(repoRoot, repoId) {
       if (e.isDirectory()) {
         if (skip.has(e.name) || e.name.startsWith("."))
           continue;
-        await rec(join38(dir, e.name));
+        await rec(join39(dir, e.name));
         continue;
       }
       const dot = e.name.lastIndexOf(".");
@@ -8903,7 +9388,7 @@ async function maybeWriteClangdStub(repoRoot, repoId) {
       const ext = e.name.slice(dot);
       if (!C_EXTS.has(ext) && !CPP_EXTS.has(ext))
         continue;
-      sources.push({ path: join38(dir, e.name), ext });
+      sources.push({ path: join39(dir, e.name), ext });
     }
   }
   await rec(repoRoot);
@@ -8919,9 +9404,9 @@ async function maybeWriteClangdStub(repoRoot, repoId) {
       command: `${driver} ${std} -I. -I./include -c "${src}"`
     };
   });
-  const outDir = join38(repoRoot, ".repowise");
+  const outDir = join39(repoRoot, ".repowise");
   await fs20.mkdir(outDir, { recursive: true });
-  const outPath = join38(outDir, "compile_commands.json");
+  const outPath = join39(outDir, "compile_commands.json");
   await fs20.writeFile(outPath, JSON.stringify(entries, null, 2));
   const capHit = sources.length >= MAX_STUB_SOURCES;
   console.log(`[workspace-prep] ${repoId}: wrote ${entries.length.toString()}-entry compile_commands stub to .repowise/${capHit ? " (cap reached \u2014 additional sources truncated)" : ""}`);
@@ -8930,7 +9415,7 @@ async function maybeWriteClangdStub(repoRoot, repoId) {
 var DEFAULT_TIMEOUT_MS = 10 * 60 * 1e3;
 async function fileExists15(repoRoot, name) {
   try {
-    await fs20.access(join38(repoRoot, name));
+    await fs20.access(join39(repoRoot, name));
     return true;
   } catch {
     return false;
@@ -8941,7 +9426,7 @@ async function detectWorkspaceDeps(repoRoot) {
   if (await fileExists15(repoRoot, "package.json")) {
     let pkgRaw = "";
     try {
-      pkgRaw = await fs20.readFile(join38(repoRoot, "package.json"), "utf8");
+      pkgRaw = await fs20.readFile(join39(repoRoot, "package.json"), "utf8");
     } catch {
     }
     if (pkgRaw) {
@@ -9044,7 +9529,7 @@ async function runWorkspacePreps(opts) {
   if (opts.missing.length === 0)
     return [];
   const safeRepoId = opts.repoId.replace(/[^a-zA-Z0-9_-]/g, "_");
-  const logPath2 = join38(getConfigDir(), `install-log.${safeRepoId}.txt`);
+  const logPath2 = join39(getConfigDir(), `install-log.${safeRepoId}.txt`);
   await fs20.mkdir(getConfigDir(), { recursive: true });
   const stream = opts.logStream ?? createWriteStream2(logPath2, { flags: "a" });
   stream.on("error", () => {
@@ -9195,7 +9680,7 @@ async function prepareWorkspaceDepsForRepos(repos) {
 init_registry();
 import { execFile as execFileCb, spawn as spawn10 } from "child_process";
 import { access as access3, readdir as readdir4 } from "fs/promises";
-import { join as join39 } from "path";
+import { join as join40 } from "path";
 import { promisify as promisify4 } from "util";
 var execFile6 = promisify4(execFileCb);
 var DEFAULT_BUILD_TIMEOUT_MS = 10 * 60 * 1e3;
@@ -9248,7 +9733,7 @@ async function ensureIndexable(indexRoot, language, options = {}) {
     }
   }
   try {
-    await access3(join39(indexRoot, spec.indexStoreProbe));
+    await access3(join40(indexRoot, spec.indexStoreProbe));
     return { ready: true, built: false };
   } catch {
   }
@@ -9982,13 +10467,13 @@ init_config_dir();
 import { execFile as execFileCb3 } from "child_process";
 import { createHash as createHash5 } from "crypto";
 import { mkdir as mkdir15, readdir as readdir5, rm, stat as stat6 } from "fs/promises";
-import { join as join40 } from "path";
+import { join as join41 } from "path";
 import { promisify as promisify6 } from "util";
 var execFile8 = promisify6(execFileCb3);
 var GIT_OP_TIMEOUT_MS = 6e4;
 var MAX_CONCURRENT_WORKTREES = 3;
 function worktreeBaseDir() {
-  return join40(getConfigDir(), "lsp-worktrees");
+  return join41(getConfigDir(), "lsp-worktrees");
 }
 async function reapOrphanWorktrees(maxAgeMs = 24 * 60 * 60 * 1e3, base = worktreeBaseDir()) {
   let reaped = 0;
@@ -10000,7 +10485,7 @@ async function reapOrphanWorktrees(maxAgeMs = 24 * 60 * 60 * 1e3, base = worktre
   }
   const cutoff = Date.now() - maxAgeMs;
   for (const entry of entries) {
-    const dir = join40(base, entry);
+    const dir = join41(base, entry);
     try {
       const info = await stat6(dir);
       if (!info.isDirectory() || info.mtimeMs > cutoff)
@@ -10033,7 +10518,7 @@ async function prepareCommittedTree(repoRoot, commitSha, options = {}) {
   }
   const base = options.worktreeBase ?? worktreeBaseDir();
   const dirName = createHash5("sha256").update(`${repoRoot}\0${commitSha}`).digest("hex").slice(0, 16) + "-" + commitSha.slice(0, 12);
-  const worktreePath = join40(base, dirName);
+  const worktreePath = join41(base, dirName);
   try {
     await mkdir15(base, { recursive: true });
     await git(["-C", repoRoot, "worktree", "prune"]).catch(() => void 0);
@@ -10369,8 +10854,8 @@ var CRASH_LOOP_WINDOW_MS = 3e4;
 var CRASH_LOOP_THRESHOLD = 3;
 async function readRawToolConfig() {
   try {
-    const configPath = join41(getConfigDir(), "config.json");
-    const data = await readFile13(configPath, "utf-8");
+    const configPath = join42(getConfigDir(), "config.json");
+    const data = await readFile14(configPath, "utf-8");
     const raw = JSON.parse(data);
     return {
       aiTools: Array.isArray(raw["aiTools"]) ? raw["aiTools"] : void 0,
@@ -10396,10 +10881,9 @@ async function updateToolConfigsForRepo(localPath, config2, state, repoId) {
   }
   await migrateRooToKilo(localPath).catch(() => {
   });
-  const variant = config2.graphOnly ? "graph" : "full";
   const contextFiles = await scanLocalContextFiles(localPath, contextFolder);
-  if (contextFiles.length === 0 && variant === "full")
-    return;
+  const marker = await readDocsMarker(localPath, contextFolder);
+  const variant = effectiveToolVariant(!!config2.graphOnly, contextFiles.length > 0, marker, state.repos[repoId]?.lastSyncCommitSha);
   const hash = JSON.stringify({
     rev: AI_TOOLS_REFERENCE_REV,
     block: AGENT_INSTRUCTIONS_HASH,
@@ -10426,10 +10910,15 @@ async function updateToolConfigsForRepo(localPath, config2, state, repoId) {
   if (!written.has("AGENTS.md")) {
     await updateToolConfig(localPath, "codex", repoName, contextFolder, contextFiles, variant);
   }
+  const prevToolVariant = state.repos[repoId]?.lastToolVariant;
   if (!state.repos[repoId]) {
     state.repos[repoId] = { lastSyncTimestamp: (/* @__PURE__ */ new Date()).toISOString(), lastSyncCommitSha: null };
   }
   state.repos[repoId].lastToolConfigHash = hash;
+  state.repos[repoId].lastToolVariant = variant;
+  if (!config2.graphOnly && variant === "full" && prevToolVariant === "graph") {
+    notifyDocsReady(repoId);
+  }
   console.log(`[ai-tools] Updated tool configs for ${repoId}`);
 }
 var running = false;
@@ -10446,8 +10935,8 @@ function resolveAuditRoots() {
   const out = /* @__PURE__ */ new Set();
   let dir = dirname17(process.execPath);
   for (let i = 0; i < 8; i += 1) {
-    out.add(join41(dir, "node_modules"));
-    out.add(join41(dir, "lib", "node_modules"));
+    out.add(join42(dir, "node_modules"));
+    out.add(join42(dir, "lib", "node_modules"));
     const parent = dirname17(dir);
     if (parent === dir)
       break;
@@ -10537,6 +11026,36 @@ async function waitForCredentials(isRunning2) {
       watcher.close();
   }
 }
+async function waitForCredentialsOrTerminal(isRunning2) {
+  let changed = false;
+  let watcher = null;
+  try {
+    const fs31 = await import("fs");
+    watcher = fs31.watch(getConfigDir(), (_event, filename) => {
+      if (!filename || filename === "credentials.json")
+        changed = true;
+    });
+  } catch {
+  }
+  try {
+    while (isRunning2()) {
+      await sleep(changed ? 0 : 1e4);
+      changed = false;
+      if (!isRunning2())
+        break;
+      const fresh = await getValidCredentials({ forceRefresh: true });
+      if (fresh)
+        return { kind: "recovered", creds: fresh };
+      const oc = getLastRefreshOutcome();
+      if (oc === "terminal" || oc === "no-creds")
+        return { kind: "terminal" };
+    }
+    return { kind: "stopped" };
+  } finally {
+    if (watcher)
+      watcher.close();
+  }
+}
 function decodeEmailFromIdToken(idToken) {
   try {
     const payload = JSON.parse(Buffer.from(idToken.split(".")[1], "base64url").toString());
@@ -10564,13 +11083,14 @@ async function handleSyncCompleted(notif, ctx) {
     return { stateUpdated: false };
   }
   notifyContextUpdated(notif.repoId, result.updatedFiles.length);
-  invalidateLspBuffersOnce(notif, localPath, ctx);
-  await refreshAiToolConfigs(notif, localPath, ctx);
+  await writeDocsMarker(localPath, "repowise-context", notif.commitSha ?? null, result.updatedFiles.length);
   ctx.state.repos[notif.repoId] = {
     ...ctx.state.repos[notif.repoId],
     lastSyncTimestamp: notif.createdAt,
     lastSyncCommitSha: notif.commitSha ?? ctx.state.repos[notif.repoId]?.lastSyncCommitSha ?? null
   };
+  invalidateLspBuffersOnce(notif, localPath, ctx);
+  await refreshAiToolConfigs(notif, localPath, ctx);
   await runProducerHook(notif, localPath, ctx);
   return { stateUpdated: true };
 }
@@ -10739,14 +11259,14 @@ async function checkStaleContext(repos, state, groups) {
     if (group?.offline.isOffline)
       continue;
     const { statSync: statSync2, readdirSync: readdirSync2 } = await import("fs");
-    const contextPath = join41(repo.localPath, "repowise-context");
+    const contextPath = join42(repo.localPath, "repowise-context");
     let isMissingOrEmpty = false;
     try {
       const s = statSync2(contextPath);
       if (!s.isDirectory()) {
         isMissingOrEmpty = true;
       } else {
-        const entries = readdirSync2(contextPath);
+        const entries = readdirSync2(contextPath).filter((e) => !e.startsWith("."));
         isMissingOrEmpty = entries.length === 0;
       }
     } catch {
@@ -10762,6 +11282,7 @@ async function checkStaleContext(repos, state, groups) {
       const result = await fetchContextFromServer(repo.repoId, repo.localPath, apiUrl);
       if (result.success && result.updatedFiles.length > 0) {
         console.log(`[self-heal] Re-downloaded ${result.updatedFiles.length} files for ${repo.repoId}`);
+        await writeDocsMarker(repo.localPath, "repowise-context", repoState.lastSyncCommitSha ?? null, result.updatedFiles.length);
         notifyContextUpdated(repo.repoId, result.updatedFiles.length);
       }
     }
@@ -10774,7 +11295,6 @@ function mcpAiToolsKey(aiTools) {
 async function reconcileMcpConfigs(repos, packageName) {
   const shimCmd = packageName;
   const { contextFolder, aiTools, graphOnly } = await readRawToolConfig();
-  const variant = graphOnly ? "graph" : "full";
   for (const repo of repos) {
     if (!repo.localPath)
       continue;
@@ -10785,6 +11305,8 @@ async function reconcileMcpConfigs(repos, packageName) {
     } catch {
       continue;
     }
+    const docsPresent = (await scanLocalContextFiles(repo.localPath, contextFolder ?? "repowise-context")).length > 0;
+    const variant = effectiveToolVariant(!!graphOnly, docsPresent, null, null);
     try {
       const results = await runAutoConfig({
         repoRoot: repo.localPath,
@@ -10807,10 +11329,10 @@ async function reconcileAgentInstructions(repos) {
   const { graphOnly } = await readRawToolConfig();
   const variant = graphOnly ? "graph" : "full";
   for (const repo of repos) {
-    const path = join41(repo.localPath, "repowise-context", "project-overview.md");
+    const path = join42(repo.localPath, "repowise-context", "project-overview.md");
     let content;
     try {
-      content = await readFile13(path, "utf-8");
+      content = await readFile14(path, "utf-8");
     } catch (err) {
       const code = err?.code;
       if (code === "ENOENT" || code === "ENOTDIR" || code === "EACCES" || code === "EPERM" || code === "EISDIR") {
@@ -10823,7 +11345,7 @@ async function reconcileAgentInstructions(repos) {
     if (injected === content)
       continue;
     try {
-      await writeFile15(path, injected, "utf-8");
+      await writeFile16(path, injected, "utf-8");
       console.log(`[reconcile] Reconciled agent instructions for ${repo.repoId}`);
     } catch (err) {
       console.warn(`[reconcile] write failed for ${repo.repoId}:`, err instanceof Error ? err.message : String(err));
@@ -10891,11 +11413,11 @@ async function startListener() {
   }
   const configDir = getConfigDir();
   await mkdir16(configDir, { recursive: true });
-  const lockPath = join41(configDir, "listener.lock");
-  await writeFile15(lockPath, "", { flag: "a" });
+  const lockPath = join42(configDir, "listener.lock");
+  await writeFile16(lockPath, "", { flag: "a" });
   let lockIsHeld = false;
   try {
-    lockIsHeld = await lockfile4.check(lockPath, { stale: 3e4, realpath: false });
+    lockIsHeld = await lockfile5.check(lockPath, { stale: 3e4, realpath: false });
   } catch {
   }
   if (!lockIsHeld) {
@@ -10909,7 +11431,7 @@ async function startListener() {
     }
   }
   try {
-    releaseLock = await lockfile4.lock(lockPath, { stale: 3e4, realpath: false });
+    releaseLock = await lockfile5.lock(lockPath, { stale: 3e4, realpath: false });
   } catch {
     console.error(`Listener already running. Stop it first with \`${true ? "repowisestage" : "repowise"} stop\`.`);
     process.exitCode = 1;
@@ -10934,7 +11456,7 @@ async function startListener() {
     return;
   }
   if (config2.repos.length === 0 && !config2.autoDiscoverRepos) {
-    console.error(`No repos configured. Add repos to ${join41(configDir, "config.json")}`);
+    console.error(`No repos configured. Add repos to ${join42(configDir, "config.json")}`);
     await releaseLockAndExit();
     process.exitCode = 1;
     return;
@@ -11005,8 +11527,8 @@ async function startListener() {
   let currentVersion = "";
   try {
     const selfDir = dirname17(fileURLToPath3(import.meta.url));
-    const pkgJsonPath = join41(selfDir, "..", "..", "package.json");
-    const pkgJson = JSON.parse(await readFile13(pkgJsonPath, "utf-8"));
+    const pkgJsonPath = join42(selfDir, "..", "..", "package.json");
+    const pkgJson = JSON.parse(await readFile14(pkgJsonPath, "utf-8"));
     currentVersion = pkgJson.version;
   } catch (err) {
     console.log(`[auto-update] Version detection failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -11028,6 +11550,8 @@ async function startListener() {
   console.warn = (...args) => origWarn(`[${ts()}]`, ...args);
   console.log(`RepoWise Listener started \u2014 watching ${allRepoIds.length} repo(s)`);
   let mcpRuntime = null;
+  let proactiveRefreshTimer = null;
+  const PROACTIVE_REFRESH_MS = 10 * 60 * 1e3;
   try {
     mcpRuntime = await startMcp({
       repos: config2.repos.map((r) => ({
@@ -11035,6 +11559,8 @@ async function startListener() {
         apiUrl: r.apiUrl ?? config2.defaultApiUrl,
         ...r.localPath ? { localPath: r.localPath } : {}
       })),
+      // Rides the anonymous MCP-usage heartbeat for fleet version spread.
+      listenerVersion: currentVersion,
       getAuthToken: async () => {
         const fresh = await getValidCredentials();
         if (!fresh)
@@ -11168,6 +11694,10 @@ async function startListener() {
   const shutdown = async () => {
     console.log("Shutting down...");
     stop();
+    if (proactiveRefreshTimer) {
+      clearInterval(proactiveRefreshTimer);
+      proactiveRefreshTimer = null;
+    }
     if (mcpRuntime) {
       try {
         await mcpRuntime.close();
@@ -11198,7 +11728,22 @@ async function startListener() {
       }).finally(() => process.exit(0));
     });
   }
+  if (!proactiveRefreshTimer) {
+    proactiveRefreshTimer = setInterval(() => {
+      void getValidCredentials().catch(() => {
+      });
+    }, PROACTIVE_REFRESH_MS);
+    proactiveRefreshTimer.unref();
+  }
+  let lastCycleAt = Date.now();
   while (running) {
+    const wakeDrift = Date.now() - lastCycleAt;
+    if (wakeDrift > pollIntervalMs + 6e4) {
+      console.log(`[wake] ~${Math.round(wakeDrift / 1e3).toString()}s gap detected (likely sleep) \u2014 refreshing credentials`);
+      await getValidCredentials({ forceRefresh: true }).catch(() => {
+      });
+    }
+    lastCycleAt = Date.now();
     let anyAuthError = null;
     let authErrorGroup = null;
     let minPollInterval = pollIntervalMs;
@@ -11415,10 +11960,10 @@ async function startListener() {
           }
         }
         group.offline.attemptCount++;
-        const delay2 = group.backoff.nextDelay();
-        group.offline.nextRetryAt = Date.now() + delay2;
+        const delay3 = group.backoff.nextDelay();
+        group.offline.nextRetryAt = Date.now() + delay3;
         const message = err instanceof Error ? err.message : "Unknown error";
-        console.error(`Poll failed for ${group.apiUrl} (attempt ${group.offline.attemptCount}): ${message}. Retrying in ${Math.round(delay2 / 1e3)}s`);
+        console.error(`Poll failed for ${group.apiUrl} (attempt ${group.offline.attemptCount}): ${message}. Retrying in ${Math.round(delay3 / 1e3)}s`);
       }
     }
     if (shouldReconcile) {
@@ -11495,9 +12040,10 @@ async function startListener() {
     }
     if (anyAuthError) {
       let recovered = false;
-      for (let attempt = 1; attempt <= 3; attempt++) {
-        console.warn(`Auth error \u2014 retrying credentials (attempt ${attempt}/3)...`);
-        await sleep(5e3);
+      const backoffs = [5e3, 1e4, 2e4];
+      for (let attempt = 0; attempt < backoffs.length; attempt++) {
+        console.warn(`Auth error \u2014 retrying credentials (attempt ${(attempt + 1).toString()}/${backoffs.length.toString()})...`);
+        await sleep(backoffs[attempt]);
         if (!running)
           break;
         const fresh2 = await getValidCredentials({ forceRefresh: true });
@@ -11509,22 +12055,47 @@ async function startListener() {
       }
       if (recovered)
         continue;
-      console.error("Session expired after 3 retries. Sending notification email and waiting for re-authentication...");
+      const outcome = getLastRefreshOutcome();
+      let terminal = outcome === "terminal" || outcome === "no-creds";
+      if (!terminal) {
+        console.warn("[auth] Refresh still failing (transient/offline) \u2014 keeping MCP up, waiting for connectivity...");
+        const waited = await waitForCredentialsOrTerminal(() => running);
+        if (waited.kind === "stopped")
+          continue;
+        if (waited.kind === "recovered") {
+          console.log("Reconnected \u2014 resuming listener");
+          continue;
+        }
+        console.warn("[auth] Session became terminal during the offline wait \u2014 prompting re-login");
+        terminal = true;
+      }
+      console.error("Session expired (refresh token rejected). Prompting re-login and waiting...");
+      try {
+        await mcpRuntime?.server?.suspendEndpoint();
+      } catch (err) {
+        console.warn("[mcp] suspendEndpoint failed:", err instanceof Error ? err.message : String(err));
+      }
       const creds = await getStoredCredentials();
       const email = creds?.idToken ? decodeEmailFromIdToken(creds.idToken) : null;
       if (email && authErrorGroup) {
         try {
-          await fetch(`${authErrorGroup.apiUrl}/v1/public/notify-auth-expired`, {
+          await fetchWithTimeout(`${authErrorGroup.apiUrl}/v1/public/notify-auth-expired`, {
             method: "POST",
             headers: { "Content-Type": "application/json" },
             body: JSON.stringify({ email })
-          });
+          }, 5e3);
         } catch {
         }
       }
       const fresh = await waitForCredentials(() => running);
-      if (fresh)
+      if (fresh) {
         console.log("Re-authenticated \u2014 resuming listener");
+        try {
+          await mcpRuntime?.server?.resumeEndpoint();
+        } catch (err) {
+          console.warn("[mcp] resumeEndpoint failed:", err instanceof Error ? err.message : String(err));
+        }
+      }
       continue;
     }
     pollIntervalMs = minPollInterval;
@@ -11548,7 +12119,7 @@ if (isDirectRun) {
 
 // src/lib/env.ts
 import { homedir as homedir7 } from "os";
-import { join as join42 } from "path";
+import { join as join43 } from "path";
 var IS_STAGING2 = true ? true : false;
 var PRODUCTION = {
   apiUrl: "https://api.repowise.ai",
@@ -11568,7 +12139,7 @@ function getEnvConfig() {
   return IS_STAGING2 ? STAGING : PRODUCTION;
 }
 function getConfigDir2() {
-  return join42(homedir7(), IS_STAGING2 ? ".repowise-staging" : ".repowise");
+  return join43(homedir7(), IS_STAGING2 ? ".repowise-staging" : ".repowise");
 }
 function getPackageName() {
   return true ? "repowisestage" : "repowise";
@@ -11578,12 +12149,12 @@ function getPackageName() {
 import chalk from "chalk";
 
 // src/lib/config.ts
-import { readFile as readFile14, writeFile as writeFile16, mkdir as mkdir17, rename as rename4, unlink as unlink10 } from "fs/promises";
-import { join as join43 } from "path";
-import lockfile5 from "proper-lockfile";
+import { readFile as readFile15, writeFile as writeFile17, mkdir as mkdir17, rename as rename6, unlink as unlink12 } from "fs/promises";
+import { join as join44 } from "path";
+import lockfile6 from "proper-lockfile";
 async function getConfig() {
   try {
-    const data = await readFile14(join43(getConfigDir2(), "config.json"), "utf-8");
+    const data = await readFile15(join44(getConfigDir2(), "config.json"), "utf-8");
     return JSON.parse(data);
   } catch {
     return {};
@@ -11591,15 +12162,15 @@ async function getConfig() {
 }
 async function saveConfig(config2) {
   const dir = getConfigDir2();
-  const path = join43(dir, "config.json");
+  const path = join44(dir, "config.json");
   await mkdir17(dir, { recursive: true });
   const tmpPath = path + ".tmp";
   try {
-    await writeFile16(tmpPath, JSON.stringify(config2, null, 2));
-    await rename4(tmpPath, path);
+    await writeFile17(tmpPath, JSON.stringify(config2, null, 2));
+    await rename6(tmpPath, path);
   } catch (err) {
     try {
-      await unlink10(tmpPath);
+      await unlink12(tmpPath);
     } catch {
     }
     throw err;
@@ -11607,18 +12178,18 @@ async function saveConfig(config2) {
 }
 async function mergeAndSaveConfig(updates) {
   const dir = getConfigDir2();
-  const path = join43(dir, "config.json");
+  const path = join44(dir, "config.json");
   await mkdir17(dir, { recursive: true });
   try {
-    await writeFile16(path, "", { flag: "a" });
+    await writeFile17(path, "", { flag: "a" });
   } catch {
   }
   let release = null;
   try {
-    release = await lockfile5.lock(path, { stale: 1e4, retries: 3, realpath: false });
+    release = await lockfile6.lock(path, { stale: 1e4, retries: 3, realpath: false });
     let raw = {};
     try {
-      raw = JSON.parse(await readFile14(path, "utf-8"));
+      raw = JSON.parse(await readFile15(path, "utf-8"));
     } catch {
     }
     const merged = { ...raw, ...updates };
@@ -11678,18 +12249,33 @@ async function showWelcome(currentVersion) {
 
 // src/commands/create.ts
 import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync3 } from "fs";
-import { dirname as dirname19, join as join50 } from "path";
+import { dirname as dirname19, join as join51 } from "path";
 init_src();
 import chalk8 from "chalk";
 import ora from "ora";
 
 // src/lib/auth.ts
 import { createHash as createHash6, randomBytes as randomBytes3 } from "crypto";
-import { readFile as readFile15, writeFile as writeFile17, mkdir as mkdir18, chmod as chmod4, unlink as unlink11 } from "fs/promises";
+import { readFile as readFile16, writeFile as writeFile18, mkdir as mkdir18, chmod as chmod4, unlink as unlink13, rename as rename7, open as open5 } from "fs/promises";
 import http from "http";
-import { join as join44 } from "path";
+import { join as join45 } from "path";
+import lockfile7 from "proper-lockfile";
+
+// src/lib/http.ts
+async function fetchWithTimeout2(url, init, timeoutMs) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    return await fetch(url, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// src/lib/auth.ts
 var CLI_CALLBACK_PORT = 19876;
 var CALLBACK_TIMEOUT_MS = 12e4;
+var TOKEN_ENDPOINT_TIMEOUT_MS2 = 3e4;
 function getCognitoConfigForStorage() {
   const { domain, clientId, region, customDomain } = getCognitoConfig();
   return { domain, clientId, region, customDomain };
@@ -11830,31 +12416,65 @@ async function exchangeCodeForTokens(code, codeVerifier) {
   };
 }
 async function refreshTokens2(refreshToken) {
-  const response = await fetch(getTokenUrl2(), {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "refresh_token",
-      client_id: getCognitoConfig().clientId,
-      refresh_token: refreshToken
-    })
-  });
+  let response;
+  try {
+    response = await fetchWithTimeout2(
+      getTokenUrl2(),
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          grant_type: "refresh_token",
+          client_id: getCognitoConfig().clientId,
+          refresh_token: refreshToken
+        })
+      },
+      TOKEN_ENDPOINT_TIMEOUT_MS2
+    );
+  } catch (err) {
+    throw new RefreshTokenError(
+      "transient",
+      `Token refresh network error: ${err instanceof Error ? err.message : String(err)}`,
+      null
+    );
+  }
   if (!response.ok) {
-    throw new Error(`Token refresh failed: ${response.status}`);
+    const body = await response.text().catch(() => "");
+    throw new RefreshTokenError(
+      classifyRefreshFailure(response.status, body),
+      `Token refresh failed: ${response.status}`,
+      response.status
+    );
   }
   const data = await response.json();
   return {
     accessToken: data.access_token,
-    refreshToken,
-    // Cognito does not return a new refresh token
+    // Carry forward a rotated refresh token when Cognito returns one (rotation
+    // enabled); otherwise reuse the current token (rotation disabled today).
+    // Persisting the newest token is the hard prerequisite for enabling
+    // refresh-token rotation server-side.
+    refreshToken: data.refresh_token ?? refreshToken,
     idToken: data.id_token,
     expiresAt: Date.now() + data.expires_in * 1e3
   };
 }
+async function revokeRefreshToken(refreshToken) {
+  const { clientId } = getCognitoConfig();
+  if (!clientId || !refreshToken) return;
+  await fetchWithTimeout2(
+    `${getCognitoBaseUrl()}/oauth2/revoke`,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({ token: refreshToken, client_id: clientId })
+    },
+    TOKEN_ENDPOINT_TIMEOUT_MS2
+  );
+}
 async function getStoredCredentials2() {
   try {
-    const credPath = join44(getConfigDir2(), "credentials.json");
-    const data = await readFile15(credPath, "utf-8");
+    const credPath = join45(getConfigDir2(), "credentials.json");
+    const data = await readFile16(credPath, "utf-8");
     return JSON.parse(data);
   } catch (err) {
     if (err.code === "ENOENT" || err instanceof SyntaxError) {
@@ -11865,37 +12485,78 @@ async function getStoredCredentials2() {
 }
 async function storeCredentials2(credentials) {
   const dir = getConfigDir2();
-  const credPath = join44(dir, "credentials.json");
+  const credPath = join45(dir, "credentials.json");
   await mkdir18(dir, { recursive: true, mode: 448 });
-  await writeFile17(credPath, JSON.stringify(credentials, null, 2));
-  await chmod4(credPath, 384);
+  try {
+    await writeFile18(credPath, "", { flag: "a", mode: 384 });
+  } catch {
+  }
+  let release = null;
+  try {
+    release = await lockfile7.lock(credPath, { stale: 1e4, retries: 3, realpath: false });
+    const tmpPath = credPath + ".tmp";
+    try {
+      await writeFile18(tmpPath, JSON.stringify(credentials, null, 2), { mode: 384 });
+      let fh;
+      try {
+        fh = await open5(tmpPath, "r+");
+        await fh.datasync();
+      } finally {
+        await fh?.close();
+      }
+      await rename7(tmpPath, credPath);
+      await chmod4(credPath, 384);
+    } catch (err) {
+      try {
+        await unlink13(tmpPath);
+      } catch {
+      }
+      throw err;
+    }
+  } finally {
+    if (release) {
+      try {
+        await release();
+      } catch {
+      }
+    }
+  }
 }
 async function clearCredentials() {
   try {
-    await unlink11(join44(getConfigDir2(), "credentials.json"));
+    await unlink13(join45(getConfigDir2(), "credentials.json"));
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
   }
 }
+var refreshInFlight2 = null;
 async function getValidCredentials2(opts) {
   const creds = await getStoredCredentials2();
   if (!creds) return null;
   const needsRefresh = opts?.forceRefresh || Date.now() > creds.expiresAt - 5 * 60 * 1e3;
-  if (needsRefresh) {
-    try {
-      const refreshed = await refreshTokens2(creds.refreshToken);
-      refreshed.cognito = creds.cognito;
-      await storeCredentials2(refreshed);
-      return refreshed;
-    } catch {
-      if (Date.now() < creds.expiresAt) {
-        return creds;
-      }
+  if (!needsRefresh) return creds;
+  if (!refreshInFlight2) {
+    refreshInFlight2 = doRefresh2(creds).finally(() => {
+      refreshInFlight2 = null;
+    });
+  }
+  return refreshInFlight2;
+}
+async function doRefresh2(creds) {
+  try {
+    const refreshed = await refreshTokens2(creds.refreshToken);
+    refreshed.cognito = creds.cognito;
+    await storeCredentials2(refreshed);
+    return refreshed;
+  } catch (err) {
+    const kind = err instanceof RefreshTokenError ? err.kind : "transient";
+    if (kind === "terminal") {
       await clearCredentials();
       return null;
     }
+    if (Date.now() < creds.expiresAt) return creds;
+    return null;
   }
-  return creds;
 }
 async function performLogin() {
   const codeVerifier = generateCodeVerifier();
@@ -11904,8 +12565,8 @@ async function performLogin() {
   const authorizeUrl = getAuthorizeUrl(codeChallenge, state);
   const callbackPromise = startCallbackServer();
   try {
-    const open4 = (await import("open")).default;
-    await open4(authorizeUrl);
+    const open6 = (await import("open")).default;
+    await open6(authorizeUrl);
   } catch {
     console.log(`
 Open this URL in your browser to authenticate:
@@ -12003,7 +12664,6 @@ async function apiRequest(path, options) {
       });
     }
     if (!refreshed || response.status === 401) {
-      await clearCredentials();
       throw new Error("Session expired. Run `repowise login` again.");
     }
   }
@@ -12120,7 +12780,7 @@ async function writeToolConfigsForRepo(opts) {
 }
 
 // src/lib/mcp-resolver.ts
-import { basename as basename4, join as join45 } from "path";
+import { basename as basename4, join as join46 } from "path";
 import { promises as fs21 } from "fs";
 var MCP_WRITER_TOOLS = /* @__PURE__ */ new Set([
   "claude-code",
@@ -12134,19 +12794,19 @@ var MCP_WRITER_TOOLS = /* @__PURE__ */ new Set([
 function mcpPathFor(tool, repoRoot, home) {
   switch (tool) {
     case "claude-code":
-      return { path: join45(repoRoot, ".mcp.json"), scope: "repo" };
+      return { path: join46(repoRoot, ".mcp.json"), scope: "repo" };
     case "cursor":
-      return { path: join45(repoRoot, ".cursor", "mcp.json"), scope: "repo" };
+      return { path: join46(repoRoot, ".cursor", "mcp.json"), scope: "repo" };
     case "copilot":
-      return { path: join45(repoRoot, ".vscode", "mcp.json"), scope: "repo" };
+      return { path: join46(repoRoot, ".vscode", "mcp.json"), scope: "repo" };
     case "codex":
-      return { path: join45(home, ".codex", "mcp.json"), scope: "global" };
+      return { path: join46(home, ".codex", "mcp.json"), scope: "global" };
     case "windsurf":
-      return { path: join45(home, ".codeium", "windsurf", "mcp_config.json"), scope: "global" };
+      return { path: join46(home, ".codeium", "windsurf", "mcp_config.json"), scope: "global" };
     case "cline":
-      return { path: join45(home, ".cline", "mcp.json"), scope: "global" };
+      return { path: join46(home, ".cline", "mcp.json"), scope: "global" };
     case "gemini":
-      return { path: join45(home, ".gemini", "settings.json"), scope: "global" };
+      return { path: join46(home, ".gemini", "settings.json"), scope: "global" };
     default:
       return null;
   }
@@ -12196,9 +12856,9 @@ async function mcpStatusForRepo(opts) {
 
 // src/lib/gitignore.ts
 import { readFileSync as readFileSync2, writeFileSync, existsSync as existsSync2 } from "fs";
-import { join as join46 } from "path";
+import { join as join47 } from "path";
 function ensureGitignore(repoRoot, entry) {
-  const gitignorePath = join46(repoRoot, ".gitignore");
+  const gitignorePath = join47(repoRoot, ".gitignore");
   if (existsSync2(gitignorePath)) {
     const content = readFileSync2(gitignorePath, "utf-8");
     const lines = content.split("\n").map((l) => l.trim());
@@ -12215,7 +12875,7 @@ function ensureGitignore(repoRoot, entry) {
 // src/lib/graph-cache.ts
 init_config_dir();
 import { mkdirSync, writeFileSync as writeFileSync2, renameSync, unlinkSync } from "fs";
-import { dirname as dirname18, join as join47 } from "path";
+import { dirname as dirname18, join as join48 } from "path";
 var SAFE_REPO_ID = /^[A-Za-z0-9_.-]{1,128}$/;
 function assertSafeRepoId2(repoId) {
   if (!repoId || typeof repoId !== "string" || !SAFE_REPO_ID.test(repoId) || repoId === "." || repoId === ".." || repoId.startsWith(".")) {
@@ -12224,7 +12884,7 @@ function assertSafeRepoId2(repoId) {
 }
 function graphCachePath(repoId) {
   assertSafeRepoId2(repoId);
-  return join47(getConfigDir(), "graphs", `${repoId}.json`);
+  return join48(getConfigDir(), "graphs", `${repoId}.json`);
 }
 function isUsableGraph(parsed) {
   if (typeof parsed !== "object" || parsed === null) return false;
@@ -12653,19 +13313,17 @@ var ProgressRenderer = class {
     });
   }
   /**
-   * Coffee-and-context message shown once, after the user-driven interview
-   * completes. This is the gate between user input and the long
-   * machine-driven scan/generate/validate phases.
+   * Latch marking the end of the user-driven interview and the start of the
+   * long machine-driven scan/generate/validate phases. The post-interview
+   * "coffee" line now rides with the paid "RepoWise MCP is live" message
+   * (create.ts), emitted once the knowledge graph is actually downloadable \u2014
+   * so it no longer fires here. The stop/start keeps the spinner cadence
+   * stable across the interview\u2192scan handoff.
    */
   renderInterviewComplete(spinner) {
     if (this.interviewCompleteShown) return;
     this.interviewCompleteShown = true;
     spinner.stop();
-    console.log("");
-    console.log(
-      chalk4.cyan("  \u2615 Sit back and grab a coffee \u2014 we'll handle the rest from here.")
-    );
-    console.log("");
     spinner.start();
   }
   renderScanProgress(progress, spinner) {
@@ -12952,7 +13610,7 @@ import chalk6 from "chalk";
 
 // src/lib/dep-installer.ts
 import { promises as fs22 } from "fs";
-import { join as join48 } from "path";
+import { join as join49 } from "path";
 var SUPPORTED_DEP_LANGUAGES = /* @__PURE__ */ new Set([
   "typescript",
   "javascript",
@@ -12969,7 +13627,7 @@ var exists = async (p) => {
   }
 };
 async function fileExists16(repoRoot, name) {
-  return exists(join48(repoRoot, name));
+  return exists(join49(repoRoot, name));
 }
 async function detectNodePackageManager(repoRoot) {
   if (await fileExists16(repoRoot, "pnpm-lock.yaml")) {
@@ -13047,11 +13705,11 @@ async function detectMissingDeps(repoRoot, scopedLanguages) {
 import { spawn as spawn11 } from "child_process";
 import { createWriteStream as createWriteStream3 } from "fs";
 import { promises as fs23 } from "fs";
-import { join as join49 } from "path";
+import { join as join50 } from "path";
 var DEFAULT_INSTALL_TIMEOUT_MS = 10 * 60 * 1e3;
 async function runMissingDepInstalls(opts) {
   const safeRepoId = opts.repoId.replace(/[^a-zA-Z0-9_-]/g, "_");
-  const logPath2 = join49(getConfigDir2(), `install-log.${safeRepoId}.txt`);
+  const logPath2 = join50(getConfigDir2(), `install-log.${safeRepoId}.txt`);
   await fs23.mkdir(getConfigDir2(), { recursive: true });
   const stream = opts.logStream ?? createWriteStream3(logPath2, { flags: "a" });
   stream.on("error", () => {
@@ -13098,7 +13756,7 @@ async function runOne2(dep, repoRoot, stream, timeoutMs) {
 }
 async function runPipFlow(repoRoot, stream, timeoutMs) {
   await runSimple(["python3", "-m", "venv", ".venv"], repoRoot, stream, timeoutMs);
-  const venvPip = process.platform === "win32" ? join49(".venv", "Scripts", "pip.exe") : join49(".venv", "bin", "pip");
+  const venvPip = process.platform === "win32" ? join50(".venv", "Scripts", "pip.exe") : join50(".venv", "bin", "pip");
   await runSimple([venvPip, "install", "-r", "requirements.txt"], repoRoot, stream, timeoutMs);
 }
 function runSimple(cmd, repoRoot, stream, timeoutMs) {
@@ -13257,13 +13915,15 @@ function reportLspInstallOutcomes(results) {
 // src/commands/create.ts
 function formatElapsed(ms) {
   const totalSeconds = Math.round(ms / 1e3);
-  const minutes = Math.floor(totalSeconds / 60);
+  const hours = Math.floor(totalSeconds / 3600);
+  const minutes = Math.floor(totalSeconds % 3600 / 60);
   const seconds = totalSeconds % 60;
+  if (hours > 0) return minutes > 0 ? `${hours}h ${minutes}m` : `${hours}h`;
   if (minutes === 0) return `${seconds}s`;
   return seconds > 0 ? `${minutes}m ${seconds}s` : `${minutes}m`;
 }
 var POLL_INTERVAL_MS = 3e3;
-var MAX_POLL_ATTEMPTS = 7200;
+var MAX_POLL_ATTEMPTS = 14600;
 var DEFAULT_CONTEXT_FOLDER = "repowise-context";
 function buildWatchedRepoEntry(args) {
   const entry = {
@@ -13506,6 +14166,8 @@ async function create() {
     }
     let pollAttempts = 0;
     let pollErrors = 0;
+    let graphEarlyWriteDone = false;
+    let nonAwaitingPolls = 0;
     const MAX_POLL_ERRORS = 5;
     const progressRenderer = new ProgressRenderer();
     let depInstallShown = false;
@@ -13576,8 +14238,17 @@ async function create() {
         if (!interviewComplete && graphOnly) {
           interviewComplete = true;
           progressRenderer.setInterviewComplete(spinner);
+          spinner.stop();
+          console.log(
+            chalk8.cyan(
+              "  \u2615 Building your code graph \u2014 MCP will be live in a moment (Free plan: graph + MCP)."
+            )
+          );
+          spinner.start();
         }
         progressRenderer.update(syncResult, spinner);
+        if (syncResult.status === "awaiting_input") nonAwaitingPolls = 0;
+        else nonAwaitingPolls += 1;
         if (!graphOnly && syncResult.status === "in_progress") {
           if (syncResult.lspWaitState === "awaiting" || syncResult.lspWaitState === "analyzing") {
             lspWaitStartedAt ??= Date.now();
@@ -13591,6 +14262,45 @@ async function create() {
             spinner.start();
           }
         }
+        const interviewPhaseOver = interviewComplete || nonAwaitingPolls >= 3;
+        if (!graphOnly && !graphEarlyWriteDone && syncResult.graphReady === true && syncResult.status !== "awaiting_input" && interviewPhaseOver && repoRoot) {
+          const earlyCreds = await getValidCredentials2();
+          if (earlyCreds) {
+            graphEarlyWriteDone = true;
+            if (!interviewComplete) {
+              interviewComplete = true;
+              progressRenderer.setInterviewComplete(spinner);
+            }
+            spinner.stop();
+            await ensureGraphDownloaded({
+              repoId,
+              accessToken: earlyCreds.accessToken,
+              apiUrl: getEnvConfig().apiUrl
+            });
+            await writeToolConfigsForRepo({
+              repoRoot,
+              tools,
+              repoName,
+              contextFolder: DEFAULT_CONTEXT_FOLDER,
+              contextFiles: [],
+              variant: "graph",
+              migrateLegacy: true
+            });
+            if (!sigintBusy) {
+              console.log("");
+              console.log(
+                chalk8.green("  \u2714 RepoWise MCP is live \u2014 start exploring your codebase now.")
+              );
+              console.log(
+                chalk8.cyan(
+                  "  \u2615 Full docs are still generating in the background \u2014 your AI tools auto-upgrade when they're ready (graph precision keeps improving too)."
+                )
+              );
+              console.log("");
+              spinner.start();
+            }
+          }
+        }
         if (syncResult.status === "awaiting_input") {
           seenAwaitingInput = true;
         }
@@ -13669,7 +14379,7 @@ async function create() {
         const listResult = await apiRequest(`/v1/repos/${repoId}/context`);
         const files = listResult.data?.files ?? listResult.files ?? [];
         if (files.length > 0) {
-          const contextDir = join50(repoRoot, DEFAULT_CONTEXT_FOLDER);
+          const contextDir = join51(repoRoot, DEFAULT_CONTEXT_FOLDER);
           mkdirSync2(contextDir, { recursive: true });
           let downloadedCount = 0;
           let failedCount = 0;
@@ -13683,7 +14393,7 @@ async function create() {
             const response = await fetch(presignedUrl);
             if (response.ok) {
               const content = await response.text();
-              const filePath = join50(contextDir, file.fileName);
+              const filePath = join51(contextDir, file.fileName);
               mkdirSync2(dirname19(filePath), { recursive: true });
               writeFileSync3(filePath, content, "utf-8");
               downloadedCount++;
@@ -13778,6 +14488,13 @@ Files are stored on our servers (not in git). Retry when online.`
       });
       spinner.succeed("AI tools configured");
       console.log(chalk8.dim(results.map((r) => `  ${r}`).join("\n")));
+      if (!graphOnly && contextFiles.length > 0) {
+        console.log(
+          chalk8.cyan(
+            "  \u2728 Full context docs are ready \u2014 start a new AI session (or restart your AI tool) to pick up the upgraded instructions."
+          )
+        );
+      }
     }
     const priorAutoInstall = await getPriorConsent(repoId);
     const updatedRepos = [];
@@ -13905,7 +14622,7 @@ Files are stored on our servers (not in git). Retry when online.`
 
 // src/commands/member.ts
 import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname20, join as join51, resolve, sep } from "path";
+import { dirname as dirname20, join as join52, resolve, sep } from "path";
 import chalk9 from "chalk";
 import ora2 from "ora";
 var DEFAULT_CONTEXT_FOLDER2 = "repowise-context";
@@ -14059,7 +14776,7 @@ async function member() {
     spinner.succeed(`Found ${chalk9.bold(files.length)} context files on server`);
     const { tools } = await selectAiTools();
     spinner.start("Downloading context files...");
-    const contextDir = join51(repoRoot, DEFAULT_CONTEXT_FOLDER2);
+    const contextDir = join52(repoRoot, DEFAULT_CONTEXT_FOLDER2);
     mkdirSync3(contextDir, { recursive: true });
     let downloadedCount = 0;
     let failedCount = 0;
@@ -14239,9 +14956,9 @@ import ora3 from "ora";
 // src/lib/tenant-graph-purge.ts
 import { promises as fs24 } from "fs";
 import { homedir as homedir8 } from "os";
-import { join as join52 } from "path";
+import { join as join53 } from "path";
 async function purgeForeignGraphs(validRepoIds, home = homedir8()) {
-  const graphsDir = join52(home, ".repowise", "graphs");
+  const graphsDir = join53(home, ".repowise", "graphs");
   const result = { kept: [], removed: [] };
   let entries;
   try {
@@ -14259,7 +14976,7 @@ async function purgeForeignGraphs(validRepoIds, home = homedir8()) {
       result.kept.push(entry);
       continue;
     }
-    const path = join52(graphsDir, entry);
+    const path = join53(graphsDir, entry);
     try {
       const stat8 = await fs24.lstat(path);
       if (stat8.isSymbolicLink()) {
@@ -14295,8 +15012,8 @@ Waiting for authentication...`);
     } else {
       spinner.text = "Opening browser for authentication...";
       try {
-        const open4 = (await import("open")).default;
-        await open4(authorizeUrl);
+        const open6 = (await import("open")).default;
+        await open6(authorizeUrl);
         spinner.text = "Waiting for authentication in browser...";
       } catch {
         spinner.stop();
@@ -14363,30 +15080,25 @@ async function logout() {
     console.log(chalk11.yellow("Not logged in."));
     return;
   }
+  try {
+    await revokeRefreshToken(creds.refreshToken);
+  } catch {
+  }
   await clearCredentials();
   console.log(chalk11.green("Logged out successfully."));
 }
 
 // src/commands/status.ts
-import { readFile as readFile16 } from "fs/promises";
-import { basename as basename5, join as join53 } from "path";
+import { readFile as readFile17 } from "fs/promises";
+import { basename as basename5, join as join54 } from "path";
 import { homedir as homedir10 } from "os";
-
-// ../../packages/shared/dist/lib/creds.js
-function isCredsHardExpired(creds) {
-  if (!creds || typeof creds.expiresAt !== "number")
-    return true;
-  return Date.now() >= creds.expiresAt;
-}
-
-// src/commands/status.ts
 async function status() {
   const configDir = getConfigDir2();
-  const STATE_PATH = join53(configDir, "listener-state.json");
-  const CONFIG_PATH = join53(configDir, "config.json");
+  const STATE_PATH = join54(configDir, "listener-state.json");
+  const CONFIG_PATH = join54(configDir, "config.json");
   let state = null;
   try {
-    const data = await readFile16(STATE_PATH, "utf-8");
+    const data = await readFile17(STATE_PATH, "utf-8");
     state = JSON.parse(data);
   } catch {
   }
@@ -14430,7 +15142,7 @@ async function status() {
   const repoPaths = /* @__PURE__ */ new Map();
   let aiTools = [];
   try {
-    const configData = await readFile16(CONFIG_PATH, "utf-8");
+    const configData = await readFile17(CONFIG_PATH, "utf-8");
     const config2 = JSON.parse(configData);
     for (const repo of config2.repos ?? []) {
       repoNames.set(repo.repoId, basename5(repo.localPath));
@@ -14472,16 +15184,18 @@ async function status() {
 
 // src/commands/sync.ts
 import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname21, join as join54 } from "path";
+import { dirname as dirname21, join as join55 } from "path";
 import chalk12 from "chalk";
 import ora4 from "ora";
 var POLL_INTERVAL_MS2 = 3e3;
-var MAX_POLL_ATTEMPTS2 = 7200;
+var MAX_POLL_ATTEMPTS2 = 14600;
 var DEFAULT_CONTEXT_FOLDER3 = "repowise-context";
 function formatElapsed3(ms) {
   const totalSeconds = Math.round(ms / 1e3);
-  const minutes = Math.floor(totalSeconds / 60);
+  const hours = Math.floor(totalSeconds / 3600);
+  const minutes = Math.floor(totalSeconds % 3600 / 60);
   const seconds = totalSeconds % 60;
+  if (hours > 0) return minutes > 0 ? `${hours}h ${minutes}m` : `${hours}h`;
   if (minutes === 0) return `${seconds}s`;
   return seconds > 0 ? `${minutes}m ${seconds}s` : `${minutes}m`;
 }
@@ -14621,7 +15335,7 @@ async function sync() {
       const listResult = await apiRequest(`/v1/repos/${repoId}/context`);
       const files = listResult.data?.files ?? listResult.files ?? [];
       if (files.length > 0) {
-        const contextDir = join54(repoRoot, DEFAULT_CONTEXT_FOLDER3);
+        const contextDir = join55(repoRoot, DEFAULT_CONTEXT_FOLDER3);
         mkdirSync4(contextDir, { recursive: true });
         let downloadedCount = 0;
         let failedCount = 0;
@@ -14635,7 +15349,7 @@ async function sync() {
           const response = await fetch(presignedUrl);
           if (response.ok) {
             const content = await response.text();
-            const filePath = join54(contextDir, file.fileName);
+            const filePath = join55(contextDir, file.fileName);
             mkdirSync4(dirname21(filePath), { recursive: true });
             writeFileSync5(filePath, content, "utf-8");
             downloadedCount++;
@@ -15038,8 +15752,8 @@ async function toolsList() {
 
 // src/commands/mcp-log.ts
 import { createDecipheriv as createDecipheriv2 } from "crypto";
-import { mkdir as mkdir19, readFile as readFile17, stat as stat7, writeFile as writeFile18 } from "fs/promises";
-import { dirname as dirname22, join as join55 } from "path";
+import { mkdir as mkdir19, readFile as readFile18, stat as stat7, writeFile as writeFile19 } from "fs/promises";
+import { dirname as dirname22, join as join56 } from "path";
 var FLAG_FILE = "mcp-log.flag";
 var LOG_FILE = "mcp-log.jsonl.enc";
 var KEY_FILE = "mcp-log.key";
@@ -15047,20 +15761,20 @@ var ENDPOINT_FILE = "listener.endpoint";
 var IV_BYTES2 = 12;
 var TAG_BYTES2 = 16;
 function flagPath() {
-  return join55(getConfigDir2(), FLAG_FILE);
+  return join56(getConfigDir2(), FLAG_FILE);
 }
 function logPath() {
-  return join55(getConfigDir2(), LOG_FILE);
+  return join56(getConfigDir2(), LOG_FILE);
 }
 async function writeFlag(flag) {
   const path = flagPath();
   await mkdir19(dirname22(path), { recursive: true });
-  await writeFile18(path, JSON.stringify(flag, null, 2), { encoding: "utf-8", mode: 384 });
+  await writeFile19(path, JSON.stringify(flag, null, 2), { encoding: "utf-8", mode: 384 });
 }
 async function mcpLogOn() {
   let flagOnDisk = null;
   try {
-    flagOnDisk = JSON.parse(await readFile17(flagPath(), "utf-8"));
+    flagOnDisk = JSON.parse(await readFile18(flagPath(), "utf-8"));
   } catch {
     flagOnDisk = null;
   }
@@ -15070,11 +15784,12 @@ async function mcpLogOn() {
       enabled: true
     };
     await writeFlag(next);
-    process.stderr.write(`MCP logging re-enabled. Log file: ${logPath()}
-`);
+    process.stderr.write(
+      "MCP telemetry re-enabled. The pseudonymous usage heartbeat will resume.\n"
+    );
     return;
   }
-  process.stderr.write("MCP logging is already enabled.\n");
+  process.stderr.write("MCP telemetry is already enabled.\n");
   if (!flagOnDisk || !flagOnDisk.consentSentToServer) {
     const synced = await trySendConsentToServer();
     if (synced) {
@@ -15091,14 +15806,14 @@ async function trySendConsentToServer() {
   let apiUrl = null;
   let token = null;
   try {
-    const body = await readFile17(join55(getConfigDir2(), "config.json"), "utf-8");
+    const body = await readFile18(join56(getConfigDir2(), "config.json"), "utf-8");
     const parsed = JSON.parse(body);
     apiUrl = parsed.repos?.find((r) => Boolean(r.apiUrl))?.apiUrl ?? parsed.defaultApiUrl ?? null;
   } catch {
     return false;
   }
   try {
-    const body = await readFile17(join55(getConfigDir2(), "credentials.json"), "utf-8");
+    const body = await readFile18(join56(getConfigDir2(), "credentials.json"), "utf-8");
     const parsed = JSON.parse(body);
     token = parsed.idToken ?? null;
   } catch {
@@ -15121,12 +15836,12 @@ async function trySendConsentToServer() {
 async function mcpLogOff() {
   let flagOnDisk = null;
   try {
-    flagOnDisk = JSON.parse(await readFile17(flagPath(), "utf-8"));
+    flagOnDisk = JSON.parse(await readFile18(flagPath(), "utf-8"));
   } catch {
     flagOnDisk = null;
   }
   if (flagOnDisk && flagOnDisk.enabled === false) {
-    process.stderr.write("MCP logging is already disabled.\n");
+    process.stderr.write("MCP telemetry is already disabled.\n");
     process.exitCode = 1;
     return;
   }
@@ -15137,38 +15852,38 @@ async function mcpLogOff() {
   };
   await writeFlag(next);
   process.stderr.write(
-    "MCP logging disabled. Local log file is preserved; consent record is NOT revoked.\n"
+    "MCP telemetry disabled. The pseudonymous usage heartbeat is now off; the server-side consent record is NOT revoked (GDPR Art. 7(1) audit trail).\n"
   );
 }
 async function mcpLogStatus() {
   let flagOnDisk = null;
   try {
-    flagOnDisk = JSON.parse(await readFile17(flagPath(), "utf-8"));
+    flagOnDisk = JSON.parse(await readFile18(flagPath(), "utf-8"));
   } catch {
     flagOnDisk = null;
   }
   const enabled = !flagOnDisk || flagOnDisk.enabled !== false;
   const enabledLabel = flagOnDisk == null ? "yes (default)" : flagOnDisk.enabled ? "yes" : "no";
   void enabled;
-  process.stderr.write("MCP Log Status\n");
-  process.stderr.write("==============\n");
-  process.stderr.write(`Enabled:         ${enabledLabel}
-`);
-  process.stderr.write(`Consent granted: ${flagOnDisk?.consentGrantedAt ?? "never"}
+  process.stderr.write("MCP Telemetry Status\n");
+  process.stderr.write("====================\n");
+  process.stderr.write(`Heartbeat enabled: ${enabledLabel}
 `);
-  process.stderr.write(`Log file:        ${logPath()}
+  process.stderr.write(`Opt-in since:      ${flagOnDisk?.consentGrantedAt ?? "never"}
 `);
+  process.stderr.write("Raw local logging: disabled (heartbeat only)\n");
   try {
     const s = await stat7(logPath());
-    process.stderr.write(
-      `Log size:        ${formatBytes(s.size)} (last modified ${s.mtime.toISOString()})
+    if (s.size > 0) {
+      process.stderr.write(
+        `Raw log file:      ${logPath()} \u2014 ${formatBytes(s.size)} (escape hatch enabled)
 `
-    );
+      );
+    }
   } catch {
-    process.stderr.write("Log size:        no file yet\n");
   }
   try {
-    const endpointBody = await readFile17(join55(getConfigDir2(), ENDPOINT_FILE), "utf-8");
+    const endpointBody = await readFile18(join56(getConfigDir2(), ENDPOINT_FILE), "utf-8");
     const match = /endpoint=([^\n]+)/.exec(endpointBody);
     process.stderr.write(`MCP endpoint:    ${match?.[1] ?? "(malformed endpoint file)"}
 `);
@@ -15184,13 +15899,13 @@ function formatBytes(n) {
 async function mcpLogViewingFlags(flags = {}) {
   let flagOnDisk = null;
   try {
-    flagOnDisk = JSON.parse(await readFile17(flagPath(), "utf-8"));
+    flagOnDisk = JSON.parse(await readFile18(flagPath(), "utf-8"));
   } catch {
     flagOnDisk = null;
   }
   if (flagOnDisk && flagOnDisk.enabled === false) {
     process.stderr.write(
-      `MCP logging is disabled. Run \`repowise mcp-log on\` to re-enable and view logs.
+      `MCP telemetry is disabled. Run \`repowise mcp-log on\` to re-enable.
 `
     );
     return;
@@ -15199,7 +15914,7 @@ async function mcpLogViewingFlags(flags = {}) {
   const key = await readKey();
   if (!key) {
     process.stderr.write(
-      `No encryption key at ${join55(getConfigDir2(), KEY_FILE)} \u2014 listener may not have started yet.
+      `No encryption key at ${join56(getConfigDir2(), KEY_FILE)} \u2014 listener may not have started yet.
 `
     );
     return;
@@ -15227,7 +15942,7 @@ async function mcpLogViewingFlags(flags = {}) {
     }
   };
   try {
-    const raw = await readFile17(path, "utf-8");
+    const raw = await readFile18(path, "utf-8");
     const decoded = [];
     for (const line of raw.split("\n")) {
       const r = filter(line);
@@ -15251,7 +15966,7 @@ async function mcpLogViewingFlags(flags = {}) {
         try {
           const s = await stat7(path);
           if (s.size > lastSize) {
-            const fresh = await readFile17(path, "utf-8");
+            const fresh = await readFile18(path, "utf-8");
             const tail = fresh.slice(lastSize);
             for (const line of tail.split("\n")) {
               const r = filter(line);
@@ -15275,7 +15990,7 @@ async function mcpLogViewingFlags(flags = {}) {
 }
 async function readKey() {
   try {
-    const body = await readFile17(join55(getConfigDir2(), KEY_FILE), "utf-8");
+    const body = await readFile18(join56(getConfigDir2(), KEY_FILE), "utf-8");
     const parsed = Buffer.from(body.trim(), "base64");
     if (parsed.length !== 32) return null;
     return parsed;
@@ -15319,7 +16034,7 @@ import chalk15 from "chalk";
 
 // src/lib/graph-loader.ts
 import { promises as fs25 } from "fs";
-import { join as join56, resolve as resolve2 } from "path";
+import { join as join57, resolve as resolve2 } from "path";
 import { gunzipSync } from "zlib";
 var RELATIVE_GRAPH_PATH = "repowise-context/.meta/dependency-graph.json";
 var GZIPPED_GRAPH_PATH = "repowise-context/.meta/dependency-graph.json.gz";
@@ -15336,8 +16051,8 @@ var GraphNotFoundError = class extends Error {
 var cache = /* @__PURE__ */ new Map();
 async function loadGraph(repoRoot = process.cwd()) {
   const root = resolve2(repoRoot);
-  const gzPath = join56(root, GZIPPED_GRAPH_PATH);
-  const plainPath = join56(root, RELATIVE_GRAPH_PATH);
+  const gzPath = join57(root, GZIPPED_GRAPH_PATH);
+  const plainPath = join57(root, RELATIVE_GRAPH_PATH);
   const cached = cache.get(root);
   if (cached) {
     return { graph: cached, path: plainPath, bytes: 0, parseMs: 0, fromCache: true };
@@ -15753,12 +16468,12 @@ function registerQueryCommand(program2) {
 // src/commands/uninstall.ts
 import { promises as fs29 } from "fs";
 import { homedir as homedir12 } from "os";
-import { join as join60 } from "path";
+import { join as join61 } from "path";
 import chalk16 from "chalk";
 
 // src/lib/cleanup/marker-blocks.ts
 import { promises as fs26 } from "fs";
-import { join as join57 } from "path";
+import { join as join58 } from "path";
 var MARKER_START = "<!-- repowise-start -->";
 var MARKER_END = "<!-- repowise-end -->";
 var CONTEXT_FILES = [
@@ -15798,7 +16513,7 @@ async function stripMarkerBlock(filePath) {
 async function stripAllMarkerBlocks(repoRoot) {
   const out = [];
   for (const relative of CONTEXT_FILES) {
-    const full = join57(repoRoot, relative);
+    const full = join58(repoRoot, relative);
     const result = await stripMarkerBlock(full).catch((err) => ({
       path: full,
       status: "untouched",
@@ -15811,18 +16526,18 @@ async function stripAllMarkerBlocks(repoRoot) {
 
 // src/lib/cleanup/mcp-configs.ts
 import { promises as fs27 } from "fs";
-import { join as join58 } from "path";
+import { join as join59 } from "path";
 function mcpConfigPaths(repoRoot, home) {
   return [
-    join58(repoRoot, ".mcp.json"),
-    join58(repoRoot, ".cursor", "mcp.json"),
-    join58(repoRoot, ".vscode", "mcp.json"),
-    join58(repoRoot, ".roo", "mcp.json"),
-    join58(home, ".cline", "mcp.json"),
-    join58(home, ".codeium", "windsurf", "mcp_config.json"),
-    join58(home, ".gemini", "settings.json"),
-    join58(home, ".codex", "mcp.json"),
-    join58(home, ".roo", "mcp.json")
+    join59(repoRoot, ".mcp.json"),
+    join59(repoRoot, ".cursor", "mcp.json"),
+    join59(repoRoot, ".vscode", "mcp.json"),
+    join59(repoRoot, ".roo", "mcp.json"),
+    join59(home, ".cline", "mcp.json"),
+    join59(home, ".codeium", "windsurf", "mcp_config.json"),
+    join59(home, ".gemini", "settings.json"),
+    join59(home, ".codex", "mcp.json"),
+    join59(home, ".roo", "mcp.json")
   ];
 }
 async function removeRepowiseFromConfig(path, serverName) {
@@ -15863,10 +16578,10 @@ async function removeAllMcpEntries(repoRoot, home, repoId) {
 // src/lib/cleanup/local-state.ts
 import { promises as fs28 } from "fs";
 import { homedir as homedir11 } from "os";
-import { join as join59, resolve as resolve3 } from "path";
+import { join as join60, resolve as resolve3 } from "path";
 async function clearLocalState(homeOverride) {
   const home = homeOverride ?? homedir11();
-  const target = resolve3(join59(home, ".repowise"));
+  const target = resolve3(join60(home, ".repowise"));
   if (target === resolve3(home) || !target.startsWith(resolve3(home))) {
     return { path: target, status: "error", error: "refused: not under home" };
   }
@@ -15910,7 +16625,7 @@ async function uninstall2(opts = {}) {
   else if (svc.error) report.skipped.push({ path: "listener service", reason: svc.error });
   if (tier === "stop") return report;
   try {
-    await fs29.unlink(join60(home, ".repowise", "credentials.json"));
+    await fs29.unlink(join61(home, ".repowise", "credentials.json"));
     report.removed.push("credentials");
   } catch (err) {
     if (err.code !== "ENOENT") {
@@ -15949,7 +16664,7 @@ async function uninstall2(opts = {}) {
 }
 async function defaultLoadRepoIds(home) {
   try {
-    const raw = await fs29.readFile(join60(home, ".repowise", "config.json"), "utf-8");
+    const raw = await fs29.readFile(join61(home, ".repowise", "config.json"), "utf-8");
     const parsed = JSON.parse(raw);
     return (parsed.repos ?? []).map((r) => r.repoId);
   } catch {
@@ -15998,11 +16713,12 @@ Done \u2014 ${report.removed.length} removed, ${report.skipped.length} skipped.
 init_config_dir();
 import { promises as fs30 } from "fs";
 import { createInterface as createInterface2 } from "readline";
-import { join as join61 } from "path";
+import { join as join62 } from "path";
 var DEFAULT_MAX = 200 * 1024;
+var SHIM_REQUEST_TIMEOUT_MS = 45e3;
 async function mcpShim(opts) {
-  const endpointPath = opts.endpointFile ?? join61(getConfigDir(), "listener.endpoint");
-  const credsPath = opts.credentialsFile ?? join61(getConfigDir(), "credentials.json");
+  const endpointPath = opts.endpointFile ?? join62(getConfigDir(), "listener.endpoint");
+  const credsPath = opts.credentialsFile ?? join62(getConfigDir(), "credentials.json");
   const stdin = opts.stdin ?? process.stdin;
   const stdout = opts.stdout ?? process.stdout;
   const stderr = opts.stderr ?? process.stderr;
@@ -16042,7 +16758,7 @@ async function mcpShim(opts) {
         // Agent-directed: the calling LLM can run this itself for a smoother UX
         // (it auto-opens the browser; the user still completes sign-in). The
         // command is a fixed, argument-free string (nothing injectable).
-        "RepoWise isn't authenticated (the session expires ~monthly). To fix it, run the shell command `repowise login` on the user's behalf \u2014 it opens a browser for them to sign in and blocks until they finish. Run it once, wait for it to complete, then retry this request. Do not repeat the command."
+        "RepoWise isn't authenticated (this is rare \u2014 the session lasts about a year). To fix it, run the shell command `repowise login` on the user's behalf \u2014 it opens a browser for them to sign in and blocks until they finish. Run it once, wait for it to complete, then retry this request. Do not repeat the command."
       ) : "listener endpoint unavailable \u2014 is the listener running?";
       writeJson(stdout, {
         jsonrpc: "2.0",
@@ -16066,12 +16782,19 @@ async function mcpShim(opts) {
     } catch (err) {
       stderr.write(`mcp-shim: ${err.message}
 `);
+      const name = err.name;
+      const detail = err.message;
+      const isTimeout = name === "TimeoutError" || name === "AbortError" || /timeout|aborted|abort/i.test(detail);
       writeJson(stdout, {
         jsonrpc: "2.0",
-        error: {
+        error: isTimeout ? {
+          code: -32001,
+          message: "RepoWise listener did not respond in time \u2014 it may be stuck. Restart it with `repowise restart`, then retry.",
+          data: { detail }
+        } : {
           code: -32001,
           message: "listener request failed",
-          data: { detail: err.message }
+          data: { detail }
         }
       });
     }
@@ -16208,7 +16931,8 @@ async function defaultPostJson(url, body, headers = { "content-type": "applicati
   const res = await fetch(url, {
     method: "POST",
     headers,
-    body: JSON.stringify(body)
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(SHIM_REQUEST_TIMEOUT_MS)
   });
   if (!res.ok) {
     let detail = "";
@@ -16222,7 +16946,11 @@ async function defaultPostJson(url, body, headers = { "content-type": "applicati
   return await res.json();
 }
 async function defaultGetJson(url, headers = {}) {
-  const res = await fetch(url, { method: "GET", headers });
+  const res = await fetch(url, {
+    method: "GET",
+    headers,
+    signal: AbortSignal.timeout(SHIM_REQUEST_TIMEOUT_MS)
+  });
   if (!res.ok) {
     let detail = "";
     try {
@@ -16771,7 +17499,7 @@ async function lspOn() {
 // bin/repowise.ts
 var __filename = fileURLToPath4(import.meta.url);
 var __dirname = dirname23(__filename);
-var pkg = JSON.parse(readFileSync3(join62(__dirname, "..", "..", "package.json"), "utf-8"));
+var pkg = JSON.parse(readFileSync3(join63(__dirname, "..", "..", "package.json"), "utf-8"));
 var program = new Command();
 program.name(getPackageName()).description("AI-optimized codebase context generator").version(pkg.version).hook("preAction", async () => {
   await showWelcome(pkg.version);