@echomem/mcp 1.4.20 → 1.4.22

package/dist/setup.js

@@ -1,16 +1,17 @@
 /**
- * `echomem-mcp init | setup | login | unlock | status | logout` — onboarding for the local bridge (spec §8).
+ * `echomem-mcp init | setup | login | unlock | status | logout` — local bridge lifecycle (spec §8).
  *
  * Design goals from the spec:
- *   - One command → one browser approval → one reload.
+ *   - `login` establishes the account and trusted device only; it never reads local history.
+ *   - `init` runs one ordered flow: local-history permission/report, login, plan if needed, then extraction.
  *   - Both secrets (API token + encryption key) ride a single browser flow and land in the local
  *     keystore — never in the client's MCP config, never in the agent's chat context.
  *   - Re-unlock after the key's TTL is one step, not a re-setup.
  *
- * The browser flow posts `{ token, key? }` to a localhost callback this process opens. The
- * "connect device" web page that drives it is the one piece that lives in the web app (not here);
- * until it ships, the same flow is fully usable via the manual flags (`--token`, `--key`,
- * `--passphrase`), which is also the documented headless/SSH path (spec §8).
+ * Both browser flows stay on a localhost page. Login collects email OTP consent and an encryption
+ * passphrase; onboarding separately asks to access local coding history. This process asks the
+ * hosted API to send/verify OTP and mint a device token. Secrets land in the local keystore —
+ * never in the client's MCP config or the agent's chat context.
  */
 import http from "node:http";
 import { randomUUID } from "node:crypto";
@@ -23,7 +24,7 @@ import readline from "node:readline";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import axios from "axios";
 import { KeyStore } from "./keystore.js";
-import { fetchEncryptionConfig, deriveAndVerifyKey, verifyKeyB64 } from "./encryption.js";
+import { fetchEncryptionConfig, deriveAndVerifyKey, setupNewEncryptionKey, verifyKeyB64 } from "./encryption.js";
 import { collect, runReport, buildStatsPayload } from "./report.js";
 import { cmdMigrate, applyAccountImportStatus, applyFastAccountImportStatus, discoverMigratableFastDiscovery, discoverMigratableSessions, discoverPendingSessionsTargeted, estimateMigrationEta, fetchProcessedImportKeys, isImportStatusUnsupported, markAccountImportStatusFailed, markAccountImportStatusUnavailable, markFastAccountImportStatusUnavailable, startMigration, summarizeFastMigratableDiscovery, MIGRATE_CONCURRENCY, } from "./migrate.js";
 import { syncCodexUsage } from "./codex-sync.js";
@@ -33,12 +34,32 @@ import { repoLabel, validateForensicReportForSetup } from "./forensics.js";
 import { installHooks } from "./hud/hooks.js";
 import { MCP_PACKAGE_LABEL, MCP_PACKAGE_NAME, MCP_PACKAGE_VERSION, MCP_UPDATE_ALL_COMMAND, MCP_UPDATE_COMMAND } from "./package-metadata.js";
 import { checkLatestUpdateStatus, compareSemver, readCachedUpdateStatus } from "./update-check.js";
-// The hosted connect-device page is now only the account-auth/token courier. The dashboard itself is
-// served by this localhost bridge, where local logs and processed/unprocessed counts never leave the
-// device unless the user explicitly starts migration. Override the hosted auth origin with ECHO_WEB_URL.
-const WEB_URL = (process.env.ECHO_WEB_URL || "https://yeahecho.com").replace(/\/$/, "");
+// The setup dashboard, account login, and encryption passphrase entry are all served by this
+// localhost bridge. The hosted API only sends OTP email, verifies the code, and mints a device token.
 const API_BASE_URL = (process.env.ECHO_API_BASE_URL || "https://echo-mem-chrome.vercel.app").replace(/\/$/, "");
 const PRICING_URL = (process.env.ECHO_PRICING_URL || "https://echoknows.com/pricing").replace(/\/$/, "");
+function hostedBillingEndpoint(pathname) {
+    const url = new URL(PRICING_URL);
+    url.pathname = pathname;
+    url.search = "";
+    url.hash = "";
+    return url.toString();
+}
+function isExpectedStripeUrl(value, kind) {
+    if (typeof value !== "string")
+        return false;
+    try {
+        const url = new URL(value);
+        if (url.protocol !== "https:")
+            return false;
+        return kind === "checkout"
+            ? url.hostname === "checkout.stripe.com"
+            : url.hostname === "billing.stripe.com";
+    }
+    catch {
+        return false;
+    }
+}
 const CODEX_SKILL_NAMES = [
     "echomem-search",
     "echomem-save",
@@ -268,6 +289,52 @@ function resolveGlobalEntry() {
     }
     return null;
 }
+export function needsDurableGlobalUpdate(runningEntry, durableEntry, targetVersion = MCP_PACKAGE_VERSION) {
+    if (!isEphemeralNpxPath(runningEntry))
+        return false;
+    const installedVersion = durableEntry
+        ? packageVersionFromPath(durableEntry)?.version
+        : undefined;
+    return installedVersion !== targetVersion;
+}
+function installDurableGlobalUpdate() {
+    const runningEntry = (() => {
+        try {
+            return fs.realpathSync(process.argv[1] || "");
+        }
+        catch {
+            return process.argv[1] || "";
+        }
+    })();
+    const currentGlobalEntry = resolveGlobalEntry();
+    if (!needsDurableGlobalUpdate(runningEntry, currentGlobalEntry))
+        return;
+    const packageSpec = `${MCP_PACKAGE_NAME}@${MCP_PACKAGE_VERSION}`;
+    console.log(`Installing durable ${packageSpec} before updating client configs…`);
+    const npmExecPath = process.env.npm_execpath;
+    try {
+        if (npmExecPath && fs.existsSync(npmExecPath)) {
+            execFileSync(process.execPath, [npmExecPath, "install", "-g", packageSpec], {
+                stdio: "inherit",
+            });
+        }
+        else {
+            execFileSync(process.platform === "win32" ? "npm.cmd" : "npm", ["install", "-g", packageSpec], {
+                stdio: "inherit",
+            });
+        }
+    }
+    catch (error) {
+        throw new Error(`Could not install ${packageSpec} globally: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const installedEntry = resolveGlobalEntry();
+    const installedVersion = installedEntry
+        ? packageVersionFromPath(installedEntry)?.version
+        : undefined;
+    if (installedVersion !== MCP_PACKAGE_VERSION) {
+        throw new Error(`Global EchoMem bridge is ${installedVersion || "missing"} after update; expected ${MCP_PACKAGE_VERSION}.`);
+    }
+}
 /** The TOML block EchoMem adds to ~/.codex/config.toml. No secret — the bridge reads the keystore. */
 export function codexTomlBlock(entry) {
     const command = JSON.stringify(String(entry.command));
@@ -1191,9 +1258,9 @@ function publicRunningForensicProgress(value) {
     };
 }
 /**
- * Start the persistent localhost bridge used by the connect-device page. It accepts the token,
- * serves local Wrapped stats, and holds the /migrate response until cmdLogin has created a cloud
- * import session.
+ * Start the persistent localhost bridge used by the setup page. It sends/verifies OTP through the
+ * hosted API, accepts the local passphrase, serves local Wrapped stats, and holds the /migrate
+ * response until cmdLogin has created a cloud import session.
  */
 export function startCallbackServer(opts = {}) {
     const timeoutMs = opts.timeoutMs ?? 15 * 60_000;
@@ -1203,6 +1270,11 @@ export function startCallbackServer(opts = {}) {
     const dashboardTimeoutMs = 4 * 60 * 60 * 1000;
     const expectedNonce = opts.nonce;
     const scanId = opts.scanId ?? randomUUID();
+    const flow = opts.flow ?? "onboarding";
+    const isLoginFlow = flow === "login";
+    // A login screen must not be blocked by a local-history permission. That permission belongs to
+    // onboarding and is intentionally enforced separately below.
+    const requiresReportConsent = opts.requireReportConsent === true && !isLoginFlow;
     return new Promise((resolveOuter, rejectOuter) => {
         const onToken = deferred();
         const decision = deferred();
@@ -1210,8 +1282,10 @@ export function startCallbackServer(opts = {}) {
         let stats = null;
         let authUrl = "";
         let switchAccountUrl = "";
-        let connected = false;
-        let reportConsentGranted = opts.requireReportConsent !== true;
+        let connected = Boolean(opts.initialToken?.token);
+        let activeDeviceToken = opts.initialToken?.token || "";
+        let pendingLocalAuth = null;
+        let reportConsentGranted = !requiresReportConsent;
         let progress = { status: "idle", total: 0, completed: 0, running: 0, queued: 0, failed: 0, extracted: 0 };
         let migrateStarted = false;
         let tokenRefreshHandler = null;
@@ -1227,6 +1301,26 @@ export function startCallbackServer(opts = {}) {
         const checkNonce = (nonce) => !expectedNonce || nonce === expectedNonce;
         const text = (res, status, body = "") => res.writeHead(status, { "Content-Type": "text/plain" }).end(body);
         const json = (res, status, body) => res.writeHead(status, { "Content-Type": "application/json" }).end(JSON.stringify(body));
+        const revokeDeviceToken = async (token) => {
+            try {
+                await authedAxios(token).post("/api/extension/mcp/local-auth/revoke-device", {}, { timeout: 10_000 });
+                return true;
+            }
+            catch (error) {
+                console.error(`Could not revoke incomplete local login: ${error instanceof Error ? error.message : String(error)}`);
+                return false;
+            }
+        };
+        const revokePendingLocalAuth = async () => {
+            const pending = pendingLocalAuth;
+            pendingLocalAuth = null;
+            if (!pending)
+                return false;
+            return revokeDeviceToken(pending.token);
+        };
+        const completeDeviceLogin = async (token) => {
+            await authedAxios(token).post("/api/extension/mcp/local-auth/complete-device", {}, { timeout: 10_000 });
+        };
         const close = () => {
             if (timer)
                 clearTimeout(timer);
@@ -1234,6 +1328,7 @@ export function startCallbackServer(opts = {}) {
             if (closed)
                 return;
             closed = true;
+            void revokePendingLocalAuth();
             server.close();
             for (const socket of sockets)
                 socket.destroy();
@@ -1245,7 +1340,7 @@ export function startCallbackServer(opts = {}) {
             const waitMs = onToken.settled() ? dashboardTimeoutMs : timeoutMs;
             timer = setTimeout(() => {
                 if (!onToken.settled()) {
-                    onToken.reject(new Error(`browser approval did not finish in ${approvalTimeoutLabel}`));
+                    onToken.reject(new Error(`local setup did not finish in ${approvalTimeoutLabel}`));
                 }
                 else if (!decision.settled()) {
                     decision.resolve("timeout");
@@ -1257,7 +1352,7 @@ export function startCallbackServer(opts = {}) {
         const handleCallback = (res, token, key, nonce) => {
             if (!checkNonce(nonce))
                 return void text(res, 403, "bad nonce");
-            if (opts.requireReportConsent === true && !reportConsentGranted) {
+            if (requiresReportConsent && !reportConsentGranted) {
                 return void json(res, 403, {
                     error: "LOCAL_HISTORY_CONSENT_REQUIRED",
                     message: "Allow local history access in the setup page before connecting EchoMem.",
@@ -1265,9 +1360,10 @@ export function startCallbackServer(opts = {}) {
             }
             if (!token)
                 return void text(res, 400, "missing token");
-            console.log(`[${new Date().toISOString()}] Browser approval callback received.`);
+            console.log(`[${new Date().toISOString()}] Device token callback received.`);
             const firstToken = !onToken.settled();
             connected = true;
+            activeDeviceToken = token;
             const setupPath = `/setup?nonce=${encodeURIComponent(nonce || "")}&connected=1`;
             res.writeHead(200, { "Content-Type": "text/html" }).end(`<!doctype html><html><head><meta charset="utf-8"></head><body style="font-family:system-ui;padding:3rem;text-align:center"><h2>EchoMem connected</h2><p>Returning to the local setup page...</p><p><a href="${setupPath}">Continue</a></p><script>(function(){var target=${JSON.stringify(setupPath)};try{if(window.opener&&!window.opener.closed){window.opener.postMessage({type:"echomem:connected",nonce:${JSON.stringify(nonce || "")}},window.location.origin);window.close();setTimeout(function(){window.location.href=target;},500);return;}}catch(_){}window.location.href=target;})();</script></body></html>`);
             const callbackToken = { token, key };
@@ -1281,17 +1377,198 @@ export function startCallbackServer(opts = {}) {
             }
             armTimeout();
         };
+        const rejectIfLocalAuthBlocked = (res, nonce) => {
+            if (!checkNonce(nonce)) {
+                text(res, 403, "bad nonce");
+                return true;
+            }
+            if (requiresReportConsent && !reportConsentGranted) {
+                json(res, 403, {
+                    error: "LOCAL_HISTORY_CONSENT_REQUIRED",
+                    message: "Allow local history access in the setup page before connecting EchoMem.",
+                });
+                return true;
+            }
+            return false;
+        };
+        const resolveLocalToken = (token, key) => {
+            const firstToken = !onToken.settled();
+            connected = true;
+            activeDeviceToken = token;
+            pendingLocalAuth = null;
+            const callbackToken = { token, key };
+            if (firstToken) {
+                onToken.resolve(callbackToken);
+            }
+            else if (tokenRefreshHandler) {
+                Promise.resolve(tokenRefreshHandler(callbackToken)).catch((e) => {
+                    console.error(`Could not refresh local login: ${e instanceof Error ? e.message : String(e)}`);
+                });
+            }
+            armTimeout();
+        };
+        const isOnboardingOnlyRoute = (route) => [
+            "/report-consent",
+            "/report",
+            "/stats",
+            "/billing-status",
+            "/billing-checkout",
+            "/billing-portal",
+            "/progress",
+            "/migrate",
+            "/skip",
+        ].includes(route);
+        const handleLocalSendOtp = async (res, body) => {
+            if (rejectIfLocalAuthBlocked(res, asString(body.nonce)))
+                return;
+            const email = normalizeEmail(body.email);
+            if (!validEmail(email))
+                return void json(res, 400, { ok: false, error: "Invalid email address" });
+            if (!acceptedLocalTerms(body)) {
+                return void json(res, 400, {
+                    ok: false,
+                    error: "Confirm your age and accept Echo's terms before continuing.",
+                });
+            }
+            try {
+                const response = await apiAxios().post("/api/extension/mcp/local-auth/send-otp", {
+                    email,
+                    acceptedTerms: true,
+                    ageConfirmed: true,
+                }, { timeout: 10_000 });
+                json(res, 200, { ok: true, email: asString(response.data?.email) || email });
+            }
+            catch (error) {
+                const detail = publicAxiosError(error, "Failed to send verification code");
+                json(res, detail.status, { ok: false, error: detail.message });
+            }
+        };
+        const handleLocalVerifyOtp = async (res, body) => {
+            if (rejectIfLocalAuthBlocked(res, asString(body.nonce)))
+                return;
+            const email = normalizeEmail(body.email);
+            const otp = asString(body.otp)?.trim() || "";
+            if (!validEmail(email))
+                return void json(res, 400, { ok: false, error: "Invalid email address" });
+            if (!/^\d{6}$/.test(otp)) {
+                return void json(res, 400, { ok: false, error: "Enter the 6-digit verification code." });
+            }
+            if (!acceptedLocalTerms(body)) {
+                return void json(res, 400, {
+                    ok: false,
+                    error: "Confirm your age and accept Echo's terms before continuing.",
+                });
+            }
+            try {
+                const response = await apiAxios().post("/api/extension/mcp/local-auth/verify-otp", {
+                    email,
+                    otp,
+                    acceptedTerms: true,
+                    ageConfirmed: true,
+                }, { timeout: 15_000 });
+                const token = asString(response.data?.api_key);
+                const userId = asString(response.data?.user_id);
+                if (!token || !userId) {
+                    return void json(res, 502, { ok: false, error: "The EchoMem API did not return a device token." });
+                }
+                let config;
+                try {
+                    config = await fetchEncryptionConfig(authedAxios(token));
+                }
+                catch (error) {
+                    await revokeDeviceToken(token);
+                    throw error;
+                }
+                await revokePendingLocalAuth();
+                pendingLocalAuth = {
+                    token,
+                    userId,
+                    email: asString(response.data?.email) || email,
+                    mode: config.enabled ? "unlock" : "setup",
+                    config: config.enabled ? config : undefined,
+                    expiresAtMs: Date.now() + 10 * 60_000,
+                };
+                json(res, 200, {
+                    ok: true,
+                    stage: "passphrase",
+                    mode: pendingLocalAuth.mode,
+                    email: pendingLocalAuth.email,
+                });
+            }
+            catch (error) {
+                const detail = publicAxiosError(error, "Failed to verify code");
+                json(res, detail.status, { ok: false, error: detail.message });
+            }
+        };
+        const handleLocalPassphrase = async (res, body) => {
+            if (rejectIfLocalAuthBlocked(res, asString(body.nonce)))
+                return;
+            const passphrase = typeof body.passphrase === "string" ? body.passphrase : "";
+            if (passphrase.length < 4) {
+                return void json(res, 400, { ok: false, error: "Enter an encryption passphrase with at least 4 characters." });
+            }
+            if (!pendingLocalAuth || pendingLocalAuth.expiresAtMs <= Date.now()) {
+                await revokePendingLocalAuth();
+                return void json(res, 409, {
+                    ok: false,
+                    error: "This local login expired. Send a new verification code.",
+                    reset: true,
+                });
+            }
+            try {
+                if (pendingLocalAuth.mode === "unlock") {
+                    const key = pendingLocalAuth.config
+                        ? await deriveAndVerifyKey(passphrase, pendingLocalAuth.config)
+                        : null;
+                    if (!key)
+                        return void json(res, 400, { ok: false, error: "Incorrect encryption passphrase." });
+                    await completeDeviceLogin(pendingLocalAuth.token);
+                    resolveLocalToken(pendingLocalAuth.token, key);
+                    return void json(res, 200, { ok: true, connected: true });
+                }
+                const setup = await setupNewEncryptionKey(passphrase);
+                await authedAxios(pendingLocalAuth.token).post("/api/extension/account/encryption", {
+                    salt: setup.saltBase64,
+                    verification: setup.verification,
+                    iterations: setup.iterations,
+                }, {
+                    timeout: 10_000,
+                    headers: { "X-Encryption-Key": setup.keyBase64 },
+                });
+                pendingLocalAuth.mode = "unlock";
+                pendingLocalAuth.config = {
+                    enabled: true,
+                    salt: setup.saltBase64,
+                    verification: setup.verification,
+                    iterations: setup.iterations,
+                };
+                await completeDeviceLogin(pendingLocalAuth.token);
+                resolveLocalToken(pendingLocalAuth.token, setup.keyBase64);
+                json(res, 200, { ok: true, connected: true });
+            }
+            catch (error) {
+                const detail = publicAxiosError(error, "Failed to unlock encrypted memory");
+                json(res, detail.status, { ok: false, error: detail.message });
+            }
+        };
         server = http.createServer((req, res) => {
             res.setHeader("Access-Control-Allow-Origin", "*");
             res.setHeader("Access-Control-Allow-Headers", "Content-Type");
             res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
-            // Let the HTTPS connect-device page reach this localhost server (Chrome Private Network Access).
-            res.setHeader("Access-Control-Allow-Private-Network", "true");
             if (req.method === "OPTIONS")
                 return void res.writeHead(204).end();
             const url = new URL(req.url || "/", "http://127.0.0.1");
             const route = url.pathname;
             const run = async () => {
+                // Defense in depth: the login bridge never exposes the routes that can inspect or move
+                // local conversation history. The browser UI also routes around them, but the server is
+                // the authority for this privacy boundary.
+                if (isLoginFlow && isOnboardingOnlyRoute(route)) {
+                    return void json(res, 404, {
+                        error: "ONBOARDING_REQUIRED",
+                        message: "Run `echomem-mcp init` to access local-history onboarding.",
+                    });
+                }
                 if ((route === "/city" || route.startsWith("/city/")) && req.method === "GET") {
                     serveRepoCityAsset(route, res);
                     return;
@@ -1327,11 +1604,13 @@ export function startCallbackServer(opts = {}) {
                         return void text(res, 403, "bad nonce");
                     json(res, 200, {
                         connected,
+                        flow,
                         authUrl,
                         switchAccountUrl: switchAccountUrl || authUrl,
                         localOnly: true,
+                        localAuth: true,
                         workspacePath: process.cwd(),
-                        consentRequired: opts.requireReportConsent === true,
+                        consentRequired: requiresReportConsent,
                         consentGranted: reportConsentGranted,
                     });
                     return;
@@ -1385,10 +1664,46 @@ export function startCallbackServer(opts = {}) {
                     handleCallback(res, asString(body.token), asString(body.key), asString(body.nonce));
                     return;
                 }
+                if (route === "/local-auth/send-otp" && req.method === "POST") {
+                    let body;
+                    try {
+                        body = await readJsonBody(req);
+                    }
+                    catch {
+                        text(res, 400, "bad json");
+                        return;
+                    }
+                    await handleLocalSendOtp(res, body);
+                    return;
+                }
+                if (route === "/local-auth/verify-otp" && req.method === "POST") {
+                    let body;
+                    try {
+                        body = await readJsonBody(req);
+                    }
+                    catch {
+                        text(res, 400, "bad json");
+                        return;
+                    }
+                    await handleLocalVerifyOtp(res, body);
+                    return;
+                }
+                if (route === "/local-auth/passphrase" && req.method === "POST") {
+                    let body;
+                    try {
+                        body = await readJsonBody(req);
+                    }
+                    catch {
+                        text(res, 400, "bad json");
+                        return;
+                    }
+                    await handleLocalPassphrase(res, body);
+                    return;
+                }
                 if (route === "/stats" && req.method === "GET") {
                     if (!checkNonce(url.searchParams.get("nonce") || undefined))
                         return void text(res, 403, "bad nonce");
-                    if (opts.requireReportConsent === true && !reportConsentGranted) {
+                    if (requiresReportConsent && !reportConsentGranted) {
                         return void json(res, 403, {
                             error: "LOCAL_HISTORY_CONSENT_REQUIRED",
                             message: "Allow local history access before continuing setup.",
@@ -1403,13 +1718,13 @@ export function startCallbackServer(opts = {}) {
                 if (route === "/billing-status" && req.method === "GET") {
                     if (!checkNonce(url.searchParams.get("nonce") || undefined))
                         return void text(res, 403, "bad nonce");
-                    if (opts.requireReportConsent === true && !reportConsentGranted) {
+                    if (requiresReportConsent && !reportConsentGranted) {
                         return void json(res, 403, {
                             error: "LOCAL_HISTORY_CONSENT_REQUIRED",
                             message: "Allow local history access before continuing setup.",
                         });
                     }
-                    const token = new KeyStore().getToken();
+                    const token = activeDeviceToken || new KeyStore().getToken();
                     const pricingUrl = `${PRICING_URL}?source=mcp_onboarding`;
                     if (!token) {
                         json(res, 200, { plan: "free", paid: false, trialAvailable: true, trialUsed: false, pricingUrl });
@@ -1445,12 +1760,84 @@ export function startCallbackServer(opts = {}) {
                     }
                     return;
                 }
+                if ((route === "/billing-checkout" || route === "/billing-portal") && req.method === "POST") {
+                    let body;
+                    try {
+                        body = await readJsonBody(req);
+                    }
+                    catch {
+                        text(res, 400, "bad json");
+                        return;
+                    }
+                    if (!checkNonce(asString(body.nonce)))
+                        return void text(res, 403, "bad nonce");
+                    if (requiresReportConsent && !reportConsentGranted) {
+                        return void json(res, 403, {
+                            error: "LOCAL_HISTORY_CONSENT_REQUIRED",
+                            message: "Allow local history access before managing an onboarding plan.",
+                        });
+                    }
+                    const token = activeDeviceToken || new KeyStore().getToken();
+                    if (!connected || !token) {
+                        return void json(res, 401, {
+                            error: "ECHOMEM_LOGIN_REQUIRED",
+                            message: "Connect your EchoMem account before continuing to billing.",
+                        });
+                    }
+                    const isCheckout = route === "/billing-checkout";
+                    const requestBody = { source: "mcp_onboarding" };
+                    if (isCheckout) {
+                        const plan = asString(body.plan)?.toLowerCase();
+                        if (plan !== "pro" && plan !== "power") {
+                            return void json(res, 400, {
+                                error: "INVALID_PLAN",
+                                message: "Choose Pro or Power to continue to checkout.",
+                            });
+                        }
+                        requestBody.plan = plan;
+                        requestBody.trial = body.trial === true;
+                    }
+                    else {
+                        const plan = asString(body.plan)?.toLowerCase();
+                        if (plan) {
+                            if (plan !== "pro" && plan !== "power") {
+                                return void json(res, 400, {
+                                    error: "INVALID_PLAN",
+                                    message: "Choose Pro or Power to change plans.",
+                                });
+                            }
+                            requestBody.plan = plan;
+                        }
+                    }
+                    try {
+                        const response = await axios.post(hostedBillingEndpoint(isCheckout ? "/api/billing/checkout" : "/api/billing/portal"), requestBody, {
+                            timeout: 15_000,
+                            headers: {
+                                "Content-Type": "application/json",
+                                Authorization: `Bearer ${token}`,
+                            },
+                        });
+                        const hostedUrl = response.data?.url;
+                        if (!isExpectedStripeUrl(hostedUrl, isCheckout ? "checkout" : "portal")) {
+                            return void json(res, 502, {
+                                error: "INVALID_BILLING_DESTINATION",
+                                message: "Echo billing returned an unexpected destination.",
+                            });
+                        }
+                        json(res, 200, { url: hostedUrl });
+                    }
+                    catch (error) {
+                        const detail = publicAxiosError(error, isCheckout ? "Could not start secure checkout." : "Could not open secure plan management.");
+                        json(res, detail.status, { error: "BILLING_REQUEST_FAILED", message: detail.message });
+                    }
+                    return;
+                }
                 if (route === "/report" && req.method === "GET") {
                     // Local forensic "Context Doctor" report — computed locally, served BEFORE auth (scan-first).
                     res.setHeader("Cache-Control", "no-store");
                     if (!checkNonce(url.searchParams.get("nonce") || undefined))
                         return void text(res, 403, "bad nonce");
-                    if (opts.requireReportConsent === true && !reportConsentGranted) {
+                    if (requiresReportConsent && !reportConsentGranted) {
                         return void json(res, 403, {
                             error: "LOCAL_HISTORY_CONSENT_REQUIRED",
                             message: "Allow local history access before starting the local scan.",
@@ -1551,7 +1938,7 @@ export function startCallbackServer(opts = {}) {
                 if (route === "/progress" && req.method === "GET") {
                     if (!checkNonce(url.searchParams.get("nonce") || undefined))
                         return void text(res, 403, "bad nonce");
-                    if (opts.requireReportConsent === true && !reportConsentGranted) {
+                    if (requiresReportConsent && !reportConsentGranted) {
                         return void json(res, 403, {
                             error: "LOCAL_HISTORY_CONSENT_REQUIRED",
                             message: "Allow local history access before continuing setup.",
@@ -1599,10 +1986,18 @@ export function startCallbackServer(opts = {}) {
                         /* already logged out locally */
                     }
                     connected = false;
+                    activeDeviceToken = "";
+                    const revokedPendingCredential = await revokePendingLocalAuth();
                     stats = null;
                     migrateStarted = false;
                     progress = { status: "idle", total: 0, completed: 0, running: 0, queued: 0, failed: 0, extracted: 0 };
-                    json(res, 200, { ok: true, authUrl, switchAccountUrl: switchAccountUrl || authUrl, localOnly: true });
+                    json(res, 200, {
+                        ok: true,
+                        authUrl,
+                        switchAccountUrl: switchAccountUrl || authUrl,
+                        localOnly: true,
+                        revokedPendingCredential,
+                    });
                     Promise.resolve()
                         .then(() => logoutHandler?.())
                         .catch((e) => {
@@ -1621,7 +2016,7 @@ export function startCallbackServer(opts = {}) {
                     }
                     if (!checkNonce(asString(body.nonce)))
                         return void text(res, 403, "bad nonce");
-                    if (opts.requireReportConsent === true && !reportConsentGranted) {
+                    if (requiresReportConsent && !reportConsentGranted) {
                         return void json(res, 403, {
                             error: "LOCAL_HISTORY_CONSENT_REQUIRED",
                             message: "Allow local history access before starting extraction.",
@@ -1682,6 +2077,8 @@ export function startCallbackServer(opts = {}) {
             sockets.add(socket);
             socket.on("close", () => sockets.delete(socket));
         });
+        if (opts.initialToken)
+            onToken.resolve(opts.initialToken);
         armTimeout();
         server.on("error", (e) => rejectOuter(e));
         server.listen(opts.port ?? 0, "127.0.0.1", () => {
@@ -1726,6 +2123,34 @@ function authedAxios(token) {
         headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
     });
 }
+function apiAxios() {
+    return axios.create({
+        baseURL: API_BASE_URL,
+        headers: { "Content-Type": "application/json" },
+    });
+}
+function normalizeEmail(value) {
+    return typeof value === "string" ? value.trim().toLowerCase() : "";
+}
+function validEmail(value) {
+    return value.length > 0 && value.length <= 254 && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value);
+}
+function acceptedLocalTerms(body) {
+    return body.acceptedTerms === true && body.ageConfirmed === true;
+}
+function publicAxiosError(error, fallback) {
+    if (axios.isAxiosError(error)) {
+        const data = error.response?.data;
+        const status = typeof error.response?.status === "number" ? error.response.status : 500;
+        const message = typeof data?.error === "string"
+            ? data.error
+            : typeof data?.message === "string"
+                ? data.message
+                : fallback;
+        return { message, status };
+    }
+    return { message: error instanceof Error ? error.message : fallback, status: 500 };
+}
 function formatVerificationError(error) {
     if (axios.isAxiosError(error)) {
         const status = typeof error.response?.status === "number" ? error.response.status : null;
@@ -1888,9 +2313,9 @@ async function cmdSetup(flags) {
 /**
  * `echomem-mcp init` — the one-command install. Configures EVERY coding agent installed on this
  * machine (Codex + Claude Code + Claude Desktop, not just auto-detected ones), installs EchoMem's
- * Codex skills, writes the AGENTS.md memory guidance, logs in via the browser, and launches the
- * context HUD — the whole product in a single command. `setup`/`update` remain the granular
- * primitives; init just picks the "do everything" defaults and frames the result.
+ * Codex skills, writes the AGENTS.md memory guidance, and launches the context HUD. One browser
+ * bridge then runs permission → report → login → plan if needed → extraction in that order.
+ * `setup`/`login`/`update` remain granular primitives; init picks the full product defaults.
  */
 async function cmdInit(flags) {
     console.log("Setting up EchoMem — shared memory for all your coding agents, plus the live context HUD.\n");
@@ -1899,10 +2324,10 @@ async function cmdInit(flags) {
     // 2. Bring the HUD up NOW (non-blocking) so everything is already running while onboarding proceeds.
     if (!flags["no-hud"])
         await cmdSetupHud(flags);
-    // 3. Start onboarding — opens the browser dashboard (scan → connect → extraction) and waits there.
+    // 3. Start one ordered onboarding bridge. A fresh device logs in only after consent + report.
     console.log("");
-    if (!flags["skip-login"] && !flags["no-login"] && !await cmdLogin(flags)) {
-        console.log("\nEchoMem is configured, but this device was not connected. Restart EchoMem and use the new page it opens.");
+    if (!flags["skip-login"] && !flags["no-login"] && !await cmdOnboarding(flags)) {
+        console.log("\nEchoMem is configured, but onboarding did not finish. Run `echomem-mcp init` again when you are ready.");
         return;
     }
     console.log("");
@@ -1963,6 +2388,8 @@ function writeCodexSkillsForTargets(targets) {
     }
 }
 async function cmdUpdate(flags) {
+    if (!flags.dev)
+        installDurableGlobalUpdate();
     await cmdSetup({ ...flags, "skip-login": true });
     console.log(`Update config complete. Start a new MCP session to load ${MCP_PACKAGE_LABEL}.`);
 }
@@ -2027,6 +2454,19 @@ function parseHudClient(value) {
         ? value
         : "auto";
 }
+function localBridgeOptions(flags) {
+    const port = typeof flags["dev-port"] === "string" ? Number(flags["dev-port"]) : undefined;
+    if (port !== undefined && (!Number.isInteger(port) || port < 1024 || port > 65535)) {
+        throw new Error("--dev-port must be an integer between 1024 and 65535");
+    }
+    const requestedNonce = typeof flags["dev-nonce"] === "string" ? flags["dev-nonce"].trim() : undefined;
+    if (requestedNonce && port === undefined)
+        throw new Error("--dev-nonce requires --dev-port");
+    if (requestedNonce && !/^[A-Za-z0-9-]{16,128}$/.test(requestedNonce)) {
+        throw new Error("--dev-nonce must contain 16-128 letters, numbers, or hyphens");
+    }
+    return { port, nonce: requestedNonce || randomUUID() };
+}
 async function cmdLogin(flags) {
     // Manual path (also the headless path): secrets supplied as flags.
     if (typeof flags.token === "string") {
@@ -2039,20 +2479,51 @@ async function cmdLogin(flags) {
             process.exitCode = 1;
         return ok;
     }
-    // Browser path: open a localhost dashboard. It briefly leaves for hosted auth, then returns here
-    // after the web page has delivered the token+key to the callback. The nonce gates every local route.
-    console.log("Opening your browser to approve this device…");
-    const devPortRaw = typeof flags["dev-port"] === "string" ? Number(flags["dev-port"]) : undefined;
-    if (devPortRaw !== undefined && (!Number.isInteger(devPortRaw) || devPortRaw < 1024 || devPortRaw > 65535)) {
-        throw new Error("--dev-port must be an integer between 1024 and 65535");
+    const store = new KeyStore();
+    if (!flags.force && store.getToken() && store.getKey()) {
+        console.log("This device is already connected. Run `echomem-mcp login --force` to sign in with a different account.");
+        return true;
     }
-    const devNonce = typeof flags["dev-nonce"] === "string" ? flags["dev-nonce"].trim() : undefined;
-    if (devNonce && devPortRaw === undefined)
-        throw new Error("--dev-nonce requires --dev-port");
-    if (devNonce && !/^[A-Za-z0-9-]{16,128}$/.test(devNonce)) {
-        throw new Error("--dev-nonce must contain 16-128 letters, numbers, or hyphens");
+    // Browser path: this bridge does only account/device authentication. It intentionally exposes
+    // no local-history routes; `init` owns scan consent, reporting, and optional extraction.
+    console.log("Opening your browser to connect this device locally…");
+    const { port, nonce } = localBridgeOptions(flags);
+    const srv = await startCallbackServer({ port, nonce, flow: "login" });
+    const localLoginUrl = `http://127.0.0.1:${srv.port}/setup?nonce=${nonce}`;
+    openBrowser(localLoginUrl);
+    console.log(`If it didn't open, visit:\n  ${localLoginUrl}\n`);
+    console.log("Waiting for local login for up to 15 minutes…");
+    try {
+        const credentials = await srv.onToken;
+        const ok = await verifyAndPrint(credentials);
+        srv.close();
+        if (!ok) {
+            process.exitCode = 1;
+            return false;
+        }
+        console.log("✅ This device is connected. Run `echomem-mcp init` to begin local-history onboarding.");
+        return true;
     }
-    const nonce = devNonce || randomUUID();
+    catch (error) {
+        srv.close();
+        console.error(`❌ ${error instanceof Error ? error.message : String(error)}. Run \`echomem-mcp login\` to retry.`);
+        process.exitCode = 1;
+        return false;
+    }
+}
+/**
+ * The local-history onboarding flow. Existing device credentials are reused when available; a
+ * fresh device stays in this same bridge and asks for login only after permission and report.
+ */
+async function cmdOnboarding(flags) {
+    const store = new KeyStore();
+    const savedToken = store.getToken();
+    const savedKey = store.getKey();
+    const initialToken = savedToken && savedKey
+        ? { token: savedToken, key: savedKey }
+        : undefined;
+    console.log("Opening your browser for EchoMem onboarding…");
+    const { port, nonce } = localBridgeOptions(flags);
     let stats = null;
     let forensicReport = null;
     let forensicConsent = "pending";
@@ -2071,8 +2542,10 @@ async function cmdLogin(flags) {
         updatedAt: forensicStartedAt,
     };
     const srv = await startCallbackServer({
-        port: devPortRaw,
+        port,
         nonce,
+        flow: "onboarding",
+        initialToken,
         requireReportConsent: true,
         getStats: () => stats,
         getReport: () => forensicReport,
@@ -2113,18 +2586,10 @@ async function cmdLogin(flags) {
             startForensicScan();
         },
     });
-    const callbackUrl = `http://127.0.0.1:${srv.port}/callback`;
     const localSetupUrl = `http://127.0.0.1:${srv.port}/setup?nonce=${nonce}`;
-    const connectUrl = `${WEB_URL}/connect-device?callback=${encodeURIComponent(callbackUrl)}&nonce=${nonce}&return_to=${encodeURIComponent(localSetupUrl)}`;
-    const switchAccountUrl = new URL(connectUrl);
-    // The hosted connect-device page should clear its own Supabase/browser session before minting
-    // the localhost token when this hint is present. Localhost cannot safely clear yeahecho.com auth.
-    switchAccountUrl.searchParams.set("force_signout", "1");
-    switchAccountUrl.searchParams.set("prompt", "login");
-    srv.setAuthUrl(connectUrl, switchAccountUrl.toString());
     openBrowser(localSetupUrl);
     console.log(`If it didn't open, visit:\n  ${localSetupUrl}\n`);
-    console.log("Waiting for browser approval for up to 15 minutes…");
+    console.log("Waiting for local-history onboarding for up to 15 minutes…");
     const startForensicScan = () => {
         if (forensicScanStarted || forensicConsent !== "allowed")
             return;
@@ -2872,15 +3337,16 @@ function cmdLogout() {
 const HELP = `EchoMem MCP — local memory bridge
 
 Usage:
-  echomem-mcp init                  One command: configure every installed agent + HUD + log in
+  echomem-mcp init                  One command: configure agents + HUD + login + local-history onboarding
   echomem-mcp                       Run the MCP server (stdio; default — used by your editor)
-  echomem-mcp setup [--client X]    Detect editor, write its MCP config, then log in
+  echomem-mcp setup [--client X]    Detect editor, write its MCP config, then connect this device
   echomem-mcp setup --skip-login    Write MCP config without opening login/browser
   echomem-mcp setup --no-codex-skills  Skip installing the bundled EchoMem Codex skills
-  echomem-mcp update --all          Repoint detected clients to this installed bridge; no login/browser
+  echomem-mcp update --all          Install this bridge durably + repoint detected clients; no login/browser
   echomem-mcp update --client X     Repoint one MCP client; no login/browser
   echomem-mcp setup --with-hud      Configure MCP, then launch the EchoMem context HUD
-  echomem-mcp login                 Approve this device in the browser (or --token/--passphrase)
+  echomem-mcp login                 Connect this device only; never scans or imports local history
+  echomem-mcp login --force         Reconnect this device with a different account
   echomem-mcp unlock                Privately unlock the vault on this trusted device
   echomem-mcp lock                  Remove the local vault key while keeping the device login
   echomem-mcp status                Show token/key/clients