@fml-inc/fml 0.8.6-rc.2 → 0.8.6-rc.3

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fml",
-  "version": "0.8.6-rc.2",
+  "version": "0.8.6-rc.3",
   "description": "FML agent tools for Claude Code",
   "mcpServers": {
     "fml": {

package/README.md

@@ -25,19 +25,24 @@ npm install --global @fml-inc/fml
 fml setup
 ```
 
-For a customer-hosted deployment, pass its public backend (Convex HTTP
-actions) origin directly to login. The CLI validates and saves the URL as the
-active `custom` environment before authenticating, so later CLI and observer
-traffic uses the same deployment:
+For a customer-hosted deployment, pass the address you use to open FML in the
+browser to setup instead. The CLI asks that app for its backend (Convex HTTP
+actions) origin, signs in against it, and only then saves both as the active
+`custom` environment and restarts the observer, so later CLI and observer
+traffic uses the same deployment and a failed login never switches
+environments:
 
 ```bash
-fml login https://actions.fml.example.com
-# Headless alternative:
-fml login https://actions.fml.example.com --device
+fml setup https://fml.example.com
+# Sign in again later, or headless:
+fml login https://fml.example.com
+fml login https://fml.example.com --device
 ```
 
-The URL must be an HTTPS origin with no path, query, credentials, or fragment.
-Plain HTTP is accepted only for loopback development servers.
+The backend origin itself (for example `https://actions.fml.example.com`) is
+also accepted. Either URL must be an HTTPS origin with no path, query,
+credentials, or fragment. Plain HTTP is accepted only for loopback development
+servers.
 
 Run `fml update` to check for and install a newer global package with npm. It
 reports the version installed and refreshes FML setup automatically. Stable
@@ -308,7 +313,7 @@ fml tools call <tool-name> --args '{"key":"value"}'
 ## CLI overview
 
 ```text
-fml setup                Install integrations, sign in if needed, and start FML
+fml setup [backend-url]  Install integrations, sign in if needed, and start FML
 fml install              Register FML agent integrations and the MCP server
 fml uninstall            Remove agent integration; add --purge to remove local state
 fml update               Update @fml-inc/fml with npm (stable: latest; prerelease: next)

package/dist/{chunk-FGR7SHV7.js → chunk-2DQQXBWM.js}

@@ -1,6 +1,6 @@
 import {
   FML_HOOK_CAPTURE_DISABLED_FILE
-} from "./chunk-KWCFT54L.js";
+} from "./chunk-B3H2YWPJ.js";
 
 // src/json-file.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-3T5UCGBR.js → chunk-5TOOBX7I.js}

@@ -1,6 +1,6 @@
 import {
   FML_HOOK_INBOX_DIR
-} from "./chunk-KWCFT54L.js";
+} from "./chunk-B3H2YWPJ.js";
 
 // ../../packages/panopticon/src/observer/auth.ts
 import crypto from "crypto";

package/dist/{chunk-KWCFT54L.js → chunk-B3H2YWPJ.js}

@@ -192,12 +192,20 @@ function ensureDirs() {
 }
 
 // src/config.ts
-var DEFAULT_PROD_URL = "https://trustworthy-chihuahua-382.convex.cloud";
-var DEFAULT_SYNC_URL = DEFAULT_PROD_URL.replace(
-  ".convex.cloud",
-  ".convex.site"
-);
+var DEFAULT_PROD_URL = "https://api.fml.inc";
 var DEFAULT_TARGET_NAME = "fml";
+var LEGACY_HOSTED_BACKEND_URLS = [
+  "https://trustworthy-chihuahua-382.convex.site"
+];
+function isHostedBackendUrl(url) {
+  let normalized;
+  try {
+    normalized = normalizeConvexUrl(url);
+  } catch {
+    return false;
+  }
+  return normalized === DEFAULT_PROD_URL || LEGACY_HOSTED_BACKEND_URLS.includes(normalized);
+}
 var ENV_CONFIG_PATH = path2.join(FML_DATA_DIR, "env.json");
 var ENV_NAME_RE = /^[A-Za-z0-9_-]+$/;
 function isValidEnvName(envName) {
@@ -211,7 +219,10 @@ function normalizeConvexUrl(value) {
       "FML environment URL must be HTTPS (HTTP is allowed only for loopback) with no path, credentials, query, or fragment"
     );
   }
-  return value.replace(/\/$/, "").replace(".convex.site", ".convex.cloud");
+  return url.origin;
+}
+function normalizeAppUrl(value) {
+  return normalizeConvexUrl(value);
 }
 function readEnvConfig() {
   try {
@@ -233,14 +244,19 @@ function readEnvConfig() {
         if (!isValidEnvName(name) || !environment || typeof environment !== "object" || Array.isArray(environment)) {
           continue;
         }
-        const convexUrl = environment.convexUrl;
-        if (typeof convexUrl !== "string") continue;
+        const entry = environment;
+        if (typeof entry.convexUrl !== "string") continue;
         try {
-          environments[name] = { convexUrl: normalizeConvexUrl(convexUrl) };
+          const appUrl = typeof entry.appUrl === "string" ? normalizeAppUrl(entry.appUrl) : void 0;
+          environments[name] = {
+            convexUrl: normalizeConvexUrl(entry.convexUrl),
+            ...appUrl ? { appUrl } : {}
+          };
         } catch {
         }
       }
     }
+    environments[DEFAULT_TARGET_NAME] = { convexUrl: DEFAULT_PROD_URL };
     return {
       schemaVersion: 1,
       active: config.active,
@@ -275,7 +291,7 @@ function resolveEnvConvexUrl(envName) {
   if (envName === DEFAULT_TARGET_NAME) return DEFAULT_PROD_URL;
   return null;
 }
-function setActiveEnvironment(name, convexUrl) {
+function setActiveEnvironment(name, convexUrl, appUrl) {
   if (!isValidEnvName(name)) {
     throw new Error(`Invalid FML environment name: ${name}`);
   }
@@ -285,19 +301,23 @@ function setActiveEnvironment(name, convexUrl) {
     active: name,
     environments: {
       ...current.environments ?? {},
-      [name]: { convexUrl: normalizeConvexUrl(convexUrl) }
+      [name]: {
+        convexUrl: normalizeConvexUrl(convexUrl),
+        ...appUrl ? { appUrl: normalizeAppUrl(appUrl) } : {}
+      }
     }
   };
   writeEnvConfig(next);
   return next;
 }
 function getActiveEnv() {
-  const name = readEnvConfig().active;
+  const config = readEnvConfig();
+  const name = config.active;
+  const stored = config.environments?.[name];
   const override = process.env.FML_CONVEX_URL;
-  return {
-    name,
-    convexUrl: override ? normalizeConvexUrl(override) : resolveEnvConvexUrl(name)
-  };
+  const convexUrl = override ? normalizeConvexUrl(override) : resolveEnvConvexUrl(name);
+  const appUrl = stored?.appUrl && stored.convexUrl === convexUrl ? stored.appUrl : null;
+  return { name, convexUrl, appUrl };
 }
 function authStorePathFor(envName) {
   return path2.join(FML_DATA_DIR, `auth.${envName}.json`);
@@ -311,7 +331,7 @@ function getSiteUrl() {
 function getSiteUrlForConvexUrl(convexUrl) {
   const explicit = process.env.CONVEX_SITE_URL;
   if (explicit) return explicit.replace(/\/$/, "");
-  return (convexUrl ?? DEFAULT_PROD_URL).replace(".convex.cloud", ".convex.site").replace(/\/$/, "");
+  return (convexUrl ?? DEFAULT_PROD_URL).replace(/\/$/, "");
 }
 
 // src/sentry.ts
@@ -1587,8 +1607,10 @@ export {
   ensureDirs,
   DEFAULT_PROD_URL,
   DEFAULT_TARGET_NAME,
+  isHostedBackendUrl,
   isValidEnvName,
   normalizeConvexUrl,
+  readEnvConfig,
   writeEnvConfig,
   envConfigExists,
   resolveEnvConvexUrl,

package/dist/{chunk-RZ5LWWRO.js → chunk-LOJPIJZW.js}

@@ -7,7 +7,7 @@ import {
   getSelectedOrg,
   getSiteUrlForConvexUrl,
   getValidToken
-} from "./chunk-KWCFT54L.js";
+} from "./chunk-B3H2YWPJ.js";
 
 // src/fml-client.ts
 var LOGIN_EXPIRED_MESSAGE = "Authentication expired. Run `fml login` to sign in again, then restart Claude Code.";
@@ -79,7 +79,7 @@ function createFmlClient(token, options = {}) {
         const repo = resolveRepoFromCwd(process.cwd());
         if (repo) body.repo = repo.repo;
         if (isServiceToken) {
-          const { readTokens, SERVICE_TOKEN_LOGIN_USER_ID } = await import("./token-store-TEPDSK2A.js");
+          const { readTokens, SERVICE_TOKEN_LOGIN_USER_ID } = await import("./token-store-ORR5MIJL.js");
           const stored = readTokens(options.envName);
           const storedUserExternalId = stored?.tokenType === "service" && stored.user.id !== SERVICE_TOKEN_LOGIN_USER_ID ? stored.user.id : void 0;
           const userExternalId = process.env.FML_USER_EXTERNAL_ID ?? storedUserExternalId;

package/dist/{chunk-GQ2WVOGY.js → chunk-ORYHJUC7.js}

@@ -1,12 +1,12 @@
 import {
   OBSERVER_SERVICE_NAME
-} from "./chunk-3T5UCGBR.js";
+} from "./chunk-5TOOBX7I.js";
 import {
   FML_OBSERVER_LOCK_FILE,
   FML_OBSERVER_PORT,
   FML_OBSERVER_STATE_FILE,
   Sentry
-} from "./chunk-KWCFT54L.js";
+} from "./chunk-B3H2YWPJ.js";
 
 // src/observer/state.ts
 import { randomUUID } from "crypto";
@@ -990,7 +990,7 @@ var PACKAGE_NAME = "@fml-inc/fml";
 var UPDATE_TIMEOUT_MS = 12e4;
 var SETUP_TIMEOUT_MS = 3e5;
 function getCurrentVersion() {
-  return true ? "0.8.6-rc.2+bda7cc0a" : "unknown";
+  return true ? "0.8.6-rc.3+f7c7191d" : "unknown";
 }
 function parseVersion(version) {
   const match = SEMVER_PATTERN.exec(version);

package/dist/{chunk-GST2GTOC.js → chunk-PJWMSHHZ.js}

@@ -6,7 +6,7 @@ import {
   getSiteUrlForConvexUrl,
   getSyncDestinationIdentity,
   getValidToken
-} from "./chunk-KWCFT54L.js";
+} from "./chunk-B3H2YWPJ.js";
 
 // src/hooks/sync-loop.ts
 import { createHash } from "crypto";

package/dist/{chunk-Z2LWDZ6Z.js → chunk-V2XC7JTB.js}

@@ -6,7 +6,7 @@ import {
   getSiteUrlForConvexUrl,
   getSyncDestinationIdentity,
   getValidToken
-} from "./chunk-KWCFT54L.js";
+} from "./chunk-B3H2YWPJ.js";
 
 // ../../packages/panopticon/src/artifact.ts
 import {

package/dist/{chunk-JEZPS7F5.js → chunk-YFHZJPTC.js}

@@ -1,7 +1,7 @@
 import {
   resolvePackageRoot,
   runRawSyncOnce
-} from "./chunk-Z2LWDZ6Z.js";
+} from "./chunk-V2XC7JTB.js";
 
 // src/observer/sync-cycle.ts
 import { fork } from "child_process";

package/dist/cli.js

@@ -2,7 +2,7 @@
 import {
   createFmlClient,
   getAuthenticatedClient
-} from "./chunk-RZ5LWWRO.js";
+} from "./chunk-LOJPIJZW.js";
 import {
   OBSERVER_HEARTBEAT_STALE_MS,
   execBinSync,
@@ -13,13 +13,13 @@ import {
   readObserverStateStatus,
   removeObserverStateIfOwned,
   resolveBin
-} from "./chunk-GQ2WVOGY.js";
+} from "./chunk-ORYHJUC7.js";
 import {
   readJsonFile,
   setHookCaptureDisabled,
   writeJsonFile,
   writeTextFileAtomic
-} from "./chunk-FGR7SHV7.js";
+} from "./chunk-2DQQXBWM.js";
 import {
   CODEX_HOOK_EVENTS,
   GEMINI_HOOK_EVENTS,
@@ -27,7 +27,7 @@ import {
   isObserverHealth,
   readHookInboxStatus,
   readObserverAuthToken
-} from "./chunk-3T5UCGBR.js";
+} from "./chunk-5TOOBX7I.js";
 import "./chunk-7V7G7NVF.js";
 import {
   claudeConfigDirectory,
@@ -37,7 +37,7 @@ import {
   initializeSyncSettings,
   resolvePackageRoot,
   runRawSyncOnce
-} from "./chunk-Z2LWDZ6Z.js";
+} from "./chunk-V2XC7JTB.js";
 import {
   DEFAULT_PROD_URL,
   DEFAULT_TARGET_NAME,
@@ -68,9 +68,11 @@ import {
   getSiteUrlForConvexUrl,
   getValidToken,
   initSentry,
+  isHostedBackendUrl,
   isValidEnvName,
   normalizeConvexUrl,
   observerOnlyOverrideWarning,
+  readEnvConfig,
   readTokens,
   resolveEnvConvexUrl,
   resolveFmlDefaultDirectories,
@@ -79,7 +81,7 @@ import {
   storeServiceRefreshToken,
   writeEnvConfig,
   writeTokens
-} from "./chunk-KWCFT54L.js";
+} from "./chunk-B3H2YWPJ.js";
 import "./chunk-MLKGABMK.js";
 
 // src/cli.ts
@@ -127,7 +129,7 @@ var POLL_INTERVAL_MS = 50;
 var LOG_ROTATE_BYTES = 10 * 1024 * 1024;
 var LOG_ROTATE_FILES = 3;
 function expectedObserverVersion() {
-  return true ? "0.8.6-rc.2+bda7cc0a" : "dev";
+  return true ? "0.8.6-rc.3+f7c7191d" : "dev";
 }
 function delay(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
@@ -6828,8 +6830,16 @@ async function handleFmlRestart() {
 import crypto from "crypto";
 import http from "http";
 async function fetchWorkosLoginConfig(siteUrl) {
-  const response = await fetch(`${siteUrl}/api/auth/config`);
-  const data = await response.json();
+  const configUrl = `${siteUrl}/api/auth/config`;
+  const response = await fetch(configUrl);
+  let data;
+  try {
+    data = await response.json();
+  } catch {
+    throw new Error(
+      `${configUrl} did not return JSON (HTTP ${response.status}). Use the FML backend HTTP-actions origin, not the web app URL.`
+    );
+  }
   if (!response.ok || data.ok === false || !data.workosClientId) {
     throw new Error(data.error ?? `HTTP ${response.status}`);
   }
@@ -7001,14 +7011,6 @@ function startCallbackServer(expectedState) {
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
-async function fetchWorkosClientId(siteUrl) {
-  const response = await fetch(`${siteUrl}/api/auth/config`);
-  const data = await response.json();
-  if (!response.ok || data.ok === false || !data.workosClientId) {
-    throw new Error(data.error ?? `HTTP ${response.status}`);
-  }
-  return data.workosClientId;
-}
 function userName(user) {
   return [user.first_name, user.last_name].filter(Boolean).join(" ");
 }
@@ -7086,7 +7088,7 @@ async function pollForTokens(clientId, authorization) {
   throw new Error("Device authorization timed out. Run `fml login` again.");
 }
 async function deviceLogin(options) {
-  const clientId = await fetchWorkosClientId(options.siteUrl);
+  const { clientId } = await fetchWorkosLoginConfig(options.siteUrl);
   const authorization = await requestDeviceAuthorization(clientId);
   console.log("");
   console.log("  Sign in with this code:");
@@ -7153,14 +7155,78 @@ function resolveGitHubToken() {
   }
 }
 
+// src/backend-discovery.ts
+var DISCOVERY_TIMEOUT_MS = 3e4;
+var defaultFetch = (input) => fetch(input, { signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS) });
+async function fetchJsonObject(url, fetchImpl) {
+  let response;
+  try {
+    response = await fetchImpl(url);
+  } catch (error) {
+    const message = error instanceof Error && error.name === "TimeoutError" ? `no response within ${DISCOVERY_TIMEOUT_MS / 1e3}s` : error instanceof Error ? error.message : String(error);
+    throw new Error(`Could not reach ${url}: ${message}`);
+  }
+  let parsed;
+  try {
+    parsed = await response.json();
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return null;
+  }
+  return parsed;
+}
+async function discoverBackend(inputUrl, fetchImpl = defaultFetch) {
+  const origin = normalizeConvexUrl(inputUrl);
+  const appConfig = await fetchJsonObject(
+    `${origin}/api/cli/config`,
+    fetchImpl
+  );
+  if (appConfig?.ok === true && typeof appConfig.backendUrl === "string") {
+    let backendUrl;
+    try {
+      backendUrl = normalizeConvexUrl(appConfig.backendUrl);
+    } catch {
+      throw new Error(
+        `${origin} advertised an invalid FML backend URL: ${appConfig.backendUrl}`
+      );
+    }
+    return { backendUrl, appUrl: origin };
+  }
+  if (appConfig && (appConfig.service === "fml-app" || appConfig.ok === false) && typeof appConfig.error === "string") {
+    throw new Error(
+      `${origin} could not provide its backend: ${appConfig.error}`
+    );
+  }
+  const authConfig = await fetchJsonObject(
+    `${origin}/api/auth/config`,
+    fetchImpl
+  );
+  if (authConfig?.ok === true && typeof authConfig.workosClientId === "string") {
+    return { backendUrl: origin };
+  }
+  throw new Error(
+    `${origin} is not an FML web app or backend URL. Pass the address you use to open FML in the browser. If that app was deployed before CLI discovery existed, pass its backend HTTP origin instead.`
+  );
+}
+
 // src/commands/login.ts
-function prepareLoginEnvironment(backendUrl) {
-  if (backendUrl) {
-    const convexUrl = normalizeConvexUrl(backendUrl);
-    setActiveEnvironment("custom", convexUrl);
+async function resolveLoginEnvironment(deploymentUrl) {
+  if (deploymentUrl) {
+    const discovered = await discoverBackend(deploymentUrl);
+    if (isHostedBackendUrl(discovered.backendUrl)) {
+      return {
+        envName: DEFAULT_TARGET_NAME,
+        siteUrl: getSiteUrlForConvexUrl(DEFAULT_PROD_URL),
+        pendingConvexUrl: DEFAULT_PROD_URL
+      };
+    }
     return {
       envName: "custom",
-      siteUrl: getSiteUrlForConvexUrl(convexUrl)
+      siteUrl: getSiteUrlForConvexUrl(discovered.backendUrl),
+      pendingConvexUrl: discovered.backendUrl,
+      ...discovered.appUrl ? { pendingAppUrl: discovered.appUrl } : {}
     };
   }
   const environment = getActiveEnv();
@@ -7169,6 +7235,22 @@ function prepareLoginEnvironment(backendUrl) {
     siteUrl: getSiteUrlForConvexUrl(environment.convexUrl)
   };
 }
+function commitLoginEnvironment(environment) {
+  if (environment.pendingConvexUrl) {
+    setActiveEnvironment(
+      environment.envName,
+      environment.pendingConvexUrl,
+      environment.pendingAppUrl
+    );
+  }
+}
+function canReuseStoredLogin(stored, environment) {
+  if (stored?.siteUrl) {
+    if (stored.siteUrl === environment.siteUrl) return true;
+    return environment.envName === DEFAULT_TARGET_NAME && isHostedBackendUrl(stored.siteUrl);
+  }
+  return !environment.pendingConvexUrl;
+}
 async function linkGitHubIdentity(environment) {
   const token = resolveGitHubToken();
   if (!token) {
@@ -7302,7 +7384,7 @@ async function selectOrg(environment) {
   }
 }
 async function runServiceTokenLogin(refreshToken, backendUrl) {
-  const environment = prepareLoginEnvironment(backendUrl);
+  const environment = await resolveLoginEnvironment(backendUrl);
   const envName = environment.envName;
   if (!isValidEnvName(envName)) {
     throw new Error(
@@ -7318,6 +7400,7 @@ async function runServiceTokenLogin(refreshToken, backendUrl) {
   if (!ok) {
     throw new Error("Service token login failed.");
   }
+  commitLoginEnvironment(environment);
   await selectOrg(environment);
   console.log("Logged in with FML service token.");
   console.log(
@@ -7340,11 +7423,14 @@ async function handleServiceTokenLogin(refreshToken, backendUrl) {
   }
 }
 async function runInteractiveLogin(opts = {}) {
-  const environment = prepareLoginEnvironment(opts.backendUrl);
+  const environment = await resolveLoginEnvironment(opts.backendUrl);
   const envName = environment.envName;
   const stored = readTokens(envName);
-  const canReuseStoredLogin = !opts.backendUrl || stored?.siteUrl === environment.siteUrl;
-  const existingToken = canReuseStoredLogin ? await getValidToken({ env: envName }) : null;
+  let existingToken = null;
+  if (canReuseStoredLogin(stored, environment)) {
+    commitLoginEnvironment(environment);
+    existingToken = await getValidToken({ env: envName });
+  }
   if (existingToken) {
     if (stored?.tokenType === "service") {
       const label = stored.user.id === SERVICE_TOKEN_LOGIN_USER_ID ? "a service token" : `${stored.user.name} (${stored.user.email})`;
@@ -7366,6 +7452,7 @@ async function runInteractiveLogin(opts = {}) {
   } else {
     result = await login(environment);
   }
+  commitLoginEnvironment(environment);
   console.log(`Logged in as ${result.name} (${result.email})`);
   await linkGitHubIdentity(environment);
   await selectOrg(environment);
@@ -7393,7 +7480,7 @@ async function handleLogin(opts) {
 var defaultDependencies = {
   install: () => handleInstall(),
   getActiveToken: () => getValidToken({ env: getActiveEnv().name }),
-  login: () => runInteractiveLogin(),
+  login: (options) => runInteractiveLogin(options),
   stop: () => handleFmlStop(),
   start: () => handleFmlStart()
 };
@@ -7408,15 +7495,25 @@ async function handleSetup(dependencies = defaultDependencies, options = {}) {
   if (process.exitCode) {
     throw new Error("FML setup cannot run after an earlier command failure.");
   }
+  if (options.backendUrl && options.nonInteractive) {
+    throw new Error(
+      "A backend URL requires interactive login; omit --non-interactive."
+    );
+  }
   console.log("Setting up FML...");
   await runStep("integration installation", dependencies.install);
-  const token = await dependencies.getActiveToken();
-  if (token) {
-    console.log("Already signed in.");
-  } else if (options.nonInteractive) {
-    console.log("Not signed in; skipping login (non-interactive).");
+  if (options.backendUrl) {
+    const backendUrl = options.backendUrl;
+    await runStep("login", () => dependencies.login({ backendUrl }));
   } else {
-    await runStep("login", dependencies.login);
+    const token = await dependencies.getActiveToken();
+    if (token) {
+      console.log("Already signed in.");
+    } else if (options.nonInteractive) {
+      console.log("Not signed in; skipping login (non-interactive).");
+    } else {
+      await runStep("login", () => dependencies.login());
+    }
   }
   await runStep("observer stop", dependencies.stop);
   await runStep("observer start", dependencies.start);
@@ -7927,9 +8024,12 @@ async function handleOrg(slug) {
 
 // src/commands/open.ts
 var DEFAULT_APP_BASE_URL = "https://app.fml.inc";
-function appBaseUrl() {
+function appBaseUrl(environmentAppUrl) {
   const configured = process.env.FML_APP_URL?.trim();
-  return (configured || DEFAULT_APP_BASE_URL).replace(/\/+$/, "");
+  return (configured || environmentAppUrl || DEFAULT_APP_BASE_URL).replace(
+    /\/+$/,
+    ""
+  );
 }
 async function handleOpen(opts) {
   const environment = getActiveEnv();
@@ -7957,7 +8057,7 @@ async function handleOpen(opts) {
     );
     slug = "";
   }
-  const baseUrl = appBaseUrl();
+  const baseUrl = appBaseUrl(environment.appUrl);
   const url = slug ? `${baseUrl}/${slug}` : baseUrl;
   if (opts.json) {
     console.log(JSON.stringify({ url }));
@@ -8246,22 +8346,35 @@ async function handleStatus() {
 
 // src/commands/env.ts
 function handleEnvShow() {
-  const { name, convexUrl } = getActiveEnv();
+  const { name, convexUrl, appUrl } = getActiveEnv();
   console.log(`Environment: ${name}`);
   console.log(`  Service URL: ${convexUrl ?? "not configured"}`);
+  if (appUrl) console.log(`  App URL: ${appUrl}`);
 }
-function handleEnvSwitch(target2) {
+async function handleEnvSwitch(target2) {
   let name = target2;
   let convexUrl = null;
+  let appUrl;
   try {
     if (/^https?:\/\//.test(target2)) {
-      name = "custom";
-      convexUrl = normalizeConvexUrl(target2);
+      const discovered = await discoverBackend(target2);
+      if (isHostedBackendUrl(discovered.backendUrl)) {
+        name = DEFAULT_TARGET_NAME;
+        convexUrl = DEFAULT_PROD_URL;
+      } else {
+        name = "custom";
+        convexUrl = discovered.backendUrl;
+        appUrl = discovered.appUrl;
+      }
     } else {
       if (!isValidEnvName(target2)) {
         throw new Error(`Invalid FML environment name: ${target2}`);
       }
       convexUrl = process.env.FML_CONVEX_URL ? normalizeConvexUrl(process.env.FML_CONVEX_URL) : resolveEnvConvexUrl(target2);
+      const stored = readEnvConfig().environments?.[target2];
+      if (stored?.appUrl && stored.convexUrl === convexUrl) {
+        appUrl = stored.appUrl;
+      }
     }
   } catch (error) {
     console.error(
@@ -8273,14 +8386,15 @@ function handleEnvSwitch(target2) {
   if (!convexUrl) {
     console.error(`Environment ${name} has no configured service URL.`);
     console.error(
-      `Set FML_CONVEX_URL=https://<deployment>.convex.cloud and run \`fml env ${name}\` again.`
+      `Set FML_CONVEX_URL=https://<backend-origin> and run \`fml env ${name}\` again.`
     );
     process.exitCode = 1;
     return;
   }
-  setActiveEnvironment(name, convexUrl);
+  setActiveEnvironment(name, convexUrl, appUrl);
   console.log(`Environment switched to ${name}.`);
   console.log(`Service URL: ${convexUrl}`);
+  if (appUrl) console.log(`App URL: ${appUrl}`);
   console.log("CLI commands and agent activity sync now use this environment.");
   console.log(
     "Start a new agent session to use the new environment and credentials."
@@ -8841,7 +8955,7 @@ async function handleConfigDetail(opts) {
 // src/commands/tools.ts
 import { readFileSync } from "fs";
 import path28 from "path";
-var pluginVersion = true ? "0.8.6-rc.2+bda7cc0a" : void 0;
+var pluginVersion = true ? "0.8.6-rc.3+f7c7191d" : void 0;
 async function getApi() {
   const api = await getAuthenticatedClient();
   if (!api) {
@@ -8998,7 +9112,7 @@ if (process.argv.length <= 2 || process.argv.includes("--help") || process.argv.
   printBanner();
 }
 var program = new Command().name("fml").description("FML CLI and agent tools").version(
-  true ? "0.8.6-rc.2+bda7cc0a" : "dev"
+  true ? "0.8.6-rc.3+f7c7191d" : "dev"
 );
 function formatCommandInventory(cmd, prefix = "") {
   const name = prefix ? `${prefix} ${cmd.name()}` : cmd.name();
@@ -9027,13 +9141,19 @@ tools.command("call").description("Invoke a backend tool by name with JSON args"
 program.command("mcp-server", { hidden: true }).description("Run the FML MCP server on stdio").action(async () => {
   await import("./mcp/server.js");
 });
-program.command("setup").description("Install integrations, sign in if needed, and start FML").addOption(
+program.command("setup").description("Install integrations, sign in if needed, and start FML").argument(
+  "[backend-url]",
+  "Self-hosted FML app or backend URL (saved as the active custom environment)"
+).addOption(
   new Option(
     "--non-interactive",
     "Skip interactive login (internal)"
   ).hideHelp()
 ).action(
-  (opts) => handleSetup(void 0, { nonInteractive: Boolean(opts.nonInteractive) })
+  (backendUrl, opts) => handleSetup(void 0, {
+    nonInteractive: Boolean(opts.nonInteractive),
+    backendUrl
+  })
 );
 program.command("install").description("Register FML agent integrations and the MCP server").action(() => handleInstall());
 program.command("uninstall").description("Remove FML agent integrations and optionally local data").option("--purge", "Also remove all data, logs, and auth tokens").option("-y, --yes", "Skip the purge confirmation prompt").action(
@@ -9049,7 +9169,7 @@ program.command("update").description("Update fml when a newer release is availa
 );
 program.command("login").description("Sign in to your FML account").argument(
   "[backend-url]",
-  "Self-hosted FML backend URL (saved as the active custom environment)"
+  "Self-hosted FML app or backend URL (saved as the active custom environment)"
 ).option("--device", "Use device authorization flow (no browser needed)").option(
   "--service-token",
   "Sign in with an org service refresh token (prompts for fml_srt_*)"
@@ -9061,8 +9181,8 @@ program.command("org").description("Show or select organization").argument("[slu
 program.command("status").description("Show auth, environment, and raw sync watermarks").action(() => handleStatus());
 program.command("doctor").description("Check FML configuration, agent activity sync, and connectivity").option("--json", "Output as JSON").action((opts) => handleDoctor(opts));
 program.command("open").description("Open FML dashboard in browser").option("--json", "Output URL as JSON instead of opening browser").action((opts) => handleOpen(opts));
-program.command("env").description("Show or switch FML backend environment").argument("[target]", "Environment name or backend URL").action((target2) => {
-  if (target2) handleEnvSwitch(target2);
+program.command("env").description("Show or switch FML backend environment").argument("[target]", "Environment name, FML app URL, or backend URL").action(async (target2) => {
+  if (target2) await handleEnvSwitch(target2);
   else handleEnvShow();
 });
 program.command("start").description("Start the local observer and continuous agent activity sync").action(() => handleFmlStart());

package/dist/hook-handler.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   hookCaptureIsDisabled
-} from "./chunk-FGR7SHV7.js";
+} from "./chunk-2DQQXBWM.js";
 import {
   getActiveHookDestinationBinding
-} from "./chunk-GST2GTOC.js";
+} from "./chunk-PJWMSHHZ.js";
 import {
   SHELL_TOOL_NAMES,
   createHookInboxEntry,
@@ -12,7 +12,7 @@ import {
   normalizeObserverHookCapture,
   persistHookInboxEntry,
   readObserverAuthToken
-} from "./chunk-3T5UCGBR.js";
+} from "./chunk-5TOOBX7I.js";
 import {
   resolveRepositoryRootFromCwd,
   resolveRepositorySlugFromCwd
@@ -23,7 +23,7 @@ import {
   FML_OBSERVER_AUTH_TOKEN_FILE,
   FML_OBSERVER_ENDPOINT_FILE,
   getValidToken
-} from "./chunk-KWCFT54L.js";
+} from "./chunk-B3H2YWPJ.js";
 import "./chunk-MLKGABMK.js";
 
 // src/hooks/handler.ts

package/dist/mcp/server.js

@@ -2,7 +2,7 @@
 import {
   createFmlClient,
   getAuthenticatedClient
-} from "../chunk-RZ5LWWRO.js";
+} from "../chunk-LOJPIJZW.js";
 import {
   resolveRepoFromCwd
 } from "../chunk-7V7G7NVF.js";
@@ -17,7 +17,7 @@ import {
   getValidToken,
   initSentry,
   readTokens
-} from "../chunk-KWCFT54L.js";
+} from "../chunk-B3H2YWPJ.js";
 import "../chunk-MLKGABMK.js";
 
 // src/mcp/server.ts

package/dist/observer-server.js

@@ -11,11 +11,11 @@ import {
   removeObserverStateIfOwned,
   resolveBin,
   updateObserverState
-} from "./chunk-GQ2WVOGY.js";
+} from "./chunk-ORYHJUC7.js";
 import {
   createHookSyncLoop,
   getActiveHookDestinationBinding
-} from "./chunk-GST2GTOC.js";
+} from "./chunk-PJWMSHHZ.js";
 import {
   OBSERVER_PROTOCOL_VERSION,
   OBSERVER_SERVICE_NAME,
@@ -30,15 +30,15 @@ import {
   parseHookInboxMetadata,
   readHookInboxStatusAsync,
   retireHookInboxEntry
-} from "./chunk-3T5UCGBR.js";
+} from "./chunk-5TOOBX7I.js";
 import "./chunk-7V7G7NVF.js";
 import {
   ObserverSyncCycleAbortedError,
   runObserverSyncCycleSubprocess
-} from "./chunk-JEZPS7F5.js";
+} from "./chunk-YFHZJPTC.js";
 import {
   createCliRawSync
-} from "./chunk-Z2LWDZ6Z.js";
+} from "./chunk-V2XC7JTB.js";
 import {
   FML_OBSERVER_AUTH_TOKEN_FILE,
   FML_OBSERVER_ENDPOINT_FILE,
@@ -56,7 +56,7 @@ import {
   getSyncDestinationAuthBinding,
   getValidToken,
   observerOnlyOverrideWarning
-} from "./chunk-KWCFT54L.js";
+} from "./chunk-B3H2YWPJ.js";
 import "./chunk-MLKGABMK.js";
 
 // src/observer-server.ts
@@ -1480,7 +1480,7 @@ var hookRejectionStatus = () => ({
   ...lastRejectedReason !== void 0 ? { lastRejectedReason } : {},
   ...lastRejectedTarget !== void 0 ? { lastRejectedTarget } : {}
 });
-var packageVersion = true ? "0.8.6-rc.2+bda7cc0a" : "dev";
+var packageVersion = true ? "0.8.6-rc.3+f7c7191d" : "dev";
 var health = () => ({
   status: "ok",
   service: OBSERVER_SERVICE_NAME,

package/dist/pi/extension.js

@@ -853,11 +853,7 @@ var FML_HOOK_CAPTURE_DISABLED_FILE = path3.join(
 );
 
 // src/config.ts
-var DEFAULT_PROD_URL = "https://trustworthy-chihuahua-382.convex.cloud";
-var DEFAULT_SYNC_URL = DEFAULT_PROD_URL.replace(
-  ".convex.cloud",
-  ".convex.site"
-);
+var DEFAULT_PROD_URL = "https://api.fml.inc";
 var DEFAULT_TARGET_NAME = "fml";
 var ENV_CONFIG_PATH = path4.join(FML_DATA_DIR, "env.json");
 var ENV_NAME_RE = /^[A-Za-z0-9_-]+$/;
@@ -872,7 +868,10 @@ function normalizeConvexUrl(value) {
       "FML environment URL must be HTTPS (HTTP is allowed only for loopback) with no path, credentials, query, or fragment"
     );
   }
-  return value.replace(/\/$/, "").replace(".convex.site", ".convex.cloud");
+  return url.origin;
+}
+function normalizeAppUrl(value) {
+  return normalizeConvexUrl(value);
 }
 function readEnvConfig() {
   try {
@@ -894,14 +893,19 @@ function readEnvConfig() {
         if (!isValidEnvName(name) || !environment || typeof environment !== "object" || Array.isArray(environment)) {
           continue;
         }
-        const convexUrl = environment.convexUrl;
-        if (typeof convexUrl !== "string") continue;
+        const entry = environment;
+        if (typeof entry.convexUrl !== "string") continue;
         try {
-          environments[name] = { convexUrl: normalizeConvexUrl(convexUrl) };
+          const appUrl = typeof entry.appUrl === "string" ? normalizeAppUrl(entry.appUrl) : void 0;
+          environments[name] = {
+            convexUrl: normalizeConvexUrl(entry.convexUrl),
+            ...appUrl ? { appUrl } : {}
+          };
         } catch {
         }
       }
     }
+    environments[DEFAULT_TARGET_NAME] = { convexUrl: DEFAULT_PROD_URL };
     return {
       schemaVersion: 1,
       active: config.active,
@@ -924,12 +928,13 @@ function resolveEnvConvexUrl(envName) {
   return null;
 }
 function getActiveEnv() {
-  const name = readEnvConfig().active;
+  const config = readEnvConfig();
+  const name = config.active;
+  const stored = config.environments?.[name];
   const override = process.env.FML_CONVEX_URL;
-  return {
-    name,
-    convexUrl: override ? normalizeConvexUrl(override) : resolveEnvConvexUrl(name)
-  };
+  const convexUrl = override ? normalizeConvexUrl(override) : resolveEnvConvexUrl(name);
+  const appUrl = stored?.appUrl && stored.convexUrl === convexUrl ? stored.appUrl : null;
+  return { name, convexUrl, appUrl };
 }
 function authStorePathFor(envName) {
   return path4.join(FML_DATA_DIR, `auth.${envName}.json`);
@@ -939,7 +944,7 @@ var WORKOS_API_URL = "https://api.workos.com";
 function getSiteUrlForConvexUrl(convexUrl) {
   const explicit = process.env.CONVEX_SITE_URL;
   if (explicit) return explicit.replace(/\/$/, "");
-  return (convexUrl ?? DEFAULT_PROD_URL).replace(".convex.cloud", ".convex.site").replace(/\/$/, "");
+  return (convexUrl ?? DEFAULT_PROD_URL).replace(/\/$/, "");
 }
 
 // src/sentry.ts

package/dist/sync-cycle.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import {
   runObserverSyncCycle
-} from "./chunk-JEZPS7F5.js";
-import "./chunk-Z2LWDZ6Z.js";
-import "./chunk-KWCFT54L.js";
+} from "./chunk-YFHZJPTC.js";
+import "./chunk-V2XC7JTB.js";
+import "./chunk-B3H2YWPJ.js";
 import "./chunk-MLKGABMK.js";
 
 // src/sync-cycle.ts

package/dist/{token-store-TEPDSK2A.js → token-store-ORR5MIJL.js}

@@ -10,7 +10,7 @@ import {
   setSelectedOrg,
   storeServiceRefreshToken,
   writeTokens
-} from "./chunk-KWCFT54L.js";
+} from "./chunk-B3H2YWPJ.js";
 import "./chunk-MLKGABMK.js";
 export {
   SERVICE_TOKEN_LOGIN_USER_ID,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fml-inc/fml",
-  "version": "0.8.6-rc.2",
+  "version": "0.8.6-rc.3",
   "description": "FML CLI and agent tools",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",