@lorekit/cli 1.21.0 → 1.23.0

package/README.md

@@ -116,7 +116,7 @@ and `global`) — split into two clearly-labelled sections so you can see where
 each lesson lives:
 
 - **Offline** — the local two-tier store (`.lorekit/` in the repo + `~/.lorekit/`).
-- **Remote** — the hosted MCP store. When no token/endpoint is configured this
+- **Remote** — the hosted LoreKit store, reached over the REST API. When no token/endpoint is configured this
   section is a short note on how to set it up; it is **never an error** (the
   command still exits 0 and shows your offline lessons). A network/server error
   is likewise a per-scope warning, not a crash.
@@ -192,7 +192,7 @@ which is the point of an overview). An unconfigured remote degrades to a short
 note — never an error, always exit 0. `--endpoint` / `--token` / `--store`
 behave as in `list`. Remote counts reflect what the hosted `memory.list` returns
 per scope (the server's default page size); there is no cap-usage `N / limit`
-figure because the MCP surface exposes no total-count or cap tool.
+figure because the REST API exposes no total-count or cap endpoint.
 
 ### `lorekit scopes`
 
@@ -224,13 +224,13 @@ stored by basename only) — so every scope is reconstructed verbatim. Lessons
 present in both tiers are counted once (project shadows home, the same merge
 `list` uses); archived lessons are excluded.
 
-**Remote enumeration is not possible, and `scopes` says so honestly.** The
-hosted MCP surface exposes no "list all scopes" tool — every read tool
-(`memory.list` / `memory.search` / `memory.read`) *requires* a scope — so a
-remote inventory can't be built. The Remote section is therefore always a short
-note (never a faked listing), degrading gracefully at exit 0, the same way
-`stats` omits a cap-usage figure. `--endpoint` / `--token` / `--store` behave as
-in `list`.
+**Remote enumeration is exact too.** `RemoteStore.listScopes()` calls
+`GET /memories/scopes`, which aggregates one `{ scope, count }` row per scope in
+Postgres (never a truncatable `select('scope')` plus a client-side dedupe), so
+the Remote section is a real inventory rendered through the same helpers as the
+Offline one. A denied, unconfigured, unreachable, or erroring remote degrades to
+a short, accurate note (network error / HTTP status — never a faked listing) at
+exit 0. `--endpoint` / `--token` / `--store` behave as in `list`.
 
 ### `lorekit diff`
 
@@ -367,7 +367,7 @@ Memory has a controllable backend. Three **modes**:
 |------|--------------------|-------|
 | `off` | nowhere | Memory is disabled — every hook event and store op is a silent no-op. |
 | `local` | markdown files in two tiers (see below) | **Local means _not_ on the hosted website** — local lessons never sync to the LoreKit dashboard. That is the point of local: private-by-default, greppable, git-native. |
-| `remote` | the LoreKit MCP server (hosted) | The shared, cross-machine backend. Reads stay silent until an endpoint + token are configured. This is the default. |
+| `remote` | the hosted LoreKit API (REST) | The shared, cross-machine backend. Reads stay silent until an endpoint + token are configured. This is the default. |
 
 ### Local store layout — two tiers
 

package/bin/lorekit.mjs

@@ -45,10 +45,10 @@ ${c.bold('Commands')}
               the MCP server entry, and the lifecycle hooks for the chosen scope. Surgical —
               other servers, hooks, and settings are left untouched. Prompts
               project vs global; --project / --global choose non-interactively.
-  doctor      Verify the skill install, MCP connectivity, token, and scope.
+  doctor      Verify the skill install, remote connectivity, token, and scope.
   list (ls)   List the memories that apply to the current directory, split into
               an Offline section (local .lorekit/ + ~/.lorekit/) and a Remote
-              section (hosted MCP). Groups by scope (project/branch/repo/global).
+              section (the hosted LoreKit API). Groups by scope (project/branch/repo/global).
               --json for scripting, --scope <s> to narrow.
   search      Full-text search the applicable memories across both stores and all
     (grep)    scopes (case-insensitive, literal substring over key + value),
@@ -194,7 +194,7 @@ ${c.bold('Examples')}
 ${c.bold('Usage')}
   npx @lorekit/cli doctor [options]
 
-Checks the node runtime, skill install, resolved memory mode, MCP connectivity,
+Checks the node runtime, skill install, resolved memory mode, remote connectivity,
 token, and scope.
 
 ${c.bold('Options')}
@@ -217,8 +217,8 @@ ${c.bold('Usage')}
 
 Shows the memories for the scopes that resolve for the current directory
 (project/branch/repo/global), split into an Offline section (the local
-.lorekit/ + ~/.lorekit/ two-tier store) and a Remote section (the hosted MCP
-server). When no remote token/endpoint is configured the Remote section is a
+.lorekit/ + ~/.lorekit/ two-tier store) and a Remote section (the hosted LoreKit
+API). When no remote token/endpoint is configured the Remote section is a
 short note on how to set it up — never an error.
 
 ${c.bold('Options')}
@@ -320,7 +320,7 @@ ${c.bold('Usage')}
 
 Shows how many memories apply to the current directory's scopes (project/branch/
 repo/global), broken down per scope and per store (Offline = the local .lorekit/
-+ ~/.lorekit/ two-tier store; Remote = the hosted MCP server), with per-store and
++ ~/.lorekit/ two-tier store; Remote = the hosted LoreKit API), with per-store and
 grand totals. An unconfigured remote degrades to a short note, never an error.
 
 ${c.bold('Options')}
@@ -348,9 +348,10 @@ is a full inventory — it surfaces scopes anywhere in the store, regardless of
 current directory.
 
 Offline counts are exact: each scope is read from the memory files' frontmatter,
-not reverse-mapped from the directory layout. The Remote section is always a
-short note: the hosted MCP surface has no "list all scopes" tool (every read tool
-requires a scope), so a remote inventory isn't possible — never an error (exit 0).
+not reverse-mapped from the directory layout. Remote counts are exact too — they
+come from \`GET /memories/scopes\`, which aggregates one row per scope server-side.
+A denied, unconfigured, or unreachable remote degrades to a short, accurate note
+rather than an error (exit 0).
 
 ${c.bold('Options')}
   -d, --dir <path>        Target project root (default: current directory)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lorekit/cli",
-  "version": "1.21.0",
+  "version": "1.23.0",
   "description": "Install the LoreKit shared-memory skill and run health checks for the LoreKit MCP server.",
   "license": "MIT",
   "repository": {

package/src/mcp-server.mjs

@@ -11,10 +11,12 @@
 //   off    → advertise no tools; a call reports "disabled"
 //
 // org.* tools are always advertised regardless of memory mode. They proxy to
-// the remote endpoint because org management requires a server-side session
-// (JWT auth, SECURITY DEFINER RPCs). In local/off mode a transient RemoteStore
-// is built from the configured endpoint + token. If no remote is configured,
-// a clear error is returned.
+// the remote endpoint because orgs are server-side state — there is no local
+// equivalent to serve them from. (They no longer require a Supabase JWT: the
+// store calls the REST `/orgs` routes, which accept `lk_*` API tokens as of
+// 00041_org_actor_override.sql.) In local/off mode a transient RemoteStore is
+// built from the configured endpoint + token. If no remote is configured, a
+// clear error is returned.
 //
 // Machine-facing: ONLY JSON-RPC frames go to stdout — any diagnostics go to
 // stderr. The server never throws on malformed or partial input; a bad frame

package/src/mcp.mjs

@@ -27,7 +27,11 @@ export function buildRemoteUrl(endpoint, token) {
 let idCounter = 0;
 
 // Returns { ok, httpStatus, result, error, networkError }.
-export async function mcpCall(endpoint, token, method, params = {}, { timeoutMs = 10000 } = {}) {
+//
+// `opts.traceparent` is an optional W3C traceparent header value (see
+// src/telemetry.mjs `getActiveTraceparent`); when present it is forwarded so
+// the server-side span joins the CLI's trace — same idiom as restFetch.
+export async function mcpCall(endpoint, token, method, params = {}, { timeoutMs = 10000, traceparent } = {}) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
@@ -40,6 +44,7 @@ export async function mcpCall(endpoint, token, method, params = {}, { timeoutMs
         'content-type': 'application/json',
         accept: 'application/json, text/event-stream',
         ...(token ? { authorization: `Bearer ${token}` } : {}),
+        ...(traceparent ? { traceparent } : {}),
       },
       body: JSON.stringify({ jsonrpc: '2.0', id: ++idCounter, method, params }),
       signal: controller.signal,

package/src/scopes.mjs

@@ -13,10 +13,12 @@
 // mapping the on-disk directory layout, which is lossy for `project::{name}`
 // (stored by basename only) — so every scope is reconstructed exactly.
 //
-// Remote enumeration is NOT possible: the hosted MCP surface exposes no "list
-// all scopes" tool — every read tool (memory.list / search / read) REQUIRES a
-// scope — so the Remote section is always an honest note (never faked), the same
-// way `stats` omits a cap-usage figure. It still degrades gracefully at exit 0.
+// Remote enumeration is EXACT too: `RemoteStore.listScopes()` calls
+// `GET /memories/scopes`, which aggregates one row per scope in Postgres (never
+// a truncatable `select('scope')` + client-side dedupe), so both sections are
+// real inventories rendered through the same pure helpers. A denied,
+// unconfigured, unreachable, or erroring remote still degrades to a short,
+// accurate note at exit 0 — never a throw.
 //
 // Graceful, read-only, human-facing (the bin wraps it in `traceCommand`).
 // `LOREKIT_DENY` suppresses a section; `--scope <s>` filters the inventory to
@@ -26,15 +28,9 @@ import process from 'node:process';
 import { resolveProjectRoot } from './config.mjs';
 import { resolveDenies } from './control.mjs';
 import { resolveStores, remoteUnavailableReason } from './stores.mjs';
-import { summarizeScopeInventory, filterScopeInventory } from './lessons-view.mjs';
+import { summarizeScopeInventory, filterScopeInventory, describeError } from './lessons-view.mjs';
 import { log, heading, status, c } from './util.mjs';
 
-// The honest note the Remote section shows when it isn't denied/unconfigured:
-// the hosted MCP surface simply can't enumerate scopes. Exported so tests can
-// assert the exact wording rather than a fragile substring.
-export const REMOTE_SCOPES_UNSUPPORTED =
-  'remote scope enumeration is not supported by the hosted MCP surface (memory.list requires a scope)';
-
 export async function scopes(args) {
   const root = resolveProjectRoot(args.dir);
   const env = { ...process.env };
@@ -63,16 +59,21 @@ export async function scopes(args) {
     offlineSection = { available: true, ...summarizeScopeInventory(inventory) };
   }
 
-  // Remote: never enumerable. A deny note, an unconfigured note, or the honest
-  // "not supported" note — all graceful (exit 0). Order matches the other
-  // commands' precedence: deny first, then connectivity, then the capability.
+  // Remote: the hosted enumeration, via `GET /memories/scopes`. Precedence is
+  // unchanged from the other read commands — deny first, then connectivity, then
+  // the call itself. A failed call degrades to the same bounded, non-PII
+  // `describeError` note a failed `list()` gets (network error / HTTP status),
+  // never a throw and never a faked inventory.
   let remoteSection;
   if (remoteDenied) {
     remoteSection = { available: false, reason: `disabled by deny constraint (${remoteDenied.source})` };
   } else if (!remote.usable()) {
     remoteSection = { available: false, reason: remoteUnavailableReason(connection) };
   } else {
-    remoteSection = { available: false, reason: REMOTE_SCOPES_UNSUPPORTED };
+    const res = await remote.listScopes();
+    remoteSection = res.ok
+      ? { available: true, ...summarizeScopeInventory(filterScopeInventory(res.scopes, filter)) }
+      : { available: false, reason: describeError(res) };
   }
 
   if (args.json) {
@@ -89,15 +90,17 @@ export async function scopes(args) {
     log('');
   }
 
-  // Bounded, non-PII telemetry extras (counts + a boolean) — never a scope
-  // string, path, or token. `remote_available` is always false: the surface
-  // can't enumerate, and saying so is the honest signal.
+  // Bounded, non-PII telemetry extras (counts + booleans) — never a scope
+  // string, path, or token. `remote_available` now reflects whether the hosted
+  // enumeration actually answered; the remote counts mirror the offline pair.
   return {
     exitCode: 0,
     'lorekit.cli.scopes.offline_scope_count': offlineSection.available ? offlineSection.scopes.length : 0,
     'lorekit.cli.scopes.offline_total': offlineSection.available ? offlineSection.total : 0,
     'lorekit.cli.scopes.filtered': Boolean(filter),
-    'lorekit.cli.scopes.remote_available': false,
+    'lorekit.cli.scopes.remote_scope_count': remoteSection.available ? remoteSection.scopes.length : 0,
+    'lorekit.cli.scopes.remote_total': remoteSection.available ? remoteSection.total : 0,
+    'lorekit.cli.scopes.remote_available': remoteSection.available,
   };
 }
 

package/src/store/remote.mjs

@@ -1,10 +1,24 @@
-// Remote store: wraps the LoreKit REST API `memory.*` endpoints behind the
-// common store contract. Memory operations use the REST API for lower overhead
-// and W3C traceparent propagation. Org operations remain on MCP because org
-// RPCs require a Supabase JWT session (auth.uid() via SECURITY DEFINER
-// functions), which is incompatible with the lk_* api_key tokens that CLI
-// users have. Zero-dependency.
-import { mcpCall, restFetch, mcpToRestBase } from '../mcp.mjs';
+// Remote store: wraps the LoreKit REST API behind the common store contract.
+// EVERY operation this store performs goes over REST — memory list, search,
+// read, write, delete (soft-archive AND `?force=true` hard-delete), the
+// store-wide `listScopes()` enumeration, all four `org.*` operations, and the
+// `ping` connectivity probe. There is NO MCP transport left here: the store
+// imports `restFetch`/`mcpToRestBase` and nothing else.
+//
+// Org ops used to be the one holdout. The org RPCs resolved their actor from
+// `auth.uid()`, which is NULL on the service-role connection an `lk_*` api_key
+// token gets, so `/orgs` 403'd every CLI caller and the store had to keep a
+// JSON-RPC transport alive purely for `org.create`/`org.list`/`org.rename`/
+// `org.delete`. `00041_org_actor_override.sql` added a `p_actor_user_id`
+// override that the RPCs honour only on a verified service_role connection,
+// and the `orgs` edge function now passes it plus its own tenant filters — so
+// every `/orgs*` route serves api_key tokens and the holdout is gone.
+//
+// `packages/cli/src/mcp.mjs` still exists and is still used: it backs the
+// `lorekit mcp` stdio server command and provides `mcpToRestBase`. It is just
+// no longer a transport for this store.
+// Zero-dependency.
+import { restFetch, mcpToRestBase } from '../mcp.mjs';
 import { getActiveTraceparent } from '../telemetry.mjs';
 
 // Drop undefined/null args so JSON payloads stay tidy.
@@ -20,7 +34,12 @@ export function createRemoteStore({ endpoint, token } = {}) {
 
 class RemoteStore {
   constructor(endpoint, token) {
-    this.endpoint = endpoint; // MCP URL (kept for org ops)
+    // The configured endpoint is still spelled as the `/mcp` URL (that is what
+    // `.mcp.json` / LOREKIT_MCP_URL hold, and changing that config key is a
+    // separate migration). Nothing here speaks MCP: it exists only so
+    // `usable()` can judge the configuration and `mcpToRestBase` can derive the
+    // REST base from it.
+    this.endpoint = endpoint;
     this.token = token;
     this.restBase = mcpToRestBase(endpoint); // REST base URL for memory ops
     this.mode = 'remote';
@@ -37,22 +56,6 @@ class RemoteStore {
     return restFetch(this.restBase, this.token, path, { ...opts, traceparent: this._tp() });
   }
 
-  async _mcp(name, args) {
-    if (!this.usable()) return { ok: false, unusable: true };
-    return mcpCall(this.endpoint, this.token, 'tools/call', { name, arguments: args });
-  }
-
-  _mcpEntries(res) {
-    if (!res.ok) return { ok: false, error: res.error, networkError: res.networkError };
-    // MCP wraps results in { content: [{ type: 'text', text: '<json>' }] }
-    let payload = null;
-    if (Array.isArray(res.result?.content)) {
-      const text = res.result.content.map((c) => c?.text ?? '').join('');
-      try { payload = JSON.parse(text); } catch { /* ignore */ }
-    } else { payload = res.result; }
-    return { ok: true, entries: Array.isArray(payload?.entries) ? payload.entries : [] };
-  }
-
   // ── Memory operations → REST ──────────────────────────────────────────────
 
   async list({ scope, tags, limit } = {}) {
@@ -79,6 +82,8 @@ class RemoteStore {
     const p = new URLSearchParams();
     if (scope) p.set('scope', scope);
     if (key) p.set('key', key);
+    // scope+key is unique, so one row is all there can be — don't pull the default page of 50.
+    p.set('limit', '1');
     const res = await this._rest(`/memories?${p}`);
     if (!res.ok) return { ok: false, error: res.error, networkError: res.networkError };
     const entries = res.data?.entries ?? [];
@@ -99,14 +104,12 @@ class RemoteStore {
     return { ok: res.ok, error: res.error, networkError: res.networkError };
   }
 
+  // Natural-key DELETE. Without `force` the server soft-archives (stamps
+  // `archived_at`); `?force=true` hard-deletes the row outright — both forms of
+  // the same REST route (supabase/functions/memories/handlers/remove.ts).
   async delete({ scope, key, force = false } = {}) {
-    if (force) {
-      // Hard-delete requires MCP — REST only supports soft-archive (archived_at)
-      const res = await this._mcp('memory.delete', { scope, key, force: true });
-      return { ok: res.ok, error: res.error, networkError: res.networkError };
-    }
-    // Soft-archive via natural-key REST endpoint
     const p = new URLSearchParams({ scope, key });
+    if (force) p.set('force', 'true');
     const res = await this._rest(`/memories?${p}`, { method: 'DELETE' });
     return { ok: res.ok, error: res.error, networkError: res.networkError };
   }
@@ -116,66 +119,94 @@ class RemoteStore {
     return this.delete({ scope, key, force: false });
   }
 
-  // ── Org operations ─────────────────────────────────────────────────────────
-  // Org RPCs (lorekit_org_*) use auth.uid() server-side via SECURITY DEFINER
-  // functions, which only works with a Supabase JWT session. CLI uses lk_*
-  // api_key tokens which provide no JWT context, so the REST /orgs endpoint
-  // returns 403 for api_key callers. Org ops stay on the MCP endpoint which
-  // handles this correctly (the Deno edge function has its own auth path).
-  // TODO: if org RPCs ever gain api_key support, switch these to REST too.
-
+  // ── Org operations → REST ─────────────────────────────────────────────────
+  // `supabase/functions/orgs/` serves `lk_*` tokens on every route as of
+  // 00041_org_actor_override.sql (see the file header). Each method's RETURN
+  // SHAPE is unchanged from the MCP era — `packages/cli/src/mcp-server.mjs`
+  // serialises these objects straight into a `tools/call` result, so the shape
+  // is a published contract, not an internal detail.
+  //
+  // Slugs are interpolated into the PATH, so they must be encodeURIComponent'd.
+  // A slug is server-side constrained to `[a-z0-9-]`, but the CLI passes
+  // whatever the user typed and an un-encoded `../` or `?` would retarget the
+  // request at a different route entirely.
+
+  // POST /orgs → 201 with the created org object, `{ id, slug, name, created_at }`.
+  // The handler reads the row back after the RPC (`orgs/handlers/orgs/create.ts`);
+  // `created_at` is absent only on the read-back miss, where it falls back to
+  // `{ id, slug, name }`. A bare JSON id string is the LEGACY shape an older
+  // deployed backend can still return — that is what the string branch below is
+  // for, not the normal case. Either way this method reassembles the
+  // `{ id, slug, name }` triple, because `packages/cli/src/mcp-server.mjs`
+  // serialises it straight into a `tools/call` result and that shape is a
+  // published contract.
   async orgCreate({ slug, name } = {}) {
-    const res = await this._mcp('org.create', { slug, name });
+    const res = await this._rest('/orgs', { method: 'POST', body: { slug, name } });
     if (!res.ok) return { ok: false, error: res.error, networkError: res.networkError };
-    let payload = null;
-    if (Array.isArray(res.result?.content)) {
-      try { payload = JSON.parse(res.result.content.map((c) => c?.text ?? '').join('')); } catch {}
-    } else { payload = res.result; }
-    return { ok: true, org: payload };
+    const id = typeof res.data === 'string' ? res.data : (res.data?.id ?? null);
+    return { ok: true, org: { id, slug, name } };
   }
 
+  // GET /orgs → { entries: [{ id, slug, name, role, created_at }] }
   async orgList() {
-    const res = await this._mcp('org.list', {});
-    return this._mcpEntries(res);
+    const res = await this._rest('/orgs');
+    if (!res.ok) return { ok: false, error: res.error, networkError: res.networkError };
+    return { ok: true, entries: Array.isArray(res.data?.entries) ? res.data.entries : [] };
   }
 
+  // PATCH /orgs/:slug → 200 { slug, name }
   async orgRename({ slug, name } = {}) {
-    const res = await this._mcp('org.rename', { slug, name });
+    const res = await this._rest(`/orgs/${encodeURIComponent(slug)}`, { method: 'PATCH', body: { name } });
     if (!res.ok) return { ok: false, error: res.error, networkError: res.networkError };
-    let payload = null;
-    try { payload = Array.isArray(res.result?.content) ? JSON.parse(res.result.content.map((c) => c?.text ?? '').join('')) : res.result; } catch {}
-    return { ok: true, ...(payload ?? {}) };
+    return { ok: true, ...(res.data ?? { slug, name }) };
   }
 
+  // DELETE /orgs/:slug → 204 with no body, so `deleted: true` is synthesised to
+  // preserve the `{ ok, deleted, slug }` shape the MCP tool returned.
   async orgDelete({ slug } = {}) {
-    const res = await this._mcp('org.delete', { slug });
+    const res = await this._rest(`/orgs/${encodeURIComponent(slug)}`, { method: 'DELETE' });
     if (!res.ok) return { ok: false, error: res.error, networkError: res.networkError };
-    let payload = null;
-    try { payload = Array.isArray(res.result?.content) ? JSON.parse(res.result.content.map((c) => c?.text ?? '').join('')) : res.result; } catch {}
-    return { ok: true, ...(payload ?? {}) };
-  }
-
-  // Store-wide scope enumeration is NOT possible against the hosted REST surface:
-  // every read tool requires a scope, and there is no "list all scopes" endpoint.
-  // Signal that honestly so the `scopes` command shows a clear note rather than
-  // faking an inventory.
+    return { ok: true, deleted: true, slug };
+  }
+
+  // Store-wide scope enumeration — every distinct scope the caller can see with
+  // its count of active (non-archived, non-expired) memories. `GET
+  // /memories/scopes` aggregates in Postgres, so the answer is exact at any size
+  // (see supabase/functions/memories/handlers/scopes.ts).
+  //
+  // The `scopes` array is the SAME `[{ scope, count }]` inventory shape
+  // `LocalStore.listScopes()` returns, so `scopes.mjs` feeds both through the
+  // same pure `filterScopeInventory`/`summarizeScopeInventory` helpers. Ordering
+  // is not relied upon (the server sorts by scope asc; the view re-sorts by
+  // scope type). Failures use this store's standard `{ ok:false, error,
+  // networkError }` envelope so the caller can degrade gracefully.
   async listScopes() {
-    return { ok: false, unsupported: true };
+    const res = await this._rest('/memories/scopes');
+    if (!res.ok) return { ok: false, error: res.error, networkError: res.networkError, unusable: res.unusable };
+    const scopes = Array.isArray(res.data?.scopes) ? res.data.scopes : [];
+    return { ok: true, scopes: scopes.map((s) => ({ scope: s.scope, count: Number(s.count) || 0 })) };
   }
 
   // Connectivity probe for doctor — a transport check, not a memory op.
+  //
+  // There is no MCP fallback: a `restBase` we could not derive means the
+  // configured endpoint is not a URL, and a JSON-RPC POST to that same
+  // unparseable string could only fail in a less legible way. Report the
+  // configuration problem instead.
   async ping() {
     if (!this.usable()) return { ok: false, unusable: true };
     // Use the /health function as a connectivity probe (public, no auth)
-    const healthUrl = this.restBase
-      ? `${this.restBase.replace(/\/functions\/v1$/, '')}/functions/v1/health`
-      : null;
-    if (healthUrl) {
-      try {
-        const res = await fetch(healthUrl, { signal: AbortSignal.timeout(5000) });
-        return { ok: res.ok, httpStatus: res.status };
-      } catch (e) { return { ok: false, networkError: String(e?.message ?? e) }; }
+    if (!this.restBase) {
+      return { ok: false, error: { message: `Endpoint is not a valid URL: ${this.endpoint}` } };
     }
-    return mcpCall(this.endpoint, this.token, 'tools/list', {});
+    const healthUrl = `${this.restBase.replace(/\/functions\/v1$/, '')}/functions/v1/health`;
+    const tp = this._tp();
+    try {
+      const res = await fetch(healthUrl, {
+        signal: AbortSignal.timeout(5000),
+        ...(tp ? { headers: { traceparent: tp } } : {}),
+      });
+      return { ok: res.ok, httpStatus: res.status };
+    } catch (e) { return { ok: false, networkError: String(e?.message ?? e) }; }
   }
 }

package/src/telemetry.mjs

@@ -41,19 +41,30 @@ const FLAG_ATTRS = ['global', 'project', 'deep', 'yes', 'force', 'no-hooks', 'js
 const OFF_VALUES = new Set(['0', 'off', 'false', 'no', 'disable', 'disabled']);
 
 // ── Active trace context (for traceparent propagation to REST calls) ──────────
-// Set at the start of each traced command run; used by RemoteStore to
-// forward the CLI span's trace identity to outgoing REST requests.
+// Set at the start of EVERY traced command run — including runs where export is
+// disabled. Context propagation is deliberately decoupled from export: a user
+// who opted out (or who simply has no OTLP endpoint configured) must still get
+// correlated server-side traces, they just don't contribute a CLI span.
 let _activeTraceId = null;
 let _activeSpanId = null;
+// Whether the current command's span will actually be exported. Drives the
+// W3C `sampled` bit only — never whether the header is sent.
+let _activeSampled = false;
 
 /**
- * Get the W3C traceparent for the currently-running CLI command, or null.
- * Called by RemoteStore to inject the header into REST fetches so CLI spans
- * are linked to REST API spans in Dash0.
+ * Get the W3C traceparent for the currently-running CLI command, or null when
+ * no command is running. Called by RemoteStore to inject the header into
+ * outgoing REST/MCP calls so the server span joins the CLI's trace.
+ *
+ * Flags are `01` when the CLI span is exported and `00` when it is not — the
+ * trace id is still carried either way, so the server can correlate. This
+ * mirrors `formatTraceparent` in `packages/mcp-core/src/trace-context.ts`
+ * (the CLI is zero-dep `.mjs` and cannot import the TS module); keep the two
+ * byte-consistent.
  */
 export function getActiveTraceparent() {
   if (!_activeTraceId || !_activeSpanId) return null;
-  return `00-${_activeTraceId}-${_activeSpanId}-01`;
+  return `00-${_activeTraceId}-${_activeSpanId}-${_activeSampled ? '01' : '00'}`;
 }
 
 // ── Config resolution ─────────────────────────────────────────────────────────
@@ -313,18 +324,32 @@ export async function traceCommand(command, args, version, run) {
     config = { enabled: false };
   }
 
+  // Generate trace context BEFORE the export gate below, so outgoing REST/MCP
+  // calls can forward it as `traceparent` even when telemetry is disabled.
+  // Propagation is decoupled from export: a user with no OTLP endpoint (the
+  // common case — TELEMETRY_TOKEN is empty in git) still gets a single
+  // correlated server-side trace. The `sampled` bit is what reflects export.
+  // The same IDs are reused in exportInvocation() to link the CLI span to
+  // REST spans.
+  _activeTraceId = randHex(16);
+  _activeSpanId = randHex(8);
+  _activeSampled = Boolean(config.enabled);
+
   // Fast path: no export configured → run with zero telemetry overhead. Still
   // normalize the result to a numeric exit code: commands may resolve to an
   // { exitCode, ...extra } object (e.g. `doctor`), and only the instrumented
   // path below unwraps it. Returning `run()` raw would leak that object all the
   // way to `process.exit(obj)` in the bin entry → ERR_INVALID_ARG_TYPE crash
   // (exit 1) for every user without an OTLP endpoint configured.
-  if (!config.enabled) return normalizeExitCode(await run());
-
-  // Generate trace context before run() so REST calls can forward it as traceparent.
-  // The same IDs are reused in exportInvocation() to link the CLI span to REST spans.
-  _activeTraceId = randHex(16);
-  _activeSpanId = randHex(8);
+  if (!config.enabled) {
+    try {
+      return normalizeExitCode(await run());
+    } finally {
+      _activeTraceId = null;
+      _activeSpanId = null;
+      _activeSampled = false;
+    }
+  }
 
   const startMs = Date.now();
   let exitCode = 0;
@@ -389,6 +414,7 @@ export async function traceCommand(command, args, version, run) {
     } finally {
       _activeTraceId = null;
       _activeSpanId = null;
+      _activeSampled = false;
     }
   }
 }