@nearform/fling 0.1.2 → 0.3.0

package/dist/cli.js

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 
 // src/cli.ts
+import chalk10 from "chalk";
 import { Command } from "commander";
 
 // src/commands/auth.ts
-import chalk4 from "chalk";
+import chalk5 from "chalk";
 
 // src/auth.ts
 import { randomBytes } from "node:crypto";
@@ -24,7 +25,7 @@ var MAX_FILES = 5e3;
 var MAX_PATH_LENGTH = 1024;
 
 // ../../packages/shared/src/secrets.ts
-var SECRET_SCAN_MAX_FILE_BYTES = 5 * 1024 * 1024;
+var SECRET_SCAN_MAX_FILE_BYTES = MAX_FILE_BYTES;
 var BINARY_SNIFF_BYTES = 8192;
 var SECRET_EXTENSIONS = [
   ".pem",
@@ -49,8 +50,8 @@ var SECRET_NAMES = /* @__PURE__ */ new Set([
   ".htpasswd"
 ]);
 var SSH_KEY_RE = /^id_(?:rsa|dsa|ecdsa|ed25519)(?:[._-]|$)/;
-function isSecretPath(path) {
-  const name = (path.split(/[\\/]/).at(-1) ?? "").toLowerCase();
+function isSecretPath(path3) {
+  const name = (path3.split(/[\\/]/).at(-1) ?? "").toLowerCase();
   if (!name) return false;
   if (SECRET_NAMES.has(name)) return true;
   if (SECRET_EXTENSIONS.some((ext) => name.endsWith(ext) && name.length > ext.length)) return true;
@@ -160,24 +161,24 @@ function lineAt(starts, index) {
   }
   return lo + 1;
 }
-function scanForSecrets(text, path) {
+function scanForSecrets(text2, path3) {
   let starts;
   const findings = [];
   const seen = /* @__PURE__ */ new Set();
   for (const rule of RULES) {
     rule.re.lastIndex = 0;
-    for (let m = rule.re.exec(text); m !== null; m = rule.re.exec(text)) {
+    for (let m = rule.re.exec(text2); m !== null; m = rule.re.exec(text2)) {
       if (m[0].length === 0) rule.re.lastIndex++;
       if (rule.allow?.(m)) continue;
       if (!starts) {
         starts = [0];
-        for (let i = text.indexOf("\n"); i !== -1; i = text.indexOf("\n", i + 1)) starts.push(i + 1);
+        for (let i = text2.indexOf("\n"); i !== -1; i = text2.indexOf("\n", i + 1)) starts.push(i + 1);
       }
       const line = lineAt(starts, m.index);
       const key = `${rule.id}:${line}`;
       if (seen.has(key)) continue;
       seen.add(key);
-      findings.push({ path, line, rule: rule.id });
+      findings.push({ path: path3, line, rule: rule.id });
     }
   }
   return findings.sort((a, b) => a.line - b.line || a.rule.localeCompare(b.rule));
@@ -185,8 +186,8 @@ function scanForSecrets(text, path) {
 var BINARY_EXTENSIONS = new Set(
   "png jpg jpeg gif webp avif ico bmp tif tiff heic psd woff woff2 ttf otf eot mp3 mp4 m4a m4v mov webm ogg oga ogv wav flac aac avi mkv zip gz tgz br zst bz2 xz 7z rar wasm pdf glb gltf-binary bin dat".split(/\s+/).filter(Boolean)
 );
-function isScannablePath(path) {
-  const name = path.split("/").at(-1) ?? "";
+function isScannablePath(path3) {
+  const name = path3.split("/").at(-1) ?? "";
   const dot = name.lastIndexOf(".");
   return dot <= 0 || !BINARY_EXTENSIONS.has(name.slice(dot + 1).toLowerCase());
 }
@@ -195,10 +196,10 @@ function looksBinary(bytes) {
   for (let i = 0; i < end; i++) if (bytes[i] === 0) return true;
   return false;
 }
-function scanBytesForSecrets(bytes, path) {
-  if (!isScannablePath(path) || bytes.length > SECRET_SCAN_MAX_FILE_BYTES || looksBinary(bytes))
+function scanBytesForSecrets(bytes, path3) {
+  if (!isScannablePath(path3) || bytes.length > SECRET_SCAN_MAX_FILE_BYTES || looksBinary(bytes))
     return [];
-  return scanForSecrets(new TextDecoder("utf-8").decode(bytes), path);
+  return scanForSecrets(new TextDecoder("utf-8").decode(bytes), path3);
 }
 function describeSecretFindings(findings, max = 20) {
   const lines = findings.slice(0, max).map((f) => `${f.path} line ${f.line}: ${SECRET_RULE_LABELS[f.rule] ?? f.rule}`);
@@ -208,10 +209,10 @@ function describeSecretFindings(findings, max = 20) {
 var NEVER_PUBLISHED_NOTE = "Fling never publishes dotfiles, gitignored files, secret files (keys, certificates, credentials) or files that contain secrets.";
 
 // ../../packages/shared/src/manifest.ts
-function isValidSitePath(path) {
-  if (!path || path.length > MAX_PATH_LENGTH) return false;
-  if (path.startsWith("/") || path.includes("\\") || path.includes("\0")) return false;
-  return path.split("/").every((seg) => seg !== "" && !seg.startsWith("."));
+function isValidSitePath(path3) {
+  if (!path3 || path3.length > MAX_PATH_LENGTH) return false;
+  if (path3.startsWith("/") || path3.includes("\\") || path3.includes("\0")) return false;
+  return path3.split("/").every((seg) => seg !== "" && !seg.startsWith("."));
 }
 var ManifestFileSchema = z.object({
   path: z.string().refine(isValidSitePath, "invalid path (dotfiles are never published)").refine((p) => !isSecretPath(p), "secret file (keys, certificates, credentials) never published"),
@@ -227,7 +228,13 @@ var MeSchema = z2.object({
   email: z2.string(),
   name: z2.string(),
   picture: z2.string().nullable(),
-  userSlug: z2.string()
+  userSlug: z2.string(),
+  /** one of the instance's admins (servers from before admins don't say: false) */
+  admin: z2.boolean().default(false),
+  /** while an admin impersonates this user: the admin (browser sessions only) */
+  impersonator: z2.string().optional(),
+  /** …and when the impersonation lapses */
+  impersonationEndsAt: z2.string().optional()
 });
 var SiteSchema = z2.object({
   name: z2.string(),
@@ -329,8 +336,122 @@ var OAuthRequestInfoSchema = z2.object({
   email: z2.string()
 });
 var OAuthDecisionSchema = z2.object({ redirectUrl: z2.string() });
+var AdminUserSchema = z2.object({
+  email: z2.string(),
+  name: z2.string(),
+  picture: z2.string().nullable(),
+  userSlug: z2.string(),
+  createdAt: z2.string().nullable(),
+  lastSignInAt: z2.string().nullable(),
+  /** sites the user holds, archived ones included */
+  siteCount: z2.number(),
+  admin: z2.boolean()
+});
+var AdminUserListSchema = z2.object({
+  users: z2.array(AdminUserSchema),
+  /** pass back as `cursor` for the next page; null: no more */
+  cursor: z2.string().nullable()
+});
+var AuditEntrySchema = z2.object({
+  id: z2.string(),
+  at: z2.string(),
+  action: z2.enum(["impersonation.start", "impersonation.stop"]),
+  actor: z2.string(),
+  target: z2.string(),
+  until: z2.string().optional(),
+  lapsed: z2.boolean().optional()
+});
+var AuditListSchema = z2.object({ entries: z2.array(AuditEntrySchema) });
+var ImpersonateRequestSchema = z2.object({ email: z2.string().trim().toLowerCase().min(3) });
 
-// ../../packages/shared/src/hosts.ts
+// ../../packages/shared/src/comments.ts
+import { z as z3 } from "zod";
+var COMMENT_MAX_CHARS = 4e3;
+var COMMENT_PATH_MAX = 1024;
+var CommentAuthorSchema = z3.discriminatedUnion("kind", [
+  z3.object({ kind: z3.literal("user"), email: z3.string() }),
+  z3.object({ kind: z3.literal("guest"), name: z3.string() })
+]);
+var ANCHOR_SELECTOR_MAX = 512;
+var px = z3.number().finite().min(-1e7).max(1e7);
+var percent = z3.number().min(0).max(100);
+var CommentAnchorSchema = z3.object({
+  x: percent,
+  y: percent,
+  selector: z3.string().min(1).max(ANCHOR_SELECTOR_MAX).optional(),
+  ex: percent.optional(),
+  ey: percent.optional(),
+  docX: px.optional(),
+  docY: px.optional(),
+  scrollX: px.optional(),
+  scrollY: px.optional(),
+  vw: z3.number().finite().min(0).max(1e5).optional(),
+  vh: z3.number().finite().min(0).max(1e5).optional(),
+  hash: z3.string().max(COMMENT_PATH_MAX).optional()
+});
+var CommentSchema = z3.object({
+  id: z3.string(),
+  /** the thread this replies to; null for the comment that starts a thread */
+  parentId: z3.string().nullable(),
+  /** the page, as normalizeCommentPath() writes it ('/', '/docs/', '/about.html') */
+  path: z3.string(),
+  /** the version the site was serving when the comment was made (null: none was) */
+  versionId: z3.string().nullable(),
+  anchor: CommentAnchorSchema.nullable(),
+  body: z3.string(),
+  author: CommentAuthorSchema,
+  createdAt: z3.string(),
+  /** threads only: when and by whom it was resolved (null: open) */
+  resolvedAt: z3.string().nullable(),
+  resolvedBy: CommentAuthorSchema.nullable(),
+  /** whether the caller may delete it (policy's answer, so clients don't guess) */
+  canDelete: z3.boolean()
+});
+var CommentListSchema = z3.object({
+  site: z3.object({
+    name: z3.string(),
+    url: z3.string(),
+    currentVersionId: z3.string().nullable()
+  }),
+  comments: z3.array(CommentSchema),
+  can: z3.object({
+    create: z3.boolean(),
+    resolve: z3.boolean(),
+    /** delete anyone's comment (everyone may delete their own) */
+    deleteAny: z3.boolean()
+  })
+});
+var CreateCommentRequestSchema = z3.object({
+  body: z3.string().trim().min(1).max(COMMENT_MAX_CHARS),
+  path: z3.string().max(COMMENT_PATH_MAX).optional(),
+  parentId: z3.string().min(1).max(100).optional(),
+  anchor: CommentAnchorSchema.optional()
+});
+var UpdateCommentRequestSchema = z3.object({ resolved: z3.boolean() });
+function commentThreads(comments) {
+  const threads = /* @__PURE__ */ new Map();
+  for (const c of comments) {
+    if (c.parentId === null) threads.set(c.id, { comment: c, replies: [] });
+  }
+  for (const c of comments) {
+    if (c.parentId !== null) threads.get(c.parentId)?.replies.push(c);
+  }
+  return [...threads.values()];
+}
+function authorLabel(author) {
+  return author.kind === "user" ? author.email : `${author.name} (guest)`;
+}
+function reviewUrl(appOrigin, name, path3) {
+  const base = `${appOrigin.replace(/\/+$/, "")}/review/${name === "<name>" ? name : encodeURIComponent(name)}`;
+  return path3 && path3 !== "/" ? `${base}?path=${encodeURIComponent(path3)}` : base;
+}
+
+// ../../packages/shared/src/distribution.ts
+var CLI_PACKAGE = "@nearform/fling";
+var REPO_SLUG = "nearform/fling";
+var DEFAULT_INSTALL_COMMAND = `npm install -g ${CLI_PACKAGE}`;
+
+// ../../packages/shared/src/site-labels.ts
 var SITE_NAME_MAX = 50;
 var SHARE_TOKEN_LENGTH = 20;
 var RESERVED_SITE_NAMES = [
@@ -351,26 +472,92 @@ var RESERVED_SITE_NAMES = [
 ];
 var SLUG_RE = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
 var SHARE_TOKEN_RE = new RegExp(`^[a-z0-9]{${SHARE_TOKEN_LENGTH}}$`);
-function slugify(input, max = SITE_NAME_MAX) {
-  return input.normalize("NFKD").replace(/[̀-ͯ]/g, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, max).replace(/-+$/g, "");
-}
 function isValidSiteName(name) {
   return name.length <= SITE_NAME_MAX && SLUG_RE.test(name) && !name.includes("--") && !RESERVED_SITE_NAMES.includes(name);
 }
+
+// ../../packages/shared/src/hosts.ts
+function slugify(input, max = SITE_NAME_MAX) {
+  return input.normalize("NFKD").replace(/[̀-ͯ]/g, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, max).replace(/-+$/g, "");
+}
 function siteUrl(label, sitesDomain, protocol = "https:") {
   return `${protocol}//${label}.${sitesDomain}/`;
 }
 
+// ../../packages/shared/src/instance.ts
+import { z as z4 } from "zod";
+var INSTANCE_METADATA_PATH = "/.well-known/fling";
+var HEX_COLOR_RE = /^#(?:[0-9a-f]{3}|[0-9a-f]{6})$/i;
+var color = z4.string().regex(HEX_COLOR_RE);
+var InstanceAuthSchema = z4.looseObject({
+  kind: z4.string().min(1),
+  displayName: z4.string().min(1),
+  issuer: z4.string().optional(),
+  emailDomains: z4.array(z4.string()).default([]),
+  invitedEmails: z4.boolean().optional()
+});
+var BrandColorsSchema = z4.looseObject({
+  primary: color.optional(),
+  primaryContent: color.optional(),
+  accent: color.optional(),
+  ink: color.optional(),
+  highlight: color.optional()
+});
+var InstanceBrandSchema = z4.looseObject({
+  /** https: or data: URL of the logo mark shown before the name (light theme). */
+  logoUrl: z4.string().optional(),
+  /** The same for the dark theme; defaults to `logoUrl`. */
+  logoDarkUrl: z4.string().optional(),
+  faviconUrl: z4.string().optional(),
+  colors: BrandColorsSchema.default({})
+});
+var InstanceMetadataSchema = z4.looseObject({
+  version: z4.number().int().min(1),
+  /** Display name, e.g. "Fling". */
+  name: z4.string().min(1),
+  /** e.g. `https://fling.example.test` (no trailing slash) */
+  appOrigin: z4.string().url(),
+  /** host[:port] sites hang off: a site is `<name>.<sitesDomain>` */
+  sitesDomain: z4.string().min(1),
+  siteScheme: z4.enum(["http", "https"]),
+  auth: InstanceAuthSchema,
+  brand: InstanceBrandSchema.default({ colors: {} }),
+  /** Feature flags: a client hides what is missing or false. */
+  capabilities: z4.record(z4.string(), z4.boolean()).default({}),
+  /** How to install the CLI, e.g. `npm install -g <package>`. */
+  installCommand: z4.string().min(1)
+});
+function instanceSitesPattern(instance) {
+  return `${instance.siteScheme}://<name>.${instance.sitesDomain}`;
+}
+function emailDomainsPhrase(auth) {
+  const domains = auth.emailDomains.map((d) => `@${d}`);
+  if (domains.length === 0) return null;
+  return domains.length === 1 ? domains[0] : `${domains.slice(0, -1).join(", ")} or ${domains.at(-1)}`;
+}
+function allowedAccountsPhrase(auth) {
+  const domains = emailDomainsPhrase(auth);
+  const parts = [domains && `${domains} accounts`, auth.invitedEmails && "invited accounts"];
+  return parts.filter(Boolean).join(" and ") || null;
+}
+function privateAudience(instance) {
+  const accounts = allowedAccountsPhrase(instance.auth);
+  return `anyone signed in to ${instance.name}${accounts ? ` (${accounts})` : ""}`;
+}
+function instanceMetadataUrl(serverUrl) {
+  return `${serverUrl.replace(/\/+$/, "")}${INSTANCE_METADATA_PATH}`;
+}
+
 // ../../packages/shared/src/kvs.ts
-import { z as z3 } from "zod";
-var KvsSiteValueSchema = z3.object({
+import { z as z5 } from "zod";
+var KvsSiteValueSchema = z5.object({
   /** siteId — S3 prefix is `sites/<id>/<v>/` */
-  id: z3.string(),
+  id: z5.string(),
   /** current versionId */
-  v: z3.string(),
-  vis: z3.enum(["private", "public"]),
+  v: z5.string(),
+  vis: z5.enum(["private", "public"]),
   /** serve /index.html for unknown extensionless paths */
-  spa: z3.boolean()
+  spa: z5.boolean()
 });
 
 // ../../packages/shared/src/listing.ts
@@ -379,9 +566,9 @@ var escapeHtml = (s) => s.replace(
   /[&<>"']/g,
   (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]
 );
-var hrefFor = (path) => path.split("/").map(encodeURIComponent).join("/");
-function isHtmlPath(path) {
-  return /\.html?$/i.test(path);
+var hrefFor = (path3) => path3.split("/").map(encodeURIComponent).join("/");
+function isHtmlPath(path3) {
+  return /\.html?$/i.test(path3);
 }
 function extractHtmlTitle(html) {
   const match = /<title[^>]*>([\s\S]*?)<\/title>/i.exec(html.slice(0, 65536));
@@ -454,181 +641,238 @@ ${body}
 }
 
 // ../../packages/shared/src/mcp-tools.ts
-import { z as z4 } from "zod";
+import { z as z6 } from "zod";
 var MCP_PUBLISH_MAX_BYTES = 4 * 1024 * 1024;
 var MCP_UPLOAD_CHUNK_MAX_CHARS = 4 * 1024 * 1024;
 var MCP_UPLOAD_TTL_SECONDS = 60 * 60;
 var tool = (def) => def;
-var NAME_RULES = `Site names are 1-${SITE_NAME_MAX} chars of lowercase letters, digits and single hyphens, and are one global namespace (first come, first served): the site is served at https://<name>.fling.labs.nearform.com.`;
+var GENERIC_REVIEW = "the site's review page in the Fling web app (/review/<name>)";
+function mcpWording(instance) {
+  if (!instance) {
+    return {
+      name: "Fling",
+      sitesPattern: "https://<name>.<sites domain>",
+      privateAudience: "people signed in to this Fling",
+      signIn: "the Fling sign-in page",
+      reviewPattern: GENERIC_REVIEW
+    };
+  }
+  return {
+    name: instance.name,
+    sitesPattern: instanceSitesPattern(instance),
+    privateAudience: privateAudience(instance),
+    signIn: `their ${instance.auth.displayName} account`,
+    reviewPattern: instance.appOrigin ? reviewUrl(instance.appOrigin, "<name>") : GENERIC_REVIEW
+  };
+}
 var NAME_REQUIRED = 'Publishing needs a name: if the user did not give one, propose a short descriptive one (e.g. "q3-report") and confirm it with them first (fling_check_name tells you whether it is free). If the name is taken by someone else the call fails with free suggestions \u2014 offer those to the user and retry with the one they pick.';
-var VISIBILITY = "Sites are private by default (only signed-in Nearformers can open them); pass `public: true` only if the user asks for a public site. Share links (fling_share) are public to anyone who has them.";
 var INLINE_ONLY = "If you created the content in this conversation, pass it directly \u2014 never pass file paths from your sandbox (this server cannot read them) and never try to curl/upload from your sandbox.";
 var NEVER_PUBLISHED = "Fling never publishes dotfiles, gitignored files, secret files (keys, certs, credentials) or files that contain secrets (API keys, tokens, private keys, passwords in database URLs); it stops and tells you which file and line. Remove the secret (or leave the file out) and retry \u2014 there is no way to override this.";
 var ENCODING = '`encoding` is "utf8" (default, for text: HTML, CSS, JS, SVG, JSON, Markdown\u2026) or "base64" (binary: images, fonts, PDFs).';
 var LIST_HTML = "If the files have no root index.html but do include HTML pages, the call does not publish: it reports how many HTML pages there are and asks you to check with the user. Ask them whether to generate an index.html listing those pages (retry with `listHtml: true`) or to publish without one (`listHtml: false` \u2014 the site root will 404, the pages still work at their own paths), then retry.";
-var listHtml = z4.boolean().optional().describe(
+var listHtml = z6.boolean().optional().describe(
   "Only matters when there is no root index.html: true \u2192 generate an index.html linking every HTML page; false \u2192 publish without one (root 404s). Omit until the user has decided"
 );
-var siteName = z4.string().min(1).max(200).describe('Site name, e.g. "q3-report"');
-var sitePath = z4.string().min(1).max(1024).describe(
+var siteName = z6.string().min(1).max(200).describe('Site name, e.g. "q3-report"');
+var sitePath = z6.string().min(1).max(1024).describe(
   'Site-relative path with forward slashes, e.g. "index.html", "css/app.css", "img/logo.png". The root page must be "index.html". No dotfiles (".env", ".well-known/\u2026")'
 );
-var encoding = z4.enum(["utf8", "base64"]).optional().describe('How `content` is encoded: "utf8" (default) for text, "base64" for binary files');
-var spa = z4.boolean().optional().describe(
+var commentPath = z6.string().max(1024);
+var commentId = z6.string().min(1).max(100);
+var encoding = z6.enum(["utf8", "base64"]).optional().describe('How `content` is encoded: "utf8" (default) for text, "base64" for binary files');
+var spa = z6.boolean().optional().describe(
   "Single-page app: serve index.html for unknown paths (client-side routing). Omit to keep the current setting"
 );
-var isPublic = z4.boolean().optional().describe(
-  "true \u2192 anyone can view; false \u2192 Nearformers only. Omit to keep the current setting (new sites are private)"
-);
-var mcpTools = {
-  whoami: tool({
-    name: "fling_whoami",
-    title: "Who am I",
-    description: "Show the signed-in Nearform user that Fling acts as.",
-    inputSchema: {},
-    annotations: { readOnlyHint: true, openWorldHint: false }
-  }),
-  list: tool({
-    name: "fling_list",
-    title: "List sites",
-    description: "List the user's Fling sites with URL, visibility and share link.",
-    inputSchema: {
-      archived: z4.boolean().optional().describe("List archived sites instead of live ones")
-    },
-    annotations: { readOnlyHint: true, openWorldHint: false }
-  }),
-  info: tool({
-    name: "fling_info",
-    title: "Site details",
-    description: "Show one site: URL, visibility, share link, current version and version history (ids for fling_rollback).",
-    inputSchema: { name: siteName },
-    annotations: { readOnlyHint: true, openWorldHint: false }
-  }),
-  files: tool({
-    name: "fling_files",
-    title: "List site files",
-    description: "List the files in a site's current version (or in `versionId`, from fling_info): path, size and content type, sorted by path. Use it to check what was actually published \u2014 e.g. when the user sees a 404, confirm the page exists at that path and that there is a root index.html (without one the site root 404s).",
-    inputSchema: {
-      name: siteName,
-      versionId: z4.string().min(1).max(100).optional().describe("Version id (from fling_info); omit for the version being served")
-    },
-    annotations: { readOnlyHint: true, openWorldHint: false }
-  }),
-  checkName: tool({
-    name: "fling_check_name",
-    title: "Check a site name",
-    description: "Check whether a site name can be used before publishing: `available` (a new site), `yours` (publishing updates the user's existing site), `taken` (someone else's \u2014 free `suggestions` are returned) or `invalid`. " + NAME_RULES,
-    inputSchema: { name: z4.string().min(1).max(200).describe("Site name to check") },
-    annotations: { readOnlyHint: true, openWorldHint: false }
-  }),
-  publish: tool({
-    name: "fling_publish",
-    title: "Publish a site",
-    description: `Publish a static site to Fling in one call and get back its URL. Pass every file of the site inline in \`files\` (whole site, up to ${MCP_PUBLISH_MAX_BYTES / 1024 / 1024} MB decoded in total; bigger sites: fling_upload_begin / fling_upload_file / fling_upload_finish). ${INLINE_ONLY} ${ENCODING} Publishing replaces the whole site with exactly these files (it is not a patch: include unchanged files too); publishing identical content again is a no-op. ${NAME_REQUIRED} ${NAME_RULES} ${VISIBILITY} ${LIST_HTML} ${NEVER_PUBLISHED} The result includes \`warnings\`. Share the returned URL with the user; fling_files shows exactly which files the site has.`,
-    inputSchema: {
-      name: siteName,
-      files: z4.array(
-        z4.object({
-          path: sitePath,
-          content: z4.string().describe("The file content, encoded as `encoding` says"),
-          encoding
-        })
-      ).min(1).max(MAX_FILES).describe("Every file of the site"),
-      spa,
-      public: isPublic,
-      listHtml
-    },
-    annotations: { destructiveHint: false, idempotentHint: true, openWorldHint: true }
-  }),
-  uploadBegin: tool({
-    name: "fling_upload_begin",
-    title: "Start a chunked upload",
-    description: `Start publishing a site too big for one fling_publish call (over ${MCP_PUBLISH_MAX_BYTES / 1024 / 1024} MB, or large binary files). Returns an \`uploadId\`; then send each file with fling_upload_file and finish with fling_upload_finish within ${MCP_UPLOAD_TTL_SECONDS / 60} minutes. ${INLINE_ONLY} ${NAME_REQUIRED} ${VISIBILITY}`,
-    inputSchema: { name: siteName, spa, public: isPublic },
-    annotations: { destructiveHint: false, openWorldHint: false }
-  }),
-  uploadFile: tool({
-    name: "fling_upload_file",
-    title: "Upload a file (chunked)",
-    description: `Add one file to a chunked upload started with fling_upload_begin. Sending the same path again replaces it. A file larger than ${MCP_UPLOAD_CHUNK_MAX_CHARS / 1024 / 1024} MB of content can span calls: send the first part normally, then the following parts in order with \`append: true\` (same path and encoding; send appends one at a time, not in parallel). ${ENCODING} ${NEVER_PUBLISHED}`,
-    inputSchema: {
-      uploadId: z4.string().min(1).max(100).describe("From fling_upload_begin"),
-      path: sitePath,
-      content: z4.string().max(MCP_UPLOAD_CHUNK_MAX_CHARS).describe("The file content (or the next part of it, with `append`)"),
-      encoding,
-      append: z4.boolean().optional().describe("Append this content to the file sent earlier with the same path")
-    },
-    annotations: { destructiveHint: false, openWorldHint: false }
-  }),
-  uploadFinish: tool({
-    name: "fling_upload_finish",
-    title: "Finish a chunked upload",
-    description: `Publish everything sent with fling_upload_file as the new version of the site and return its URL. The site becomes exactly the uploaded files. ${LIST_HTML} The upload stays open, so just call fling_upload_finish again with \`listHtml\`. The result includes \`warnings\`.`,
-    inputSchema: {
-      uploadId: z4.string().min(1).max(100).describe("From fling_upload_begin"),
-      listHtml
-    },
-    annotations: { destructiveHint: false, openWorldHint: true }
-  }),
-  share: tool({
-    name: "fling_share",
-    title: "Share link",
-    description: "Get or create a public share link for a site: anyone with the link can view it without signing in (use it to show a private site to someone outside Nearform). `refresh` replaces the link (the old one stops working); `revoke` removes it.",
-    inputSchema: {
-      name: siteName,
-      refresh: z4.boolean().optional().describe("Rotate the link"),
-      revoke: z4.boolean().optional().describe("Remove the link")
-    },
-    annotations: { destructiveHint: false, openWorldHint: true }
-  }),
-  setVisibility: tool({
-    name: "fling_set_visibility",
-    title: "Set visibility",
-    description: "Make a site private (signed-in Nearformers only) or public (anyone).",
-    inputSchema: { name: siteName, visibility: z4.enum(["private", "public"]) },
-    annotations: { idempotentHint: true, openWorldHint: true }
-  }),
-  archive: tool({
-    name: "fling_archive",
-    title: "Archive or restore a site",
-    description: "Archive a site (it stops being served and is hidden from lists, but its name, files and versions are kept) or, with `unarchive`, bring it back. Prefer this over deleting.",
-    inputSchema: {
-      name: siteName,
-      unarchive: z4.boolean().optional().describe("Restore an archived site")
-    },
-    annotations: { idempotentHint: true, openWorldHint: false }
-  }),
-  delete: tool({
-    name: "fling_delete",
-    title: "Delete a site",
-    description: "Permanently delete a site and every version of it, freeing its name. Cannot be undone \u2014 confirm with the user first and pass `confirm: true`. Consider fling_archive instead.",
-    inputSchema: {
-      name: siteName,
-      confirm: z4.literal(true).describe("Must be true: the user has confirmed the deletion")
-    },
-    annotations: { destructiveHint: true, openWorldHint: false }
-  }),
-  rollback: tool({
-    name: "fling_rollback",
-    title: "Roll back",
-    description: "Point a site at an earlier version (ids from fling_info). Instant; nothing is uploaded.",
-    inputSchema: {
-      name: siteName,
-      versionId: z4.string().min(1).max(100).describe("Version id to serve")
-    },
-    annotations: { idempotentHint: true, openWorldHint: false }
-  })
-};
-var MCP_REMOTE_INSTRUCTIONS = [
-  "Fling publishes static sites (HTML/CSS/JS, images, documents) for Nearform staff at https://<name>.fling.labs.nearform.com.",
-  "To publish content you created in this conversation (an HTML page, a report, a small app): call fling_publish with every file inline (text as utf8, binary as base64). This server cannot read files in your sandbox and your sandbox cannot reach Fling, so never pass sandbox file paths and never curl or upload from the sandbox. Make the site self-contained: an index.html at the root, relative links between files.",
-  "Every site needs a name. If the user did not give one, propose a short descriptive name and confirm it before publishing (fling_check_name shows whether it is free). Names are global and first come, first served; when a name is taken, offer the returned suggestions.",
-  "Sites are private (Nearformers only) by default. Only make one public if asked; to show a private site to someone outside Nearform, create a share link with fling_share.",
-  "If a site has HTML pages but no root index.html, fling_publish / fling_upload_finish stop and ask: check with the user whether to generate an index.html listing the pages (`listHtml: true`) or publish without one (`listHtml: false`, the root URL will 404), then retry.",
-  NEVER_PUBLISHED,
-  `For sites over ${MCP_PUBLISH_MAX_BYTES / 1024 / 1024} MB use fling_upload_begin, fling_upload_file (repeat, \`append\` for big files) and fling_upload_finish.`,
-  "Always give the user the URL that comes back. Use fling_list / fling_info to find existing sites, fling_rollback to restore a version, fling_archive rather than fling_delete unless the user insists. Use fling_files to see exactly which files a site has (e.g. when the user reports a 404)."
-].join("\n\n");
+function mcpToolsFor(w) {
+  const NAME_RULES = `Site names are 1-${SITE_NAME_MAX} chars of lowercase letters, digits and single hyphens, and are one global namespace (first come, first served): the site is served at ${w.sitesPattern}.`;
+  const VISIBILITY = `Sites are private by default (only ${w.privateAudience} can open them); pass \`public: true\` only if the user asks for a public site. Share links (fling_share) are public to anyone who has them.`;
+  const isPublic = z6.boolean().optional().describe(
+    `true \u2192 anyone can view; false \u2192 only ${w.privateAudience}. Omit to keep the current setting (new sites are private)`
+  );
+  return {
+    whoami: tool({
+      name: "fling_whoami",
+      title: "Who am I",
+      description: `Show the signed-in user that ${w.name} acts as.`,
+      inputSchema: {},
+      annotations: { readOnlyHint: true, openWorldHint: false }
+    }),
+    list: tool({
+      name: "fling_list",
+      title: "List sites",
+      description: "List the user's Fling sites with URL, visibility and share link.",
+      inputSchema: {
+        archived: z6.boolean().optional().describe("List archived sites instead of live ones")
+      },
+      annotations: { readOnlyHint: true, openWorldHint: false }
+    }),
+    info: tool({
+      name: "fling_info",
+      title: "Site details",
+      description: "Show one site: URL, visibility, share link, current version and version history (ids for fling_rollback).",
+      inputSchema: { name: siteName },
+      annotations: { readOnlyHint: true, openWorldHint: false }
+    }),
+    files: tool({
+      name: "fling_files",
+      title: "List site files",
+      description: "List the files in a site's current version (or in `versionId`, from fling_info): path, size and content type, sorted by path. Use it to check what was actually published \u2014 e.g. when the user sees a 404, confirm the page exists at that path and that there is a root index.html (without one the site root 404s).",
+      inputSchema: {
+        name: siteName,
+        versionId: z6.string().min(1).max(100).optional().describe("Version id (from fling_info); omit for the version being served")
+      },
+      annotations: { readOnlyHint: true, openWorldHint: false }
+    }),
+    checkName: tool({
+      name: "fling_check_name",
+      title: "Check a site name",
+      description: "Check whether a site name can be used before publishing: `available` (a new site), `yours` (publishing updates the user's existing site), `taken` (someone else's \u2014 free `suggestions` are returned) or `invalid`. " + NAME_RULES,
+      inputSchema: { name: z6.string().min(1).max(200).describe("Site name to check") },
+      annotations: { readOnlyHint: true, openWorldHint: false }
+    }),
+    publish: tool({
+      name: "fling_publish",
+      title: "Publish a site",
+      description: `Publish a static site to Fling in one call and get back its URL. Pass every file of the site inline in \`files\` (whole site, up to ${MCP_PUBLISH_MAX_BYTES / 1024 / 1024} MB decoded in total; bigger sites: fling_upload_begin / fling_upload_file / fling_upload_finish). ${INLINE_ONLY} ${ENCODING} Publishing replaces the whole site with exactly these files (it is not a patch: include unchanged files too); publishing identical content again is a no-op. ${NAME_REQUIRED} ${NAME_RULES} ${VISIBILITY} ${LIST_HTML} ${NEVER_PUBLISHED} The result includes \`warnings\`. Share the returned URL with the user; fling_files shows exactly which files the site has.`,
+      inputSchema: {
+        name: siteName,
+        files: z6.array(
+          z6.object({
+            path: sitePath,
+            content: z6.string().describe("The file content, encoded as `encoding` says"),
+            encoding
+          })
+        ).min(1).max(MAX_FILES).describe("Every file of the site"),
+        spa,
+        public: isPublic,
+        listHtml
+      },
+      annotations: { destructiveHint: false, idempotentHint: true, openWorldHint: true }
+    }),
+    uploadBegin: tool({
+      name: "fling_upload_begin",
+      title: "Start a chunked upload",
+      description: `Start publishing a site too big for one fling_publish call (over ${MCP_PUBLISH_MAX_BYTES / 1024 / 1024} MB, or large binary files). Returns an \`uploadId\`; then send each file with fling_upload_file and finish with fling_upload_finish within ${MCP_UPLOAD_TTL_SECONDS / 60} minutes. ${INLINE_ONLY} ${NAME_REQUIRED} ${VISIBILITY}`,
+      inputSchema: { name: siteName, spa, public: isPublic },
+      annotations: { destructiveHint: false, openWorldHint: false }
+    }),
+    uploadFile: tool({
+      name: "fling_upload_file",
+      title: "Upload a file (chunked)",
+      description: `Add one file to a chunked upload started with fling_upload_begin. Sending the same path again replaces it. A file larger than ${MCP_UPLOAD_CHUNK_MAX_CHARS / 1024 / 1024} MB of content can span calls: send the first part normally, then the following parts in order with \`append: true\` (same path and encoding; send appends one at a time, not in parallel). ${ENCODING} ${NEVER_PUBLISHED}`,
+      inputSchema: {
+        uploadId: z6.string().min(1).max(100).describe("From fling_upload_begin"),
+        path: sitePath,
+        content: z6.string().max(MCP_UPLOAD_CHUNK_MAX_CHARS).describe("The file content (or the next part of it, with `append`)"),
+        encoding,
+        append: z6.boolean().optional().describe("Append this content to the file sent earlier with the same path")
+      },
+      annotations: { destructiveHint: false, openWorldHint: false }
+    }),
+    uploadFinish: tool({
+      name: "fling_upload_finish",
+      title: "Finish a chunked upload",
+      description: `Publish everything sent with fling_upload_file as the new version of the site and return its URL. The site becomes exactly the uploaded files. ${LIST_HTML} The upload stays open, so just call fling_upload_finish again with \`listHtml\`. The result includes \`warnings\`.`,
+      inputSchema: {
+        uploadId: z6.string().min(1).max(100).describe("From fling_upload_begin"),
+        listHtml
+      },
+      annotations: { destructiveHint: false, openWorldHint: true }
+    }),
+    share: tool({
+      name: "fling_share",
+      title: "Share link",
+      description: "Get or create a public share link for a site: anyone with the link can view it without signing in (use it to show a private site to someone who cannot sign in). `refresh` replaces the link (the old one stops working); `revoke` removes it.",
+      inputSchema: {
+        name: siteName,
+        refresh: z6.boolean().optional().describe("Rotate the link"),
+        revoke: z6.boolean().optional().describe("Remove the link")
+      },
+      annotations: { destructiveHint: false, openWorldHint: true }
+    }),
+    setVisibility: tool({
+      name: "fling_set_visibility",
+      title: "Set visibility",
+      description: `Make a site private (only ${w.privateAudience}) or public (anyone).`,
+      inputSchema: { name: siteName, visibility: z6.enum(["private", "public"]) },
+      annotations: { idempotentHint: true, openWorldHint: true }
+    }),
+    archive: tool({
+      name: "fling_archive",
+      title: "Archive or restore a site",
+      description: "Archive a site (it stops being served and is hidden from lists, but its name, files and versions are kept) or, with `unarchive`, bring it back. Prefer this over deleting.",
+      inputSchema: {
+        name: siteName,
+        unarchive: z6.boolean().optional().describe("Restore an archived site")
+      },
+      annotations: { idempotentHint: true, openWorldHint: false }
+    }),
+    delete: tool({
+      name: "fling_delete",
+      title: "Delete a site",
+      description: "Permanently delete a site and every version of it, freeing its name. Cannot be undone \u2014 confirm with the user first and pass `confirm: true`. Consider fling_archive instead.",
+      inputSchema: {
+        name: siteName,
+        confirm: z6.literal(true).describe("Must be true: the user has confirmed the deletion")
+      },
+      annotations: { destructiveHint: true, openWorldHint: false }
+    }),
+    commentsList: tool({
+      name: "fling_comments_list",
+      title: "List comments",
+      description: `List the comments people left on a site while reviewing it (${w.reviewPattern}), as threads: each has the page path it is about, the version the site was serving when it was written, its replies, and whether it is resolved. Anyone signed in to ${w.name} can comment on a site they can open. Resolved threads are left out unless \`includeResolved\`. Use it to act on feedback: fix the site, republish, then resolve the threads with fling_comment_resolve.`,
+      inputSchema: {
+        name: siteName,
+        path: commentPath.optional().describe('Only this page, e.g. "/" or "/docs/"'),
+        includeResolved: z6.boolean().optional().describe("Include resolved threads")
+      },
+      annotations: { readOnlyHint: true, openWorldHint: false }
+    }),
+    commentAdd: tool({
+      name: "fling_comment_add",
+      title: "Add a comment",
+      description: `Comment on a page of a site (shown on its review page, ${w.reviewPattern}), or reply to a thread (\`replyTo\`: a thread id from fling_comments_list). Comments are signed with the user's name, so only write one the user asked for.`,
+      inputSchema: {
+        name: siteName,
+        body: z6.string().min(1).max(COMMENT_MAX_CHARS).describe("The comment (plain text)"),
+        path: commentPath.optional().describe('The page it is about (default "/"); ignored for a reply'),
+        replyTo: commentId.optional().describe("Reply to this thread instead of starting one")
+      },
+      annotations: { destructiveHint: false, openWorldHint: true }
+    }),
+    commentResolve: tool({
+      name: "fling_comment_resolve",
+      title: "Resolve a comment thread",
+      description: "Mark a comment thread resolved (e.g. after fixing what it asks for), or reopen it with `reopen: true`. Thread ids come from fling_comments_list.",
+      inputSchema: {
+        name: siteName,
+        id: commentId.describe("The thread id"),
+        reopen: z6.boolean().optional().describe("Reopen a resolved thread")
+      },
+      annotations: { idempotentHint: true, openWorldHint: false }
+    }),
+    commentDelete: tool({
+      name: "fling_comment_delete",
+      title: "Delete a comment",
+      description: "Delete a comment; deleting a thread deletes its replies. People can delete their own comments, and a site's owner anyone's. Cannot be undone: prefer fling_comment_resolve, and confirm with the user first.",
+      inputSchema: { name: siteName, id: commentId.describe("The comment id") },
+      annotations: { destructiveHint: true, openWorldHint: false }
+    }),
+    rollback: tool({
+      name: "fling_rollback",
+      title: "Roll back",
+      description: "Point a site at an earlier version (ids from fling_info). Instant; nothing is uploaded.",
+      inputSchema: {
+        name: siteName,
+        versionId: z6.string().min(1).max(100).describe("Version id to serve")
+      },
+      annotations: { idempotentHint: true, openWorldHint: false }
+    })
+  };
+}
+var mcpTools = mcpToolsFor(mcpWording());
+var COMMENTS_NOTE = (w) => `People review sites at ${w.reviewPattern} and leave comments on its pages. Publishing returns this review link (\`reviewUrl\`): it is the one to share when the user wants feedback; reviewers sign in to use it. fling_comments_list shows the comments; after acting on feedback, resolve the threads with fling_comment_resolve. Only post (fling_comment_add) or delete (fling_comment_delete) comments when the user asks.`;
+var shareForFeedback = (reviewPage2, instanceName) => `Share for feedback: ${reviewPage2} (reviewers sign in to ${instanceName} to see the site and comment).`;
 var MCP_FILES_LISTED = 200;
 function describeVersionFiles(name, files, opts) {
   const kb = (n2) => n2 < 1024 ? `${n2} B` : n2 < 1024 * 1024 ? `${(n2 / 1024).toFixed(1)} KB` : `${(n2 / 1024 / 1024).toFixed(1)} MB`;
@@ -650,12 +894,30 @@ function describeVersionFiles(name, files, opts) {
   if (n > MCP_FILES_LISTED) lines.push(`\u2026 and ${n - MCP_FILES_LISTED} more`);
   return lines.join("\n");
 }
+function describeComments(list, opts = {}) {
+  const all = commentThreads(list.comments);
+  const threads = opts.includeResolved ? all : all.filter((t) => t.comment.resolvedAt === null);
+  const hidden = all.length - threads.length;
+  const name = list.site.name;
+  const version = (id) => id === null ? "" : id === list.site.currentVersionId ? ", current version" : `, version ${id}`;
+  const head = `${threads.length} ${opts.includeResolved ? "" : "open "}thread${threads.length === 1 ? "" : "s"} on ${name}` + (hidden ? ` (${hidden} resolved not shown)` : "") + (opts.reviewUrl ? `. Review page: ${opts.reviewUrl}` : "");
+  const blocks = threads.map(
+    ({ comment: c, replies }) => [
+      `- [${c.id}] ${c.resolvedAt ? "RESOLVED " : ""}${c.path}${version(c.versionId)} \u2014 ${authorLabel(c.author)}, ${c.createdAt}:`,
+      `  ${c.body.replace(/\n/g, "\n  ")}`,
+      ...replies.map(
+        (r) => `  - [${r.id}] ${authorLabel(r.author)}, ${r.createdAt}: ${r.body.replace(/\n/g, "\n    ")}`
+      )
+    ].join("\n")
+  );
+  return [head, ...blocks].join("\n");
+}
 
 // ../../packages/shared/src/ready.ts
 var READY_TIMEOUT_MS = 15e3;
 var NOT_READY_NOTE = "it can take a few more seconds to appear everywhere; reload if you see a 404";
 var isReachableStatus = (status) => status >= 200 && status < 400 || status === 401 || status === 403;
-var defaultSleep = (ms) => new Promise((resolve3) => setTimeout(resolve3, ms));
+var defaultSleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
 async function waitUntilReachable(url, opts = {}) {
   const timeoutMs = opts.timeoutMs ?? READY_TIMEOUT_MS;
   const doFetch = opts.fetch ?? ((u, init) => fetch(u, init));
@@ -698,6 +960,95 @@ function readinessWaitDisabled(env) {
   return env.FLING_NO_WAIT === "1" || env.VITEST === "true" || env.NODE_ENV === "test";
 }
 
+// ../../packages/shared/src/review-bridge.ts
+import { z as z7 } from "zod";
+var tag = { fling: z7.literal("review") };
+var path = z7.string().max(COMMENT_PATH_MAX);
+var hash = z7.string().max(COMMENT_PATH_MAX);
+var BridgePinSchema = z7.object({
+  id: z7.string(),
+  n: z7.number().int().min(1),
+  anchor: CommentAnchorSchema,
+  selected: z7.boolean(),
+  resolved: z7.boolean()
+});
+var BridgeCursorSchema = z7.object({
+  id: z7.string(),
+  name: z7.string().max(100),
+  colour: z7.string().max(32),
+  anchor: CommentAnchorSchema
+});
+var ShellMessageSchema = z7.discriminatedUnion("type", [
+  z7.object({ ...tag, type: z7.literal("ready") }),
+  /** the frame is on `path` (normalised, see normalizeCommentPath) with fragment `hash` ('' or '#…') */
+  z7.object({ ...tag, type: z7.literal("location"), path, hash, title: z7.string().max(300) }),
+  z7.object({ ...tag, type: z7.literal("pinPlaced"), anchor: CommentAnchorSchema }),
+  z7.object({ ...tag, type: z7.literal("pinCancelled") }),
+  z7.object({ ...tag, type: z7.literal("pinClicked"), id: z7.string() }),
+  /** this reviewer's pointer on the page; null when it left the frame */
+  z7.object({ ...tag, type: z7.literal("cursor"), anchor: CommentAnchorSchema.nullable() }),
+  /** a link or form to another origin, stopped: the frame stays on the site */
+  z7.object({ ...tag, type: z7.literal("blocked"), href: z7.string().max(2048) }),
+  z7.object({ ...tag, type: z7.literal("escape") })
+]);
+var PageMessageSchema = z7.discriminatedUnion("type", [
+  /** load `path` (site-relative, may carry `?query` and `#hash`) in the frame */
+  z7.object({ ...tag, type: z7.literal("navigate"), path: z7.string().max(COMMENT_PATH_MAX * 2) }),
+  z7.object({ ...tag, type: z7.literal("reload") }),
+  z7.object({ ...tag, type: z7.literal("placing"), on: z7.boolean() }),
+  /** the pins on the frame's current page */
+  z7.object({ ...tag, type: z7.literal("pins"), pins: z7.array(BridgePinSchema) }),
+  /** scroll the pin into view and draw attention to it */
+  z7.object({ ...tag, type: z7.literal("focusPin"), id: z7.string() }),
+  z7.object({ ...tag, type: z7.literal("cursors"), cursors: z7.array(BridgeCursorSchema) })
+]);
+
+// ../../packages/shared/src/review-live.ts
+import { z as z8 } from "zod";
+var LIVE_PICTURE_MAX = 1024;
+var LivePeerSchema = z8.object({
+  id: z8.string(),
+  name: z8.string().max(100),
+  colour: z8.string().max(32),
+  /** their profile picture (https), when sign-in gave one; else clients show initials */
+  picture: z8.string().max(LIVE_PICTURE_MAX).optional()
+});
+var LiveTicketSchema = z8.object({
+  url: z8.string(),
+  ticket: z8.string(),
+  /** seconds the ticket is good for: connect before then */
+  expiresIn: z8.number().int()
+});
+var path2 = z8.string().max(COMMENT_PATH_MAX);
+var hash2 = z8.string().max(COMMENT_PATH_MAX);
+var LiveClientMessageSchema = z8.discriminatedUnion("type", [
+  z8.object({ type: z8.literal("hello") }),
+  /** where this peer's pointer is; `anchor` null when it left the page */
+  z8.object({
+    type: z8.literal("cursor"),
+    path: path2,
+    hash: hash2,
+    anchor: CommentAnchorSchema.nullable()
+  }),
+  z8.object({ type: z8.literal("ping") })
+]);
+var LiveServerMessageSchema = z8.discriminatedUnion("type", [
+  /** the answer to `hello`: who this connection is, and who else is in the room */
+  z8.object({ type: z8.literal("welcome"), you: LivePeerSchema, peers: z8.array(LivePeerSchema) }),
+  z8.object({ type: z8.literal("join"), peer: LivePeerSchema }),
+  z8.object({ type: z8.literal("leave"), peerId: z8.string() }),
+  z8.object({
+    type: z8.literal("cursor"),
+    peerId: z8.string(),
+    path: path2,
+    hash: hash2,
+    anchor: CommentAnchorSchema.nullable()
+  }),
+  /** the site's comments changed: refetch them */
+  z8.object({ type: z8.literal("comments") }),
+  z8.object({ type: z8.literal("pong") })
+]);
+
 // src/errors.ts
 var EXIT_ERROR = 1;
 var EXIT_NOT_LOGGED_IN = 2;
@@ -722,6 +1073,14 @@ var NotLoggedInError = class extends CliError {
     this.name = "NotLoggedInError";
   }
 };
+var NoServerError = class extends CliError {
+  constructor(binName) {
+    super(`No Fling server set \u2014 run \`${binName} login <url>\` with your Fling's address`, {
+      exitCode: EXIT_NOT_LOGGED_IN
+    });
+    this.name = "NoServerError";
+  }
+};
 function exitCodeFor(error) {
   return error instanceof CliError ? error.exitCode : EXIT_ERROR;
 }
@@ -729,9 +1088,9 @@ function exitCodeFor(error) {
 // package.json
 var package_default = {
   name: "@nearform/fling",
-  version: "0.1.2",
+  version: "0.3.0",
   license: "MIT",
-  description: "Fling a folder of static files at fling.labs.nearform.com and get a link back. CLI + MCP server.",
+  description: "Fling a folder of static files at a Fling server and get a link back. CLI + MCP server.",
   type: "module",
   bin: {
     fling: "./dist/cli.js"
@@ -739,7 +1098,8 @@ var package_default = {
   files: [
     "dist/cli.js",
     "dist/cli.js.map",
-    "README.md"
+    "README.md",
+    "CHANGELOG.md"
   ],
   engines: {
     node: ">=22"
@@ -760,6 +1120,7 @@ var package_default = {
     test: "vitest run"
   },
   dependencies: {
+    "@clack/prompts": "^1.8.1",
     "@modelcontextprotocol/sdk": "^1.20.0",
     chalk: "^5.6.2",
     commander: "^15.0.0",
@@ -812,8 +1173,8 @@ function defaultHint(status) {
   if (status === 403) return "You are not allowed to do that.";
   return void 0;
 }
-function buildUrl(serverUrl, path, query) {
-  const url = new URL(`${serverUrl.replace(/\/+$/, "")}${path.startsWith("/") ? path : `/${path}`}`);
+function buildUrl(serverUrl, path3, query) {
+  const url = new URL(`${serverUrl.replace(/\/+$/, "")}${path3.startsWith("/") ? path3 : `/${path3}`}`);
   for (const [key, value] of Object.entries(query ?? {})) {
     if (value !== void 0 && value !== null) url.searchParams.set(key, String(value));
   }
@@ -823,8 +1184,8 @@ function createApiClient(options) {
   const serverUrl = options.serverUrl.replace(/\/+$/, "");
   const fetchImpl = options.fetch ?? ((input, init) => fetch(input, init));
   const timeoutMs = options.timeoutMs ?? 6e4;
-  async function request(method, path, reqOptions = {}) {
-    const url = buildUrl(serverUrl, path, reqOptions.query);
+  async function request(method, path3, reqOptions = {}) {
+    const url = buildUrl(serverUrl, path3, reqOptions.query);
     const headers = {
       Accept: "application/json",
       "User-Agent": `${BIN_NAME}-cli/${VERSION}`
@@ -849,7 +1210,7 @@ function createApiClient(options) {
       });
     }
     const raw = await readBody(response);
-    if (!response.ok) throw errorFromResponse(response.status, raw, method, path);
+    if (!response.ok) throw errorFromResponse(response.status, raw, method, path3);
     if (!reqOptions.schema) return raw;
     const parsed = reqOptions.schema.safeParse(raw);
     if (!parsed.success) {
@@ -859,8 +1220,8 @@ function createApiClient(options) {
         status: response.status,
         code: "invalid_response",
         body: raw,
-        message: `Unexpected response from ${method} ${path}${where}: ${issue?.message ?? "invalid"}`,
-        hint: `Your ${BIN_NAME} CLI may be out of date \u2014 try \`npm i -g @nearform/fling@latest\`.`
+        message: `Unexpected response from ${method} ${path3}${where}: ${issue?.message ?? "invalid"}`,
+        hint: `Your ${BIN_NAME} CLI may be out of date \u2014 try \`npm i -g ${PACKAGE_NAME}@latest\`.`
       });
     }
     return parsed.data;
@@ -893,15 +1254,15 @@ async function putUpload(fetchImpl, url, headers, body, timeoutMs = 5 * 6e4) {
 }
 async function readBody(response) {
   if (response.status === 204) return void 0;
-  const text = await response.text();
-  if (text === "") return void 0;
+  const text2 = await response.text();
+  if (text2 === "") return void 0;
   try {
-    return JSON.parse(text);
+    return JSON.parse(text2);
   } catch {
-    return text;
+    return text2;
   }
 }
-function errorFromResponse(status, body, method, path) {
+function errorFromResponse(status, body, method, path3) {
   const envelope = ErrorEnvelopeSchema.safeParse(body);
   if (envelope.success) {
     const { code } = envelope.data.error;
@@ -917,12 +1278,12 @@ function errorFromResponse(status, body, method, path) {
     if (Array.isArray(extra?.paths)) Object.assign(error, { paths: extra.paths });
     return error;
   }
-  return new CliApiError({ status, body, message: `${method} ${path} failed with HTTP ${status}` });
+  return new CliApiError({ status, body, message: `${method} ${path3} failed with HTTP ${status}` });
 }
 var NEVER_PUBLISHED_HINTS = {
   secret_detected: "Remove the secret from the file (and rotate it if it was ever shared), or add the file to .flingignore if the site does not need it.",
   secret_file: "Move the secret files out of the folder, or add them to .flingignore if the site does not need them.",
-  dotfile: `Dotfiles are never flung. Update the CLI (\`npm i -g @nearform/fling@latest\`), which skips them.`
+  dotfile: `Dotfiles are never flung. Update the CLI (\`npm i -g ${PACKAGE_NAME}@latest\`), which skips them.`
 };
 function describeCause(cause) {
   if (cause instanceof Error) {
@@ -938,10 +1299,9 @@ function describeCause(cause) {
 import { chmod, mkdir, readFile, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { z as z5 } from "zod";
+import { z as z9 } from "zod";
 var CONFIG_DIR_NAME = ".fling";
 var CONFIG_FILE_NAME = "config.json";
-var DEFAULT_SERVER_URL = "https://fling.labs.nearform.com";
 var ENV = {
   apiKey: "FLING_API_KEY",
   url: "FLING_URL",
@@ -950,13 +1310,15 @@ var ENV = {
   /** Where to look for files given by name (the .mcpb extension sets it from its settings). */
   downloadsDir: "FLING_DOWNLOADS_DIR"
 };
-var cliConfigSchema = z5.object({
-  serverUrl: z5.string().url().optional(),
-  apiKey: z5.string().min(1).optional(),
-  user: z5.object({
-    email: z5.string().optional(),
-    name: z5.string().optional(),
-    userSlug: z5.string().optional()
+var cliConfigSchema = z9.object({
+  serverUrl: z9.string().url().optional(),
+  /** What `serverUrl` said about itself at login. A copy a newer CLI can't read is just refetched. */
+  instance: InstanceMetadataSchema.optional().catch(void 0),
+  apiKey: z9.string().min(1).optional(),
+  user: z9.object({
+    email: z9.string().optional(),
+    name: z9.string().optional(),
+    userSlug: z9.string().optional()
   }).optional()
 });
 function systemLocateOptions(env = process.env) {
@@ -1012,18 +1374,21 @@ function createConfigStore(options = {}) {
       return next;
     },
     async clearCredentials() {
-      const { serverUrl } = await load();
-      await save(serverUrl ? { serverUrl } : {});
+      const { serverUrl, instance } = await load();
+      await save({ serverUrl, instance });
     },
     async resolve(overrides = {}) {
       const config = await load();
       const envUrl = fromEnv(env[ENV.url]);
       const envKey = fromEnv(env[ENV.apiKey]);
-      const [serverUrl, serverUrlSource] = overrides.serverUrl ? [overrides.serverUrl, "flag"] : envUrl ? [envUrl, "env"] : config.serverUrl ? [config.serverUrl, "config"] : [DEFAULT_SERVER_URL, "default"];
+      const [rawUrl, serverUrlSource] = overrides.serverUrl ? [overrides.serverUrl, "flag"] : envUrl ? [envUrl, "env"] : config.serverUrl ? [config.serverUrl, "config"] : [void 0, "none"];
+      const serverUrl = rawUrl === void 0 ? void 0 : normalizeServerUrl(rawUrl);
       const [apiKey, apiKeySource] = envKey ? [envKey, "env"] : config.apiKey ? [config.apiKey, "config"] : [void 0, "none"];
+      const stored = config.serverUrl && normalizeServerUrl(config.serverUrl);
       return {
-        serverUrl: serverUrl.replace(/\/+$/, ""),
+        serverUrl,
         serverUrlSource,
+        instance: serverUrl && stored === serverUrl ? config.instance : void 0,
         apiKey,
         apiKeySource,
         user: config.user,
@@ -1032,12 +1397,53 @@ function createConfigStore(options = {}) {
     }
   };
 }
+function normalizeServerUrl(input) {
+  const trimmed = input.trim();
+  const withScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`;
+  const url = new URL(withScheme);
+  if (url.protocol !== "https:" && url.protocol !== "http:") {
+    throw new Error(`Not an http(s) URL: ${input}`);
+  }
+  return `${url.origin}${url.pathname}`.replace(/\/+$/, "");
+}
 var REDACTED_KEY_CHARS = 10;
 function redactKey(key) {
   if (!key) return "-";
   return key.length <= REDACTED_KEY_CHARS + 8 ? "****" : `${key.slice(0, REDACTED_KEY_CHARS)}\u2026`;
 }
 
+// src/instance.ts
+async function fetchInstance(serverUrl, fetch2) {
+  const url = instanceMetadataUrl(serverUrl);
+  let response;
+  try {
+    response = await fetch2(url, { headers: { Accept: "application/json" } });
+  } catch (cause) {
+    throw new CliError(`Could not reach ${serverUrl} (${cause.message ?? cause})`, {
+      hint: "Check the address and your connection.",
+      cause
+    });
+  }
+  const notFling = () => new CliError(`${serverUrl} does not look like a Fling server (no valid ${url})`, {
+    hint: "Use the address of your Fling, e.g. https://fling.example.com."
+  });
+  if (!response.ok) throw notFling();
+  const parsed = InstanceMetadataSchema.safeParse(await response.json().catch(() => null));
+  if (!parsed.success) throw notFling();
+  return parsed.data;
+}
+async function loadInstance(store, config, fetch2) {
+  if (config.instance) return config.instance;
+  if (!config.serverUrl) return null;
+  try {
+    const instance = await fetchInstance(config.serverUrl, fetch2);
+    if (config.serverUrlSource === "config") await store.update({ instance });
+    return instance;
+  } catch {
+    return null;
+  }
+}
+
 // src/auth.ts
 var CALLBACK_PORT_START = 8765;
 var CALLBACK_PORT_END = 8770;
@@ -1046,12 +1452,13 @@ var CALLBACK_PATH = "/callback";
 var AUTH_CLI_PATH = "/auth/cli";
 async function loginFlow(options) {
   const { serverUrl, store, log } = options;
+  const instance = await fetchInstance(serverUrl, options.fetch ?? fetch);
   const state = randomBytes(16).toString("hex");
   const callback = await startCallbackServer({ state, timeoutMs: options.timeoutMs });
   try {
     const authUrl = buildAuthUrl(serverUrl, callback.url, options.hostname ?? osHostname(), state);
     options.onAuthUrl?.(authUrl);
-    log.info(`Opening your browser to sign in at ${serverUrl}`);
+    log.info(`Opening your browser to sign in to ${instance.name} at ${serverUrl}`);
     log.hint(`If it does not open, visit: ${authUrl}`);
     try {
       await options.open(authUrl);
@@ -1064,6 +1471,7 @@ async function loginFlow(options) {
     const user = await client.request("GET", "/api/me", { schema: MeSchema });
     await store.update({
       serverUrl,
+      instance,
       apiKey: key,
       user: { email: user.email, name: user.name, userSlug: user.userSlug }
     });
@@ -1071,7 +1479,7 @@ async function loginFlow(options) {
     log.success(`Signed in as ${user.email}`);
     log.hint(`Server: ${serverUrl}`);
     log.hint(`API key: ${keyPrefix} (stored in ${store.file})`);
-    return { serverUrl, keyPrefix, user };
+    return { serverUrl, keyPrefix, user, instance };
   } finally {
     callback.close();
   }
@@ -1101,8 +1509,8 @@ async function startCallbackServer(options = {}) {
   const timeoutMs = options.timeoutMs ?? LOGIN_TIMEOUT_MS;
   let settle;
   let timer;
-  const result = new Promise((resolve3, reject) => {
-    settle = { resolve: resolve3, reject };
+  const result = new Promise((resolve5, reject) => {
+    settle = { resolve: resolve5, reject };
   }).finally(() => clearTimeout(timer));
   result.catch(() => {
   });
@@ -1163,7 +1571,7 @@ ${close ? "<script>setTimeout(function(){window.close()},800)</script>" : ""}
   res.end(html);
 }
 function listenOnFreePort(server) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve5, reject) => {
     let port = CALLBACK_PORT_START;
     const tryNext = () => {
       if (port > CALLBACK_PORT_END) {
@@ -1185,18 +1593,18 @@ function listenOnFreePort(server) {
       });
       server.listen(port, "127.0.0.1", () => {
         server.removeAllListeners("error");
-        resolve3(port);
+        resolve5(port);
       });
     };
     tryNext();
   });
 }
-function escapeHtml2(text) {
-  return text.replace(/[&<>"']/g, (ch) => `&#${ch.charCodeAt(0)};`);
+function escapeHtml2(text2) {
+  return text2.replace(/[&<>"']/g, (ch) => `&#${ch.charCodeAt(0)};`);
 }
 
 // src/context.ts
-import { createInterface } from "node:readline/promises";
+import { confirm, isCancel, text } from "@clack/prompts";
 
 // src/ready.ts
 import chalk from "chalk";
@@ -1232,20 +1640,83 @@ async function waitWithSpinner(waiter, url, paths, io) {
 }
 
 // src/utils/logger.ts
+import chalk3 from "chalk";
+
+// src/ui/theme.ts
 import chalk2 from "chalk";
-var PREFIX = chalk2.cyan("fling");
+var STOPS = [
+  [0, 229, 255],
+  [124, 77, 255],
+  [255, 78, 205]
+];
+var WORDMARK = [
+  "\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2557     \u2588\u2588\u2557\u2588\u2588\u2588\u2557   \u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557 ",
+  "\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2551     \u2588\u2588\u2551\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D ",
+  "\u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2551     \u2588\u2588\u2551\u2588\u2588\u2554\u2588\u2588\u2557 \u2588\u2588\u2551\u2588\u2588\u2551  \u2588\u2588\u2588\u2557",
+  "\u2588\u2588\u2554\u2550\u2550\u255D  \u2588\u2588\u2551     \u2588\u2588\u2551\u2588\u2588\u2551\u255A\u2588\u2588\u2557\u2588\u2588\u2551\u2588\u2588\u2551   \u2588\u2588\u2551",
+  "\u2588\u2588\u2551     \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2551\u2588\u2588\u2551 \u255A\u2588\u2588\u2588\u2588\u2551\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D",
+  "\u255A\u2550\u255D     \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D\u255A\u2550\u255D\u255A\u2550\u255D  \u255A\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D "
+];
+var TRAILS = ["      ", "  \u2501\u2501\u2501 ", " \u2501\u2501\u2501\u2501 ", "   \u2501\u2501 ", "      ", "      "];
+var LOGO_WIDTH = TRAILS[0].length + WORDMARK[0].length;
+var brand = {
+  primary: chalk2.hex("#7C4DFF"),
+  accent: chalk2.hex("#00E5FF"),
+  url: (url) => chalk2.bold.hex("#00E5FF")(url)
+};
+var symbols = {
+  info: chalk2.hex("#7C4DFF")("\u25C6"),
+  success: chalk2.green("\u2714"),
+  warn: chalk2.yellow("\u25B2"),
+  error: chalk2.red("\u2716"),
+  step: chalk2.dim("\u2502")
+};
+function colourAt(t) {
+  const scaled = Math.min(Math.max(t, 0), 1) * (STOPS.length - 1);
+  const i = Math.min(Math.floor(scaled), STOPS.length - 2);
+  const f = scaled - i;
+  const a = STOPS[i];
+  const b = STOPS[i + 1];
+  return [0, 1, 2].map((k) => Math.round(a[k] + (b[k] - a[k]) * f));
+}
+function gradient(text2, width = text2.length, offset = 0) {
+  if (chalk2.level === 0) return text2;
+  return [...text2].map((ch, i) => ch === " " ? ch : chalk2.rgb(...colourAt((offset + i) / (width - 1)))(ch)).join("");
+}
+function logo(options = {}) {
+  const columns = options.columns || process.stderr.columns || 80;
+  const tagline = options.tagline ?? "throw static files at the web, get a link back";
+  if (columns < LOGO_WIDTH + 2) return `${gradient("\u25B6\u25B6 fling")}  ${chalk2.dim(tagline)}`;
+  const lines = WORDMARK.map(
+    (row, i) => chalk2.dim(TRAILS[i] ?? "") + gradient(row, WORDMARK[0].length)
+  );
+  return ["", ...lines, `${" ".repeat(TRAILS[0].length)}${chalk2.dim(tagline)}`, ""].join("\n");
+}
+var ANSI = /\x1b\[[0-9;]*m/g;
+var visibleLength = (s) => s.replace(ANSI, "").length;
+function box(lines, title) {
+  const width = Math.max(...lines.map(visibleLength), title ? visibleLength(title) + 2 : 0);
+  const border = chalk2.dim;
+  const top = title ? `${border("\u256D\u2500")} ${title} ${border(`${"\u2500".repeat(width - visibleLength(title) - 1)}\u256E`)}` : border(`\u256D${"\u2500".repeat(width + 2)}\u256E`);
+  const body = lines.map(
+    (line) => `${border("\u2502")} ${line}${" ".repeat(width - visibleLength(line))} ${border("\u2502")}`
+  );
+  return [top, ...body, border(`\u2570${"\u2500".repeat(width + 2)}\u256F`)].join("\n");
+}
+
+// src/utils/logger.ts
 function createLogger(options = {}) {
   const write = options.write ?? ((line) => process.stderr.write(`${line}
 `));
   const debugEnabled = options.debug ?? false;
   return {
-    info: (message) => write(`${PREFIX} ${message}`),
-    success: (message) => write(`${PREFIX} ${chalk2.green("\u2713")} ${message}`),
-    warn: (message) => write(`${PREFIX} ${chalk2.yellow("!")} ${message}`),
-    error: (message) => write(`${PREFIX} ${chalk2.red("\u2717")} ${message}`),
-    hint: (message) => write(chalk2.dim(`  ${message}`)),
+    info: (message) => write(`${symbols.info} ${message}`),
+    success: (message) => write(`${symbols.success} ${message}`),
+    warn: (message) => write(`${symbols.warn} ${chalk3.yellow(message)}`),
+    error: (message) => write(`${symbols.error} ${chalk3.red(message)}`),
+    hint: (message) => write(chalk3.dim(`  ${message}`)),
     debug: (message) => {
-      if (debugEnabled) write(chalk2.dim(`[debug] ${message}`));
+      if (debugEnabled) write(chalk3.dim(`[debug] ${message}`));
     }
   };
 }
@@ -1265,12 +1736,13 @@ var silentLogger = {
 };
 
 // src/utils/output.ts
-import chalk3 from "chalk";
+import chalk4 from "chalk";
 function createOutput(options = {}) {
   const json = options.json ?? false;
   const write = options.write ?? ((chunk) => process.stdout.write(chunk));
   return {
     json,
+    tty: options.tty ?? (options.write ? false : Boolean(process.stdout.isTTY)),
     data: (raw, human) => write(`${json ? formatJson(raw) : human()}
 `),
     text: (line) => {
@@ -1283,15 +1755,15 @@ function formatJson(value) {
   return JSON.stringify(value, null, 2);
 }
 function renderTable(rows, columns) {
-  if (rows.length === 0) return chalk3.dim("(no results)");
+  if (rows.length === 0) return chalk4.dim("(no results)");
   const cells = rows.map((row) => columns.map((column) => formatCell(column.value(row))));
   const widths = columns.map(
     (column, i) => Math.max(column.header.length, ...cells.map((line) => line[i]?.length ?? 0))
   );
-  const pad = (text, i) => i === columns.length - 1 ? text : text.padEnd(widths[i] ?? 0);
+  const pad = (text2, i) => i === columns.length - 1 ? text2 : text2.padEnd(widths[i] ?? 0);
   const header = columns.map((column, i) => pad(column.header, i)).join("  ");
   const body = cells.map((line) => line.map(pad).join("  "));
-  return [chalk3.bold(header), ...body].join("\n");
+  return [chalk4.bold(header), ...body].join("\n");
 }
 function formatCell(value) {
   if (value === null || value === void 0 || value === "") return "-";
@@ -1341,32 +1813,35 @@ async function createContext(options = {}) {
   };
 }
 async function ttyConfirm(question) {
-  const answer = await ttyPrompt(`${question} [y/N] `);
-  return /^y(es)?$/i.test(answer.trim());
+  const answer = await confirm({ message: question, initialValue: false, output: process.stderr });
+  if (isCancel(answer)) throw new CliError("Cancelled");
+  return answer;
 }
 async function ttyPrompt(question) {
-  const rl = createInterface({ input: process.stdin, output: process.stderr });
-  try {
-    return await rl.question(question);
-  } finally {
-    rl.close();
-  }
+  const answer = await text({ message: question.trim(), output: process.stderr });
+  if (isCancel(answer)) throw new CliError("Cancelled");
+  return answer ?? "";
 }
 function ttyProgress(line) {
   process.stderr.write(`\r\x1B[2K${line ?? ""}`);
 }
+function requireServer(ctx) {
+  if (!ctx.config.serverUrl) throw new NoServerError(ctx.binName);
+  return ctx.config.serverUrl;
+}
 function requireClient(ctx) {
+  const serverUrl = requireServer(ctx);
   if (!ctx.config.apiKey) throw new NotLoggedInError(ctx.binName);
   return createApiClient({
-    serverUrl: ctx.config.serverUrl,
+    serverUrl,
     apiKey: ctx.config.apiKey,
     fetch: ctx.fetch
   });
 }
 
 // src/sites.ts
-import { z as z6 } from "zod";
-var ShareResponseSchema2 = z6.looseObject({ shareUrl: z6.string() });
+import { z as z10 } from "zod";
+var ShareResponseSchema2 = z10.looseObject({ shareUrl: z10.string() });
 var sitePath2 = (name) => `/api/sites/${encodeURIComponent(name)}`;
 function whoami(client) {
   return client.request("GET", "/api/me", { schema: MeSchema });
@@ -1376,32 +1851,8 @@ function checkName(client, name) {
     schema: NameCheckSchema
   });
 }
-function sitesBaseFor(serverUrl) {
-  try {
-    const url = new URL(serverUrl);
-    const { hostname } = url;
-    if (url.port || !hostname.includes(".") || /^[\d.]+$/.test(hostname) || hostname.startsWith("["))
-      return null;
-    return { protocol: url.protocol, domain: hostname };
-  } catch {
-    return null;
-  }
-}
-function sitesBaseFromSiteUrl(siteUrl2) {
-  try {
-    const url = new URL(siteUrl2);
-    const dot = url.host.indexOf(".");
-    return dot > 0 ? { protocol: url.protocol, domain: url.host.slice(dot + 1) } : null;
-  } catch {
-    return null;
-  }
-}
-async function discoverSitesBase(client) {
-  const inferred = sitesBaseFor(client.serverUrl);
-  if (inferred) return inferred;
-  const sites = await listSites(client).catch(() => []);
-  const first = sites[0];
-  return first ? sitesBaseFromSiteUrl(first.url) : null;
+function sitesBaseOf(instance) {
+  return instance ? { protocol: `${instance.siteScheme}:`, domain: instance.sitesDomain } : null;
 }
 function siteUrlFor(name, base) {
   return siteUrl(name, base.domain, base.protocol);
@@ -1471,11 +1922,47 @@ async function share(client, name, opts = {}) {
   });
   return { name, action: hadLink ? "refreshed" : "created", shareUrl: res.shareUrl };
 }
+function listComments(client, name, opts = {}) {
+  return client.request("GET", `${sitePath2(name)}/comments`, {
+    schema: CommentListSchema,
+    query: { path: opts.path }
+  });
+}
+function addComment(client, name, input) {
+  return client.request("POST", `${sitePath2(name)}/comments`, {
+    schema: CommentSchema,
+    body: input
+  });
+}
+function resolveComment(client, name, id, resolved) {
+  return client.request("PATCH", `${sitePath2(name)}/comments/${encodeURIComponent(id)}`, {
+    schema: CommentSchema,
+    body: { resolved }
+  });
+}
+async function deleteComment(client, name, id) {
+  await client.request("DELETE", `${sitePath2(name)}/comments/${encodeURIComponent(id)}`);
+  return { name, id, deleted: true };
+}
+function commentsEnabled(instance) {
+  if (!instance) return false;
+  return instance.capabilities.comments ?? true;
+}
 
 // src/commands/auth.ts
-async function runLogin(ctx) {
+function loginServer(ctx, url) {
+  if (url === void 0) return requireServer(ctx);
+  try {
+    return normalizeServerUrl(url);
+  } catch {
+    throw new CliError(`"${url}" is not a server address`, {
+      hint: `Run \`${ctx.binName} login <url>\` with your Fling's address, e.g. https://fling.example.com.`
+    });
+  }
+}
+async function runLogin(ctx, url) {
   const result = await loginFlow({
-    serverUrl: ctx.config.serverUrl,
+    serverUrl: loginServer(ctx, url),
     store: ctx.store,
     log: ctx.log,
     open: ctx.open,
@@ -1491,30 +1978,109 @@ async function runLogout(ctx) {
   }
   await ctx.store.clearCredentials();
   ctx.log.success("Logged out; API key removed from this machine");
-  ctx.log.hint(`Revoke it on the server under API keys at ${ctx.config.serverUrl}`);
+  if (ctx.config.serverUrl)
+    ctx.log.hint(`Revoke it on the server under Connections at ${ctx.config.serverUrl}`);
 }
 async function runWhoami(ctx) {
   const client = requireClient(ctx);
   const me = await whoami(client);
-  const base = ctx.json ? null : await discoverSitesBase(client);
+  const instance = await loadInstance(ctx.store, ctx.config, ctx.fetch);
   ctx.out.data(
     {
       ...me,
       serverUrl: ctx.config.serverUrl,
+      instance: instance?.name ?? null,
       apiKey: redactKey(ctx.config.apiKey),
       apiKeySource: ctx.config.apiKeySource
     },
     () => [
-      `${chalk4.bold("User:")}    ${me.name} <${me.email}>`,
-      `${chalk4.bold("Sites:")}   ${sitesPattern(base)} ${chalk4.dim("(names are first come, first served)")}`,
-      `${chalk4.bold("Server:")}  ${ctx.config.serverUrl}`,
-      `${chalk4.bold("API key:")} ${redactKey(ctx.config.apiKey)} ${chalk4.dim(`(from ${ctx.config.apiKeySource})`)}`
+      `${chalk5.bold("User:")}    ${me.name} <${me.email}>`,
+      `${chalk5.bold("Sites:")}   ${sitesPattern(sitesBaseOf(instance))} ${chalk5.dim("(names are first come, first served)")}`,
+      `${chalk5.bold("Server:")}  ${ctx.config.serverUrl}${instance ? chalk5.dim(` (${instance.name})`) : ""}`,
+      `${chalk5.bold("API key:")} ${redactKey(ctx.config.apiKey)} ${chalk5.dim(`(from ${ctx.config.apiKeySource})`)}`
     ].join("\n")
   );
 }
 
+// src/commands/comments.ts
+import chalk6 from "chalk";
+function commentsClient(ctx) {
+  const instance = ctx.config.instance;
+  if (instance && !commentsEnabled(instance)) {
+    throw new CliError(`${instance.name} has comments turned off`);
+  }
+  return requireClient(ctx);
+}
+var reviewPage = (ctx, name, path3) => reviewUrl(ctx.config.instance?.appOrigin ?? ctx.config.serverUrl ?? "", name, path3);
+function describe(c, currentVersionId) {
+  const version = c.versionId === null ? "" : c.versionId === currentVersionId ? "" : chalk6.dim(` (on version ${c.versionId})`);
+  return `${chalk6.bold(authorLabel(c.author))} ${chalk6.dim(formatDate(c.createdAt))}${version}`;
+}
+async function runComments(ctx, name, opts) {
+  const list = await listComments(commentsClient(ctx), name, { path: opts.path });
+  const all = commentThreads(list.comments);
+  const threads = opts.all ? all : all.filter((t) => t.comment.resolvedAt === null);
+  const hidden = all.length - threads.length;
+  ctx.out.data({ ...list, reviewUrl: reviewPage(ctx, name) }, () => {
+    const lines = [];
+    let lastPath = null;
+    for (const { comment: c, replies } of threads.sort(
+      (a, b) => a.comment.path.localeCompare(b.comment.path)
+    )) {
+      if (c.path !== lastPath) {
+        lines.push("", chalk6.bold.underline(c.path));
+        lastPath = c.path;
+      }
+      const state = c.resolvedAt ? chalk6.green(" \u2713 resolved") : "";
+      lines.push(`${chalk6.dim(c.id)}${state}  ${describe(c, list.site.currentVersionId)}`);
+      lines.push(...c.body.split("\n").map((l) => `  ${l}`));
+      for (const r of replies) {
+        lines.push(`  ${chalk6.dim("\u21B3")} ${describe(r, list.site.currentVersionId)}`);
+        lines.push(...r.body.split("\n").map((l) => `    ${l}`));
+      }
+    }
+    const summary = chalk6.dim(
+      `${threads.length} ${opts.all ? "" : "open "}thread${threads.length === 1 ? "" : "s"}` + (hidden ? ` (${hidden} resolved \u2014 \`--all\` shows them)` : "") + ` \xB7 review: ${reviewPage(ctx, name)}`
+    );
+    return [...lines, "", summary].join("\n").replace(/^\n/, "");
+  });
+}
+async function runComment(ctx, name, text2, opts) {
+  if (!text2.trim()) throw new CliError("The comment is empty");
+  const comment = await addComment(commentsClient(ctx), name, {
+    body: text2,
+    path: opts.path,
+    parentId: opts.reply
+  });
+  ctx.log.success(
+    comment.parentId ? `Replied to ${comment.parentId} on ${name}` : `Comment added on ${name} ${comment.path}`
+  );
+  ctx.out.data(comment, () => reviewPage(ctx, name, comment.path));
+}
+async function runResolve(ctx, name, id, opts) {
+  const comment = await resolveComment(commentsClient(ctx), name, id, !opts.reopen);
+  ctx.log.success(opts.reopen ? `Thread ${id} reopened` : `Thread ${id} resolved`);
+  if (ctx.json) ctx.out.data(comment, () => "");
+}
+async function runUncomment(ctx, name, id, opts) {
+  if (!opts.yes) {
+    if (!ctx.interactive) {
+      throw new CliError(`Refusing to delete comment ${id} without confirmation`, {
+        hint: "Pass --yes to delete."
+      });
+    }
+    const ok = await ctx.confirm(`Delete comment ${id} (and its replies)? This cannot be undone.`);
+    if (!ok) throw new CliError("Cancelled");
+  }
+  const result = await deleteComment(commentsClient(ctx), name, id);
+  ctx.log.success(`Comment ${id} deleted`);
+  if (ctx.json) ctx.out.data(result, () => "");
+}
+
 // src/commands/deploy.ts
-import chalk5 from "chalk";
+import { stat as stat4 } from "node:fs/promises";
+import { resolve as resolve3 } from "node:path";
+import chalk7 from "chalk";
 
 // src/deploy.ts
 import { readFile as readFile4 } from "node:fs/promises";
@@ -1534,7 +2100,7 @@ import { join as join2, relative, sep } from "node:path";
 import ignore from "ignore";
 var GIT_TIMEOUT_MS = 2e4;
 function git(cwd, args, input) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve5) => {
     try {
       const child = execFile(
         "git",
@@ -1542,14 +2108,14 @@ function git(cwd, args, input) {
         { timeout: GIT_TIMEOUT_MS, maxBuffer: 256 * 1024 * 1024, encoding: "utf8" },
         (error, stdout) => {
           const code = error?.code;
-          if (error && !(args[0] === "check-ignore" && code === 1)) resolve3(null);
-          else resolve3(stdout);
+          if (error && !(args[0] === "check-ignore" && code === 1)) resolve5(null);
+          else resolve5(stdout);
         }
       );
-      child.on("error", () => resolve3(null));
+      child.on("error", () => resolve5(null));
       if (input !== void 0) child.stdin?.end(input);
     } catch {
-      resolve3(null);
+      resolve5(null);
     }
   });
 }
@@ -1598,13 +2164,13 @@ function nestedMode() {
       return false;
     },
     async enterDir(absDir, relDir) {
-      let text;
+      let text2;
       try {
-        text = await readFile2(join2(absDir, ".gitignore"), "utf8");
+        text2 = await readFile2(join2(absDir, ".gitignore"), "utf8");
       } catch {
         return;
       }
-      levels.push({ base: relDir, ig: ignore().add(text) });
+      levels.push({ base: relDir, ig: ignore().add(text2) });
     }
   };
 }
@@ -1678,19 +2244,19 @@ function describeSkipped(skipped) {
     lines.push(line(skipped.gitignored.length, "gitignored file", skipped.gitignored));
   return lines;
 }
-function contentTypeFor(path) {
-  const type = mime.getType(path) ?? "application/octet-stream";
+function contentTypeFor(path3) {
+  const type = mime.getType(path3) ?? "application/octet-stream";
   return type.startsWith("text/") || CHARSET_TYPES.has(type) ? `${type}; charset=utf-8` : type;
 }
-async function sha256File(path) {
-  const hash = createHash("sha256");
-  for await (const chunk of createReadStream(path)) hash.update(chunk);
-  return hash.digest("hex");
+async function sha256File(path3) {
+  const hash3 = createHash("sha256");
+  for await (const chunk of createReadStream(path3)) hash3.update(chunk);
+  return hash3.digest("hex");
 }
 function toManifest(local) {
   return {
-    files: local.files.map(({ path, sha256, size, contentType }) => ({
-      path,
+    files: local.files.map(({ path: path3, sha256, size, contentType }) => ({
+      path: path3,
       sha256,
       size,
       contentType
@@ -2023,8 +2589,8 @@ async function deploy(deps, opts) {
     totalBytes: local.totalBytes,
     warnings: local.warnings
   };
-  const path = `/api/sites/${encodeURIComponent(name)}/deploys`;
-  const res = await deps.client.request("POST", path, {
+  const path3 = `/api/sites/${encodeURIComponent(name)}/deploys`;
+  const res = await deps.client.request("POST", path3, {
     schema: DeployResponseSchema,
     body: {
       manifest: toManifest(local),
@@ -2064,7 +2630,7 @@ async function deploy(deps, opts) {
   });
   const fin = await deps.client.request(
     "POST",
-    `${path}/${encodeURIComponent(res.versionId)}/finalize`,
+    `${path3}/${encodeURIComponent(res.versionId)}/finalize`,
     { schema: FinalizeResponseSchema }
   );
   return {
@@ -2100,51 +2666,51 @@ import { copyFile, mkdir as mkdir2, mkdtemp, readFile as readFile5, rm, stat as
 import { tmpdir } from "node:os";
 import { basename as basename2, extname, join as join4, resolve as resolve2, sep as sep4 } from "node:path";
 import { unzipSync } from "fflate";
-function inputKind(path, isDirectory) {
+function inputKind(path3, isDirectory) {
   if (isDirectory) return "folder";
-  const ext = extname(path).toLowerCase();
+  const ext = extname(path3).toLowerCase();
   if (ext === ".html" || ext === ".htm") return "html";
   if (ext === ".zip") return "zip";
   return "file";
 }
-function fileSiteName(path) {
-  const file = basename2(path.replace(/\\/g, "/"));
+function fileSiteName(path3) {
+  const file = basename2(path3.replace(/\\/g, "/"));
   const stem = file.slice(0, file.length - extname(file).length) || file;
   return fitName([stem.replace(/\s*\(\d+\)$/, "")]);
 }
-function defaultNameFor(path, isDirectory) {
-  return isDirectory ? defaultSiteName(path) : fileSiteName(path);
+function defaultNameFor(path3, isDirectory) {
+  return isDirectory ? defaultSiteName(path3) : fileSiteName(path3);
 }
 async function tempFolder() {
   const dir = await mkdtemp(join4(tmpdir(), "fling-"));
   return { dir, cleanup: () => rm(dir, { recursive: true, force: true }) };
 }
-async function prepareInput(path) {
+async function prepareInput(path3) {
   let info;
   try {
-    info = await stat3(path);
+    info = await stat3(path3);
   } catch {
-    throw new CliError(`Not found: ${path}`);
+    throw new CliError(`Not found: ${path3}`);
   }
-  const kind = inputKind(path, info.isDirectory());
-  const defaultName = defaultNameFor(path, info.isDirectory());
+  const kind = inputKind(path3, info.isDirectory());
+  const defaultName = defaultNameFor(path3, info.isDirectory());
   if (kind === "folder")
     return {
       kind,
-      source: path,
-      dir: path,
+      source: path3,
+      dir: path3,
       defaultName,
       skippedDotfiles: [],
       cleanup: async () => {
       }
     };
-  const file = basename2(path);
+  const file = basename2(path3);
   if (file.startsWith("."))
     throw new CliError(`Not flung: ${file} is a dotfile. ${NEVER_PUBLISHED_NOTE}`);
   if (kind === "file" && isSecretPath(file)) throw new SecretFilesError([file]);
   if (info.size > MAX_DEPLOY_BYTES)
     throw new CliError(
-      `${basename2(path)} is ${formatBytes(info.size)}; the limit is ${formatBytes(MAX_DEPLOY_BYTES)}`
+      `${basename2(path3)} is ${formatBytes(info.size)}; the limit is ${formatBytes(MAX_DEPLOY_BYTES)}`
     );
   const tmp = await tempFolder();
   const skippedDotfiles = [];
@@ -2152,21 +2718,21 @@ async function prepareInput(path) {
     if (kind === "html") {
       if (info.size > MAX_FILE_BYTES)
         throw new CliError(
-          `${basename2(path)} is ${formatBytes(info.size)}; the limit is ${formatBytes(MAX_FILE_BYTES)} per file`
+          `${basename2(path3)} is ${formatBytes(info.size)}; the limit is ${formatBytes(MAX_FILE_BYTES)} per file`
         );
-      await copyFile(path, join4(tmp.dir, "index.html"));
+      await copyFile(path3, join4(tmp.dir, "index.html"));
     } else if (kind === "zip") {
-      await extractZip(await readFile5(path), tmp.dir, skippedDotfiles);
+      await extractZip(await readFile5(path3), tmp.dir, skippedDotfiles);
     } else {
-      const name = basename2(path);
-      await copyFile(path, join4(tmp.dir, name));
+      const name = basename2(path3);
+      await copyFile(path3, join4(tmp.dir, name));
       await writeFile2(join4(tmp.dir, "index.html"), wrapperPage(name));
     }
   } catch (error) {
     await tmp.cleanup();
     throw error;
   }
-  return { kind, source: path, dir: tmp.dir, defaultName, skippedDotfiles, cleanup: tmp.cleanup };
+  return { kind, source: path3, dir: tmp.dir, defaultName, skippedDotfiles, cleanup: tmp.cleanup };
 }
 var JUNK_FILES = /* @__PURE__ */ new Set(["thumbs.db", "desktop.ini"]);
 function zipEntryPath(name) {
@@ -2206,12 +2772,12 @@ async function extractZip(data, dest, skippedDotfiles = []) {
   try {
     entries = unzipSync(data, {
       filter: (file) => {
-        const path = zipEntryPath(file.name);
-        if (path === "unsafe") {
+        const path3 = zipEntryPath(file.name);
+        if (path3 === "unsafe") {
           unsafe.push(file.name);
           return false;
         }
-        if (path === null) {
+        if (path3 === null) {
           const dot = zipDotEntry(file.name);
           if (dot && !skippedDotfiles.includes(dot)) skippedDotfiles.push(dot);
           return false;
@@ -2220,7 +2786,7 @@ async function extractZip(data, dest, skippedDotfiles = []) {
         declared += file.originalSize;
         if (file.originalSize > MAX_FILE_BYTES)
           throw new CliError(
-            `${path} in the zip is ${formatBytes(file.originalSize)}; the limit is ${formatBytes(MAX_FILE_BYTES)} per file`
+            `${path3} in the zip is ${formatBytes(file.originalSize)}; the limit is ${formatBytes(MAX_FILE_BYTES)} per file`
           );
         if (declared > MAX_DEPLOY_BYTES)
           throw new CliError(
@@ -2297,315 +2863,25 @@ function wrapperPage(file) {
 `;
 }
 
-// src/locate.ts
-import { lstat, readdir as readdir2, readFile as readFile6, realpath as realpath3, stat as stat4 } from "node:fs/promises";
-import { posix, win32 } from "node:path";
-import { fileURLToPath } from "node:url";
-var DOWNLOADS_DIR_ENV = "FLING_DOWNLOADS_DIR";
-var FOUND_AS_GIVEN = "path";
-var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", "__MACOSX", "Library", "AppData", "$RECYCLE.BIN"]);
-var SESSION_SKIP_DIRS = /* @__PURE__ */ new Set(["skills-plugin", "rpm", "uploads", "memory"]);
-var SESSIONS_DEPTH = 4;
-var OUTPUTS_DEPTH = 4;
-var SANDBOX_PATH_RE = /^\/(mnt\/user-data|mnt\/data|sessions|home\/claude|tmp\/outputs)(\/|$)/;
-var nodeFs = {
-  async stat(path) {
-    try {
-      const s = await stat4(path);
-      return { isFile: s.isFile(), isDirectory: s.isDirectory(), mtimeMs: s.mtimeMs, size: s.size };
-    } catch {
-      return null;
-    }
-  },
-  async readdir(path) {
-    try {
-      const entries = await readdir2(path, { withFileTypes: true });
-      const out = [];
-      for (const e of entries) {
-        if (e.isSymbolicLink()) {
-          const s = await stat4(`${path}/${e.name}`).catch(() => null);
-          out.push({ name: e.name, isFile: Boolean(s?.isFile()), isDirectory: false });
-        } else out.push({ name: e.name, isFile: e.isFile(), isDirectory: e.isDirectory() });
-      }
-      return out;
-    } catch {
-      return [];
-    }
-  },
-  async realpath(path) {
-    return realpath3(path).catch(() => null);
-  },
-  async readText(path) {
-    try {
-      if (!(await lstat(path)).isFile()) return null;
-      return await readFile6(path, "utf8");
-    } catch {
-      return null;
-    }
-  }
-};
-var pathFor = (platform) => platform === "win32" ? win32 : posix;
-var usable = (value) => Boolean(value?.trim()) && !value?.trim().startsWith("${");
-async function xdgUserDir(key, opts, fs) {
-  const fromEnv2 = opts.env[`XDG_${key}_DIR`];
-  if (usable(fromEnv2)) return fromEnv2;
-  const configHome = opts.env.XDG_CONFIG_HOME || posix.join(opts.home, ".config");
-  const text = await fs.readText(posix.join(configHome, "user-dirs.dirs"));
-  const match = text?.match(new RegExp(`^XDG_${key}_DIR="([^"]*)"`, "m"));
-  if (!match?.[1]) return void 0;
-  return match[1].replace(/^\$HOME(?=\/|$)/, opts.home);
-}
-async function searchRoots(opts) {
-  const fs = opts.fs ?? nodeFs;
-  const p = pathFor(opts.platform);
-  const { home, env, platform } = opts;
-  const userHome = platform === "win32" && usable(env.USERPROFILE) ? env.USERPROFILE : home;
-  const roots = [];
-  const add = (label, path, depth, sessions = false) => {
-    if (!path) return;
-    const norm = p.resolve(path);
-    if (roots.some((r) => r.path === norm)) return;
-    roots.push({ label, path: norm, depth, ...sessions ? { sessions } : {} });
-  };
-  const cwd = p.resolve(opts.cwd);
-  if (cwd !== p.parse(cwd).root && cwd !== p.resolve(userHome)) add("current folder", cwd, 4);
-  const configured = usable(opts.downloadsDir) ? opts.downloadsDir : usable(env[DOWNLOADS_DIR_ENV]) ? env[DOWNLOADS_DIR_ENV] : void 0;
-  const defaultDownloads = platform === "linux" ? await xdgUserDir("DOWNLOAD", opts, fs) ?? p.join(home, "Downloads") : p.join(userHome, "Downloads");
-  add("Downloads", configured ? expandHome(configured, home, platform) : defaultDownloads, 3);
-  add("Downloads", defaultDownloads, 3);
-  const desktop = platform === "linux" ? await xdgUserDir("DESKTOP", opts, fs) ?? p.join(home, "Desktop") : p.join(userHome, "Desktop");
-  add("Desktop", desktop, 3);
-  if (platform === "win32" && usable(env.OneDrive))
-    add("Desktop", p.join(env.OneDrive, "Desktop"), 3);
-  const documents = platform === "linux" ? await xdgUserDir("DOCUMENTS", opts, fs) ?? p.join(home, "Documents") : p.join(userHome, "Documents");
-  add("Documents/Claude", p.join(documents, "Claude"), 4);
-  add("~/Claude", p.join(userHome, "Claude"), 4);
-  const claudeConfig = platform === "darwin" ? p.join(home, "Library", "Application Support", "Claude") : platform === "win32" ? p.join(
-    usable(env.APPDATA) ? env.APPDATA : p.join(userHome, "AppData", "Roaming"),
-    "Claude"
-  ) : p.join(env.XDG_CONFIG_HOME || p.join(home, ".config"), "Claude");
-  add(
-    "Claude Desktop outputs",
-    p.join(claudeConfig, "local-agent-mode-sessions"),
-    SESSIONS_DEPTH,
-    true
-  );
-  if (!fs.realpath) return roots;
-  const real = [];
-  for (const root of roots) {
-    const path = await fs.realpath(root.path) ?? root.path;
-    if (!real.some((r) => r.path === path)) real.push({ ...root, path });
-  }
-  return real;
-}
-function expandHome(input, home, platform) {
-  if (input === "~") return home;
-  if (input.startsWith("~/") || platform === "win32" && input.startsWith("~\\"))
-    return pathFor(platform).join(home, input.slice(2));
-  return input;
-}
-async function walk(roots, opts, visit) {
-  const fs = opts.fs ?? nodeFs;
-  const p = pathFor(opts.platform);
-  const now = opts.now ?? Date.now;
-  const deadline = now() + (opts.timeBudgetMs ?? 4e3);
-  let budget = opts.entryBudget ?? 6e4;
-  const skip = (name) => name.startsWith(".") || SKIP_DIRS.has(name);
-  const expanded = [];
-  for (const root of roots) {
-    if (!root.sessions) {
-      expanded.push(root);
-      continue;
-    }
-    let level = [root.path];
-    for (let depth = 0; depth < root.depth && level.length; depth++) {
-      const next = [];
-      for (const dir of level) {
-        for (const e of await fs.readdir(dir)) {
-          if (!e.isDirectory || skip(e.name) || SESSION_SKIP_DIRS.has(e.name)) continue;
-          const child = p.join(dir, e.name);
-          if (e.name === "outputs")
-            expanded.push({ label: root.label, path: child, depth: OUTPUTS_DEPTH });
-          else next.push(child);
-        }
-      }
-      level = next;
-    }
-  }
-  for (const root of expanded) {
-    let level = [root.path];
-    for (let depth = 0; depth <= root.depth && level.length; depth++) {
-      const next = [];
-      for (const dir of level) {
-        if (now() > deadline || budget <= 0) return { complete: false };
-        const entries = await fs.readdir(dir);
-        budget -= entries.length;
-        for (const entry of entries) {
-          if (entry.name.startsWith(".")) continue;
-          const path = p.join(dir, entry.name);
-          const result = await visit({ root, path, entry, siblings: entries });
-          if (entry.isDirectory && !skip(entry.name) && result !== "skip" && depth < root.depth)
-            next.push(path);
-        }
-      }
-      level = next;
-    }
-  }
-  return { complete: true };
-}
-function withoutDuplicateSuffix(name) {
-  return name.replace(/ \(\d+\)(?=\.[^.]+$|$)/, "");
-}
-function namesMatch(candidate, wanted) {
-  const a = candidate.toLowerCase();
-  const b = wanted.toLowerCase();
-  return a === b || withoutDuplicateSuffix(a) === withoutDuplicateSuffix(b);
-}
-var splitSegments = (path) => path.split(/[\\/]+/).filter((s) => s !== "" && s !== "." && s !== "~");
-function suffixScore(path, wanted) {
-  const have = splitSegments(path);
-  let score = 1;
-  for (let i = 2; i <= Math.min(have.length, wanted.length); i++) {
-    if (have[have.length - i]?.toLowerCase() !== wanted[wanted.length - i]?.toLowerCase()) break;
-    score++;
-  }
-  return score;
-}
-var looksLikeSandboxPath = (input) => SANDBOX_PATH_RE.test(input.replace(/\\/g, "/"));
-function normaliseInput(raw, opts) {
-  let input = raw.trim().replace(/^(["'])(.*)\1$/, "$2");
-  if (input.startsWith("file://")) {
-    try {
-      input = fileURLToPath(input, { windows: opts.platform === "win32" });
-    } catch {
-      input = decodeURIComponent(input.slice("file://".length));
-    }
-  }
-  return expandHome(input, opts.home, opts.platform);
-}
-async function resolveInput(input, opts) {
-  const fs = opts.fs ?? nodeFs;
-  const p = pathFor(opts.platform);
-  const given = normaliseInput(input, opts);
-  if (!given) throw new CliError("No path given");
-  const direct = p.isAbsolute(given) ? p.normalize(given) : p.resolve(opts.cwd, given);
-  const directStat = await fs.stat(direct);
-  if (directStat && (directStat.isFile || directStat.isDirectory)) {
-    return {
-      path: direct,
-      foundIn: FOUND_AS_GIVEN,
-      isDirectory: directStat.isDirectory,
-      alternatives: []
-    };
-  }
-  const wanted = splitSegments(given);
-  const name = wanted.at(-1);
-  const roots = await searchRoots(opts);
-  if (!name) throw notFound(input, roots);
-  const found = [];
-  const seen = /* @__PURE__ */ new Set();
-  await walk(roots, opts, async ({ root, path, entry }) => {
-    if (!(entry.isFile || entry.isDirectory) || !namesMatch(entry.name, name)) return;
-    if (seen.has(path)) return;
-    seen.add(path);
-    const s = await fs.stat(path);
-    if (!s) return;
-    found.push({
-      path,
-      foundIn: root.label,
-      kind: s.isDirectory ? "folder" : "file",
-      modified: new Date(s.mtimeMs).toISOString(),
-      size: s.size,
-      score: suffixScore(path, wanted),
-      mtimeMs: s.mtimeMs,
-      isDirectory: s.isDirectory
-    });
-    return void 0;
-  });
-  if (found.length === 0) throw notFound(input, roots);
-  found.sort((a, b) => b.score - a.score || b.mtimeMs - a.mtimeMs);
-  const strip = ({ score: _s, mtimeMs: _m, isDirectory: _d, ...c }) => c;
-  const [best, ...rest] = found;
-  return {
-    path: best.path,
-    foundIn: best.foundIn,
-    isDirectory: best.isDirectory,
-    alternatives: rest.slice(0, 5).map(strip)
-  };
-}
-function notFound(input, roots) {
-  const where = roots.map((r) => `${r.label} (${r.path})`).join(", ");
-  const sandbox = looksLikeSandboxPath(input) ? " That looks like a path inside Claude\u2019s sandbox, which this computer cannot see: publish the content inline with fling_publish, or save/download the file to this computer first." : "";
-  return new CliError(`Could not find "${input}". Looked for it by name in: ${where}.${sandbox}`, {
-    hint: "Pass the full path, or save the file to your Downloads folder and use just its name."
-  });
-}
-var LISTED_EXT = /\.(html?|zip)$/i;
-async function findFiles(opts, find = {}) {
-  const fs = opts.fs ?? nodeFs;
-  const p = pathFor(opts.platform);
-  const now = (opts.now ?? Date.now)();
-  const since = now - (find.days ?? 14) * 24 * 60 * 60 * 1e3;
-  const query = find.query?.trim().toLowerCase();
-  const roots = await searchRoots(opts);
-  const found = /* @__PURE__ */ new Map();
-  const rootPaths = new Set(roots.map((r) => r.path));
-  const { complete } = await walk(roots, opts, async ({ root, path, entry }) => {
-    if (entry.isDirectory) {
-      if (rootPaths.has(path)) return;
-      const index = (await fs.readdir(path)).find((e) => e.isFile && /^index\.html?$/i.test(e.name));
-      if (!index) return;
-      const s2 = await fs.stat(p.join(path, index.name));
-      if (s2 && s2.mtimeMs >= since && (!query || entry.name.toLowerCase().includes(query)))
-        found.set(path, {
-          path,
-          foundIn: root.label,
-          kind: "folder",
-          modified: new Date(s2.mtimeMs).toISOString(),
-          size: s2.size,
-          mtimeMs: s2.mtimeMs
-        });
-      return "skip";
-    }
-    if (!entry.isFile || !LISTED_EXT.test(entry.name)) return;
-    if (query && !entry.name.toLowerCase().includes(query)) return;
-    const s = await fs.stat(path);
-    if (!s || s.mtimeMs < since || found.has(path)) return;
-    found.set(path, {
-      path,
-      foundIn: root.label,
-      kind: "file",
-      modified: new Date(s.mtimeMs).toISOString(),
-      size: s.size,
-      mtimeMs: s.mtimeMs
-    });
-    return void 0;
-  });
-  const files = [...found.values()].sort((a, b) => b.mtimeMs - a.mtimeMs).slice(0, find.limit ?? 20).map(({ mtimeMs: _m, ...c }) => c);
-  return { files, searched: roots, complete };
-}
-
 // src/commands/deploy.ts
 async function runDeploy(ctx, input, opts) {
   const client = requireClient(ctx);
   const ask = ctx.interactive && !opts.yes;
-  const base = ask ? await discoverSitesBase(client) : sitesBaseFor(client.serverUrl);
-  const located = await resolveInput(input ?? ".", ctx.locate ?? systemLocateOptions());
-  if (located.foundIn !== FOUND_AS_GIVEN) {
-    ctx.log.info(`Found in ${located.foundIn}: ${located.path}`);
-    if (located.alternatives.length)
-      ctx.log.hint(
-        `Also found (older): ${located.alternatives.map((a) => a.path).join(", ")} \u2014 pass the full path to fling another.`
-      );
-  }
-  const prepared = await prepareInput(located.path);
+  const instance = await loadInstance(ctx.store, ctx.config, ctx.fetch);
+  const base = sitesBaseOf(instance);
+  const path3 = resolve3(input ?? ".");
+  if (!await stat4(path3).catch(() => null))
+    throw new CliError(`No such file or folder: ${input ?? "."}`, {
+      hint: `Give the path to a folder, .html, .zip or other file, e.g. \`${ctx.binName} deploy ./dist\`.`
+    });
+  const prepared = await prepareInput(path3);
   try {
-    await deployPrepared(ctx, client, base, prepared, opts, ask);
+    await deployPrepared(ctx, client, instance, base, prepared, opts, ask);
   } finally {
     await prepared.cleanup();
   }
 }
-async function deployPrepared(ctx, client, base, prepared, opts, ask) {
+async function deployPrepared(ctx, client, instance, base, prepared, opts, ask) {
   let local = await buildManifest(prepared.dir);
   local.skipped.dotfiles.unshift(...prepared.skippedDotfiles);
   for (const line of describeSkipped(local.skipped)) ctx.log.info(line);
@@ -2634,7 +2910,7 @@ async function deployPrepared(ctx, client, base, prepared, opts, ask) {
         if (p.total === 0) return;
         progressShown = true;
         ctx.progress(
-          `${chalk5.cyan("fling")} uploading ${p.uploaded}/${p.total} files \xB7 ${formatBytes(p.bytes)}/${formatBytes(p.totalBytes)}`
+          `${progressBar(p.totalBytes ? p.bytes / p.totalBytes : p.uploaded / p.total)} uploading ${p.uploaded}/${p.total} files \xB7 ${formatBytes(p.bytes)}/${formatBytes(p.totalBytes)}`
         );
       }
     }
@@ -2643,12 +2919,12 @@ async function deployPrepared(ctx, client, base, prepared, opts, ask) {
   });
   for (const warning of result.warnings) if (warning !== NO_INDEX_WARNING) ctx.log.warn(warning);
   const summary = `${result.fileCount} files, ${formatBytes(result.totalBytes)}`;
-  if (result.status === "unchanged") ctx.log.info(`Unchanged ${chalk5.dim(`(${summary})`)}`);
+  if (result.status === "unchanged") ctx.log.info(`Unchanged ${chalk7.dim(`(${summary})`)}`);
   else if (result.status === "repointed")
-    ctx.log.success(`Restored version ${result.versionId} ${chalk5.dim(`(${summary})`)}`);
+    ctx.log.success(`Restored version ${result.versionId} ${chalk7.dim(`(${summary})`)}`);
   else
     ctx.log.success(
-      `Deployed ${result.name} ${chalk5.dim(`(${summary}; uploaded ${result.uploaded}, version ${result.versionId})`)}`
+      `Deployed ${result.name} ${chalk7.dim(`(${summary}; uploaded ${result.uploaded}, version ${result.versionId})`)}`
     );
   const ready = result.status === "unchanged" ? true : (await waitWithSpinner(
     ctx.waitReady,
@@ -2656,17 +2932,39 @@ async function deployPrepared(ctx, client, base, prepared, opts, ask) {
     local.files.map((f) => f.path),
     { progress: ctx.progress, warn: (m) => ctx.log.warn(m) }
   )).ready;
-  ctx.out.data({ status: result.status, site: result.site, ready, skipped: local.skipped }, () => {
-    const lines = [chalk5.bold(result.url)];
-    if (result.site.visibility === "private")
-      lines.push(
-        chalk5.dim(
-          `Private: Nearform sign-in required. Share publicly with \`${ctx.binName} share ${result.name}\`.`
-        )
+  const who = instance ? `only ${privateAudience(instance)} can open it` : "sign-in required";
+  const privateNote = `Private: ${who}. Share publicly with \`${ctx.binName} share ${result.name}\`.`;
+  const review = instance && commentsEnabled(instance) ? reviewUrl(instance.appOrigin, result.name) : void 0;
+  const reviewNote = instance ? `Share for feedback (reviewers sign in to ${instance.name}):` : "Share for feedback:";
+  const data = {
+    status: result.status,
+    site: result.site,
+    ...review ? { reviewUrl: review } : {},
+    ready,
+    skipped: local.skipped
+  };
+  ctx.out.data(data, () => {
+    const isPrivate = result.site.visibility === "private";
+    if (ctx.out.tty)
+      return box(
+        [
+          ...review ? [chalk7.dim(reviewNote), brand.url(review), "", chalk7.dim("Site:")] : [],
+          brand.url(result.url),
+          ...isPrivate ? [chalk7.dim(privateNote)] : []
+        ],
+        isPrivate ? chalk7.bold("flung \xB7 private") : chalk7.bold("flung \xB7 public")
       );
+    const lines = [chalk7.bold(result.url)];
+    if (review) lines.push(chalk7.dim(`${reviewNote} ${review}`));
+    if (isPrivate) lines.push(chalk7.dim(privateNote));
     return lines.join("\n");
   });
 }
+var BAR_WIDTH = 20;
+function progressBar(fraction) {
+  const done = Math.round(Math.min(Math.max(fraction, 0), 1) * BAR_WIDTH);
+  return brand.primary("\u2501".repeat(done)) + chalk7.dim("\u2500".repeat(BAR_WIDTH - done));
+}
 async function askNoIndex(ctx, pages) {
   const question = pages > 0 ? "No index.html at the root. [L]ist the HTML pages on a generated index page / [f]ling anyway (the root will 404) / [a]bort " : "No index.html at the root (and no HTML pages to list). [f]ling anyway (the root will 404) / [A]bort ";
   for (; ; ) {
@@ -2681,20 +2979,20 @@ async function askNoIndex(ctx, pages) {
 }
 async function confirmSiteName(ctx, client, generated, base) {
   const where = (n) => base ? ` \u2192 ${siteUrlFor(n, base)}` : "";
-  const describe = (n, note) => ctx.log.info(`Site name: ${chalk5.bold(n)}${where(n)}  ${chalk5.dim(`(${note})`)}`);
+  const describe2 = (n, note) => ctx.log.info(`Site name: ${chalk7.bold(n)}${where(n)}  ${chalk7.dim(`(${note})`)}`);
   let candidate = generated;
   for (; ; ) {
-    const check = await checkName(client, candidate);
+    const check2 = await checkName(client, candidate);
     let proposal;
-    if (check.status === "available" || check.status === "yours") {
+    if (check2.status === "available" || check2.status === "yours") {
       proposal = candidate;
-      describe(candidate, check.status === "yours" ? "updates your existing site" : "new");
+      describe2(candidate, check2.status === "yours" ? "updates your existing site" : "new");
     } else {
-      const why = check.status === "taken" ? "is taken" : "is not a valid site name";
-      const alternatives = check.suggestions.length ? ` Suggestions: ${check.suggestions.join(", ")}` : "";
+      const why = check2.status === "taken" ? "is taken" : "is not a valid site name";
+      const alternatives = check2.suggestions.length ? ` Suggestions: ${check2.suggestions.join(", ")}` : "";
       ctx.log.warn(`${candidate} ${why}.${alternatives}`);
-      proposal = check.suggestions[0];
-      if (proposal) describe(proposal, "new");
+      proposal = check2.suggestions[0];
+      if (proposal) describe2(proposal, "new");
     }
     for (; ; ) {
       const question = proposal ? `Use "${proposal}"? [Y/n or type another name] ` : "Type a site name (or n to abort): ";
@@ -2717,8 +3015,215 @@ async function confirmSiteName(ctx, client, generated, base) {
   }
 }
 
+// src/commands/setup.ts
+import { intro, outro, spinner } from "@clack/prompts";
+import chalk8 from "chalk";
+
+// src/claude.ts
+import { execFile as execFile2 } from "node:child_process";
+import { access, mkdtemp as mkdtemp2, writeFile as writeFile3 } from "node:fs/promises";
+import { homedir as homedir3, tmpdir as tmpdir2 } from "node:os";
+import { join as join5 } from "node:path";
+var MARKETPLACE_SOURCE = REPO_SLUG;
+var MARKETPLACE_NAME = "fling";
+var PLUGIN_NAME = "fling";
+var PLUGIN_ID = `${PLUGIN_NAME}@${MARKETPLACE_NAME}`;
+var MCPB_PATH = "/downloads/fling.mcpb";
+var runClaude = (args) => new Promise((resolve5) => {
+  execFile2(
+    "claude",
+    [...args],
+    { timeout: 12e4, maxBuffer: 16 * 1024 * 1024, shell: process.platform === "win32" },
+    (error, stdout, stderr) => {
+      const missing = error?.code === "ENOENT";
+      const code = !error ? 0 : missing ? -1 : typeof error.code === "number" ? error.code : 1;
+      resolve5({ code, stdout: String(stdout), stderr: String(stderr) });
+    }
+  );
+});
+async function claudeCodeStatus(run) {
+  const version = await run(["--version"]);
+  if (version.code !== 0) return { claude: "missing" };
+  const claude = version.stdout.trim().split(/\s+/)[0] ?? "unknown";
+  const list = await run(["plugin", "list", "--json"]);
+  let plugins = [];
+  try {
+    plugins = JSON.parse(list.stdout);
+  } catch {
+  }
+  const fling = Array.isArray(plugins) ? plugins.find((p) => p.id === PLUGIN_ID) : void 0;
+  if (!fling) return { claude, installed: false };
+  return {
+    claude,
+    installed: true,
+    version: fling.version,
+    scope: fling.scope,
+    enabled: fling.enabled
+  };
+}
+async function installPlugin(run, scope) {
+  check(
+    await run(["plugin", "install", PLUGIN_NAME, "--marketplace", MARKETPLACE_SOURCE, "-s", scope]),
+    "install the Fling plugin"
+  );
+}
+async function updatePlugin(run, scope) {
+  check(await run(["plugin", "marketplace", "update", MARKETPLACE_NAME]), "update the marketplace");
+  check(
+    await run(["plugin", "update", PLUGIN_ID, ...scope ? ["-s", scope] : []]),
+    "update the Fling plugin"
+  );
+}
+function check(result, what) {
+  if (result.code === 0) return;
+  const detail = (result.stderr || result.stdout).trim().split("\n").at(-1);
+  throw new Error(`Could not ${what}${detail ? `: ${detail}` : ""}`);
+}
+async function findClaudeDesktop(platform = process.platform, env = process.env, exists = (path3) => access(path3).then(
+  () => true,
+  () => false
+)) {
+  const candidates = platform === "darwin" ? ["/Applications/Claude.app", join5(homedir3(), "Applications", "Claude.app")] : platform === "win32" && env.LOCALAPPDATA ? [join5(env.LOCALAPPDATA, "AnthropicClaude"), join5(env.LOCALAPPDATA, "Programs", "Claude")] : [];
+  for (const path3 of candidates) if (await exists(path3)) return path3;
+  return null;
+}
+async function downloadExtension(serverUrl, fetch2) {
+  const url = new URL(MCPB_PATH, serverUrl).toString();
+  const response = await fetch2(url);
+  if (!response.ok) throw new Error(`Could not download ${url} (HTTP ${response.status})`);
+  const dir = await mkdtemp2(join5(tmpdir2(), "fling-mcpb-"));
+  const file = join5(dir, "fling.mcpb");
+  await writeFile3(file, Buffer.from(await response.arrayBuffer()));
+  return file;
+}
+
+// src/commands/setup.ts
+var SCOPES = ["user", "project", "local"];
+async function runSetup(baseCtx, opts, deps = {}) {
+  const scope = opts.scope ?? "user";
+  if (!SCOPES.includes(scope))
+    throw new CliError(`--scope must be one of ${SCOPES.join(", ")}, not "${opts.scope}"`);
+  const run = deps.runClaude ?? runClaude;
+  const ask = baseCtx.interactive && !opts.yes;
+  const fancy = baseCtx.interactive && !baseCtx.json;
+  const ctx = fancy ? {
+    ...baseCtx,
+    log: createLogger({
+      debug: baseCtx.config.debug,
+      write: (line) => process.stderr.write(`${chalk8.gray("\u2502")}  ${line}
+`)
+    })
+  } : baseCtx;
+  if (fancy) {
+    process.stderr.write(`${logo()}
+`);
+    intro(chalk8.bold(" fling setup "), { output: process.stderr });
+  }
+  const results = {
+    login: await stepLogin(ctx, opts.url),
+    claudeCode: "skipped",
+    claudeDesktop: "skipped"
+  };
+  const after = results.login === "done" ? { ...ctx, config: await ctx.store.resolve() } : ctx;
+  results.claudeCode = await stepClaudeCode(after, run, scope, ask, fancy);
+  results.claudeDesktop = await stepClaudeDesktop(after, deps, ask, fancy);
+  const failed = Object.values(results).includes("failed");
+  if (fancy)
+    outro(
+      failed ? chalk8.yellow("Setup finished with problems \u2014 see above, then run `fling setup` again.") : `You're set. Try ${chalk8.bold(`${ctx.binName} deploy ./dist`)}, or ask Claude to \u201Cfling this\u201D.`,
+      { output: process.stderr }
+    );
+  ctx.out.data(results, () => "");
+  if (failed) process.exitCode = 1;
+}
+async function stepLogin(ctx, url) {
+  const sameServer = url === void 0 || safeNormalize(url) === ctx.config.serverUrl;
+  if (ctx.config.apiKey && sameServer) {
+    try {
+      const me = await whoami(requireClient(ctx));
+      ctx.log.success(`Signed in as ${chalk8.bold(me.name)} ${chalk8.dim(`<${me.email}>`)}`);
+      return "already";
+    } catch (error) {
+      if (exitCodeFor(error) !== 2) {
+        ctx.log.error(error instanceof Error ? error.message : String(error));
+        return "failed";
+      }
+      ctx.log.warn("The stored API key no longer works \u2014 signing in again");
+    }
+  }
+  try {
+    await runLogin({ ...ctx, json: false }, url);
+    return "done";
+  } catch (error) {
+    ctx.log.error(error instanceof Error ? error.message : String(error));
+    return "failed";
+  }
+}
+function safeNormalize(url) {
+  try {
+    return normalizeServerUrl(url);
+  } catch {
+    return void 0;
+  }
+}
+async function stepClaudeCode(ctx, run, scope, ask, fancy) {
+  const status = await claudeCodeStatus(run);
+  if (status.claude === "missing") {
+    ctx.log.info(`Claude Code not found ${chalk8.dim("(no `claude` on your PATH) \u2014 skipped")}`);
+    ctx.log.hint(
+      `Once it is installed, run \`${ctx.binName} setup\` again, or in Claude Code: /plugin marketplace add ${MARKETPLACE_SOURCE} then /plugin install ${PLUGIN_ID}`
+    );
+    return "missing";
+  }
+  const installed = "installed" in status && status.installed;
+  const question = installed ? `The Fling plugin is installed in Claude Code${status.version ? ` (${status.version})` : ""}. Update it to the latest?` : "Install the Fling plugin (skill + MCP server) into Claude Code?";
+  if (ask && !await ctx.confirm(question)) {
+    ctx.log.info(chalk8.dim("Claude Code plugin: skipped"));
+    return installed ? "already" : "skipped";
+  }
+  const s = fancy ? spinner({ output: process.stderr }) : null;
+  s?.start(installed ? "Updating the Claude Code plugin" : "Installing the Claude Code plugin");
+  try {
+    if (installed) await updatePlugin(run, status.scope);
+    else await installPlugin(run, scope);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (s) s.error(message);
+    else ctx.log.error(message);
+    return "failed";
+  }
+  const done = installed ? `Claude Code plugin ${PLUGIN_NAME} is up to date` : `Claude Code plugin ${PLUGIN_NAME} installed ${chalk8.dim(`(${scope} scope)`)}`;
+  if (s) s.stop(done);
+  else ctx.log.success(done);
+  ctx.log.hint("Restart Claude Code (or run /reload-plugins) to pick it up.");
+  return installed ? "updated" : "done";
+}
+async function stepClaudeDesktop(ctx, deps, ask, fancy) {
+  const app = await (deps.findClaudeDesktop ?? findClaudeDesktop)();
+  if (!app) return "missing";
+  if (ask && !await ctx.confirm("Add the Fling extension to Claude Desktop too?")) {
+    ctx.log.info(chalk8.dim("Claude Desktop extension: skipped"));
+    return "skipped";
+  }
+  const s = fancy ? spinner({ output: process.stderr }) : null;
+  s?.start("Downloading the Claude Desktop extension");
+  try {
+    const file = await (deps.downloadExtension ?? ((serverUrl) => downloadExtension(serverUrl, ctx.fetch)))(requireServer(ctx));
+    await ctx.open(file);
+    const done = "Opened fling.mcpb in Claude Desktop \u2014 click Install there to finish";
+    if (s) s.stop(done);
+    else ctx.log.success(done);
+    return "done";
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (s) s.error(message);
+    else ctx.log.error(message);
+    return "failed";
+  }
+}
+
 // src/commands/sites.ts
-import chalk6 from "chalk";
+import chalk9 from "chalk";
 async function runList(ctx, opts) {
   const sites = await listSites(requireClient(ctx), opts);
   ctx.out.data(
@@ -2736,11 +3241,11 @@ async function runList(ctx, opts) {
   );
 }
 function describeSite(site) {
-  const row = (label, value) => `${chalk6.bold(`${label}:`.padEnd(12))}${value}`;
+  const row = (label, value) => `${chalk9.bold(`${label}:`.padEnd(12))}${value}`;
   return [
     row("Name", site.name),
     row("URL", site.url),
-    row("Visibility", site.visibility + (site.archived ? chalk6.yellow(" (archived)") : "")),
+    row("Visibility", site.visibility + (site.archived ? chalk9.yellow(" (archived)") : "")),
     row("SPA", site.spa ? "yes" : "no"),
     row("Share link", site.shareUrl ?? "-"),
     row("Version", site.currentVersionId ?? "-"),
@@ -2755,128 +3260,420 @@ function filesRow(site, row) {
   const n = current.fileCount;
   return [row("Files", `${n} file${n === 1 ? "" : "s"}, ${formatBytes(current.totalBytes)}`)];
 }
-async function runInfo(ctx, name) {
-  const site = await getSite(requireClient(ctx), name);
-  ctx.out.data(
-    site,
-    () => [
-      ...describeSite(site),
-      "",
-      chalk6.dim(
-        `${site.versions.length} version(s) \u2014 \`fling versions ${name}\`; files \u2014 \`fling files ${name}\``
-      )
-    ].join("\n")
-  );
+async function runInfo(ctx, name) {
+  const site = await getSite(requireClient(ctx), name);
+  ctx.out.data(
+    site,
+    () => [
+      ...describeSite(site),
+      "",
+      chalk9.dim(
+        `${site.versions.length} version(s) \u2014 \`fling versions ${name}\`; files \u2014 \`fling files ${name}\``
+      )
+    ].join("\n")
+  );
+}
+async function runVersions(ctx, name) {
+  const site = await getSite(requireClient(ctx), name);
+  ctx.out.data(
+    { name: site.name, currentVersionId: site.currentVersionId, versions: site.versions },
+    () => renderTable(site.versions, [
+      { header: "", value: (v) => v.id === site.currentVersionId ? "*" : " " },
+      { header: "VERSION", value: (v) => v.id },
+      { header: "FILES", value: (v) => v.fileCount },
+      { header: "SIZE", value: (v) => formatBytes(v.totalBytes) },
+      { header: "CREATED", value: (v) => formatDate(v.createdAt) }
+    ])
+  );
+}
+async function runFiles(ctx, name, versionId) {
+  const result = await versionFiles(requireClient(ctx), name, versionId);
+  if (!result.files.some((f) => f.path === "index.html")) {
+    ctx.log.warn("No index.html at the root \u2014 the site root URL will 404");
+  }
+  ctx.out.data(result, () => {
+    const n = result.files.length;
+    const header = chalk9.dim(
+      `${result.versionId}${result.current ? " (current)" : " (not served)"} \u2014 ${n} file${n === 1 ? "" : "s"}, ${formatBytes(result.totalBytes)}${result.generatedIndex ? ", generated index.html" : ""}`
+    );
+    const table = renderTable(result.files, [
+      { header: "PATH", value: (f) => f.path },
+      { header: "SIZE", value: (f) => formatBytes(f.size) },
+      { header: "TYPE", value: (f) => f.contentType }
+    ]);
+    return `${header}
+${table}`;
+  });
+}
+async function runRollback(ctx, name, versionId) {
+  const site = await rollback(requireClient(ctx), name, versionId);
+  ctx.log.success(`${name} now serves version ${site.currentVersionId ?? versionId}`);
+  ctx.out.data(site, () => site.url);
+}
+async function runShare(ctx, name, opts) {
+  if (opts.refresh && opts.revoke) throw new CliError("Use either --refresh or --revoke, not both");
+  const client = requireClient(ctx);
+  const result = await share(client, name, opts);
+  let ready;
+  if (result.action === "created" || result.action === "refreshed") {
+    const files = ctx.waitReady ? await versionFiles(client, name).catch(() => null) : null;
+    ready = (await waitWithSpinner(ctx.waitReady, result.shareUrl, files?.files.map((f) => f.path) ?? [], {
+      progress: ctx.progress,
+      warn: (m) => ctx.log.warn(m)
+    })).ready;
+  }
+  if (result.action === "revoked") ctx.log.success(`Share link for ${name} revoked`);
+  else if (result.action === "refreshed")
+    ctx.log.success("New share link \u2014 the old one no longer works");
+  else if (result.action === "created")
+    ctx.log.success("Share link created \u2014 anyone with it can view the site");
+  ctx.out.data(
+    ready === void 0 ? result : { ...result, ready },
+    () => result.shareUrl ? result.shareUrl : chalk9.dim("(no share link)")
+  );
+}
+async function runVisibility(ctx, name, visibility) {
+  if (visibility !== "private" && visibility !== "public") {
+    throw new CliError(`Visibility must be "private" or "public", not "${visibility}"`);
+  }
+  const site = await setVisibility(requireClient(ctx), name, visibility);
+  ctx.log.success(
+    site.visibility === "public" ? `${name} is public \u2014 no sign-in needed` : `${name} is private \u2014 sign-in required`
+  );
+  ctx.out.data(site, () => site.url);
+}
+async function runArchive(ctx, name, unarchive = false) {
+  const site = await archiveSite(requireClient(ctx), name, { unarchive });
+  ctx.log.success(
+    unarchive ? `${name} restored` : `${name} archived \u2014 it 404s until \`fling unarchive ${name}\``
+  );
+  if (ctx.json) ctx.out.data(site, () => "");
+  else if (unarchive) ctx.out.text(site.url);
+}
+async function runRemove(ctx, name, opts) {
+  if (!opts.yes) {
+    if (!ctx.interactive) {
+      throw new CliError(`Refusing to delete ${name} without confirmation`, {
+        hint: "Pass --yes to delete."
+      });
+    }
+    const ok = await ctx.confirm(`Delete ${name} and every version of it? This cannot be undone.`);
+    if (!ok) throw new CliError("Cancelled");
+  }
+  const result = await deleteSite(requireClient(ctx), name);
+  ctx.log.success(`${name} deleted`);
+  if (ctx.json) ctx.out.data(result, () => "");
+}
+
+// src/mcp.ts
+import { mkdir as mkdir3, mkdtemp as mkdtemp3, rm as rm2, writeFile as writeFile4 } from "node:fs/promises";
+import { tmpdir as tmpdir3 } from "node:os";
+import { basename as basename3, dirname as dirname2, join as join6 } from "node:path";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z as z11 } from "zod";
+
+// src/locate.ts
+import { lstat, readdir as readdir2, readFile as readFile6, realpath as realpath3, stat as stat5 } from "node:fs/promises";
+import { posix, win32 } from "node:path";
+import { fileURLToPath } from "node:url";
+var DOWNLOADS_DIR_ENV = "FLING_DOWNLOADS_DIR";
+var FOUND_AS_GIVEN = "path";
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", "__MACOSX", "Library", "AppData", "$RECYCLE.BIN"]);
+var SESSION_SKIP_DIRS = /* @__PURE__ */ new Set(["skills-plugin", "rpm", "uploads", "memory"]);
+var SESSIONS_DEPTH = 4;
+var OUTPUTS_DEPTH = 4;
+var SANDBOX_PATH_RE = /^\/(mnt\/user-data|mnt\/data|sessions|home\/claude|tmp\/outputs)(\/|$)/;
+var nodeFs = {
+  async stat(path3) {
+    try {
+      const s = await stat5(path3);
+      return { isFile: s.isFile(), isDirectory: s.isDirectory(), mtimeMs: s.mtimeMs, size: s.size };
+    } catch {
+      return null;
+    }
+  },
+  async readdir(path3) {
+    try {
+      const entries = await readdir2(path3, { withFileTypes: true });
+      const out = [];
+      for (const e of entries) {
+        if (e.isSymbolicLink()) {
+          const s = await stat5(`${path3}/${e.name}`).catch(() => null);
+          out.push({ name: e.name, isFile: Boolean(s?.isFile()), isDirectory: false });
+        } else out.push({ name: e.name, isFile: e.isFile(), isDirectory: e.isDirectory() });
+      }
+      return out;
+    } catch {
+      return [];
+    }
+  },
+  async realpath(path3) {
+    return realpath3(path3).catch(() => null);
+  },
+  async readText(path3) {
+    try {
+      if (!(await lstat(path3)).isFile()) return null;
+      return await readFile6(path3, "utf8");
+    } catch {
+      return null;
+    }
+  }
+};
+var pathFor = (platform) => platform === "win32" ? win32 : posix;
+var usable = (value) => Boolean(value?.trim()) && !value?.trim().startsWith("${");
+async function xdgUserDir(key, opts, fs) {
+  const fromEnv2 = opts.env[`XDG_${key}_DIR`];
+  if (usable(fromEnv2)) return fromEnv2;
+  const configHome = opts.env.XDG_CONFIG_HOME || posix.join(opts.home, ".config");
+  const text2 = await fs.readText(posix.join(configHome, "user-dirs.dirs"));
+  const match = text2?.match(new RegExp(`^XDG_${key}_DIR="([^"]*)"`, "m"));
+  if (!match?.[1]) return void 0;
+  return match[1].replace(/^\$HOME(?=\/|$)/, opts.home);
+}
+async function searchRoots(opts) {
+  const fs = opts.fs ?? nodeFs;
+  const p = pathFor(opts.platform);
+  const { home, env, platform } = opts;
+  const userHome = platform === "win32" && usable(env.USERPROFILE) ? env.USERPROFILE : home;
+  const roots = [];
+  const add = (label, path3, depth, sessions = false) => {
+    if (!path3) return;
+    const norm = p.resolve(path3);
+    if (roots.some((r) => r.path === norm)) return;
+    roots.push({ label, path: norm, depth, ...sessions ? { sessions } : {} });
+  };
+  const cwd = p.resolve(opts.cwd);
+  if (cwd !== p.parse(cwd).root && cwd !== p.resolve(userHome)) add("current folder", cwd, 4);
+  const configured = usable(opts.downloadsDir) ? opts.downloadsDir : usable(env[DOWNLOADS_DIR_ENV]) ? env[DOWNLOADS_DIR_ENV] : void 0;
+  const defaultDownloads = platform === "linux" ? await xdgUserDir("DOWNLOAD", opts, fs) ?? p.join(home, "Downloads") : p.join(userHome, "Downloads");
+  add("Downloads", configured ? expandHome(configured, home, platform) : defaultDownloads, 3);
+  add("Downloads", defaultDownloads, 3);
+  const desktop = platform === "linux" ? await xdgUserDir("DESKTOP", opts, fs) ?? p.join(home, "Desktop") : p.join(userHome, "Desktop");
+  add("Desktop", desktop, 3);
+  if (platform === "win32" && usable(env.OneDrive))
+    add("Desktop", p.join(env.OneDrive, "Desktop"), 3);
+  const documents = platform === "linux" ? await xdgUserDir("DOCUMENTS", opts, fs) ?? p.join(home, "Documents") : p.join(userHome, "Documents");
+  add("Documents/Claude", p.join(documents, "Claude"), 4);
+  add("~/Claude", p.join(userHome, "Claude"), 4);
+  const claudeConfig = platform === "darwin" ? p.join(home, "Library", "Application Support", "Claude") : platform === "win32" ? p.join(
+    usable(env.APPDATA) ? env.APPDATA : p.join(userHome, "AppData", "Roaming"),
+    "Claude"
+  ) : p.join(env.XDG_CONFIG_HOME || p.join(home, ".config"), "Claude");
+  add(
+    "Claude Desktop outputs",
+    p.join(claudeConfig, "local-agent-mode-sessions"),
+    SESSIONS_DEPTH,
+    true
+  );
+  if (!fs.realpath) return roots;
+  const real = [];
+  for (const root of roots) {
+    const path3 = await fs.realpath(root.path) ?? root.path;
+    if (!real.some((r) => r.path === path3)) real.push({ ...root, path: path3 });
+  }
+  return real;
+}
+function expandHome(input, home, platform) {
+  if (input === "~") return home;
+  if (input.startsWith("~/") || platform === "win32" && input.startsWith("~\\"))
+    return pathFor(platform).join(home, input.slice(2));
+  return input;
+}
+async function walk(roots, opts, visit) {
+  const fs = opts.fs ?? nodeFs;
+  const p = pathFor(opts.platform);
+  const now = opts.now ?? Date.now;
+  const deadline = now() + (opts.timeBudgetMs ?? 4e3);
+  let budget = opts.entryBudget ?? 6e4;
+  const skip = (name) => name.startsWith(".") || SKIP_DIRS.has(name);
+  const expanded = [];
+  for (const root of roots) {
+    if (!root.sessions) {
+      expanded.push(root);
+      continue;
+    }
+    let level = [root.path];
+    for (let depth = 0; depth < root.depth && level.length; depth++) {
+      const next = [];
+      for (const dir of level) {
+        for (const e of await fs.readdir(dir)) {
+          if (!e.isDirectory || skip(e.name) || SESSION_SKIP_DIRS.has(e.name)) continue;
+          const child = p.join(dir, e.name);
+          if (e.name === "outputs")
+            expanded.push({ label: root.label, path: child, depth: OUTPUTS_DEPTH });
+          else next.push(child);
+        }
+      }
+      level = next;
+    }
+  }
+  for (const root of expanded) {
+    let level = [root.path];
+    for (let depth = 0; depth <= root.depth && level.length; depth++) {
+      const next = [];
+      for (const dir of level) {
+        if (now() > deadline || budget <= 0) return { complete: false };
+        const entries = await fs.readdir(dir);
+        budget -= entries.length;
+        for (const entry of entries) {
+          if (entry.name.startsWith(".")) continue;
+          const path3 = p.join(dir, entry.name);
+          const result = await visit({ root, path: path3, entry, siblings: entries });
+          if (entry.isDirectory && !skip(entry.name) && result !== "skip" && depth < root.depth)
+            next.push(path3);
+        }
+      }
+      level = next;
+    }
+  }
+  return { complete: true };
+}
+function withoutDuplicateSuffix(name) {
+  return name.replace(/ \(\d+\)(?=\.[^.]+$|$)/, "");
 }
-async function runVersions(ctx, name) {
-  const site = await getSite(requireClient(ctx), name);
-  ctx.out.data(
-    { name: site.name, currentVersionId: site.currentVersionId, versions: site.versions },
-    () => renderTable(site.versions, [
-      { header: "", value: (v) => v.id === site.currentVersionId ? "*" : " " },
-      { header: "VERSION", value: (v) => v.id },
-      { header: "FILES", value: (v) => v.fileCount },
-      { header: "SIZE", value: (v) => formatBytes(v.totalBytes) },
-      { header: "CREATED", value: (v) => formatDate(v.createdAt) }
-    ])
-  );
+function namesMatch(candidate, wanted) {
+  const a = candidate.toLowerCase();
+  const b = wanted.toLowerCase();
+  return a === b || withoutDuplicateSuffix(a) === withoutDuplicateSuffix(b);
 }
-async function runFiles(ctx, name, versionId) {
-  const result = await versionFiles(requireClient(ctx), name, versionId);
-  if (!result.files.some((f) => f.path === "index.html")) {
-    ctx.log.warn("No index.html at the root \u2014 the site root URL will 404");
+var splitSegments = (path3) => path3.split(/[\\/]+/).filter((s) => s !== "" && s !== "." && s !== "~");
+function suffixScore(path3, wanted) {
+  const have = splitSegments(path3);
+  let score = 1;
+  for (let i = 2; i <= Math.min(have.length, wanted.length); i++) {
+    if (have[have.length - i]?.toLowerCase() !== wanted[wanted.length - i]?.toLowerCase()) break;
+    score++;
   }
-  ctx.out.data(result, () => {
-    const n = result.files.length;
-    const header = chalk6.dim(
-      `${result.versionId}${result.current ? " (current)" : " (not served)"} \u2014 ${n} file${n === 1 ? "" : "s"}, ${formatBytes(result.totalBytes)}${result.generatedIndex ? ", generated index.html" : ""}`
-    );
-    const table = renderTable(result.files, [
-      { header: "PATH", value: (f) => f.path },
-      { header: "SIZE", value: (f) => formatBytes(f.size) },
-      { header: "TYPE", value: (f) => f.contentType }
-    ]);
-    return `${header}
-${table}`;
-  });
-}
-async function runRollback(ctx, name, versionId) {
-  const site = await rollback(requireClient(ctx), name, versionId);
-  ctx.log.success(`${name} now serves version ${site.currentVersionId ?? versionId}`);
-  ctx.out.data(site, () => site.url);
+  return score;
 }
-async function runShare(ctx, name, opts) {
-  if (opts.refresh && opts.revoke) throw new CliError("Use either --refresh or --revoke, not both");
-  const client = requireClient(ctx);
-  const result = await share(client, name, opts);
-  let ready;
-  if (result.action === "created" || result.action === "refreshed") {
-    const files = ctx.waitReady ? await versionFiles(client, name).catch(() => null) : null;
-    ready = (await waitWithSpinner(ctx.waitReady, result.shareUrl, files?.files.map((f) => f.path) ?? [], {
-      progress: ctx.progress,
-      warn: (m) => ctx.log.warn(m)
-    })).ready;
+var looksLikeSandboxPath = (input) => SANDBOX_PATH_RE.test(input.replace(/\\/g, "/"));
+function normaliseInput(raw, opts) {
+  let input = raw.trim().replace(/^(["'])(.*)\1$/, "$2");
+  if (input.startsWith("file://")) {
+    try {
+      input = fileURLToPath(input, { windows: opts.platform === "win32" });
+    } catch {
+      input = decodeURIComponent(input.slice("file://".length));
+    }
   }
-  if (result.action === "revoked") ctx.log.success(`Share link for ${name} revoked`);
-  else if (result.action === "refreshed")
-    ctx.log.success("New share link \u2014 the old one no longer works");
-  else if (result.action === "created")
-    ctx.log.success("Share link created \u2014 anyone with it can view the site");
-  ctx.out.data(
-    ready === void 0 ? result : { ...result, ready },
-    () => result.shareUrl ? result.shareUrl : chalk6.dim("(no share link)")
-  );
+  return expandHome(input, opts.home, opts.platform);
 }
-async function runVisibility(ctx, name, visibility) {
-  if (visibility !== "private" && visibility !== "public") {
-    throw new CliError(`Visibility must be "private" or "public", not "${visibility}"`);
+async function resolveInput(input, opts) {
+  const fs = opts.fs ?? nodeFs;
+  const p = pathFor(opts.platform);
+  const given = normaliseInput(input, opts);
+  if (!given) throw new CliError("No path given");
+  const direct = p.isAbsolute(given) ? p.normalize(given) : p.resolve(opts.cwd, given);
+  const directStat = await fs.stat(direct);
+  if (directStat && (directStat.isFile || directStat.isDirectory)) {
+    return {
+      path: direct,
+      foundIn: FOUND_AS_GIVEN,
+      isDirectory: directStat.isDirectory,
+      alternatives: []
+    };
   }
-  const site = await setVisibility(requireClient(ctx), name, visibility);
-  ctx.log.success(
-    site.visibility === "public" ? `${name} is public \u2014 no sign-in needed` : `${name} is private \u2014 Nearform sign-in required`
-  );
-  ctx.out.data(site, () => site.url);
+  const wanted = splitSegments(given);
+  const name = wanted.at(-1);
+  const roots = await searchRoots(opts);
+  if (!name) throw notFound(input, roots);
+  const found = [];
+  const seen = /* @__PURE__ */ new Set();
+  await walk(roots, opts, async ({ root, path: path3, entry }) => {
+    if (!(entry.isFile || entry.isDirectory) || !namesMatch(entry.name, name)) return;
+    if (seen.has(path3)) return;
+    seen.add(path3);
+    const s = await fs.stat(path3);
+    if (!s) return;
+    found.push({
+      path: path3,
+      foundIn: root.label,
+      kind: s.isDirectory ? "folder" : "file",
+      modified: new Date(s.mtimeMs).toISOString(),
+      size: s.size,
+      score: suffixScore(path3, wanted),
+      mtimeMs: s.mtimeMs,
+      isDirectory: s.isDirectory
+    });
+    return void 0;
+  });
+  if (found.length === 0) throw notFound(input, roots);
+  found.sort((a, b) => b.score - a.score || b.mtimeMs - a.mtimeMs);
+  const strip = ({ score: _s, mtimeMs: _m, isDirectory: _d, ...c }) => c;
+  const [best, ...rest] = found;
+  return {
+    path: best.path,
+    foundIn: best.foundIn,
+    isDirectory: best.isDirectory,
+    alternatives: rest.slice(0, 5).map(strip)
+  };
 }
-async function runArchive(ctx, name, unarchive = false) {
-  const site = await archiveSite(requireClient(ctx), name, { unarchive });
-  ctx.log.success(
-    unarchive ? `${name} restored` : `${name} archived \u2014 it 404s until \`fling unarchive ${name}\``
-  );
-  if (ctx.json) ctx.out.data(site, () => "");
-  else if (unarchive) ctx.out.text(site.url);
+function notFound(input, roots) {
+  const where = roots.map((r) => `${r.label} (${r.path})`).join(", ");
+  const sandbox = looksLikeSandboxPath(input) ? " That looks like a path inside Claude\u2019s sandbox, which this computer cannot see: publish the content inline with fling_publish, or save/download the file to this computer first." : "";
+  return new CliError(`Could not find "${input}". Looked for it by name in: ${where}.${sandbox}`, {
+    hint: "Pass the full path, or save the file to your Downloads folder and use just its name."
+  });
 }
-async function runRemove(ctx, name, opts) {
-  if (!opts.yes) {
-    if (!ctx.interactive) {
-      throw new CliError(`Refusing to delete ${name} without confirmation`, {
-        hint: "Pass --yes to delete."
-      });
+var LISTED_EXT = /\.(html?|zip)$/i;
+async function findFiles(opts, find = {}) {
+  const fs = opts.fs ?? nodeFs;
+  const p = pathFor(opts.platform);
+  const now = (opts.now ?? Date.now)();
+  const since = now - (find.days ?? 14) * 24 * 60 * 60 * 1e3;
+  const query = find.query?.trim().toLowerCase();
+  const roots = await searchRoots(opts);
+  const found = /* @__PURE__ */ new Map();
+  const rootPaths = new Set(roots.map((r) => r.path));
+  const { complete } = await walk(roots, opts, async ({ root, path: path3, entry }) => {
+    if (entry.isDirectory) {
+      if (rootPaths.has(path3)) return;
+      const index = (await fs.readdir(path3)).find((e) => e.isFile && /^index\.html?$/i.test(e.name));
+      if (!index) return;
+      const s2 = await fs.stat(p.join(path3, index.name));
+      if (s2 && s2.mtimeMs >= since && (!query || entry.name.toLowerCase().includes(query)))
+        found.set(path3, {
+          path: path3,
+          foundIn: root.label,
+          kind: "folder",
+          modified: new Date(s2.mtimeMs).toISOString(),
+          size: s2.size,
+          mtimeMs: s2.mtimeMs
+        });
+      return "skip";
     }
-    const ok = await ctx.confirm(`Delete ${name} and every version of it? This cannot be undone.`);
-    if (!ok) throw new CliError("Cancelled");
-  }
-  const result = await deleteSite(requireClient(ctx), name);
-  ctx.log.success(`${name} deleted`);
-  if (ctx.json) ctx.out.data(result, () => "");
+    if (!entry.isFile || !LISTED_EXT.test(entry.name)) return;
+    if (query && !entry.name.toLowerCase().includes(query)) return;
+    const s = await fs.stat(path3);
+    if (!s || s.mtimeMs < since || found.has(path3)) return;
+    found.set(path3, {
+      path: path3,
+      foundIn: root.label,
+      kind: "file",
+      modified: new Date(s.mtimeMs).toISOString(),
+      size: s.size,
+      mtimeMs: s.mtimeMs
+    });
+    return void 0;
+  });
+  const files = [...found.values()].sort((a, b) => b.mtimeMs - a.mtimeMs).slice(0, find.limit ?? 20).map(({ mtimeMs: _m, ...c }) => c);
+  return { files, searched: roots, complete };
 }
 
 // src/mcp.ts
-import { mkdir as mkdir3, mkdtemp as mkdtemp2, rm as rm2, writeFile as writeFile3 } from "node:fs/promises";
-import { tmpdir as tmpdir2 } from "node:os";
-import { basename as basename3, dirname as dirname2, join as join5 } from "node:path";
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { z as z7 } from "zod";
-var LOGIN_HINT = `Not logged in to Fling. Call fling_login (it opens the browser to sign in with Nearform Google), or ask the user to run \`${NPX_COMMAND} login\` in a terminal (in Claude Code: \`! ${NPX_COMMAND} login\`), then try again.`;
-var MCP_LOCAL_INSTRUCTIONS = [
-  "Fling publishes static sites (HTML/CSS/JS, images, documents) for Nearform staff at https://<name>.fling.labs.nearform.com. This server runs on the user's computer.",
+var LOGIN_HINT = `Not logged in to Fling. Call fling_login (it opens the browser to sign in), or ask the user to run \`${NPX_COMMAND} login\` in a terminal (in Claude Code: \`! ${NPX_COMMAND} login\`), then try again.`;
+var NO_SERVER_HINT = `No Fling server is set up on this computer. Ask the user for their Fling's address and to run \`${NPX_COMMAND} login <url>\` in a terminal (in Claude Code: \`! ${NPX_COMMAND} login <url>\`), then try again.`;
+var mcpLocalInstructions = (w, opts = {}) => [
+  `${w.name} publishes static sites (HTML/CSS/JS, images, documents) at ${w.sitesPattern}. This server runs on the user's computer.`,
   "Content you created in this conversation (an HTML page, a report, a small app): call fling_publish with every file inline (text as utf8, binary as base64). Never pass file paths from your sandbox (e.g. /mnt/user-data/outputs/\u2026, /sessions/\u2026) \u2014 this computer cannot see them \u2014 and never curl or upload from the sandbox.",
   'A file or folder the user has on this computer (a downloaded .html, a .zip, a build folder): call fling_deploy with its path, or just its file name (e.g. "Pitch Deck.html") \u2014 it is looked up in Downloads, Desktop, Documents/Claude and Claude Desktop output folders. Use fling_find_files to see recent candidates when unsure which file the user means.',
   "Confirm the site name with the user before publishing (fling_check_name shows whether it is free and, for a path, the generated name). Names are global, first come first served; when one is taken, offer the suggestions.",
   "When there is no index.html but there are HTML pages, fling_deploy and fling_publish do not publish: ask the user whether to generate an index page listing the pages (`listHtml: true`) or publish without one (`listHtml: false`, the root URL 404s), then retry.",
   NEVER_PUBLISHED,
   "Not logged in? Call fling_login, let the user finish signing in in the browser, then retry.",
-  "Sites are private (Nearformers only) by default; only make one public if asked. Use fling_share for a link people outside Nearform can open. Always give the user the URL that comes back."
+  `Sites are private (only ${w.privateAudience}) by default; only make one public if asked. Use fling_share for a link people who cannot sign in can open. ${opts.comments ? "Always give the user the links that come back: the review link first, as the one to share for feedback, then the site URL." : "Always give the user the URL that comes back."}`,
+  ...opts.comments ? [COMMENTS_NOTE(w)] : []
 ].join("\n\n");
 var toolDef = (def) => ({
   title: def.title,
@@ -2890,6 +3687,8 @@ function createMcpServer(deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const locate = deps.locate ?? { ...systemLocateOptions(), cwd };
   const waitReady = deps.waitReady ?? createReadyWaiter();
+  const wording = mcpWording(deps.instance);
+  const mcpTools2 = mcpToolsFor(wording);
   async function edgeReady(url, paths) {
     const r = await waitReady(url, paths).catch(() => ({ ready: false, waitedMs: 0 }));
     return {
@@ -2900,9 +3699,14 @@ Not reachable yet at ${url}: ${NOT_READY_NOTE}.`
   }
   async function client() {
     const config = await store.resolve({ serverUrl: deps.server });
+    if (!config.serverUrl) throw new NoServerError("fling");
     if (!config.apiKey) throw new CliError("Not logged in", { exitCode: EXIT_NOT_LOGGED_IN });
     return createApiClient({ serverUrl: config.serverUrl, apiKey: config.apiKey, fetch: fetchImpl });
   }
+  async function sitesBase() {
+    const config = await store.resolve({ serverUrl: deps.server });
+    return sitesBaseOf(await loadInstance(store, config, fetchImpl));
+  }
   async function run(op) {
     try {
       const { summary, data } = await op(await client());
@@ -2958,9 +3762,15 @@ Warnings:
       result.url,
       local.files.map((f) => f.path)
     );
+    const instance = deps.instance;
+    const review = instance && commentsEnabled(instance) ? reviewUrl(instance.appOrigin, result.name) : void 0;
+    const listing = generatedIndex ? " \u2014 with a generated index.html listing the HTML pages" : "";
+    const head = review ? `${what}${listing}.
+${shareForFeedback(review, instance?.name ?? "Fling")}
+Site: ${result.url} (${result.site.visibility})` : `${what}: ${result.url} (${result.site.visibility})${listing}`;
     return {
       kind: "deployed",
-      summary: `${what}: ${result.url} (${result.site.visibility})${generatedIndex ? " \u2014 with a generated index.html listing the HTML pages" : ""}${warnings}${skippedNote}${edge.note}
+      summary: `${head}${warnings}${skippedNote}${edge.note}
 To check exactly which files the site has, call fling_files with name "${result.name}".`,
       data: {
         status: result.status,
@@ -2969,6 +3779,7 @@ To check exactly which files the site has, call fling_files with name "${result.
         nameGenerated: !opts.nameGiven,
         versionId: result.versionId,
         site: result.site,
+        ...review ? { reviewUrl: review } : {},
         generatedIndex,
         warnings: result.warnings,
         skipped: local.skipped
@@ -2977,23 +3788,27 @@ To check exactly which files the site has, call fling_files with name "${result.
   }
   const server = new McpServer(
     { name: "fling", version: VERSION },
-    { instructions: MCP_LOCAL_INSTRUCTIONS }
+    {
+      instructions: mcpLocalInstructions(wording, {
+        comments: commentsEnabled(deps.instance)
+      })
+    }
   );
-  const { listHtml: listHtml2, spa: spa2, public: isPublic2 } = mcpTools.publish.inputSchema;
+  const { listHtml: listHtml2, spa: spa2, public: isPublic } = mcpTools2.publish.inputSchema;
   server.registerTool(
     "fling_deploy",
     {
       title: "Deploy a file or folder from this computer",
-      description: 'Fling something that is on the user\'s computer and return its stable URL (https://<name>.fling.labs.nearform.com): a folder of static files (e.g. a build output like dist/), a single .html file (served as the site\'s index.html), a .zip of a site (extracted; a single top-level folder is unwrapped), or any other single file (.pdf, .svg, .png\u2026, served next to a generated page that shows it). `path` can be absolute, relative to the working directory, or just a file name ("Pitch Deck.html"): names are looked up, newest first, in Downloads, Desktop, Documents/Claude and Claude Desktop output folders, and the result says where the file was found. Never pass paths from your own sandbox (/mnt/user-data/\u2026, /sessions/\u2026): for content you created, use fling_publish. Without `name`, a name is generated: from the file name for files ("Pitch Deck (1).html" \u2192 pitch-deck), from the project and folder for folders (~/work/rocketpod/docs \u2192 rocketpod-docs). Site names are one global namespace, first come first served \u2014 confirm the name with the user first (fling_check_name with `path` shows the generated one). If the name is taken it fails with free suggestions \u2014 ask the user to pick one, then retry with `name`. If there is no index.html but there are HTML pages, it does not deploy: ask the user whether to generate an index page listing them (`listHtml: true`) or deploy without one (`listHtml: false`), then retry. Re-deploying identical content is a no-op. Sites are private to signed-in Nearformers unless `public` is set. ' + NEVER_PUBLISHED,
+      description: `Fling something that is on the user's computer and return its stable URL (${wording.sitesPattern}): a folder of static files (e.g. a build output like dist/), a single .html file (served as the site's index.html), a .zip of a site (extracted; a single top-level folder is unwrapped), or any other single file (.pdf, .svg, .png\u2026, served next to a generated page that shows it). \`path\` can be absolute, relative to the working directory, or just a file name ("Pitch Deck.html"): names are looked up, newest first, in Downloads, Desktop, Documents/Claude and Claude Desktop output folders, and the result says where the file was found. Never pass paths from your own sandbox (/mnt/user-data/\u2026, /sessions/\u2026): for content you created, use fling_publish. Without \`name\`, a name is generated: from the file name for files ("Pitch Deck (1).html" \u2192 pitch-deck), from the project and folder for folders (~/work/rocketpod/docs \u2192 rocketpod-docs). Site names are one global namespace, first come first served \u2014 confirm the name with the user first (fling_check_name with \`path\` shows the generated one). If the name is taken it fails with free suggestions \u2014 ask the user to pick one, then retry with \`name\`. If there is no index.html but there are HTML pages, it does not deploy: ask the user whether to generate an index page listing them (\`listHtml: true\`) or deploy without one (\`listHtml: false\`), then retry. Re-deploying identical content is a no-op. Sites are private (only ${wording.privateAudience}) unless \`public\` is set. ` + NEVER_PUBLISHED,
       inputSchema: {
-        path: z7.string().min(1).describe(
+        path: z11.string().min(1).describe(
           "File or folder on this computer: absolute, relative to the working directory, or just its name (looked up in Downloads, Desktop and Claude output folders)"
         ),
-        name: z7.string().optional().describe(
+        name: z11.string().optional().describe(
           "Site name (lowercase letters, digits, single hyphens; max 50). Defaults to a name generated from the file or folder"
         ),
         spa: spa2,
-        public: isPublic2,
+        public: isPublic,
         listHtml: listHtml2
       },
       annotations: { destructiveHint: false, idempotentHint: true, openWorldHint: true }
@@ -3038,9 +3853,9 @@ To check exactly which files the site has, call fling_files with name "${result.
       title: "Find files to fling",
       description: "List recent things on this computer that could be flung, newest first: .html/.htm and .zip files, and folders containing an index.html, from the working directory, Downloads, Desktop, Documents/Claude, ~/Claude and Claude Desktop output folders. Each has its path, where it was found, size and modified time. Use it when the user refers to a file they downloaded or that Claude Desktop saved, then pass the chosen path (or name) to fling_deploy.",
       inputSchema: {
-        query: z7.string().optional().describe('Only names containing this text (case-insensitive), e.g. "deck"'),
-        limit: z7.number().int().min(1).max(100).optional().describe("Max results (default 20)"),
-        days: z7.number().int().min(1).max(3650).optional().describe("Only things modified in the last N days (default 14)")
+        query: z11.string().optional().describe('Only names containing this text (case-insensitive), e.g. "deck"'),
+        limit: z11.number().int().min(1).max(100).optional().describe("Max results (default 20)"),
+        days: z11.number().int().min(1).max(3650).optional().describe("Only things modified in the last N days (default 14)")
       },
       annotations: { readOnlyHint: true, openWorldHint: false }
     },
@@ -3067,7 +3882,7 @@ ${JSON.stringify(data, null, 2)}` }]
       }
     }
   );
-  const publishDef = mcpTools.publish;
+  const publishDef = mcpTools2.publish;
   server.registerTool(
     publishDef.name,
     {
@@ -3080,7 +3895,7 @@ ${JSON.stringify(data, null, 2)}` }]
     },
     (args) => run(async (c) => {
       const name = resolveSiteName(".", args.name);
-      const tmp = await mkdtemp2(join5(tmpdir2(), "fling-publish-"));
+      const tmp = await mkdtemp3(join6(tmpdir3(), "fling-publish-"));
       try {
         const { skippedDotfiles } = await writeInlineFiles(tmp, args.files);
         const outcome = await deployFolder(c, tmp, {
@@ -3101,11 +3916,11 @@ ${JSON.stringify(data, null, 2)}` }]
   server.registerTool(
     "fling_check_name",
     {
-      ...toolDef(mcpTools.checkName),
-      description: `${mcpTools.checkName.description} Pass \`path\` instead of \`name\` to see the name fling_deploy would generate for a file or folder on this computer (same lookup as fling_deploy), so you can confirm it with the user.`,
+      ...toolDef(mcpTools2.checkName),
+      description: `${mcpTools2.checkName.description} Pass \`path\` instead of \`name\` to see the name fling_deploy would generate for a file or folder on this computer (same lookup as fling_deploy), so you can confirm it with the user.`,
       inputSchema: {
-        name: z7.string().min(1).max(200).optional().describe("Site name to check"),
-        path: z7.string().optional().describe("File or folder whose generated default name to check (path or file name)")
+        name: z11.string().min(1).max(200).optional().describe("Site name to check"),
+        path: z11.string().optional().describe("File or folder whose generated default name to check (path or file name)")
       }
     },
     (args) => run(async (c) => {
@@ -3117,20 +3932,20 @@ ${JSON.stringify(data, null, 2)}` }]
         source = await resolveInput(args.path, locate);
         name = defaultNameFor(source.path, source.isDirectory);
       }
-      const check = await checkName(c, name);
-      const base = check.status === "invalid" ? null : await discoverSitesBase(c);
+      const check2 = await checkName(c, name);
+      const base = check2.status === "invalid" ? null : await sitesBase();
       const url = base ? siteUrlFor(name, base) : null;
-      const suggestions = check.suggestions.length ? ` Suggestions: ${check.suggestions.join(", ")}.` : "";
+      const suggestions = check2.suggestions.length ? ` Suggestions: ${check2.suggestions.join(", ")}.` : "";
       const summary = {
         available: `"${name}" is available${url ? ` \u2192 ${url}` : ""}.`,
         yours: `"${name}" is the user's existing site${url ? ` (${url})` : ""} \u2014 deploying updates it.`,
         taken: `"${name}" is taken by someone else.${suggestions}`,
         invalid: `"${name}" is not a valid site name.${suggestions}`
-      }[check.status];
+      }[check2.status];
       return {
         summary,
         data: {
-          ...check,
+          ...check2,
           url,
           ...source ? { generated: true, source: { path: source.path, foundIn: source.foundIn } } : {}
         }
@@ -3142,17 +3957,19 @@ ${JSON.stringify(data, null, 2)}` }]
     "fling_login",
     {
       title: "Sign in to Fling",
-      description: "Sign the user in to Fling: opens their browser at the Fling sign-in page (Nearform Google account) and stores the key on this computer (shared with the fling CLI). Waits up to ~30 seconds; if sign-in is not finished by then, it keeps waiting in the background for up to 5 minutes \u2014 tell the user to finish signing in in the browser, then retry what you were doing. Call it when another tool says the user is not logged in.",
+      description: `Sign the user in to ${wording.name}: opens their browser to sign in with ${wording.signIn} and stores the key on this computer (shared with the fling CLI). Waits up to ~30 seconds; if sign-in is not finished by then, it keeps waiting in the background for up to 5 minutes \u2014 tell the user to finish signing in in the browser, then retry what you were doing. Call it when another tool says the user is not logged in.`,
       inputSchema: {},
       annotations: { readOnlyHint: false, openWorldHint: true }
     },
     async () => {
       try {
         const config = await store.resolve({ serverUrl: deps.server });
+        const serverUrl = config.serverUrl;
+        if (!serverUrl) throw new NoServerError("fling");
         if (config.apiKey && !pendingLogin) {
           const me = await whoami(
             createApiClient({
-              serverUrl: config.serverUrl,
+              serverUrl,
               apiKey: config.apiKey,
               fetch: fetchImpl
             })
@@ -3164,7 +3981,7 @@ ${JSON.stringify(data, null, 2)}` }]
             done: Promise.resolve()
           };
           login.done = loginFlow({
-            serverUrl: config.serverUrl,
+            serverUrl,
             store,
             log: silentLogger,
             open: deps.open ?? (async (url) => (await import("open")).default(url)),
@@ -3199,7 +4016,7 @@ ${JSON.stringify(data, null, 2)}` }]
       }
     }
   );
-  const t = mcpTools;
+  const t = mcpTools2;
   server.registerTool(
     t.list.name,
     toolDef(t.list),
@@ -3284,12 +4101,66 @@ ${JSON.stringify(data, null, 2)}` }]
       };
     })
   );
+  if (deps.instance && commentsEnabled(deps.instance)) {
+    const appOrigin = deps.instance.appOrigin;
+    const review = (name) => reviewUrl(appOrigin, name);
+    server.registerTool(
+      t.commentsList.name,
+      toolDef(t.commentsList),
+      (args) => run(async (c) => {
+        const list = await listComments(c, args.name, { path: args.path });
+        const reviewPage2 = review(list.site.name);
+        return {
+          summary: describeComments(list, {
+            includeResolved: args.includeResolved,
+            reviewUrl: reviewPage2
+          }),
+          data: { ...list, reviewUrl: reviewPage2 }
+        };
+      })
+    );
+    server.registerTool(
+      t.commentAdd.name,
+      toolDef(t.commentAdd),
+      (args) => run(async (c) => {
+        const comment = await addComment(c, args.name, {
+          body: args.body,
+          path: args.path,
+          parentId: args.replyTo
+        });
+        const what = comment.parentId ? `Replied to thread ${comment.parentId}` : "Comment added";
+        return {
+          summary: `${what} on ${args.name} (${comment.path}, id ${comment.id}). Review page: ${review(args.name)}`,
+          data: comment
+        };
+      })
+    );
+    server.registerTool(
+      t.commentResolve.name,
+      toolDef(t.commentResolve),
+      (args) => run(async (c) => {
+        const comment = await resolveComment(c, args.name, args.id, !args.reopen);
+        return {
+          summary: `Thread ${comment.id} on ${args.name} ${args.reopen ? "reopened" : "resolved"}`,
+          data: comment
+        };
+      })
+    );
+    server.registerTool(
+      t.commentDelete.name,
+      toolDef(t.commentDelete),
+      (args) => run(async (c) => {
+        const result = await deleteComment(c, args.name, args.id);
+        return { summary: `Comment ${args.id} on ${args.name} deleted`, data: result };
+      })
+    );
+  }
   server.registerTool(
     t.whoami.name,
     toolDef(t.whoami),
     () => run(async (c) => {
       const me = await whoami(c);
-      const base = await discoverSitesBase(c);
+      const base = await sitesBase();
       return {
         summary: `Signed in as ${me.email} (sites are served at ${sitesPattern(base)})`,
         data: me
@@ -3298,38 +4169,39 @@ ${JSON.stringify(data, null, 2)}` }]
   );
   return server;
 }
-var textResult = (text) => ({ content: [{ type: "text", text }] });
+var textResult = (text2) => ({ content: [{ type: "text", text: text2 }] });
 async function writeInlineFiles(dir, files) {
   const seen = /* @__PURE__ */ new Set();
   const skippedDotfiles = [];
   const secretFiles = [];
   let total = 0;
   for (const f of files) {
-    const path = f.path.replace(/^(\.\/)+/, "").replace(/^\/+/, "");
-    const segments = path.split("/");
-    if (path && !path.includes("\\") && segments.every((s) => s !== "" && s !== "." && s !== "..") && segments.some((s) => s.startsWith("."))) {
-      skippedDotfiles.push(path);
+    const path3 = f.path.replace(/^(\.\/)+/, "").replace(/^\/+/, "");
+    const segments = path3.split("/");
+    if (path3 && !path3.includes("\\") && segments.every((s) => s !== "" && s !== "." && s !== "..") && segments.some((s) => s.startsWith("."))) {
+      skippedDotfiles.push(path3);
       continue;
     }
-    if (!isValidSitePath(path)) throw new CliError(`Invalid file path: "${f.path}"`);
-    if (isSecretPath(path)) {
-      secretFiles.push(path);
+    if (!isValidSitePath(path3)) throw new CliError(`Invalid file path: "${f.path}"`);
+    if (isSecretPath(path3)) {
+      secretFiles.push(path3);
       continue;
     }
-    if (seen.has(path)) throw new CliError(`"${path}" is listed twice`);
-    seen.add(path);
+    if (seen.has(path3)) throw new CliError(`"${path3}" is listed twice`);
+    seen.add(path3);
     const bytes = Buffer.from(f.content, f.encoding === "base64" ? "base64" : "utf8");
     total += bytes.length;
     if (total > MAX_DEPLOY_BYTES)
       throw new CliError(`The site is larger than ${formatBytes(MAX_DEPLOY_BYTES)}`);
-    const target = join5(dir, ...path.split("/"));
+    const target = join6(dir, ...path3.split("/"));
     await mkdir3(dirname2(target), { recursive: true });
-    await writeFile3(target, bytes);
+    await writeFile4(target, bytes);
   }
   if (secretFiles.length > 0) throw new SecretFilesError(secretFiles);
   return { skippedDotfiles };
 }
 function describeError(error) {
+  if (error instanceof NoServerError) return NO_SERVER_HINT;
   if (error instanceof CliError && error.exitCode === EXIT_NOT_LOGGED_IN) return LOGIN_HINT;
   if (error instanceof CliApiError && error.status === 401) return LOGIN_HINT;
   if (error instanceof CliError)
@@ -3338,28 +4210,87 @@ ${error.hint}` : error.message;
   return error instanceof Error ? error.message : String(error);
 }
 async function runMcpServer(deps = {}) {
-  const server = createMcpServer(deps);
+  const store = deps.store ?? createConfigStore();
+  const instance = deps.instance ?? await store.resolve({ serverUrl: deps.server }).then((config) => loadInstance(store, config, deps.fetch ?? ((i, init) => fetch(i, init)))).catch(() => null);
+  const server = createMcpServer({ ...deps, store, instance });
   await server.connect(new StdioServerTransport());
 }
 
+// src/route.ts
+import { stat as stat6 } from "node:fs/promises";
+import { resolve as resolve4 } from "node:path";
+var PASS_THROUGH = /* @__PURE__ */ new Set(["-h", "--help", "-V", "--version"]);
+var pathExists = (path3) => stat6(resolve4(path3)).then(
+  () => true,
+  () => false
+);
+async function routeArgs(args, opts) {
+  const exists = opts.exists ?? pathExists;
+  let first;
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--") {
+      first = args[i + 1];
+      break;
+    }
+    if (arg.startsWith("-")) {
+      if (PASS_THROUGH.has(arg)) return { kind: "run", args: [...args] };
+      if (opts.valueFlags.has(arg)) i++;
+      continue;
+    }
+    first = arg;
+    break;
+  }
+  if (first === void 0) return { kind: "help" };
+  if (await exists(first)) return { kind: "run", args: ["deploy", ...args] };
+  if (opts.commands.has(first)) return { kind: "run", args: [...args] };
+  return { kind: "unknown", arg: first };
+}
+function routeOptionsFor(program2) {
+  const commands = /* @__PURE__ */ new Set(["help"]);
+  const valueFlags = /* @__PURE__ */ new Set();
+  const addFlags = (command) => {
+    for (const option of command.options)
+      if (option.required || option.optional) {
+        for (const flag of [option.short, option.long]) if (flag) valueFlags.add(flag);
+      }
+  };
+  addFlags(program2);
+  for (const command of program2.commands) {
+    commands.add(command.name());
+    for (const alias of command.aliases()) commands.add(alias);
+    addFlags(command);
+  }
+  return { commands, valueFlags };
+}
+
 // src/cli.ts
 var program = new Command();
-program.name(BIN_NAME).description("Fling a folder of static files at Fling and get a link back").version(VERSION).option(
-  "--server <url>",
-  `server URL (default: $${ENV.url} or config, else ${DEFAULT_SERVER_URL})`
-).option("--json", "print JSON instead of human output", false).showHelpAfterError().addHelpText(
+program.name(BIN_NAME).description("Fling a folder of static files at Fling and get a link back").version(VERSION).option("--server <url>", `server URL (default: $${ENV.url}, else the one you logged in to)`).option("--json", "print JSON instead of human output", false).showHelpAfterError().configureHelp({
+  sortSubcommands: false,
+  styleTitle: (title) => chalk10.bold(brand.primary(title)),
+  styleCommandText: (text2) => chalk10.bold(text2),
+  styleSubcommandText: (text2) => brand.accent(text2),
+  styleOptionText: (text2) => brand.accent(text2),
+  styleArgumentText: (text2) => chalk10.dim(text2)
+}).addHelpText(
+  "before",
+  () => process.stdout.isTTY ? logo({ columns: process.stdout.columns }) : ""
+).addHelpText(
   "after",
-  `
-Examples:
-  $ ${BIN_NAME} login
-  $ ${BIN_NAME} ./dist --name my-app     deploy \u2192 https://my-app.fling.labs.nearform.com
-  $ ${BIN_NAME} ./dist --yes             no prompts (CI): use the generated name, fail if it is taken
-  $ ${BIN_NAME} "Pitch Deck.html"        a single page; found in Downloads if it is not here
-  $ ${BIN_NAME} site.zip                 a zip of a site
-  $ ${BIN_NAME} share my-app             public link for people outside Nearform
+  () => `
+${chalk10.bold(brand.primary("Examples:"))}
+  $ ${BIN_NAME} login https://fling.example.com  sign in to your Fling (once; there is no default)
+  $ ${BIN_NAME} setup                      sign in and add Fling to Claude Code / Claude Desktop
+  $ ${BIN_NAME} deploy ./dist --name my-app \u2192 https://my-app.<your sites domain>
+  $ ${BIN_NAME} ./dist                     the same: an existing path deploys
+  $ ${BIN_NAME} ./dist --yes               no prompts (CI): use the generated name, fail if it is taken
+  $ ${BIN_NAME} "Pitch Deck.html"          a single page
+  $ ${BIN_NAME} site.zip                   a zip of a site
+  $ ${BIN_NAME} share my-app               public link for people who can't sign in
 
-Exit codes: 0 ok \xB7 1 error \xB7 2 not logged in \xB7 3 forbidden
-Env:        ${ENV.apiKey} \xB7 ${ENV.url} \xB7 ${ENV.configDir} \xB7 ${ENV.debug}`
+${chalk10.dim(`Exit codes: 0 ok \xB7 1 error \xB7 2 not logged in \xB7 3 forbidden
+Env:        ${ENV.apiKey} \xB7 ${ENV.url} \xB7 ${ENV.configDir} \xB7 ${ENV.debug}`)}`
 );
 function action(handler) {
   return async (...args) => {
@@ -3397,41 +4328,93 @@ function report(error, ctx) {
     );
   }
 }
-program.command("deploy [path]", { isDefault: true }).description(
-  "deploy a folder (default: .), a single .html file, a .zip or any file \u2014 the default command, so `fling ./dist` works. A path that does not exist is looked up by name in Downloads, Desktop and Claude output folders"
+program.command("deploy [path]").helpGroup("Deploy:").description(
+  "deploy a folder (default: .), a single .html file, a .zip or any file. `fling <path>` is short for it"
 ).option(
   "-n, --name <name>",
   "site name \u2014 names are global, first come first served (default: generated from the project and folder, e.g. rocketpod-docs; you confirm it on a terminal)"
-).option("--spa", "single-page app: serve index.html for unknown paths").option("--public", "make the site public (default: Nearform sign-in required)").option(
+).option("--spa", "single-page app: serve index.html for unknown paths").option("--public", "make the site public (default: sign-in required)").option(
   "-y, --yes",
   "never prompt: accept the generated name; without index.html, list the HTML pages (or fling anyway if there are none)"
 ).option("--list-html", "no index.html at the root: generate one listing the HTML pages").option("--no-list-html", "no index.html at the root: fling anyway (the root will 404)").action(
   action(
-    (ctx, path, opts) => runDeploy(ctx, path, opts)
+    (ctx, path3, opts) => runDeploy(ctx, path3, opts)
+  )
+);
+program.command("setup [url]").helpGroup("Setup:").description(
+  "sign in (to the Fling at url, the first time), then add the Fling plugin to Claude Code and the extension to Claude Desktop"
+).option("-y, --yes", "do every step without asking").option("-s, --scope <scope>", "Claude Code plugin scope: user, project or local", "user").action(
+  action(
+    (ctx, url, opts) => runSetup(ctx, { ...opts, url })
   )
 );
-program.command("login").description("sign in through the browser and store an API key").action(action((ctx) => runLogin(ctx)));
-program.command("logout").description("remove the stored API key").action(action((ctx) => runLogout(ctx)));
-program.command("whoami").description("show the signed-in user").action(action((ctx) => runWhoami(ctx)));
-program.command("ls").alias("list").description("list your sites").option("--archived", "list archived sites").action(action((ctx, opts) => runList(ctx, opts)));
-program.command("info <name>").description("show a site").action(action((ctx, name) => runInfo(ctx, name)));
-program.command("versions <name>").description("list a site's versions (* = live)").action(action((ctx, name) => runVersions(ctx, name)));
-program.command("files <name> [versionId]").description("list the files in a site's live version (or in versionId)").action(
+program.command("login [url]").helpGroup("Setup:").description(
+  "sign in through the browser to the Fling at url (remembered; later logins can omit it) and store an API key"
+).action(
+  action(async (ctx, url) => {
+    await runLogin(ctx, url);
+    ctx.log.hint(`Next: \`${BIN_NAME} setup\` adds Fling to Claude Code and Claude Desktop.`);
+  })
+);
+program.command("logout").helpGroup("Setup:").description("remove the stored API key").action(action((ctx) => runLogout(ctx)));
+program.command("whoami").helpGroup("Setup:").description("show the signed-in user").action(action((ctx) => runWhoami(ctx)));
+program.commandsGroup("Setup:").helpCommand("help [command]", "show help for a command");
+program.command("ls").helpGroup("Sites:").alias("list").description("list your sites").option("--archived", "list archived sites").action(action((ctx, opts) => runList(ctx, opts)));
+program.command("info <name>").helpGroup("Sites:").description("show a site").action(action((ctx, name) => runInfo(ctx, name)));
+program.command("versions <name>").helpGroup("Sites:").description("list a site's versions (* = live)").action(action((ctx, name) => runVersions(ctx, name)));
+program.command("files <name> [versionId]").helpGroup("Sites:").description("list the files in a site's live version (or in versionId)").action(
   action((ctx, name, versionId) => runFiles(ctx, name, versionId))
 );
-program.command("rollback <name> <versionId>").description("serve an earlier version again").action(action((ctx, name, versionId) => runRollback(ctx, name, versionId)));
-program.command("share <name>").description("print (or create) a public share link \u2014 anyone with it can view the site").option("--refresh", "replace the link; the old one stops working").option("--revoke", "remove the link").action(
+program.command("rollback <name> <versionId>").helpGroup("Sites:").description("serve an earlier version again").action(action((ctx, name, versionId) => runRollback(ctx, name, versionId)));
+program.command("share <name>").helpGroup("Sites:").description("print (or create) a public share link \u2014 anyone with it can view the site").option("--refresh", "replace the link; the old one stops working").option("--revoke", "remove the link").action(
   action(
     (ctx, name, opts) => runShare(ctx, name, opts)
   )
 );
-program.command("visibility <name> <visibility>").description("private (Nearform sign-in) or public (anyone)").action(action((ctx, name, visibility) => runVisibility(ctx, name, visibility)));
-program.command("archive <name>").description("take a site offline (404) but keep its files; undo with unarchive").action(action((ctx, name) => runArchive(ctx, name)));
-program.command("unarchive <name>").description("bring an archived site back").action(action((ctx, name) => runArchive(ctx, name, true)));
-program.command("rm <name>").alias("delete").description("delete a site and all its versions (asks first unless --yes)").option("-y, --yes", "do not ask for confirmation").action(action((ctx, name, opts) => runRemove(ctx, name, opts)));
-program.command("mcp").description("run the MCP server on stdio (used by the Claude Code plugin)").action(async (_opts, command) => {
+program.command("visibility <name> <visibility>").helpGroup("Sites:").description("private (sign-in required) or public (anyone)").action(action((ctx, name, visibility) => runVisibility(ctx, name, visibility)));
+program.command("archive <name>").helpGroup("Sites:").description("take a site offline (404) but keep its files; undo with unarchive").action(action((ctx, name) => runArchive(ctx, name)));
+program.command("unarchive <name>").helpGroup("Sites:").description("bring an archived site back").action(action((ctx, name) => runArchive(ctx, name, true)));
+program.command("rm <name>").helpGroup("Sites:").alias("delete").description("delete a site and all its versions (asks first unless --yes)").option("-y, --yes", "do not ask for confirmation").action(action((ctx, name, opts) => runRemove(ctx, name, opts)));
+program.command("comments <name>").helpGroup("Comments:").description("list a site's open comment threads (people leave them on its review page)").option("-p, --path <path>", "only this page, e.g. / or /docs/").option("-a, --all", "include resolved threads").action(
+  action(
+    (ctx, name, opts) => runComments(ctx, name, opts)
+  )
+);
+program.command("comment <name> <text>").helpGroup("Comments:").description("comment on a page of a site (default: its home page), or reply to a thread").option("-p, --path <path>", "the page, e.g. /docs/ or about.html").option("-r, --reply <id>", "reply to this thread").action(
+  action(
+    (ctx, name, text2, opts) => runComment(ctx, name, text2, opts)
+  )
+);
+program.command("resolve <name> <id>").helpGroup("Comments:").description("mark a comment thread resolved").option("--reopen", "reopen it instead").action(
+  action(
+    (ctx, name, id, opts) => runResolve(ctx, name, id, opts)
+  )
+);
+program.command("uncomment <name> <id>").helpGroup("Comments:").alias("delete-comment").description("delete a comment (a thread goes with its replies; asks first unless --yes)").option("-y, --yes", "do not ask for confirmation").action(
+  action(
+    (ctx, name, id, opts) => runUncomment(ctx, name, id, opts)
+  )
+);
+program.command("mcp").helpGroup("Agents:").description("run the MCP server on stdio (used by the Claude Code plugin)").action(async (_opts, command) => {
   const globals = command.optsWithGlobals();
   await runMcpServer({ server: globals.server });
 });
-program.parseAsync(process.argv);
+async function main() {
+  const route = await routeArgs(process.argv.slice(2), routeOptionsFor(program));
+  if (route.kind === "help") {
+    program.outputHelp();
+    return;
+  }
+  if (route.kind === "unknown") {
+    const log = createLogger();
+    log.error(`"${route.arg}" is not a command, file or folder`);
+    log.hint(
+      `Run \`${BIN_NAME} --help\` for the commands, or \`${BIN_NAME} deploy <path>\` to deploy.`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  await program.parseAsync(route.args, { from: "user" });
+}
+await main();
 //# sourceMappingURL=cli.js.map