chat-recall 0.5.20 → 0.5.22

package/dist/cli.js

@@ -19727,7 +19727,7 @@ var init_http = __esm({
       CLI_VERSION = JSON.parse(readFileSync33(new URL("../package.json", import.meta.url), "utf-8")).version || CLI_VERSION;
     } catch {
       try {
-        if (true) CLI_VERSION = "0.5.20";
+        if (true) CLI_VERSION = "0.5.22";
       } catch {
       }
     }
@@ -20239,7 +20239,7 @@ var init_telemetry = __esm({
     init_sync_client();
     cliVersion2 = () => {
       try {
-        return true ? "0.5.20" : "dev";
+        return true ? "0.5.22" : "dev";
       } catch {
         return "dev";
       }
@@ -22066,7 +22066,7 @@ var init_sync_client = __esm({
       ownVersion = JSON.parse(readFileSync37(join44(dir, "../package.json"), "utf-8")).version || ownVersion;
     } catch {
       try {
-        if (true) ownVersion = "0.5.20";
+        if (true) ownVersion = "0.5.22";
       } catch {
       }
     }
@@ -22237,75 +22237,6 @@ var init_which = __esm({
   }
 });
 
-// ../engine/dist/core/sync-scope.js
-var sync_scope_exports = {};
-__export(sync_scope_exports, {
-  summariseSyncScope: () => summariseSyncScope
-});
-function summariseSyncScope(sinceMs = 0) {
-  const sync = loadSettings().sync;
-  const excludeProjects = sync?.excludeProjects ?? [];
-  const excludeTools = new Set(sync?.excludeTools ?? []);
-  const allowlistMode = (sync?.syncMode ?? "all") === "only";
-  const syncOnly2 = new Set(sync?.syncOnlyProjects ?? []);
-  const perProject = /* @__PURE__ */ new Map();
-  const perTool = /* @__PURE__ */ new Map();
-  for (const backend of listAvailableBackends()) {
-    let refs = [];
-    try {
-      refs = backend.listSessions({ sinceMs });
-    } catch {
-      continue;
-    }
-    for (const ref of refs) {
-      const projectPath = ref.projectPath || "";
-      const toolId = ref.toolId || backend.id;
-      let heldBackBy = null;
-      if (excludeTools.has(toolId))
-        heldBackBy = "excluded-tool";
-      else if (excludeProjects.some((x) => projectPathIncludes(projectPath, x)))
-        heldBackBy = "excluded-project";
-      else if (!isProjectSyncable(idOf(projectPath), projectPath, { syncMode: sync?.syncMode, syncOnly: syncOnly2 })) {
-        heldBackBy = "not-in-allowlist";
-      }
-      const id = idOf(projectPath);
-      const key2 = `${id}\0${projectPath}`;
-      const row = perProject.get(key2) ?? { id, projectPath, sessions: 0, heldBackBy };
-      row.sessions++;
-      row.heldBackBy = row.heldBackBy ?? heldBackBy;
-      perProject.set(key2, row);
-      if (!heldBackBy)
-        perTool.set(toolId, (perTool.get(toolId) ?? 0) + 1);
-    }
-  }
-  const projects = [...perProject.values()].sort((a, b) => b.sessions - a.sessions);
-  const noPathSessions = projects.filter((p) => !p.projectPath && !p.heldBackBy).reduce((n, p) => n + p.sessions, 0);
-  return {
-    included: projects.filter((p) => !p.heldBackBy).reduce((n, p) => n + p.sessions, 0),
-    heldBack: projects.filter((p) => p.heldBackBy).reduce((n, p) => n + p.sessions, 0),
-    byTool: [...perTool.entries()].map(([tool, sessions]) => ({ tool, sessions })).sort((a, b) => b.sessions - a.sessions),
-    projects,
-    allowlistMode,
-    noPathSessions
-  };
-}
-function idOf(projectPath) {
-  if (!projectPath)
-    return "";
-  const r = resolveProjectId(projectPath);
-  return r.source === "ignored" ? "" : r.id;
-}
-var init_sync_scope = __esm({
-  "../engine/dist/core/sync-scope.js"() {
-    "use strict";
-    init_tool_backend();
-    init_backends();
-    init_project_resolver();
-    init_settings();
-    init_project_path_match();
-  }
-});
-
 // ../engine/dist/core/mcp-clients.js
 var mcp_clients_exports = {};
 __export(mcp_clients_exports, {
@@ -24217,6 +24148,8 @@ var init_escalate = __esm({
 // src/server-probe.ts
 var server_probe_exports = {};
 __export(server_probe_exports, {
+  classifyUnreachable: () => classifyUnreachable,
+  describeCause: () => describeCause,
   probeAdvice: () => probeAdvice,
   probeOk: () => probeOk,
   probeServer: () => probeServer
@@ -24232,7 +24165,11 @@ async function probeServer(base2, opts = {}) {
       signal: AbortSignal.timeout(opts.timeoutMs ?? 1e4)
     });
   } catch (err) {
-    return { kind: "unreachable", error: err instanceof Error ? err.message : String(err) };
+    return {
+      kind: "unreachable",
+      error: describeCause(err),
+      reason: classifyUnreachable(err)
+    };
   }
   if (res.status === 401 || res.status === 403) return { kind: "unauthorized", status: res.status };
   if (res.status === 404 || res.status === 410) return { kind: "moved", status: res.status };
@@ -24242,7 +24179,7 @@ async function probeServer(base2, opts = {}) {
   try {
     body = await res.text();
   } catch (err) {
-    return { kind: "unreachable", error: err instanceof Error ? err.message : String(err) };
+    return { kind: "unreachable", error: describeCause(err), reason: classifyUnreachable(err) };
   }
   let parsed;
   try {
@@ -24273,8 +24210,45 @@ function probeAdvice(r, base2) {
     case "not_api":
       return `${base2} answered ${r.status} with something that is not the chat-recall API (${JSON.stringify(r.snippet)}) \u2014 check the URL, a proxy or a captive portal`;
     case "unreachable":
-      return `no HTTP response from ${base2} (${r.error}) \u2014 check the URL, DNS, or that the server is running`;
+      switch (r.reason) {
+        case "dns":
+          return `cannot resolve the host in ${base2} (${r.error}) \u2014 check the URL for a typo, and your DNS or VPN`;
+        case "refused":
+          return `${base2} resolves but refused the connection (${r.error}) \u2014 the server is not running, or the port is wrong`;
+        case "tls":
+          return `the TLS certificate at ${base2} was rejected (${r.error}) \u2014 expired, self-signed, or issued for another host. A corporate proxy that re-signs traffic does this.`;
+        case "timeout":
+          return `${base2} did not answer in time (${r.error}) \u2014 a firewall or proxy that drops traffic silently looks exactly like this`;
+        case "reset":
+          return `the connection to ${base2} was cut (${r.error}) \u2014 often a proxy or a captive portal`;
+        default:
+          return `no HTTP response from ${base2} (${r.error}) \u2014 check the URL, DNS, or that the server is running`;
+      }
+  }
+}
+function classifyUnreachable(err) {
+  if (err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError")) return "timeout";
+  for (let e = err, depth = 0; e && depth < 5; depth++) {
+    const code2 = String(e.code ?? "");
+    const msg = String(e.message ?? "");
+    if (code2 === "ENOTFOUND" || code2 === "EAI_AGAIN") return "dns";
+    if (code2 === "ECONNREFUSED") return "refused";
+    if (code2 === "ECONNRESET" || code2 === "EPIPE") return "reset";
+    if (code2 === "ETIMEDOUT" || code2 === "UND_ERR_CONNECT_TIMEOUT" || code2 === "UND_ERR_HEADERS_TIMEOUT") return "timeout";
+    if (code2.startsWith("CERT_") || code2.startsWith("ERR_TLS") || code2 === "DEPTH_ZERO_SELF_SIGNED_CERT" || code2 === "SELF_SIGNED_CERT_IN_CHAIN" || code2 === "UNABLE_TO_VERIFY_LEAF_SIGNATURE" || /certificate/i.test(msg)) return "tls";
+    e = e.cause;
   }
+  return "unknown";
+}
+function describeCause(err) {
+  const parts = [];
+  for (let e = err, depth = 0; e && depth < 5; depth++) {
+    const code2 = e.code;
+    if (typeof code2 === "string" && code2 && !parts.includes(code2)) parts.push(code2);
+    e = e.cause;
+  }
+  const base2 = err instanceof Error ? err.message : String(err);
+  return parts.length ? `${base2}: ${parts.join(" \u2192 ")}` : base2;
 }
 var init_server_probe = __esm({
   "src/server-probe.ts"() {
@@ -25862,7 +25836,7 @@ var init_intent_drain = __esm({
       ownVersion2 = JSON.parse(readFileSync46(join55(dir, "../package.json"), "utf-8")).version || ownVersion2;
     } catch {
       try {
-        if (true) ownVersion2 = "0.5.20";
+        if (true) ownVersion2 = "0.5.22";
       } catch {
       }
     }
@@ -27261,6 +27235,50 @@ var init_device_auth = __esm({
   }
 });
 
+// src/install-report.ts
+var install_report_exports = {};
+__export(install_report_exports, {
+  reportInstallFailure: () => reportInstallFailure
+});
+async function reportInstallFailure(serverUrl, failure, opts = {}) {
+  if (!serverUrl) return false;
+  if (!userConsents() && !mayReport(serverUrl)) return false;
+  const payload = {
+    step: failure.step,
+    reason: trim(failure.reason, 40),
+    message: trim(failure.message, 200),
+    cliVersion: trim(process.env.CHAT_RECALL_CLI_VERSION, 20),
+    node: trim(process.versions.node, 20),
+    os: `${process.platform}-${process.arch}`
+  };
+  try {
+    assertNoSensitiveKeys(payload);
+  } catch {
+    return false;
+  }
+  const f = opts.fetchImpl || fetch;
+  try {
+    const res = await f(`${serverUrl.replace(/\/+$/, "")}/install/report`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(payload),
+      signal: AbortSignal.timeout(opts.timeoutMs ?? 3e3)
+    });
+    return res.ok || res.status === 204;
+  } catch {
+    return false;
+  }
+}
+function trim(v, n) {
+  return typeof v === "string" && v.trim() ? v.trim().slice(0, n) : null;
+}
+var init_install_report = __esm({
+  "src/install-report.ts"() {
+    "use strict";
+    init_telemetry_consent();
+  }
+});
+
 // ../engine/dist/core/resume-command.js
 function toolOfSessionId(sessionId) {
   if (sessionId.startsWith("codex_"))
@@ -27377,54 +27395,20 @@ function firstTarget() {
   if (!cred) return null;
   return { base: cred.serverUrl.replace(/\/+$/, ""), token: cred.token };
 }
-async function confirmFirstSyncScope(skipPause) {
-  const { summariseSyncScope: summariseSyncScope2 } = await Promise.resolve().then(() => (init_sync_scope(), sync_scope_exports));
-  let scope;
-  try {
-    scope = summariseSyncScope2();
-  } catch {
-    console.log(chalk.dim("   (could not summarise local scope \u2014 proceeding)"));
-    return true;
-  }
-  console.log(chalk.bold("6. What would leave this machine"));
-  if (scope.included === 0 && scope.heldBack === 0) {
-    console.log(chalk.dim("   No local sessions found yet \u2014 nothing to ship."));
-    return true;
-  }
-  const tools = scope.byTool.map((t) => `${t.tool} ${t.sessions}`).join(", ");
-  console.log(`   ${chalk.bold(String(scope.included))} session(s) would upload${tools ? chalk.dim(`  (${tools})`) : ""}`);
-  if (scope.heldBack > 0) {
-    console.log(`   ${chalk.green(String(scope.heldBack))} held back by your existing rules`);
-  }
-  if (scope.allowlistMode) {
-    console.log(chalk.yellow("   Allowlist mode is on \u2014 only the projects you listed would ship."));
-  }
-  if (scope.noPathSessions > 0) {
-    console.log(`   ${chalk.yellow(String(scope.noPathSessions))} of those carry no project path \u2014 only \`exclude tool\` can hold those back`);
-  }
-  const shown = scope.projects.filter((p) => !p.heldBackBy).slice(0, 8);
-  for (const p of shown) {
-    console.log(`     ${chalk.cyan(p.projectPath || p.id)} ${chalk.dim(`\xB7 ${p.sessions}`)}`);
-  }
-  const more = scope.projects.filter((p) => !p.heldBackBy).length - shown.length;
-  if (more > 0) console.log(chalk.dim(`     \u2026and ${more} more project(s)`));
-  console.log(chalk.dim("   Secrets are masked on this machine before anything uploads."));
-  console.log(chalk.dim("   Hold one back:  chat-recall exclude project <path>"));
-  console.log(chalk.dim("   Or invert it:   chat-recall sync-only add <project>"));
-  if (skipPause || !process.stdin.isTTY) {
-    console.log();
-    return true;
-  }
-  const { createInterface: createInterface3 } = await import("node:readline/promises");
-  const rl = createInterface3({ input: process.stdin, output: process.stdout });
-  const answer = (await rl.question("   Upload these now? [Y/n] ")).trim().toLowerCase();
-  rl.close();
-  if (answer === "n" || answer === "no") {
-    console.log(chalk.dim("   Skipped. Set your rules, then run `chat-recall sync`."));
-    return false;
+function describeProbeError(err) {
+  const codes = [];
+  for (let e = err, depth = 0; e && depth < 5; depth++) {
+    const code2 = e.code;
+    if (typeof code2 === "string" && code2 && !codes.includes(code2)) codes.push(code2);
+    e = e.cause;
   }
-  console.log();
-  return true;
+  const base2 = err instanceof Error ? err.message : String(err);
+  return codes.length ? `${base2}: ${codes.join(" \u2192 ")}` : base2;
+}
+function failLogin(opts, message) {
+  if (opts.fromInit) throw new Error(message);
+  console.error(chalk.red("login failed:"), message);
+  process.exit(1);
 }
 function requireTarget() {
   const t = firstTarget();
@@ -27480,6 +27464,13 @@ async function serverDelete(path, body) {
   if (!res.ok) throw new Error(`server ${path}: HTTP ${res.status} ${await res.text().catch(() => "")}`);
   return res.json();
 }
+var pkgEngines = (() => {
+  try {
+    return JSON.parse(readFileSync49(new URL("../package.json", import.meta.url), "utf-8")).engines?.node ?? "";
+  } catch {
+    return "";
+  }
+})();
 var pkgVersion = JSON.parse(
   readFileSync49(new URL("../package.json", import.meta.url), "utf-8")
 ).version;
@@ -27556,11 +27547,21 @@ var DEFAULT_ALLOW = [
   "recall_toolkit_sync"
 ];
 var SELF_HOST_DOCS = "https://github.com/munhq/chat-recall/blob/main/docs/SELF_HOSTING.md";
+function enforceNodeVersion() {
+  const required = Number(/(\d+)/.exec(String(pkgEngines))?.[1] ?? 0);
+  const found = Number(process.versions.node.split(".")[0]);
+  if (!required || !found || found >= required) return;
+  console.error(`chat-recall needs Node ${required} or newer. This is Node ${process.versions.node}.`);
+  console.error(`Install it with your version manager (\`nvm install ${required}\`, \`fnm install ${required}\`, \`brew upgrade node\`), then run this again.`);
+  process.exit(1);
+}
+process.env.CHAT_RECALL_CLI_VERSION = pkgVersion;
+enforceNodeVersion();
 var program = new Command();
 program.name("chat-recall").description("Semantic search for Claude Code sessions - recall and resume past conversations").version(pkgVersion);
 program.command("init").description("Set up chat-recall: connect to your server, configure MCP, ship your local sessions").option("--server <url>", "chat-recall server URL to connect this machine to").option("--token <token>", "Self-host device token (skips the interactive OIDC login)").option("--skip-mcp", "Skip MCP server configuration").option("--skip-sync", "Skip the first session sync").option("--with-codeindex", "Force-download the codeindex binary during init. Default behavior is to detect an already-installed codeindex on PATH and register it as an MCP server.").option("--skip-codeindex", "Skip the codeindex companion entirely (no detection, no registration).").option("--skip-service", "Skip installing the per-user background sync service (Linux/macOS/Windows). By default init installs it so new conversations ship automatically.").option("--yes", "Do not pause before the first upload. The scope summary still prints.", false).option("--prompt-json", "Print the device prompt as one JSON line on stdout, then continue", false).action(async (options) => {
   try {
-    console.log(chalk.bold("chat-recall init"));
+    console.log(chalk.bold("chat-recall init") + chalk.dim(`  v${pkgVersion}`));
     console.log();
     console.log(chalk.bold("1. Detecting AI tools..."));
     const clis = [
@@ -27586,8 +27587,13 @@ program.command("init").description("Set up chat-recall: connect to your server,
     console.log(chalk.bold("2. Connecting to your server..."));
     let target = firstTarget();
     if (options.server) {
-      await runLogin(options.server, { token: options.token, fromInit: true, promptJson: options.promptJson });
-      target = firstTarget();
+      try {
+        await runLogin(options.server, { token: options.token, fromInit: true, promptJson: options.promptJson });
+        target = firstTarget();
+      } catch (e) {
+        console.log(`   ${chalk.yellow("Not connected.")} ${describeProbeError(e)}`);
+        console.log(`   ${chalk.dim(`Run ${chalk.bold(`chat-recall login ${options.server}`)} when ready, or self-host: ${SELF_HOST_DOCS}`)}`);
+      }
     } else if (!target) {
       console.log(`   Connecting to ${chalk.bold(DEFAULT_SERVER)} \u2014 sign in to approve this machine.`);
       console.log(`   ${chalk.dim(`Prefer your own server? ${chalk.bold("--server <url>")}. Self-hosting is free: ${SELF_HOST_DOCS}`)}`);
@@ -27595,7 +27601,7 @@ program.command("init").description("Set up chat-recall: connect to your server,
         await runLogin(DEFAULT_SERVER, { token: options.token, fromInit: true, promptJson: options.promptJson });
         target = firstTarget();
       } catch (e) {
-        console.log(`   ${chalk.yellow("Not connected.")} ${e instanceof Error ? e.message : e}`);
+        console.log(`   ${chalk.yellow("Not connected.")} ${describeProbeError(e)}`);
         console.log(`   ${chalk.dim(`Run ${chalk.bold("chat-recall login <server-url>")} when ready, or self-host: ${SELF_HOST_DOCS}`)}`);
       }
     }
@@ -27604,7 +27610,7 @@ program.command("init").description("Set up chat-recall: connect to your server,
     }
     console.log();
     if (!options.skipMcp) {
-      console.log(chalk.bold("4. Configuring MCP server..."));
+      console.log(chalk.bold("3. Configuring MCP server..."));
       const projectRoot = join60(import.meta.dirname, "..");
       let mcpBinOnPath = false;
       mcpBinOnPath = isOnPath("chat-recall-mcp");
@@ -27629,13 +27635,13 @@ program.command("init").description("Set up chat-recall: connect to your server,
       }
       console.log(chalk.dim(`   Launch: ${launch.command}${launch.args ? " " + launch.args.join(" ") : ""}`));
     } else {
-      console.log(chalk.bold("4. Skipping MCP configuration (--skip-mcp)"));
+      console.log(chalk.bold("3. Skipping MCP configuration (--skip-mcp)"));
     }
     console.log();
     const skipCodeindex = options.skipCodeindex === true;
     const forceInstall = options.withCodeindex === true || process.env.CHAT_RECALL_WITH_CODEINDEX === "1";
     if (skipCodeindex) {
-      console.log(chalk.bold("5. Skipping codeindex companion (--skip-codeindex)"));
+      console.log(chalk.bold("4. Skipping codeindex companion (--skip-codeindex)"));
     } else {
       const {
         checkCodeindexStatus: checkCodeindexStatus2,
@@ -27645,7 +27651,7 @@ program.command("init").description("Set up chat-recall: connect to your server,
       } = await Promise.resolve().then(() => (init_companions(), companions_exports));
       const detected = checkCodeindexStatus2();
       if (detected.installed && !forceInstall) {
-        console.log(chalk.bold("5. Detected codeindex companion"));
+        console.log(chalk.bold("4. Detected codeindex companion"));
         console.log(`   ${chalk.green("codeindex")}: ${detected.path}`);
         if (!options.skipMcp) {
           const mcpJsonPath = join60(homedir22(), ".mcp.json");
@@ -27654,7 +27660,7 @@ program.command("init").description("Set up chat-recall: connect to your server,
           else console.log(`   codeindex MCP server: ${chalk.green("already registered")}`);
         }
       } else if (forceInstall) {
-        console.log(chalk.bold("5. Installing codeindex companion (--with-codeindex)..."));
+        console.log(chalk.bold("4. Installing codeindex companion (--with-codeindex)..."));
         try {
           const result = await installCodeindex2({ force: true });
           if (result.installed) {
@@ -27677,7 +27683,7 @@ program.command("init").description("Set up chat-recall: connect to your server,
           }
         }
       } else {
-        console.log(chalk.bold("5. codeindex companion: not installed"));
+        console.log(chalk.bold("4. codeindex companion: not installed"));
         console.log(chalk.dim("   codeindex is a separate MCP server for code-level lookup \u2014"));
         console.log(chalk.dim("   find_symbol, plan_change, get_change_impact, etc."));
         console.log(chalk.dim("   To install: `chat-recall init --with-codeindex`"));
@@ -27739,27 +27745,22 @@ program.command("init").description("Set up chat-recall: connect to your server,
       console.log();
     }
     if (!options.skipSync && firstTarget()) {
-      const shipped = await confirmFirstSyncScope(!!options.yes);
-      if (!shipped) {
-        console.log();
-      } else {
-        console.log(chalk.dim("   Shipping..."));
-        try {
-          const { syncSessions: syncSessions2 } = await Promise.resolve().then(() => (init_sync_client(), sync_client_exports));
-          const r = await syncSessions2();
-          console.log(`   ${chalk.green(`Synced ${r.uploaded} session(s), ${r.items} item(s)`)} ${chalk.dim(`\u2014 ${r.links} links, ${r.derived} derived rows, ${r.kgTriples} KG triples, ${r.skipped} skipped, ${r.redactions} secrets redacted, ${r.findings} secret findings${r.scanned ? ` (scanned ${r.scanned} in ${r.scanMs}ms)` : ""}`)}`);
-        } catch (err) {
-          console.log(`   ${chalk.yellow("Sync failed")} \u2014 ${err instanceof Error ? err.message : err}`);
-          console.log(`   ${chalk.dim("Re-run `chat-recall sync` once your server is reachable.")}`);
-        }
+      console.log(chalk.bold("5. Indexing and uploading your sessions"));
+      try {
+        const { syncSessions: syncSessions2 } = await Promise.resolve().then(() => (init_sync_client(), sync_client_exports));
+        const r = await syncSessions2();
+        console.log(`   ${chalk.green(`Synced ${r.uploaded} session(s), ${r.items} item(s)`)} ${chalk.dim(`\u2014 ${r.links} links, ${r.derived} derived rows, ${r.kgTriples} KG triples, ${r.skipped} skipped, ${r.redactions} secrets redacted, ${r.findings} secret findings${r.scanned ? ` (scanned ${r.scanned} in ${r.scanMs}ms)` : ""}`)}`);
+      } catch (err) {
+        console.log(`   ${chalk.yellow("Sync failed")} \u2014 ${err instanceof Error ? err.message : err}`);
+        console.log(`   ${chalk.dim("Re-run `chat-recall sync` once your server is reachable.")}`);
       }
     } else if (!options.skipSync) {
-      console.log(chalk.bold("6. Skipping first sync (not logged in)"));
+      console.log(chalk.bold("5. Skipping first sync (not logged in)"));
     } else {
-      console.log(chalk.bold("6. Skipping first sync (--skip-sync)"));
+      console.log(chalk.bold("5. Skipping first sync (--skip-sync)"));
     }
     console.log();
-    console.log(chalk.bold("7. Background sync"));
+    console.log(chalk.bold("6. Background sync"));
     console.log(chalk.dim("   Runs via the MCP server while Claude Code is open (no extra service to install)."));
     console.log(chalk.dim("   Always-on / headless? Opt in with `chat-recall watch --install-service`."));
     void options.skipService;
@@ -29607,19 +29608,16 @@ async function runLogin(serverUrl, opts) {
   if (opts.token) {
     const token = opts.token.trim();
     if (/[^\x21-\x7e]/.test(token)) {
-      console.error(chalk.red('login failed: the token contains non-ASCII characters \u2014 this looks like a masked/truncated copy (e.g. "ct_12345678\u2026").'));
       console.error(chalk.dim("Use the Copy button next to the token in the dashboard and paste the full line."));
-      process.exit(1);
+      return failLogin(opts, 'the token contains non-ASCII characters \u2014 this looks like a masked/truncated copy (e.g. "ct_12345678\u2026")');
     }
     const check = await verifyToken(token);
     if (!check.ok) {
       if (check.status === 401 || check.status === 403) {
-        console.error(chalk.red(`login failed: ${base2} rejected the token (HTTP ${check.status}).`));
         console.error(chalk.dim("Tokens are shown once \u2014 mint a fresh one (Account \u2192 Connect your machine) and copy the whole line."));
-      } else {
-        console.error(chalk.red(`login failed: could not verify the token against ${base2}:`), check.error || `HTTP ${check.status}`);
+        return failLogin(opts, `${base2} rejected the token (HTTP ${check.status})`);
       }
-      process.exit(1);
+      return failLogin(opts, `could not verify the token against ${base2}: ${check.error || `HTTP ${check.status}`}`);
     }
     saveCredentials2({ serverUrl, token });
     console.log(chalk.green("\u2713 Logged in.") + chalk.dim(`  server: ${serverUrl} (token verified)`));
@@ -29647,12 +29645,36 @@ async function runLogin(serverUrl, opts) {
     const { deviceLogin: deviceLogin2, betterAuthDeviceLogin: betterAuthDeviceLogin2 } = await Promise.resolve().then(() => (init_device_auth(), device_auth_exports));
     let issuer = opts.issuer;
     let authProvider;
+    let capsError = null;
     if (!issuer) {
-      try {
-        const caps = await fetch(`${base2}/api/capabilities`, { signal: AbortSignal.timeout(8e3) }).then((r) => r.json());
-        authProvider = caps?.authProvider;
-        if (caps?.oidcIssuer) issuer = caps.oidcIssuer;
-      } catch {
+      const { probeServer: probeServer2, probeOk: probeOk2, probeAdvice: probeAdvice2 } = await Promise.resolve().then(() => (init_server_probe(), server_probe_exports));
+      for (let attempt = 1; attempt <= 3 && !authProvider; attempt++) {
+        const probe = await probeServer2(base2, { timeoutMs: 15e3 });
+        if (probeOk2(probe)) {
+          try {
+            const caps = await fetch(`${base2}/api/capabilities`, { signal: AbortSignal.timeout(15e3) }).then((r) => r.json());
+            authProvider = caps?.authProvider;
+            if (caps?.oidcIssuer) issuer = caps.oidcIssuer;
+            capsError = null;
+          } catch (err) {
+            capsError = describeProbeError(err);
+          }
+        } else {
+          capsError = probeAdvice2(probe, base2);
+        }
+        if (!authProvider && attempt < 3) await new Promise((r) => setTimeout(r, attempt * 1e3));
+      }
+    }
+    if (!authProvider && !issuer) {
+      authProvider = "better-auth";
+      if (capsError) {
+        console.log(`   ${chalk.yellow("Could not read the server's capabilities")} (${capsError}) \u2014 assuming the standard sign-in flow.`);
+        void Promise.resolve().then(() => (init_install_report(), install_report_exports)).then(({ reportInstallFailure: reportInstallFailure2 }) => reportInstallFailure2(base2, {
+          step: "cli_login_probe",
+          reason: capsError?.slice(0, 40) ?? null,
+          message: capsError
+        })).catch(() => {
+        });
       }
     }
     const onPrompt = (p) => {
@@ -29681,9 +29703,8 @@ async function runLogin(serverUrl, opts) {
         slug = (await created.json()).slug;
         console.log(chalk.dim(`Created workspace "${name}" (${slug}) \u2014 you're its owner.`));
       } else {
-        console.error(chalk.red("You belong to multiple teams \u2014 pass --team <slug>:"));
         teams.forEach((t) => console.error(`  ${t.team_slug}  ${chalk.dim(t.name)}`));
-        process.exit(1);
+        throw new Error("you belong to multiple teams \u2014 pass --team <slug> (listed above)");
       }
     }
     const deviceId = opts.deviceId || (await import("node:os")).hostname();
@@ -29700,6 +29721,7 @@ async function runLogin(serverUrl, opts) {
       console.log(chalk.dim("Run `chat-recall sync` to push redacted conversations."));
     }
   } catch (err) {
+    if (opts.fromInit) throw err instanceof Error ? err : new Error(String(err));
     console.error(chalk.red("login failed:"), err instanceof Error ? err.message : err);
     process.exit(1);
   }