chat-recall 0.5.21 → 0.5.23

package/dist/cli.js

@@ -13470,8 +13470,11 @@ function isInside(child, parent) {
   return c.startsWith(p);
 }
 function globMatch(pattern, path) {
-  const re = new RegExp("^" + globToRegex(pattern) + "$");
-  return re.test(path);
+  const re = new RegExp("^" + globToRegex(toPosix(pattern)) + "$");
+  return re.test(toPosix(path));
+}
+function toPosix(p) {
+  return p.replace(/\\/g, "/");
 }
 function globToRegex(glob) {
   let out = "";
@@ -19727,7 +19730,7 @@ var init_http = __esm({
       CLI_VERSION = JSON.parse(readFileSync33(new URL("../package.json", import.meta.url), "utf-8")).version || CLI_VERSION;
     } catch {
       try {
-        if (true) CLI_VERSION = "0.5.21";
+        if (true) CLI_VERSION = "0.5.23";
       } catch {
       }
     }
@@ -20239,7 +20242,7 @@ var init_telemetry = __esm({
     init_sync_client();
     cliVersion2 = () => {
       try {
-        return true ? "0.5.21" : "dev";
+        return true ? "0.5.23" : "dev";
       } catch {
         return "dev";
       }
@@ -20351,6 +20354,143 @@ var init_collector_health = __esm({
   }
 });
 
+// src/server-probe.ts
+var server_probe_exports = {};
+__export(server_probe_exports, {
+  classifyUnreachable: () => classifyUnreachable,
+  describeCause: () => describeCause,
+  describeUnreachable: () => describeUnreachable,
+  probeAdvice: () => probeAdvice,
+  probeOk: () => probeOk,
+  probeServer: () => probeServer
+});
+function probeOk(r) {
+  return r.kind === "ok" && r.apiVersion >= 2;
+}
+async function probeServer(base2, opts = {}) {
+  const f = opts.fetchImpl || fetch;
+  let res;
+  try {
+    res = await f(`${base2.replace(/\/+$/, "")}/api/capabilities`, {
+      signal: AbortSignal.timeout(opts.timeoutMs ?? 1e4)
+    });
+  } catch (err) {
+    return {
+      kind: "unreachable",
+      error: describeCause(err),
+      reason: classifyUnreachable(err)
+    };
+  }
+  if (res.status === 401 || res.status === 403) return { kind: "unauthorized", status: res.status };
+  if (res.status === 404 || res.status === 410) return { kind: "moved", status: res.status };
+  if (res.status >= 500) return { kind: "server_error", status: res.status };
+  if (!res.ok) return { kind: "moved", status: res.status };
+  let body;
+  try {
+    body = await res.text();
+  } catch (err) {
+    return { kind: "unreachable", error: describeCause(err), reason: classifyUnreachable(err) };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return { kind: "not_api", status: res.status, snippet: body.trim().slice(0, 60) };
+  }
+  if (typeof parsed?.apiVersion !== "number") {
+    return { kind: "not_api", status: res.status, snippet: body.trim().slice(0, 60) };
+  }
+  return {
+    kind: "ok",
+    apiVersion: parsed.apiVersion,
+    edition: parsed.edition,
+    cliVersion: parsed.cli?.version,
+    raw: parsed
+  };
+}
+function probeAdvice(r, base2) {
+  switch (r.kind) {
+    case "ok":
+      return r.apiVersion >= 2 ? `apiVersion ${r.apiVersion}${r.edition ? `, edition ${r.edition}` : ""}` : `apiVersion ${r.apiVersion} is too old for this CLI \u2014 upgrade the server`;
+    case "moved":
+      return `HTTP ${r.status} \u2014 nothing is served at ${base2}. If the host moved, re-point it: \`chat-recall login <new-server-url>\``;
+    case "unauthorized":
+      return `HTTP ${r.status} \u2014 ${base2} rejected the credential. Re-login: \`chat-recall login ` + base2 + "`";
+    case "server_error":
+      return `HTTP ${r.status} \u2014 ${base2} is up but failing. Nothing to fix locally; check the server.`;
+    case "not_api":
+      return `${base2} answered ${r.status} with something that is not the chat-recall API (${JSON.stringify(r.snippet)}) \u2014 check the URL, a proxy or a captive portal`;
+    case "unreachable":
+      switch (r.reason) {
+        case "dns":
+          return `cannot resolve the host in ${base2} (${r.error}) \u2014 check the URL for a typo, and your DNS or VPN`;
+        case "refused":
+          return `${base2} resolves but refused the connection (${r.error}) \u2014 the server is not running, or the port is wrong`;
+        case "tls":
+          return `the TLS certificate at ${base2} was rejected (${r.error}) \u2014 expired, self-signed, or issued for another host. A corporate proxy that re-signs traffic does this.`;
+        case "timeout":
+          return `${base2} did not answer in time (${r.error}) \u2014 a firewall or proxy that drops traffic silently looks exactly like this`;
+        case "reset":
+          return `the connection to ${base2} was cut (${r.error}) \u2014 often a proxy or a captive portal`;
+        case "bad_port":
+          return `${base2} names a port that Node and every browser refuse to open (the WHATWG bad-port list) \u2014 use the server's real port`;
+        default:
+          return `no HTTP response from ${base2} (${r.error}) \u2014 check the URL, DNS, or that the server is running`;
+      }
+  }
+}
+function classifyUnreachable(err) {
+  if (err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError")) return "timeout";
+  for (const e of walkErrorChain(err)) {
+    const code2 = String(e.code ?? "");
+    const msg = String(e.message ?? "");
+    if (code2 === "ENOTFOUND" || code2 === "EAI_AGAIN") return "dns";
+    if (code2 === "ECONNREFUSED") return "refused";
+    if (code2 === "ECONNRESET" || code2 === "EPIPE") return "reset";
+    if (code2 === "ETIMEDOUT" || code2 === "UND_ERR_CONNECT_TIMEOUT" || code2 === "UND_ERR_HEADERS_TIMEOUT") return "timeout";
+    if (code2.startsWith("CERT_") || code2.startsWith("ERR_TLS") || code2 === "DEPTH_ZERO_SELF_SIGNED_CERT" || code2 === "SELF_SIGNED_CERT_IN_CHAIN" || code2 === "UNABLE_TO_VERIFY_LEAF_SIGNATURE" || /certificate/i.test(msg)) return "tls";
+    if (/^bad port$/i.test(msg)) return "bad_port";
+  }
+  return "unknown";
+}
+function* walkErrorChain(err, depth = 0) {
+  if (!err || typeof err !== "object" || depth > 5) return;
+  yield err;
+  const members = err.errors;
+  if (Array.isArray(members)) {
+    for (const m of members) yield* walkErrorChain(m, depth + 1);
+  }
+  yield* walkErrorChain(err.cause, depth + 1);
+}
+function describeCause(err) {
+  const parts = [];
+  for (const e of walkErrorChain(err)) {
+    const code2 = e.code;
+    if (typeof code2 === "string" && code2 && !parts.includes(code2)) parts.push(code2);
+  }
+  const base2 = err instanceof Error ? err.message : String(err);
+  return parts.length ? `${base2}: ${parts.join(" \u2192 ")}` : base2;
+}
+function describeUnreachable(err) {
+  const reason = classifyUnreachable(err);
+  const detail = describeCause(err);
+  const phrase = {
+    dns: "the host name does not resolve",
+    refused: "the connection was refused \u2014 nothing is listening there",
+    tls: "the TLS certificate was rejected",
+    timeout: "no answer before the timeout",
+    reset: "the connection was cut mid-request",
+    bad_port: "that port is one Node and every browser refuse to open",
+    unknown: "no HTTP response"
+  };
+  return `${phrase[reason]} (${detail})`;
+}
+var init_server_probe = __esm({
+  "src/server-probe.ts"() {
+    "use strict";
+  }
+});
+
 // src/client-events.ts
 var client_events_exports = {};
 __export(client_events_exports, {
@@ -20758,6 +20898,7 @@ async function fetchTenantSyncConfig(cred) {
     persistSyncConfig(base2, config2);
     return config2;
   } catch (err) {
+    if (isSyncRulesRefusal(err)) throw err;
     return lastKnownSyncConfig(base2, err instanceof Error ? err.message : "request failed");
   }
 }
@@ -20767,9 +20908,14 @@ function lastKnownSyncConfig(base2, reason) {
     console.error(`[sync] could not read server-side sync rules (${reason}) \u2014 applying the last known set from ${new Date(remembered.fetchedAt).toISOString()}`);
     return remembered.config;
   }
-  throw new Error(
+  const refusal = new Error(
     `Cannot read the server-side sync rules from ${base2} (${reason}), and this machine has never successfully read them. Refusing to sync: uploading without knowing your exclusions could ship a project you told the dashboard to hold back. Fix the server or retry.`
   );
+  refusal[SYNC_RULES_REFUSAL] = true;
+  throw refusal;
+}
+function isSyncRulesRefusal(err) {
+  return !!err && typeof err === "object" && err[SYNC_RULES_REFUSAL] === true;
 }
 function deviceLabel() {
   try {
@@ -21030,7 +21176,12 @@ async function verifyServerApi(serverUrl, minApi) {
   const base2 = serverUrl.replace(/\/$/, "");
   const seen = capsOk.get(base2);
   if (seen !== void 0 && Date.now() - seen < CAPS_TTL_MS) return true;
-  const caps = await fetchWithTimeout(`${base2}/api/capabilities`).then((r) => r.json());
+  const { probeServer: probeServer2, probeAdvice: probeAdvice2 } = await Promise.resolve().then(() => (init_server_probe(), server_probe_exports));
+  const probe = await probeServer2(base2, {
+    fetchImpl: ((url, init) => fetchWithTimeout(String(url), init ?? {}))
+  });
+  if (probe.kind !== "ok") throw new Error(probeAdvice2(probe, base2));
+  const caps = probe.raw;
   if ((caps.apiVersion ?? 0) < minApi) {
     throw new Error(`server too old: apiVersion ${caps.apiVersion ?? "none"} < required ${minApi} \u2014 update the server image before syncing`);
   }
@@ -22020,7 +22171,7 @@ async function syncIncremental(opts = {}) {
     lock.release();
   }
 }
-var ownVersion, walkProgressForUpload, lastServerPackSpec, credPath, _securityConfigCache, SECURITY_CONFIG_TTL_MS, _syncConfigCache, EMPTY_SYNC_CONFIG, _fetchTenantSyncConfigForTests, hashPath, MAX_DERIVED_ROW_BYTES, isLocalHost, CAPS_TTL_MS, capsOk, advertisedIngestConc, advertisedGzipBody, FULL_BUILD_MAX_BYTES, FULL_BUILD_TAIL_BYTES, BATCH_SCAN_MAX_BYTES;
+var ownVersion, walkProgressForUpload, lastServerPackSpec, credPath, _securityConfigCache, SECURITY_CONFIG_TTL_MS, _syncConfigCache, EMPTY_SYNC_CONFIG, _fetchTenantSyncConfigForTests, SYNC_RULES_REFUSAL, hashPath, MAX_DERIVED_ROW_BYTES, isLocalHost, CAPS_TTL_MS, capsOk, advertisedIngestConc, advertisedGzipBody, FULL_BUILD_MAX_BYTES, FULL_BUILD_TAIL_BYTES, BATCH_SCAN_MAX_BYTES;
 var init_sync_client = __esm({
   "src/sync-client.ts"() {
     "use strict";
@@ -22066,7 +22217,7 @@ var init_sync_client = __esm({
       ownVersion = JSON.parse(readFileSync37(join44(dir, "../package.json"), "utf-8")).version || ownVersion;
     } catch {
       try {
-        if (true) ownVersion = "0.5.21";
+        if (true) ownVersion = "0.5.23";
       } catch {
       }
     }
@@ -22078,6 +22229,7 @@ var init_sync_client = __esm({
     _syncConfigCache = /* @__PURE__ */ new Map();
     EMPTY_SYNC_CONFIG = { excludeTools: [], excludeProjects: [], excludeSources: [], approveSources: [] };
     _fetchTenantSyncConfigForTests = fetchTenantSyncConfig;
+    SYNC_RULES_REFUSAL = /* @__PURE__ */ Symbol.for("chat-recall.syncRulesRefusal");
     hashPath = (p) => p ? "p_" + createHash13("sha256").update(p).digest("hex").slice(0, 12) : "";
     MAX_DERIVED_ROW_BYTES = 2 * 1024 * 1024;
     isLocalHost = isPrivateHost;
@@ -22237,75 +22389,6 @@ var init_which = __esm({
   }
 });
 
-// ../engine/dist/core/sync-scope.js
-var sync_scope_exports = {};
-__export(sync_scope_exports, {
-  summariseSyncScope: () => summariseSyncScope
-});
-function summariseSyncScope(sinceMs = 0) {
-  const sync = loadSettings().sync;
-  const excludeProjects = sync?.excludeProjects ?? [];
-  const excludeTools = new Set(sync?.excludeTools ?? []);
-  const allowlistMode = (sync?.syncMode ?? "all") === "only";
-  const syncOnly2 = new Set(sync?.syncOnlyProjects ?? []);
-  const perProject = /* @__PURE__ */ new Map();
-  const perTool = /* @__PURE__ */ new Map();
-  for (const backend of listAvailableBackends()) {
-    let refs = [];
-    try {
-      refs = backend.listSessions({ sinceMs });
-    } catch {
-      continue;
-    }
-    for (const ref of refs) {
-      const projectPath = ref.projectPath || "";
-      const toolId = ref.toolId || backend.id;
-      let heldBackBy = null;
-      if (excludeTools.has(toolId))
-        heldBackBy = "excluded-tool";
-      else if (excludeProjects.some((x) => projectPathIncludes(projectPath, x)))
-        heldBackBy = "excluded-project";
-      else if (!isProjectSyncable(idOf(projectPath), projectPath, { syncMode: sync?.syncMode, syncOnly: syncOnly2 })) {
-        heldBackBy = "not-in-allowlist";
-      }
-      const id = idOf(projectPath);
-      const key2 = `${id}\0${projectPath}`;
-      const row = perProject.get(key2) ?? { id, projectPath, sessions: 0, heldBackBy };
-      row.sessions++;
-      row.heldBackBy = row.heldBackBy ?? heldBackBy;
-      perProject.set(key2, row);
-      if (!heldBackBy)
-        perTool.set(toolId, (perTool.get(toolId) ?? 0) + 1);
-    }
-  }
-  const projects = [...perProject.values()].sort((a, b) => b.sessions - a.sessions);
-  const noPathSessions = projects.filter((p) => !p.projectPath && !p.heldBackBy).reduce((n, p) => n + p.sessions, 0);
-  return {
-    included: projects.filter((p) => !p.heldBackBy).reduce((n, p) => n + p.sessions, 0),
-    heldBack: projects.filter((p) => p.heldBackBy).reduce((n, p) => n + p.sessions, 0),
-    byTool: [...perTool.entries()].map(([tool, sessions]) => ({ tool, sessions })).sort((a, b) => b.sessions - a.sessions),
-    projects,
-    allowlistMode,
-    noPathSessions
-  };
-}
-function idOf(projectPath) {
-  if (!projectPath)
-    return "";
-  const r = resolveProjectId(projectPath);
-  return r.source === "ignored" ? "" : r.id;
-}
-var init_sync_scope = __esm({
-  "../engine/dist/core/sync-scope.js"() {
-    "use strict";
-    init_tool_backend();
-    init_backends();
-    init_project_resolver();
-    init_settings();
-    init_project_path_match();
-  }
-});
-
 // ../engine/dist/core/mcp-clients.js
 var mcp_clients_exports = {};
 __export(mcp_clients_exports, {
@@ -23571,7 +23654,7 @@ __export(toolkit_pull_exports, {
   portableCommand: () => portableCommand
 });
 import { existsSync as existsSync48, mkdirSync as mkdirSync14, statSync as statSync42, writeFileSync as writeFileSync15 } from "node:fs";
-import { delimiter as delimiter3, dirname as dirname22, join as join52, basename as basename25, isAbsolute as isAbsolute3 } from "node:path";
+import { dirname as dirname22, join as join52, basename as basename25, isAbsolute as isAbsolute3 } from "node:path";
 function isExecutableFile(p) {
   try {
     return statSync42(p).isFile();
@@ -23580,13 +23663,7 @@ function isExecutableFile(p) {
   }
 }
 function onPath(name) {
-  const dirs = (process.env.PATH || "").split(delimiter3).filter(Boolean);
-  for (const d of dirs) {
-    const candidate = join52(d, name);
-    if (isExecutableFile(candidate))
-      return candidate;
-  }
-  return null;
+  return resolveOnPath(name);
 }
 function portableCommand(cmd) {
   if (!isAbsolute3(cmd)) {
@@ -23848,6 +23925,7 @@ var NOT_REBUILDABLE;
 var init_toolkit_pull = __esm({
   "../engine/dist/core/toolkit-pull.js"() {
     "use strict";
+    init_which();
     init_toolkit_sync();
     init_artifact_codec();
     NOT_REBUILDABLE = {
@@ -24214,74 +24292,6 @@ var init_escalate = __esm({
   }
 });
 
-// src/server-probe.ts
-var server_probe_exports = {};
-__export(server_probe_exports, {
-  probeAdvice: () => probeAdvice,
-  probeOk: () => probeOk,
-  probeServer: () => probeServer
-});
-function probeOk(r) {
-  return r.kind === "ok" && r.apiVersion >= 2;
-}
-async function probeServer(base2, opts = {}) {
-  const f = opts.fetchImpl || fetch;
-  let res;
-  try {
-    res = await f(`${base2.replace(/\/+$/, "")}/api/capabilities`, {
-      signal: AbortSignal.timeout(opts.timeoutMs ?? 1e4)
-    });
-  } catch (err) {
-    return { kind: "unreachable", error: err instanceof Error ? err.message : String(err) };
-  }
-  if (res.status === 401 || res.status === 403) return { kind: "unauthorized", status: res.status };
-  if (res.status === 404 || res.status === 410) return { kind: "moved", status: res.status };
-  if (res.status >= 500) return { kind: "server_error", status: res.status };
-  if (!res.ok) return { kind: "moved", status: res.status };
-  let body;
-  try {
-    body = await res.text();
-  } catch (err) {
-    return { kind: "unreachable", error: err instanceof Error ? err.message : String(err) };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(body);
-  } catch {
-    return { kind: "not_api", status: res.status, snippet: body.trim().slice(0, 60) };
-  }
-  if (typeof parsed?.apiVersion !== "number") {
-    return { kind: "not_api", status: res.status, snippet: body.trim().slice(0, 60) };
-  }
-  return {
-    kind: "ok",
-    apiVersion: parsed.apiVersion,
-    edition: parsed.edition,
-    cliVersion: parsed.cli?.version
-  };
-}
-function probeAdvice(r, base2) {
-  switch (r.kind) {
-    case "ok":
-      return r.apiVersion >= 2 ? `apiVersion ${r.apiVersion}${r.edition ? `, edition ${r.edition}` : ""}` : `apiVersion ${r.apiVersion} is too old for this CLI \u2014 upgrade the server`;
-    case "moved":
-      return `HTTP ${r.status} \u2014 nothing is served at ${base2}. If the host moved, re-point it: \`chat-recall login <new-server-url>\``;
-    case "unauthorized":
-      return `HTTP ${r.status} \u2014 ${base2} rejected the credential. Re-login: \`chat-recall login ` + base2 + "`";
-    case "server_error":
-      return `HTTP ${r.status} \u2014 ${base2} is up but failing. Nothing to fix locally; check the server.`;
-    case "not_api":
-      return `${base2} answered ${r.status} with something that is not the chat-recall API (${JSON.stringify(r.snippet)}) \u2014 check the URL, a proxy or a captive portal`;
-    case "unreachable":
-      return `no HTTP response from ${base2} (${r.error}) \u2014 check the URL, DNS, or that the server is running`;
-  }
-}
-var init_server_probe = __esm({
-  "src/server-probe.ts"() {
-    "use strict";
-  }
-});
-
 // src/verify-deep.ts
 var verify_deep_exports = {};
 __export(verify_deep_exports, {
@@ -25862,7 +25872,7 @@ var init_intent_drain = __esm({
       ownVersion2 = JSON.parse(readFileSync46(join55(dir, "../package.json"), "utf-8")).version || ownVersion2;
     } catch {
       try {
-        if (true) ownVersion2 = "0.5.21";
+        if (true) ownVersion2 = "0.5.23";
       } catch {
       }
     }
@@ -27137,6 +27147,24 @@ __export(device_auth_exports, {
   deviceLogin: () => deviceLogin
 });
 import { createHash as createHash19, randomBytes } from "node:crypto";
+async function readDeviceCode(res, where) {
+  const text = await res.text().catch(() => "");
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new Error(
+      `${where} answered ${res.status} with something that is not a device-code response (${JSON.stringify(text.trim().slice(0, 60))}) \u2014 this host is not serving the chat-recall API`
+    );
+  }
+  const d = parsed;
+  if (typeof d?.device_code !== "string" || typeof d?.user_code !== "string" || typeof d?.verification_uri !== "string" || typeof d?.expires_in !== "number") {
+    throw new Error(
+      `${where} answered ${res.status} with JSON that is not a device-code response (${JSON.stringify(text.trim().slice(0, 60))}) \u2014 this host is not serving the chat-recall API`
+    );
+  }
+  return d;
+}
 async function deviceLogin(opts, onPrompt) {
   const issuer = (opts.issuer || DEFAULT_ISSUER).replace(/\/+$/, "");
   if (!issuer) {
@@ -27156,7 +27184,7 @@ async function deviceLogin(opts, onPrompt) {
   if (!startRes.ok) {
     throw new Error(`device-auth init failed: HTTP ${startRes.status} ${await startRes.text().catch(() => "")}`);
   }
-  const start = await startRes.json();
+  const start = await readDeviceCode(startRes, issuer);
   onPrompt({
     url: start.verification_uri_complete || start.verification_uri,
     userCode: start.user_code,
@@ -27210,7 +27238,7 @@ async function betterAuthDeviceLogin(serverUrl, onPrompt) {
   if (!startRes.ok) {
     throw new Error(`device-auth init failed: HTTP ${startRes.status} ${await startRes.text().catch(() => "")}`);
   }
-  const start = await startRes.json();
+  const start = await readDeviceCode(startRes, base2);
   onPrompt({
     url: start.verification_uri_complete || start.verification_uri,
     userCode: start.user_code,
@@ -27261,6 +27289,50 @@ var init_device_auth = __esm({
   }
 });
 
+// src/install-report.ts
+var install_report_exports = {};
+__export(install_report_exports, {
+  reportInstallFailure: () => reportInstallFailure
+});
+async function reportInstallFailure(serverUrl, failure, opts = {}) {
+  if (!serverUrl) return false;
+  if (!userConsents() && !mayReport(serverUrl)) return false;
+  const payload = {
+    step: failure.step,
+    reason: trim(failure.reason, 40),
+    message: trim(failure.message, 200),
+    cliVersion: trim(process.env.CHAT_RECALL_CLI_VERSION, 20),
+    node: trim(process.versions.node, 20),
+    os: `${process.platform}-${process.arch}`
+  };
+  try {
+    assertNoSensitiveKeys(payload);
+  } catch {
+    return false;
+  }
+  const f = opts.fetchImpl || fetch;
+  try {
+    const res = await f(`${serverUrl.replace(/\/+$/, "")}/install/report`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(payload),
+      signal: AbortSignal.timeout(opts.timeoutMs ?? 3e3)
+    });
+    return res.ok || res.status === 204;
+  } catch {
+    return false;
+  }
+}
+function trim(v, n) {
+  return typeof v === "string" && v.trim() ? v.trim().slice(0, n) : null;
+}
+var init_install_report = __esm({
+  "src/install-report.ts"() {
+    "use strict";
+    init_telemetry_consent();
+  }
+});
+
 // ../engine/dist/core/resume-command.js
 function toolOfSessionId(sessionId) {
   if (sessionId.startsWith("codex_"))
@@ -27337,6 +27409,7 @@ function tierAll(results) {
 // src/cli.ts
 init_sync_client();
 init_update_notice();
+init_server_probe();
 init_which();
 init_collector_health();
 init_telemetry_consent();
@@ -27377,54 +27450,15 @@ function firstTarget() {
   if (!cred) return null;
   return { base: cred.serverUrl.replace(/\/+$/, ""), token: cred.token };
 }
-async function confirmFirstSyncScope(skipPause) {
-  const { summariseSyncScope: summariseSyncScope2 } = await Promise.resolve().then(() => (init_sync_scope(), sync_scope_exports));
-  let scope;
-  try {
-    scope = summariseSyncScope2();
-  } catch {
-    console.log(chalk.dim("   (could not summarise local scope \u2014 proceeding)"));
-    return true;
-  }
-  console.log(chalk.bold("6. What would leave this machine"));
-  if (scope.included === 0 && scope.heldBack === 0) {
-    console.log(chalk.dim("   No local sessions found yet \u2014 nothing to ship."));
-    return true;
-  }
-  const tools = scope.byTool.map((t) => `${t.tool} ${t.sessions}`).join(", ");
-  console.log(`   ${chalk.bold(String(scope.included))} session(s) would upload${tools ? chalk.dim(`  (${tools})`) : ""}`);
-  if (scope.heldBack > 0) {
-    console.log(`   ${chalk.green(String(scope.heldBack))} held back by your existing rules`);
-  }
-  if (scope.allowlistMode) {
-    console.log(chalk.yellow("   Allowlist mode is on \u2014 only the projects you listed would ship."));
-  }
-  if (scope.noPathSessions > 0) {
-    console.log(`   ${chalk.yellow(String(scope.noPathSessions))} of those carry no project path \u2014 only \`exclude tool\` can hold those back`);
-  }
-  const shown = scope.projects.filter((p) => !p.heldBackBy).slice(0, 8);
-  for (const p of shown) {
-    console.log(`     ${chalk.cyan(p.projectPath || p.id)} ${chalk.dim(`\xB7 ${p.sessions}`)}`);
-  }
-  const more = scope.projects.filter((p) => !p.heldBackBy).length - shown.length;
-  if (more > 0) console.log(chalk.dim(`     \u2026and ${more} more project(s)`));
-  console.log(chalk.dim("   Secrets are masked on this machine before anything uploads."));
-  console.log(chalk.dim("   Hold one back:  chat-recall exclude project <path>"));
-  console.log(chalk.dim("   Or invert it:   chat-recall sync-only add <project>"));
-  if (skipPause || !process.stdin.isTTY) {
-    console.log();
-    return true;
-  }
-  const { createInterface: createInterface3 } = await import("node:readline/promises");
-  const rl = createInterface3({ input: process.stdin, output: process.stdout });
-  const answer = (await rl.question("   Upload these now? [Y/n] ")).trim().toLowerCase();
-  rl.close();
-  if (answer === "n" || answer === "no") {
-    console.log(chalk.dim("   Skipped. Set your rules, then run `chat-recall sync`."));
-    return false;
-  }
-  console.log();
-  return true;
+function describeProbeError(err) {
+  const msg = err instanceof Error ? err.message : String(err);
+  if (!/fetch failed|ECONN|ENOTFOUND|EAI_AGAIN|ETIMEDOUT|CERT_|aborted|timeout/i.test(msg)) return msg;
+  return describeUnreachable(err);
+}
+function failLogin(opts, message) {
+  if (opts.fromInit) throw new Error(message);
+  console.error(chalk.red("login failed:"), message);
+  process.exit(1);
 }
 function requireTarget() {
   const t = firstTarget();
@@ -27434,11 +27468,21 @@ function requireTarget() {
   }
   return t;
 }
+async function readJsonBody(res, base2, what) {
+  const text = await res.text().catch(() => "");
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new Error(
+      `${base2} answered ${res.status} with something that is not JSON (${JSON.stringify(text.trim().slice(0, 60))}) for ${what} \u2014 a proxy, a captive portal or a host that no longer serves the chat-recall API`
+    );
+  }
+}
 async function serverGet(path) {
   const t = requireTarget();
   const res = await fetch(t.base + path, { headers: t.token ? { authorization: `Bearer ${t.token}` } : {} });
   if (!res.ok) throw new Error(`server ${path}: HTTP ${res.status} ${await res.text().catch(() => "")}`);
-  return res.json();
+  return readJsonBody(res, t.base, `GET ${path}`);
 }
 async function serverGetSoft(path) {
   const t = requireTarget();
@@ -27448,7 +27492,7 @@ async function serverGetSoft(path) {
     return { status: res.status, data: null, message: body.message };
   }
   if (!res.ok) throw new Error(`server ${path}: HTTP ${res.status} ${await res.text().catch(() => "")}`);
-  return { status: res.status, data: await res.json() };
+  return { status: res.status, data: await readJsonBody(res, t.base, `GET ${path}`) };
 }
 async function serverPost(path, body) {
   const t = requireTarget();
@@ -27458,7 +27502,7 @@ async function serverPost(path, body) {
     body: JSON.stringify(body)
   });
   if (!res.ok) throw new Error(`server ${path}: HTTP ${res.status} ${await res.text().catch(() => "")}`);
-  return res.json();
+  return readJsonBody(res, t.base, `POST ${path}`);
 }
 async function serverPatch(path, body) {
   const t = requireTarget();
@@ -27468,7 +27512,7 @@ async function serverPatch(path, body) {
     body: JSON.stringify(body)
   });
   if (!res.ok) throw new Error(`server ${path}: HTTP ${res.status} ${await res.text().catch(() => "")}`);
-  return res.json();
+  return readJsonBody(res, t.base, `PATCH ${path}`);
 }
 async function serverDelete(path, body) {
   const t = requireTarget();
@@ -27478,12 +27522,19 @@ async function serverDelete(path, body) {
     body: JSON.stringify(body)
   });
   if (!res.ok) throw new Error(`server ${path}: HTTP ${res.status} ${await res.text().catch(() => "")}`);
-  return res.json();
+  return readJsonBody(res, t.base, `DELETE ${path}`);
 }
+var pkgEngines = (() => {
+  try {
+    return JSON.parse(readFileSync49(new URL("../package.json", import.meta.url), "utf-8")).engines?.node ?? "";
+  } catch {
+    return "";
+  }
+})();
 var pkgVersion = JSON.parse(
   readFileSync49(new URL("../package.json", import.meta.url), "utf-8")
 ).version;
-var DEFAULT_SERVER = "https://chatrecall.dev";
+var DEFAULT_SERVER = (process.env.CHAT_RECALL_DEFAULT_SERVER || "https://chatrecall.dev").replace(/\/+$/, "");
 var DEFAULT_ALLOW = [
   "recall_search",
   "recall_show",
@@ -27556,11 +27607,21 @@ var DEFAULT_ALLOW = [
   "recall_toolkit_sync"
 ];
 var SELF_HOST_DOCS = "https://github.com/munhq/chat-recall/blob/main/docs/SELF_HOSTING.md";
+function enforceNodeVersion() {
+  const required = Number(/(\d+)/.exec(String(pkgEngines))?.[1] ?? 0);
+  const found = Number(process.versions.node.split(".")[0]);
+  if (!required || !found || found >= required) return;
+  console.error(`chat-recall needs Node ${required} or newer. This is Node ${process.versions.node}.`);
+  console.error(`Install it with your version manager (\`nvm install ${required}\`, \`fnm install ${required}\`, \`brew upgrade node\`), then run this again.`);
+  process.exit(1);
+}
+process.env.CHAT_RECALL_CLI_VERSION = pkgVersion;
+enforceNodeVersion();
 var program = new Command();
 program.name("chat-recall").description("Semantic search for Claude Code sessions - recall and resume past conversations").version(pkgVersion);
 program.command("init").description("Set up chat-recall: connect to your server, configure MCP, ship your local sessions").option("--server <url>", "chat-recall server URL to connect this machine to").option("--token <token>", "Self-host device token (skips the interactive OIDC login)").option("--skip-mcp", "Skip MCP server configuration").option("--skip-sync", "Skip the first session sync").option("--with-codeindex", "Force-download the codeindex binary during init. Default behavior is to detect an already-installed codeindex on PATH and register it as an MCP server.").option("--skip-codeindex", "Skip the codeindex companion entirely (no detection, no registration).").option("--skip-service", "Skip installing the per-user background sync service (Linux/macOS/Windows). By default init installs it so new conversations ship automatically.").option("--yes", "Do not pause before the first upload. The scope summary still prints.", false).option("--prompt-json", "Print the device prompt as one JSON line on stdout, then continue", false).action(async (options) => {
   try {
-    console.log(chalk.bold("chat-recall init"));
+    console.log(chalk.bold("chat-recall init") + chalk.dim(`  v${pkgVersion}`));
     console.log();
     console.log(chalk.bold("1. Detecting AI tools..."));
     const clis = [
@@ -27585,9 +27646,15 @@ program.command("init").description("Set up chat-recall: connect to your server,
     console.log();
     console.log(chalk.bold("2. Connecting to your server..."));
     let target = firstTarget();
+    let deadTarget = false;
     if (options.server) {
-      await runLogin(options.server, { token: options.token, fromInit: true, promptJson: options.promptJson });
-      target = firstTarget();
+      try {
+        await runLogin(options.server, { token: options.token, fromInit: true, promptJson: options.promptJson });
+        target = firstTarget();
+      } catch (e) {
+        console.log(`   ${chalk.yellow("Not connected.")} ${describeProbeError(e)}`);
+        console.log(`   ${chalk.dim(`Run ${chalk.bold(`chat-recall login ${options.server}`)} when ready, or self-host: ${SELF_HOST_DOCS}`)}`);
+      }
     } else if (!target) {
       console.log(`   Connecting to ${chalk.bold(DEFAULT_SERVER)} \u2014 sign in to approve this machine.`);
       console.log(`   ${chalk.dim(`Prefer your own server? ${chalk.bold("--server <url>")}. Self-hosting is free: ${SELF_HOST_DOCS}`)}`);
@@ -27595,16 +27662,43 @@ program.command("init").description("Set up chat-recall: connect to your server,
         await runLogin(DEFAULT_SERVER, { token: options.token, fromInit: true, promptJson: options.promptJson });
         target = firstTarget();
       } catch (e) {
-        console.log(`   ${chalk.yellow("Not connected.")} ${e instanceof Error ? e.message : e}`);
+        console.log(`   ${chalk.yellow("Not connected.")} ${describeProbeError(e)}`);
         console.log(`   ${chalk.dim(`Run ${chalk.bold("chat-recall login <server-url>")} when ready, or self-host: ${SELF_HOST_DOCS}`)}`);
       }
     }
-    if (target) {
+    if (target && !options.server) {
+      const { probeServer: probeServer2, probeOk: probeOk2, probeAdvice: probeAdvice2 } = await Promise.resolve().then(() => (init_server_probe(), server_probe_exports));
+      const probe = await probeServer2(target.base, { timeoutMs: 1e4 });
+      if (probeOk2(probe)) {
+        console.log(`   ${chalk.green("Connected")} \u2192 ${target.base}`);
+      } else if (probe.kind === "moved" || probe.kind === "not_api") {
+        const retired = target.base;
+        console.log(`   ${chalk.yellow("The saved server no longer serves chat-recall")} \u2192 ${retired}`);
+        console.log(`   ${probeAdvice2(probe, retired)}`);
+        console.log(`   Switching to ${chalk.bold(DEFAULT_SERVER)} \u2014 sign in to approve this machine.`);
+        try {
+          await runLogin(DEFAULT_SERVER, { token: options.token, fromInit: true, promptJson: options.promptJson });
+          const { removeCredentials: removeCredentials2 } = await Promise.resolve().then(() => (init_sync_client(), sync_client_exports));
+          if (removeCredentials2(retired)) {
+            console.log(`   ${chalk.dim(`Removed the retired target ${retired} (log in there again any time).`)}`);
+          }
+          target = firstTarget();
+          if (target) console.log(`   ${chalk.green("Connected")} \u2192 ${target.base}`);
+        } catch (e) {
+          console.log(`   ${chalk.yellow("Not connected.")} ${describeProbeError(e)}`);
+          console.log(`   ${chalk.dim(`Run ${chalk.bold(`chat-recall login ${DEFAULT_SERVER}`)} when ready, then ${chalk.bold(`chat-recall logout ${retired}`)}.`)}`);
+          deadTarget = true;
+        }
+      } else {
+        console.log(`   ${chalk.yellow("Saved server did not answer")} \u2192 ${target.base}`);
+        console.log(`   ${probeAdvice2(probe, target.base)}`);
+      }
+    } else if (target) {
       console.log(`   ${chalk.green("Connected")} \u2192 ${target.base}`);
     }
     console.log();
     if (!options.skipMcp) {
-      console.log(chalk.bold("4. Configuring MCP server..."));
+      console.log(chalk.bold("3. Configuring MCP server..."));
       const projectRoot = join60(import.meta.dirname, "..");
       let mcpBinOnPath = false;
       mcpBinOnPath = isOnPath("chat-recall-mcp");
@@ -27629,13 +27723,13 @@ program.command("init").description("Set up chat-recall: connect to your server,
       }
       console.log(chalk.dim(`   Launch: ${launch.command}${launch.args ? " " + launch.args.join(" ") : ""}`));
     } else {
-      console.log(chalk.bold("4. Skipping MCP configuration (--skip-mcp)"));
+      console.log(chalk.bold("3. Skipping MCP configuration (--skip-mcp)"));
     }
     console.log();
     const skipCodeindex = options.skipCodeindex === true;
     const forceInstall = options.withCodeindex === true || process.env.CHAT_RECALL_WITH_CODEINDEX === "1";
     if (skipCodeindex) {
-      console.log(chalk.bold("5. Skipping codeindex companion (--skip-codeindex)"));
+      console.log(chalk.bold("4. Skipping codeindex companion (--skip-codeindex)"));
     } else {
       const {
         checkCodeindexStatus: checkCodeindexStatus2,
@@ -27645,7 +27739,7 @@ program.command("init").description("Set up chat-recall: connect to your server,
       } = await Promise.resolve().then(() => (init_companions(), companions_exports));
       const detected = checkCodeindexStatus2();
       if (detected.installed && !forceInstall) {
-        console.log(chalk.bold("5. Detected codeindex companion"));
+        console.log(chalk.bold("4. Detected codeindex companion"));
         console.log(`   ${chalk.green("codeindex")}: ${detected.path}`);
         if (!options.skipMcp) {
           const mcpJsonPath = join60(homedir22(), ".mcp.json");
@@ -27654,7 +27748,7 @@ program.command("init").description("Set up chat-recall: connect to your server,
           else console.log(`   codeindex MCP server: ${chalk.green("already registered")}`);
         }
       } else if (forceInstall) {
-        console.log(chalk.bold("5. Installing codeindex companion (--with-codeindex)..."));
+        console.log(chalk.bold("4. Installing codeindex companion (--with-codeindex)..."));
         try {
           const result = await installCodeindex2({ force: true });
           if (result.installed) {
@@ -27677,7 +27771,7 @@ program.command("init").description("Set up chat-recall: connect to your server,
           }
         }
       } else {
-        console.log(chalk.bold("5. codeindex companion: not installed"));
+        console.log(chalk.bold("4. codeindex companion: not installed"));
         console.log(chalk.dim("   codeindex is a separate MCP server for code-level lookup \u2014"));
         console.log(chalk.dim("   find_symbol, plan_change, get_change_impact, etc."));
         console.log(chalk.dim("   To install: `chat-recall init --with-codeindex`"));
@@ -27708,22 +27802,40 @@ program.command("init").description("Set up chat-recall: connect to your server,
         const { executePull: executePull2 } = await Promise.resolve().then(() => (init_toolkit_pull(), toolkit_pull_exports));
         const { hostname: hostname3 } = await import("node:os");
         const rows = [];
+        let answered = 0;
+        const askFailed = [];
         for (const t of loadAllCredentials2()) {
           try {
             const res = await fetch(`${t.serverUrl}/api/toolkit/browse/mcp?limit=1000`, {
               headers: t.token ? { authorization: `Bearer ${t.token}` } : {},
               signal: AbortSignal.timeout(2e4)
             });
-            if (!res.ok) continue;
-            const body = await res.json();
+            if (!res.ok) {
+              askFailed.push(`${t.serverUrl} (HTTP ${res.status})`);
+              continue;
+            }
+            const text = await res.text();
+            let body;
+            try {
+              body = JSON.parse(text);
+            } catch {
+              askFailed.push(`${t.serverUrl} (not JSON: ${JSON.stringify(text.trim().slice(0, 40))})`);
+              continue;
+            }
+            answered++;
             for (const it of body.items || []) rows.push(it);
-          } catch {
+          } catch (e) {
+            askFailed.push(`${t.serverUrl} (${describeProbeError(e)})`);
           }
         }
         const report = executePull2(rows, { thisDeviceId: hostname3(), types: ["mcp"] });
         const written = report.outcomes.filter((o) => o.status === "written");
         const present = report.outcomes.filter((o) => o.status === "present").length;
-        if (written.length === 0 && present === 0) {
+        if (answered === 0) {
+          console.log(`   ${chalk.yellow("Could not ask your server what MCP servers are on your account")}`);
+          for (const f of askFailed) console.log(`   ${chalk.dim(f)}`);
+          console.log(`   ${chalk.dim("Re-run `chat-recall toolkit pull` once the server answers.")}`);
+        } else if (written.length === 0 && present === 0) {
           console.log(chalk.dim("   Nothing on your account to install yet."));
         } else {
           console.log(`   ${chalk.green(`Installed ${written.length}`)} ${chalk.dim(`(${present} already present)`)}`);
@@ -27738,28 +27850,26 @@ program.command("init").description("Set up chat-recall: connect to your server,
       }
       console.log();
     }
-    if (!options.skipSync && firstTarget()) {
-      const shipped = await confirmFirstSyncScope(!!options.yes);
-      if (!shipped) {
-        console.log();
-      } else {
-        console.log(chalk.dim("   Shipping..."));
-        try {
-          const { syncSessions: syncSessions2 } = await Promise.resolve().then(() => (init_sync_client(), sync_client_exports));
-          const r = await syncSessions2();
-          console.log(`   ${chalk.green(`Synced ${r.uploaded} session(s), ${r.items} item(s)`)} ${chalk.dim(`\u2014 ${r.links} links, ${r.derived} derived rows, ${r.kgTriples} KG triples, ${r.skipped} skipped, ${r.redactions} secrets redacted, ${r.findings} secret findings${r.scanned ? ` (scanned ${r.scanned} in ${r.scanMs}ms)` : ""}`)}`);
-        } catch (err) {
-          console.log(`   ${chalk.yellow("Sync failed")} \u2014 ${err instanceof Error ? err.message : err}`);
-          console.log(`   ${chalk.dim("Re-run `chat-recall sync` once your server is reachable.")}`);
-        }
+    if (deadTarget) {
+      console.log(chalk.bold("5. Skipping first sync \u2014 the saved server is not serving chat-recall"));
+      console.log(`   ${chalk.dim(`Re-point with the two commands above, then run ${chalk.bold("chat-recall sync")}.`)}`);
+    } else if (!options.skipSync && firstTarget()) {
+      console.log(chalk.bold("5. Indexing and uploading your sessions"));
+      try {
+        const { syncSessions: syncSessions2 } = await Promise.resolve().then(() => (init_sync_client(), sync_client_exports));
+        const r = await syncSessions2();
+        console.log(`   ${chalk.green(`Synced ${r.uploaded} session(s), ${r.items} item(s)`)} ${chalk.dim(`\u2014 ${r.links} links, ${r.derived} derived rows, ${r.kgTriples} KG triples, ${r.skipped} skipped, ${r.redactions} secrets redacted, ${r.findings} secret findings${r.scanned ? ` (scanned ${r.scanned} in ${r.scanMs}ms)` : ""}`)}`);
+      } catch (err) {
+        console.log(`   ${chalk.yellow("Sync failed")} \u2014 ${err instanceof Error ? err.message : err}`);
+        console.log(`   ${chalk.dim("Re-run `chat-recall sync` once your server is reachable.")}`);
       }
     } else if (!options.skipSync) {
-      console.log(chalk.bold("6. Skipping first sync (not logged in)"));
+      console.log(chalk.bold("5. Skipping first sync (not logged in)"));
     } else {
-      console.log(chalk.bold("6. Skipping first sync (--skip-sync)"));
+      console.log(chalk.bold("5. Skipping first sync (--skip-sync)"));
     }
     console.log();
-    console.log(chalk.bold("7. Background sync"));
+    console.log(chalk.bold("6. Background sync"));
     console.log(chalk.dim("   Runs via the MCP server while Claude Code is open (no extra service to install)."));
     console.log(chalk.dim("   Always-on / headless? Opt in with `chat-recall watch --install-service`."));
     void options.skipService;
@@ -29601,25 +29711,31 @@ async function runLogin(serverUrl, opts) {
       });
       return { ok: res.ok, status: res.status };
     } catch (err) {
-      return { ok: false, error: err instanceof Error ? err.message : String(err) };
+      return { ok: false, error: describeUnreachable(err) };
     }
   };
   if (opts.token) {
     const token = opts.token.trim();
     if (/[^\x21-\x7e]/.test(token)) {
-      console.error(chalk.red('login failed: the token contains non-ASCII characters \u2014 this looks like a masked/truncated copy (e.g. "ct_12345678\u2026").'));
       console.error(chalk.dim("Use the Copy button next to the token in the dashboard and paste the full line."));
-      process.exit(1);
+      return failLogin(opts, 'the token contains non-ASCII characters \u2014 this looks like a masked/truncated copy (e.g. "ct_12345678\u2026")');
     }
+    const { probeServer: identifyServer, probeOk: identified, probeAdvice: identifyAdvice } = await Promise.resolve().then(() => (init_server_probe(), server_probe_exports));
+    const who = await identifyServer(base2, { timeoutMs: 1e4 });
+    if (!identified(who)) return failLogin(opts, identifyAdvice(who, base2));
     const check = await verifyToken(token);
     if (!check.ok) {
       if (check.status === 401 || check.status === 403) {
-        console.error(chalk.red(`login failed: ${base2} rejected the token (HTTP ${check.status}).`));
         console.error(chalk.dim("Tokens are shown once \u2014 mint a fresh one (Account \u2192 Connect your machine) and copy the whole line."));
-      } else {
-        console.error(chalk.red(`login failed: could not verify the token against ${base2}:`), check.error || `HTTP ${check.status}`);
+        return failLogin(opts, `${base2} rejected the token (HTTP ${check.status})`);
       }
-      process.exit(1);
+      if (check.status !== void 0 && check.status >= 500) {
+        return failLogin(opts, `${base2} answered HTTP ${check.status} \u2014 the server is up but failing. The token was never checked. Nothing to fix locally.`);
+      }
+      if (check.status === 404 || check.status === 410) {
+        return failLogin(opts, `${base2} does not serve the chat-recall API (HTTP ${check.status}). If the server moved, log in to its new URL.`);
+      }
+      return failLogin(opts, `could not verify the token against ${base2}: ${check.error || `HTTP ${check.status}`}`);
     }
     saveCredentials2({ serverUrl, token });
     console.log(chalk.green("\u2713 Logged in.") + chalk.dim(`  server: ${serverUrl} (token verified)`));
@@ -29631,11 +29747,15 @@ async function runLogin(serverUrl, opts) {
     return;
   }
   try {
-    const probe = await fetch(`${base2}/api/status`, { signal: AbortSignal.timeout(8e3) });
-    if (probe.status === 200) {
-      saveCredentials2({ serverUrl, token: "" });
-      console.log(chalk.green("\u2713 Logged in.") + chalk.dim(`  ${serverUrl} (local server \u2014 no auth, no token needed)`));
-      return;
+    const { probeServer: probeServer2, probeOk: probeOk2 } = await Promise.resolve().then(() => (init_server_probe(), server_probe_exports));
+    const identified = await probeServer2(base2, { timeoutMs: 8e3 });
+    if (probeOk2(identified)) {
+      const probe = await fetch(`${base2}/api/status`, { signal: AbortSignal.timeout(8e3) });
+      if (probe.status === 200) {
+        saveCredentials2({ serverUrl, token: "" });
+        console.log(chalk.green("\u2713 Logged in.") + chalk.dim(`  ${serverUrl} (local server \u2014 no auth, no token needed)`));
+        return;
+      }
     }
   } catch {
   }
@@ -29649,19 +29769,18 @@ async function runLogin(serverUrl, opts) {
     let authProvider;
     let capsError = null;
     if (!issuer) {
+      const { probeServer: probeServer2, probeOk: probeOk2, probeAdvice: probeAdvice2 } = await Promise.resolve().then(() => (init_server_probe(), server_probe_exports));
       for (let attempt = 1; attempt <= 3 && !authProvider; attempt++) {
-        try {
-          const res = await fetch(`${base2}/api/capabilities`, { signal: AbortSignal.timeout(15e3) });
-          if (!res.ok) {
-            capsError = `HTTP ${res.status}`;
-          } else {
-            const caps = await res.json();
-            authProvider = caps?.authProvider;
-            if (caps?.oidcIssuer) issuer = caps.oidcIssuer;
-            capsError = null;
-          }
-        } catch (err) {
-          capsError = err instanceof Error ? err.message : String(err);
+        const probe = await probeServer2(base2, { timeoutMs: 15e3 });
+        if (probeOk2(probe)) {
+          const caps = probe.raw;
+          authProvider = caps?.authProvider;
+          if (caps?.oidcIssuer) issuer = caps.oidcIssuer;
+          capsError = null;
+        } else if (probe.kind === "moved" || probe.kind === "not_api") {
+          return failLogin(opts, probeAdvice2(probe, base2));
+        } else {
+          capsError = probeAdvice2(probe, base2);
         }
         if (!authProvider && attempt < 3) await new Promise((r) => setTimeout(r, attempt * 1e3));
       }
@@ -29670,6 +29789,12 @@ async function runLogin(serverUrl, opts) {
       authProvider = "better-auth";
       if (capsError) {
         console.log(`   ${chalk.yellow("Could not read the server's capabilities")} (${capsError}) \u2014 assuming the standard sign-in flow.`);
+        void Promise.resolve().then(() => (init_install_report(), install_report_exports)).then(({ reportInstallFailure: reportInstallFailure2 }) => reportInstallFailure2(base2, {
+          step: "cli_login_probe",
+          reason: capsError?.slice(0, 40) ?? null,
+          message: capsError
+        })).catch(() => {
+        });
       }
     }
     const onPrompt = (p) => {
@@ -29686,7 +29811,9 @@ async function runLogin(serverUrl, opts) {
     };
     const tokens = authProvider === "better-auth" ? await betterAuthDeviceLogin2(base2, onPrompt) : await deviceLogin2({ issuer, clientId: opts.clientId }, onPrompt);
     const authHdr = { authorization: `Bearer ${tokens.accessToken}`, "content-type": "application/json" };
-    const me = await fetch(`${base2}/api/me`, { headers: authHdr }).then((r) => r.json());
+    const meRes = await fetch(`${base2}/api/me`, { headers: authHdr });
+    if (!meRes.ok) throw new Error(`${base2}/api/me: HTTP ${meRes.status} ${await meRes.text().catch(() => "")}`);
+    const me = await readJsonBody(meRes, base2, "GET /api/me");
     const teams = me.teams || [];
     let slug = opts.team;
     if (!slug) {
@@ -29695,12 +29822,11 @@ async function runLogin(serverUrl, opts) {
         const name = me.user?.email?.split("@")[0]?.replace(/[^a-z0-9]/gi, "") || "workspace";
         const created = await fetch(`${base2}/api/teams`, { method: "POST", headers: authHdr, body: JSON.stringify({ name }) });
         if (!created.ok) throw new Error(`workspace create failed: HTTP ${created.status} ${await created.text().catch(() => "")}`);
-        slug = (await created.json()).slug;
+        slug = (await readJsonBody(created, base2, "POST /api/teams")).slug;
         console.log(chalk.dim(`Created workspace "${name}" (${slug}) \u2014 you're its owner.`));
       } else {
-        console.error(chalk.red("You belong to multiple teams \u2014 pass --team <slug>:"));
         teams.forEach((t) => console.error(`  ${t.team_slug}  ${chalk.dim(t.name)}`));
-        process.exit(1);
+        throw new Error("you belong to multiple teams \u2014 pass --team <slug> (listed above)");
       }
     }
     const deviceId = opts.deviceId || (await import("node:os")).hostname();
@@ -29710,13 +29836,14 @@ async function runLogin(serverUrl, opts) {
       body: JSON.stringify({ device_id: deviceId })
     });
     if (!mint.ok) throw new Error(`token mint failed: HTTP ${mint.status} ${await mint.text().catch(() => "")}`);
-    const { token } = await mint.json();
+    const { token } = await readJsonBody(mint, base2, "POST /api/teams/:slug/tokens");
     saveCredentials2({ serverUrl, token });
     console.log(chalk.green(`\u2713 Logged in to ${chalk.bold(slug)}`) + chalk.dim(`  (device: ${deviceId})  server: ${serverUrl}`));
     if (!opts.fromInit) {
       console.log(chalk.dim("Run `chat-recall sync` to push redacted conversations."));
     }
   } catch (err) {
+    if (opts.fromInit) throw err instanceof Error ? err : new Error(String(err));
     console.error(chalk.red("login failed:"), err instanceof Error ? err.message : err);
     process.exit(1);
   }