chat-recall 0.5.22 → 0.5.23

package/dist/cli.js

@@ -13470,8 +13470,11 @@ function isInside(child, parent) {
   return c.startsWith(p);
 }
 function globMatch(pattern, path) {
-  const re = new RegExp("^" + globToRegex(pattern) + "$");
-  return re.test(path);
+  const re = new RegExp("^" + globToRegex(toPosix(pattern)) + "$");
+  return re.test(toPosix(path));
+}
+function toPosix(p) {
+  return p.replace(/\\/g, "/");
 }
 function globToRegex(glob) {
   let out = "";
@@ -19727,7 +19730,7 @@ var init_http = __esm({
       CLI_VERSION = JSON.parse(readFileSync33(new URL("../package.json", import.meta.url), "utf-8")).version || CLI_VERSION;
     } catch {
       try {
-        if (true) CLI_VERSION = "0.5.22";
+        if (true) CLI_VERSION = "0.5.23";
       } catch {
       }
     }
@@ -20239,7 +20242,7 @@ var init_telemetry = __esm({
     init_sync_client();
     cliVersion2 = () => {
       try {
-        return true ? "0.5.22" : "dev";
+        return true ? "0.5.23" : "dev";
       } catch {
         return "dev";
       }
@@ -20351,6 +20354,143 @@ var init_collector_health = __esm({
   }
 });
 
+// src/server-probe.ts
+var server_probe_exports = {};
+__export(server_probe_exports, {
+  classifyUnreachable: () => classifyUnreachable,
+  describeCause: () => describeCause,
+  describeUnreachable: () => describeUnreachable,
+  probeAdvice: () => probeAdvice,
+  probeOk: () => probeOk,
+  probeServer: () => probeServer
+});
+function probeOk(r) {
+  return r.kind === "ok" && r.apiVersion >= 2;
+}
+async function probeServer(base2, opts = {}) {
+  const f = opts.fetchImpl || fetch;
+  let res;
+  try {
+    res = await f(`${base2.replace(/\/+$/, "")}/api/capabilities`, {
+      signal: AbortSignal.timeout(opts.timeoutMs ?? 1e4)
+    });
+  } catch (err) {
+    return {
+      kind: "unreachable",
+      error: describeCause(err),
+      reason: classifyUnreachable(err)
+    };
+  }
+  if (res.status === 401 || res.status === 403) return { kind: "unauthorized", status: res.status };
+  if (res.status === 404 || res.status === 410) return { kind: "moved", status: res.status };
+  if (res.status >= 500) return { kind: "server_error", status: res.status };
+  if (!res.ok) return { kind: "moved", status: res.status };
+  let body;
+  try {
+    body = await res.text();
+  } catch (err) {
+    return { kind: "unreachable", error: describeCause(err), reason: classifyUnreachable(err) };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return { kind: "not_api", status: res.status, snippet: body.trim().slice(0, 60) };
+  }
+  if (typeof parsed?.apiVersion !== "number") {
+    return { kind: "not_api", status: res.status, snippet: body.trim().slice(0, 60) };
+  }
+  return {
+    kind: "ok",
+    apiVersion: parsed.apiVersion,
+    edition: parsed.edition,
+    cliVersion: parsed.cli?.version,
+    raw: parsed
+  };
+}
+function probeAdvice(r, base2) {
+  switch (r.kind) {
+    case "ok":
+      return r.apiVersion >= 2 ? `apiVersion ${r.apiVersion}${r.edition ? `, edition ${r.edition}` : ""}` : `apiVersion ${r.apiVersion} is too old for this CLI \u2014 upgrade the server`;
+    case "moved":
+      return `HTTP ${r.status} \u2014 nothing is served at ${base2}. If the host moved, re-point it: \`chat-recall login <new-server-url>\``;
+    case "unauthorized":
+      return `HTTP ${r.status} \u2014 ${base2} rejected the credential. Re-login: \`chat-recall login ` + base2 + "`";
+    case "server_error":
+      return `HTTP ${r.status} \u2014 ${base2} is up but failing. Nothing to fix locally; check the server.`;
+    case "not_api":
+      return `${base2} answered ${r.status} with something that is not the chat-recall API (${JSON.stringify(r.snippet)}) \u2014 check the URL, a proxy or a captive portal`;
+    case "unreachable":
+      switch (r.reason) {
+        case "dns":
+          return `cannot resolve the host in ${base2} (${r.error}) \u2014 check the URL for a typo, and your DNS or VPN`;
+        case "refused":
+          return `${base2} resolves but refused the connection (${r.error}) \u2014 the server is not running, or the port is wrong`;
+        case "tls":
+          return `the TLS certificate at ${base2} was rejected (${r.error}) \u2014 expired, self-signed, or issued for another host. A corporate proxy that re-signs traffic does this.`;
+        case "timeout":
+          return `${base2} did not answer in time (${r.error}) \u2014 a firewall or proxy that drops traffic silently looks exactly like this`;
+        case "reset":
+          return `the connection to ${base2} was cut (${r.error}) \u2014 often a proxy or a captive portal`;
+        case "bad_port":
+          return `${base2} names a port that Node and every browser refuse to open (the WHATWG bad-port list) \u2014 use the server's real port`;
+        default:
+          return `no HTTP response from ${base2} (${r.error}) \u2014 check the URL, DNS, or that the server is running`;
+      }
+  }
+}
+function classifyUnreachable(err) {
+  if (err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError")) return "timeout";
+  for (const e of walkErrorChain(err)) {
+    const code2 = String(e.code ?? "");
+    const msg = String(e.message ?? "");
+    if (code2 === "ENOTFOUND" || code2 === "EAI_AGAIN") return "dns";
+    if (code2 === "ECONNREFUSED") return "refused";
+    if (code2 === "ECONNRESET" || code2 === "EPIPE") return "reset";
+    if (code2 === "ETIMEDOUT" || code2 === "UND_ERR_CONNECT_TIMEOUT" || code2 === "UND_ERR_HEADERS_TIMEOUT") return "timeout";
+    if (code2.startsWith("CERT_") || code2.startsWith("ERR_TLS") || code2 === "DEPTH_ZERO_SELF_SIGNED_CERT" || code2 === "SELF_SIGNED_CERT_IN_CHAIN" || code2 === "UNABLE_TO_VERIFY_LEAF_SIGNATURE" || /certificate/i.test(msg)) return "tls";
+    if (/^bad port$/i.test(msg)) return "bad_port";
+  }
+  return "unknown";
+}
+function* walkErrorChain(err, depth = 0) {
+  if (!err || typeof err !== "object" || depth > 5) return;
+  yield err;
+  const members = err.errors;
+  if (Array.isArray(members)) {
+    for (const m of members) yield* walkErrorChain(m, depth + 1);
+  }
+  yield* walkErrorChain(err.cause, depth + 1);
+}
+function describeCause(err) {
+  const parts = [];
+  for (const e of walkErrorChain(err)) {
+    const code2 = e.code;
+    if (typeof code2 === "string" && code2 && !parts.includes(code2)) parts.push(code2);
+  }
+  const base2 = err instanceof Error ? err.message : String(err);
+  return parts.length ? `${base2}: ${parts.join(" \u2192 ")}` : base2;
+}
+function describeUnreachable(err) {
+  const reason = classifyUnreachable(err);
+  const detail = describeCause(err);
+  const phrase = {
+    dns: "the host name does not resolve",
+    refused: "the connection was refused \u2014 nothing is listening there",
+    tls: "the TLS certificate was rejected",
+    timeout: "no answer before the timeout",
+    reset: "the connection was cut mid-request",
+    bad_port: "that port is one Node and every browser refuse to open",
+    unknown: "no HTTP response"
+  };
+  return `${phrase[reason]} (${detail})`;
+}
+var init_server_probe = __esm({
+  "src/server-probe.ts"() {
+    "use strict";
+  }
+});
+
 // src/client-events.ts
 var client_events_exports = {};
 __export(client_events_exports, {
@@ -20758,6 +20898,7 @@ async function fetchTenantSyncConfig(cred) {
     persistSyncConfig(base2, config2);
     return config2;
   } catch (err) {
+    if (isSyncRulesRefusal(err)) throw err;
     return lastKnownSyncConfig(base2, err instanceof Error ? err.message : "request failed");
   }
 }
@@ -20767,9 +20908,14 @@ function lastKnownSyncConfig(base2, reason) {
     console.error(`[sync] could not read server-side sync rules (${reason}) \u2014 applying the last known set from ${new Date(remembered.fetchedAt).toISOString()}`);
     return remembered.config;
   }
-  throw new Error(
+  const refusal = new Error(
     `Cannot read the server-side sync rules from ${base2} (${reason}), and this machine has never successfully read them. Refusing to sync: uploading without knowing your exclusions could ship a project you told the dashboard to hold back. Fix the server or retry.`
   );
+  refusal[SYNC_RULES_REFUSAL] = true;
+  throw refusal;
+}
+function isSyncRulesRefusal(err) {
+  return !!err && typeof err === "object" && err[SYNC_RULES_REFUSAL] === true;
 }
 function deviceLabel() {
   try {
@@ -21030,7 +21176,12 @@ async function verifyServerApi(serverUrl, minApi) {
   const base2 = serverUrl.replace(/\/$/, "");
   const seen = capsOk.get(base2);
   if (seen !== void 0 && Date.now() - seen < CAPS_TTL_MS) return true;
-  const caps = await fetchWithTimeout(`${base2}/api/capabilities`).then((r) => r.json());
+  const { probeServer: probeServer2, probeAdvice: probeAdvice2 } = await Promise.resolve().then(() => (init_server_probe(), server_probe_exports));
+  const probe = await probeServer2(base2, {
+    fetchImpl: ((url, init) => fetchWithTimeout(String(url), init ?? {}))
+  });
+  if (probe.kind !== "ok") throw new Error(probeAdvice2(probe, base2));
+  const caps = probe.raw;
   if ((caps.apiVersion ?? 0) < minApi) {
     throw new Error(`server too old: apiVersion ${caps.apiVersion ?? "none"} < required ${minApi} \u2014 update the server image before syncing`);
   }
@@ -22020,7 +22171,7 @@ async function syncIncremental(opts = {}) {
     lock.release();
   }
 }
-var ownVersion, walkProgressForUpload, lastServerPackSpec, credPath, _securityConfigCache, SECURITY_CONFIG_TTL_MS, _syncConfigCache, EMPTY_SYNC_CONFIG, _fetchTenantSyncConfigForTests, hashPath, MAX_DERIVED_ROW_BYTES, isLocalHost, CAPS_TTL_MS, capsOk, advertisedIngestConc, advertisedGzipBody, FULL_BUILD_MAX_BYTES, FULL_BUILD_TAIL_BYTES, BATCH_SCAN_MAX_BYTES;
+var ownVersion, walkProgressForUpload, lastServerPackSpec, credPath, _securityConfigCache, SECURITY_CONFIG_TTL_MS, _syncConfigCache, EMPTY_SYNC_CONFIG, _fetchTenantSyncConfigForTests, SYNC_RULES_REFUSAL, hashPath, MAX_DERIVED_ROW_BYTES, isLocalHost, CAPS_TTL_MS, capsOk, advertisedIngestConc, advertisedGzipBody, FULL_BUILD_MAX_BYTES, FULL_BUILD_TAIL_BYTES, BATCH_SCAN_MAX_BYTES;
 var init_sync_client = __esm({
   "src/sync-client.ts"() {
     "use strict";
@@ -22066,7 +22217,7 @@ var init_sync_client = __esm({
       ownVersion = JSON.parse(readFileSync37(join44(dir, "../package.json"), "utf-8")).version || ownVersion;
     } catch {
       try {
-        if (true) ownVersion = "0.5.22";
+        if (true) ownVersion = "0.5.23";
       } catch {
       }
     }
@@ -22078,6 +22229,7 @@ var init_sync_client = __esm({
     _syncConfigCache = /* @__PURE__ */ new Map();
     EMPTY_SYNC_CONFIG = { excludeTools: [], excludeProjects: [], excludeSources: [], approveSources: [] };
     _fetchTenantSyncConfigForTests = fetchTenantSyncConfig;
+    SYNC_RULES_REFUSAL = /* @__PURE__ */ Symbol.for("chat-recall.syncRulesRefusal");
     hashPath = (p) => p ? "p_" + createHash13("sha256").update(p).digest("hex").slice(0, 12) : "";
     MAX_DERIVED_ROW_BYTES = 2 * 1024 * 1024;
     isLocalHost = isPrivateHost;
@@ -23502,7 +23654,7 @@ __export(toolkit_pull_exports, {
   portableCommand: () => portableCommand
 });
 import { existsSync as existsSync48, mkdirSync as mkdirSync14, statSync as statSync42, writeFileSync as writeFileSync15 } from "node:fs";
-import { delimiter as delimiter3, dirname as dirname22, join as join52, basename as basename25, isAbsolute as isAbsolute3 } from "node:path";
+import { dirname as dirname22, join as join52, basename as basename25, isAbsolute as isAbsolute3 } from "node:path";
 function isExecutableFile(p) {
   try {
     return statSync42(p).isFile();
@@ -23511,13 +23663,7 @@ function isExecutableFile(p) {
   }
 }
 function onPath(name) {
-  const dirs = (process.env.PATH || "").split(delimiter3).filter(Boolean);
-  for (const d of dirs) {
-    const candidate = join52(d, name);
-    if (isExecutableFile(candidate))
-      return candidate;
-  }
-  return null;
+  return resolveOnPath(name);
 }
 function portableCommand(cmd) {
   if (!isAbsolute3(cmd)) {
@@ -23779,6 +23925,7 @@ var NOT_REBUILDABLE;
 var init_toolkit_pull = __esm({
   "../engine/dist/core/toolkit-pull.js"() {
     "use strict";
+    init_which();
     init_toolkit_sync();
     init_artifact_codec();
     NOT_REBUILDABLE = {
@@ -24145,117 +24292,6 @@ var init_escalate = __esm({
   }
 });
 
-// src/server-probe.ts
-var server_probe_exports = {};
-__export(server_probe_exports, {
-  classifyUnreachable: () => classifyUnreachable,
-  describeCause: () => describeCause,
-  probeAdvice: () => probeAdvice,
-  probeOk: () => probeOk,
-  probeServer: () => probeServer
-});
-function probeOk(r) {
-  return r.kind === "ok" && r.apiVersion >= 2;
-}
-async function probeServer(base2, opts = {}) {
-  const f = opts.fetchImpl || fetch;
-  let res;
-  try {
-    res = await f(`${base2.replace(/\/+$/, "")}/api/capabilities`, {
-      signal: AbortSignal.timeout(opts.timeoutMs ?? 1e4)
-    });
-  } catch (err) {
-    return {
-      kind: "unreachable",
-      error: describeCause(err),
-      reason: classifyUnreachable(err)
-    };
-  }
-  if (res.status === 401 || res.status === 403) return { kind: "unauthorized", status: res.status };
-  if (res.status === 404 || res.status === 410) return { kind: "moved", status: res.status };
-  if (res.status >= 500) return { kind: "server_error", status: res.status };
-  if (!res.ok) return { kind: "moved", status: res.status };
-  let body;
-  try {
-    body = await res.text();
-  } catch (err) {
-    return { kind: "unreachable", error: describeCause(err), reason: classifyUnreachable(err) };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(body);
-  } catch {
-    return { kind: "not_api", status: res.status, snippet: body.trim().slice(0, 60) };
-  }
-  if (typeof parsed?.apiVersion !== "number") {
-    return { kind: "not_api", status: res.status, snippet: body.trim().slice(0, 60) };
-  }
-  return {
-    kind: "ok",
-    apiVersion: parsed.apiVersion,
-    edition: parsed.edition,
-    cliVersion: parsed.cli?.version
-  };
-}
-function probeAdvice(r, base2) {
-  switch (r.kind) {
-    case "ok":
-      return r.apiVersion >= 2 ? `apiVersion ${r.apiVersion}${r.edition ? `, edition ${r.edition}` : ""}` : `apiVersion ${r.apiVersion} is too old for this CLI \u2014 upgrade the server`;
-    case "moved":
-      return `HTTP ${r.status} \u2014 nothing is served at ${base2}. If the host moved, re-point it: \`chat-recall login <new-server-url>\``;
-    case "unauthorized":
-      return `HTTP ${r.status} \u2014 ${base2} rejected the credential. Re-login: \`chat-recall login ` + base2 + "`";
-    case "server_error":
-      return `HTTP ${r.status} \u2014 ${base2} is up but failing. Nothing to fix locally; check the server.`;
-    case "not_api":
-      return `${base2} answered ${r.status} with something that is not the chat-recall API (${JSON.stringify(r.snippet)}) \u2014 check the URL, a proxy or a captive portal`;
-    case "unreachable":
-      switch (r.reason) {
-        case "dns":
-          return `cannot resolve the host in ${base2} (${r.error}) \u2014 check the URL for a typo, and your DNS or VPN`;
-        case "refused":
-          return `${base2} resolves but refused the connection (${r.error}) \u2014 the server is not running, or the port is wrong`;
-        case "tls":
-          return `the TLS certificate at ${base2} was rejected (${r.error}) \u2014 expired, self-signed, or issued for another host. A corporate proxy that re-signs traffic does this.`;
-        case "timeout":
-          return `${base2} did not answer in time (${r.error}) \u2014 a firewall or proxy that drops traffic silently looks exactly like this`;
-        case "reset":
-          return `the connection to ${base2} was cut (${r.error}) \u2014 often a proxy or a captive portal`;
-        default:
-          return `no HTTP response from ${base2} (${r.error}) \u2014 check the URL, DNS, or that the server is running`;
-      }
-  }
-}
-function classifyUnreachable(err) {
-  if (err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError")) return "timeout";
-  for (let e = err, depth = 0; e && depth < 5; depth++) {
-    const code2 = String(e.code ?? "");
-    const msg = String(e.message ?? "");
-    if (code2 === "ENOTFOUND" || code2 === "EAI_AGAIN") return "dns";
-    if (code2 === "ECONNREFUSED") return "refused";
-    if (code2 === "ECONNRESET" || code2 === "EPIPE") return "reset";
-    if (code2 === "ETIMEDOUT" || code2 === "UND_ERR_CONNECT_TIMEOUT" || code2 === "UND_ERR_HEADERS_TIMEOUT") return "timeout";
-    if (code2.startsWith("CERT_") || code2.startsWith("ERR_TLS") || code2 === "DEPTH_ZERO_SELF_SIGNED_CERT" || code2 === "SELF_SIGNED_CERT_IN_CHAIN" || code2 === "UNABLE_TO_VERIFY_LEAF_SIGNATURE" || /certificate/i.test(msg)) return "tls";
-    e = e.cause;
-  }
-  return "unknown";
-}
-function describeCause(err) {
-  const parts = [];
-  for (let e = err, depth = 0; e && depth < 5; depth++) {
-    const code2 = e.code;
-    if (typeof code2 === "string" && code2 && !parts.includes(code2)) parts.push(code2);
-    e = e.cause;
-  }
-  const base2 = err instanceof Error ? err.message : String(err);
-  return parts.length ? `${base2}: ${parts.join(" \u2192 ")}` : base2;
-}
-var init_server_probe = __esm({
-  "src/server-probe.ts"() {
-    "use strict";
-  }
-});
-
 // src/verify-deep.ts
 var verify_deep_exports = {};
 __export(verify_deep_exports, {
@@ -25836,7 +25872,7 @@ var init_intent_drain = __esm({
       ownVersion2 = JSON.parse(readFileSync46(join55(dir, "../package.json"), "utf-8")).version || ownVersion2;
     } catch {
       try {
-        if (true) ownVersion2 = "0.5.22";
+        if (true) ownVersion2 = "0.5.23";
       } catch {
       }
     }
@@ -27111,6 +27147,24 @@ __export(device_auth_exports, {
   deviceLogin: () => deviceLogin
 });
 import { createHash as createHash19, randomBytes } from "node:crypto";
+async function readDeviceCode(res, where) {
+  const text = await res.text().catch(() => "");
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new Error(
+      `${where} answered ${res.status} with something that is not a device-code response (${JSON.stringify(text.trim().slice(0, 60))}) \u2014 this host is not serving the chat-recall API`
+    );
+  }
+  const d = parsed;
+  if (typeof d?.device_code !== "string" || typeof d?.user_code !== "string" || typeof d?.verification_uri !== "string" || typeof d?.expires_in !== "number") {
+    throw new Error(
+      `${where} answered ${res.status} with JSON that is not a device-code response (${JSON.stringify(text.trim().slice(0, 60))}) \u2014 this host is not serving the chat-recall API`
+    );
+  }
+  return d;
+}
 async function deviceLogin(opts, onPrompt) {
   const issuer = (opts.issuer || DEFAULT_ISSUER).replace(/\/+$/, "");
   if (!issuer) {
@@ -27130,7 +27184,7 @@ async function deviceLogin(opts, onPrompt) {
   if (!startRes.ok) {
     throw new Error(`device-auth init failed: HTTP ${startRes.status} ${await startRes.text().catch(() => "")}`);
   }
-  const start = await startRes.json();
+  const start = await readDeviceCode(startRes, issuer);
   onPrompt({
     url: start.verification_uri_complete || start.verification_uri,
     userCode: start.user_code,
@@ -27184,7 +27238,7 @@ async function betterAuthDeviceLogin(serverUrl, onPrompt) {
   if (!startRes.ok) {
     throw new Error(`device-auth init failed: HTTP ${startRes.status} ${await startRes.text().catch(() => "")}`);
   }
-  const start = await startRes.json();
+  const start = await readDeviceCode(startRes, base2);
   onPrompt({
     url: start.verification_uri_complete || start.verification_uri,
     userCode: start.user_code,
@@ -27355,6 +27409,7 @@ function tierAll(results) {
 // src/cli.ts
 init_sync_client();
 init_update_notice();
+init_server_probe();
 init_which();
 init_collector_health();
 init_telemetry_consent();
@@ -27396,14 +27451,9 @@ function firstTarget() {
   return { base: cred.serverUrl.replace(/\/+$/, ""), token: cred.token };
 }
 function describeProbeError(err) {
-  const codes = [];
-  for (let e = err, depth = 0; e && depth < 5; depth++) {
-    const code2 = e.code;
-    if (typeof code2 === "string" && code2 && !codes.includes(code2)) codes.push(code2);
-    e = e.cause;
-  }
-  const base2 = err instanceof Error ? err.message : String(err);
-  return codes.length ? `${base2}: ${codes.join(" \u2192 ")}` : base2;
+  const msg = err instanceof Error ? err.message : String(err);
+  if (!/fetch failed|ECONN|ENOTFOUND|EAI_AGAIN|ETIMEDOUT|CERT_|aborted|timeout/i.test(msg)) return msg;
+  return describeUnreachable(err);
 }
 function failLogin(opts, message) {
   if (opts.fromInit) throw new Error(message);
@@ -27418,11 +27468,21 @@ function requireTarget() {
   }
   return t;
 }
+async function readJsonBody(res, base2, what) {
+  const text = await res.text().catch(() => "");
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new Error(
+      `${base2} answered ${res.status} with something that is not JSON (${JSON.stringify(text.trim().slice(0, 60))}) for ${what} \u2014 a proxy, a captive portal or a host that no longer serves the chat-recall API`
+    );
+  }
+}
 async function serverGet(path) {
   const t = requireTarget();
   const res = await fetch(t.base + path, { headers: t.token ? { authorization: `Bearer ${t.token}` } : {} });
   if (!res.ok) throw new Error(`server ${path}: HTTP ${res.status} ${await res.text().catch(() => "")}`);
-  return res.json();
+  return readJsonBody(res, t.base, `GET ${path}`);
 }
 async function serverGetSoft(path) {
   const t = requireTarget();
@@ -27432,7 +27492,7 @@ async function serverGetSoft(path) {
     return { status: res.status, data: null, message: body.message };
   }
   if (!res.ok) throw new Error(`server ${path}: HTTP ${res.status} ${await res.text().catch(() => "")}`);
-  return { status: res.status, data: await res.json() };
+  return { status: res.status, data: await readJsonBody(res, t.base, `GET ${path}`) };
 }
 async function serverPost(path, body) {
   const t = requireTarget();
@@ -27442,7 +27502,7 @@ async function serverPost(path, body) {
     body: JSON.stringify(body)
   });
   if (!res.ok) throw new Error(`server ${path}: HTTP ${res.status} ${await res.text().catch(() => "")}`);
-  return res.json();
+  return readJsonBody(res, t.base, `POST ${path}`);
 }
 async function serverPatch(path, body) {
   const t = requireTarget();
@@ -27452,7 +27512,7 @@ async function serverPatch(path, body) {
     body: JSON.stringify(body)
   });
   if (!res.ok) throw new Error(`server ${path}: HTTP ${res.status} ${await res.text().catch(() => "")}`);
-  return res.json();
+  return readJsonBody(res, t.base, `PATCH ${path}`);
 }
 async function serverDelete(path, body) {
   const t = requireTarget();
@@ -27462,7 +27522,7 @@ async function serverDelete(path, body) {
     body: JSON.stringify(body)
   });
   if (!res.ok) throw new Error(`server ${path}: HTTP ${res.status} ${await res.text().catch(() => "")}`);
-  return res.json();
+  return readJsonBody(res, t.base, `DELETE ${path}`);
 }
 var pkgEngines = (() => {
   try {
@@ -27474,7 +27534,7 @@ var pkgEngines = (() => {
 var pkgVersion = JSON.parse(
   readFileSync49(new URL("../package.json", import.meta.url), "utf-8")
 ).version;
-var DEFAULT_SERVER = "https://chatrecall.dev";
+var DEFAULT_SERVER = (process.env.CHAT_RECALL_DEFAULT_SERVER || "https://chatrecall.dev").replace(/\/+$/, "");
 var DEFAULT_ALLOW = [
   "recall_search",
   "recall_show",
@@ -27586,6 +27646,7 @@ program.command("init").description("Set up chat-recall: connect to your server,
     console.log();
     console.log(chalk.bold("2. Connecting to your server..."));
     let target = firstTarget();
+    let deadTarget = false;
     if (options.server) {
       try {
         await runLogin(options.server, { token: options.token, fromInit: true, promptJson: options.promptJson });
@@ -27605,7 +27666,34 @@ program.command("init").description("Set up chat-recall: connect to your server,
         console.log(`   ${chalk.dim(`Run ${chalk.bold("chat-recall login <server-url>")} when ready, or self-host: ${SELF_HOST_DOCS}`)}`);
       }
     }
-    if (target) {
+    if (target && !options.server) {
+      const { probeServer: probeServer2, probeOk: probeOk2, probeAdvice: probeAdvice2 } = await Promise.resolve().then(() => (init_server_probe(), server_probe_exports));
+      const probe = await probeServer2(target.base, { timeoutMs: 1e4 });
+      if (probeOk2(probe)) {
+        console.log(`   ${chalk.green("Connected")} \u2192 ${target.base}`);
+      } else if (probe.kind === "moved" || probe.kind === "not_api") {
+        const retired = target.base;
+        console.log(`   ${chalk.yellow("The saved server no longer serves chat-recall")} \u2192 ${retired}`);
+        console.log(`   ${probeAdvice2(probe, retired)}`);
+        console.log(`   Switching to ${chalk.bold(DEFAULT_SERVER)} \u2014 sign in to approve this machine.`);
+        try {
+          await runLogin(DEFAULT_SERVER, { token: options.token, fromInit: true, promptJson: options.promptJson });
+          const { removeCredentials: removeCredentials2 } = await Promise.resolve().then(() => (init_sync_client(), sync_client_exports));
+          if (removeCredentials2(retired)) {
+            console.log(`   ${chalk.dim(`Removed the retired target ${retired} (log in there again any time).`)}`);
+          }
+          target = firstTarget();
+          if (target) console.log(`   ${chalk.green("Connected")} \u2192 ${target.base}`);
+        } catch (e) {
+          console.log(`   ${chalk.yellow("Not connected.")} ${describeProbeError(e)}`);
+          console.log(`   ${chalk.dim(`Run ${chalk.bold(`chat-recall login ${DEFAULT_SERVER}`)} when ready, then ${chalk.bold(`chat-recall logout ${retired}`)}.`)}`);
+          deadTarget = true;
+        }
+      } else {
+        console.log(`   ${chalk.yellow("Saved server did not answer")} \u2192 ${target.base}`);
+        console.log(`   ${probeAdvice2(probe, target.base)}`);
+      }
+    } else if (target) {
       console.log(`   ${chalk.green("Connected")} \u2192 ${target.base}`);
     }
     console.log();
@@ -27714,22 +27802,40 @@ program.command("init").description("Set up chat-recall: connect to your server,
         const { executePull: executePull2 } = await Promise.resolve().then(() => (init_toolkit_pull(), toolkit_pull_exports));
         const { hostname: hostname3 } = await import("node:os");
         const rows = [];
+        let answered = 0;
+        const askFailed = [];
         for (const t of loadAllCredentials2()) {
           try {
             const res = await fetch(`${t.serverUrl}/api/toolkit/browse/mcp?limit=1000`, {
               headers: t.token ? { authorization: `Bearer ${t.token}` } : {},
               signal: AbortSignal.timeout(2e4)
             });
-            if (!res.ok) continue;
-            const body = await res.json();
+            if (!res.ok) {
+              askFailed.push(`${t.serverUrl} (HTTP ${res.status})`);
+              continue;
+            }
+            const text = await res.text();
+            let body;
+            try {
+              body = JSON.parse(text);
+            } catch {
+              askFailed.push(`${t.serverUrl} (not JSON: ${JSON.stringify(text.trim().slice(0, 40))})`);
+              continue;
+            }
+            answered++;
             for (const it of body.items || []) rows.push(it);
-          } catch {
+          } catch (e) {
+            askFailed.push(`${t.serverUrl} (${describeProbeError(e)})`);
           }
         }
         const report = executePull2(rows, { thisDeviceId: hostname3(), types: ["mcp"] });
         const written = report.outcomes.filter((o) => o.status === "written");
         const present = report.outcomes.filter((o) => o.status === "present").length;
-        if (written.length === 0 && present === 0) {
+        if (answered === 0) {
+          console.log(`   ${chalk.yellow("Could not ask your server what MCP servers are on your account")}`);
+          for (const f of askFailed) console.log(`   ${chalk.dim(f)}`);
+          console.log(`   ${chalk.dim("Re-run `chat-recall toolkit pull` once the server answers.")}`);
+        } else if (written.length === 0 && present === 0) {
           console.log(chalk.dim("   Nothing on your account to install yet."));
         } else {
           console.log(`   ${chalk.green(`Installed ${written.length}`)} ${chalk.dim(`(${present} already present)`)}`);
@@ -27744,7 +27850,10 @@ program.command("init").description("Set up chat-recall: connect to your server,
       }
       console.log();
     }
-    if (!options.skipSync && firstTarget()) {
+    if (deadTarget) {
+      console.log(chalk.bold("5. Skipping first sync \u2014 the saved server is not serving chat-recall"));
+      console.log(`   ${chalk.dim(`Re-point with the two commands above, then run ${chalk.bold("chat-recall sync")}.`)}`);
+    } else if (!options.skipSync && firstTarget()) {
       console.log(chalk.bold("5. Indexing and uploading your sessions"));
       try {
         const { syncSessions: syncSessions2 } = await Promise.resolve().then(() => (init_sync_client(), sync_client_exports));
@@ -29602,7 +29711,7 @@ async function runLogin(serverUrl, opts) {
       });
       return { ok: res.ok, status: res.status };
     } catch (err) {
-      return { ok: false, error: err instanceof Error ? err.message : String(err) };
+      return { ok: false, error: describeUnreachable(err) };
     }
   };
   if (opts.token) {
@@ -29611,12 +29720,21 @@ async function runLogin(serverUrl, opts) {
       console.error(chalk.dim("Use the Copy button next to the token in the dashboard and paste the full line."));
       return failLogin(opts, 'the token contains non-ASCII characters \u2014 this looks like a masked/truncated copy (e.g. "ct_12345678\u2026")');
     }
+    const { probeServer: identifyServer, probeOk: identified, probeAdvice: identifyAdvice } = await Promise.resolve().then(() => (init_server_probe(), server_probe_exports));
+    const who = await identifyServer(base2, { timeoutMs: 1e4 });
+    if (!identified(who)) return failLogin(opts, identifyAdvice(who, base2));
     const check = await verifyToken(token);
     if (!check.ok) {
       if (check.status === 401 || check.status === 403) {
         console.error(chalk.dim("Tokens are shown once \u2014 mint a fresh one (Account \u2192 Connect your machine) and copy the whole line."));
         return failLogin(opts, `${base2} rejected the token (HTTP ${check.status})`);
       }
+      if (check.status !== void 0 && check.status >= 500) {
+        return failLogin(opts, `${base2} answered HTTP ${check.status} \u2014 the server is up but failing. The token was never checked. Nothing to fix locally.`);
+      }
+      if (check.status === 404 || check.status === 410) {
+        return failLogin(opts, `${base2} does not serve the chat-recall API (HTTP ${check.status}). If the server moved, log in to its new URL.`);
+      }
       return failLogin(opts, `could not verify the token against ${base2}: ${check.error || `HTTP ${check.status}`}`);
     }
     saveCredentials2({ serverUrl, token });
@@ -29629,11 +29747,15 @@ async function runLogin(serverUrl, opts) {
     return;
   }
   try {
-    const probe = await fetch(`${base2}/api/status`, { signal: AbortSignal.timeout(8e3) });
-    if (probe.status === 200) {
-      saveCredentials2({ serverUrl, token: "" });
-      console.log(chalk.green("\u2713 Logged in.") + chalk.dim(`  ${serverUrl} (local server \u2014 no auth, no token needed)`));
-      return;
+    const { probeServer: probeServer2, probeOk: probeOk2 } = await Promise.resolve().then(() => (init_server_probe(), server_probe_exports));
+    const identified = await probeServer2(base2, { timeoutMs: 8e3 });
+    if (probeOk2(identified)) {
+      const probe = await fetch(`${base2}/api/status`, { signal: AbortSignal.timeout(8e3) });
+      if (probe.status === 200) {
+        saveCredentials2({ serverUrl, token: "" });
+        console.log(chalk.green("\u2713 Logged in.") + chalk.dim(`  ${serverUrl} (local server \u2014 no auth, no token needed)`));
+        return;
+      }
     }
   } catch {
   }
@@ -29651,14 +29773,12 @@ async function runLogin(serverUrl, opts) {
       for (let attempt = 1; attempt <= 3 && !authProvider; attempt++) {
         const probe = await probeServer2(base2, { timeoutMs: 15e3 });
         if (probeOk2(probe)) {
-          try {
-            const caps = await fetch(`${base2}/api/capabilities`, { signal: AbortSignal.timeout(15e3) }).then((r) => r.json());
-            authProvider = caps?.authProvider;
-            if (caps?.oidcIssuer) issuer = caps.oidcIssuer;
-            capsError = null;
-          } catch (err) {
-            capsError = describeProbeError(err);
-          }
+          const caps = probe.raw;
+          authProvider = caps?.authProvider;
+          if (caps?.oidcIssuer) issuer = caps.oidcIssuer;
+          capsError = null;
+        } else if (probe.kind === "moved" || probe.kind === "not_api") {
+          return failLogin(opts, probeAdvice2(probe, base2));
         } else {
           capsError = probeAdvice2(probe, base2);
         }
@@ -29691,7 +29811,9 @@ async function runLogin(serverUrl, opts) {
     };
     const tokens = authProvider === "better-auth" ? await betterAuthDeviceLogin2(base2, onPrompt) : await deviceLogin2({ issuer, clientId: opts.clientId }, onPrompt);
     const authHdr = { authorization: `Bearer ${tokens.accessToken}`, "content-type": "application/json" };
-    const me = await fetch(`${base2}/api/me`, { headers: authHdr }).then((r) => r.json());
+    const meRes = await fetch(`${base2}/api/me`, { headers: authHdr });
+    if (!meRes.ok) throw new Error(`${base2}/api/me: HTTP ${meRes.status} ${await meRes.text().catch(() => "")}`);
+    const me = await readJsonBody(meRes, base2, "GET /api/me");
     const teams = me.teams || [];
     let slug = opts.team;
     if (!slug) {
@@ -29700,7 +29822,7 @@ async function runLogin(serverUrl, opts) {
         const name = me.user?.email?.split("@")[0]?.replace(/[^a-z0-9]/gi, "") || "workspace";
         const created = await fetch(`${base2}/api/teams`, { method: "POST", headers: authHdr, body: JSON.stringify({ name }) });
         if (!created.ok) throw new Error(`workspace create failed: HTTP ${created.status} ${await created.text().catch(() => "")}`);
-        slug = (await created.json()).slug;
+        slug = (await readJsonBody(created, base2, "POST /api/teams")).slug;
         console.log(chalk.dim(`Created workspace "${name}" (${slug}) \u2014 you're its owner.`));
       } else {
         teams.forEach((t) => console.error(`  ${t.team_slug}  ${chalk.dim(t.name)}`));
@@ -29714,7 +29836,7 @@ async function runLogin(serverUrl, opts) {
       body: JSON.stringify({ device_id: deviceId })
     });
     if (!mint.ok) throw new Error(`token mint failed: HTTP ${mint.status} ${await mint.text().catch(() => "")}`);
-    const { token } = await mint.json();
+    const { token } = await readJsonBody(mint, base2, "POST /api/teams/:slug/tokens");
     saveCredentials2({ serverUrl, token });
     console.log(chalk.green(`\u2713 Logged in to ${chalk.bold(slug)}`) + chalk.dim(`  (device: ${deviceId})  server: ${serverUrl}`));
     if (!opts.fromInit) {