chat-recall 0.5.22 → 0.5.24

package/dist/cli.js

@@ -7134,13 +7134,13 @@ async function parseCodexSubagents(sessionPath) {
     if (meta?.type !== "session_meta")
       continue;
     const payload = meta.payload || {};
-    const spawn2 = payload.source?.subagent?.thread_spawn;
-    if (!spawn2)
+    const spawn3 = payload.source?.subagent?.thread_spawn;
+    if (!spawn3)
       continue;
-    if (spawn2.parent_thread_id !== parentId)
+    if (spawn3.parent_thread_id !== parentId)
       continue;
     const id = fileName.replace(/\.jsonl$/i, "");
-    const role = String(spawn2.agent_role || payload.agent_role || "").toLowerCase();
+    const role = String(spawn3.agent_role || payload.agent_role || "").toLowerCase();
     const kind = role.includes("compact") ? "compact" : role.includes("aside") ? "aside" : role.includes("worker") || role.includes("explore") ? "explore" : "other";
     let messages = [];
     try {
@@ -7152,8 +7152,8 @@ async function parseCodexSubagents(sessionPath) {
     subagents.push({
       id,
       kind,
-      agentType: spawn2.agent_role || payload.agent_role,
-      description: spawn2.agent_nickname || payload.agent_nickname,
+      agentType: spawn3.agent_role || payload.agent_role,
+      description: spawn3.agent_nickname || payload.agent_nickname,
       filePath,
       messageCount: messages.length,
       toolUseCount,
@@ -7488,7 +7488,7 @@ async function archiveRawSession(store, sessionId) {
 }
 function detectForkPredecessor(sessionPath) {
   const { readFileSync: readFileSync50, readdirSync: readdirSync35 } = requireFs();
-  const { dirname: dirname28, join: join61, basename: basename29 } = requirePath();
+  const { dirname: dirname28, join: join61, basename: basename30 } = requirePath();
   let text;
   try {
     text = readFileSync50(sessionPath, "utf-8");
@@ -7514,7 +7514,7 @@ function detectForkPredecessor(sessionPath) {
   if (text.includes(`"uuid":"${headParent}"`))
     return null;
   const dir = dirname28(sessionPath);
-  const self = basename29(sessionPath);
+  const self = basename30(sessionPath);
   let entries;
   try {
     entries = readdirSync35(dir);
@@ -7526,7 +7526,7 @@ function detectForkPredecessor(sessionPath) {
       continue;
     try {
       if (readFileSync50(join61(dir, f), "utf-8").includes(`"uuid":"${headParent}"`)) {
-        return basename29(f, ".jsonl");
+        return basename30(f, ".jsonl");
       }
     } catch {
     }
@@ -9781,8 +9781,8 @@ var init_codex2 = __esm({
           } catch {
             continue;
           }
-          const spawn2 = meta?.payload?.source?.subagent?.thread_spawn;
-          if (!spawn2 || spawn2.parent_thread_id !== parentUuid)
+          const spawn3 = meta?.payload?.source?.subagent?.thread_spawn;
+          if (!spawn3 || spawn3.parent_thread_id !== parentUuid)
             continue;
           events.push(...this.parseRollout(path));
         }
@@ -9975,10 +9975,10 @@ var init_codex2 = __esm({
                 const meta = JSON.parse(first);
                 const payload = meta?.payload || {};
                 projectPath = payload.cwd || "";
-                const spawn2 = payload.source?.subagent?.thread_spawn;
-                if (spawn2 || payload.agent_role || payload.agent_nickname) {
+                const spawn3 = payload.source?.subagent?.thread_spawn;
+                if (spawn3 || payload.agent_role || payload.agent_nickname) {
                   isSubagent = true;
-                  parentId = spawn2?.parent_thread_id || null;
+                  parentId = spawn3?.parent_thread_id || null;
                 }
               }
             } catch {
@@ -13470,8 +13470,11 @@ function isInside(child, parent) {
   return c.startsWith(p);
 }
 function globMatch(pattern, path) {
-  const re = new RegExp("^" + globToRegex(pattern) + "$");
-  return re.test(path);
+  const re = new RegExp("^" + globToRegex(toPosix(pattern)) + "$");
+  return re.test(toPosix(path));
+}
+function toPosix(p) {
+  return p.replace(/\\/g, "/");
 }
 function globToRegex(glob) {
   let out = "";
@@ -19727,7 +19730,7 @@ var init_http = __esm({
       CLI_VERSION = JSON.parse(readFileSync33(new URL("../package.json", import.meta.url), "utf-8")).version || CLI_VERSION;
     } catch {
       try {
-        if (true) CLI_VERSION = "0.5.22";
+        if (true) CLI_VERSION = "0.5.24";
       } catch {
       }
     }
@@ -20239,7 +20242,7 @@ var init_telemetry = __esm({
     init_sync_client();
     cliVersion2 = () => {
       try {
-        return true ? "0.5.22" : "dev";
+        return true ? "0.5.24" : "dev";
       } catch {
         return "dev";
       }
@@ -20351,6 +20354,143 @@ var init_collector_health = __esm({
   }
 });
 
+// src/server-probe.ts
+var server_probe_exports = {};
+__export(server_probe_exports, {
+  classifyUnreachable: () => classifyUnreachable,
+  describeCause: () => describeCause,
+  describeUnreachable: () => describeUnreachable,
+  probeAdvice: () => probeAdvice,
+  probeOk: () => probeOk,
+  probeServer: () => probeServer
+});
+function probeOk(r) {
+  return r.kind === "ok" && r.apiVersion >= 2;
+}
+async function probeServer(base2, opts = {}) {
+  const f = opts.fetchImpl || fetch;
+  let res;
+  try {
+    res = await f(`${base2.replace(/\/+$/, "")}/api/capabilities`, {
+      signal: AbortSignal.timeout(opts.timeoutMs ?? 1e4)
+    });
+  } catch (err) {
+    return {
+      kind: "unreachable",
+      error: describeCause(err),
+      reason: classifyUnreachable(err)
+    };
+  }
+  if (res.status === 401 || res.status === 403) return { kind: "unauthorized", status: res.status };
+  if (res.status === 404 || res.status === 410) return { kind: "moved", status: res.status };
+  if (res.status >= 500) return { kind: "server_error", status: res.status };
+  if (!res.ok) return { kind: "moved", status: res.status };
+  let body;
+  try {
+    body = await res.text();
+  } catch (err) {
+    return { kind: "unreachable", error: describeCause(err), reason: classifyUnreachable(err) };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return { kind: "not_api", status: res.status, snippet: body.trim().slice(0, 60) };
+  }
+  if (typeof parsed?.apiVersion !== "number") {
+    return { kind: "not_api", status: res.status, snippet: body.trim().slice(0, 60) };
+  }
+  return {
+    kind: "ok",
+    apiVersion: parsed.apiVersion,
+    edition: parsed.edition,
+    cliVersion: parsed.cli?.version,
+    raw: parsed
+  };
+}
+function probeAdvice(r, base2) {
+  switch (r.kind) {
+    case "ok":
+      return r.apiVersion >= 2 ? `apiVersion ${r.apiVersion}${r.edition ? `, edition ${r.edition}` : ""}` : `apiVersion ${r.apiVersion} is too old for this CLI \u2014 upgrade the server`;
+    case "moved":
+      return `HTTP ${r.status} \u2014 nothing is served at ${base2}. If the host moved, re-point it: \`chat-recall login <new-server-url>\``;
+    case "unauthorized":
+      return `HTTP ${r.status} \u2014 ${base2} rejected the credential. Re-login: \`chat-recall login ` + base2 + "`";
+    case "server_error":
+      return `HTTP ${r.status} \u2014 ${base2} is up but failing. Nothing to fix locally; check the server.`;
+    case "not_api":
+      return `${base2} answered ${r.status} with something that is not the chat-recall API (${JSON.stringify(r.snippet)}) \u2014 check the URL, a proxy or a captive portal`;
+    case "unreachable":
+      switch (r.reason) {
+        case "dns":
+          return `cannot resolve the host in ${base2} (${r.error}) \u2014 check the URL for a typo, and your DNS or VPN`;
+        case "refused":
+          return `${base2} resolves but refused the connection (${r.error}) \u2014 the server is not running, or the port is wrong`;
+        case "tls":
+          return `the TLS certificate at ${base2} was rejected (${r.error}) \u2014 expired, self-signed, or issued for another host. A corporate proxy that re-signs traffic does this.`;
+        case "timeout":
+          return `${base2} did not answer in time (${r.error}) \u2014 a firewall or proxy that drops traffic silently looks exactly like this`;
+        case "reset":
+          return `the connection to ${base2} was cut (${r.error}) \u2014 often a proxy or a captive portal`;
+        case "bad_port":
+          return `${base2} names a port that Node and every browser refuse to open (the WHATWG bad-port list) \u2014 use the server's real port`;
+        default:
+          return `no HTTP response from ${base2} (${r.error}) \u2014 check the URL, DNS, or that the server is running`;
+      }
+  }
+}
+function classifyUnreachable(err) {
+  if (err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError")) return "timeout";
+  for (const e of walkErrorChain(err)) {
+    const code2 = String(e.code ?? "");
+    const msg = String(e.message ?? "");
+    if (code2 === "ENOTFOUND" || code2 === "EAI_AGAIN") return "dns";
+    if (code2 === "ECONNREFUSED") return "refused";
+    if (code2 === "ECONNRESET" || code2 === "EPIPE") return "reset";
+    if (code2 === "ETIMEDOUT" || code2 === "UND_ERR_CONNECT_TIMEOUT" || code2 === "UND_ERR_HEADERS_TIMEOUT") return "timeout";
+    if (code2.startsWith("CERT_") || code2.startsWith("ERR_TLS") || code2 === "DEPTH_ZERO_SELF_SIGNED_CERT" || code2 === "SELF_SIGNED_CERT_IN_CHAIN" || code2 === "UNABLE_TO_VERIFY_LEAF_SIGNATURE" || /certificate/i.test(msg)) return "tls";
+    if (/^bad port$/i.test(msg)) return "bad_port";
+  }
+  return "unknown";
+}
+function* walkErrorChain(err, depth = 0) {
+  if (!err || typeof err !== "object" || depth > 5) return;
+  yield err;
+  const members = err.errors;
+  if (Array.isArray(members)) {
+    for (const m of members) yield* walkErrorChain(m, depth + 1);
+  }
+  yield* walkErrorChain(err.cause, depth + 1);
+}
+function describeCause(err) {
+  const parts = [];
+  for (const e of walkErrorChain(err)) {
+    const code2 = e.code;
+    if (typeof code2 === "string" && code2 && !parts.includes(code2)) parts.push(code2);
+  }
+  const base2 = err instanceof Error ? err.message : String(err);
+  return parts.length ? `${base2}: ${parts.join(" \u2192 ")}` : base2;
+}
+function describeUnreachable(err) {
+  const reason = classifyUnreachable(err);
+  const detail = describeCause(err);
+  const phrase = {
+    dns: "the host name does not resolve",
+    refused: "the connection was refused \u2014 nothing is listening there",
+    tls: "the TLS certificate was rejected",
+    timeout: "no answer before the timeout",
+    reset: "the connection was cut mid-request",
+    bad_port: "that port is one Node and every browser refuse to open",
+    unknown: "no HTTP response"
+  };
+  return `${phrase[reason]} (${detail})`;
+}
+var init_server_probe = __esm({
+  "src/server-probe.ts"() {
+    "use strict";
+  }
+});
+
 // src/client-events.ts
 var client_events_exports = {};
 __export(client_events_exports, {
@@ -20758,6 +20898,7 @@ async function fetchTenantSyncConfig(cred) {
     persistSyncConfig(base2, config2);
     return config2;
   } catch (err) {
+    if (isSyncRulesRefusal(err)) throw err;
     return lastKnownSyncConfig(base2, err instanceof Error ? err.message : "request failed");
   }
 }
@@ -20767,9 +20908,14 @@ function lastKnownSyncConfig(base2, reason) {
     console.error(`[sync] could not read server-side sync rules (${reason}) \u2014 applying the last known set from ${new Date(remembered.fetchedAt).toISOString()}`);
     return remembered.config;
   }
-  throw new Error(
+  const refusal = new Error(
     `Cannot read the server-side sync rules from ${base2} (${reason}), and this machine has never successfully read them. Refusing to sync: uploading without knowing your exclusions could ship a project you told the dashboard to hold back. Fix the server or retry.`
   );
+  refusal[SYNC_RULES_REFUSAL] = true;
+  throw refusal;
+}
+function isSyncRulesRefusal(err) {
+  return !!err && typeof err === "object" && err[SYNC_RULES_REFUSAL] === true;
 }
 function deviceLabel() {
   try {
@@ -21030,7 +21176,12 @@ async function verifyServerApi(serverUrl, minApi) {
   const base2 = serverUrl.replace(/\/$/, "");
   const seen = capsOk.get(base2);
   if (seen !== void 0 && Date.now() - seen < CAPS_TTL_MS) return true;
-  const caps = await fetchWithTimeout(`${base2}/api/capabilities`).then((r) => r.json());
+  const { probeServer: probeServer2, probeAdvice: probeAdvice2 } = await Promise.resolve().then(() => (init_server_probe(), server_probe_exports));
+  const probe = await probeServer2(base2, {
+    fetchImpl: ((url, init) => fetchWithTimeout(String(url), init ?? {}))
+  });
+  if (probe.kind !== "ok") throw new Error(probeAdvice2(probe, base2));
+  const caps = probe.raw;
   if ((caps.apiVersion ?? 0) < minApi) {
     throw new Error(`server too old: apiVersion ${caps.apiVersion ?? "none"} < required ${minApi} \u2014 update the server image before syncing`);
   }
@@ -22020,7 +22171,7 @@ async function syncIncremental(opts = {}) {
     lock.release();
   }
 }
-var ownVersion, walkProgressForUpload, lastServerPackSpec, credPath, _securityConfigCache, SECURITY_CONFIG_TTL_MS, _syncConfigCache, EMPTY_SYNC_CONFIG, _fetchTenantSyncConfigForTests, hashPath, MAX_DERIVED_ROW_BYTES, isLocalHost, CAPS_TTL_MS, capsOk, advertisedIngestConc, advertisedGzipBody, FULL_BUILD_MAX_BYTES, FULL_BUILD_TAIL_BYTES, BATCH_SCAN_MAX_BYTES;
+var ownVersion, walkProgressForUpload, lastServerPackSpec, credPath, _securityConfigCache, SECURITY_CONFIG_TTL_MS, _syncConfigCache, EMPTY_SYNC_CONFIG, _fetchTenantSyncConfigForTests, SYNC_RULES_REFUSAL, hashPath, MAX_DERIVED_ROW_BYTES, isLocalHost, CAPS_TTL_MS, capsOk, advertisedIngestConc, advertisedGzipBody, FULL_BUILD_MAX_BYTES, FULL_BUILD_TAIL_BYTES, BATCH_SCAN_MAX_BYTES;
 var init_sync_client = __esm({
   "src/sync-client.ts"() {
     "use strict";
@@ -22066,7 +22217,7 @@ var init_sync_client = __esm({
       ownVersion = JSON.parse(readFileSync37(join44(dir, "../package.json"), "utf-8")).version || ownVersion;
     } catch {
       try {
-        if (true) ownVersion = "0.5.22";
+        if (true) ownVersion = "0.5.24";
       } catch {
       }
     }
@@ -22078,6 +22229,7 @@ var init_sync_client = __esm({
     _syncConfigCache = /* @__PURE__ */ new Map();
     EMPTY_SYNC_CONFIG = { excludeTools: [], excludeProjects: [], excludeSources: [], approveSources: [] };
     _fetchTenantSyncConfigForTests = fetchTenantSyncConfig;
+    SYNC_RULES_REFUSAL = /* @__PURE__ */ Symbol.for("chat-recall.syncRulesRefusal");
     hashPath = (p) => p ? "p_" + createHash13("sha256").update(p).digest("hex").slice(0, 12) : "";
     MAX_DERIVED_ROW_BYTES = 2 * 1024 * 1024;
     isLocalHost = isPrivateHost;
@@ -22882,7 +23034,7 @@ var init_install_skills = __esm({
 
 // ../engine/dist/core/artifact-codec.js
 import { readFileSync as readFileSync42 } from "fs";
-import { join as join50 } from "path";
+import { basename as basename24, join as join50 } from "path";
 import { homedir as homedir17 } from "os";
 function parseCommandText(content, format, fallbackName) {
   if (format === "toml") {
@@ -23010,8 +23162,7 @@ function emit(type, art, toTool, projectPath) {
   };
 }
 function base(filePath) {
-  const b = filePath.split("/").pop() || filePath;
-  return b.replace(/\.(md|toml)$/, "");
+  return basename24(filePath).replace(/\.(md|toml)$/, "");
 }
 var init_artifact_codec = __esm({
   "../engine/dist/core/artifact-codec.js"() {
@@ -23046,7 +23197,7 @@ __export(toolkit_sync_exports, {
   writeMcpEntry: () => writeMcpEntry
 });
 import { existsSync as existsSync47, mkdirSync as mkdirSync13, readFileSync as readFileSync43, writeFileSync as writeFileSync14, cpSync as cpSync2 } from "fs";
-import { dirname as dirname21, join as join51, basename as basename24 } from "path";
+import { dirname as dirname21, join as join51, basename as basename25 } from "path";
 import { homedir as homedir18 } from "os";
 function supportedTargetsFor(type) {
   return SUPPORTED_TARGETS[type];
@@ -23104,7 +23255,7 @@ function copySkill(row, toTool) {
   const skillDir = row.extra.skillDir || dirname21(row.filePath);
   if (!existsSync47(skillDir))
     return { ok: false, status: 404, error: `Source dir missing: ${skillDir}` };
-  const name = row.extra.skillName || basename24(skillDir);
+  const name = row.extra.skillName || basename25(skillDir);
   const targetDir = join51(skillsDirFor(toTool), name);
   if (existsSync47(targetDir))
     return { ok: false, status: 409, error: `Already exists: ${targetDir}` };
@@ -23502,7 +23653,7 @@ __export(toolkit_pull_exports, {
   portableCommand: () => portableCommand
 });
 import { existsSync as existsSync48, mkdirSync as mkdirSync14, statSync as statSync42, writeFileSync as writeFileSync15 } from "node:fs";
-import { delimiter as delimiter3, dirname as dirname22, join as join52, basename as basename25, isAbsolute as isAbsolute3 } from "node:path";
+import { dirname as dirname22, join as join52, basename as basename26, isAbsolute as isAbsolute3 } from "node:path";
 function isExecutableFile(p) {
   try {
     return statSync42(p).isFile();
@@ -23511,13 +23662,7 @@ function isExecutableFile(p) {
   }
 }
 function onPath(name) {
-  const dirs = (process.env.PATH || "").split(delimiter3).filter(Boolean);
-  for (const d of dirs) {
-    const candidate = join52(d, name);
-    if (isExecutableFile(candidate))
-      return candidate;
-  }
-  return null;
+  return resolveOnPath(name);
 }
 function portableCommand(cmd) {
   if (!isAbsolute3(cmd)) {
@@ -23525,7 +23670,7 @@ function portableCommand(cmd) {
   }
   if (isExecutableFile(cmd))
     return { command: cmd, rewritten: false };
-  const base2 = basename25(cmd);
+  const base2 = basename26(cmd);
   if (onPath(base2))
     return { command: base2, rewritten: true };
   return { missing: cmd };
@@ -23779,6 +23924,7 @@ var NOT_REBUILDABLE;
 var init_toolkit_pull = __esm({
   "../engine/dist/core/toolkit-pull.js"() {
     "use strict";
+    init_which();
     init_toolkit_sync();
     init_artifact_codec();
     NOT_REBUILDABLE = {
@@ -24005,7 +24151,7 @@ __export(escalate_exports, {
   extractLearnings: () => extractLearnings,
   runEscalate: () => runEscalate
 });
-import { basename as basename26 } from "node:path";
+import { basename as basename27 } from "node:path";
 function isNoiseUserMessage(content) {
   const c = content.trimStart();
   return c.length === 0 || c.length > 4e3 || c.startsWith("Caveat:") || c.startsWith("[Request interrupted") || c.includes("<command-name>") || c.includes("<local-command") || c.startsWith("<system-reminder>");
@@ -24072,10 +24218,10 @@ async function runEscalate(deps, opts) {
       return null;
     }
     sessionId = row.sessionId;
-    if (!projectName && row.projectPath) projectName = basename26(row.projectPath);
+    if (!projectName && row.projectPath) projectName = basename27(row.projectPath);
   }
   if (!sessionId) throw new Error("pass a session id or --latest");
-  if (!projectName) projectName = basename26(opts.cwd);
+  if (!projectName) projectName = basename27(opts.cwd);
   const convo = await deps.getSoft(`/api/conversations/${encodeURIComponent(sessionId)}?limit=0`);
   if (!convo.data || convo.data.messages.length === 0) {
     deps.log(`escalate: session ${sessionId} not synced yet${convo.message ? ` (${convo.message})` : ""} \u2014 nothing to do.`);
@@ -24145,117 +24291,6 @@ var init_escalate = __esm({
   }
 });
 
-// src/server-probe.ts
-var server_probe_exports = {};
-__export(server_probe_exports, {
-  classifyUnreachable: () => classifyUnreachable,
-  describeCause: () => describeCause,
-  probeAdvice: () => probeAdvice,
-  probeOk: () => probeOk,
-  probeServer: () => probeServer
-});
-function probeOk(r) {
-  return r.kind === "ok" && r.apiVersion >= 2;
-}
-async function probeServer(base2, opts = {}) {
-  const f = opts.fetchImpl || fetch;
-  let res;
-  try {
-    res = await f(`${base2.replace(/\/+$/, "")}/api/capabilities`, {
-      signal: AbortSignal.timeout(opts.timeoutMs ?? 1e4)
-    });
-  } catch (err) {
-    return {
-      kind: "unreachable",
-      error: describeCause(err),
-      reason: classifyUnreachable(err)
-    };
-  }
-  if (res.status === 401 || res.status === 403) return { kind: "unauthorized", status: res.status };
-  if (res.status === 404 || res.status === 410) return { kind: "moved", status: res.status };
-  if (res.status >= 500) return { kind: "server_error", status: res.status };
-  if (!res.ok) return { kind: "moved", status: res.status };
-  let body;
-  try {
-    body = await res.text();
-  } catch (err) {
-    return { kind: "unreachable", error: describeCause(err), reason: classifyUnreachable(err) };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(body);
-  } catch {
-    return { kind: "not_api", status: res.status, snippet: body.trim().slice(0, 60) };
-  }
-  if (typeof parsed?.apiVersion !== "number") {
-    return { kind: "not_api", status: res.status, snippet: body.trim().slice(0, 60) };
-  }
-  return {
-    kind: "ok",
-    apiVersion: parsed.apiVersion,
-    edition: parsed.edition,
-    cliVersion: parsed.cli?.version
-  };
-}
-function probeAdvice(r, base2) {
-  switch (r.kind) {
-    case "ok":
-      return r.apiVersion >= 2 ? `apiVersion ${r.apiVersion}${r.edition ? `, edition ${r.edition}` : ""}` : `apiVersion ${r.apiVersion} is too old for this CLI \u2014 upgrade the server`;
-    case "moved":
-      return `HTTP ${r.status} \u2014 nothing is served at ${base2}. If the host moved, re-point it: \`chat-recall login <new-server-url>\``;
-    case "unauthorized":
-      return `HTTP ${r.status} \u2014 ${base2} rejected the credential. Re-login: \`chat-recall login ` + base2 + "`";
-    case "server_error":
-      return `HTTP ${r.status} \u2014 ${base2} is up but failing. Nothing to fix locally; check the server.`;
-    case "not_api":
-      return `${base2} answered ${r.status} with something that is not the chat-recall API (${JSON.stringify(r.snippet)}) \u2014 check the URL, a proxy or a captive portal`;
-    case "unreachable":
-      switch (r.reason) {
-        case "dns":
-          return `cannot resolve the host in ${base2} (${r.error}) \u2014 check the URL for a typo, and your DNS or VPN`;
-        case "refused":
-          return `${base2} resolves but refused the connection (${r.error}) \u2014 the server is not running, or the port is wrong`;
-        case "tls":
-          return `the TLS certificate at ${base2} was rejected (${r.error}) \u2014 expired, self-signed, or issued for another host. A corporate proxy that re-signs traffic does this.`;
-        case "timeout":
-          return `${base2} did not answer in time (${r.error}) \u2014 a firewall or proxy that drops traffic silently looks exactly like this`;
-        case "reset":
-          return `the connection to ${base2} was cut (${r.error}) \u2014 often a proxy or a captive portal`;
-        default:
-          return `no HTTP response from ${base2} (${r.error}) \u2014 check the URL, DNS, or that the server is running`;
-      }
-  }
-}
-function classifyUnreachable(err) {
-  if (err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError")) return "timeout";
-  for (let e = err, depth = 0; e && depth < 5; depth++) {
-    const code2 = String(e.code ?? "");
-    const msg = String(e.message ?? "");
-    if (code2 === "ENOTFOUND" || code2 === "EAI_AGAIN") return "dns";
-    if (code2 === "ECONNREFUSED") return "refused";
-    if (code2 === "ECONNRESET" || code2 === "EPIPE") return "reset";
-    if (code2 === "ETIMEDOUT" || code2 === "UND_ERR_CONNECT_TIMEOUT" || code2 === "UND_ERR_HEADERS_TIMEOUT") return "timeout";
-    if (code2.startsWith("CERT_") || code2.startsWith("ERR_TLS") || code2 === "DEPTH_ZERO_SELF_SIGNED_CERT" || code2 === "SELF_SIGNED_CERT_IN_CHAIN" || code2 === "UNABLE_TO_VERIFY_LEAF_SIGNATURE" || /certificate/i.test(msg)) return "tls";
-    e = e.cause;
-  }
-  return "unknown";
-}
-function describeCause(err) {
-  const parts = [];
-  for (let e = err, depth = 0; e && depth < 5; depth++) {
-    const code2 = e.code;
-    if (typeof code2 === "string" && code2 && !parts.includes(code2)) parts.push(code2);
-    e = e.cause;
-  }
-  const base2 = err instanceof Error ? err.message : String(err);
-  return parts.length ? `${base2}: ${parts.join(" \u2192 ")}` : base2;
-}
-var init_server_probe = __esm({
-  "src/server-probe.ts"() {
-    "use strict";
-  }
-});
-
 // src/verify-deep.ts
 var verify_deep_exports = {};
 __export(verify_deep_exports, {
@@ -24516,10 +24551,10 @@ __export(collector_exports, {
   isSecretRule: () => isSecretRule,
   resolveCodeindexBin: () => resolveCodeindexBin
 });
-import { spawn } from "node:child_process";
+import { spawn as spawn2 } from "node:child_process";
 import { execSync as execSync4 } from "node:child_process";
 import { readFileSync as readFileSync44 } from "node:fs";
-import { join as join53, basename as basename27 } from "node:path";
+import { join as join53, basename as basename28 } from "node:path";
 async function resolveCodeindexBin(autoInstall = true) {
   let st = checkCodeindexStatus();
   if (!st.installed && autoInstall)
@@ -24531,7 +24566,7 @@ async function resolveCodeindexBin(autoInstall = true) {
 }
 function runMcp(binPath, workspace, calls, timeoutMs = 18e4) {
   return new Promise((resolve3, reject) => {
-    const p = spawn(binPath, ["--mcp", "--workspace", workspace], { stdio: ["pipe", "pipe", "ignore"] });
+    const p = spawn2(binPath, ["--mcp", "--workspace", workspace], { stdio: ["pipe", "pipe", "ignore"] });
     const res = /* @__PURE__ */ new Map();
     let pending = "";
     let failed = false;
@@ -24897,7 +24932,7 @@ async function collectCode(opts) {
       file,
       line: null,
       rule: "god_module",
-      title: `God module ${basename27(file)}`,
+      title: `God module ${basename28(file)}`,
       snippet: `fan-in ${m.fan_in}, fan-out ${m.fan_out}`,
       why: FINDING_WHY.coupling,
       agentPrompt: couplingPrompt(file, m.fan_in ?? 0, m.fan_out ?? 0, Math.round((m.instability ?? 0) * 100) / 100)
@@ -25065,7 +25100,7 @@ async function collectCode(opts) {
       file,
       line: v.line ?? null,
       rule: v.violation_type ?? "manifest_violation",
-      title: `${v.violation_type} in ${basename27(file)}`,
+      title: `${v.violation_type} in ${basename28(file)}`,
       snippet: v.description ?? "",
       why: FINDING_WHY.manifest,
       agentPrompt: manifestPrompt(v.violation_type ?? "", file, v.line ?? null, v.description ?? "")
@@ -25836,7 +25871,7 @@ var init_intent_drain = __esm({
       ownVersion2 = JSON.parse(readFileSync46(join55(dir, "../package.json"), "utf-8")).version || ownVersion2;
     } catch {
       try {
-        if (true) ownVersion2 = "0.5.22";
+        if (true) ownVersion2 = "0.5.24";
       } catch {
       }
     }
@@ -27111,6 +27146,24 @@ __export(device_auth_exports, {
   deviceLogin: () => deviceLogin
 });
 import { createHash as createHash19, randomBytes } from "node:crypto";
+async function readDeviceCode(res, where) {
+  const text = await res.text().catch(() => "");
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new Error(
+      `${where} answered ${res.status} with something that is not a device-code response (${JSON.stringify(text.trim().slice(0, 60))}) \u2014 this host is not serving the chat-recall API`
+    );
+  }
+  const d = parsed;
+  if (typeof d?.device_code !== "string" || typeof d?.user_code !== "string" || typeof d?.verification_uri !== "string" || typeof d?.expires_in !== "number") {
+    throw new Error(
+      `${where} answered ${res.status} with JSON that is not a device-code response (${JSON.stringify(text.trim().slice(0, 60))}) \u2014 this host is not serving the chat-recall API`
+    );
+  }
+  return d;
+}
 async function deviceLogin(opts, onPrompt) {
   const issuer = (opts.issuer || DEFAULT_ISSUER).replace(/\/+$/, "");
   if (!issuer) {
@@ -27130,7 +27183,7 @@ async function deviceLogin(opts, onPrompt) {
   if (!startRes.ok) {
     throw new Error(`device-auth init failed: HTTP ${startRes.status} ${await startRes.text().catch(() => "")}`);
   }
-  const start = await startRes.json();
+  const start = await readDeviceCode(startRes, issuer);
   onPrompt({
     url: start.verification_uri_complete || start.verification_uri,
     userCode: start.user_code,
@@ -27184,7 +27237,7 @@ async function betterAuthDeviceLogin(serverUrl, onPrompt) {
   if (!startRes.ok) {
     throw new Error(`device-auth init failed: HTTP ${startRes.status} ${await startRes.text().catch(() => "")}`);
   }
-  const start = await startRes.json();
+  const start = await readDeviceCode(startRes, base2);
   onPrompt({
     url: start.verification_uri_complete || start.verification_uri,
     userCode: start.user_code,
@@ -27328,7 +27381,7 @@ import { Command } from "commander";
 import chalk from "chalk";
 import { existsSync as existsSync56, readFileSync as readFileSync49, writeFileSync as writeFileSync21, realpathSync as realpathSync5 } from "fs";
 import { homedir as homedir22 } from "os";
-import { join as join60, resolve as resolve2, dirname as dirname27, basename as basename28 } from "path";
+import { join as join60, resolve as resolve2, dirname as dirname27, basename as basename29 } from "path";
 
 // ../engine/dist/core/score-tier.js
 var STRONG_RATIO = 0.85;
@@ -27355,6 +27408,34 @@ function tierAll(results) {
 // src/cli.ts
 init_sync_client();
 init_update_notice();
+init_server_probe();
+
+// src/open-browser.ts
+import { spawn } from "node:child_process";
+function isSafeUrl(url) {
+  try {
+    const u = new URL(url);
+    return u.protocol === "https:" || u.protocol === "http:";
+  } catch {
+    return false;
+  }
+}
+function openBrowser(url) {
+  if (!isSafeUrl(url)) return false;
+  if (process.env.CHAT_RECALL_NO_BROWSER === "1" || process.env.CI) return false;
+  const [cmd, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+  try {
+    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {
+    });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/cli.ts
 init_which();
 init_collector_health();
 init_telemetry_consent();
@@ -27396,14 +27477,9 @@ function firstTarget() {
   return { base: cred.serverUrl.replace(/\/+$/, ""), token: cred.token };
 }
 function describeProbeError(err) {
-  const codes = [];
-  for (let e = err, depth = 0; e && depth < 5; depth++) {
-    const code2 = e.code;
-    if (typeof code2 === "string" && code2 && !codes.includes(code2)) codes.push(code2);
-    e = e.cause;
-  }
-  const base2 = err instanceof Error ? err.message : String(err);
-  return codes.length ? `${base2}: ${codes.join(" \u2192 ")}` : base2;
+  const msg = err instanceof Error ? err.message : String(err);
+  if (!/fetch failed|ECONN|ENOTFOUND|EAI_AGAIN|ETIMEDOUT|CERT_|aborted|timeout/i.test(msg)) return msg;
+  return describeUnreachable(err);
 }
 function failLogin(opts, message) {
   if (opts.fromInit) throw new Error(message);
@@ -27418,11 +27494,21 @@ function requireTarget() {
   }
   return t;
 }
+async function readJsonBody(res, base2, what) {
+  const text = await res.text().catch(() => "");
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new Error(
+      `${base2} answered ${res.status} with something that is not JSON (${JSON.stringify(text.trim().slice(0, 60))}) for ${what} \u2014 a proxy, a captive portal or a host that no longer serves the chat-recall API`
+    );
+  }
+}
 async function serverGet(path) {
   const t = requireTarget();
   const res = await fetch(t.base + path, { headers: t.token ? { authorization: `Bearer ${t.token}` } : {} });
   if (!res.ok) throw new Error(`server ${path}: HTTP ${res.status} ${await res.text().catch(() => "")}`);
-  return res.json();
+  return readJsonBody(res, t.base, `GET ${path}`);
 }
 async function serverGetSoft(path) {
   const t = requireTarget();
@@ -27432,7 +27518,7 @@ async function serverGetSoft(path) {
     return { status: res.status, data: null, message: body.message };
   }
   if (!res.ok) throw new Error(`server ${path}: HTTP ${res.status} ${await res.text().catch(() => "")}`);
-  return { status: res.status, data: await res.json() };
+  return { status: res.status, data: await readJsonBody(res, t.base, `GET ${path}`) };
 }
 async function serverPost(path, body) {
   const t = requireTarget();
@@ -27442,7 +27528,7 @@ async function serverPost(path, body) {
     body: JSON.stringify(body)
   });
   if (!res.ok) throw new Error(`server ${path}: HTTP ${res.status} ${await res.text().catch(() => "")}`);
-  return res.json();
+  return readJsonBody(res, t.base, `POST ${path}`);
 }
 async function serverPatch(path, body) {
   const t = requireTarget();
@@ -27452,7 +27538,7 @@ async function serverPatch(path, body) {
     body: JSON.stringify(body)
   });
   if (!res.ok) throw new Error(`server ${path}: HTTP ${res.status} ${await res.text().catch(() => "")}`);
-  return res.json();
+  return readJsonBody(res, t.base, `PATCH ${path}`);
 }
 async function serverDelete(path, body) {
   const t = requireTarget();
@@ -27462,7 +27548,7 @@ async function serverDelete(path, body) {
     body: JSON.stringify(body)
   });
   if (!res.ok) throw new Error(`server ${path}: HTTP ${res.status} ${await res.text().catch(() => "")}`);
-  return res.json();
+  return readJsonBody(res, t.base, `DELETE ${path}`);
 }
 var pkgEngines = (() => {
   try {
@@ -27474,7 +27560,7 @@ var pkgEngines = (() => {
 var pkgVersion = JSON.parse(
   readFileSync49(new URL("../package.json", import.meta.url), "utf-8")
 ).version;
-var DEFAULT_SERVER = "https://chatrecall.dev";
+var DEFAULT_SERVER = (process.env.CHAT_RECALL_DEFAULT_SERVER || "https://chatrecall.dev").replace(/\/+$/, "");
 var DEFAULT_ALLOW = [
   "recall_search",
   "recall_show",
@@ -27586,6 +27672,7 @@ program.command("init").description("Set up chat-recall: connect to your server,
     console.log();
     console.log(chalk.bold("2. Connecting to your server..."));
     let target = firstTarget();
+    let deadTarget = false;
     if (options.server) {
       try {
         await runLogin(options.server, { token: options.token, fromInit: true, promptJson: options.promptJson });
@@ -27605,7 +27692,34 @@ program.command("init").description("Set up chat-recall: connect to your server,
         console.log(`   ${chalk.dim(`Run ${chalk.bold("chat-recall login <server-url>")} when ready, or self-host: ${SELF_HOST_DOCS}`)}`);
       }
     }
-    if (target) {
+    if (target && !options.server) {
+      const { probeServer: probeServer2, probeOk: probeOk2, probeAdvice: probeAdvice2 } = await Promise.resolve().then(() => (init_server_probe(), server_probe_exports));
+      const probe = await probeServer2(target.base, { timeoutMs: 1e4 });
+      if (probeOk2(probe)) {
+        console.log(`   ${chalk.green("Connected")} \u2192 ${target.base}`);
+      } else if (probe.kind === "moved" || probe.kind === "not_api") {
+        const retired = target.base;
+        console.log(`   ${chalk.yellow("The saved server no longer serves chat-recall")} \u2192 ${retired}`);
+        console.log(`   ${probeAdvice2(probe, retired)}`);
+        console.log(`   Switching to ${chalk.bold(DEFAULT_SERVER)} \u2014 sign in to approve this machine.`);
+        try {
+          await runLogin(DEFAULT_SERVER, { token: options.token, fromInit: true, promptJson: options.promptJson });
+          const { removeCredentials: removeCredentials2 } = await Promise.resolve().then(() => (init_sync_client(), sync_client_exports));
+          if (removeCredentials2(retired)) {
+            console.log(`   ${chalk.dim(`Removed the retired target ${retired} (log in there again any time).`)}`);
+          }
+          target = firstTarget();
+          if (target) console.log(`   ${chalk.green("Connected")} \u2192 ${target.base}`);
+        } catch (e) {
+          console.log(`   ${chalk.yellow("Not connected.")} ${describeProbeError(e)}`);
+          console.log(`   ${chalk.dim(`Run ${chalk.bold(`chat-recall login ${DEFAULT_SERVER}`)} when ready, then ${chalk.bold(`chat-recall logout ${retired}`)}.`)}`);
+          deadTarget = true;
+        }
+      } else {
+        console.log(`   ${chalk.yellow("Saved server did not answer")} \u2192 ${target.base}`);
+        console.log(`   ${probeAdvice2(probe, target.base)}`);
+      }
+    } else if (target) {
       console.log(`   ${chalk.green("Connected")} \u2192 ${target.base}`);
     }
     console.log();
@@ -27714,22 +27828,40 @@ program.command("init").description("Set up chat-recall: connect to your server,
         const { executePull: executePull2 } = await Promise.resolve().then(() => (init_toolkit_pull(), toolkit_pull_exports));
         const { hostname: hostname3 } = await import("node:os");
         const rows = [];
+        let answered = 0;
+        const askFailed = [];
         for (const t of loadAllCredentials2()) {
           try {
             const res = await fetch(`${t.serverUrl}/api/toolkit/browse/mcp?limit=1000`, {
               headers: t.token ? { authorization: `Bearer ${t.token}` } : {},
               signal: AbortSignal.timeout(2e4)
             });
-            if (!res.ok) continue;
-            const body = await res.json();
+            if (!res.ok) {
+              askFailed.push(`${t.serverUrl} (HTTP ${res.status})`);
+              continue;
+            }
+            const text = await res.text();
+            let body;
+            try {
+              body = JSON.parse(text);
+            } catch {
+              askFailed.push(`${t.serverUrl} (not JSON: ${JSON.stringify(text.trim().slice(0, 40))})`);
+              continue;
+            }
+            answered++;
             for (const it of body.items || []) rows.push(it);
-          } catch {
+          } catch (e) {
+            askFailed.push(`${t.serverUrl} (${describeProbeError(e)})`);
           }
         }
         const report = executePull2(rows, { thisDeviceId: hostname3(), types: ["mcp"] });
         const written = report.outcomes.filter((o) => o.status === "written");
         const present = report.outcomes.filter((o) => o.status === "present").length;
-        if (written.length === 0 && present === 0) {
+        if (answered === 0) {
+          console.log(`   ${chalk.yellow("Could not ask your server what MCP servers are on your account")}`);
+          for (const f of askFailed) console.log(`   ${chalk.dim(f)}`);
+          console.log(`   ${chalk.dim("Re-run `chat-recall toolkit pull` once the server answers.")}`);
+        } else if (written.length === 0 && present === 0) {
           console.log(chalk.dim("   Nothing on your account to install yet."));
         } else {
           console.log(`   ${chalk.green(`Installed ${written.length}`)} ${chalk.dim(`(${present} already present)`)}`);
@@ -27744,7 +27876,10 @@ program.command("init").description("Set up chat-recall: connect to your server,
       }
       console.log();
     }
-    if (!options.skipSync && firstTarget()) {
+    if (deadTarget) {
+      console.log(chalk.bold("5. Skipping first sync \u2014 the saved server is not serving chat-recall"));
+      console.log(`   ${chalk.dim(`Re-point with the two commands above, then run ${chalk.bold("chat-recall sync")}.`)}`);
+    } else if (!options.skipSync && firstTarget()) {
       console.log(chalk.bold("5. Indexing and uploading your sessions"));
       try {
         const { syncSessions: syncSessions2 } = await Promise.resolve().then(() => (init_sync_client(), sync_client_exports));
@@ -28246,7 +28381,7 @@ program.command("doctor").description("Quick health check across login, server,
     }
   }
   for (const hooksJson of claudeHookConfigFiles()) {
-    const profile = basename28(dirname27(hooksJson));
+    const profile = basename29(dirname27(hooksJson));
     const label = `Claude hooks (${profile})`;
     if (!existsSync57(hooksJson)) {
       note(false, label, `no ${hooksJson} \u2014 run \`chat-recall install-hooks\``);
@@ -29602,7 +29737,7 @@ async function runLogin(serverUrl, opts) {
       });
       return { ok: res.ok, status: res.status };
     } catch (err) {
-      return { ok: false, error: err instanceof Error ? err.message : String(err) };
+      return { ok: false, error: describeUnreachable(err) };
     }
   };
   if (opts.token) {
@@ -29611,12 +29746,21 @@ async function runLogin(serverUrl, opts) {
       console.error(chalk.dim("Use the Copy button next to the token in the dashboard and paste the full line."));
       return failLogin(opts, 'the token contains non-ASCII characters \u2014 this looks like a masked/truncated copy (e.g. "ct_12345678\u2026")');
     }
+    const { probeServer: identifyServer, probeOk: identified, probeAdvice: identifyAdvice } = await Promise.resolve().then(() => (init_server_probe(), server_probe_exports));
+    const who = await identifyServer(base2, { timeoutMs: 1e4 });
+    if (!identified(who)) return failLogin(opts, identifyAdvice(who, base2));
     const check = await verifyToken(token);
     if (!check.ok) {
       if (check.status === 401 || check.status === 403) {
         console.error(chalk.dim("Tokens are shown once \u2014 mint a fresh one (Account \u2192 Connect your machine) and copy the whole line."));
         return failLogin(opts, `${base2} rejected the token (HTTP ${check.status})`);
       }
+      if (check.status !== void 0 && check.status >= 500) {
+        return failLogin(opts, `${base2} answered HTTP ${check.status} \u2014 the server is up but failing. The token was never checked. Nothing to fix locally.`);
+      }
+      if (check.status === 404 || check.status === 410) {
+        return failLogin(opts, `${base2} does not serve the chat-recall API (HTTP ${check.status}). If the server moved, log in to its new URL.`);
+      }
       return failLogin(opts, `could not verify the token against ${base2}: ${check.error || `HTTP ${check.status}`}`);
     }
     saveCredentials2({ serverUrl, token });
@@ -29629,11 +29773,15 @@ async function runLogin(serverUrl, opts) {
     return;
   }
   try {
-    const probe = await fetch(`${base2}/api/status`, { signal: AbortSignal.timeout(8e3) });
-    if (probe.status === 200) {
-      saveCredentials2({ serverUrl, token: "" });
-      console.log(chalk.green("\u2713 Logged in.") + chalk.dim(`  ${serverUrl} (local server \u2014 no auth, no token needed)`));
-      return;
+    const { probeServer: probeServer2, probeOk: probeOk2 } = await Promise.resolve().then(() => (init_server_probe(), server_probe_exports));
+    const identified = await probeServer2(base2, { timeoutMs: 8e3 });
+    if (probeOk2(identified)) {
+      const probe = await fetch(`${base2}/api/status`, { signal: AbortSignal.timeout(8e3) });
+      if (probe.status === 200) {
+        saveCredentials2({ serverUrl, token: "" });
+        console.log(chalk.green("\u2713 Logged in.") + chalk.dim(`  ${serverUrl} (local server \u2014 no auth, no token needed)`));
+        return;
+      }
     }
   } catch {
   }
@@ -29651,14 +29799,12 @@ async function runLogin(serverUrl, opts) {
       for (let attempt = 1; attempt <= 3 && !authProvider; attempt++) {
         const probe = await probeServer2(base2, { timeoutMs: 15e3 });
         if (probeOk2(probe)) {
-          try {
-            const caps = await fetch(`${base2}/api/capabilities`, { signal: AbortSignal.timeout(15e3) }).then((r) => r.json());
-            authProvider = caps?.authProvider;
-            if (caps?.oidcIssuer) issuer = caps.oidcIssuer;
-            capsError = null;
-          } catch (err) {
-            capsError = describeProbeError(err);
-          }
+          const caps = probe.raw;
+          authProvider = caps?.authProvider;
+          if (caps?.oidcIssuer) issuer = caps.oidcIssuer;
+          capsError = null;
+        } else if (probe.kind === "moved" || probe.kind === "not_api") {
+          return failLogin(opts, probeAdvice2(probe, base2));
         } else {
           capsError = probeAdvice2(probe, base2);
         }
@@ -29686,12 +29832,16 @@ async function runLogin(serverUrl, opts) {
       console.log(chalk.bold("To log in, open:"));
       console.log("  " + chalk.cyan(p.url));
       console.log(chalk.dim(`  (if prompted, enter code: ${chalk.bold(p.userCode)} at ${p.verificationUri})`));
+      const opened = openBrowser(p.url);
+      if (opened) console.log(chalk.dim("  (opening your browser\u2026 if nothing happens, use the link above)"));
       console.log(chalk.dim("After approving, come back to THIS terminal \u2014 it finishes the login by itself."));
       console.log(chalk.dim("Waiting for approval\u2026"));
     };
     const tokens = authProvider === "better-auth" ? await betterAuthDeviceLogin2(base2, onPrompt) : await deviceLogin2({ issuer, clientId: opts.clientId }, onPrompt);
     const authHdr = { authorization: `Bearer ${tokens.accessToken}`, "content-type": "application/json" };
-    const me = await fetch(`${base2}/api/me`, { headers: authHdr }).then((r) => r.json());
+    const meRes = await fetch(`${base2}/api/me`, { headers: authHdr });
+    if (!meRes.ok) throw new Error(`${base2}/api/me: HTTP ${meRes.status} ${await meRes.text().catch(() => "")}`);
+    const me = await readJsonBody(meRes, base2, "GET /api/me");
     const teams = me.teams || [];
     let slug = opts.team;
     if (!slug) {
@@ -29700,7 +29850,7 @@ async function runLogin(serverUrl, opts) {
         const name = me.user?.email?.split("@")[0]?.replace(/[^a-z0-9]/gi, "") || "workspace";
         const created = await fetch(`${base2}/api/teams`, { method: "POST", headers: authHdr, body: JSON.stringify({ name }) });
         if (!created.ok) throw new Error(`workspace create failed: HTTP ${created.status} ${await created.text().catch(() => "")}`);
-        slug = (await created.json()).slug;
+        slug = (await readJsonBody(created, base2, "POST /api/teams")).slug;
         console.log(chalk.dim(`Created workspace "${name}" (${slug}) \u2014 you're its owner.`));
       } else {
         teams.forEach((t) => console.error(`  ${t.team_slug}  ${chalk.dim(t.name)}`));
@@ -29714,7 +29864,7 @@ async function runLogin(serverUrl, opts) {
       body: JSON.stringify({ device_id: deviceId })
     });
     if (!mint.ok) throw new Error(`token mint failed: HTTP ${mint.status} ${await mint.text().catch(() => "")}`);
-    const { token } = await mint.json();
+    const { token } = await readJsonBody(mint, base2, "POST /api/teams/:slug/tokens");
     saveCredentials2({ serverUrl, token });
     console.log(chalk.green(`\u2713 Logged in to ${chalk.bold(slug)}`) + chalk.dim(`  (device: ${deviceId})  server: ${serverUrl}`));
     if (!opts.fromInit) {