fullstackgtm 0.45.0 → 0.47.0

package/dist/bin.js

@@ -1,8 +1,11 @@
 #!/usr/bin/env node
 import { runCli } from "./cli.js";
-import { flushRunReport } from "./runReport.js";
+import { beginRunReport, flushRunReport } from "./runReport.js";
 const args = process.argv.slice(2);
 const startedAt = Date.now();
+// Arm live progress heartbeats (paired CLIs stream long runs to the hosted
+// app under the same clientRunId the final flush below will upsert).
+beginRunReport(args, startedAt);
 runCli(args)
     .then(async () => {
     // exitCode 2 (audit findings / create-gate) or 1 (no value) = "partial":

package/dist/cli/auth.d.ts

@@ -5,6 +5,8 @@
  * shell escaping does nothing for a token sent in cleartext.
  */
 export declare function assertSecureBrokerUrl(raw: string): URL;
+type CrmProvider = "hubspot" | "salesforce";
+export declare function hostedProviderLogin(provider: CrmProvider, baseUrl: string): Promise<void>;
 export declare function login(args: string[]): Promise<void>;
 export declare function logout(args: string[]): void;
 type ProviderDoctorStatus = {

package/dist/cli/auth.js

@@ -47,6 +47,7 @@ export function assertSecureBrokerUrl(raw) {
     throw new Error(`Refusing to pair over ${url.protocol}//${url.host}: the broker exchanges a long-lived token and mints live CRM ` +
         "credentials, so it must use https (http is allowed only for localhost dev).");
 }
+const DEFAULT_HOSTED_BASE_URL = "https://app.fullstackgtm.com";
 async function brokerLogin(baseUrl) {
     const viaUrl = assertSecureBrokerUrl(baseUrl);
     const base = baseUrl.replace(/\/$/, "");
@@ -118,12 +119,115 @@ async function brokerLogin(baseUrl) {
     }
     throw new Error("Pairing timed out before it was approved.");
 }
+export async function hostedProviderLogin(provider, baseUrl) {
+    const viaUrl = assertSecureBrokerUrl(baseUrl);
+    const base = baseUrl.replace(/\/$/, "");
+    const os = await import("node:os");
+    const requesterLabel = `${os.hostname()} (${process.platform}, ${os.userInfo().username})`;
+    let startResponse;
+    try {
+        startResponse = await fetch(`${base}/api/cli/oauth/start`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ provider, requesterLabel }),
+        });
+    }
+    catch (error) {
+        const cause = error instanceof Error && error.cause instanceof Error ? `: ${error.cause.message}` : "";
+        throw new Error(`Cannot reach the hosted deployment at ${base}${cause}. Check the --via URL and network access.`);
+    }
+    if (!startResponse.ok) {
+        throw new Error(`Could not start ${provider} OAuth with ${base} (${startResponse.status}). Is this a FullStackGTM deployment?`);
+    }
+    const start = await startResponse.json();
+    let sameOrigin = false;
+    try {
+        sameOrigin = new URL(start.verificationUrl).origin === viaUrl.origin;
+    }
+    catch {
+        sameOrigin = false;
+    }
+    console.error(`\n${provider} OAuth code: ${start.userCode}\n\nApprove this CLI ("${requesterLabel}") in your hosted FullStackGTM dashboard:\n\n  ${start.verificationUrl}\n`);
+    if (sameOrigin) {
+        void openInBrowser(start.verificationUrl);
+    }
+    else {
+        console.error(`(Not auto-opening: the verification URL is not on ${viaUrl.origin}. Open it manually only if you trust it.)`);
+    }
+    const deadline = Date.now() + (start.expiresInSeconds ?? 600) * 1000;
+    const intervalMs = Math.max(0, (start.intervalSeconds ?? 3) * 1000);
+    while (Date.now() < deadline) {
+        await new Promise((resolveSleep) => setTimeout(resolveSleep, intervalMs));
+        const pollResponse = await fetch(`${base}/api/cli/auth/poll`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ deviceCode: start.deviceCode }),
+        });
+        if (!pollResponse.ok)
+            throw new Error(`Pairing poll failed (${pollResponse.status}).`);
+        const poll = await pollResponse.json();
+        if (poll.status === "pending")
+            continue;
+        if (poll.status === "approved" && poll.cliToken) {
+            const now = new Date().toISOString();
+            storeCredential("broker", {
+                kind: "broker",
+                accessToken: poll.cliToken,
+                baseUrl: base,
+                createdAt: now,
+                updatedAt: now,
+            });
+            console.log(`Logged in to ${provider} via hosted OAuth at ${base}. Credentials stored in ${credentialsPath()}.`);
+            console.log("Provider tokens are minted server-side by the hosted app; no provider app secret is stored in this CLI.");
+            return;
+        }
+        throw new Error(`Pairing was ${poll.status}.`);
+    }
+    throw new Error("Pairing timed out before it was approved.");
+}
+function hostedBase(args) {
+    return option(args, "--via") ?? process.env.FULLSTACKGTM_HOSTED_URL ?? DEFAULT_HOSTED_BASE_URL;
+}
+async function guidedProviderLogin(provider, args, reason) {
+    const command = `fullstackgtm login ${provider} --hosted`;
+    if (!process.stdin.isTTY || process.env.CI) {
+        console.error(`${reason}\nNext command: ${command}`);
+        throw new Error(reason);
+    }
+    console.error(`\n${provider} login options:\n` +
+        `  1) Hosted OAuth (default): no provider app needed; browser approval via FullStackGTM.\n` +
+        `  2) BYO ${provider === "salesforce" ? "Connected App" : "HubSpot app"}: advanced OAuth/device flow.\n` +
+        `  3) Paste token: read from stdin/prompt; never from argv.\n`);
+    const readline = await import("node:readline/promises");
+    const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+    const answer = (await rl.question("Choose [1]: ")).trim();
+    rl.close();
+    if (answer === "" || answer === "1")
+        return hostedProviderLogin(provider, hostedBase(args));
+    if (answer === "2") {
+        throw new Error(provider === "salesforce"
+            ? "Advanced BYO Salesforce: run `fullstackgtm login salesforce --device --client-id <consumer key>` or pipe a token with `--instance-url <url>`."
+            : `Advanced BYO HubSpot: run \`fullstackgtm login hubspot --oauth --client-id <id>\` (redirect http://localhost:${numericOption(args, "--port") ?? DEFAULT_LOOPBACK_PORT}/callback).`);
+    }
+    if (answer === "3") {
+        throw new Error(provider === "salesforce"
+            ? "Paste-token Salesforce: pipe the token with `fullstackgtm login salesforce --instance-url <url>`."
+            : "Paste-token HubSpot: pipe the token with `fullstackgtm login hubspot --private-token`.");
+    }
+    return hostedProviderLogin(provider, hostedBase(args));
+}
 async function salesforceLogin(args) {
     const now = new Date().toISOString();
+    rejectArgvSecret(args, "--token");
+    if (args.includes("--hosted") || (!args.includes("--device") && !args.includes("--instance-url"))) {
+        await hostedProviderLogin("salesforce", hostedBase(args));
+        return;
+    }
     if (args.includes("--device")) {
         const clientId = option(args, "--client-id");
         if (!clientId) {
-            throw new Error("--device requires --client-id (the consumer key of a Connected App with device flow enabled).");
+            await guidedProviderLogin("salesforce", args, "--device requires --client-id (the consumer key of a Connected App with device flow enabled).");
+            return;
         }
         const loginUrl = option(args, "--login-url") ?? undefined;
         const authorization = await startSalesforceDeviceLogin({ clientId, loginUrl });
@@ -150,11 +254,10 @@ async function salesforceLogin(args) {
         console.log("Tokens refresh silently; no further browser interaction is needed.");
         return;
     }
-    rejectArgvSecret(args, "--token");
     const instanceUrl = option(args, "--instance-url");
     if (!instanceUrl) {
-        throw new Error("Salesforce login needs --device --client-id <consumer key>, or --instance-url " +
-            "<https://yourorg.my.salesforce.com> with the access token piped on stdin.");
+        await guidedProviderLogin("salesforce", args, "Salesforce login needs hosted OAuth, --device --client-id <consumer key>, or --instance-url <https://yourorg.my.salesforce.com> with the access token piped on stdin.");
+        return;
     }
     const token = await readSecret("Salesforce access token");
     if (!token)
@@ -175,12 +278,12 @@ async function salesforceLogin(args) {
     console.log(`Logged in to Salesforce. Credentials stored in ${credentialsPath()}.`);
 }
 export async function login(args) {
+    const provider = args.find((arg) => !arg.startsWith("--") && !isOptionValue(args, arg));
     const via = option(args, "--via");
-    if (via) {
+    if (via && !provider) {
         await brokerLogin(via);
         return;
     }
-    const provider = args.find((arg) => !arg.startsWith("--") && !isOptionValue(args, arg));
     if (provider === "salesforce") {
         await salesforceLogin(args);
         return;
@@ -261,13 +364,18 @@ export async function login(args) {
         throw new Error("login supports: hubspot, salesforce, stripe, anthropic, openai, apollo, pipe0, explorium, or --via <hosted url>. Usage: fullstackgtm login <provider> | fullstackgtm login --via https://gtm.example.com");
     }
     const now = new Date().toISOString();
+    rejectArgvSecret(args, "--token");
+    if (args.includes("--hosted") || (!args.includes("--oauth") && !args.includes("--private-token"))) {
+        await hostedProviderLogin("hubspot", hostedBase(args));
+        return;
+    }
     if (args.includes("--oauth")) {
         rejectArgvSecret(args, "--client-secret");
         const clientId = option(args, "--client-id");
         if (!clientId) {
-            throw new Error("--oauth requires --client-id from your own HubSpot app " +
-                `(register http://localhost:${numericOption(args, "--port") ?? DEFAULT_LOOPBACK_PORT}/callback as a redirect URL). ` +
-                "The client secret is read from stdin or an interactive prompt.");
+            await guidedProviderLogin("hubspot", args, "--oauth requires --client-id from your own HubSpot app " +
+                `(register http://localhost:${numericOption(args, "--port") ?? DEFAULT_LOOPBACK_PORT}/callback as a redirect URL).`);
+            return;
         }
         const clientSecret = await readSecret("HubSpot app client secret");
         if (!clientSecret)
@@ -294,7 +402,6 @@ export async function login(args) {
         console.log("Tokens refresh silently; no further browser interaction is needed.");
         return;
     }
-    rejectArgvSecret(args, "--token");
     const token = await readSecret("HubSpot private app token");
     if (!token)
         throw new Error("No token provided.");
@@ -354,7 +461,7 @@ export function doctorReport(env = process.env) {
     const nextSteps = connected.length === 0
         ? [
             "fullstackgtm audit --demo            # no credentials needed",
-            "fullstackgtm login hubspot           # connect your CRM (or: login --via <hosted url>)",
+            "fullstackgtm login hubspot           # hosted browser OAuth (default; or: login salesforce)",
         ]
         : [`fullstackgtm audit --provider ${connected[0][0]}`];
     return {
@@ -380,7 +487,7 @@ function providerStatus(provider, broker) {
     if (broker) {
         return { source: "broker", detail: `via ${broker.baseUrl ?? "hosted deployment"}` };
     }
-    return { source: "none", detail: `fullstackgtm login ${provider}` };
+    return { source: "none", detail: provider === "hubspot" || provider === "salesforce" ? `fullstackgtm login ${provider} (hosted OAuth default)` : `fullstackgtm login ${provider}` };
 }
 /**
  * The workspace slice of doctor: current health + plans awaiting approval.

package/dist/cli/backfill.d.ts

@@ -0,0 +1 @@
+export declare function backfillCommand(args: string[]): Promise<void>;

package/dist/cli/backfill.js

@@ -0,0 +1,125 @@
+// `backfill stripe` — paid Stripe invoices → closed-won deal proposals through
+// the governed plan/apply flow. This command NEVER writes to a CRM: it reads
+// paid invoices (Stripe, read-only), reads a CRM snapshot, and builds a
+// dry-run create_record plan. --save persists the plan for the normal
+// plans approve → apply spine, where the HubSpot connector re-resolves each
+// invoice id (resolve-first) and creates only on a confirmed miss.
+import { buildStripeBackfillPlan, DEFAULT_BACKFILL_MATCH_PROPERTY } from "../backfill.js";
+import { fetchStripePaidInvoices } from "../connectors/stripe.js";
+import { getCredential } from "../credentials.js";
+import { patchPlanToMarkdown } from "../format.js";
+import { createFilePlanStore } from "../planStore.js";
+import { BACKFILL_STRIPE_STAGES, composeListeners, createProgressEmitter } from "../progress.js";
+import { progressReporter } from "../runReport.js";
+import { unknownSubcommandError } from "./suggest.js";
+import { option, readSnapshot, saveRequested } from "./shared.js";
+import { colorEnabled, createProgressRenderer, paint, stylizePlanMarkdown, table } from "./ui.js";
+/** STRIPE_SECRET_KEY env ∨ stored `login stripe` credential (same ladder as `--provider stripe`). */
+function resolveStripeKey() {
+    const key = process.env.STRIPE_SECRET_KEY ?? getCredential("stripe")?.accessToken;
+    if (!key) {
+        throw new Error("No Stripe credentials. Run `echo \"$STRIPE_KEY\" | fullstackgtm login stripe` or set STRIPE_SECRET_KEY. " +
+            "A restricted key with read access to Invoices and Customers is enough. (`fullstackgtm doctor` shows credential status.)");
+    }
+    return key;
+}
+export async function backfillCommand(args) {
+    const [subcommand, ...rest] = args;
+    if (subcommand === "runs") {
+        const { backfillRunsCommand } = await import("./backfillRuns.js");
+        await backfillRunsCommand(rest);
+        return;
+    }
+    if (subcommand !== "stripe") {
+        throw unknownSubcommandError("backfill", subcommand ?? "", ["stripe", "runs"]);
+    }
+    const since = option(rest, "--since");
+    const pipeline = option(rest, "--pipeline") ?? undefined;
+    const matchProperty = option(rest, "--match-property") ?? undefined;
+    const skipUnmatched = rest.includes("--skip-unmatched");
+    const save = saveRequested(rest);
+    // Shared progress: the BACKFILL_STRIPE_STAGES tick on an interactive stderr
+    // board (inert when piped) and heartbeat to a paired hosted app on long runs.
+    const renderer = createProgressRenderer(BACKFILL_STRIPE_STAGES);
+    const progress = createProgressEmitter(composeListeners(renderer.listener, progressReporter()));
+    const stage = (name) => progress.stage(name, BACKFILL_STRIPE_STAGES.indexOf(name), BACKFILL_STRIPE_STAGES.length);
+    let result;
+    try {
+        // 1. Revenue truth: paid invoices from Stripe (read-only).
+        stage("invoices");
+        const stripeKey = resolveStripeKey();
+        const invoices = await fetchStripePaidInvoices({ getApiKey: () => stripeKey }, { ...(since ? { sinceIso: since } : {}), onPage: (fetched) => progress.items(fetched) });
+        // 2. The CRM as it stands (same source options as audit: --provider <crm>,
+        //    --input <snapshot.json>, --demo, --sample). The pull's own stage/items
+        //    events ride the same emitter (the board ignores the nested stages).
+        stage("snapshot");
+        const snapshot = await readSnapshot(rest, progress);
+        // 3. Dry-run plan: one closed-won create_record deal per invoice with no
+        //    deal yet; unmatched customers also get a proposed account (unless
+        //    --skip-unmatched restores report-only behavior).
+        stage("matching");
+        result = buildStripeBackfillPlan(invoices, snapshot, {
+            pipeline,
+            matchProperty,
+            source: "stripe:invoices",
+            createMissingAccounts: !skipUnmatched,
+        });
+        stage("plan");
+        progress.flush();
+    }
+    finally {
+        renderer.done();
+    }
+    if (rest.includes("--json")) {
+        console.log(JSON.stringify({ plan: result.plan, counts: result.counts, unmatched: result.unmatched, proposedAccounts: result.proposedAccounts }, null, 2));
+    }
+    else {
+        // TTY-only styling; piped output stays byte-identical plain text.
+        console.log(stylizePlanMarkdown(patchPlanToMarkdown(result.plan), paint(colorEnabled(process.stdout))));
+        if (result.proposedAccounts.length > 0) {
+            console.log(`\nProposed new accounts (${result.proposedAccounts.length}) — Stripe customers the CRM doesn't know; ` +
+                "created only if this plan is approved and applied:");
+            const accountRows = [
+                ["account", "domain", "invoices"],
+                ...result.proposedAccounts.map((entry) => [
+                    entry.name,
+                    entry.domain ?? "—",
+                    String(entry.invoiceCount),
+                ]),
+            ];
+            for (const line of table(accountRows))
+                console.log(`  ${line}`);
+        }
+        if (result.unmatched.length > 0) {
+            console.log(`\nUnmatched invoices (${result.unmatched.length}) — ${skipUnmatched
+                ? "customer matched no CRM account by domain or name; reported only (--skip-unmatched)"
+                : "customer has no usable name or company domain; reported only"}:`);
+            const rows = [
+                ["invoice", "customer", "domain", "amount", "paid"],
+                ...result.unmatched.map((entry) => [
+                    entry.invoiceNumber ?? entry.invoiceId,
+                    entry.customerName ?? "—",
+                    entry.customerDomain ?? "—",
+                    `${entry.amountPaid}${entry.currency ? ` ${entry.currency}` : ""}`,
+                    entry.paidAt ?? "—",
+                ]),
+            ];
+            for (const line of table(rows))
+                console.log(`  ${line}`);
+        }
+    }
+    if (!save) {
+        console.error("\nDry run — nothing written. Re-run with --save to persist the plan, then approve + apply.");
+        return;
+    }
+    if (result.plan.operations.length === 0) {
+        console.error("No deals to backfill (every paid invoice already matched a deal or its customer was unmatched); nothing saved.");
+        return;
+    }
+    await createFilePlanStore().save(result.plan);
+    console.error(`Saved plan ${result.plan.id} — ${result.counts.planned} closed-won deal(s)` +
+        `${result.counts.accountsProposed > 0 ? ` + ${result.counts.accountsProposed} new account(s)` : ""} from ${result.counts.invoices} paid invoice(s). ` +
+        `Review \`fullstackgtm plans show ${result.plan.id}\`, approve \`fullstackgtm plans approve ${result.plan.id} --operations all\`, ` +
+        `then \`fullstackgtm apply --plan-id ${result.plan.id} --provider hubspot\`. ` +
+        `Apply re-checks ${result.plan.operations.length ? `the ${matchProperty ?? DEFAULT_BACKFILL_MATCH_PROPERTY} dedupe key` : "resolve-first"} before creating.`);
+}

package/dist/cli/backfillRuns.d.ts

@@ -0,0 +1 @@
+export declare function backfillRunsCommand(args: string[]): Promise<void>;

package/dist/cli/backfillRuns.js

@@ -0,0 +1,187 @@
+// `backfill runs` — replay the LOCAL execution history to the paired hosted
+// app, so an engagement that started CLI-only gets its full trail the moment
+// it pairs (instead of a feed that begins mid-engagement):
+//   - every stored plan's runs[] (apply attempts, per-op result counts)
+//     → POST /api/cli/run, one record per run
+//   - the health.jsonl timeline (per-audit hygiene scores)
+//     → POST /api/cli/health, chunked
+// Idempotent by construction: each run carries a DETERMINISTIC clientRunId
+// (fnv1a of planId + startedAt + index) and health entries dedupe server-side
+// on their timestamp — re-running backfill never duplicates anything.
+// Privacy: replays only what live reporting would have sent — statuses,
+// counts, timestamps, scores. No CRM field values leave the machine.
+import { getCredential } from "../credentials.js";
+import { readHealthTimeline } from "../health.js";
+import { createFilePlanStore } from "../planStore.js";
+import { activeProfile } from "../credentials.js";
+import { composeListeners, createProgressEmitter, RUNS_REPLAY_STAGES } from "../progress.js";
+import { progressReporter } from "../runReport.js";
+import { createProgressRenderer } from "./ui.js";
+function fnv1a(value) {
+    let hash = 0x811c9dc5;
+    for (let i = 0; i < value.length; i += 1) {
+        hash ^= value.charCodeAt(i);
+        hash = Math.imul(hash, 0x01000193);
+    }
+    return (hash >>> 0).toString(16).padStart(8, "0");
+}
+const RUN_STATUS = {
+    applied: "success",
+    partial: "partial",
+    failed: "error",
+    rejected: "error",
+};
+export async function backfillRunsCommand(args) {
+    const dryRun = args.includes("--dry-run");
+    const json = args.includes("--json");
+    const broker = getCredential("broker");
+    if (!broker?.baseUrl || !broker.accessToken) {
+        throw new Error("Not paired with a hosted app. Run `fullstackgtm login --via <url>` first — backfill replays local history to the paired backend.");
+    }
+    const baseUrl = broker.baseUrl.replace(/\/+$/, "");
+    const headers = {
+        Authorization: `Bearer ${broker.accessToken}`,
+        "Content-Type": "application/json",
+    };
+    const profile = activeProfile();
+    // 1. Gather: every stored plan's runs[] + the health timeline.
+    const plans = await createFilePlanStore().list();
+    const runPayloads = plans.flatMap((stored) => stored.runs.map((run, index) => {
+        const startedAt = Date.parse(run.startedAt);
+        const finishedAt = Date.parse(run.finishedAt);
+        const tally = { applied: 0, skipped: 0, conflicts: 0, failed: 0 };
+        for (const result of run.results) {
+            if (result.status === "applied")
+                tally.applied += 1;
+            else if (result.status === "skipped")
+                tally.skipped += 1;
+            else if (result.status === "conflict")
+                tally.conflicts += 1;
+            else
+                tally.failed += 1;
+        }
+        return {
+            clientRunId: `bkf_${fnv1a(`${stored.plan.id}:${run.startedAt}:${index}`)}`,
+            command: `apply --plan-id ${stored.plan.id}`,
+            status: RUN_STATUS[run.status] ?? "error",
+            profile,
+            startedAt: Number.isFinite(startedAt) ? startedAt : Date.now(),
+            finishedAt: Number.isFinite(finishedAt) ? finishedAt : startedAt,
+            durationMs: Number.isFinite(startedAt) && Number.isFinite(finishedAt) && finishedAt >= startedAt
+                ? finishedAt - startedAt
+                : 0,
+            counts: { ...tally, provider: run.provider, backfilled: true },
+        };
+    }));
+    const healthEntries = readHealthTimeline().map((entry) => ({
+        at: Date.parse(entry.at),
+        score: entry.score,
+        findings: entry.findings,
+        weightedFindings: entry.weightedFindings,
+        records: entry.records,
+        severityCounts: entry.severityCounts,
+        byObjectType: entry.byObjectType,
+        byRule: entry.byRule,
+    })).filter((entry) => Number.isFinite(entry.at));
+    if (dryRun) {
+        const summary = {
+            ok: true,
+            dryRun: true,
+            plans: plans.length,
+            runs: runPayloads.length,
+            healthEntries: healthEntries.length,
+            target: baseUrl,
+        };
+        if (json)
+            console.log(JSON.stringify(summary, null, 2));
+        else {
+            console.log(`Dry run — would replay ${runPayloads.length} plan run(s) (from ${plans.length} stored plan(s)) ` +
+                `and ${healthEntries.length} health reading(s) to ${baseUrl}. Nothing sent.`);
+        }
+        return;
+    }
+    // Shared progress: replay ticks on an interactive stderr board (inert when
+    // piped) and heartbeats to the paired app — this command is paired by
+    // definition, so a big replay shows live on the dashboard as it lands.
+    const renderer = createProgressRenderer(RUNS_REPLAY_STAGES);
+    const progress = createProgressEmitter(composeListeners(renderer.listener, progressReporter()));
+    // 2. Replay runs (sequential; server dedupes on clientRunId).
+    let reported = 0;
+    let failed = 0;
+    const errors = [];
+    let healthInserted = 0;
+    let healthDeduped = 0;
+    try {
+        progress.stage(RUNS_REPLAY_STAGES[0], 0, RUNS_REPLAY_STAGES.length);
+        for (const payload of runPayloads) {
+            try {
+                const response = await fetch(`${baseUrl}/api/cli/run`, {
+                    method: "POST",
+                    headers,
+                    body: JSON.stringify(payload),
+                    signal: AbortSignal.timeout(10_000),
+                });
+                if (!response.ok)
+                    throw new Error(`HTTP ${response.status}`);
+                reported += 1;
+            }
+            catch (error) {
+                failed += 1;
+                if (errors.length < 5) {
+                    errors.push(`${payload.command}: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+            progress.items(reported + failed, runPayloads.length);
+        }
+        // 3. Replay health history in chunks (server dedupes on timestamp).
+        progress.stage(RUNS_REPLAY_STAGES[1], 1, RUNS_REPLAY_STAGES.length);
+        for (let i = 0; i < healthEntries.length; i += 200) {
+            const chunk = healthEntries.slice(i, i + 200);
+            try {
+                const response = await fetch(`${baseUrl}/api/cli/health`, {
+                    method: "POST",
+                    headers,
+                    body: JSON.stringify({ entries: chunk }),
+                    signal: AbortSignal.timeout(15_000),
+                });
+                if (!response.ok)
+                    throw new Error(`HTTP ${response.status}`);
+                const result = (await response.json());
+                healthInserted += result.inserted ?? 0;
+                healthDeduped += result.deduped ?? 0;
+            }
+            catch (error) {
+                failed += 1;
+                if (errors.length < 5) {
+                    errors.push(`health chunk: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+            progress.items(Math.min(i + 200, healthEntries.length), healthEntries.length);
+        }
+        progress.flush();
+    }
+    finally {
+        renderer.done();
+    }
+    const summary = {
+        ok: failed === 0,
+        runsReported: reported,
+        runsFailed: failed,
+        healthInserted,
+        healthDeduped,
+        target: baseUrl,
+        ...(errors.length > 0 ? { errors } : {}),
+    };
+    if (json) {
+        console.log(JSON.stringify(summary, null, 2));
+    }
+    else {
+        console.log(`Replayed ${reported}/${runPayloads.length} plan run(s) and ${healthInserted} health reading(s) ` +
+            `to ${baseUrl} (${healthDeduped} readings already there — dedupe is server-side, re-running is safe).`);
+        for (const line of errors)
+            console.error(`  error: ${line}`);
+    }
+    if (failed > 0) {
+        process.exitCode = 1;
+    }
+}

package/dist/cli/call.js

@@ -5,13 +5,13 @@ import { patchPlanToMarkdown } from "../format.js";
 import { createFilePlanStore } from "../planStore.js";
 import { normalizeTranscript, parseCall, suggestCallDeal } from "../calls.js";
 import { classifyCall, rubricForCallType, rubricPresets, CALL_TYPES, CALL_TYPE_IDS } from "../callTypes.js";
-import { DEFAULT_RUBRIC, classifyCallLlm, extractInsightsLlm, parseRubric, resolveLlmCredential, scoreCallLlm } from "../llm.js";
+import { DEFAULT_RUBRIC, classifyCallLlm, extractInsightsChunked, parseRubric, resolveLlmCredential, scoreCallLlm } from "../llm.js";
 import { option, readSnapshot, requireLlmCredential, saveRequested } from "./shared.js";
 import { startElapsedStatus } from "./ui.js";
 export async function callCommand(args) {
     const [subcommand, ...rest] = args;
     if (args.includes("--help") || args.includes("-h")) {
-        console.log(`call parse    --transcript <file> [--title t] [--source s] [--model m] [--deterministic] [--json|--ndjson] [--out <path>]
+        console.log(`call parse    --transcript <file> [--title t] [--source s] [--model m] [--llm] [--heuristics] [--json|--ndjson] [--out <path>]
 call classify --transcript <file>|--call <parsed.json> [--llm] [--deterministic] [--json] [--list]
 call score    --transcript <file>|--call <parsed.json> [--call-type <t>] [--rubric <rubric.json>] [--model m] [--json|--out <path>] [--list-rubrics]
 call link     --attendees <a@x.com,...> | --domain <x.com>  [source options] [--json]
@@ -21,9 +21,12 @@ classify picks the call type (deterministic signals; --llm for a model tiebreak)
 score auto-selects the type-specific rubric from that classification unless you
 pass --call-type or --rubric. Call types: ${CALL_TYPE_IDS.join(", ")}.
 
-parse/score default to LLM extraction (Anthropic or OpenAI key via env,
-\`login anthropic|openai\`, or a one-time prompt). parse --deterministic is the
-free keyword baseline and classify --deterministic needs no key.
+parse defaults to chunked LLM extraction when a key resolves (ANTHROPIC_API_KEY/
+OPENAI_API_KEY or \`login anthropic|openai\`) and falls back to the free
+deterministic engine when none does. --heuristics (alias --deterministic)
+forces the deterministic engine; --llm forces the LLM path (one-time key prompt
+on a TTY). Model: --model, else env FSGTM_INSIGHTS_MODEL, else the provider
+default. classify --deterministic needs no key.
 score always needs a key (scoring is LLM work).`);
         return;
     }
@@ -42,19 +45,30 @@ score always needs a key (scoring is LLM work).`);
             sourceSystem: source,
             capturedAt: new Date().toISOString(),
         };
-        if (rest.includes("--deterministic")) {
+        if (rest.includes("--heuristics") || rest.includes("--deterministic")) {
+            return parseCall(raw, base);
+        }
+        // Engine parity with the hosted app: the chunked LLM pipeline runs by
+        // default whenever a key resolves (env or stored login), and the free
+        // deterministic engine runs when none does. --llm keeps the strict path
+        // for scripts (one-time TTY key prompt / actionable error, never silent).
+        if (!rest.includes("--llm") && !resolveLlmCredential()) {
+            console.error("No LLM key — using deterministic extraction. `fullstackgtm login anthropic|openai` or set ANTHROPIC_API_KEY/OPENAI_API_KEY for chunked LLM insights.");
             return parseCall(raw, base);
         }
-        // LLM extraction is the default: bring-your-own-key (Anthropic or OpenAI).
         const credential = await requireLlmCredential();
         const normalized = normalizeTranscript(raw);
         // Elapsed-time spinner on interactive terminals while the model works.
         const wait = startElapsedStatus((elapsed) => `Extracting insights · ${credential.provider} · ${elapsed}`);
         let extraction;
         try {
-            extraction = await extractInsightsLlm(normalized, {
+            // Chunked langextract-style pipeline: small per-chunk extraction calls
+            // beat one whole-transcript pass on long calls (single-shot truncates).
+            extraction = await extractInsightsChunked(normalized, {
                 ...credential,
-                model: option(rest, "--model") ?? undefined,
+                // --model wins, then the hosted app's env contract
+                // (FSGTM_INSIGHTS_MODEL), then the provider default downstream.
+                model: option(rest, "--model") ?? (process.env.FSGTM_INSIGHTS_MODEL || undefined),
                 title: base.title,
             });
         }