subto 7.0.0 → 8.0.0

package/README.md

@@ -24,57 +24,6 @@ Advanced features
 
 - `subto upload [dir]` — run a local-only AI analysis on the sampled files (does not send files to the server). Useful when you want quick on-device feedback without uploading.
 
-Examples (local testing and common workflows)
--------------------------------------------
-
-- Save an OpenRouter key non-interactively:
-
-```
-node cli/bin/subto.js upload key sk-or-...YOURKEY...
-```
-
-- Save an OpenRouter key interactively:
-
-```
-node cli/bin/subto.js upload key
-```
-
-- Upload a directory but run the local AI stub (dry-run):
-
-```
-SUBTO_LOCAL_AI=1 node cli/bin/subto.js upload path/to/project
-```
-
-- Upload a directory to the server (requests server to expire uploads after 1 day):
-
-```
-node cli/bin/subto.js upload path/to/project
-```
-
-- Upload a directory and request a server scan (returns uploadId and scanId):
-
-```
-node cli/bin/subto.js scan upload path/to/project --wait
-```
-
-- Print/open the web AI chat for a scan:
-
-```
-node cli/bin/subto.js aichat <scanId>
-```
-
-- Quick smoke test (included):
-
-```
-bash test/smoke_cli_test.sh
-```
-
-Notes
------
-
-- By default `upload` will send files to the server and request a 1-day expiry. Use `SUBTO_LOCAL_AI=1` to exercise the local AI dry-run behavior used during development and testing.
-- After `subto scan` completes the CLI prints both the AI chat URL and the video URL (if available): `https://subto.one/aichat/<scanId>` and `https://subto.one/video/<scanId>`.
-
 `.subtoignore` format
 - One pattern per line.
 - Lines starting with `#` are comments.

package/dist/package/README.md

@@ -40,7 +40,7 @@ Commands
 {
   "url": "https://example.com",
   "source": "cli",
-  "client": { "name": "subto-cli", "version": "7.0.0" }
+  "client": { "name": "subto-cli", "version": "8.0.0" }
 }
 ```
 
@@ -98,11 +98,11 @@ Download
 After publishing or packing, a distributable tarball will be available under `./dist/` e.g.:
 
 ```
-./dist/subto-7.0.0.tgz
+./dist/subto-8.0.0.tgz
 ```
 
 You can download that file directly and install locally with:
 
 ```bash
-npm install -g ./dist/subto-7.0.0.tgz
+npm install -g ./dist/subto-8.0.0.tgz
 ```

package/dist/package/index.js

@@ -11,7 +11,7 @@ const chalk = (_chalk && _chalk.default) ? _chalk.default : _chalk;
 const CONFIG_DIR = path.join(os.homedir(), '.subto');
 const CONFIG_PATH = path.join(CONFIG_DIR, 'config.json');
 const DEFAULT_API_BASE = 'https://subto.one';
-const CLIENT_META = { name: 'subto-cli', version: '7.0.0' };
+const CLIENT_META = { name: 'subto-cli', version: '8.0.0' };
 
 function configFilePath() { return CONFIG_PATH; }
 
@@ -69,8 +69,8 @@ async function postScan(url, apiKey) {
   const base = process.env.SUBTO_API_BASE_URL || DEFAULT_API_BASE;
   const endpoint = new URL('/api/v1/scan', base).toString();
   const body = { url, source: 'cli', client: CLIENT_META };
-  const fetchFn = global.fetch;
-  if (typeof fetchFn !== 'function') throw new Error('Global fetch() is not available in this Node runtime. Use Node 18+');
+  const fetchFn = global.fetch || (function(){ try{ const u = require('undici'); if (u && typeof u.fetch === 'function') { global.fetch = u.fetch; return global.fetch; } } catch(e){} return null; })();
+  if (typeof fetchFn !== 'function') throw new Error('Global fetch() is not available in this Node runtime. Install Node 18+ or run `npm install undici`.');
   const res = await fetchFn(endpoint, { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${apiKey}`, 'User-Agent': `${CLIENT_META.name}/${CLIENT_META.version}` }, body: JSON.stringify(body) });
   const text = await res.text();
   let data = null; try { data = text ? JSON.parse(text) : null; } catch (e) { data = text; }
@@ -111,105 +111,122 @@ async function run(argv) {
     .option('--no-wait', 'Do not poll; return immediately')
     .action(async (url, opts) => {
       if (!validateUrl(url)) { console.error(chalk.red('Invalid URL. Provide a full URL including http:// or https://')); process.exit(1); }
-      const cfg = await readConfig(); if (!cfg || !cfg.apiKey) { console.error(chalk.red('Missing API key. Run:'), chalk.cyan('subto login')); process.exit(1); }
+
+      // Load saved config (for API key)
+      const cfg = await readConfig();
+      if (!cfg || !cfg.apiKey) {
+        console.error(chalk.red('No API key configured. Run `subto login` to save your API key to ~/.subto/config.json'));
+        process.exit(1);
+      }
+
+      // Submit scan request
+      let resp;
       try {
-        const resp = await postScan(url, cfg.apiKey);
-        if (resp.status === 429) {
-          let retrySeconds = null;
-          if (resp.body && typeof resp.body === 'object' && resp.body.retry_after) retrySeconds = resp.body.retry_after;
-          try { const ra = resp.headers.get && resp.headers.get('retry-after'); if (!retrySeconds && ra) retrySeconds = parseInt(ra, 10); } catch (e) {}
-          if (retrySeconds) console.error(chalk.yellow(`Rate limit reached. Try again in ${retrySeconds} seconds.`)); else console.error(chalk.yellow('Rate limit reached. Try again later.'));
-          process.exit(1);
-        }
-        if (resp.status < 200 || resp.status >= 300) { let msg = `Request failed with status ${resp.status}`; if (resp.body && typeof resp.body === 'object' && resp.body.error) msg += ': ' + resp.body.error; console.error(chalk.red(msg)); process.exit(1); }
-
-        // Decide whether to poll:
-        // - if user passed --wait -> poll
-        // - if user passed --no-wait -> do not poll
-        // - otherwise, poll by default when server returns a queued/started status
-        const serverStatus = resp.body && resp.body.status;
-        const serverIndicatesQueued = serverStatus && ['started', 'queued', 'pending', 'accepted'].includes(String(serverStatus).toLowerCase());
-        const shouldPoll = (!opts.noWait) && (opts.wait || serverIndicatesQueued);
-
-        // If user asked for JSON only and we're not polling, print and exit.
-        if (opts.json && !shouldPoll) {
-          console.log(JSON.stringify(resp.body, null, 2));
-          return;
-        }
+        resp = await postScan(url, cfg.apiKey);
+      } catch (err) {
+        const msg = err && err.message ? err.message : String(err);
+        console.error(chalk.red('Network error:'), msg);
+        process.exit(1);
+      }
+
+      // Handle non-2xx responses
+      if (!resp || typeof resp.status !== 'number') {
+        console.error(chalk.red('Unexpected response from server')); process.exit(1);
+      }
+      if (resp.status === 401 || resp.status === 403) {
+        console.error(chalk.red('Authentication failed. Check your API key with `subto login`.')); process.exit(1);
+      }
+      if (resp.status === 429) {
+        let retrySeconds = null;
+        try { if (resp.body && typeof resp.body === 'object' && resp.body.retry_after) retrySeconds = resp.body.retry_after; } catch (e) {}
+        try { const ra = resp.headers && resp.headers.get && resp.headers.get('retry-after'); if (!retrySeconds && ra) retrySeconds = parseInt(ra, 10); } catch (e) {}
+        if (retrySeconds) console.error(chalk.yellow(`Rate limit reached. Try again in ${retrySeconds} seconds.`)); else console.error(chalk.yellow('Rate limit reached. Try again later.'));
+        process.exit(1);
+      }
+      if (resp.status < 200 || resp.status >= 300) {
+        let msg = `Request failed with status ${resp.status}`;
+        if (resp.body && typeof resp.body === 'object' && resp.body.error) msg += ': ' + resp.body.error;
+        console.error(chalk.red(msg)); process.exit(1);
+      }
+
+      // Decide whether to poll
+      const serverStatus = resp.body && resp.body.status;
+      const serverIndicatesQueued = serverStatus && ['started', 'queued', 'pending', 'accepted'].includes(String(serverStatus).toLowerCase());
+      let shouldPoll;
+      if (opts.wait === false) shouldPoll = false;
+      else if (opts.wait === true) shouldPoll = true;
+      else shouldPoll = serverIndicatesQueued;
 
-        // If we should poll, poll the scan resource until completion and print progress.
-        if (shouldPoll) {
-          const scanId = (resp.body && (resp.body.scanId || resp.body.id || resp.body.scan_id));
-          if (!scanId) {
-            console.error(chalk.red('Server did not return a scanId to poll.'));
+      if (opts.json && !shouldPoll) {
+        console.log(JSON.stringify(resp.body, null, 2)); return;
+      }
+
+      if (shouldPoll) {
+        const scanId = (resp.body && (resp.body.scanId || resp.body.id || resp.body.scan_id));
+        if (!scanId) { console.error(chalk.red('Server did not return a scanId to poll.')); process.exit(1); }
+
+        const base = process.env.SUBTO_API_BASE_URL || DEFAULT_API_BASE;
+        const fetchFn = global.fetch || (function(){ try{ const u = require('undici'); if (u && typeof u.fetch === 'function') { global.fetch = u.fetch; return global.fetch; } } catch(e){} return null; })();
+        if (typeof fetchFn !== 'function') throw new Error('Global fetch() is not available in this Node runtime. Install Node 18+ or run `npm install undici`.');
+
+        const sleep = ms => new Promise(r => setTimeout(r, ms));
+        let interval = 5000;
+        console.log(chalk.blue('Queued scan. Polling for progress...'));
+
+        let recheckedAfterTerminal = false;
+        while (true) {
+          const statusUrl = new URL(`/api/v1/scan/${scanId}`, base).toString();
+          const r = await fetchFn(statusUrl, { headers: { 'Authorization': `Bearer ${cfg.apiKey}`, 'Accept': 'application/json' } });
+
+          if (r.status === 429) {
+            let retrySeconds = null;
+            try { const j = await r.json(); if (j && j.retry_after) retrySeconds = j.retry_after; } catch (e) {}
+            try { const ra = r.headers.get && r.headers.get('retry-after'); if (!retrySeconds && ra) retrySeconds = parseInt(ra, 10); } catch (e) {}
+            if (retrySeconds) console.error(chalk.yellow(`Rate limit reached. Try again in ${retrySeconds} seconds.`)); else console.error(chalk.yellow('Rate limit reached. Try again later.'));
             process.exit(1);
           }
 
-          const base = process.env.SUBTO_API_BASE_URL || DEFAULT_API_BASE;
-          const fetchFn = global.fetch;
-          if (typeof fetchFn !== 'function') throw new Error('Global fetch() is not available in this Node runtime. Use Node 18+');
-
-          const sleep = ms => new Promise(r => setTimeout(r, ms));
-          let interval = 5000;
-          console.log(chalk.blue('Queued scan. Polling for progress...'));
-
-          let recheckedAfterTerminal = false;
-          while (true) {
-            const statusUrl = new URL(`/api/v1/scan/${scanId}`, base).toString();
-            const r = await fetchFn(statusUrl, { headers: { 'Authorization': `Bearer ${cfg.apiKey}`, 'Accept': 'application/json' } });
-
-            if (r.status === 429) {
-              let retrySeconds = null;
-              try { const j = await r.json(); if (j && j.retry_after) retrySeconds = j.retry_after; } catch (e) {}
-              try { const ra = r.headers.get && r.headers.get('retry-after'); if (!retrySeconds && ra) retrySeconds = parseInt(ra, 10); } catch (e) {}
-              if (retrySeconds) console.error(chalk.yellow(`Rate limit reached. Try again in ${retrySeconds} seconds.`)); else console.error(chalk.yellow('Rate limit reached. Try again later.'));
-              process.exit(1);
-            }
+          let data = null;
+          try { data = await r.json(); } catch (e) { data = null; }
+
+          if (data) {
+            if (data.queuePosition !== undefined) console.log(chalk.cyan('Queue position:'), data.queuePosition);
+            if (data.progress !== undefined) console.log(chalk.cyan('Progress:'), String(data.progress) + '%');
+            const rawStatus = data.status !== undefined && data.status !== null ? String(data.status) : '';
+            const displayStatus = rawStatus.trim();
+            if (displayStatus) console.log(chalk.cyan('Status:'), displayStatus);
+            if (data.stage) console.log(chalk.dim('Stage:'), data.stage);
+          } else {
+            console.log(chalk.dim('Waiting for server response...'));
+          }
 
-            let data = null;
-            try { data = await r.json(); } catch (e) { data = null; }
-
-            if (data) {
-              if (data.queuePosition !== undefined) console.log(chalk.cyan('Queue position:'), data.queuePosition);
-              if (data.progress !== undefined) console.log(chalk.cyan('Progress:'), String(data.progress) + '%');
-              const rawStatus = data.status !== undefined && data.status !== null ? String(data.status) : '';
-              const displayStatus = rawStatus.trim();
-              if (displayStatus) console.log(chalk.cyan('Status:'), displayStatus);
-              if (data.stage) console.log(chalk.dim('Stage:'), data.stage);
-            } else {
-              console.log(chalk.dim('Waiting for server response...'));
+          const statusStr = data && data.status ? String(data.status).toLowerCase().trim() : '';
+          const terminalStates = ['finished', 'completed', 'done', 'complete', 'success', 'succeeded'];
+          const done = statusStr && terminalStates.includes(statusStr);
+
+          if (done) {
+            const payloadKeys = data ? Object.keys(data).filter(k => !['status','queuePosition','progress','stage'].includes(k)) : [];
+            const hasPayload = payloadKeys.length > 0;
+            if (!hasPayload && !recheckedAfterTerminal) {
+              recheckedAfterTerminal = true;
+              console.log(chalk.yellow('Status is terminal but results not yet available — rechecking shortly...'));
+              await new Promise(r => setTimeout(r, 2000));
+              continue;
             }
 
-            const statusStr = data && data.status ? String(data.status).toLowerCase().trim() : '';
-            const terminalStates = ['finished', 'completed', 'done', 'complete', 'success', 'succeeded'];
-            const done = statusStr && terminalStates.includes(statusStr);
-
-            if (done) {
-              // If server signals completion but hasn't populated result fields yet,
-              // re-check once after a short delay to allow finalization.
-              const payloadKeys = data ? Object.keys(data).filter(k => !['status','queuePosition','progress','stage'].includes(k)) : [];
-              const hasPayload = payloadKeys.length > 0;
-              if (!hasPayload && !recheckedAfterTerminal) {
-                recheckedAfterTerminal = true;
-                console.log(chalk.yellow('Status is terminal but results not yet available — rechecking shortly...'));
-                await new Promise(r => setTimeout(r, 2000));
-                continue; // loop will fetch again
-              }
-
-              console.log(chalk.green('Scan finished. Full results:'));
-              console.log(JSON.stringify(data, null, 2));
-              return;
-            }
+            console.log(chalk.green('Scan finished. Full results:'));
+            console.log(JSON.stringify(data, null, 2));
+            return;
+          }
 
-            try { const ra = r.headers.get && r.headers.get('retry-after'); if (ra) { const secs = parseInt(ra, 10); if (!Number.isNaN(secs)) interval = Math.max(interval, secs * 1000); } } catch (e) {}
+          try { const ra = r.headers.get && r.headers.get('retry-after'); if (ra) { const secs = parseInt(ra, 10); if (!Number.isNaN(secs)) interval = Math.max(interval, secs * 1000); } } catch (e) {}
 
-            await sleep(interval);
-          }
+          await sleep(interval);
         }
+      }
 
-        // Default (no wait): pretty summary
-        printScanSummary(resp.body);
-      } catch (err) { const msg = err && err.message ? err.message : String(err); console.error(chalk.red('Network error:'), msg); process.exit(1); }
+      // Default (no wait): pretty summary
+      printScanSummary(resp.body);
     });
 
   if (!argv || argv.length === 0) { program.help(); return; }

package/index.js

@@ -10,29 +10,69 @@ const chalk = (_chalk && _chalk.default) ? _chalk.default : _chalk;
 
 const CONFIG_DIR = path.join(os.homedir(), '.subto');
 const CONFIG_PATH = path.join(CONFIG_DIR, 'config.json');
-const DEFAULT_API_BASE = 'https://subto.one';
-let CLIENT_META = { name: 'subto-cli', version: '7.0.0' };
-try {
-  // prefer the package.json version when available
-  const pkg = require('./package.json');
-  if (pkg && pkg.version) CLIENT_META.version = String(pkg.version);
-} catch (e) { /* keep default */ }
+const DEFAULT_API_BASE = 'https://subto.one/api/v1';
+const CLIENT_META = { name: 'subto-cli', version: '8.0.0' };
 const cp = require('child_process');
 
+// Normalize SUBTO API base so callers can set either
+// - https://subto.one
+// - https://subto.one/
+// - https://subto.one/api/v1
+// - https://subto.one/api/v1/
+// All usages below can rely on `SUBTO_HOST_BASE` (no trailing slash, no /api/v1)
+// and `SUBTO_API_BASE` (no trailing slash, includes /api/v1).
+const RAW_SUBTO_BASE = process.env.SUBTO_API_BASE_URL || DEFAULT_API_BASE;
+const SUBTO_HOST_BASE = String(RAW_SUBTO_BASE).replace(/\/api\/v1\/?$/i, '').replace(/\/$/, '');
+const SUBTO_API_BASE = SUBTO_HOST_BASE + '/api/v1';
+const SUBTO_API_BASE_SLASH = SUBTO_API_BASE + '/';
+
 // Load local CLI .env if present (safe, optional)
 try {
   const dotenvPath = path.join(__dirname, '.env');
   const fsSync = require('fs');
   if (fsSync.existsSync(dotenvPath)) {
     try {
-      const dotenv = require('dotenv');
-      dotenv.config({ path: dotenvPath });
+      // Load dotenv quietly to avoid third-party tip messages appearing in CLI output
+      const _console = { log: console.log, info: console.info, warn: console.warn };
+      console.log = console.info = console.warn = () => {};
+      try {
+        const dotenv = require('dotenv');
+        dotenv.config({ path: dotenvPath });
+      } finally {
+        console.log = _console.log; console.info = _console.info; console.warn = _console.warn;
+      }
     } catch (e) {
       // dotenv not installed in this environment; ignore silently
     }
   }
 } catch (e) { /* non-fatal */ }
 
+// Also try loading .env from current working directory and user home for convenience
+try {
+  const fsSync = require('fs');
+  const dotenv = (() => { try { return require('dotenv'); } catch(e) { return null; } })();
+  if (dotenv) {
+    try {
+      // Load .env from CWD quietly
+      const cwdEnv = path.join(process.cwd(), '.env');
+      if (fsSync.existsSync(cwdEnv)) {
+        const _console = { log: console.log, info: console.info, warn: console.warn };
+        console.log = console.info = console.warn = () => {};
+        try { dotenv.config({ path: cwdEnv }); } finally { console.log = _console.log; console.info = _console.info; console.warn = _console.warn; }
+      }
+    } catch (e) {}
+    try {
+      // Load ~/.env quietly
+      const homeEnv = path.join(os.homedir(), '.env');
+      if (fsSync.existsSync(homeEnv)) {
+        const _console2 = { log: console.log, info: console.info, warn: console.warn };
+        console.log = console.info = console.warn = () => {};
+        try { dotenv.config({ path: homeEnv }); } finally { console.log = _console2.log; console.info = _console2.info; console.warn = _console2.warn; }
+      }
+    } catch (e) {}
+  }
+} catch (e) { /* ignore */ }
+
 function configFilePath() { return CONFIG_PATH; }
 
 async function readConfig() {
@@ -50,6 +90,47 @@ async function writeConfig(obj) {
   await fs.rename(tmp, configFilePath());
 }
 
+// Interactive helper to store OpenRouter key + model into ~/.subto/config.json
+async function storeOpenRouterKeyInteractive(keyArg, modelArg) {
+  try {
+    let key = keyArg;
+    if (!key) {
+      key = await promptHidden('OpenRouter API key: ');
+      if (!key || !key.trim()) { console.log('Aborted.'); return; }
+    }
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const model = modelArg || await new Promise(res => rl.question('Model (e.g. openai/gpt-oss-120b:free): ', a => { rl.close(); res(a && a.trim()); }));
+    const chosenModel = model && model.length ? model : 'openai/gpt-oss-120b:free';
+
+    // Best-effort validation
+    let validated = false;
+    const fetchFn = global.fetch;
+    if (typeof fetchFn === 'function') {
+      try {
+        const res = await fetchFn('https://openrouter.ai/api/v1/models', { headers: { 'Authorization': `Bearer ${key}` } });
+        if (res && res.ok) {
+          const jd = await res.json().catch(()=>null);
+          const modelsList = jd && (jd.models || jd.data || jd) ;
+          const names = Array.isArray(modelsList) ? modelsList.map(m => m.id || m.name || m.model || m.modelId).filter(Boolean) : [];
+          if (names.length && names.includes(chosenModel)) validated = true;
+        }
+      } catch (e) { /* ignore network errors */ }
+    }
+
+    if (!validated) {
+      const rl2 = readline.createInterface({ input: process.stdin, output: process.stdout });
+      const answer = await new Promise(res => rl2.question('Could not verify model with OpenRouter. Save anyway? (y/N): ', a => { rl2.close(); res(a && a.trim().toLowerCase()); }));
+      if (answer !== 'y' && answer !== 'yes') { console.log('Aborted.'); return; }
+    }
+
+    const cfg = await readConfig() || {};
+    cfg.openrouterKey = String(key).trim();
+    cfg.openrouterModel = chosenModel;
+    await writeConfig(cfg);
+    console.log(chalk.green('OpenRouter key and model saved to'), chalk.cyan(configFilePath()));
+  } catch (e) { console.error(chalk.red('Failed to save key:'), e && e.message ? e.message : String(e)); process.exit(1); }
+}
+
 async function promptHidden(prompt) {
   if (!process.stdin.isTTY) throw new Error('Interactive prompt required');
   return new Promise((resolve, reject) => {
@@ -86,8 +167,8 @@ function validateUrl(input) {
 }
 
 async function postScan(url, apiKey) {
-  const base = process.env.SUBTO_API_BASE_URL || DEFAULT_API_BASE;
-  const endpoint = new URL('/api/v1/scan', base).toString();
+  // Use normalized API base
+  const endpoint = new URL('scan', SUBTO_API_BASE_SLASH).toString();
   const body = { url, source: 'cli', client: CLIENT_META };
   const fetchFn = global.fetch;
   if (typeof fetchFn !== 'function') throw new Error('Global fetch() is not available in this Node runtime. Use Node 18+');
@@ -190,7 +271,7 @@ async function printFullReport(data) {
 
   // Video link
   if (scan.videoUrl || scan.videoPath || scan.hasVideo) {
-    const vurl = scan.videoUrl || ((scan.videoPath) ? `${process.env.SUBTO_API_BASE_URL || DEFAULT_API_BASE}/video/${scan.scanId || scan.id}` : null);
+    const vurl = scan.videoUrl || ((scan.videoPath) ? `${SUBTO_HOST_BASE}/video/${scan.scanId || scan.id}` : null);
     if (vurl) {
       // attempt to HEAD the video URL to detect expiry / 404
       let note = '';
@@ -212,7 +293,7 @@ async function printFullReport(data) {
 
   // Helpful interactive links (browser-based) — point to server-side chat and video endpoints
   try {
-    const base = (process.env.SUBTO_API_BASE_URL || DEFAULT_API_BASE).replace(/\/$/, '');
+    const base = SUBTO_HOST_BASE;
     const id = scan.scanId || scan.id;
     if (id) {
       console.log(chalk.bold.underline('\nInteractive Links'));
@@ -324,7 +405,7 @@ function summarizeScanForPrompt(scan){
   }
   const issues = scan.issues || (scan.results && scan.results.issues) || [];
   if(Array.isArray(issues) && issues.length) parts.push(`Issues: ${issues.slice(0,10).map(i=>i.title||i.message||i.rule||i.id).join('; ')}`);
-  if(scan.videoUrl || scan.videoPath) parts.push(`Video: ${scan.videoUrl || `${process.env.SUBTO_API_BASE_URL||DEFAULT_API_BASE}/video/${scan.scanId||scan.id}`}`);
+  if(scan.videoUrl || scan.videoPath) parts.push(`Video: ${scan.videoUrl || `${SUBTO_HOST_BASE}/video/${scan.scanId||scan.id}`}`);
   return parts.join('\n');
 }
 
@@ -351,7 +432,7 @@ async function answerFromScan(scan, question){
   // Local heuristic fallback
   const lq = q.toLowerCase();
   if(lq.includes('video')||lq.includes('record')){
-    const url = scan.videoUrl || (scan.videoPath? `${process.env.SUBTO_API_BASE_URL||DEFAULT_API_BASE}/video/${scan.scanId||scan.id}` : null);
+    const url = scan.videoUrl || (scan.videoPath? `${SUBTO_HOST_BASE}/video/${scan.scanId||scan.id}` : null);
     return url? `Session video: ${url}` : 'No session video available for this scan.';
   }
   if(lq.includes('issues')||lq.includes('problem')){
@@ -377,6 +458,10 @@ async function answerFromScan(scan, question){
 
 async function startChatREPL(scanData){
   if(!process.stdin.isTTY){ console.log(chalk.yellow('Interactive chat not available in non-interactive terminal.')); return; }
+  // Report whether an AI key is configured (helps users debug why assistant may be limited)
+  const aiKeyPresent = Boolean(process.env.OPENAI_API_KEY || process.env.AI_API_KEY || process.env.OPENROUTER_API_KEY);
+  if (!aiKeyPresent) console.log(chalk.yellow('\nNo external AI API key found in environment. Assistant will run in local fallback mode (heuristic answers).'));
+  else console.log(chalk.cyan('\nAI API key found — assistant will call the configured model.'));
   console.log(chalk.cyan('\nStarting interactive assistant. Type `exit` or Ctrl-D to quit.'));
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout, prompt: 'AI> ' });
   rl.prompt();
@@ -396,8 +481,13 @@ async function startChatREPL(scanData){
 
 async function run(argv) {
   const program = new Command();
-  program.name('subto').description('Subto CLI — wrapper around Subto.One API').version(CLIENT_META.version || '7.0.0');
+  program.name('subto').description('Subto CLI — wrapper around Subto.One API').version(CLIENT_META.version || '8.0.0');
+  program.option('-v, --verbose', 'Show verbose HTTP logs');
   program.option('--chat', 'Start local AI assistant (no command required)');
+  program.option('--no-auto-skip', 'Disable automatic skipping of external APIs when scans appear stuck');
+  program.option('--skip-prompt-ms <n>', 'Milliseconds before prompting to skip external APIs (default 15000)');
+  program.option('--skip-countdown-ms <n>', 'Milliseconds countdown before auto-skip after prompt (default 10000)');
+  program.option('--skip-force-ms <n>', 'Milliseconds before forcing auto-skip after prompt (default 15000)');
 
   program.command('login').description('Store your API key in ~/.subto/config.json').action(async () => {
     try {
@@ -436,14 +526,20 @@ async function run(argv) {
         // - otherwise, poll by default when server returns a queued/started status
         // If server returned HTML (some proxies or web routes), avoid dumping raw HTML to terminal.
         // Try to recover a scanId from the HTML and fetch the JSON scan resource instead.
+        const VERBOSE = program.opts && program.opts().verbose;
         if (typeof resp.body === 'string' && resp.body.indexOf('<') !== -1) {
           // attempt to extract scan id
-          const attemptId = extractScanIdFromHtml(resp.body);
+              const attemptId = extractScanIdFromHtml(resp.body);
           const fetchFn = global.fetch;
+          if (VERBOSE) {
+            try {
+              console.log(chalk.dim(`Response status: ${resp.status}`));
+              if (resp.headers && typeof resp.headers.forEach === 'function') resp.headers.forEach((v,k)=>console.log(chalk.dim(`${k}: ${v}`)));
+            } catch (e) {}
+          }
           if (attemptId && typeof fetchFn === 'function') {
             try {
-              const base = process.env.SUBTO_API_BASE_URL || DEFAULT_API_BASE;
-              const statusUrl = new URL(`/api/v1/scan/${attemptId}`, base).toString();
+              const statusUrl = new URL(`scan/${attemptId}`, SUBTO_API_BASE_SLASH).toString();
               const r2 = await fetchFn(statusUrl, { headers: { 'Authorization': `Bearer ${cfg.apiKey}`, 'Accept': 'application/json' } });
               if (r2 && r2.ok) {
                 try { resp.body = await r2.json(); } catch (e) { /* leave as-is */ }
@@ -452,12 +548,28 @@ async function run(argv) {
                 resp.body = { scanId: attemptId, status: 'accepted' };
               }
             } catch (e) {
-              // couldn't fetch, fall through and keep original body but avoid printing HTML
-              resp.body = { status: 'unknown', note: 'Server returned HTML and scanId could not be resolved.' };
+              // couldn't fetch; save the HTML to a temp file for inspection
+              try {
+                const tmpPath = path.join(os.tmpdir(), `subto-scan-${Date.now()}.html`);
+                await fs.writeFile(tmpPath, resp.body, 'utf8');
+                console.error(chalk.yellow(`Server returned HTML and scanId could not be resolved. Saved HTML to: ${tmpPath}`));
+                if (VERBOSE) console.error(chalk.dim('Open the file to inspect the server response and locate a scanId.'));
+                resp.body = { status: 'unknown', note: `Server returned HTML (saved to ${tmpPath}).` };
+              } catch (writeErr) {
+                resp.body = { status: 'unknown', note: 'Server returned HTML and scanId could not be resolved.' };
+              }
             }
           } else {
-            // No scan id found; replace with a safe message (do NOT print raw HTML)
-            resp.body = { status: 'unknown', note: 'Server returned HTML. Use --wait or provide the scanId to fetch structured JSON.' };
+            // No scan id found; save HTML to temp file and provide a helpful message
+            try {
+              const tmpPath = path.join(os.tmpdir(), `subto-scan-${Date.now()}.html`);
+              await fs.writeFile(tmpPath, resp.body, 'utf8');
+              console.error(chalk.yellow(`Server returned HTML. Saved response to: ${tmpPath}`));
+              if (VERBOSE) console.error(chalk.dim('You can open that file in a browser to inspect what the server returned.'));
+              resp.body = { status: 'unknown', note: `Server returned HTML (saved to ${tmpPath}). Use --wait or provide the scanId to fetch structured JSON.` };
+            } catch (writeErr) {
+              resp.body = { status: 'unknown', note: 'Server returned HTML. Use --wait or provide the scanId to fetch structured JSON.' };
+            }
           }
         }
 
@@ -479,7 +591,7 @@ async function run(argv) {
             process.exit(1);
           }
 
-          const base = process.env.SUBTO_API_BASE_URL || DEFAULT_API_BASE;
+          const base = SUBTO_HOST_BASE;
           const fetchFn = global.fetch;
           if (typeof fetchFn !== 'function') throw new Error('Global fetch() is not available in this Node runtime. Use Node 18+');
 
@@ -496,9 +608,27 @@ async function run(argv) {
           // Track last server-provided percent to detect stalls
           let lastServerPercent = null;
           let lastServerChangeAt = Date.now();
+          let promptedSkipExternal = false;
+          let skipRequestedAt = null;
+          const globalOpts = (program && typeof program.opts === 'function') ? program.opts() : {};
+          const SKIP_PROMPT_MS = Number(globalOpts.skipPromptMs || process.env.SUBTO_CLI_SKIP_PROMPT_MS || '15000'); // prompt after 15s stuck at 50%
+          const SKIP_COUNTDOWN_MS = Number(globalOpts.skipCountdownMs || process.env.SUBTO_CLI_SKIP_COUNTDOWN_MS || '10000'); // countdown before auto-skip
+          // If the scan remains stuck even after the interactive countdown, force auto-skip after this extra window
+          const SKIP_FORCE_AFTER_MS = Number(globalOpts.skipForceMs || process.env.SUBTO_CLI_SKIP_FORCE_AFTER_MS || '15000'); // default 15s
+          const AUTO_SKIP = (typeof globalOpts.autoSkip !== 'undefined') ? Boolean(globalOpts.autoSkip) : (globalOpts.noAutoSkip ? false : true);
           let lastPollTs = Date.now();
           const terminalStates = ['finished', 'completed', 'done', 'complete', 'success', 'succeeded'];
 
+          function markSkipRequested(currentServerPct){
+            try{
+              skipRequestedAt = Date.now();
+              lastServerChangeAt = Date.now();
+              // nudge targetPercent forward but avoid jumping to 100 — leave room for analysis
+              const base = (typeof currentServerPct === 'number' && currentServerPct > 0) ? currentServerPct : (lastServerPercent || 50);
+              targetPercent = Math.max(targetPercent, Math.min(90, Math.round(base + 10)));
+            }catch(e){}
+          }
+
           // Render a single-line progress: spinner + label + [###-------] NN%
           let lastRender = '';
           function computePercentFromData(d){
@@ -661,7 +791,7 @@ async function run(argv) {
           let data = null;
           startSpinner();
           while (true) {
-            const statusUrl = new URL(`/api/v1/scan/${scanId}`, base).toString();
+              const statusUrl = new URL(`scan/${scanId}`, SUBTO_API_BASE_SLASH).toString();
             const r = await fetchFn(statusUrl, { headers: { 'Authorization': `Bearer ${cfg.apiKey}`, 'Accept': 'application/json' } });
 
             if (r.status === 429) {
@@ -687,6 +817,174 @@ async function run(argv) {
             // render progress line
             renderLine(data);
 
+            // Stall detection: update lastServerPercent timestamp when server percent changes
+            try {
+              const serverPct = computePercentFromData(data);
+              if (typeof serverPct === 'number') {
+                if (lastServerPercent === null || serverPct !== lastServerPercent) {
+                  lastServerPercent = serverPct;
+                  lastServerChangeAt = Date.now();
+                }
+              }
+              // If stuck at ~50% for a while, prompt user to skip external APIs
+              if (!promptedSkipExternal && typeof serverPct === 'number' && serverPct === 50) {
+                const stuckMs = Date.now() - lastServerChangeAt;
+                if (stuckMs > SKIP_PROMPT_MS) {
+                  promptedSkipExternal = true;
+                  var promptedSkipExternalAt = Date.now();
+                  // If not interactive, behave as before and auto-request skip immediately.
+                  if (!process.stdin || !process.stdin.isTTY) {
+                    try {
+                      stopSpinner();
+                      if (AUTO_SKIP) {
+                        console.log(chalk.yellow('\nNo progress detected on external APIs — requesting server to skip external API calls (auto).'));
+                        const skipUrl = new URL(`scan/${scanId}/skip-apis`, SUBTO_API_BASE_SLASH).toString();
+                        markSkipRequested(lastServerPercent);
+                        await fetchFn(skipUrl, { method: 'POST', headers: { 'Authorization': `Bearer ${cfg.apiKey}`, 'Content-Type': 'application/json' }, body: '{}' });
+                        console.log(chalk.yellow('Requested server to skip external API calls for this scan.'));
+                      } else {
+                        console.log(chalk.yellow('\nNo progress detected on external APIs. Automatic skip is disabled.'));
+                      }
+                    } catch (e) {
+                      console.error(chalk.red('Failed to request skip:'), e && e.message ? e.message : e);
+                    } finally {
+                      startSpinner();
+                    }
+                  } else {
+                    // Interactive TTY: show a countdown and allow single-key to skip now or continue waiting.
+                    stopSpinner();
+                    try {
+                      const totalMs = SKIP_COUNTDOWN_MS;
+                      let remaining = totalMs;
+                      process.stdout.write('\n');
+                      process.stdout.write(chalk.yellow(`No progress detected on external APIs. Auto-skip in ${Math.ceil(remaining/1000)}s. Press 's' to skip now, 'w' to continue waiting.`));
+
+                      // Ensure stdin in raw mode so we can capture single key presses
+                      const stdin = process.stdin;
+                      stdin.resume();
+                      if (typeof stdin.setRawMode === 'function') stdin.setRawMode(true);
+
+                      let resolved = false;
+
+                      const cleanup = () => {
+                        try {
+                          if (typeof stdin.setRawMode === 'function') stdin.setRawMode(false);
+                        } catch (e) {}
+                        try { stdin.pause(); } catch (e) {}
+                      };
+
+                      const onKey = async (buf) => {
+                        if (resolved) return;
+                        const ch = String(buf || '').toLowerCase();
+                        if (ch === '\u0003') {
+                          // Ctrl+C - restore and exit
+                          cleanup();
+                          process.exit(1);
+                        }
+                        if (ch === 's') {
+                          resolved = true;
+                          stdin.removeListener('data', onKey);
+                          cleanup();
+                          // send skip now
+                          try {
+                            console.log(chalk.yellow('\nSkip requested by user.')); 
+                            const skipUrl = new URL(`scan/${scanId}/skip-apis`, SUBTO_API_BASE_SLASH).toString();
+                            markSkipRequested(serverPct);
+                            await fetchFn(skipUrl, { method: 'POST', headers: { 'Authorization': `Bearer ${cfg.apiKey}`, 'Content-Type': 'application/json' }, body: '{}' });
+                            console.log(chalk.yellow('Requested server to skip external API calls for this scan.'));
+                          } catch (e) {
+                            console.error(chalk.red('Failed to request skip:'), e && e.message ? e.message : e);
+                          } finally {
+                            startSpinner();
+                          }
+                        } else if (ch === 'w') {
+                          // continue waiting
+                          resolved = true;
+                          stdin.removeListener('data', onKey);
+                          cleanup();
+                          promptedSkipExternal = false;
+                          lastServerChangeAt = Date.now();
+                          console.log(chalk.dim('\nContinuing to wait for external API calls...'));
+                          startSpinner();
+                        }
+                      };
+
+                      stdin.on('data', onKey);
+
+                      // countdown interval to update message
+                      const tick = 1000;
+                      const intervalId = setInterval(() => {
+                        remaining -= tick;
+                        if (resolved) {
+                          clearInterval(intervalId);
+                          return;
+                        }
+                        if (remaining <= 0) {
+                          clearInterval(intervalId);
+                          stdin.removeListener('data', onKey);
+                          cleanup();
+                          // timeout reached - auto-skip
+                          (async () => {
+                            try {
+                              if (AUTO_SKIP) {
+                                console.log(chalk.yellow('\nAuto-skip timeout reached — requesting server to skip external API calls.'));
+                                const skipUrl = new URL(`scan/${scanId}/skip-apis`, SUBTO_API_BASE_SLASH).toString();
+                                markSkipRequested(lastServerPercent);
+                                await fetchFn(skipUrl, { method: 'POST', headers: { 'Authorization': `Bearer ${cfg.apiKey}`, 'Content-Type': 'application/json' }, body: '{}' });
+                                console.log(chalk.yellow('Requested server to skip external API calls for this scan.'));
+                              } else {
+                                console.log(chalk.yellow('\nAuto-skip timeout reached but automatic skip is disabled. Continuing to wait.'));
+                              }
+                            } catch (e) {
+                              console.error(chalk.red('Failed to request skip:'), e && e.message ? e.message : e);
+                            } finally {
+                              startSpinner();
+                            }
+                          })();
+                        } else {
+                          try {
+                            readline.clearLine(process.stdout, 0);
+                            readline.cursorTo(process.stdout, 0);
+                            process.stdout.write(chalk.yellow(`Auto-skip in ${Math.ceil(remaining/1000)}s. Press 's' to skip now, 'w' to continue waiting.`));
+                          } catch (e) {
+                            // ignore render errors
+                          }
+                        }
+                      }, tick);
+
+                    } catch (e) {
+                      console.error(chalk.red('Prompt error:'), e && e.message ? e.message : e);
+                      startSpinner();
+                    }
+                  }
+                }
+              }
+            } catch (e) { /* ignore stall-detection errors */ }
+
+              // If user was prompted but no action taken and overall time exceeds force threshold, auto-skip
+              try {
+                if (promptedSkipExternal && promptedSkipExternalAt && (Date.now() - promptedSkipExternalAt) > SKIP_FORCE_AFTER_MS) {
+                  // send skip once and reset flag
+                  promptedSkipExternal = false;
+                  try {
+                    stopSpinner();
+                    if (AUTO_SKIP) {
+                      console.log(chalk.yellow('\nScan stuck at 50% for too long — auto-requesting skip of external APIs.'));
+                      const skipUrl = new URL(`scan/${scanId}/skip-apis`, SUBTO_API_BASE_SLASH).toString();
+                      markSkipRequested(lastServerPercent);
+                      await fetchFn(skipUrl, { method: 'POST', headers: { 'Authorization': `Bearer ${cfg.apiKey}`, 'Content-Type': 'application/json' }, body: '{}' });
+                      console.log(chalk.yellow('Requested server to skip external API calls for this scan.'));
+                    } else {
+                      console.log(chalk.yellow('\nScan stuck at 50% for too long but automatic skip is disabled.'));
+                    }
+                  } catch (e) {
+                    console.error(chalk.red('Failed to auto-request skip:'), e && e.message ? e.message : e);
+                  } finally {
+                    startSpinner();
+                  }
+                }
+              } catch (e) { /* ignore */ }
+
             // consider terminal if status matches known terminal states OR percent maps to 100
             const pctNow = computePercentFromData(data);
             const done = (statusStr && terminalStates.includes(statusStr)) || (typeof pctNow === 'number' && pctNow === 100);
@@ -710,15 +1008,6 @@ async function run(argv) {
               console.log(chalk.green('Scan finished. Full results:'));
               if (opts && opts.json) console.log(JSON.stringify(data, null, 2));
               else await printFullReport(data);
-              // Print web links for AI chat and session video when available
-              try {
-                const sid = data && (data.scanId || data.id || data.scan_id);
-                if (sid) {
-                  const baseUrl = (process.env.SUBTO_API_BASE_URL || DEFAULT_API_BASE).replace(/\/$/, '');
-                  console.log('AI Chat URL:', baseUrl + `/aichat/${sid}`);
-                  console.log('Video URL:', baseUrl + `/video/${sid}`);
-                }
-              } catch (e) { /* ignore */ }
               if (opts && opts.chat) await startChatREPL(data);
               return;
             }
@@ -731,14 +1020,6 @@ async function run(argv) {
 
         // Default (no wait): pretty summary
         printScanSummary(resp.body);
-        try {
-          const sid = resp.body && (resp.body.scanId || resp.body.id || resp.body.scan_id);
-          if (sid) {
-            const baseUrl = (process.env.SUBTO_API_BASE_URL || DEFAULT_API_BASE).replace(/\/$/, '');
-            console.log('AI Chat URL:', baseUrl + `/aichat/${sid}`);
-            console.log('Video URL:', baseUrl + `/video/${sid}`);
-          }
-        } catch (e) { /* ignore */ }
         if (opts && opts.chat) await startChatREPL(resp.body);
       } catch (err) { const msg = err && err.message ? err.message : String(err); console.error(chalk.red('Network error:'), msg); process.exit(1); }
     });
@@ -767,10 +1048,10 @@ async function run(argv) {
 
       // Send to server
       try {
-        const base = process.env.SUBTO_API_BASE_URL || DEFAULT_API_BASE;
+        const base = SUBTO_HOST_BASE;
         const endpoint = new URL('/api/v1/upload', base).toString();
         const fetchFn = global.fetch; if (typeof fetchFn !== 'function') throw new Error('Global fetch() is not available in this Node runtime. Use Node 18+');
-        const body = { files: samples, meta: { collected: collected.length, totalBytes, expiresInSeconds: 86400 } };
+        const body = { files: samples, meta: { collected: collected.length, totalBytes } };
         const r = await fetchFn(endpoint, { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${cfg.apiKey}` }, body: JSON.stringify(body) });
         if (!r.ok) {
           const txt = await r.text().catch(()=>null);
@@ -786,7 +1067,7 @@ async function run(argv) {
         const j = await r.json(); console.log(chalk.green('Upload queued:'), j.uploadId, 'scanId:', j.scanId, 'expiresAt:', new Date(j.expiresAt).toString());
         if (opts.wait) {
           // Poll the scan resource until completed (reuse existing polling behavior)
-          const statusUrl = new URL(`/api/v1/scan/${j.scanId}`, base).toString();
+          const statusUrl = new URL(`scan/${j.scanId}`, SUBTO_API_BASE_SLASH).toString();
           const sleep = ms => new Promise(r=>setTimeout(r,ms));
           while (true) {
             const s = await fetchFn(statusUrl, { headers: { 'Authorization': `Bearer ${cfg.apiKey}`, 'Accept': 'application/json' } });
@@ -817,10 +1098,10 @@ async function run(argv) {
         }
 
         if (!scanData && scanId) {
-          const base = process.env.SUBTO_API_BASE_URL || DEFAULT_API_BASE;
+          const base = SUBTO_HOST_BASE;
           const fetchFn = global.fetch;
           if (typeof fetchFn !== 'function') throw new Error('Global fetch() is not available in this Node runtime. Use Node 18+');
-          const statusUrl = new URL(`/api/v1/scan/${scanId}`, base).toString();
+          const statusUrl = new URL(`scan/${scanId}`, SUBTO_API_BASE_SLASH).toString();
           const r = await fetchFn(statusUrl, { headers: { 'Authorization': `Bearer ${cfg.apiKey}`, 'Accept': 'application/json' } });
           if (!r.ok) { throw new Error(`Failed to fetch scan ${scanId}: ${r.status}`); }
           scanData = await r.json();
@@ -831,8 +1112,6 @@ async function run(argv) {
       } catch (e) { console.error(chalk.red('Error starting chat:'), e && e.message ? e.message : String(e)); process.exit(1); }
     });
 
-  
-
   // Upload project files to AI for analysis. Respects `.subtoignore` and always ignores `.env`.
   program
     .command('upload [dir]')
@@ -840,41 +1119,14 @@ async function run(argv) {
     .option('--max-files <n>', 'Maximum number of files to include', '300')
     .option('--max-bytes <n>', 'Maximum total bytes to include', String(5 * 1024 * 1024))
     .action(async (dir, opts) => {
+      // Support the legacy convenience `subto upload key` by dispatching
+      // to the interactive OpenRouter key storage flow when caller used
+      // the literal token `key` — avoids ambiguity with directory upload.
+      if (String(dir || '').toLowerCase() === 'key') {
+        await storeOpenRouterKeyInteractive();
+        return;
+      }
       try {
-        // If the user passed something that looks like an API key, reject it and
-        // instruct them to use the dedicated `subto upload key` command instead.
-        if (dir) {
-          const maybeKey = String(dir).trim();
-          const looksLikeKey = /^sk(-or)?-/i.test(maybeKey) || /^[A-Za-z0-9_-]{30,}$/.test(maybeKey);
-          if (looksLikeKey) {
-            console.error(chalk.red('It looks like you passed an API key to `subto upload`.'));
-            console.error(chalk.red('Do not pass API keys as the <dir> argument.'));
-            console.error('To store an OpenRouter key locally, run:', chalk.cyan('subto upload key'));
-            process.exit(1);
-          }
-        }
-
-        // Support the pattern: `subto upload key <keyValue>` by handling when dir === 'key'.
-        if (dir === 'key') {
-          try {
-            const raw = process.argv.slice(2);
-            // raw usually looks like ['upload','key','<value>']
-            const idx = raw.indexOf('key');
-            const providedKey = (idx >= 0 && raw.length > idx + 1) ? raw[idx + 1] : null;
-            if (providedKey && (/^sk(-or)?-/i.test(providedKey) || /^[A-Za-z0-9_-]{30,}$/.test(providedKey))) {
-              const cfg = await readConfig() || {};
-              const chosenModel = process.env.AI_MODEL || (cfg && cfg.openrouterModel) || 'openai/gpt-oss-120b:free';
-              cfg.openrouterKey = providedKey.trim();
-              cfg.openrouterModel = chosenModel;
-              await writeConfig(cfg);
-              console.log(chalk.green('OpenRouter key and model saved to'), chalk.cyan(configFilePath()));
-              return;
-            }
-            console.error(chalk.red('No API key value provided. Use `subto upload key <your-key>` or run `subto upload key` interactively.'));
-            process.exit(1);
-          } catch (e) { console.error(chalk.red('Failed to save key:'), e && e.message ? e.message : String(e)); process.exit(1); }
-        }
-
         const target = dir ? path.resolve(dir) : process.cwd();
         const maxFiles = parseInt(opts.maxFiles || opts.maxFiles === 0 ? opts.maxFiles : opts.maxFiles, 10) || parseInt(opts.maxFiles || 300, 10) || 300;
         const maxBytes = parseInt(opts.maxBytes || opts.maxBytes === 0 ? opts.maxBytes : opts.maxBytes, 10) || (5 * 1024 * 1024);
@@ -961,37 +1213,11 @@ async function run(argv) {
 
         const prompt = promptParts.join('\n\n');
 
-        console.log(chalk.dim(`Collected ${collected.length} files, ${Math.round(totalBytes/1024)} KB total.`));
-        // For local testing, support the SUBTO_LOCAL_AI=1 hook to run the local AI stub instead
-        if (process.env.SUBTO_LOCAL_AI === '1') {
-          console.log(chalk.dim('Running local AI stub (dry-run) instead of uploading.'));
-          const answer = await callOpenAI(prompt);
-          console.log(chalk.bold('\nAI Analysis:'));
-          console.log(answer);
-          console.log(chalk.dim('\nNote: sensitive values are not printed; rotate any exposed keys if they were stored in the repo.'));
-          return;
-        }
-
-        try {
-          const base = process.env.SUBTO_API_BASE_URL || DEFAULT_API_BASE;
-          const endpoint = new URL('/api/v1/upload', base).toString();
-          const fetchFn = global.fetch; if (typeof fetchFn !== 'function') throw new Error('Global fetch() is not available in this Node runtime. Use Node 18+');
-          const body = { files: samples, meta: { collected: collected.length, totalBytes, expiresInSeconds: 86400, startScan: false } };
-          const cfg = await readConfig();
-          const r = await fetchFn(endpoint, { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${cfg && cfg.apiKey}` }, body: JSON.stringify(body) });
-          if (!r.ok) {
-            const txt = await r.text().catch(()=>null);
-            console.error(chalk.red('Upload failed:'), r.status, txt || r.statusText);
-            process.exit(1);
-          }
-          const j = await r.json().catch(()=>null) || {};
-          console.log(chalk.green('Upload stored:'), j.uploadId ? `uploadId: ${j.uploadId}` : '');
-          if (j.scanId) console.log('scanId (server generated):', j.scanId);
-          if (j.scanId) console.log('AI Chat URL:', (process.env.SUBTO_API_BASE_URL || DEFAULT_API_BASE) + `/aichat/${j.scanId}`);
-          return;
-        } catch (e) {
-          console.error(chalk.red('Upload request error:'), e && e.message ? e.message : String(e)); process.exit(1);
-        }
+        console.log(chalk.dim(`Collected ${collected.length} files, ${Math.round(totalBytes/1024)} KB total. Sending summary to AI...`));
+        const answer = await callOpenAI(prompt);
+        console.log(chalk.bold('\nAI Analysis:'));
+        console.log(answer);
+        console.log(chalk.dim('\nNote: sensitive values are not printed; rotate any exposed keys if they were stored in the repo.'));
       } catch (e) {
         console.error(chalk.red('Upload failed:'), e && e.message ? e.message : String(e));
         process.exit(1);
@@ -1000,61 +1226,78 @@ async function run(argv) {
 
   // Store a local OpenRouter key + model for client-side AI calls (kept in ~/.subto)
   program
-    .command('upload key')
+    .command('upload key [key]')
     .description('Store a local OpenRouter API key and model for analysis (kept locally only)')
-    .action(async () => {
+    .action(async (keyArg) => {
+      await storeOpenRouterKeyInteractive(keyArg);
+    });
+
+  // Push a locally-stored OpenRouter/OpenAI key to a running server's internal endpoint.
+  program
+    .command('server-set-ai-key [key]')
+    .description('Push AI API key to a running server via /internal/set-ai-key')
+    .option('--server <url>', 'Server host base (default: ' + SUBTO_HOST_BASE + ')')
+    .option('--secret <secret>', 'Internal task secret header (or set INTERNAL_TASK_SECRET env var)')
+    .option('--provider <provider>', 'Provider name: openrouter|openai', 'openrouter')
+    .option('--model <model>', 'Model identifier to request (OpenRouter model id)', 'openai/gpt-oss-120b:free')
+    .action(async (keyArg, opts) => {
       try {
-        const key = await promptHidden('OpenRouter API key: ');
-        if (!key || !key.trim()) { console.log('Aborted.'); return; }
-        // Ask for preferred model
-        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-        const model = await new Promise(res => rl.question('Model (e.g. openai/gpt-oss-120b:free): ', a => { rl.close(); res(a && a.trim()); }));
-        const chosenModel = model && model.length ? model : 'openai/gpt-oss-120b:free';
-
-        // Try to validate model exists (best-effort). If validation fails, ask user to confirm saving.
-        let validated = false;
-        const fetchFn = global.fetch;
-        if (typeof fetchFn === 'function') {
-          try {
-            const res = await fetchFn('https://openrouter.ai/api/v1/models', { headers: { 'Authorization': `Bearer ${key}` } });
-            if (res && res.ok) {
-              const jd = await res.json().catch(()=>null);
-              const modelsList = jd && (jd.models || jd.data || jd) ;
-              const names = Array.isArray(modelsList) ? modelsList.map(m => m.id || m.name || m.model || m.modelId).filter(Boolean) : [];
-              if (names.length && names.includes(chosenModel)) validated = true;
-            }
-          } catch (e) { /* ignore network errors */ }
+        const cfg = await readConfig();
+        let key = keyArg || (cfg && (cfg.openrouterKey || cfg.apiKey || cfg.openaiKey));
+        if (!key) key = await promptHidden('API key to push to server: ');
+        if (!key) { console.log(chalk.yellow('No key provided. Aborting.')); return; }
+        const serverBase = opts.server || SUBTO_HOST_BASE;
+        const secret = opts.secret || process.env.INTERNAL_TASK_SECRET || process.env.X_INTERNAL_TASK_SECRET;
+        if (!secret) {
+          console.log(chalk.yellow('Warning: no internal secret provided. The server will reject this request unless you supply --secret or set INTERNAL_TASK_SECRET.'));
         }
-
-        if (!validated) {
-          const rl2 = readline.createInterface({ input: process.stdin, output: process.stdout });
-          const answer = await new Promise(res => rl2.question('Could not verify model with OpenRouter. Save anyway? (y/N): ', a => { rl2.close(); res(a && a.trim().toLowerCase()); }));
-          if (answer !== 'y' && answer !== 'yes') { console.log('Aborted.'); return; }
+        const fetchFn = global.fetch;
+        if (typeof fetchFn !== 'function') throw new Error('Global fetch() is not available in this Node runtime. Use Node 18+');
+        const endpoint = new URL('internal/set-ai-key', serverBase).toString();
+        const body = { key: String(key).trim(), provider: String(opts.provider || 'openrouter'), model: String(opts.model || 'openai/gpt-oss-120b:free') };
+        const res = await fetchFn(endpoint, { method: 'POST', headers: { 'Content-Type': 'application/json', 'X-Internal-Task-Secret': secret || '' }, body: JSON.stringify(body) });
+        const text = await res.text();
+        let data = null; try { data = text ? JSON.parse(text) : null; } catch (e) { data = text; }
+        if (res.ok) {
+          console.log(chalk.green('Server accepted the key. AI should be available immediately.'));
+          if (data) console.log(JSON.stringify(data, null, 2));
+        } else {
+          console.error(chalk.red('Server rejected the request:'), res.status, data || text);
+          process.exit(1);
         }
-
-        const cfg = await readConfig() || {};
-        cfg.openrouterKey = key.trim();
-        cfg.openrouterModel = chosenModel;
-        await writeConfig(cfg);
-        console.log(chalk.green('OpenRouter key and model saved to'), chalk.cyan(configFilePath()));
-      } catch (e) { console.error(chalk.red('Failed to save key:'), e && e.message ? e.message : String(e)); process.exit(1); }
+      } catch (e) { console.error(chalk.red('Failed to push key:'), e && e.message ? e.message : String(e)); process.exit(1); }
     });
 
+  // Diagnostic helper: fetch video debug info for a scan id and present a friendly summary
   program
-    .command('aichat <scanId>')
-    .description('Print and optionally open the web AI chat for a scan')
-    .action(async (scanId) => {
+    .command('diag video <scanId>')
+    .description('Retrieve video debug info for <scanId> from the server and summarize')
+    .option('--server <url>', 'Server host base (default: ' + SUBTO_HOST_BASE + ')')
+    .action(async (scanId, opts) => {
       try {
-        if (!scanId) { console.error(chalk.red('Please provide a scanId')); process.exit(1); }
-        const base = (process.env.SUBTO_API_BASE_URL || DEFAULT_API_BASE).replace(/\/$/, '');
-        const url = `${base}/aichat/${scanId}`;
-        console.log('AI Chat URL:', url);
-        try {
-          if (process.platform === 'darwin') require('child_process').spawnSync('open', [url]);
-          else if (process.platform === 'win32') require('child_process').spawnSync('start', [url], { shell: true });
-          else require('child_process').spawnSync('xdg-open', [url]);
-        } catch (e) { /* ignore open errors */ }
-      } catch (e) { console.error(chalk.red('Error:'), e && e.message ? e.message : String(e)); process.exit(1); }
+        const serverBase = opts.server || SUBTO_HOST_BASE;
+        const fetchFn = global.fetch;
+        if (typeof fetchFn !== 'function') throw new Error('Global fetch() is not available in this Node runtime. Use Node 18+');
+        const endpoint = new URL(`video/${scanId}/debug`, serverBase).toString();
+        const res = await fetchFn(endpoint, { headers: { 'Accept': 'application/json' } });
+        if (!res.ok) throw new Error(`Server returned ${res.status}`);
+        const json = await res.json();
+        console.log(chalk.bold('\nVideo diagnostic for:'), scanId);
+        if (json && json.scan) {
+          console.log('  URL:', json.scan.url || '(unknown)');
+          console.log('  Status:', json.scan.status || json.scan.lastPhase || '(unknown)');
+          console.log('  CompletedAt:', json.scan.completedAt ? new Date(json.scan.completedAt).toString() : '(not set)');
+        }
+        if (json && Array.isArray(json.checks)) {
+          console.log(chalk.bold('\nChecked paths:'));
+          for (const c of json.checks) {
+            const ok = c.exists ? chalk.green('FOUND') : chalk.red('MISSING');
+            console.log(`  - ${c.path} : ${ok}`);
+          }
+        }
+        console.log('\nSummary:', json && json.found ? chalk.green('Video available') : chalk.red('Video not found'));
+        if (!json || !json.found) console.log(chalk.dim('If missing, verify pipeline logs and ensure GOOGLE_APPLICATION_CREDENTIALS and GCS_VIDEO_BUCKET are configured on the server.'));
+      } catch (e) { console.error(chalk.red('Video diagnostic failed:'), e && e.message ? e.message : String(e)); process.exit(1); }
     });
 
   if (!argv || argv.length === 0) { program.help(); return; }
@@ -1073,9 +1316,9 @@ async function run(argv) {
     try { if (await fs.stat(answer).then(s=>s.isFile()).catch(()=>false)) { const txt = await fs.readFile(answer,'utf8'); scanData = JSON.parse(txt); } } catch(e) {}
     try {
       if (!scanData) {
-        const base = process.env.SUBTO_API_BASE_URL || DEFAULT_API_BASE; const fetchFn = global.fetch;
+        const base = SUBTO_HOST_BASE; const fetchFn = global.fetch;
         if (typeof fetchFn !== 'function') throw new Error('Global fetch() is not available in this Node runtime. Use Node 18+');
-        const statusUrl = new URL(`/api/v1/scan/${answer}`, base).toString();
+          const statusUrl = new URL(`scan/${answer}`, SUBTO_API_BASE_SLASH).toString();
         const r = await fetchFn(statusUrl, { headers: { 'Authorization': `Bearer ${cfg.apiKey}`, 'Accept': 'application/json' } });
         if (!r.ok) throw new Error(`Failed to fetch scan ${answer}: ${r.status}`);
         scanData = await r.json();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "subto",
-  "version": "7.0.0",
+  "version": "8.0.0",
   "description": "Subto CLI — thin wrapper around the Subto.One API",
   "bin": {
     "subto": "bin/subto.js"