fix me version --no-server flag colliding with global --server

The --no-server boolean and the global --server <url> flag share the
same opts key under commander, so optsWithGlobals() was returning
true (the --no-server default) instead of a URL string. That fed into
normalizeOrigin and crashed with 'url2.replace is not a function'.

- Rename --no-server to --local to avoid the collision.
- Guard with typeof === 'string' before passing to resolveServer.
- Add a TypeError at the top of normalizeOrigin so a similar mishap
  surfaces a clear error instead of a cryptic one.

Author: jgpruitt

docs/cli/me-version.md

@@ -5,7 +5,7 @@ Show CLI and server versions and check compatibility.
 ## Usage
 
 ```
-me version [--no-server]
+me version [--local]
 ```
 
 ## Description
@@ -30,7 +30,7 @@ instead of obscure errors mid-login.
 
 | Option | Description |
 |--------|-------------|
-| `--no-server` | Skip the server probe; print only the local CLI version. |
+| `--local` | Skip the server probe; print only the local CLI version. |
 
 ## Global Options
 
@@ -57,7 +57,7 @@ me version --server https://api.memory.build
 Local-only output (e.g. on an air-gapped machine):
 
 ```
-me version --no-server
+me version --local
 ```
 
 JSON output for scripts and CI:

packages/cli/commands/version.ts

@@ -21,10 +21,10 @@ export function createVersionCommand(): Command {
   return new Command("version")
     .description("show CLI and server versions and check compatibility")
     .option(
-      "--no-server",
-      "skip the server check; print only the local CLI version",
+      "--local",
+      "skip the server probe; print only the local CLI version",
     )
-    .action(async (opts: { server: boolean }, cmd) => {
+    .action(async (opts: { local?: boolean }, cmd) => {
       const globalOpts = cmd.optsWithGlobals();
       const fmt = getOutputFormat(globalOpts);
 
@@ -39,15 +39,20 @@ export function createVersionCommand(): Command {
         bundledMinClientVersion: MIN_CLIENT_VERSION,
       };
 
-      if (!opts.server) {
+      if (opts.local) {
         await output({ ...local, server: null }, fmt, () => {
           console.log(`  Client version:  ${local.clientVersion}`);
           console.log(`  Min server:      ${local.minServerVersion}`);
         });
         return;
       }
 
-      const server = resolveServer(globalOpts.server);
+      // The global option is `--server <url>` and may also leak through as
+      // `globalOpts.server` for parent flags. Only pass it through to
+      // resolveServer when it is actually a string.
+      const serverFlag =
+        typeof globalOpts.server === "string" ? globalOpts.server : undefined;
+      const server = resolveServer(serverFlag);
 
       try {
         const probe = await checkServerVersion({

packages/cli/credentials.ts

@@ -93,6 +93,14 @@ function getCredentialsPath(): string {
  * Strips trailing slashes and default ports.
  */
 export function normalizeOrigin(url: string): string {
+  // Defense in depth: this function gets called with values that flow in
+  // from CLI flags, env vars, and YAML files. Throwing a clear error beats
+  // a cryptic "url2.replace is not a function" downstream.
+  if (typeof url !== "string") {
+    throw new TypeError(
+      `Expected server URL to be a string, got ${typeof url}`,
+    );
+  }
   try {
     const parsed = new URL(url);
     // Remove default ports