@modelstatus/cli 0.1.86 → 0.1.87

package/src/tui/signin.js

@@ -12,6 +12,19 @@ import { h } from "./ui.js";
 
 const SPINNER = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
 
+// One in-flight device-auth session per apiBase, held OUTSIDE the component.
+// SignIn is remounted on every signed-out Account-tab visit (and after a game
+// round-trip); without this, each mount minted a NEW device code and popped
+// ANOTHER browser tab — and an approval made in the browser after the user
+// switched tabs landed on a code nobody was polling. A remount now resumes the
+// pending session (same code, same URL, no extra tab) and picks the approval up.
+// Sessions clear on approval/denial/expiry/start-failure (and g re-mints one).
+// apiBase -> { device_code, user_code, verification_url, interval, deadline, opened }
+const authSessions = new Map();
+
+/** Test hook: forget all pending device-auth sessions. */
+export function _resetAuthSessions() { authSessions.clear(); }
+
 export function SignIn({ apiBase, onSuccess, onSkip }) {
   const { exit } = useApp();
   const [phase, setPhase] = React.useState("starting"); // starting | polling | error
@@ -35,19 +48,38 @@ export function SignIn({ apiBase, onSuccess, onSkip }) {
 
     const start = async () => {
       try {
-        const s = await client.authStart({ client_name: "mm CLI" });
+        // Resume the session a previous mount left in flight (tab switch, game
+        // round-trip) — same code, same browser tab, and an approval made while
+        // we weren't looking gets picked up on the first poll. Mint a fresh one
+        // only when none is pending or the old one passed its deadline.
+        let s = authSessions.get(apiBase);
+        if (!s || Date.now() > s.deadline) {
+          const fresh = await client.authStart({ client_name: "mm CLI" });
+          s = {
+            device_code: fresh.device_code,
+            user_code: fresh.user_code,
+            verification_url: fresh.verification_url,
+            interval: Math.max(1, fresh.interval || 3) * 1000,
+            deadline: Date.now() + (fresh.expires_in || 600) * 1000,
+            opened: false,
+          };
+          // Cache even if this mount was cancelled mid-start — the code is
+          // already minted, so let the next visit resume it instead of orphaning it.
+          authSessions.set(apiBase, s);
+        }
         if (cancelled) return;
         setCode(s.user_code);
         setUrl(s.verification_url);
         setPhase("polling");
-        openUrl(s.verification_url); // best-effort, no error if it fails
-
-        const interval = Math.max(1, s.interval || 3) * 1000;
-        const deadline = Date.now() + (s.expires_in || 600) * 1000;
+        if (!s.opened) {
+          s.opened = true;
+          openUrl(s.verification_url); // best-effort, ONCE per session (o re-opens)
+        }
 
         const poll = async () => {
           if (cancelled) return;
-          if (Date.now() > deadline) {
+          if (Date.now() > s.deadline) {
+            authSessions.delete(apiBase);
             setError("The login request expired.");
             setPhase("error");
             return;
@@ -60,6 +92,7 @@ export function SignIn({ apiBase, onSuccess, onSkip }) {
           }
           if (cancelled) return;
           if (res?.status === "approved") {
+            authSessions.delete(apiBase);
             const cfg = loadConfig();
             cfg.apiKey = res.api_key;
             cfg.apiBase = apiBase;
@@ -68,20 +101,23 @@ export function SignIn({ apiBase, onSuccess, onSkip }) {
             return;
           }
           if (res?.status === "denied") {
+            authSessions.delete(apiBase);
             setError("Authorization was denied.");
             setPhase("error");
             return;
           }
           if (res?.status === "expired") {
+            authSessions.delete(apiBase);
             setError("The login request expired. Press q and run mm login again.");
             setPhase("error");
             return;
           }
-          pollTimer = setTimeout(poll, interval);
+          pollTimer = setTimeout(poll, s.interval);
         };
         poll();
       } catch (e) {
         if (cancelled) return;
+        authSessions.delete(apiBase); // a failed start isn't resumable
         setError(e?.message || String(e));
         setPhase("error");
       }

package/src/tui/views/account.js

@@ -28,6 +28,18 @@ export function AccountView({ client, me, refreshMe, apiBase, ui, active }) {
 
   React.useEffect(() => ui?.reportStatus?.({ context: `plan: ${me?.plan ?? "…"}` }), [me, ui]);
 
+  // The upgrade poll below is a self-rescheduling setTimeout chain — without
+  // cleanup it outlives the view (keeps hitting /me every 4s for up to 10min,
+  // sets state on an unmounted component, and holds the event loop open AFTER
+  // quit, hanging the user's shell). Cancel it the moment the view unmounts.
+  const pollTimerRef = React.useRef(null);
+  const mountedRef = React.useRef(true);
+  React.useEffect(() => () => {
+    mountedRef.current = false;
+    if (pollTimerRef.current) clearTimeout(pollTimerRef.current);
+    pollTimerRef.current = null;
+  }, []);
+
   async function upgrade() {
     // Without a loaded account a checkout would just fire at an unreachable
     // endpoint and die with a raw fetch error — say what to do instead.
@@ -40,9 +52,11 @@ export function AccountView({ client, me, refreshMe, apiBase, ui, active }) {
       setStatus("Complete checkout in your browser… (polling /me)");
       const deadline = Date.now() + 10 * 60 * 1000;
       const tick = async () => {
+        if (!mountedRef.current) return;
         if (Date.now() > deadline) return setStatus("Timed out — press u to retry.");
         try {
           const m = await client.me();
+          if (!mountedRef.current) return;
           if (m?.account?.plan && m.account.plan !== "free") {
             setStatus(null);
             ui.showToast(`upgraded to ${m.account.plan}!`);
@@ -52,9 +66,12 @@ export function AccountView({ client, me, refreshMe, apiBase, ui, active }) {
         } catch {
           /* keep polling */
         }
-        setTimeout(tick, 4000);
+        if (!mountedRef.current) return;
+        pollTimerRef.current = setTimeout(tick, 4000);
       };
-      setTimeout(tick, 4000);
+      // A second u press replaces (not stacks) any poll chain already running.
+      if (pollTimerRef.current) clearTimeout(pollTimerRef.current);
+      pollTimerRef.current = setTimeout(tick, 4000);
     } catch (e) {
       setStatus(e.status === 503 ? "Billing isn't configured on this server." : `checkout failed: ${e.message} — press u to retry.`);
     }

package/src/tui/views/alerts.js

@@ -125,11 +125,20 @@ export function AlertsView({ client, ui, active, width = 78, height = 14 }) {
             .patchRule(cur.id, { delivery: DELIVERY[(DELIVERY.indexOf(cur.delivery) + 1) % 3] })
             .then(() => rules.reload())
             .catch((e) => ui.showToast(e.message, "red"));
-        if (input === "d")
-          return client.deleteRule(cur.id).then(() => {
-            ui.showToast("rule deleted");
-            rules.reload();
-          }).catch((e) => ui.showToast(e.message, "red"));
+        if (input === "d") {
+          // One stray keypress shouldn't silently delete a rule — confirm with a
+          // single y, same pattern as InventoryView's d (inventory.js).
+          return ui.askPrompt(`Delete ${ruleLabel(cur)}? type y`, {
+            onSubmit: (v) => {
+              if (String(v || "").trim().toLowerCase() !== "y") return ui.showToast("delete cancelled");
+              client.deleteRule(cur.id).then(() => {
+                ui.showToast("rule deleted");
+                setCursor((c) => clampCursor(c, ruleList.length - 1));
+                rules.reload();
+              }).catch((e) => ui.showToast(e.message, "red"));
+            },
+          });
+        }
       } else {
         if (input === "n") return addChannel();
         if (input === "t" && cur) return testChannel(cur);
@@ -150,14 +159,18 @@ export function AlertsView({ client, ui, active, width = 78, height = 14 }) {
     if (!ruleList.length) {
       body = h(EmptyCard, { title: "No alert rules yet", lines: ["Stay ahead of your model timeline — a heads-up 90, 30, 7, and 1 day before anything you use is deprecated or retired.", "Press n to set the sensible default (your models · in-app + email · those lead times)."], width });
     } else {
+      // Window the list around the cursor (same as whatsnew.js) — a fixed
+      // slice(0, ROWS) lets the selection walk below the visible page and
+      // space/c/d act on a row the user can't see.
       const curIdx = clampCursor(cursor, ruleList.length);
+      const start = Math.max(0, Math.min(curIdx - ROWS + 1, ruleList.length - ROWS));
       const fixed = 2 + 26 + 1 + 10 + 1; // glyph + name + gap + delivery + gap
       const rest = Math.max(8, width - 1 - fixed);
       body = h(
         Box,
         { flexDirection: "column" },
-        ...ruleList.slice(0, ROWS).map((r, i) => {
-          const isCur = i === curIdx;
+        ...ruleList.slice(start, start + ROWS).map((r, i) => {
+          const isCur = start + i === curIdx;
           const enabled = !!r.enabled;
           const leads = r.leadTimes || r.lead_times || [];
           const chanText = [(r.channels || []).join(","), leads.length ? leads.join("/") + "d" : ""].filter(Boolean).join(" · ");
@@ -182,13 +195,15 @@ export function AlertsView({ client, ui, active, width = 78, height = 14 }) {
         h(Text, { color: "#d97706" }, "  Slack/Discord/SMS/webhook channels need Pro — press 7 → u to upgrade."),
       );
     } else {
+      // Windowed around the cursor like the rules list above.
       const curIdx = clampCursor(cursor, chanList.length);
+      const start = Math.max(0, Math.min(curIdx - ROWS + 1, chanList.length - ROWS));
       const rest = Math.max(8, width - 1 - 10); // after the 10-wide kind pill
       body = h(
         Box,
         { flexDirection: "column" },
-        ...chanList.slice(0, ROWS).map((c, i) => {
-          const isCur = i === curIdx;
+        ...chanList.slice(start, start + ROWS).map((c, i) => {
+          const isCur = start + i === curIdx;
           const cells = [
             { text: cell(c.kind, 10), color: KIND_COLOR[c.kind] || C.FG_DIM, bold: true },
             { text: cellE(c.label || c.value, rest), color: C.FG },

package/src/updater.js

@@ -3,10 +3,13 @@
  * Design (see also docs.llmstatus.ai/install):
  *   - Only runs when IS_SHELL_INSTALL is true (Bun-compiled binary). npm-managed
  *     installs defer to `npm update -g @modelstatus/cli`.
- *   - Capped at one check per 24 h (cache file at ~/.config/llmstatus/updater.json).
+ *   - Throttled via CHECK_INTERVAL_MS (30 s default; cache file at
+ *     ~/.config/llmstatus/updater.json). A version that failed to install backs
+ *     off for FAIL_BACKOFF_MS so a bad release can't re-download per command.
  *   - Opt-out via MM_NO_AUTO_UPDATE=1, or any --json/--ci invocation.
  *   - All errors are swallowed silently. The user's command must NEVER break
- *     because the updater hiccupped.
+ *     because the updater hiccupped. Every fetch is deadline-capped so the
+ *     at-exit await can never stall the command on a hung CDN.
  *   - Verifies the downloaded binary's sha256 against `cli/latest/version.json`
  *     before atomically renaming over process.execPath.
  *   - Notification (one stderr line) prints after the user's command finishes —
@@ -31,6 +34,16 @@ const CACHE_FILE = path.join(os.homedir(), ".config", "llmstatus", "updater.json
 // network cost is trivial — this throttle is purely about local CPU/IO.
 // Override with MM_UPDATE_INTERVAL_MS for testing.
 const CHECK_INTERVAL_MS = Number(process.env.MM_UPDATE_INTERVAL_MS) || 30 * 1000;
+// After a download/verify/swap failure for a given version, don't re-attempt
+// that same version for this long — a bad publish must not turn every command
+// into a full binary download. `mm update` ignores this (explicit ask).
+const FAIL_BACKOFF_MS = Number(process.env.MM_UPDATE_FAIL_BACKOFF_MS) || 6 * 60 * 60 * 1000;
+// Deadlines: the check is awaited before process exit, so every network hop
+// must be finite. Manifest legs are tiny (~520 B); the binary is ~60 MB, so it
+// gets a generous — but still finite — cap. On timeout we skip silently and a
+// future run retries.
+const manifestTimeoutMs = () => Number(process.env.MM_UPDATE_FETCH_TIMEOUT_MS) || 5_000;
+const downloadTimeoutMs = () => Number(process.env.MM_UPDATE_DOWNLOAD_TIMEOUT_MS) || 120_000;
 
 /** Tolerant of v-prefixes; splits on dots & dashes (handles 0.1.2-rc1). */
 function parseVer(s) {
@@ -83,7 +96,7 @@ function platformKey() {
 }
 
 async function fetchJson(url) {
-  const res = await fetch(url, { cache: "no-store" });
+  const res = await fetch(url, { cache: "no-store", signal: AbortSignal.timeout(manifestTimeoutMs()) });
   if (!res.ok) throw new Error(`GET ${url} -> ${res.status}`);
   return res.json();
 }
@@ -101,8 +114,8 @@ MCowBQYDK2VwAyEApu4VP7vB6iwxsPcK5KaosjK7SIp9HrWMt5IvcUwjUOM=
  * invalid (fail closed — never self-update against an unverifiable manifest). */
 async function fetchVerifiedManifest(base) {
   const [mRes, sRes] = await Promise.all([
-    fetch(`${base}/version.json`, { cache: "no-store" }),
-    fetch(`${base}/version.json.sig`, { cache: "no-store" }),
+    fetch(`${base}/version.json`, { cache: "no-store", signal: AbortSignal.timeout(manifestTimeoutMs()) }),
+    fetch(`${base}/version.json.sig`, { cache: "no-store", signal: AbortSignal.timeout(manifestTimeoutMs()) }),
   ]);
   if (!mRes.ok) throw new Error(`GET version.json -> ${mRes.status}`);
   if (!sRes.ok) throw new Error("manifest signature unavailable — refusing to self-update");
@@ -134,21 +147,59 @@ export function isBrewManaged(execPath = process.execPath) {
   return p.includes("/Cellar/") || p.includes("/homebrew/") || p.includes("/linuxbrew/");
 }
 
-/** Replace the executable via the atomic tmp+rename pattern ONLY (a new inode).
- * We must NOT writeFileSync over the live executable's inode: truncating +
- * rewriting a running, memory-mapped Mach-O can make macOS SIGKILL the running
- * process mid-write ("killed: 9"). Requires a writable parent dir; callers
- * pre-check dirWritable() and never reach here otherwise. Throws on failure
- * (the outer catch swallows it — better no update than a half-written binary). */
-function replaceBinary(exe, buf) {
-  const tmp = path.join(path.dirname(exe), `.${path.basename(exe)}.new.${process.pid}`);
+/** Where a downloaded-and-sha-verified binary for `version` is staged (same dir
+ * as the exe, so the final rename stays same-filesystem/atomic). Deliberately
+ * NOT pid-suffixed: it survives a failed swap so the next attempt skips the
+ * ~60 MB re-download. */
+function stagedPath(exe, version) {
+  const v = String(version).replace(/[^A-Za-z0-9._-]/g, "_");
+  return path.join(path.dirname(exe), `.${path.basename(exe)}.staged.${v}`);
+}
+
+/** Best-effort sweep of update leftovers next to the exe: parked `<exe>.old.*`
+ * copies from a Windows swap (the running image can't be deleted mid-swap, only
+ * renamed aside — see replaceBinary) and staged downloads. `keepStaged` is the
+ * path of a staged download to preserve, or `true` to preserve all staged files
+ * (used by the routine per-check sweep, which doesn't yet know the pending
+ * version). Never throws; a still-running old exe just stays until a later run. */
+function cleanupLeftovers(exe, keepStaged) {
   try {
-    fs.writeFileSync(tmp, buf, { mode: 0o755 });
-    fs.renameSync(tmp, exe);
-  } catch (e) {
-    try { fs.unlinkSync(tmp); } catch { /* tmp may not exist */ }
-    throw e;
+    const dir = path.dirname(exe);
+    const base = path.basename(exe);
+    for (const name of fs.readdirSync(dir)) {
+      const full = path.join(dir, name);
+      if (name.startsWith(`.${base}.staged.`)) {
+        if (keepStaged === true || full === keepStaged) continue;
+      } else if (!name.startsWith(`${base}.old.`)) {
+        continue;
+      }
+      try { fs.unlinkSync(full); } catch { /* e.g. old exe still running on Windows */ }
+    }
+  } catch { /* best effort */ }
+}
+
+/** Swap the staged (already-verified) binary into place via rename ONLY — a new
+ * inode. We must NOT writeFileSync over the live executable's inode: truncating
+ * + rewriting a running, memory-mapped Mach-O can make macOS SIGKILL the running
+ * process mid-write ("killed: 9"). On Windows a running .exe's image file can't
+ * be deleted or overwritten — but it CAN be renamed — so park the live binary
+ * aside first and sweep the parked copy on a later run (cleanupLeftovers).
+ * Requires a writable parent dir; callers pre-check dirWritable() and never
+ * reach here otherwise. Throws on failure (the caller memoizes it — better no
+ * update than a half-written binary). */
+function replaceBinary(exe, staged) {
+  if (process.platform === "win32") {
+    const parked = `${exe}.old.${process.pid}`;
+    fs.renameSync(exe, parked);
+    try {
+      fs.renameSync(staged, exe);
+    } catch (e) {
+      try { fs.renameSync(parked, exe); } catch { /* leave parked as a last resort */ }
+      throw e;
+    }
+    return;
   }
+  fs.renameSync(staged, exe);
 }
 
 // Our Developer ID team. A self-update download must be signed by us before we
@@ -171,27 +222,49 @@ function verifyMacSignature(file) {
 
 async function downloadAndReplace(version, key, expectedSha) {
   const exe = process.execPath;
-  const ext = process.platform === "win32" ? ".exe" : "";
-  const url = `${CDN}/cli/${version}/modelstatus-cli-${key}${ext}`;
-  const res = await fetch(url);
-  if (!res.ok) throw new Error(`GET ${url} -> ${res.status}`);
-  const buf = Buffer.from(await res.arrayBuffer());
-  const actualSha = crypto.createHash("sha256").update(buf).digest("hex");
-  if (actualSha !== expectedSha) {
-    throw new Error(`sha256 mismatch: expected ${expectedSha.slice(0, 12)}…, got ${actualSha.slice(0, 12)}…`);
-  }
-  // On macOS, verify the SIGNATURE before trusting these bytes as our binary.
-  // Stage to a temp file, codesign-verify it, then swap — never swap unverified.
-  if (process.platform === "darwin") {
-    const staged = path.join(path.dirname(exe), `.${path.basename(exe)}.verify.${process.pid}`);
+  const staged = stagedPath(exe, version);
+  cleanupLeftovers(exe, staged);
+
+  // Reuse a previously-downloaded copy of this exact version when its sha256
+  // still matches the manifest — a failed swap must not cost a full ~60 MB
+  // re-download on the next attempt.
+  let haveStaged = false;
+  try {
+    const existing = fs.readFileSync(staged);
+    haveStaged = crypto.createHash("sha256").update(existing).digest("hex") === expectedSha;
+  } catch { /* no staged copy yet */ }
+
+  if (!haveStaged) {
+    const ext = process.platform === "win32" ? ".exe" : "";
+    const url = `${CDN}/cli/${version}/modelstatus-cli-${key}${ext}`;
+    const res = await fetch(url, { signal: AbortSignal.timeout(downloadTimeoutMs()) });
+    if (!res.ok) throw new Error(`GET ${url} -> ${res.status}`);
+    const buf = Buffer.from(await res.arrayBuffer());
+    const actualSha = crypto.createHash("sha256").update(buf).digest("hex");
+    if (actualSha !== expectedSha) {
+      throw new Error(`sha256 mismatch: expected ${expectedSha.slice(0, 12)}…, got ${actualSha.slice(0, 12)}…`);
+    }
+    // Stage via tmp+rename so a concurrent run can't observe a half-written file.
+    const tmp = `${staged}.${process.pid}`;
     try {
-      fs.writeFileSync(staged, buf, { mode: 0o755 });
-      verifyMacSignature(staged);
-    } finally {
-      try { fs.unlinkSync(staged); } catch { /* best effort */ }
+      fs.writeFileSync(tmp, buf, { mode: 0o755 });
+      fs.renameSync(tmp, staged);
+    } catch (e) {
+      try { fs.unlinkSync(tmp); } catch { /* tmp may not exist */ }
+      throw e;
     }
   }
-  replaceBinary(exe, buf);
+
+  // On macOS, verify the SIGNATURE before trusting these bytes as our binary —
+  // never swap unverified. A codesign failure discards the staged copy (bad
+  // bytes must not be reused).
+  try {
+    verifyMacSignature(staged);
+  } catch (e) {
+    try { fs.unlinkSync(staged); } catch { /* best effort */ }
+    throw e;
+  }
+  replaceBinary(exe, staged);
 }
 
 /** Strip an optional leading "v" for display. The manifest writes "v0.1.8" but
@@ -199,6 +272,24 @@ async function downloadAndReplace(version, key, expectedSha) {
  * "0.1.8 → v0.1.9" which looks like a typo. */
 function dispVer(v) { return String(v).replace(/^v/, ""); }
 
+/** Memoize a per-version install failure so the background check backs off
+ * (FAIL_BACKOFF_MS) instead of re-attempting a version that keeps failing. */
+function recordFailure(version, e) {
+  const cache = readCache() || {};
+  const prior = cache.fail?.version === version ? cache.fail.count || 0 : 0;
+  writeCache({
+    ...cache,
+    fail: { version, at: Date.now(), count: prior + 1, reason: String(e?.message ?? e).slice(0, 200) },
+  });
+}
+
+function clearFailure() {
+  const cache = readCache();
+  if (!cache?.fail) return;
+  delete cache.fail;
+  writeCache(cache);
+}
+
 /**
  * Force an update RIGHT NOW for an explicit `mm update` / `--update` — ignores
  * the 30s throttle AND MM_NO_AUTO_UPDATE (the user asked for it). Swaps the
@@ -230,7 +321,15 @@ export async function forceUpdate() {
     if (!dirWritable(path.dirname(process.execPath))) {
       return { status: "manual", from: dispVer(BUILD_VERSION), to: dispVer(manifest.version) };
     }
-    await downloadAndReplace(manifest.version, key, expectedSha);
+    // Explicit ask → no backoff gate, but record/clear the failure memo so the
+    // background checks stay in sync with what happened here.
+    try {
+      await downloadAndReplace(manifest.version, key, expectedSha);
+    } catch (e) {
+      recordFailure(manifest.version, e);
+      throw e;
+    }
+    clearFailure();
     return { status: "updated", from: dispVer(BUILD_VERSION), to: dispVer(manifest.version) };
   } catch (e) {
     return { status: "error", message: e?.message ?? String(e) };
@@ -251,14 +350,30 @@ export async function maybeCheckForUpdate(flags = {}) {
     const key = platformKey();
     if (!key) return null;
 
+    // Sweep parked .old binaries from a previous (Windows) swap; keep any
+    // staged downloads — the pending version isn't known yet.
+    cleanupLeftovers(process.execPath, true);
+
+    // Record the attempt BEFORE the network hop: a hung/unreachable CDN gets
+    // probed at most once per interval (each probe deadline-capped), not on
+    // every single run.
+    writeCache({ ...cache, last_check: Date.now() });
+
     const manifest = await fetchVerifiedManifest(`${CDN}/cli/${CHANNEL_PATH}`);
-    // Always update the cache so we don't re-check for 24 h.
+    // Update the cache so we don't re-check within the throttle interval.
     writeCache({ ...cache, last_check: Date.now(), latest_known: manifest.version });
 
     if (!manifest.version || compareVer(manifest.version, BUILD_VERSION) <= 0) return null;
     const expectedSha = manifest.sha256?.[key];
     if (!expectedSha) return null;
 
+    // A version that already failed to install (sha mismatch, codesign, swap
+    // error) backs off — don't burn a download per command on a bad release.
+    // A newer published version passes this gate and clears the memo naturally.
+    if (cache.fail && cache.fail.version === manifest.version && Date.now() - (cache.fail.at || 0) < FAIL_BACKOFF_MS) {
+      return null;
+    }
+
     // Only self-update when we can atomically swap the binary (writable parent
     // dir). For root-owned dirs like /usr/local/bin we can't — and overwriting
     // the live binary in place is unsafe — so signal a manual reinstall instead
@@ -267,7 +382,13 @@ export async function maybeCheckForUpdate(flags = {}) {
       return { manual: true, from: dispVer(BUILD_VERSION), to: dispVer(manifest.version) };
     }
 
-    await downloadAndReplace(manifest.version, key, expectedSha);
+    try {
+      await downloadAndReplace(manifest.version, key, expectedSha);
+    } catch (e) {
+      recordFailure(manifest.version, e);
+      return null;
+    }
+    clearFailure();
     return { from: dispVer(BUILD_VERSION), to: dispVer(manifest.version) };
   } catch {
     return null;

package/src/upgrade.js

@@ -2,24 +2,53 @@ import { openUrl } from "./openUrl.js";
 
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 
-/** Open Stripe checkout and poll /me until the plan flips off "free". Mirrors
- * the browser-login poll UX. Returns the new plan, or null on timeout. */
-export async function upgradeViaBrowser({ client, plan, log = console.error, onTick }) {
+/** Has the account reached the TARGET plan? "pro" = any paid plan; "lifetime"
+ * needs an explicit lifetime marker (plan_status/planStatus/plan) — a Pro
+ * subscriber buying Lifetime already reads plan="pro", so a bare "not free"
+ * check would claim success before the Stripe page even loads. Exported for
+ * tests. */
+export function planArrived(account, target) {
+  if (!account) return false;
+  if (target === "lifetime") {
+    const status = account.plan_status ?? account.planStatus ?? null;
+    return status === "lifetime" || account.plan === "lifetime";
+  }
+  return !!account.plan && account.plan !== "free";
+}
+
+/** Open Stripe checkout and poll /me until the TARGET plan is active. Mirrors
+ * the browser-login poll UX. Returns the plan name on success, or null on
+ * timeout — the caller must NOT claim success on null. `pollMs`/`timeoutMs`
+ * are injectable for tests. */
+export async function upgradeViaBrowser({ client, plan, log = console.error, onTick, pollMs = 4000, timeoutMs = 10 * 60 * 1000 }) {
+  const target = plan === "lifetime" ? "lifetime" : "pro";
+
+  // Snapshot BEFORE opening checkout: already on the target → nothing to buy
+  // (and nothing to falsely "confirm" on the first poll tick).
+  try {
+    const me = await client.me();
+    if (planArrived(me?.account, target)) {
+      log(`\n  ✓ Your plan is already ${target} — nothing to buy.\n`);
+      return target;
+    }
+  } catch { /* can't pre-check — the poll below decides */ }
+
   const { url } = await client.checkout(plan);
   if (!url) throw new Error("Could not start checkout.");
   log(`\n  Opening checkout in your browser…`);
   log(`  If it doesn't open, visit:\n    ${url}\n`);
   openUrl(url);
+  log(`  Waiting for checkout to complete… (ctrl-c to stop)`);
 
-  const deadline = Date.now() + 10 * 60 * 1000;
+  const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
-    await sleep(4000);
+    await sleep(pollMs);
     try {
       const me = await client.me();
       onTick?.(me);
-      if (me?.account?.plan && me.account.plan !== "free") {
-        log(`\n  ✓ Upgraded to ${me.account.plan}. Thank you!\n`);
-        return me.account.plan;
+      if (planArrived(me?.account, target)) {
+        log(`\n  ✓ Upgraded to ${target}. Thank you!\n`);
+        return target;
       }
     } catch {
       /* keep polling */