@tiens.nguyen/gu-cli 1.0.705 → 1.0.706

package/clear-state.mjs

@@ -32,6 +32,8 @@ export const STATE_ITEMS = [
     what: "Local-mode setup progress and the chosen mode", cost: "setup starts over" },
   { path: "instance", group: "identity",
     what: "this machine's id", cost: "it gets a new one" },
+  { path: "cli-token.json", group: "identity",
+    what: "the gu token (plan + computers)", cost: "a Client Expert machine needs it pasted again" },
   { path: "prefs.json", group: "identity", what: "CLI preferences", cost: "defaults return" },
   { path: "wizard-state.json", group: "identity",
     what: "installer progress", cost: "the wizard starts over" },

package/cli-token.mjs

@@ -0,0 +1,285 @@
+/**
+ * THE CLI TOKEN, CLIENT SIDE (#232) — keep it fresh, and say one line when something needs attention.
+ *
+ * A SOFT LICENCE, by the owner's choice: nothing here ever blocks a session, refuses a command or
+ * delays a prompt. The worst it does is one line in the bottom bar. Someone who patches it out is
+ * acceptable.
+ *
+ * The token is signed by the hosted API (api/src/billing/cliToken.ts) and checked HERE, offline,
+ * with the public key only. The rules in verifyCliToken must match the API's; the test file checks
+ * a token the real API code signed.
+ *
+ * RENEWAL, agreed with the owner:
+ *   · Client mode (hosted API): at start, then at most once a DAY — with the worker key when there is
+ *     no token yet, with the token after that.
+ *   · Client Expert (local-only): at most once a WEEK, and always against the HOSTED API. The local
+ *     API cannot sign tokens or see payments, and a local-only machine should make the fewest
+ *     outside calls that still work.
+ *   · Either mode renews at start while a warning is showing, so someone who just paid is not told
+ *     "plan ended" for a week.
+ *   · Every failure is silent: the current token stays and nothing new is shown.
+ *
+ * THE KEY. EMBEDDED_PUBLIC_KEY is the public half of the production pair, generated ONCE on
+ * 2026-09-17 (api: npm run cli-token:keygen). The private half lives only in the API's api.env and the
+ * owner's password manager. Generating another pair makes every installed CLI reject every new token
+ * — see the note in api/scripts/cli-token-keygen.mts before ever doing it.
+ * With an empty key (GU_CLI_TOKEN_PUBLIC_KEY unset and none embedded) the feature shows nothing and
+ * sends nothing.
+ */
+import { createHash, createPublicKey, verify } from "node:crypto";
+import { execFile } from "node:child_process";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { hostname as osHostname } from "node:os";
+import { dirname, join } from "node:path";
+
+/** The public half of the API's CLI_TOKEN_PRIVATE_KEY, base64 SPKI DER (Ed25519). Generated 2026-09-17. */
+export const EMBEDDED_PUBLIC_KEY = "MCowBQYDK2VwAyEA2xkKnY+xWGoS4Nvc7DEHCCurdQQYZGl/x7kPp+gDmvY=";
+
+export const TOKEN_PREFIX = "gu1";
+export const STALE_AFTER_DAYS = 30;
+export const RENEW_EVERY_MS = { client: 86_400_000, expert: 7 * 86_400_000 };
+/** Where the notices send people. Overridable for staging. */
+export const DEFAULT_SITE = "https://gu.gomarsic.cc";
+
+export function publicKey(env = process.env) {
+  return String(env.GU_CLI_TOKEN_PUBLIC_KEY ?? "").trim() || EMBEDDED_PUBLIC_KEY;
+}
+
+export function siteUrl(env = process.env) {
+  return (String(env.GU_SITE_URL ?? "").trim() || DEFAULT_SITE).replace(/\/+$/, "");
+}
+
+const isIso = (v) => typeof v === "string" && v.length > 0 && !Number.isNaN(Date.parse(v));
+
+/** Same rules as api/src/billing/cliToken.ts verifyCliToken. Never throws. */
+export function verifyCliToken(token, publicKeyB64) {
+  if (typeof token !== "string") return { ok: false, why: "malformed" };
+  const parts = token.trim().split(".");
+  if (parts.length !== 3 || !parts[1] || !parts[2]) return { ok: false, why: "malformed" };
+  if (parts[0] !== TOKEN_PREFIX) return { ok: false, why: "unknown-version" };
+  let key;
+  try {
+    key = createPublicKey({ key: Buffer.from(String(publicKeyB64), "base64"), format: "der", type: "spki" });
+  } catch {
+    return { ok: false, why: "bad-signature" };
+  }
+  let good = false;
+  try {
+    good = verify(null, Buffer.from(`${parts[0]}.${parts[1]}`, "utf8"), key, Buffer.from(parts[2], "base64url"));
+  } catch {
+    good = false;
+  }
+  if (!good) return { ok: false, why: "bad-signature" };
+  let p;
+  try {
+    p = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+  } catch {
+    return { ok: false, why: "bad-payload" };
+  }
+  if (
+    !p || typeof p !== "object" ||
+    p.v !== 1 ||
+    typeof p.sub !== "string" || !p.sub ||
+    (p.plan !== "pro" && p.plan !== "free") ||
+    !(p.paidUntil === null || isIso(p.paidUntil)) ||
+    !isIso(p.issuedAt) ||
+    (p.issuedBy !== "refresh" && p.issuedBy !== "account" && p.issuedBy !== "admin") ||
+    !(p.device === null || (typeof p.device === "string" && /^[0-9a-f]{64}$/.test(p.device))) ||
+    !(p.activeDevices === null || (Number.isInteger(p.activeDevices) && p.activeDevices >= 0)) ||
+    !(Number.isInteger(p.deviceLimit) && p.deviceLimit > 0)
+  ) {
+    return { ok: false, why: "bad-payload" };
+  }
+  return { ok: true, payload: p };
+}
+
+// ---------------------------------------------------------------------------
+// THIS COMPUTER
+// ---------------------------------------------------------------------------
+
+const run = (cmd, args) =>
+  new Promise((resolve) => {
+    execFile(cmd, args, { timeout: 3000, windowsHide: true }, (err, stdout) => resolve(err ? "" : String(stdout)));
+  });
+
+/**
+ * The operating system's own id for this machine, or "".
+ *
+ * NOT ~/.gonext/instance: copying the folder to another computer carries that file along, and
+ * `gu clear` makes a new one, which would count one laptop several times. The OS id survives both.
+ */
+export async function osMachineId({ platform = process.platform, read = (p) => readFile(p, "utf8"), exec = run } = {}) {
+  try {
+    if (platform === "darwin") {
+      const out = await exec("ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"]);
+      return out.match(/"IOPlatformUUID"\s*=\s*"([^"]+)"/)?.[1]?.trim() ?? "";
+    }
+    if (platform === "win32") {
+      const out = await exec("reg", ["query", "HKLM\\SOFTWARE\\Microsoft\\Cryptography", "/v", "MachineGuid"]);
+      return out.match(/MachineGuid\s+REG_SZ\s+(\S+)/i)?.[1]?.trim() ?? "";
+    }
+    for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
+      const id = (await read(p).catch(() => "")).trim();
+      if (id) return id;
+    }
+  } catch {
+    /* fall through to "" */
+  }
+  return "";
+}
+
+/** What renewals send about this computer. The raw OS id never leaves the machine — only a salted hash. */
+export async function thisDevice({ platform = process.platform, hostName = osHostname(), machineId, instanceId } = {}) {
+  const raw = machineId ?? (await osMachineId({ platform }));
+  const source = raw || (instanceId ? `instance:${instanceId}` : "");
+  if (!source) return null;
+  return {
+    id: createHash("sha256").update(`gu-device-v1:${source}`).digest("hex"),
+    hostName: String(hostName ?? "").slice(0, 64),
+    os: platform === "darwin" || platform === "linux" || platform === "win32" ? platform : "other",
+  };
+}
+
+// ---------------------------------------------------------------------------
+// STATE: ~/.gonext/cli-token.json
+// ---------------------------------------------------------------------------
+
+export const STATE_FILE = "cli-token.json";
+
+export async function readState(dir) {
+  try {
+    const s = JSON.parse(await readFile(join(dir, STATE_FILE), "utf8"));
+    return {
+      token: typeof s.token === "string" ? s.token : "",
+      lastAttemptAt: isIso(s.lastAttemptAt) ? s.lastAttemptAt : null,
+    };
+  } catch {
+    return { token: "", lastAttemptAt: null };
+  }
+}
+
+/** Atomic and owner-only: a token is not a password, but it is someone's, and renews for them. */
+export async function writeState(dir, state) {
+  const file = join(dir, STATE_FILE);
+  await mkdir(dirname(file), { recursive: true });
+  const tmp = `${file}.${process.pid}.tmp`;
+  await writeFile(tmp, JSON.stringify({ token: state.token ?? "", lastAttemptAt: state.lastAttemptAt ?? null }, null, 2) + "\n", {
+    encoding: "utf8",
+    mode: 0o600,
+  });
+  await rename(tmp, file);
+}
+
+// ---------------------------------------------------------------------------
+// WHEN TO RENEW, AND HOW
+// ---------------------------------------------------------------------------
+
+/** mode: "client" | "expert". warningShowing: a notice is up right now. */
+export function shouldRenew({ state, mode, now = new Date(), warningShowing = false }) {
+  if (warningShowing) return true;
+  const last = Date.parse(state?.lastAttemptAt ?? "");
+  if (Number.isNaN(last)) return true;
+  return now.getTime() - last >= (RENEW_EVERY_MS[mode] ?? RENEW_EVERY_MS.client);
+}
+
+/**
+ * One renewal request. Returns { ok: true, token } or { ok: false, why } — never throws.
+ *
+ * With a token: POST /api/billing/cli-token/renew, bearer = token. Without one, in Client mode only:
+ * POST /api/billing/cli-token with the worker key. A Client Expert worker key belongs to the LOCAL
+ * API and means nothing to the hosted one, so it is never sent there.
+ */
+export async function renewToken({ mode, apiBase, hostedBase, token, workerKey, device, fetchImpl = fetch, timeoutMs = 8000 }) {
+  const base = String(mode === "expert" ? hostedBase : apiBase || hostedBase).replace(/\/+$/, "");
+  const body = JSON.stringify(device ? { device } : {});
+  let url;
+  const headers = { "content-type": "application/json" };
+  if (token) {
+    url = `${base}/api/billing/cli-token/renew`;
+    headers.authorization = `Bearer ${token}`;
+  } else if (mode === "client" && workerKey) {
+    url = `${base}/api/billing/cli-token`;
+    headers["x-worker-key"] = workerKey;
+  } else {
+    return { ok: false, why: "no-credential" };
+  }
+  if (!base) return { ok: false, why: "no-api" };
+  try {
+    const res = await fetchImpl(url, { method: "POST", headers, body, signal: AbortSignal.timeout(timeoutMs) });
+    if (!res.ok) return { ok: false, why: `http-${res.status}` };
+    const data = await res.json().catch(() => null);
+    return typeof data?.token === "string" ? { ok: true, token: data.token } : { ok: false, why: "bad-response" };
+  } catch (e) {
+    return { ok: false, why: e?.name === "TimeoutError" ? "timeout" : "network" };
+  }
+}
+
+// ---------------------------------------------------------------------------
+// WHAT THE BAR SAYS
+// ---------------------------------------------------------------------------
+
+const MONTHS = ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"];
+/** "12 Oct 2026" — spelled out here rather than via toLocaleDateString, whose month names vary by ICU version. */
+export function shortDate(iso) {
+  const d = new Date(iso);
+  return Number.isNaN(d.getTime()) ? "" : `${d.getUTCDate()} ${MONTHS[d.getUTCMonth()]} ${d.getUTCFullYear()}`;
+}
+
+/**
+ * The one line for the bottom bar, or null. Highest priority first:
+ *
+ *   1. the plan ended          — money, and the fix is on the site
+ *   2. more computers than the plan covers
+ *   3. no usable token, or one over 30 days old — only AFTER a renewal was tried in Client mode,
+ *      where one is normally fetched automatically; straight away in Client Expert, where nothing
+ *      fetches one until a token is pasted
+ *
+ * Never the word "licence". Returns null when the feature is off (no public key).
+ */
+export function barNotice({ token, publicKeyB64, mode, now = new Date(), attempted = false, site = DEFAULT_SITE }) {
+  if (!publicKeyB64) return null;
+  const host = site.replace(/^https?:\/\//, "");
+  // Shown without the scheme — shorter on a narrow bar, and still what a person types.
+  const pricingUrl = `${host}/pricing`;
+  const accountUrl = `${host}/account`;
+  const check = token ? verifyCliToken(token, publicKeyB64) : { ok: false, why: "missing" };
+
+  if (check.ok) {
+    const p = check.payload;
+    const ended = p.paidUntil && Date.parse(p.paidUntil) <= now.getTime();
+    if (ended) return { kind: "plan-ended", text: `Your gu Pro plan ended on ${shortDate(p.paidUntil)} — renew at ${pricingUrl}` };
+    if (Number.isInteger(p.activeDevices) && p.activeDevices > p.deviceLimit) {
+      return {
+        kind: "over-limit",
+        text: `gu is active on ${p.activeDevices} computers — ${p.plan === "pro" ? "Pro" : "Free"} covers ${p.deviceLimit}`,
+      };
+    }
+    const age = now.getTime() - Date.parse(p.issuedAt);
+    if (age <= STALE_AFTER_DAYS * 86_400_000) return null;
+  } else if (mode === "client" && !attempted) {
+    return null; // Client mode fetches one by itself; do not complain before it has tried.
+  }
+
+  return mode === "expert"
+    ? { kind: "stale", text: `Get a fresh gu token at ${accountUrl} to keep getting updates` }
+    : { kind: "stale", text: "Sign in to keep getting gu updates — run gu login" };
+}
+
+/** What `gu token` prints about a valid token — plain lines, no colour, for the command to style. */
+export function tokenSummary(payload, now = new Date()) {
+  const lines = [];
+  if (payload.plan === "pro" && payload.paidUntil && Date.parse(payload.paidUntil) > now.getTime()) {
+    lines.push(`Pro until ${shortDate(payload.paidUntil)}.`);
+  } else if (payload.paidUntil) {
+    lines.push(`Free — the Pro plan ended on ${shortDate(payload.paidUntil)}.`);
+  } else {
+    lines.push("Free.");
+  }
+  if (Number.isInteger(payload.activeDevices)) {
+    const n = payload.activeDevices;
+    lines.push(`Active on ${n} ${n === 1 ? "computer" : "computers"} in the last 30 days — ${payload.plan === "pro" ? "Pro" : "Free"} covers ${payload.deviceLimit}.`);
+  }
+  lines.push(`Issued ${shortDate(payload.issuedAt)}.`);
+  return lines;
+}
+

package/gonext_agent_chat.py

@@ -6023,6 +6023,35 @@ def _shell_syntax_error(command, argv):
 # commands are confirmed. False = confirm every command. Module-level default so the tool body
 # reads a real boolean even on a path where run() never set it.
 _accept_edits = True
+
+
+def _live_accept_edits(api_base, worker_key, job_id, current, _fetch=None):
+    """The accept-edits switch AS IT IS NOW (#47), not as it was when the turn was queued.
+
+    Shift+Tab during a turn posts the new value to the job; reading it here, right before a
+    command is gated, is what lets it apply to the turn already running. Any failure keeps
+    `current` — a network blip must not silently flip a safety setting in either direction.
+    One GET per command: small next to running the command, and only when a terminal is there
+    to ask (the caller checks)."""
+    base = (api_base or "").rstrip("/")
+    if not base or not worker_key or not job_id:
+        return current
+    try:
+        if _fetch is None:
+            import urllib.request as _u
+            req = _u.Request(f"{base}/api/worker/jobs/{job_id}",
+                             headers={"X-Worker-Key": worker_key}, method="GET")
+            with _u.urlopen(req, timeout=5, context=_ssl_context()) as resp:
+                data = json.loads(resp.read().decode("utf-8"))
+        else:
+            data = _fetch(f"{base}/api/worker/jobs/{job_id}")
+    except Exception as e:  # noqa: BLE001
+        _log(f"accept-edits read failed: {e} — keeping {'on' if current else 'off'}")
+        return current
+    value = data.get("acceptEdits") if isinstance(data, dict) else None
+    return value if isinstance(value, bool) else current
+
+
 _WS_RUN_ALLOWLIST = set()  # opt-in lockdown from cfg; empty = allow all
 _WS_RUN_DENYLIST = set()   # extra user blocks from cfg
 
@@ -11601,6 +11630,11 @@ def run_agent_chat(cfg):
                 # client can approve interactively (terminal), PAUSE and ask the user;
                 # otherwise (web) keep hard-blocking the privilege/denylist cases.
                 _hard_reason, _ask_reason = _ws_command_risk(command, argv, _WS_RUN_DENYLIST)
+                # Shift+Tab may have switched it since the turn started (#47).
+                global _accept_edits
+                if _interactive_approval and _job_id:
+                    _accept_edits = _live_accept_edits(worker_api_base, worker_api_key,
+                                                       _job_id, _accept_edits)
                 # ACCEPT EDITS OFF ⇒ ASK BEFORE RUNNING ANYTHING (task #179). The risk gate is
                 # the FLOOR, not the whole policy: sudo and rm -rf ask either way, and turning
                 # the toggle off raises the bar to every command. Off is the cautious setting,

package/gu-cli.mjs

@@ -76,6 +76,8 @@ gu-cli
 Usage:
   gu-cli
   gu-cli login [--api-base <url>]   # browser sign-in → writes ~/.gonext/worker.env
+  gu-cli token [<token>]                   # show this computer's gu token, or save one pasted from
+                                               #   the Account page (Client Expert machines)
   gu-cli set <workerKey> [--api-base <url>]
   gu-cli start | stop | status | restart   # run the polling daemon in the background
   gu-cli status                            # daemon + a table of the running model servers
@@ -181,6 +183,48 @@ if (args[0] === "set") {
   await setConfig();
   process.exit(0);
 }
+if (args[0] === "token") {
+  // #232. `gu token <token>` saves a token pasted from the web Account page — the only way a Client
+  // Expert machine, which has no worker key, gets its first one. `gu token` alone shows what the
+  // saved one says. Checked OFFLINE against the public key before saving, so a typo or a token from
+  // another server is refused here rather than turning into a warning later.
+  // NOT `gu tokens`: that is token USAGE, and stays exactly as it was.
+  const ct = await import("./cli-token.mjs");
+  const dir = join(homedir(), ".gonext");
+  const pk = ct.publicKey();
+  const pasted = String(args[1] ?? "").trim();
+  if (!pk) {
+    console.error("This version of gu cannot check tokens yet — nothing to do, gu works without one.");
+    process.exit(pasted ? 1 : 0);
+  }
+  if (pasted) {
+    const check = ct.verifyCliToken(pasted, pk);
+    if (!check.ok) {
+      const why =
+        check.why === "bad-signature" ? "it was not issued by gu (or was copied incompletely)"
+        : check.why === "unknown-version" ? "it is from a newer gu — update this one first"
+        : "it is not a whole token — copy it again from the Account page";
+      console.error(`That token was not saved: ${why}.`);
+      process.exit(1);
+    }
+    // lastAttemptAt null: the next gu start renews at once, which records THIS computer.
+    await ct.writeState(dir, { token: pasted, lastAttemptAt: null });
+    console.log(accent("Saved.") + " It renews itself from now on.");
+    for (const l of ct.tokenSummary(check.payload)) console.log("  " + l);
+    process.exit(0);
+  }
+  const state = await ct.readState(dir);
+  const check = state.token ? ct.verifyCliToken(state.token, pk) : { ok: false, why: "missing" };
+  if (!check.ok) {
+    console.log(state.token ? "The saved token is not valid here." : "No gu token on this computer.");
+    console.log(`  Get one at ${ct.siteUrl()}/account, then: gu token <paste>`);
+    process.exit(0);
+  }
+  for (const l of ct.tokenSummary(check.payload)) console.log(l);
+  if (state.lastAttemptAt) console.log(`Last renewal attempt ${ct.shortDate(state.lastAttemptAt)}.`);
+  process.exit(0);
+}
+
 if (args[0] === "login") {
   // Task #127, Phase 1: browser device-pairing → writes worker.env. `--api-base` overrides
   // which API to pair against (defaults to the production API).

package/gu-repl.mjs

@@ -522,7 +522,7 @@ const argv = process.argv.slice(2);
 // process.argv and exits inside its own subcommand branch, before it ever starts polling.
 const CLI_SUBCOMMANDS = [
   "status", "start", "stop", "restart", "logs", "doctor", "login", "set", "rag",
-  "clear", "reset", "api", "token-usage", "tokens",
+  "clear", "reset", "api", "token-usage", "tokens", "token",
 ];
 // `gu logz` USED TO START THE REPL (task #181). Silently: an unrecognised word was not in
 // the list, so it fell through to "no subcommand given" and a full agent session opened in that
@@ -1848,6 +1848,69 @@ async function refreshAvailableUpdates() {
  * output and corrupt a step's story. When that happens the notice waits: the main loop calls
  * this again at the next prompt, and the bar has been showing the control the whole time.
  */
+/**
+ * THE gu TOKEN (#232) — renewed quietly, and at most one line on the separator row.
+ *
+ * A SOFT LICENCE: nothing here blocks, prompts or delays. The schedule lives in cli-token.mjs
+ * (Client: a day; Client Expert, local-only: a week — the owner's call) so this runs on a cheap
+ * hourly tick that usually just re-reads a file and decides nothing is due.
+ *
+ * `startupRenewDone` is what stops "renew while a warning is up" from becoming "renew every hour
+ * while a warning is up": an account over its computer limit stays over it, and would otherwise
+ * call the hosted API all day. It gets ONE early renewal per gu start — enough for someone who just
+ * paid to see the warning go.
+ */
+let tokenNotice = null;
+let tokenBusy = false;
+let startupRenewDone = false;
+async function refreshCliToken() {
+  if (tokenBusy) return;
+  tokenBusy = true;
+  try {
+    const ct = await import("./cli-token.mjs");
+    const pk = ct.publicKey();
+    if (!pk) {
+      tokenNotice = null; // no key (none embedded, GU_CLI_TOKEN_PUBLIC_KEY empty): nothing to check against
+      return;
+    }
+    const dir = join(homedir(), ".gonext");
+    const mode = isClientExpert() ? "expert" : "client";
+    const site = ct.siteUrl();
+    let state = await ct.readState(dir);
+    const now = new Date();
+    const noticeNow = () =>
+      ct.barNotice({ token: state.token, publicKeyB64: pk, mode, now: new Date(), attempted: Boolean(state.lastAttemptAt), site });
+    tokenNotice = noticeNow();
+
+    const early = Boolean(tokenNotice) && !startupRenewDone;
+    startupRenewDone = true;
+    if (ct.shouldRenew({ state, mode, now, warningShowing: early })) {
+      const { DEFAULT_API_BASE } = await import("./device-login.mjs");
+      const device = await ct.thisDevice({ instanceId: myInstanceId || "" }).catch(() => null);
+      const r = await ct.renewToken({
+        mode,
+        apiBase,
+        hostedBase: String(process.env.GU_TOKEN_API_BASE ?? "").trim() || DEFAULT_API_BASE,
+        token: state.token,
+        workerKey,
+        device,
+      });
+      // A reply is only kept if it checks out here — a proxy's HTML page or another server's token
+      // must not replace a good one.
+      const fresh = r.ok && ct.verifyCliToken(r.token, pk).ok ? r.token : state.token;
+      state = { token: fresh, lastAttemptAt: now.toISOString() };
+      await ct.writeState(dir, state).catch(() => {});
+      tokenNotice = noticeNow();
+    }
+  } catch {
+    /* never a reason to disturb a session */
+  } finally {
+    tokenBusy = false;
+    if (barPinned()) paintBar();
+  }
+}
+const TOKEN_TICK_MS = 60 * 60 * 1000;
+
 let cliNoticeShown = false;
 function announceCliUpdate() {
   if (cliNoticeShown || !availableUpdates.cli) return;
@@ -2148,8 +2211,11 @@ function frozenZone() {
   // separator exists to lift a CONTROL off the typed line, so with no control there is nothing
   // to lift. The same three conditions the rows[sep] writes below test — kept adjacent so they
   // cannot drift into disagreeing about whether a control is showing.
+  // The token notice counts only when it FITS — the same test its write below uses. With
+  // Boolean(tokenNotice) alone, a narrow terminal lifted a blank row for a line it never drew.
+  const tokenFits = Boolean(tokenNotice) && visibleLen(tokenNotice.text) + 4 <= width - 1;
   const headControl =
-    scrolledBack() || availableUpdates.any || Boolean(agentsIndicator(otherAgents));
+    scrolledBack() || availableUpdates.any || tokenFits || Boolean(agentsIndicator(otherAgents));
   const zone = inputZoneRows({
     headControl,
     width,
@@ -2213,6 +2279,14 @@ function frozenZone() {
       rows[sep] = clipVisible(dim(up.text.slice(0, up.from)) + accent(up.text.slice(up.from)), width - 1);
       updateRowTarget = { from: up.from, to: up.to };
     }
+  } else if (tokenFits) {
+    // The gu token's one line (#232), right-aligned like the controls around it. BELOW the update
+    // control, because an update is actionable with a click and this is a standing fact; ABOVE the
+    // agents count, because it needs the user and that does not. Not clickable. Too narrow to say
+    // it whole → the condition above lets the agents count (or nothing) have the row instead.
+    const len = visibleLen(tokenNotice.text);
+    const from = width - 1 - len;
+    rows[sep] = clipVisible(dim("\u2500".repeat(Math.max(0, from - 1)) + " ") + yellow(tokenNotice.text), width - 1);
   } else if (agentsIndicator(otherAgents)) {
     // …and when there is no update to offer, the same row carries the agents count (task #195).
     // THREE THINGS CANNOT SHARE ONE ROW, so they are ranked by how time-critical they are:
@@ -3114,6 +3188,34 @@ function eraseFooter() {
 }
 // Shift+Tab redraw: the bar is below the caret, so a plain redraw in place is enough.
 const redrawModeLine = () => drawFooter();
+// Shift+Tab (#47). At the prompt it sets the mode for the next message. During a turn it ALSO
+// tells the running agent, which re-reads it before each command — the flag the turn was queued
+// with is only its starting value. If the API cannot take it (an older one without the route),
+// say once that it applies from the next message, rather than let the bar claim something the
+// running agent never heard.
+let editModeLiveWarnedJob = null;
+function switchEditMode() {
+  editMode = editMode === "accept" ? "manual" : "accept";
+  redrawModeLine();
+  const jobId = currentJobId;
+  if (!jobId || !apiBase || !workerKey) return;
+  fetch(`${apiBase}/api/worker/jobs/${encodeURIComponent(jobId)}/accept-edits`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", "X-Worker-Key": workerKey },
+    body: JSON.stringify({ acceptEdits: editMode === "accept" }),
+    signal: AbortSignal.timeout(10_000),
+  })
+    .then((r) => {
+      if (!r.ok) throw new Error(`HTTP ${r.status}`);
+    })
+    .catch(() => {
+      if (editModeLiveWarnedJob === jobId || currentJobId !== jobId) return;
+      editModeLiveWarnedJob = jobId;
+      process.stdout.write(
+        "\n" + GUTTER + dim("accept edits: the running agent did not get the change — it applies from your next message") + "\n"
+      );
+    });
+}
 
 // ---------- the gap between Enter and the agent (task #140) -----------------------------
 // Enter tears the bar down at once (it must: the echoed newline would otherwise land on the
@@ -3471,6 +3573,10 @@ if (process.stdin.isTTY) {
       // hover-click, so the fuller thought stays reachable with the mouse capture off (the
       // capture is what would eat the scroll wheel; see hoverMouse).
       if (key && key.ctrl && key.name === "t" && toggleActiveThought) toggleActiveThought();
+      // Shift+Tab WORKS DURING A TURN (#47). This branch used to swallow every key but Ctrl+T,
+      // so the switch did nothing while the agent was thinking — which is exactly when a user
+      // watching it reach for commands wants to change it.
+      if (key && key.name === "tab" && key.shift) switchEditMode();
       rl.line = "";
       rl.cursor = 0;
       rl.historyIndex = -1;
@@ -3501,10 +3607,7 @@ if (process.stdin.isTTY) {
     // Shift+Tab cycles the edit mode shown in the bottom bar (display-only). Skip while the
     // slash overlay owns the screen so we don't fight its redraw.
     if (key && key.name === "tab" && key.shift) {
-      if (!slashOverlayActive) {
-        editMode = editMode === "accept" ? "manual" : "accept";
-        redrawModeLine();
-      }
+      if (!slashOverlayActive) switchEditMode();
       return;
     }
     // Enter is handled by rl.on("line") — don't redraw the hint on the way out.
@@ -10091,6 +10194,9 @@ async function main() {
   // reason gu refuses to exit.
   void refreshAvailableUpdates();
   setInterval(() => void refreshAvailableUpdates(), UPDATE_CHECK_MS).unref();
+  // The gu token (#232): same arrangement — background, never delays the prompt, unref'd.
+  void refreshCliToken();
+  setInterval(() => void refreshCliToken(), TOKEN_TICK_MS).unref();
   // …and the other-agents count (task #195). Slower than the turn's own poll and skipped while
   // a turn runs; unref'd so a pending timer is never the reason gu refuses to exit.
   void refreshOtherAgents();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiens.nguyen/gu-cli",
-  "version": "1.0.705",
+  "version": "1.0.706",
   "description": "Gu CLI — the gu terminal plus the local worker that runs agent / OCR / PDF / embedding jobs on your Mac (Ollama / MLX / OpenAI-compatible).",
   "type": "module",
   "license": "MIT",
@@ -51,6 +51,7 @@
     "terminal-copy.mjs",
     "version-check.mjs",
     "rag-selftest.mjs",
+    "cli-token.mjs",
     "device-login.mjs",
     "daemon-control.mjs",
     "poll-errors.mjs",