@tiens.nguyen/gu-cli 1.0.705 → 1.0.707

package/clear-state.mjs

@@ -32,6 +32,8 @@ export const STATE_ITEMS = [
     what: "Local-mode setup progress and the chosen mode", cost: "setup starts over" },
   { path: "instance", group: "identity",
     what: "this machine's id", cost: "it gets a new one" },
+  { path: "cli-token.json", group: "identity",
+    what: "the gu token (plan + computers)", cost: "a Client Expert machine needs it pasted again" },
   { path: "prefs.json", group: "identity", what: "CLI preferences", cost: "defaults return" },
   { path: "wizard-state.json", group: "identity",
     what: "installer progress", cost: "the wizard starts over" },

package/cli-token.mjs

@@ -0,0 +1,341 @@
+/**
+ * THE CLI TOKEN, CLIENT SIDE (#232) — keep it fresh, and say one line when something needs attention.
+ *
+ * A SOFT LICENCE, by the owner's choice: nothing here ever blocks a session, refuses a command or
+ * delays a prompt. The worst it does is one line in the bottom bar. Someone who patches it out is
+ * acceptable.
+ *
+ * The token is signed by the hosted API (api/src/billing/cliToken.ts) and checked HERE, offline,
+ * with the public key only. The rules in verifyCliToken must match the API's; the test file checks
+ * a token the real API code signed.
+ *
+ * RENEWAL, agreed with the owner:
+ *   · Client mode (hosted API): at start, then at most once a DAY — with the worker key when there is
+ *     no token yet, with the token after that.
+ *   · Client Expert (local-only): at most once a WEEK, and always against the HOSTED API. The local
+ *     API cannot sign tokens or see payments, and a local-only machine should make the fewest
+ *     outside calls that still work.
+ *   · Either mode renews at start while a warning is showing, so someone who just paid is not told
+ *     "plan ended" for a week.
+ *   · Every failure is silent: the current token stays and nothing new is shown.
+ *
+ * THE KEY. EMBEDDED_PUBLIC_KEY is the public half of the production pair, generated ONCE on
+ * 2026-09-17 (api: npm run cli-token:keygen). The private half lives only in the API's api.env and the
+ * owner's password manager. Generating another pair makes every installed CLI reject every new token
+ * — see the note in api/scripts/cli-token-keygen.mts before ever doing it.
+ * With an empty key (GU_CLI_TOKEN_PUBLIC_KEY unset and none embedded) the feature shows nothing and
+ * sends nothing.
+ */
+import { createHash, createPublicKey, verify } from "node:crypto";
+import { execFile } from "node:child_process";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { hostname as osHostname } from "node:os";
+import { dirname, join } from "node:path";
+
+/** The public half of the API's CLI_TOKEN_PRIVATE_KEY, base64 SPKI DER (Ed25519). Generated 2026-09-17. */
+export const EMBEDDED_PUBLIC_KEY = "MCowBQYDK2VwAyEA2xkKnY+xWGoS4Nvc7DEHCCurdQQYZGl/x7kPp+gDmvY=";
+
+export const TOKEN_PREFIX = "gu1";
+export const STALE_AFTER_DAYS = 30;
+export const RENEW_EVERY_MS = { client: 86_400_000, expert: 7 * 86_400_000 };
+/** Where the notices send people. Overridable for staging. */
+export const DEFAULT_SITE = "https://gu.gomarsic.cc";
+
+export function publicKey(env = process.env) {
+  return String(env.GU_CLI_TOKEN_PUBLIC_KEY ?? "").trim() || EMBEDDED_PUBLIC_KEY;
+}
+
+export function siteUrl(env = process.env) {
+  return (String(env.GU_SITE_URL ?? "").trim() || DEFAULT_SITE).replace(/\/+$/, "");
+}
+
+const isIso = (v) => typeof v === "string" && v.length > 0 && !Number.isNaN(Date.parse(v));
+
+/** Same rules as api/src/billing/cliToken.ts verifyCliToken. Never throws. */
+export function verifyCliToken(token, publicKeyB64) {
+  if (typeof token !== "string") return { ok: false, why: "malformed" };
+  const parts = token.trim().split(".");
+  if (parts.length !== 3 || !parts[1] || !parts[2]) return { ok: false, why: "malformed" };
+  if (parts[0] !== TOKEN_PREFIX) return { ok: false, why: "unknown-version" };
+  let key;
+  try {
+    key = createPublicKey({ key: Buffer.from(String(publicKeyB64), "base64"), format: "der", type: "spki" });
+  } catch {
+    return { ok: false, why: "bad-signature" };
+  }
+  let good = false;
+  try {
+    good = verify(null, Buffer.from(`${parts[0]}.${parts[1]}`, "utf8"), key, Buffer.from(parts[2], "base64url"));
+  } catch {
+    good = false;
+  }
+  if (!good) return { ok: false, why: "bad-signature" };
+  let p;
+  try {
+    p = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+  } catch {
+    return { ok: false, why: "bad-payload" };
+  }
+  if (
+    !p || typeof p !== "object" ||
+    p.v !== 1 ||
+    typeof p.sub !== "string" || !p.sub ||
+    (p.plan !== "pro" && p.plan !== "free") ||
+    !(p.paidUntil === null || isIso(p.paidUntil)) ||
+    !isIso(p.issuedAt) ||
+    (p.issuedBy !== "refresh" && p.issuedBy !== "account" && p.issuedBy !== "admin") ||
+    !(p.device === null || (typeof p.device === "string" && /^[0-9a-f]{64}$/.test(p.device))) ||
+    !(p.activeDevices === null || (Number.isInteger(p.activeDevices) && p.activeDevices >= 0)) ||
+    !(Number.isInteger(p.deviceLimit) && p.deviceLimit > 0) ||
+    // Missing means OFF — tokens issued before the switch existed (#238) are in CLIs right now.
+    !(p.enforce === undefined || typeof p.enforce === "boolean")
+  ) {
+    return { ok: false, why: "bad-payload" };
+  }
+  return { ok: true, payload: { ...p, enforce: p.enforce === true } };
+}
+
+// ---------------------------------------------------------------------------
+// THIS COMPUTER
+// ---------------------------------------------------------------------------
+
+const run = (cmd, args) =>
+  new Promise((resolve) => {
+    execFile(cmd, args, { timeout: 3000, windowsHide: true }, (err, stdout) => resolve(err ? "" : String(stdout)));
+  });
+
+/**
+ * The operating system's own id for this machine, or "".
+ *
+ * NOT ~/.gonext/instance: copying the folder to another computer carries that file along, and
+ * `gu clear` makes a new one, which would count one laptop several times. The OS id survives both.
+ */
+export async function osMachineId({ platform = process.platform, read = (p) => readFile(p, "utf8"), exec = run } = {}) {
+  try {
+    if (platform === "darwin") {
+      const out = await exec("ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"]);
+      return out.match(/"IOPlatformUUID"\s*=\s*"([^"]+)"/)?.[1]?.trim() ?? "";
+    }
+    if (platform === "win32") {
+      const out = await exec("reg", ["query", "HKLM\\SOFTWARE\\Microsoft\\Cryptography", "/v", "MachineGuid"]);
+      return out.match(/MachineGuid\s+REG_SZ\s+(\S+)/i)?.[1]?.trim() ?? "";
+    }
+    for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
+      const id = (await read(p).catch(() => "")).trim();
+      if (id) return id;
+    }
+  } catch {
+    /* fall through to "" */
+  }
+  return "";
+}
+
+/** What renewals send about this computer. The raw OS id never leaves the machine — only a salted hash. */
+export async function thisDevice({ platform = process.platform, hostName = osHostname(), machineId, instanceId } = {}) {
+  const raw = machineId ?? (await osMachineId({ platform }));
+  const source = raw || (instanceId ? `instance:${instanceId}` : "");
+  if (!source) return null;
+  return {
+    id: createHash("sha256").update(`gu-device-v1:${source}`).digest("hex"),
+    hostName: String(hostName ?? "").slice(0, 64),
+    os: platform === "darwin" || platform === "linux" || platform === "win32" ? platform : "other",
+  };
+}
+
+// ---------------------------------------------------------------------------
+// STATE: ~/.gonext/cli-token.json
+// ---------------------------------------------------------------------------
+
+export const STATE_FILE = "cli-token.json";
+
+export async function readState(dir) {
+  try {
+    const s = JSON.parse(await readFile(join(dir, STATE_FILE), "utf8"));
+    return {
+      token: typeof s.token === "string" ? s.token : "",
+      lastAttemptAt: isIso(s.lastAttemptAt) ? s.lastAttemptAt : null,
+    };
+  } catch {
+    return { token: "", lastAttemptAt: null };
+  }
+}
+
+/** Atomic and owner-only: a token is not a password, but it is someone's, and renews for them. */
+export async function writeState(dir, state) {
+  const file = join(dir, STATE_FILE);
+  await mkdir(dirname(file), { recursive: true });
+  const tmp = `${file}.${process.pid}.tmp`;
+  await writeFile(tmp, JSON.stringify({ token: state.token ?? "", lastAttemptAt: state.lastAttemptAt ?? null }, null, 2) + "\n", {
+    encoding: "utf8",
+    mode: 0o600,
+  });
+  await rename(tmp, file);
+}
+
+// ---------------------------------------------------------------------------
+// WHEN TO RENEW, AND HOW
+// ---------------------------------------------------------------------------
+
+/** mode: "client" | "expert". warningShowing: a notice is up right now. */
+export function shouldRenew({ state, mode, now = new Date(), warningShowing = false }) {
+  if (warningShowing) return true;
+  const last = Date.parse(state?.lastAttemptAt ?? "");
+  if (Number.isNaN(last)) return true;
+  return now.getTime() - last >= (RENEW_EVERY_MS[mode] ?? RENEW_EVERY_MS.client);
+}
+
+/**
+ * One renewal request. Returns { ok: true, token } or { ok: false, why } — never throws.
+ *
+ * With a token: POST /api/billing/cli-token/renew, bearer = token. Without one, in Client mode only:
+ * POST /api/billing/cli-token with the worker key. A Client Expert worker key belongs to the LOCAL
+ * API and means nothing to the hosted one, so it is never sent there.
+ */
+export async function renewToken({ mode, apiBase, hostedBase, token, workerKey, device, fetchImpl = fetch, timeoutMs = 8000 }) {
+  const base = String(mode === "expert" ? hostedBase : apiBase || hostedBase).replace(/\/+$/, "");
+  const body = JSON.stringify(device ? { device } : {});
+  let url;
+  const headers = { "content-type": "application/json" };
+  if (token) {
+    url = `${base}/api/billing/cli-token/renew`;
+    headers.authorization = `Bearer ${token}`;
+  } else if (mode === "client" && workerKey) {
+    url = `${base}/api/billing/cli-token`;
+    headers["x-worker-key"] = workerKey;
+  } else {
+    return { ok: false, why: "no-credential" };
+  }
+  if (!base) return { ok: false, why: "no-api" };
+  try {
+    const res = await fetchImpl(url, { method: "POST", headers, body, signal: AbortSignal.timeout(timeoutMs) });
+    if (!res.ok) return { ok: false, why: `http-${res.status}` };
+    const data = await res.json().catch(() => null);
+    return typeof data?.token === "string" ? { ok: true, token: data.token } : { ok: false, why: "bad-response" };
+  } catch (e) {
+    return { ok: false, why: e?.name === "TimeoutError" ? "timeout" : "network" };
+  }
+}
+
+// ---------------------------------------------------------------------------
+// WHAT THE BAR SAYS
+// ---------------------------------------------------------------------------
+
+const MONTHS = ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"];
+/** "12 Oct 2026" — spelled out here rather than via toLocaleDateString, whose month names vary by ICU version. */
+export function shortDate(iso) {
+  const d = new Date(iso);
+  return Number.isNaN(d.getTime()) ? "" : `${d.getUTCDate()} ${MONTHS[d.getUTCMonth()]} ${d.getUTCFullYear()}`;
+}
+
+/**
+ * The one line for the bottom bar, or null. Highest priority first:
+ *
+ *   1. the plan ended          — money, and the fix is on the site
+ *   2. more computers than the plan covers
+ *   3. no usable token, or one over 30 days old — only AFTER a renewal was tried in Client mode,
+ *      where one is normally fetched automatically; straight away in Client Expert, where nothing
+ *      fetches one until a token is pasted
+ *
+ * Never the word "licence". Returns null when the feature is off (no public key).
+ */
+export function barNotice({ token, publicKeyB64, mode, now = new Date(), attempted = false, site = DEFAULT_SITE }) {
+  if (!publicKeyB64) return null;
+  const host = site.replace(/^https?:\/\//, "");
+  // Shown without the scheme — shorter on a narrow bar, and still what a person types.
+  const pricingUrl = `${host}/pricing`;
+  const accountUrl = `${host}/account`;
+  const check = token ? verifyCliToken(token, publicKeyB64) : { ok: false, why: "missing" };
+
+  if (check.ok) {
+    const p = check.payload;
+    const ended = p.paidUntil && Date.parse(p.paidUntil) <= now.getTime();
+    if (ended) return { kind: "plan-ended", text: `Your gu Pro plan ended on ${shortDate(p.paidUntil)} — renew at ${pricingUrl}` };
+    if (Number.isInteger(p.activeDevices) && p.activeDevices > p.deviceLimit) {
+      return {
+        kind: "over-limit",
+        text: `gu is active on ${p.activeDevices} devices — ${p.plan === "pro" ? "Pro" : "Free"} covers ${p.deviceLimit}`,
+      };
+    }
+    const age = now.getTime() - Date.parse(p.issuedAt);
+    if (age <= STALE_AFTER_DAYS * 86_400_000) return null;
+  } else if (mode === "client" && !attempted) {
+    return null; // Client mode fetches one by itself; do not complain before it has tried.
+  }
+
+  return mode === "expert"
+    ? { kind: "stale", text: `Get a fresh gu token at ${accountUrl} to keep getting updates` }
+    : { kind: "stale", text: "Sign in to keep getting gu updates — run gu login" };
+}
+
+/** What `gu token` prints about a valid token — plain lines, no colour, for the command to style. */
+export function tokenSummary(payload, now = new Date()) {
+  const lines = [];
+  if (payload.plan === "pro" && payload.paidUntil && Date.parse(payload.paidUntil) > now.getTime()) {
+    lines.push(`Pro until ${shortDate(payload.paidUntil)}.`);
+  } else if (payload.paidUntil) {
+    lines.push(`Free — the Pro plan ended on ${shortDate(payload.paidUntil)}.`);
+  } else {
+    lines.push("Free.");
+  }
+  if (Number.isInteger(payload.activeDevices)) {
+    const n = payload.activeDevices;
+    lines.push(`Active on ${n} ${n === 1 ? "device" : "devices"} in the last 30 days — ${payload.plan === "pro" ? "Pro" : "Free"} covers ${payload.deviceLimit}.`);
+  }
+  lines.push(`Issued ${shortDate(payload.issuedAt)}.`);
+  return lines;
+}
+
+// ---------------------------------------------------------------------------
+// ENFORCEMENT (#238) — decided ONCE, when gu starts
+// ---------------------------------------------------------------------------
+
+/**
+ * May this session send turns?
+ *
+ * The switch lives on the server and rides in the token (payload.enforce). This is read ONCE at
+ * startup, by the owner's requirement — a session that began is never interrupted by a later renewal,
+ * and nothing asks the network again per turn.
+ *
+ * WITH THE SWITCH OFF (the default and what ships today) the answer is always yes: the licence stays
+ * soft — barNotice() says its one line and nothing is blocked.
+ *
+ * WITH IT ON, a session may send turns when the token is valid, the plan is Pro, its paid time has not
+ * run out, and the account is within its computer limit. Otherwise gu says why and refuses to SEND
+ * TURNS — `gu login`, `gu token`, /model and every other command keep working, because the person has
+ * to be able to fix it from where they are.
+ */
+export function enforcementDecision({ token, publicKeyB64, now = new Date(), site = DEFAULT_SITE }) {
+  if (!publicKeyB64) return { enforced: false, allowed: true, why: "" };
+  const check = token ? verifyCliToken(token, publicKeyB64) : { ok: false, why: "missing" };
+  // An unreadable or missing token cannot say whether enforcement is on, and this must not be a way
+  // to switch it off by deleting a file — but it is also not a reason to block someone whose server
+  // has enforcement OFF. Unknown means soft, exactly like a server that cannot be reached.
+  if (!check.ok) return { enforced: false, allowed: true, why: "" };
+  const p = check.payload;
+  if (!p.enforce) return { enforced: false, allowed: true, why: "" };
+
+  const host = site.replace(/^https?:\/\//, "");
+  const pricingUrl = `${host}/pricing`;
+  const accountUrl = `${host}/account`;
+  const ended = p.paidUntil && Date.parse(p.paidUntil) <= now.getTime();
+  if (p.plan !== "pro" || ended) {
+    return {
+      enforced: true,
+      allowed: false,
+      why: ended
+        ? `Your gu Pro plan ended on ${shortDate(p.paidUntil)}. Renew at ${pricingUrl} to keep using the agent.`
+        : `gu needs a Pro plan on this account. See ${pricingUrl} — the rest of gu still works.`,
+    };
+  }
+  if (Number.isInteger(p.activeDevices) && p.activeDevices > p.deviceLimit) {
+    return {
+      enforced: true,
+      allowed: false,
+      why:
+        `This account is active on ${p.activeDevices} devices and Pro covers ${p.deviceLimit}. ` +
+        `Sign out of one, or remove it at ${accountUrl}.`,
+    };
+  }
+  return { enforced: true, allowed: true, why: "" };
+}
+

package/credential-recovery.mjs

@@ -0,0 +1,82 @@
+/**
+ * WHEN THE CREDENTIALS ON THIS MACHINE NO LONGER WORK (task #240).
+ *
+ * THE DEAD END THIS EXISTS TO CLOSE, reproduced in a clean Ubuntu container: a machine whose
+ * ~/.gonext/worker.env holds a key the API rejects (rotated, revoked, pasted from another
+ * account, or written by the wizard for a different server) could not reach the first-run flow
+ * at all. `gu` printed one red line and exited — every time, forever. The questions a first run
+ * asks were unreachable, and the only route back was `gu clear`, which is a RESET: it deletes
+ * conversation history, registered workspaces, deploy targets, the agent's edit backups and the
+ * RAG indexes. Reported as "first run question doesn't appear … I then needed gu clear then gu
+ * again", and that is exactly what the user had been driven to.
+ *
+ * A REJECTED KEY IS THE SAME SITUATION AS NO KEY. Both mean this machine is not connected to an
+ * account, and the answer to both is the sign-in that the first run already offers. So gu offers
+ * it here too, in place, keeping everything else on the machine.
+ *
+ * WHY A MODULE AND NOT AN `if` IN THE REPL: so the rule can be called by a test. The conduct
+ * being pinned is "which situations offer a sign-in", and open-coded it could only be guarded by
+ * a regex over gu-repl.mjs — which pins the WORDING and lets the conduct change underneath.
+ *
+ * THE CODE, NOT THE WORDING, decides. payloadError() stamps `code` on the error the API call
+ * throws; nothing downstream matches on the message text, which is free to be reworded.
+ */
+
+/** The error an agent-payload call failed with, carrying a code the recovery can switch on. */
+export function payloadError(status, data) {
+  const message = (data && typeof data === "object" && data.error) || "";
+  if (status === 404) {
+    const e = new Error(
+      "the API does not have POST /api/worker/agent-payload yet — deploy the latest API (sam build && sam deploy)."
+    );
+    e.code = "API_TOO_OLD";
+    return e;
+  }
+  // 401/403: the key is present and WRONG. We never re-validate a stored key proactively, so
+  // this is where a rotated or revoked one surfaces — the first thing gu does on startup.
+  if (status === 401 || status === 403) {
+    const e = new Error(
+      "your worker key was rejected (it may have been rotated or revoked). " +
+        "Run `gu login` to sign in again, or update it with `gu set <workerKey> --api-base <url>`."
+    );
+    e.code = "KEY_REJECTED";
+    return e;
+  }
+  const e = new Error(message || `agent-payload failed (HTTP ${status})`);
+  e.code = "API_ERROR";
+  return e;
+}
+
+/**
+ * What should happen when the startup probe fails?
+ *
+ *   "offer-signin" — ask, here and now, and carry on with the session when it works.
+ *   "report"       — print what is wrong and stop. The caller's existing message.
+ *
+ * ONLY a rejected key, and only with somebody there to answer. A network failure is not a
+ * credential problem (the key may be perfect and the wifi off), and a pipe or CI job has nobody
+ * at the keyboard — offering there would hang a script on a prompt no one can see, which is the
+ * failure mode that made `gu` unusable in the deploy app's stages.
+ *
+ * NOT ON A CLIENT EXPERT MACHINE. Its API is local and issues its own key; a hosted device-login
+ * there points the terminal away from the very stack it was set up to use. The same reasoning
+ * that made first-run setup skip the sign-in after Client Expert applies to the recovery.
+ */
+export function recoveryPlan({ code, isTty, clientExpert } = {}) {
+  if (code !== "KEY_REJECTED") return { action: "report" };
+  if (!isTty) return { action: "report" };
+  if (clientExpert) return { action: "report" };
+  return {
+    action: "offer-signin",
+    // What it says matters as much as that it asks: someone who has just been told their key is
+    // bad needs to know that answering will not cost them their work.
+    lines: [
+      "gu: this machine's worker key was rejected — it may have been rotated or revoked.",
+      "  Sign in again to reconnect this machine to an account.",
+      "  Nothing else is touched: your folders, chat history and RAG indexes stay as they are.",
+    ],
+    // UN-INDENTED, like every other ask() caller: ask() insets by the gutter itself, and a
+    // prompt carrying its own spaces comes out sitting two columns right of every other question.
+    prompt: "worker key (or Enter to sign in): ",
+  };
+}

package/gonext_agent_chat.py

@@ -6023,6 +6023,35 @@ def _shell_syntax_error(command, argv):
 # commands are confirmed. False = confirm every command. Module-level default so the tool body
 # reads a real boolean even on a path where run() never set it.
 _accept_edits = True
+
+
+def _live_accept_edits(api_base, worker_key, job_id, current, _fetch=None):
+    """The accept-edits switch AS IT IS NOW (#47), not as it was when the turn was queued.
+
+    Shift+Tab during a turn posts the new value to the job; reading it here, right before a
+    command is gated, is what lets it apply to the turn already running. Any failure keeps
+    `current` — a network blip must not silently flip a safety setting in either direction.
+    One GET per command: small next to running the command, and only when a terminal is there
+    to ask (the caller checks)."""
+    base = (api_base or "").rstrip("/")
+    if not base or not worker_key or not job_id:
+        return current
+    try:
+        if _fetch is None:
+            import urllib.request as _u
+            req = _u.Request(f"{base}/api/worker/jobs/{job_id}",
+                             headers={"X-Worker-Key": worker_key}, method="GET")
+            with _u.urlopen(req, timeout=5, context=_ssl_context()) as resp:
+                data = json.loads(resp.read().decode("utf-8"))
+        else:
+            data = _fetch(f"{base}/api/worker/jobs/{job_id}")
+    except Exception as e:  # noqa: BLE001
+        _log(f"accept-edits read failed: {e} — keeping {'on' if current else 'off'}")
+        return current
+    value = data.get("acceptEdits") if isinstance(data, dict) else None
+    return value if isinstance(value, bool) else current
+
+
 _WS_RUN_ALLOWLIST = set()  # opt-in lockdown from cfg; empty = allow all
 _WS_RUN_DENYLIST = set()   # extra user blocks from cfg
 
@@ -11601,6 +11630,11 @@ def run_agent_chat(cfg):
                 # client can approve interactively (terminal), PAUSE and ask the user;
                 # otherwise (web) keep hard-blocking the privilege/denylist cases.
                 _hard_reason, _ask_reason = _ws_command_risk(command, argv, _WS_RUN_DENYLIST)
+                # Shift+Tab may have switched it since the turn started (#47).
+                global _accept_edits
+                if _interactive_approval and _job_id:
+                    _accept_edits = _live_accept_edits(worker_api_base, worker_api_key,
+                                                       _job_id, _accept_edits)
                 # ACCEPT EDITS OFF ⇒ ASK BEFORE RUNNING ANYTHING (task #179). The risk gate is
                 # the FLOOR, not the whole policy: sudo and rm -rf ask either way, and turning
                 # the toggle off raises the bar to every command. Off is the cautious setting,

package/gu-cli.mjs

@@ -76,6 +76,8 @@ gu-cli
 Usage:
   gu-cli
   gu-cli login [--api-base <url>]   # browser sign-in → writes ~/.gonext/worker.env
+  gu-cli token [<token>]                   # show this computer's gu token, or save one pasted from
+                                               #   the Account page (Client Expert machines)
   gu-cli set <workerKey> [--api-base <url>]
   gu-cli start | stop | status | restart   # run the polling daemon in the background
   gu-cli status                            # daemon + a table of the running model servers
@@ -181,6 +183,48 @@ if (args[0] === "set") {
   await setConfig();
   process.exit(0);
 }
+if (args[0] === "token") {
+  // #232. `gu token <token>` saves a token pasted from the web Account page — the only way a Client
+  // Expert machine, which has no worker key, gets its first one. `gu token` alone shows what the
+  // saved one says. Checked OFFLINE against the public key before saving, so a typo or a token from
+  // another server is refused here rather than turning into a warning later.
+  // NOT `gu tokens`: that is token USAGE, and stays exactly as it was.
+  const ct = await import("./cli-token.mjs");
+  const dir = join(homedir(), ".gonext");
+  const pk = ct.publicKey();
+  const pasted = String(args[1] ?? "").trim();
+  if (!pk) {
+    console.error("This version of gu cannot check tokens yet — nothing to do, gu works without one.");
+    process.exit(pasted ? 1 : 0);
+  }
+  if (pasted) {
+    const check = ct.verifyCliToken(pasted, pk);
+    if (!check.ok) {
+      const why =
+        check.why === "bad-signature" ? "it was not issued by gu (or was copied incompletely)"
+        : check.why === "unknown-version" ? "it is from a newer gu — update this one first"
+        : "it is not a whole token — copy it again from the Account page";
+      console.error(`That token was not saved: ${why}.`);
+      process.exit(1);
+    }
+    // lastAttemptAt null: the next gu start renews at once, which records THIS computer.
+    await ct.writeState(dir, { token: pasted, lastAttemptAt: null });
+    console.log(accent("Saved.") + " It renews itself from now on.");
+    for (const l of ct.tokenSummary(check.payload)) console.log("  " + l);
+    process.exit(0);
+  }
+  const state = await ct.readState(dir);
+  const check = state.token ? ct.verifyCliToken(state.token, pk) : { ok: false, why: "missing" };
+  if (!check.ok) {
+    console.log(state.token ? "The saved token is not valid here." : "No gu token on this computer.");
+    console.log(`  Get one at ${ct.siteUrl()}/account, then: gu token <paste>`);
+    process.exit(0);
+  }
+  for (const l of ct.tokenSummary(check.payload)) console.log(l);
+  if (state.lastAttemptAt) console.log(`Last renewal attempt ${ct.shortDate(state.lastAttemptAt)}.`);
+  process.exit(0);
+}
+
 if (args[0] === "login") {
   // Task #127, Phase 1: browser device-pairing → writes worker.env. `--api-base` overrides
   // which API to pair against (defaults to the production API).

package/gu-repl.mjs

@@ -137,6 +137,9 @@ import { REQUIRED_AGENT_MODEL, REQUIRED_AGENT_PREFIX, REQUIRED_EMBED_MODEL } fro
 // plain SGR code: terminals disagree about colour, so accent.mjs picks 24-bit, 256 or the
 // sixteen-colour magenta from what this one actually claims to support.
 import { accent } from "./accent.mjs";
+// Task #240: what a failed agent-payload call means, and when a rejected key may be recovered
+// from in place instead of ending the session.
+import { payloadError, recoveryPlan } from "./credential-recovery.mjs";
 import { isNoCodeRetry, splitVerboseLine, stepHasCode } from "./verbose-lines.mjs";
 import {
   createTranscript,
@@ -522,7 +525,7 @@ const argv = process.argv.slice(2);
 // process.argv and exits inside its own subcommand branch, before it ever starts polling.
 const CLI_SUBCOMMANDS = [
   "status", "start", "stop", "restart", "logs", "doctor", "login", "set", "rag",
-  "clear", "reset", "api", "token-usage", "tokens",
+  "clear", "reset", "api", "token-usage", "tokens", "token",
 ];
 // `gu logz` USED TO START THE REPL (task #181). Silently: an unrecognised word was not in
 // the list, so it fell through to "no subcommand given" and a full agent session opened in that
@@ -1848,6 +1851,87 @@ async function refreshAvailableUpdates() {
  * output and corrupt a step's story. When that happens the notice waits: the main loop calls
  * this again at the next prompt, and the bar has been showing the control the whole time.
  */
+/**
+ * THE gu TOKEN (#232) — renewed quietly, and at most one line on the separator row.
+ *
+ * A SOFT LICENCE: nothing here blocks, prompts or delays. The schedule lives in cli-token.mjs
+ * (Client: a day; Client Expert, local-only: a week — the owner's call) so this runs on a cheap
+ * hourly tick that usually just re-reads a file and decides nothing is due.
+ *
+ * `startupRenewDone` is what stops "renew while a warning is up" from becoming "renew every hour
+ * while a warning is up": an account over its computer limit stays over it, and would otherwise
+ * call the hosted API all day. It gets ONE early renewal per gu start — enough for someone who just
+ * paid to see the warning go.
+ */
+let tokenNotice = null;
+let tokenBusy = false;
+let startupRenewDone = false;
+/**
+ * THE ENFORCEMENT DECISION (#238) — taken ONCE, on the first refresh after gu starts, and never
+ * revisited. The owner's requirement: check when gu starts, not repeatedly. A session already running
+ * is never cut off by a switch flipped elsewhere, and a later renewal only updates the bar's line.
+ */
+let licenceBlock = null;
+let licenceDecided = false;
+async function refreshCliToken() {
+  if (tokenBusy) return;
+  tokenBusy = true;
+  try {
+    const ct = await import("./cli-token.mjs");
+    const pk = ct.publicKey();
+    if (!pk) {
+      tokenNotice = null; // no key (none embedded, GU_CLI_TOKEN_PUBLIC_KEY empty): nothing to check against
+      return;
+    }
+    const dir = join(homedir(), ".gonext");
+    const mode = isClientExpert() ? "expert" : "client";
+    const site = ct.siteUrl();
+    let state = await ct.readState(dir);
+    const now = new Date();
+    const noticeNow = () =>
+      ct.barNotice({ token: state.token, publicKeyB64: pk, mode, now: new Date(), attempted: Boolean(state.lastAttemptAt), site });
+    tokenNotice = noticeNow();
+
+    const early = Boolean(tokenNotice) && !startupRenewDone;
+    startupRenewDone = true;
+    if (ct.shouldRenew({ state, mode, now, warningShowing: early })) {
+      const { DEFAULT_API_BASE } = await import("./device-login.mjs");
+      const device = await ct.thisDevice({ instanceId: myInstanceId || "" }).catch(() => null);
+      const r = await ct.renewToken({
+        mode,
+        apiBase,
+        hostedBase: String(process.env.GU_TOKEN_API_BASE ?? "").trim() || DEFAULT_API_BASE,
+        token: state.token,
+        workerKey,
+        device,
+      });
+      // A reply is only kept if it checks out here — a proxy's HTML page or another server's token
+      // must not replace a good one.
+      const fresh = r.ok && ct.verifyCliToken(r.token, pk).ok ? r.token : state.token;
+      state = { token: fresh, lastAttemptAt: now.toISOString() };
+      await ct.writeState(dir, state).catch(() => {});
+      tokenNotice = noticeNow();
+    }
+    if (!licenceDecided) {
+      licenceDecided = true;
+      const d = ct.enforcementDecision({ token: state.token, publicKeyB64: pk, site });
+      licenceBlock = d.enforced && !d.allowed ? d.why : null;
+      if (licenceBlock) {
+        console.log("");
+        console.log(GUTTER + orange("gu cannot run turns on this account.") );
+        console.log(GUTTER + dim("  " + licenceBlock));
+        console.log(GUTTER + dim("  Everything else still works: /model, gu token, gu login.") + "\n");
+      }
+    }
+  } catch {
+    /* never a reason to disturb a session */
+  } finally {
+    tokenBusy = false;
+    if (barPinned()) paintBar();
+  }
+}
+const TOKEN_TICK_MS = 60 * 60 * 1000;
+
 let cliNoticeShown = false;
 function announceCliUpdate() {
   if (cliNoticeShown || !availableUpdates.cli) return;
@@ -2148,8 +2232,11 @@ function frozenZone() {
   // separator exists to lift a CONTROL off the typed line, so with no control there is nothing
   // to lift. The same three conditions the rows[sep] writes below test — kept adjacent so they
   // cannot drift into disagreeing about whether a control is showing.
+  // The token notice counts only when it FITS — the same test its write below uses. With
+  // Boolean(tokenNotice) alone, a narrow terminal lifted a blank row for a line it never drew.
+  const tokenFits = Boolean(tokenNotice) && visibleLen(tokenNotice.text) + 4 <= width - 1;
   const headControl =
-    scrolledBack() || availableUpdates.any || Boolean(agentsIndicator(otherAgents));
+    scrolledBack() || availableUpdates.any || tokenFits || Boolean(agentsIndicator(otherAgents));
   const zone = inputZoneRows({
     headControl,
     width,
@@ -2213,6 +2300,14 @@ function frozenZone() {
       rows[sep] = clipVisible(dim(up.text.slice(0, up.from)) + accent(up.text.slice(up.from)), width - 1);
       updateRowTarget = { from: up.from, to: up.to };
     }
+  } else if (tokenFits) {
+    // The gu token's one line (#232), right-aligned like the controls around it. BELOW the update
+    // control, because an update is actionable with a click and this is a standing fact; ABOVE the
+    // agents count, because it needs the user and that does not. Not clickable. Too narrow to say
+    // it whole → the condition above lets the agents count (or nothing) have the row instead.
+    const len = visibleLen(tokenNotice.text);
+    const from = width - 1 - len;
+    rows[sep] = clipVisible(dim("\u2500".repeat(Math.max(0, from - 1)) + " ") + yellow(tokenNotice.text), width - 1);
   } else if (agentsIndicator(otherAgents)) {
     // …and when there is no update to offer, the same row carries the agents count (task #195).
     // THREE THINGS CANNOT SHARE ONE ROW, so they are ranked by how time-critical they are:
@@ -3114,6 +3209,34 @@ function eraseFooter() {
 }
 // Shift+Tab redraw: the bar is below the caret, so a plain redraw in place is enough.
 const redrawModeLine = () => drawFooter();
+// Shift+Tab (#47). At the prompt it sets the mode for the next message. During a turn it ALSO
+// tells the running agent, which re-reads it before each command — the flag the turn was queued
+// with is only its starting value. If the API cannot take it (an older one without the route),
+// say once that it applies from the next message, rather than let the bar claim something the
+// running agent never heard.
+let editModeLiveWarnedJob = null;
+function switchEditMode() {
+  editMode = editMode === "accept" ? "manual" : "accept";
+  redrawModeLine();
+  const jobId = currentJobId;
+  if (!jobId || !apiBase || !workerKey) return;
+  fetch(`${apiBase}/api/worker/jobs/${encodeURIComponent(jobId)}/accept-edits`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", "X-Worker-Key": workerKey },
+    body: JSON.stringify({ acceptEdits: editMode === "accept" }),
+    signal: AbortSignal.timeout(10_000),
+  })
+    .then((r) => {
+      if (!r.ok) throw new Error(`HTTP ${r.status}`);
+    })
+    .catch(() => {
+      if (editModeLiveWarnedJob === jobId || currentJobId !== jobId) return;
+      editModeLiveWarnedJob = jobId;
+      process.stdout.write(
+        "\n" + GUTTER + dim("accept edits: the running agent did not get the change — it applies from your next message") + "\n"
+      );
+    });
+}
 
 // ---------- the gap between Enter and the agent (task #140) -----------------------------
 // Enter tears the bar down at once (it must: the echoed newline would otherwise land on the
@@ -3471,6 +3594,10 @@ if (process.stdin.isTTY) {
       // hover-click, so the fuller thought stays reachable with the mouse capture off (the
       // capture is what would eat the scroll wheel; see hoverMouse).
       if (key && key.ctrl && key.name === "t" && toggleActiveThought) toggleActiveThought();
+      // Shift+Tab WORKS DURING A TURN (#47). This branch used to swallow every key but Ctrl+T,
+      // so the switch did nothing while the agent was thinking — which is exactly when a user
+      // watching it reach for commands wants to change it.
+      if (key && key.name === "tab" && key.shift) switchEditMode();
       rl.line = "";
       rl.cursor = 0;
       rl.historyIndex = -1;
@@ -3501,10 +3628,7 @@ if (process.stdin.isTTY) {
     // Shift+Tab cycles the edit mode shown in the bottom bar (display-only). Skip while the
     // slash overlay owns the screen so we don't fight its redraw.
     if (key && key.name === "tab" && key.shift) {
-      if (!slashOverlayActive) {
-        editMode = editMode === "accept" ? "manual" : "accept";
-        redrawModeLine();
-      }
+      if (!slashOverlayActive) switchEditMode();
       return;
     }
     // Enter is handled by rl.on("line") — don't redraw the hint on the way out.
@@ -7521,27 +7645,65 @@ async function fetchAgentPayload(messages, codingModelOverride = "") {
     data = {};
   }
   if (!res.ok) {
-    if (res.status === 404) {
-      throw new Error(
-        "the API does not have POST /api/worker/agent-payload yet — deploy the latest API (sam build && sam deploy)."
-      );
-    }
     // Task #127 (BC1b): a present-but-INVALID worker key (rotated/revoked while worker.env
-    // kept the stale one) shows up as 401/403. Point the user at re-login rather than a
-    // generic error — we don't proactively re-validate the key, so the first rejection is
-    // where this surfaces.
-    if (res.status === 401 || res.status === 403) {
-      throw new Error(
-        "your worker key was rejected (it may have been rotated or revoked). " +
-          "Run `gu-cli login` to sign in again, or update it with " +
-          "`gu-cli set <workerKey> --api-base <url>`."
-      );
-    }
-    throw new Error(data?.error || `agent-payload failed (HTTP ${res.status})`);
+    // kept the stale one) shows up as 401/403. We don't proactively re-validate the key, so
+    // the first rejection is where this surfaces.
+    //
+    // THE MESSAGES AND THE CODES NOW LIVE IN credential-recovery.mjs (task #240), because the
+    // startup probe does more than print them: a rejected key there OFFERS THE SIGN-IN rather
+    // than exiting, and that decision must switch on a code, not on a regex over wording.
+    throw payloadError(res.status, data);
   }
   return data;
 }
 
+/**
+ * The STARTUP probe, with one way back from a rejected key (task #240).
+ *
+ * Reproduced in a clean Ubuntu container: with a key the API rejects, `gu` printed one red line
+ * and exited — every time. The first-run questions were unreachable from that state, so the only
+ * route back was `gu clear`, which also deletes chat history, workspaces, edit backups and RAG
+ * indexes. A rejected key means this machine is not connected to an account, which is the same
+ * situation a first run is for; so the sign-in is offered here, keeping everything else.
+ *
+ * EXACTLY ONE OFFER. The retry is outside the recovery, so a key that is rejected AGAIN (the
+ * account has no worker, the API is confused) falls through to the normal error and exit instead
+ * of asking in a loop.
+ *
+ * Only the startup probe recovers. The other fetchAgentPayload callers run mid-session, where a
+ * sign-in prompt would interrupt work in progress; they keep their existing error handling.
+ */
+async function probeWithRecovery() {
+  const ping = [{ role: "user", content: "ping" }];
+  try {
+    return await fetchAgentPayload(ping);
+  } catch (err) {
+    const plan = recoveryPlan({
+      code: err?.code,
+      isTty: IS_TTY,
+      clientExpert: isClientExpert(),
+    });
+    if (plan.action !== "offer-signin") throw err;
+    console.log("");
+    console.log(red(plan.lines[0]));
+    for (const line of plan.lines.slice(1)) console.log(dim(line));
+    console.log("");
+    const { deviceLogin, saveWorkerKey, DEFAULT_API_BASE } = await import("./device-login.mjs");
+    const typed = (await ask(plan.prompt)).trim();
+    const r = typed
+      ? await saveWorkerKey({
+          apiBase: apiBase || DEFAULT_API_BASE,
+          workerKey: typed,
+          log: (s) => console.log(s),
+        })
+      : await deviceLogin({ apiBase: apiBase || DEFAULT_API_BASE, log: (s) => console.log(s) });
+    // worker.env is written by those two; this process is still holding the rejected values.
+    workerKey = r.workerKey;
+    apiBase = r.apiBase;
+    return await fetchAgentPayload(ping);
+  }
+}
+
 // ---------- run one agent turn via the JOB QUEUE (the daemon executes it) ----------
 // The question is enqueued exactly like a web question, so the RUNNING
 // gu-cli daemon claims + executes it — its terminal shows the full
@@ -8254,6 +8416,12 @@ const wrapThought = (s, width, maxLines) => {
  * own conversation.
  */
 async function runAgentTurn(history, { attachJobId = "" } = {}) {
+  // #238: when the licence is ENFORCED and this account is not entitled, no turn is sent. Decided at
+  // startup (see licenceBlock) — never re-checked here, so a turn cannot die halfway through.
+  if (licenceBlock) {
+    console.log(GUTTER + orange("Not sent.") + dim(" " + licenceBlock) + "\n");
+    return;
+  }
   const attached = Boolean(attachJobId);
   inputVisible = false; // the frozen zone shows an empty prompt for the duration (#141)
   // Something on screen from the FIRST moment (task #140): Enter has just wiped the bar, and
@@ -9680,7 +9848,7 @@ async function main() {
   }
   // Show which models will answer, straight from user settings (also validates auth).
   try {
-    const probe = await fetchAgentPayload([{ role: "user", content: "ping" }]);
+    const probe = await probeWithRecovery();
     const p = probe?.payload ?? {};
     // Remember the default coder id for the token footer's global-total label, and the
     // default backend's coding URL so the GLOBAL output-token total is keyed to it (task
@@ -10075,6 +10243,12 @@ async function main() {
                 dim("\n  If that fails, check MongoDB is running and see ~/.gonext/local-api.log\n")
         );
       }
+    } else if (err?.code === "KEY_REJECTED") {
+      // WE REACHED THE API PERFECTLY WELL — it told us the key is no good (task #240). Wrapping
+      // that in "couldn't reach the API" sends the reader off debugging DNS, a proxy and their
+      // wifi for a problem the server already named. Seen in the container: a second bad key
+      // pasted at the recovery prompt produced exactly that sentence.
+      console.error(red("gu: " + err.message));
     } else {
       // The SAME bare "fetch failed" the Client Expert branch above was written to fix — that
       // one names the host and offers a next step, this one printed node's four words and
@@ -10091,6 +10265,9 @@ async function main() {
   // reason gu refuses to exit.
   void refreshAvailableUpdates();
   setInterval(() => void refreshAvailableUpdates(), UPDATE_CHECK_MS).unref();
+  // The gu token (#232): same arrangement — background, never delays the prompt, unref'd.
+  void refreshCliToken();
+  setInterval(() => void refreshCliToken(), TOKEN_TICK_MS).unref();
   // …and the other-agents count (task #195). Slower than the turn's own poll and skipped while
   // a turn runs; unref'd so a pending timer is never the reason gu refuses to exit.
   void refreshOtherAgents();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiens.nguyen/gu-cli",
-  "version": "1.0.705",
+  "version": "1.0.707",
   "description": "Gu CLI — the gu terminal plus the local worker that runs agent / OCR / PDF / embedding jobs on your Mac (Ollama / MLX / OpenAI-compatible).",
   "type": "module",
   "license": "MIT",
@@ -51,6 +51,8 @@
     "terminal-copy.mjs",
     "version-check.mjs",
     "rag-selftest.mjs",
+    "cli-token.mjs",
+    "credential-recovery.mjs",
     "device-login.mjs",
     "daemon-control.mjs",
     "poll-errors.mjs",