@tiens.nguyen/gu-cli 1.0.706 → 1.0.707

package/cli-token.mjs

@@ -86,11 +86,13 @@ export function verifyCliToken(token, publicKeyB64) {
     (p.issuedBy !== "refresh" && p.issuedBy !== "account" && p.issuedBy !== "admin") ||
     !(p.device === null || (typeof p.device === "string" && /^[0-9a-f]{64}$/.test(p.device))) ||
     !(p.activeDevices === null || (Number.isInteger(p.activeDevices) && p.activeDevices >= 0)) ||
-    !(Number.isInteger(p.deviceLimit) && p.deviceLimit > 0)
+    !(Number.isInteger(p.deviceLimit) && p.deviceLimit > 0) ||
+    // Missing means OFF — tokens issued before the switch existed (#238) are in CLIs right now.
+    !(p.enforce === undefined || typeof p.enforce === "boolean")
   ) {
     return { ok: false, why: "bad-payload" };
   }
-  return { ok: true, payload: p };
+  return { ok: true, payload: { ...p, enforce: p.enforce === true } };
 }
 
 // ---------------------------------------------------------------------------
@@ -251,7 +253,7 @@ export function barNotice({ token, publicKeyB64, mode, now = new Date(), attempt
     if (Number.isInteger(p.activeDevices) && p.activeDevices > p.deviceLimit) {
       return {
         kind: "over-limit",
-        text: `gu is active on ${p.activeDevices} computers — ${p.plan === "pro" ? "Pro" : "Free"} covers ${p.deviceLimit}`,
+        text: `gu is active on ${p.activeDevices} devices — ${p.plan === "pro" ? "Pro" : "Free"} covers ${p.deviceLimit}`,
       };
     }
     const age = now.getTime() - Date.parse(p.issuedAt);
@@ -277,9 +279,63 @@ export function tokenSummary(payload, now = new Date()) {
   }
   if (Number.isInteger(payload.activeDevices)) {
     const n = payload.activeDevices;
-    lines.push(`Active on ${n} ${n === 1 ? "computer" : "computers"} in the last 30 days — ${payload.plan === "pro" ? "Pro" : "Free"} covers ${payload.deviceLimit}.`);
+    lines.push(`Active on ${n} ${n === 1 ? "device" : "devices"} in the last 30 days — ${payload.plan === "pro" ? "Pro" : "Free"} covers ${payload.deviceLimit}.`);
   }
   lines.push(`Issued ${shortDate(payload.issuedAt)}.`);
   return lines;
 }
 
+// ---------------------------------------------------------------------------
+// ENFORCEMENT (#238) — decided ONCE, when gu starts
+// ---------------------------------------------------------------------------
+
+/**
+ * May this session send turns?
+ *
+ * The switch lives on the server and rides in the token (payload.enforce). This is read ONCE at
+ * startup, by the owner's requirement — a session that began is never interrupted by a later renewal,
+ * and nothing asks the network again per turn.
+ *
+ * WITH THE SWITCH OFF (the default and what ships today) the answer is always yes: the licence stays
+ * soft — barNotice() says its one line and nothing is blocked.
+ *
+ * WITH IT ON, a session may send turns when the token is valid, the plan is Pro, its paid time has not
+ * run out, and the account is within its computer limit. Otherwise gu says why and refuses to SEND
+ * TURNS — `gu login`, `gu token`, /model and every other command keep working, because the person has
+ * to be able to fix it from where they are.
+ */
+export function enforcementDecision({ token, publicKeyB64, now = new Date(), site = DEFAULT_SITE }) {
+  if (!publicKeyB64) return { enforced: false, allowed: true, why: "" };
+  const check = token ? verifyCliToken(token, publicKeyB64) : { ok: false, why: "missing" };
+  // An unreadable or missing token cannot say whether enforcement is on, and this must not be a way
+  // to switch it off by deleting a file — but it is also not a reason to block someone whose server
+  // has enforcement OFF. Unknown means soft, exactly like a server that cannot be reached.
+  if (!check.ok) return { enforced: false, allowed: true, why: "" };
+  const p = check.payload;
+  if (!p.enforce) return { enforced: false, allowed: true, why: "" };
+
+  const host = site.replace(/^https?:\/\//, "");
+  const pricingUrl = `${host}/pricing`;
+  const accountUrl = `${host}/account`;
+  const ended = p.paidUntil && Date.parse(p.paidUntil) <= now.getTime();
+  if (p.plan !== "pro" || ended) {
+    return {
+      enforced: true,
+      allowed: false,
+      why: ended
+        ? `Your gu Pro plan ended on ${shortDate(p.paidUntil)}. Renew at ${pricingUrl} to keep using the agent.`
+        : `gu needs a Pro plan on this account. See ${pricingUrl} — the rest of gu still works.`,
+    };
+  }
+  if (Number.isInteger(p.activeDevices) && p.activeDevices > p.deviceLimit) {
+    return {
+      enforced: true,
+      allowed: false,
+      why:
+        `This account is active on ${p.activeDevices} devices and Pro covers ${p.deviceLimit}. ` +
+        `Sign out of one, or remove it at ${accountUrl}.`,
+    };
+  }
+  return { enforced: true, allowed: true, why: "" };
+}
+

package/credential-recovery.mjs

@@ -0,0 +1,82 @@
+/**
+ * WHEN THE CREDENTIALS ON THIS MACHINE NO LONGER WORK (task #240).
+ *
+ * THE DEAD END THIS EXISTS TO CLOSE, reproduced in a clean Ubuntu container: a machine whose
+ * ~/.gonext/worker.env holds a key the API rejects (rotated, revoked, pasted from another
+ * account, or written by the wizard for a different server) could not reach the first-run flow
+ * at all. `gu` printed one red line and exited — every time, forever. The questions a first run
+ * asks were unreachable, and the only route back was `gu clear`, which is a RESET: it deletes
+ * conversation history, registered workspaces, deploy targets, the agent's edit backups and the
+ * RAG indexes. Reported as "first run question doesn't appear … I then needed gu clear then gu
+ * again", and that is exactly what the user had been driven to.
+ *
+ * A REJECTED KEY IS THE SAME SITUATION AS NO KEY. Both mean this machine is not connected to an
+ * account, and the answer to both is the sign-in that the first run already offers. So gu offers
+ * it here too, in place, keeping everything else on the machine.
+ *
+ * WHY A MODULE AND NOT AN `if` IN THE REPL: so the rule can be called by a test. The conduct
+ * being pinned is "which situations offer a sign-in", and open-coded it could only be guarded by
+ * a regex over gu-repl.mjs — which pins the WORDING and lets the conduct change underneath.
+ *
+ * THE CODE, NOT THE WORDING, decides. payloadError() stamps `code` on the error the API call
+ * throws; nothing downstream matches on the message text, which is free to be reworded.
+ */
+
+/** The error an agent-payload call failed with, carrying a code the recovery can switch on. */
+export function payloadError(status, data) {
+  const message = (data && typeof data === "object" && data.error) || "";
+  if (status === 404) {
+    const e = new Error(
+      "the API does not have POST /api/worker/agent-payload yet — deploy the latest API (sam build && sam deploy)."
+    );
+    e.code = "API_TOO_OLD";
+    return e;
+  }
+  // 401/403: the key is present and WRONG. We never re-validate a stored key proactively, so
+  // this is where a rotated or revoked one surfaces — the first thing gu does on startup.
+  if (status === 401 || status === 403) {
+    const e = new Error(
+      "your worker key was rejected (it may have been rotated or revoked). " +
+        "Run `gu login` to sign in again, or update it with `gu set <workerKey> --api-base <url>`."
+    );
+    e.code = "KEY_REJECTED";
+    return e;
+  }
+  const e = new Error(message || `agent-payload failed (HTTP ${status})`);
+  e.code = "API_ERROR";
+  return e;
+}
+
+/**
+ * What should happen when the startup probe fails?
+ *
+ *   "offer-signin" — ask, here and now, and carry on with the session when it works.
+ *   "report"       — print what is wrong and stop. The caller's existing message.
+ *
+ * ONLY a rejected key, and only with somebody there to answer. A network failure is not a
+ * credential problem (the key may be perfect and the wifi off), and a pipe or CI job has nobody
+ * at the keyboard — offering there would hang a script on a prompt no one can see, which is the
+ * failure mode that made `gu` unusable in the deploy app's stages.
+ *
+ * NOT ON A CLIENT EXPERT MACHINE. Its API is local and issues its own key; a hosted device-login
+ * there points the terminal away from the very stack it was set up to use. The same reasoning
+ * that made first-run setup skip the sign-in after Client Expert applies to the recovery.
+ */
+export function recoveryPlan({ code, isTty, clientExpert } = {}) {
+  if (code !== "KEY_REJECTED") return { action: "report" };
+  if (!isTty) return { action: "report" };
+  if (clientExpert) return { action: "report" };
+  return {
+    action: "offer-signin",
+    // What it says matters as much as that it asks: someone who has just been told their key is
+    // bad needs to know that answering will not cost them their work.
+    lines: [
+      "gu: this machine's worker key was rejected — it may have been rotated or revoked.",
+      "  Sign in again to reconnect this machine to an account.",
+      "  Nothing else is touched: your folders, chat history and RAG indexes stay as they are.",
+    ],
+    // UN-INDENTED, like every other ask() caller: ask() insets by the gutter itself, and a
+    // prompt carrying its own spaces comes out sitting two columns right of every other question.
+    prompt: "worker key (or Enter to sign in): ",
+  };
+}

package/gu-repl.mjs

@@ -137,6 +137,9 @@ import { REQUIRED_AGENT_MODEL, REQUIRED_AGENT_PREFIX, REQUIRED_EMBED_MODEL } fro
 // plain SGR code: terminals disagree about colour, so accent.mjs picks 24-bit, 256 or the
 // sixteen-colour magenta from what this one actually claims to support.
 import { accent } from "./accent.mjs";
+// Task #240: what a failed agent-payload call means, and when a rejected key may be recovered
+// from in place instead of ending the session.
+import { payloadError, recoveryPlan } from "./credential-recovery.mjs";
 import { isNoCodeRetry, splitVerboseLine, stepHasCode } from "./verbose-lines.mjs";
 import {
   createTranscript,
@@ -1863,6 +1866,13 @@ async function refreshAvailableUpdates() {
 let tokenNotice = null;
 let tokenBusy = false;
 let startupRenewDone = false;
+/**
+ * THE ENFORCEMENT DECISION (#238) — taken ONCE, on the first refresh after gu starts, and never
+ * revisited. The owner's requirement: check when gu starts, not repeatedly. A session already running
+ * is never cut off by a switch flipped elsewhere, and a later renewal only updates the bar's line.
+ */
+let licenceBlock = null;
+let licenceDecided = false;
 async function refreshCliToken() {
   if (tokenBusy) return;
   tokenBusy = true;
@@ -1902,6 +1912,17 @@ async function refreshCliToken() {
       await ct.writeState(dir, state).catch(() => {});
       tokenNotice = noticeNow();
     }
+    if (!licenceDecided) {
+      licenceDecided = true;
+      const d = ct.enforcementDecision({ token: state.token, publicKeyB64: pk, site });
+      licenceBlock = d.enforced && !d.allowed ? d.why : null;
+      if (licenceBlock) {
+        console.log("");
+        console.log(GUTTER + orange("gu cannot run turns on this account.") );
+        console.log(GUTTER + dim("  " + licenceBlock));
+        console.log(GUTTER + dim("  Everything else still works: /model, gu token, gu login.") + "\n");
+      }
+    }
   } catch {
     /* never a reason to disturb a session */
   } finally {
@@ -7624,27 +7645,65 @@ async function fetchAgentPayload(messages, codingModelOverride = "") {
     data = {};
   }
   if (!res.ok) {
-    if (res.status === 404) {
-      throw new Error(
-        "the API does not have POST /api/worker/agent-payload yet — deploy the latest API (sam build && sam deploy)."
-      );
-    }
     // Task #127 (BC1b): a present-but-INVALID worker key (rotated/revoked while worker.env
-    // kept the stale one) shows up as 401/403. Point the user at re-login rather than a
-    // generic error — we don't proactively re-validate the key, so the first rejection is
-    // where this surfaces.
-    if (res.status === 401 || res.status === 403) {
-      throw new Error(
-        "your worker key was rejected (it may have been rotated or revoked). " +
-          "Run `gu-cli login` to sign in again, or update it with " +
-          "`gu-cli set <workerKey> --api-base <url>`."
-      );
-    }
-    throw new Error(data?.error || `agent-payload failed (HTTP ${res.status})`);
+    // kept the stale one) shows up as 401/403. We don't proactively re-validate the key, so
+    // the first rejection is where this surfaces.
+    //
+    // THE MESSAGES AND THE CODES NOW LIVE IN credential-recovery.mjs (task #240), because the
+    // startup probe does more than print them: a rejected key there OFFERS THE SIGN-IN rather
+    // than exiting, and that decision must switch on a code, not on a regex over wording.
+    throw payloadError(res.status, data);
   }
   return data;
 }
 
+/**
+ * The STARTUP probe, with one way back from a rejected key (task #240).
+ *
+ * Reproduced in a clean Ubuntu container: with a key the API rejects, `gu` printed one red line
+ * and exited — every time. The first-run questions were unreachable from that state, so the only
+ * route back was `gu clear`, which also deletes chat history, workspaces, edit backups and RAG
+ * indexes. A rejected key means this machine is not connected to an account, which is the same
+ * situation a first run is for; so the sign-in is offered here, keeping everything else.
+ *
+ * EXACTLY ONE OFFER. The retry is outside the recovery, so a key that is rejected AGAIN (the
+ * account has no worker, the API is confused) falls through to the normal error and exit instead
+ * of asking in a loop.
+ *
+ * Only the startup probe recovers. The other fetchAgentPayload callers run mid-session, where a
+ * sign-in prompt would interrupt work in progress; they keep their existing error handling.
+ */
+async function probeWithRecovery() {
+  const ping = [{ role: "user", content: "ping" }];
+  try {
+    return await fetchAgentPayload(ping);
+  } catch (err) {
+    const plan = recoveryPlan({
+      code: err?.code,
+      isTty: IS_TTY,
+      clientExpert: isClientExpert(),
+    });
+    if (plan.action !== "offer-signin") throw err;
+    console.log("");
+    console.log(red(plan.lines[0]));
+    for (const line of plan.lines.slice(1)) console.log(dim(line));
+    console.log("");
+    const { deviceLogin, saveWorkerKey, DEFAULT_API_BASE } = await import("./device-login.mjs");
+    const typed = (await ask(plan.prompt)).trim();
+    const r = typed
+      ? await saveWorkerKey({
+          apiBase: apiBase || DEFAULT_API_BASE,
+          workerKey: typed,
+          log: (s) => console.log(s),
+        })
+      : await deviceLogin({ apiBase: apiBase || DEFAULT_API_BASE, log: (s) => console.log(s) });
+    // worker.env is written by those two; this process is still holding the rejected values.
+    workerKey = r.workerKey;
+    apiBase = r.apiBase;
+    return await fetchAgentPayload(ping);
+  }
+}
+
 // ---------- run one agent turn via the JOB QUEUE (the daemon executes it) ----------
 // The question is enqueued exactly like a web question, so the RUNNING
 // gu-cli daemon claims + executes it — its terminal shows the full
@@ -8357,6 +8416,12 @@ const wrapThought = (s, width, maxLines) => {
  * own conversation.
  */
 async function runAgentTurn(history, { attachJobId = "" } = {}) {
+  // #238: when the licence is ENFORCED and this account is not entitled, no turn is sent. Decided at
+  // startup (see licenceBlock) — never re-checked here, so a turn cannot die halfway through.
+  if (licenceBlock) {
+    console.log(GUTTER + orange("Not sent.") + dim(" " + licenceBlock) + "\n");
+    return;
+  }
   const attached = Boolean(attachJobId);
   inputVisible = false; // the frozen zone shows an empty prompt for the duration (#141)
   // Something on screen from the FIRST moment (task #140): Enter has just wiped the bar, and
@@ -9783,7 +9848,7 @@ async function main() {
   }
   // Show which models will answer, straight from user settings (also validates auth).
   try {
-    const probe = await fetchAgentPayload([{ role: "user", content: "ping" }]);
+    const probe = await probeWithRecovery();
     const p = probe?.payload ?? {};
     // Remember the default coder id for the token footer's global-total label, and the
     // default backend's coding URL so the GLOBAL output-token total is keyed to it (task
@@ -10178,6 +10243,12 @@ async function main() {
                 dim("\n  If that fails, check MongoDB is running and see ~/.gonext/local-api.log\n")
         );
       }
+    } else if (err?.code === "KEY_REJECTED") {
+      // WE REACHED THE API PERFECTLY WELL — it told us the key is no good (task #240). Wrapping
+      // that in "couldn't reach the API" sends the reader off debugging DNS, a proxy and their
+      // wifi for a problem the server already named. Seen in the container: a second bad key
+      // pasted at the recovery prompt produced exactly that sentence.
+      console.error(red("gu: " + err.message));
     } else {
       // The SAME bare "fetch failed" the Client Expert branch above was written to fix — that
       // one names the host and offers a next step, this one printed node's four words and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiens.nguyen/gu-cli",
-  "version": "1.0.706",
+  "version": "1.0.707",
   "description": "Gu CLI — the gu terminal plus the local worker that runs agent / OCR / PDF / embedding jobs on your Mac (Ollama / MLX / OpenAI-compatible).",
   "type": "module",
   "license": "MIT",
@@ -52,6 +52,7 @@
     "version-check.mjs",
     "rag-selftest.mjs",
     "cli-token.mjs",
+    "credential-recovery.mjs",
     "device-login.mjs",
     "daemon-control.mjs",
     "poll-errors.mjs",