@tiens.nguyen/gu-cli 1.0.777 → 1.0.778

package/cli-token.mjs

@@ -90,7 +90,10 @@ export function verifyCliToken(token, publicKeyB64) {
     // Missing means OFF — tokens issued before the switch existed (#238) are in CLIs right now.
     !(p.enforce === undefined || typeof p.enforce === "boolean") ||
     // Missing is every token before #267; present, it must be an address.
-    !(p.email === undefined || isEmail(p.email))
+    !(p.email === undefined || isEmail(p.email)) ||
+    // #315: this computer's free time — missing = unknown, null = no limit (the owner's Mark OK).
+    !(p.freeUntil === undefined || p.freeUntil === null || isIso(p.freeUntil)) ||
+    !(p.freeAccounts === undefined || (Number.isInteger(p.freeAccounts) && p.freeAccounts >= 1))
   ) {
     return { ok: false, why: "bad-payload" };
   }
@@ -172,6 +175,13 @@ export async function claimTrial({ hostedBase, device, fetchImpl = fetch, timeou
   }
 }
 
+/** Where a person who thinks a lock is wrong can write (#315 P7) — the address the website shows. */
+export const SUPPORT_EMAIL = "support@getmarsic.cc";
+
+/** The Cursor-style line (#315 W2): matter-of-fact, never "abuse", never the other account. */
+export const FREE_USED_UP_MANY =
+  "Too many free accounts used on this computer. Its free time is used up — enter a Pro token to continue.";
+
 /** Whole days left until an ISO date (rounded up; 0 when past). */
 export function daysLeft(iso, now = new Date()) {
   const ms = Date.parse(iso ?? "") - now.getTime();
@@ -179,9 +189,10 @@ export function daysLeft(iso, now = new Date()) {
 }
 
 /** The one line a first install sees instead of a token question (#305). */
-export function trialStartedLine(endsAt, site = DEFAULT_SITE) {
+export function trialStartedLine(endsAt, site = DEFAULT_SITE, now = new Date()) {
   const accountUrl = `${String(site).replace(/^https?:\/\//, "")}/account`;
-  return `Free trial on this computer: 10 days, until ${shortDate(endsAt)}. ` +
+  const n = daysLeft(endsAt, now);
+  return `Free trial on this computer: ${n} day${n === 1 ? "" : "s"}, until ${shortDate(endsAt)}. ` +
     `Then get a free token for 1 computer at ${accountUrl} — gu token <paste> links it.`;
 }
 
@@ -198,7 +209,7 @@ export function shortToken(token) {
  * THE TOKEN QUESTION, WITH THE TRIAL AS ITS DEFAULT (#305/#76, placed by #314).
  *
  *     Input token: gu1.eyJ2IjoxLCJz…Xk9aQw          ← typed in: Enter takes it, or delete it
- *     This is a free trial token: 10 days on this computer, until 10 Oct 2026.     ← yellow, under
+ *     This is a free trial token: 30 days left on this computer, until 30 Oct 2026.  ← yellow, under
  *     For a free token for 1 computer, log in at gu.example/account and create one — or buy Pro …
  *
  * The trial is fetched first (it is the same one every time for this computer). Nothing is saved
@@ -226,6 +237,12 @@ export async function promptForToken({
   publicKeyB64 = publicKey(),
   required = false,
   maxRounds = 1000, // a bound for tests; a person answers long before this
+  // #315: WHY the question is asked when a token exists but is no longer entitled (the computer's
+  // free time is used up, the trial ended…) — replaces the "needs a token" title, adds the way on.
+  why = "",
+  // #315: a saved token must also be ENTITLED on this computer. `accept(token)` → { ok } | { ok:false, reason }
+  // — the REPL renews it from this computer (to learn its free time) and runs the licence rule.
+  accept = null,
 }) {
   const accountUrl = `${String(site).replace(/^https?:\/\//, "")}/account`;
   const dev = device === undefined ? await trialDevice().catch(() => null) : device;
@@ -236,16 +253,32 @@ export async function promptForToken({
     trialOk = Boolean(trial.ok && verifyCliToken(trial.token, publicKeyB64).ok);
     shown = trialOk ? shortToken(trial.token) : "";
     hint = trialOk
-      ? [`This is a free trial token: 10 days on this computer, until ${shortDate(trial.endsAt)}.`, getOne, "Enter uses it — or delete it (one Backspace) and paste your own token."]
+      ? [`This is a free trial token: ${daysLeft(trial.endsAt)} days left on this computer, until ${shortDate(trial.endsAt)}.`, getOne, "Enter uses it — or delete it (one Backspace) and paste your own token."]
       : [
           ...(trial.why === "used" && trial.endedAt ? [`The free trial on this computer ended on ${shortDate(trial.endedAt)}.`] : []),
           ...(trial.why === "unreachable" ? ["The gu service can't be reached right now — Enter on an empty line tries again."] : []),
           getOne,
           required ? "Paste it here, then Enter." : "Paste it here — or Enter to skip for now.",
         ];
+    if (why) {
+      const pricingUrl = `${String(site).replace(/^https?:\/\//, "")}/pricing`;
+      hint = [
+        // The reason (the title) already says what happened; a "trial ended on <date>" line beside it is
+        // noise — and wrong for a computer that went straight to a free account and never had one.
+        ...hint.filter((l) => !/^For a free token|^Paste it here|^The free trial on this computer ended/.test(l)),
+        `Get Pro at ${pricingUrl}  ·  Think this is wrong? ${SUPPORT_EMAIL}`,
+        ...(trialOk ? [] : ["Paste a Pro token here, then Enter."]),
+      ];
+    }
   };
   await offer();
-  log("This computer needs a gu token before the agent can start — one time only.", "title");
+  log(why || "This computer needs a gu token before the agent can start — one time only.", "title");
+  const entitled = async (token) => {
+    if (!accept) return true;
+    const r = await accept(token).catch(() => ({ ok: true })); // unknown = soft, like every other check here
+    if (!r.ok) log(`That token can't be used on this computer: ${r.reason}`, "warn");
+    return r.ok;
+  };
   const ask1 = () => ask("Input token: ", { prefill: shown, hint, atomic: true, noCancel: required });
   for (let round = 0; required ? round < maxRounds : round < 2; round++) {
     const typed = String((await ask1()) ?? "").trim();
@@ -256,11 +289,13 @@ export async function promptForToken({
     }
     if (trialOk && (typed === shown || typed === trial.token)) {
       await writeState(dir, { token: trial.token, lastAttemptAt: new Date().toISOString() });
-      log(`✓ free trial token saved — 10 days on this computer, until ${shortDate(trial.endsAt)}.`, "ok");
+      if (!(await entitled(trial.token))) continue;
+      log(`✓ free trial token saved — ${daysLeft(trial.endsAt)} days left on this computer, until ${shortDate(trial.endsAt)}.`, "ok");
       return { ok: true, kind: "trial" };
     }
     const saved = await saveTokenFromPaste(dir, typed, publicKeyB64);
     if (saved.ok) {
+      if (!(await entitled(typed))) continue;
       log("✓ token saved — it renews itself from now on.", "ok");
       return { ok: true, kind: "pasted" };
     }
@@ -435,6 +470,17 @@ export function barNotice({ token, publicKeyB64, mode, now = new Date(), attempt
       const left = daysLeft(p.paidUntil, now);
       return { kind: "trial", urgent: false, text: `trial · ${left} day${left === 1 ? "" : "s"} left · ${way}` };
     }
+    // FREE TIME IS THE COMPUTER'S (#315): the days left on THIS computer, and — when more than one free
+    // account uses it — that they share them (W1). Yellow once it matters: used up, shared, or two weeks left.
+    if (p.plan === "free" && typeof p.freeUntil === "string") {
+      const left = daysLeft(p.freeUntil, now);
+      const shared = Number.isInteger(p.freeAccounts) && p.freeAccounts > 1;
+      if (left === 0) return { kind: "free-used", urgent: true, text: `free time on this computer is used up · Pro at ${pricingUrl}` };
+      const days = `${left} day${left === 1 ? "" : "s"}`;
+      return shared
+        ? { kind: "free-shared", urgent: true, text: `More than one free account on this computer · they share ${days} of free time · Pro at ${pricingUrl}` }
+        : { kind: "free", urgent: left <= 14, text: `free · ${days} left on this computer · Pro at ${pricingUrl}` };
+    }
     // SHORT AND CALM (#292: "make it simpler … seems so serious"): the fact, then the one thing to
     // do. `urgent` is what the bar colours by — only these two need the user to act.
     if (ended) return { kind: "plan-ended", urgent: true, text: `Pro ended ${shortDate(p.paidUntil)} · renew at ${pricingUrl}` };
@@ -550,7 +596,17 @@ export function tokenSummary(payload, now = new Date()) {
  * TURNS — `gu login`, `gu token`, /model and every other command keep working, because the person has
  * to be able to fix it from where they are.
  */
-export function enforcementDecision({ token, publicKeyB64, now = new Date(), site = DEFAULT_SITE }) {
+/** #315 O3: how long a token may go without being renewed online before gu asks to connect. */
+export const MAX_OFFLINE_DAYS = { free: 7, trial: 7, pro: 30 };
+/** #315 O2: how far the computer's clock may run behind the server's before a token reads as "from the future". */
+export const CLOCK_SKEW_MS = 10 * 60_000;
+
+/**
+ * `deviceId` (#315 O1): THIS computer's hash, when the caller knows it. A free token checked on
+ * another computer — or never on any (a web-issued one) — says nothing about THIS computer's free
+ * time, so it needs one online check here first.
+ */
+export function enforcementDecision({ token, publicKeyB64, now = new Date(), site = DEFAULT_SITE, deviceId }) {
   if (!publicKeyB64) return { enforced: false, allowed: true, why: "" };
   const check = token ? verifyCliToken(token, publicKeyB64) : { ok: false, why: "missing" };
   // An unreadable or missing token cannot say whether enforcement is on, and this must not be a way
@@ -564,17 +620,55 @@ export function enforcementDecision({ token, publicKeyB64, now = new Date(), sit
   const pricingUrl = `${host}/pricing`;
   const accountUrl = `${host}/account`;
   const ended = p.paidUntil && Date.parse(p.paidUntil) <= now.getTime();
-  // A running free trial (#305) is entitled like Pro, for its ten days.
-  if ((p.plan !== "pro" && p.plan !== "trial") || ended) {
-    return {
-      enforced: true,
-      allowed: false,
-      why: ended && p.plan === "trial"
-        ? `The free trial on this computer ended on ${shortDate(p.paidUntil)}. Go Pro at ${pricingUrl} to keep using the agent.`
-        : ended
-        ? `Your gu Pro plan ended on ${shortDate(p.paidUntil)}. Renew at ${pricingUrl} to keep using the agent.`
-        : `gu needs a Pro plan on this account. See ${pricingUrl} — the rest of gu still works.`,
-    };
+  const blocked = (why) => ({ enforced: true, allowed: false, why });
+  // OFFLINE CANNOT UNLOCK ANYTHING (#315, the owner: "if the user cannot reach the internet or our
+  // API, it should still be blocked"). Three ways a token could otherwise outlive what it says:
+  //   O2 — the clock set back: a token "issued in the future" is not trusted;
+  const issued = Date.parse(p.issuedAt);
+  if (issued - now.getTime() > CLOCK_SKEW_MS) {
+    return blocked(
+      `This computer's clock is behind (your gu token was issued ${shortDate(p.issuedAt)}). ` +
+        "Set the correct date and time, then start gu again."
+    );
+  }
+  //   O3 — staying offline: a token must have been renewed online recently (Pro gets longer);
+  const paid = p.plan === "pro" && !ended;
+  const maxDays = paid ? MAX_OFFLINE_DAYS.pro : p.plan === "trial" ? MAX_OFFLINE_DAYS.trial : MAX_OFFLINE_DAYS.free;
+  if (now.getTime() - issued > maxDays * 86_400_000) {
+    return blocked(
+      `gu needs to check your token online — it was last checked ${shortDate(p.issuedAt)}. ` +
+        "Connect to the internet and start gu again."
+    );
+  }
+  //   O1 — a free token not yet checked on THIS computer (see the free branch below).
+  // THE TRIAL (#305): entitled for its days; after them a free account gives THIS computer 3 months.
+  if (p.plan === "trial") {
+    if (ended) {
+      return blocked(
+        `The free trial on this computer ended on ${shortDate(p.paidUntil)}. A free gu account gives it 3 months ` +
+          `more — get your token at ${accountUrl} — or go Pro at ${pricingUrl}.`
+      );
+    }
+  } else if (p.plan === "pro" && !ended) {
+    // Pro: the computer-count check below.
+  } else if (p.plan === "pro" && ended && p.freeUntil === undefined) {
+    // An old Pro token, issued while paid and not renewed since: it cannot know this computer's free time.
+    return blocked(`Your gu Pro plan ended on ${shortDate(p.paidUntil)}. Renew at ${pricingUrl} to keep using the agent.`);
+  } else {
+    // FREE (#315): the time belongs to the COMPUTER — 3 months, shared by every free account on it.
+    // O1: the token must have been renewed FROM THIS COMPUTER — a web-issued token (no device) or one
+    // copied from another computer says nothing about this one's free time. null = the owner marked
+    // this computer OK. undefined on a token renewed here = a server with no free-time store: allowed.
+    const notHere = !p.device || (deviceId && p.device !== deviceId);
+    if (notHere) return blocked("Connect to the internet once to activate this token on this computer.");
+    const fu = p.freeUntil;
+    if (fu !== undefined && fu !== null && Date.parse(fu) <= now.getTime()) {
+      return blocked(
+        Number.isInteger(p.freeAccounts) && p.freeAccounts > 1
+          ? FREE_USED_UP_MANY
+          : `The free time on this computer ended on ${shortDate(fu)} — enter a Pro token to continue.`
+      );
+    }
   }
   if (Number.isInteger(p.activeDevices) && p.activeDevices > p.deviceLimit) {
     return {

package/gu-repl.mjs

@@ -2280,9 +2280,10 @@ async function refreshCliToken() {
     }
     if (!licenceDecided) {
       licenceDecided = true;
-      const d = ct.enforcementDecision({ token: state.token, publicKeyB64: pk, site });
+      const d = ct.enforcementDecision({ token: state.token, publicKeyB64: pk, site, deviceId: await thisDeviceId(ct) });
       licenceBlock = d.enforced && !d.allowed ? d.why : null;
-      if (licenceBlock) {
+      // Private mode at a terminal: the start-up token row says it, and offers the way on (#315).
+      if (licenceBlock && !(isClientExpert() && process.stdin.isTTY)) {
         console.log("");
         console.log(GUTTER + orange("gu cannot run turns on this account.") );
         console.log(GUTTER + dim("  " + licenceBlock));
@@ -10008,32 +10009,98 @@ async function ensureTokenForTurn() {
  * (Esc does nothing), one Backspace clears the default for a paste, and a valid token turns the
  * row back into ">> ". → true once a token is saved.
  */
-async function askForCliToken(ct, dir) {
+async function askForCliToken(ct, dir, { why = "" } = {}) {
   console.log("");
-  const { DEFAULT_API_BASE } = await import("./device-login.mjs");
+  const hostedBase = await tokenHostedBase();
+  const pk = ct.publicKey();
+  const site = ct.siteUrl();
+  const deviceId = await thisDeviceId(ct);
   const r = await ct.promptForToken({
     ask: (label, opts) => ask(label, opts),
     dir,
     required: true,
-    hostedBase: String(process.env.GU_TOKEN_API_BASE ?? "").trim() || DEFAULT_API_BASE,
-    log: (l, kind) =>
-      console.log(GUTTER + (kind === "title" ? yellow(l) : kind === "ok" ? accent(l) : kind === "warn" ? yellow(l) : dim(l))),
+    hostedBase,
+    why,
+    // #315: a token is only good if THIS computer may use it — renew it from here (the server then
+    // says how much free time the computer has), save what came back, and run the licence rule.
+    accept: async (token) => {
+      const fresh = await renewFromThisComputer(ct, token, hostedBase);
+      const use = fresh ?? token;
+      if (fresh) await ct.writeState(dir, { token: fresh, lastAttemptAt: new Date().toISOString() });
+      const d = ct.enforcementDecision({ token: use, publicKeyB64: pk, site, deviceId });
+      return d.allowed ? { ok: true } : { ok: false, reason: d.why };
+    },
+    // Word-wrapped to the window: a long reason ("Too many free accounts used on this computer…")
+    // otherwise breaks mid-word at 80 columns.
+    log: (l, kind) => {
+      const paint = kind === "title" || kind === "warn" ? yellow : kind === "ok" ? accent : dim;
+      for (const row of questionHintRows([l], { width: process.stdout.columns || 80, gutter: GUTTER, paint })) console.log(row);
+    },
   });
   console.log("");
-  void refreshCliToken(); // the bar's trial line, now that there is a token to describe
+  if (r.ok) {
+    licenceBlock = null; // the row only lets an entitled token through
+    licenceDecided = true;
+  }
+  void refreshCliToken(); // the bar's line, now that there is a token to describe
   return r.ok;
 }
 
-/** At the first ">>": private mode with no usable token asks for one first (#314). */
+/** This computer's hash (#315 O1) — the same id every renewal sends — or undefined when unknown. */
+const thisDeviceId = async (ct) => (await ct.thisDevice({ instanceId: myInstanceId || "" }).catch(() => null))?.id;
+
+const tokenHostedBase = async () => {
+  const { DEFAULT_API_BASE } = await import("./device-login.mjs");
+  return String(process.env.GU_TOKEN_API_BASE ?? "").trim() || DEFAULT_API_BASE;
+};
+
+/** A renewed token for THIS computer (so the server counts it and says its free time), or null. */
+async function renewFromThisComputer(ct, token, hostedBase) {
+  const pk = ct.publicKey();
+  const device = await ct.thisDevice({ instanceId: myInstanceId || "" }).catch(() => null);
+  const r = await ct.renewToken({ mode: "expert", hostedBase, token, device }).catch(() => ({ ok: false }));
+  return r.ok && ct.verifyCliToken(r.token, pk).ok ? r.token : null;
+}
+
+/**
+ * At the first ">>" in private mode (#78, #315): no usable token → ask for one; a token this
+ * computer may no longer use (its free time is used up, the trial ended — enforcement is on by
+ * default) → the same row, saying why, and only an ENTITLED token leads to ">>".
+ */
 async function askTokenAtStart() {
   if (!isClientExpert() || !process.stdin.isTTY) return;
   const ct = await import("./cli-token.mjs");
-  if (!ct.publicKey()) return;
+  const pk = ct.publicKey();
+  if (!pk) return;
+  // The background refresh started at launch renews and WRITES the token: let it finish, or it
+  // could overwrite a token pasted here with the old one — and its answer is the freshest anyway.
+  await startupTokenRefresh?.catch(() => undefined);
   const dir = join(homedir(), ".gonext");
   const state = await ct.readState(dir);
-  if (!ct.turnNeedsToken({ privateMode: true, token: state.token })) return;
-  await askForCliToken(ct, dir);
+  if (ct.turnNeedsToken({ privateMode: true, token: state.token })) {
+    await askForCliToken(ct, dir);
+    return;
+  }
+  const site = ct.siteUrl();
+  const deviceId = await thisDeviceId(ct);
+  let d = ct.enforcementDecision({ token: state.token, publicKeyB64: pk, site, deviceId });
+  if (d.allowed) return;
+  // Before locking, ask the server once more from THIS computer: a plan paid a minute ago, or the
+  // owner's "Mark OK", arrives in a renewed token — never lock on a stale one.
+  const fresh = await renewFromThisComputer(ct, state.token, await tokenHostedBase());
+  if (fresh) {
+    await ct.writeState(dir, { token: fresh, lastAttemptAt: new Date().toISOString() });
+    d = ct.enforcementDecision({ token: fresh, publicKeyB64: pk, site, deviceId });
+    if (d.allowed) {
+      licenceBlock = null;
+      licenceDecided = true;
+      return;
+    }
+  }
+  await askForCliToken(ct, dir, { why: d.why });
 }
+/** The token refresh started at launch — askTokenAtStart waits for it (see there). */
+let startupTokenRefresh = null;
 
 async function runAgentTurn(history, { attachJobId = "", ownJob = false } = {}) {
   // #238: when the licence is ENFORCED and this account is not entitled, no turn is sent. Decided at
@@ -12122,7 +12189,7 @@ async function main() {
   void refreshAvailableUpdates();
   setInterval(() => void refreshAvailableUpdates(), UPDATE_CHECK_MS).unref();
   // The gu token (#232): same arrangement — background, never delays the prompt, unref'd.
-  void refreshCliToken();
+  startupTokenRefresh = refreshCliToken();
   setInterval(() => void refreshCliToken(), TOKEN_TICK_MS).unref();
   // …and the other-agents count (task #195). Slower than the turn's own poll and skipped while
   // a turn runs; unref'd so a pending timer is never the reason gu refuses to exit.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiens.nguyen/gu-cli",
-  "version": "1.0.777",
+  "version": "1.0.778",
   "description": "Gu CLI — the gu terminal plus the local worker that runs agent / OCR / PDF / embedding jobs on your Mac (Ollama / MLX / OpenAI-compatible).",
   "type": "module",
   "license": "MIT",