@tiens.nguyen/gu-cli 1.0.862 → 1.0.863

package/cli-token.mjs

@@ -275,6 +275,8 @@ export async function promptForToken({
   why = "",
   // #209: the block is the computer LIMIT (not a missing/expired plan) — a Pro token is not the way out.
   overLimit = false,
+  // #219: with overLimit, the ONE short yellow line (the long `why` is shown only on request).
+  short = "",
   // #315: a saved token must also be ENTITLED on this computer. `accept(token)` → { ok } | { ok:false, reason }
   // — the REPL renews it from this computer (to learn its free time) and runs the licence rule.
   accept = null,
@@ -283,6 +285,7 @@ export async function promptForToken({
   const dev = device === undefined ? await trialDevice().catch(() => null) : device;
   const getOne = `For a free token for 1 computer, log in at ${accountUrl} and create one — or buy Pro there for more computers.`;
   let trial, trialOk, shown, hint;
+  let details = []; // #219: the over-limit detail, printed only when the person asks ("?" or an empty Enter)
   const offer = async () => {
     trial = dev ? await claim({ hostedBase, device: dev }) : { ok: false, why: "no-device" };
     trialOk = Boolean(trial.ok && verifyCliToken(trial.token, publicKeyB64).ok);
@@ -305,12 +308,16 @@ export async function promptForToken({
         ];
     if (why) {
       const pricingUrl = `${String(site).replace(/^https?:\/\//, "")}/pricing`;
+      if (overLimit) {
+        details = [
+          why,
+          `Remove the computers you no longer use at ${accountUrl}, then start gu again — or Pro allows more computers: ${pricingUrl}`,
+          `Think this is wrong? ${SUPPORT_EMAIL}`,
+          required ? "/exit or Ctrl+C quits gu." : "Enter to skip for now.",
+        ];
+      }
       hint = overLimit
-        ? [
-            `Remove the computers you no longer use at ${accountUrl}, then start gu again — or Pro allows more computers: ${pricingUrl}`,
-            `Think this is wrong? ${SUPPORT_EMAIL}`,
-            required ? "/exit or Ctrl+C quits gu." : "Enter to skip for now.",
-          ]
+        ? [] // #219: one yellow line only — the rest is behind "?"
         : [
         // The reason (the title) already says what happened; a "trial ended on <date>" line beside it is
         // noise — and wrong for a computer that went straight to a free account and never had one.
@@ -321,7 +328,7 @@ export async function promptForToken({
     }
   };
   await offer();
-  log(why || "This computer needs a gu token before the agent can start — one time only.", "title");
+  log(overLimit && why ? `${short || why} Type ? for details.` : why || "This computer needs a gu token before the agent can start — one time only.", "title");
   const entitled = async (token) => {
     if (!accept) return true;
     const r = await accept(token).catch(() => ({ ok: true })); // unknown = soft, like every other check here
@@ -334,6 +341,12 @@ export async function promptForToken({
     // A way OUT of a required question (task #17): "/exit" is not a token, and treating it as one
     // ("That token was not saved…" and the same question again) left no way to leave gu at all.
     if (/^\/(exit|quit)$/i.test(typed)) return { ok: false, why: "quit" };
+    // #219: the over-limit detail, on request only — "?" or an empty Enter, then the same question again.
+    if (details.length && (typed === "?" || (!typed && required))) {
+      for (const l of details) log(l, "info");
+      if (!required) round--; // "?" does not use up one of the two tries
+      continue;
+    }
     if (!typed) {
       if (!required) return { ok: false, why: "skipped" };
       if (!trialOk) await offer(); // no default: maybe the service is back, or the trial exists now
@@ -754,6 +767,8 @@ export function enforcementDecision({ token, publicKeyB64, now = new Date(), sit
       enforced: true,
       allowed: false,
       reason: "over-limit",
+      // #219: the ONE short line shown first (the long `why` is the detail, shown on request).
+      short: `${planName(p.plan)} allows ${computers(p.deviceLimit)}; this account is on ${p.activeDevices}.`,
       why:
         `This account has used gu on ${computers(p.activeDevices)} in the last 30 days, and the ` +
         `${planName(p.plan)} allows ${p.deviceLimit}. Sign out of one, or remove it at ${accountUrl}.`,

package/gu-cli.mjs

@@ -1159,81 +1159,97 @@ if (args[0] === "fix-powershell") {
     process.exit(0);
   }
   const { execFileSync } = await import("node:child_process");
-  const ps = (script) =>
-    execFileSync("powershell", ["-NoProfile", "-Command", script], { encoding: "utf8" }).trim();
-
-  let profilePath = "";
-  try {
-    profilePath = ps("$PROFILE");
-  } catch (e) {
-    console.error(`  Could not ask PowerShell where your profile is: ${e.message}`);
-    process.exit(1);
-  }
-  const { readFileSync, writeFileSync, mkdirSync, existsSync } = await import("node:fs");
-  const current = existsSync(profilePath) ? readFileSync(profilePath, "utf8") : "";
-  const next = pa.profileWithFix(current);
-  // ASKED IN EVERY PATH, because "already fixed" was reported on the very machine whose policy
-  // stops the profile loading — the same "said Done, changed nothing" mistake one branch along.
-  const blockedBy = () => {
+  const runPs = (host, script) =>
+    execFileSync(host, ["-NoProfile", "-Command", script], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+    }).trim();
+
+  // EVERY installed PowerShell has its OWN profile: Windows PowerShell 5.1 (`powershell`) and
+  // PowerShell 7 (`pwsh`, VS Code's usual terminal) read different files. Asking only
+  // `powershell` wrote the fix where a pwsh terminal never looked.
+  const found = [];
+  for (const host of pa.POWERSHELL_HOSTS) {
     try {
-      return pa.profileBlockedBy(ps("Get-ExecutionPolicy"));
+      found.push({ host, profilePath: runPs(host, "$PROFILE.CurrentUserAllHosts") });
     } catch {
-      return "";
+      /* that PowerShell is not installed */
     }
-  };
-  if (next === null) {
-    console.log(`  Already fixed — ${profilePath} removes the alias.`);
-    const blocked = blockedBy();
-    if (blocked) {
-      console.log("");
-      for (const l of pa.policyAdvice(blocked)) console.log("  " + l);
-      process.exit(1);
-    }
-    console.log("  Open a NEW PowerShell window for it to take effect.");
-    process.exit(0);
   }
-  if (args.includes("--check")) {
-    console.log("  Not fixed yet. `gu` in PowerShell is still Get-Unique.");
-    const blocked = blockedBy();
-    if (blocked) for (const l of pa.policyAdvice(blocked)) console.log("  " + l);
-    console.log(`  Run:  gu-cli fix-powershell    (edits ${profilePath})`);
-    process.exit(1);
-  }
-  console.log("");
-  for (const l of pa.shadowedAdvice()) console.log("  " + l);
-  console.log("");
-  console.log(`  This appends ONE line to ${profilePath}:`);
-  console.log("    " + pa.PROFILE_LINE);
-  const rlp = (await import("node:readline")).createInterface({
-    input: process.stdin,
-    output: process.stdout,
-  });
-  const answer = await new Promise((r) => rlp.question("\n  Append it? [y/N]: ", r));
-  rlp.close();
-  if (!/^y(es)?$/i.test(String(answer).trim())) {
-    console.log("  " + pa.MEANWHILE);
-    process.exit(0);
-  }
-  try {
-    const dir = profilePath.replace(/[\\/][^\\/]*$/, "");
-    if (dir && !existsSync(dir)) mkdirSync(dir, { recursive: true });
-    writeFileSync(profilePath, next, "utf8");
-  } catch (e) {
-    console.error(`  Could not write ${profilePath}: ${e.message}`);
+  const targets = pa.uniqueProfiles(found);
+  if (targets.length === 0) {
+    console.error("  Could not ask PowerShell where your profile is (neither `powershell` nor `pwsh` answered).");
     process.exit(1);
   }
-  console.log(`  Done — ${profilePath} updated.`);
-  // VERIFY THE FIX CAN ACTUALLY RUN. Writing the line is not the same as PowerShell loading it:
-  // under Restricted or AllSigned the profile is a script it refuses to execute, and the first
-  // real run of this said "Done" to a machine where `gu` stayed shadowed.
-  const policy = blockedBy();
-  if (policy) {
+  const { readFileSync, writeFileSync, mkdirSync, existsSync } = await import("node:fs");
+  const checkOnly = args.includes("--check");
+  let rlp = null;
+  let worst = 0;
+
+  for (const { host, profilePath } of targets) {
     console.log("");
-    for (const l of pa.policyAdvice(policy)) console.log("  " + l);
-    process.exit(1);
+    console.log(`  ${pa.hostLabel(host)} — ${profilePath}`);
+    const current = existsSync(profilePath) ? readFileSync(profilePath, "utf8") : "";
+    const next = pa.profileWithFix(current);
+    // ASKED IN EVERY PATH, because "already fixed" was reported on the very machine whose policy
+    // stops the profile loading — the same "said Done, changed nothing" mistake one branch along.
+    const blockedBy = () => {
+      try {
+        return pa.profileBlockedBy(runPs(host, "Get-ExecutionPolicy"));
+      } catch {
+        return "";
+      }
+    };
+    if (next === null) {
+      console.log("  Already fixed — the profile removes the alias.");
+      const blocked = blockedBy();
+      if (blocked) {
+        for (const l of pa.policyAdvice(blocked)) console.log("  " + l);
+        worst = 1;
+      }
+      continue;
+    }
+    if (checkOnly) {
+      console.log("  Not fixed yet. `gu` in this PowerShell is still Get-Unique.");
+      const blocked = blockedBy();
+      if (blocked) for (const l of pa.policyAdvice(blocked)) console.log("  " + l);
+      worst = 1;
+      continue;
+    }
+    for (const l of pa.shadowedAdvice()) console.log("  " + l);
+    console.log(`  This appends ONE line to ${profilePath}:`);
+    console.log("    " + pa.PROFILE_LINE);
+    rlp ??= (await import("node:readline")).createInterface({
+      input: process.stdin,
+      output: process.stdout,
+    });
+    const answer = await new Promise((r) => rlp.question("\n  Append it? [y/N]: ", r));
+    if (!/^y(es)?$/i.test(String(answer).trim())) {
+      console.log("  " + pa.MEANWHILE);
+      continue;
+    }
+    try {
+      const dir = profilePath.replace(/[\\/][^\\/]*$/, "");
+      if (dir && !existsSync(dir)) mkdirSync(dir, { recursive: true });
+      writeFileSync(profilePath, next, "utf8");
+    } catch (e) {
+      console.error(`  Could not write ${profilePath}: ${e.message}`);
+      worst = 1;
+      continue;
+    }
+    console.log(`  Done — ${profilePath} updated.`);
+    // VERIFY THE FIX CAN ACTUALLY RUN. Writing the line is not the same as PowerShell loading it:
+    // under Restricted or AllSigned the profile is a script it refuses to execute, and the first
+    // real run of this said "Done" to a machine where `gu` stayed shadowed.
+    const policy = blockedBy();
+    if (policy) {
+      for (const l of pa.policyAdvice(policy)) console.log("  " + l);
+      worst = 1;
+    }
   }
-  console.log("  Open a NEW PowerShell window, then `gu` runs this CLI.");
-  process.exit(0);
+  rlp?.close();
+  if (worst === 0 && !checkOnly) console.log("\n  Open a NEW PowerShell window (in VS Code too), then `gu` runs this CLI.");
+  process.exit(worst);
 }
 
 if (args[0] === "support") {

package/gu-repl.mjs

@@ -2488,6 +2488,8 @@ async function refreshAvailableUpdates() {
  * paid to see the warning go.
  */
 let tokenNotice = null;
+/** #219: true while the token question is on screen — the bar must not repeat its warning. */
+let tokenQuestionOpen = false;
 let tokenBusy = false;
 let startupRenewDone = false;
 /**
@@ -3008,7 +3010,7 @@ function zoneNotice(width) {
   }
   if (priceUpdate) items.push({ key: "prices", clickable: true, paint: accent, text: `${priceUpdateText()} (click)` });
   if (limitsUpdate) items.push({ key: "limits", clickable: true, paint: accent, text: `${limitsUpdate.label} (click)` });
-  if (tokenNotice?.text) items.push({ key: "token", paint: tokenNotice.urgent ? yellow : dim, text: tokenNotice.text });
+  if (tokenNotice?.text && !(tokenQuestionOpen && tokenNotice.kind === "over-limit")) items.push({ key: "token", paint: tokenNotice.urgent ? yellow : dim, text: tokenNotice.text });
   const agents = agentsIndicator(otherAgents);
   if (agents) items.push({ key: "agents", clickable: true, paint: accent, text: `${agents} running (click)` });
   const shells = shellsNotice(shellEntries, { cwd: process.cwd() });
@@ -11780,13 +11782,15 @@ async function ensureTokenForTurn() {
  * (Esc does nothing), one Backspace clears the default for a paste, and a valid token turns the
  * row back into ">> ". → true once a token is saved.
  */
-async function askForCliToken(ct, dir, { why = "", overLimit = false } = {}) {
+async function askForCliToken(ct, dir, { why = "", overLimit = false, short = "" } = {}) {
   console.log("");
   tokenPromptActive = true; // Ctrl+C now quits gu (see onInterrupt) — task #17
+  tokenQuestionOpen = true;
   try {
-    return await askForCliTokenInner(ct, dir, why, overLimit);
+    return await askForCliTokenInner(ct, dir, why, overLimit, short);
   } finally {
     tokenPromptActive = false;
+    tokenQuestionOpen = false;
   }
 }
 
@@ -11804,7 +11808,7 @@ function quitFromTokenPrompt() {
   process.exit(0);
 }
 
-async function askForCliTokenInner(ct, dir, why, overLimit = false) {
+async function askForCliTokenInner(ct, dir, why, overLimit = false, short = "") {
   const hostedBase = await tokenHostedBase();
   const pk = ct.publicKey();
   const site = ct.siteUrl();
@@ -11816,6 +11820,7 @@ async function askForCliTokenInner(ct, dir, why, overLimit = false) {
     hostedBase,
     why,
     overLimit, // #209: the computer limit, not a missing plan — no "paste a Pro token"
+    short, // #219: the one short yellow line; the rest is behind "?"
     // #315: a token is only good if THIS computer may use it — renew it from here (the server then
     // says how much free time the computer has), save what came back, and run the licence rule.
     accept: async (token) => {
@@ -11893,7 +11898,7 @@ async function askTokenAtStart() {
       return;
     }
   }
-  await askForCliToken(ct, dir, { why: d.why, overLimit: d.reason === "over-limit" });
+  await askForCliToken(ct, dir, { why: d.why, overLimit: d.reason === "over-limit", short: d.short ?? "" });
 }
 /** The token refresh started at launch — askTokenAtStart waits for it (see there). */
 let startupTokenRefresh = null;

package/install-path.mjs

@@ -21,7 +21,7 @@
  *   - NEVER fail the install. Every path through this file ends in exit 0; npm treats a
  *     postinstall failure as a failed install and the user gets nothing.
  *   - NEVER run on Windows (PATH there lives in the registry, and `gu`'s PowerShell
- *     alias problem is powershell-alias.mjs's job, explicitly interactive).
+ *     alias problem is install.ps1's job (asks once) and `gu-cli fix-powershell`'s, both interactive).
  *   - NEVER touch an rc file twice: the marker pair makes re-runs no-ops.
  *   - Under `sudo npm i -g`, write to the REAL user's home (SUDO_USER) and chown the
  *     file back, or the user's next login shell reads a root-owned rc file.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiens.nguyen/gu-cli",
-  "version": "1.0.862",
+  "version": "1.0.863",
   "description": "Gu CLI — the gu terminal plus the local worker that runs agent / OCR / PDF / embedding jobs on your Mac (Ollama / MLX / OpenAI-compatible).",
   "type": "module",
   "license": "MIT",

package/powershell-alias.mjs

@@ -9,9 +9,12 @@
  * an alias beats every executable and every function we could ship. The only remedies are to
  * remove the alias from the user's profile, or to be called something else.
  *
- * So this offers the removal, EXPLICITLY and never automatically. A profile is the user's file;
- * a CLI that edits it during an install is a CLI that surprises people. `gu-cli fix-powershell`
- * asks, shows the line, and appends it — and `--check` just reports.
+ * So this offers the removal, EXPLICITLY and never silently. A profile is the user's file;
+ * a CLI that edits it unannounced is a CLI that surprises people. The Windows installer
+ * (web-v2/public/install.ps1) asks ONCE, default Yes, for every PowerShell on the machine, so a
+ * new user never meets the alias; `gu-cli fix-powershell` is the same fix for an existing install
+ * (it asks, shows the line, and appends it — `--check` just reports). Both write the ALL-HOSTS
+ * profile, which VS Code's terminal reads too.
  */
 
 /** The line appended to the profile. `-Force` because the built-in alias is read-only. */
@@ -29,6 +32,61 @@ export const PROFILE_LINE =
  */
 export const MEANWHILE = "Left alone. `gu-cli` and `gu.cmd` both run this program in the meantime.";
 
+/**
+ * The PowerShell hosts that can be installed side by side on Windows 11.
+ * `powershell` = Windows PowerShell 5.1 (built in); `pwsh` = PowerShell 7 (the default in many
+ * VS Code terminals). Each has ITS OWN profile and execution policy — fixing one leaves the other
+ * shadowed (issue #218).
+ */
+export const POWERSHELL_HOSTS = ["powershell", "pwsh"];
+
+/** The one PowerShell command that reports where a host's profiles are and its policy (3 lines). */
+export const HOST_PROBE =
+  "$PROFILE.CurrentUserAllHosts; $PROFILE.CurrentUserCurrentHost; Get-ExecutionPolicy";
+
+/** Parse HOST_PROBE output: { allHosts, currentHost, policy } (empty strings when missing). */
+export function parseHostProbe(out) {
+  const [allHosts = "", currentHost = "", policy = ""] = String(out ?? "")
+    .split(/\r?\n/)
+    .map((s) => s.trim())
+    .filter(Boolean);
+  return { allHosts, currentHost, policy };
+}
+
+/**
+ * Is ONE host fixed, and can its profile run? Fixed if either of its profile files (all-hosts or
+ * this-host, the latter where older versions wrote) already drops the alias.
+ */
+export function hostStatus({ allHostsText, currentHostText, policy }) {
+  return {
+    fixed: alreadyFixed(allHostsText) || alreadyFixed(currentHostText),
+    blocked: profileBlockedBy(policy),
+  };
+}
+
+/** A human name for a host command. */
+export function hostLabel(host) {
+  return host === "pwsh" ? "PowerShell 7 (pwsh)" : "Windows PowerShell";
+}
+
+/**
+ * The profiles to fix, one per distinct file. `found` is [{host, profilePath}] in host order;
+ * entries with an empty path are dropped, and two hosts that share a file are fixed once.
+ */
+export function uniqueProfiles(found) {
+  const seen = new Set();
+  const out = [];
+  for (const f of found ?? []) {
+    const p = String(f?.profilePath ?? "").trim();
+    if (!p) continue;
+    const key = p.toLowerCase();
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push({ host: f.host, profilePath: p });
+  }
+  return out;
+}
+
 /** True when this machine can even have the problem. */
 export function affectsThisMachine(platform = process.platform) {
   return platform === "win32";
@@ -44,7 +102,7 @@ export function shadowedAdvice() {
   return [
     "PowerShell has a built-in alias `gu` (Get-Unique) that wins over this CLI.",
     "Right now:   use `gu-cli` — or `gu.cmd`, which is this program.",
-    "Permanently: run `gu-cli fix-powershell` to drop the alias from your PowerShell profile.",
+    "Permanently: run `gu-cli fix-powershell` to drop the alias from your PowerShell profile(s) —\n              Windows PowerShell and PowerShell 7 (pwsh, the VS Code default) each have their own.",
     "cmd.exe is unaffected; `gu` works there already.",
   ];
 }