@ucsandman/legcli 0.13.1 → 0.14.0

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.14.0 (2026-09-18)
+
+The 14-day trial is back.
+
+- **Free for 14 days, no key, no card.** The first `leg <agent>` on a machine
+  starts a 14-day trial with every gate open, Team's `leg share` included, and
+  records it in `$LEG_HOME/trial.json`. `leg license status` shows the days
+  left without starting the clock. After the trial, or with a refused key once
+  it is over, a session exits 4 with the price and the 30-day guarantee, which
+  stays as the second net after buying. Deleting the file resets the clock,
+  which is the known limit of an offline trial and is accepted. The license
+  agreement gains the trial clause; the site, README, support page and
+  `llms.txt` say "free for 14 days" where they said "no trial".
+- **The README stops calling the repository private.** It has been public at
+  github.com/ucsandman/legcli; two sentences still said otherwise.
+
 ## 0.13.1 (2026-09-18)
 
 A one-line fix in the terminal and the marketing site brought up to what 0.13.0 does.

package/LICENSE

@@ -9,6 +9,8 @@ install or use Leg.
 
 1. License. When you buy a license we grant you a non-exclusive,
    non-transferable license to install and use Leg as follows.
+   Trial: before buying, one person may install and use Leg to evaluate it
+   for 14 days from its first use on a machine, on the Team terms below.
    Personal: one named person, on any number of machines that person uses.
    Team: one named person per seat purchased. A Team license also covers use
    of the shared board (leg share) by the people holding seats. A Personal

package/README.md

@@ -23,7 +23,7 @@ files and regions). `leg claude --model opus` is
 1. **A board.** Opened once in your browser, reused after that. Every Leg
    session in every terminal is a row on it, and the row's register reads
    status, repo on branch, uncommitted and unpushed counts, agent and model,
-   and how long it has been quiet: `waiting on you  baton on main  dirty 3
+   and how long it has been quiet: `waiting on you  leg on main  dirty 3
    ahead 2  claude/fable`. Under that come the prompt, the one thing worth
    knowing, the files it is touching and the usage bucket that will stop it.
    Capacity is one strip at the top rather than a region, with the login
@@ -138,8 +138,8 @@ agent name passes straight through (`leg codex -m gpt-5.3-codex-spark`,
 through unchanged, and your settings file is never edited: Leg's hooks ride
 in a separate per-session `--settings` file.
 
-The source repository is private. Leg is commercial, source-available
-software: every `.mjs` file that runs is in the package you just installed, at
+Leg is commercial, source-available software, and the source is on
+[GitHub](https://github.com/ucsandman/legcli): every `.mjs` file that runs is in the package you just installed, at
 `$(npm root -g)/legcli/src`, and the license lets you read it and modify
 your own copy. There is nothing compiled, minified or bundled to see through.
 
@@ -697,8 +697,8 @@ drift. CI waits for the Ubuntu and Windows test matrix, validates both
 when that version is missing and newer than the stable `latest`. Existing
 versions skip cleanly; older, prerelease, lockstep, and registry-error cases
 fail the job. The npm trusted publisher is bound to `ucsandman/legcli` and
-`.github/workflows/ci.yml` (bind `leg-agents` the same way). The repository
-stays private, so publication uses `--provenance=false`.
+`.github/workflows/ci.yml` (bind `leg-agents` the same way). Publication
+uses `--provenance=false`.
 
 ## Privacy and attribution
 
@@ -714,17 +714,19 @@ Leg is commercial software under the [Leg License Agreement](LICENSE).
 It ships as readable JavaScript so you can see what it does on your machine,
 and you may modify it for your own use, but not redistribute it or work
 around the license check. Versions 0.2.0 and 0.3.0 were published under MIT
-and remain available. The version in this source tree is 0.13.1; see
+and remain available. The version in this source tree is 0.14.0; see
 [npm](https://www.npmjs.com/package/legcli) for published versions and
 [CHANGELOG.md](CHANGELOG.md) for release notes.
 
-Using it needs a license: **Personal, $79 once**, one human on any number of
+The first 14 days are a **free trial**: install it, type `leg claude`, and
+everything in both plans is on, with no key and no card. The clock starts on
+your first session and `leg license status` shows what is left. After that
+it needs a license: **Personal, $79 once**, one human on any number of
 machines, every release for 12 months and the version you have keeps working
 after that; **Team, $12 per seat per month**, Personal plus `leg share` for
 more than one human on the board. Buy at the site, then
-`leg license activate <key>`. There is no trial; there is a **30-day
-money-back guarantee**, so the way to evaluate Leg is to use it on real work
-and ask for a refund if it does not earn its place. A key is a signed token
+`leg license activate <key>`. There is also a **30-day money-back
+guarantee** after buying, no reason required. A key is a signed token
 checked offline with the public key in `src/license.mjs`; only a Team key
 renewal talks to the site. The bare agent CLIs are never affected by any of
 this; only what Leg adds is licensed.

package/bin/leg.mjs

@@ -493,10 +493,11 @@ async function main() {
     // The paid gate. Keys verify offline against the public key in
     // src/license.mjs; nothing here talks to the network except refresh.
     if (!cmd || cmd === 'status') {
-      const ent = entitlement()
+      // looking does not start the trial clock; the first session does
+      const ent = entitlement({ startTrial: false })
       out(describeLicense(ent))
       if (ent.source === 'license') out(`stored at ${licensePath()}`)
-      if (!ent.ok) out(`Buy: ${BUY_URL}   then: leg license activate <key>`)
+      if (!ent.ok || ent.source === 'trial') out(`Buy: ${BUY_URL}   then: leg license activate <key>`)
       return
     }
     if (cmd === 'activate') {
@@ -508,7 +509,7 @@ async function main() {
       } catch (err) { die(2, err.message) }
       return
     }
-    if (cmd === 'deactivate') return out(deactivateLicense() ? `removed ${licensePath()}; Leg needs a key again before it will run` : 'no license was stored')
+    if (cmd === 'deactivate') return out(deactivateLicense() ? `removed ${licensePath()}; Leg is back on the trial if it has days left, otherwise it needs a key` : 'no license was stored')
     if (cmd === 'refresh') {
       try { const p = await refreshLicense(); out(`renewed ${p.plan} license ${p.id}, valid through ${p.expires}`) } catch (err) { die(2, err.message) }
       return

package/docs/DECISIONS.md

@@ -100,7 +100,7 @@ The repository stays private (see the 2026-09-11 license decision). That left ev
 ## 2026-09-11: Leg is a commercial product; the site stays on the free Vercel address
 
 - **License.** Wes: "if we're trying to sell this thing it shouldn't be open source and MIT." The repo stays private and the package ships under the Leg License Agreement (LICENSE): commercial, source readable in the package for inspection and own-use modification, no redistribution, no working around the license check. The FSL option from the pricing research was dropped for the same reason. Versions 0.2.0 and 0.3.0 remain available under MIT.
-- **Pricing.** Personal $79 once with 12 months of releases (Sublime shape); Team $12 per seat per month (adds `leg share`); no trial, and a 30-day money-back guarantee as the risk reversal instead (2026-09-15: a trial suits daily-habit products, and Leg's value is bursty, it pays off in the moment a limit lands, which a fortnight of evaluation does not reliably contain; a buyer already paying for two or three agent subscriptions is not price-sensitive at $79, they are trust-sensitive, and a trial does not answer trust). Keys are Ed25519 tokens signed with a private key that lives only in the seller's `.env` and the site's Vercel env; the public key is in `src/license.mjs`. A Personal key is a window over `RELEASE_DATE`, so every release bumps that constant.
+- **Pricing.** Personal $79 once with 12 months of releases (Sublime shape); Team $12 per seat per month (adds `leg share`); ~~no trial, and a 30-day money-back guarantee as the risk reversal instead~~ superseded 2026-09-18 (2026-09-15: a trial suits daily-habit products, and Leg's value is bursty, it pays off in the moment a limit lands, which a fortnight of evaluation does not reliably contain; a buyer already paying for two or three agent subscriptions is not price-sensitive at $79, they are trust-sensitive, and a trial does not answer trust). 2026-09-18, Wes, ahead of the Hacker News post: the 14-day trial from 0.4.0 is back, started by the first session and recorded in `$LEG_HOME/trial.json` with every gate open, and the 30-day guarantee stays as the second net after buying. A launch audience installs to look, and "buy first" on a repo they found ten minutes ago is a wall the guarantee does not lower. Keys are Ed25519 tokens signed with a private key that lives only in the seller's `.env` and the site's Vercel env; the public key is in `src/license.mjs`. A Personal key is a window over `RELEASE_DATE`, so every release bumps that constant.
 - **Checkout.** Stripe payment links (live) with automatic tax, `site/api/key` and `site/api/webhook` on Vercel functions, Resend from `legcli@practicalsystems.io`. `scripts/stripe-setup.mjs` is idempotent per site origin; a test-mode purchase was run end to end on 2026-09-11 (checkout, thanks page, key activated in the CLI, webhook 200 twice).
 - **Domain.** A `legcli.com` purchase ($11.25) was started and cancelled at Wes's "just deploy it to a free vercel site"; nothing was bought. The site is https://legcli.com/.
 - **Not a lawyer.** The license text was drafted in-session; a review before the first sale outside the US is Wes's call.
@@ -116,6 +116,7 @@ The repository stays private (see the 2026-09-11 license decision). That left ev
 - **Root Directory had to change first.** It was `.`, which is correct when deploying from inside `site/` but would have published the repo root on a git build: no `index.html`, and `api/key` and `api/webhook` gone, so a purchase in flight would not have received its key.
 - ~~**Not every push.** `site/vercel.json` carries `ignoreCommand: git diff --quiet HEAD^ HEAD .`, which Vercel maps to the Ignored Build Step. A commit that touches nothing under `site/` cancels the build. The command failing (a shallow clone with no `HEAD^`) exits non-zero, which builds, so the failure mode is a redundant deploy rather than a missed one.~~ **Superseded 2026-09-15: the failure mode was a MISSED deploy.** `HEAD^ HEAD` compares one commit, not the push. Fast-forwarding five commits to main where only the first touched `site/` left the tip with no `site/` change, so Vercel cancelled the build and the redesigned site never went out while the repo said it had. The `ignoreCommand` is removed: every push to `main` deploys the site. Vercel's own "Skip deployments when there are no changes to the root directory" toggle is the safe version of this idea, because it compares against the last deployment rather than against `HEAD^`.
 - **Agent sessions cannot do this part.** `vercel --prod` and `vercel git connect` are both denied by the harness classifier as production deploys, and the CLI auth token cannot be read. Wes ran both.
+- **2026-09-18: the git deploy did not fire, and the manual fallback has two traps.** The push of 0.13.1 (`19667ba`) produced no `vercel[bot]` deployment on GitHub (commit status stayed `pending`, no statuses), while the pushes an hour earlier had; the account had an overdue invoice at the time, which is the likeliest cause, and the git integration should be re-checked in the Vercel dashboard after a rename (the GitHub repository was renamed since the connection was made; `git remote -v` has the current name and the project still says `baton`). The fallback that works, run from the **repo root**, not `site/`: a root `.vercel/project.json` copied from `site/.vercel/` (gitignored), a root `.vercelignore` of `*`, `!site`, `!site/**`, `site/.vercel`, `site/.env*`, then `vercel --prod --yes --archive=tgz`. Trap one: `vercel --prod --yes` from inside `site/` uploads `site/` as the root, Vercel applies Root Directory `site` on top of it, and the deployment errors with an empty message. Trap two: that same `--yes` auto-linked the repo root to a **new** Vercel project named `leg` (empty, no domain); it is junk and `vercel project rm leg` removes it. Trap three: with no `.vercelignore` the CLI uploads the untracked probe debris too and refuses at 15,000 files.
 
 
 ## 2026-09-15: the board is a dark product surface, and DESIGN.md was the defect

package/docs/ERRORS.md

@@ -3,6 +3,28 @@
 What broke, why, and what fixed it. One entry per failure, newest first. A first
 occurrence has to be written down or a repeat is never countable.
 
+## 2026-09-18: 0.14.0 pushed, CI green everywhere, and npm still served 0.13.1
+
+**Fixed by putting the `repository` block back into the lockfile root
+(`packages[""]`) and pushing again.** `scripts/npm-publish-gate.mjs` requires
+`package-lock.json`'s root `repository.url` to equal the trusted-publisher
+binding, and npm 10.9 (the local install) does not write that block; npm 11
+does, which is where the 0.13.1 lockfile got it. `npm version 0.14.0` on npm
+10 rewrote the lockfile without it, the test matrix and the site deploy passed,
+and only the `publish-npm` job failed, on the gate, before publishing anything.
+The lesson: a lockfile touched by a different npm major is a release change,
+and "CI green" after a push means the run, not the publish; `npm view
+@ucsandman/legcli version` is the check.
+
+## 2026-09-18: `vercel --prod --yes` from `site/` failed the deploy and created a stray Vercel project
+
+**Fixed by deploying from the repo root with a root `.vercelignore` and
+`--archive=tgz`; the recipe is in DECISIONS.md under "the site deploys itself
+from git".** The `--yes` also auto-created an empty Vercel project named `leg`
+that still needs `vercel project rm leg`. The lesson: on a project with a Root
+Directory set, the CLI must run from the repo root, and `--yes` is a consent to
+create projects, not only to skip a confirmation.
+
 ## 2026-09-18: the terminal's opening `next:` line named the same agent twice and no model
 
 **Fixed in `src/attach.mjs`: the line maps the chain through `rungLabel`, so it

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ucsandman/legcli",
-  "version": "0.13.1",
-  "description": "Usage-limit monitor and automatic handoff for Claude Code, Codex, agy and Grok. Type leg claude|codex|agy|grok and get the same interactive agent with a board alongside, auto-approve on by default, usage tracking per agent and account, a live context handoff bundle, and at the limit the next agent continuing in the same terminal. $79 once, 30-day money-back guarantee.",
+  "version": "0.14.0",
+  "description": "Usage-limit monitor and automatic handoff for Claude Code, Codex, agy and Grok. Type leg claude|codex|agy|grok and get the same interactive agent with a board alongside, auto-approve on by default, usage tracking per agent and account, a live context handoff bundle, and at the limit the next agent continuing in the same terminal. 14-day free trial, then $79 once, 30-day money-back guarantee.",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://legcli.com",

package/src/board/board.js

@@ -68,7 +68,7 @@
   // release lands on disk under a board that was started before it: the page
   // then draws controls the process has no routes for (an empty agent select,
   // no buckets). test/files-version.test.mjs pins this to package.json.
-  const FILES_VERSION = '0.13.1'
+  const FILES_VERSION = '0.14.0'
   const TIMELINE_CAP = 12
   // mirrors LOOPBACK in src/auth.mjs; state.bind is "<host>:<port>" and an IPv6
   // host arrives bracketed

package/src/board/floor.js

@@ -50,7 +50,7 @@
   // name. test/board-updates.test.mjs pins `state.stopped` in this file by
   // source text, which is why the module object keeps the name.
   // pinned to package.json by test/files-version.test.mjs; see board.js FILES_VERSION
-  const FILES_VERSION = '0.13.1'
+  const FILES_VERSION = '0.14.0'
   const state = { es: null, retryMs: 1000, timers: [], stopped: false, sseRequest: 0, floorRequest: 0, trunkRequest: 0, headRequest: 0, cardsRequest: 0, lastReadingAt: null, bind: (typeof location !== 'undefined' && location.host) || '127.0.0.1:4747', pendingFloor: null, pendingCards: null, cards: new Map(), blockers: new Map(), doneOpen: false, ringId: null, scheduler: {}, trunkOff: false }
 
   // What the entry row reads on every render: the terminals (for the repo it

package/src/license.mjs

@@ -8,10 +8,11 @@
 //   team      per-seat subscription; the key carries an expiry a few days past
 //             the billing period, `leg license refresh` fetches a renewed one
 //
-// There is no trial. Leg pays off in the moment a limit lands mid-flow, which
-// is not a thing a fortnight of evaluation reliably contains; the risk reversal
-// is a 30-day money-back guarantee instead, which costs no code and no expiry
-// machinery. Key shape: LEG-<base64url payload>.<base64url signature> (legacy
+// Before any key there is a 14-day trial, started the first time a session
+// asks and recorded under $LEG_HOME/trial.json with every gate open. Deleting
+// that file resets the clock; that is a known and accepted limit of an offline
+// trial. Past the trial, or with a refused key, Leg needs a license; the risk
+// reversal after buying is a 30-day money-back guarantee. Key shape: LEG-<base64url payload>.<base64url signature> (legacy
 // BATON- prefix still accepted) where the signature is Ed25519 over the payload
 // bytes exactly as encoded.
 import { createPublicKey, createPrivateKey, verify as cryptoVerify, sign as cryptoSign, createHash } from 'node:crypto'
@@ -29,11 +30,13 @@ export const PUBLIC_KEY_B64 = 'MCowBQYDK2VwAyEAIpVQymHHJAkIrZHv0u4o0bgfFmtW3Crm7
 const ACTIVE_PUBLIC_KEY = process.env.LEG_PUBLIC_KEY_B64 || process.env.BATON_PUBLIC_KEY_B64 || PUBLIC_KEY_B64
 // The date this release was cut. A personal key activates when this is on or
 // before its updates_until. Bumped with every published version.
-export const RELEASE_DATE = '2026-09-16'
+export const RELEASE_DATE = '2026-09-18'
+export const TRIAL_DAYS = 14
 export const GUARANTEE_DAYS = 30
 export const SITE = process.env.LEG_SITE || process.env.BATON_SITE || 'https://legcli.com'
 export const BUY_URL = `${SITE}/#pricing`
 export const PLANS = {
+  trial: { label: 'Trial', gates: ['run', 'share'] },
   personal: { label: 'Personal', gates: ['run'] },
   team: { label: 'Team', gates: ['run', 'share'] },
 }
@@ -86,6 +89,7 @@ export function verifyLicense(key, { publicKeyB64 = ACTIVE_PUBLIC_KEY, today = i
 }
 
 export function licensePath() { return join(home(), 'license.json') }
+export function trialPath() { return join(home(), 'trial.json') }
 
 function readJson(f) { try { return JSON.parse(readFileSync(f, 'utf8')) } catch { return null } }
 function writeJson(f, obj) {
@@ -114,14 +118,30 @@ export function deactivate() {
   return had
 }
 
-// What this machine may do right now: a valid key, or nothing, with the reason
-// the stored key (if any) was refused.
-export function entitlement({ today = isoToday(), releaseDate = RELEASE_DATE } = {}) {
+// The trial starts the first time something asks with start on (a session;
+// `leg license status` asks with it off, so looking does not start the clock).
+export function trial({ today = isoToday(), start = true } = {}) {
+  let t = readJson(trialPath())
+  if (!t?.started && start) { t = { started: today }; writeJson(trialPath(), t) }
+  if (!t?.started) return { started: null, daysLeft: TRIAL_DAYS, expired: false }
+  const used = Math.floor((Date.parse(today) - Date.parse(t.started)) / 86400000)
+  const daysLeft = Math.max(0, TRIAL_DAYS - used)
+  return { started: t.started, daysLeft, expired: used >= TRIAL_DAYS || used < 0 }
+}
+
+// What this machine may do right now. A valid key wins; otherwise the trial;
+// otherwise nothing, with the reason the stored key (if any) was refused.
+export function entitlement({ today = isoToday(), releaseDate = RELEASE_DATE, startTrial = true } = {}) {
   const lic = readLicense()
-  if (!lic) return { ok: false, plan: 'none', reason: 'no-license', refused: null }
-  const v = verifyLicense(lic.key, { today, releaseDate })
-  if (v.ok) return { ok: true, plan: v.payload.plan, seats: v.payload.seats ?? 1, payload: v.payload, source: 'license' }
-  return { ok: false, plan: 'none', reason: v.reason, refused: v.reason }
+  let refused = null
+  if (lic) {
+    const v = verifyLicense(lic.key, { today, releaseDate })
+    if (v.ok) return { ok: true, plan: v.payload.plan, seats: v.payload.seats ?? 1, payload: v.payload, source: 'license' }
+    refused = v.reason
+  }
+  const t = trial({ today, start: startTrial })
+  if (!t.expired) return { ok: true, plan: 'trial', started: t.started, daysLeft: t.daysLeft, source: 'trial', refused }
+  return { ok: false, plan: 'none', reason: refused ?? 'trial-expired', refused }
 }
 
 export function allows(ent, gate) {
@@ -136,13 +156,18 @@ export function explain(reason, payload) {
     case 'unknown-plan': return `the key names a plan this version does not know (${payload?.plan})`
     case 'personal-updates-ended': return `this Personal key covers releases up to ${payload?.updates_until}; this release is dated ${RELEASE_DATE}. Keep the version you have, or renew at ${BUY_URL}`
     case 'team-expired': return `this Team key expired on ${payload?.expires}; run "leg license refresh" (the subscription renews it) or see ${BUY_URL}`
-    case 'no-license': return `Leg needs a license key. Buy one at ${BUY_URL} (${GUARANTEE_DAYS}-day money-back guarantee), then: leg license activate <key>`
+    case 'trial-expired': return `the ${TRIAL_DAYS}-day trial has ended; Leg needs a license key. Buy one at ${BUY_URL} (${GUARANTEE_DAYS}-day money-back guarantee), then: leg license activate <key>`
     default: return String(reason)
   }
 }
 
 export function describe(ent) {
   if (!ent.ok) return `no license: ${explain(ent.reason)}`
+  if (ent.plan === 'trial') {
+    const note = ent.refused ? ` (stored key refused: ${ent.refused})` : ''
+    if (!ent.started) return `${TRIAL_DAYS}-day trial, not started; it starts with your first leg <agent>${note}`
+    return `${TRIAL_DAYS}-day trial, ${ent.daysLeft} day${ent.daysLeft === 1 ? '' : 's'} left; buy at ${BUY_URL}${note}`
+  }
   const p = ent.payload
   const until = p.plan === 'personal' ? `updates through ${p.updates_until}` : `renews; valid through ${p.expires}`
   return `${PLANS[p.plan].label} license ${p.id}${p.seats > 1 ? `, ${p.seats} seats` : ''}, ${until}`