codexuse-cli 5.0.9 → 5.1.1

package/dist/index.js

@@ -2022,7 +2022,7 @@ var require_toml = __commonJS({
 });
 
 // src/commands/accountPool.ts
-var import_node_crypto4 = require("crypto");
+var import_node_crypto7 = require("crypto");
 var import_node_path7 = __toESM(require("path"));
 
 // ../../packages/contracts/src/settings/types.ts
@@ -2366,7 +2366,7 @@ async function withDatabase(dbPath, task) {
 function resolveAppStorageDbPath(userDataDir) {
   return import_node_path.default.join(userDataDir, APP_STORAGE_DB_DIR, APP_STORAGE_DB_NAME);
 }
-async function readDocument(dbPath, namespace, normalize) {
+async function readDocument(dbPath, namespace, normalize2) {
   return withDatabase(dbPath, (db) => {
     const row = useStatement(
       db,
@@ -2377,10 +2377,10 @@ async function readDocument(dbPath, namespace, normalize) {
     if (parsed === null) {
       return null;
     }
-    return normalize(parsed);
+    return normalize2(parsed);
   });
 }
-async function readDocumentStrict(dbPath, namespace, normalize) {
+async function readDocumentStrict(dbPath, namespace, normalize2) {
   return withDatabase(dbPath, (db) => {
     const row = useStatement(
       db,
@@ -2401,7 +2401,7 @@ async function readDocumentStrict(dbPath, namespace, normalize) {
       );
     }
     try {
-      return normalize(parsed);
+      return normalize2(parsed);
     } catch (error) {
       throw new AppStorageCorruptionError(
         `App storage document ${namespace} failed normalization.`,
@@ -2480,6 +2480,25 @@ async function updateDocument(input) {
     })
   );
 }
+async function deleteDocument(dbPath, namespace) {
+  await withWriteQueue(
+    dbPath,
+    async () => withDatabase(dbPath, (db) => {
+      beginImmediate(db);
+      try {
+        useStatement(
+          db,
+          `DELETE FROM ${APP_STORAGE_TABLE} WHERE namespace = ?`,
+          (statement) => statement.run(namespace)
+        );
+        commit(db);
+      } catch (error) {
+        rollback(db);
+        throw error;
+      }
+    })
+  );
+}
 
 // ../../packages/runtime-app-state/src/app/state.ts
 var APP_STATE_DOCUMENT = "desktop.app-state";
@@ -2564,6 +2583,16 @@ function createDefaultAppState() {
       status: "inactive",
       signature: null
     },
+    trial: {
+      deviceId: null,
+      startedAt: null,
+      expiresAt: null,
+      lastServerCheckAt: null,
+      lastLocalSeenAt: null,
+      offlineGraceUntil: null,
+      serverExpired: false,
+      signature: null
+    },
     preferences: {
       excludeFolders: [],
       enableTaskCompleteBeep: true,
@@ -3011,6 +3040,25 @@ function normalizeAppState(raw) {
   if (!["inactive", "active", "grace", "error"].includes(merged.license.status)) {
     merged.license.status = "inactive";
   }
+  if (!isRecord2(merged.trial)) {
+    merged.trial = clone2(defaults.trial);
+  }
+  merged.trial.deviceId = asString(merged.trial.deviceId);
+  merged.trial.startedAt = asString(merged.trial.startedAt);
+  merged.trial.expiresAt = asString(merged.trial.expiresAt);
+  merged.trial.lastServerCheckAt = asString(merged.trial.lastServerCheckAt);
+  merged.trial.lastLocalSeenAt = asString(merged.trial.lastLocalSeenAt);
+  merged.trial.offlineGraceUntil = asString(merged.trial.offlineGraceUntil);
+  merged.trial.serverExpired = merged.trial.serverExpired === true;
+  merged.trial.signature = asString(merged.trial.signature);
+  {
+    const allowedTrialKeys = new Set(Object.keys(defaults.trial));
+    for (const key of Object.keys(merged.trial)) {
+      if (!allowedTrialKeys.has(key)) {
+        delete merged.trial[key];
+      }
+    }
+  }
   if (!Array.isArray(merged.preferences.excludeFolders)) {
     merged.preferences.excludeFolders = [];
   }
@@ -3416,7 +3464,7 @@ async function writeAppSettings(settings, onUpdated) {
 }
 
 // ../../packages/runtime-profiles/src/license/service.ts
-var import_node_crypto2 = __toESM(require("crypto"), 1);
+var import_node_crypto5 = __toESM(require("crypto"), 1);
 
 // ../../packages/runtime-codex/src/codex/settings.ts
 function asString2(value) {
@@ -3459,6 +3507,53 @@ function parseStoredLicense(raw) {
   );
   return hasValue ? license : null;
 }
+function parseStoredTrial(raw) {
+  if (!isRecord3(raw)) {
+    return null;
+  }
+  const trial = {
+    deviceId: asString2(raw.deviceId ?? raw.device_id),
+    startedAt: asString2(raw.startedAt ?? raw.started_at),
+    expiresAt: asString2(raw.expiresAt ?? raw.expires_at),
+    lastServerCheckAt: asString2(raw.lastServerCheckAt ?? raw.last_server_check_at),
+    lastLocalSeenAt: asString2(raw.lastLocalSeenAt ?? raw.last_local_seen_at),
+    offlineGraceUntil: asString2(raw.offlineGraceUntil ?? raw.offline_grace_until),
+    serverExpired: raw.serverExpired === true || raw.server_expired === true,
+    signature: asString2(raw.signature)
+  };
+  const hasValue = Boolean(
+    trial.deviceId || trial.startedAt || trial.expiresAt || trial.lastServerCheckAt || trial.lastLocalSeenAt || trial.serverExpired || trial.signature
+  );
+  return hasValue ? trial : null;
+}
+async function getStoredTrial() {
+  const state = await getAppState();
+  return parseStoredTrial(state.trial);
+}
+async function persistTrial(trial) {
+  const parsed = parseStoredTrial(trial);
+  await patchAppState({
+    trial: parsed ? {
+      deviceId: parsed.deviceId ?? null,
+      startedAt: parsed.startedAt ?? null,
+      expiresAt: parsed.expiresAt ?? null,
+      lastServerCheckAt: parsed.lastServerCheckAt ?? null,
+      lastLocalSeenAt: parsed.lastLocalSeenAt ?? null,
+      offlineGraceUntil: parsed.offlineGraceUntil ?? null,
+      serverExpired: parsed.serverExpired === true,
+      signature: parsed.signature ?? null
+    } : {
+      deviceId: null,
+      startedAt: null,
+      expiresAt: null,
+      lastServerCheckAt: null,
+      lastLocalSeenAt: null,
+      offlineGraceUntil: null,
+      serverExpired: false,
+      signature: null
+    }
+  });
+}
 async function getStoredLicense() {
   const state = await getAppState();
   return parseStoredLicense(state.license);
@@ -3590,7 +3685,9 @@ function getActiveOffer() {
     isActive: true,
     campaign: "summer-2026",
     productPermalink: "codex-use",
-    checkoutBaseUrl: "https://hweihwang.gumroad.com/l/codex-use"
+    checkoutBaseUrl: "https://hweihwang.gumroad.com/l/codex-use",
+    trialEnabled: true,
+    trialDays: 7
   };
 }
 function buildCheckoutUrl(offer2, options) {
@@ -3613,6 +3710,504 @@ function buildCheckoutUrl(offer2, options) {
   return url.toString();
 }
 
+// ../../packages/runtime-profiles/src/license/trial.ts
+var import_node_crypto4 = __toESM(require("crypto"), 1);
+
+// ../../packages/runtime-profiles/src/license/device-id.ts
+var import_node_crypto2 = __toESM(require("crypto"), 1);
+var import_promises = require("fs/promises");
+var import_node_child_process = require("child_process");
+var import_node_util = require("util");
+var DEVICE_ID_DOCUMENT = "desktop.device-id";
+var SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/i;
+var execFileAsync = (0, import_node_util.promisify)(import_node_child_process.execFile);
+var memoizedDeviceId = null;
+function normalize(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+async function readHardwareUuid() {
+  if (process.platform !== "darwin") {
+    return null;
+  }
+  try {
+    const { stdout } = await execFileAsync(
+      "ioreg",
+      ["-rd1", "-c", "IOPlatformExpertDevice"],
+      { timeout: 4e3 }
+    );
+    const match = stdout.match(/"IOPlatformUUID"\s*=\s*"([^"]+)"/);
+    return normalize(match?.[1]) || null;
+  } catch {
+    return null;
+  }
+}
+async function readLinuxMachineId() {
+  if (process.platform !== "linux") {
+    return null;
+  }
+  for (const file of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
+    try {
+      const value = normalize(await (0, import_promises.readFile)(file, "utf8"));
+      if (value) {
+        return value;
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+function hashDeviceComponent(value) {
+  return import_node_crypto2.default.createHash("sha256").update(`codexuse-device:${value}`).digest("hex");
+}
+async function getDeviceId() {
+  if (memoizedDeviceId) {
+    return memoizedDeviceId;
+  }
+  const dbPath = resolveAppStorageDbPath(getUserDataDir());
+  const cached = normalize(await readDocument(dbPath, DEVICE_ID_DOCUMENT, normalize));
+  const stableDeviceSource = await readHardwareUuid() ?? await readLinuxMachineId();
+  if (stableDeviceSource) {
+    const deviceId2 = hashDeviceComponent(stableDeviceSource);
+    if (cached !== deviceId2) {
+      await writeDocument(dbPath, DEVICE_ID_DOCUMENT, deviceId2);
+    }
+    memoizedDeviceId = deviceId2;
+    return deviceId2;
+  }
+  if (SHA256_HEX_PATTERN.test(cached)) {
+    memoizedDeviceId = cached;
+    return cached;
+  }
+  const seed = import_node_crypto2.default.randomBytes(32).toString("hex");
+  const deviceId = hashDeviceComponent(seed);
+  await writeDocument(dbPath, DEVICE_ID_DOCUMENT, deviceId);
+  memoizedDeviceId = deviceId;
+  return deviceId;
+}
+function hashEmail(email) {
+  const normalized = typeof email === "string" ? email.trim().toLowerCase() : "";
+  if (!normalized) {
+    return null;
+  }
+  return import_node_crypto2.default.createHash("sha256").update(`codexuse-email:${normalized}`).digest("hex");
+}
+
+// ../../packages/runtime-profiles/src/license/trial-client.ts
+var DEFAULT_API_BASE_URL = "https://api.codexuse.com";
+var TRIAL_REQUEST_TIMEOUT_MS = 1e4;
+function getApiBaseUrl() {
+  return DEFAULT_API_BASE_URL;
+}
+function parseResponse(raw) {
+  if (!raw || typeof raw !== "object") {
+    return null;
+  }
+  const record = raw;
+  const serverNow = typeof record.serverNow === "string" ? record.serverNow : null;
+  if (!serverNow) {
+    return null;
+  }
+  return {
+    trialActive: record.trialActive === true,
+    startedAt: typeof record.startedAt === "string" ? record.startedAt : null,
+    expiresAt: typeof record.expiresAt === "string" ? record.expiresAt : null,
+    trialToken: typeof record.trialToken === "string" ? record.trialToken : null,
+    serverNow,
+    offlineGraceMs: typeof record.offlineGraceMs === "number" && Number.isFinite(record.offlineGraceMs) ? record.offlineGraceMs : 0
+  };
+}
+async function registerTrialWithServer(input) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), TRIAL_REQUEST_TIMEOUT_MS);
+  try {
+    const response = await fetch(`${getApiBaseUrl()}/v1/trial/register`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        deviceId: input.deviceId,
+        emailHash: input.emailHash ?? null,
+        trialToken: input.trialToken ?? null
+      }),
+      signal: controller.signal
+    });
+    if (!response.ok) {
+      throw new Error(`Trial registration failed (${response.status}).`);
+    }
+    const parsed = parseResponse(await response.json());
+    if (!parsed) {
+      throw new Error("Trial registration response was incomplete.");
+    }
+    return parsed;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+// ../../packages/runtime-profiles/src/license/trial-token-store.ts
+var import_node_crypto3 = require("crypto");
+var import_node_child_process2 = require("child_process");
+var KEYCHAIN_SERVICE = "CODEXUSE_TRIAL_TOKEN";
+var KEYCHAIN_ACCOUNT_PREFIX = "device-sha256:";
+var FALLBACK_DOCUMENT_PREFIX = "desktop.trial-token.";
+function keychainAccountForDevice(deviceId) {
+  const digest = (0, import_node_crypto3.createHash)("sha256").update(deviceId).digest("hex");
+  return KEYCHAIN_ACCOUNT_PREFIX + digest;
+}
+function fallbackDocumentForDevice(deviceId) {
+  const digest = (0, import_node_crypto3.createHash)("sha256").update(deviceId).digest("hex");
+  return FALLBACK_DOCUMENT_PREFIX + digest;
+}
+function normalizeToken(value) {
+  const trimmed = typeof value === "string" ? value.trim() : "";
+  return trimmed.length > 0 ? trimmed : null;
+}
+function runSecurityCommand(args) {
+  return new Promise((resolve, reject) => {
+    const child = (0, import_node_child_process2.spawn)("security", args, { stdio: ["ignore", "pipe", "ignore"] });
+    let stdout = "";
+    child.stdout?.on("data", (chunk) => {
+      stdout += String(chunk);
+    });
+    child.on("error", () => {
+      reject(new Error("keychain-command-failed"));
+    });
+    child.on("close", (code) => {
+      resolve({ code, stdout });
+    });
+  });
+}
+async function readStoredTrialToken(deviceId) {
+  if (process.platform !== "darwin") {
+    const dbPath = resolveAppStorageDbPath(getUserDataDir());
+    return readDocument(
+      dbPath,
+      fallbackDocumentForDevice(deviceId),
+      normalizeToken
+    );
+  }
+  const result = await runSecurityCommand([
+    "find-generic-password",
+    "-a",
+    keychainAccountForDevice(deviceId),
+    "-s",
+    KEYCHAIN_SERVICE,
+    "-w"
+  ]).catch(() => null);
+  await deleteDocument(
+    resolveAppStorageDbPath(getUserDataDir()),
+    fallbackDocumentForDevice(deviceId)
+  ).catch(() => void 0);
+  if (!result || result.code !== 0) {
+    return null;
+  }
+  return result.stdout.length > 0 ? result.stdout.replace(/\n$/, "") : null;
+}
+async function writeStoredTrialToken(deviceId, token) {
+  const value = typeof token === "string" ? token.trim() : "";
+  if (!value) {
+    return;
+  }
+  if (process.platform !== "darwin") {
+    const dbPath = resolveAppStorageDbPath(getUserDataDir());
+    await writeDocument(
+      dbPath,
+      fallbackDocumentForDevice(deviceId),
+      value
+    );
+    return;
+  }
+  const result = await runSecurityCommand([
+    "add-generic-password",
+    "-U",
+    "-a",
+    keychainAccountForDevice(deviceId),
+    "-s",
+    KEYCHAIN_SERVICE,
+    "-w",
+    value
+  ]).catch(() => null);
+  await deleteDocument(
+    resolveAppStorageDbPath(getUserDataDir()),
+    fallbackDocumentForDevice(deviceId)
+  ).catch(() => void 0);
+  if (!result || result.code !== 0) {
+    throw new Error("trial-token-keychain-write-failed");
+  }
+}
+
+// ../../packages/runtime-profiles/src/license/trial.ts
+var DAY_MS = 24 * 60 * 60 * 1e3;
+var TRIAL_SERVER_REFRESH_MS = 15 * 60 * 1e3;
+var TRIAL_BACKGROUND_RETRY_MS = 60 * 1e3;
+var CLOCK_ROLLBACK_TOLERANCE_MS = 5 * 60 * 1e3;
+var verifiedTrialCache = null;
+var backgroundTrialSyncPromise = null;
+var nextBackgroundTrialSyncAtMs = 0;
+function isTrialEnforcementEnabled() {
+  return true;
+}
+function trialSignaturePayload(trial) {
+  return JSON.stringify({
+    deviceId: trial.deviceId ?? null,
+    startedAt: trial.startedAt ?? null,
+    expiresAt: trial.expiresAt ?? null,
+    lastServerCheckAt: trial.lastServerCheckAt ?? null,
+    lastLocalSeenAt: trial.lastLocalSeenAt ?? null,
+    offlineGraceUntil: trial.offlineGraceUntil ?? null,
+    serverExpired: trial.serverExpired === true
+  });
+}
+function signTrial(trial, secret) {
+  return import_node_crypto4.default.createHmac("sha256", secret).update(trialSignaturePayload(trial)).digest("hex");
+}
+function withTrialSignature(trial, secret) {
+  return { ...trial, signature: signTrial(trial, secret) };
+}
+function isSignatureValid(trial, secret) {
+  return Boolean(trial.signature) && signTrial(trial, secret) === trial.signature;
+}
+function parseTs(value) {
+  if (typeof value !== "string" || value.trim() === "") {
+    return null;
+  }
+  const parsed = Date.parse(value);
+  return Number.isNaN(parsed) ? null : parsed;
+}
+function buildTrialInfo(stored, now) {
+  const expiresAtMs = parseTs(stored?.expiresAt);
+  const expired = stored?.serverExpired === true || expiresAtMs === null || expiresAtMs <= now;
+  const daysLeft = expired || expiresAtMs === null ? 0 : Math.max(0, Math.ceil((expiresAtMs - now) / DAY_MS));
+  return {
+    active: !expired,
+    expired,
+    expiresAt: stored?.expiresAt ?? null,
+    daysLeft
+  };
+}
+function buildLockedTrialInfo(stored) {
+  return {
+    active: false,
+    expired: true,
+    expiresAt: stored?.expiresAt ?? null,
+    daysLeft: 0
+  };
+}
+function hasTrustedServerRecord(stored, secret, deviceId) {
+  return Boolean(
+    stored && stored.deviceId === deviceId && stored.startedAt && stored.lastServerCheckAt && isSignatureValid(stored, secret)
+  );
+}
+function shouldRefreshInBackground(stored, now) {
+  const lastServerCheckMs = parseTs(stored.lastServerCheckAt);
+  return lastServerCheckMs !== null && now - lastServerCheckMs >= TRIAL_SERVER_REFRESH_MS;
+}
+function hasLocalClockRollback(stored, now) {
+  const lastTrustedMs = Math.max(
+    parseTs(stored.lastLocalSeenAt) ?? 0,
+    parseTs(stored.lastServerCheckAt) ?? 0
+  );
+  return lastTrustedMs > 0 && now + CLOCK_ROLLBACK_TOLERANCE_MS < lastTrustedMs;
+}
+function canUseOfflineTrial(stored, now) {
+  if (stored.serverExpired === true || hasLocalClockRollback(stored, now)) {
+    return false;
+  }
+  const expiresAtMs = parseTs(stored.expiresAt);
+  const offlineGraceUntilMs = parseTs(stored.offlineGraceUntil);
+  const effectiveNow = trustedTrialNow(stored, now);
+  if (expiresAtMs === null || offlineGraceUntilMs === null) {
+    return false;
+  }
+  return effectiveNow < expiresAtMs && effectiveNow <= offlineGraceUntilMs;
+}
+function trustedTrialNow(stored, now) {
+  return Math.max(now, parseTs(stored.lastServerCheckAt) ?? now);
+}
+async function persistLocalSeenIfNeeded(stored, secret, now) {
+  const lastLocalSeenMs = parseTs(stored.lastLocalSeenAt);
+  if (lastLocalSeenMs !== null && now - lastLocalSeenMs < TRIAL_SERVER_REFRESH_MS) {
+    return stored;
+  }
+  const next = withTrialSignature(
+    {
+      ...stored,
+      lastLocalSeenAt: new Date(Math.max(now, lastLocalSeenMs ?? 0)).toISOString()
+    },
+    secret
+  );
+  await persistTrial(next);
+  return next;
+}
+function startTrialSyncInBackground() {
+  const now = Date.now();
+  if (backgroundTrialSyncPromise || now < nextBackgroundTrialSyncAtMs) {
+    return;
+  }
+  nextBackgroundTrialSyncAtMs = now + TRIAL_BACKGROUND_RETRY_MS;
+  backgroundTrialSyncPromise = syncTrialWithServer({ force: true }).catch(() => false).finally(() => {
+    backgroundTrialSyncPromise = null;
+  });
+}
+async function resolveFirstProfileEmailHash() {
+  try {
+    const state = await getAppState();
+    for (const record of Object.values(state.profilesByName ?? {})) {
+      const hashed = hashEmail(record.email ?? null);
+      if (hashed) {
+        return hashed;
+      }
+    }
+  } catch {
+  }
+  return null;
+}
+function signedServerTrial(input) {
+  const serverNowMs = parseTs(input.response.serverNow) ?? input.now;
+  return withTrialSignature(
+    {
+      deviceId: input.deviceId,
+      startedAt: input.response.startedAt ?? input.stored?.startedAt ?? new Date(serverNowMs).toISOString(),
+      expiresAt: input.response.expiresAt ?? input.stored?.expiresAt ?? null,
+      lastServerCheckAt: input.response.serverNow,
+      lastLocalSeenAt: new Date(input.now).toISOString(),
+      offlineGraceUntil: new Date(serverNowMs + input.response.offlineGraceMs).toISOString(),
+      serverExpired: input.response.trialActive === false
+    },
+    input.secret
+  );
+}
+async function syncAndPersistTrial(input) {
+  let deviceId;
+  try {
+    deviceId = await getDeviceId();
+  } catch {
+    return null;
+  }
+  const emailHash = input.emailHash ?? await resolveFirstProfileEmailHash();
+  try {
+    const trialToken = await readStoredTrialToken(deviceId).catch(() => null);
+    const response = await registerTrialWithServer({ deviceId, emailHash, trialToken });
+    if (response.trialToken) {
+      try {
+        await writeStoredTrialToken(deviceId, response.trialToken);
+      } catch {
+        if (!trialToken) {
+          return null;
+        }
+      }
+    }
+    const next = signedServerTrial({
+      response,
+      secret: input.secret,
+      stored: input.stored,
+      now: input.now,
+      deviceId
+    });
+    await persistTrial(next);
+    rememberServerVerifiedTrial(next, input.now);
+    return next;
+  } catch {
+    return null;
+  }
+}
+function rememberServerVerifiedTrial(stored, now) {
+  const refreshAtMs = now + TRIAL_SERVER_REFRESH_MS;
+  const expiresAtMs = stored.serverExpired === true ? refreshAtMs : parseTs(stored.expiresAt) ?? now;
+  verifiedTrialCache = {
+    stored,
+    usableUntilMs: Math.max(now, Math.min(expiresAtMs, refreshAtMs))
+  };
+}
+function readServerVerifiedTrial(now) {
+  if (!verifiedTrialCache || verifiedTrialCache.usableUntilMs <= now) {
+    verifiedTrialCache = null;
+    return null;
+  }
+  return verifiedTrialCache.stored;
+}
+async function resolveTrialState(now = Date.now(), options = {}) {
+  if (!isTrialEnforcementEnabled()) {
+    return { info: null, locked: false };
+  }
+  const allowNetwork = options.allowNetwork !== false;
+  const secret = await getLicenseSecret();
+  let stored = await getStoredTrial();
+  const hadStoredTrial = stored !== null;
+  const currentDeviceId = await getDeviceId().catch(() => null);
+  const cached = readServerVerifiedTrial(now);
+  if (cached) {
+    if (!currentDeviceId || !hasTrustedServerRecord(cached, secret, currentDeviceId)) {
+      verifiedTrialCache = null;
+    } else {
+      if (hasLocalClockRollback(cached, now)) {
+        const refreshed2 = allowNetwork ? await syncAndPersistTrial({ stored: cached, secret, now }) : null;
+        if (!refreshed2) {
+          return { info: buildLockedTrialInfo(cached), locked: true };
+        }
+        const info3 = buildTrialInfo(refreshed2, trustedTrialNow(refreshed2, now));
+        return { info: info3, locked: info3.expired };
+      }
+      if (shouldRefreshInBackground(cached, now)) {
+        void syncTrialWithServer({ force: true }).catch(() => void 0);
+      }
+      const info2 = buildTrialInfo(cached, trustedTrialNow(cached, now));
+      return { info: info2, locked: info2.expired };
+    }
+  }
+  if (stored && (!currentDeviceId || !hasTrustedServerRecord(stored, secret, currentDeviceId))) {
+    stored = null;
+  }
+  if (!allowNetwork) {
+    if (stored && canUseOfflineTrial(stored, now)) {
+      const next = await persistLocalSeenIfNeeded(stored, secret, now).catch(() => stored);
+      rememberServerVerifiedTrial(next, now);
+      if (options.refreshInBackground === true && shouldRefreshInBackground(next, now)) {
+        startTrialSyncInBackground();
+      }
+      const info2 = buildTrialInfo(next, trustedTrialNow(next, now));
+      return { info: info2, locked: info2.expired };
+    }
+    if (options.refreshInBackground === true) {
+      startTrialSyncInBackground();
+    }
+    if (!hadStoredTrial && options.refreshInBackground === true) {
+      return { info: null, locked: false };
+    }
+    return { info: buildLockedTrialInfo(stored), locked: true };
+  }
+  const refreshed = await syncAndPersistTrial({ stored, secret, now });
+  if (!refreshed) {
+    if (stored && canUseOfflineTrial(stored, now)) {
+      const next = await persistLocalSeenIfNeeded(stored, secret, now).catch(() => stored);
+      rememberServerVerifiedTrial(next, now);
+      const info2 = buildTrialInfo(next, trustedTrialNow(next, now));
+      return { info: info2, locked: info2.expired };
+    }
+    return { info: buildLockedTrialInfo(stored), locked: true };
+  }
+  const info = buildTrialInfo(refreshed, trustedTrialNow(refreshed, now));
+  return { info, locked: info.expired };
+}
+async function syncTrialWithServer(opts = {}) {
+  if (!isTrialEnforcementEnabled()) {
+    return true;
+  }
+  const now = Date.now();
+  const secret = await getLicenseSecret();
+  const stored = await getStoredTrial();
+  const explicitEmailHash = opts.emailHash ?? null;
+  if (!opts.force && !explicitEmailHash && readServerVerifiedTrial(now)) {
+    return true;
+  }
+  const next = await syncAndPersistTrial({
+    stored,
+    secret,
+    now,
+    emailHash: explicitEmailHash
+  });
+  return next !== null;
+}
+
 // ../../packages/runtime-profiles/src/license/service.ts
 var offer = getActiveOffer();
 var PRODUCT_PERMALINK = offer.productPermalink;
@@ -3677,7 +4272,7 @@ function licenseSignaturePayload(license) {
   return JSON.stringify(payload);
 }
 function signLicense(license, secret) {
-  return import_node_crypto2.default.createHmac("sha256", secret).update(licenseSignaturePayload(license)).digest("hex");
+  return import_node_crypto5.default.createHmac("sha256", secret).update(licenseSignaturePayload(license)).digest("hex");
 }
 function withSignature(license, secret) {
   return {
@@ -3685,7 +4280,7 @@ function withSignature(license, secret) {
     signature: signLicense(license, secret)
   };
 }
-function isSignatureValid(license, secret) {
+function isSignatureValid2(license, secret) {
   if (!license.signature) {
     return false;
   }
@@ -3763,6 +4358,47 @@ function ensureWithinUseLimit(response) {
     );
   }
 }
+function computeCapabilities(opts) {
+  return {
+    unlimitedProfiles: opts.entitled,
+    accountPool: opts.entitled,
+    telegram: opts.entitled,
+    autoRoll: opts.entitled,
+    cloudSync: opts.licensed || opts.entitled
+  };
+}
+function applyTrial(base, trial) {
+  if (base.isPro) {
+    return { ...base, trial: null };
+  }
+  const { info, locked } = trial;
+  if (!info) {
+    return base;
+  }
+  if (info.active) {
+    return {
+      ...base,
+      tier: "trial",
+      state: "trial",
+      capabilities: computeCapabilities({ licensed: false, entitled: true }),
+      profileLimit: null,
+      profilesRemaining: null,
+      trial: info
+    };
+  }
+  if (locked) {
+    return {
+      ...base,
+      tier: "free",
+      state: "locked",
+      capabilities: computeCapabilities({ licensed: false, entitled: false }),
+      profileLimit: 0,
+      profilesRemaining: 0,
+      trial: info
+    };
+  }
+  return { ...base, trial: info };
+}
 function toLicenseStatus(stored, overrides = {}) {
   const tier = determineTierFromStored(stored);
   const isPro = tier === "pro";
@@ -3771,6 +4407,8 @@ function toLicenseStatus(stored, overrides = {}) {
     tier,
     state,
     isPro,
+    capabilities: computeCapabilities({ licensed: isPro, entitled: isPro }),
+    trial: null,
     profileLimit: isPro ? null : FREE_PROFILE_LIMIT,
     profilesRemaining: null,
     purchaseEmail: stored?.purchaseEmail ?? null,
@@ -3812,15 +4450,27 @@ var LicenseService = class {
     const refreshInBackground = Boolean(options.refreshInBackground);
     const secret = await getLicenseSecret();
     const stored = await getStoredLicense();
+    const finalize = async (status) => {
+      if (status.isPro) {
+        return { ...status, trial: null };
+      }
+      return applyTrial(
+        status,
+        await resolveTrialState(Date.now(), {
+          allowNetwork: !allowStale || forceRefresh,
+          refreshInBackground
+        })
+      );
+    };
     if (!stored?.licenseKey) {
-      return toLicenseStatus(null);
+      return finalize(toLicenseStatus(null));
     }
     const now = Date.now();
     const nextCheckTs = parseTimestamp(stored.nextCheckAt);
     const lastVerifiedTs = parseTimestamp(stored.lastVerifiedAt);
     const graceStale = (stored.status === "grace" || stored.status === "error") && (lastVerifiedTs === null || lastVerifiedTs + GRACE_MAX_AGE_MS < now);
     let workingStored = { ...stored };
-    const signatureValid = isSignatureValid(workingStored, secret);
+    const signatureValid = isSignatureValid2(workingStored, secret);
     let cappedNextCheckTs = nextCheckTs;
     if (nextCheckTs !== null && nextCheckTs > now + MAX_NEXT_CHECK_MS) {
       cappedNextCheckTs = now;
@@ -3843,7 +4493,7 @@ var LicenseService = class {
       if (allowStale && shouldRefresh && refreshInBackground) {
         this.refreshStatusInBackground({ force: forceRefresh });
       }
-      return cached;
+      return finalize(cached);
     }
     if (this.verificationPromise && !forceRefresh) {
       return this.verificationPromise;
@@ -3863,7 +4513,7 @@ var LicenseService = class {
         };
         const signed = withSignature(updated, secret);
         await persistLicense(signed);
-        return toLicenseStatus(signed);
+        return finalize(toLicenseStatus(signed));
       } catch (error) {
         const message = error instanceof Error ? error.message : "License verification failed.";
         if (error instanceof LicenseError && error.code === "network") {
@@ -3881,7 +4531,7 @@ var LicenseService = class {
             state: fallbackStored2.status ?? "grace",
             error: message
           });
-          return fallback;
+          return finalize(fallback);
         }
         const fallbackStored = withSignature({
           licenseKey: workingStored.licenseKey,
@@ -3892,7 +4542,7 @@ var LicenseService = class {
           lastVerificationError: message
         }, secret);
         await persistLicense(fallbackStored);
-        return toLicenseStatus(fallbackStored, { error: message });
+        return finalize(toLicenseStatus(fallbackStored, { error: message }));
       }
     };
     this.verificationPromise = verify();
@@ -3908,7 +4558,7 @@ var LicenseService = class {
       throw new Error("License key is required.");
     }
     const secret = await getLicenseSecret();
-    const digest = import_node_crypto2.default.createHash("sha256").update(trimmed).digest("hex");
+    const digest = import_node_crypto5.default.createHash("sha256").update(trimmed).digest("hex");
     const result = await requestGumroadVerify(trimmed, "activation");
     ensureWithinUseLimit(result);
     const normalized = normalizeVerificationResult(result);
@@ -3950,9 +4600,28 @@ var LicenseService = class {
   }
 };
 var licenseService = new LicenseService();
+function isExplicitInvalidation(message) {
+  if (!message) {
+    return false;
+  }
+  const normalized = message.toLowerCase();
+  return normalized.includes("revoked") || normalized.includes("refunded") || normalized.includes("invalid") || normalized.includes("no longer active");
+}
+function shouldEnforceProfileLimit(status) {
+  if (status.capabilities.unlimitedProfiles) {
+    return false;
+  }
+  if (status.state === "grace" || status.state === "verifying" || status.state === "error") {
+    return false;
+  }
+  if (isExplicitInvalidation(status.error)) {
+    return true;
+  }
+  return status.state === "inactive" || status.state === "locked";
+}
 
 // ../../packages/runtime-profiles/src/profiles/profile-manager.ts
-var import_node_crypto3 = require("crypto");
+var import_node_crypto6 = require("crypto");
 var import_fs = require("fs");
 var import_path = __toESM(require("path"), 1);
 var import_path2 = require("path");
@@ -4005,7 +4674,7 @@ function resolveProfileIdentityKeyFromProfile(profile) {
 }
 
 // ../../packages/runtime-codex/src/codex/rpc.ts
-var import_node_child_process2 = require("child_process");
+var import_node_child_process4 = require("child_process");
 var import_node_readline = __toESM(require("readline"), 1);
 var import_node_fs3 = require("fs");
 var import_node_os2 = __toESM(require("os"), 1);
@@ -4137,7 +4806,7 @@ async function requireCodexCli() {
 }
 
 // ../../packages/runtime-codex/src/codex/command.ts
-var import_node_child_process = require("child_process");
+var import_node_child_process3 = require("child_process");
 var import_node_path4 = __toESM(require("path"), 1);
 var cachedNodeRuntime = null;
 function isJavaScriptEntrypoint(binaryPath) {
@@ -4180,7 +4849,7 @@ function resolveNodeRuntime(env) {
     )
   );
   for (const candidate of candidates) {
-    const probe = (0, import_node_child_process.spawnSync)(candidate, ["-v"], { env: runtimeEnv, stdio: "ignore" });
+    const probe = (0, import_node_child_process3.spawnSync)(candidate, ["-v"], { env: runtimeEnv, stdio: "ignore" });
     if (!probe.error && probe.status === 0) {
       cachedNodeRuntime = candidate;
       return candidate;
@@ -4862,7 +5531,7 @@ function parseRateLimitSnapshotFromOAuthUsage(value) {
   }
   return {
     lastUpdated: (/* @__PURE__ */ new Date()).toISOString(),
-    source: "codex-oauth",
+    source: "codex-oauth-estimate",
     ...primary ? { primary } : {},
     ...secondary ? { secondary } : {},
     ...extraWindows.length > 0 ? { extraWindows } : {}
@@ -5059,7 +5728,7 @@ async function fetchRateLimitsViaRpc(envOverride, options = {}) {
     ["-s", "read-only", "-a", "untrusted", "app-server"],
     childEnv
   );
-  const child = (0, import_node_child_process2.spawn)(command.command, command.args, {
+  const child = (0, import_node_child_process4.spawn)(command.command, command.args, {
     stdio: ["pipe", "pipe", "pipe"],
     env: childEnv,
     shell: command.shell
@@ -5169,7 +5838,7 @@ async function activateResetWindowViaRpc(envOverride, options = {}) {
     ["-s", "read-only", "-a", "untrusted", "app-server"],
     childEnv
   );
-  const child = (0, import_node_child_process2.spawn)(command.command, command.args, {
+  const child = (0, import_node_child_process4.spawn)(command.command, command.args, {
     stdio: ["pipe", "pipe", "pipe"],
     env: childEnv,
     shell: command.shell
@@ -5633,7 +6302,7 @@ var ProfileManager = class {
     if (!trimmed) {
       return this.emptyAuthSnapshot();
     }
-    const fingerprint = (0, import_node_crypto3.createHash)("sha256").update(trimmed).digest("hex");
+    const fingerprint = (0, import_node_crypto6.createHash)("sha256").update(trimmed).digest("hex");
     try {
       const parsed = JSON.parse(trimmed);
       const normalized = this.normalizeProfileData(parsed);
@@ -7048,6 +7717,25 @@ var ProfileManager = class {
       });
     }
   }
+  async readConfirmedRateLimits(name, options = {}) {
+    const profileName = this.normalizeProfileName(name);
+    try {
+      return await this.enqueueProfileOperation(
+        profileName,
+        () => this.runWithPreparedProfileHome(
+          profileName,
+          (env) => fetchRateLimitsViaRpc(env, { codexPath: options.codexPath }),
+          { syncFromActiveAuthBeforeAction: false }
+        )
+      );
+    } finally {
+      await this.enqueueAuthSwap(async () => {
+        await this.syncActiveAuthFromProfileIfCurrent(profileName);
+      }).catch((error) => {
+        logWarn(`Failed to sync active auth after rate-limit confirmation for '${profileName}':`, error);
+      });
+    }
+  }
   async activateResetWindow(name, options = {}) {
     const profileName = this.normalizeProfileName(name);
     try {
@@ -7266,7 +7954,7 @@ var ProfileManager = class {
       }
       if (options.canAutoImport === false) {
         return this.buildActiveCodexAuthStatus("unmanaged", description, {
-          importBlockedReason: options.importBlockedReason ?? "Profile limit reached. Upgrade to CodexUse Pro or remove a profile before importing this Codex login."
+          importBlockedReason: options.importBlockedReason ?? "Your CodexUse trial has ended. Upgrade to Pro before importing this Codex login."
         });
       }
       const records = await this.listProfileRecords();
@@ -7454,7 +8142,7 @@ Flags:
   --runtime=NAME   Accounts Pool runtime store: desktop
   --state-dir=PATH Override the runtime state dir for Accounts Pool inspection
   --passphrase-stdin Read Cloud Sync passphrase from stdin
-Note: profile autoroll requires Pro.
+Note: profile autoroll requires Pro or an active trial.
 Cloud Sync: set CODEXUSE_SYNC_PASSPHRASE or use --passphrase-stdin unless the passphrase is saved in Keychain.
 `);
 }
@@ -7506,7 +8194,7 @@ function parseStringFlag(flags, name) {
 
 // src/commands/accountPool.ts
 var ACCOUNT_POOL_DOCUMENT = "desktop.account-pool.v2";
-var ACCOUNT_POOL_PRO_REQUIRED_MESSAGE = "Accounts Pool requires a Pro license.";
+var ACCOUNT_POOL_PRO_REQUIRED_MESSAGE = "Accounts Pool requires a Pro license or an active trial.";
 var DESKTOP_RPC_STATE_DIR = "desktop-rpc";
 var ACCOUNT_POOL_STORE_VERSION = 3;
 var MAX_RESPONSE_IDS_PER_SESSION = 64;
@@ -7894,13 +8582,13 @@ async function listApiKeys(stateDir) {
   return Object.values(store.apiKeysById).filter((key) => key.revokedAt === null).sort((left, right) => right.createdAt.localeCompare(left.createdAt)).map(accountPoolApiKeyView);
 }
 function hashToken(token) {
-  return (0, import_node_crypto4.createHash)("sha256").update(token).digest("hex");
+  return (0, import_node_crypto7.createHash)("sha256").update(token).digest("hex");
 }
 async function createApiKey(stateDir) {
-  const plaintextToken = `cux_pool_${(0, import_node_crypto4.randomBytes)(24).toString("hex")}`;
+  const plaintextToken = `cux_pool_${(0, import_node_crypto7.randomBytes)(24).toString("hex")}`;
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const keyRecord = {
-    id: (0, import_node_crypto4.randomUUID)(),
+    id: (0, import_node_crypto7.randomUUID)(),
     tokenHash: hashToken(plaintextToken),
     tokenPreview: `${plaintextToken.slice(0, 8)}...${plaintextToken.slice(-6)}`,
     createdAt: now,
@@ -7994,7 +8682,7 @@ async function readAccountPoolRuntimeSummary(input = {}) {
     stateDir,
     baseUrl: resolveBaseUrlFromPort(runtime, input.port ?? null),
     enabled: normalized.accountPoolEnabled,
-    hasProLicense: license?.isPro === true,
+    hasAccountPoolAccess: license?.capabilities.accountPool === true,
     routingStrategy: normalized.accountPoolRoutingStrategy,
     activeApiKeyCount: apiKeys.length,
     activeSessionCount: sessions.length
@@ -8011,7 +8699,7 @@ async function updateSettings(transform) {
   const { raw, normalized } = await readSettingsSnapshot();
   const nextSettings = transform(normalized);
   const license = await licenseService.getStatus().catch(() => null);
-  const forcedDisabledByLicense = !license?.isPro && nextSettings.accountPoolEnabled === true;
+  const forcedDisabledByLicense = license?.capabilities.accountPool !== true && nextSettings.accountPoolEnabled === true;
   const sanitizedSettings = {
     ...nextSettings,
     accountPoolEnabled: forcedDisabledByLicense ? false : nextSettings.accountPoolEnabled,
@@ -8038,7 +8726,7 @@ async function updateSettings(transform) {
 }
 async function requireProAccess() {
   const license = await licenseService.getStatus();
-  if (!license.isPro) {
+  if (!license.capabilities.accountPool) {
     throw new Error(ACCOUNT_POOL_PRO_REQUIRED_MESSAGE);
   }
 }
@@ -8100,7 +8788,7 @@ async function handleStatus(flags) {
   console.log(`Runtime: ${runtime}`);
   console.log(`State dir: ${stateDir}`);
   console.log(`Routing: ${formatRoutingStrategy(normalized.accountPoolRoutingStrategy)}`);
-  console.log(`Public API ready: ${normalized.accountPoolEnabled && license?.isPro === true && apiKeys.length > 0 ? "yes" : "no"}`);
+  console.log(`Public API ready: ${normalized.accountPoolEnabled && license?.capabilities.accountPool === true && apiKeys.length > 0 ? "yes" : "no"}`);
   console.log(`API keys: ${apiKeys.length}`);
   console.log(`Sessions: ${sessions.length}`);
   console.log(`Selection mode: ${explicitSelection.length > 0 ? "explicit" : "all saved profiles"}`);
@@ -8116,7 +8804,7 @@ async function handleStatus(flags) {
   printStringList("Published models", normalized.accountPoolExposedModels);
   printStringList("Reasoning aliases", normalized.accountPoolExposedReasoningEfforts);
   printStringList("Fast-mode aliases", normalized.accountPoolExposedFastModeReasoningEfforts);
-  if (normalized.accountPoolEnabled && license?.isPro !== true) {
+  if (normalized.accountPoolEnabled && license?.capabilities.accountPool !== true) {
     console.log(ACCOUNT_POOL_PRO_REQUIRED_MESSAGE);
   }
 }
@@ -8321,7 +9009,7 @@ async function handleQuickstart(flags) {
   console.log("Accounts Pool quickstart");
   console.log(`Runtime: ${summary.runtime}`);
   console.log(`Enabled: ${summary.enabled ? "yes" : "no"}`);
-  console.log(`Pro: ${summary.hasProLicense ? "yes" : "no"}`);
+  console.log(`Access: ${summary.hasAccountPoolAccess ? "yes" : "no"}`);
   console.log(`API keys: ${summary.activeApiKeyCount}`);
   console.log(`Base URL: ${baseUrl}`);
   console.log("");
@@ -8405,7 +9093,7 @@ async function handleAccountPoolCommand(args, version) {
 }
 
 // src/commands/codex.ts
-var import_node_child_process4 = require("child_process");
+var import_node_child_process6 = require("child_process");
 
 // ../../packages/runtime-profiles/src/profiles/rate-limit-notifier.ts
 function maxUsedPercent(snapshot) {
@@ -8414,8 +9102,7 @@ function maxUsedPercent(snapshot) {
   }
   const candidates = [
     snapshot.primary?.usedPercent,
-    snapshot.secondary?.usedPercent,
-    ...(snapshot.extraWindows ?? []).map((window) => window.usedPercent)
+    snapshot.secondary?.usedPercent
   ].filter((value) => typeof value === "number" && Number.isFinite(value));
   if (candidates.length === 0) {
     return null;
@@ -8423,8 +9110,108 @@ function maxUsedPercent(snapshot) {
   return Math.max(...candidates);
 }
 
+// ../../packages/runtime-profiles/src/profiles/profile-visibility.ts
+function resolveLicenseVisibleProfiles(args) {
+  const { profiles, license, currentProfile } = args;
+  const licenseWithCounts = licenseService.applyProfileCount(license, profiles.length);
+  const enforceProfileLimit = shouldEnforceProfileLimit(licenseWithCounts);
+  const visibleProfiles = enforceProfileLimit ? resolveVisibleProfiles(profiles, licenseWithCounts, currentProfile) : profiles;
+  return {
+    allProfiles: profiles,
+    profiles: licenseWithCounts.capabilities.unlimitedProfiles ? profiles : visibleProfiles,
+    license,
+    licenseWithCounts,
+    enforceProfileLimit
+  };
+}
+async function loadLicenseVisibleProfiles(profileManager, options = {}) {
+  await profileManager.initialize();
+  const license = options.freshLicense ? await licenseService.getStatus() : await licenseService.getCachedStatus();
+  const profiles = await profileManager.listProfiles();
+  const currentProfile = options.currentProfile !== void 0 ? options.currentProfile : (await profileManager.getCurrentProfile()).name;
+  return resolveLicenseVisibleProfiles({
+    profiles,
+    license,
+    currentProfile
+  });
+}
+function resolveVisibleProfiles(profiles, license, currentProfile) {
+  if (license.capabilities.unlimitedProfiles) {
+    return profiles;
+  }
+  const limit = typeof license.profileLimit === "number" && license.profileLimit >= 0 ? license.profileLimit : FREE_PROFILE_LIMIT;
+  if (profiles.length <= limit) {
+    return profiles;
+  }
+  const normalizedCurrent = currentProfile ?? null;
+  const sorted = profiles.slice().sort((a, b) => compareProfilesForLimit(a, b, normalizedCurrent));
+  return sorted.slice(0, limit);
+}
+function compareProfilesForLimit(a, b, currentProfile) {
+  if (currentProfile) {
+    if (a.name === currentProfile && b.name !== currentProfile) {
+      return -1;
+    }
+    if (b.name === currentProfile && a.name !== currentProfile) {
+      return 1;
+    }
+  }
+  if (Boolean(a.isValid) !== Boolean(b.isValid)) {
+    return a.isValid ? -1 : 1;
+  }
+  const aTimestamp = parseTimestamp3(a.createdAt ?? null);
+  const bTimestamp = parseTimestamp3(b.createdAt ?? null);
+  if (aTimestamp !== null && bTimestamp !== null) {
+    if (aTimestamp === bTimestamp) {
+      return a.name.localeCompare(b.name);
+    }
+    return bTimestamp - aTimestamp;
+  }
+  if (aTimestamp !== null) {
+    return -1;
+  }
+  if (bTimestamp !== null) {
+    return 1;
+  }
+  return a.name.localeCompare(b.name);
+}
+function parseTimestamp3(value) {
+  if (typeof value !== "string" || value.trim() === "") {
+    return null;
+  }
+  const parsed = Date.parse(value);
+  return Number.isNaN(parsed) ? null : parsed;
+}
+
+// ../../packages/runtime-profiles/src/license/guard.ts
+var PROFILE_ACCESS_DENIED_MESSAGE = "Your CodexUse trial has ended. Upgrade to Pro to use saved profiles.";
+async function assertProfileCreationAllowed(profileManager) {
+  const manager = profileManager ?? new ProfileManager();
+  await manager.initialize();
+  const license = await licenseService.getStatus();
+  const profiles = await manager.listProfiles();
+  const licenseWithCounts = licenseService.applyProfileCount(license, profiles.length);
+  if (typeof licenseWithCounts.profileLimit === "number" && licenseWithCounts.profilesRemaining !== null && licenseWithCounts.profilesRemaining <= 0) {
+    throw new Error("Your CodexUse trial has ended. Upgrade to Pro for unlimited profiles.");
+  }
+}
+async function assertProfileAccessAllowed(profileManager, profileName) {
+  const name = profileName.trim();
+  if (!name) {
+    throw new Error("Profile name is required.");
+  }
+  const visible = await loadLicenseVisibleProfiles(profileManager, {
+    freshLicense: true
+  });
+  const exists = visible.allProfiles.some((profile) => profile.name === name);
+  const allowed = visible.profiles.some((profile) => profile.name === name);
+  if (exists && !allowed) {
+    throw new Error(PROFILE_ACCESS_DENIED_MESSAGE);
+  }
+}
+
 // src/platform/codexCli.ts
-var import_node_child_process3 = require("child_process");
+var import_node_child_process5 = require("child_process");
 var import_node_fs5 = require("fs");
 var import_node_path8 = __toESM(require("path"));
 var ENV_HINTS2 = ["CODEX_BINARY", "CODEX_CLI_PATH", "CODEX_PATH"];
@@ -8496,7 +9283,7 @@ async function runCodexLogin(mode) {
   const resolvedMode = resolveLoginMode(mode ?? null);
   const loginArgs = resolvedMode === "device" ? ["login", "--device-auth"] : ["login"];
   const { command, args, shell } = buildCodexCommand2(codexPath, loginArgs);
-  const child = (0, import_node_child_process3.spawn)(command, args, {
+  const child = (0, import_node_child_process5.spawn)(command, args, {
     stdio: "inherit",
     env: process.env,
     shell
@@ -8544,8 +9331,7 @@ function formatUsagePercent(value) {
 function snapshotResetSeconds(snapshot) {
   const values = [
     snapshot?.primary?.resetsInSeconds,
-    snapshot?.secondary?.resetsInSeconds,
-    ...(snapshot?.extraWindows ?? []).map((window) => window.resetsInSeconds)
+    snapshot?.secondary?.resetsInSeconds
   ].filter((value) => typeof value === "number" && Number.isFinite(value));
   return values.length > 0 ? Math.min(...values) : null;
 }
@@ -8569,7 +9355,7 @@ function compareCandidates(left, right) {
 async function runCommand(codexPath, args, timeoutMs) {
   const command = buildCodexCommand2(codexPath, args);
   return new Promise((resolve) => {
-    const child = (0, import_node_child_process4.spawn)(command.command, command.args, {
+    const child = (0, import_node_child_process6.spawn)(command.command, command.args, {
       env: process.env,
       shell: command.shell,
       stdio: ["ignore", "pipe", "pipe"]
@@ -8630,12 +9416,13 @@ async function runCodexWithProfile(manager, profileName, codexArgs) {
   if (!codexPath) {
     throw new Error("Codex CLI not found. Install Codex CLI or set CODEX_BINARY.");
   }
+  await assertProfileAccessAllowed(manager, profileName);
   const runtime = await manager.prepareProfileRuntime(profileName, {
     syncFromActiveAuthBeforeAction: false
   });
   const command = buildCodexCommand2(codexPath, codexArgs);
   try {
-    const child = (0, import_node_child_process4.spawn)(command.command, command.args, {
+    const child = (0, import_node_child_process6.spawn)(command.command, command.args, {
       env: runtime.env,
       shell: command.shell,
       stdio: "inherit"
@@ -8736,7 +9523,7 @@ async function handleBestCommand(args) {
     console.log(`Usage:
   codexuse best -- <codex args>
 
-Picks the healthiest saved profile, then runs Codex. Auto-run requires Pro.`);
+Picks the healthiest saved profile, then runs Codex. Auto-run requires Pro or an active trial.`);
     return;
   }
   const codexPath = resolveCodexBinary();
@@ -8744,20 +9531,17 @@ Picks the healthiest saved profile, then runs Codex. Auto-run requires Pro.`);
     throw new Error("Codex CLI not found. Install Codex CLI or set CODEX_BINARY.");
   }
   const manager = new ProfileManager();
-  const profiles = await manager.listProfiles();
+  const visible = await loadLicenseVisibleProfiles(manager, { freshLicense: true });
+  if (!visible.licenseWithCounts.capabilities.autoRoll) {
+    throw new Error("Auto-run requires Pro or an active trial.");
+  }
+  const profiles = visible.profiles;
   const best = await selectBestProfile(manager, profiles, codexPath);
   if (!best) {
     throw new Error("No valid saved profiles found. Add one with `codexuse profile add <name>`.");
   }
   const dryRun = hasFlag(flags, "--dry-run");
-  const license = await licenseService.getStatus();
   const summary = `${best.profile.name} (${formatUsagePercent(best.usedPercent)} used)`;
-  if (!license.isPro) {
-    console.log(`Best profile: ${summary}`);
-    console.log("Auto-run is Pro. Free path:");
-    console.log(`  codexuse run --profile ${best.profile.name} -- ${codexArgs.join(" ")}`.trimEnd());
-    return;
-  }
   if (dryRun) {
     console.log(`Would run with profile: ${summary}`);
     return;
@@ -8815,21 +9599,9 @@ async function handleLicense(args, version) {
   }
 }
 
-// ../../packages/runtime-profiles/src/license/guard.ts
-async function assertProfileCreationAllowed(profileManager) {
-  const manager = profileManager ?? new ProfileManager();
-  await manager.initialize();
-  const license = await licenseService.getStatus();
-  const profiles = await manager.listProfiles();
-  const licenseWithCounts = licenseService.applyProfileCount(license, profiles.length);
-  if (typeof licenseWithCounts.profileLimit === "number" && licenseWithCounts.profilesRemaining !== null && licenseWithCounts.profilesRemaining <= 0) {
-    throw new Error("CodexUse Free supports up to 2 profiles. Upgrade to CodexUse Pro for unlimited profiles.");
-  }
-}
-
 // ../../packages/runtime-codex/src/codex/officialAppRestart.ts
-var import_node_child_process5 = require("child_process");
-var import_node_crypto5 = require("crypto");
+var import_node_child_process7 = require("child_process");
+var import_node_crypto8 = require("crypto");
 var import_node_fs7 = require("fs");
 var import_node_os3 = require("os");
 var import_node_net = __toESM(require("net"), 1);
@@ -9104,7 +9876,7 @@ function hashProfileKey(profileKey) {
   if (!profileKey) {
     return null;
   }
-  return (0, import_node_crypto5.createHash)("sha256").update(profileKey).digest("hex").slice(0, 12);
+  return (0, import_node_crypto8.createHash)("sha256").update(profileKey).digest("hex").slice(0, 12);
 }
 function sanitizeOfficialCodexOverlayActionTargetsForRenderer(targets) {
   const sanitized = [];
@@ -9727,6 +10499,7 @@ function buildInCodexStatusOverlayCssRules() {
     `${chip} .codexuse-handoff-main{display:inline-flex;align-items:center;padding:5px 8px 5px 10px;border-radius:999px;cursor:pointer;}`,
     `${chip} .codexuse-handoff-hide{display:inline-flex;width:20px;height:20px;align-items:center;justify-content:center;margin-right:3px;border-radius:50%;color:var(--cu-muted);cursor:pointer;font-size:12px;line-height:1;}`,
     `${chip} .codexuse-handoff-hide:hover{background:var(--cu-border);color:var(--cu-fg,#ececf1);}`,
+    `body>[data-radix-popper-content-wrapper],body>[data-floating-ui-portal]{z-index:2147483004!important;}`,
     // Hand-off account picker is a standalone body child (not inside the pill),
     // so the pill-scoped popover rules don't reach it — give it its own palette
     // + popover styling, mirroring the chip.
@@ -12656,7 +13429,7 @@ async function runCdpCommandSequence(debuggerUrl, commands, timeoutMs = CODEX_CD
   });
 }
 async function verifyCdpBindingRoundTrip(debuggerUrl) {
-  const nonce = (0, import_node_crypto5.randomUUID)();
+  const nonce = (0, import_node_crypto8.randomUUID)();
   const expression = `(() => {
     const binding = window[${JSON.stringify(CODEXUSE_BRIDGE_BINDING_NAME)}];
     if (typeof binding !== "function") return false;
@@ -13429,7 +14202,7 @@ async function recordOfficialCodexActivity(input) {
 }
 function runCommand2(command, args, timeoutMs = COMMAND_TIMEOUT_MS) {
   return new Promise((resolve) => {
-    const child = (0, import_node_child_process5.spawn)(command, args, {
+    const child = (0, import_node_child_process7.spawn)(command, args, {
       stdio: ["ignore", "pipe", "pipe"]
     });
     let stdout = "";
@@ -13728,7 +14501,7 @@ async function openCodexWithProfileHome(candidate, profileHome, profileName, cdp
     if (appUserDataDir) {
       (0, import_node_fs7.mkdirSync)(appUserDataDir, { recursive: true });
     }
-    child = (0, import_node_child_process5.spawn)(
+    child = (0, import_node_child_process7.spawn)(
       "/usr/bin/open",
       [
         "-n",
@@ -14507,6 +15280,13 @@ function formatProfileLabel(name, displayName) {
   }
   return name;
 }
+var AUTO_ROLL_ACCESS_REQUIRED_MESSAGE = "Auto-roll requires a Pro license or an active trial.";
+async function assertAutoRollAccess() {
+  const license = await licenseService.getStatus();
+  if (!license.capabilities.autoRoll) {
+    throw new Error(AUTO_ROLL_ACCESS_REQUIRED_MESSAGE);
+  }
+}
 function profileRateLimitKey(profile) {
   return resolveProfileIdentityKeyFromProfile(profile);
 }
@@ -15163,6 +15943,7 @@ async function collectUsageMap(manager, profiles, codexPath) {
   return usageMap;
 }
 async function runAutoRollPass(manager, options) {
+  await assertAutoRollAccess();
   const profiles = await manager.listProfiles();
   if (!profiles.length) {
     return { switched: false, message: "No profiles found.", source: null, target: null };
@@ -15287,9 +16068,13 @@ async function handleProfileCommand(args, version) {
   const manager = new ProfileManager();
   switch (sub) {
     case "list": {
-      const profiles = await manager.listProfiles();
+      const visible = await loadLicenseVisibleProfiles(manager, { freshLicense: true });
+      const profiles = visible.profiles;
       const current = await manager.getCurrentProfile();
       if (!profiles.length) {
+        if (visible.allProfiles.length) {
+          throw new Error(PROFILE_ACCESS_DENIED_MESSAGE);
+        }
         console.log("No profiles found.");
         return;
       }
@@ -15331,6 +16116,7 @@ async function handleProfileCommand(args, version) {
         console.log("No active profile.");
         return;
       }
+      await assertProfileAccessAllowed(manager, current.name);
       console.log(current.name);
       return;
     }
@@ -15354,6 +16140,7 @@ async function handleProfileCommand(args, version) {
       if (!name) {
         throw new Error("Profile name is required.");
       }
+      await assertProfileAccessAllowed(manager, name);
       if (!hasFlag(flags, "--skip-login")) {
         const loginMode = resolveLoginMode(parseLoginMode(flags));
         await runCodexLogin(loginMode);
@@ -15368,6 +16155,7 @@ async function handleProfileCommand(args, version) {
       if (!name) {
         throw new Error("Profile name is required.");
       }
+      await assertProfileAccessAllowed(manager, name);
       const activateOfficialCodex = resolveActivateCodexFlag(flags, false);
       const profiles = await manager.listProfiles();
       const targetProfileKey = findProfileKey(profiles, name);
@@ -15387,10 +16175,7 @@ async function handleProfileCommand(args, version) {
     }
     case "autoroll":
     case "auto-roll": {
-      const license = await licenseService.getStatus();
-      if (!license.isPro) {
-        throw new Error("Auto-roll requires a Pro license.");
-      }
+      await assertAutoRollAccess();
       const watch = hasFlag(flags, "--watch");
       const dryRun = hasFlag(flags, "--dry-run");
       const settings = await getStoredAutoRollSettings().catch(() => null);
@@ -15470,6 +16255,7 @@ async function handleProfileCommand(args, version) {
       if (!from || !to) {
         throw new Error("Old and new profile names are required.");
       }
+      await assertProfileAccessAllowed(manager, from);
       await manager.renameProfile(from, to);
       console.log(`Profile renamed: ${from} -> ${to}`);
       return;
@@ -15598,7 +16384,7 @@ function normalizeSnapshot(value) {
     settingsJson
   };
 }
-async function requestJson(method, pathname, licenseKey, body, rawBody) {
+async function requestJson(method, pathname, access, body, rawBody) {
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), CLOUD_SYNC_TIMEOUT_MS);
   try {
@@ -15606,7 +16392,10 @@ async function requestJson(method, pathname, licenseKey, body, rawBody) {
       method,
       headers: {
         "Content-Type": "application/json",
-        "x-codexuse-license-key": licenseKey
+        "x-codexuse-license-key": access.syncKey,
+        ...access.trialDeviceId ? { "x-codexuse-trial-device-id": access.trialDeviceId } : {},
+        ...access.trialToken ? { "x-codexuse-trial-token": access.trialToken } : {},
+        ...access.trialMigration ? { "x-codexuse-sync-migrate-trial": "1" } : {}
       },
       body: typeof rawBody === "string" ? rawBody : body === void 0 ? void 0 : JSON.stringify(body),
       signal: controller.signal
@@ -15633,15 +16422,15 @@ async function requestJson(method, pathname, licenseKey, body, rawBody) {
     clearTimeout(timeout);
   }
 }
-async function fetchRemoteSnapshot(licenseKey) {
-  const response = await requestJson("GET", "/v1/sync/snapshot", licenseKey);
+async function fetchRemoteSnapshot(access) {
+  const response = await requestJson("GET", "/v1/sync/snapshot", access);
   return normalizeSnapshot(response.snapshot);
 }
-async function fetchRemoteSnapshotMeta(licenseKey) {
+async function fetchRemoteSnapshotMeta(access) {
   const response = await requestJson(
     "GET",
     "/v1/sync/snapshot/meta",
-    licenseKey
+    access
   );
   const updatedAt = toIsoOrNull(response.updatedAt);
   const snapshotKind = normalizeSnapshotKind(response.snapshotKind);
@@ -15650,12 +16439,12 @@ async function fetchRemoteSnapshotMeta(licenseKey) {
     snapshotKind: updatedAt && response.snapshotKind === void 0 ? "legacy-plaintext" : snapshotKind
   };
 }
-async function pushRemoteSnapshot(licenseKey, snapshot, options) {
+async function pushRemoteSnapshot(access, snapshot, options) {
   const serializedSnapshot = typeof options?.serializedSnapshot === "string" ? options.serializedSnapshot : JSON.stringify(snapshot);
   const response = await requestJson(
     "PUT",
     "/v1/sync/snapshot",
-    licenseKey,
+    access,
     void 0,
     `{"snapshot":${serializedSnapshot}}`
   );
@@ -15674,8 +16463,8 @@ async function pushRemoteSnapshot(licenseKey, snapshot, options) {
 var import_toml3 = __toESM(require_toml(), 1);
 
 // ../../packages/runtime-codex/src/codex/config-metadata.ts
-var import_node_child_process6 = require("child_process");
-var import_promises = require("fs/promises");
+var import_node_child_process8 = require("child_process");
+var import_promises2 = require("fs/promises");
 var import_node_path11 = __toESM(require("path"), 1);
 var CONFIG_SCHEMA_URL = "https://raw.githubusercontent.com/openai/codex/main/codex-rs/core/config.schema.json";
 var METADATA_CACHE_TTL_MS = 6e4;
@@ -15786,7 +16575,7 @@ function uniqueSorted(values) {
 }
 async function runCommand3(command, args, timeoutMs = 3e3) {
   return new Promise((resolve, reject) => {
-    const child = (0, import_node_child_process6.spawn)(command, args, {
+    const child = (0, import_node_child_process8.spawn)(command, args, {
       stdio: ["ignore", "pipe", "pipe"],
       env: process.env
     });
@@ -15867,7 +16656,7 @@ async function readSchemaFromLocal() {
   ].filter((candidate) => Boolean(candidate));
   for (const candidate of candidates) {
     try {
-      return await (0, import_promises.readFile)(candidate, "utf8");
+      return await (0, import_promises2.readFile)(candidate, "utf8");
     } catch {
     }
   }
@@ -15967,7 +16756,7 @@ async function getCodexConfigMetadata(forceRefresh = false) {
 }
 
 // ../../packages/runtime-codex/src/codex/config-io.ts
-var import_promises2 = require("fs/promises");
+var import_promises3 = require("fs/promises");
 var import_node_path13 = __toESM(require("path"), 1);
 
 // ../../packages/runtime-codex/src/codex/home.ts
@@ -16077,7 +16866,7 @@ function getConfigPath(options) {
 }
 async function ensureConfigDirExists(filePath) {
   const dir = import_node_path13.default.dirname(filePath);
-  await (0, import_promises2.mkdir)(dir, { recursive: true });
+  await (0, import_promises3.mkdir)(dir, { recursive: true });
 }
 function normalizeLineEndings(content) {
   return content.replace(/\r\n/g, "\n");
@@ -16089,7 +16878,7 @@ function ensureTrailingNewline(content) {
 async function readConfigContent(options) {
   const configPath = getConfigPath(options);
   try {
-    const content = await (0, import_promises2.readFile)(configPath, "utf8");
+    const content = await (0, import_promises3.readFile)(configPath, "utf8");
     return {
       exists: true,
       content: normalizeLineEndings(content)
@@ -16109,14 +16898,14 @@ async function writeConfigContent(content, options) {
   const configPath = getConfigPath(options);
   await ensureConfigDirExists(configPath);
   const normalized = ensureTrailingNewline(normalizeLineEndings(content));
-  await (0, import_promises2.writeFile)(configPath, normalized, "utf8");
+  await (0, import_promises3.writeFile)(configPath, normalized, "utf8");
 }
 async function getUpdatedAt(configPath, exists) {
   if (!exists) {
     return null;
   }
   try {
-    const stats = await (0, import_promises2.stat)(configPath);
+    const stats = await (0, import_promises3.stat)(configPath);
     return stats.mtimeMs;
   } catch (error) {
     const nodeError = error;
@@ -16630,10 +17419,10 @@ async function saveCodexConfigContent(content, options) {
 }
 
 // ../../packages/runtime-profiles/src/cloud-sync/encryption.ts
-var import_node_child_process7 = require("child_process");
-var import_node_crypto6 = require("crypto");
-var KEYCHAIN_SERVICE = "CODEXUSE_CLOUD_SYNC_PASSPHRASE";
-var KEYCHAIN_ACCOUNT_PREFIX = "license-sha256:";
+var import_node_child_process9 = require("child_process");
+var import_node_crypto9 = require("crypto");
+var KEYCHAIN_SERVICE2 = "CODEXUSE_CLOUD_SYNC_PASSPHRASE";
+var KEYCHAIN_ACCOUNT_PREFIX2 = "license-sha256:";
 var ENCRYPTION_AAD = Buffer.from("codexuse-cloud-sync-v2", "utf8");
 var SCRYPT_PARAMS = {
   N: 32768,
@@ -16656,7 +17445,7 @@ function requireCloudSyncPassphrase(value) {
 }
 async function deriveKey(passphrase, salt, params = SCRYPT_PARAMS) {
   return new Promise((resolve, reject) => {
-    (0, import_node_crypto6.scrypt)(passphrase, salt, params.keyLength, {
+    (0, import_node_crypto9.scrypt)(passphrase, salt, params.keyLength, {
       N: params.N,
       r: params.r,
       p: params.p,
@@ -16693,10 +17482,10 @@ function normalizeDecryptedSnapshot(value) {
   };
 }
 async function encryptCloudSyncSnapshot(snapshot, passphrase) {
-  const salt = (0, import_node_crypto6.randomBytes)(16);
-  const iv = (0, import_node_crypto6.randomBytes)(12);
+  const salt = (0, import_node_crypto9.randomBytes)(16);
+  const iv = (0, import_node_crypto9.randomBytes)(12);
   const key = await deriveKey(requireCloudSyncPassphrase(passphrase), salt);
-  const cipher = (0, import_node_crypto6.createCipheriv)("aes-256-gcm", key, iv);
+  const cipher = (0, import_node_crypto9.createCipheriv)("aes-256-gcm", key, iv);
   cipher.setAAD(ENCRYPTION_AAD);
   const plaintext = Buffer.from(JSON.stringify(snapshot), "utf8");
   const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
@@ -16723,7 +17512,7 @@ async function decryptCloudSyncSnapshot(snapshot, passphrase) {
     const tag = fromBase64(snapshot.encryption.tag);
     const ciphertext = fromBase64(snapshot.encryption.ciphertext);
     const key = await deriveKey(requireCloudSyncPassphrase(passphrase), salt, snapshot.encryption.kdfParams);
-    const decipher = (0, import_node_crypto6.createDecipheriv)("aes-256-gcm", key, iv);
+    const decipher = (0, import_node_crypto9.createDecipheriv)("aes-256-gcm", key, iv);
     decipher.setAAD(ENCRYPTION_AAD);
     decipher.setAuthTag(tag);
     const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
@@ -16738,12 +17527,12 @@ async function decryptCloudSyncSnapshot(snapshot, passphrase) {
   }
 }
 function keychainAccountForLicense(licenseKey) {
-  const digest = (0, import_node_crypto6.createHash)("sha256").update(licenseKey).digest("hex");
-  return KEYCHAIN_ACCOUNT_PREFIX + digest;
+  const digest = (0, import_node_crypto9.createHash)("sha256").update(licenseKey).digest("hex");
+  return KEYCHAIN_ACCOUNT_PREFIX2 + digest;
 }
-function runSecurityCommand(args) {
+function runSecurityCommand2(args) {
   return new Promise((resolve, reject) => {
-    const child = (0, import_node_child_process7.spawn)("security", args, { stdio: ["ignore", "pipe", "ignore"] });
+    const child = (0, import_node_child_process9.spawn)("security", args, { stdio: ["ignore", "pipe", "ignore"] });
     let stdout = "";
     child.stdout?.on("data", (chunk) => {
       stdout += String(chunk);
@@ -16760,12 +17549,12 @@ async function readRememberedCloudSyncPassphrase(licenseKey) {
   if (process.platform !== "darwin") {
     return null;
   }
-  const result = await runSecurityCommand([
+  const result = await runSecurityCommand2([
     "find-generic-password",
     "-a",
     keychainAccountForLicense(licenseKey),
     "-s",
-    KEYCHAIN_SERVICE,
+    KEYCHAIN_SERVICE2,
     "-w"
   ]);
   if (result.code !== 0) {
@@ -16778,13 +17567,13 @@ async function writeRememberedCloudSyncPassphrase(licenseKey, passphrase) {
     throw new Error("keychain-unsupported");
   }
   const value = requireCloudSyncPassphrase(passphrase);
-  const result = await runSecurityCommand([
+  const result = await runSecurityCommand2([
     "add-generic-password",
     "-U",
     "-a",
     keychainAccountForLicense(licenseKey),
     "-s",
-    KEYCHAIN_SERVICE,
+    KEYCHAIN_SERVICE2,
     "-w",
     value
   ]);
@@ -16863,31 +17652,144 @@ async function writeState(patch) {
 async function resolveEligibility() {
   const stored = await getStoredLicense();
   const licenseKey = typeof stored?.licenseKey === "string" ? stored.licenseKey.trim() : "";
-  if (!licenseKey) {
+  const status = await licenseService.getStatus();
+  if (licenseKey && status.isPro) {
+    const active = status.state === "active" || status.state === "grace";
+    if (active) {
+      await migrateTrialCloudSyncToPaidLicenseSafe(licenseKey);
+    }
     return {
-      canSync: false,
-      reason: "License key is required for cloud sync.",
-      licenseKey: null,
-      licenseState: null
+      canSync: active,
+      canDelete: active,
+      reason: active ? null : "Cloud sync requires an active Pro license.",
+      access: active ? { syncKey: licenseKey } : null,
+      hasPaidLicenseKey: true,
+      licenseState: status.state
     };
   }
-  const status = await licenseService.getStatus();
-  const active = status.state === "active" || status.state === "grace";
-  if (!active) {
+  if (status.trial?.active && status.capabilities.cloudSync) {
+    const trialAccess = await resolveTrialCloudSyncAccess();
+    if (trialAccess) {
+      return {
+        canSync: true,
+        canDelete: true,
+        reason: null,
+        access: trialAccess,
+        hasPaidLicenseKey: false,
+        licenseState: status.state
+      };
+    }
     return {
       canSync: false,
-      reason: "Cloud sync requires an active Pro license.",
-      licenseKey,
+      canDelete: false,
+      reason: "Cloud sync trial identity is unavailable.",
+      access: null,
+      hasPaidLicenseKey: false,
       licenseState: status.state
     };
   }
+  if (status.trial?.expired) {
+    const trialAccess = await resolveTrialCloudSyncAccess();
+    if (trialAccess) {
+      return {
+        canSync: false,
+        canDelete: true,
+        reason: "Cloud sync requires an active trial or Pro license.",
+        access: trialAccess,
+        hasPaidLicenseKey: false,
+        licenseState: status.state
+      };
+    }
+  }
   return {
-    canSync: true,
-    reason: null,
-    licenseKey,
+    canSync: false,
+    canDelete: false,
+    reason: "Cloud sync requires an active trial or Pro license.",
+    access: null,
+    hasPaidLicenseKey: false,
     licenseState: status.state
   };
 }
+async function hasRemoteSnapshot(access) {
+  const meta = await fetchRemoteSnapshotMeta(access);
+  return meta.snapshotKind !== "none" || Boolean(meta.updatedAt);
+}
+async function readRemoteSnapshotOrNull(access) {
+  try {
+    return await fetchRemoteSnapshot(access);
+  } catch (error) {
+    if (error instanceof CloudSyncClientError && (error.status === 403 || error.status === 404)) {
+      return null;
+    }
+    throw error;
+  }
+}
+async function migrateTrialPassphraseToPaidLicense(trialKey, licenseKey) {
+  const paidPassphrase = await readRememberedCloudSyncPassphrase(licenseKey).catch(() => null);
+  if (paidPassphrase) {
+    return;
+  }
+  const trialPassphrase = await readRememberedCloudSyncPassphrase(trialKey).catch(() => null);
+  if (!trialPassphrase) {
+    return;
+  }
+  await writeRememberedCloudSyncPassphrase(licenseKey, trialPassphrase);
+}
+async function migrateTrialCloudSyncToPaidLicense(licenseKey) {
+  const paidLicenseKey = licenseKey.trim();
+  if (!paidLicenseKey) {
+    return;
+  }
+  const trialAccess = await resolveTrialCloudSyncAccess();
+  if (!trialAccess || trialAccess.syncKey === paidLicenseKey) {
+    return;
+  }
+  if (await hasRemoteSnapshot({ syncKey: paidLicenseKey })) {
+    await migrateTrialPassphraseToPaidLicense(trialAccess.syncKey, paidLicenseKey).catch((error) => {
+      logWarn("[cloud-sync] failed to migrate remembered trial passphrase", {
+        error: error instanceof Error ? error.message : String(error)
+      });
+    });
+    return;
+  }
+  const trialSnapshot = await readRemoteSnapshotOrNull({
+    ...trialAccess,
+    syncKey: paidLicenseKey,
+    trialMigration: true
+  });
+  if (trialSnapshot) {
+    await pushRemoteSnapshot({ syncKey: paidLicenseKey }, trialSnapshot, {
+      serializedSnapshot: JSON.stringify(trialSnapshot)
+    });
+  }
+  await migrateTrialPassphraseToPaidLicense(trialAccess.syncKey, paidLicenseKey);
+}
+async function migrateTrialCloudSyncToPaidLicenseSafe(licenseKey) {
+  try {
+    await migrateTrialCloudSyncToPaidLicense(licenseKey);
+  } catch (error) {
+    logWarn("[cloud-sync] trial snapshot migration to paid license failed", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+  }
+}
+async function resolveTrialCloudSyncAccess() {
+  let deviceId;
+  try {
+    deviceId = await getDeviceId();
+  } catch {
+    return null;
+  }
+  const trialToken = await readStoredTrialToken(deviceId).catch(() => null);
+  if (!trialToken) {
+    return null;
+  }
+  return {
+    syncKey: `trial:${deviceId}`,
+    trialDeviceId: deviceId,
+    trialToken
+  };
+}
 function formatMegabytes(bytes) {
   return (bytes / MB_DIVISOR).toFixed(2);
 }
@@ -16980,19 +17882,19 @@ async function getCloudSyncStatus() {
   let remoteUpdatedAt = state.remoteUpdatedAt ?? null;
   let remoteKind = state.remoteKind ?? "none";
   let hasRememberedPassphrase = false;
-  if (eligibility.canSync && eligibility.licenseKey) {
+  if (eligibility.canSync && eligibility.access) {
     hasRememberedPassphrase = Boolean(
-      await readRememberedCloudSyncPassphrase(eligibility.licenseKey).catch(() => null)
+      await readRememberedCloudSyncPassphrase(eligibility.access.syncKey).catch(() => null)
     );
     try {
-      const remoteMeta = await fetchRemoteSnapshotMeta(eligibility.licenseKey);
+      const remoteMeta = await fetchRemoteSnapshotMeta(eligibility.access);
       remoteUpdatedAt = remoteMeta.updatedAt;
       remoteKind = remoteMeta.snapshotKind;
       await writeState({ remoteUpdatedAt, remoteKind });
     } catch (error) {
       if (error instanceof CloudSyncClientError && error.status === 404) {
         try {
-          const remote = await fetchRemoteSnapshot(eligibility.licenseKey);
+          const remote = await fetchRemoteSnapshot(eligibility.access);
           remoteUpdatedAt = remote?.updatedAt ?? null;
           remoteKind = getSnapshotKind(remote);
         } catch {
@@ -17002,9 +17904,10 @@ async function getCloudSyncStatus() {
   }
   return {
     canSync: eligibility.canSync,
+    canDelete: eligibility.canDelete,
     reason: eligibility.reason,
     licenseState: eligibility.licenseState,
-    hasLicenseKey: Boolean(eligibility.licenseKey),
+    hasLicenseKey: eligibility.hasPaidLicenseKey,
     hasRememberedPassphrase,
     lastPushAt: state.lastPushAt ?? null,
     lastPullAt: state.lastPullAt ?? null,
@@ -17015,7 +17918,7 @@ async function getCloudSyncStatus() {
 }
 async function pushCloudSync(options = {}) {
   const eligibility = await resolveEligibility();
-  if (!eligibility.canSync || !eligibility.licenseKey) {
+  if (!eligibility.canSync || !eligibility.access) {
     return {
       mode: "push",
       status: "skipped",
@@ -17028,7 +17931,7 @@ async function pushCloudSync(options = {}) {
   try {
     await profileManager.initialize();
     const localSnapshot = await buildLocalSnapshot(profileManager, { enforcePushGuards: true });
-    const passphrase = await resolvePassphrase(eligibility.licenseKey, options);
+    const passphrase = await resolvePassphrase(eligibility.access.syncKey, options);
     const encryptedSnapshot = await encryptCloudSyncSnapshot(localSnapshot, passphrase.value);
     const serializedSnapshot = JSON.stringify(encryptedSnapshot);
     const snapshotBytes = Buffer.byteLength(serializedSnapshot, "utf8");
@@ -17046,7 +17949,7 @@ async function pushCloudSync(options = {}) {
     if (process.env.NODE_ENV !== "production") {
       logInfo("[cloud-sync] push snapshot summary", summarizeSnapshot(localSnapshot));
     }
-    const remote = await pushRemoteSnapshot(eligibility.licenseKey, encryptedSnapshot, {
+    const remote = await pushRemoteSnapshot(eligibility.access, encryptedSnapshot, {
       serializedSnapshot
     });
     const remoteKind = getSnapshotKind(remote.snapshot);
@@ -17065,7 +17968,7 @@ async function pushCloudSync(options = {}) {
         remoteUpdatedAt: remote.snapshot.updatedAt
       };
     }
-    await rememberPassphraseIfRequested(eligibility.licenseKey, options, passphrase);
+    await rememberPassphraseIfRequested(eligibility.access.syncKey, options, passphrase);
     return {
       mode: "push",
       status: "applied",
@@ -17082,7 +17985,7 @@ async function pushCloudSync(options = {}) {
 }
 async function pullCloudSync(options = {}) {
   const eligibility = await resolveEligibility();
-  if (!eligibility.canSync || !eligibility.licenseKey) {
+  if (!eligibility.canSync || !eligibility.access) {
     return {
       mode: "pull",
       status: "skipped",
@@ -17094,7 +17997,7 @@ async function pullCloudSync(options = {}) {
   const profileManager = new ProfileManager();
   try {
     await profileManager.initialize();
-    const remote = await fetchRemoteSnapshot(eligibility.licenseKey);
+    const remote = await fetchRemoteSnapshot(eligibility.access);
     if (!remote) {
       await writeState({ remoteUpdatedAt: null, remoteKind: "none" });
       return {
@@ -17109,7 +18012,7 @@ async function pullCloudSync(options = {}) {
     let passphrase = null;
     let plainSnapshot;
     if (remote.schemaVersion === CLOUD_SYNC_ENCRYPTED_SCHEMA_VERSION) {
-      passphrase = await resolvePassphrase(eligibility.licenseKey, options);
+      passphrase = await resolvePassphrase(eligibility.access.syncKey, options);
       plainSnapshot = await decryptCloudSyncSnapshot(remote, passphrase.value);
     } else {
       plainSnapshot = remote;
@@ -17122,7 +18025,7 @@ async function pullCloudSync(options = {}) {
       lastError: void 0
     });
     if (passphrase) {
-      await rememberPassphraseIfRequested(eligibility.licenseKey, options, passphrase);
+      await rememberPassphraseIfRequested(eligibility.access.syncKey, options, passphrase);
     }
     return {
       mode: "pull",
@@ -17235,7 +18138,7 @@ async function ensureCliStorageReady() {
 }
 
 // src/app/main.ts
-var VERSION = true ? "5.0.9" : "0.0.0";
+var VERSION = true ? "5.1.1" : "0.0.0";
 async function runCli() {
   const args = process.argv.slice(2);
   if (args.length === 0) {