codexuse-cli 5.1.0 → 5.1.5

package/dist/index.js

@@ -2022,7 +2022,7 @@ var require_toml = __commonJS({
 });
 
 // src/commands/accountPool.ts
-var import_node_crypto4 = require("crypto");
+var import_node_crypto7 = require("crypto");
 var import_node_path7 = __toESM(require("path"));
 
 // ../../packages/contracts/src/settings/types.ts
@@ -2366,7 +2366,7 @@ async function withDatabase(dbPath, task) {
 function resolveAppStorageDbPath(userDataDir) {
   return import_node_path.default.join(userDataDir, APP_STORAGE_DB_DIR, APP_STORAGE_DB_NAME);
 }
-async function readDocument(dbPath, namespace, normalize) {
+async function readDocument(dbPath, namespace, normalize2) {
   return withDatabase(dbPath, (db) => {
     const row = useStatement(
       db,
@@ -2377,10 +2377,10 @@ async function readDocument(dbPath, namespace, normalize) {
     if (parsed === null) {
       return null;
     }
-    return normalize(parsed);
+    return normalize2(parsed);
   });
 }
-async function readDocumentStrict(dbPath, namespace, normalize) {
+async function readDocumentStrict(dbPath, namespace, normalize2) {
   return withDatabase(dbPath, (db) => {
     const row = useStatement(
       db,
@@ -2401,7 +2401,7 @@ async function readDocumentStrict(dbPath, namespace, normalize) {
       );
     }
     try {
-      return normalize(parsed);
+      return normalize2(parsed);
     } catch (error) {
       throw new AppStorageCorruptionError(
         `App storage document ${namespace} failed normalization.`,
@@ -2480,6 +2480,25 @@ async function updateDocument(input) {
     })
   );
 }
+async function deleteDocument(dbPath, namespace) {
+  await withWriteQueue(
+    dbPath,
+    async () => withDatabase(dbPath, (db) => {
+      beginImmediate(db);
+      try {
+        useStatement(
+          db,
+          `DELETE FROM ${APP_STORAGE_TABLE} WHERE namespace = ?`,
+          (statement) => statement.run(namespace)
+        );
+        commit(db);
+      } catch (error) {
+        rollback(db);
+        throw error;
+      }
+    })
+  );
+}
 
 // ../../packages/runtime-app-state/src/app/state.ts
 var APP_STATE_DOCUMENT = "desktop.app-state";
@@ -2564,6 +2583,16 @@ function createDefaultAppState() {
       status: "inactive",
       signature: null
     },
+    trial: {
+      deviceId: null,
+      startedAt: null,
+      expiresAt: null,
+      lastServerCheckAt: null,
+      lastLocalSeenAt: null,
+      offlineGraceUntil: null,
+      serverExpired: false,
+      signature: null
+    },
     preferences: {
       excludeFolders: [],
       enableTaskCompleteBeep: true,
@@ -3011,6 +3040,25 @@ function normalizeAppState(raw) {
   if (!["inactive", "active", "grace", "error"].includes(merged.license.status)) {
     merged.license.status = "inactive";
   }
+  if (!isRecord2(merged.trial)) {
+    merged.trial = clone2(defaults.trial);
+  }
+  merged.trial.deviceId = asString(merged.trial.deviceId);
+  merged.trial.startedAt = asString(merged.trial.startedAt);
+  merged.trial.expiresAt = asString(merged.trial.expiresAt);
+  merged.trial.lastServerCheckAt = asString(merged.trial.lastServerCheckAt);
+  merged.trial.lastLocalSeenAt = asString(merged.trial.lastLocalSeenAt);
+  merged.trial.offlineGraceUntil = asString(merged.trial.offlineGraceUntil);
+  merged.trial.serverExpired = merged.trial.serverExpired === true;
+  merged.trial.signature = asString(merged.trial.signature);
+  {
+    const allowedTrialKeys = new Set(Object.keys(defaults.trial));
+    for (const key of Object.keys(merged.trial)) {
+      if (!allowedTrialKeys.has(key)) {
+        delete merged.trial[key];
+      }
+    }
+  }
   if (!Array.isArray(merged.preferences.excludeFolders)) {
     merged.preferences.excludeFolders = [];
   }
@@ -3416,7 +3464,7 @@ async function writeAppSettings(settings, onUpdated) {
 }
 
 // ../../packages/runtime-profiles/src/license/service.ts
-var import_node_crypto2 = __toESM(require("crypto"), 1);
+var import_node_crypto5 = __toESM(require("crypto"), 1);
 
 // ../../packages/runtime-codex/src/codex/settings.ts
 function asString2(value) {
@@ -3459,6 +3507,53 @@ function parseStoredLicense(raw) {
   );
   return hasValue ? license : null;
 }
+function parseStoredTrial(raw) {
+  if (!isRecord3(raw)) {
+    return null;
+  }
+  const trial = {
+    deviceId: asString2(raw.deviceId ?? raw.device_id),
+    startedAt: asString2(raw.startedAt ?? raw.started_at),
+    expiresAt: asString2(raw.expiresAt ?? raw.expires_at),
+    lastServerCheckAt: asString2(raw.lastServerCheckAt ?? raw.last_server_check_at),
+    lastLocalSeenAt: asString2(raw.lastLocalSeenAt ?? raw.last_local_seen_at),
+    offlineGraceUntil: asString2(raw.offlineGraceUntil ?? raw.offline_grace_until),
+    serverExpired: raw.serverExpired === true || raw.server_expired === true,
+    signature: asString2(raw.signature)
+  };
+  const hasValue = Boolean(
+    trial.deviceId || trial.startedAt || trial.expiresAt || trial.lastServerCheckAt || trial.lastLocalSeenAt || trial.serverExpired || trial.signature
+  );
+  return hasValue ? trial : null;
+}
+async function getStoredTrial() {
+  const state = await getAppState();
+  return parseStoredTrial(state.trial);
+}
+async function persistTrial(trial) {
+  const parsed = parseStoredTrial(trial);
+  await patchAppState({
+    trial: parsed ? {
+      deviceId: parsed.deviceId ?? null,
+      startedAt: parsed.startedAt ?? null,
+      expiresAt: parsed.expiresAt ?? null,
+      lastServerCheckAt: parsed.lastServerCheckAt ?? null,
+      lastLocalSeenAt: parsed.lastLocalSeenAt ?? null,
+      offlineGraceUntil: parsed.offlineGraceUntil ?? null,
+      serverExpired: parsed.serverExpired === true,
+      signature: parsed.signature ?? null
+    } : {
+      deviceId: null,
+      startedAt: null,
+      expiresAt: null,
+      lastServerCheckAt: null,
+      lastLocalSeenAt: null,
+      offlineGraceUntil: null,
+      serverExpired: false,
+      signature: null
+    }
+  });
+}
 async function getStoredLicense() {
   const state = await getAppState();
   return parseStoredLicense(state.license);
@@ -3590,7 +3685,9 @@ function getActiveOffer() {
     isActive: true,
     campaign: "summer-2026",
     productPermalink: "codex-use",
-    checkoutBaseUrl: "https://hweihwang.gumroad.com/l/codex-use"
+    checkoutBaseUrl: "https://hweihwang.gumroad.com/l/codex-use",
+    trialEnabled: true,
+    trialDays: 7
   };
 }
 function buildCheckoutUrl(offer2, options) {
@@ -3613,6 +3710,504 @@ function buildCheckoutUrl(offer2, options) {
   return url.toString();
 }
 
+// ../../packages/runtime-profiles/src/license/trial.ts
+var import_node_crypto4 = __toESM(require("crypto"), 1);
+
+// ../../packages/runtime-profiles/src/license/device-id.ts
+var import_node_crypto2 = __toESM(require("crypto"), 1);
+var import_promises = require("fs/promises");
+var import_node_child_process = require("child_process");
+var import_node_util = require("util");
+var DEVICE_ID_DOCUMENT = "desktop.device-id";
+var SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/i;
+var execFileAsync = (0, import_node_util.promisify)(import_node_child_process.execFile);
+var memoizedDeviceId = null;
+function normalize(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+async function readHardwareUuid() {
+  if (process.platform !== "darwin") {
+    return null;
+  }
+  try {
+    const { stdout } = await execFileAsync(
+      "ioreg",
+      ["-rd1", "-c", "IOPlatformExpertDevice"],
+      { timeout: 4e3 }
+    );
+    const match = stdout.match(/"IOPlatformUUID"\s*=\s*"([^"]+)"/);
+    return normalize(match?.[1]) || null;
+  } catch {
+    return null;
+  }
+}
+async function readLinuxMachineId() {
+  if (process.platform !== "linux") {
+    return null;
+  }
+  for (const file of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
+    try {
+      const value = normalize(await (0, import_promises.readFile)(file, "utf8"));
+      if (value) {
+        return value;
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+function hashDeviceComponent(value) {
+  return import_node_crypto2.default.createHash("sha256").update(`codexuse-device:${value}`).digest("hex");
+}
+async function getDeviceId() {
+  if (memoizedDeviceId) {
+    return memoizedDeviceId;
+  }
+  const dbPath = resolveAppStorageDbPath(getUserDataDir());
+  const cached = normalize(await readDocument(dbPath, DEVICE_ID_DOCUMENT, normalize));
+  const stableDeviceSource = await readHardwareUuid() ?? await readLinuxMachineId();
+  if (stableDeviceSource) {
+    const deviceId2 = hashDeviceComponent(stableDeviceSource);
+    if (cached !== deviceId2) {
+      await writeDocument(dbPath, DEVICE_ID_DOCUMENT, deviceId2);
+    }
+    memoizedDeviceId = deviceId2;
+    return deviceId2;
+  }
+  if (SHA256_HEX_PATTERN.test(cached)) {
+    memoizedDeviceId = cached;
+    return cached;
+  }
+  const seed = import_node_crypto2.default.randomBytes(32).toString("hex");
+  const deviceId = hashDeviceComponent(seed);
+  await writeDocument(dbPath, DEVICE_ID_DOCUMENT, deviceId);
+  memoizedDeviceId = deviceId;
+  return deviceId;
+}
+function hashEmail(email) {
+  const normalized = typeof email === "string" ? email.trim().toLowerCase() : "";
+  if (!normalized) {
+    return null;
+  }
+  return import_node_crypto2.default.createHash("sha256").update(`codexuse-email:${normalized}`).digest("hex");
+}
+
+// ../../packages/runtime-profiles/src/license/trial-client.ts
+var DEFAULT_API_BASE_URL = "https://api.codexuse.com";
+var TRIAL_REQUEST_TIMEOUT_MS = 1e4;
+function getApiBaseUrl() {
+  return DEFAULT_API_BASE_URL;
+}
+function parseResponse(raw) {
+  if (!raw || typeof raw !== "object") {
+    return null;
+  }
+  const record = raw;
+  const serverNow = typeof record.serverNow === "string" ? record.serverNow : null;
+  if (!serverNow) {
+    return null;
+  }
+  return {
+    trialActive: record.trialActive === true,
+    startedAt: typeof record.startedAt === "string" ? record.startedAt : null,
+    expiresAt: typeof record.expiresAt === "string" ? record.expiresAt : null,
+    trialToken: typeof record.trialToken === "string" ? record.trialToken : null,
+    serverNow,
+    offlineGraceMs: typeof record.offlineGraceMs === "number" && Number.isFinite(record.offlineGraceMs) ? record.offlineGraceMs : 0
+  };
+}
+async function registerTrialWithServer(input) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), TRIAL_REQUEST_TIMEOUT_MS);
+  try {
+    const response = await fetch(`${getApiBaseUrl()}/v1/trial/register`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        deviceId: input.deviceId,
+        emailHash: input.emailHash ?? null,
+        trialToken: input.trialToken ?? null
+      }),
+      signal: controller.signal
+    });
+    if (!response.ok) {
+      throw new Error(`Trial registration failed (${response.status}).`);
+    }
+    const parsed = parseResponse(await response.json());
+    if (!parsed) {
+      throw new Error("Trial registration response was incomplete.");
+    }
+    return parsed;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+// ../../packages/runtime-profiles/src/license/trial-token-store.ts
+var import_node_crypto3 = require("crypto");
+var import_node_child_process2 = require("child_process");
+var KEYCHAIN_SERVICE = "CODEXUSE_TRIAL_TOKEN";
+var KEYCHAIN_ACCOUNT_PREFIX = "device-sha256:";
+var FALLBACK_DOCUMENT_PREFIX = "desktop.trial-token.";
+function keychainAccountForDevice(deviceId) {
+  const digest = (0, import_node_crypto3.createHash)("sha256").update(deviceId).digest("hex");
+  return KEYCHAIN_ACCOUNT_PREFIX + digest;
+}
+function fallbackDocumentForDevice(deviceId) {
+  const digest = (0, import_node_crypto3.createHash)("sha256").update(deviceId).digest("hex");
+  return FALLBACK_DOCUMENT_PREFIX + digest;
+}
+function normalizeToken(value) {
+  const trimmed = typeof value === "string" ? value.trim() : "";
+  return trimmed.length > 0 ? trimmed : null;
+}
+function runSecurityCommand(args) {
+  return new Promise((resolve, reject) => {
+    const child = (0, import_node_child_process2.spawn)("security", args, { stdio: ["ignore", "pipe", "ignore"] });
+    let stdout = "";
+    child.stdout?.on("data", (chunk) => {
+      stdout += String(chunk);
+    });
+    child.on("error", () => {
+      reject(new Error("keychain-command-failed"));
+    });
+    child.on("close", (code) => {
+      resolve({ code, stdout });
+    });
+  });
+}
+async function readStoredTrialToken(deviceId) {
+  if (process.platform !== "darwin") {
+    const dbPath = resolveAppStorageDbPath(getUserDataDir());
+    return readDocument(
+      dbPath,
+      fallbackDocumentForDevice(deviceId),
+      normalizeToken
+    );
+  }
+  const result = await runSecurityCommand([
+    "find-generic-password",
+    "-a",
+    keychainAccountForDevice(deviceId),
+    "-s",
+    KEYCHAIN_SERVICE,
+    "-w"
+  ]).catch(() => null);
+  await deleteDocument(
+    resolveAppStorageDbPath(getUserDataDir()),
+    fallbackDocumentForDevice(deviceId)
+  ).catch(() => void 0);
+  if (!result || result.code !== 0) {
+    return null;
+  }
+  return result.stdout.length > 0 ? result.stdout.replace(/\n$/, "") : null;
+}
+async function writeStoredTrialToken(deviceId, token) {
+  const value = typeof token === "string" ? token.trim() : "";
+  if (!value) {
+    return;
+  }
+  if (process.platform !== "darwin") {
+    const dbPath = resolveAppStorageDbPath(getUserDataDir());
+    await writeDocument(
+      dbPath,
+      fallbackDocumentForDevice(deviceId),
+      value
+    );
+    return;
+  }
+  const result = await runSecurityCommand([
+    "add-generic-password",
+    "-U",
+    "-a",
+    keychainAccountForDevice(deviceId),
+    "-s",
+    KEYCHAIN_SERVICE,
+    "-w",
+    value
+  ]).catch(() => null);
+  await deleteDocument(
+    resolveAppStorageDbPath(getUserDataDir()),
+    fallbackDocumentForDevice(deviceId)
+  ).catch(() => void 0);
+  if (!result || result.code !== 0) {
+    throw new Error("trial-token-keychain-write-failed");
+  }
+}
+
+// ../../packages/runtime-profiles/src/license/trial.ts
+var DAY_MS = 24 * 60 * 60 * 1e3;
+var TRIAL_SERVER_REFRESH_MS = 15 * 60 * 1e3;
+var TRIAL_BACKGROUND_RETRY_MS = 60 * 1e3;
+var CLOCK_ROLLBACK_TOLERANCE_MS = 5 * 60 * 1e3;
+var verifiedTrialCache = null;
+var backgroundTrialSyncPromise = null;
+var nextBackgroundTrialSyncAtMs = 0;
+function isTrialEnforcementEnabled() {
+  return true;
+}
+function trialSignaturePayload(trial) {
+  return JSON.stringify({
+    deviceId: trial.deviceId ?? null,
+    startedAt: trial.startedAt ?? null,
+    expiresAt: trial.expiresAt ?? null,
+    lastServerCheckAt: trial.lastServerCheckAt ?? null,
+    lastLocalSeenAt: trial.lastLocalSeenAt ?? null,
+    offlineGraceUntil: trial.offlineGraceUntil ?? null,
+    serverExpired: trial.serverExpired === true
+  });
+}
+function signTrial(trial, secret) {
+  return import_node_crypto4.default.createHmac("sha256", secret).update(trialSignaturePayload(trial)).digest("hex");
+}
+function withTrialSignature(trial, secret) {
+  return { ...trial, signature: signTrial(trial, secret) };
+}
+function isSignatureValid(trial, secret) {
+  return Boolean(trial.signature) && signTrial(trial, secret) === trial.signature;
+}
+function parseTs(value) {
+  if (typeof value !== "string" || value.trim() === "") {
+    return null;
+  }
+  const parsed = Date.parse(value);
+  return Number.isNaN(parsed) ? null : parsed;
+}
+function buildTrialInfo(stored, now) {
+  const expiresAtMs = parseTs(stored?.expiresAt);
+  const expired = stored?.serverExpired === true || expiresAtMs === null || expiresAtMs <= now;
+  const daysLeft = expired || expiresAtMs === null ? 0 : Math.max(0, Math.ceil((expiresAtMs - now) / DAY_MS));
+  return {
+    active: !expired,
+    expired,
+    expiresAt: stored?.expiresAt ?? null,
+    daysLeft
+  };
+}
+function buildLockedTrialInfo(stored) {
+  return {
+    active: false,
+    expired: true,
+    expiresAt: stored?.expiresAt ?? null,
+    daysLeft: 0
+  };
+}
+function hasTrustedServerRecord(stored, secret, deviceId) {
+  return Boolean(
+    stored && stored.deviceId === deviceId && stored.startedAt && stored.lastServerCheckAt && isSignatureValid(stored, secret)
+  );
+}
+function shouldRefreshInBackground(stored, now) {
+  const lastServerCheckMs = parseTs(stored.lastServerCheckAt);
+  return lastServerCheckMs !== null && now - lastServerCheckMs >= TRIAL_SERVER_REFRESH_MS;
+}
+function hasLocalClockRollback(stored, now) {
+  const lastTrustedMs = Math.max(
+    parseTs(stored.lastLocalSeenAt) ?? 0,
+    parseTs(stored.lastServerCheckAt) ?? 0
+  );
+  return lastTrustedMs > 0 && now + CLOCK_ROLLBACK_TOLERANCE_MS < lastTrustedMs;
+}
+function canUseOfflineTrial(stored, now) {
+  if (stored.serverExpired === true || hasLocalClockRollback(stored, now)) {
+    return false;
+  }
+  const expiresAtMs = parseTs(stored.expiresAt);
+  const offlineGraceUntilMs = parseTs(stored.offlineGraceUntil);
+  const effectiveNow = trustedTrialNow(stored, now);
+  if (expiresAtMs === null || offlineGraceUntilMs === null) {
+    return false;
+  }
+  return effectiveNow < expiresAtMs && effectiveNow <= offlineGraceUntilMs;
+}
+function trustedTrialNow(stored, now) {
+  return Math.max(now, parseTs(stored.lastServerCheckAt) ?? now);
+}
+async function persistLocalSeenIfNeeded(stored, secret, now) {
+  const lastLocalSeenMs = parseTs(stored.lastLocalSeenAt);
+  if (lastLocalSeenMs !== null && now - lastLocalSeenMs < TRIAL_SERVER_REFRESH_MS) {
+    return stored;
+  }
+  const next = withTrialSignature(
+    {
+      ...stored,
+      lastLocalSeenAt: new Date(Math.max(now, lastLocalSeenMs ?? 0)).toISOString()
+    },
+    secret
+  );
+  await persistTrial(next);
+  return next;
+}
+function startTrialSyncInBackground() {
+  const now = Date.now();
+  if (backgroundTrialSyncPromise || now < nextBackgroundTrialSyncAtMs) {
+    return;
+  }
+  nextBackgroundTrialSyncAtMs = now + TRIAL_BACKGROUND_RETRY_MS;
+  backgroundTrialSyncPromise = syncTrialWithServer({ force: true }).catch(() => false).finally(() => {
+    backgroundTrialSyncPromise = null;
+  });
+}
+async function resolveFirstProfileEmailHash() {
+  try {
+    const state = await getAppState();
+    for (const record of Object.values(state.profilesByName ?? {})) {
+      const hashed = hashEmail(record.email ?? null);
+      if (hashed) {
+        return hashed;
+      }
+    }
+  } catch {
+  }
+  return null;
+}
+function signedServerTrial(input) {
+  const serverNowMs = parseTs(input.response.serverNow) ?? input.now;
+  return withTrialSignature(
+    {
+      deviceId: input.deviceId,
+      startedAt: input.response.startedAt ?? input.stored?.startedAt ?? new Date(serverNowMs).toISOString(),
+      expiresAt: input.response.expiresAt ?? input.stored?.expiresAt ?? null,
+      lastServerCheckAt: input.response.serverNow,
+      lastLocalSeenAt: new Date(input.now).toISOString(),
+      offlineGraceUntil: new Date(serverNowMs + input.response.offlineGraceMs).toISOString(),
+      serverExpired: input.response.trialActive === false
+    },
+    input.secret
+  );
+}
+async function syncAndPersistTrial(input) {
+  let deviceId;
+  try {
+    deviceId = await getDeviceId();
+  } catch {
+    return null;
+  }
+  const emailHash = input.emailHash ?? await resolveFirstProfileEmailHash();
+  try {
+    const trialToken = await readStoredTrialToken(deviceId).catch(() => null);
+    const response = await registerTrialWithServer({ deviceId, emailHash, trialToken });
+    if (response.trialToken) {
+      try {
+        await writeStoredTrialToken(deviceId, response.trialToken);
+      } catch {
+        if (!trialToken) {
+          return null;
+        }
+      }
+    }
+    const next = signedServerTrial({
+      response,
+      secret: input.secret,
+      stored: input.stored,
+      now: input.now,
+      deviceId
+    });
+    await persistTrial(next);
+    rememberServerVerifiedTrial(next, input.now);
+    return next;
+  } catch {
+    return null;
+  }
+}
+function rememberServerVerifiedTrial(stored, now) {
+  const refreshAtMs = now + TRIAL_SERVER_REFRESH_MS;
+  const expiresAtMs = stored.serverExpired === true ? refreshAtMs : parseTs(stored.expiresAt) ?? now;
+  verifiedTrialCache = {
+    stored,
+    usableUntilMs: Math.max(now, Math.min(expiresAtMs, refreshAtMs))
+  };
+}
+function readServerVerifiedTrial(now) {
+  if (!verifiedTrialCache || verifiedTrialCache.usableUntilMs <= now) {
+    verifiedTrialCache = null;
+    return null;
+  }
+  return verifiedTrialCache.stored;
+}
+async function resolveTrialState(now = Date.now(), options = {}) {
+  if (!isTrialEnforcementEnabled()) {
+    return { info: null, locked: false };
+  }
+  const allowNetwork = options.allowNetwork !== false;
+  const secret = await getLicenseSecret();
+  let stored = await getStoredTrial();
+  const hadStoredTrial = stored !== null;
+  const currentDeviceId = await getDeviceId().catch(() => null);
+  const cached = readServerVerifiedTrial(now);
+  if (cached) {
+    if (!currentDeviceId || !hasTrustedServerRecord(cached, secret, currentDeviceId)) {
+      verifiedTrialCache = null;
+    } else {
+      if (hasLocalClockRollback(cached, now)) {
+        const refreshed2 = allowNetwork ? await syncAndPersistTrial({ stored: cached, secret, now }) : null;
+        if (!refreshed2) {
+          return { info: buildLockedTrialInfo(cached), locked: true };
+        }
+        const info3 = buildTrialInfo(refreshed2, trustedTrialNow(refreshed2, now));
+        return { info: info3, locked: info3.expired };
+      }
+      if (shouldRefreshInBackground(cached, now)) {
+        void syncTrialWithServer({ force: true }).catch(() => void 0);
+      }
+      const info2 = buildTrialInfo(cached, trustedTrialNow(cached, now));
+      return { info: info2, locked: info2.expired };
+    }
+  }
+  if (stored && (!currentDeviceId || !hasTrustedServerRecord(stored, secret, currentDeviceId))) {
+    stored = null;
+  }
+  if (!allowNetwork) {
+    if (stored && canUseOfflineTrial(stored, now)) {
+      const next = await persistLocalSeenIfNeeded(stored, secret, now).catch(() => stored);
+      rememberServerVerifiedTrial(next, now);
+      if (options.refreshInBackground === true && shouldRefreshInBackground(next, now)) {
+        startTrialSyncInBackground();
+      }
+      const info2 = buildTrialInfo(next, trustedTrialNow(next, now));
+      return { info: info2, locked: info2.expired };
+    }
+    if (options.refreshInBackground === true) {
+      startTrialSyncInBackground();
+    }
+    if (!hadStoredTrial && options.refreshInBackground === true) {
+      return { info: null, locked: false };
+    }
+    return { info: buildLockedTrialInfo(stored), locked: true };
+  }
+  const refreshed = await syncAndPersistTrial({ stored, secret, now });
+  if (!refreshed) {
+    if (stored && canUseOfflineTrial(stored, now)) {
+      const next = await persistLocalSeenIfNeeded(stored, secret, now).catch(() => stored);
+      rememberServerVerifiedTrial(next, now);
+      const info2 = buildTrialInfo(next, trustedTrialNow(next, now));
+      return { info: info2, locked: info2.expired };
+    }
+    return { info: buildLockedTrialInfo(stored), locked: true };
+  }
+  const info = buildTrialInfo(refreshed, trustedTrialNow(refreshed, now));
+  return { info, locked: info.expired };
+}
+async function syncTrialWithServer(opts = {}) {
+  if (!isTrialEnforcementEnabled()) {
+    return true;
+  }
+  const now = Date.now();
+  const secret = await getLicenseSecret();
+  const stored = await getStoredTrial();
+  const explicitEmailHash = opts.emailHash ?? null;
+  if (!opts.force && !explicitEmailHash && readServerVerifiedTrial(now)) {
+    return true;
+  }
+  const next = await syncAndPersistTrial({
+    stored,
+    secret,
+    now,
+    emailHash: explicitEmailHash
+  });
+  return next !== null;
+}
+
 // ../../packages/runtime-profiles/src/license/service.ts
 var offer = getActiveOffer();
 var PRODUCT_PERMALINK = offer.productPermalink;
@@ -3677,7 +4272,7 @@ function licenseSignaturePayload(license) {
   return JSON.stringify(payload);
 }
 function signLicense(license, secret) {
-  return import_node_crypto2.default.createHmac("sha256", secret).update(licenseSignaturePayload(license)).digest("hex");
+  return import_node_crypto5.default.createHmac("sha256", secret).update(licenseSignaturePayload(license)).digest("hex");
 }
 function withSignature(license, secret) {
   return {
@@ -3685,7 +4280,7 @@ function withSignature(license, secret) {
     signature: signLicense(license, secret)
   };
 }
-function isSignatureValid(license, secret) {
+function isSignatureValid2(license, secret) {
   if (!license.signature) {
     return false;
   }
@@ -3732,9 +4327,19 @@ async function requestGumroadVerify(licenseKey, mode) {
     clearTimeout(timeout);
   }
 }
-function normalizeVerificationResult(response) {
+function isExplicitRevocationMessage(message) {
+  if (!message) {
+    return false;
+  }
+  const normalized = message.toLowerCase();
+  return normalized.includes("revoked") || normalized.includes("refunded") || normalized.includes("chargeback") || normalized.includes("disabled") || normalized.includes("subscription") || normalized.includes("no longer active");
+}
+function normalizeVerificationResult(response, mode) {
   if (!response.success) {
     const message = response.message ?? "License key is invalid.";
+    if (mode === "refresh" && !isExplicitRevocationMessage(message)) {
+      throw new LicenseError(message, "network");
+    }
     throw new LicenseError(message, "invalid");
   }
   if (!response.purchase) {
@@ -3763,6 +4368,47 @@ function ensureWithinUseLimit(response) {
     );
   }
 }
+function computeCapabilities(opts) {
+  return {
+    unlimitedProfiles: opts.entitled,
+    accountPool: opts.entitled,
+    telegram: opts.entitled,
+    autoRoll: opts.entitled,
+    cloudSync: opts.licensed || opts.entitled
+  };
+}
+function applyTrial(base, trial) {
+  if (base.isPro) {
+    return { ...base, trial: null };
+  }
+  const { info, locked } = trial;
+  if (!info) {
+    return base;
+  }
+  if (info.active) {
+    return {
+      ...base,
+      tier: "trial",
+      state: "trial",
+      capabilities: computeCapabilities({ licensed: false, entitled: true }),
+      profileLimit: null,
+      profilesRemaining: null,
+      trial: info
+    };
+  }
+  if (locked) {
+    return {
+      ...base,
+      tier: "free",
+      state: "locked",
+      capabilities: computeCapabilities({ licensed: false, entitled: false }),
+      profileLimit: 0,
+      profilesRemaining: 0,
+      trial: info
+    };
+  }
+  return { ...base, trial: info };
+}
 function toLicenseStatus(stored, overrides = {}) {
   const tier = determineTierFromStored(stored);
   const isPro = tier === "pro";
@@ -3771,6 +4417,8 @@ function toLicenseStatus(stored, overrides = {}) {
     tier,
     state,
     isPro,
+    capabilities: computeCapabilities({ licensed: isPro, entitled: isPro }),
+    trial: null,
     profileLimit: isPro ? null : FREE_PROFILE_LIMIT,
     profilesRemaining: null,
     purchaseEmail: stored?.purchaseEmail ?? null,
@@ -3812,15 +4460,27 @@ var LicenseService = class {
     const refreshInBackground = Boolean(options.refreshInBackground);
     const secret = await getLicenseSecret();
     const stored = await getStoredLicense();
+    const finalize = async (status) => {
+      if (status.isPro) {
+        return { ...status, trial: null };
+      }
+      return applyTrial(
+        status,
+        await resolveTrialState(Date.now(), {
+          allowNetwork: !allowStale || forceRefresh,
+          refreshInBackground
+        })
+      );
+    };
     if (!stored?.licenseKey) {
-      return toLicenseStatus(null);
+      return finalize(toLicenseStatus(null));
     }
     const now = Date.now();
     const nextCheckTs = parseTimestamp(stored.nextCheckAt);
     const lastVerifiedTs = parseTimestamp(stored.lastVerifiedAt);
     const graceStale = (stored.status === "grace" || stored.status === "error") && (lastVerifiedTs === null || lastVerifiedTs + GRACE_MAX_AGE_MS < now);
     let workingStored = { ...stored };
-    const signatureValid = isSignatureValid(workingStored, secret);
+    const signatureValid = isSignatureValid2(workingStored, secret);
     let cappedNextCheckTs = nextCheckTs;
     if (nextCheckTs !== null && nextCheckTs > now + MAX_NEXT_CHECK_MS) {
       cappedNextCheckTs = now;
@@ -3843,7 +4503,7 @@ var LicenseService = class {
       if (allowStale && shouldRefresh && refreshInBackground) {
         this.refreshStatusInBackground({ force: forceRefresh });
       }
-      return cached;
+      return finalize(cached);
     }
     if (this.verificationPromise && !forceRefresh) {
       return this.verificationPromise;
@@ -3852,7 +4512,7 @@ var LicenseService = class {
       try {
         const result = await requestGumroadVerify(workingStored.licenseKey, "refresh");
         ensureWithinUseLimit(result);
-        const normalized = normalizeVerificationResult(result);
+        const normalized = normalizeVerificationResult(result, "refresh");
         const updated = {
           licenseKey: workingStored.licenseKey,
           purchaseEmail: normalized.email,
@@ -3863,7 +4523,7 @@ var LicenseService = class {
         };
         const signed = withSignature(updated, secret);
         await persistLicense(signed);
-        return toLicenseStatus(signed);
+        return finalize(toLicenseStatus(signed));
       } catch (error) {
         const message = error instanceof Error ? error.message : "License verification failed.";
         if (error instanceof LicenseError && error.code === "network") {
@@ -3881,7 +4541,7 @@ var LicenseService = class {
             state: fallbackStored2.status ?? "grace",
             error: message
           });
-          return fallback;
+          return finalize(fallback);
         }
         const fallbackStored = withSignature({
           licenseKey: workingStored.licenseKey,
@@ -3892,7 +4552,7 @@ var LicenseService = class {
           lastVerificationError: message
         }, secret);
         await persistLicense(fallbackStored);
-        return toLicenseStatus(fallbackStored, { error: message });
+        return finalize(toLicenseStatus(fallbackStored, { error: message }));
       }
     };
     this.verificationPromise = verify();
@@ -3908,10 +4568,10 @@ var LicenseService = class {
       throw new Error("License key is required.");
     }
     const secret = await getLicenseSecret();
-    const digest = import_node_crypto2.default.createHash("sha256").update(trimmed).digest("hex");
+    const digest = import_node_crypto5.default.createHash("sha256").update(trimmed).digest("hex");
     const result = await requestGumroadVerify(trimmed, "activation");
     ensureWithinUseLimit(result);
-    const normalized = normalizeVerificationResult(result);
+    const normalized = normalizeVerificationResult(result, "activation");
     const stored = {
       licenseKey: trimmed,
       purchaseEmail: normalized.email,
@@ -3950,9 +4610,28 @@ var LicenseService = class {
   }
 };
 var licenseService = new LicenseService();
+function isExplicitInvalidation(message) {
+  if (!message) {
+    return false;
+  }
+  const normalized = message.toLowerCase();
+  return normalized.includes("revoked") || normalized.includes("refunded") || normalized.includes("invalid") || normalized.includes("no longer active");
+}
+function shouldEnforceProfileLimit(status) {
+  if (status.capabilities.unlimitedProfiles) {
+    return false;
+  }
+  if (status.state === "grace" || status.state === "verifying" || status.state === "error") {
+    return false;
+  }
+  if (isExplicitInvalidation(status.error)) {
+    return true;
+  }
+  return status.state === "inactive" || status.state === "locked";
+}
 
 // ../../packages/runtime-profiles/src/profiles/profile-manager.ts
-var import_node_crypto3 = require("crypto");
+var import_node_crypto6 = require("crypto");
 var import_fs = require("fs");
 var import_path = __toESM(require("path"), 1);
 var import_path2 = require("path");
@@ -4001,11 +4680,15 @@ function resolveProfileIdentityKey(profile) {
   return profileName ? `profile:${profileName}` : null;
 }
 function resolveProfileIdentityKeyFromProfile(profile) {
+  const rateLimitKey = normalizeValue(profile.rateLimitKey);
+  if (rateLimitKey) {
+    return rateLimitKey;
+  }
   return resolveProfileIdentityKey(profile) ?? `profile:${profile.name}`;
 }
 
 // ../../packages/runtime-codex/src/codex/rpc.ts
-var import_node_child_process2 = require("child_process");
+var import_node_child_process4 = require("child_process");
 var import_node_readline = __toESM(require("readline"), 1);
 var import_node_fs3 = require("fs");
 var import_node_os2 = __toESM(require("os"), 1);
@@ -4137,7 +4820,7 @@ async function requireCodexCli() {
 }
 
 // ../../packages/runtime-codex/src/codex/command.ts
-var import_node_child_process = require("child_process");
+var import_node_child_process3 = require("child_process");
 var import_node_path4 = __toESM(require("path"), 1);
 var cachedNodeRuntime = null;
 function isJavaScriptEntrypoint(binaryPath) {
@@ -4180,7 +4863,7 @@ function resolveNodeRuntime(env) {
     )
   );
   for (const candidate of candidates) {
-    const probe = (0, import_node_child_process.spawnSync)(candidate, ["-v"], { env: runtimeEnv, stdio: "ignore" });
+    const probe = (0, import_node_child_process3.spawnSync)(candidate, ["-v"], { env: runtimeEnv, stdio: "ignore" });
     if (!probe.error && probe.status === 0) {
       cachedNodeRuntime = candidate;
       return candidate;
@@ -4204,6 +4887,17 @@ function buildCodexCommand(binaryPath, args, env) {
   };
 }
 
+// ../../packages/runtime-codex/src/cli/env.ts
+function buildCodexChildEnv(overrides = {}) {
+  const env = { ...process.env };
+  for (const key of Object.keys(env)) {
+    if (key.startsWith("OPENAI_")) {
+      delete env[key];
+    }
+  }
+  return { ...env, ...overrides };
+}
+
 // ../../packages/shared/src/core/logger.ts
 var isTestEnv = process.env.NODE_ENV === "test" || process.env.VITEST === "true" || process.env.VITEST === "1";
 function isMocked(fn) {
@@ -5046,20 +5740,19 @@ async function fetchRateLimitsViaRpc(envOverride, options = {}) {
     });
     return null;
   }
-  const childEnv = {
-    ...process.env,
+  const childEnv = buildCodexChildEnv({
     ...envOverride ?? {},
     HOME: tempHome,
     CODEX_HOME: tempHome,
     CODEX_TELEMETRY_LABEL: "codex-rpc",
     ELECTRON_RUN_AS_NODE: "1"
-  };
+  });
   const command = buildCodexCommand(
     binaryPath,
     ["-s", "read-only", "-a", "untrusted", "app-server"],
     childEnv
   );
-  const child = (0, import_node_child_process2.spawn)(command.command, command.args, {
+  const child = (0, import_node_child_process4.spawn)(command.command, command.args, {
     stdio: ["pipe", "pipe", "pipe"],
     env: childEnv,
     shell: command.shell
@@ -5156,20 +5849,19 @@ async function activateResetWindowViaRpc(envOverride, options = {}) {
     });
     return { status: "skipped", reason: "auth-missing" };
   }
-  const childEnv = {
-    ...process.env,
+  const childEnv = buildCodexChildEnv({
     ...envOverride ?? {},
     HOME: tempHome,
     CODEX_HOME: tempHome,
     CODEX_TELEMETRY_LABEL: "codex-reset-activation",
     ELECTRON_RUN_AS_NODE: "1"
-  };
+  });
   const command = buildCodexCommand(
     binaryPath,
     ["-s", "read-only", "-a", "untrusted", "app-server"],
     childEnv
   );
-  const child = (0, import_node_child_process2.spawn)(command.command, command.args, {
+  const child = (0, import_node_child_process4.spawn)(command.command, command.args, {
     stdio: ["pipe", "pipe", "pipe"],
     env: childEnv,
     shell: command.shell
@@ -5486,6 +6178,7 @@ var ProfileManager = class {
       displayName: record.displayName ?? null,
       data: record.data,
       metadata: record.metadata,
+      rateLimitKey: record.rateLimitKey ?? null,
       accountId: record.accountId ?? null,
       workspaceId: record.workspaceId ?? null,
       workspaceName: record.workspaceName ?? null,
@@ -5503,11 +6196,14 @@ var ProfileManager = class {
     if (!dataRaw || typeof dataRaw !== "object") {
       return null;
     }
-    return {
+    const data = cloneJson(dataRaw);
+    const metadata = raw.metadata ? cloneJson(raw.metadata) : void 0;
+    const fallbackRecord = {
       name: profileName,
       displayName: typeof raw.displayName === "string" ? raw.displayName : null,
-      data: cloneJson(dataRaw),
-      metadata: raw.metadata ? cloneJson(raw.metadata) : void 0,
+      data,
+      metadata,
+      rateLimitKey: typeof raw.rateLimitKey === "string" ? raw.rateLimitKey : null,
       accountId: typeof raw.accountId === "string" ? raw.accountId : null,
       workspaceId: typeof raw.workspaceId === "string" ? raw.workspaceId : null,
       workspaceName: typeof raw.workspaceName === "string" ? raw.workspaceName : null,
@@ -5516,6 +6212,10 @@ var ProfileManager = class {
       createdAt: typeof raw.createdAt === "string" ? raw.createdAt : null,
       updatedAt: typeof raw.updatedAt === "string" ? raw.updatedAt : null
     };
+    return {
+      ...fallbackRecord,
+      rateLimitKey: fallbackRecord.rateLimitKey ?? this.resolveProfileIdentityFromRecord(fallbackRecord)
+    };
   }
   async readProfilesStateSource() {
     const state = await getAppState();
@@ -5565,10 +6265,11 @@ var ProfileManager = class {
   }
   rateLimitSnapshotKeysForRecord(record) {
     return Array.from(
-      /* @__PURE__ */ new Set([
+      new Set([
         this.resolveProfileIdentityFromRecord(record),
+        record.rateLimitKey,
         resolveFallbackAccountKey(record.name)
-      ])
+      ].filter((key) => Boolean(key)))
     );
   }
   rateLimitSnapshotKeysForStateMap(map) {
@@ -5633,7 +6334,7 @@ var ProfileManager = class {
     if (!trimmed) {
       return this.emptyAuthSnapshot();
     }
-    const fingerprint = (0, import_node_crypto3.createHash)("sha256").update(trimmed).digest("hex");
+    const fingerprint = (0, import_node_crypto6.createHash)("sha256").update(trimmed).digest("hex");
     try {
       const parsed = JSON.parse(trimmed);
       const normalized = this.normalizeProfileData(parsed);
@@ -6281,6 +6982,7 @@ var ProfileManager = class {
       displayName,
       data,
       metadata: resolvedMetadata,
+      rateLimitKey: existingRecord?.rateLimitKey ?? this.resolveProfileIdentityFromData(resolvedName, data, resolvedMetadata),
       accountId,
       workspaceId: data.workspace_id ?? workspaceId,
       workspaceName: data.workspace_name ?? workspaceName,
@@ -6299,6 +7001,7 @@ var ProfileManager = class {
       createdAt: row.createdAt ?? void 0,
       authMethod: row.authMethod ?? void 0,
       accountId: row.accountId ?? void 0,
+      rateLimitKey: row.rateLimitKey ?? void 0,
       workspaceId: row.workspaceId ?? void 0,
       workspaceName: row.workspaceName ?? void 0,
       metadata: row.metadata
@@ -6335,6 +7038,7 @@ var ProfileManager = class {
       name,
       displayName: fallback?.displayName ?? name,
       isValid: Boolean(data && Object.keys(data).length > 0),
+      rateLimitKey: fallback?.rateLimitKey,
       accountId,
       workspaceId,
       workspaceName,
@@ -6726,11 +7430,10 @@ var ProfileManager = class {
     const codexFormat = this.convertToCodexFormat(profileData);
     const profileHome = await this.prepareProfileHome(profileName, codexFormat);
     const authPath = import_path.default.join(profileHome, "auth.json");
-    const envOverrides = {
-      ...process.env,
+    const envOverrides = buildCodexChildEnv({
       HOME: profileHome,
       CODEX_HOME: profileHome
-    };
+    });
     try {
       return await action(envOverrides);
     } finally {
@@ -6780,11 +7483,10 @@ var ProfileManager = class {
         const profileHome = await this.prepareProfileHome(profileName, codexFormat);
         return {
           profileHome,
-          env: {
-            ...process.env,
+          env: buildCodexChildEnv({
             HOME: profileHome,
             CODEX_HOME: profileHome
-          }
+          })
         };
       })
     );
@@ -7029,13 +7731,13 @@ var ProfileManager = class {
           profileName,
           async (env) => {
             try {
-              const oauthSnapshot = await fetchRateLimitsViaOAuth(env);
-              if (oauthSnapshot) {
-                return oauthSnapshot;
+              const rpcSnapshot = await fetchRateLimitsViaRpc(env, { codexPath: options.codexPath });
+              if (rpcSnapshot) {
+                return rpcSnapshot;
               }
             } catch {
             }
-            return fetchRateLimitsViaRpc(env, { codexPath: options.codexPath });
+            return fetchRateLimitsViaOAuth(env);
           },
           { syncFromActiveAuthBeforeAction: false }
         )
@@ -7285,7 +7987,7 @@ var ProfileManager = class {
       }
       if (options.canAutoImport === false) {
         return this.buildActiveCodexAuthStatus("unmanaged", description, {
-          importBlockedReason: options.importBlockedReason ?? "Profile limit reached. Upgrade to CodexUse Pro or remove a profile before importing this Codex login."
+          importBlockedReason: options.importBlockedReason ?? "Your CodexUse trial has ended. Upgrade to Pro before importing this Codex login."
         });
       }
       const records = await this.listProfileRecords();
@@ -7380,6 +8082,7 @@ var ProfileManager = class {
           displayName: typeof candidate.displayName === "string" ? candidate.displayName : null,
           data,
           metadata,
+          rateLimitKey: this.resolveProfileIdentityFromData(name, data, metadata),
           accountId: typeof candidate.accountId === "string" ? candidate.accountId : null,
           workspaceId: typeof candidate.workspaceId === "string" ? candidate.workspaceId : null,
           workspaceName: typeof candidate.workspaceName === "string" ? candidate.workspaceName : null,
@@ -7473,7 +8176,7 @@ Flags:
   --runtime=NAME   Accounts Pool runtime store: desktop
   --state-dir=PATH Override the runtime state dir for Accounts Pool inspection
   --passphrase-stdin Read Cloud Sync passphrase from stdin
-Note: profile autoroll requires Pro.
+Note: profile autoroll requires Pro or an active trial.
 Cloud Sync: set CODEXUSE_SYNC_PASSPHRASE or use --passphrase-stdin unless the passphrase is saved in Keychain.
 `);
 }
@@ -7525,7 +8228,7 @@ function parseStringFlag(flags, name) {
 
 // src/commands/accountPool.ts
 var ACCOUNT_POOL_DOCUMENT = "desktop.account-pool.v2";
-var ACCOUNT_POOL_PRO_REQUIRED_MESSAGE = "Accounts Pool requires a Pro license.";
+var ACCOUNT_POOL_PRO_REQUIRED_MESSAGE = "Accounts Pool requires a Pro license or an active trial.";
 var DESKTOP_RPC_STATE_DIR = "desktop-rpc";
 var ACCOUNT_POOL_STORE_VERSION = 3;
 var MAX_RESPONSE_IDS_PER_SESSION = 64;
@@ -7913,13 +8616,13 @@ async function listApiKeys(stateDir) {
   return Object.values(store.apiKeysById).filter((key) => key.revokedAt === null).sort((left, right) => right.createdAt.localeCompare(left.createdAt)).map(accountPoolApiKeyView);
 }
 function hashToken(token) {
-  return (0, import_node_crypto4.createHash)("sha256").update(token).digest("hex");
+  return (0, import_node_crypto7.createHash)("sha256").update(token).digest("hex");
 }
 async function createApiKey(stateDir) {
-  const plaintextToken = `cux_pool_${(0, import_node_crypto4.randomBytes)(24).toString("hex")}`;
+  const plaintextToken = `cux_pool_${(0, import_node_crypto7.randomBytes)(24).toString("hex")}`;
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const keyRecord = {
-    id: (0, import_node_crypto4.randomUUID)(),
+    id: (0, import_node_crypto7.randomUUID)(),
     tokenHash: hashToken(plaintextToken),
     tokenPreview: `${plaintextToken.slice(0, 8)}...${plaintextToken.slice(-6)}`,
     createdAt: now,
@@ -8013,7 +8716,7 @@ async function readAccountPoolRuntimeSummary(input = {}) {
     stateDir,
     baseUrl: resolveBaseUrlFromPort(runtime, input.port ?? null),
     enabled: normalized.accountPoolEnabled,
-    hasProLicense: license?.isPro === true,
+    hasAccountPoolAccess: license?.capabilities.accountPool === true,
     routingStrategy: normalized.accountPoolRoutingStrategy,
     activeApiKeyCount: apiKeys.length,
     activeSessionCount: sessions.length
@@ -8030,7 +8733,7 @@ async function updateSettings(transform) {
   const { raw, normalized } = await readSettingsSnapshot();
   const nextSettings = transform(normalized);
   const license = await licenseService.getStatus().catch(() => null);
-  const forcedDisabledByLicense = !license?.isPro && nextSettings.accountPoolEnabled === true;
+  const forcedDisabledByLicense = license?.capabilities.accountPool !== true && nextSettings.accountPoolEnabled === true;
   const sanitizedSettings = {
     ...nextSettings,
     accountPoolEnabled: forcedDisabledByLicense ? false : nextSettings.accountPoolEnabled,
@@ -8057,7 +8760,7 @@ async function updateSettings(transform) {
 }
 async function requireProAccess() {
   const license = await licenseService.getStatus();
-  if (!license.isPro) {
+  if (!license.capabilities.accountPool) {
     throw new Error(ACCOUNT_POOL_PRO_REQUIRED_MESSAGE);
   }
 }
@@ -8119,7 +8822,7 @@ async function handleStatus(flags) {
   console.log(`Runtime: ${runtime}`);
   console.log(`State dir: ${stateDir}`);
   console.log(`Routing: ${formatRoutingStrategy(normalized.accountPoolRoutingStrategy)}`);
-  console.log(`Public API ready: ${normalized.accountPoolEnabled && license?.isPro === true && apiKeys.length > 0 ? "yes" : "no"}`);
+  console.log(`Public API ready: ${normalized.accountPoolEnabled && license?.capabilities.accountPool === true && apiKeys.length > 0 ? "yes" : "no"}`);
   console.log(`API keys: ${apiKeys.length}`);
   console.log(`Sessions: ${sessions.length}`);
   console.log(`Selection mode: ${explicitSelection.length > 0 ? "explicit" : "all saved profiles"}`);
@@ -8135,7 +8838,7 @@ async function handleStatus(flags) {
   printStringList("Published models", normalized.accountPoolExposedModels);
   printStringList("Reasoning aliases", normalized.accountPoolExposedReasoningEfforts);
   printStringList("Fast-mode aliases", normalized.accountPoolExposedFastModeReasoningEfforts);
-  if (normalized.accountPoolEnabled && license?.isPro !== true) {
+  if (normalized.accountPoolEnabled && license?.capabilities.accountPool !== true) {
     console.log(ACCOUNT_POOL_PRO_REQUIRED_MESSAGE);
   }
 }
@@ -8340,7 +9043,7 @@ async function handleQuickstart(flags) {
   console.log("Accounts Pool quickstart");
   console.log(`Runtime: ${summary.runtime}`);
   console.log(`Enabled: ${summary.enabled ? "yes" : "no"}`);
-  console.log(`Pro: ${summary.hasProLicense ? "yes" : "no"}`);
+  console.log(`Access: ${summary.hasAccountPoolAccess ? "yes" : "no"}`);
   console.log(`API keys: ${summary.activeApiKeyCount}`);
   console.log(`Base URL: ${baseUrl}`);
   console.log("");
@@ -8424,7 +9127,7 @@ async function handleAccountPoolCommand(args, version) {
 }
 
 // src/commands/codex.ts
-var import_node_child_process4 = require("child_process");
+var import_node_child_process6 = require("child_process");
 
 // ../../packages/runtime-profiles/src/profiles/rate-limit-notifier.ts
 function maxUsedPercent(snapshot) {
@@ -8441,8 +9144,108 @@ function maxUsedPercent(snapshot) {
   return Math.max(...candidates);
 }
 
+// ../../packages/runtime-profiles/src/profiles/profile-visibility.ts
+function resolveLicenseVisibleProfiles(args) {
+  const { profiles, license, currentProfile } = args;
+  const licenseWithCounts = licenseService.applyProfileCount(license, profiles.length);
+  const enforceProfileLimit = shouldEnforceProfileLimit(licenseWithCounts);
+  const visibleProfiles = enforceProfileLimit ? resolveVisibleProfiles(profiles, licenseWithCounts, currentProfile) : profiles;
+  return {
+    allProfiles: profiles,
+    profiles: licenseWithCounts.capabilities.unlimitedProfiles ? profiles : visibleProfiles,
+    license,
+    licenseWithCounts,
+    enforceProfileLimit
+  };
+}
+async function loadLicenseVisibleProfiles(profileManager, options = {}) {
+  await profileManager.initialize();
+  const license = options.freshLicense ? await licenseService.getStatus() : await licenseService.getCachedStatus();
+  const profiles = await profileManager.listProfiles();
+  const currentProfile = options.currentProfile !== void 0 ? options.currentProfile : (await profileManager.getCurrentProfile()).name;
+  return resolveLicenseVisibleProfiles({
+    profiles,
+    license,
+    currentProfile
+  });
+}
+function resolveVisibleProfiles(profiles, license, currentProfile) {
+  if (license.capabilities.unlimitedProfiles) {
+    return profiles;
+  }
+  const limit = typeof license.profileLimit === "number" && license.profileLimit >= 0 ? license.profileLimit : FREE_PROFILE_LIMIT;
+  if (profiles.length <= limit) {
+    return profiles;
+  }
+  const normalizedCurrent = currentProfile ?? null;
+  const sorted = profiles.slice().sort((a, b) => compareProfilesForLimit(a, b, normalizedCurrent));
+  return sorted.slice(0, limit);
+}
+function compareProfilesForLimit(a, b, currentProfile) {
+  if (currentProfile) {
+    if (a.name === currentProfile && b.name !== currentProfile) {
+      return -1;
+    }
+    if (b.name === currentProfile && a.name !== currentProfile) {
+      return 1;
+    }
+  }
+  if (Boolean(a.isValid) !== Boolean(b.isValid)) {
+    return a.isValid ? -1 : 1;
+  }
+  const aTimestamp = parseTimestamp3(a.createdAt ?? null);
+  const bTimestamp = parseTimestamp3(b.createdAt ?? null);
+  if (aTimestamp !== null && bTimestamp !== null) {
+    if (aTimestamp === bTimestamp) {
+      return a.name.localeCompare(b.name);
+    }
+    return bTimestamp - aTimestamp;
+  }
+  if (aTimestamp !== null) {
+    return -1;
+  }
+  if (bTimestamp !== null) {
+    return 1;
+  }
+  return a.name.localeCompare(b.name);
+}
+function parseTimestamp3(value) {
+  if (typeof value !== "string" || value.trim() === "") {
+    return null;
+  }
+  const parsed = Date.parse(value);
+  return Number.isNaN(parsed) ? null : parsed;
+}
+
+// ../../packages/runtime-profiles/src/license/guard.ts
+var PROFILE_ACCESS_DENIED_MESSAGE = "Your CodexUse trial has ended. Upgrade to Pro to use saved profiles.";
+async function assertProfileCreationAllowed(profileManager) {
+  const manager = profileManager ?? new ProfileManager();
+  await manager.initialize();
+  const license = await licenseService.getStatus();
+  const profiles = await manager.listProfiles();
+  const licenseWithCounts = licenseService.applyProfileCount(license, profiles.length);
+  if (typeof licenseWithCounts.profileLimit === "number" && licenseWithCounts.profilesRemaining !== null && licenseWithCounts.profilesRemaining <= 0) {
+    throw new Error("Your CodexUse trial has ended. Upgrade to Pro for unlimited profiles.");
+  }
+}
+async function assertProfileAccessAllowed(profileManager, profileName) {
+  const name = profileName.trim();
+  if (!name) {
+    throw new Error("Profile name is required.");
+  }
+  const visible = await loadLicenseVisibleProfiles(profileManager, {
+    freshLicense: true
+  });
+  const exists = visible.allProfiles.some((profile) => profile.name === name);
+  const allowed = visible.profiles.some((profile) => profile.name === name);
+  if (exists && !allowed) {
+    throw new Error(PROFILE_ACCESS_DENIED_MESSAGE);
+  }
+}
+
 // src/platform/codexCli.ts
-var import_node_child_process3 = require("child_process");
+var import_node_child_process5 = require("child_process");
 var import_node_fs5 = require("fs");
 var import_node_path8 = __toESM(require("path"));
 var ENV_HINTS2 = ["CODEX_BINARY", "CODEX_CLI_PATH", "CODEX_PATH"];
@@ -8514,7 +9317,7 @@ async function runCodexLogin(mode) {
   const resolvedMode = resolveLoginMode(mode ?? null);
   const loginArgs = resolvedMode === "device" ? ["login", "--device-auth"] : ["login"];
   const { command, args, shell } = buildCodexCommand2(codexPath, loginArgs);
-  const child = (0, import_node_child_process3.spawn)(command, args, {
+  const child = (0, import_node_child_process5.spawn)(command, args, {
     stdio: "inherit",
     env: process.env,
     shell
@@ -8586,7 +9389,7 @@ function compareCandidates(left, right) {
 async function runCommand(codexPath, args, timeoutMs) {
   const command = buildCodexCommand2(codexPath, args);
   return new Promise((resolve) => {
-    const child = (0, import_node_child_process4.spawn)(command.command, command.args, {
+    const child = (0, import_node_child_process6.spawn)(command.command, command.args, {
       env: process.env,
       shell: command.shell,
       stdio: ["ignore", "pipe", "pipe"]
@@ -8647,12 +9450,13 @@ async function runCodexWithProfile(manager, profileName, codexArgs) {
   if (!codexPath) {
     throw new Error("Codex CLI not found. Install Codex CLI or set CODEX_BINARY.");
   }
+  await assertProfileAccessAllowed(manager, profileName);
   const runtime = await manager.prepareProfileRuntime(profileName, {
     syncFromActiveAuthBeforeAction: false
   });
   const command = buildCodexCommand2(codexPath, codexArgs);
   try {
-    const child = (0, import_node_child_process4.spawn)(command.command, command.args, {
+    const child = (0, import_node_child_process6.spawn)(command.command, command.args, {
       env: runtime.env,
       shell: command.shell,
       stdio: "inherit"
@@ -8753,7 +9557,7 @@ async function handleBestCommand(args) {
     console.log(`Usage:
   codexuse best -- <codex args>
 
-Picks the healthiest saved profile, then runs Codex. Auto-run requires Pro.`);
+Picks the healthiest saved profile, then runs Codex. Auto-run requires Pro or an active trial.`);
     return;
   }
   const codexPath = resolveCodexBinary();
@@ -8761,20 +9565,17 @@ Picks the healthiest saved profile, then runs Codex. Auto-run requires Pro.`);
     throw new Error("Codex CLI not found. Install Codex CLI or set CODEX_BINARY.");
   }
   const manager = new ProfileManager();
-  const profiles = await manager.listProfiles();
+  const visible = await loadLicenseVisibleProfiles(manager, { freshLicense: true });
+  if (!visible.licenseWithCounts.capabilities.autoRoll) {
+    throw new Error("Auto-run requires Pro or an active trial.");
+  }
+  const profiles = visible.profiles;
   const best = await selectBestProfile(manager, profiles, codexPath);
   if (!best) {
     throw new Error("No valid saved profiles found. Add one with `codexuse profile add <name>`.");
   }
   const dryRun = hasFlag(flags, "--dry-run");
-  const license = await licenseService.getStatus();
   const summary = `${best.profile.name} (${formatUsagePercent(best.usedPercent)} used)`;
-  if (!license.isPro) {
-    console.log(`Best profile: ${summary}`);
-    console.log("Auto-run is Pro. Free path:");
-    console.log(`  codexuse run --profile ${best.profile.name} -- ${codexArgs.join(" ")}`.trimEnd());
-    return;
-  }
   if (dryRun) {
     console.log(`Would run with profile: ${summary}`);
     return;
@@ -8832,21 +9633,9 @@ async function handleLicense(args, version) {
   }
 }
 
-// ../../packages/runtime-profiles/src/license/guard.ts
-async function assertProfileCreationAllowed(profileManager) {
-  const manager = profileManager ?? new ProfileManager();
-  await manager.initialize();
-  const license = await licenseService.getStatus();
-  const profiles = await manager.listProfiles();
-  const licenseWithCounts = licenseService.applyProfileCount(license, profiles.length);
-  if (typeof licenseWithCounts.profileLimit === "number" && licenseWithCounts.profilesRemaining !== null && licenseWithCounts.profilesRemaining <= 0) {
-    throw new Error("CodexUse Free supports up to 2 profiles. Upgrade to CodexUse Pro for unlimited profiles.");
-  }
-}
-
 // ../../packages/runtime-codex/src/codex/officialAppRestart.ts
-var import_node_child_process5 = require("child_process");
-var import_node_crypto5 = require("crypto");
+var import_node_child_process7 = require("child_process");
+var import_node_crypto8 = require("crypto");
 var import_node_fs7 = require("fs");
 var import_node_os3 = require("os");
 var import_node_net = __toESM(require("net"), 1);
@@ -8856,6 +9645,7 @@ var import_node_path10 = __toESM(require("path"), 1);
 var import_node_fs6 = require("fs");
 var import_node_path9 = __toESM(require("path"), 1);
 var ROLLOUT_DIRS = ["sessions", "archived_sessions"];
+var SQLITE_EXTENSIONS = /* @__PURE__ */ new Set([".db", ".sqlite", ".sqlite3"]);
 function isRecord5(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
@@ -8974,8 +9764,91 @@ function resolveRolloutPath(profileHome, rolloutPath) {
   }
   return import_node_path9.default.isAbsolute(rolloutPath) ? rolloutPath : import_node_path9.default.join(profileHome, rolloutPath);
 }
-async function readThreadRecordFromStateDb(profileHome, threadId) {
-  const dbPath = import_node_path9.default.join(profileHome, "state_5.sqlite");
+async function collectSessionDatabasePaths(profileHome) {
+  const paths = [];
+  const sqliteDir = import_node_path9.default.join(profileHome, "sqlite");
+  try {
+    const entries = await import_node_fs6.promises.readdir(sqliteDir, {
+      withFileTypes: true,
+      encoding: "utf8"
+    });
+    for (const entry of entries) {
+      if (!entry.isFile()) {
+        continue;
+      }
+      const entryName = String(entry.name);
+      if (SQLITE_EXTENSIONS.has(import_node_path9.default.extname(entryName))) {
+        paths.push(import_node_path9.default.join(sqliteDir, entryName));
+      }
+    }
+  } catch {
+  }
+  paths.sort((left, right) => {
+    const leftName = import_node_path9.default.basename(left);
+    const rightName = import_node_path9.default.basename(right);
+    if (leftName === "codex-dev.db" && rightName !== "codex-dev.db") return -1;
+    if (rightName === "codex-dev.db" && leftName !== "codex-dev.db") return 1;
+    return leftName.localeCompare(rightName);
+  });
+  const legacy = import_node_path9.default.join(profileHome, "state_5.sqlite");
+  if (!paths.includes(legacy)) {
+    paths.push(legacy);
+  }
+  return paths;
+}
+function tableColumns(db, table) {
+  try {
+    return new Set(
+      db.prepare(`PRAGMA table_info(${table})`).all().map((row) => isRecord5(row) ? recordString(row.name) : null).filter((name) => Boolean(name))
+    );
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+}
+function firstColumn(columns, names) {
+  return names.find((name) => columns.has(name)) ?? null;
+}
+function sqlColumnOrNull(column, alias) {
+  return column ? `${column} AS ${alias}` : `NULL AS ${alias}`;
+}
+function queryThreadRecordFromTable(db, profileHome, threadId, config) {
+  const columns = tableColumns(db, config.table);
+  const idColumn = firstColumn(columns, config.id);
+  if (!idColumn) {
+    return null;
+  }
+  const variants = threadIdVariants(threadId);
+  const placeholders = variants.map(() => "?").join(", ");
+  const orderByColumn = firstColumn(columns, [
+    "updated_at_ms",
+    "updated_at",
+    "created_at_ms",
+    "created_at"
+  ]);
+  const select = [
+    sqlColumnOrNull(firstColumn(columns, config.rolloutPath), "rollout_path"),
+    sqlColumnOrNull(firstColumn(columns, config.title), "title"),
+    sqlColumnOrNull(firstColumn(columns, config.cwd), "cwd"),
+    sqlColumnOrNull(firstColumn(columns, ["updated_at"]), "updated_at"),
+    sqlColumnOrNull(firstColumn(columns, ["updated_at_ms"]), "updated_at_ms"),
+    sqlColumnOrNull(firstColumn(columns, ["created_at_ms", "created_at"]), "created_at_ms")
+  ].join(", ");
+  const orderBy = orderByColumn ? ` ORDER BY ${orderByColumn} DESC, ${idColumn} DESC` : ` ORDER BY ${idColumn} DESC`;
+  const row = db.prepare(
+    `SELECT ${select} FROM ${config.table} WHERE ${idColumn} IN (${placeholders})${orderBy} LIMIT 1`
+  ).all(...variants).find(isRecord5);
+  if (!row) {
+    return null;
+  }
+  return {
+    rolloutPath: resolveRolloutPath(profileHome, recordString(row.rollout_path)),
+    title: recordString(row.title),
+    cwd: recordString(row.cwd),
+    updatedAt: recordString(row.updated_at),
+    updatedAtMs: normalizeTimestampMs(row.updated_at_ms) ?? normalizeTimestampMs(row.updated_at) ?? normalizeTimestampMs(row.created_at_ms)
+  };
+}
+async function readThreadRecordFromDb(profileHome, dbPath, threadId) {
   try {
     await import_node_fs6.promises.access(dbPath);
   } catch {
@@ -8984,42 +9857,28 @@ async function readThreadRecordFromStateDb(profileHome, threadId) {
   let db = null;
   try {
     db = await openReadonlyDatabase(dbPath);
-    const columns = new Set(
-      db.prepare("PRAGMA table_info(threads)").all().map((row2) => isRecord5(row2) ? recordString(row2.name) : null).filter((name) => Boolean(name))
-    );
-    const idColumn = columns.has("id") ? "id" : columns.has("thread_id") ? "thread_id" : null;
-    if (!idColumn) {
-      return null;
-    }
-    const variants = threadIdVariants(threadId);
-    const placeholders = variants.map(() => "?").join(", ");
-    const select = [
-      columns.has("rollout_path") ? "rollout_path AS rollout_path" : "NULL AS rollout_path",
-      columns.has("title") ? "title AS title" : "NULL AS title",
-      columns.has("cwd") ? "cwd AS cwd" : "NULL AS cwd",
-      columns.has("updated_at") ? "updated_at AS updated_at" : "NULL AS updated_at",
-      columns.has("updated_at_ms") ? "updated_at_ms AS updated_at_ms" : "NULL AS updated_at_ms",
-      columns.has("created_at_ms") ? "created_at_ms AS created_at_ms" : "NULL AS created_at_ms"
-    ].join(", ");
-    const orderByColumn = columns.has("updated_at_ms") ? "updated_at_ms" : columns.has("updated_at") ? "updated_at" : columns.has("created_at_ms") ? "created_at_ms" : null;
-    const orderBy = orderByColumn ? ` ORDER BY ${orderByColumn} DESC, ${idColumn} DESC` : ` ORDER BY ${idColumn} DESC`;
-    const rows = db.prepare(
-      `SELECT ${select} FROM threads WHERE ${idColumn} IN (${placeholders})${orderBy} LIMIT 1`
-    ).all(...variants);
-    const row = rows.find(isRecord5);
-    if (!row) {
-      return null;
+    for (const config of [
+      {
+        table: "threads",
+        id: ["id", "thread_id"],
+        title: ["title", "thread_title"],
+        cwd: ["cwd", "source_cwd"],
+        rolloutPath: ["rollout_path"]
+      },
+      {
+        table: "automation_runs",
+        id: ["thread_id", "id"],
+        title: ["thread_title", "title", "inbox_title"],
+        cwd: ["source_cwd", "cwd"],
+        rolloutPath: []
+      }
+    ]) {
+      const record = queryThreadRecordFromTable(db, profileHome, threadId, config);
+      if (record) {
+        return record;
+      }
     }
-    return {
-      rolloutPath: resolveRolloutPath(
-        profileHome,
-        recordString(row.rollout_path)
-      ),
-      title: recordString(row.title),
-      cwd: recordString(row.cwd),
-      updatedAt: recordString(row.updated_at),
-      updatedAtMs: normalizeTimestampMs(row.updated_at_ms) ?? normalizeTimestampMs(row.updated_at) ?? normalizeTimestampMs(row.created_at_ms)
-    };
+    return null;
   } catch {
     return null;
   } finally {
@@ -9027,9 +9886,16 @@ async function readThreadRecordFromStateDb(profileHome, threadId) {
   }
 }
 async function findOfficialCodexThreadRecord(profileHome, threadId) {
-  const stateRecord = await readThreadRecordFromStateDb(profileHome, threadId);
-  if (stateRecord) {
-    return stateRecord;
+  const records = [];
+  for (const dbPath of await collectSessionDatabasePaths(profileHome)) {
+    const stateRecord = await readThreadRecordFromDb(profileHome, dbPath, threadId);
+    if (stateRecord) {
+      records.push(stateRecord);
+    }
+  }
+  if (records.length > 0) {
+    records.sort((left, right) => (right.updatedAtMs ?? 0) - (left.updatedAtMs ?? 0));
+    return records[0] ?? null;
   }
   const rolloutMatch = await findRolloutFileByScan(profileHome, threadId);
   if (!rolloutMatch) {
@@ -9121,7 +9987,7 @@ function hashProfileKey(profileKey) {
   if (!profileKey) {
     return null;
   }
-  return (0, import_node_crypto5.createHash)("sha256").update(profileKey).digest("hex").slice(0, 12);
+  return (0, import_node_crypto8.createHash)("sha256").update(profileKey).digest("hex").slice(0, 12);
 }
 function sanitizeOfficialCodexOverlayActionTargetsForRenderer(targets) {
   const sanitized = [];
@@ -9395,13 +10261,14 @@ async function readCdpTargets(port) {
   }
   throw lastError instanceof Error ? lastError : new Error("cdp-list-failed");
 }
-function pickCodexCdpTarget(targets) {
+function pickCodexCdpTarget(targets, options = {}) {
   const pages = targets.filter(
     (target) => target.webSocketDebuggerUrl && (target.type === "page" || target.type === "webview" || !target.type)
   );
-  return pages.find(
+  const codexPage = pages.find(
     (target) => `${target.title ?? ""} ${target.url ?? ""}`.toLowerCase().includes("codex")
-  ) ?? pages[0] ?? null;
+  ) ?? null;
+  return codexPage ?? (options.allowAnyPage === true ? pages[0] ?? null : null);
 }
 function buildCdpDevToolsUrl(port, target) {
   const frontendUrl = target.devtoolsFrontendUrl?.trim();
@@ -9744,6 +10611,9 @@ function buildInCodexStatusOverlayCssRules() {
     `${chip} .codexuse-handoff-main{display:inline-flex;align-items:center;padding:5px 8px 5px 10px;border-radius:999px;cursor:pointer;}`,
     `${chip} .codexuse-handoff-hide{display:inline-flex;width:20px;height:20px;align-items:center;justify-content:center;margin-right:3px;border-radius:50%;color:var(--cu-muted);cursor:pointer;font-size:12px;line-height:1;}`,
     `${chip} .codexuse-handoff-hide:hover{background:var(--cu-border);color:var(--cu-fg,#ececf1);}`,
+    `body>[data-radix-popper-content-wrapper],body>[data-floating-ui-portal]{z-index:2147483004!important;}`,
+    // Official Codex marks its titlebar draggable; injected controls must opt out.
+    `${id},${id} *,${chip},${chip} *,${picker},${picker} *{-webkit-app-region:no-drag;}`,
     // Hand-off account picker is a standalone body child (not inside the pill),
     // so the pill-scoped popover rules don't reach it — give it its own palette
     // + popover styling, mirroring the chip.
@@ -10125,6 +10995,7 @@ function createBridgeApplyQolExpression(settings) {
     const overlayPosKey = "codexuse:overlay:pos";
     const handoffHiddenKey = "codexuse:handoff:hidden";
     const handoffPosKey = "codexuse:handoff:pos:v2";
+    const defaultPosKey = "codexuse:overlay:top-default:v1";
     const readOverlayStore = (key) => {
       try {
         return window.localStorage.getItem(key);
@@ -10219,8 +11090,8 @@ function createBridgeApplyQolExpression(settings) {
     };
     const placeInitialOverlayPosition = (pill) => {
       const rect = pill.getBoundingClientRect();
-      const x = Math.round((window.innerWidth - rect.width) / 2);
-      const y = Math.max(72, Math.min(140, Math.round(window.innerHeight * 0.16)));
+      const x = Math.max(8, window.innerWidth - rect.width - 32);
+      const y = Math.max(96, Math.min(132, Math.round(window.innerHeight * 0.12)));
       placeOverlay(pill, x, y);
     };
     const rectsOverlap = (a, b, gap = 0) =>
@@ -10234,30 +11105,17 @@ function createBridgeApplyQolExpression(settings) {
       right: pos.x + rect.width,
       bottom: pos.y + rect.height
     });
-    const placeInitialHandoffPosition = (chip, anchorRect = null) => {
+    const placeInitialHandoffPosition = (chip) => {
       const rect = chip.getBoundingClientRect();
-      if (anchorRect && rect.width > 0 && rect.height > 0) {
-        const gap = 8;
-        const middleY = Math.round(anchorRect.top + (anchorRect.height - rect.height) / 2);
-        const candidates = [
-          { x: anchorRect.right + gap, y: middleY },
-          { x: anchorRect.left - rect.width - gap, y: middleY },
-          { x: anchorRect.right - rect.width, y: anchorRect.top - rect.height - gap },
-          { x: anchorRect.left, y: anchorRect.top - rect.height - gap },
-          { x: anchorRect.right - rect.width, y: anchorRect.bottom + gap }
-        ];
-        for (const candidate of candidates) {
-          const next = clampOverlayXY(chip, candidate.x, candidate.y);
-          if (!rectsOverlap(positionedRect(rect, next), anchorRect, 6)) {
-            placeOverlay(chip, next.x, next.y);
-            return;
-          }
-        }
-      }
-      const x = Math.max(8, window.innerWidth - rect.width - 16);
-      const y = Math.max(64, Math.min(128, Math.round(window.innerHeight * 0.14)));
+      const x = Math.round((window.innerWidth - rect.width) / 2);
+      const y = 14;
       placeOverlay(chip, x, y);
     };
+    if (readOverlayStore(defaultPosKey) !== "1") {
+      writeOverlayStore(overlayPosKey, null);
+      writeOverlayStore(handoffPosKey, null);
+      writeOverlayStore(defaultPosKey, "1");
+    }
     const setOverlayMessage = (value) => {
       const node = document.querySelector("#" + statusId + " [data-codexuse-action-status]");
       if (node) node.textContent = value || "";
@@ -10387,7 +11245,8 @@ function createBridgeApplyQolExpression(settings) {
           renderHandoff();
         }, true);
         document.body.appendChild(pill);
-        applyStoredOverlayPosition(pill);
+        if (hasStoredPosition) applyStoredOverlayPosition(pill);
+        else placeInitialOverlayPosition(pill);
         return true;
       }
       pill.dataset.open = currentAutoRollDecision || wasOpen || shouldShowIntro ? "true" : "false";
@@ -10692,6 +11551,8 @@ function createBridgeApplyQolExpression(settings) {
       if (shouldShowIntro) {
         placeInitialOverlayPosition(pill);
         writeOverlayStore(overlayIntroKey, "1");
+      } else if (!hasStoredPosition) {
+        placeInitialOverlayPosition(pill);
       } else {
         applyStoredOverlayPosition(pill);
       }
@@ -10936,18 +11797,18 @@ function createBridgeApplyQolExpression(settings) {
             const next = clampOverlayXY(chip, pos.x, pos.y);
             const chipRect = chip.getBoundingClientRect();
             if (rectsOverlap(positionedRect(chipRect, next), rect, 6)) {
-              placeInitialHandoffPosition(chip, rect);
+              placeInitialHandoffPosition(chip);
             } else {
               placeOverlay(chip, next.x, next.y);
             }
           } else {
-            placeInitialHandoffPosition(chip, rect);
+            placeInitialHandoffPosition(chip);
           }
         } catch {
-          placeInitialHandoffPosition(chip, rect);
+          placeInitialHandoffPosition(chip);
         }
       } else {
-        placeInitialHandoffPosition(chip, rect);
+        placeInitialHandoffPosition(chip);
       }
       if (wasOpen) openPicker();
       reportHandoff("rendered");
@@ -11299,11 +12160,23 @@ function createBridgeApplyPowerExpression(settings, settingsExpression) {
             || typeof item.name === "string"
           )
         );
-      const patchModelArray = (items, allowEmpty = false) => {
+      const modelLabelLooksKnown = (value) =>
+        typeof value === "string" && /(?:gpt|codex|chatgpt|claude|gemini|llama|mistral|qwen|deepseek|grok|davinci|\\bo[1-9]\\b)/i.test(value);
+      const objectArrayLooksModelLike = (items) =>
+        objectArrayLooksPatchable(items)
+        && items.some((item) =>
+          modelLabelLooksKnown(item.model)
+          || modelLabelLooksKnown(item.id)
+          || modelLabelLooksKnown(item.slug)
+          || modelLabelLooksKnown(item.name)
+          || modelLabelLooksKnown(item.displayName)
+          || modelLabelLooksKnown(item.title)
+        );
+      const patchModelArray = (items, allowEmpty = false, requireModelLike = false) => {
         if (!Array.isArray(items)) return false;
         let localChanged = false;
-        unhideArray(items);
         if (stringArrayLooksPatchable(items)) {
+          if (requireModelLike && !items.some(modelLabelLooksKnown)) return false;
           for (const model of modelWhitelistModels) {
             if (!items.includes(model)) {
               items.push(model);
@@ -11312,7 +12185,8 @@ function createBridgeApplyPowerExpression(settings, settingsExpression) {
           }
           return localChanged;
         }
-        if (objectArrayLooksPatchable(items, allowEmpty)) {
+        if (objectArrayLooksPatchable(items, allowEmpty) && (!requireModelLike || allowEmpty || objectArrayLooksModelLike(items))) {
+          unhideArray(items);
           const existing = new Set();
           for (const item of items) {
             existing.add(String(item.model || item.id || item.slug || item.name || ""));
@@ -11327,8 +12201,8 @@ function createBridgeApplyPowerExpression(settings, settingsExpression) {
         return localChanged;
       };
       if (patchModelArray(value.models, "defaultModel" in value || "availableModels" in value)) changed = true;
-      if (patchModelArray(value.data)) changed = true;
-      if (patchModelArray(value.result)) changed = true;
+      if (patchModelArray(value.data, false, true)) changed = true;
+      if (patchModelArray(value.result, false, true)) changed = true;
       if (patchModelArray(value.availableModels, true)) changed = true;
       if (patchModelArray(value.available_models, true)) changed = true;
       if (value.available_models instanceof Set) {
@@ -11445,11 +12319,23 @@ function createBridgeApplyPowerExpression(settings, settingsExpression) {
       return changed;
     };
     const reactFiberKeys = (element) => Object.keys(element || {}).filter((key) => key.startsWith("__reactFiber") || key.startsWith("__reactInternalInstance") || key.startsWith("__reactProps"));
+    const reactModelStatePatchSelector = "[role='menu'],[role='dialog'],[role='listbox'],[data-radix-popper-content-wrapper],[data-floating-ui-portal]";
+    const isWorkspaceChromeNode = (node) => {
+      if (!node || node.nodeType !== 1) return false;
+      if (node.closest?.("[data-app-action-sidebar-section-heading='Chats'],[data-app-action-sidebar-section-heading='Projects'],[data-app-action-sidebar-thread-id],[data-app-action-sidebar-project-row],[data-app-action-sidebar-project-id]")) {
+        return true;
+      }
+      return Boolean(node.closest?.("main aside"));
+    };
+    const reactModelStatePatchNodes = () => {
+      return Array.from(document.querySelectorAll(reactModelStatePatchSelector))
+        .filter((node) => node && !isWorkspaceChromeNode(node));
+    };
     const patchReactModelState = () => {
       if (!enabled.modelWhitelistUnlock) return false;
       try {
         const visited = new WeakSet();
-        const nodes = [document.body, ...Array.from(document.querySelectorAll("button,[role='menu'],[role='dialog'],[data-radix-popper-content-wrapper]"))].filter(Boolean);
+        const nodes = reactModelStatePatchNodes();
         let changed = false;
         for (const node of nodes.slice(0, 220)) {
           for (const key of reactFiberKeys(node)) {
@@ -11464,6 +12350,39 @@ function createBridgeApplyPowerExpression(settings, settingsExpression) {
         return false;
       }
     };
+    const installModelReactStateObserver = () => {
+      if (typeof state.cleanupModelReactStateObserver === "function") {
+        state.cleanupModelReactStateObserver();
+        state.cleanupModelReactStateObserver = null;
+      }
+      if (!enabled.modelWhitelistUnlock) return false;
+      let frame = 0;
+      const schedulePatch = () => {
+        if (frame) return;
+        frame = requestAnimationFrame(() => {
+          frame = 0;
+          patchReactModelState();
+        });
+      };
+      const isPatchableMutationNode = (node) => {
+        const element = node?.nodeType === 1 ? node : node?.parentElement;
+        return Boolean(
+          element?.matches?.(reactModelStatePatchSelector)
+          || element?.querySelector?.(reactModelStatePatchSelector)
+        );
+      };
+      const observer = new MutationObserver((mutations) => {
+        if (mutations.some((mutation) => Array.from(mutation.addedNodes).some(isPatchableMutationNode))) {
+          schedulePatch();
+        }
+      });
+      observer.observe(document.body, { childList: true, subtree: true });
+      state.cleanupModelReactStateObserver = () => {
+        observer.disconnect();
+        if (frame) cancelAnimationFrame(frame);
+      };
+      return true;
+    };
     const patchPluginContainer = (value, visited = new WeakSet(), depth = 0, inheritedMarketplaceName = null) => {
       if (!enabled.pluginMarketplaceUnlock || !value || typeof value !== "object" || visited.has(value) || depth > 4) return false;
       visited.add(value);
@@ -12007,6 +12926,7 @@ function createBridgeApplyPowerExpression(settings, settingsExpression) {
     const modelStatsigPatchApplied = enabled.modelWhitelistUnlock
       ? patchStatsigModelWhitelist()
       : false;
+    installModelReactStateObserver();
     const modelReactStatePatched = enabled.modelWhitelistUnlock
       ? patchReactModelState()
       : false;
@@ -12673,7 +13593,7 @@ async function runCdpCommandSequence(debuggerUrl, commands, timeoutMs = CODEX_CD
   });
 }
 async function verifyCdpBindingRoundTrip(debuggerUrl) {
-  const nonce = (0, import_node_crypto5.randomUUID)();
+  const nonce = (0, import_node_crypto8.randomUUID)();
   const expression = `(() => {
     const binding = window[${JSON.stringify(CODEXUSE_BRIDGE_BINDING_NAME)}];
     if (typeof binding !== "function") return false;
@@ -13183,14 +14103,16 @@ async function reloadOfficialCodexBridgePage(debuggerUrl) {
     return false;
   }
 }
-async function probeOfficialCodexBridge(instance, forceInstall = false) {
+async function probeOfficialCodexBridge(instance, forceInstall = false, allowAnyPageTarget = false) {
   const checkedAt = Date.now();
   if (!instance.cdpPort) {
     return bridgeStateUnavailable();
   }
   try {
     const targets = await readCdpTargets(instance.cdpPort);
-    const target = pickCodexCdpTarget(targets);
+    const target = pickCodexCdpTarget(targets, {
+      allowAnyPage: allowAnyPageTarget
+    });
     if (!target?.webSocketDebuggerUrl) {
       return bridgeStateUnhealthy(
         instance.cdpPort,
@@ -13260,14 +14182,16 @@ async function probeOfficialCodexBridge(instance, forceInstall = false) {
     );
   }
 }
-async function reapplyDesiredBridgeSettings(instance, bridge) {
+async function reapplyDesiredBridgeSettings(instance, bridge, allowAnyPageTarget = false) {
   const shouldClearPowerRuntime = !instance.desiredPowerSettings && hasEnabledBridgePowerRuntime(bridge.bridgePower);
   if (bridge.bridgeStatus !== "healthy" || !instance.cdpPort || !instance.desiredQolSettings && !instance.desiredPowerSettings && !shouldClearPowerRuntime) {
     return bridge;
   }
   try {
     const targets = await readCdpTargets(instance.cdpPort);
-    const target = pickCodexCdpTarget(targets);
+    const target = pickCodexCdpTarget(targets, {
+      allowAnyPage: allowAnyPageTarget
+    });
     if (!target?.webSocketDebuggerUrl) {
       return bridge;
     }
@@ -13353,7 +14277,7 @@ async function reapplyDesiredBridgeSettings(instance, bridge) {
     };
   }
 }
-async function refreshBridgeStateIfNeeded(instance, running, force = false, reapplyDesired = false) {
+async function refreshBridgeStateIfNeeded(instance, running, force = false, reapplyDesired = false, allowAnyPageTarget = false) {
   if (!running || !instance.cdpPort) {
     return bridgeStateUnavailable();
   }
@@ -13361,12 +14285,16 @@ async function refreshBridgeStateIfNeeded(instance, running, force = false, reap
   if (!force && checkedAt && Date.now() - checkedAt < CODEX_BRIDGE_PROBE_TTL_MS) {
     return bridgeStateForStoredInstance(instance, true);
   }
-  const bridge = await probeOfficialCodexBridge(instance, force);
-  return reapplyDesired ? await reapplyDesiredBridgeSettings(instance, bridge) : bridge;
+  const bridge = await probeOfficialCodexBridge(
+    instance,
+    force,
+    allowAnyPageTarget
+  );
+  return reapplyDesired ? await reapplyDesiredBridgeSettings(instance, bridge, allowAnyPageTarget) : bridge;
 }
 async function waitForBridgeStateAfterLaunch(instance) {
   const deadline = Date.now() + CODEX_BRIDGE_LAUNCH_WAIT_MS;
-  let latest = await refreshBridgeStateIfNeeded(instance, true, true, true);
+  let latest = await refreshBridgeStateIfNeeded(instance, true, true, true, true);
   while (latest.bridgeStatus !== "healthy" && Date.now() < deadline) {
     await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
     latest = await refreshBridgeStateIfNeeded(
@@ -13376,6 +14304,7 @@ async function waitForBridgeStateAfterLaunch(instance) {
       },
       true,
       true,
+      true,
       true
     );
   }
@@ -13384,7 +14313,7 @@ async function waitForBridgeStateAfterLaunch(instance) {
 async function waitForBridgeStateAfterReload(instance) {
   const deadline = Date.now() + CODEX_BRIDGE_LAUNCH_WAIT_MS;
   await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
-  let latest = await refreshBridgeStateIfNeeded(instance, true, true, true);
+  let latest = await refreshBridgeStateIfNeeded(instance, true, true, true, true);
   while (latest.bridgeStatus !== "healthy" && Date.now() < deadline) {
     await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
     latest = await refreshBridgeStateIfNeeded(
@@ -13394,6 +14323,7 @@ async function waitForBridgeStateAfterReload(instance) {
       },
       true,
       true,
+      true,
       true
     );
   }
@@ -13446,7 +14376,7 @@ async function recordOfficialCodexActivity(input) {
 }
 function runCommand2(command, args, timeoutMs = COMMAND_TIMEOUT_MS) {
   return new Promise((resolve) => {
-    const child = (0, import_node_child_process5.spawn)(command, args, {
+    const child = (0, import_node_child_process7.spawn)(command, args, {
       stdio: ["ignore", "pipe", "pipe"]
     });
     let stdout = "";
@@ -13745,7 +14675,7 @@ async function openCodexWithProfileHome(candidate, profileHome, profileName, cdp
     if (appUserDataDir) {
       (0, import_node_fs7.mkdirSync)(appUserDataDir, { recursive: true });
     }
-    child = (0, import_node_child_process5.spawn)(
+    child = (0, import_node_child_process7.spawn)(
       "/usr/bin/open",
       [
         "-n",
@@ -13763,7 +14693,7 @@ async function openCodexWithProfileHome(candidate, profileHome, profileName, cdp
       ],
       {
         detached: true,
-        env: process.env,
+        env: buildCodexChildEnv(),
         stdio: "ignore"
       }
     );
@@ -14524,6 +15454,13 @@ function formatProfileLabel(name, displayName) {
   }
   return name;
 }
+var AUTO_ROLL_ACCESS_REQUIRED_MESSAGE = "Auto-roll requires a Pro license or an active trial.";
+async function assertAutoRollAccess() {
+  const license = await licenseService.getStatus();
+  if (!license.capabilities.autoRoll) {
+    throw new Error(AUTO_ROLL_ACCESS_REQUIRED_MESSAGE);
+  }
+}
 function profileRateLimitKey(profile) {
   return resolveProfileIdentityKeyFromProfile(profile);
 }
@@ -15180,6 +16117,7 @@ async function collectUsageMap(manager, profiles, codexPath) {
   return usageMap;
 }
 async function runAutoRollPass(manager, options) {
+  await assertAutoRollAccess();
   const profiles = await manager.listProfiles();
   if (!profiles.length) {
     return { switched: false, message: "No profiles found.", source: null, target: null };
@@ -15304,9 +16242,13 @@ async function handleProfileCommand(args, version) {
   const manager = new ProfileManager();
   switch (sub) {
     case "list": {
-      const profiles = await manager.listProfiles();
+      const visible = await loadLicenseVisibleProfiles(manager, { freshLicense: true });
+      const profiles = visible.profiles;
       const current = await manager.getCurrentProfile();
       if (!profiles.length) {
+        if (visible.allProfiles.length) {
+          throw new Error(PROFILE_ACCESS_DENIED_MESSAGE);
+        }
         console.log("No profiles found.");
         return;
       }
@@ -15348,6 +16290,7 @@ async function handleProfileCommand(args, version) {
         console.log("No active profile.");
         return;
       }
+      await assertProfileAccessAllowed(manager, current.name);
       console.log(current.name);
       return;
     }
@@ -15371,6 +16314,7 @@ async function handleProfileCommand(args, version) {
       if (!name) {
         throw new Error("Profile name is required.");
       }
+      await assertProfileAccessAllowed(manager, name);
       if (!hasFlag(flags, "--skip-login")) {
         const loginMode = resolveLoginMode(parseLoginMode(flags));
         await runCodexLogin(loginMode);
@@ -15385,6 +16329,7 @@ async function handleProfileCommand(args, version) {
       if (!name) {
         throw new Error("Profile name is required.");
       }
+      await assertProfileAccessAllowed(manager, name);
       const activateOfficialCodex = resolveActivateCodexFlag(flags, false);
       const profiles = await manager.listProfiles();
       const targetProfileKey = findProfileKey(profiles, name);
@@ -15404,10 +16349,7 @@ async function handleProfileCommand(args, version) {
     }
     case "autoroll":
     case "auto-roll": {
-      const license = await licenseService.getStatus();
-      if (!license.isPro) {
-        throw new Error("Auto-roll requires a Pro license.");
-      }
+      await assertAutoRollAccess();
       const watch = hasFlag(flags, "--watch");
       const dryRun = hasFlag(flags, "--dry-run");
       const settings = await getStoredAutoRollSettings().catch(() => null);
@@ -15487,6 +16429,7 @@ async function handleProfileCommand(args, version) {
       if (!from || !to) {
         throw new Error("Old and new profile names are required.");
       }
+      await assertProfileAccessAllowed(manager, from);
       await manager.renameProfile(from, to);
       console.log(`Profile renamed: ${from} -> ${to}`);
       return;
@@ -15615,7 +16558,7 @@ function normalizeSnapshot(value) {
     settingsJson
   };
 }
-async function requestJson(method, pathname, licenseKey, body, rawBody) {
+async function requestJson(method, pathname, access, body, rawBody) {
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), CLOUD_SYNC_TIMEOUT_MS);
   try {
@@ -15623,7 +16566,10 @@ async function requestJson(method, pathname, licenseKey, body, rawBody) {
       method,
       headers: {
         "Content-Type": "application/json",
-        "x-codexuse-license-key": licenseKey
+        "x-codexuse-license-key": access.syncKey,
+        ...access.trialDeviceId ? { "x-codexuse-trial-device-id": access.trialDeviceId } : {},
+        ...access.trialToken ? { "x-codexuse-trial-token": access.trialToken } : {},
+        ...access.trialMigration ? { "x-codexuse-sync-migrate-trial": "1" } : {}
       },
       body: typeof rawBody === "string" ? rawBody : body === void 0 ? void 0 : JSON.stringify(body),
       signal: controller.signal
@@ -15650,15 +16596,15 @@ async function requestJson(method, pathname, licenseKey, body, rawBody) {
     clearTimeout(timeout);
   }
 }
-async function fetchRemoteSnapshot(licenseKey) {
-  const response = await requestJson("GET", "/v1/sync/snapshot", licenseKey);
+async function fetchRemoteSnapshot(access) {
+  const response = await requestJson("GET", "/v1/sync/snapshot", access);
   return normalizeSnapshot(response.snapshot);
 }
-async function fetchRemoteSnapshotMeta(licenseKey) {
+async function fetchRemoteSnapshotMeta(access) {
   const response = await requestJson(
     "GET",
     "/v1/sync/snapshot/meta",
-    licenseKey
+    access
   );
   const updatedAt = toIsoOrNull(response.updatedAt);
   const snapshotKind = normalizeSnapshotKind(response.snapshotKind);
@@ -15667,12 +16613,12 @@ async function fetchRemoteSnapshotMeta(licenseKey) {
     snapshotKind: updatedAt && response.snapshotKind === void 0 ? "legacy-plaintext" : snapshotKind
   };
 }
-async function pushRemoteSnapshot(licenseKey, snapshot, options) {
+async function pushRemoteSnapshot(access, snapshot, options) {
   const serializedSnapshot = typeof options?.serializedSnapshot === "string" ? options.serializedSnapshot : JSON.stringify(snapshot);
   const response = await requestJson(
     "PUT",
     "/v1/sync/snapshot",
-    licenseKey,
+    access,
     void 0,
     `{"snapshot":${serializedSnapshot}}`
   );
@@ -15691,8 +16637,8 @@ async function pushRemoteSnapshot(licenseKey, snapshot, options) {
 var import_toml3 = __toESM(require_toml(), 1);
 
 // ../../packages/runtime-codex/src/codex/config-metadata.ts
-var import_node_child_process6 = require("child_process");
-var import_promises = require("fs/promises");
+var import_node_child_process8 = require("child_process");
+var import_promises2 = require("fs/promises");
 var import_node_path11 = __toESM(require("path"), 1);
 var CONFIG_SCHEMA_URL = "https://raw.githubusercontent.com/openai/codex/main/codex-rs/core/config.schema.json";
 var METADATA_CACHE_TTL_MS = 6e4;
@@ -15803,9 +16749,9 @@ function uniqueSorted(values) {
 }
 async function runCommand3(command, args, timeoutMs = 3e3) {
   return new Promise((resolve, reject) => {
-    const child = (0, import_node_child_process6.spawn)(command, args, {
+    const child = (0, import_node_child_process8.spawn)(command, args, {
       stdio: ["ignore", "pipe", "pipe"],
-      env: process.env
+      env: buildCodexChildEnv()
     });
     let stdout = "";
     let stderr = "";
@@ -15884,7 +16830,7 @@ async function readSchemaFromLocal() {
   ].filter((candidate) => Boolean(candidate));
   for (const candidate of candidates) {
     try {
-      return await (0, import_promises.readFile)(candidate, "utf8");
+      return await (0, import_promises2.readFile)(candidate, "utf8");
     } catch {
     }
   }
@@ -15984,7 +16930,7 @@ async function getCodexConfigMetadata(forceRefresh = false) {
 }
 
 // ../../packages/runtime-codex/src/codex/config-io.ts
-var import_promises2 = require("fs/promises");
+var import_promises3 = require("fs/promises");
 var import_node_path13 = __toESM(require("path"), 1);
 
 // ../../packages/runtime-codex/src/codex/home.ts
@@ -16094,7 +17040,7 @@ function getConfigPath(options) {
 }
 async function ensureConfigDirExists(filePath) {
   const dir = import_node_path13.default.dirname(filePath);
-  await (0, import_promises2.mkdir)(dir, { recursive: true });
+  await (0, import_promises3.mkdir)(dir, { recursive: true });
 }
 function normalizeLineEndings(content) {
   return content.replace(/\r\n/g, "\n");
@@ -16106,7 +17052,7 @@ function ensureTrailingNewline(content) {
 async function readConfigContent(options) {
   const configPath = getConfigPath(options);
   try {
-    const content = await (0, import_promises2.readFile)(configPath, "utf8");
+    const content = await (0, import_promises3.readFile)(configPath, "utf8");
     return {
       exists: true,
       content: normalizeLineEndings(content)
@@ -16126,14 +17072,14 @@ async function writeConfigContent(content, options) {
   const configPath = getConfigPath(options);
   await ensureConfigDirExists(configPath);
   const normalized = ensureTrailingNewline(normalizeLineEndings(content));
-  await (0, import_promises2.writeFile)(configPath, normalized, "utf8");
+  await (0, import_promises3.writeFile)(configPath, normalized, "utf8");
 }
 async function getUpdatedAt(configPath, exists) {
   if (!exists) {
     return null;
   }
   try {
-    const stats = await (0, import_promises2.stat)(configPath);
+    const stats = await (0, import_promises3.stat)(configPath);
     return stats.mtimeMs;
   } catch (error) {
     const nodeError = error;
@@ -16647,10 +17593,10 @@ async function saveCodexConfigContent(content, options) {
 }
 
 // ../../packages/runtime-profiles/src/cloud-sync/encryption.ts
-var import_node_child_process7 = require("child_process");
-var import_node_crypto6 = require("crypto");
-var KEYCHAIN_SERVICE = "CODEXUSE_CLOUD_SYNC_PASSPHRASE";
-var KEYCHAIN_ACCOUNT_PREFIX = "license-sha256:";
+var import_node_child_process9 = require("child_process");
+var import_node_crypto9 = require("crypto");
+var KEYCHAIN_SERVICE2 = "CODEXUSE_CLOUD_SYNC_PASSPHRASE";
+var KEYCHAIN_ACCOUNT_PREFIX2 = "license-sha256:";
 var ENCRYPTION_AAD = Buffer.from("codexuse-cloud-sync-v2", "utf8");
 var SCRYPT_PARAMS = {
   N: 32768,
@@ -16673,7 +17619,7 @@ function requireCloudSyncPassphrase(value) {
 }
 async function deriveKey(passphrase, salt, params = SCRYPT_PARAMS) {
   return new Promise((resolve, reject) => {
-    (0, import_node_crypto6.scrypt)(passphrase, salt, params.keyLength, {
+    (0, import_node_crypto9.scrypt)(passphrase, salt, params.keyLength, {
       N: params.N,
       r: params.r,
       p: params.p,
@@ -16710,10 +17656,10 @@ function normalizeDecryptedSnapshot(value) {
   };
 }
 async function encryptCloudSyncSnapshot(snapshot, passphrase) {
-  const salt = (0, import_node_crypto6.randomBytes)(16);
-  const iv = (0, import_node_crypto6.randomBytes)(12);
+  const salt = (0, import_node_crypto9.randomBytes)(16);
+  const iv = (0, import_node_crypto9.randomBytes)(12);
   const key = await deriveKey(requireCloudSyncPassphrase(passphrase), salt);
-  const cipher = (0, import_node_crypto6.createCipheriv)("aes-256-gcm", key, iv);
+  const cipher = (0, import_node_crypto9.createCipheriv)("aes-256-gcm", key, iv);
   cipher.setAAD(ENCRYPTION_AAD);
   const plaintext = Buffer.from(JSON.stringify(snapshot), "utf8");
   const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
@@ -16740,7 +17686,7 @@ async function decryptCloudSyncSnapshot(snapshot, passphrase) {
     const tag = fromBase64(snapshot.encryption.tag);
     const ciphertext = fromBase64(snapshot.encryption.ciphertext);
     const key = await deriveKey(requireCloudSyncPassphrase(passphrase), salt, snapshot.encryption.kdfParams);
-    const decipher = (0, import_node_crypto6.createDecipheriv)("aes-256-gcm", key, iv);
+    const decipher = (0, import_node_crypto9.createDecipheriv)("aes-256-gcm", key, iv);
     decipher.setAAD(ENCRYPTION_AAD);
     decipher.setAuthTag(tag);
     const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
@@ -16755,12 +17701,12 @@ async function decryptCloudSyncSnapshot(snapshot, passphrase) {
   }
 }
 function keychainAccountForLicense(licenseKey) {
-  const digest = (0, import_node_crypto6.createHash)("sha256").update(licenseKey).digest("hex");
-  return KEYCHAIN_ACCOUNT_PREFIX + digest;
+  const digest = (0, import_node_crypto9.createHash)("sha256").update(licenseKey).digest("hex");
+  return KEYCHAIN_ACCOUNT_PREFIX2 + digest;
 }
-function runSecurityCommand(args) {
+function runSecurityCommand2(args) {
   return new Promise((resolve, reject) => {
-    const child = (0, import_node_child_process7.spawn)("security", args, { stdio: ["ignore", "pipe", "ignore"] });
+    const child = (0, import_node_child_process9.spawn)("security", args, { stdio: ["ignore", "pipe", "ignore"] });
     let stdout = "";
     child.stdout?.on("data", (chunk) => {
       stdout += String(chunk);
@@ -16777,12 +17723,12 @@ async function readRememberedCloudSyncPassphrase(licenseKey) {
   if (process.platform !== "darwin") {
     return null;
   }
-  const result = await runSecurityCommand([
+  const result = await runSecurityCommand2([
     "find-generic-password",
     "-a",
     keychainAccountForLicense(licenseKey),
     "-s",
-    KEYCHAIN_SERVICE,
+    KEYCHAIN_SERVICE2,
     "-w"
   ]);
   if (result.code !== 0) {
@@ -16795,13 +17741,13 @@ async function writeRememberedCloudSyncPassphrase(licenseKey, passphrase) {
     throw new Error("keychain-unsupported");
   }
   const value = requireCloudSyncPassphrase(passphrase);
-  const result = await runSecurityCommand([
+  const result = await runSecurityCommand2([
     "add-generic-password",
     "-U",
     "-a",
     keychainAccountForLicense(licenseKey),
     "-s",
-    KEYCHAIN_SERVICE,
+    KEYCHAIN_SERVICE2,
     "-w",
     value
   ]);
@@ -16880,31 +17826,144 @@ async function writeState(patch) {
 async function resolveEligibility() {
   const stored = await getStoredLicense();
   const licenseKey = typeof stored?.licenseKey === "string" ? stored.licenseKey.trim() : "";
-  if (!licenseKey) {
+  const status = await licenseService.getStatus();
+  if (licenseKey && status.isPro) {
+    const active = status.state === "active" || status.state === "grace";
+    if (active) {
+      await migrateTrialCloudSyncToPaidLicenseSafe(licenseKey);
+    }
     return {
-      canSync: false,
-      reason: "License key is required for cloud sync.",
-      licenseKey: null,
-      licenseState: null
+      canSync: active,
+      canDelete: active,
+      reason: active ? null : "Cloud sync requires an active Pro license.",
+      access: active ? { syncKey: licenseKey } : null,
+      hasPaidLicenseKey: true,
+      licenseState: status.state
     };
   }
-  const status = await licenseService.getStatus();
-  const active = status.state === "active" || status.state === "grace";
-  if (!active) {
+  if (status.trial?.active && status.capabilities.cloudSync) {
+    const trialAccess = await resolveTrialCloudSyncAccess();
+    if (trialAccess) {
+      return {
+        canSync: true,
+        canDelete: true,
+        reason: null,
+        access: trialAccess,
+        hasPaidLicenseKey: false,
+        licenseState: status.state
+      };
+    }
     return {
       canSync: false,
-      reason: "Cloud sync requires an active Pro license.",
-      licenseKey,
+      canDelete: false,
+      reason: "Cloud sync trial identity is unavailable.",
+      access: null,
+      hasPaidLicenseKey: false,
       licenseState: status.state
     };
   }
+  if (status.trial?.expired) {
+    const trialAccess = await resolveTrialCloudSyncAccess();
+    if (trialAccess) {
+      return {
+        canSync: false,
+        canDelete: true,
+        reason: "Cloud sync requires an active trial or Pro license.",
+        access: trialAccess,
+        hasPaidLicenseKey: false,
+        licenseState: status.state
+      };
+    }
+  }
   return {
-    canSync: true,
-    reason: null,
-    licenseKey,
+    canSync: false,
+    canDelete: false,
+    reason: "Cloud sync requires an active trial or Pro license.",
+    access: null,
+    hasPaidLicenseKey: false,
     licenseState: status.state
   };
 }
+async function hasRemoteSnapshot(access) {
+  const meta = await fetchRemoteSnapshotMeta(access);
+  return meta.snapshotKind !== "none" || Boolean(meta.updatedAt);
+}
+async function readRemoteSnapshotOrNull(access) {
+  try {
+    return await fetchRemoteSnapshot(access);
+  } catch (error) {
+    if (error instanceof CloudSyncClientError && (error.status === 403 || error.status === 404)) {
+      return null;
+    }
+    throw error;
+  }
+}
+async function migrateTrialPassphraseToPaidLicense(trialKey, licenseKey) {
+  const paidPassphrase = await readRememberedCloudSyncPassphrase(licenseKey).catch(() => null);
+  if (paidPassphrase) {
+    return;
+  }
+  const trialPassphrase = await readRememberedCloudSyncPassphrase(trialKey).catch(() => null);
+  if (!trialPassphrase) {
+    return;
+  }
+  await writeRememberedCloudSyncPassphrase(licenseKey, trialPassphrase);
+}
+async function migrateTrialCloudSyncToPaidLicense(licenseKey) {
+  const paidLicenseKey = licenseKey.trim();
+  if (!paidLicenseKey) {
+    return;
+  }
+  const trialAccess = await resolveTrialCloudSyncAccess();
+  if (!trialAccess || trialAccess.syncKey === paidLicenseKey) {
+    return;
+  }
+  if (await hasRemoteSnapshot({ syncKey: paidLicenseKey })) {
+    await migrateTrialPassphraseToPaidLicense(trialAccess.syncKey, paidLicenseKey).catch((error) => {
+      logWarn("[cloud-sync] failed to migrate remembered trial passphrase", {
+        error: error instanceof Error ? error.message : String(error)
+      });
+    });
+    return;
+  }
+  const trialSnapshot = await readRemoteSnapshotOrNull({
+    ...trialAccess,
+    syncKey: paidLicenseKey,
+    trialMigration: true
+  });
+  if (trialSnapshot) {
+    await pushRemoteSnapshot({ syncKey: paidLicenseKey }, trialSnapshot, {
+      serializedSnapshot: JSON.stringify(trialSnapshot)
+    });
+  }
+  await migrateTrialPassphraseToPaidLicense(trialAccess.syncKey, paidLicenseKey);
+}
+async function migrateTrialCloudSyncToPaidLicenseSafe(licenseKey) {
+  try {
+    await migrateTrialCloudSyncToPaidLicense(licenseKey);
+  } catch (error) {
+    logWarn("[cloud-sync] trial snapshot migration to paid license failed", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+  }
+}
+async function resolveTrialCloudSyncAccess() {
+  let deviceId;
+  try {
+    deviceId = await getDeviceId();
+  } catch {
+    return null;
+  }
+  const trialToken = await readStoredTrialToken(deviceId).catch(() => null);
+  if (!trialToken) {
+    return null;
+  }
+  return {
+    syncKey: `trial:${deviceId}`,
+    trialDeviceId: deviceId,
+    trialToken
+  };
+}
 function formatMegabytes(bytes) {
   return (bytes / MB_DIVISOR).toFixed(2);
 }
@@ -16997,19 +18056,19 @@ async function getCloudSyncStatus() {
   let remoteUpdatedAt = state.remoteUpdatedAt ?? null;
   let remoteKind = state.remoteKind ?? "none";
   let hasRememberedPassphrase = false;
-  if (eligibility.canSync && eligibility.licenseKey) {
+  if (eligibility.canSync && eligibility.access) {
     hasRememberedPassphrase = Boolean(
-      await readRememberedCloudSyncPassphrase(eligibility.licenseKey).catch(() => null)
+      await readRememberedCloudSyncPassphrase(eligibility.access.syncKey).catch(() => null)
     );
     try {
-      const remoteMeta = await fetchRemoteSnapshotMeta(eligibility.licenseKey);
+      const remoteMeta = await fetchRemoteSnapshotMeta(eligibility.access);
       remoteUpdatedAt = remoteMeta.updatedAt;
       remoteKind = remoteMeta.snapshotKind;
       await writeState({ remoteUpdatedAt, remoteKind });
     } catch (error) {
       if (error instanceof CloudSyncClientError && error.status === 404) {
         try {
-          const remote = await fetchRemoteSnapshot(eligibility.licenseKey);
+          const remote = await fetchRemoteSnapshot(eligibility.access);
           remoteUpdatedAt = remote?.updatedAt ?? null;
           remoteKind = getSnapshotKind(remote);
         } catch {
@@ -17019,9 +18078,10 @@ async function getCloudSyncStatus() {
   }
   return {
     canSync: eligibility.canSync,
+    canDelete: eligibility.canDelete,
     reason: eligibility.reason,
     licenseState: eligibility.licenseState,
-    hasLicenseKey: Boolean(eligibility.licenseKey),
+    hasLicenseKey: eligibility.hasPaidLicenseKey,
     hasRememberedPassphrase,
     lastPushAt: state.lastPushAt ?? null,
     lastPullAt: state.lastPullAt ?? null,
@@ -17032,7 +18092,7 @@ async function getCloudSyncStatus() {
 }
 async function pushCloudSync(options = {}) {
   const eligibility = await resolveEligibility();
-  if (!eligibility.canSync || !eligibility.licenseKey) {
+  if (!eligibility.canSync || !eligibility.access) {
     return {
       mode: "push",
       status: "skipped",
@@ -17045,7 +18105,7 @@ async function pushCloudSync(options = {}) {
   try {
     await profileManager.initialize();
     const localSnapshot = await buildLocalSnapshot(profileManager, { enforcePushGuards: true });
-    const passphrase = await resolvePassphrase(eligibility.licenseKey, options);
+    const passphrase = await resolvePassphrase(eligibility.access.syncKey, options);
     const encryptedSnapshot = await encryptCloudSyncSnapshot(localSnapshot, passphrase.value);
     const serializedSnapshot = JSON.stringify(encryptedSnapshot);
     const snapshotBytes = Buffer.byteLength(serializedSnapshot, "utf8");
@@ -17063,7 +18123,7 @@ async function pushCloudSync(options = {}) {
     if (process.env.NODE_ENV !== "production") {
       logInfo("[cloud-sync] push snapshot summary", summarizeSnapshot(localSnapshot));
     }
-    const remote = await pushRemoteSnapshot(eligibility.licenseKey, encryptedSnapshot, {
+    const remote = await pushRemoteSnapshot(eligibility.access, encryptedSnapshot, {
       serializedSnapshot
     });
     const remoteKind = getSnapshotKind(remote.snapshot);
@@ -17082,7 +18142,7 @@ async function pushCloudSync(options = {}) {
         remoteUpdatedAt: remote.snapshot.updatedAt
       };
     }
-    await rememberPassphraseIfRequested(eligibility.licenseKey, options, passphrase);
+    await rememberPassphraseIfRequested(eligibility.access.syncKey, options, passphrase);
     return {
       mode: "push",
       status: "applied",
@@ -17099,7 +18159,7 @@ async function pushCloudSync(options = {}) {
 }
 async function pullCloudSync(options = {}) {
   const eligibility = await resolveEligibility();
-  if (!eligibility.canSync || !eligibility.licenseKey) {
+  if (!eligibility.canSync || !eligibility.access) {
     return {
       mode: "pull",
       status: "skipped",
@@ -17111,7 +18171,7 @@ async function pullCloudSync(options = {}) {
   const profileManager = new ProfileManager();
   try {
     await profileManager.initialize();
-    const remote = await fetchRemoteSnapshot(eligibility.licenseKey);
+    const remote = await fetchRemoteSnapshot(eligibility.access);
     if (!remote) {
       await writeState({ remoteUpdatedAt: null, remoteKind: "none" });
       return {
@@ -17126,7 +18186,7 @@ async function pullCloudSync(options = {}) {
     let passphrase = null;
     let plainSnapshot;
     if (remote.schemaVersion === CLOUD_SYNC_ENCRYPTED_SCHEMA_VERSION) {
-      passphrase = await resolvePassphrase(eligibility.licenseKey, options);
+      passphrase = await resolvePassphrase(eligibility.access.syncKey, options);
       plainSnapshot = await decryptCloudSyncSnapshot(remote, passphrase.value);
     } else {
       plainSnapshot = remote;
@@ -17139,7 +18199,7 @@ async function pullCloudSync(options = {}) {
       lastError: void 0
     });
     if (passphrase) {
-      await rememberPassphraseIfRequested(eligibility.licenseKey, options, passphrase);
+      await rememberPassphraseIfRequested(eligibility.access.syncKey, options, passphrase);
     }
     return {
       mode: "pull",
@@ -17252,7 +18312,7 @@ async function ensureCliStorageReady() {
 }
 
 // src/app/main.ts
-var VERSION = true ? "5.1.0" : "0.0.0";
+var VERSION = true ? "5.1.5" : "0.0.0";
 async function runCli() {
   const args = process.argv.slice(2);
   if (args.length === 0) {