free-pi-cli 0.6.4 → 0.6.7

package/README.md

@@ -5,7 +5,7 @@ for the user because ads pay for inference. All model calls route through the
 free-pi proxy — you never handle a model API key.
 
 ```
-npx free-pi-cli
+npx free-pi-cli@latest
 ```
 
 First run shows a consent screen (free inference, ads pay for it, sessions
@@ -18,7 +18,7 @@ existing `~/.pi/agent` install.
 Closed the terminal? Just run the same command again — you stay signed in:
 
 ```
-npx free-pi-cli
+npx free-pi-cli@latest
 ```
 
 Prefer a shorter command? Install it once, globally, then call it by name:
@@ -29,7 +29,7 @@ free-pi-cli
 ```
 
 Note: `free-pi-cli` is the command — **not** `pi`. If you see the built-in
-agent suggest `pi --session …` on exit, use `npx free-pi-cli --session <id>`
+agent suggest `pi --session …` on exit, use `npx free-pi-cli@latest --session <id>`
 instead. In a folder with a recent session, some users are offered a
 one-keypress continue (default Yes). `--continue` resumes the last session
 here; `--new` starts fresh.
@@ -48,7 +48,7 @@ here; `--new` starts fresh.
 | `src/index.ts` | bin entry — wires real dependencies, calls `run()` |
 | `src/run.ts` | orchestration: consent → login → token check → launch |
 | `src/consent.ts` | consent screen text/parsing |
-| `src/auth-flow.ts` | GitHub device flow client (`/auth/github/device`, `/auth/consent`, `/auth/token`), `/me` token check |
+| `src/auth-flow.ts` | Sign-in clients: browser "Connect this terminal" (`/auth/connect/start`, `/auth/connect/poll`) and the GitHub device flow fallback (`/auth/github/device`, `/auth/consent`, `/auth/token`), `/me` token check |
 | `src/credentials.ts` | JWT file storage (mode 0600) under the free-pi config dir |
 | `src/provider.ts` | pure builder for the `pi.registerProvider` config |
 | `src/pi-launch.ts` | the actual pi SDK integration (registers the provider, launches the TUI) |

package/dist/index.js

@@ -17,7 +17,7 @@ function zstdSupportError(zlibModule = zlib, nodeVersion = process.versions.node
     `The pi agent needs Node with zstd support (Node >= 22.15, or >= 23.8 on the`,
     `Current line) — older Node crashes mid-request inside the agent. Upgrade Node:`,
     ``,
-    `  nvm install 22     # then re-run:  npx free-pi-cli`,
+    `  nvm install 22     # then re-run:  npx free-pi-cli@latest`,
     ``,
     `(or update your system Node to the latest LTS.)`
   ].join(`
@@ -30,4 +30,4 @@ if (err) {
   console.error(err);
   process.exit(1);
 }
-await import("./main-2mvzsazb.js");
+await import("./main-tm302552.js");

package/dist/{main-2mvzsazb.js → main-tm302552.js}

@@ -14407,6 +14407,21 @@ var AuthConsentRequestSchema = exports_external.object({
   signup_src: exports_external.string().optional(),
   referral_code: exports_external.string().optional()
 });
+var ConnectStartRequestSchema = exports_external.object({
+  consent_version: exports_external.string().min(1).max(32),
+  signup_src: exports_external.string().optional(),
+  referral_code: exports_external.string().optional(),
+  client: exports_external.object({ os: exports_external.string().max(64).optional(), cli_version: exports_external.string().max(64).optional() }).optional()
+});
+var ConnectStartResponseSchema = exports_external.object({
+  session_id: exports_external.string().uuid(),
+  poll_secret: exports_external.string(),
+  token: exports_external.string(),
+  confirm_code: exports_external.string(),
+  connect_url: exports_external.string(),
+  expires_in: exports_external.number(),
+  interval: exports_external.number()
+});
 var GuestStartRequestSchema = exports_external.object({
   consent_version: exports_external.string().min(1).max(32),
   signup_src: exports_external.string().optional(),
@@ -14692,7 +14707,12 @@ var ConfigSchema = exports_external.object({
   referralMaxActivePerReferrer: exports_external.number().int().default(10),
   referralGithubMinAgeDays: exports_external.number().int().default(30),
   referralCreditGrantCredits: exports_external.number().int().default(0),
-  webClaimCredits: exports_external.number().int().default(0)
+  webClaimCredits: exports_external.number().int().default(0),
+  geoipDbPath: exports_external.string().optional(),
+  sanctionedCountries: exports_external.array(exports_external.string()).default(["IR", "CU", "KP", "SY"]),
+  regionLimitsStart: exports_external.date().optional(),
+  fullAllowanceCountries: exports_external.array(exports_external.string()).default(["US", "CA", "GB", "AU", "NZ", "IE"]),
+  regionLowCapMicros: exports_external.bigint().default(100000n)
 });
 function envNumber(value) {
   if (value === undefined || value === "")
@@ -14728,6 +14748,15 @@ function envList(value) {
   const items = value.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
   return items.length > 0 ? items : undefined;
 }
+function envCountries(value) {
+  return envList(value)?.map((s) => s.toUpperCase());
+}
+function envDate(value) {
+  if (!value?.trim())
+    return;
+  const d = new Date(value.trim());
+  return Number.isNaN(d.getTime()) ? undefined : d;
+}
 function envDecimalString(value) {
   if (value === undefined || value.trim() === "")
     return;
@@ -14822,7 +14851,12 @@ function loadConfig(env = process.env) {
     referralMaxActivePerReferrer: envStrictInt("REFERRAL_MAX_ACTIVE_PER_REFERRER", env.REFERRAL_MAX_ACTIVE_PER_REFERRER),
     referralGithubMinAgeDays: envStrictInt("REFERRAL_GITHUB_MIN_AGE_DAYS", env.REFERRAL_GITHUB_MIN_AGE_DAYS),
     referralCreditGrantCredits: envStrictInt("REFERRAL_CREDIT_GRANT_CREDITS", env.REFERRAL_CREDIT_GRANT_CREDITS),
-    webClaimCredits: envStrictInt("WEB_CLAIM_CREDITS", env.WEB_CLAIM_CREDITS)
+    webClaimCredits: envStrictInt("WEB_CLAIM_CREDITS", env.WEB_CLAIM_CREDITS),
+    geoipDbPath: env.GEOIP_DB_PATH?.trim() || undefined,
+    sanctionedCountries: envCountries(env.SANCTIONED_COUNTRIES),
+    regionLimitsStart: envDate(env.REGION_LIMITS_START),
+    fullAllowanceCountries: envCountries(env.FULL_ALLOWANCE_COUNTRIES),
+    regionLowCapMicros: envMicros("REGION_LOW_CAP_USD", env.REGION_LOW_CAP_USD)
   });
 }
 // ../shared/src/credits.ts
@@ -15061,7 +15095,7 @@ var HiveClassifyResponseSchema = exports_external.object({
 // package.json
 var package_default = {
   name: "free-pi-cli",
-  version: "0.6.4",
+  version: "0.6.7",
   description: "Free, ad-supported distribution of the pi coding agent. Inference paid for by ads.",
   license: "MIT",
   type: "module",
@@ -15104,6 +15138,7 @@ Usage:
   free-pi-cli --session <id>  resume a previous session
   free-pi-cli --continue      resume the last session in this folder
   free-pi-cli --new           start a new session
+  free-pi-cli --device-login  sign in with a GitHub device code instead of the browser page
   free-pi-cli --ref <code>    first-run referral code (from freepi.ai/?ref=)
   free-pi-cli --src <channel> first-run campaign attribution (from freepi.ai/?src=)
   free-pi-cli logout          remove the stored sign-in token; the next run signs in again
@@ -15114,6 +15149,7 @@ Usage:
 
 Environment:
   FREEPI_BASE_URL        override the backend base URL (default https://api.freepi.ai)
+  FREEPI_DEVICE_LOGIN=1  same as --device-login
   FREEPI_NO_AUTO_UPDATE  disable in-place self-update for this run
   FREEPI_NO_GRAVITY_PIXEL=1  do not run Gravity's ad-measurement pixel
   FREEPI_REF             same as --ref when the flag is omitted
@@ -15139,7 +15175,7 @@ function parseCliArgs(argv) {
     let i = 0;
     while (i < argv.length) {
       const arg = argv[i];
-      if (arg === "--continue" || arg === "--resume" || arg === "--new") {
+      if (arg === "--continue" || arg === "--resume" || arg === "--new" || arg === "--device-login") {
         i += 1;
         continue;
       }
@@ -15641,12 +15677,16 @@ function mapErrorCode(code) {
     case "account_review":
       return "this account is under review — contact support";
     case "ads_required":
-      return "ads aren't displaying for this account, so free completions are paused — run free-pi through `npx free-pi-cli`, then retry";
+      return "ads aren't displaying for this account, so free completions are paused — run free-pi through `npx free-pi-cli@latest`, then retry";
     case "guest_allowance":
       return "guest trial used up — sign in with GitHub (/login) for 15,000 free credits a day";
     case "guest_unavailable":
     case "guest_login_required":
       return "this needs a GitHub sign-in — run /login for 15,000 free credits a day";
+    case "region_unavailable":
+      return "free-pi is not available in your region";
+    case "model_requires_credits":
+      return "this model needs purchased credits in your region — run /buy-credits, or switch to the default model";
     default:
       return assertExhaustiveErrorCode(code);
   }
@@ -15666,6 +15706,7 @@ function buyMore(buyUrl) {
 }
 var CONFIRM_TURNS = 3;
 var lastCreditUsd;
+var lastToken;
 var confirm;
 function creditAddedMessage(addedUsd) {
   return `Payment received — ${usdToCredits(addedUsd).toLocaleString("en-US")} credits added to your balance.`;
@@ -15679,6 +15720,12 @@ async function renderMeter(deps, ctx) {
   }
   const theme = ctx.ui.theme;
   const credit = typeof me.credit_usd === "number" ? me.credit_usd : undefined;
+  const token = await deps.getToken();
+  if (token !== lastToken) {
+    lastToken = token;
+    lastCreditUsd = undefined;
+    confirm = undefined;
+  }
   const added = credit !== undefined && lastCreditUsd !== undefined ? credit - lastCreditUsd : 0;
   lastCreditUsd = credit;
   if (added > 0)
@@ -15773,6 +15820,7 @@ function createAdsExtension(opts) {
       pi.on("session_start", async (_event, ctx) => {
         stopped = false;
         inline.reset(ctx);
+        opts.registerMeterRefresh?.(() => renderMeter(deps, ctx));
         await Promise.all([renderBanner(ctx, true), renderMeter(deps, ctx)]);
         if (bannerInterval)
           clearInterval(bannerInterval);
@@ -20198,6 +20246,8 @@ var IMAGE_GUIDELINES = [
   "Each image uses part of the user's daily allowance, so do not regenerate unless the user asks."
 ];
 var ERROR_TEXT = {
+  guest_login_required: "This tool needs a GitHub sign-in; the guest trial cannot use it. Do not retry or work around it; tell the user to run /login (it also gives 15,000 free credits a day), and continue without this tool.",
+  guest_unavailable: "The guest trial is not available right now. Do not retry; tell the user to run /login to sign in with GitHub, and continue without this tool.",
   daily_cap: "The user's free allowance for today is used up. Do not retry. Tell the user they can get credits at freepi.ai/extra-credits, and continue without this tool.",
   rolling_cap: "The user's short-term usage limit is reached. Do not retry; continue without this tool.",
   rate_limited: "Too many image requests right now. Do not call generate_image again in this turn unless the user asks.",
@@ -20325,6 +20375,8 @@ var VISION_GUIDELINES = [
   "The answer comes from another model and can be wrong. Verify layout claims with DOM measurements when you can."
 ];
 var ERROR_TEXT2 = {
+  guest_login_required: "This tool needs a GitHub sign-in; the guest trial cannot use it. Do not retry or work around it; tell the user to run /login (it also gives 15,000 free credits a day), and continue without this tool.",
+  guest_unavailable: "The guest trial is not available right now. Do not retry; tell the user to run /login to sign in with GitHub, and continue without this tool.",
   daily_cap: "The user's free allowance for today is used up. Do not retry. Tell the user they can get credits at freepi.ai/extra-credits, and continue without this tool.",
   rolling_cap: "The user's short-term usage limit is reached. Do not retry; continue without this tool.",
   rate_limited: "Another image question is already running or requests are too frequent. Do not call look_at_image again in this turn unless the user asks.",
@@ -20603,7 +20655,7 @@ var FREE_PI_DOCS = `# free-pi
 
 ## What free-pi is
 free-pi is a free, ad-supported distribution of the pi coding agent.
-You run \`npx free-pi-cli\`, sign in with GitHub, and get free inference with
+You run \`npx free-pi-cli@latest\`, sign in with GitHub, and get free inference with
 exciting models. Ads shown in the terminal pay for it. You never handle a
 model API key. Config and the sign-in token live under \`~/.free-pi/agent\`,
 separate from any \`~/.pi/agent\` install.
@@ -20629,7 +20681,7 @@ first. Purchased credits cover use beyond it and do not expire.
 ## Model and restarting
 \`/model\` shows the current model and lets you switch it; the model can change
 during a session. Credits are free-pi's usage unit, not model tokens. To
-restart, exit and run \`npx free-pi-cli\` again; \`--continue\` resumes the last
+restart, exit and run \`npx free-pi-cli@latest\` again; \`--continue\` resumes the last
 session.
 
 ## Commands
@@ -21174,7 +21226,7 @@ var AGENT_RULES = `## Working rules
   failed. Never an empty reply.
 - For questions about free-pi itself (model, credits, limits, commands, restart), call the
   ${DOCS_TOOL_NAME} tool instead of searching files. Credits are free-pi's usage unit, not model tokens.
-  To restart, run npx free-pi-cli.
+  To restart, run npx free-pi-cli@latest.
 - Write files longer than about 300 lines in parts, not one huge write.
 - Never print whole env, config or credential files. Search for the specific name and never
   echo secret values.
@@ -21400,6 +21452,22 @@ function mergeAttribution(a, b) {
 
 // src/changelog.ts
 var CHANGELOG_HIGHLIGHTS = [
+  {
+    version: "0.6.7",
+    highlights: [
+      "/logout now signs you out of free-pi: it removes your saved sign-in and exits. Restart free-pi to sign in again. Guests are told they are not signed in.",
+      "The confirmation code shown during browser sign-in is now bold and bright, so it is easy to compare with the one on freepi.ai.",
+      'Fixed a wrong "Payment received" line that could appear right after signing in.'
+    ]
+  },
+  {
+    version: "0.6.6",
+    highlights: [
+      'Sign-in is now one click in your browser: press "Connect this terminal" on freepi.ai after checking the confirmation code. The GitHub device code is still used over SSH or without a browser, or with --device-login.',
+      "Shorter consent screen and a one-line intro. The version check now runs before consent, and the footer credits refresh right after /login.",
+      'If free-pi is not available in your region, sign-in says so instead of showing "HTTP 403". Guests using look_at_image or generate_image are told to run /login.'
+    ]
+  },
   {
     version: "0.6.4",
     highlights: [
@@ -21668,6 +21736,9 @@ function highlightsFor(version3) {
   return CHANGELOG_HIGHLIGHTS.find((e) => e.version === version3)?.highlights;
 }
 
+// src/commands.ts
+import { access } from "node:fs/promises";
+
 // src/auth-flow.ts
 class UnauthorizedError extends Error {
   constructor() {
@@ -21693,12 +21764,39 @@ async function postJsonRetry(baseUrl, path, body, attempts = 4, sleep = (ms) =>
     }
   }
 }
+var REGION_UNAVAILABLE_LINE = "free-pi is not available in your region.";
+function refusalMessage(status, body) {
+  if (body?.code === "region_unavailable") {
+    return typeof body.message === "string" && body.message.trim() ? body.message : REGION_UNAVAILABLE_LINE;
+  }
+  if (status >= 400 && status < 500 && typeof body?.message === "string" && body.message.trim()) {
+    return body.message;
+  }
+  return;
+}
+async function readRefusal(res) {
+  return await res.json().catch(() => {
+    return;
+  });
+}
 async function startDeviceFlow(baseUrl) {
   const res = await postJsonRetry(baseUrl, "/auth/github/device", {});
-  if (!res.ok)
-    throw new Error(`device flow start failed: HTTP ${res.status}`);
+  if (!res.ok) {
+    throw new Error(refusalMessage(res.status, await readRefusal(res)) ?? `device flow start failed: HTTP ${res.status}`);
+  }
   return GithubDeviceResponseSchema.parse(await res.json());
 }
+async function startConnect(baseUrl, consentVersion, attribution = {}, client = {}) {
+  const res = await postJsonRetry(baseUrl, "/auth/connect/start", {
+    consent_version: consentVersion,
+    client,
+    ...attribution.signup_src ? { signup_src: attribution.signup_src } : {},
+    ...attribution.referral_code ? { referral_code: attribution.referral_code } : {}
+  });
+  if (!res.ok)
+    throw new Error(refusalMessage(res.status, await readRefusal(res)) ?? `connect start failed: HTTP ${res.status}`);
+  return ConnectStartResponseSchema.parse(await res.json());
+}
 async function submitConsent(baseUrl, sessionId, consentVersion, attribution = {}) {
   const res = await postJsonRetry(baseUrl, "/auth/consent", {
     session_id: sessionId,
@@ -21706,8 +21804,9 @@ async function submitConsent(baseUrl, sessionId, consentVersion, attribution = {
     ...attribution.signup_src ? { signup_src: attribution.signup_src } : {},
     ...attribution.referral_code ? { referral_code: attribution.referral_code } : {}
   });
-  if (!res.ok)
-    throw new Error(`consent submission failed: HTTP ${res.status}`);
+  if (!res.ok) {
+    throw new Error(refusalMessage(res.status, await readRefusal(res)) ?? `consent submission failed: HTTP ${res.status}`);
+  }
 }
 
 class GuestUnavailableError extends Error {
@@ -21724,9 +21823,9 @@ async function startGuestSession(baseUrl, consentVersion, attribution = {}) {
     ...attribution.referral_code ? { referral_code: attribution.referral_code } : {}
   });
   if (res.status === 403) {
-    const body = await res.json().catch(() => {
-      return;
-    });
+    const body = await readRefusal(res);
+    if (body?.code === "region_unavailable")
+      throw new Error(refusalMessage(res.status, body));
     throw new GuestUnavailableError(body?.reason ?? "disabled");
   }
   if (!res.ok)
@@ -21759,6 +21858,12 @@ class LoginTimeoutError extends Error {
     super("github_login_timeout");
   }
 }
+
+class LoginDeniedError extends Error {
+  constructor() {
+    super("login_denied");
+  }
+}
 async function pollForToken(baseUrl, sessionId, interval, sleep, opts = {}) {
   let consecutiveNetworkFailures = 0;
   const now = opts.now ?? Date.now;
@@ -21772,10 +21877,10 @@ async function pollForToken(baseUrl, sessionId, interval, sleep, opts = {}) {
       if (opts.jwt)
         headers.authorization = `Bearer ${opts.jwt}`;
       const doFetch = opts.fetchImpl ?? fetch;
-      res = await doFetch(new URL("/auth/token", baseUrl), {
+      res = await doFetch(new URL(opts.endpoint ?? "/auth/token", baseUrl), {
         method: "POST",
         headers,
-        body: JSON.stringify({ session_id: sessionId })
+        body: JSON.stringify({ session_id: sessionId, ...opts.pollSecret ? { poll_secret: opts.pollSecret } : {} })
       });
       consecutiveNetworkFailures = 0;
     } catch (err) {
@@ -21786,16 +21891,17 @@ async function pollForToken(baseUrl, sessionId, interval, sleep, opts = {}) {
       await sleep(Math.max(interval, 5) * 1000);
       continue;
     }
-    if (res.status === 403) {
-      const body = await res.json().catch(() => {
-        return;
-      });
-      if (body?.code === "consent_required") {
+    if (!res.ok) {
+      const body = await readRefusal(res);
+      if (res.status === 403 && body?.code === "consent_required") {
         throw new Error("consent_required: server did not record consent before polling");
       }
+      if (res.status === 403 && body?.code === "denied")
+        throw new LoginDeniedError;
+      if (res.status === 410 && body?.code === "expired")
+        throw new LoginTimeoutError;
+      throw new Error(refusalMessage(res.status, body) ?? `token poll failed: HTTP ${res.status}`);
     }
-    if (!res.ok)
-      throw new Error(`token poll failed: HTTP ${res.status}`);
     const parsed = AuthTokenResponseSchema.parse(await res.json());
     if ("token" in parsed)
       return parsed.token;
@@ -21894,40 +22000,18 @@ function clipboardCommand(platform) {
 
 // src/consent.ts
 var CONSENT_TEXT = `
-free-pi — before you start
-
-  * Inference is free. Ads pay for it, and so does training.
-  * Ad cards render in the terminal UI. Some ads come from a third-party ad
-    provider (Gravity), which receives excerpts of your recent conversation
-    to pick a relevant ad.
-  * Gravity also keeps a session and visitor ID on your machine (in
-    ~/.free-pi) and receives usage events from free-pi to measure and
-    attribute ads.
-  * Your coding sessions (prompts, code, files, and model responses) are saved
-    as traces and used to train models. We may share or sell that data to
-    third parties. Once you accept, there is no opt-out, except where the law
-    gives you one.
-  * We do our best to remove personal information from traces before we store
-    them. We cannot promise it is perfectly clean.
-  * free-pi is in alpha and testing. There are no warranties or guarantees,
-    expressed or implied, and no guarantee of uptime.
-  * If GitHub email capture is enabled, we collect your GitHub email and may
-    use it to contact you about the service or product.
-  * free-pi-cli auto-updates itself when a new version is available. Disable
-    with FREEPI_NO_AUTO_UPDATE or {"autoUpdate":false} in ~/.free-pi/config.json.
-
-By accepting you agree to the Terms of Service (https://freepi.ai/terms)
-and the Privacy Policy (https://freepi.ai/privacy).
-
-Decline and nothing is sent to the free-pi server.
+free-pi is free. In exchange, we show you ads and may train on your data.
+If you want to use free-pi, you accept that. If you don't, don't use it.
+Terms: https://freepi.ai/terms   Privacy: https://freepi.ai/privacy
 `.trim();
 var CONSENT_VERSION = "4";
-var NON_INTERACTIVE_CONSENT_TEXT = "free-pi first-run consent needs an interactive terminal (stdin is not a TTY). " + "Run `npx free-pi-cli` in a terminal once to review and accept; " + "after that, non-interactive runs work.";
+var NON_INTERACTIVE_CONSENT_TEXT = "free-pi first-run consent needs an interactive terminal (stdin is not a TTY). " + "Run `npx free-pi-cli@latest` in a terminal once to review and accept; " + "after that, non-interactive runs work.";
 var CONSENT_PROMPT = "Accept? [y/N] ";
 function parseConsentAnswer(answer) {
   return /^\s*y(es)?\s*$/i.test(answer);
 }
-var REPROMPT_CONSENT_TEXT = CONSENT_TEXT.replace("Decline and nothing is sent to the free-pi server.", "Decline and free-pi exits; you will be asked again next time.");
+var REPROMPT_CONSENT_TEXT = `${CONSENT_TEXT}
+If you decline, free-pi exits and asks again next time.`;
 
 // src/refill-card.ts
 var LOGIN_BONUS_UNLOCK_LINE = "Sign in with GitHub to unlock a one-time comeback bonus.";
@@ -22151,6 +22235,79 @@ async function runDeviceLogin(deps, attribution = {}) {
     throw err;
   }
 }
+var CONNECT_BROWSER_FAILED_LINE = "Couldn't open a browser here, so using the GitHub device code instead.";
+var CONNECT_FALLBACK_LINE = "Couldn't start the browser sign-in, so using the GitHub device code instead.";
+var LOGIN_DENIED_LINE = "Sign-in was cancelled in the browser. Run /login to try again.";
+var DEVICE_LOGIN_HINT = "Prefer a GitHub device code? Run: npx free-pi-cli@latest --device-login";
+function browserLikelyAvailable(env = process.env, platform = process.platform) {
+  if (env.SSH_CONNECTION || env.SSH_CLIENT || env.SSH_TTY)
+    return false;
+  if (platform === "linux" && !env.DISPLAY && !env.WAYLAND_DISPLAY)
+    return false;
+  return true;
+}
+function emphasize(text, color = !process.env.NO_COLOR && process.stdout.isTTY === true) {
+  return color ? `\x1B[1;97m${text}\x1B[0m` : text;
+}
+function formatConnectPrompt(connect, color) {
+  return [
+    "",
+    LOGIN_REWARD_LINE,
+    "",
+    "  Opening your browser to connect this terminal. If it doesn't open, go to:",
+    `  ${connect.connect_url}`,
+    "",
+    `  Confirmation code:  ${emphasize(connect.confirm_code, color)}`,
+    "  (the page must show the same code)",
+    "",
+    DEVICE_LOGIN_HINT,
+    ""
+  ].join(`
+`);
+}
+async function runConnectLogin(deps, attribution = {}) {
+  const connect = await startConnect(deps.baseUrl, CONSENT_VERSION, attribution, {
+    os: process.platform,
+    cli_version: CLI_VERSION
+  });
+  deps.log(formatConnectPrompt(connect));
+  let browserOpened = false;
+  try {
+    browserOpened = await deps.openBrowser(connect.connect_url) !== false;
+  } catch {
+    browserOpened = false;
+  }
+  if (!browserOpened) {
+    deps.log(CONNECT_BROWSER_FAILED_LINE);
+    return;
+  }
+  deps.log(LOGIN_WAITING_LINE.replace("GitHub", "browser sign-in"));
+  const deadline = (deps.now ?? Date.now)() + connect.expires_in * 1000;
+  return pollForToken(deps.baseUrl, connect.session_id, connect.interval, deps.sleep, {
+    deadline,
+    now: deps.now,
+    jwt: deps.jwt,
+    fetchImpl: deps.fetchImpl,
+    endpoint: "/auth/connect/poll",
+    pollSecret: connect.poll_secret
+  });
+}
+async function runLoginAuto(deps, attribution = {}, opts = {}) {
+  const env = opts.env ?? process.env;
+  const forced = opts.forceDevice || env.FREEPI_DEVICE_LOGIN === "1" || env.FREEPI_DEVICE_LOGIN === "true";
+  if (!forced && browserLikelyAvailable(env, opts.platform)) {
+    try {
+      const token = await runConnectLogin(deps, attribution);
+      if (token)
+        return token;
+    } catch (err) {
+      if (err instanceof LoginTimeoutError || err instanceof LoginDeniedError)
+        throw err;
+      deps.log(CONNECT_FALLBACK_LINE);
+    }
+  }
+  return runDeviceLogin(deps, attribution);
+}
 
 // src/allowance-counter.ts
 var cached2;
@@ -22301,7 +22458,7 @@ async function runLogin(opts, ctx) {
   try {
     const attribution = opts.agentDir ? await loadAttribution(getAttributionPath(opts.agentDir)) : {};
     const variant = resolveHandoffVariant(opts);
-    const token = await runDeviceLogin({
+    const token = await runLoginAuto({
       baseUrl: opts.baseUrl,
       openBrowser: opts.openBrowserImpl ?? openBrowser,
       sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
@@ -22314,12 +22471,16 @@ async function runLogin(opts, ctx) {
     if (opts.credentialsPath)
       await saveJwt(opts.credentialsPath, token);
     opts.onLogin?.(token);
-    ctx.ui.notify(isHandoffTreatment(variant) ? SIGNED_IN_CONTINUE_LINE : "Signed in. Restart free-pi-cli to unlock 15,000 free credits a day and a one-time comeback bonus.", "info");
+    ctx.ui.notify(isHandoffTreatment(variant) ? SIGNED_IN_CONTINUE_LINE : "Signed in. You now have 15,000 free credits a day, plus a one-time comeback bonus.", "info");
   } catch (err) {
     if (err instanceof LoginTimeoutError) {
       ctx.ui.notify(LOGIN_TIMEOUT_LINE, "warning");
       return;
     }
+    if (err instanceof LoginDeniedError) {
+      ctx.ui.notify(LOGIN_DENIED_LINE, "warning");
+      return;
+    }
     const reason = err instanceof Error && err.message ? ` (${err.message})` : "";
     ctx.ui.notify(`Couldn't finish GitHub sign-in${reason}. Run /login to try again.`, "error");
   }
@@ -22340,6 +22501,33 @@ function installLoginHandler(mode, opts) {
     return runLogin(opts, { ui: { notify } });
   };
 }
+var LOGOUT_DONE_LINE = "Signed out of free-pi. Restart free-pi to sign in again.";
+var LOGOUT_NOT_SIGNED_IN_LINE = "You're not signed in to free-pi.";
+function installLogoutHandler(mode, opts) {
+  const printAtExit = opts.printAtExit ?? ((line) => void process.once("exit", () => process.stdout.write(`${line}
+`)));
+  const m = mode;
+  mode.showOAuthSelector = async () => {
+    if (!opts.credentialsPath || opts.isGuest?.()) {
+      m.showStatus(LOGOUT_NOT_SIGNED_IN_LINE);
+      return;
+    }
+    try {
+      try {
+        await runLogout({ credentialsPath: opts.credentialsPath, loadJwt, clearJwt, log: () => {} });
+      } catch (err) {
+        if (await access(opts.credentialsPath).then(() => true, () => false)) {
+          const reason = err instanceof Error && err.message ? err.message : "unknown error";
+          m.showError(`Couldn't sign out: ${reason}. Try: npx free-pi-cli@latest logout`);
+          return;
+        }
+      }
+      m.showStatus(LOGOUT_DONE_LINE);
+      printAtExit(LOGOUT_DONE_LINE);
+      await m.shutdown();
+    } catch {}
+  };
+}
 async function showUsage(opts, ctx) {
   const r = await fetchUsageText(opts);
   ctx.ui.notify(r.text, r.ok ? "info" : "error");
@@ -24307,7 +24495,7 @@ var RESUME_COMMAND_RE = /(To resume this session:(?:\u001b\[[0-9;]*m|\s)*)pi(?=\
 function rewriteResumeLine(chunk) {
   if (!chunk.includes(RESUME_LABEL))
     return chunk;
-  return chunk.replace(RESUME_COMMAND_RE, "$1npx free-pi-cli");
+  return chunk.replace(RESUME_COMMAND_RE, "$1npx free-pi-cli@latest");
 }
 function patchResumeLine(stream) {
   const original = stream.write.bind(stream);
@@ -24367,12 +24555,17 @@ function projectTrustForCwd(cwd, launch, agentDir, hasTrustRequiringResources =
 function createSessionAuth(initial) {
   let jwt2 = initial.jwt;
   let guest = initial.guest;
+  let onSignedIn;
   return {
     getJwt: () => jwt2,
     isGuest: () => guest,
     becomeSignedIn(token) {
       jwt2 = token;
       guest = false;
+      onSignedIn?.();
+    },
+    setOnSignedIn(fn) {
+      onSignedIn = fn;
     }
   };
 }
@@ -24450,6 +24643,7 @@ function buildRuntimeOptions(opts, sessionId) {
   };
   let advertiserUrl;
   const adsExtension = createAdsExtension({
+    registerMeterRefresh: (refresh) => auth.setOnSignedIn(() => void refresh().catch(() => {})),
     baseUrl: opts.baseUrl,
     getToken: () => auth.getJwt(),
     sessionId,
@@ -24665,6 +24859,7 @@ async function launchPi(opts) {
     onLogin: (token) => auth.becomeSignedIn(token),
     variant: () => opts.guestHandoffVariant
   });
+  installLogoutHandler(mode, { credentialsPath: opts.credentialsPath, isGuest: () => auth.isGuest() });
   installModelAllowanceHandler(mode);
   installFooterRightAlign(mode);
   await mode.run();
@@ -25008,18 +25203,7 @@ import { existsSync as existsSync6, readdirSync as readdirSync3, realpathSync as
 import { homedir as homedir6 } from "node:os";
 import { join as join12 } from "node:path";
 var INTRO_ENV_SKIP = "FREEPI_NO_INTRO";
-var INTRO_TEXT = `
-Welcome to free-pi — a free coding agent in your terminal.
-
-  • It's the pi coding agent, free to use. Ads in the terminal pay for the
-    inference — ad content never reaches the model.
-  • Tell it what to build, fix, or explain, like any coding assistant.
-  • You can run free-pi in more than one terminal. If you close the terminal,
-    relaunch with "npx free-pi-cli" — or resume where you left off with
-    "npx free-pi-cli --session <id>" (the id prints when you exit).
-
-Set ${INTRO_ENV_SKIP}=1 to skip this next time.
-`.trim();
+var INTRO_TEXT = "Tell free-pi what to build, fix, or explain. Resume later with: npx free-pi-cli@latest --continue";
 function introSkipped(env = process.env) {
   const v = env[INTRO_ENV_SKIP];
   return v === "1" || v === "true";
@@ -25052,7 +25236,7 @@ Try one of these on this project — just type it:
 `.trim();
 var FIRST_TASK_EMPTY_TEXT = `
 This folder doesn't look like a project. free-pi works best on code you
-already have: quit, "cd" into a project, and run "npx free-pi-cli" there.
+already have: quit, "cd" into a project, and run "npx free-pi-cli@latest" there.
 Or just type: Create a small runnable hello-world app here and run it
 `.trim();
 function showFirstTaskHint(log, cwd = process.cwd(), home = homedir6()) {
@@ -25106,20 +25290,23 @@ async function loginFlow(deps, argv = []) {
     throw new Error(resolved.error);
   }
   try {
-    const token = await runDeviceLogin({
+    const token = await runLoginAuto({
       baseUrl: deps.baseUrl,
       openBrowser: deps.openBrowser,
       sleep: deps.sleep,
       log: deps.log,
       jwt: await loadJwt(deps.credentialsPath),
       credentialsPath: deps.credentialsPath
-    }, resolved.attribution ?? {});
+    }, resolved.attribution ?? {}, { forceDevice: argv.includes("--device-login"), env: deps.env, platform: deps.platform });
     await saveJwt(deps.credentialsPath, token);
     return token;
   } catch (err) {
     if (err instanceof LoginTimeoutError) {
       deps.log(LOGIN_TIMEOUT_LINE);
     }
+    if (err instanceof LoginDeniedError) {
+      deps.log(LOGIN_DENIED_LINE);
+    }
     throw err;
   }
 }
@@ -25153,6 +25340,21 @@ function reportResumeExposure(deps, jwt2, event, experiment = RESUME_ON_LAUNCH_E
 async function defaultFindLatestSession(cwd, agentDir) {
   return findLatestSession(cwd, getSessionDir(cwd, agentDir));
 }
+async function handleVersionAction(deps, versionCheck) {
+  const outcome = await deps.maybeSelfUpdate(versionCheck.action, versionCheck.latest);
+  if (outcome === "updated-exit")
+    return { code: 0 };
+  if (outcome === "blocked") {
+    const relaunched = await deps.relaunchLatest?.(versionCheck.latest);
+    if (relaunched !== undefined)
+      return { code: relaunched };
+    deps.log(`free-pi-cli needs an update. From a trusted folder (for example: cd ~), run:
+  npx --yes free-pi-cli@latest
+or: npm i -g free-pi-cli@latest`);
+    return { code: 1 };
+  }
+  return outcome === "notice" ? { updateLatest: versionCheck.latest } : {};
+}
 async function run(deps, argv = process.argv) {
   const resumeFlags = parseResumeFlags(argv);
   if (resumeFlags.sessionError) {
@@ -25172,6 +25374,17 @@ async function run(deps, argv = process.argv) {
 ${FINISH_SIGNIN_LINE}
 `);
   let jwt2 = await loadJwt(deps.credentialsPath);
+  const hadJwt = Boolean(jwt2);
+  let versionCheck = await deps.checkClientVersion(deps.baseUrl, CLI_VERSION, jwt2);
+  let updateLatest;
+  let versionHandled = false;
+  if (versionCheck.action === "block") {
+    const handled = await handleVersionAction(deps, versionCheck);
+    if (handled.code !== undefined)
+      return handled.code;
+    updateLatest = handled.updateLatest;
+    versionHandled = true;
+  }
   let guestHandoffVariant;
   let showFirstTask = false;
   let consentCurrent = false;
@@ -25202,7 +25415,7 @@ ${FINISH_SIGNIN_LINE}
   if (!jwt2) {
     const accepted = await deps.promptConsent();
     if (!accepted) {
-      deps.log("Declined. Exiting without contacting the free-pi server.");
+      deps.log("Declined. Exiting.");
       return 1;
     }
     showIntro(deps.log);
@@ -25233,24 +25446,13 @@ Guest trial is not available right now.
     }
     consentCurrent = true;
   }
-  const versionCheck = await deps.checkClientVersion(deps.baseUrl, CLI_VERSION, jwt2);
-  let updateLatest;
-  if (versionCheck.action !== "ok") {
-    const outcome = await deps.maybeSelfUpdate(versionCheck.action, versionCheck.latest);
-    if (outcome === "updated-exit")
-      return 0;
-    if (outcome === "blocked") {
-      const relaunched = await deps.relaunchLatest?.(versionCheck.latest);
-      if (relaunched !== undefined)
-        return relaunched;
-      deps.log(`free-pi-cli needs an update. From a trusted folder (for example: cd ~), run:
-  npx --yes free-pi-cli@latest
-or: npm i -g free-pi-cli@latest`);
-      return 1;
-    }
-    if (outcome === "notice") {
-      updateLatest = versionCheck.latest;
-    }
+  if (!hadJwt)
+    versionCheck = await deps.checkClientVersion(deps.baseUrl, CLI_VERSION, jwt2);
+  if (!versionHandled && versionCheck.action !== "ok") {
+    const handled = await handleVersionAction(deps, versionCheck);
+    if (handled.code !== undefined)
+      return handled.code;
+    updateLatest = handled.updateLatest;
   }
   const whatsNew = maybeWhatsNew(CLI_VERSION, deps.agentDir);
   if (whatsNew)
@@ -25335,8 +25537,8 @@ ${exitCard}`);
     reportRefillCardShown({ baseUrl: deps.baseUrl, jwt: jwt2 });
   }
   deps.log(finalSessionId ? `
-free-pi session ended. Start it again anytime:  npx free-pi-cli --session ${finalSessionId}` : `
-free-pi session ended. Start it again anytime:  npx free-pi-cli`);
+free-pi session ended. Start it again anytime:  npx free-pi-cli@latest --session ${finalSessionId}` : `
+free-pi session ended. Start it again anytime:  npx free-pi-cli@latest`);
   deps.log(`(or install once for a shorter command:  npm i -g free-pi-cli  →  free-pi-cli)
 `);
   return 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "free-pi-cli",
-  "version": "0.6.4",
+  "version": "0.6.7",
   "description": "Free, ad-supported distribution of the pi coding agent. Inference paid for by ads.",
   "license": "MIT",
   "type": "module",