free-pi-cli 0.6.8 → 0.6.9

package/dist/index.js

@@ -30,4 +30,4 @@ if (err) {
   console.error(err);
   process.exit(1);
 }
-await import("./main-tyjwqhr5.js");
+await import("./main-cgxt6te1.js");

package/dist/{main-tyjwqhr5.js → main-cgxt6te1.js}

@@ -14382,7 +14382,8 @@ var GithubDeviceResponseSchema = exports_external.object({
   user_code: exports_external.string(),
   verification_uri: exports_external.string(),
   interval: exports_external.number(),
-  expires_in: exports_external.number().optional()
+  expires_in: exports_external.number().optional(),
+  verification_uri_complete: exports_external.string().optional()
 });
 var AuthTokenRequestSchema = exports_external.object({
   session_id: exports_external.string().uuid()
@@ -14449,8 +14450,15 @@ var GuestUnavailableResponseSchema = exports_external.object({
   message: exports_external.string(),
   reason: exports_external.enum(["disabled", "global_budget", "ip_sessions", "ip_allowance"])
 });
+var FunnelEventNameSchema = exports_external.enum([
+  "device_code_shown",
+  "browser_opened",
+  "device_code_reminted",
+  "device_code_expired",
+  "device_poll_slow_down"
+]);
 var FunnelEventRequestSchema = exports_external.object({
-  event: exports_external.enum(["device_code_shown", "browser_opened"]),
+  event: FunnelEventNameSchema,
   session_id: exports_external.string().uuid().optional()
 });
 var ReturnBonusTelemetrySchema = exports_external.object({
@@ -14629,6 +14637,11 @@ var ConfigSchema = exports_external.object({
   maxOutputTokens: exports_external.number().int().min(1).default(32768),
   accountsPerDayCeiling: exports_external.number().int().default(500),
   authRatePerIpPerHour: exports_external.number().int().default(30),
+  siteLoginStartRateLimitEnabled: exports_external.boolean().default(false),
+  siteLoginStartPerIp: exports_external.number().int().min(0).default(5),
+  siteLoginStartPerSubject: exports_external.number().int().min(0).default(5),
+  siteLoginStartWindowSeconds: exports_external.number().int().min(1).default(600),
+  siteLoginStartCooldownSeconds: exports_external.number().int().min(0).default(60),
   webBuyUrlRatePerProviderPerHour: exports_external.number().int().default(20),
   handoffTokenRatePerProviderPerHour: exports_external.number().int().default(60),
   handoffHourlyCompletionCap: exports_external.number().int().default(120),
@@ -14648,6 +14661,7 @@ var ConfigSchema = exports_external.object({
   lifecycleEmailSend: exports_external.boolean().default(false),
   emailProviderConfigured: exports_external.boolean().default(false),
   emailFrom: exports_external.string().optional(),
+  emailPostalAddress: exports_external.string().optional(),
   emailProviderUrl: exports_external.string().optional(),
   hiveEnabled: exports_external.boolean().default(false),
   providerOrder: exports_external.array(exports_external.string()).optional(),
@@ -14748,6 +14762,9 @@ function envBoolean(value) {
     return;
   return value === "true" || value === "1";
 }
+function envFlagOn(value) {
+  return ["true", "1", "on", "yes"].includes((value ?? "").trim().toLowerCase());
+}
 function envList(value) {
   if (!value)
     return;
@@ -14779,6 +14796,11 @@ function loadConfig(env = process.env) {
     maxOutputTokens: envNumber(env.MAX_OUTPUT_TOKENS),
     accountsPerDayCeiling: envNumber(env.ACCOUNTS_PER_DAY_CEILING),
     authRatePerIpPerHour: envNumber(env.AUTH_RATE_PER_IP_PER_HOUR),
+    siteLoginStartRateLimitEnabled: envFlagOn(env.SITE_LOGIN_START_RATE_LIMIT),
+    siteLoginStartPerIp: envNumber(env.SITE_LOGIN_START_PER_IP),
+    siteLoginStartPerSubject: envNumber(env.SITE_LOGIN_START_PER_SUBJECT),
+    siteLoginStartWindowSeconds: envNumber(env.SITE_LOGIN_START_WINDOW_SECONDS),
+    siteLoginStartCooldownSeconds: envNumber(env.SITE_LOGIN_START_COOLDOWN_SECONDS),
     webBuyUrlRatePerProviderPerHour: envNumber(env.WEB_BUY_URL_RATE_PER_PROVIDER_PER_HOUR),
     handoffTokenRatePerProviderPerHour: envNumber(env.HANDOFF_TOKEN_RATE_PER_PROVIDER_PER_HOUR),
     handoffHourlyCompletionCap: envNumber(env.HANDOFF_HOURLY_COMPLETION_CAP),
@@ -14798,6 +14820,7 @@ function loadConfig(env = process.env) {
     lifecycleEmailSend: envBoolean(env.LIFECYCLE_EMAIL_SEND),
     emailProviderConfigured: env.EMAIL_PROVIDER_KEY ? env.EMAIL_PROVIDER_KEY.trim().length > 0 : undefined,
     emailFrom: env.EMAIL_FROM?.trim() || undefined,
+    emailPostalAddress: env.EMAIL_POSTAL_ADDRESS?.trim() || undefined,
     emailProviderUrl: env.EMAIL_PROVIDER_URL?.trim() || undefined,
     hiveEnabled: envBoolean(env.HIVE_ENABLED),
     providerOrder: envList(env.PROVIDER_ORDER),
@@ -14936,42 +14959,46 @@ var LIMIT_NOTICE_LABELS = {
   concurrent_session: "another session is active",
   guest_allowance: "guest trial"
 };
-var EXTRA_CREDITS_URL = "freepi.ai/extra-credits";
 var LIMIT_NOTICE_LOCAL_TIME_AFTER_SECONDS = 90 * 60;
 var REFILL_CLOCK_LIMITS = new Set(["daily_cap", "global_cap", "queue_wait"]);
 function formatLimitNotice(fields, opts = {}) {
   const slow = fields.lane === "slow" && fields.limit === "hourly_ceiling" && fields.hourly_ceiling != null;
-  const label = slow ? `You've used today's free allowance, so you're on the slow lane (${fields.hourly_ceiling.toLocaleString("en-US")} requests an hour).` : LIMIT_NOTICE_LABELS[fields.limit] ?? fields.limit.replace(/_/g, " ");
-  const parts = [label];
   const retry = fields.retry_after_seconds;
-  const waitBits = [];
+  let when;
   if (retry != null && retry > 0) {
     const useClock = Boolean(opts.localTime) && Boolean(fields.clears_at) && retry >= LIMIT_NOTICE_LOCAL_TIME_AFTER_SECONDS;
-    if (useClock) {
-      const formatted = new Intl.DateTimeFormat("en-US", {
-        timeZone: opts.timeZone,
-        hour: "numeric",
-        minute: "2-digit"
-      }).format(new Date(fields.clears_at));
-      waitBits.push(`back at ${formatted}`);
-    } else {
-      waitBits.push(`back in ${Math.max(1, Math.ceil(retry / 60))} min`);
-    }
+    when = useClock ? `at ${new Intl.DateTimeFormat("en-US", { timeZone: opts.timeZone, hour: "numeric", minute: "2-digit" }).format(new Date(fields.clears_at))}` : `in ${Math.max(1, Math.ceil(retry / 60))} min`;
   }
-  if (opts.copyStyle === "treatment" && REFILL_CLOCK_LIMITS.has(fields.limit) && fields.clears_at) {
+  const resets = () => {
+    if (opts.copyStyle !== "treatment" || !REFILL_CLOCK_LIMITS.has(fields.limit) || !fields.clears_at)
+      return "";
     const clears = new Date(fields.clears_at);
-    if (!Number.isNaN(clears.getTime())) {
-      waitBits.push(`resets ${formatRefillEt(clears)}`);
-    }
-  }
-  if (waitBits.length > 0)
-    parts.push(waitBits.join(" · "));
+    return Number.isNaN(clears.getTime()) ? "" : ` Resets ${formatRefillEt(clears)}.`;
+  };
+  const refillOrBuy = (lead) => `${lead} ${when ? `Credits refill ${when}, or keep going with /buy-credits.` : "Keep going with /buy-credits."}${resets()}`;
   if (slow) {
-    const wait = waitBits[0] ? ` ${waitBits[0][0].toUpperCase()}${waitBits[0].slice(1)} — or get` : " Get";
-    return `${label}${wait} credits at ${EXTRA_CREDITS_URL} to keep going at full speed.`;
+    const label2 = `You've used today's free allowance, so you're on the slow lane (${fields.hourly_ceiling.toLocaleString("en-US")} requests an hour).`;
+    const wait = when ? ` Back ${when} — or use` : " Use";
+    return `${label2}${wait} /buy-credits to keep going at full speed.`;
   }
-  parts.push(`${fields.remaining_credits_today.toLocaleString("en-US")} credits left today`);
-  return parts.join(", ");
+  switch (fields.limit) {
+    case "guest_allowance":
+      return fields.remaining_credits_today > 0 ? "Guest access is busy right now." : "Your guest trial is used up.";
+    case "daily_cap":
+      return refillOrBuy("You've used today's free credits.");
+    case "rolling_cap":
+      return `You've reached your usage limit for now.${when ? ` Back ${when}.` : ""}`;
+    case "queue_wait":
+      return `free-pi is busy right now. ${when ? `Try again ${when}, or keep going with /buy-credits.` : "Try again soon, or keep going with /buy-credits."}${resets()}`;
+    case "global_cap":
+      return `free-pi has reached its shared daily limit; this isn't your limit.${when ? ` Back ${when}.` : ""}${resets()}`;
+  }
+  const label = LIMIT_NOTICE_LABELS[fields.limit] ?? fields.limit.replace(/_/g, " ");
+  const bits = [label];
+  if (when)
+    bits.push(`back ${when}`);
+  bits.push(`${fields.remaining_credits_today.toLocaleString("en-US")} credits left today`);
+  return bits.join(", ");
 }
 // ../shared/src/version.ts
 function compareVersions(a, b) {
@@ -15102,7 +15129,7 @@ var HiveClassifyResponseSchema = exports_external.object({
 // package.json
 var package_default = {
   name: "free-pi-cli",
-  version: "0.6.8",
+  version: "0.6.9",
   description: "Free, ad-supported distribution of the pi coding agent. Inference paid for by ads.",
   license: "MIT",
   type: "module",
@@ -15739,13 +15766,13 @@ async function renderMeter(deps, ctx) {
     confirm = { addedUsd: added, turnsLeft: CONFIRM_TURNS };
   if (confirm && confirm.turnsLeft > 0) {
     confirm.turnsLeft--;
-    ctx.ui.setWidget(METER_WIDGET_ID, [renderErrorLine(creditAddedMessage(confirm.addedUsd), theme)]);
+    ctx.ui.setWidget(METER_WIDGET_ID, [theme.fg("accent", creditAddedMessage(confirm.addedUsd))]);
     return;
   }
   confirm = undefined;
   const notice = typeof me.notice === "string" ? sanitizeText(me.notice).trim() : "";
   if (notice !== "") {
-    ctx.ui.setWidget(METER_WIDGET_ID, [renderErrorLine(notice, theme)]);
+    ctx.ui.setWidget(METER_WIDGET_ID, [theme.fg("accent", notice)]);
     return;
   }
   if (me.lane === "fallback") {
@@ -21195,6 +21222,22 @@ function formatLimitEnvelope(env, opts) {
     hourly_ceiling: env.hourly_ceiling
   }, { localTime: true, timeZone: opts?.timeZone, copyStyle: env.copy_variant });
 }
+var LIMIT_CODES = new Set([
+  "guest_allowance",
+  "daily_cap",
+  "queue_wait",
+  "rolling_cap",
+  "hourly_ceiling",
+  "concurrent",
+  "concurrent_session",
+  "model_requires_credits",
+  "global_cap",
+  "upgrade_required",
+  "guest_unavailable",
+  "account_review",
+  "ads_required",
+  "region_unavailable"
+]);
 function createErrorNoticeExtension(opts = {}) {
   const lastAt = new Map;
   const now = opts.now ?? Date.now;
@@ -21213,10 +21256,10 @@ function createErrorNoticeExtension(opts = {}) {
         if (t - (lastAt.get(env.code) ?? -Infinity) < NOTICE_DEDUPE_MS)
           return;
         lastAt.set(env.code, t);
-        ctx.ui.notify(formatLimitEnvelope(env, { timeZone }), env.status >= 500 ? "error" : "warning");
         const extra = opts.extraNotice?.(env);
-        if (extra)
-          ctx.ui.notify(extra, "info");
+        const text = formatLimitEnvelope(env, { timeZone }) + (extra ? `
+${extra}` : "");
+        ctx.ui.notify(text, LIMIT_CODES.has(env.code) ? "info" : env.status >= 500 ? "error" : "warning");
       });
     }
   };
@@ -21554,6 +21597,14 @@ function mergeAttribution(a, b) {
 
 // src/changelog.ts
 var CHANGELOG_HIGHLIGHTS = [
+  {
+    version: "0.6.9",
+    highlights: [
+      "When the guest trial runs out, sign-in opens in your browser automatically, and the link and code stay on screen.",
+      "An expired sign-in takes you back to GitHub sign-in instead of starting a new guest trial.",
+      "Limits (daily credits, slow lane, busy, usage limit) now show as information with a next step, not as errors."
+    ]
+  },
   {
     version: "0.6.8",
     highlights: [
@@ -21976,8 +22027,18 @@ class LoginDeniedError extends Error {
     super("login_denied");
   }
 }
+
+class DeviceCodeExpiredError extends Error {
+  constructor() {
+    super("expired_token");
+  }
+}
+function isExpiredTokenPoll(body) {
+  return body?.message === "expired_token";
+}
 async function pollForToken(baseUrl, sessionId, interval, sleep, opts = {}) {
   let consecutiveNetworkFailures = 0;
+  let waitSeconds = Math.max(0, interval);
   const now = opts.now ?? Date.now;
   for (;; ) {
     if (opts.deadline !== undefined && now() >= opts.deadline) {
@@ -22000,7 +22061,7 @@ async function pollForToken(baseUrl, sessionId, interval, sleep, opts = {}) {
       if (consecutiveNetworkFailures >= 6) {
         throw new Error(`token poll failed: network unreachable after ${consecutiveNetworkFailures} attempts (${err instanceof Error ? err.message : String(err)})`);
       }
-      await sleep(Math.max(interval, 5) * 1000);
+      await sleep(Math.max(waitSeconds, 5) * 1000);
       continue;
     }
     if (!res.ok) {
@@ -22012,6 +22073,8 @@ async function pollForToken(baseUrl, sessionId, interval, sleep, opts = {}) {
         throw new LoginDeniedError;
       if (res.status === 410 && body?.code === "expired")
         throw new LoginTimeoutError;
+      if (isExpiredTokenPoll(body))
+        throw new DeviceCodeExpiredError;
       throw new Error(refusalMessage(res.status, body) ?? `token poll failed: HTTP ${res.status}`);
     }
     const parsed = AuthTokenResponseSchema.parse(await res.json());
@@ -22021,7 +22084,13 @@ async function pollForToken(baseUrl, sessionId, interval, sleep, opts = {}) {
       throw new Error("consent_required: server did not record consent before polling");
     }
     const retryAfter = "retry_after" in parsed && typeof parsed.retry_after === "number" ? parsed.retry_after : 0;
-    await sleep(Math.max(interval, retryAfter) * 1000);
+    if (retryAfter > waitSeconds) {
+      waitSeconds = retryAfter;
+      opts.onSlowDown?.(waitSeconds);
+    } else if (retryAfter > 0) {
+      opts.onSlowDown?.(waitSeconds);
+    }
+    await sleep(waitSeconds * 1000);
   }
 }
 async function checkToken(baseUrl, jwt2) {
@@ -22114,6 +22183,7 @@ function clipboardCommand(platform) {
 var CONSENT_TEXT = `
 free-pi is free. In exchange, we show you ads and may train on your data.
 If you want to use free-pi, you accept that. If you don't, don't use it.
+You must be at least 13 in the US, 16 in the EEA/UK, or 18 elsewhere.
 Terms: https://freepi.ai/terms   Privacy: https://freepi.ai/privacy
 `.trim();
 var CONSENT_VERSION = "4";
@@ -22291,6 +22361,37 @@ var LOGIN_REWARD_LINE = "Sign in with GitHub to get 15,000 free credits a day";
 var LOGIN_WAITING_LINE = "Waiting for GitHub…";
 var LOGIN_TIMEOUT_LINE = "GitHub sign-in timed out. Run /login to try again.";
 var BROWSER_FAILED_LINE = "Couldn't open a browser here. Open the URL above yourself and enter the code.";
+var LOGIN_CODE_EXPIRED_LINE = "That code expired. Enter this new one before it times out.";
+var LOGIN_CODE_EXPIRY_HINT = "Enter the code on GitHub before it expires.";
+var MAX_DEVICE_CODE_REMINTS = 2;
+function formatRemaining(seconds) {
+  const s = Math.max(0, Math.floor(seconds));
+  if (s >= 90)
+    return `${Math.round(s / 60)} min`;
+  if (s >= 60)
+    return "1 min";
+  if (s > 0)
+    return `${s} sec`;
+  return "0 sec";
+}
+function formatCodeExpiryLine(expiresInSeconds) {
+  return `  Code expires in ${formatRemaining(expiresInSeconds)}. ${LOGIN_CODE_EXPIRY_HINT}`;
+}
+function formatWaitingLine(expiresInSeconds) {
+  return `${LOGIN_WAITING_LINE} code expires in ${formatRemaining(expiresInSeconds)}.`;
+}
+function deviceBrowserUrl(device) {
+  if (device.verification_uri_complete?.trim())
+    return device.verification_uri_complete.trim();
+  try {
+    const url2 = new URL(device.verification_uri);
+    if (!url2.searchParams.has("user_code"))
+      url2.searchParams.set("user_code", device.user_code);
+    return url2.toString();
+  } catch {
+    return device.verification_uri;
+  }
+}
 function formatDeviceCodePrompt(device, variant) {
   const value = isHandoffTreatment(variant) ? LOGIN_VALUE_LINE : LOGIN_REWARD_LINE;
   return [
@@ -22300,12 +22401,51 @@ function formatDeviceCodePrompt(device, variant) {
     "",
     `  Open ${device.verification_uri}`,
     `  Enter code:  ${device.user_code}`,
+    formatCodeExpiryLine(device.expires_in ?? 900),
     ""
   ].join(`
 `);
 }
 async function runDeviceLogin(deps, attribution = {}) {
+  let remints = 0;
+  let lastSessionId;
+  for (;; ) {
+    try {
+      return await runDeviceLoginOnce(deps, attribution, {
+        reminted: remints > 0,
+        onSession: (id) => {
+          lastSessionId = id;
+        }
+      });
+    } catch (err) {
+      const expired = err instanceof DeviceCodeExpiredError || err instanceof LoginTimeoutError;
+      if (!expired || remints >= MAX_DEVICE_CODE_REMINTS) {
+        throw err instanceof DeviceCodeExpiredError ? new LoginTimeoutError : err;
+      }
+      if (lastSessionId) {
+        await reportFunnelEvent(deps.baseUrl, "device_code_expired", {
+          sessionId: lastSessionId,
+          jwt: deps.jwt,
+          fetchImpl: deps.fetchImpl
+        });
+      }
+      remints += 1;
+      deps.log(`
+${LOGIN_CODE_EXPIRED_LINE}
+`);
+    }
+  }
+}
+async function runDeviceLoginOnce(deps, attribution, once) {
   const device = await startDeviceFlow(deps.baseUrl);
+  once.onSession(device.session_id);
+  if (once.reminted) {
+    await reportFunnelEvent(deps.baseUrl, "device_code_reminted", {
+      sessionId: device.session_id,
+      jwt: deps.jwt,
+      fetchImpl: deps.fetchImpl
+    });
+  }
   deps.log(formatDeviceCodePrompt(device, deps.variant));
   if (deps.credentialsPath) {
     await savePendingLogin(deps.credentialsPath, {
@@ -22319,10 +22459,12 @@ async function runDeviceLogin(deps, attribution = {}) {
   if (copied)
     deps.log(`  (code copied to clipboard)
 `);
-  deps.log(LOGIN_WAITING_LINE);
+  const expiresIn = device.expires_in ?? 900;
+  deps.log(formatWaitingLine(expiresIn));
+  const openUrl = deviceBrowserUrl(device);
   let browserOpened = false;
   try {
-    browserOpened = await deps.openBrowser(device.verification_uri) !== false;
+    browserOpened = await deps.openBrowser(openUrl) !== false;
   } catch {
     browserOpened = false;
   }
@@ -22336,16 +22478,23 @@ async function runDeviceLogin(deps, attribution = {}) {
     deps.log(copied ? BROWSER_FAILED_LINE : `${BROWSER_FAILED_LINE} ${HEADLESS_FALLBACK_LINE}`);
   }
   await submitConsent(deps.baseUrl, device.session_id, CONSENT_VERSION, attribution);
-  const expiresInMs = (device.expires_in ?? 900) * 1000;
-  const deadline = (deps.now ?? Date.now)() + expiresInMs;
-  try {
-    const token = await pollForToken(deps.baseUrl, device.session_id, device.interval, deps.sleep, { deadline, now: deps.now, jwt: deps.jwt, fetchImpl: deps.fetchImpl });
-    if (deps.credentialsPath)
-      await clearPendingLogin(deps.credentialsPath);
-    return token;
-  } catch (err) {
-    throw err;
-  }
+  const deadline = (deps.now ?? Date.now)() + expiresIn * 1000;
+  const token = await pollForToken(deps.baseUrl, device.session_id, device.interval, deps.sleep, {
+    deadline,
+    now: deps.now,
+    jwt: deps.jwt,
+    fetchImpl: deps.fetchImpl,
+    onSlowDown: () => {
+      reportFunnelEvent(deps.baseUrl, "device_poll_slow_down", {
+        sessionId: device.session_id,
+        jwt: deps.jwt,
+        fetchImpl: deps.fetchImpl
+      });
+    }
+  });
+  if (deps.credentialsPath)
+    await clearPendingLogin(deps.credentialsPath);
+  return token;
 }
 var CONNECT_BROWSER_FAILED_LINE = "Couldn't open a browser here, so using the GitHub device code instead.";
 var CONNECT_FALLBACK_LINE = "Couldn't start the browser sign-in, so using the GitHub device code instead.";
@@ -22566,7 +22715,25 @@ async function openPrivacyPolicy(opts, ctx) {
 function resolveHandoffVariant(opts) {
   return typeof opts.variant === "function" ? opts.variant() : opts.variant;
 }
-async function runLogin(opts, ctx) {
+var LOGIN_ATTEMPT_MAX_MS = 900000;
+var loginAttempt;
+async function runLogin(opts, ctx, lead) {
+  const startedAt = (opts.now ?? Date.now)();
+  if (loginAttempt && startedAt - loginAttempt.startedAt < LOGIN_ATTEMPT_MAX_MS)
+    return false;
+  const attempt = { startedAt };
+  loginAttempt = attempt;
+  try {
+    return await runLoginUnguarded(opts, ctx, lead);
+  } finally {
+    if (loginAttempt === attempt)
+      loginAttempt = undefined;
+  }
+}
+async function runLoginUnguarded(opts, ctx, lead) {
+  const lines = lead ? [lead] : [];
+  if (lead)
+    ctx.ui.notify(lead, "info");
   try {
     const attribution = opts.agentDir ? await loadAttribution(getAttributionPath(opts.agentDir)) : {};
     const variant = resolveHandoffVariant(opts);
@@ -22574,7 +22741,11 @@ async function runLogin(opts, ctx) {
       baseUrl: opts.baseUrl,
       openBrowser: opts.openBrowserImpl ?? openBrowser,
       sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
-      log: (message) => ctx.ui.notify(message.trim(), "info"),
+      log: (message) => {
+        lines.push(message.trim());
+        ctx.ui.notify(lines.filter(Boolean).join(`
+`), "info");
+      },
       jwt: await opts.getToken(),
       fetchImpl: opts.fetchImpl,
       variant,
@@ -22584,31 +22755,30 @@ async function runLogin(opts, ctx) {
       await saveJwt(opts.credentialsPath, token);
     opts.onLogin?.(token);
     ctx.ui.notify(isHandoffTreatment(variant) ? SIGNED_IN_CONTINUE_LINE : "Signed in. You now have 15,000 free credits a day, plus a one-time comeback bonus.", "info");
+    return true;
   } catch (err) {
     if (err instanceof LoginTimeoutError) {
-      ctx.ui.notify(LOGIN_TIMEOUT_LINE, "warning");
-      return;
+      ctx.ui.notify(LOGIN_TIMEOUT_LINE, "info");
+      return false;
     }
     if (err instanceof LoginDeniedError) {
-      ctx.ui.notify(LOGIN_DENIED_LINE, "warning");
-      return;
+      ctx.ui.notify(LOGIN_DENIED_LINE, "info");
+      return false;
     }
     const reason = err instanceof Error && err.message ? ` (${err.message})` : "";
     ctx.ui.notify(`Couldn't finish GitHub sign-in${reason}. Run /login to try again.`, "error");
+    return false;
   }
 }
 function installLoginHandler(mode, opts) {
   const m = mode;
   mode.handleLoginCommand = () => {
-    const lines = [];
     const notify2 = (message, type) => {
       if (type === "error")
         return m.showError(message);
       if (type === "warning")
         return m.showWarning(message);
-      lines.push(message);
-      m.showStatus(lines.join(`
-`));
+      m.showStatus(message);
     };
     return runLogin(opts, { ui: { notify: notify2 } });
   };
@@ -22727,14 +22897,24 @@ function loadRea(pi, opts, ctx) {
   }
   ctx.ui.notify("Loading REA (reverse-engineering tools) for this session. The first run downloads rea-agents, so it can take a minute. Deep native analysis needs your own Hopper, Ghidra, or IDA install.", "info");
 }
+var GUEST_WALL_LINE = "Your guest trial is used up. Opening GitHub sign-in in your browser… (15,000 free credits a day)";
+var GUEST_BUSY_LINE = "Guest access is busy right now. Opening GitHub sign-in in your browser… (15,000 free credits a day)";
+var GUEST_UNAVAILABLE_LINE = "Sign in with GitHub to keep going. Opening your browser… (15,000 free credits a day)";
 function createGuestLoginExtension(opts) {
   let started = false;
+  let inFlight = false;
+  let signedIn = false;
   let nearWallWarned = false;
-  const start = (ctx) => {
+  const start = (ctx, line) => {
     started = true;
+    inFlight = true;
     const variant = resolveHandoffVariant(opts);
-    ctx.ui.notify(isHandoffTreatment(variant) ? LOGIN_VALUE_LINE : LOGIN_REWARD_LINE, "info");
-    runLogin(opts, ctx);
+    const lead = line ?? (isHandoffTreatment(variant) ? LOGIN_VALUE_LINE : LOGIN_REWARD_LINE);
+    runLogin(opts, ctx, lead).then((ok) => {
+      signedIn = ok;
+    }).catch(() => {}).finally(() => {
+      inFlight = false;
+    });
   };
   return {
     name: "free-pi-guest-login",
@@ -22743,8 +22923,12 @@ function createGuestLoginExtension(opts) {
         if (!opts.isGuest?.())
           return;
         const msg = event.message;
-        if (!started && msg?.stopReason === "error" && parseErrorEnvelope(msg.errorMessage)?.code === "guest_allowance") {
-          start(ctx);
+        const envelope = msg?.stopReason === "error" ? parseErrorEnvelope(msg.errorMessage) : undefined;
+        if (envelope && (envelope.code === "guest_allowance" || envelope.code === "guest_unavailable" || envelope.prompt === "github_signin")) {
+          if (!inFlight && !signedIn) {
+            const busy = envelope.code === "guest_allowance" && (envelope.remaining_credits_today ?? 0) > 0;
+            start(ctx, envelope.code === "guest_unavailable" ? GUEST_UNAVAILABLE_LINE : busy ? GUEST_BUSY_LINE : GUEST_WALL_LINE);
+          }
           return;
         }
         if (started || nearWallWarned || !isHandoffTreatment(resolveHandoffVariant(opts)))
@@ -25397,32 +25581,56 @@ async function resolveAttribution(agentDir, argv) {
   await saveAttribution(getAttributionPath(agentDir), merged);
   return { attribution: merged };
 }
-async function loginFlow(deps, argv = []) {
-  const resolved = await resolveAttribution(deps.agentDir, argv);
-  if ("error" in resolved && resolved.error) {
-    throw new Error(resolved.error);
+var GUEST_SIGNIN_PROMPT = "You're using free-pi as a guest. Press Enter to sign in with GitHub (15,000 free credits a day), or Esc to keep going as a guest.";
+function parseGuestSigninKey(raw) {
+  if (raw === "\r" || raw === `
+`)
+    return "signin";
+  if (raw === "\x1B")
+    return "guest";
+  if (raw === "\x03")
+    return "aborted";
+  return;
+}
+async function promptGuestSigninInteractive() {
+  let prompt = `
+${GUEST_SIGNIN_PROMPT}
+`;
+  for (;; ) {
+    const choice = parseGuestSigninKey(await readOneKeypress(prompt));
+    prompt = "";
+    if (choice)
+      return choice;
   }
+}
+function storedTokenKind(jwt2) {
   try {
-    const token = await runLoginAuto({
-      baseUrl: deps.baseUrl,
-      openBrowser: deps.openBrowser,
-      sleep: deps.sleep,
-      log: deps.log,
-      jwt: await loadJwt(deps.credentialsPath),
-      credentialsPath: deps.credentialsPath
-    }, resolved.attribution ?? {}, { forceDevice: argv.includes("--device-login"), env: deps.env, platform: deps.platform });
-    await saveJwt(deps.credentialsPath, token);
-    return token;
-  } catch (err) {
-    if (err instanceof LoginTimeoutError) {
-      deps.log(LOGIN_TIMEOUT_LINE);
-    }
-    if (err instanceof LoginDeniedError) {
-      deps.log(LOGIN_DENIED_LINE);
-    }
-    throw err;
+    const claims = JSON.parse(Buffer.from(jwt2.split(".")[1] ?? "", "base64url").toString("utf8"));
+    if (typeof claims !== "object" || claims === null)
+      return "unknown";
+    return claims.guest === true ? "guest" : "github";
+  } catch {
+    return "unknown";
   }
 }
+async function loginFlow(deps, argv = [], priorJwt) {
+  const resolved = await resolveAttribution(deps.agentDir, argv);
+  if ("error" in resolved && resolved.error) {
+    throw new Error(resolved.error);
+  }
+  const token = await runLoginAuto({
+    baseUrl: deps.baseUrl,
+    openBrowser: deps.openBrowser,
+    sleep: deps.sleep,
+    log: deps.log,
+    jwt: priorJwt ?? await loadJwt(deps.credentialsPath),
+    credentialsPath: deps.credentialsPath
+  }, resolved.attribution ?? {}, { forceDevice: argv.includes("--device-login"), env: deps.env, platform: deps.platform });
+  await saveJwt(deps.credentialsPath, token);
+  return token;
+}
+var SIGNIN_UNFINISHED_LINE = "Sign-in didn't finish. Run npx free-pi-cli again when you're ready.";
+var DECLINED_CALM_LINE = "OK, free-pi won't start. Run it again if you change your mind.";
 function validateSessionId(value) {
   try {
     SessionManager2.inMemory(process.cwd(), { id: value });
@@ -25498,6 +25706,12 @@ ${FINISH_SIGNIN_LINE}
     updateLatest = handled.updateLatest;
     versionHandled = true;
   }
+  const interactive = deps.stdinIsTTY ?? process.stdin.isTTY === true;
+  const canPrompt = interactive && !resumeFlags.hasPrompt && !argv.some((a) => a === "-p" || a === "--print");
+  let rejectedJwt;
+  let rejectedKind = "unknown";
+  let startedGuestThisRun = false;
+  let signedInAfterExpiry = false;
   let guestHandoffVariant;
   let showFirstTask = false;
   let consentCurrent = false;
@@ -25507,8 +25721,10 @@ ${FINISH_SIGNIN_LINE}
       consentCurrent = serverConsent === CONSENT_VERSION;
       if (serverConsent !== undefined && serverConsent !== CONSENT_VERSION) {
         if (!await deps.promptConsent(REPROMPT_CONSENT_TEXT)) {
-          deps.log("Declined. free-pi needs you to accept the updated terms to continue; you will be asked again next time.");
-          return 1;
+          if (!interactive)
+            return 1;
+          deps.log(DECLINED_CALM_LINE);
+          return 0;
         }
         consentCurrent = true;
         try {
@@ -25520,6 +25736,8 @@ ${FINISH_SIGNIN_LINE}
       }
     } catch (err) {
       if (err instanceof UnauthorizedError) {
+        rejectedKind = storedTokenKind(jwt2);
+        rejectedJwt = jwt2;
         await clearJwt(deps.credentialsPath);
         jwt2 = null;
       }
@@ -25528,9 +25746,45 @@ ${FINISH_SIGNIN_LINE}
   if (!jwt2) {
     const accepted = await deps.promptConsent();
     if (!accepted) {
-      deps.log("Declined. Exiting.");
-      return 1;
+      if (!interactive)
+        return 1;
+      deps.log(DECLINED_CALM_LINE);
+      return 0;
+    }
+    if (canPrompt && rejectedKind !== "unknown") {
+      try {
+        if (rejectedKind === "github") {
+          deps.log(`
+Your free-pi sign-in has expired. Signing in with GitHub again.
+`);
+        }
+        const choice = rejectedKind === "github" ? "signin" : await (deps.promptGuestSignin ?? promptGuestSigninInteractive)();
+        if (choice === "aborted") {
+          deps.log("Aborted.");
+          return 1;
+        }
+        if (choice === "signin") {
+          jwt2 = await loginFlow(deps, argv, rejectedKind === "guest" ? rejectedJwt : undefined);
+          consentCurrent = true;
+          signedInAfterExpiry = true;
+        }
+      } catch (err) {
+        if (rejectedKind === "github") {
+          if (err instanceof LoginTimeoutError || err instanceof LoginDeniedError) {
+            deps.log(SIGNIN_UNFINISHED_LINE);
+            return 0;
+          }
+          const reason = err instanceof Error && err.message ? err.message : "unknown error";
+          deps.log(`Couldn't finish GitHub sign-in: ${reason}. Run npx free-pi-cli again to retry.`);
+          return 1;
+        }
+        deps.log(`
+Couldn't finish GitHub sign-in. Continuing as a guest.
+`);
+      }
     }
+  }
+  if (!jwt2) {
     showIntro(deps.log);
     const resolved = await resolveAttribution(deps.agentDir, argv);
     if ("error" in resolved && resolved.error) {
@@ -25542,6 +25796,7 @@ ${FINISH_SIGNIN_LINE}
       const guest = await startGuestSession(deps.baseUrl, CONSENT_VERSION, attribution);
       await saveJwt(deps.credentialsPath, guest.token);
       jwt2 = guest.token;
+      startedGuestThisRun = true;
       deps.log(isHandoffTreatment(guest.guestHandoffVariant) ? `
 You're on a short guest trial — ads pay for it. ${LOGIN_VALUE_LINE}
 ` : `
@@ -25560,11 +25815,19 @@ You're on a short guest trial — ads pay for it. Sign in with GitHub anytime (/
       deps.log(`
 Guest trial is not available right now.
 `);
-      jwt2 = await loginFlow(deps, argv);
+      try {
+        jwt2 = await loginFlow(deps, argv);
+      } catch (loginErr) {
+        if (loginErr instanceof LoginTimeoutError || loginErr instanceof LoginDeniedError) {
+          deps.log(SIGNIN_UNFINISHED_LINE);
+          return 0;
+        }
+        throw loginErr;
+      }
     }
     consentCurrent = true;
   }
-  if (!hadJwt)
+  if (!hadJwt || signedInAfterExpiry)
     versionCheck = await deps.checkClientVersion(deps.baseUrl, CLI_VERSION, jwt2);
   if (!versionHandled && versionCheck.action !== "ok") {
     const handled = await handleVersionAction(deps, versionCheck);
@@ -25577,13 +25840,37 @@ Guest trial is not available right now.
     deps.log(whatsNew);
   if (versionCheck.notice)
     deps.log(versionCheck.notice);
+  let me = await fetchMe2(deps.baseUrl, jwt2).catch(() => null);
+  if (me?.guest && !startedGuestThisRun && canPrompt && consentCurrent) {
+    try {
+      const choice = await (deps.promptGuestSignin ?? promptGuestSigninInteractive)();
+      if (choice === "aborted") {
+        deps.log("Aborted.");
+        return 1;
+      }
+      if (choice === "signin") {
+        jwt2 = await loginFlow(deps, argv);
+        me = await fetchMe2(deps.baseUrl, jwt2).catch(() => null);
+        versionCheck = await deps.checkClientVersion(deps.baseUrl, CLI_VERSION, jwt2).catch(() => versionCheck);
+        if (versionCheck.action !== "ok") {
+          const handled = await handleVersionAction(deps, versionCheck);
+          if (handled.code !== undefined)
+            return handled.code;
+          updateLatest = handled.updateLatest;
+        }
+      }
+    } catch {
+      deps.log(`
+Couldn't finish GitHub sign-in. Continuing as a guest.
+`);
+    }
+  }
   let getGravityContext;
   if (consentCurrent) {
     try {
       getGravityContext = deps.startGravityPixel?.(jwt2);
     } catch {}
   }
-  const me = await fetchMe2(deps.baseUrl, jwt2).catch(() => null);
   if (me)
     updateAllowanceCache(me);
   guestHandoffVariant = me?.experiments?.guest_handoff ?? guestHandoffVariant;
@@ -25611,7 +25898,6 @@ ${creditsBack}`);
   const experiment = versionCheck.experiments?.[RESUME_ON_LAUNCH_EXPERIMENT];
   const variant = experiment?.variant === "treatment" ? "treatment" : "control";
   const recentHours = recentHoursFromEnv(process.env, experiment?.recent_hours);
-  const interactive = deps.stdinIsTTY ?? process.stdin.isTTY === true;
   if (!session && !resumeFlags.startNew && !resumeFlags.hasPrompt && variant === "treatment" && interactive) {
     const latest = await lookupLatest(process.cwd(), deps.agentDir);
     const now = deps.now?.() ?? new Date;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "free-pi-cli",
-  "version": "0.6.8",
+  "version": "0.6.9",
   "description": "Free, ad-supported distribution of the pi coding agent. Inference paid for by ads.",
   "license": "MIT",
   "type": "module",