harness-wingman 0.9.7 → 0.9.8

package/apps/cli/dist/main.js

@@ -283,6 +283,14 @@ var init_cli = __esm({
       "cli.licenseJson": "The license file is not valid JSON",
       "cli.licenseFields": "The license file is missing token/signature fields",
       "cli.licenseSignature": "License signature verification failed (modified content or issued for another product)",
+      "cli.licenseOtherDevice": "This license is bound to another device",
+      "cli.licenseDeviceUnavailable": "This Mac\u2019s device identifier is unavailable. Activation is unavailable; existing unbound licenses keep their current validity.",
+      "cli.licenseDeviceLimit": "This license is already activated on 3 devices",
+      "cli.licenseActivationExpired": "This license has expired. Renew it before activating this device.",
+      "cli.licenseUnbindRequiresActiveDevice": "Unbind devices from an activated device with an unexpired license.",
+      "cli.licenseDeviceRevoked": "This device\u2019s activation was revoked. Click \u201CActivate this device\u201D to activate it again.",
+      "cli.licenseFixturesOffline": "Fixture mode does not contact the online license server",
+      "cli.licenseDevicesInvalid": "The license server returned an invalid device list",
       "cli.licenseClaimsFields": "License payload fields are incomplete",
       "cli.licenseClaimsDecode": "The license payload could not be decoded",
       "cli.licenseValidUntil": "{plan} valid until {exp}",
@@ -443,6 +451,10 @@ var init_panel = __esm({
       "panel.mobile.disclosure": "After pairing, your Mac uploads encrypted project and session status for the phone app to read. The relay only sees ciphertext.",
       "panel.mobile.scan": "Scan with the Wingman app on your phone",
       "panel.mobile.qrLabel": "Phone pairing QR code",
+      "panel.mobile.qrExpired": "QR code expired",
+      "panel.mobile.expired": "Expired",
+      "panel.mobile.regenerate": "Regenerate",
+      "panel.mobile.expiredTip": "The pairing window has ended. Generate a new QR code to scan.",
       "panel.mobile.autoClose": "Closes automatically after you scan on your phone",
       "panel.mobile.cancel": "Cancel pairing",
       "panel.mobile.unnamed": "Phone",
@@ -559,6 +571,23 @@ var init_panel = __esm({
       "panel.license.licenseImportedNewStatusUnknownRefresh": "License imported (new status unknown; refresh this page)",
       "panel.license.dropOneLicenseJsonFileAt": "Drop one license.json file at a time (received {p0})",
       "panel.license.onlyJsonFilesAreAcceptedReceived": "Only .json files are accepted (received {p0})",
+      "panel.license.deviceActive": "This device is activated \xB7 {count}/{max} devices",
+      "panel.license.deviceLimit": "This license is activated on {count} devices",
+      "panel.license.deviceNotRegistered": "This device is not activated \xB7 {count}/{max} devices",
+      "panel.license.deviceNotRegisteredTip": "Import the license again to activate this device when a slot is available",
+      "panel.license.deviceRevoked": "Activation for this device was revoked",
+      "panel.license.deviceRevokedTip": "Your existing license is kept until it expires. Automatic and manual refresh cannot reactivate this device. Select Activate this device when a device slot is available.",
+      "panel.license.activateDevice": "Activate this device",
+      "panel.license.deviceUnavailable": "Cannot read this device\u2019s identifier; activation is unavailable",
+      "panel.license.devicePending": "This device is not activated yet",
+      "panel.license.deviceTip": "Each subscription supports up to {max} devices. Licenses renew automatically every 24 hours. View devices.",
+      "panel.license.deviceLimitTip": "Unbind an old device from an activated device, then import the license again here. Any existing local license is kept until it expires.",
+      "panel.license.deviceManageElsewhere": "Unbind from an activated device with an unexpired license",
+      "panel.license.devices": "Activated devices",
+      "panel.license.unnamedDevice": "Unnamed device",
+      "panel.license.deviceLastSeen": "Last renewed: {at}",
+      "panel.license.unbind": "Unbind",
+      "panel.license.unbindTip": "Unbinding revokes renewals for that device. Its existing license is kept until it expires. Only importing a license again or selecting Activate this device on that machine can reactivate it.",
       "panel.live.sessionStarted": "Session started",
       "panel.live.sessionEnded": "Session ended",
       "panel.live.promptSubmitted": "Prompt submitted",
@@ -1639,6 +1668,14 @@ var init_cli2 = __esm({
       "cli.licenseJson": "license \u6587\u4EF6\u4E0D\u662F\u5408\u6CD5 JSON",
       "cli.licenseFields": "license \u6587\u4EF6\u7F3A token/signature \u5B57\u6BB5",
       "cli.licenseSignature": "license \u9A8C\u7B7E\u5931\u8D25(\u5185\u5BB9\u88AB\u6539\u52A8\u6216\u975E\u672C\u4EA7\u54C1\u7B7E\u53D1)",
+      "cli.licenseOtherDevice": "\u6B64 license \u7ED1\u5B9A\u4E86\u5176\u4ED6\u8BBE\u5907",
+      "cli.licenseDeviceUnavailable": "\u65E0\u6CD5\u83B7\u53D6\u672C\u673A\u8BBE\u5907\u6807\u8BC6\uFF0C\u6682\u65F6\u65E0\u6CD5\u6FC0\u6D3B\uFF1B\u5DF2\u6709\u672A\u7ED1\u5B9A license \u4ECD\u6309\u539F\u6709\u6548\u671F\u4F7F\u7528\u3002",
+      "cli.licenseDeviceLimit": "\u6B64 license \u5DF2\u5728 3 \u53F0\u8BBE\u5907\u6FC0\u6D3B",
+      "cli.licenseActivationExpired": "\u6B64 license \u5DF2\u5230\u671F\uFF0C\u8BF7\u5148\u7EED\u671F\u540E\u518D\u6FC0\u6D3B\u672C\u673A\u3002",
+      "cli.licenseUnbindRequiresActiveDevice": "\u8BF7\u4ECE\u5DF2\u6FC0\u6D3B\u4E14\u6388\u6743\u672A\u5230\u671F\u7684\u8BBE\u5907\u89E3\u7ED1\u3002",
+      "cli.licenseDeviceRevoked": "\u672C\u673A\u6FC0\u6D3B\u5DF2\u88AB\u64A4\u9500\uFF1B\u5982\u9700\u7EE7\u7EED\u4F7F\u7528\uFF0C\u8BF7\u70B9\u51FB\u300C\u6FC0\u6D3B\u672C\u673A\u300D\u3002",
+      "cli.licenseFixturesOffline": "\u6837\u4F8B\u6A21\u5F0F\u4E0D\u4F1A\u8054\u7CFB\u5728\u7EBF\u7B7E\u53D1\u7AEF",
+      "cli.licenseDevicesInvalid": "\u7B7E\u53D1\u7AEF\u8FD4\u56DE\u7684\u8BBE\u5907\u5217\u8868\u65E0\u6548",
       "cli.licenseClaimsFields": "license \u8F7D\u8377\u5B57\u6BB5\u4E0D\u5B8C\u6574",
       "cli.licenseClaimsDecode": "license \u8F7D\u8377\u65E0\u6CD5\u89E3\u7801",
       "cli.licenseValidUntil": "{plan}\u6709\u6548\u81F3 {exp}",
@@ -1799,6 +1836,10 @@ var init_panel2 = __esm({
       "panel.mobile.disclosure": "\u914D\u5BF9\u540E Mac \u4F1A\u628A\u9879\u76EE\u4E0E\u4F1A\u8BDD\u72B6\u6001\u52A0\u5BC6\u4E0A\u4F20,\u624B\u673A App \u624D\u80FD\u770B\u5230;\u4E2D\u8F6C\u53EA\u89C1\u5BC6\u6587",
       "panel.mobile.scan": "\u6253\u5F00\u624B\u673A\u4E0A\u7684 Wingman App \u626B\u7801\u914D\u5BF9",
       "panel.mobile.qrLabel": "\u624B\u673A\u914D\u5BF9\u4E8C\u7EF4\u7801",
+      "panel.mobile.qrExpired": "\u4E8C\u7EF4\u7801\u5DF2\u8FC7\u671F",
+      "panel.mobile.expired": "\u5DF2\u8FC7\u671F",
+      "panel.mobile.regenerate": "\u91CD\u65B0\u751F\u6210",
+      "panel.mobile.expiredTip": "\u914D\u5BF9\u7B49\u5F85\u7A97\u53E3\u5DF2\u7ED3\u675F\uFF0C\u8BF7\u91CD\u65B0\u751F\u6210\u4E8C\u7EF4\u7801\u540E\u626B\u7801\u3002",
       "panel.mobile.autoClose": "\u5DF2\u5728\u624B\u673A\u4E0A\u626B\u7801\u540E\u81EA\u52A8\u5173\u95ED",
       "panel.mobile.cancel": "\u53D6\u6D88\u914D\u5BF9",
       "panel.mobile.unnamed": "\u624B\u673A",
@@ -1915,6 +1956,23 @@ var init_panel2 = __esm({
       "panel.license.licenseImportedNewStatusUnknownRefresh": "license \u5DF2\u5BFC\u5165(\u65B0\u72B6\u6001\u672A\u77E5,\u5237\u65B0\u672C\u9875\u67E5\u770B)",
       "panel.license.dropOneLicenseJsonFileAt": "\u4E00\u6B21\u62D6\u5165 1 \u4E2A license.json \u6587\u4EF6(\u6536\u5230 {p0} \u4E2A)",
       "panel.license.onlyJsonFilesAreAcceptedReceived": "\u53EA\u8BA4 .json \u6587\u4EF6(\u6536\u5230 {p0})",
+      "panel.license.deviceActive": "\u672C\u673A\u5DF2\u6FC0\u6D3B \xB7 {count}/{max} \u53F0",
+      "panel.license.deviceLimit": "\u6B64 license \u5DF2\u5728 {count} \u53F0\u8BBE\u5907\u6FC0\u6D3B",
+      "panel.license.deviceNotRegistered": "\u672C\u673A\u5C1A\u672A\u6FC0\u6D3B \xB7 {count}/{max} \u53F0",
+      "panel.license.deviceNotRegisteredTip": "\u6709\u8BBE\u5907\u540D\u989D\u65F6\uFF0C\u8BF7\u91CD\u65B0\u5BFC\u5165 license \u4EE5\u6FC0\u6D3B\u672C\u673A",
+      "panel.license.deviceRevoked": "\u672C\u673A\u6FC0\u6D3B\u5DF2\u88AB\u64A4\u9500",
+      "panel.license.deviceRevokedTip": "\u73B0\u6709\u6388\u6743\u4FDD\u7559\u81F3\u5230\u671F\uFF0C\u81EA\u52A8\u6216\u624B\u52A8\u5237\u65B0\u4E0D\u4F1A\u91CD\u65B0\u6FC0\u6D3B\u3002\u82E5\u8981\u7EE7\u7EED\u5728\u672C\u673A\u4F7F\u7528\uFF0C\u8BF7\u5728\u6709\u8BBE\u5907\u540D\u989D\u65F6\u70B9\u300C\u6FC0\u6D3B\u672C\u673A\u300D\u3002",
+      "panel.license.activateDevice": "\u6FC0\u6D3B\u672C\u673A",
+      "panel.license.deviceUnavailable": "\u65E0\u6CD5\u8BFB\u53D6\u672C\u673A\u8BBE\u5907\u6807\u8BC6\uFF0C\u6682\u65F6\u65E0\u6CD5\u6FC0\u6D3B",
+      "panel.license.devicePending": "\u672C\u673A\u5C1A\u672A\u6FC0\u6D3B",
+      "panel.license.deviceTip": "\u6BCF\u6761\u8BA2\u9605\u6700\u591A {max} \u53F0\u8BBE\u5907\uFF0C\u6388\u6743\u6BCF 24 \u5C0F\u65F6\u81EA\u52A8\u7EED\u671F\u3002\u70B9\u6B64\u67E5\u770B\u8BBE\u5907\u3002",
+      "panel.license.deviceLimitTip": "\u8BF7\u5148\u5728\u5DF2\u6FC0\u6D3B\u8BBE\u5907\u4E0A\u89E3\u7ED1\u4E00\u53F0\u65E7\u8BBE\u5907\uFF0C\u518D\u5728\u672C\u673A\u91CD\u65B0\u5BFC\u5165 license\uFF1B\u672C\u673A\u5DF2\u6709\u6388\u6743\u4FDD\u7559\u81F3\u5176\u5230\u671F\u3002",
+      "panel.license.deviceManageElsewhere": "\u8BF7\u5728\u5DF2\u6FC0\u6D3B\u4E14\u6388\u6743\u672A\u5230\u671F\u7684\u8BBE\u5907\u4E0A\u89E3\u7ED1",
+      "panel.license.devices": "\u5DF2\u6FC0\u6D3B\u8BBE\u5907",
+      "panel.license.unnamedDevice": "\u672A\u547D\u540D\u8BBE\u5907",
+      "panel.license.deviceLastSeen": "\u6700\u8FD1\u7EED\u671F\uFF1A{at}",
+      "panel.license.unbind": "\u89E3\u7ED1",
+      "panel.license.unbindTip": "\u89E3\u7ED1\u4F1A\u64A4\u9500\u8BE5\u8BBE\u5907\u7684\u7EED\u671F\u8D44\u683C\uFF0C\u73B0\u6709\u6388\u6743\u4FDD\u7559\u81F3\u5230\u671F\uFF1B\u53EA\u6709\u5728\u90A3\u53F0\u673A\u5668\u91CD\u65B0\u5BFC\u5165 license \u6216\u70B9\u300C\u6FC0\u6D3B\u672C\u673A\u300D\u624D\u4F1A\u91CD\u65B0\u6FC0\u6D3B\u3002",
       "panel.live.sessionStarted": "\u4F1A\u8BDD\u5F00\u59CB",
       "panel.live.sessionEnded": "\u4F1A\u8BDD\u7ED3\u675F",
       "panel.live.promptSubmitted": "\u63D0\u4EA4\u63D0\u793A",
@@ -12582,7 +12640,7 @@ var init_json_edit = __esm({
 });
 
 // packages/adapter-cc/dist/toggle.js
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 import { existsSync as existsSync7, readdirSync as readdirSync2, readFileSync as readFileSync7 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
 import { basename as basename4, join as join12, resolve as resolve3 } from "node:path";
@@ -12692,7 +12750,7 @@ function isCcFeatureId(id2) {
   return FEATURE_KEYS.some((key) => id2 === `cc:gates:user:${key}`);
 }
 function featureBytesHash(raw) {
-  return raw === void 0 ? null : createHash4("sha256").update(raw).digest("hex");
+  return raw === void 0 ? null : createHash5("sha256").update(raw).digest("hex");
 }
 function matchesTarget(data, key, target) {
   if (featureValue(data, key) !== target)
@@ -17489,6 +17547,38 @@ import { verify } from "node:crypto";
 import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync3, renameSync, writeFileSync as writeFileSync3 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
 import { join as join7 } from "node:path";
+
+// apps/cli/dist/license-device.js
+import { execFileSync as execFileSync2 } from "node:child_process";
+import { createHash as createHash3 } from "node:crypto";
+import { hostname } from "node:os";
+var cachedDevice;
+function getLicenseDevice() {
+  const device = cachedDevice ?? readLicenseDevice();
+  if (device)
+    cachedDevice = device;
+  return device;
+}
+function readLicenseDevice(options = {}) {
+  if ((options.platform ?? process.platform) !== "darwin")
+    return null;
+  try {
+    const output = (options.read ?? (() => execFileSync2("/usr/sbin/ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"], {
+      encoding: "utf8",
+      timeout: 2e3
+    })))();
+    const uuid = /"IOPlatformUUID"\s*=\s*"([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})"/i.exec(output)?.[1];
+    if (!uuid || /^0{8}-0{4}-0{4}-0{4}-0{12}$/.test(uuid))
+      return null;
+    const id2 = createHash3("sha256").update(uuid.toUpperCase()).digest("base64url").slice(0, 22);
+    const name = (options.hostname ?? hostname()).split(".")[0];
+    return { id: id2, ...name ? { name } : {} };
+  } catch {
+    return null;
+  }
+}
+
+// apps/cli/dist/license.js
 var OFFLINE_GRACE_DAYS = 14;
 var PROD_PUBLIC_KEY_PEM = "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAyU4yO0SJcflt/CV77wqVxIwCkM52CYGC6qrPGP8dMME=\n-----END PUBLIC KEY-----\n";
 function checkLicense(options = {}) {
@@ -17510,7 +17600,15 @@ function licenseStatus(options = {}) {
   if (publicKeyPem === "") {
     return { state: "active", detail: t("cli.licenseDevelopment") };
   }
-  return verifyEntitlement(raw, options.now ?? /* @__PURE__ */ new Date(), publicKeyPem);
+  const status3 = verifyEntitlement(raw, options.now ?? /* @__PURE__ */ new Date(), publicKeyPem);
+  if (status3.claims?.dev !== void 0) {
+    const device = options.device === void 0 ? getLicenseDevice() : options.device;
+    if (!device)
+      return { state: "invalid", detail: t("cli.licenseDeviceUnavailable") };
+    if (status3.claims.dev !== device.id)
+      return { state: "invalid", detail: t("cli.licenseOtherDevice") };
+  }
+  return status3;
 }
 function verifyEntitlement(raw, now, publicKeyPem) {
   let parsed;
@@ -17533,10 +17631,16 @@ function verifyEntitlement(raw, now, publicKeyPem) {
   let claims;
   try {
     const decoded = JSON.parse(Buffer.from(parsed.token, "base64url").toString("utf8"));
-    if (typeof decoded.sub !== "string" || decoded.plan !== "trial" && decoded.plan !== "subscription" || typeof decoded.iat !== "string" || typeof decoded.exp !== "string" || Number.isNaN(Date.parse(decoded.exp))) {
+    if (typeof decoded.sub !== "string" || decoded.plan !== "trial" && decoded.plan !== "subscription" || typeof decoded.iat !== "string" || typeof decoded.exp !== "string" || Number.isNaN(Date.parse(decoded.exp)) || decoded.dev !== void 0 && (typeof decoded.dev !== "string" || !decoded.dev)) {
       return { state: "invalid", detail: t("cli.licenseClaimsFields") };
     }
-    claims = { sub: decoded.sub, plan: decoded.plan, iat: decoded.iat, exp: decoded.exp };
+    claims = {
+      sub: decoded.sub,
+      plan: decoded.plan,
+      iat: decoded.iat,
+      exp: decoded.exp,
+      ...typeof decoded.dev === "string" ? { dev: decoded.dev } : {}
+    };
   } catch {
     return { state: "invalid", detail: t("cli.licenseClaimsDecode") };
   }
@@ -17616,7 +17720,34 @@ import { copyFileSync, readFileSync as readFileSync4, renameSync as renameSync2,
 import { homedir as homedir4 } from "node:os";
 import { dirname as dirname6, join as join8 } from "node:path";
 var DEFAULT_LICENSE_SERVER = "https://api.getwingman.dev";
+function parseDevices(value) {
+  if (!Array.isArray(value) || value.length > 3)
+    return void 0;
+  if (!value.every((item) => typeof item === "object" && item !== null && "id" in item && typeof item.id === "string" && "registeredAt" in item && typeof item.registeredAt === "string" && !Number.isNaN(Date.parse(item.registeredAt)) && "renewedAt" in item && typeof item.renewedAt === "string" && !Number.isNaN(Date.parse(item.renewedAt)) && (!("name" in item) || typeof item.name === "string")))
+    return void 0;
+  return value.map((item) => ({
+    id: item.id,
+    registeredAt: item.registeredAt,
+    renewedAt: item.renewedAt,
+    ...item.name ? { name: item.name } : {}
+  }));
+}
+function licenseNetworkAllowed(options, baseUrl) {
+  if (!options.offline || options.fetchFn)
+    return true;
+  try {
+    return ["127.0.0.1", "localhost", "[::1]"].includes(new URL(baseUrl).hostname);
+  } catch {
+    return false;
+  }
+}
 async function refreshLicense(options = {}) {
+  return renewLicense(options, "refresh");
+}
+async function activateLicense(options) {
+  return renewLicense(options, "activate");
+}
+async function renewLicense(options, action) {
   const home = options.homeDir ?? homedir4();
   const baseUrl = options.baseUrl ?? process.env.WINGMAN_LICENSE_SERVER ?? DEFAULT_LICENSE_SERVER;
   const licensePath = join8(home, ".wingman", "license.json");
@@ -17630,12 +17761,33 @@ async function refreshLicense(options = {}) {
       reason: "missing"
     };
   }
+  if (!licenseNetworkAllowed(options, baseUrl)) {
+    return { ok: false, message: t("cli.licenseFixturesOffline"), reason: "offline" };
+  }
+  const publicKeyPem = options.publicKeyPem ?? PROD_PUBLIC_KEY_PEM;
+  if (publicKeyPem !== "") {
+    const status3 = verifyEntitlement(raw, options.now ?? /* @__PURE__ */ new Date(), publicKeyPem);
+    if (status3.state === "invalid")
+      return { ok: false, message: t("cli.licenseSignature"), reason: "invalid-license" };
+    if (action === "activate" && status3.state !== "active")
+      return { ok: false, message: t("cli.licenseActivationExpired"), reason: "invalid-license" };
+  }
+  const device = options.device === void 0 ? getLicenseDevice() : options.device;
+  if (!device)
+    return { ok: false, message: t("cli.licenseDeviceUnavailable"), reason: "device-unavailable" };
+  let requestBody;
+  try {
+    requestBody = JSON.stringify(action === "activate" ? { license: JSON.parse(raw), action, ...device } : { ...JSON.parse(raw), device: { id: device.id } });
+  } catch {
+    return { ok: false, message: t("cli.licenseJson"), reason: "invalid-license" };
+  }
   let response;
   try {
-    response = await fetch(`${baseUrl}/refresh`, {
+    response = await (options.fetchFn ?? fetch)(`${baseUrl}/${action === "activate" ? "devices" : "refresh"}`, {
       method: "POST",
       headers: { "content-type": "application/json" },
-      body: raw,
+      body: requestBody,
+      redirect: "error",
       signal: AbortSignal.timeout(15e3)
     });
   } catch {
@@ -17650,6 +17802,25 @@ async function refreshLicense(options = {}) {
     let inactive = false;
     try {
       const body = await response.json();
+      if (response.status === 409 && body.code === "device_limit") {
+        const devices2 = parseDevices(body.devices);
+        if (devices2)
+          return {
+            ok: false,
+            message: t("cli.licenseDeviceLimit"),
+            reason: "device_limit",
+            devices: devices2
+          };
+      }
+      if (response.status === 403 && body.code === "device_revoked") {
+        const devices2 = parseDevices(body.devices);
+        return {
+          ok: false,
+          message: t("cli.licenseDeviceRevoked"),
+          reason: "device_revoked",
+          ...devices2 ? { devices: devices2 } : {}
+        };
+      }
       if (typeof body.error === "string")
         detail = body.error;
       inactive = body.reason === "inactive";
@@ -17680,13 +17851,14 @@ async function refreshLicense(options = {}) {
   }
   const next = `${JSON.stringify({ token: entitlement.token, signature: entitlement.signature })}
 `;
-  const publicKeyPem = options.publicKeyPem ?? PROD_PUBLIC_KEY_PEM;
   if (publicKeyPem !== "") {
     const status3 = verifyEntitlement(next, options.now ?? /* @__PURE__ */ new Date(), publicKeyPem);
-    if (status3.state !== "active" && status3.state !== "grace") {
+    if (status3.state !== "active" && status3.state !== "grace" || status3.claims?.dev !== device.id) {
       return {
         ok: false,
-        message: t("cli.refreshInvalid", { detail: status3.detail }),
+        message: t("cli.refreshInvalid", {
+          detail: status3.claims?.dev !== device.id ? t("cli.licenseOtherDevice") : status3.detail
+        }),
         reason: "invalid-response"
       };
     }
@@ -17719,7 +17891,70 @@ async function refreshLicense(options = {}) {
       reason: "write"
     };
   }
-  return { ok: true, message: t("cli.licenseRenewed", { suffix: expSuffix(entitlement.token) }) };
+  const devices = parseDevices(entitlement.devices);
+  return {
+    ok: true,
+    message: t("cli.licenseRenewed", { suffix: expSuffix(entitlement.token) }),
+    ...devices ? { devices } : {}
+  };
+}
+async function manageLicenseDevices(options, action, id2) {
+  const baseUrl = options.baseUrl ?? process.env.WINGMAN_LICENSE_SERVER ?? DEFAULT_LICENSE_SERVER;
+  if (!licenseNetworkAllowed(options, baseUrl))
+    return { ok: false, message: t("cli.licenseFixturesOffline"), reason: "offline" };
+  let raw;
+  try {
+    raw = readFileSync4(join8(options.homeDir ?? homedir4(), ".wingman", "license.json"), "utf8");
+  } catch {
+    return { ok: false, message: t("cli.licenseMissing"), reason: "missing" };
+  }
+  const key = options.publicKeyPem ?? PROD_PUBLIC_KEY_PEM;
+  const status3 = key === "" ? void 0 : verifyEntitlement(raw, options.now ?? /* @__PURE__ */ new Date(), key);
+  if (status3?.state === "invalid")
+    return { ok: false, message: t("cli.licenseSignature"), reason: "invalid-license" };
+  let callerDeviceId;
+  if (action === "unbind") {
+    const device = options.device === void 0 ? getLicenseDevice() : options.device;
+    if (!device)
+      return {
+        ok: false,
+        message: t("cli.licenseDeviceUnavailable"),
+        reason: "device-unavailable"
+      };
+    if (status3?.state !== "active" || status3.claims?.dev !== device.id)
+      return {
+        ok: false,
+        message: t("cli.licenseUnbindRequiresActiveDevice"),
+        reason: "invalid-license"
+      };
+    callerDeviceId = device.id;
+  }
+  try {
+    const response = await (options.fetchFn ?? fetch)(`${baseUrl}/devices`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        license: JSON.parse(raw),
+        action,
+        ...id2 ? { id: id2 } : {},
+        ...callerDeviceId === void 0 ? {} : { device: { id: callerDeviceId } }
+      }),
+      signal: AbortSignal.timeout(15e3),
+      redirect: "error"
+    });
+    if (!response.ok)
+      return {
+        ok: false,
+        message: response.status === 403 && action === "unbind" ? t("cli.licenseUnbindRequiresActiveDevice") : t("cli.refreshHttp", { status: response.status }),
+        reason: response.status === 403 ? "invalid-license" : "server"
+      };
+    const devices = parseDevices((await response.json()).devices);
+    if (!devices)
+      return { ok: false, message: t("cli.licenseDevicesInvalid"), reason: "invalid-response" };
+    return { ok: true, message: "", devices };
+  } catch {
+    return { ok: false, message: t("cli.refreshNetwork"), reason: "network" };
+  }
 }
 function expSuffix(token) {
   try {
@@ -17949,9 +18184,9 @@ function runSecurity(args) {
 // apps/cli/dist/mobile/snapshot.js
 init_dist2();
 init_dist();
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 function mobileId(value) {
-  return createHash3("sha256").update(value).digest("hex");
+  return createHash4("sha256").update(value).digest("hex");
 }
 function buildMobileSnapshot(narrative, at, wired) {
   const sources = narrative.getProjects().projects;
@@ -18194,6 +18429,7 @@ function writeMobileState(homeDir, state) {
 }
 
 // apps/cli/dist/mobile/service.js
+var PAIRING_WINDOW_MS = 5 * 6e4;
 function createMobileService(options) {
   const keychain = options.keychain ?? createMacKeychain();
   const fetchRelay = options.fetch ?? globalThis.fetch;
@@ -18678,7 +18914,7 @@ function createMobileService(options) {
           throw new Error("mobile.relayUnavailable");
         created = true;
         persist((current) => [...current, pair]);
-        pairs.set(pairId, { ...runtime(pair), pairingUntil: now().getTime() + 1e4 });
+        pairs.set(pairId, { ...runtime(pair), pairingUntil: now().getTime() + PAIRING_WINDOW_MS });
         stateError = void 0;
         return { pairId, url: pairingUrl({ relay, pairId, deviceKey }) };
       } catch {
@@ -18702,16 +18938,15 @@ function createMobileService(options) {
         throw new Error(created ? "mobile.localWriteFailed" : "mobile.relayUnavailable");
       }
     },
-    async list(pairing) {
-      const entry = pairing ? pairs.get(pairing) : void 0;
-      if (entry?.status === "pending")
-        entry.pairingUntil = now().getTime() + 1e4;
+    async list() {
       await refresh();
-      const error = stateError ?? [...pairs.values()].find((entry2) => entry2.error)?.error;
+      const at = now().getTime();
+      const error = stateError ?? [...pairs.values()].find((entry) => entry.error)?.error;
       return {
-        pairs: [...pairs.values()].map((entry2) => ({
-          ...entry2.pair,
-          status: entry2.status,
+        pairs: [...pairs.values()].map((entry) => ({
+          ...entry.pair,
+          status: entry.status,
+          ...entry.status === "pending" && at >= (entry.pairingUntil ?? 0) ? { expired: true } : {},
           ...!options.licensed() ? { paused: true } : {}
         })),
         ...error ? { error } : {}
@@ -20977,7 +21212,7 @@ function resolveWingmanVersion({ defined, moduleUrl = import.meta.url, readPacka
   return void 0;
 }
 function wingmanVersion() {
-  const defined = false ? void 0 : "0.9.7";
+  const defined = false ? void 0 : "0.9.8";
   return resolveWingmanVersion({
     defined,
     readPackage: (url) => JSON.parse(readFileSync18(url, "utf8"))
@@ -22766,12 +23001,12 @@ function humanFeedbackState(harness2, session2) {
     return state;
   return state.state === "needs_user" ? { ...state, since: at } : { ...state, requestSince: at };
 }
-function humanWaiting(harness2, lines2, wait, at = wait.since) {
-  if (harness2 !== "codex" || wait.kind !== "permission")
-    return wait;
+function humanWaiting(harness2, lines2, wait2, at = wait2.since) {
+  if (harness2 !== "codex" || wait2.kind !== "permission")
+    return wait2;
   if (codexAutomaticReviewAt(lines2, at))
     return null;
-  return codexAutomaticReviewAt(lines2, wait.since) ? { ...wait, since: at } : wait;
+  return codexAutomaticReviewAt(lines2, wait2.since) ? { ...wait2, since: at } : wait2;
 }
 function observedMcpServers(lines2, configuredServers) {
   const names = /* @__PURE__ */ new Set();
@@ -22837,7 +23072,7 @@ function observedSkills(lines2) {
 function derive(harness2, session2, nowIso, configuredPlugins, configuredMcpServers) {
   const codexLines = sortedCodexByTimestamp(session2.codexLines);
   const waiting2 = session2.waiting === null ? null : humanWaiting(harness2, codexLines, session2.waiting, session2.feedbackRequestAt);
-  const waitEpisodes = session2.waitEpisodes.map((wait) => humanWaiting(harness2, codexLines, wait, wait.requestAt)).filter((wait) => wait !== null);
+  const waitEpisodes = session2.waitEpisodes.map((wait2) => humanWaiting(harness2, codexLines, wait2, wait2.requestAt)).filter((wait2) => wait2 !== null);
   const lines2 = harness2 === "codex" ? adaptCodexNarrativeLines(codexLines) : sortedByTimestamp(session2.lines);
   const timeline = deriveTodoTimeline(extractTodoSnapshots(lines2));
   const allSteps = extractSteps(lines2);
@@ -24082,9 +24317,132 @@ import { execFile as execFile3 } from "node:child_process";
 import { createHmac, timingSafeEqual } from "node:crypto";
 import { readFile as readFile4 } from "node:fs/promises";
 import { createServer } from "node:http";
-import { hostname } from "node:os";
+import { hostname as hostname2 } from "node:os";
 import { extname, isAbsolute as isAbsolute7, relative as relative5, resolve as resolve14, sep as sep2 } from "node:path";
 
+// apps/cli/dist/license-activation.js
+import { setTimeout as wait } from "node:timers/promises";
+function createLicenseActivation(options) {
+  let activation = { state: "pending", devices: [], maxDevices: 3 };
+  let queue = Promise.resolve();
+  const serial = (work) => {
+    const next = queue.then(work, work);
+    queue = next.catch(() => {
+    });
+    return next;
+  };
+  const statusOptions = () => options;
+  const status3 = () => {
+    const current = licenseStatus(statusOptions());
+    return {
+      state: current.state,
+      detail: current.detail,
+      ...current.claims ? { plan: current.claims.plan, exp: current.claims.exp } : {},
+      tier: checkLicense(statusOptions()) ? "full" : "free",
+      ...current.state === "none" || activation.state === "pending" && current.claims?.dev ? {} : { activation }
+    };
+  };
+  const refresh = async (explicitActivation = false) => {
+    const result5 = await (explicitActivation ? activateLicense : refreshLicense)(options);
+    if (result5.reason === "device_limit")
+      activation = {
+        state: activation.state === "device_revoked" ? "device_revoked" : "device_limit",
+        devices: result5.devices ?? [],
+        maxDevices: 3,
+        detail: result5.message
+      };
+    else if (result5.reason === "device_revoked")
+      activation = {
+        state: "device_revoked",
+        devices: result5.devices ?? activation.devices,
+        maxDevices: 3,
+        detail: result5.message
+      };
+    else if (result5.reason === "device-unavailable")
+      activation = { state: "unavailable", devices: [], maxDevices: 3, detail: result5.message };
+    else if (result5.ok) {
+      const current = licenseStatus(statusOptions());
+      activation = {
+        state: current.claims?.dev && result5.devices ? "active" : "pending",
+        devices: result5.devices ?? [],
+        maxDevices: 3
+      };
+    }
+    return result5;
+  };
+  return {
+    status: status3,
+    refresh: () => serial(() => refresh()),
+    autoRefresh: () => serial(async () => {
+      if ((options.publicKeyPem ?? PROD_PUBLIC_KEY_PEM) === "")
+        return;
+      const result5 = await refresh();
+      return result5.ok || result5.reason === "missing" ? void 0 : result5.reason;
+    }),
+    install: (raw) => serial(async () => {
+      const result5 = installLicense(raw, statusOptions());
+      if (!result5.ok)
+        return { ok: false, message: result5.error };
+      activation = { state: "pending", devices: [], maxDevices: 3 };
+      if ((options.publicKeyPem ?? PROD_PUBLIC_KEY_PEM) !== "")
+        await refresh(true);
+      return { ok: true, message: "" };
+    }),
+    devices: (action, id2) => serial(async () => {
+      if (action === "activate")
+        return refresh(true);
+      const result5 = await manageLicenseDevices(options, action, id2);
+      if (!result5.ok)
+        return result5;
+      activation = { ...activation, devices: result5.devices ?? [] };
+      if (action === "unbind") {
+        await (options.wait ?? wait)(1e3);
+        return refresh();
+      }
+      const current = licenseStatus(statusOptions());
+      if (activation.state !== "device_revoked" && current.claims?.dev && (current.state === "active" || current.state === "grace")) {
+        const devices = result5.devices ?? [];
+        activation = {
+          state: devices.some((device) => device.id === current.claims?.dev) ? "active" : "device_limit",
+          devices,
+          maxDevices: 3
+        };
+      }
+      return result5;
+    })
+  };
+}
+
+// apps/cli/dist/license-auto-refresh.js
+function startLicenseAutoRefresh(options) {
+  const clock = options.clock ?? { setTimeout, clearTimeout, setInterval, clearInterval };
+  let running = false;
+  const run = async () => {
+    if (running)
+      return;
+    running = true;
+    try {
+      await options.refresh();
+    } catch {
+      options.warn?.("license automatic refresh failed");
+    } finally {
+      running = false;
+    }
+  };
+  let interval;
+  const timeout = clock.setTimeout(() => {
+    void run();
+    interval = clock.setInterval(() => void run(), 24 * 60 * 60 * 1e3);
+    interval.unref?.();
+  }, 5e3);
+  timeout.unref?.();
+  return () => {
+    clock.clearTimeout(timeout);
+    if (interval !== void 0)
+      clock.clearInterval(interval);
+  };
+}
+
 // apps/cli/dist/suggest.js
 init_dist2();
 init_dist();
@@ -24271,10 +24629,21 @@ var PANEL_ACTION_HEADER = "x-wingman-panel-action";
 var LOCAL_HOST = /^(?:127\.0\.0\.1|localhost)(?::\d+)?$|^\[::1\](?::\d+)?$/i;
 function createWingmanServer(options) {
   const warn = options.warn ?? ((message) => console.error(message));
-  const runtime = { anatomy: null };
+  const licenseOptions = {
+    ...options.homeDir === void 0 ? {} : { homeDir: options.homeDir },
+    ...options.licenseOptions,
+    ...options.licenseRefreshOptions,
+    ...options.readonlyActions && options.licenseOptions?.device === void 0 && options.licenseRefreshOptions?.device === void 0 ? { device: null } : {},
+    offline: options.readonlyActions === true || options.licenseRefreshOptions?.offline === true
+  };
+  options = { ...options, licenseOptions };
+  const runtime = {
+    anatomy: null,
+    license: createLicenseActivation(licenseOptions)
+  };
   options.narrative?.setCodexPluginsProvider(() => runtime.anatomy?.configs.find((config) => config.harness === "codex")?.slots.skills.filter((item) => item.nativeName.startsWith("plugins.")).map((item) => item.nativeName.slice("plugins.".length)) ?? []);
   options.narrative?.setCcMcpServersProvider(() => runtime.anatomy?.configs.find((config) => config.harness === "cc")?.slots.tools.filter((item) => item.nativeName.startsWith("mcpServers.")).map((item) => item.nativeName.slice("mcpServers.".length)) ?? []);
-  return createServer({ requireHostHeader: false }, (req, res) => {
+  const server = createServer({ requireHostHeader: false }, (req, res) => {
     handle(req, res, options, warn, runtime).catch((error) => {
       warn(t("cli.server.requestFailed", { error: errorMessage3(error) }));
       if (!res.headersSent)
@@ -24283,6 +24652,21 @@ function createWingmanServer(options) {
         res.end();
     });
   });
+  if (options.licenseAutoRefresh) {
+    server.once("listening", () => {
+      const stop = startLicenseAutoRefresh({
+        ...options.licenseAutoRefresh,
+        refresh: async () => {
+          const reason = await runtime.license.autoRefresh();
+          if (reason)
+            warn(`license automatic refresh: ${reason}`);
+        },
+        warn
+      });
+      server.once("close", stop);
+    });
+  }
+  return server;
 }
 function listen(server, port) {
   return new Promise((resolvePort, reject) => {
@@ -24382,7 +24766,7 @@ async function handle(req, res, options, warn, runtime) {
     return;
   }
   if (url.pathname === "/api/license/install" && req.method === "POST") {
-    await handleLicenseInstall(req, res, options);
+    await handleLicenseInstall(req, res, options, runtime);
     return;
   }
   if (url.pathname === "/api/license/refresh") {
@@ -24394,7 +24778,36 @@ async function handle(req, res, options, warn, runtime) {
       sendJson2(res, 403, { error: t("cli.server.refreshFromPanel") });
       return;
     }
-    await handleLicenseRefresh(res, options);
+    await handleLicenseRefresh(res, options, runtime);
+    return;
+  }
+  if (url.pathname === "/api/license/devices") {
+    if (req.method !== "POST") {
+      sendText2(res, 405, "method not allowed");
+      return;
+    }
+    if (req.headers[PANEL_ACTION_HEADER] !== "license-devices") {
+      sendJson2(res, 403, { error: t("cli.server.refreshFromPanel") });
+      return;
+    }
+    const raw = await readTextBody(req, LICENSE_BODY_LIMIT);
+    let body;
+    try {
+      body = JSON.parse(raw ?? "");
+    } catch {
+      sendJson2(res, 400, { error: "invalid device action" });
+      return;
+    }
+    if (!body || body.action !== "list" && body.action !== "unbind" && body.action !== "activate" || body.action === "unbind" && (typeof body.id !== "string" || !body.id)) {
+      sendJson2(res, 400, { error: "invalid device action" });
+      return;
+    }
+    const result5 = await runtime.license.devices(body.action, typeof body.id === "string" ? body.id : void 0);
+    sendJson2(res, result5.ok ? 200 : result5.reason === "device_limit" ? 409 : result5.reason === "device_revoked" || result5.reason === "invalid-license" ? 403 : 400, {
+      ...licenseApiStatus(options, runtime),
+      ...result5.ok ? {} : { error: result5.message },
+      ...result5.reason === "device_revoked" ? { code: result5.reason } : {}
+    });
     return;
   }
   if (req.method !== "GET") {
@@ -24402,19 +24815,7 @@ async function handle(req, res, options, warn, runtime) {
     return;
   }
   if (url.pathname === "/api/license") {
-    const body = publicLicenseStatus(licenseStatus(options.licenseOptions));
-    body.tier = checkLicense(options.licenseOptions) ? "full" : "free";
-    if (body.tier === "free") {
-      const cached = runtime.anatomy?.configs;
-      const detected = new Set((cached ?? []).map((config) => config.harness));
-      const homeDir = options.homeDir ?? options.licenseOptions?.homeDir;
-      const settings = homeDir === void 0 ? void 0 : readReturnTargetSettings(homeDir);
-      const selected = settings && !("unavailable" in settings) ? settings.freeHarness : void 0;
-      body.freeHarness = selected !== void 0 && (cached === void 0 || detected.has(selected)) ? selected : HARNESS_IDS.find((harness2) => detected.has(harness2)) ?? HARNESS_IDS[0];
-      if (settings && !("unavailable" in settings) && settings.freeHarnessChosenAt !== void 0) {
-        body.freeHarnessSwitchableAt = new Date(Date.parse(settings.freeHarnessChosenAt) + FREE_HARNESS_SWITCH_COOLDOWN_MS).toISOString();
-      }
-    }
+    const body = licenseApiStatus(options, runtime);
     sendJson2(res, 200, body);
     return;
   }
@@ -24709,7 +25110,7 @@ function handleProtocolUserAction(body, res, options, runtime) {
         ...install && before.version !== void 0 && after.version !== void 0 && before.version < after.version ? { fromVersion: before.version, toVersion: after.version } : {},
         blockBytes: Buffer.byteLength(block ?? ""),
         backupDir: t("cli.server.backupPreview"),
-        hostname: hostname()
+        hostname: hostname2()
       });
     } else {
       runtime.anatomy = null;
@@ -24889,56 +25290,45 @@ async function handleTaskOverlay(req, res, options) {
   sendJson2(res, 200, { key, entry: result5.entry });
 }
 var LICENSE_BODY_LIMIT = 64 * 1024;
-async function handleLicenseInstall(req, res, options) {
+function licenseApiStatus(options, runtime) {
+  const body = runtime.license.status();
+  if (body.tier === "free") {
+    const cached = runtime.anatomy?.configs;
+    const detected = new Set((cached ?? []).map((config) => config.harness));
+    const homeDir = options.homeDir ?? options.licenseOptions?.homeDir;
+    const settings = homeDir === void 0 ? void 0 : readReturnTargetSettings(homeDir);
+    const selected = settings && !("unavailable" in settings) ? settings.freeHarness : void 0;
+    body.freeHarness = selected !== void 0 && (cached === void 0 || detected.has(selected)) ? selected : HARNESS_IDS.find((harness2) => detected.has(harness2)) ?? HARNESS_IDS[0];
+    if (settings && !("unavailable" in settings) && settings.freeHarnessChosenAt !== void 0) {
+      body.freeHarnessSwitchableAt = new Date(Date.parse(settings.freeHarnessChosenAt) + FREE_HARNESS_SWITCH_COOLDOWN_MS).toISOString();
+    }
+  }
+  return body;
+}
+async function handleLicenseInstall(req, res, options, runtime) {
   const raw = await readTextBody(req, LICENSE_BODY_LIMIT);
   if (raw === void 0) {
     sendJson2(res, 400, { error: t("cli.server.licenseRead") });
     return;
   }
-  const result5 = installLicense(raw, options.licenseOptions);
+  const result5 = await runtime.license.install(raw);
   if (!result5.ok) {
-    sendJson2(res, 400, { error: result5.error });
+    sendJson2(res, 400, { error: result5.message });
     return;
   }
-  sendJson2(res, 200, { ...publicLicenseStatus(result5.status), tier: "full" });
+  sendJson2(res, 200, licenseApiStatus(options, runtime));
 }
-async function handleLicenseRefresh(res, options) {
-  const homeDir = options.licenseRefreshOptions?.homeDir ?? options.licenseOptions?.homeDir;
-  const publicKeyPem = options.licenseRefreshOptions?.publicKeyPem ?? options.licenseOptions?.publicKeyPem;
-  const now = options.licenseRefreshOptions?.now ?? options.licenseOptions?.now;
-  const refreshOptions = {
-    ...options.licenseRefreshOptions,
-    ...homeDir === void 0 ? {} : { homeDir },
-    ...publicKeyPem === void 0 ? {} : { publicKeyPem },
-    ...now === void 0 ? {} : { now }
-  };
-  const result5 = await refreshLicense(refreshOptions);
+async function handleLicenseRefresh(res, options, runtime) {
+  const result5 = await runtime.license.refresh();
   if (!result5.ok) {
-    sendJson2(res, 400, {
+    sendJson2(res, result5.reason === "device_limit" ? 409 : result5.reason === "device_revoked" ? 403 : 400, {
       error: result5.message,
-      canSubscribe: result5.reason === "inactive"
+      canSubscribe: result5.reason === "inactive",
+      ...result5.reason === "device_revoked" ? { code: result5.reason } : {}
     });
     return;
   }
-  const statusOptions = {
-    ...options.licenseOptions,
-    ...homeDir === void 0 ? {} : { homeDir },
-    ...publicKeyPem === void 0 ? {} : { publicKeyPem },
-    ...now === void 0 ? {} : { now }
-  };
-  sendJson2(res, 200, {
-    ...publicLicenseStatus(licenseStatus(statusOptions)),
-    tier: "full",
-    message: result5.message
-  });
-}
-function publicLicenseStatus(status3) {
-  const body = { state: status3.state, detail: status3.detail };
-  if (status3.claims) {
-    body.plan = status3.claims.plan;
-    body.exp = status3.claims.exp;
-  }
-  return body;
+  sendJson2(res, 200, { ...licenseApiStatus(options, runtime), message: result5.message });
 }
 function readTextBody(req, maxBytes) {
   return new Promise((resolveBody) => {
@@ -25161,7 +25551,7 @@ async function main(argv) {
         return 0;
       }
       if (rest[0] === "refresh") {
-        const result5 = await refreshLicense({ homeDir });
+        const result5 = await refreshLicense({ homeDir, offline: argv.includes("--fixtures") });
         process.stdout.write(`${result5.message}
 `);
         if (!result5.ok)
@@ -25271,7 +25661,10 @@ async function runServe(args) {
     receiver: createReceiver({ onEvent: narrative.handleEvent }),
     readonlyActions: fixtures,
     homeDir,
+    // fixtures 只替换扫描根；授权仍使用进程 HOME，测试由子进程环境注入临时目录。
+    licenseOptions: { homeDir: homedir17() },
     narrative,
+    licenseAutoRefresh: {},
     ...mobile === void 0 ? {} : { mobile },
     hookToken,
     ...locale === void 0 ? {} : { localeArg: locale },