moltengine-cli 0.1.4 → 0.1.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "moltengine-cli",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "CLI for Moltengine - The WP Engine for AI Agents",
   "type": "module",
   "license": "MIT",

package/src/moltengine.js

@@ -1,9 +1,11 @@
 #!/usr/bin/env node
 
 import { request } from "undici";
+import { exec } from "child_process";
+import { createInterface } from "readline";
 
 // Configuration
-const API_URL = process.env.MOLTENGINE_API || "http://localhost:8080";
+const API_URL = process.env.MOLTENGINE_API || "https://api.moltengine.com";
 const TENANT_KEY = process.env.MOLT_TENANT_KEY || "";
 const WEB_URL = process.env.MOLTENGINE_WEB || "https://moltengine.com";
 
@@ -60,9 +62,11 @@ ${colors.primary}  __  __       _ _                   _
 `;
 
 const ASCII_LOGO_COMPACT = `
-${colors.primary} ╔╦╗╔═╗╦ ╔╦╗╔═╗╔╗╔╔═╗╦╔╗╔╔═╗
- ║║║║ ║║  ║ ║╣ ║║║║ ╦║║║║║╣ 
- ╩ ╩╚═╝╩═╝╩ ╚═╝╝╚╝╚═╝╩╝╚╝╚═╝${colors.reset}
+${colors.primary} __   __     _ _              _        
+|  \\/  |___| | |_ ___ _ _  _(_)_ _  ___
+| |\\/| / _ \\ | __/ -_) ' \\/ _\` | ' \\/ -_)
+|_|  |_\\___/_|\\__\\___|_||_\\__, |_||_\\___|
+                          |___/${colors.reset}
 `;
 
 // ============================================================================
@@ -93,6 +97,48 @@ function error(message) {
   process.exit(1);
 }
 
+/**
+ * Check if tenant needs to complete payment and prompt if so
+ * Returns true if payment is needed (and command should stop)
+ */
+function checkPaymentRequired(tenant) {
+  const unpaidStatuses = ['pending', 'incomplete', 'incomplete_expired', 'past_due', 'unpaid', 'trialing'];
+  const billingStatus = tenant.billingStatus || tenant.billing_status || tenant.status;
+  
+  // Check if tenant needs to pay
+  if (unpaidStatuses.includes(billingStatus?.toLowerCase())) {
+    console.log(ASCII_LOGO_COMPACT);
+    console.log();
+    print(`${colors.warning}⚡ Subscription Required${colors.reset}`, colors.bold);
+    console.log();
+    
+    if (billingStatus === 'past_due') {
+      console.log(`  Your subscription payment is past due.`);
+      console.log(`  Please update your payment method to continue.`);
+    } else {
+      console.log(`  Complete your subscription to start using Moltengine.`);
+    }
+    
+    console.log();
+    print("Plans", colors.bold);
+    print("─".repeat(40), colors.muted);
+    console.log(`  ${colors.accent}Starter${colors.reset}    ${PLAN_PRICES.starter}   — 1 agent, all tools, approvals`);
+    console.log(`  ${colors.accent}Team${colors.reset}       ${PLAN_PRICES.team}  — 5 agents, approvals`);
+    console.log(`  ${colors.accent}Business${colors.reset}   ${PLAN_PRICES.business}  — 25 agents, SIEM, RBAC`);
+    console.log(`  ${colors.accent}Enterprise${colors.reset} ${PLAN_PRICES.enterprise}   — SSO, VPC, compliance`);
+    console.log();
+    
+    const checkoutUrl = `${WEB_URL}/checkout`;
+    print(`${colors.info}→ Subscribe now: ${colors.accent}${checkoutUrl}${colors.reset}`, colors.bold);
+    console.log();
+    
+    return true;
+  }
+  
+  return false;
+}
+
+
 /**
  * Print success message
  */
@@ -111,12 +157,42 @@ function info(message) {
 // API CLIENT
 // ============================================================================
 
+/**
+ * Show signup/login prompt when no tenant key is set
+ */
+function showAuthRequired() {
+  console.log(ASCII_LOGO_COMPACT);
+  console.log();
+  print(`${colors.warning}🔑 Authentication Required${colors.reset}`, colors.bold);
+  console.log();
+  console.log(`  You need a Moltengine account to use the CLI.`);
+  console.log();
+  print("Get Started", colors.bold);
+  print("─".repeat(40), colors.muted);
+  console.log(`  1. Sign up or log in at ${colors.accent}${WEB_URL}/login${colors.reset}`);
+  console.log(`  2. Subscribe to a plan at ${colors.accent}${WEB_URL}/checkout${colors.reset}`);
+  console.log(`  3. Copy your tenant key from the dashboard`);
+  console.log(`  4. Set it in your environment:`);
+  console.log();
+  console.log(`     ${colors.muted}export MOLT_TENANT_KEY="your-key-here"${colors.reset}`);
+  console.log();
+  print("Plans", colors.bold);
+  print("─".repeat(40), colors.muted);
+  console.log(`  ${colors.accent}Starter${colors.reset}    ${PLAN_PRICES.starter}   — 1 agent, all tools, approvals`);
+  console.log(`  ${colors.accent}Team${colors.reset}       ${PLAN_PRICES.team}  — 5 agents, approvals`);
+  console.log(`  ${colors.accent}Business${colors.reset}   ${PLAN_PRICES.business}  — 25 agents, SIEM, RBAC`);
+  console.log();
+  print(`${colors.info}→ Start free: ${colors.accent}${WEB_URL}/login${colors.reset}`, colors.bold);
+  console.log();
+  process.exit(0);
+}
+
 /**
  * Make an authenticated GET request
  */
 async function apiGet(path) {
   if (!TENANT_KEY) {
-    error("MOLT_TENANT_KEY environment variable is required");
+    showAuthRequired();
   }
 
   const url = `${API_URL}${path}`;
@@ -151,7 +227,7 @@ async function apiGet(path) {
  */
 async function apiPost(path, body = {}) {
   if (!TENANT_KEY) {
-    error("MOLT_TENANT_KEY environment variable is required");
+    showAuthRequired();
   }
 
   const url = `${API_URL}${path}`;
@@ -266,10 +342,316 @@ function padLeft(str, len) {
   return str.padStart(len);
 }
 
+// ============================================================================
+// BROWSER HELPER
+// ============================================================================
+
+/**
+ * Open a URL in the default browser
+ */
+function openBrowser(url) {
+  const platform = process.platform;
+  let command;
+  
+  if (platform === "darwin") {
+    command = `open "${url}"`;
+  } else if (platform === "win32") {
+    command = `start "" "${url}"`;
+  } else {
+    // Linux and others
+    command = `xdg-open "${url}" 2>/dev/null || sensible-browser "${url}" 2>/dev/null || x-www-browser "${url}" 2>/dev/null || gnome-open "${url}" 2>/dev/null`;
+  }
+  
+  return new Promise((resolve) => {
+    exec(command, (err) => {
+      resolve(!err);
+    });
+  });
+}
+
+/**
+ * Prompt user for input
+ */
+function prompt(question) {
+  const rl = createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+  
+  return new Promise((resolve) => {
+    rl.question(question, (answer) => {
+      rl.close();
+      resolve(answer.trim());
+    });
+  });
+}
+
 // ============================================================================
 // COMMANDS
 // ============================================================================
 
+/**
+ * Login command - authenticate and get API key
+ */
+async function cmdLogin() {
+  console.log(ASCII_LOGO_COMPACT);
+  
+  // Check if already authenticated
+  if (TENANT_KEY) {
+    try {
+      const tenant = await apiGet("/tenant/me");
+      const billingStatus = tenant.billingStatus || tenant.billing_status || tenant.status;
+      
+      if (billingStatus === "active") {
+        success("You're already logged in!");
+        console.log();
+        console.log(`  ${colors.muted}Tenant:${colors.reset}  ${tenant.name}`);
+        console.log(`  ${colors.muted}Email:${colors.reset}   ${tenant.email}`);
+        console.log(`  ${colors.muted}Plan:${colors.reset}    ${formatPlan(tenant.plan || "starter")}`);
+        console.log();
+        console.log(`  ${colors.info}Run ${colors.accent}moltctl status${colors.reset} to see your dashboard.`);
+        console.log();
+        return;
+      }
+      
+      // Has key but not paid - redirect to checkout
+      console.log();
+      print(`${colors.warning}⚡ Subscription Required${colors.reset}`, colors.bold);
+      console.log();
+      console.log(`  Your account exists but needs an active subscription.`);
+      console.log();
+      
+      const checkoutUrl = `${WEB_URL}/checkout`;
+      print(`Opening checkout in your browser...`, colors.info);
+      console.log();
+      
+      const opened = await openBrowser(checkoutUrl);
+      if (!opened) {
+        console.log(`  ${colors.muted}Could not open browser. Please visit:${colors.reset}`);
+        console.log(`  ${colors.accent}${checkoutUrl}${colors.reset}`);
+      }
+      
+      console.log();
+      console.log(`  ${colors.muted}After subscribing, run ${colors.accent}moltctl status${colors.reset}${colors.muted} to verify.${colors.reset}`);
+      console.log();
+      return;
+    } catch {
+      // Key is invalid, proceed with login flow
+    }
+  }
+  
+  // No key or invalid key - start login flow
+  console.log();
+  print("Welcome to Moltengine!", colors.bold);
+  console.log();
+  console.log(`  Let's get you set up with a secure Moltbot runtime.`);
+  console.log();
+  
+  print("Choose an option:", colors.bold);
+  print("─".repeat(40), colors.muted);
+  console.log(`  ${colors.accent}[1]${colors.reset} Sign up / Subscribe (new users)`);
+  console.log(`  ${colors.accent}[2]${colors.reset} Log in (existing users)`);
+  console.log(`  ${colors.accent}[3]${colors.reset} Enter API key manually`);
+  console.log();
+  
+  const choice = await prompt(`  ${colors.muted}Enter choice (1/2/3):${colors.reset} `);
+  console.log();
+  
+  if (choice === "1") {
+    // New user - go to checkout
+    const checkoutUrl = `${WEB_URL}/checkout`;
+    print("Opening checkout in your browser...", colors.info);
+    
+    const opened = await openBrowser(checkoutUrl);
+    if (!opened) {
+      console.log();
+      console.log(`  ${colors.muted}Could not open browser. Please visit:${colors.reset}`);
+      console.log(`  ${colors.accent}${checkoutUrl}${colors.reset}`);
+    }
+    
+    console.log();
+    print("After checkout:", colors.bold);
+    print("─".repeat(40), colors.muted);
+    console.log(`  1. Complete payment via Stripe`);
+    console.log(`  2. Copy your API key from the success page`);
+    console.log(`  3. Run: ${colors.accent}moltctl login${colors.reset} and choose option 3`);
+    console.log(`     Or set: ${colors.accent}export MOLT_TENANT_KEY="your-key"${colors.reset}`);
+    console.log();
+    
+  } else if (choice === "2") {
+    // Existing user - go to login
+    const loginUrl = `${WEB_URL}/login`;
+    print("Opening login page in your browser...", colors.info);
+    
+    const opened = await openBrowser(loginUrl);
+    if (!opened) {
+      console.log();
+      console.log(`  ${colors.muted}Could not open browser. Please visit:${colors.reset}`);
+      console.log(`  ${colors.accent}${loginUrl}${colors.reset}`);
+    }
+    
+    console.log();
+    print("After login:", colors.bold);
+    print("─".repeat(40), colors.muted);
+    console.log(`  1. Check your email for the magic link`);
+    console.log(`  2. Go to Credentials in your dashboard`);
+    console.log(`  3. Copy your API key`);
+    console.log(`  4. Run: ${colors.accent}moltctl login${colors.reset} and choose option 3`);
+    console.log(`     Or set: ${colors.accent}export MOLT_TENANT_KEY="your-key"${colors.reset}`);
+    console.log();
+    
+  } else if (choice === "3") {
+    // Manual key entry
+    const key = await prompt(`  ${colors.muted}Enter your API key:${colors.reset} `);
+    
+    if (!key) {
+      print("No key entered.", colors.warning);
+      console.log();
+      return;
+    }
+    
+    // Validate the key
+    print("Validating key...", colors.info);
+    
+    try {
+      // Temporarily set the key to validate
+      const response = await request(`${API_URL}/tenant/me`, {
+        method: "GET",
+        headers: {
+          "x-tenant-key": key,
+          "Accept": "application/json"
+        }
+      });
+      
+      const text = await response.body.text();
+      
+      if (response.statusCode >= 400) {
+        print("Invalid API key. Please check and try again.", colors.error);
+        console.log();
+        return;
+      }
+      
+      const tenant = JSON.parse(text);
+      const billingStatus = tenant.billingStatus || tenant.billing_status || tenant.status;
+      
+      console.log();
+      success("API key validated!");
+      console.log();
+      console.log(`  ${colors.muted}Tenant:${colors.reset}  ${tenant.name}`);
+      console.log(`  ${colors.muted}Email:${colors.reset}   ${tenant.email}`);
+      console.log(`  ${colors.muted}Plan:${colors.reset}    ${formatPlan(tenant.plan || "starter")}`);
+      console.log(`  ${colors.muted}Status:${colors.reset}  ${formatStatus(billingStatus)}`);
+      console.log();
+      
+      // Check if payment needed
+      const unpaidStatuses = ['pending', 'incomplete', 'incomplete_expired', 'unpaid'];
+      if (unpaidStatuses.includes(billingStatus?.toLowerCase())) {
+        print(`${colors.warning}⚠ Subscription required${colors.reset}`, colors.bold);
+        console.log();
+        console.log(`  Complete your subscription at: ${colors.accent}${WEB_URL}/checkout${colors.reset}`);
+        console.log();
+      }
+      
+      // Show how to save the key
+      print("Save your key:", colors.bold);
+      print("─".repeat(40), colors.muted);
+      console.log(`  Add to your shell config (~/.bashrc or ~/.zshrc):`);
+      console.log();
+      console.log(`  ${colors.accent}export MOLT_TENANT_KEY="${key}"${colors.reset}`);
+      console.log();
+      console.log(`  Then run: ${colors.accent}source ~/.bashrc${colors.reset}`);
+      console.log();
+      
+    } catch (err) {
+      if (err.code === "ECONNREFUSED") {
+        print(`Cannot connect to API at ${API_URL}`, colors.error);
+      } else {
+        print(`Validation failed: ${err.message}`, colors.error);
+      }
+      console.log();
+    }
+    
+  } else {
+    print("Invalid choice. Please run 'moltctl login' again.", colors.warning);
+    console.log();
+  }
+}
+
+/**
+ * Checkout command - go directly to checkout/subscribe
+ */
+async function cmdCheckout(plan) {
+  console.log(ASCII_LOGO_COMPACT);
+  console.log();
+  
+  // Check if already subscribed
+  if (TENANT_KEY) {
+    try {
+      const tenant = await apiGet("/tenant/me");
+      const billingStatus = tenant.billingStatus || tenant.billing_status || tenant.status;
+      
+      if (billingStatus === "active") {
+        success("You already have an active subscription!");
+        console.log();
+        console.log(`  ${colors.muted}Plan:${colors.reset}    ${formatPlan(tenant.plan || "starter")}`);
+        console.log();
+        console.log(`  ${colors.info}To upgrade, run: ${colors.accent}moltctl upgrade${colors.reset}`);
+        console.log(`  ${colors.info}To manage billing: ${colors.accent}${WEB_URL}/dashboard/subscription${colors.reset}`);
+        console.log();
+        return;
+      }
+    } catch {
+      // Key invalid, proceed to checkout
+    }
+  }
+  
+  print("Plans", colors.bold);
+  print("─".repeat(40), colors.muted);
+  console.log(`  ${colors.accent}starter${colors.reset}     ${PLAN_PRICES.starter}   — 1 agent, all tools, approvals`);
+  console.log(`  ${colors.accent}team${colors.reset}        ${PLAN_PRICES.team}  — 5 agents, approvals`);
+  console.log(`  ${colors.accent}business${colors.reset}    ${PLAN_PRICES.business}  — 25 agents, SIEM, RBAC`);
+  console.log(`  ${colors.accent}enterprise${colors.reset}  ${PLAN_PRICES.enterprise}   — SSO, VPC, compliance`);
+  console.log();
+  
+  // Build checkout URL
+  let checkoutUrl = `${WEB_URL}/checkout`;
+  if (plan && ['starter', 'team', 'business', 'enterprise'].includes(plan.toLowerCase())) {
+    if (plan.toLowerCase() === 'enterprise') {
+      print("Enterprise Plan", colors.bold);
+      print("─".repeat(40), colors.muted);
+      console.log(`  Contact sales for custom pricing and features.`);
+      console.log();
+      console.log(`  ${colors.info}→ Email: ${colors.accent}sales@mg.moltengine.com${colors.reset}`);
+      console.log();
+      return;
+    }
+    checkoutUrl += `?plan=${plan.toLowerCase()}`;
+    print(`Opening checkout for ${plan} plan...`, colors.info);
+  } else if (plan) {
+    print(`Unknown plan: ${plan}. Opening general checkout...`, colors.warning);
+  } else {
+    print("Opening checkout in your browser...", colors.info);
+  }
+  
+  const opened = await openBrowser(checkoutUrl);
+  
+  if (!opened) {
+    console.log();
+    console.log(`  ${colors.muted}Could not open browser. Please visit:${colors.reset}`);
+    console.log(`  ${colors.accent}${checkoutUrl}${colors.reset}`);
+  }
+  
+  console.log();
+  print("Next steps:", colors.bold);
+  print("─".repeat(40), colors.muted);
+  console.log(`  1. Complete checkout via Stripe`);
+  console.log(`  2. Copy your API key from the success page`);
+  console.log(`  3. Set your environment variable:`);
+  console.log(`     ${colors.accent}export MOLT_TENANT_KEY="your-key"${colors.reset}`);
+  console.log(`  4. Run ${colors.accent}moltctl status${colors.reset} to verify`);
+  console.log();
+}
+
 /**
  * Display help with branding
  */
@@ -282,6 +664,11 @@ function showHelp() {
   console.log(`  ${colors.primary}moltctl${colors.reset} <command> [options]`);
   console.log();
   
+  print("GETTING STARTED", colors.bold);
+  console.log(`  ${colors.accent}login${colors.reset}        Authenticate and get your API key`);
+  console.log(`  ${colors.accent}checkout${colors.reset}     Subscribe to a plan (opens browser)`);
+  console.log();
+  
   print("COMMANDS", colors.bold);
   console.log(`  ${colors.accent}status${colors.reset}       Show status, usage, and pending approvals`);
   console.log(`  ${colors.accent}whoami${colors.reset}       Show current tenant and plan information`);
@@ -289,11 +676,19 @@ function showHelp() {
   console.log(`  ${colors.accent}approvals${colors.reset}    List and manage pending approvals`);
   console.log(`  ${colors.accent}deployments${colors.reset}  List recent deployments`);
   console.log(`  ${colors.accent}upgrade${colors.reset}      Upgrade to a higher plan`);
-  console.log(`  ${colors.accent}audit${colors.reset}        Search and export audit logs (Team+)`);
-  console.log(`  ${colors.accent}policies${colors.reset}     Manage security policies (Team+)`);
+  console.log(`  ${colors.accent}audit${colors.reset}        Search and export audit logs`);
+  console.log(`  ${colors.accent}policies${colors.reset}     Manage security policies`);
   console.log(`  ${colors.accent}help${colors.reset}         Show this help message`);
   console.log();
   
+  print("QUICK START", colors.bold);
+  console.log(`  ${colors.muted}# New user? Start here:${colors.reset}`);
+  console.log(`  ${colors.primary}moltctl${colors.reset} login`);
+  console.log();
+  console.log(`  ${colors.muted}# Or go directly to checkout:${colors.reset}`);
+  console.log(`  ${colors.primary}moltctl${colors.reset} checkout starter`);
+  console.log();
+  
   print("APPROVALS", colors.bold);
   console.log(`  ${colors.primary}moltctl${colors.reset} approvals list           List pending approvals`);
   console.log(`  ${colors.primary}moltctl${colors.reset} approvals approve <id>   Approve a pending action`);
@@ -302,19 +697,7 @@ function showHelp() {
   
   print("ENVIRONMENT", colors.bold);
   console.log(`  ${colors.muted}MOLTENGINE_API${colors.reset}   API URL (default: http://localhost:8080)`);
-  console.log(`  ${colors.muted}MOLT_TENANT_KEY${colors.reset}  Your tenant API key (required)`);
-  console.log();
-  
-  print("EXAMPLES", colors.bold);
-  console.log(`  ${colors.muted}# Set up environment${colors.reset}`);
-  console.log(`  export MOLTENGINE_API="https://api.moltengine.com"`);
-  console.log(`  export MOLT_TENANT_KEY="your-tenant-key-here"`);
-  console.log();
-  console.log(`  ${colors.muted}# Check status and pending approvals${colors.reset}`);
-  console.log(`  ${colors.primary}moltctl${colors.reset} status`);
-  console.log();
-  console.log(`  ${colors.muted}# Approve a pending action${colors.reset}`);
-  console.log(`  ${colors.primary}moltctl${colors.reset} approvals approve 1`);
+  console.log(`  ${colors.muted}MOLT_TENANT_KEY${colors.reset}  Your tenant API key (from checkout)`);
   console.log();
 }
 
@@ -324,6 +707,11 @@ function showHelp() {
 async function cmdWhoami() {
   const data = await apiGet("/tenant/me");
   
+  // Check if payment is required
+  if (checkPaymentRequired(data)) {
+    return;
+  }
+  
   printHeader("Tenant Information");
   console.log(`  ${colors.muted}ID:${colors.reset}       ${data.tenantId}`);
   console.log(`  ${colors.muted}Name:${colors.reset}     ${data.name}`);
@@ -362,9 +750,16 @@ async function cmdWhoami() {
  * Show tenant status with usage and approvals/blocked actions
  */
 async function cmdStatus() {
-  // Fetch tenant info, usage, and limits in parallel
-  const [tenant, usage, limits] = await Promise.all([
-    apiGet("/tenant/me"),
+  // Fetch tenant info first to check payment status
+  const tenant = await apiGet("/tenant/me");
+  
+  // Check if payment is required
+  if (checkPaymentRequired(tenant)) {
+    return;
+  }
+  
+  // Fetch usage and limits in parallel
+  const [usage, limits] = await Promise.all([
     apiGet("/tenant/usage").catch(() => ({ runs: 0, events: 0, agents: 0 })),
     apiGet("/tenant/limits").catch(() => ({ runs: 100, events: 1000, agents: 1 }))
   ]);
@@ -387,16 +782,14 @@ async function cmdStatus() {
   }
   
   const plan = tenant.plan || "starter";
-  const hasApprovals = plan !== "starter";
+  // All plans have approvals
   
   // Print logo
   console.log(ASCII_LOGO_COMPACT);
   
   // Tenant Status section
   printHeader("Tenant Status");
-  const planDisplay = plan === "starter" 
-    ? `Starter (${PLAN_PRICES.starter}) — ${colors.warning}Safe Mode${colors.reset}`
-    : `${plan.charAt(0).toUpperCase() + plan.slice(1)} (${PLAN_PRICES[plan] || ""})`;
+  const planDisplay = `${plan.charAt(0).toUpperCase() + plan.slice(1)} (${PLAN_PRICES[plan] || ""})`;
   console.log(`  ${colors.muted}Plan:${colors.reset}     ${planDisplay}`);
   
   const statusIcon = tenant.status === "active" ? "●" : "○";
@@ -424,67 +817,38 @@ async function cmdStatus() {
   const runsPct = limits.runs > 0 ? (usage.runs / limits.runs) * 100 : 0;
   const eventsPct = limits.events > 0 ? (usage.events / limits.events) * 100 : 0;
   
-  // Approvals section (for Team+ plans)
-  if (hasApprovals) {
-    const pendingApprovals = approvals.filter(a => a.status === "pending");
-    const pendingCount = pendingApprovals.length;
-    
-    console.log();
-    if (pendingCount > 0) {
-      print(`Approvals                           ${colors.warning}⚠ ${pendingCount} pending${colors.reset}`, colors.bold);
-    } else {
-      print(`Approvals                           ${colors.success}✓ none pending${colors.reset}`, colors.bold);
-    }
-    print("─".repeat(40), colors.muted);
-    
-    if (pendingCount > 0) {
-      // Show up to 5 pending approvals
-      const toShow = pendingApprovals.slice(0, 5);
-      for (let i = 0; i < toShow.length; i++) {
-        const a = toShow[i];
-        const actionType = (a.action_type || "ACTION").toUpperCase().padEnd(5);
-        const target = truncate(a.action_path || a.description || "unknown", 28);
-        const time = formatRelativeTime(a.created_at);
-        console.log(`  ${colors.muted}[${i + 1}]${colors.reset} ${actionType} ${target.padEnd(28)} ${colors.muted}${time}${colors.reset}`);
-      }
-      
-      if (pendingCount > 5) {
-        console.log(`  ${colors.muted}... and ${pendingCount - 5} more${colors.reset}`);
-      }
-      
-      console.log();
-      console.log(`  ${colors.info}→ moltctl approvals approve <id>${colors.reset}`);
-      console.log(`  ${colors.info}→ moltctl approvals list --all${colors.reset}`);
-    } else {
-      console.log(`  ${colors.muted}No actions waiting for approval${colors.reset}`);
-    }
+  // Approvals section (available on all plans)
+  const pendingApprovals = approvals.filter(a => a.status === "pending");
+  const pendingCount = pendingApprovals.length;
+  
+  console.log();
+  if (pendingCount > 0) {
+    print(`Approvals                           ${colors.warning}⚠ ${pendingCount} pending${colors.reset}`, colors.bold);
   } else {
-    // Starter plan - show blocked actions
-    const blockedCount = blockedActions.length || 0;
-    const todayBlocked = usage.blocked_today || blockedCount || 0;
-    
-    console.log();
-    if (todayBlocked > 0) {
-      print(`Blocked Today                       ${colors.error}⛔ ${todayBlocked} actions${colors.reset}`, colors.bold);
-    } else {
-      print(`Blocked Today                       ${colors.success}✓ none${colors.reset}`, colors.bold);
+    print(`Approvals                           ${colors.success}✓ none pending${colors.reset}`, colors.bold);
+  }
+  print("─".repeat(40), colors.muted);
+  
+  if (pendingCount > 0) {
+    // Show up to 5 pending approvals
+    const toShow = pendingApprovals.slice(0, 5);
+    for (let i = 0; i < toShow.length; i++) {
+      const a = toShow[i];
+      const actionType = (a.action_type || "ACTION").toUpperCase().padEnd(5);
+      const target = truncate(a.action_path || a.description || "unknown", 28);
+      const time = formatRelativeTime(a.created_at);
+      console.log(`  ${colors.muted}[${i + 1}]${colors.reset} ${actionType} ${target.padEnd(28)} ${colors.muted}${time}${colors.reset}`);
     }
-    print("─".repeat(40), colors.muted);
     
-    if (todayBlocked > 0 && blockedActions.length > 0) {
-      // Show recent blocked actions
-      const toShow = blockedActions.slice(0, 3);
-      for (const b of toShow) {
-        const actionType = (b.action_type || "ACTION").toUpperCase().padEnd(5);
-        const target = truncate(b.action_path || b.description || "unknown", 28);
-        const time = formatRelativeTime(b.created_at);
-        console.log(`  ${actionType} ${target.padEnd(28)} ${colors.muted}${time}${colors.reset}`);
-      }
-      console.log();
+    if (pendingCount > 5) {
+      console.log(`  ${colors.muted}... and ${pendingCount - 5} more${colors.reset}`);
     }
     
-    console.log(`  ${colors.muted}Risky actions are blocked in Safe Mode.${colors.reset}`);
-    console.log(`  ${colors.info}→ Upgrade to enable approvals: ${colors.accent}moltctl upgrade team${colors.reset}`);
+    console.log();
+    console.log(`  ${colors.info}→ moltctl approvals approve <id>${colors.reset}`);
+    console.log(`  ${colors.info}→ moltctl approvals list --all${colors.reset}`);
+  } else {
+    console.log(`  ${colors.muted}No high-risk actions waiting for approval${colors.reset}`);
   }
   
   // Show warning if approaching limits
@@ -514,6 +878,12 @@ function truncate(str, len) {
  * List recent deployments
  */
 async function cmdDeployments() {
+  // First check payment status
+  const tenant = await apiGet("/tenant/me");
+  if (checkPaymentRequired(tenant)) {
+    return;
+  }
+  
   const data = await apiGet("/tenant/deployments");
   
   printHeader("Recent Deployments");
@@ -540,8 +910,15 @@ async function cmdDeployments() {
  * Show detailed usage vs plan limits
  */
 async function cmdUsage() {
-  const [tenant, usage, limits] = await Promise.all([
-    apiGet("/tenant/me"),
+  // Fetch tenant info first to check payment status
+  const tenant = await apiGet("/tenant/me");
+  
+  // Check if payment is required
+  if (checkPaymentRequired(tenant)) {
+    return;
+  }
+  
+  const [usage, limits] = await Promise.all([
     apiGet("/tenant/usage").catch(() => ({ runs: 0, events: 0, agents: 0, approvals: 0 })),
     apiGet("/tenant/limits").catch(() => ({ runs: 100, events: 1000, agents: 1, approvals: 0, retention_days: 7 }))
   ]);
@@ -587,12 +964,41 @@ async function cmdUsage() {
  */
 async function cmdUpgrade(targetPlan) {
   const tenant = await apiGet("/tenant/me");
+  
+  // Check if payment is required - but allow showing upgrade options for unpaid users
+  const billingStatus = tenant.billingStatus || tenant.billing_status || tenant.status;
+  const unpaidStatuses = ['pending', 'incomplete', 'incomplete_expired', 'unpaid'];
+  
+  if (unpaidStatuses.includes(billingStatus?.toLowerCase())) {
+    // User hasn't subscribed yet - redirect to checkout
+    console.log(ASCII_LOGO_COMPACT);
+    console.log();
+    print(`${colors.warning}⚡ Subscription Required${colors.reset}`, colors.bold);
+    console.log();
+    console.log(`  You need an active subscription to use Moltengine.`);
+    console.log();
+    print("Choose a Plan", colors.bold);
+    print("─".repeat(40), colors.muted);
+    console.log(`  ${colors.accent}Starter${colors.reset}    ${PLAN_PRICES.starter}   — 1 agent, all tools, approvals`);
+    console.log(`  ${colors.accent}Team${colors.reset}       ${PLAN_PRICES.team}  — 5 agents, approvals`);
+    console.log(`  ${colors.accent}Business${colors.reset}   ${PLAN_PRICES.business}  — 25 agents, SIEM, RBAC`);
+    console.log(`  ${colors.accent}Enterprise${colors.reset} ${PLAN_PRICES.enterprise}   — SSO, VPC, compliance`);
+    console.log();
+    
+    const checkoutUrl = targetPlan 
+      ? `${WEB_URL}/checkout?plan=${targetPlan}` 
+      : `${WEB_URL}/checkout`;
+    print(`${colors.info}→ Subscribe now: ${colors.accent}${checkoutUrl}${colors.reset}`, colors.bold);
+    console.log();
+    return;
+  }
+  
   const currentPlan = tenant.plan || "starter";
   
   console.log(ASCII_LOGO_COMPACT);
   
   const plans = [
-    { id: "starter", price: "$49/mo", agents: 1, runs: "100/day", highlight: "Safe Mode" },
+    { id: "starter", price: "$49/mo", agents: 1, runs: "100/day", highlight: "All Tools" },
     { id: "team", price: "$299/mo", agents: 5, runs: "1,000/day", highlight: "Human-in-the-loop approvals" },
     { id: "business", price: "$999/mo", agents: 25, runs: "10,000/day", highlight: "SIEM export, RBAC" },
     { id: "enterprise", price: "Custom", agents: 100, runs: "100,000/day", highlight: "SSO, VPC, compliance" }
@@ -663,31 +1069,18 @@ async function cmdUpgrade(targetPlan) {
 
 /**
  * Approvals command - list, approve, or deny pending approvals
+ * Available on all plans (required for high-risk actions)
  */
 async function cmdApprovals(subcommand, id) {
   const tenant = await apiGet("/tenant/me");
-  const plan = tenant.plan || "starter";
   
-  // Check if plan supports approvals
-  if (plan === "starter") {
-    console.log(ASCII_LOGO_COMPACT);
-    console.log();
-    print(`${colors.error}⛔ Approvals require Team plan or higher${colors.reset}`, colors.bold);
-    console.log();
-    console.log(`  Your current plan (Starter) runs in Safe Mode where`);
-    console.log(`  risky actions are automatically blocked.`);
-    console.log();
-    console.log(`  ${colors.info}Team plan includes:${colors.reset}`);
-    console.log(`  • Human-in-the-loop approvals`);
-    console.log(`  • Audit log search & export`);
-    console.log(`  • Policy editor`);
-    console.log(`  • Email alerts`);
-    console.log();
-    console.log(`  ${colors.info}→ Upgrade: ${colors.accent}moltctl upgrade team${colors.reset}`);
-    console.log();
+  // Check if payment is required
+  if (checkPaymentRequired(tenant)) {
     return;
   }
   
+  // Approvals available on all plans
+  
   // Handle subcommands
   switch (subcommand) {
     case "list":
@@ -779,30 +1172,19 @@ async function denyAction(id) {
 }
 
 /**
- * Audit command - search and export audit logs (Team+ only)
+ * Audit command - search and export audit logs
+ * Available on all plans
  */
 async function cmdAudit(subcommand, ...args) {
   const tenant = await apiGet("/tenant/me");
-  const plan = tenant.plan || "starter";
   
-  if (plan === "starter") {
-    console.log(ASCII_LOGO_COMPACT);
-    console.log();
-    print(`${colors.error}⛔ Audit search requires Team plan or higher${colors.reset}`, colors.bold);
-    console.log();
-    console.log(`  Your current plan (Starter) stores audit logs but`);
-    console.log(`  search and export require an upgrade.`);
-    console.log();
-    console.log(`  ${colors.info}Team plan includes:${colors.reset}`);
-    console.log(`  • Audit log search`);
-    console.log(`  • CSV/JSON export`);
-    console.log(`  • 90-day retention (vs 7 days)`);
-    console.log();
-    console.log(`  ${colors.info}→ Upgrade: ${colors.accent}moltctl upgrade team${colors.reset}`);
-    console.log();
+  // Check if payment is required
+  if (checkPaymentRequired(tenant)) {
     return;
   }
   
+  // Audit available on all plans
+  
   // Handle subcommands
   switch (subcommand) {
     case "search":
@@ -939,30 +1321,19 @@ async function auditStats() {
 }
 
 /**
- * Policies command - manage security policies (Team+ only)
+ * Policies command - manage security policies
+ * Available on all plans
  */
 async function cmdPolicies(subcommand, ...args) {
   const tenant = await apiGet("/tenant/me");
-  const plan = tenant.plan || "starter";
   
-  if (plan === "starter") {
-    console.log(ASCII_LOGO_COMPACT);
-    console.log();
-    print(`${colors.error}⛔ Policy editor requires Team plan or higher${colors.reset}`, colors.bold);
-    console.log();
-    console.log(`  Your current plan (Starter) uses default security`);
-    console.log(`  policies. Custom policies require an upgrade.`);
-    console.log();
-    console.log(`  ${colors.info}Team plan includes:${colors.reset}`);
-    console.log(`  • Tool allowlist/blocklist`);
-    console.log(`  • Network domain policies`);
-    console.log(`  • Filesystem access rules`);
-    console.log();
-    console.log(`  ${colors.info}→ Upgrade: ${colors.accent}moltctl upgrade team${colors.reset}`);
-    console.log();
+  // Check if payment is required
+  if (checkPaymentRequired(tenant)) {
     return;
   }
   
+  // Policy editor available on all plans
+  
   // Handle subcommands
   switch (subcommand) {
     case "list":
@@ -1008,9 +1379,9 @@ async function policiesList() {
       console.log(`  ${colors.muted}Using secure defaults${colors.reset}`);
       console.log();
       console.log(`  ${colors.info}Default policy:${colors.reset}`);
-      console.log(`  • Dangerous tools blocked (shell, browser)`);
+      console.log(`  • All tools available (high-risk actions require approval)`);
       console.log(`  • Network requests allowed (except blocked domains)`);
-      console.log(`  • Filesystem writes restricted to /data/*, /exports/*`);
+      console.log(`  • Sandboxing enabled by default (user-configurable)`);
       console.log();
       return;
     }
@@ -1219,6 +1590,12 @@ async function policiesBlockDomain(domain) {
  */
 async function cmdExport(subcommand, ...args) {
   const tenant = await apiGet("/tenant/me");
+  
+  // Check if payment is required
+  if (checkPaymentRequired(tenant)) {
+    return;
+  }
+  
   const plan = tenant.plan || "starter";
   
   if (plan === "starter" || plan === "team") {
@@ -1410,6 +1787,12 @@ async function exportHistory(configId) {
  */
 async function cmdUsers(subcommand, ...args) {
   const tenant = await apiGet("/tenant/me");
+  
+  // Check if payment is required
+  if (checkPaymentRequired(tenant)) {
+    return;
+  }
+  
   const plan = tenant.plan || "starter";
   
   if (plan === "starter" || plan === "team") {
@@ -1551,6 +1934,12 @@ async function usersRemove(userId) {
  */
 async function cmdEnv(subcommand, ...args) {
   const tenant = await apiGet("/tenant/me");
+  
+  // Check if payment is required
+  if (checkPaymentRequired(tenant)) {
+    return;
+  }
+  
   const plan = tenant.plan || "starter";
   
   if (plan === "starter" || plan === "team") {
@@ -1702,6 +2091,15 @@ async function main() {
   console.log();
   
   switch (command) {
+    case "login":
+      await cmdLogin();
+      break;
+      
+    case "checkout":
+    case "subscribe":
+      await cmdCheckout(args[0]);
+      break;
+      
     case "whoami":
       await cmdWhoami();
       break;