vexp-cli 2.0.13 → 2.0.15

package/dist/autostart.js

@@ -251,12 +251,17 @@ function installWindowsStartup() {
     fs.mkdirSync(path.dirname(p), { recursive: true });
     const logPath = path.join(homedir(), ".vexp", "autostart.log");
     fs.mkdirSync(path.dirname(logPath), { recursive: true });
-    const cmdParts = [launcher.bin, ...launcher.args]
-        .map((a) => `""${a.replace(/"/g, '\\"')}""`)
-        .join(" ");
+    // Two-context escaping: cmd.exe and VBScript both quote-double, but the
+    // contexts nest. Build the cmd string first, then wrap it as a VBScript
+    // string literal. /d /s /c forces legacy single-strip quote semantics so
+    // the outer `cmd ... "<inner>"` survives intact.
+    const quoteCmdArg = (a) => `"${a.replace(/"/g, '""')}"`;
+    const vbString = (s) => `"${s.replace(/"/g, '""')}"`;
+    const cmdParts = [launcher.bin, ...launcher.args].map(quoteCmdArg).join(" ");
+    const command = `%ComSpec% /d /s /c "${cmdParts} >> ${quoteCmdArg(logPath)} 2>&1"`;
     const script = `' vexp autostart — launches \`vexp serve\` hidden at login.\n` +
         `Set sh = CreateObject("WScript.Shell")\n` +
-        `sh.Run "cmd /c " & ${JSON.stringify(cmdParts)} & " >> ""${logPath.replace(/\\/g, "\\\\")}"" 2>&1", 0, False\n`;
+        `sh.Run ${vbString(command)}, 0, False\n`;
     fs.writeFileSync(p, script);
     return { installed: true, mechanism: "windows-startup", path: p };
 }
@@ -318,6 +323,21 @@ export function uninstallAutostart() {
 export function installAutostartIfNeeded() {
     if (process.env.VEXP_NO_AUTOSTART_INSTALL === "1")
         return;
+    // 2.0.12 shipped a broken Windows VBS template; rewrite any existing
+    // file matching that signature regardless of marker state, so upgraded
+    // users get fixed without manual autostart uninstall/install.
+    if (process.platform === "win32") {
+        try {
+            const p = windowsStartupPath();
+            if (fs.existsSync(p)) {
+                const existing = fs.readFileSync(p, "utf-8");
+                if (/sh\.Run\s+"cmd \/c "\s*&/.test(existing)) {
+                    installWindowsStartup();
+                }
+            }
+        }
+        catch { /* non-fatal */ }
+    }
     const marker = installMarkerPath();
     if (fs.existsSync(marker))
         return;

package/dist/license.js

@@ -143,13 +143,21 @@ function clearDeviceBlocked() {
  * exactly as before. This MUST never throw.
  */
 export async function tryOnlineRefresh(longJwt) {
-    // Rate limit: at most one network call per REFRESH_BACKOFF_MS
-    const last = readLastCheck();
-    if (Date.now() - last < REFRESH_BACKOFF_MS)
-        return;
     // Global kill switch for users who want to stay fully offline
     if (process.env.VEXP_OFFLINE === "1")
         return;
+    // Rate limit: at most one network call per REFRESH_BACKOFF_MS,
+    // UNLESS the long JWT is within the last 7 days of validity.
+    // That window is where expiry is imminent — bypass backoff so any
+    // CLI invocation in the danger zone attempts a refresh.
+    const last = readLastCheck();
+    const longClaims = verifyAndDecode(longJwt);
+    const nearExpiryMs = 7 * 24 * 60 * 60 * 1000;
+    const nearExpiry = longClaims
+        ? longClaims.exp * 1000 - Date.now() < nearExpiryMs
+        : false;
+    if (!nearExpiry && Date.now() - last < REFRESH_BACKOFF_MS)
+        return;
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), VALIDATE_TIMEOUT_MS);
     try {
@@ -309,7 +317,8 @@ export function readLicenseLimits() {
     if (!longJwt)
         return FREE_LIMITS;
     const longClaims = verifyAndDecode(longJwt);
-    if (!longClaims || longClaims.exp * 1000 < Date.now()) {
+    // Signature-invalid long JWT is fatal — nothing the server can do.
+    if (!longClaims) {
         return FREE_LIMITS;
     }
     // Device cap enforcement: if this machine is over-cap, the server told
@@ -319,7 +328,9 @@ export function readLicenseLimits() {
         return FREE_LIMITS;
     }
     // Fire-and-forget opportunistic refresh. Never awaited — we do not block
-    // CLI startup on the network.
+    // CLI startup on the network. We send the long JWT *even if it's already
+    // past `exp`*, because the server (Fix 3) accepts expired JWTs and
+    // re-issues freshTokens as long as the Stripe subscription (`pe`) holds.
     void tryOnlineRefresh(longJwt);
     // Prefer a still-valid freshToken within the grace window
     const fresh = loadFreshToken();
@@ -332,5 +343,11 @@ export function readLicenseLimits() {
         // grace window → server is unreachable for too long. Fall back to the
         // long JWT (keeps working as today, no downgrade to free).
     }
+    // No usable fresh token. If the long JWT itself has expired, we have
+    // nothing left to authenticate with → free tier. (The refresh fired
+    // above will populate fresh.jwt asynchronously for the next call.)
+    if (longClaims.exp * 1000 < Date.now()) {
+        return FREE_LIMITS;
+    }
     return claimsToLimits(longClaims);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vexp-cli",
-  "version": "2.0.13",
+  "version": "2.0.15",
   "description": "Vexp — Context Engine for AI Coding Agents. Pre-indexes your codebase into a dependency graph and delivers ranked context to any MCP-compatible agent. 58% lower cost per task, 90% fewer tool calls (SWE-bench Verified). Works with Claude Code, Cursor, Copilot, Windsurf, Codex, Cline, Aider, and 12+ agents. Local-first. Your code never leaves your machine.",
   "type": "module",
   "bin": {
@@ -99,10 +99,10 @@
     "node": ">=20.0.0"
   },
   "optionalDependencies": {
-    "@vexp/core-linux-x64": "2.0.13",
-    "@vexp/core-linux-arm64": "2.0.13",
-    "@vexp/core-darwin-x64": "2.0.13",
-    "@vexp/core-darwin-arm64": "2.0.13",
-    "@vexp/core-win32-x64": "2.0.13"
+    "@vexp/core-linux-x64": "2.0.15",
+    "@vexp/core-linux-arm64": "2.0.15",
+    "@vexp/core-darwin-x64": "2.0.15",
+    "@vexp/core-darwin-arm64": "2.0.15",
+    "@vexp/core-win32-x64": "2.0.15"
   }
 }