vexp-cli 2.0.14 → 2.0.15

package/dist/license.js

@@ -143,13 +143,21 @@ function clearDeviceBlocked() {
  * exactly as before. This MUST never throw.
  */
 export async function tryOnlineRefresh(longJwt) {
-    // Rate limit: at most one network call per REFRESH_BACKOFF_MS
-    const last = readLastCheck();
-    if (Date.now() - last < REFRESH_BACKOFF_MS)
-        return;
     // Global kill switch for users who want to stay fully offline
     if (process.env.VEXP_OFFLINE === "1")
         return;
+    // Rate limit: at most one network call per REFRESH_BACKOFF_MS,
+    // UNLESS the long JWT is within the last 7 days of validity.
+    // That window is where expiry is imminent — bypass backoff so any
+    // CLI invocation in the danger zone attempts a refresh.
+    const last = readLastCheck();
+    const longClaims = verifyAndDecode(longJwt);
+    const nearExpiryMs = 7 * 24 * 60 * 60 * 1000;
+    const nearExpiry = longClaims
+        ? longClaims.exp * 1000 - Date.now() < nearExpiryMs
+        : false;
+    if (!nearExpiry && Date.now() - last < REFRESH_BACKOFF_MS)
+        return;
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), VALIDATE_TIMEOUT_MS);
     try {
@@ -309,7 +317,8 @@ export function readLicenseLimits() {
     if (!longJwt)
         return FREE_LIMITS;
     const longClaims = verifyAndDecode(longJwt);
-    if (!longClaims || longClaims.exp * 1000 < Date.now()) {
+    // Signature-invalid long JWT is fatal — nothing the server can do.
+    if (!longClaims) {
         return FREE_LIMITS;
     }
     // Device cap enforcement: if this machine is over-cap, the server told
@@ -319,7 +328,9 @@ export function readLicenseLimits() {
         return FREE_LIMITS;
     }
     // Fire-and-forget opportunistic refresh. Never awaited — we do not block
-    // CLI startup on the network.
+    // CLI startup on the network. We send the long JWT *even if it's already
+    // past `exp`*, because the server (Fix 3) accepts expired JWTs and
+    // re-issues freshTokens as long as the Stripe subscription (`pe`) holds.
     void tryOnlineRefresh(longJwt);
     // Prefer a still-valid freshToken within the grace window
     const fresh = loadFreshToken();
@@ -332,5 +343,11 @@ export function readLicenseLimits() {
         // grace window → server is unreachable for too long. Fall back to the
         // long JWT (keeps working as today, no downgrade to free).
     }
+    // No usable fresh token. If the long JWT itself has expired, we have
+    // nothing left to authenticate with → free tier. (The refresh fired
+    // above will populate fresh.jwt asynchronously for the next call.)
+    if (longClaims.exp * 1000 < Date.now()) {
+        return FREE_LIMITS;
+    }
     return claimsToLimits(longClaims);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vexp-cli",
-  "version": "2.0.14",
+  "version": "2.0.15",
   "description": "Vexp — Context Engine for AI Coding Agents. Pre-indexes your codebase into a dependency graph and delivers ranked context to any MCP-compatible agent. 58% lower cost per task, 90% fewer tool calls (SWE-bench Verified). Works with Claude Code, Cursor, Copilot, Windsurf, Codex, Cline, Aider, and 12+ agents. Local-first. Your code never leaves your machine.",
   "type": "module",
   "bin": {
@@ -99,10 +99,10 @@
     "node": ">=20.0.0"
   },
   "optionalDependencies": {
-    "@vexp/core-linux-x64": "2.0.14",
-    "@vexp/core-linux-arm64": "2.0.14",
-    "@vexp/core-darwin-x64": "2.0.14",
-    "@vexp/core-darwin-arm64": "2.0.14",
-    "@vexp/core-win32-x64": "2.0.14"
+    "@vexp/core-linux-x64": "2.0.15",
+    "@vexp/core-linux-arm64": "2.0.15",
+    "@vexp/core-darwin-x64": "2.0.15",
+    "@vexp/core-darwin-arm64": "2.0.15",
+    "@vexp/core-win32-x64": "2.0.15"
   }
 }