vexp-cli 2.0.31 → 2.0.33

package/dist/doctor.js

@@ -102,6 +102,19 @@ export async function runDoctor() {
     const ws = resolveWorkspace();
     console.log(`  cwd: ${process.cwd()}`);
     line(OK, `resolves to: ${ws.root}  (via ${ws.source})`);
+    // A *global* VEXP_WORKSPACE env var overrides the per-session signal
+    // (CLAUDE_PROJECT_DIR) for EVERY agent session, pinning Claude *and* Codex to
+    // one repo's daemon. Agents working in other repos then hit the wrong daemon
+    // and get [] / wrong-repo results from get_skeleton & run_pipeline. The
+    // ~/.claude.json / ~/.codex checks below only catch a pin written into the MCP
+    // *config*; a shell/OS env var is invisible to them — flag it here when it
+    // disagrees with this directory's natural target.
+    if (ws.source === "VEXP_WORKSPACE") {
+        const discovered = discoverWorkspaceRoot(process.cwd());
+        if (discovered.toLowerCase() !== ws.root.toLowerCase()) {
+            line(WARN, `global VEXP_WORKSPACE env var pins this session to ${ws.root}, but this directory's natural target is ${discovered} → agents here get [] / wrong-repo results. Unset the VEXP_WORKSPACE OS/shell env var for per-session targeting.`);
+        }
+    }
     const sock = socketForWorkspace(ws.root);
     const live = await reachable(sock);
     line(live ? OK : WARN, `daemon socket ${live ? "reachable" : "NOT reachable"}: ${sock}`);
@@ -132,6 +145,13 @@ export async function runDoctor() {
         const inReg = entries.some(([r]) => r.toLowerCase() === ws.root.toLowerCase());
         if (!inReg)
             line(WARN, `current workspace (${ws.root}) is NOT registered — a child here could mis-route`);
+        // Multi-daemon + global pin: catches the case the section-1 check misses
+        // (doctor run from the same dir VEXP_WORKSPACE points at). With several
+        // daemons registered, a global VEXP_WORKSPACE still routes EVERY agent
+        // session to just one of them.
+        if (ws.source === "VEXP_WORKSPACE" && entries.length >= 2) {
+            line(WARN, `${entries.length} daemons registered but a global VEXP_WORKSPACE pins EVERY agent session to ${ws.root}; agents in the other repos get [] / wrong-repo results. Unset the global VEXP_WORKSPACE env var.`);
+        }
     }
     // 3) License (fresh.jwt rolling token vs license.jwt).
     console.log(chalk.bold("\nLicense tokens (~/.vexp)"));

package/dist/hook-template.js

@@ -2,19 +2,52 @@
  * Claude Code PreToolUse hook that conditionally blocks Grep/Glob
  * when the vexp daemon is available, falling back to allow them
  * when the daemon is not running.
+ *
+ * Cross-platform: Unix/macOS expose the daemon as a domain socket file
+ * (.vexp/daemon.sock); Windows uses a named pipe with NO socket file, so the
+ * daemon writes a .vexp/daemon.pipe marker instead. The previous template only
+ * checked `[ -S "$SOCK" ]`, which is ALWAYS false on Windows → the hook failed
+ * open and never blocked Grep/Glob there. We now branch on `uname` so each
+ * platform uses the right "daemon is listening" signal. The healthy marker
+ * (removed by the daemon on graceful shutdown) gates both branches.
  */
 export const VEXP_GUARD_HOOK = `#!/bin/bash
-# vexp-guard: block Grep/Glob when vexp daemon is running AND index is healthy.
-# Fast path: if socket file or healthy marker doesn't exist, allow immediately.
-# PID check: verify daemon process is alive (handles stale files after kill -9).
+# vexp-guard: block Grep/Glob/Read when the vexp daemon is running AND healthy.
+# Cross-platform: Unix/macOS use the domain socket file (.vexp/daemon.sock);
+# Windows (Git Bash) has no socket file, so the daemon writes .vexp/daemon.pipe.
 VEXP_DIR="\${CLAUDE_PROJECT_DIR:-.}/.vexp"
 SOCK="$VEXP_DIR/daemon.sock"
+PIPE="$VEXP_DIR/daemon.pipe"
 HEALTHY="$VEXP_DIR/healthy"
 PID_FILE="$VEXP_DIR/daemon.pid"
-if [ -S "$SOCK" ] && [ -f "$HEALTHY" ] && [ -f "$PID_FILE" ] && kill -0 "$(cat "$PID_FILE" 2>/dev/null)" 2>/dev/null; then
-  printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"vexp daemon is running. Use run_pipeline instead of Grep/Glob."}}'
-else
+
+vexp_deny() {
+  printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"vexp daemon is running. Use run_pipeline instead of Grep/Glob/Read."}}'
+  exit 0
+}
+vexp_allow() {
   printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow","permissionDecisionReason":"vexp index not ready, allowing direct search fallback."}}'
-fi
-exit 0
+  exit 0
+}
+
+# Healthy marker is the portable "daemon is up" signal; the daemon removes it on
+# graceful shutdown. Required on every platform — if it's missing, fail open.
+[ -f "$HEALTHY" ] || vexp_allow
+
+case "$(uname -s 2>/dev/null)" in
+  MINGW*|MSYS*|CYGWIN*|Windows*)
+    # Windows: no Unix socket to stat, and \`kill -0\` on a native Windows PID is
+    # unreliable under Git Bash. The pipe marker + healthy marker are the signal.
+    [ -f "$PIPE" ] && vexp_deny
+    vexp_allow
+    ;;
+  *)
+    # Unix/macOS: require the live socket AND a live PID (the PID check catches
+    # stale files left behind after \`kill -9\`).
+    [ -S "$SOCK" ] || vexp_allow
+    [ -f "$PID_FILE" ] || vexp_allow
+    kill -0 "$(cat "$PID_FILE" 2>/dev/null)" 2>/dev/null && vexp_deny
+    vexp_allow
+    ;;
+esac
 `;

package/dist/license.js

@@ -183,6 +183,22 @@ export async function tryOnlineRefresh(longJwt) {
             // Only save if the freshToken itself verifies locally
             if (verifyAndDecode(data.freshToken)) {
                 saveFreshToken(data.freshToken);
+                // The server re-issued a 30-day long token (entitlement changed:
+                // AppSumo tier up/downgrade, or a Stripe resub migration). Overwrite
+                // the on-disk long JWT so the new entitlement survives even fully
+                // offline and the previous one stops working — without the user
+                // re-pasting a key. Only persist if it verifies locally.
+                if (data.newLongToken && verifyAndDecode(data.newLongToken)) {
+                    try {
+                        const licensePath = getLicensePath();
+                        fs.mkdirSync(path.dirname(licensePath), { recursive: true });
+                        fs.writeFileSync(licensePath, data.newLongToken, "utf-8");
+                    }
+                    catch {
+                        // read-only FS: the freshToken still carries the new entitlement
+                        // for this session; we just can't persist the long JWT.
+                    }
+                }
                 writeLastCheck(Date.now());
                 // Any previous device-blocked state is stale once the server issues
                 // a freshToken for us — we are back in a good state.
@@ -257,6 +273,12 @@ export function activateLicense(jwt) {
     const licensePath = getLicensePath();
     fs.mkdirSync(path.dirname(licensePath), { recursive: true });
     fs.writeFileSync(licensePath, jwt, "utf-8");
+    // The freshly activated long JWT is authoritative. Drop any cached
+    // freshToken: it may be a 7-day token minted at the PREVIOUS tier, and both
+    // readLicenseLimits() and the Rust daemon prefer fresh.jwt over license.jwt —
+    // leaving it would shadow the just-activated tier until it expired. The next
+    // online refresh re-creates fresh.jwt at the new tier.
+    removeFreshToken();
     return claims;
 }
 /** Remove the current license file (and any cached freshToken) */