vexp-cli 2.0.32 → 2.1.0

package/dist/license.js

@@ -183,6 +183,22 @@ export async function tryOnlineRefresh(longJwt) {
             // Only save if the freshToken itself verifies locally
             if (verifyAndDecode(data.freshToken)) {
                 saveFreshToken(data.freshToken);
+                // The server re-issued a 30-day long token (entitlement changed:
+                // AppSumo tier up/downgrade, or a Stripe resub migration). Overwrite
+                // the on-disk long JWT so the new entitlement survives even fully
+                // offline and the previous one stops working — without the user
+                // re-pasting a key. Only persist if it verifies locally.
+                if (data.newLongToken && verifyAndDecode(data.newLongToken)) {
+                    try {
+                        const licensePath = getLicensePath();
+                        fs.mkdirSync(path.dirname(licensePath), { recursive: true });
+                        fs.writeFileSync(licensePath, data.newLongToken, "utf-8");
+                    }
+                    catch {
+                        // read-only FS: the freshToken still carries the new entitlement
+                        // for this session; we just can't persist the long JWT.
+                    }
+                }
                 writeLastCheck(Date.now());
                 // Any previous device-blocked state is stale once the server issues
                 // a freshToken for us — we are back in a good state.
@@ -257,6 +273,12 @@ export function activateLicense(jwt) {
     const licensePath = getLicensePath();
     fs.mkdirSync(path.dirname(licensePath), { recursive: true });
     fs.writeFileSync(licensePath, jwt, "utf-8");
+    // The freshly activated long JWT is authoritative. Drop any cached
+    // freshToken: it may be a 7-day token minted at the PREVIOUS tier, and both
+    // readLicenseLimits() and the Rust daemon prefer fresh.jwt over license.jwt —
+    // leaving it would shadow the just-activated tier until it expired. The next
+    // online refresh re-creates fresh.jwt at the new tier.
+    removeFreshToken();
     return claims;
 }
 /** Remove the current license file (and any cached freshToken) */
@@ -297,6 +319,10 @@ function claimsToLimits(claims) {
             return { maxNodes: 100_000, maxRepos: 0, allTools: true, plan: "tier3", email: claims.sub, renewsAt };
         case "tier4":
             return { maxNodes: 0, maxRepos: 0, allTools: true, plan: "tier4", email: claims.sub, renewsAt };
+        // WS-H H5 forward-compat: capacity plans (ent_500/ent_2000/ent_unlimited)
+        // are SERVER-ONLY (the self-hosted SDK gateway). A capacity JWT presented to
+        // the cli/vscode falls through here and fails-closed to FREE — never crashes,
+        // never grants entitlements meant for the server.
         default:
             return FREE_LIMITS;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vexp-cli",
-  "version": "2.0.32",
+  "version": "2.1.0",
   "description": "Vexp — Context Engine for AI Coding Agents. Pre-indexes your codebase into a dependency graph and delivers ranked context to any MCP-compatible agent. 58% lower cost per task, 90% fewer tool calls (SWE-bench Verified). Works with Claude Code, Cursor, Copilot, Windsurf, Codex, Cline, Aider, and 12+ agents. Local-first. Your code never leaves your machine.",
   "type": "module",
   "bin": {
@@ -100,10 +100,10 @@
     "node": ">=20.0.0"
   },
   "optionalDependencies": {
-    "@vexp/core-linux-x64": "2.0.32",
-    "@vexp/core-linux-arm64": "2.0.32",
-    "@vexp/core-darwin-x64": "2.0.32",
-    "@vexp/core-darwin-arm64": "2.0.32",
-    "@vexp/core-win32-x64": "2.0.32"
+    "@vexp/core-linux-x64": "2.1.0",
+    "@vexp/core-linux-arm64": "2.1.0",
+    "@vexp/core-darwin-x64": "2.1.0",
+    "@vexp/core-darwin-arm64": "2.1.0",
+    "@vexp/core-win32-x64": "2.1.0"
   }
 }