vexp-cli 2.6.2 → 2.6.3

package/dist/cli.js

@@ -10,7 +10,7 @@ import { checkbox, confirm } from "@inquirer/prompts";
 import { getBinaryPath, getInstalledVersion, getMcpServerPath, binaryEnv } from "./binary.js";
 import { detectAgents, getAgentList, configureSelectedAgents, resolveAgentName, suggestAgentName, setGuardMode, plannedWrites, takeSkippedConfigs, takeUnreachableTargets } from "./agent-config.js";
 import { CLI_VERSION } from "./version.js";
-import { activateLicense, deactivateLicense, readLicenseLimits, readDeviceBlocked, } from "./license.js";
+import { activateLicense, deactivateLicense, readLicenseLimits, readDeviceBlocked, tryOnlineRefresh, } from "./license.js";
 import { checkForUpdate } from "./update-check.js";
 import { ensureMcpHttpServer, mcpHttpStatus } from "./mcp-supervisor.js";
 import { installAutostart, uninstallAutostart, autostartStatus, migrateClaudeUnpinIfNeeded } from "./autostart.js";
@@ -1057,6 +1057,18 @@ program
         console.log(`  Plan:    ${claims.plan}`);
         console.log(`  Email:   ${claims.sub}`);
         console.log(`  Expires: ${new Date(claims.exp * 1000).toLocaleDateString()}`);
+        // Register this machine NOW, while the user is watching, instead of
+        // whenever a later command happens to fall outside the 24h refresh
+        // window. The dashboard tells people to "open vexp on any machine to
+        // register it" and activating IS that — a tier-4 user read 0 of 10
+        // devices immediately after activating and reasonably thought something
+        // had failed. Best effort by design: the refresh has its own short
+        // timeout and never throws, so an offline activation still succeeds and
+        // simply registers later.
+        try {
+            await tryOnlineRefresh(key.trim());
+        }
+        catch { /* offline or server down: registration happens on a later run */ }
         console.log("");
     }
     catch (err) {
@@ -1076,15 +1088,28 @@ program
     .description("Show current license status")
     .action(() => {
     const limits = readLicenseLimits();
+    // AppSumo lifetime tiers print as the raw internal string ("tier3") with a
+    // "Renews" date one month out — which is the local token's expiry, not the
+    // licence's. It rolls forward by itself on every check-in. A tier-3 buyer
+    // read that as a monthly deadline and re-activated his key by hand every
+    // month for nothing, and he was right to be alarmed by what it said.
+    const ltd = /^tier[1-4]$/.test(limits.plan);
+    const planLabel = ltd
+        ? `Lifetime · Tier ${limits.plan.slice(4)}`
+        : limits.plan;
     console.log(chalk.bold("\nvexp License Status\n"));
-    console.log(`  Plan:      ${limits.plan}`);
+    console.log(`  Plan:      ${planLabel}`);
     if (limits.email)
         console.log(`  Email:     ${limits.email}`);
     console.log(`  Max nodes: ${limits.maxNodes === 0 ? "unlimited" : limits.maxNodes.toLocaleString()}`);
     console.log(`  Max repos: ${limits.maxRepos === 0 ? "unlimited" : limits.maxRepos}`);
     console.log(`  All tools: ${limits.allTools ? "yes" : "no (7/10)"}`);
-    if (limits.renewsAt)
-        console.log(`  Renews:    ${limits.renewsAt.toLocaleDateString()}`);
+    if (limits.renewsAt) {
+        console.log(ltd
+            ? `  Renewal:   none — lifetime licence (local token auto-refreshes, ` +
+                `current one valid to ${limits.renewsAt.toLocaleDateString()})`
+            : `  Renews:    ${limits.renewsAt.toLocaleDateString()}`);
+    }
     const blocked = readDeviceBlocked();
     if (blocked) {
         console.log("");
@@ -1708,14 +1733,20 @@ async function executeCommand(label, rl) {
             // ── License commands ──
             case "status": {
                 const limits = readLicenseLimits();
-                console.log(`    Plan:      ${limits.plan}`);
+                // Same wording as `vexp license`: a lifetime tier must not be shown as
+                // a raw "tier3" with a monthly renewal date it does not have.
+                const ltd = /^tier[1-4]$/.test(limits.plan);
+                console.log(`    Plan:      ${ltd ? `Lifetime · Tier ${limits.plan.slice(4)}` : limits.plan}`);
                 if (limits.email)
                     console.log(`    Email:     ${limits.email}`);
                 console.log(`    Max nodes: ${limits.maxNodes === 0 ? "unlimited" : limits.maxNodes.toLocaleString()}`);
                 console.log(`    Max repos: ${limits.maxRepos === 0 ? "unlimited" : limits.maxRepos}`);
                 console.log(`    All tools: ${limits.allTools ? "yes" : "no (7/10)"}`);
-                if (limits.renewsAt)
-                    console.log(`    Renews:    ${limits.renewsAt.toLocaleDateString()}`);
+                if (limits.renewsAt) {
+                    console.log(ltd
+                        ? `    Renewal:   none — lifetime licence (token auto-refreshes, valid to ${limits.renewsAt.toLocaleDateString()})`
+                        : `    Renews:    ${limits.renewsAt.toLocaleDateString()}`);
+                }
                 break;
             }
             case "activate": {

package/dist/doctor.js

@@ -527,6 +527,93 @@ export async function runDoctor() {
             }
         }
     }
+    // 5b-bis) Codex orientation hook. The section above it reports Codex's MCP
+    // config and stops there, so a Codex user could have half the product wired
+    // and read nothing but [OK]: the tools come from ~/.codex/config.toml, the
+    // per-prompt orientation comes from .codex/hooks.json, and until now only
+    // the first was ever checked. Two users reached that blind spot from
+    // opposite directions in one week — one could not tell whether orientation
+    // was configured, the other could not tell whether it ran.
+    console.log(chalk.bold("\nCodex orientation hook (.codex/hooks.json)"));
+    {
+        const hooksJson = path.join(ws.root, ".codex", "hooks.json");
+        const scriptPath = path.join(ws.root, ".codex", "vexp-hint.sh");
+        const codexMcp = (() => {
+            try {
+                return fs
+                    .readFileSync(path.join(os.homedir(), ".codex", "config.toml"), "utf-8")
+                    .includes("vexp");
+            }
+            catch {
+                return false;
+            }
+        })();
+        let cfg = null;
+        try {
+            cfg = JSON.parse(fs.readFileSync(hooksJson, "utf-8"));
+        }
+        catch { /* absent */ }
+        if (!cfg) {
+            // Only a finding for someone who actually uses Codex here.
+            line(codexMcp ? WARN : OK, codexMcp
+                ? "no .codex/hooks.json, but vexp MCP is configured for Codex — the tools work and the per-prompt orientation was never installed. Run 'vexp setup' here (needs Codex >= 0.129)."
+                : "no .codex/hooks.json (Codex not configured here)");
+        }
+        else {
+            // Two shapes exist in the wild: the installer nests under "hooks", and
+            // files from earlier versions (or edited by hand) carry the event at the
+            // top level. Reading only one of them would leave the other undiagnosable
+            // — and the flat one is what the user who reported this had on disk.
+            const events = (Array.isArray(cfg?.hooks?.UserPromptSubmit)
+                ? cfg.hooks.UserPromptSubmit
+                : Array.isArray(cfg?.UserPromptSubmit)
+                    ? cfg.UserPromptSubmit
+                    : []);
+            const hook = events
+                .flatMap((m) => (Array.isArray(m?.hooks) ? m.hooks : []))
+                .find((h) => typeof h?.command === "string" && h.command.includes("vexp-hint"));
+            if (!hook) {
+                line(WARN, "hooks.json has no vexp UserPromptSubmit entry — re-run 'vexp setup'.");
+            }
+            else if (!fs.existsSync(scriptPath)) {
+                line(BAD, "hooks.json points at .codex/vexp-hint.sh but the script is missing — the hook fails on every prompt.");
+            }
+            else {
+                // Run it. The script bakes an absolute path to the vexp binary and
+                // exits 0 when that path is not executable, so a stale or wrong-profile
+                // path leaves NO trace anywhere: no orientation, no error, forever.
+                // A Windows user found exactly that by reading the generated file.
+                const r = spawnSync(process.platform === "win32" ? "bash" : "sh", ["-c", hook.command], {
+                    env: { ...process.env, CLAUDE_PROJECT_DIR: ws.root },
+                    input: JSON.stringify({ session_id: "vexp-doctor", prompt: "vexp doctor probe", cwd: ws.root }),
+                    timeout: 10000,
+                    encoding: "utf-8",
+                });
+                const baked = (() => {
+                    try {
+                        const m = fs.readFileSync(scriptPath, "utf-8").match(/VEXP_BIN="([^"]+)"/);
+                        return m?.[1];
+                    }
+                    catch {
+                        return undefined;
+                    }
+                })();
+                if (r.error) {
+                    line(BAD, `hook DID NOT RUN: ${r.error.code ?? r.error.message} — orientation is inert. On Windows this usually means bash (Git Bash) is not on PATH.`);
+                }
+                else if (r.status !== 0) {
+                    line(BAD, `hook exited ${r.status}${r.stderr ? ` — ${String(r.stderr).trim().slice(0, 160)}` : ""} — Codex continues without vexp.`);
+                }
+                else if (baked && !fs.existsSync(baked)) {
+                    line(BAD, `hook runs but the binary it points at does not exist: ${baked} — it exits silently on every prompt. Re-run 'vexp setup' as the user that owns this install.`);
+                }
+                else {
+                    const why = String(r.stderr ?? "").trim().replace(/^vexp [\w-]+: /, "");
+                    line(OK, `UserPromptSubmit hook runs${why ? ` (this probe: ${why.slice(0, 120)})` : ""}`);
+                }
+            }
+        }
+    }
     // 5c) Cursor guard hook — same live-execution philosophy as 5b. Cursor's
     // hooks fail OPEN too (`failClosed` defaults to false), so a guard that
     // cannot spawn silently enforces nothing there as well. The guard's stdin

package/dist/license.js

@@ -71,6 +71,15 @@ function readLastCheck() {
         return 0;
     }
 }
+/** Forget when we last checked in, so the next refresh is not throttled. */
+export function clearLastCheck() {
+    try {
+        fs.rmSync(getLastCheckPath(), { force: true });
+    }
+    catch {
+        /* best effort: a stale stamp only delays registration, never breaks it */
+    }
+}
 function writeLastCheck(ts) {
     try {
         fs.mkdirSync(path.dirname(getLastCheckPath()), { recursive: true });
@@ -289,6 +298,14 @@ export function activateLicense(jwt) {
     // leaving it would shadow the just-activated tier until it expired. The next
     // online refresh re-creates fresh.jwt at the new tier.
     removeFreshToken();
+    // Activation is the one moment we KNOW the user is at this machine, so it is
+    // the moment to register it. Clearing the throttle stamp makes the very next
+    // refresh run instead of waiting out the 24h backoff — without it the device
+    // does not appear on the dashboard until some later command happens to fall
+    // outside the window, and the page meanwhile says "Open vexp on any machine
+    // to register it" to someone who just did exactly that. Reported by a tier-4
+    // user whose dashboard read 0 of 10 right after activating.
+    clearLastCheck();
     return claims;
 }
 /** Remove the current license file (and any cached freshToken) */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vexp-cli",
-  "version": "2.6.2",
+  "version": "2.6.3",
   "description": "Local-first context engine for AI coding agents. Pre-indexes your codebase into a dependency graph and feeds any MCP agent only the code that matters — 87% fewer tokens per call. New in 2.5: mechanical work verification and a PII/secret scanner. Works with Claude Code, Cursor, Codex, Copilot, Windsurf, Cline, Aider and 14 agents. Your code never leaves your machine.",
   "type": "module",
   "bin": {
@@ -105,10 +105,10 @@
   },
   "homepage": "https://vexp.dev",
   "optionalDependencies": {
-    "@vexp/core-linux-x64": "2.6.2",
-    "@vexp/core-linux-arm64": "2.6.2",
-    "@vexp/core-darwin-x64": "2.6.2",
-    "@vexp/core-darwin-arm64": "2.6.2",
-    "@vexp/core-win32-x64": "2.6.2"
+    "@vexp/core-linux-x64": "2.6.3",
+    "@vexp/core-linux-arm64": "2.6.3",
+    "@vexp/core-darwin-x64": "2.6.3",
+    "@vexp/core-darwin-arm64": "2.6.3",
+    "@vexp/core-win32-x64": "2.6.3"
   }
 }