whydid 1.0.0 → 1.0.2

package/dist/cli/commands/license.js

@@ -1,10 +1,25 @@
 import { Command } from "commander";
-import { createDefaultLicenseManager, PRICING_URL } from "../../licensing/config.js";
+import { createDefaultLicenseManager } from "../../licensing/config.js";
+import { LicenseClientError } from "../../licensing/license-client.js";
+const SUPPORT_EMAIL = "hello@whydid.dev";
 export async function runLogin(manager, licenseKey) {
     await manager.activate(licenseKey);
 }
 export async function runLogout(manager) {
-    await manager.deactivate();
+    return manager.deactivate();
+}
+/**
+ * Only the device-limit case gets device-management guidance — every other
+ * failure (bad key, network down, server down) showing the same hint was
+ * noise at best and, since there's no self-serve devices page yet, a dead
+ * link at worst. Points to support directly until that page exists.
+ */
+export function formatLoginFailureMessage(err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (err instanceof LicenseClientError && err.code === "MACHINE_LIMIT_REACHED") {
+        return [message, `Already using this license on 2 devices? Email ${SUPPORT_EMAIL} to free up a slot.`];
+    }
+    return [message];
 }
 /** Reads only the locally-stored, already-verified license — no network call, matching whydid's local-first design even for its own status check. */
 export async function runLicenseStatus(manager) {
@@ -23,8 +38,8 @@ export function createLoginCommand() {
             console.log("✓ Activated. Run `whydid license` any time to check status.");
         }
         catch (err) {
-            console.error(err instanceof Error ? err.message : String(err));
-            console.error(`Manage your devices: ${PRICING_URL.replace("/pricing", "/account/devices")}`);
+            for (const line of formatLoginFailureMessage(err))
+                console.error(line);
             process.exitCode = 1;
         }
     });
@@ -34,8 +49,8 @@ export function createLogoutCommand() {
         .description("Deactivate this machine")
         .action(async () => {
         const manager = await createDefaultLicenseManager();
-        await runLogout(manager);
-        console.log("✓ Deactivated this machine.");
+        const wasActivated = await runLogout(manager);
+        console.log(wasActivated ? "✓ Deactivated this machine." : "Nothing was activated on this machine.");
     });
 }
 export function createLicenseCommand() {

package/dist/cli/index.js

@@ -49,8 +49,9 @@ async function main() {
     const program = new Command("whydid").description("A local time machine for AI-assisted coding").version(PACKAGE_VERSION, "-V, --version");
     const rawArg = process.argv[2];
     const commandArg = rawArg === "doctor" ? "recap" : rawArg; // doctor is an alias registered on the recap Command itself
+    const subCommandArg = process.argv[3];
     const { commandNeedsLicense, printLicenseRequiredMessage } = await import("./license-gate.js");
-    if (commandNeedsLicense(commandArg)) {
+    if (commandNeedsLicense(commandArg, subCommandArg)) {
         const { createDefaultLicenseManager } = await import("../licensing/config.js");
         const manager = await createDefaultLicenseManager();
         await manager.refreshIfNeeded().catch(() => undefined); // best-effort, offline-tolerant

package/dist/cli/license-gate.js

@@ -1,13 +1,17 @@
 import { PRICING_URL } from "../licensing/config.js";
 /** Never gated — a customer must be able to authenticate/check status/see this message without already having a valid license. */
 const EXEMPT_COMMANDS = new Set(["login", "logout", "license"]);
-export function commandNeedsLicense(commandArg) {
+/** Stopping or checking an already-running daemon shouldn't require a valid license — only starting new work (or any other command) does. */
+const EXEMPT_DAEMON_SUBCOMMANDS = new Set(["stop", "status"]);
+export function commandNeedsLicense(commandArg, subCommandArg) {
     if (!commandArg)
         return false; // no args -> shows help
     if (commandArg === "--help" || commandArg === "-h")
         return false;
     if (commandArg === "--version" || commandArg === "-V")
         return false;
+    if (commandArg === "daemon" && subCommandArg && EXEMPT_DAEMON_SUBCOMMANDS.has(subCommandArg))
+        return false;
     return !EXEMPT_COMMANDS.has(commandArg);
 }
 export function printLicenseRequiredMessage() {

package/dist/licensing/config.js

@@ -5,13 +5,13 @@ import { HttpLicenseApiClient } from "./license-client.js";
 import { createLicenseStore } from "./license-store.js";
 import { getMachineId } from "./machine-id.js";
 /**
- * PLACEHOLDER until license-server's real production keypair is generated
- * (license-server/scripts/generate-keypair.ts) — replace with the real
- * public key before this ever ships to a real customer. A build/release
- * check should refuse to publish while this constant is unchanged; add
- * that check as part of actual deployment, not covered by this plan.
+ * The real production Ed25519 public key, matching the private key held
+ * only in license-server's deployed .env (LICENSE_ED25519_PRIVATE_KEY) —
+ * generated once via license-server/scripts/generate-keypair.ts. Every
+ * signed license this public key verifies was signed by that exact
+ * deployment; swapping it invalidates every previously-issued license.
  */
-export const PUBLIC_KEY_DER_BASE64 = process.env.WHYDID_LICENSE_PUBLIC_KEY ?? "REPLACE_WITH_REAL_PRODUCTION_PUBLIC_KEY";
+export const PUBLIC_KEY_DER_BASE64 = process.env.WHYDID_LICENSE_PUBLIC_KEY ?? "MCowBQYDK2VwAyEA2CpLqf2+q26q6q1k77bbJZYvQ1otG4E6iY19e+KNogc=";
 export const LICENSE_API_URL = process.env.WHYDID_LICENSE_API_URL ?? "https://license.whydid.dev";
 export const PRICING_URL = "https://whydid.dev/pricing";
 function globalLicenseDir() {

package/dist/licensing/license-manager.js

@@ -58,12 +58,15 @@ export class LicenseManager {
         const signed = await this.apiClient.activate(licenseKey, machineId, this.cached?.dodoInstanceId);
         await this.persist(signed);
     }
+    /** Returns whether anything was actually activated before this call, so the CLI can give an accurate message rather than always reporting success. */
     async deactivate() {
+        const wasActivated = this.cached !== null;
         if (this.cached) {
             await this.apiClient.deactivate(this.cached.licenseId, this.cached.machineId, this.cached.dodoInstanceId).catch(() => undefined);
         }
         await this.store.clear();
         this.cached = null;
+        return wasActivated;
     }
     /** Offline-tolerant by design: a failed refresh (no network) leaves the last-known signed license in place, still valid until the grace period actually runs out. */
     async refreshIfNeeded() {

package/dist/licensing/license-store.js

@@ -3,6 +3,24 @@ import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:
 import { dirname, join } from "node:path";
 const SERVICE_NAME = "whydid-license";
 const ACCOUNT_NAME = "license";
+async function loadRealKeytar() {
+    return import("@napi-rs/keyring/keytar.js");
+}
+/**
+ * The OS keychain prompt (e.g. macOS's "wants to use your confidential
+ * information") asks for the user's own Mac login password, not anything
+ * whydid-specific — but denying/canceling it throws a raw native error
+ * ("User canceled the operation.") straight out of @napi-rs/keyring. Left
+ * unwrapped, that string reaches the user verbatim with no context. This
+ * wraps ANY keychain-access failure (denied, canceled, or an unexpected
+ * platform error) in one clear, actionable message.
+ */
+function wrapKeychainError(err) {
+    const raw = err instanceof Error ? err.message : String(err);
+    return new Error(`whydid couldn't access your saved license in the system keychain (${raw}). ` +
+        `This is asking for your Mac's own login password, not a whydid password — ` +
+        `run the command again and click "Allow" (or "Always Allow") when prompted.`);
+}
 /**
  * OS keychain (macOS Keychain / Windows Credential Manager / Linux Secret
  * Service), via @napi-rs/keyring's keytar-compatible API — the maintained
@@ -12,13 +30,28 @@ const ACCOUNT_NAME = "license";
  * this platform/architecture.
  */
 export class KeychainLicenseStore {
+    loadKeytar;
+    constructor(loadKeytar = loadRealKeytar) {
+        this.loadKeytar = loadKeytar;
+    }
     async save(signed) {
-        const { setPassword } = await import("@napi-rs/keyring/keytar.js");
-        await setPassword(SERVICE_NAME, ACCOUNT_NAME, JSON.stringify(signed));
+        const { setPassword } = await this.loadKeytar();
+        try {
+            await setPassword(SERVICE_NAME, ACCOUNT_NAME, JSON.stringify(signed));
+        }
+        catch (err) {
+            throw wrapKeychainError(err);
+        }
     }
     async load() {
-        const { getPassword } = await import("@napi-rs/keyring/keytar.js");
-        const raw = await getPassword(SERVICE_NAME, ACCOUNT_NAME);
+        const { getPassword } = await this.loadKeytar();
+        let raw;
+        try {
+            raw = await getPassword(SERVICE_NAME, ACCOUNT_NAME);
+        }
+        catch (err) {
+            throw wrapKeychainError(err);
+        }
         if (!raw)
             return null;
         try {
@@ -29,7 +62,7 @@ export class KeychainLicenseStore {
         }
     }
     async clear() {
-        const { deletePassword } = await import("@napi-rs/keyring/keytar.js");
+        const { deletePassword } = await this.loadKeytar();
         await deletePassword(SERVICE_NAME, ACCOUNT_NAME).catch(() => false);
     }
 }

package/dist/watcher/watcher.js

@@ -1,4 +1,5 @@
 import chokidar from "chokidar";
+import { relative as nodeRelative } from "node:path";
 import { createCheckpoint } from "../core/engine.js";
 import { annotateCheckpoint } from "../llm/annotate-checkpoint.js";
 import { updateContextTree } from "../core/context-tree.js";
@@ -6,6 +7,19 @@ import { generateAndSaveSocialPost } from "../llm/social-post.js";
 import { NoopProvider } from "../llm/noop-provider.js";
 import { syncClaudeCodeTurns } from "../adapters/sync-claude-code.js";
 const TURN_POLL_MS = 250;
+/**
+ * Chokidar normalizes the paths it hands to `ignored` to forward slashes on
+ * every platform, but a project root resolved via Node's own path APIs is
+ * OS-native (backslashes on Windows) — a naive string-prefix strip silently
+ * fails to match there, passing the full absolute path straight through to
+ * IgnoreRules, which then throws (the `ignore` package requires a relative
+ * path). `path.relative()` correctly handles drive letters, casing, and
+ * slash style regardless of platform; `relativeImpl` is overridable only so
+ * tests can exercise Windows semantics (`path.win32.relative`) on any host OS.
+ */
+export function toProjectRelativePath(projectRoot, absolutePath, relativeImpl = nodeRelative) {
+    return relativeImpl(projectRoot, absolutePath);
+}
 export class ProjectWatcher {
     ctx;
     projectId;
@@ -90,7 +104,7 @@ export class ProjectWatcher {
         this.pollingMode = usePolling;
         const watcher = chokidar.watch(this.ctx.projectRoot, {
             ignored: (path) => {
-                const rel = path.replace(this.ctx.projectRoot, "").replace(/^[\\/]/, "");
+                const rel = toProjectRelativePath(this.ctx.projectRoot, path);
                 return rel !== "" && this.ctx.ignoreRules.isIgnored(rel);
             },
             ignoreInitial: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whydid",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "type": "module",
   "license": "UNLICENSED",
   "description": "A local-first AI coding time machine — captures meaningful changes, reasoning, and session context so you can see what happened across your coding sessions, even days later.",