[longzhi]

Closes #181. Part of second-state/vibebuddy-cloud#16 (ADR-0020, #179).

Based on claude/plan-ui (#188, itself on #178): it uses the plan the daemon reads in #188. Retarget once those merge.

What changes

Daemon.

• relay.rs: the computer's hello carries "session" when signed in (outside the signature). signed_out and plan, as an error at hello or as close 4006/4007, are a new RelayError::Account; close 1013 reads as Refused("unavailable").
• After signed_out or plan the daemon doesn't try the Relay again until the account changes. The account has a counter (relay_chance) that goes up on signing in or out and on each read of the account (sign-in, POST /v1/account/refresh) that finds the Paid plan. A refusal records the counter, and RelayConfig::waits_for_account holds while it hasn't moved; the serial worker skips the Relay meanwhile. A read that still finds Free doesn't count. unavailable backs off as any refusal does now (60 s, doubling to 5 min).
• If the Relay's hourly check refuses an open link, the bridge records the refusal, so the next try waits as well.
• /v1/status gains device.relay_refused (signed_out | plan | unavailable) while the refusal holds, and the status stream pushes when it changes.
• The account is now made before the Relay config in main, so the Relay can read its session.

Apps (Mac and Linux). While the box is away, the Device tab's link section says "Sign in to use the Relay.", "The Relay needs the Paid plan.", or "The Relay can't check the account right now. VibeBuddy tries again later." Strings are in the shared zh-Hans table.

Docs. docs/relay-protocol.md covers hello's session, the three refusals with their close codes and the hourly check, and what the daemon does after each. docs/app.md covers the Device tab text.

Checked

• cargo test --workspace: all pass. New relay tests run against a fake Relay that checks plans:
  • the session is sent, the signature still verifies, and a signed-out daemon sends no session;
  • after plan it waits, a read that finds Free changes nothing, and a read that finds Paid lets the next try link: two connections in all;
  • signed_out waits until sign-out; unavailable doesn't wait and backs off ≥ 60 s;
  • a plan that ends while linked ends the link, and the next try waits;
  • the close codes map as above.
    There's also a Linux status test for the wording.
• cargo clippy --all-targets --workspace: no warnings in the touched files.
• swift build --package-path app and swift run --package-path app SelfTest pass, with a relay_refused decoding check.
• python3 tools/check-localization.py: ok, 335 keys.

Not checked

• "No reconnect loop" is tested at the gate (waits_for_account) and by counting the fake Relay's connections, not by running the serial worker. Its loop scans real serial ports, so it isn't run in tests. The worker change is one condition and one match arm.
• Nothing was tried on staging: no box linked over the Relay with a plan row, and nothing was tried after deleting that row. Neither App was clicked through.
• One try is still made after a daemon restart even when the last answer was a refusal. The refusal isn't persisted, so the Relay's answer just sets it again.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.