Every account gets 1,000 free credits each month, plus 60 free requests per minute. Unused credits carry over.
+ Every account gets 1,000 free credits each month. Unused credits carry over.
Credit balance
—One balance across web, CLI, and agents.
Your plan
Free plan
@@ -309,7 +314,7 @@
Credits & billing
$0per month
1,000 credits each month
No subscription required. Earn more by contributing useful public pages.
-
Includes 60 free requests per minute.
+
Search costs 1 credit, Answer 2, and Research 3.
Paid
Monthly subscription
@@ -326,7 +331,6 @@ Credits & billing
diff --git a/internal/community/web/style.css b/internal/community/web/style.css
index de034bf..533c4a4 100644
--- a/internal/community/web/style.css
+++ b/internal/community/web/style.css
@@ -1268,3 +1268,6 @@ select { -webkit-appearance: none; appearance: none; min-height: 46px; line-heig
.billing-activity dl { grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 22px; margin: 0; }
.activity-heading { align-items: flex-start; flex-direction: column; gap: 4px; }
}
+:root .auth-options { display: flex; flex-direction: column; align-items: center; gap: 4px; margin: 8px 0; }
+:root .auth-options .text-button { min-height: 36px; padding: 8px 12px; font-size: 13px; font-weight: 400; color: var(--muted); }
+:root .auth-options .text-button:hover { color: var(--accent); }
diff --git a/internal/community/webtests/app.test.cjs b/internal/community/webtests/app.test.cjs
index 6a8beae..20e4a4c 100644
--- a/internal/community/webtests/app.test.cjs
+++ b/internal/community/webtests/app.test.cjs
@@ -6,7 +6,7 @@ const vm = require('node:vm');
const fs = require('node:fs');
const path = require('node:path');
const source = fs.readFileSync(path.join(__dirname, '../web/app.js'), 'utf8');
-const policy = {guest_interval_seconds:60, guest:{search:{requests:1, window_seconds:60}},member:{search:{requests:60,window_seconds:60}},member_free_requests_per_minute:60};
+const policy = {guest_interval_seconds:1800, guest:{search:{requests:1, window_seconds:1800},answer:{requests:1,window_seconds:3600},research:{requests:1,window_seconds:5400}},member:{search:{requests:120,window_seconds:60}},member_free_requests_per_minute:0};
const tick = () => new Promise(setImmediate);
function node() {
return {hidden:false, disabled:false, value:'', textContent:'', children:[], dataset:{}, files:[],
@@ -46,6 +46,13 @@ test('logout during search clears private state and permits another search',asyn
assert.equal(a.get('results').children.length,0);
assert.equal(a.get('auth').hidden,false);
});
+test('guest policy explains one shared weighted cooldown', async () => {
+ const a=await app(); a.run('user=null');
+ const loading=a.run('refreshLimits()'); await tick();
+ a.respond('limits',policy); await loading;
+ assert.equal(a.get('guest-policy').textContent,'Shared guest cooldown: Search 30 min · Answer 60 min · Research 90 min. A request pauses all three modes.');
+ assert.equal(a.get('request-limits').textContent,a.get('guest-policy').textContent);
+});
test('late saved response cannot repopulate a logged-out account',async()=>{
const a=await app(); const saved=a.run('refreshSaved()').catch(()=>{}); await tick();
const logout=a.get('logout').onclick(); await tick(); a.respond('logout',{}); await logout;
@@ -232,3 +239,48 @@ test('logout prevents a delayed billing portal response from navigating', async
a.respond('payments/portal',{url:'https://billing.stripe.com/p/session/test'}); await portal;
assert.equal(a.context.destination,undefined);
});
+test('shared login defaults to OTP with password behind an optional secondary control', async () => {
+ const a=await app(); a.run('resetAccount(); sharedAuth=true; supportsPassword=true; renderSharedAuth()');
+ assert.equal(a.get('password-field').hidden,true);
+ assert.equal(a.get('auth-password-switch').hidden,false);
+ assert.equal(a.get('auth-submit').textContent,'Email me a code →');
+ a.get('auth-password-switch').onclick();
+ assert.equal(a.get('password-field').hidden,false);
+ assert.equal(a.get('auth-password-reset').hidden,false);
+ a.get('auth-password-switch').onclick();
+ assert.equal(a.get('password-field').hidden,true);
+ a.run('supportsPassword=false; renderSharedAuth()');
+ assert.equal(a.get('auth-password-switch').hidden,true);
+});
+test('password login sends the password endpoint and retains input after a generic failure', async () => {
+ const a=await app(); a.run('resetAccount(); sharedAuth=true; supportsPassword=true; renderSharedAuth()');
+ a.get('auth-password-switch').onclick(); const form=a.get('auth-form');
+ form.elements.email.value='shared@example.com';form.elements.password.value='a test-only password';
+ a.context.FormData=class {constructor(form){this.form=form}get(key){return this.form.elements[key]?.value||''}};
+ const login=form.onsubmit({preventDefault(){},target:form});await tick();
+ assert.deepEqual(JSON.parse(a.pending.find(p=>p.url==='/api/auth/password').opts.body),{email:'shared@example.com',password:'a test-only password'});
+ a.get('auth-password-switch').onclick();assert.equal(a.run('sharedLoginMode'),'password');
+ a.respond('auth/password',{error:'invalid email or password'},401);await login;
+ assert.equal(a.run('user'),null);
+ assert.equal(form.elements.password.value,'a test-only password');
+ assert.equal(form.querySelector().disabled,false);
+});
+test('password setup requires an email code and passes the new password only to verification', async () => {
+ const a=await app();a.run('resetAccount(); sharedAuth=true; supportsPassword=true; renderSharedAuth()');
+ a.get('auth-password-switch').onclick();a.get('auth-password-reset').onclick();
+ const form=a.get('auth-form');form.elements.email.value='shared@example.com';
+ a.context.FormData=class {constructor(form){this.form=form}get(key){return this.form.elements[key]?.value||''}};
+ const start=form.onsubmit({preventDefault(){},target:form});await tick();
+ assert.equal(a.get('password-field').hidden,true);
+ assert.deepEqual(JSON.parse(a.pending.find(p=>p.url==='/api/auth/start').opts.body),{email:'shared@example.com'});
+ a.respond('auth/start',{request_id:'fresh-otp-request'});await start;
+ assert.equal(a.get('password-field').hidden,false);
+ assert.equal(form.elements.password.autocomplete,'new-password');
+ form.elements.password.value='fresh test-only password';form.elements.code.value='123456';
+ const verify=form.onsubmit({preventDefault(){},target:form});await tick();
+ assert.deepEqual(JSON.parse(a.pending.find(p=>p.url==='/api/auth/verify').opts.body),{request_id:'fresh-otp-request',code:'123456',password:'fresh test-only password'});
+ a.respond('auth/verify',{error:'invalid or expired code'},401);await verify;
+ a.get('auth-restart').onclick();
+ assert.equal(a.get('password-field').hidden,true);
+ assert.equal(form.elements.password.value,'');
+});
diff --git a/internal/sharedaccount/password_test.go b/internal/sharedaccount/password_test.go
new file mode 100644
index 0000000..47a0b36
--- /dev/null
+++ b/internal/sharedaccount/password_test.go
@@ -0,0 +1,111 @@
+package sharedaccount
+
+import (
+ "context"
+ "encoding/json"
+ "errors"
+ "net/http"
+ "net/http/httptest"
+ "strings"
+ "testing"
+
+ "golang.org/x/oauth2"
+)
+
+func TestRemoteSharedPasswordWireAndOTPCompatibility(t *testing.T) {
+ const token = "ck_1_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+ calls := 0
+ srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+ calls++
+ if r.Header.Get("Authorization") != "" || r.Header.Get("X-Serverless-Authorization") != "Bearer infrastructure-fixture" || r.Header.Get("X-Forwarded-For") != "203.0.113.7" {
+ t.Error("credential or IP forwarding mismatch")
+ }
+ var body map[string]string
+ if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+ t.Error(err)
+ }
+ switch calls {
+ case 1:
+ if r.URL.Path != "/auth/verify" || body["request_id"] != "request" || body["code"] != "123456" || body["password"] != " password-valid-123 " {
+ t.Error("enrollment payload mismatch")
+ }
+ case 2:
+ if r.URL.Path != "/auth/password" || body["email"] != "shared@example.com" || body["password"] != " password-valid-123 " {
+ t.Error("login payload mismatch")
+ }
+ case 3:
+ if r.URL.Path != "/auth/verify" {
+ t.Error("OTP route changed")
+ }
+ if _, ok := body["password"]; ok {
+ t.Error("old OTP flow sent enrollment field")
+ }
+ default:
+ t.Error("invalid request reached upstream")
+ }
+ _ = json.NewEncoder(w).Encode(Issued{Token: token, UID: "0123456789abcdef"})
+ }))
+ defer srv.Close()
+ remote, err := newRemote(context.Background(), srv.URL, "", false)
+ if err != nil {
+ t.Fatal(err)
+ }
+ remote.identity = oauth2.StaticTokenSource(&oauth2.Token{AccessToken: "infrastructure-fixture"})
+ c := Client{auth: remote}
+ ctx := WithClientIP(context.Background(), "203.0.113.7")
+ if _, err = c.FinishPassword(ctx, "request", "123456", " password-valid-123 "); err != nil {
+ t.Fatal(err)
+ }
+ if _, err = c.Password(ctx, "shared@example.com", " password-valid-123 "); err != nil {
+ t.Fatal(err)
+ }
+ if _, err = c.Finish(ctx, "request", "123456"); err != nil {
+ t.Fatal(err)
+ }
+ if _, err = c.FinishPassword(ctx, "request", "123456", "short"); !errors.Is(err, ErrInvalid) {
+ t.Fatal(err)
+ }
+ if _, err = c.Password(ctx, "shared@example.com", strings.Repeat("é", 129)); !errors.Is(err, ErrUnauthorized) {
+ t.Fatal(err)
+ }
+ if calls != 3 {
+ t.Fatal(calls)
+ }
+}
+func TestRemoteSharedPasswordErrorContractAndMalformedCredentials(t *testing.T) {
+ for _, tc := range []struct {
+ name string
+ status int
+ body string
+ want error
+ }{
+ {"wrong credentials", 401, `{"error":"Unauthorized","status":401,"detail":"invalid email or password"}`, ErrUnauthorized},
+ {"Google HTML denial", 401, `private infrastructure`, ErrUnavailable},
+ {"unrecognized denial", 401, `{"error":"Unauthorized","status":401,"detail":"private service error"}`, ErrUnavailable},
+ {"limited", 429, `{}`, ErrLimited},
+ {"unavailable", 503, `{}`, ErrUnavailable},
+ {"bad token", 200, `{"token":"not-canonical","account_uid":"0123456789abcdef"}`, ErrUnavailable},
+ {"bad UID", 200, `{"token":"ck_1_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","account_uid":"bad"}`, ErrUnavailable},
+ {"redirect", 307, `{}`, ErrUnavailable},
+ } {
+ t.Run(tc.name, func(t *testing.T) {
+ calls := 0
+ srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+ calls++
+ w.Header().Set("Location", "/unexpected")
+ w.WriteHeader(tc.status)
+ _, _ = w.Write([]byte(tc.body))
+ }))
+ defer srv.Close()
+ remote, err := newRemote(context.Background(), srv.URL, "", false)
+ if err != nil {
+ t.Fatal(err)
+ }
+ c := Client{auth: remote}
+ _, err = c.Password(context.Background(), "shared@example.com", "password-valid-123")
+ if !errors.Is(err, tc.want) || calls != 1 {
+ t.Fatalf("error=%v calls=%d", err, calls)
+ }
+ })
+ }
+}
diff --git a/internal/sharedaccount/provider.go b/internal/sharedaccount/provider.go
index 9234c89..d516b65 100644
--- a/internal/sharedaccount/provider.go
+++ b/internal/sharedaccount/provider.go
@@ -42,6 +42,13 @@ type Provider interface {
Call(context.Context, string, string, map[string]any) (map[string]any, error)
}
+// PasswordProvider is optional so existing shared OTP providers remain usable.
+// Password credentials are held and verified only by the authoritative service.
+type PasswordProvider interface {
+ FinishPassword(context.Context, string, string, string) (Issued, error)
+ Password(context.Context, string, string) (Issued, error)
+}
+
var tokenPattern = regexp.MustCompile(`^ck_([1-9][0-9]{0,5})_([A-Z2-7]{39})$`)
var UIDPattern = regexp.MustCompile(`^[0-9a-f]{16}$`)
diff --git a/internal/sharedaccount/remote.go b/internal/sharedaccount/remote.go
index 5dfc700..358f377 100644
--- a/internal/sharedaccount/remote.go
+++ b/internal/sharedaccount/remote.go
@@ -91,7 +91,7 @@ func (r *remote) call(ctx context.Context, path, token string, body any, out any
if problem.Status != res.StatusCode || problem.Error != http.StatusText(res.StatusCode) {
return ErrUnavailable
}
- if res.StatusCode == 401 && (problem.Detail == "invalid or revoked token" || problem.Detail == "invalid or expired code") {
+ if res.StatusCode == 401 && (problem.Detail == "invalid or revoked token" || problem.Detail == "invalid or expired code" || path == "/auth/password" && problem.Detail == "invalid email or password") {
return ErrUnauthorized
}
if res.StatusCode == 403 && problem.Detail == "account suspended" {
@@ -126,8 +126,23 @@ func (c *Client) Start(ctx context.Context, email string) (Challenge, error) {
return result, err
}
func (c *Client) Finish(ctx context.Context, requestID, code string) (Issued, error) {
+ return c.issue(ctx, "/auth/verify", map[string]string{"request_id": requestID, "code": code})
+}
+func (c *Client) FinishPassword(ctx context.Context, requestID, code, password string) (Issued, error) {
+ if len(password) < 12 || len(password) > 256 {
+ return Issued{}, ErrInvalid
+ }
+ return c.issue(ctx, "/auth/verify", map[string]string{"request_id": requestID, "code": code, "password": password})
+}
+func (c *Client) Password(ctx context.Context, email, password string) (Issued, error) {
+ if len(password) < 12 || len(password) > 256 {
+ return Issued{}, ErrUnauthorized
+ }
+ return c.issue(ctx, "/auth/password", map[string]string{"email": email, "password": password})
+}
+func (c *Client) issue(ctx context.Context, path string, body map[string]string) (Issued, error) {
var result Issued
- err := c.auth.call(ctx, "/auth/verify", "", map[string]string{"request_id": requestID, "code": code}, &result)
+ err := c.auth.call(ctx, path, "", body, &result)
if err == nil {
if _, e := Parse(result.Token); e != nil || !UIDPattern.MatchString(result.UID) {
err = ErrUnavailable
diff --git a/skills/cosift/SKILL.md b/skills/cosift/SKILL.md
index 08ea5bd..1a53b0b 100644
--- a/skills/cosift/SKILL.md
+++ b/skills/cosift/SKILL.md
@@ -83,15 +83,22 @@ and text/metadata checks do not guarantee image or video moderation. Do not
modify content or vectors to evade a rejection.
Verified new content earns 10 credits once; existing, duplicate, rejected and
-unverified pages earn none. Every account gets 60 shared free requests/minute
-plus 1,000 free credits per UTC calendar month, without a subscription. The
+unverified pages earn none. Every account gets 1,000 free credits per UTC calendar
+month, without a subscription. The
current month's grant is applied once on authenticated use; inactive past months
-are not backfilled. Unused credits carry over. Extra successful requests cost
-1 credit for Search, 2 for Answer, and 3 for Research after the shared free
-allowance. Web, CLI, and MCP searches use the same gateway balance; mode caps
+are not backfilled. Unused credits carry over. Every successful authenticated
+retrieval costs 1 credit for Search, 2 for Answer, and 3 for Research, including
+the first request. There is no free per-minute member bypass. Insufficient credit
+stops backend work; backend failures refund reserved credits. Web, CLI, and MCP
+searches use the same gateway balance; mode caps
and MCP's separate daily cap still apply. Inspect current policy rather than
assuming a balance buys unrestricted usage.
+If the user chooses guest retrieval, one shared cooldown applies per public IP:
+30 minutes after successful Search, 60 after Answer, and 90 after Research.
+Changing modes does not bypass that cooldown; backend failures do not consume it.
+Respect the server's retry guidance rather than repeatedly retrying.
+
The optional paid plan costs $5/month and adds 50,000 credits per paid month.
Subscribers also keep their free monthly allowance and may buy $5/50,000-credit
top-ups. Top-ups require a paid current subscription period. Cancellation retains