feat: bind free sessions to accounts to prevent multi-account abuse

[AbhijitK20]

Summary

Prevents users from switching accounts mid-session to abuse free-tier limits. When a freebuff session becomes active, it is now bound to the authenticating user's ID. Multiple guard rails enforce this:

Changes

File	Change
cli/src/state/freebuff-session-store.ts	Added sessionBoundUserId state + setter
cli/src/hooks/use-freebuff-session.ts	Set binding on active, clear on ended/none/superseded, startup guard for mismatched users
cli/src/commands/command-registry.ts	/logout blocked during active session (requires --end-session or --force)
cli/src/hooks/use-auth-state.ts	Login rejected if new user differs from session-bound user
cli/src/data/slash-commands.ts	Updated /logout help text to document --force

How it works

1. Session binds on activation — When the poll loop receives an active status, sessionBoundUserId is set to the current user's ID from credentials.json.

2. /logout blocked — If a session is bound, /logout shows a warning and suggests /end-session first. Use /logout --force to override.

3. Login rejected on mismatch — If someone logs in as a different user while a session is bound to another account, the login is rejected and credentials are cleared.

4. Startup guard — On mount, if sessionBoundUserId exists but doesn't match the current credentials (e.g., credentials were swapped externally), the session is ended immediately.

5. Binding cleared on session end — When the session transitions to ended, none, or superseded, the binding is cleared.

Abuse scenario prevented

Before: User A logs in → gets free session → /logout → User B logs in → another free session
After:  User A logs in → gets free session → /logout blocked → must /end-session first

Notes

• Server already enforces one free session per account — this adds client-side enforcement so the same machine can't cycle through accounts
• No functional change for legitimate single-account users
• The --force flag on /logout provides an escape hatch for edge cases

[codebuff-team]

Good instinct — preventing account-cycling on shared free-tier slots is worth doing — but the implementation doesn't actually hold up against the scenario it's designed to stop.

sessionBoundUserId in freebuff-session-store.ts is plain in-memory zustand state with no persistence (no persist middleware, no write to disk/credentials file). A user abusing free sessions doesn't need /logout --force — they can just Ctrl-C the CLI and start a new process. On restart, sessionBoundUserId is null again, the startup guard in use-freebuff-session.ts (line ~426) has nothing to compare against, and once the poll loop sees status: 'active' it re-binds to whatever user is currently in credentials.json — including the new account. So the described abuse scenario (logout → login as B → new free session) is unaffected by this PR whenever the user simply restarts the process instead of using /logout, which is the more natural way to switch accounts anyway.

That makes the added friction (blocking /logout, rejecting login on mismatch, the --force escape hatch, the new analytics event) mostly cosmetic — it inconveniences the honest path while doing nothing against the actual abuse path. The PR body's claim that this is meaningful "client-side enforcement" on top of server-side limits doesn't hold unless the binding survives process restarts (e.g. persisted alongside credentials.json or tied to the server-issued session/instance id itself, checked server-side).

Secondary point: login-modal.tsx's onLoginSuccess signature changes from void to string | null — worth double-checking there are no other call sites assuming the old contract.

Tests only cover the zustand store getters/setters, not the actual restart-bypass scenario, which is the crux of whether this defends anything.

Worth revisiting with persisted or server-verified binding rather than closing outright, since the direction is sound.

[AbhijitK20]

Thanks for the thorough review — the restart-bypass hole was a real catch. Here's what's been addressed:

1. Persistence (the main gap)

Added cli/src/utils/session-binding.ts — the binding is now persisted to ~/.config/manicode/session-binding.json:

• Written when session becomes active
• Loaded on startup and restored to in-memory state
• Cleared on session end or /logout --force
• Checked on startup against current credentials

The restart-bypass path is now closed:

Before: Ctrl-C → restart → binding is null → switch accounts → new session
After:  Ctrl-C → restart → readSessionBinding() returns old user → startup guard ends session

2. onLoginSuccess type change

Verified — only one call site (app.tsx:235 → LoginModal). The LoginModalProps interface was updated to match. The plain login flow (freebuff login command) runs outside the TUI and doesn't use this callback.

3. Tests

Added cli/src/utils/__tests__/session-binding.test.ts — 8 tests covering read/write/clear/malformed edge cases against the actual file I/O.

Also added cli/src/state/__tests__/freebuff-session-store.test.ts for the store binding lifecycle.