feat: sign-in opcional — guest mode instala harness + FIA sem login (#3)

O login da Academy vira pergunta opcional logo no passo 1: sessão válida
segue direto ("Welcome back"); sem login, o guest instala só harness +
agente, com alerta claro do que fica travado (templates e toda a
automação) no início e no resumo final.

- auth.js: oferta "Sign in (optional)" com as duas opções; negação de
  autorização cai para guest em vez de matar a run (--login avulso ainda
  sai com erro); assinatura inativa avisa com link de renovação e oferece
  o caminho limitado; --yes sem token vira guest com warning
  (CREATE_IAI_TOKEN inválido continua falhando alto no CI).
- mode.js: guest + --mode full / --stack recomendada = erro duro (nunca
  downgrade silencioso em script); interativo esconde a opção template
  (linha LOCKED no box); resume de full install pela metade exige login.
- stack.js: guest não é promovido a full quando as escolhas batem com a
  stack recomendada — segue pelo manifesto com aviso.
- Download: header Authorization só com token; harness.js sem o guard de
  token (o servidor serve o harness anonimamente — PUBLIC_TEMPLATES no
  gate do iai-cursos, precisa de deploy do Convex); mensagem amigável
  para missing_token/401.
- Modo harness não instala mais gh (vestigial — nada o usa nesse modo).
- README/DOCS/--help atualizados; testes novos (mode-guest + download
  guest sem header) — 688 passando.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: elberrd

DOCS.md

@@ -19,8 +19,9 @@ harness, **FIA — the IAI Agent Factory** and how to extend it. Getting started
 | **Template** | private repo (community gated API) | Next.js 16 + Convex + Clerk + shadcn/Tailwind v4 app, with EVERYTHING implemented — **optional** |
 
 The CLI **does not bundle** the template or the harness: both are downloaded at
-install time **exclusively through the community gated API** (paying-student
-token) — there is no direct GitHub clone.
+install time **exclusively through the community API** — there is no direct
+GitHub clone. The templates require the paying-student token; the harness is
+also served **without** one (guest mode installs harness + FIA only).
 
 **Tenancy**: `--tenancy single` (default) downloads live1; `--tenancy multi`
 downloads **live2** — multi-tenant with organizations owned by the
@@ -218,11 +219,11 @@ prelude, then the tail for the chosen mode).
 
 | #  | Step | File | Notes |
 | -- | ----- | ------- | ----- |
-| 1  | Access — community student | `steps/auth.js` | Device-flow login; validates the subscription |
+| 1  | Access — sign in (optional) | `steps/auth.js` | Valid session → "Welcome back"; otherwise offers the device-flow login. Declining sets **guest mode**: harness + FIA only, every template path locked (announced on the spot) |
 | 2  | Claude Code | `steps/preflight.js` | Blocks if missing/logged out |
 | 3  | Name and folder | `steps/project.js` | `.` installs in the current folder |
-| 4  | **How to start — mode + stack path** | `steps/mode.js` | Sets `ctx.mode` + `ctx.stackPath` |
-| 5  | Your stack — layer by layer | `steps/stack.js` | Only the "build my own stack" path asks; may switch `ctx.mode` to `full` |
+| 4  | **How to start — mode + stack path** | `steps/mode.js` | Sets `ctx.mode` + `ctx.stackPath`; in guest mode the template path is locked (flags forcing it error out) |
+| 5  | Your stack — layer by layer | `steps/stack.js` | Only the "build my own stack" path asks; may switch `ctx.mode` to `full` (never for guests) |
 
 **`full` mode (harness + template):** each step declares a CAPABILITY
 (`core` always runs; `convex`/`clerk`/`shadcn`/`storage`/`mcps` only when the
@@ -257,7 +258,7 @@ template declares them in `requires` — see §2.4 and `src/lib/pipeline.js`).
 
 | #  | Step | File | Notes |
 | -- | ----- | ------- | ----- |
-| 6  | CLIs (git, gh) | `steps/preflight.js` | Binaries only — no gh login and no Vercel; with a community token even the gh install is skipped |
+| 6  | CLIs (git) | `steps/preflight.js` | Binaries only — no gh, no Vercel (the harness always comes through the community API, token or not) |
 | 7  | Harness | `steps/harness.js` | Merge into the folder; runs `git init` if missing |
 | 8  | Stack — manifest, docs and tooling | `steps/stack-docs.js` | Manifest + `AGENTS.md` block + skills/CLIs/MCPs of the chosen techs (incl. Neon/Supabase dev DB) |
 | 9  | FIA — Pi + FDAs | `steps/fia.js` | Stamps `imp/` + `.pi/` |
@@ -439,7 +440,8 @@ the browser sends the binary STRAIGHT to storage via signed URL.
 ## 8. Harness
 
 **The installer's base — always installed**, in both modes. Downloads the
-harness through the community gated API (paying-student token — the only path)
+harness through the community API (the only path — with the student token, or
+anonymously in guest mode: harness + FIA are the free tier)
 and merges **without overwriting anything** — existing files
 win, the harness `README.md` becomes `imp/HARNESS.md`, and its `AGENTS.md` is
 appended to the project's between the `<!-- harness-start/end -->` markers.
@@ -846,7 +848,8 @@ FIA and design
                            no API key; default on. Requires Node >= 22.12
   --no-impeccable          Skips Impeccable (--skip-impeccable is the same)
 
-Access (the CLI is exclusive to students with an active subscription)
+Access (sign-in is optional: it unlocks the templates + their automation;
+without it the installer delivers the harness + agent only)
   --login                  Authenticates this computer (browser) and exits
   --logout                 Removes/revokes the CLI token and exits
   --whoami                 Shows subscription status and exits
@@ -871,6 +874,9 @@ General
 `--preset`/groups), default shadcn block, no webhook/R2/deploy, **harness
 installed**, local commit without a remote repo, no integration-CLI logins.
 For harness only without prompts: `--harness-only` (or `--mode harness`).
+Without a valid login (or `CREATE_IAI_TOKEN`), `--yes` continues as **guest**
+— harness + agent only — and `--mode full`/`--stack template` error out
+instead of silently downgrading.
 
 ## 10. How to add a new addon
 

README.md

@@ -18,12 +18,22 @@ npx impactus
 
 ## Who can use it
 
-The installer is exclusive to **[Impactus Academy](https://www.impactus.academy)
-students with an active enrollment**. On first run it opens the browser to
-authorize your computer (OAuth device flow); the project templates and the
-agent harness are delivered by the academy's gated API — they are **not** in
-this repository or in the npm package, and the CLI has no clone path. Access
-is revalidated on every use.
+Anyone can run the installer — **signing in is optional and asked right at
+the start**:
+
+- **Signed in** ([Impactus Academy](https://www.impactus.academy) student with
+  an active enrollment): the full installer — the ready-made project templates
+  plus the whole automated template pipeline (cloud provisioning, keys,
+  webhooks, GitHub, deploy).
+- **Without signing in** (guest mode): the CLI still installs the **agent
+  harness + the FIA agents**, but nothing from the templates — the CLI shows
+  the limitation up front and again in the final summary.
+
+Login uses the OAuth device flow (browser, one time per computer); access is
+revalidated on every use. Templates and harness are delivered by the academy's
+API — they are **not** in this repository or in the npm package, and the CLI
+has no clone path (the harness is served without a token; the templates
+require an active enrollment).
 
 ```bash
 npx impactus --login    # authenticate this computer
@@ -56,6 +66,8 @@ command passes straight through to the real `pi` binary.
 
 - **Node.js >= 22.12**
 - An **active [Impactus Academy](https://www.impactus.academy) enrollment**
+  for the templates + automated pipeline (optional: without it the installer
+  delivers the harness + agent only)
 - **Claude Code** installed and logged in with a Claude **Pro/Max**
   subscription
 - For FIA's Codex roles: a **ChatGPT Plus/Pro** subscription (login at the
@@ -81,5 +93,6 @@ onboarding happen inside the academy community.
 
 [MIT](./LICENSE) — covers this repository: the installer CLI and the runtime
 it stamps (`fia-templates/`, `pi-templates/`). The project templates and the
-agent harness are proprietary, live in private repositories and are delivered
-only to enrolled students — they are not part of this package.
+agent harness are proprietary and live in private repositories — they are not
+part of this package. The templates are delivered only to enrolled students;
+the harness is served by the academy's API to any installer run.

src/config.js

@@ -1,12 +1,14 @@
 // Central configuration for the impactus installer.
 
-// ── Community (paid-student gate via device flow) ────────────────────────────
-// The CLI only installs for students with an ACTIVE subscription in the
-// community. Login uses the OAuth 2.0 Device Authorization Grant (RFC 8628)
-// against the /api/cli/* endpoints served by the community's Convex deployment
-// (.convex.site); both the template AND the private harness are downloaded
-// through it (tarball) — the student never needs GitHub access, and the CLI
-// has no direct-clone path.
+// ── Community (student gate via device flow — sign-in is OPTIONAL) ───────────
+// Signing in (ACTIVE subscription) unlocks the full installer; without it the
+// CLI still delivers the harness + FIA ("guest mode" — steps/auth.js) but
+// nothing from the templates. Login uses the OAuth 2.0 Device Authorization
+// Grant (RFC 8628) against the /api/cli/* endpoints served by the community's
+// Convex deployment (.convex.site); template AND harness are downloaded
+// through it (tarball) — the harness even without a token, the templates only
+// with one. The student never needs GitHub access, and the CLI has no
+// direct-clone path.
 //
 // `apiBase` must point to the community's PRODUCTION deployment — the same one
 // the www.impactus.academy site uses (verified against the production bundle).
@@ -75,8 +77,9 @@ export const DEFAULT_TEMPLATE_ID = 'live1';
 
 // Harness — optional agent-workflow scaffold (/start, /dev, /sv, /test-ui, …)
 // merged INTO the generated project as the last install step. Private
-// repository, downloaded EXCLUSIVELY through the community's gated API
-// (paid-student token) — there is no direct GitHub clone.
+// repository, downloaded EXCLUSIVELY through the community's API — served
+// even WITHOUT a token (the free tier: guests install harness + FIA); there
+// is no direct GitHub clone.
 // Merge rules (see src/steps/harness.js):
 //   - files that already exist in the project are NEVER overwritten;
 //   - the harness README.md is saved as imp/HARNESS.md (the project README wins);

src/lib/args.js

@@ -307,7 +307,8 @@ Options:
   --terminal, --no-ui      Accepted for compatibility (the terminal is already the default)
   --port <n>               UI server port (default: 4599)
 
-  Access (the CLI is exclusive to community students with an active subscription):
+  Access (sign-in is optional: it unlocks the templates + their automation;
+  without it the installer delivers the harness + agent only):
   --login                  Authenticates this computer (opens the browser) and exits
   --logout                 Removes/revokes this computer's CLI token and exits
   --whoami                 Shows your subscription status and exits

src/lib/auth-client.js

@@ -123,7 +123,9 @@ export async function revokeToken(apiBase, token, timeoutMs = 10000) {
 }
 
 /**
- * Downloads the private (gated) template tarball. Writes to `destPath`.
+ * Downloads a template tarball through the community API. Writes to `destPath`.
+ * `token` may be null: the harness is served without one (the free tier) —
+ * the gated names (live1/live2) answer 401/missing_token instead.
  * Capped at 2 minutes so a frozen connection never hangs the install forever;
  * on timeout the reason is `download_timeout`, and any other network failure
  * (DNS, refused, offline) is `network_error` — never a raw throw
@@ -136,7 +138,7 @@ export async function downloadTemplate(apiBase, token, name, destPath, ref, time
   const signal = AbortSignal.timeout(timeoutMs); // also aborts the body read
   try {
     const res = await fetch(`${apiBase}/api/cli/template/${encodeURIComponent(name)}${qs}`, {
-      headers: { authorization: `Bearer ${token}` },
+      headers: token ? { authorization: `Bearer ${token}` } : {},
       signal,
     });
     if (!res.ok) {

src/lib/pipeline.js

@@ -34,9 +34,9 @@ export function unknownCapabilities(requires = []) {
  * Used in harness mode (which has no decisions phase). In full mode the
  * preflight now looks at the DECISION (ctx.decisions.push/deploy) — gh/vercel
  * are only prepared when the user said "yes". GitHub CLI login is only
- * needed when a push can happen: with a student token, both the template
- * and the harness come through the gate (steps/harness.js uses the API
- * whenever `ctx.authToken` exists; `gh` is only a dev fallback without a token).
+ * needed when a push can happen: template and harness always come through
+ * the community API (the harness even without a token — guest mode), so
+ * harness mode never touches `gh` at all.
  *
  * Mirrors the precedence of steps/github.js.
  */

src/lib/template-fetch.js

@@ -43,6 +43,9 @@ export async function fetchTemplateToDir(apiBase, token, name, destDir, ref) {
  * matters is between "wait and try again" and "retrying won't help":
  *
  *   no_active_enrollment → inactive subscription, it's on the student;
+ *   missing_token / http_401 → the download needs the sign-in (a guest run
+ *     reached a gated name, or the server does not serve this one anonymously
+ *     yet) — retrying won't help, signing in will;
  *   server_misconfigured → missing env on the community server (e.g. the
  *     GitHub token that fetches the private repos). Saying "try again in a
  *     moment" here makes the student retry forever an error only the
@@ -63,6 +66,13 @@ export function downloadErrorMessage(what, reason) {
   if (reason === 'no_active_enrollment') {
     return `Your subscription is no longer active — the ${what} could not be downloaded.`;
   }
+  if (reason === 'missing_token' || reason === 'http_401') {
+    return [
+      `The ${what} download requires the community sign-in.`,
+      'Authenticate with `npx impactus --login` (or run the installer again and',
+      'choose "Sign in") and repeat the command.',
+    ].join('\n');
+  }
   if (reason === 'server_misconfigured') {
     return [
       `The community server couldn't deliver the ${what} (pending configuration on its side).`,

src/main.js

@@ -44,8 +44,10 @@ export async function main(flags = {}) {
 
   // Early gate (before login): if --template-id/--tenancy ask for an unknown
   // or unpublished template, warn right away. Every download (template AND
-  // harness) goes exclusively through the community's gated API — there is no
-  // direct GitHub clone (see steps/project.js and steps/harness.js).
+  // harness) goes exclusively through the community's API — there is no
+  // direct GitHub clone. The templates require the student token; the harness
+  // is also served WITHOUT one (guest mode installs harness + FIA only — see
+  // steps/auth.js, steps/mode.js and steps/harness.js).
   {
     const { id } = resolveTemplateId(flags);
     if (id && !TEMPLATES[id]) {
@@ -92,7 +94,7 @@ export async function main(flags = {}) {
   // template stack runs before it; in 'harness' mode nothing else runs — only
   // the folder is prepared and the harness is merged into it.
   const preludeSteps = [
-    ['Access — community student', () => ensureAuthenticated(ctx)],
+    ['Access — sign in to the community (optional)', () => ensureAuthenticated(ctx)],
     ['Prerequisite: Claude Code', () => ensureClaudeCode(flags)],
     ['Project — target folder (the project name is the folder name)', async () => Object.assign(ctx, await promptProject(flags))],
     ['How to start — ready-made template, your own stack, or decide later', () => selectInstallMode(ctx)],
@@ -163,14 +165,13 @@ export async function main(flags = {}) {
   const tailSteps = (mode) =>
     mode === 'harness'
       ? [
-          // The harness comes through the community gate (no clone): git comes
-          // in for the local commit and nothing is pushed to GitHub, so with a
-          // community token the gh binary would never be used — skip installing
-          // it. Without a token (dev runs outside the gate) gh stays as the
-          // fallback. Vercel CLI is not installed.
+          // The harness always comes through the community API (with or
+          // without a token — guests get it anonymously): git comes in for the
+          // local commit, nothing is pushed to GitHub and no clone happens, so
+          // neither gh nor the Vercel CLI is installed.
           [
-            'CLIs — git and gh',
-            () => ensureCliTools({ vercel: false, gh: !ctx.authToken, ghAuth: false, flags }),
+            'CLIs — git',
+            () => ensureCliTools({ vercel: false, gh: false, ghAuth: false, flags }),
           ],
           ['Harness — agent workflow', () => setupHarness(ctx)],
           // After the harness (which creates ai-docs/): the ai-docs/stack.md