fix(cli): billing re-reads the account on Enter and sells nothing it can't price - #7226

Reviewed at 845a584d46811bd1cc358133b69f07fee414b42d.

The initial null-plan retry/refusal and Enter-time successful-read coverage/shortfall checks address the reported cases (packages/cli/src/commands/billing.ts:77–85,103–120,200–210). addonBlocks remains the shared quote/checkout rounding function: a verified Pro balance moving from 1000 to 4000 with --needed 5000 requests one 1000-credit pack, and a balance of 5000 creates none. Offer min/max clamping is unchanged, so this does not promise that a single capped checkout can cover every arbitrarily large need.

Pre-existing follow-up — fail-closed is still partial. This fixes the initial null read case, including unattended add-credits --needed, but not every unreadable-plan path. Enter's null read falls back to the original shortfall (:103–106). Also readPlanBefore accepts a truthy mock:true fallback (:116–120; real plan.ts:57–74 returns it after HTTP failure). Actual command/plan probes show initial 1000 → Enter 503 still creates four packs, and all subscription reads 503 with HYPERFRAMES_MOCK_PLAN=pro:1000 prints that checkout unattended. These stale/mock purchases were already possible on main; this patch does not worsen them. Follow up by refusing null/mock snapshots at both checkout gates while leaving the page/poll active.

Nit/follow-up — quote refresh and reconfirmation remain absent. billing.ts:83–85 displays a changed pack total and creates its session immediately after the first Enter; it also reuses the initial offer. A balance falling 4000 → 1000 changes a $1 quote into a $4 checkout for the now-correct shortfall. Stripe still presents its price before payment; this is not an automatic or unconfirmed charge. To restore the safeguards described in closed #7085, refresh the offer too and ask again whenever the displayed quote changes, proceeding only when a newly verified quote matches the quote accepted by Enter. Missing Pro-price refusal remains absent; absent add-on offers already refuse in createCheckout.

Validation: full root bun run build passes. bun run --cwd packages/cli test src/commands/billing.test.ts src/heygen/plan.test.ts passes 36/36 at this head. Swapping in current main (216395e98e094972ec905e20c851149ab302a6f1) billing source makes exactly the four new tests fail (32 pass); selecting only their describe block gives 4 failures. Failures are duplicate checkout, 4000 versus 1000 shortfall, checkout after unreadable plan, and 5000 versus 1000 after one failed read. Restored source passes 36/36; worktree clean. plan.ts and its tests are identical on main/head. Initial borrowed-dependency build/collection failures were resolved by a frozen install before these results; local Bun is 1.3.14 versus repository engine 1.4.4. Independent actual-command/real-plan probes use fake fetch and terminal/browser/auth seams; root reproduced Enter-null, initial-mock and balance-drop. No live purchase, HeyGen/Stripe request, real browser or terminal used. Existing stop-signal/late-work cancellation is retained; webhook settlement lag is outside a client re-read's guarantee.

Need: yes · Size: ok · Reuse: addonBlocks and existing cancellation signal · Simpler: bounded re-read/retry added to the existing flow · Structure: fine
Risk: medium — billing creates checkout sessions from asynchronous account balances; inherited verification/quote follow-ups remain.

Verdict: APPROVE
Reasoning: The patch fixes the four reported cases without a verified new blocking regression. This approves the increment, not a claim that all #7085 verified-plan and quote-consent safeguards have landed.

— Rames (hf-review)