Show one-time ToS/Privacy disclaimer in Studio CLI and Studio Code

[sejas]

Related issues

• Fixes STU-1734

How AI was used in this PR

AI assisted with the implementation, tests, and code review passes.

Proposed Changes

It shows the terms of service and privacy policy the first time you execute a command. It doesn't stop the command from being executed it's just displayed above the command the first time.

Per legal guidelines, users must see a Terms of Service / Privacy Policy notice near the primary action the first time they use Studio from the terminal. Currently the CLI and Studio Code show no such notice.

• The first time a user runs any Studio CLI command in an interactive terminal, a one-time boxed notice prints to stderr (mirroring the existing update alert): "By continuing, you agree to our Terms of Service and have read our Privacy Policy", with links to both documents. It never shows again afterwards.
• In Studio Code (studio code / studio ai), the notice renders natively inside the TUI, right under the welcome logo, instead of the CLI banner.
• The notice is careful never to get in the way or be silently consumed:
  • It writes to stderr only, so --json (NDJSON) output and piped stdout stay machine-clean.
  • Headless contexts defer rather than burn the one-time flag: runs spawned by the desktop app (which shows its own disclaimer), remote-session daemon turns, and any run where stderr is not a TTY (MCP clients, cron, redirects) skip the notice and let the next interactive run show it.
  • Failures reading/writing config or writing to a closed stderr never break the command.

Note: studio code sessions list/delete and other non-interactive invocations intentionally defer the notice to the next visible run.

Testing Instructions

Setup: npm install && npm run cli:build. To simulate a new user, remove the tosNoticeShownAt key from ~/.studio/cli.json.

CLI first run

1. Run node apps/cli/dist/cli/main.mjs auth status in a real terminal.
2. Expect a blue boxed disclaimer (stderr) before command output, with both URLs.
3. ~/.studio/cli.json now contains tosNoticeShownAt; running the command again shows no banner.

Studio Code TUI

1. Remove the flag again, run node apps/cli/dist/cli/main.mjs code.
2. Expect the dimmed disclaimer under the welcome logo (no stderr box). Flag persists; rerunning code shows nothing.

Second and following times executed

1. Run any command or node apps/cli/dist/cli/main.mjs code again
2. Observe the message doesn't appear anymore

Desktop app

1. npm start, start a site, use Studio Code from the app — no CLI banner anywhere (IPC-spawned runs are suppressed). I'll create a follow-up for that.

Pre-merge Checklist

• Have you checked for TypeScript, React or other console errors?

[nightnei]

LGTM and works as expected, I confirm that tosNoticeShownAt is set always correctly and I don't see the banner again.

[epeicher]

Thanks @sejas for adding this! I have tested it, and I can see the ToS when expected. LGTM!

studio auth command first time and second time	studio code first time	studio code second time

[katinthehatsite]

Some CodeQL actions were failing so I pushed an empty commit to trigger CI again.

[wpmobilebot]

📊 Performance Test Results

Comparing 2c14418 vs trunk

app-size

Metric	trunk	2c14418	Diff	Change
App Size (Mac)	1358.08 MB	1358.09 MB	+0.00 MB	⚪ 0.0%

site-editor

Metric	trunk	2c14418	Diff	Change
load	1648 ms	1667 ms	+19 ms	⚪ 0.0%

site-startup

Metric	trunk	2c14418	Diff	Change
siteCreation	9030 ms	9493 ms	+463 ms	🔴 5.1%
siteStartup	4395 ms	4394 ms	1 ms	⚪ 0.0%

---

Results are median values from multiple test runs.

Legend: 🟢 Improvement (faster) | 🔴 Regression (slower) | ⚪ No change (<50ms diff)