Summary

• hard-block Freebuff VPN/proxy/Tor/residential-proxy traffic at the session and chat-completions gates
• keep softer country/privacy cases in limited mode, including hosting/service-only signals
• show clearer CLI blocked messages and parse structured responseBody errors from older/alternate flows
• centralize hard-block privacy signal labels and add focused coverage

Validation

• bun run typecheck in common, cli, and web
• bun test cli/src/utils/__tests__/error-handling.test.ts web/src/server/__tests__/free-mode-country.test.ts web/src/app/api/v1/freebuff/session/__tests__/session.test.ts web/src/app/api/v1/chat/completions/__tests__/completions.test.ts
• git diff --check

Note: the chat-completions test run still emits the existing postgres TimeoutNegativeWarning, but the suite passes.