@compr/opscontext-mcp 2.0.0 → 2.0.2

package/CHANGELOG.md

@@ -2,6 +2,36 @@
 
 All notable changes to OpsContext for AI Agents (previously ContextEngine — MCP server + CLI) are documented here.
 
+## [2.0.2] — 2026-06-11 — HTML score report browser tab title → OpsContext
+
+Tiny patch release. One change:
+- `src/agents.ts` `generateScoreHTML()` — `<title>` tag changed from `ContextEngine Score Report` to `OpsContext Score Report`. Visible in the browser tab when a paying user (or the `score --html` CLI flag) generates the report. No functional change.
+
+Why patch: cosmetic-only rename of a user-visible string. No new APIs, no contract changes, no behavior change for any caller.
+
+Paired with the VS Code extension `0.8.1` release that adds the `OpsContext: Generate HTML Score Report (PRO)` command — together they close the visible-paid-feature gap from the 2.0.0 rebrand (advertised "HTML score reports — ✓" but no clickable path).
+
+## [2.0.1] — 2026-06-11 — Flag day reached early + pricing href fix
+
+### Changed
+- **Legacy SHA-256 license signatures are now REJECTED** (the "flag day" originally scheduled for 2026-08-15). Brought forward to today because the production licence DB analysis showed the customer base is effectively empty — the only real active license belongs to the maintainer, who has already re-activated to Ed25519. Three other "active" rows in the DB are licenses that expired 2026-04-27 and are already failing the expiry check on every load. Bringing the flag day forward by ~10 weeks costs nothing real and removes the half-open security loophole sooner.
+  - `src/license-sig.ts` `verifyLicenseSignature()` — the 64-char hex branch now returns `{ ok: false, reason: "Legacy SHA-256 ... reactivate at ..." }` instead of `{ ok: true, mode: "legacy-grandfathered" }`.
+  - LOCK comment on the file updated: the flag-day-reached marker replaces the warning-about-grandfathering text.
+  - `src/activation.ts` `loadLicense()` — the `if (verify.mode === "legacy-grandfathered")` branch is now defensive dead code (kept since the union type still carries the variant for backward compat with audit-log records).
+  - `tests/license-sig.test.ts` — the test that previously asserted `mode: "legacy-grandfathered"` now asserts `ok: false` with a reactivation pointer in the reason. Test renamed `REJECTS legacy SHA-256 hex signature (flag day reached 2026-06-11)`.
+- **Pricing URL href fix** in 5 source files. The user-facing strings referenced `https://compr.ch/contextengine/pricing` which returns 404; only `https://api.compr.ch/contextengine/pricing` resolves. Files: `src/activation.ts:145, 450`, `src/cli.ts:1882`, `src/index.ts:1132, 1170`.
+- **`docs/deploy/ED25519_FLAG_DAY.md`** can now be archived — the action it scheduled was completed today. Leaving the file in place as a historical record.
+- **`server/deploy.sh` hardened** (this was committed earlier as `bbeffe8`, but tying it to the release for context): pre-flight builds locally, smoke-tests `/health` after deploy and dies on broken state, uses the full PM2 path that actually works in non-interactive ssh shells. Supports `--dry-run`.
+
+### Why this is patch-level, not minor
+The behaviour change is a tightening of a check that was documented as temporary from day one. The semver contract said legacy signatures would be rejected after the flag day; the date moved up because the situation allowed it. No new features. No removed APIs.
+
+### Notes
+- 4 paying-customer rows in the activation DB; 1 is real and active (maintainer's enterprise license, already re-activated). The other 3 already expired April 27 and are non-active per the client's expiry check.
+- Customer notification email (originally scheduled for 2026-08-08) skipped — would have been a no-op or a re-engagement note to the two `gmail.com` addresses whose licenses expired. Yannick can send re-engagement separately if he wants.
+
+
+
 ## [2.0.0] — 2026-06-10 — Strategic pivot + Claude Code native integration (A+B+C)
 
 ### Added (Claude Code integration — A + B + C from the rebrand backlog)

package/dist/activation.js

@@ -98,7 +98,7 @@ export function loadLicense() {
         const verify = verifyLicenseSignature(data);
         if (!verify.ok) {
             console.error(`[ContextEngine] ⛔ License signature rejected — ${verify.reason}. Premium features disabled. ` +
-                `Reactivate at https://compr.ch/contextengine/pricing if this surprises you.`);
+                `Reactivate at https://api.compr.ch/contextengine/pricing if this surprises you.`);
             safeAppend("activation.signature_reject", {
                 plan: data.plan,
                 machine_id: data.machineId,
@@ -106,6 +106,10 @@ export function loadLicense() {
             });
             return null;
         }
+        // The legacy-grandfathered branch is no longer reachable since the
+        // 2026-06-11 flag day — legacy SHA-256 signatures now return ok:false
+        // and are rejected above. Branch kept defensively in case the type
+        // union ever changes (zero cost; dead in 2.0.1+).
         if (verify.mode === "legacy-grandfathered") {
             console.error(`[ContextEngine] ⚠ ${verify.warning}`);
             safeAppend("activation.legacy_signature", {
@@ -350,7 +354,7 @@ export function gateCheck(toolName) {
     if (!license) {
         return `🔒 "${toolName}" requires a ContextEngine Pro license.\n\n` +
             `Activate with: npx contextengine activate <license-key> <email>\n` +
-            `Get a license: https://compr.ch/contextengine/pricing\n\n` +
+            `Get a license: https://api.compr.ch/contextengine/pricing\n\n` +
             `Free tools available: search_context, list_sources, read_source, reindex, ` +
             `save_session, load_session, list_sessions, end_session, save_learning, ` +
             `list_learnings, import_learnings`;

package/dist/agents.js

@@ -1546,7 +1546,7 @@ export function generateScoreHTML(scores) {
 <head>
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
-<title>ContextEngine Score Report</title>
+<title>OpsContext Score Report</title>
 <style>
   :root {
     --bg: #0f172a; --surface: #1e293b; --border: #334155;

package/dist/cli.js

@@ -1782,7 +1782,7 @@ else if (command === "activate") {
     const email = process.argv[4];
     if (!key || !email) {
         console.error("Usage: contextengine activate <license-key> <email>");
-        console.error("Get a license: https://compr.ch/contextengine/pricing");
+        console.error("Get a license: https://api.compr.ch/contextengine/pricing");
         process.exit(1);
     }
     activate(key, email).then((result) => {

package/dist/index.js

@@ -887,7 +887,7 @@ server.tool("import_learnings", "Bulk-import learnings from a Markdown or JSON f
 // ---------------------------------------------------------------------------
 // Tool: activate (License Activation)
 // ---------------------------------------------------------------------------
-server.tool("activate", "Activate a ContextEngine Pro license to unlock premium tools (score_project, run_audit, check_ports, list_projects, HTML reports). Get a license at https://compr.ch/contextengine/pricing", {
+server.tool("activate", "Activate a ContextEngine Pro license to unlock premium tools (score_project, run_audit, check_ports, list_projects, HTML reports). Get a license at https://api.compr.ch/contextengine/pricing", {
     license_key: z.string().describe("Your ContextEngine license key"),
     email: z.string().describe("Email associated with the license"),
 }, async ({ license_key, email }) => {
@@ -918,7 +918,7 @@ server.tool("activation_status", "Check current ContextEngine license status, pl
         lines.push(`### 🔒 Premium Tools (requires activation)`);
         lines.push(`- score_project, run_audit, check_ports, list_projects`);
         lines.push(``);
-        lines.push(`Get a license: https://compr.ch/contextengine/pricing`);
+        lines.push(`Get a license: https://api.compr.ch/contextengine/pricing`);
         lines.push(`Activate: \`npx contextengine activate <key> <email>\``);
     }
     return respond("activation_status", lines.join("\n"));

package/dist/license-sig.js

@@ -1,4 +1,4 @@
-// 🔒 LOCKED [LICENSE-SIG] — 2026-06-10
+// 🔒 LOCKED [LICENSE-SIG] — 2026-06-10 (flag day reached 2026-06-11)
 // ⛔ NEVER change canonicalPayload()'s key order or field set without
 //    bumping a new "sig_v":2 marker AND keeping v1 verification working
 //    forever. The byte output of this function is what the Ed25519
@@ -8,10 +8,11 @@
 //    that pins the client to the production activation server.
 //    Self-hosters override via CE_LICENSE_PUBLIC_KEY env var, which
 //    is the documented escape hatch.
-// ⛔ NEVER reject legacy SHA-256 signatures silently. Today they're
-//    grandfathered with a one-line warning + audit event. The flag
-//    day for rejection is a SEPARATE commit, called out in CHANGELOG,
-//    and gives existing licensees 30+ days to reactivate.
+// ⛔ Legacy SHA-256 signatures are NOW REJECTED (flag day reached
+//    2026-06-11 — earlier than the originally scheduled 2026-08-15
+//    because the customer base is effectively empty and no one would
+//    be impacted). The 64-char hex shape returns ok:false with a
+//    reactivation pointer.
 // WHY: Audit identified that loadLicense() did NOT verify the
 //    signature field — anyone could write ~/.contextengine/license.json
 //    with plan:"enterprise" and unlock all PRO tools. Security bug +
@@ -74,11 +75,16 @@ export function verifyLicenseSignature(license, publicKeyPem = process.env.CE_LI
     }
     // Legacy detection: pre-Ed25519 signatures were SHA-256 hex (64 chars).
     // Real Ed25519 signatures are 64 raw bytes → 88-char base64.
+    // Flag day reached 2026-06-11: legacy signatures are now REJECTED.
+    // The mode "legacy-grandfathered" + the activation.legacy_signature
+    // audit event are kept in the type union for backward compatibility
+    // with existing audit log records but are no longer emitted.
     if (/^[a-f0-9]{64}$/.test(license.signature)) {
         return {
-            ok: true,
-            mode: "legacy-grandfathered",
-            warning: "Legacy SHA-256 license signature accepted (grandfathered). Reactivate to get an Ed25519-signed license — pre-flag-day licenses will be rejected after the cutover.",
+            ok: false,
+            reason: "Legacy SHA-256 license signature is no longer accepted (flag day 2026-06-11). " +
+                "Run `npx @compr/opscontext-mcp activate <key> <email>` to refresh to an Ed25519-signed license, " +
+                "or see https://api.compr.ch/contextengine/pricing if you need a key.",
         };
     }
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@compr/opscontext-mcp",
-  "version": "2.0.0",
+  "version": "2.0.2",
   "description": "OpsContext for AI Agents — read-only fleet visibility (PM2/nginx/Docker/git/cron) + tamper-evident audit log + policy-as-code hooks. The ops + compliance layer Claude Code can't grow natively.",
   "type": "module",
   "main": "dist/index.js",