@compr/opscontext-mcp 2.0.0

package/dist/activation.js

@@ -0,0 +1,377 @@
+// LOCKED — verified March 3 2026 — activation + delta decryption + machine fingerprint + heartbeat
+// DO NOT RE-AUDIT — E2E tested Feb 23 2026, all 4 Pro tools verified
+/**
+ * Activation & Delta Module System
+ *
+ * The npm package ships with core functionality (search, sessions, learnings,
+ * operational collectors). PRO unlocks the four high-value tools that consume
+ * collector + multi-project data.
+ *
+ * Free (no activation required):
+ *   - search_context, list_sources, read_source, reindex
+ *   - save/load/list/delete/end_session
+ *   - save/list/delete/import_learning
+ *   - Operational collectors run during reindex (PM2, nginx, Docker, git,
+ *     cron, .env redacted, composer, systemd) — collected data is searchable
+ *     via search_context
+ *
+ * Activation unlocks the four PRO tools that consume collected/multi-project
+ * data and the HTML report generators:
+ *   - list_projects (cross-project tech-stack analysis)
+ *   - check_ports   (cross-project port conflict scan)
+ *   - run_audit     (compliance audit with HTML report)
+ *   - score_project (AI-readiness score + SCORE.md + score-report.html)
+ *
+ * On activation:
+ *   1. License key is validated against the ContextEngine API
+ *   2. Server returns a signed delta bundle (encrypted JS modules)
+ *   3. Delta is cached locally at ~/.contextengine/delta/
+ *   4. Premium tools become available
+ */
+import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, unlinkSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+import { createHash, createDecipheriv } from "crypto";
+import { safeAppend } from "./audit.js";
+import { verifyLicenseSignature } from "./license-sig.js";
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+const DELTA_DIR = join(homedir(), ".contextengine", "delta");
+const LICENSE_FILE = join(homedir(), ".contextengine", "license.json");
+const ACTIVATION_API_BASE = process.env.CONTEXTENGINE_API || "https://api.compr.ch/contextengine";
+const ACTIVATION_API = `${ACTIVATION_API_BASE}/activate`;
+const HEARTBEAT_INTERVAL_MS = 24 * 60 * 60 * 1000; // daily check
+// Premium modules that require activation.
+// NOTE: collectors.ts runs unconditionally during reindex for all users
+// (operational data feeds search_context for everyone). The PRO tools below
+// in PREMIUM_TOOLS are what consume that data for scoring/audit/cross-project
+// reports. Keep the gate at the tool layer, not the data-collection layer.
+export const PREMIUM_MODULES = [
+    "agents", // scorer, auditor, port checker, HTML report formatters
+    "search-adv", // advanced BM25 with tuned parameters
+];
+// Tools that require activation
+export const PREMIUM_TOOLS = [
+    "score_project",
+    "run_audit",
+    "check_ports",
+    "list_projects",
+];
+// ---------------------------------------------------------------------------
+// Machine fingerprint (non-PII)
+// ---------------------------------------------------------------------------
+function getMachineId() {
+    const components = [
+        process.platform,
+        process.arch,
+        homedir().split("/").slice(0, 3).join("/"), // just /Users/xxx level
+        process.env.USER || process.env.USERNAME || "unknown",
+    ];
+    return createHash("sha256")
+        .update(components.join("|"))
+        .digest("hex")
+        .slice(0, 16);
+}
+// ---------------------------------------------------------------------------
+// License management
+// ---------------------------------------------------------------------------
+export function loadLicense() {
+    try {
+        if (!existsSync(LICENSE_FILE))
+            return null;
+        const data = JSON.parse(readFileSync(LICENSE_FILE, "utf-8"));
+        // Check expiry
+        if (new Date(data.expiresAt) < new Date()) {
+            console.error("[ContextEngine] ⚠ License expired — premium features disabled");
+            return null;
+        }
+        // Verify machine binding
+        if (data.machineId !== getMachineId()) {
+            console.error("[ContextEngine] ⚠ License bound to different machine");
+            return null;
+        }
+        // Verify Ed25519 signature. Three outcomes:
+        //   ed25519              → cryptographically verified, full trust
+        //   legacy-grandfathered → pre-Ed25519 SHA-256 hash, allowed until flag day
+        //   reject               → tampered / wrong keypair / missing signature
+        const verify = verifyLicenseSignature(data);
+        if (!verify.ok) {
+            console.error(`[ContextEngine] ⛔ License signature rejected — ${verify.reason}. Premium features disabled. ` +
+                `Reactivate at https://compr.ch/contextengine/pricing if this surprises you.`);
+            safeAppend("activation.signature_reject", {
+                plan: data.plan,
+                machine_id: data.machineId,
+                reason: verify.reason,
+            });
+            return null;
+        }
+        if (verify.mode === "legacy-grandfathered") {
+            console.error(`[ContextEngine] ⚠ ${verify.warning}`);
+            safeAppend("activation.legacy_signature", {
+                plan: data.plan,
+                machine_id: data.machineId,
+            });
+        }
+        return data;
+    }
+    catch {
+        return null;
+    }
+}
+function saveLicense(license) {
+    const dir = join(homedir(), ".contextengine");
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+    writeFileSync(LICENSE_FILE, JSON.stringify(license, null, 2));
+}
+// ---------------------------------------------------------------------------
+// Activation flow
+// ---------------------------------------------------------------------------
+export async function activate(licenseKey, email) {
+    try {
+        const machineId = getMachineId();
+        const response = await fetch(ACTIVATION_API, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                key: licenseKey,
+                email,
+                machineId,
+                version: getPackageVersion(),
+                platform: process.platform,
+                arch: process.arch,
+            }),
+        });
+        if (!response.ok) {
+            const text = await response.text();
+            return { success: false, message: `Activation failed: ${response.status} ${text}` };
+        }
+        const data = (await response.json());
+        if (!data.success) {
+            return { success: false, message: data.error || "Activation rejected" };
+        }
+        // Save license
+        saveLicense(data.license);
+        // Decrypt and store delta modules
+        await installDelta(data.delta, data.license.key);
+        safeAppend("activation.activate", {
+            plan: data.license.plan,
+            email: data.license.email,
+            machine_id: data.license.machineId,
+            expires_at: data.license.expiresAt,
+            delta_version: data.license.deltaVersion,
+        });
+        return {
+            success: true,
+            message: `✅ Activated! Plan: ${data.license.plan}, expires: ${data.license.expiresAt}`,
+            plan: data.license.plan,
+        };
+    }
+    catch (err) {
+        return { success: false, message: `Activation error: ${err.message}` };
+    }
+}
+// ---------------------------------------------------------------------------
+// Delta module management
+// ---------------------------------------------------------------------------
+async function installDelta(delta, licenseKey) {
+    if (!existsSync(DELTA_DIR))
+        mkdirSync(DELTA_DIR, { recursive: true });
+    // Derive decryption key from license key
+    const derivedKey = createHash("sha256")
+        .update(licenseKey + getMachineId())
+        .digest();
+    const iv = Buffer.from(delta.iv, "hex");
+    for (const mod of delta.modules) {
+        const encrypted = Buffer.from(mod.payload, "base64");
+        // AES-256-CBC decrypt
+        const decipher = createDecipheriv("aes-256-cbc", derivedKey, iv);
+        let decrypted = decipher.update(encrypted);
+        decrypted = Buffer.concat([decrypted, decipher.final()]);
+        const content = decrypted.toString("utf-8");
+        // Verify checksum
+        const checksum = createHash("sha256").update(content).digest("hex");
+        if (checksum !== mod.checksum) {
+            throw new Error(`Delta module ${mod.name} checksum mismatch — possible tampering`);
+        }
+        // Write to delta directory
+        writeFileSync(join(DELTA_DIR, `${mod.name}.mjs`), content);
+    }
+    // Write version marker
+    writeFileSync(join(DELTA_DIR, "manifest.json"), JSON.stringify({
+        version: delta.version,
+        installedAt: new Date().toISOString(),
+        modules: delta.modules.map((m) => m.name),
+    }));
+    console.error(`[ContextEngine] 📦 Delta v${delta.version} installed (${delta.modules.length} modules)`);
+}
+/**
+ * Check if delta modules are installed and valid.
+ */
+export function isDeltaInstalled() {
+    const manifestPath = join(DELTA_DIR, "manifest.json");
+    if (!existsSync(manifestPath))
+        return false;
+    try {
+        const manifest = JSON.parse(readFileSync(manifestPath, "utf-8"));
+        // Verify all expected module files exist
+        for (const modName of manifest.modules) {
+            if (!existsSync(join(DELTA_DIR, `${modName}.mjs`)))
+                return false;
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Dynamically import a delta module.
+ * Returns null if not activated or module not found.
+ */
+export async function loadDeltaModule(name) {
+    if (!isDeltaInstalled())
+        return null;
+    const modulePath = join(DELTA_DIR, `${name}.mjs`);
+    if (!existsSync(modulePath))
+        return null;
+    try {
+        // Dynamic import of the decrypted module
+        const moduleUrl = `file://${modulePath}`;
+        return await import(moduleUrl);
+    }
+    catch (err) {
+        console.error(`[ContextEngine] ⚠ Failed to load delta module ${name}:`, err.message);
+        return null;
+    }
+}
+// ---------------------------------------------------------------------------
+// Heartbeat — periodic license validation
+// ---------------------------------------------------------------------------
+export async function heartbeat() {
+    const license = loadLicense();
+    if (!license)
+        return false;
+    const lastBeat = new Date(license.lastHeartbeat).getTime();
+    const now = Date.now();
+    // Only check once per day
+    if (now - lastBeat < HEARTBEAT_INTERVAL_MS)
+        return true;
+    try {
+        const response = await fetch(`${ACTIVATION_API_BASE}/heartbeat`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                key: license.key,
+                machineId: getMachineId(),
+                deltaVersion: license.deltaVersion,
+            }),
+        });
+        if (response.ok) {
+            license.lastHeartbeat = new Date().toISOString();
+            saveLicense(license);
+            return true;
+        }
+        // License revoked or expired server-side
+        console.error("[ContextEngine] ⚠ License validation failed — premium features disabled");
+        return false;
+    }
+    catch {
+        // Network error — allow offline grace period (7 days)
+        const daysSinceLastBeat = (now - lastBeat) / (1000 * 60 * 60 * 24);
+        if (daysSinceLastBeat > 7) {
+            console.error("[ContextEngine] ⚠ Offline too long — premium features disabled");
+            return false;
+        }
+        return true; // grace period
+    }
+}
+// ---------------------------------------------------------------------------
+// Deactivation
+// ---------------------------------------------------------------------------
+export function deactivate() {
+    const prior = loadLicense();
+    // Remove license
+    if (existsSync(LICENSE_FILE))
+        unlinkSync(LICENSE_FILE);
+    // Remove delta modules
+    if (existsSync(DELTA_DIR)) {
+        for (const file of readdirSync(DELTA_DIR)) {
+            unlinkSync(join(DELTA_DIR, file));
+        }
+    }
+    safeAppend("activation.deactivate", {
+        prior_plan: prior?.plan ?? null,
+        prior_email: prior?.email ?? null,
+        machine_id: prior?.machineId ?? null,
+    });
+    console.error("[ContextEngine] 🔒 Deactivated — premium features removed");
+}
+// ---------------------------------------------------------------------------
+// Status
+// ---------------------------------------------------------------------------
+export function getActivationStatus() {
+    const license = loadLicense();
+    const deltaInstalled = isDeltaInstalled();
+    if (!license || !deltaInstalled) {
+        return {
+            activated: false,
+            plan: "community",
+            expiresAt: "n/a",
+            deltaVersion: "n/a",
+            premiumTools: [],
+            machineId: getMachineId(),
+        };
+    }
+    return {
+        activated: true,
+        plan: license.plan,
+        expiresAt: license.expiresAt,
+        deltaVersion: license.deltaVersion,
+        premiumTools: [...PREMIUM_TOOLS],
+        machineId: getMachineId(),
+    };
+}
+/**
+ * Check if a specific tool requires activation.
+ */
+export function requiresActivation(toolName) {
+    return PREMIUM_TOOLS.includes(toolName);
+}
+/**
+ * Gate check — returns error message if tool requires activation but isn't activated.
+ * Returns null if tool is available.
+ */
+export function gateCheck(toolName) {
+    if (!requiresActivation(toolName))
+        return null;
+    const license = loadLicense();
+    if (!license) {
+        return `🔒 "${toolName}" requires a ContextEngine Pro license.\n\n` +
+            `Activate with: npx contextengine activate <license-key> <email>\n` +
+            `Get a license: https://compr.ch/contextengine/pricing\n\n` +
+            `Free tools available: search_context, list_sources, read_source, reindex, ` +
+            `save_session, load_session, list_sessions, end_session, save_learning, ` +
+            `list_learnings, import_learnings`;
+    }
+    if (!isDeltaInstalled()) {
+        return `🔒 Premium modules not installed. Re-activate:\n` +
+            `npx contextengine activate ${license.key} ${license.email}`;
+    }
+    return null;
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function getPackageVersion() {
+    try {
+        const pkgPath = join(import.meta.url.replace("file://", ""), "..", "..", "package.json");
+        const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+        return pkg.version || "unknown";
+    }
+    catch {
+        return "unknown";
+    }
+}
+//# sourceMappingURL=activation.js.map

package/dist/adapters.d.ts

@@ -0,0 +1,101 @@
+import type { Chunk } from "./ingest.js";
+/**
+ * ContextEngine Plugin/Adapter System
+ *
+ * Adapters are pluggable data source connectors that extend ContextEngine
+ * with custom data collection. Each adapter implements the Adapter interface
+ * and returns Chunk[] compatible with the existing search pipeline.
+ *
+ * Built-in collectors (git, package.json, docker, pm2, etc.) remain as-is.
+ * Adapters add NEW sources without modifying core code.
+ *
+ * Usage in contextengine.json:
+ * {
+ *   "adapters": [
+ *     { "name": "notion", "module": "./adapters/notion-adapter.js", "config": { "token": "$NOTION_TOKEN" } },
+ *     { "name": "jira", "module": "@compr/contextengine-jira", "config": { "baseUrl": "https://myorg.atlassian.net" } }
+ *   ]
+ * }
+ */
+/**
+ * Configuration for a single adapter entry in contextengine.json
+ */
+export interface AdapterEntry {
+    /** Unique identifier for this adapter instance */
+    name: string;
+    /** Module path — local file (./adapters/foo.js) or npm package (@compr/contextengine-jira) */
+    module: string;
+    /** Adapter-specific configuration (passed to init/collect) */
+    config?: Record<string, unknown>;
+    /** Whether this adapter is enabled (default: true) */
+    enabled?: boolean;
+}
+/**
+ * The interface every adapter must implement.
+ *
+ * Adapters are ES modules that export a default object implementing this interface,
+ * OR export a `createAdapter(config)` factory function.
+ */
+export interface Adapter {
+    /** Human-readable adapter name */
+    name: string;
+    /** Short description of what this adapter collects */
+    description: string;
+    /**
+     * Collect data and return searchable chunks.
+     * Called during reindex. Must be safe (read-only, no side effects).
+     * Should never throw — return empty array on failure.
+     *
+     * @param config — Adapter-specific config from contextengine.json
+     * @returns Array of chunks to merge into the search index
+     */
+    collect(config?: Record<string, unknown>): Promise<Chunk[]> | Chunk[];
+    /**
+     * Optional: validate configuration before collect().
+     * Return an error message string if config is invalid, or null if OK.
+     */
+    validate?(config?: Record<string, unknown>): string | null;
+    /**
+     * Optional: one-time initialization (e.g. auth handshake).
+     * Called once when the adapter is first loaded.
+     */
+    init?(config?: Record<string, unknown>): Promise<void> | void;
+    /**
+     * Optional: cleanup resources on shutdown.
+     */
+    destroy?(): Promise<void> | void;
+}
+/**
+ * Factory function signature — adapters can export this instead of a static object.
+ * Allows per-instance configuration.
+ */
+export type AdapterFactory = (config?: Record<string, unknown>) => Adapter | Promise<Adapter>;
+/**
+ * Load and register all adapters from config.
+ * Safe — logs errors but never crashes.
+ *
+ * @param entries — Adapter entries from contextengine.json
+ * @returns Number of successfully loaded adapters
+ */
+export declare function loadAdapters(entries: AdapterEntry[]): Promise<number>;
+/**
+ * Collect data from all registered adapters.
+ * Returns combined chunks from all adapters.
+ * Safe — individual adapter failures don't affect others.
+ *
+ * @param entries — Adapter entries (for config lookup)
+ * @returns Combined chunks from all adapters
+ */
+export declare function collectFromAdapters(entries: AdapterEntry[]): Promise<Chunk[]>;
+/**
+ * Destroy all registered adapters (cleanup).
+ */
+export declare function destroyAdapters(): Promise<void>;
+/**
+ * Get list of registered adapter names and their descriptions.
+ */
+export declare function listRegisteredAdapters(): Array<{
+    name: string;
+    description: string;
+}>;
+//# sourceMappingURL=adapters.d.ts.map

package/dist/adapters.js

@@ -0,0 +1,171 @@
+import { resolve } from "path";
+// ---------------------------------------------------------------------------
+// Adapter Registry
+// ---------------------------------------------------------------------------
+/** Active adapter instances keyed by name */
+const adapterRegistry = new Map();
+/**
+ * Resolve environment variable references in config values.
+ * Supports "$ENV_VAR" syntax — replaces with process.env value.
+ */
+function resolveEnvVars(config) {
+    const resolved = {};
+    for (const [key, value] of Object.entries(config)) {
+        if (typeof value === "string" && value.startsWith("$")) {
+            const envVar = value.slice(1);
+            resolved[key] = process.env[envVar] || value;
+        }
+        else if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+            resolved[key] = resolveEnvVars(value);
+        }
+        else {
+            resolved[key] = value;
+        }
+    }
+    return resolved;
+}
+/**
+ * Load a single adapter from its module path.
+ * Supports:
+ * - Local files: "./adapters/foo.js" (relative to config file)
+ * - npm packages: "@compr/contextengine-jira"
+ * - Named exports: "my-package#myAdapter"
+ */
+async function loadAdapterModule(modulePath, config) {
+    let moduleSpecifier = modulePath;
+    let exportName = null;
+    // Support "module#export" syntax
+    if (modulePath.includes("#")) {
+        const [mod, exp] = modulePath.split("#", 2);
+        moduleSpecifier = mod;
+        exportName = exp;
+    }
+    // Resolve relative paths from CWD
+    if (moduleSpecifier.startsWith(".") || moduleSpecifier.startsWith("/")) {
+        moduleSpecifier = resolve(process.cwd(), moduleSpecifier);
+    }
+    const mod = await import(moduleSpecifier);
+    // Check for factory function
+    if (exportName && typeof mod[exportName] === "function") {
+        return await mod[exportName](config);
+    }
+    if (typeof mod.createAdapter === "function") {
+        return await mod.createAdapter(config);
+    }
+    // Check for default export
+    if (mod.default) {
+        if (typeof mod.default === "function") {
+            return await mod.default(config);
+        }
+        if (typeof mod.default.collect === "function") {
+            return mod.default;
+        }
+    }
+    // Check for named adapter export
+    if (typeof mod.adapter === "object" && typeof mod.adapter.collect === "function") {
+        return mod.adapter;
+    }
+    throw new Error(`Module "${modulePath}" does not export a valid adapter. ` +
+        `Expected: default export with collect(), createAdapter() factory, or named 'adapter' export.`);
+}
+/**
+ * Load and register all adapters from config.
+ * Safe — logs errors but never crashes.
+ *
+ * @param entries — Adapter entries from contextengine.json
+ * @returns Number of successfully loaded adapters
+ */
+export async function loadAdapters(entries) {
+    let loaded = 0;
+    for (const entry of entries) {
+        if (entry.enabled === false) {
+            console.error(`[ContextEngine] 🔌 Adapter "${entry.name}" — disabled, skipping`);
+            continue;
+        }
+        try {
+            const resolvedConfig = entry.config ? resolveEnvVars(entry.config) : undefined;
+            const adapter = await loadAdapterModule(entry.module, resolvedConfig);
+            // Validate config if adapter supports it
+            if (adapter.validate) {
+                const error = adapter.validate(resolvedConfig);
+                if (error) {
+                    console.error(`[ContextEngine] ⚠ Adapter "${entry.name}" config invalid: ${error}`);
+                    continue;
+                }
+            }
+            // Initialize
+            if (adapter.init) {
+                await adapter.init(resolvedConfig);
+            }
+            adapterRegistry.set(entry.name, adapter);
+            loaded++;
+            console.error(`[ContextEngine] 🔌 Adapter "${entry.name}" loaded — ${adapter.description}`);
+        }
+        catch (err) {
+            console.error(`[ContextEngine] ⚠ Failed to load adapter "${entry.name}" from "${entry.module}": ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    return loaded;
+}
+/**
+ * Collect data from all registered adapters.
+ * Returns combined chunks from all adapters.
+ * Safe — individual adapter failures don't affect others.
+ *
+ * @param entries — Adapter entries (for config lookup)
+ * @returns Combined chunks from all adapters
+ */
+export async function collectFromAdapters(entries) {
+    const allChunks = [];
+    for (const entry of entries) {
+        const adapter = adapterRegistry.get(entry.name);
+        if (!adapter)
+            continue;
+        try {
+            const resolvedConfig = entry.config ? resolveEnvVars(entry.config) : undefined;
+            const startMs = Date.now();
+            const chunks = await adapter.collect(resolvedConfig);
+            const elapsedMs = Date.now() - startMs;
+            // Tag chunks with adapter source
+            for (const chunk of chunks) {
+                if (!chunk.source.includes(entry.name)) {
+                    chunk.source = `${entry.name} — ${chunk.source}`;
+                }
+            }
+            allChunks.push(...chunks);
+            if (chunks.length > 0) {
+                console.error(`[ContextEngine] 🔌 Adapter "${entry.name}" collected ${chunks.length} chunks (${elapsedMs}ms)`);
+            }
+        }
+        catch (err) {
+            console.error(`[ContextEngine] ⚠ Adapter "${entry.name}" collect() failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    return allChunks;
+}
+/**
+ * Destroy all registered adapters (cleanup).
+ */
+export async function destroyAdapters() {
+    for (const [name, adapter] of adapterRegistry) {
+        try {
+            if (adapter.destroy) {
+                await adapter.destroy();
+            }
+        }
+        catch (err) {
+            console.error(`[ContextEngine] ⚠ Adapter "${name}" destroy() failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    adapterRegistry.clear();
+}
+/**
+ * Get list of registered adapter names and their descriptions.
+ */
+export function listRegisteredAdapters() {
+    return Array.from(adapterRegistry.entries()).map(([name, adapter]) => ({
+        name,
+        description: adapter.description,
+    }));
+}
+//# sourceMappingURL=adapters.js.map