@ornexus/neocortex 4.60.66 → 4.60.68

package/packages/client/dist/commands/activate.js

@@ -1,8 +1,394 @@
-import{existsSync as Y,mkdirSync as x,writeFileSync as X,readFileSync as I}from"node:fs";import{join as i,dirname as C}from"node:path";import{homedir as W}from"node:os";import{fileURLToPath as J}from"node:url";import{LicenseClient as B}from"../license/license-client.js";import{EncryptedCache as P}from"../cache/encrypted-cache.js";import{getMachineFingerprint as S}from"../machine/fingerprint.js";import{updateAgentDescription as E}from"../agent/update-description.js";import{refreshStubs as h}from"../agent/refresh-stubs.js";import{updateAgentYaml as N}from"../agent/update-agent-yaml.js";import{saveSecureConfig as G,setSecureDirPermissions as _}from"../config/secure-config.js";import{DEFAULT_SERVER_URL as z}from"../constants.js";function b(){try{const e=J(import.meta.url);let t=C(e);for(let r=0;r<5;r++){try{const n=JSON.parse(I(i(t,"package.json"),"utf-8"));if(n.name==="@ornexus/neocortex"||n.name==="@neocortex/client")return n.version??"0.0.0"}catch{}t=C(t)}}catch{}return"0.0.0"}const o=i(W(),".neocortex"),c=i(o,"config.json"),q=/^NX-(F|P|E)-[a-f0-9]+-[a-f0-9]+$/i,H=/^nxk_(?:[a-z]+_)?[a-f0-9]+_[a-f0-9]+$/;function Q(e){if(!e||e.trim().length===0)return{valid:!1,error:"License key cannot be empty"};const t=e.trim().toUpperCase();return t.startsWith("NX-")?q.test(t)?{valid:!0}:{valid:!1,error:"Invalid license key format. Expected: NX-{TIER}-{ID} (e.g., NX-PRO-ABC-123)"}:{valid:!1,error:'License key must start with "NX-"'}}function Z(e){if(!e||e.trim().length===0)return{valid:!1,error:"API key cannot be empty"};const t=e.trim();return t.startsWith("nxk_")?t.length<20?{valid:!1,error:"API key is too short"}:H.test(t)?{valid:!0}:{valid:!1,error:"Invalid API key format. Expected: nxk_{id}_{check} (e.g., nxk_abc123def456...)"}:{valid:!1,error:'API key must start with "nxk_"'}}function he(){try{if(Y(c)){const e=I(c,"utf-8");return JSON.parse(e)}}catch{}return null}function A(e){x(o,{recursive:!0}),_(o);const t=i(o,"cache");if(x(t,{recursive:!0}),_(t),e.licenseKey||e.apiKey)G({serverUrl:e.serverUrl,mode:e.mode,machineId:e.machineId,activatedAt:e.activatedAt,tier:e.tier,licenseKey:e.licenseKey??e.apiKey});else{const r={configVersion:1,...e};X(c,JSON.stringify(r,null,2)+`
-`,"utf-8")}}async function ye(e){const{licenseKey:t,serverUrl:r=z}=e;if(!t)return{success:!1,message:["No key provided.","","Get your license key at https://neocortex.sh/portal/login","","Usage:","  neocortex activate YOUR-LICENSE-KEY","  neocortex activate YOUR-API-KEY"].join(`
-`)};const n=t.trim();if(n.startsWith("nxk_")){const s=Z(n);if(!s.valid)return{success:!1,message:`Invalid API key: ${s.error}`};const k=n.match(/^nxk_(free|pro|ent)_/),T={free:"free",pro:"pro",ent:"enterprise"},L=k?.[1]?T[k[1]]??"unknown":"unknown",w=S(),l=b();let m;try{const a=await fetch(`${r}/api/v1/license/activate-key`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({api_key:n,machine_id:w,client_version:l})});if(!a.ok)return{success:!1,message:`API key activation failed: ${(await a.json().catch(()=>({}))).message??`HTTP ${a.status}`}`};m=await a.json()}catch{return{success:!1,message:["Failed to connect to IP Protection Server.","","Possible causes:",`  - Server at ${r} is unreachable`,"  - Network connectivity issue","","Workaround: Use --local flag to run in local mode"].join(`
-`)}}const p=m.tier??L,$=i(o,"cache");try{await new P({cacheDir:$,passphrase:n}).set("neocortex:jwt:token",m.token,m.expires_in*1e3)}catch{}const M={serverUrl:r,mode:"remote",machineId:w,activatedAt:new Date().toISOString(),tier:p,apiKey:n};try{A(M)}catch(a){return{success:!1,message:`Failed to save configuration: ${a instanceof Error?a.message:"unknown error"}`}}const V=h(l,{forceCreate:!0,targetFilter:"claude-code"})+h(l);return E(l,p),N(l,p),{success:!0,message:["Neocortex activated successfully.","","Open your preferred platform (Claude Code, Cursor, VS Code, etc.)","and reference the Neocortex agent.",...V>0?["","Managed agent wrappers were refreshed while preserving existing Markdown frontmatter and unrelated platform files."]:[],"","Use *menu to see available commands or check the Docs in your Dashboard."].join(`
-`),tier:p,serverUrl:r,configPath:c}}const v=Q(n);if(!v.valid)return{success:!1,message:`Invalid license key: ${v.error}`};const d=n,g=d.match(/^NX-(F|P|E)-/i),F={F:"free",P:"pro",E:"enterprise"},K=g?.[1]?F[g[1].toUpperCase()]??"unknown":"unknown",U=i(o,"cache"),j=new P({cacheDir:U,passphrase:d}),D=new B({serverUrl:r,licenseKey:d,cacheProvider:j});let y;try{y=await D.activate()}catch{return{success:!1,message:["Failed to connect to IP Protection Server.","","Possible causes:",`  - Server at ${r} is unreachable`,"  - Network connectivity issue","  - Server is still being deployed","","Workaround: Use --local flag to run in local mode"].join(`
-`)}}if(!y)return{success:!1,message:["License activation failed.","","Possible causes:","  - Invalid or expired license key","  - License already activated on another machine","  - Server rejected the activation request","","Check your license key and try again.","Contact support if the problem persists."].join(`
-`)};const u=y.tier??K,O={serverUrl:r,mode:"remote",machineId:S(),activatedAt:new Date().toISOString(),tier:u,licenseKey:d};try{A(O)}catch(s){return{success:!1,message:`Failed to save config to ${c}: ${s instanceof Error?s.message:String(s)}`}}const f=b(),R=h(f,{forceCreate:!0,targetFilter:"claude-code"})+h(f);return E(f,u),N(f,u),{success:!0,message:["Neocortex activated successfully.","","Open your preferred platform (Claude Code, Cursor, VS Code, etc.)","and reference the Neocortex agent.",...R>0?["","Managed agent wrappers were refreshed while preserving existing Markdown frontmatter and unrelated platform files."]:[],"","Use *menu to see available commands or check the Docs in your Dashboard."].join(`
-`),tier:u,serverUrl:r,configPath:c}}export{ye as activate,Z as validateApiKeyFormat,Q as validateLicenseKeyFormat};
+/**
+ * @license FSL-1.1
+ * Copyright (c) 2026 OrNexus AI
+ *
+ * This file is part of Neocortex CLI, licensed under the
+ * Functional Source License, Version 1.1 (FSL-1.1).
+ *
+ * Change Date: February 20, 2029
+ * Change License: MIT
+ *
+ * See the LICENSE file in the project root for full license text.
+ */
+/**
+ * @neocortex/client - Activate Command
+ *
+ * Manages license activation for the Neocortex CLI.
+ * Validates license key with the IP Protection Server,
+ * caches JWT token, and creates user config file.
+ *
+ * Story 43.3 - AC1, AC3, AC4, AC5
+ */
+import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { homedir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+import { LicenseClient } from '../license/license-client.js';
+import { EncryptedCache } from '../cache/encrypted-cache.js';
+import { getMachineFingerprint } from '../machine/fingerprint.js';
+import { updateAgentDescription } from '../agent/update-description.js';
+import { refreshStubs } from '../agent/refresh-stubs.js';
+import { updateAgentYaml } from '../agent/update-agent-yaml.js';
+import { saveSecureConfig, setSecureDirPermissions } from '../config/secure-config.js';
+import { DEFAULT_SERVER_URL } from '../constants.js';
+// ── Version Resolution ────────────────────────────────────────────────────
+function getInstalledVersion() {
+    try {
+        const thisFile = fileURLToPath(import.meta.url);
+        let dir = dirname(thisFile);
+        for (let i = 0; i < 5; i++) {
+            try {
+                const pkg = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf-8'));
+                if (pkg.name === '@ornexus/neocortex' || pkg.name === '@neocortex/client') {
+                    return pkg.version ?? '0.0.0';
+                }
+            }
+            catch { /* no package.json at this level */ }
+            dir = dirname(dir);
+        }
+    }
+    catch { /* fallback */ }
+    return '0.0.0';
+}
+// ── Constants ─────────────────────────────────────────────────────────────
+const CONFIG_DIR = join(homedir(), '.neocortex');
+const CONFIG_FILE = join(CONFIG_DIR, 'config.json');
+// License key format: NX-{F|P|E}-{24 hex}-{4 hex checksum}
+const LICENSE_KEY_PATTERN = /^NX-(F|P|E)-[a-f0-9]+-[a-f0-9]+$/i;
+// API key format: nxk_{24hex}_{4check} (new, P32) or nxk_{tier}_{24hex}_{4check} (legacy)
+const API_KEY_PATTERN = /^nxk_(?:[a-z]+_)?[a-f0-9]+_[a-f0-9]+$/;
+// ── Validation ────────────────────────────────────────────────────────────
+/**
+ * Validate license key format.
+ * Format: NX-{TIER}-{random}-{random}
+ * Tiers: FREE, PRO, ENT
+ */
+export function validateLicenseKeyFormat(key) {
+    if (!key || key.trim().length === 0) {
+        return { valid: false, error: 'License key cannot be empty' };
+    }
+    const trimmed = key.trim().toUpperCase();
+    if (!trimmed.startsWith('NX-')) {
+        return { valid: false, error: 'License key must start with "NX-"' };
+    }
+    if (!LICENSE_KEY_PATTERN.test(trimmed)) {
+        return {
+            valid: false,
+            error: 'Invalid license key format. Expected: NX-{TIER}-{ID} (e.g., NX-PRO-ABC-123)',
+        };
+    }
+    return { valid: true };
+}
+/**
+ * Validate API key format.
+ * Format: nxk_{tier}_{random}_{check}
+ */
+export function validateApiKeyFormat(key) {
+    if (!key || key.trim().length === 0) {
+        return { valid: false, error: 'API key cannot be empty' };
+    }
+    const trimmed = key.trim();
+    if (!trimmed.startsWith('nxk_')) {
+        return { valid: false, error: 'API key must start with "nxk_"' };
+    }
+    if (trimmed.length < 20) {
+        return { valid: false, error: 'API key is too short' };
+    }
+    if (!API_KEY_PATTERN.test(trimmed)) {
+        return {
+            valid: false,
+            error: 'Invalid API key format. Expected: nxk_{id}_{check} (e.g., nxk_abc123def456...)',
+        };
+    }
+    return { valid: true };
+}
+// ── Config Management ─────────────────────────────────────────────────────
+/**
+ * Load existing user config, if any.
+ */
+function loadExistingConfig() {
+    try {
+        if (existsSync(CONFIG_FILE)) {
+            const raw = readFileSync(CONFIG_FILE, 'utf-8');
+            return JSON.parse(raw);
+        }
+    }
+    catch {
+        // Corrupted config - will be overwritten
+    }
+    return null;
+}
+/**
+ * Save user config after successful activation.
+ * License key is encrypted using machine fingerprint (Story 61.2).
+ * File permissions set to 600 (Story 61.4).
+ */
+function saveConfig(config) {
+    // Ensure directories exist with secure permissions
+    mkdirSync(CONFIG_DIR, { recursive: true });
+    setSecureDirPermissions(CONFIG_DIR);
+    const cacheDir = join(CONFIG_DIR, 'cache');
+    mkdirSync(cacheDir, { recursive: true });
+    setSecureDirPermissions(cacheDir);
+    if (config.licenseKey || config.apiKey) {
+        // Use secure config writer which encrypts the key
+        saveSecureConfig({
+            serverUrl: config.serverUrl,
+            mode: config.mode,
+            machineId: config.machineId,
+            activatedAt: config.activatedAt,
+            tier: config.tier,
+            licenseKey: (config.licenseKey ?? config.apiKey),
+        });
+    }
+    else {
+        // Fallback: write without key (should not happen in normal flow)
+        const fallbackConfig = { configVersion: 1, ...config };
+        writeFileSync(CONFIG_FILE, JSON.stringify(fallbackConfig, null, 2) + '\n', 'utf-8');
+    }
+}
+// ── Activate Command ──────────────────────────────────────────────────────
+/**
+ * Activate a Neocortex license.
+ *
+ * Flow:
+ * 1. Validate license key format
+ * 2. Call IP Protection Server to activate
+ * 3. Cache JWT token via LicenseClient
+ * 4. Create/update ~/.neocortex/config.json
+ * 5. Return result with feedback
+ */
+export async function activate(options) {
+    const { licenseKey, serverUrl = DEFAULT_SERVER_URL } = options;
+    // 1. Check if key is provided
+    if (!licenseKey) {
+        return {
+            success: false,
+            message: [
+                'No key provided.',
+                '',
+                'Get your license key at https://neocortex.sh/portal/login',
+                '',
+                'Usage:',
+                '  neocortex activate YOUR-LICENSE-KEY',
+                '  neocortex activate YOUR-API-KEY',
+            ].join('\n'),
+        };
+    }
+    const trimmedKey = licenseKey.trim();
+    // 2. Detect key type: API key (nxk_) or license key (NX-)
+    const isApiKey = trimmedKey.startsWith('nxk_');
+    if (isApiKey) {
+        // ── API Key Activation Flow (Story 22.04) ──────────────────────────
+        const apiValidation = validateApiKeyFormat(trimmedKey);
+        if (!apiValidation.valid) {
+            return {
+                success: false,
+                message: `Invalid API key: ${apiValidation.error}`,
+            };
+        }
+        // Extract tier from API key -- new format has no tier prefix, server returns tier in response
+        const tierMatch = trimmedKey.match(/^nxk_(free|pro|ent)_/);
+        const apiTierMap = { free: 'free', pro: 'pro', ent: 'enterprise' };
+        const tier = tierMatch?.[1] ? (apiTierMap[tierMatch[1]] ?? 'unknown') : 'unknown'; // will be overridden by server response
+        const machineId = getMachineFingerprint();
+        const cliVersion = getInstalledVersion();
+        // Call /api/v1/license/activate-key
+        let response;
+        try {
+            const res = await fetch(`${serverUrl}/api/v1/license/activate-key`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    api_key: trimmedKey,
+                    machine_id: machineId,
+                    client_version: cliVersion,
+                }),
+            });
+            if (!res.ok) {
+                const body = await res.json().catch(() => ({}));
+                const errorBody = body;
+                return {
+                    success: false,
+                    message: `API key activation failed: ${errorBody.message ?? `HTTP ${res.status}`}`,
+                };
+            }
+            response = await res.json();
+        }
+        catch {
+            return {
+                success: false,
+                message: [
+                    'Failed to connect to IP Protection Server.',
+                    '',
+                    'Possible causes:',
+                    `  - Server at ${serverUrl} is unreachable`,
+                    '  - Network connectivity issue',
+                    '',
+                    'Workaround: Use --local flag to run in local mode',
+                ].join('\n'),
+            };
+        }
+        const activatedTier = response.tier ?? tier;
+        // Cache JWT token via EncryptedCache
+        const cacheDir = join(CONFIG_DIR, 'cache');
+        try {
+            const encryptedCache = new EncryptedCache({
+                cacheDir,
+                passphrase: trimmedKey,
+            });
+            await encryptedCache.set('neocortex:jwt:token', response.token, response.expires_in * 1000);
+        }
+        catch {
+            // Cache is non-critical (fail-open)
+        }
+        // Save config with API key
+        const config = {
+            serverUrl,
+            mode: 'remote',
+            machineId,
+            activatedAt: new Date().toISOString(),
+            tier: activatedTier,
+            apiKey: trimmedKey,
+        };
+        try {
+            saveConfig(config);
+        }
+        catch (err) {
+            return {
+                success: false,
+                message: `Failed to save configuration: ${err instanceof Error ? err.message : 'unknown error'}`,
+            };
+        }
+        // Refresh stubs and agent description
+        const stubsRefreshed = refreshStubs(cliVersion, { forceCreate: true, targetFilter: 'claude-code' })
+            + refreshStubs(cliVersion);
+        updateAgentDescription(cliVersion, activatedTier);
+        updateAgentYaml(cliVersion, activatedTier);
+        return {
+            success: true,
+            message: [
+                'Neocortex activated successfully.',
+                '',
+                'Open your preferred platform (Claude Code, Cursor, VS Code, etc.)',
+                'and reference the Neocortex agent.',
+                ...(stubsRefreshed > 0
+                    ? ['', 'Managed agent wrappers were refreshed while preserving existing Markdown frontmatter and unrelated platform files.']
+                    : []),
+                '',
+                'Use *menu to see available commands or check the Docs in your Dashboard.',
+            ].join('\n'),
+            tier: activatedTier,
+            serverUrl,
+            configPath: CONFIG_FILE,
+        };
+    }
+    // ── License Key Activation Flow (existing) ──────────────────────────────
+    const validation = validateLicenseKeyFormat(trimmedKey);
+    if (!validation.valid) {
+        return {
+            success: false,
+            message: `Invalid license key: ${validation.error}`,
+        };
+    }
+    const normalizedKey = trimmedKey;
+    // Extract tier from key
+    const tierMatch = normalizedKey.match(/^NX-(F|P|E)-/i);
+    const tierMap = { F: 'free', P: 'pro', E: 'enterprise' };
+    const tier = tierMatch?.[1] ? (tierMap[tierMatch[1].toUpperCase()] ?? 'unknown') : 'unknown';
+    // Attempt activation via LicenseClient with EncryptedCache
+    const cacheDir = join(CONFIG_DIR, 'cache');
+    const encryptedCache = new EncryptedCache({
+        cacheDir,
+        passphrase: normalizedKey,
+    });
+    const client = new LicenseClient({
+        serverUrl,
+        licenseKey: normalizedKey,
+        cacheProvider: encryptedCache,
+    });
+    let activationResult;
+    try {
+        activationResult = await client.activate();
+    }
+    catch {
+        return {
+            success: false,
+            message: [
+                'Failed to connect to IP Protection Server.',
+                '',
+                'Possible causes:',
+                `  - Server at ${serverUrl} is unreachable`,
+                '  - Network connectivity issue',
+                '  - Server is still being deployed',
+                '',
+                'Workaround: Use --local flag to run in local mode',
+            ].join('\n'),
+        };
+    }
+    if (!activationResult) {
+        return {
+            success: false,
+            message: [
+                'License activation failed.',
+                '',
+                'Possible causes:',
+                '  - Invalid or expired license key',
+                '  - License already activated on another machine',
+                '  - Server rejected the activation request',
+                '',
+                'Check your license key and try again.',
+                'Contact support if the problem persists.',
+            ].join('\n'),
+        };
+    }
+    // An admin upgrade changes the server license tier without rotating the
+    // original NX-F/NX-P key. The validated activation response is authoritative;
+    // the prefix remains only a compatibility fallback for older servers.
+    const activatedTier = activationResult.tier ?? tier;
+    // Save config with license key for invoke re-authentication
+    const config = {
+        serverUrl,
+        mode: 'remote',
+        machineId: getMachineFingerprint(),
+        activatedAt: new Date().toISOString(),
+        tier: activatedTier,
+        licenseKey: normalizedKey,
+    };
+    try {
+        saveConfig(config);
+    }
+    catch (err) {
+        return {
+            success: false,
+            message: `Failed to save config to ${CONFIG_FILE}: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+    // Refresh Claude plus any other existing targets when versions differ.
+    const cliVersion = getInstalledVersion();
+    const stubsRefreshed = refreshStubs(cliVersion, {
+        forceCreate: true,
+        targetFilter: 'claude-code',
+    }) + refreshStubs(cliVersion);
+    // Update agent description with activated tier and version
+    updateAgentDescription(cliVersion, activatedTier);
+    // Update agent YAML with version and tier (Story 55.2)
+    updateAgentYaml(cliVersion, activatedTier);
+    return {
+        success: true,
+        message: [
+            'Neocortex activated successfully.',
+            '',
+            'Open your preferred platform (Claude Code, Cursor, VS Code, etc.)',
+            'and reference the Neocortex agent.',
+            ...(stubsRefreshed > 0
+                ? ['', 'Managed agent wrappers were refreshed while preserving existing Markdown frontmatter and unrelated platform files.']
+                : []),
+            '',
+            'Use *menu to see available commands or check the Docs in your Dashboard.',
+        ].join('\n'),
+        tier: activatedTier,
+        serverUrl,
+        configPath: CONFIG_FILE,
+    };
+}