@ornexus/neocortex 4.60.68 → 4.60.69

package/packages/client/dist/commands/activate.js

@@ -1,394 +1,8 @@
-/**
- * @license FSL-1.1
- * Copyright (c) 2026 OrNexus AI
- *
- * This file is part of Neocortex CLI, licensed under the
- * Functional Source License, Version 1.1 (FSL-1.1).
- *
- * Change Date: February 20, 2029
- * Change License: MIT
- *
- * See the LICENSE file in the project root for full license text.
- */
-/**
- * @neocortex/client - Activate Command
- *
- * Manages license activation for the Neocortex CLI.
- * Validates license key with the IP Protection Server,
- * caches JWT token, and creates user config file.
- *
- * Story 43.3 - AC1, AC3, AC4, AC5
- */
-import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'node:fs';
-import { join, dirname } from 'node:path';
-import { homedir } from 'node:os';
-import { fileURLToPath } from 'node:url';
-import { LicenseClient } from '../license/license-client.js';
-import { EncryptedCache } from '../cache/encrypted-cache.js';
-import { getMachineFingerprint } from '../machine/fingerprint.js';
-import { updateAgentDescription } from '../agent/update-description.js';
-import { refreshStubs } from '../agent/refresh-stubs.js';
-import { updateAgentYaml } from '../agent/update-agent-yaml.js';
-import { saveSecureConfig, setSecureDirPermissions } from '../config/secure-config.js';
-import { DEFAULT_SERVER_URL } from '../constants.js';
-// ── Version Resolution ────────────────────────────────────────────────────
-function getInstalledVersion() {
-    try {
-        const thisFile = fileURLToPath(import.meta.url);
-        let dir = dirname(thisFile);
-        for (let i = 0; i < 5; i++) {
-            try {
-                const pkg = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf-8'));
-                if (pkg.name === '@ornexus/neocortex' || pkg.name === '@neocortex/client') {
-                    return pkg.version ?? '0.0.0';
-                }
-            }
-            catch { /* no package.json at this level */ }
-            dir = dirname(dir);
-        }
-    }
-    catch { /* fallback */ }
-    return '0.0.0';
-}
-// ── Constants ─────────────────────────────────────────────────────────────
-const CONFIG_DIR = join(homedir(), '.neocortex');
-const CONFIG_FILE = join(CONFIG_DIR, 'config.json');
-// License key format: NX-{F|P|E}-{24 hex}-{4 hex checksum}
-const LICENSE_KEY_PATTERN = /^NX-(F|P|E)-[a-f0-9]+-[a-f0-9]+$/i;
-// API key format: nxk_{24hex}_{4check} (new, P32) or nxk_{tier}_{24hex}_{4check} (legacy)
-const API_KEY_PATTERN = /^nxk_(?:[a-z]+_)?[a-f0-9]+_[a-f0-9]+$/;
-// ── Validation ────────────────────────────────────────────────────────────
-/**
- * Validate license key format.
- * Format: NX-{TIER}-{random}-{random}
- * Tiers: FREE, PRO, ENT
- */
-export function validateLicenseKeyFormat(key) {
-    if (!key || key.trim().length === 0) {
-        return { valid: false, error: 'License key cannot be empty' };
-    }
-    const trimmed = key.trim().toUpperCase();
-    if (!trimmed.startsWith('NX-')) {
-        return { valid: false, error: 'License key must start with "NX-"' };
-    }
-    if (!LICENSE_KEY_PATTERN.test(trimmed)) {
-        return {
-            valid: false,
-            error: 'Invalid license key format. Expected: NX-{TIER}-{ID} (e.g., NX-PRO-ABC-123)',
-        };
-    }
-    return { valid: true };
-}
-/**
- * Validate API key format.
- * Format: nxk_{tier}_{random}_{check}
- */
-export function validateApiKeyFormat(key) {
-    if (!key || key.trim().length === 0) {
-        return { valid: false, error: 'API key cannot be empty' };
-    }
-    const trimmed = key.trim();
-    if (!trimmed.startsWith('nxk_')) {
-        return { valid: false, error: 'API key must start with "nxk_"' };
-    }
-    if (trimmed.length < 20) {
-        return { valid: false, error: 'API key is too short' };
-    }
-    if (!API_KEY_PATTERN.test(trimmed)) {
-        return {
-            valid: false,
-            error: 'Invalid API key format. Expected: nxk_{id}_{check} (e.g., nxk_abc123def456...)',
-        };
-    }
-    return { valid: true };
-}
-// ── Config Management ─────────────────────────────────────────────────────
-/**
- * Load existing user config, if any.
- */
-function loadExistingConfig() {
-    try {
-        if (existsSync(CONFIG_FILE)) {
-            const raw = readFileSync(CONFIG_FILE, 'utf-8');
-            return JSON.parse(raw);
-        }
-    }
-    catch {
-        // Corrupted config - will be overwritten
-    }
-    return null;
-}
-/**
- * Save user config after successful activation.
- * License key is encrypted using machine fingerprint (Story 61.2).
- * File permissions set to 600 (Story 61.4).
- */
-function saveConfig(config) {
-    // Ensure directories exist with secure permissions
-    mkdirSync(CONFIG_DIR, { recursive: true });
-    setSecureDirPermissions(CONFIG_DIR);
-    const cacheDir = join(CONFIG_DIR, 'cache');
-    mkdirSync(cacheDir, { recursive: true });
-    setSecureDirPermissions(cacheDir);
-    if (config.licenseKey || config.apiKey) {
-        // Use secure config writer which encrypts the key
-        saveSecureConfig({
-            serverUrl: config.serverUrl,
-            mode: config.mode,
-            machineId: config.machineId,
-            activatedAt: config.activatedAt,
-            tier: config.tier,
-            licenseKey: (config.licenseKey ?? config.apiKey),
-        });
-    }
-    else {
-        // Fallback: write without key (should not happen in normal flow)
-        const fallbackConfig = { configVersion: 1, ...config };
-        writeFileSync(CONFIG_FILE, JSON.stringify(fallbackConfig, null, 2) + '\n', 'utf-8');
-    }
-}
-// ── Activate Command ──────────────────────────────────────────────────────
-/**
- * Activate a Neocortex license.
- *
- * Flow:
- * 1. Validate license key format
- * 2. Call IP Protection Server to activate
- * 3. Cache JWT token via LicenseClient
- * 4. Create/update ~/.neocortex/config.json
- * 5. Return result with feedback
- */
-export async function activate(options) {
-    const { licenseKey, serverUrl = DEFAULT_SERVER_URL } = options;
-    // 1. Check if key is provided
-    if (!licenseKey) {
-        return {
-            success: false,
-            message: [
-                'No key provided.',
-                '',
-                'Get your license key at https://neocortex.sh/portal/login',
-                '',
-                'Usage:',
-                '  neocortex activate YOUR-LICENSE-KEY',
-                '  neocortex activate YOUR-API-KEY',
-            ].join('\n'),
-        };
-    }
-    const trimmedKey = licenseKey.trim();
-    // 2. Detect key type: API key (nxk_) or license key (NX-)
-    const isApiKey = trimmedKey.startsWith('nxk_');
-    if (isApiKey) {
-        // ── API Key Activation Flow (Story 22.04) ──────────────────────────
-        const apiValidation = validateApiKeyFormat(trimmedKey);
-        if (!apiValidation.valid) {
-            return {
-                success: false,
-                message: `Invalid API key: ${apiValidation.error}`,
-            };
-        }
-        // Extract tier from API key -- new format has no tier prefix, server returns tier in response
-        const tierMatch = trimmedKey.match(/^nxk_(free|pro|ent)_/);
-        const apiTierMap = { free: 'free', pro: 'pro', ent: 'enterprise' };
-        const tier = tierMatch?.[1] ? (apiTierMap[tierMatch[1]] ?? 'unknown') : 'unknown'; // will be overridden by server response
-        const machineId = getMachineFingerprint();
-        const cliVersion = getInstalledVersion();
-        // Call /api/v1/license/activate-key
-        let response;
-        try {
-            const res = await fetch(`${serverUrl}/api/v1/license/activate-key`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    api_key: trimmedKey,
-                    machine_id: machineId,
-                    client_version: cliVersion,
-                }),
-            });
-            if (!res.ok) {
-                const body = await res.json().catch(() => ({}));
-                const errorBody = body;
-                return {
-                    success: false,
-                    message: `API key activation failed: ${errorBody.message ?? `HTTP ${res.status}`}`,
-                };
-            }
-            response = await res.json();
-        }
-        catch {
-            return {
-                success: false,
-                message: [
-                    'Failed to connect to IP Protection Server.',
-                    '',
-                    'Possible causes:',
-                    `  - Server at ${serverUrl} is unreachable`,
-                    '  - Network connectivity issue',
-                    '',
-                    'Workaround: Use --local flag to run in local mode',
-                ].join('\n'),
-            };
-        }
-        const activatedTier = response.tier ?? tier;
-        // Cache JWT token via EncryptedCache
-        const cacheDir = join(CONFIG_DIR, 'cache');
-        try {
-            const encryptedCache = new EncryptedCache({
-                cacheDir,
-                passphrase: trimmedKey,
-            });
-            await encryptedCache.set('neocortex:jwt:token', response.token, response.expires_in * 1000);
-        }
-        catch {
-            // Cache is non-critical (fail-open)
-        }
-        // Save config with API key
-        const config = {
-            serverUrl,
-            mode: 'remote',
-            machineId,
-            activatedAt: new Date().toISOString(),
-            tier: activatedTier,
-            apiKey: trimmedKey,
-        };
-        try {
-            saveConfig(config);
-        }
-        catch (err) {
-            return {
-                success: false,
-                message: `Failed to save configuration: ${err instanceof Error ? err.message : 'unknown error'}`,
-            };
-        }
-        // Refresh stubs and agent description
-        const stubsRefreshed = refreshStubs(cliVersion, { forceCreate: true, targetFilter: 'claude-code' })
-            + refreshStubs(cliVersion);
-        updateAgentDescription(cliVersion, activatedTier);
-        updateAgentYaml(cliVersion, activatedTier);
-        return {
-            success: true,
-            message: [
-                'Neocortex activated successfully.',
-                '',
-                'Open your preferred platform (Claude Code, Cursor, VS Code, etc.)',
-                'and reference the Neocortex agent.',
-                ...(stubsRefreshed > 0
-                    ? ['', 'Managed agent wrappers were refreshed while preserving existing Markdown frontmatter and unrelated platform files.']
-                    : []),
-                '',
-                'Use *menu to see available commands or check the Docs in your Dashboard.',
-            ].join('\n'),
-            tier: activatedTier,
-            serverUrl,
-            configPath: CONFIG_FILE,
-        };
-    }
-    // ── License Key Activation Flow (existing) ──────────────────────────────
-    const validation = validateLicenseKeyFormat(trimmedKey);
-    if (!validation.valid) {
-        return {
-            success: false,
-            message: `Invalid license key: ${validation.error}`,
-        };
-    }
-    const normalizedKey = trimmedKey;
-    // Extract tier from key
-    const tierMatch = normalizedKey.match(/^NX-(F|P|E)-/i);
-    const tierMap = { F: 'free', P: 'pro', E: 'enterprise' };
-    const tier = tierMatch?.[1] ? (tierMap[tierMatch[1].toUpperCase()] ?? 'unknown') : 'unknown';
-    // Attempt activation via LicenseClient with EncryptedCache
-    const cacheDir = join(CONFIG_DIR, 'cache');
-    const encryptedCache = new EncryptedCache({
-        cacheDir,
-        passphrase: normalizedKey,
-    });
-    const client = new LicenseClient({
-        serverUrl,
-        licenseKey: normalizedKey,
-        cacheProvider: encryptedCache,
-    });
-    let activationResult;
-    try {
-        activationResult = await client.activate();
-    }
-    catch {
-        return {
-            success: false,
-            message: [
-                'Failed to connect to IP Protection Server.',
-                '',
-                'Possible causes:',
-                `  - Server at ${serverUrl} is unreachable`,
-                '  - Network connectivity issue',
-                '  - Server is still being deployed',
-                '',
-                'Workaround: Use --local flag to run in local mode',
-            ].join('\n'),
-        };
-    }
-    if (!activationResult) {
-        return {
-            success: false,
-            message: [
-                'License activation failed.',
-                '',
-                'Possible causes:',
-                '  - Invalid or expired license key',
-                '  - License already activated on another machine',
-                '  - Server rejected the activation request',
-                '',
-                'Check your license key and try again.',
-                'Contact support if the problem persists.',
-            ].join('\n'),
-        };
-    }
-    // An admin upgrade changes the server license tier without rotating the
-    // original NX-F/NX-P key. The validated activation response is authoritative;
-    // the prefix remains only a compatibility fallback for older servers.
-    const activatedTier = activationResult.tier ?? tier;
-    // Save config with license key for invoke re-authentication
-    const config = {
-        serverUrl,
-        mode: 'remote',
-        machineId: getMachineFingerprint(),
-        activatedAt: new Date().toISOString(),
-        tier: activatedTier,
-        licenseKey: normalizedKey,
-    };
-    try {
-        saveConfig(config);
-    }
-    catch (err) {
-        return {
-            success: false,
-            message: `Failed to save config to ${CONFIG_FILE}: ${err instanceof Error ? err.message : String(err)}`,
-        };
-    }
-    // Refresh Claude plus any other existing targets when versions differ.
-    const cliVersion = getInstalledVersion();
-    const stubsRefreshed = refreshStubs(cliVersion, {
-        forceCreate: true,
-        targetFilter: 'claude-code',
-    }) + refreshStubs(cliVersion);
-    // Update agent description with activated tier and version
-    updateAgentDescription(cliVersion, activatedTier);
-    // Update agent YAML with version and tier (Story 55.2)
-    updateAgentYaml(cliVersion, activatedTier);
-    return {
-        success: true,
-        message: [
-            'Neocortex activated successfully.',
-            '',
-            'Open your preferred platform (Claude Code, Cursor, VS Code, etc.)',
-            'and reference the Neocortex agent.',
-            ...(stubsRefreshed > 0
-                ? ['', 'Managed agent wrappers were refreshed while preserving existing Markdown frontmatter and unrelated platform files.']
-                : []),
-            '',
-            'Use *menu to see available commands or check the Docs in your Dashboard.',
-        ].join('\n'),
-        tier: activatedTier,
-        serverUrl,
-        configPath: CONFIG_FILE,
-    };
-}
+import{existsSync as Y,mkdirSync as x,writeFileSync as X,readFileSync as I}from"node:fs";import{join as i,dirname as C}from"node:path";import{homedir as W}from"node:os";import{fileURLToPath as J}from"node:url";import{LicenseClient as B}from"../license/license-client.js";import{EncryptedCache as P}from"../cache/encrypted-cache.js";import{getMachineFingerprint as S}from"../machine/fingerprint.js";import{updateAgentDescription as E}from"../agent/update-description.js";import{refreshStubs as h}from"../agent/refresh-stubs.js";import{updateAgentYaml as N}from"../agent/update-agent-yaml.js";import{saveSecureConfig as G,setSecureDirPermissions as _}from"../config/secure-config.js";import{DEFAULT_SERVER_URL as z}from"../constants.js";function b(){try{const e=J(import.meta.url);let t=C(e);for(let r=0;r<5;r++){try{const n=JSON.parse(I(i(t,"package.json"),"utf-8"));if(n.name==="@ornexus/neocortex"||n.name==="@neocortex/client")return n.version??"0.0.0"}catch{}t=C(t)}}catch{}return"0.0.0"}const o=i(W(),".neocortex"),c=i(o,"config.json"),q=/^NX-(F|P|E)-[a-f0-9]+-[a-f0-9]+$/i,H=/^nxk_(?:[a-z]+_)?[a-f0-9]+_[a-f0-9]+$/;function Q(e){if(!e||e.trim().length===0)return{valid:!1,error:"License key cannot be empty"};const t=e.trim().toUpperCase();return t.startsWith("NX-")?q.test(t)?{valid:!0}:{valid:!1,error:"Invalid license key format. Expected: NX-{TIER}-{ID} (e.g., NX-PRO-ABC-123)"}:{valid:!1,error:'License key must start with "NX-"'}}function Z(e){if(!e||e.trim().length===0)return{valid:!1,error:"API key cannot be empty"};const t=e.trim();return t.startsWith("nxk_")?t.length<20?{valid:!1,error:"API key is too short"}:H.test(t)?{valid:!0}:{valid:!1,error:"Invalid API key format. Expected: nxk_{id}_{check} (e.g., nxk_abc123def456...)"}:{valid:!1,error:'API key must start with "nxk_"'}}function he(){try{if(Y(c)){const e=I(c,"utf-8");return JSON.parse(e)}}catch{}return null}function A(e){x(o,{recursive:!0}),_(o);const t=i(o,"cache");if(x(t,{recursive:!0}),_(t),e.licenseKey||e.apiKey)G({serverUrl:e.serverUrl,mode:e.mode,machineId:e.machineId,activatedAt:e.activatedAt,tier:e.tier,licenseKey:e.licenseKey??e.apiKey});else{const r={configVersion:1,...e};X(c,JSON.stringify(r,null,2)+`
+`,"utf-8")}}async function ye(e){const{licenseKey:t,serverUrl:r=z}=e;if(!t)return{success:!1,message:["No key provided.","","Get your license key at https://neocortex.sh/portal/login","","Usage:","  neocortex activate YOUR-LICENSE-KEY","  neocortex activate YOUR-API-KEY"].join(`
+`)};const n=t.trim();if(n.startsWith("nxk_")){const s=Z(n);if(!s.valid)return{success:!1,message:`Invalid API key: ${s.error}`};const k=n.match(/^nxk_(free|pro|ent)_/),T={free:"free",pro:"pro",ent:"enterprise"},L=k?.[1]?T[k[1]]??"unknown":"unknown",w=S(),l=b();let m;try{const a=await fetch(`${r}/api/v1/license/activate-key`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({api_key:n,machine_id:w,client_version:l})});if(!a.ok)return{success:!1,message:`API key activation failed: ${(await a.json().catch(()=>({}))).message??`HTTP ${a.status}`}`};m=await a.json()}catch{return{success:!1,message:["Failed to connect to IP Protection Server.","","Possible causes:",`  - Server at ${r} is unreachable`,"  - Network connectivity issue","","Workaround: Use --local flag to run in local mode"].join(`
+`)}}const p=m.tier??L,$=i(o,"cache");try{await new P({cacheDir:$,passphrase:n}).set("neocortex:jwt:token",m.token,m.expires_in*1e3)}catch{}const M={serverUrl:r,mode:"remote",machineId:w,activatedAt:new Date().toISOString(),tier:p,apiKey:n};try{A(M)}catch(a){return{success:!1,message:`Failed to save configuration: ${a instanceof Error?a.message:"unknown error"}`}}const V=h(l,{forceCreate:!0,targetFilter:"claude-code"})+h(l);return E(l,p),N(l,p),{success:!0,message:["Neocortex activated successfully.","","Open your preferred platform (Claude Code, Cursor, VS Code, etc.)","and reference the Neocortex agent.",...V>0?["","Managed agent wrappers were refreshed while preserving existing Markdown frontmatter and unrelated platform files."]:[],"","Use *menu to see available commands or check the Docs in your Dashboard."].join(`
+`),tier:p,serverUrl:r,configPath:c}}const v=Q(n);if(!v.valid)return{success:!1,message:`Invalid license key: ${v.error}`};const d=n,g=d.match(/^NX-(F|P|E)-/i),F={F:"free",P:"pro",E:"enterprise"},K=g?.[1]?F[g[1].toUpperCase()]??"unknown":"unknown",U=i(o,"cache"),j=new P({cacheDir:U,passphrase:d}),D=new B({serverUrl:r,licenseKey:d,cacheProvider:j});let y;try{y=await D.activate()}catch{return{success:!1,message:["Failed to connect to IP Protection Server.","","Possible causes:",`  - Server at ${r} is unreachable`,"  - Network connectivity issue","  - Server is still being deployed","","Workaround: Use --local flag to run in local mode"].join(`
+`)}}if(!y)return{success:!1,message:["License activation failed.","","Possible causes:","  - Invalid or expired license key","  - License already activated on another machine","  - Server rejected the activation request","","Check your license key and try again.","Contact support if the problem persists."].join(`
+`)};const u=y.tier??K,O={serverUrl:r,mode:"remote",machineId:S(),activatedAt:new Date().toISOString(),tier:u,licenseKey:d};try{A(O)}catch(s){return{success:!1,message:`Failed to save config to ${c}: ${s instanceof Error?s.message:String(s)}`}}const f=b(),R=h(f,{forceCreate:!0,targetFilter:"claude-code"})+h(f);return E(f,u),N(f,u),{success:!0,message:["Neocortex activated successfully.","","Open your preferred platform (Claude Code, Cursor, VS Code, etc.)","and reference the Neocortex agent.",...R>0?["","Managed agent wrappers were refreshed while preserving existing Markdown frontmatter and unrelated platform files."]:[],"","Use *menu to see available commands or check the Docs in your Dashboard."].join(`
+`),tier:u,serverUrl:r,configPath:c}}export{ye as activate,Z as validateApiKeyFormat,Q as validateLicenseKeyFormat};