@planu/cli 4.14.1 → 5.0.0

package/dist/tools/activate-license.js

@@ -1,132 +0,0 @@
-// tools/activate-license.ts — Handler for activate_license MCP tool.
-// Activates a license key via Lemon Squeezy API and persists the state locally.
-import { hostname, platform, userInfo } from 'node:os';
-import { basename } from 'node:path';
-import { licenseStore } from '../storage/index.js';
-import { activateLicense, computeMachineFingerprint, deactivateLicense, loadLicensePlans, variantToTier, } from '../engine/license-validator.js';
-import { invalidateTierCache } from './license-gate.js';
-import { t, ti } from '../i18n/index.js';
-function buildInstanceName() {
-    const host = hostname();
-    const user = userInfo().username;
-    const os = platform();
-    const project = basename(process.cwd());
-    return `planu-${host} · ${user}@${os} · ${project}`;
-}
-export async function handleActivateLicense(args) {
-    const { licenseKey, instanceName } = args;
-    if (!licenseKey || licenseKey.trim().length === 0) {
-        return {
-            content: [{ type: 'text', text: t('tools.activate_license.keyRequired') }],
-            isError: true,
-        };
-    }
-    const name = instanceName ?? buildInstanceName();
-    try {
-        const response = await activateLicense(licenseKey.trim(), name);
-        if (!response.activated) {
-            return {
-                content: [
-                    {
-                        type: 'text',
-                        text: ti('tools.activate_license.activationFailed', {
-                            error: response.error ?? 'Unknown error',
-                        }),
-                    },
-                ],
-                isError: true,
-            };
-        }
-        const tier = variantToTier(response.meta.variant_name);
-        const now = new Date().toISOString();
-        const state = {
-            licenseKey: response.license_key.key,
-            instanceId: response.instance.id,
-            tier,
-            activatedAt: now,
-            lastValidatedAt: now,
-            variantName: response.meta.variant_name,
-            customerName: response.meta.customer_name,
-            customerEmail: response.meta.customer_email,
-            machineFingerprint: computeMachineFingerprint(),
-            activationLimit: response.license_key.activation_limit,
-            activationUsage: response.license_key.activation_usage,
-        };
-        await licenseStore.saveLicenseState(state);
-        invalidateTierCache();
-        const tierLabel = tier.charAt(0).toUpperCase() + tier.slice(1);
-        return {
-            content: [
-                {
-                    type: 'text',
-                    text: [
-                        `✅ ${t('tools.activate_license.activatedSuccess')}`,
-                        '',
-                        ti('tools.activate_license.plan', { tier: tierLabel }),
-                        ti('tools.activate_license.customer', { name: response.meta.customer_name }),
-                        ti('tools.activate_license.instance', { name }),
-                        '',
-                        tier === 'pro'
-                            ? t('tools.activate_license.proAccess')
-                            : ti('tools.activate_license.tierAccess', { tier }),
-                    ].join('\n'),
-                },
-            ],
-        };
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        return {
-            content: [
-                {
-                    type: 'text',
-                    text: [
-                        ti('tools.activate_license.activationFailed', { error: message }),
-                        '',
-                        t('tools.activate_license.commonCauses'),
-                        `• ${t('tools.activate_license.causeInvalidKey')}`,
-                        `• ${t('tools.activate_license.causeAlreadyActivated')}`,
-                        `• ${t('tools.activate_license.causeNetwork')}`,
-                    ].join('\n'),
-                },
-            ],
-            isError: true,
-        };
-    }
-}
-export async function handleDeactivateLicense(args) {
-    if (!args.confirm) {
-        return {
-            content: [{ type: 'text', text: t('tools.activate_license.deactivationCancelled') }],
-        };
-    }
-    const state = await licenseStore.getLicenseState();
-    if (!state) {
-        return {
-            content: [{ type: 'text', text: t('tools.activate_license.noActiveLicense') }],
-        };
-    }
-    try {
-        await deactivateLicense(state.licenseKey, state.instanceId);
-    }
-    catch {
-        // Even if remote deactivation fails, we clear local state
-    }
-    await licenseStore.deleteLicenseState();
-    invalidateTierCache();
-    return {
-        content: [
-            {
-                type: 'text',
-                text: [
-                    `✅ ${t('tools.activate_license.deactivatedSuccess')}`,
-                    ti('tools.activate_license.deactivatedFreePlan', {
-                        count: String(loadLicensePlans().freeTools.length),
-                    }),
-                    t('tools.activate_license.keyReusable'),
-                ].join('\n'),
-            },
-        ],
-    };
-}
-//# sourceMappingURL=activate-license.js.map

package/dist/tools/checkpoint-handler.d.ts

@@ -1,3 +0,0 @@
-import type { ToolResult, SessionCheckpointInput } from '../types/index.js';
-export declare function handleSessionCheckpoint(args: SessionCheckpointInput): Promise<ToolResult>;
-//# sourceMappingURL=checkpoint-handler.d.ts.map

package/dist/tools/checkpoint-handler.js

@@ -1,130 +0,0 @@
-// tools/checkpoint-handler.ts — Handler for session_checkpoint tool (SPEC-220).
-import { execFileSync } from 'node:child_process';
-import { saveSessionState, getStagedFiles, getActiveSpecIds, } from '../storage/session-state-store.js';
-import { hashProjectPath } from '../storage/base-store.js';
-import { listSpecs } from '../storage/spec-store.js';
-// ---------------------------------------------------------------------------
-// Internal helpers
-// ---------------------------------------------------------------------------
-const SEPARATOR = '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━';
-function formatList(items) {
-    if (items.length === 0) {
-        return '(none)';
-    }
-    return items.map((i) => `- ${i}`).join('\n');
-}
-function buildHandoffBlock(savedAt, activeSpecs, decisions, nextSteps, stagedFiles) {
-    const lines = [
-        `Saved: ${savedAt}`,
-        '',
-        `Active specs: ${activeSpecs.length > 0 ? activeSpecs.join(', ') : '(none)'}`,
-        '',
-        'Decisions:',
-        formatList(decisions),
-        '',
-        'Next steps:',
-        formatList(nextSteps),
-        '',
-        `Staged files: ${stagedFiles.length > 0 ? stagedFiles.join(', ') : '(none)'}`,
-    ];
-    return lines.join('\n');
-}
-async function resolveActiveSpecs(projectPath, projectId) {
-    // Try spec store first (in-progress specs)
-    try {
-        const resolvedId = projectId !== '' ? projectId : hashProjectPath(projectPath);
-        const specs = await listSpecs(resolvedId);
-        const inProgress = specs
-            .filter((s) => s.status === 'implementing')
-            .map((s) => `${s.id} (${s.status})`);
-        if (inProgress.length > 0) {
-            return inProgress;
-        }
-    }
-    catch {
-        // Fallback to filesystem scan
-    }
-    return getActiveSpecIds(projectPath);
-}
-// ---------------------------------------------------------------------------
-// Pending HTML changes notification (SPEC-326)
-// ---------------------------------------------------------------------------
-function checkPlanuUncommittedChanges(projectPath) {
-    try {
-        const output = execFileSync('git', ['status', '--porcelain', 'planu/'], {
-            cwd: projectPath,
-            encoding: 'utf-8',
-            timeout: 5_000,
-            stdio: ['pipe', 'pipe', 'pipe'],
-        });
-        return output.trim().length > 0;
-    }
-    catch {
-        return false;
-    }
-}
-// ---------------------------------------------------------------------------
-// Worktree teardown recommendation (SPEC-279)
-// ---------------------------------------------------------------------------
-function buildWorktreeTeardownRecommendation(activeSpecs) {
-    const specNames = activeSpecs.map((s) => s.replace(/ \(implementing\)$/, '')).join(', ');
-    return {
-        type: 'worktree-teardown',
-        message: `Parallel sprint detected — ${String(activeSpecs.length)} specs in progress (${specNames}). Run these steps to close the sprint safely:`,
-        steps: [
-            'For each worktree: bash scripts/auto-merge.sh  (full pipeline + merge to develop)',
-            'bash scripts/prune-worktrees.sh  (clean up merged/orphan worktrees)',
-            'pnpm test:coverage  (verify thresholds before promoting to main)',
-            'git checkout main && git merge --ff-only develop && git push origin main',
-        ],
-    };
-}
-// ---------------------------------------------------------------------------
-// Handler
-// ---------------------------------------------------------------------------
-export async function handleSessionCheckpoint(args) {
-    const { projectPath, projectId, decisions = [], nextSteps = [] } = args;
-    const savedAt = new Date().toISOString();
-    const stagedFiles = getStagedFiles(projectPath);
-    const activeSpecs = await resolveActiveSpecs(projectPath, projectId);
-    await saveSessionState(projectPath, {
-        savedAt,
-        activeSpecs,
-        recentDecisions: decisions.slice(0, 5),
-        stagedFiles,
-        nextSteps,
-    });
-    const handoff = buildHandoffBlock(savedAt, activeSpecs, decisions, nextSteps, stagedFiles);
-    // SPEC-256: always include /btw tip in checkpoint recommendations
-    const recommendations = [
-        {
-            type: 'context-tip',
-            message: 'Use /btw for side questions during implementation — keeps context clean for the task. Example: /btw what does useEffect cleanup do?',
-            command: '/btw your question here',
-        },
-    ];
-    // SPEC-279: emit worktree teardown instructions when a parallel sprint is detected
-    if (activeSpecs.length >= 2) {
-        recommendations.push(buildWorktreeTeardownRecommendation(activeSpecs));
-    }
-    // SPEC-326: Pending HTML changes notification
-    const planuChanges = checkPlanuUncommittedChanges(projectPath);
-    const planuReminder = planuChanges
-        ? '\n\n📁 Spec changes pending — commit to save: `git add planu/specs/ planu/conventions.json && git commit -m "chore(planu): save spec updates"`'
-        : '';
-    const text = [
-        `Session checkpoint saved — ${savedAt}`,
-        '',
-        'Session Handoff Block (paste in new session):',
-        SEPARATOR,
-        handoff,
-        SEPARATOR,
-    ].join('\n') + planuReminder;
-    return {
-        content: [{ type: 'text', text }],
-        structuredContent: {
-            recommendations,
-        },
-    };
-}
-//# sourceMappingURL=checkpoint-handler.js.map

package/dist/tools/export-session.d.ts

@@ -1,3 +0,0 @@
-import type { ToolResult, ExportSessionInput } from '../types/index.js';
-export declare function handleExportSession(params: ExportSessionInput): Promise<ToolResult>;
-//# sourceMappingURL=export-session.d.ts.map

package/dist/tools/export-session.js

@@ -1,90 +0,0 @@
-import { hashProjectPath } from '../storage/base-store.js';
-import * as sessionStore from '../storage/session-store.js';
-function formatAsMarkdown(session) {
-    const lines = [];
-    lines.push(`# Session Export: ${session.id}`);
-    lines.push('');
-    lines.push(`## Summary`);
-    lines.push(`- **Project**: ${session.projectId}`);
-    lines.push(`- **Started**: ${session.startedAt}`);
-    lines.push(`- **Last Saved**: ${session.lastSavedAt}`);
-    lines.push(`- **Tool Calls**: ${String(session.toolCallCount)}`);
-    lines.push('');
-    if (session.activeSpecs.length > 0) {
-        lines.push('## Active Specs');
-        for (const spec of session.activeSpecs) {
-            lines.push(`- **${spec.specId}** (${spec.status}): ${spec.summary}`);
-        }
-        lines.push('');
-    }
-    if (session.decisions.length > 0) {
-        lines.push('## Decisions');
-        for (const d of session.decisions) {
-            const specRef = d.specId ? ` [${d.specId}]` : '';
-            lines.push(`- **${d.decision}**${specRef}`);
-            if (d.rationale) {
-                lines.push(`  - _${d.rationale}_`);
-            }
-        }
-        lines.push('');
-    }
-    if (session.modifiedFiles.length > 0) {
-        lines.push('## Modified Files');
-        for (const f of session.modifiedFiles) {
-            lines.push(`- \`${f.path}\` (${f.action})`);
-        }
-        lines.push('');
-    }
-    if (Object.keys(session.metadata).length > 0) {
-        lines.push('## Metadata');
-        lines.push('```json');
-        lines.push(JSON.stringify(session.metadata, null, 2));
-        lines.push('```');
-    }
-    return lines.join('\n');
-}
-export async function handleExportSession(params) {
-    const projectId = hashProjectPath(params.projectPath);
-    const format = params.format ?? 'markdown';
-    try {
-        let session;
-        if (params.sessionId) {
-            session = await sessionStore.load(projectId, params.sessionId);
-        }
-        else {
-            session = await sessionStore.getLatest(projectId);
-        }
-        if (!session) {
-            return {
-                content: [{ type: 'text', text: 'No sessions found for this project.' }],
-            };
-        }
-        if (format === 'json') {
-            const summary = [
-                `✅ **Session exported:** ${session.id}`,
-                '',
-                `**Project:** ${session.projectId}`,
-                `**Started:** ${session.startedAt}`,
-                `**Tool Calls:** ${String(session.toolCallCount)}`,
-                `**Active Specs:** ${String(session.activeSpecs.length)}`,
-                `**Decisions:** ${String(session.decisions.length)}`,
-                `**Modified Files:** ${String(session.modifiedFiles.length)}`,
-            ].join('\n');
-            return {
-                content: [{ type: 'text', text: summary }],
-                structuredContent: session,
-            };
-        }
-        return {
-            content: [{ type: 'text', text: formatAsMarkdown(session) }],
-        };
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        return {
-            content: [{ type: 'text', text: `Error exporting session: ${message}` }],
-            isError: true,
-        };
-    }
-}
-//# sourceMappingURL=export-session.js.map

package/dist/tools/license-gate.d.ts

@@ -1,18 +0,0 @@
-import type { PricingTier, ToolResult } from '../types/index.js';
-export declare function getCurrentTier(): Promise<PricingTier>;
-export declare function invalidateTierCache(): void;
-/**
- * Synchronous tier estimate based on environment variables only — no disk I/O.
- * Used at server startup to set the display name before async validation runs.
- * Returns 'enterprise' for owner token, 'pro' if a license key env var is set, 'free' otherwise.
- */
-export declare function getTierSync(): PricingTier;
-export declare function shouldBypassDailyRateLimit(toolName: string): boolean;
-export declare function withLicenseGate<T>(toolName: string, handler: (args: T, extra?: unknown) => Promise<ToolResult>): (args: T, extra?: unknown) => Promise<ToolResult>;
-/**
- * Wraps a handler with rate limiting (free tier only) and usage event recording.
- * For free tier: checks daily limit + cooldown before executing.
- * For all tiers: records a usage event after execution (fire-and-forget).
- */
-export declare function withUsageTracking<T>(toolName: string, handler: (args: T, extra?: unknown) => Promise<ToolResult>): (args: T, extra?: unknown) => Promise<ToolResult>;
-//# sourceMappingURL=license-gate.d.ts.map

package/dist/tools/license-gate.js

@@ -1,222 +0,0 @@
-// tools/license-gate.ts — Runtime license enforcement for MCP tool handlers.
-// Provides getCurrentTier() with in-memory cache and withLicenseGate() wrapper.
-import { createHash } from 'node:crypto';
-import { licenseStore } from '../storage/index.js';
-import * as usageStore from '../storage/usage-store.js';
-import { resolveCurrentTier, checkToolAccess, isValidationFresh, isInGracePeriod, validateLicense, computeMachineFingerprint, isOpenAccessActive, } from '../engine/license-validator.js';
-import { evaluateRateLimit, isTrialActive, trialDaysRemaining, recordUsageEvent, } from '../engine/usage-tracker/index.js';
-import { getSessionContext } from '../transports/session-context.js';
-// ---------------------------------------------------------------------------
-// Owner token override (SHA-256 verified, not reversible)
-// ---------------------------------------------------------------------------
-// Salt prefix for owner token hashing (v1). New token hashes must be generated
-// as: sha256(HASH_SALT + token). To regenerate OWNER_TOKEN_HASH run:
-//   node -e "const{createHash}=require('crypto');console.log(createHash('sha256').update('planu-owner-v1'+process.argv[1]).digest('hex'))" <token>
-const HASH_SALT = 'planu-owner-v1';
-// Hash generated without salt (legacy). Kept for migration: if you rotate the
-// owner token, generate a new salted hash and replace OWNER_TOKEN_HASH_V1.
-const OWNER_TOKEN_HASH = '9f9e8410fd0a718540fe1e29f7beaa2506b539c8732915d8eddcb3bcff9b9465';
-function checkOwnerOverride() {
-    const token = process.env.SDD_OWNER_TOKEN;
-    if (!token) {
-        return null;
-    }
-    const trimmed = token.trim();
-    // Try salted hash first (current scheme).
-    const saltedHash = createHash('sha256')
-        .update(HASH_SALT + trimmed)
-        .digest('hex');
-    if (saltedHash === OWNER_TOKEN_HASH) {
-        return 'enterprise';
-    }
-    // Fall back to legacy unsalted hash so existing tokens keep working.
-    // DEPRECATED: regenerate OWNER_TOKEN_HASH with salt when rotating the token.
-    const legacyHash = createHash('sha256').update(trimmed).digest('hex');
-    return legacyHash === OWNER_TOKEN_HASH ? 'enterprise' : null;
-}
-// ---------------------------------------------------------------------------
-// In-memory tier cache (avoids disk read on every tool call)
-// ---------------------------------------------------------------------------
-const CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes
-let cachedTier = null;
-let cacheTimestamp = 0;
-export async function getCurrentTier() {
-    // Per-session license key (hosted multi-tenant mode via HTTP transport)
-    const sessionCtx = getSessionContext();
-    if (sessionCtx?.licenseKey) {
-        return resolveSessionTier(sessionCtx.licenseKey);
-    }
-    const now = Date.now();
-    if (cachedTier !== null && now - cacheTimestamp < CACHE_TTL_MS) {
-        return cachedTier;
-    }
-    const ownerTier = checkOwnerOverride();
-    if (ownerTier) {
-        cachedTier = ownerTier;
-        cacheTimestamp = now;
-        return cachedTier;
-    }
-    let state = await licenseStore.getLicenseState();
-    // Synchronous online validation when license is stale (>7 days)
-    if (state && !isValidationFresh(state)) {
-        state = await performOnlineValidation(state);
-    }
-    cachedTier = resolveCurrentTier(state);
-    cacheTimestamp = now;
-    return cachedTier;
-}
-export function invalidateTierCache() {
-    cachedTier = null;
-    cacheTimestamp = 0;
-}
-/**
- * Synchronous tier estimate based on environment variables only — no disk I/O.
- * Used at server startup to set the display name before async validation runs.
- * Returns 'enterprise' for owner token, 'pro' if a license key env var is set, 'free' otherwise.
- */
-export function getTierSync() {
-    if (checkOwnerOverride()) {
-        return 'enterprise';
-    }
-    if (process.env.SDD_LICENSE_KEY?.trim()) {
-        return 'pro';
-    }
-    return 'free';
-}
-// ---------------------------------------------------------------------------
-// Per-session license resolution (hosted multi-tenant mode)
-// ---------------------------------------------------------------------------
-const sessionTierCache = new Map();
-const SESSION_TIER_TTL_MS = 10 * 60 * 1000; // 10 min — longer since online validation is expensive
-const RATE_LIMIT_EXEMPT_TOOLS = new Set([
-    'planu_status',
-    'update_status_batch',
-    'configure_code_graph',
-    'code_graph_status',
-]);
-export function shouldBypassDailyRateLimit(toolName) {
-    return RATE_LIMIT_EXEMPT_TOOLS.has(toolName);
-}
-async function resolveSessionTier(licenseKey) {
-    const now = Date.now();
-    const cached = sessionTierCache.get(licenseKey);
-    if (cached && now < cached.expiresAt) {
-        return cached.tier;
-    }
-    try {
-        const result = await validateLicense(licenseKey, 'hosted');
-        const tier = result.valid ? 'pro' : 'free';
-        sessionTierCache.set(licenseKey, { tier, expiresAt: now + SESSION_TIER_TTL_MS });
-        return tier;
-    }
-    catch {
-        // API unreachable — degrade to free (no grace period for session keys)
-        sessionTierCache.set(licenseKey, { tier: 'free', expiresAt: now + 60_000 }); // retry in 1 min
-        return 'free';
-    }
-}
-// ---------------------------------------------------------------------------
-// License gate wrapper
-// ---------------------------------------------------------------------------
-export function withLicenseGate(toolName, handler) {
-    return async (args, extra) => {
-        const tier = await getCurrentTier();
-        const trialContext = await resolveTrialContext(tier);
-        const check = checkToolAccess(toolName, tier, trialContext);
-        if (!check.allowed) {
-            return { content: [{ type: 'text', text: check.message }], isError: true };
-        }
-        return handler(args, extra);
-    };
-}
-/**
- * Resolves trial activity for free-tier users. Returns empty context for paid tiers
- * (no need to query trial state — they already have full access).
- */
-async function resolveTrialContext(tier) {
-    if (tier !== 'free') {
-        return { trialActive: false, trialDaysRemaining: 0 };
-    }
-    try {
-        const trialState = await usageStore.ensureTrialState();
-        return {
-            trialActive: isTrialActive(trialState.firstRunAt),
-            trialDaysRemaining: trialDaysRemaining(trialState.firstRunAt),
-        };
-    }
-    catch {
-        return { trialActive: false, trialDaysRemaining: 0 };
-    }
-}
-// ---------------------------------------------------------------------------
-// Usage tracking wrapper
-// ---------------------------------------------------------------------------
-/**
- * Wraps a handler with rate limiting (free tier only) and usage event recording.
- * For free tier: checks daily limit + cooldown before executing.
- * For all tiers: records a usage event after execution (fire-and-forget).
- */
-export function withUsageTracking(toolName, handler) {
-    return async (args, extra) => {
-        const tier = await getCurrentTier();
-        // During open-access window, skip rate limiting for free tier
-        if (tier === 'free' && !isOpenAccessActive() && !shouldBypassDailyRateLimit(toolName)) {
-            const today = new Date().toISOString().slice(0, 10);
-            const [trialState, callCount, lastCallAt] = await Promise.all([
-                usageStore.ensureTrialState(),
-                usageStore.getDailyCallCount(today),
-                usageStore.getLastCallTimestamp(),
-            ]);
-            const maxCalls = isTrialActive(trialState.firstRunAt) ? 50 : 30;
-            const check = evaluateRateLimit(callCount, maxCalls, lastCallAt, new Date());
-            if (!check.allowed) {
-                return { content: [{ type: 'text', text: check.message }], isError: true };
-            }
-        }
-        // Cast to ToolResult | undefined: TypeScript says ToolResult, but JS runtime may
-        // return undefined if a handler has a missing return path not caught at compile time.
-        // noImplicitReturns in tsconfig prevents new occurrences; this guard handles old ones.
-        const rawResult = (await handler(args, extra));
-        const result = rawResult ?? {
-            content: [{ type: 'text', text: 'Internal error: tool handler returned no result' }],
-            isError: true,
-        };
-        const success = !result.isError;
-        void usageStore
-            .appendUsageEvent(recordUsageEvent(toolName, tier, success))
-            .catch((err) => {
-            console.error('[planu] appendUsageEvent failed:', err);
-        });
-        return result;
-    };
-}
-// ---------------------------------------------------------------------------
-// Synchronous online validation (replaces background fire-and-forget)
-// ---------------------------------------------------------------------------
-async function performOnlineValidation(state) {
-    try {
-        const result = await validateLicense(state.licenseKey, state.instanceId);
-        if (!result.valid) {
-            // License revoked remotely — clear local state
-            await licenseStore.deleteLicenseState();
-            return null;
-        }
-        const refreshed = {
-            ...state,
-            lastValidatedAt: new Date().toISOString(),
-            activationUsage: result.license_key.activation_usage,
-            machineFingerprint: computeMachineFingerprint(),
-        };
-        await licenseStore.saveLicenseState(refreshed);
-        return refreshed;
-    }
-    catch {
-        // API unreachable — allow if within grace period (TTL + 3 days)
-        if (isInGracePeriod(state)) {
-            return state;
-        }
-        // Grace period expired — degrade to free
-        return null;
-    }
-}
-//# sourceMappingURL=license-gate.js.map

package/dist/tools/license-status.d.ts

@@ -1,3 +0,0 @@
-import type { LicenseStatusInput, ToolResult } from '../types/index.js';
-export declare function handleLicenseStatus(_args: LicenseStatusInput): Promise<ToolResult>;
-//# sourceMappingURL=license-status.d.ts.map