@tera-system/pro 0.1.0

package/scripts/lib/integrity.mjs

@@ -0,0 +1,195 @@
+// @tera/core — File integrity subsystem (Phase 4, multi-layer license enforcement)
+// Creates SHA256 manifest of installed files + tamper detection.
+import fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+
+const INTEGRITY_FILE = "integrity.json";
+const INTEGRITY_BACKUP = "integrity.bak.json";
+const CRITICAL_FILES = [
+  "scripts/lib/license.mjs",
+  "scripts/lib/license-gate.mjs",
+  "scripts/lib/integrity.mjs",
+  "scripts/install.js",
+  "scripts/preflight.mjs",
+  ".tera/license.state.json",
+];
+
+/**
+ * Compute SHA256 of a single file.
+ */
+export function sha256File(filePath) {
+  return createHash("sha256").update(fs.readFileSync(filePath)).digest("hex");
+}
+
+/**
+ * Walk a directory and compute hashes of all files.
+ */
+export function hashDirectory(dir, baseDir = dir) {
+  const result = {};
+  if (!fs.existsSync(dir)) return result;
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      Object.assign(result, hashDirectory(full, baseDir));
+    } else if (entry.isFile()) {
+      const rel = path.relative(baseDir, full).split(path.sep).join("/");
+      result[rel] = sha256File(full);
+    }
+  }
+  return result;
+}
+
+/**
+ * Create an integrity manifest of the Tera installation.
+ * Stored in two locations to prevent single-point deletion.
+ */
+export function createIntegrityManifest(target) {
+  const teraDir = path.join(target, "tera-system");
+  const opencodeAgents = path.join(target, ".opencode", "agents");
+  const opencodeCommands = path.join(target, ".opencode", "commands");
+  const scriptsDir = path.join(target, "scripts");
+
+  const manifest = {
+    version: 1,
+    createdAt: new Date().toISOString(),
+    target,
+    fileCount: 0,
+    hashes: {},
+    criticalHashes: {},
+  };
+
+  // Hash all tera-system files
+  if (fs.existsSync(teraDir)) {
+    Object.assign(manifest.hashes, hashDirectory(teraDir, target));
+  }
+  // Hash all agent files
+  if (fs.existsSync(opencodeAgents)) {
+    Object.assign(manifest.hashes, hashDirectory(opencodeAgents, target));
+  }
+  // Hash all command files
+  if (fs.existsSync(opencodeCommands)) {
+    Object.assign(manifest.hashes, hashDirectory(opencodeCommands, target));
+  }
+  // Hash scripts
+  if (fs.existsSync(scriptsDir)) {
+    Object.assign(manifest.hashes, hashDirectory(scriptsDir, target));
+  }
+
+  manifest.fileCount = Object.keys(manifest.hashes).length;
+
+  // Hash critical files separately (with absolute paths for self-check)
+  for (const rel of CRITICAL_FILES) {
+    const abs = path.join(target, rel);
+    if (fs.existsSync(abs)) {
+      manifest.criticalHashes[rel] = sha256File(abs);
+    }
+  }
+
+  return manifest;
+}
+
+/**
+ * Save integrity manifest to disk (in two locations for redundancy).
+ */
+export function saveIntegrityManifest(target, manifest) {
+  const teraDir = path.join(target, ".tera");
+  fs.mkdirSync(teraDir, { recursive: true });
+  const json = JSON.stringify(manifest, null, 2);
+
+  // Primary location
+  fs.writeFileSync(path.join(teraDir, INTEGRITY_FILE), json);
+  // Backup location (hidden, harder to find)
+  fs.writeFileSync(path.join(teraDir, INTEGRITY_BACKUP), json);
+
+  return manifest;
+}
+
+/**
+ * Read integrity manifest from disk.
+ * Tries primary first, falls back to backup.
+ */
+export function readIntegrityManifest(target) {
+  const teraDir = path.join(target, ".tera");
+  for (const filename of [INTEGRITY_FILE, INTEGRITY_BACKUP]) {
+    const p = path.join(teraDir, filename);
+    if (fs.existsSync(p)) {
+      try {
+        return JSON.parse(fs.readFileSync(p, "utf8"));
+      } catch {
+        continue;
+      }
+    }
+  }
+  return null;
+}
+
+/**
+ * Verify integrity — returns list of modified/missing files.
+ */
+export function verifyIntegrity(target) {
+  const manifest = readIntegrityManifest(target);
+  if (!manifest) {
+    return { ok: false, reason: "manifest-missing", modified: [], missing: [] };
+  }
+
+  const modified = [];
+  const missing = [];
+
+  for (const [rel, expectedHash] of Object.entries(manifest.hashes)) {
+    const abs = path.join(target, rel);
+    if (!fs.existsSync(abs)) {
+      missing.push(rel);
+      continue;
+    }
+    try {
+      const actualHash = sha256File(abs);
+      if (actualHash !== expectedHash) {
+        modified.push(rel);
+      }
+    } catch {
+      missing.push(rel);
+    }
+  }
+
+  return {
+    ok: modified.length === 0 && missing.length === 0,
+    reason: modified.length > 0 ? "files-modified" : missing.length > 0 ? "files-missing" : "ok",
+    modified,
+    missing,
+  };
+}
+
+/**
+ * Verify critical files (license-gate.mjs, integrity.mjs, etc.)
+ * Detects tampering with the gate itself.
+ */
+export function verifyCriticalFiles(target) {
+  const manifest = readIntegrityManifest(target);
+  if (!manifest || !manifest.criticalHashes) {
+    return { ok: false, reason: "no-critical-manifest", tampered: [] };
+  }
+
+  const tampered = [];
+  for (const [rel, expectedHash] of Object.entries(manifest.criticalHashes)) {
+    const abs = path.join(target, rel);
+    if (!fs.existsSync(abs)) {
+      tampered.push({ file: rel, reason: "missing" });
+      continue;
+    }
+    try {
+      const actualHash = sha256File(abs);
+      if (actualHash !== expectedHash) {
+        tampered.push({ file: rel, reason: "modified" });
+      }
+    } catch {
+      tampered.push({ file: rel, reason: "unreadable" });
+    }
+  }
+
+  return {
+    ok: tampered.length === 0,
+    reason: tampered.length > 0 ? "critical-tampered" : "ok",
+    tampered,
+  };
+}

package/scripts/lib/license-gate.mjs

@@ -0,0 +1,263 @@
+// @tera/core — Multi-layer License Gate (Phase 4)
+// Enforces license validity + detects tampering + periodic re-verification.
+import fs from "node:fs";
+import path from "node:path";
+import { assessLicenseState, parseLicenseKey } from "./license.mjs";
+import { verifyIntegrity, verifyCriticalFiles, readIntegrityManifest } from "./integrity.mjs";
+
+export const GATE_RESULTS = {
+  ALLOW: "allow",
+  DENY_NO_LICENSE: "deny-no-license",
+  DENY_EXPIRED: "deny-expired",
+  DENY_INVALID: "deny-invalid",
+  DENY_TAMPERED: "deny-tampered",
+  DENY_INTEGRITY: "deny-integrity",
+  DENY_NEEDS_RECHECK: "deny-needs-recheck",
+};
+
+const RECHECK_INTERVAL_DAYS = 30;
+const RECHECK_INTERVAL_MS = RECHECK_INTERVAL_DAYS * 86400000;
+
+/**
+ * Try to verify license via API (online check).
+ * Returns null if API unreachable.
+ */
+async function verifyViaAPI(licenseKey, apiUrl) {
+  if (!licenseKey || !apiUrl) return null;
+  try {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 5000);
+    const res = await fetch(`${apiUrl}/verify`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ licenseKey }),
+      signal: controller.signal,
+    });
+    clearTimeout(timeout);
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Layer 1: License state check
+ */
+function checkLicenseState(target) {
+  const stateFile = path.join(target, ".tera", "license.state.json");
+  if (!fs.existsSync(stateFile)) {
+    return { ok: false, reason: "no-state-file", state: "Unlicensed" };
+  }
+  try {
+    const state = JSON.parse(fs.readFileSync(stateFile, "utf8"));
+    return { ok: true, state };
+  } catch {
+    return { ok: false, reason: "state-corrupted", state: "Invalid" };
+  }
+}
+
+/**
+ * Layer 2: Check if periodic re-verification is due
+ */
+function checkRecheckDue(state) {
+  if (!state || !state.checkedAt) return { due: true };
+  const lastCheck = new Date(state.checkedAt).getTime();
+  if (!Number.isFinite(lastCheck)) return { due: true };
+  const now = Date.now();
+  const age = now - lastCheck;
+  return { due: age > RECHECK_INTERVAL_MS, ageDays: age / 86400000 };
+}
+
+/**
+ * Layer 3: Critical file integrity (gate itself)
+ */
+function checkCriticalFiles(target) {
+  return verifyCriticalFiles(target);
+}
+
+/**
+ * Layer 4: Full file integrity
+ */
+function checkAllFiles(target) {
+  return verifyIntegrity(target);
+}
+
+/**
+ * Multi-layer license gate enforcement.
+ * Returns: { allow, result, reason, state, ... }
+ *
+ * Hard denial cases (always block):
+ * - Unlicensed / Invalid / Expired license state
+ * - Critical files tampered (license-gate.mjs, integrity.mjs, etc.)
+ * - Integrity manifest missing
+ *
+ * Soft denial cases (warn but allow in Grace):
+ * - Periodic recheck overdue (can run, but warns)
+ */
+export async function enforceLicenseGate(target, options = {}) {
+  const apiUrl = options.apiUrl || process.env.TERA_LICENSE_API || "https://teranoo.com/api/license";
+  const offlineOnly = process.env.TERA_OFFLINE_ONLY === "1";
+  const reason = { layers: [] };
+
+  // ─── Layer 1: License state ──────────────────────────────────────
+  const stateCheck = checkLicenseState(target);
+  if (!stateCheck.ok) {
+    return {
+      allow: false,
+      result: GATE_RESULTS.DENY_NO_LICENSE,
+      reason: stateCheck.reason,
+      message: "❌ License state file missing or corrupted. Reinstall Tera System.",
+    };
+  }
+
+  const lic = stateCheck.state;
+  reason.layers.push({ layer: "license-state", state: lic.state, reason: lic.reason });
+
+  // Hard block: Unlicensed
+  if (lic.state === "Unlicensed") {
+    return {
+      allow: false,
+      result: GATE_RESULTS.DENY_NO_LICENSE,
+      reason: "unlicensed",
+      state: lic,
+      message:
+        "❌ Tera System License Required.\n" +
+        "Current state: Unlicensed (trial mode).\n\n" +
+        "Visit https://teranoo.com/pricing to obtain a license key.\n" +
+        "Then run: npm run tera-license -- activate <key>",
+    };
+  }
+
+  // Hard block: Invalid
+  if (lic.state === "Invalid") {
+    return {
+      allow: false,
+      result: GATE_RESULTS.DENY_INVALID,
+      reason: lic.reason || "invalid",
+      state: lic,
+      message:
+        "❌ Tera System License Invalid.\n" +
+        `Reason: ${lic.reason}\n\n` +
+        "Your license key is not valid. Please contact support@teranoo.com.",
+    };
+  }
+
+  // Hard block: Expired (past grace)
+  if (lic.state === "Expired") {
+    return {
+      allow: false,
+      result: GATE_RESULTS.DENY_EXPIRED,
+      reason: "expired",
+      state: lic,
+      message:
+        "❌ Tera System License Expired.\n" +
+        `Expired at: ${lic.expiresAt}\n\n` +
+        "Visit https://teranoo.com/pricing to renew.",
+    };
+  }
+
+  // ─── Layer 2: Critical file integrity (gate self-protection) ─────
+  const criticalCheck = checkCriticalFiles(target);
+  reason.layers.push({ layer: "critical-files", ok: criticalCheck.ok });
+  if (!criticalCheck.ok) {
+    return {
+      allow: false,
+      result: GATE_RESULTS.DENY_TAMPERED,
+      reason: "critical-files-tampered",
+      tampered: criticalCheck.tampered,
+      message:
+        "❌ Tera System files have been tampered with.\n" +
+        `Tampered files: ${criticalCheck.tampered.map((t) => t.file).join(", ")}\n\n` +
+        "Reinstall required: npm install @tera-system/core@latest",
+    };
+  }
+
+  // ─── Layer 3: Full integrity (deep tamper detection) ────────────
+  const integrityCheck = checkAllFiles(target);
+  reason.layers.push({
+    layer: "integrity",
+    ok: integrityCheck.ok,
+    modified: integrityCheck.modified?.length || 0,
+    missing: integrityCheck.missing?.length || 0,
+  });
+  if (!integrityCheck.ok) {
+    return {
+      allow: false,
+      result: GATE_RESULTS.DENY_INTEGRITY,
+      reason: integrityCheck.reason,
+      modified: integrityCheck.modified,
+      missing: integrityCheck.missing,
+      message:
+        "❌ Tera System installation has been modified.\n" +
+        `Modified files: ${integrityCheck.modified?.length || 0}\n` +
+        `Missing files: ${integrityCheck.missing?.length || 0}\n\n` +
+        "Reinstall required to restore integrity.",
+    };
+  }
+
+  // ─── Layer 4: Periodic re-verification ───────────────────────────
+  const recheck = checkRecheckDue(lic);
+  if (recheck.due && !offlineOnly) {
+    // Try API re-verification
+    const apiResult = await verifyViaAPI(lic.licenseKey, apiUrl);
+    if (apiResult && apiResult.valid === false) {
+      return {
+        allow: false,
+        result: GATE_RESULTS.DENY_INVALID,
+        reason: "api-revoked",
+        state: lic,
+        message:
+          "❌ License revoked by server.\n" +
+          `Reason: ${apiResult.reason || "revoked"}\n\n` +
+          "Contact support@teranoo.com.",
+      };
+    }
+    // Update last check timestamp
+    lic.checkedAt = new Date().toISOString();
+    fs.writeFileSync(path.join(target, ".tera", "license.state.json"), JSON.stringify(lic, null, 2));
+  }
+
+  // ─── Grace period: allow with warning ────────────────────────────
+  if (lic.state === "Grace") {
+    return {
+      allow: true,
+      result: GATE_RESULTS.ALLOW,
+      warning: true,
+      state: lic,
+      reason: "grace-period",
+      message: `⚠️ License in grace period. Expired at ${lic.expiresAt}. Renew soon.`,
+    };
+  }
+
+  // ─── Active license: full allow ─────────────────────────────────
+  return {
+    allow: true,
+    result: GATE_RESULTS.ALLOW,
+    state: lic,
+    reason: "active",
+  };
+}
+
+/**
+ * Synchronous version for quick checks (skips API re-verification).
+ */
+export function enforceLicenseGateSync(target) {
+  const stateCheck = checkLicenseState(target);
+  if (!stateCheck.ok) {
+    return { allow: false, result: GATE_RESULTS.DENY_NO_LICENSE, reason: stateCheck.reason };
+  }
+  const lic = stateCheck.state;
+  if (lic.state === "Unlicensed" || lic.state === "Invalid" || lic.state === "Expired") {
+    return { allow: false, result: GATE_RESULTS[`DENY_${lic.state.toUpperCase()}`], state: lic };
+  }
+  const criticalCheck = checkCriticalFiles(target);
+  if (!criticalCheck.ok) {
+    return { allow: false, result: GATE_RESULTS.DENY_TAMPERED, tampered: criticalCheck.tampered };
+  }
+  const integrityCheck = checkAllFiles(target);
+  if (!integrityCheck.ok) {
+    return { allow: false, result: GATE_RESULTS.DENY_INTEGRITY };
+  }
+  return { allow: true, result: GATE_RESULTS.ALLOW, state: lic, warning: lic.state === "Grace" };
+}

package/scripts/lib/license.mjs

@@ -0,0 +1,90 @@
+// @tera/core license subsystem — offline Ed25519 validation (Phase 3, SCP-005)
+import fs from "node:fs";
+import path from "node:path";
+import crypto from "node:crypto";
+import { fileURLToPath } from "node:url";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const PUBLIC_KEY_PATH = path.join(__dirname, "public-key.pem");
+
+export const STATES = {
+  UNLICENSED: "Unlicensed",
+  ACTIVE: "Active",
+  GRACE: "Grace",
+  EXPIRED: "Expired",
+  INVALID: "Invalid",
+};
+export const GRACE_DAYS = 7;
+
+function loadPublicKey() {
+  return fs.readFileSync(PUBLIC_KEY_PATH, "utf8");
+}
+
+/**
+ * Issue a signed license key (used by the issuer — Majed).
+ * Pricing model is DATA (tier/project/expiry/seats), never code.
+ */
+export function issueLicenseKey({ tier, project, issuedAt, expiresAt, seats = 1 }, privateKeyText) {
+  const payload = { v: 1, tier, project, issuedAt, expiresAt, seats };
+  const payloadB64 = Buffer.from(JSON.stringify(payload)).toString("base64url");
+  const sig = crypto.sign(null, Buffer.from(payloadB64), privateKeyText).toString("base64url");
+  return `${payloadB64}.${sig}`;
+}
+
+/** Verify signature (client-side, offline) — public key ships in package. */
+export function parseLicenseKey(key) {
+  if (typeof key !== "string" || !key.includes(".")) return { ok: false, reason: "malformed", payload: null };
+  const [payloadB64, sigB64] = key.split(".");
+  let payload;
+  try {
+    payload = JSON.parse(Buffer.from(payloadB64, "base64url").toString("utf8"));
+  } catch {
+    return { ok: false, reason: "bad-payload", payload: null };
+  }
+  let valid = false;
+  try {
+    valid = crypto.verify(null, Buffer.from(payloadB64), loadPublicKey(), Buffer.from(sigB64, "base64url"));
+  } catch {
+    valid = false;
+  }
+  if (!valid) return { ok: false, reason: "bad-signature", payload };
+  return { ok: true, reason: "valid", payload };
+}
+
+/** Map a key + now → one of the 6 license states (with offline grace period). */
+export function assessLicenseState(key, { now = new Date(), graceDays = GRACE_DAYS } = {}) {
+  if (!key) return { state: STATES.UNLICENSED, reason: "no-key-trial" };
+  const parsed = parseLicenseKey(key);
+  if (!parsed.ok) return { state: STATES.INVALID, reason: parsed.reason };
+  const t = parsed.payload;
+  const expires = new Date(t.expiresAt).getTime();
+  const nowMs = now.getTime();
+  if (!Number.isFinite(expires)) return { state: STATES.INVALID, reason: "bad-expiry", payload: t };
+  const graceMs = graceDays * 86400000;
+  if (nowMs <= expires) {
+    return { state: STATES.ACTIVE, reason: "valid", payload: t, expiresAt: t.expiresAt };
+  }
+  if (nowMs <= expires + graceMs) {
+    return {
+      state: STATES.GRACE,
+      reason: "expired-within-grace",
+      payload: t,
+      expiresAt: t.expiresAt,
+      graceUntil: new Date(expires + graceMs).toISOString(),
+    };
+  }
+  return { state: STATES.EXPIRED, reason: "expired", payload: t, expiresAt: t.expiresAt };
+}
+
+export function readLicenseState(stateFile) {
+  try {
+    return JSON.parse(fs.readFileSync(stateFile, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+export function writeLicenseState(stateFile, state) {
+  fs.mkdirSync(path.dirname(stateFile), { recursive: true });
+  fs.writeFileSync(stateFile, JSON.stringify(state, null, 2));
+}

package/scripts/lib/public-key.pem

@@ -0,0 +1,3 @@
+-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEARWylLsXN1N2/C3QiWt5QjsWmGD62fg79IilkrXmzW0k=
+-----END PUBLIC KEY-----

package/scripts/preflight.mjs

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+/**
+ * @tera/core — Preflight Check (runs before any agent/command)
+ * --------------------------------------------------------------
+ * Can be called manually: `node scripts/preflight.mjs`
+ * Or wired into custom hooks by the OpenCode plugin system.
+ *
+ * Returns exit code 0 if allowed, non-zero if denied.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { enforceLicenseGate } from "./lib/license-gate.mjs";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+function resolveTarget() {
+  const args = process.argv.slice(2);
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "--target" && args[i + 1]) return path.resolve(args[i + 1]);
+    if (args[i] === "--help") {
+      console.log("Usage: node scripts/preflight.mjs [--target <dir>] [--quiet]");
+      process.exit(0);
+    }
+  }
+  return path.resolve(process.env.TERA_TARGET_DIR || process.env.INIT_CWD || process.cwd());
+}
+
+const TARGET = resolveTarget();
+const QUIET = process.argv.includes("--quiet");
+
+(async () => {
+  try {
+    const result = await enforceLicenseGate(TARGET);
+
+    if (!QUIET) {
+      if (result.allow) {
+        if (result.warning) {
+          console.log(`⚠️  Tera License Gate: ALLOWED (warning)`);
+          if (result.message) console.log(`   ${result.message}`);
+        } else {
+          console.log(`✅ Tera License Gate: ALLOWED (state=${result.state?.state || "Active"})`);
+        }
+      } else {
+        console.log(`\n${result.message || "❌ License gate denied."}\n`);
+      }
+    }
+
+    process.exit(result.allow ? 0 : 1);
+  } catch (err) {
+    if (!QUIET) console.log(`⚠️  Preflight error: ${err.message}`);
+    // Fail closed on unexpected errors
+    process.exit(1);
+  }
+})();