@tera-system/pro 0.2.11 → 0.2.12

package/MANIFEST.json

@@ -1,6 +1,6 @@
 {
   "name": "@tera-system/pro",
-  "version": "0.2.11",
+  "version": "0.2.12",
   "description": "Build manifest for the Tera System Pro commercial plugin component (THIN mode — content served from teranoo.com signed bundle).",
   "compatibleEnvironments": [
     "opencode"

package/RELEASES.md

@@ -6,6 +6,20 @@
 
 
 
+
+## 0.2.12 (2026-08-30)
+
+### Bug fix: preflight false tamper detection (SCP-2026-08-30-002)
+
+**What changed (scripts only - bundle unchanged):**
+- integrity.mjs: removed .tera/license.state.json from CRITICAL_FILES - it is a self-modifying STATE file (checkedAt changes on every install/heartbeat/re-check). License security comes from the Ed25519-signed key, not from hashing the state file.
+- install.js: license state is now written BEFORE the integrity snapshot, so the manifest always reflects the final on-disk state.
+- tera-license.mjs: added the 'activate <key> [email]' command (TERA_LICENSE_GUARD.md instructs blocked users to run it - it did not exist).
+
+**Why:**
+- preflight.mjs always failed with "Tampered files: .tera/license.state.json" because the install wrote the state file after the snapshot (0.36s gap) - verified and reproduced.
+- No bundle change: the fix is entirely in npm-shipped scripts. Server bundle stays v0.2.11.
+
 ## 0.2.11 (2026-08-30)
 
 ### Security hardening: license-gate message fix + zero core traces

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tera-system/pro",
-  "version": "0.2.11",
+  "version": "0.2.12",
   "description": "Tera System Pro — commercial edition (thin): system files are fetched from teranoo.com as a signed bundle; enforced license gate + heartbeat",
   "license": "SEE LICENSE IN LICENSE.md",
   "type": "module",

package/scripts/install.js

@@ -445,16 +445,9 @@ async function tryServerSync() {
       console.log("              npm run tera-sync   (or re-run install when online)");
     }
 
-    // Step 2: integrity manifest (after sync, covers server files too)
-    try {
-      const integrityManifest = createIntegrityManifest(target);
-      saveIntegrityManifest(target, integrityManifest);
-      console.log(`  [integrity] manifest created (${integrityManifest.fileCount} files tracked)`);
-    } catch (err) {
-      console.log(`  [integrity] skipped (${err.message}) — install continues`);
-    }
-
-    // Step 3: license verification (API-first with email, offline fallback)
+    // Step 2: license verification (API-first with email, offline fallback)
+    // NOTE: license state is written BEFORE the integrity snapshot (SCP-2026-08-30-002)
+    // so the manifest always reflects the final on-disk state.
     const stateFile = path.join(target, ".tera", "license.state.json");
     const prevState = readLicenseState(stateFile) || {};
     let licenseKey = prevState.licenseKey;
@@ -463,7 +456,7 @@ async function tryServerSync() {
     if (!accountEmail) accountEmail = process.env.TERA_LICENSE_EMAIL || undefined;
     const deviceId = prevState.deviceId || createDeviceId(target);
 
-    // 3a. best-effort activation (only when we have key + email and not activated yet)
+    // 2a. best-effort activation (only when we have key + email and not activated yet)
     if (licenseKey && accountEmail && !prevState.activated) {
       const act = await activateViaAPI(licenseKey, accountEmail, deviceId);
       if (act && act.ok === true) {
@@ -488,6 +481,15 @@ async function tryServerSync() {
 
     const sourceTag = result.source === "api" ? "☁️" : result.source === "offline" ? "🔒" : "🔄";
     console.log(`  [license ] ${sourceTag} state=${result.state} (${result.reason})`);
+
+    // Step 3: integrity manifest (AFTER all writes — snapshot reflects final state)
+    try {
+      const integrityManifest = createIntegrityManifest(target);
+      saveIntegrityManifest(target, integrityManifest);
+      console.log(`  [integrity] manifest created (${integrityManifest.fileCount} files tracked)`);
+    } catch (err) {
+      console.log(`  [integrity] skipped (${err.message}) — install continues`);
+    }
   } catch (err) {
     console.log(`  [license ] skipped (${err.message}) — install continues`);
   }

package/scripts/lib/integrity.mjs

@@ -12,7 +12,9 @@ const CRITICAL_FILES = [
   "scripts/lib/integrity.mjs",
   "scripts/install.js",
   "scripts/preflight.mjs",
-  ".tera/license.state.json",
+  // NOTE: .tera/license.state.json is intentionally NOT hashed (SCP-2026-08-30-002).
+  // It is a self-modifying STATE file (checkedAt written on every install/heartbeat/re-check).
+  // License security comes from the Ed25519-signed key, not from hashing the state file.
 ];
 
 /**

package/scripts/tera-license.mjs

@@ -13,7 +13,10 @@ function usage() {
   tera-license gen --tier <basic|premium> --project <name> --expires <YYYY-MM-DD> [--seats N]
        (private key: env TERA_LICENSE_PRIVATE or the dev key under license/dev/)
   tera-license check [--key <licenseKey> | --state-file <path>]
-       (or env TERA_LICENSE_KEY)`);
+       (or env TERA_LICENSE_KEY)
+  tera-license activate <licenseKey> [accountEmail]
+       (writes the key into .tera/license.state.json and verifies it)
+       (target: env TERA_TARGET_DIR / INIT_CWD / cwd)`);
 }
 
 const args = process.argv.slice(2);
@@ -58,6 +61,31 @@ if (cmd === "gen") {
     process.exit(0);
   }
   console.log(JSON.stringify(assessLicenseState(key), null, 2));
+} else if (cmd === "activate") {
+  // Write a license key into .tera/license.state.json and verify it (SCP-2026-08-30-002).
+  const key = args[1] || flag("--key");
+  if (!key) { usage(); process.exit(1); }
+  const email = args[2] || flag("--email") || process.env.TERA_LICENSE_EMAIL || null;
+  const target = path.resolve(process.env.TERA_TARGET_DIR || process.env.INIT_CWD || process.cwd());
+  const stateFile = path.join(target, ".tera", "license.state.json");
+  fs.mkdirSync(path.dirname(stateFile), { recursive: true });
+  const prev = readLicenseState(stateFile) || {};
+  const assessment = assessLicenseState(key);
+  const state = {
+    ...prev,
+    state: assessment.state,
+    reason: assessment.reason,
+    licenseKey: key,
+    accountEmail: email || prev.accountEmail || null,
+    deviceId: prev.deviceId || null,
+    activated: true,
+    expiresAt: assessment.expiresAt || null,
+    graceUntil: assessment.graceUntil || null,
+    checkedAt: new Date().toISOString(),
+  };
+  fs.writeFileSync(stateFile, JSON.stringify(state, null, 2));
+  console.log(`Activated: state=${assessment.state} (${assessment.reason}) — ${stateFile}`);
+  process.exit(assessment.state === "Active" || assessment.state === "Grace" ? 0 : 1);
 } else {
   usage();
 }