aios-core 1.0.0

package/packages/installer/src/config/templates/env-template.js

@@ -0,0 +1,270 @@
+/**
+ * .env Template Generator
+ * Story 1.6: Environment Configuration
+ *
+ * Generates .env file with secure defaults and helpful comments
+ *
+ * @module env-template
+ */
+
+const path = require('path');
+const fs = require('fs');
+
+/**
+ * Get the current AIOS version from package.json
+ * @returns {string} The version string
+ */
+function getAiosVersion() {
+  try {
+    // Try to find the root package.json
+    const rootPkgPath = path.resolve(__dirname, '../../../../package.json');
+    if (fs.existsSync(rootPkgPath)) {
+      const pkg = JSON.parse(fs.readFileSync(rootPkgPath, 'utf8'));
+      return pkg.version || '2.2.0';
+    }
+  } catch {
+    // Ignore errors
+  }
+  return '2.2.0';
+}
+
+const AIOS_VERSION = getAiosVersion();
+
+/**
+ * Generate .env file content
+ *
+ * @param {Object} apiKeys - API keys provided by user
+ * @param {string} [apiKeys.deepseek] - DeepSeek API key (optional)
+ * @param {string} [apiKeys.openai] - OpenAI API key (optional)
+ * @param {string} [apiKeys.anthropic] - Anthropic API key (optional)
+ * @param {string} [apiKeys.openrouter] - OpenRouter API key (optional)
+ * @param {string} [apiKeys.clickup] - ClickUp API key (optional)
+ * @param {string} [apiKeys.github] - GitHub token (optional)
+ * @param {string} [apiKeys.exa] - Exa API key (optional)
+ * @param {string} [apiKeys.supabaseUrl] - Supabase URL (optional)
+ * @param {string} [apiKeys.supabaseAnonKey] - Supabase anon key (optional)
+ * @returns {string} .env file content
+ */
+function generateEnvContent(apiKeys = {}) {
+  const content = `# ============================================
+# Synkra AIOS Environment Configuration
+# ============================================
+# Generated by AIOS Installer
+# DO NOT commit this file - it contains sensitive credentials
+# ============================================
+
+# --------------------------------------------
+# LLM Providers
+# --------------------------------------------
+
+# DeepSeek API (for claude-free command)
+# Get your key at: https://platform.deepseek.com/api_keys
+# Cost: ~$0.14/M tokens with tool calling support
+DEEPSEEK_API_KEY=${apiKeys.deepseek || ''}
+
+# OpenRouter API (for multi-model routing)
+# Get your key at: https://openrouter.ai/keys
+OPENROUTER_API_KEY=${apiKeys.openrouter || ''}
+
+# Anthropic API (direct, if not using Claude Max subscription)
+# Get your key at: https://console.anthropic.com/
+ANTHROPIC_API_KEY=${apiKeys.anthropic || ''}
+
+# OpenAI API Key - Get yours at: https://platform.openai.com/api-keys
+OPENAI_API_KEY=${apiKeys.openai || ''}
+
+# --------------------------------------------
+# Search & Research Tools
+# --------------------------------------------
+
+# Exa Search API (web search for agents)
+# Get your key at: https://exa.ai/
+EXA_API_KEY=${apiKeys.exa || ''}
+
+# Context7 (library documentation lookup)
+# Usually free, no key required for basic usage
+CONTEXT7_API_KEY=
+
+# --------------------------------------------
+# Database & Backend
+# --------------------------------------------
+
+# Supabase (database, auth, storage)
+# Get from your Supabase project settings
+SUPABASE_URL=${apiKeys.supabaseUrl || ''}
+SUPABASE_ANON_KEY=${apiKeys.supabaseAnonKey || ''}
+SUPABASE_SERVICE_ROLE_KEY=
+
+# --------------------------------------------
+# Version Control & CI/CD
+# --------------------------------------------
+
+# GitHub Token (for GitHub CLI and API access)
+# Create at: https://github.com/settings/tokens
+GITHUB_TOKEN=${apiKeys.github || ''}
+
+# --------------------------------------------
+# Project Management
+# --------------------------------------------
+
+# ClickUp API (if using ClickUp integration)
+# Get from: ClickUp Settings > Apps > API Token
+CLICKUP_API_KEY=${apiKeys.clickup || ''}
+
+# --------------------------------------------
+# Automation & Workflows
+# --------------------------------------------
+
+# N8N (workflow automation)
+# From your N8N instance settings
+N8N_API_KEY=
+N8N_WEBHOOK_URL=
+
+# --------------------------------------------
+# Monitoring & Analytics
+# --------------------------------------------
+
+# Sentry (error tracking)
+SENTRY_DSN=
+
+# --------------------------------------------
+# Cloud Providers
+# --------------------------------------------
+
+# Railway (deployment)
+RAILWAY_TOKEN=
+
+# Vercel (deployment)
+VERCEL_TOKEN=
+
+# --------------------------------------------
+# AIOS Core Configuration
+# --------------------------------------------
+NODE_ENV=development
+AIOS_VERSION=${AIOS_VERSION}
+
+# --------------------------------------------
+# Custom Configuration
+# --------------------------------------------
+# Add your custom API keys below
+`;
+
+  return content;
+}
+
+/**
+ * Generate .env.example file content (no sensitive data)
+ *
+ * @returns {string} .env.example file content
+ */
+function generateEnvExample() {
+  const content = `# ============================================
+# Synkra AIOS Environment Configuration
+# ============================================
+# Copy this file to .env and fill in your actual values
+# DO NOT commit .env with real credentials
+# ============================================
+
+# --------------------------------------------
+# LLM Providers
+# --------------------------------------------
+
+# DeepSeek API (for claude-free command)
+# Get your key at: https://platform.deepseek.com/api_keys
+# Cost: ~$0.14/M tokens with tool calling support
+DEEPSEEK_API_KEY=
+
+# OpenRouter API (for multi-model routing)
+# Get your key at: https://openrouter.ai/keys
+OPENROUTER_API_KEY=
+
+# Anthropic API (direct, if not using Claude Max subscription)
+# Get your key at: https://console.anthropic.com/
+ANTHROPIC_API_KEY=
+
+# OpenAI API Key - Get yours at: https://platform.openai.com/api-keys
+OPENAI_API_KEY=
+
+# --------------------------------------------
+# Search & Research Tools
+# --------------------------------------------
+
+# Exa Search API (web search for agents)
+# Get your key at: https://exa.ai/
+EXA_API_KEY=
+
+# Context7 (library documentation lookup)
+# Usually free, no key required for basic usage
+CONTEXT7_API_KEY=
+
+# --------------------------------------------
+# Database & Backend
+# --------------------------------------------
+
+# Supabase (database, auth, storage)
+# Get from your Supabase project settings
+SUPABASE_URL=
+SUPABASE_ANON_KEY=
+SUPABASE_SERVICE_ROLE_KEY=
+
+# --------------------------------------------
+# Version Control & CI/CD
+# --------------------------------------------
+
+# GitHub Token (for GitHub CLI and API access)
+# Create at: https://github.com/settings/tokens
+GITHUB_TOKEN=
+
+# --------------------------------------------
+# Project Management
+# --------------------------------------------
+
+# ClickUp API (if using ClickUp integration)
+# Get from: ClickUp Settings > Apps > API Token
+CLICKUP_API_KEY=
+
+# --------------------------------------------
+# Automation & Workflows
+# --------------------------------------------
+
+# N8N (workflow automation)
+# From your N8N instance settings
+N8N_API_KEY=
+N8N_WEBHOOK_URL=
+
+# --------------------------------------------
+# Monitoring & Analytics
+# --------------------------------------------
+
+# Sentry (error tracking)
+SENTRY_DSN=
+
+# --------------------------------------------
+# Cloud Providers
+# --------------------------------------------
+
+# Railway (deployment)
+RAILWAY_TOKEN=
+
+# Vercel (deployment)
+VERCEL_TOKEN=
+
+# --------------------------------------------
+# AIOS Core Configuration
+# --------------------------------------------
+NODE_ENV=development
+AIOS_VERSION=${AIOS_VERSION}
+
+# --------------------------------------------
+# Custom Configuration
+# --------------------------------------------
+# Add your custom API keys below
+`;
+
+  return content;
+}
+
+module.exports = {
+  generateEnvContent,
+  generateEnvExample,
+};

package/packages/installer/src/config/validation/config-validator.js

@@ -0,0 +1,243 @@
+/**
+ * Configuration Validation Module
+ * Story 1.6: Environment Configuration
+ *
+ * Validates .env and YAML configuration files
+ *
+ * @module config-validator
+ */
+
+const yaml = require('js-yaml');
+const path = require('path');
+
+/**
+ * Validate .env file format
+ *
+ * @param {string} content - .env file content
+ * @returns {Object} Validation result { valid: boolean, errors: Array<string> }
+ */
+function validateEnvFormat(content) {
+  const errors = [];
+  const lines = content.split('\n');
+
+  lines.forEach((line, index) => {
+    const lineNum = index + 1;
+    const trimmed = line.trim();
+
+    // Skip empty lines and comments
+    if (!trimmed || trimmed.startsWith('#')) {
+      return;
+    }
+
+    // Check for KEY=value format (no spaces around =)
+    if (!trimmed.match(/^[A-Z_][A-Z0-9_]*=/)) {
+      errors.push(`Line ${lineNum}: Invalid format. Expected KEY=value (no spaces around =)`);
+      return;
+    }
+
+    // Check for spaces around =
+    if (trimmed.match(/\s*=\s*/)) {
+      const [key, ...rest] = trimmed.split('=');
+      if (key.includes(' ') || (rest.length > 0 && rest[0].startsWith(' '))) {
+        errors.push(`Line ${lineNum}: Remove spaces around = in "${trimmed}"`);
+      }
+    }
+  });
+
+  return {
+    valid: errors.length === 0,
+    errors,
+  };
+}
+
+/**
+ * Validate API key format (basic check)
+ *
+ * @param {string} key - API key to validate
+ * @param {string} [provider] - Provider name for specific validation
+ * @returns {Object} Validation result { valid: boolean, error: string|null }
+ */
+function validateApiKeyFormat(key, provider = null) {
+  // Null/undefined/empty is valid (skip logic)
+  if (key === null || key === undefined || key === '') {
+    return { valid: true, error: null };
+  }
+
+  const trimmed = typeof key === 'string' ? key.trim() : '';
+
+  // Whitespace-only keys are invalid
+  if (key !== '' && trimmed === '') {
+    return { valid: false, error: 'API key cannot be only whitespace' };
+  }
+
+  // Provider-specific validation
+  if (provider) {
+    switch (provider.toLowerCase()) {
+      case 'openai':
+        // OpenAI keys start with sk- and are at least 20 chars
+        if (!trimmed.startsWith('sk-') || trimmed.length < 20) {
+          return { valid: false, error: 'OpenAI API keys should start with "sk-" and be at least 20 characters' };
+        }
+        break;
+
+      case 'anthropic':
+        // Anthropic keys start with sk-ant- and are longer
+        if (!trimmed.startsWith('sk-ant-') || trimmed.length < 30) {
+          return { valid: false, error: 'Anthropic API keys should start with "sk-ant-" and be at least 30 characters' };
+        }
+        break;
+
+      case 'github':
+        // GitHub tokens: ghp_ (personal), gho_ (OAuth), ghs_ (server), ghu_ (user), ghr_ (refresh), github_pat_ (fine-grained)
+        if (!trimmed.match(/^(ghp_|gho_|ghs_|ghu_|ghr_|github_pat_)/)) {
+          return { valid: false, error: 'GitHub tokens should start with ghp_, gho_, ghs_, ghu_, ghr_, or github_pat_' };
+        }
+        break;
+
+      // Other providers use basic validation
+      default:
+        break;
+    }
+  }
+
+  // Check for suspicious patterns (spaces, newlines)
+  if (trimmed.match(/\s/)) {
+    return { valid: false, error: 'API key should not contain spaces or newlines' };
+  }
+
+  // Check for minimum length (general safety)
+  if (trimmed.length < 10) {
+    return { valid: false, error: 'API key seems too short (minimum 10 characters)' };
+  }
+
+  return { valid: true, error: null };
+}
+
+/**
+ * Validate YAML syntax
+ *
+ * @param {string} content - YAML content
+ * @returns {Object} Validation result { valid: boolean, error: string|null, parsed: Object|null }
+ */
+function validateYamlSyntax(content) {
+  try {
+    const parsed = yaml.load(content);
+    return { valid: true, error: null, parsed };
+  } catch (error) {
+    return {
+      valid: false,
+      error: `YAML syntax error: ${error.message}`,
+      parsed: null,
+    };
+  }
+}
+
+/**
+ * Validate core-config.yaml structure
+ *
+ * @param {Object} config - Parsed YAML config
+ * @returns {Object} Validation result { valid: boolean, errors: Array<string> }
+ */
+function validateCoreConfigStructure(config) {
+  const errors = [];
+  const requiredFields = ['project', 'qa', 'prd', 'architecture'];
+
+  // Check required top-level fields
+  requiredFields.forEach(field => {
+    if (!config[field]) {
+      errors.push(`Missing required field: ${field}`);
+    }
+  });
+
+  // Validate project section
+  if (config.project) {
+    if (!config.project.type) {
+      errors.push('Missing project.type');
+    } else {
+      // Accept both lowercase and uppercase project types
+      const validTypes = ['GREENFIELD', 'BROWNFIELD', 'EXISTING_AIOS', 'greenfield', 'brownfield', 'existing_aios'];
+      if (!validTypes.includes(config.project.type)) {
+        errors.push(`Invalid project.type: ${config.project.type}. Expected greenfield, brownfield, or existing_aios`);
+      }
+    }
+  }
+
+  // Validate IDE section
+  if (config.ide) {
+    if (!Array.isArray(config.ide.selected)) {
+      errors.push('ide.selected must be an array');
+    }
+  }
+
+  return {
+    valid: errors.length === 0,
+    errors,
+  };
+}
+
+/**
+ * Validate file path (cross-platform)
+ *
+ * @param {string} filePath - Path to validate
+ * @returns {Object} Validation result { valid: boolean, error: string|null }
+ */
+function validatePath(filePath) {
+  // Check for null/undefined
+  if (!filePath) {
+    return { valid: false, error: 'Path cannot be empty' };
+  }
+
+  // Check for path traversal attempts (before normalization)
+  if (filePath.includes('..')) {
+    return { valid: false, error: 'Path traversal detected (..)' };
+  }
+
+  // Normalize and check again
+  const normalized = path.normalize(filePath);
+  if (normalized.includes('..')) {
+    return { valid: false, error: 'Path traversal detected (..)' };
+  }
+
+  // Check for invalid characters (basic check)
+  const invalidChars = /[<>"|?*\0]/;
+  if (invalidChars.test(filePath)) {
+    return { valid: false, error: 'Path contains invalid characters' };
+  }
+
+  return { valid: true, error: null };
+}
+
+/**
+ * Sanitize input to prevent injection
+ *
+ * @param {string} input - Input to sanitize
+ * @returns {string} Sanitized input
+ */
+function sanitizeInput(input) {
+  if (typeof input !== 'string') {
+    return '';
+  }
+
+  // Remove null bytes
+  let sanitized = input.replace(/\0/g, '');
+
+  // Trim whitespace
+  sanitized = sanitized.trim();
+
+  // Limit length (prevent DoS)
+  const maxLength = 10000;
+  if (sanitized.length > maxLength) {
+    sanitized = sanitized.substring(0, maxLength);
+  }
+
+  return sanitized;
+}
+
+module.exports = {
+  validateEnvFormat,
+  validateApiKeyFormat,
+  validateYamlSyntax,
+  validateCoreConfigStructure,
+  validatePath,
+  sanitizeInput,
+};

package/packages/installer/src/detection/detect-project-type.js

@@ -0,0 +1,81 @@
+const fs = require('fs');
+const path = require('path');
+
+/**
+ * Detects the type of project in the current directory
+ * 
+ * Detection Priority Order:
+ * 1. EXISTING_AIOS - .aios-core/ directory exists
+ * 2. GREENFIELD - directory is empty
+ * 3. BROWNFIELD - package.json OR .git exists
+ * 4. UNKNOWN - directory has files but no recognized markers
+ * 
+ * @param {string} targetDir - Directory to analyze (defaults to process.cwd())
+ * @returns {string} 'GREENFIELD' | 'BROWNFIELD' | 'EXISTING_AIOS' | 'UNKNOWN'
+ * @throws {Error} If directory cannot be accessed
+ * 
+ * @example
+ * // Detect current directory
+ * const type = detectProjectType();
+ * console.log(type); // 'GREENFIELD'
+ * 
+ * @example
+ * // Detect specific directory
+ * const type = detectProjectType('/path/to/project');
+ * console.log(type); // 'BROWNFIELD'
+ */
+function detectProjectType(targetDir = process.cwd()) {
+  try {
+    // Validate targetDir parameter
+    if (!targetDir || typeof targetDir !== 'string') {
+      throw new Error('Invalid targetDir parameter: must be a non-empty string');
+    }
+
+    // Normalize path for cross-platform compatibility
+    const normalizedDir = path.resolve(targetDir);
+
+    // Check if directory exists before attempting to read
+    if (!fs.existsSync(normalizedDir)) {
+      throw new Error(`Directory does not exist: ${normalizedDir}`);
+    }
+
+    // Check for AIOS installation markers (use path.join for security)
+    const hasAiosCore = fs.existsSync(path.join(normalizedDir, '.aios-core'));
+    
+    // If AIOS already installed, return immediately (highest priority)
+    if (hasAiosCore) {
+      return 'EXISTING_AIOS';
+    }
+
+    // Check directory contents
+    const dirContents = fs.readdirSync(normalizedDir);
+    const isEmpty = dirContents.length === 0;
+    
+    // Empty directory = greenfield (second priority)
+    if (isEmpty) {
+      return 'GREENFIELD';
+    }
+
+    // Check for project markers (third priority)
+    const hasPackageJson = fs.existsSync(path.join(normalizedDir, 'package.json'));
+    const hasGit = fs.existsSync(path.join(normalizedDir, '.git'));
+    
+    // Existing project markers = brownfield
+    if (hasPackageJson || hasGit) {
+      return 'BROWNFIELD';
+    }
+
+    // Directory has files but no recognized markers = unknown
+    return 'UNKNOWN';
+
+  } catch (error) {
+    // Log error with context for debugging
+    console.error(`[detect-project-type] Error detecting project type in '${targetDir}': ${error.message}`);
+    
+    // Re-throw with more context for caller to handle
+    throw new Error(`Failed to detect project type: ${error.message}`);
+  }
+}
+
+module.exports = { detectProjectType };
+