aiox-core 5.0.7 → 5.0.8

package/bin/aiox.js

@@ -8,8 +8,6 @@
 
 const path = require('path');
 const fs = require('fs');
-const { execSync } = require('child_process');
-
 // Read package.json for version
 const packageJsonPath = path.join(__dirname, '..', 'package.json');
 const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
@@ -20,6 +18,16 @@ const command = args[0];
 
 // Helper: Run initialization wizard
 async function runWizard(options = {}) {
+  if (options.force || options.yes || options.ci) {
+    process.env.AIOX_INSTALL_FORCE = '1';
+  }
+  if (options.quiet || options.ci) {
+    process.env.AIOX_INSTALL_QUIET = '1';
+  }
+  if (options.dryRun) {
+    process.env.AIOX_INSTALL_DRY_RUN = '1';
+  }
+
   // Use the v4 wizard from packages/installer/src/wizard/index.js
   const wizardPath = path.join(__dirname, '..', 'packages', 'installer', 'src', 'wizard', 'index.js');
 
@@ -342,6 +350,37 @@ async function runUpdate() {
         process.exit(1);
       }
     }
+
+    // --include-pro: also update Pro after core (Story 122.5)
+    if (updateArgs.includes('--include-pro')) {
+      try {
+        const proUpdaterPath = path.join(__dirname, '..', '.aiox-core', 'core', 'pro', 'pro-updater');
+        const { updatePro, formatUpdateResult: formatProResult } = require(proUpdaterPath);
+
+        console.log('\n🔄 Updating AIOX Pro...\n');
+
+        const proResult = await updatePro(process.cwd(), {
+          check: isCheck,
+          dryRun: isDryRun,
+          force: isForce,
+          onProgress: (phase, message) => {
+            if (isVerbose) console.log(`[pro:${phase}] ${message}`);
+          },
+        });
+
+        console.log(formatProResult(proResult));
+
+        if (!proResult.success) {
+          process.exit(1);
+        }
+      } catch (proError) {
+        console.error(`❌ Pro update failed: ${proError.message}`);
+        if (proError.stack) {
+          console.error(proError.stack);
+        }
+        process.exit(1);
+      }
+    }
   } catch (error) {
     console.error(`❌ Update error: ${error.message}`);
     if (args.includes('--verbose') || args.includes('-v')) {
@@ -640,8 +679,11 @@ Install AIOX in the current directory.
 
 Options:
   --force      Overwrite existing AIOX installation
+  --yes, -y    Accept safe defaults and overwrite existing AIOX installation
+  --ci         Non-interactive CI mode (--quiet --force)
   --quiet      Minimal output (no banner, no prompts) - ideal for CI/CD
   --dry-run    Simulate installation without modifying files
+  --ide <ide>  Configure a specific IDE during quiet/CI install
   --merge      Auto-merge existing config files (brownfield mode)
   --no-merge   Disable merge option, use legacy overwrite behavior
   -h, --help   Show this help message
@@ -670,6 +712,9 @@ Examples:
   # Silent install for CI/CD
   npx aiox-core install --quiet --force
 
+  # Explicit CI install with Claude Code files materialized
+  npx aiox-core install --ci --yes --ide claude-code
+
   # Preview what would be installed
   npx aiox-core install --dry-run
 `);
@@ -841,12 +886,18 @@ async function main() {
         showInstallHelp();
         break;
       }
+      const isCi = installArgs.includes('--ci');
+      const isYes = installArgs.includes('--yes') || installArgs.includes('-y');
+      const ideIndex = installArgs.indexOf('--ide');
       const installOptions = {
-        force: installArgs.includes('--force'),
-        quiet: installArgs.includes('--quiet'),
+        force: installArgs.includes('--force') || isYes || isCi,
+        yes: isYes,
+        ci: isCi,
+        quiet: installArgs.includes('--quiet') || isCi,
         dryRun: installArgs.includes('--dry-run'),
         forceMerge: installArgs.includes('--merge'),
         noMerge: installArgs.includes('--no-merge'),
+        ide: ideIndex >= 0 ? installArgs[ideIndex + 1] : null,
       };
       if (!installOptions.quiet) {
         console.log('AIOX-FullStack Installation\n');

package/bin/utils/framework-guard.js

@@ -44,8 +44,10 @@ const FALLBACK_EXCEPTIONS = [
  * @returns {RegExp}
  */
 function globToRegex(glob) {
+  const placeholder = '\u0000';
+
   // 1. Replace ** with placeholder before processing
-  let pattern = glob.replace(/\*\*/g, '\u0000');
+  let pattern = glob.replace(/\*\*/g, placeholder);
 
   // 2. Escape all regex-special chars (dots, plus, etc.) — but NOT * or placeholder
   pattern = pattern.replace(/[.+?^${}()|[\]\\]/g, '\\$&');
@@ -54,7 +56,7 @@ function globToRegex(glob) {
   pattern = pattern.replace(/\*/g, '[^/]+');
 
   // 4. Restore ** placeholder to any-depth matcher
-  pattern = pattern.replace(/\u0000/g, '.+');
+  pattern = pattern.split(placeholder).join('.+');
 
   // If pattern ends with .+ (was **), match prefix
   if (glob.endsWith('**')) {

package/bin/utils/pro-detector.js

@@ -31,15 +31,60 @@ const PRO_DIR = path.join(PROJECT_ROOT, 'pro');
 const PRO_PACKAGE_PATH = path.join(PRO_DIR, 'package.json');
 
 /**
- * Check if the AIOX Pro submodule is available.
+ * Canonical npm package name.
+ */
+const PRO_PACKAGE_CANONICAL = '@aiox-squads/pro';
+
+/**
+ * Legacy npm package name kept as a fallback for installs created during the
+ * unpublished @aiox-fullstack/pro transition.
+ */
+const PRO_PACKAGE_FALLBACK = '@aiox-fullstack/pro';
+
+/**
+ * Original AIOS npm package name, retained for backward compatibility.
+ */
+const PRO_PACKAGE_LEGACY = '@aios-fullstack/pro';
+
+const PRO_PACKAGES = [
+  PRO_PACKAGE_CANONICAL,
+  PRO_PACKAGE_FALLBACK,
+  PRO_PACKAGE_LEGACY,
+];
+
+/**
+ * Resolve the installed npm Pro package path.
+ * Tries canonical name first, then legacy fallbacks.
  *
- * Detection is based on the existence of pro/package.json.
- * An empty pro/ directory (uninitialized submodule) returns false.
+ * @returns {{ packagePath: string, packageName: string } | null}
+ */
+function resolveNpmProPackage() {
+  for (const packageName of PRO_PACKAGES) {
+    try {
+      const pkgJson = require.resolve(`${packageName}/package.json`, {
+        paths: [process.cwd()],
+      });
+      return { packagePath: path.dirname(pkgJson), packageName };
+    } catch {
+      // try next package
+    }
+  }
+
+  return null;
+}
+
+/**
+ * Check if the AIOX Pro is available via any source.
  *
- * @returns {boolean} true if pro/package.json exists
+ * Detection priority:
+ * 1. npm package (canonical @aiox-squads/pro or legacy fallbacks)
+ * 2. pro/ submodule directory
+ *
+ * @returns {boolean} true if Pro is available
  */
 function isProAvailable() {
   try {
+    if (resolveNpmProPackage()) return true;
     return fs.existsSync(PRO_PACKAGE_PATH);
   } catch {
     return false;
@@ -47,58 +92,99 @@ function isProAvailable() {
 }
 
 /**
- * Safely load a module from the pro/ directory.
+ * Safely load a module from the pro package.
  *
- * Returns null if:
- * - Pro submodule is not available
- * - The requested module does not exist
- * - The module throws during loading
+ * Resolution order:
+ * 1. npm package (canonical or fallback)
+ * 2. pro/ submodule directory
  *
  * @param {string} moduleName - Relative path within pro/ (e.g., 'squads/squad-creator-pro')
  * @returns {*|null} The loaded module or null
  */
 function loadProModule(moduleName) {
-  if (!isProAvailable()) {
-    return null;
+  // 1. Try npm package
+  const npmPro = resolveNpmProPackage();
+  if (npmPro) {
+    try {
+      return require(path.join(npmPro.packagePath, moduleName));
+    } catch { /* fall through */ }
   }
 
-  try {
-    const modulePath = path.join(PRO_DIR, moduleName);
-    return require(modulePath);
-  } catch {
-    return null;
+  // 2. Try submodule
+  if (fs.existsSync(PRO_PACKAGE_PATH)) {
+    try {
+      return require(path.join(PRO_DIR, moduleName));
+    } catch { /* not available */ }
   }
+
+  return null;
 }
 
 /**
  * Get the version of the installed AIOX Pro package.
  *
- * @returns {string|null} The version string (e.g., '0.1.0') or null if not available
+ * @returns {string|null} The version string (e.g., '0.3.0') or null if not available
  */
 function getProVersion() {
-  if (!isProAvailable()) {
-    return null;
+  // 1. Try npm package
+  const npmPro = resolveNpmProPackage();
+  if (npmPro) {
+    try {
+      const packageData = JSON.parse(fs.readFileSync(path.join(npmPro.packagePath, 'package.json'), 'utf8'));
+      return packageData.version || null;
+    } catch { /* fall through */ }
   }
 
-  try {
-    const packageData = JSON.parse(fs.readFileSync(PRO_PACKAGE_PATH, 'utf8'));
-    return packageData.version || null;
-  } catch {
-    return null;
+  // 2. Try submodule
+  if (fs.existsSync(PRO_PACKAGE_PATH)) {
+    try {
+      const packageData = JSON.parse(fs.readFileSync(PRO_PACKAGE_PATH, 'utf8'));
+      return packageData.version || null;
+    } catch { /* not available */ }
   }
+
+  return null;
 }
 
 /**
  * Get metadata about the AIOX Pro installation.
  *
- * @returns {{ available: boolean, version: string|null, path: string }} Pro status info
+ * @returns {{ available: boolean, version: string|null, path: string, source: string, packageName: string|null }} Pro status info
  */
 function getProInfo() {
-  const available = isProAvailable();
+  const npmPro = resolveNpmProPackage();
+  if (npmPro) {
+    try {
+      const packageData = JSON.parse(fs.readFileSync(path.join(npmPro.packagePath, 'package.json'), 'utf8'));
+      return {
+        available: true,
+        version: packageData.version || null,
+        path: npmPro.packagePath,
+        source: 'npm',
+        packageName: npmPro.packageName,
+      };
+    } catch { /* fall through */ }
+  }
+
+  if (fs.existsSync(PRO_PACKAGE_PATH)) {
+    try {
+      const packageData = JSON.parse(fs.readFileSync(PRO_PACKAGE_PATH, 'utf8'));
+      return {
+        available: true,
+        version: packageData.version || null,
+        path: PRO_DIR,
+        source: 'submodule',
+        packageName: null,
+      };
+    } catch { /* fall through */ }
+  }
+
   return {
-    available,
-    version: available ? getProVersion() : null,
+    available: false,
+    version: null,
     path: PRO_DIR,
+    source: 'none',
+    packageName: null,
   };
 }
 
@@ -107,6 +193,11 @@ module.exports = {
   loadProModule,
   getProVersion,
   getProInfo,
+  resolveNpmProPackage,
+  PRO_PACKAGE_CANONICAL,
+  PRO_PACKAGE_FALLBACK,
+  PRO_PACKAGE_LEGACY,
+  PRO_PACKAGES,
   // Exported for testing
   _PRO_DIR: PRO_DIR,
   _PRO_PACKAGE_PATH: PRO_PACKAGE_PATH,

package/bin/utils/validate-publish.js

@@ -23,10 +23,10 @@ const PROJECT_ROOT = path.join(__dirname, '..', '..');
 const PRO_DIR = path.join(PROJECT_ROOT, 'pro');
 const CRITICAL_FILE = path.join(PRO_DIR, 'license', 'license-api.js');
 const MIN_FILE_COUNT = 50;
+const PACK_DRY_RUN_TIMEOUT_MS = 120000;
 
-// CI environments may not have access to the private pro submodule unless explicitly enforced.
+// CI environments may not have access to the private pro submodule
 const IS_CI = process.env.CI === 'true' || process.env.GITHUB_ACTIONS === 'true';
-const ENFORCE_SUBMODULES = process.env.AIOX_ENFORCE_PUBLISH_SUBMODULES === 'true';
 
 let passed = true;
 let fileCount = 0;
@@ -35,7 +35,7 @@ let fileCount = 0;
 console.log('--- Publish Safety Gate (INS-4.10) ---\n');
 
 if (!fs.existsSync(PRO_DIR)) {
-  if (IS_CI && !ENFORCE_SUBMODULES) {
+  if (IS_CI) {
     console.log('SKIP: pro/ directory not available (CI — private submodule requires separate access token)');
   } else {
     console.error('FAIL: pro/ directory does not exist.');
@@ -45,7 +45,7 @@ if (!fs.existsSync(PRO_DIR)) {
 } else {
   const entries = fs.readdirSync(PRO_DIR).filter(e => e !== '.git');
   if (entries.length === 0) {
-    if (IS_CI && !ENFORCE_SUBMODULES) {
+    if (IS_CI) {
       console.log('SKIP: pro/ submodule empty (CI — private submodule requires separate access token)');
     } else {
       console.error('FAIL: pro/ submodule not initialized (directory is empty).');
@@ -59,7 +59,7 @@ if (!fs.existsSync(PRO_DIR)) {
 
 // Check 2: Critical file exists
 if (!fs.existsSync(CRITICAL_FILE)) {
-  if (IS_CI && !ENFORCE_SUBMODULES) {
+  if (IS_CI) {
     console.log('SKIP: pro/license/license-api.js not available (CI — private submodule)');
   } else {
     console.error('FAIL: pro/license/license-api.js not found.');
@@ -76,7 +76,7 @@ try {
   const packOutput = execSync('npm pack --dry-run 2>&1', {
     encoding: 'utf8',
     cwd: PROJECT_ROOT,
-    timeout: 30000,
+    timeout: PACK_DRY_RUN_TIMEOUT_MS,
   });
   // npm pack --dry-run outputs lines starting with "npm notice" for each file
   const fileLines = packOutput.split('\n').filter(line =>

package/docs/aiox-agent-flows/devops-system.md

@@ -302,6 +302,14 @@ flowchart TD
 | Comando | Task | Descrição | Modo |
 |---------|------|-----------|------|
 | `*environment-bootstrap` | environment-bootstrap.md | Bootstrap de novo projeto | Interactive |
+| `*pro-access-grant` | devops-pro-access-grant.md | Conceder/restaurar acesso AIOX Pro com validacao de API e installer | Interactive |
+| `*pro-check-access` | devops-pro-check-access.md | Consultar entitlement e existencia de conta | Interactive |
+| `*pro-request-reset` | devops-pro-request-reset.md | Disparar email de reset de senha | Interactive |
+| `*pro-resend-verification` | devops-pro-resend-verification.md | Reenviar verificacao de email | Interactive |
+| `*pro-reset-password` | devops-pro-reset-password.md | Trocar senha administrativamente e validar login | Interactive |
+| `*pro-validate-login` | devops-pro-validate-login.md | Validar login e emissao de token | Interactive |
+| `*pro-verify-status` | devops-pro-verify-status.md | Consultar estado de verificacao do email | Interactive |
+| `*pro-activate` | devops-pro-activate.md | Validar/restaurar ativacao Pro diretamente | Interactive |
 
 ---
 
@@ -623,6 +631,16 @@ npm audit --ignore-advisories=ADVISORY_ID
 @devops *push
 @devops *cleanup
 
+# AIOX Pro
+@devops *pro-access-grant costa.wanderl@gmail.com AioxPro2026!
+@devops *pro-check-access costa.wanderl@gmail.com
+@devops *pro-request-reset costa.wanderl@gmail.com
+@devops *pro-resend-verification costa.wanderl@gmail.com
+@devops *pro-reset-password costa.wanderl@gmail.com NovaSenhaForte2026!
+@devops *pro-validate-login costa.wanderl@gmail.com AioxPro2026!
+@devops *pro-verify-status ACCESS_TOKEN
+@devops *pro-activate ACCESS_TOKEN
+
 # CI/CD
 @devops *ci-cd github-actions
 @devops *release minor

package/docs/aiox-workflows/README.md

@@ -46,6 +46,7 @@ Esta pasta contém a documentação detalhada de todos os workflows do AIOX, inc
 | **Spec** | Spec Pipeline | Pipeline de especificação | [spec-pipeline-workflow.md](./spec-pipeline-workflow.md) |
 | **Design** | Design System | Construção de design system | [design-system-build-quality-workflow.md](./design-system-build-quality-workflow.md) |
 | **Git** | Auto Worktree | Gestão automática de worktrees | [auto-worktree-workflow.md](./auto-worktree-workflow.md) |
+| **Operations** | Pro Access Grant | Concessao e validacao de acesso AIOX Pro | [pro-access-grant-workflow.md](./pro-access-grant-workflow.md) |
 
 ---
 

package/docs/aiox-workflows/pro-access-grant-workflow.md

@@ -0,0 +1,218 @@
+# Workflow: Pro Access Grant
+
+**Versao:** 1.0
+**Tipo:** Operations
+**Autor:** Dex + validated with live AIOX Pro flow
+**Data de Criacao:** 2026-04-20
+**Tags:** pro, support, devops, supabase, vercel, installer
+
+---
+
+## Visao Geral
+
+O workflow **Pro Access Grant** padroniza a concessao ou restauracao de acesso ao AIOX Pro para um usuario final, cobrindo:
+
+- preflight de entitlement e conta
+- concessao de buyer
+- criacao ou ajuste da conta no Supabase Auth
+- validacao direta da API
+- validacao final pelo instalador guiado
+
+### Objetivo
+
+Permitir que `@devops` execute o suporte de acesso Pro sempre do mesmo jeito, com evidencias objetivas e sem rediscovering manual.
+
+### Quando usar
+
+- usuario pediu criacao de acesso Pro
+- usuario pediu reset de senha do Pro
+- usuario reportou que comprou mas `check-email` nao reconhece
+- usuario ja tem conta mas a ativacao nao conclui
+
+### Quando nao usar
+
+- bug de produto fora do fluxo de licenciamento
+- pedido de licenca key legada sem auth por email
+
+---
+
+## Fluxo Principal
+
+```mermaid
+flowchart TD
+    START([Solicitacao de acesso Pro]) --> PREFLIGHT[1. Preflight check-email]
+    PREFLIGHT --> DECISION{isBuyer e hasAccount?}
+
+    DECISION -->|Nao buyer| BUYER[2. Grant buyer em public.buyers]
+    BUYER --> ACCOUNT
+
+    DECISION -->|Buyer sem conta| ACCOUNT[3. Criar ou ajustar auth user]
+    DECISION -->|Buyer com conta| VERIFY
+
+    ACCOUNT --> CACHE[4. Seed buyer_validations se necessario]
+    CACHE --> VERIFY[5. Validar login e verify-status]
+    VERIFY --> ACTIVATE[6. Validar activate-pro]
+    ACTIVATE --> INSTALL[7. Rodar instalacao guiada]
+    INSTALL --> DONE([Acesso pronto e validado])
+
+    ACTIVATE -->|Falha de contrato| FIXCLIENT[Atualizar caller para accessToken no body]
+    FIXCLIENT --> ACTIVATE
+
+    VERIFY -->|Email nao verificado| CONFIRM[Confirmar email no Supabase Auth]
+    CONFIRM --> VERIFY
+```
+
+---
+
+## Steps Detalhados
+
+### Step 1: Preflight
+
+| Campo | Valor |
+|-------|-------|
+| **ID** | `preflight` |
+| **Agente** | `@devops` |
+| **Acao** | Executar `POST /api/v1/auth/check-email` |
+
+#### Saida esperada
+
+- `isBuyer=true|false`
+- `hasAccount=true|false`
+
+#### Decisao
+
+- se `isBuyer=false`: ir para `grant-buyer`
+- se `hasAccount=false`: ir para `create-account`
+- se ambos `true`: ir para `api-verify`
+
+### Step 2: Grant Buyer
+
+| Campo | Valor |
+|-------|-------|
+| **ID** | `grant-buyer` |
+| **Agente** | `@devops` |
+| **Acao** | Upsert em `public.buyers` |
+
+#### Regras
+
+- email sempre em lowercase
+- `is_active=true`
+- `source='manual_support'`
+
+### Step 3: Create Account
+
+| Campo | Valor |
+|-------|-------|
+| **ID** | `create-account` |
+| **Agente** | `@devops` |
+| **Acao** | Criar ou ajustar usuario no Supabase Auth |
+
+#### Regras
+
+- definir a senha solicitada pelo suporte
+- marcar email como confirmado
+- nao criar usuario duplicado
+
+### Step 4: Seed Local Fallback
+
+| Campo | Valor |
+|-------|-------|
+| **ID** | `seed-local-fallback` |
+| **Agente** | `@devops` |
+| **Acao** | Upsert em `public.buyer_validations` |
+
+#### Quando executar
+
+- buyer RPC instavel
+- grant muito recente ainda nao refletido no preflight
+
+### Step 5: API Verify
+
+| Campo | Valor |
+|-------|-------|
+| **ID** | `api-verify` |
+| **Agente** | `@devops` |
+| **Acao** | Validar `login` e `verify-status` |
+
+#### Pass criteria
+
+- `login` retorna `accessToken`
+- `verify-status` retorna `emailVerified=true`
+
+### Step 6: Activate Pro
+
+| Campo | Valor |
+|-------|-------|
+| **ID** | `activate-pro` |
+| **Agente** | `@devops` |
+| **Acao** | Validar `POST /api/v1/auth/activate-pro` |
+
+#### Pass criteria
+
+- `201` com `licenseKey` no primeiro grant
+- ou `200` com restauracao idempotente em reinstalacao
+
+### Step 7: Guided Install Validation
+
+| Campo | Valor |
+|-------|-------|
+| **ID** | `guided-install-validation` |
+| **Agente** | `@devops` |
+| **Acao** | Rodar instalador guiado como usuario |
+
+#### Validacao obrigatoria
+
+- path source checkout
+- path tarball empacotado
+
+#### Pass criteria
+
+- Pro instalado
+- verificacao final do installer em verde
+- `.claude/skills`, `.claude/commands` e `.codex/skills` presentes
+
+---
+
+## Entradas
+
+- `target_email`
+- `target_password`
+- `reset_password` (boolean)
+- `run_guided_validation` (boolean, default: `true` quando houve mudanca de codigo)
+
+---
+
+## Saidas
+
+- entitlement confirmado
+- conta criada ou atualizada
+- email confirmado
+- Pro ativado ou restaurado
+- evidencias de API e installer
+
+---
+
+## Preconditions
+
+- acesso ao projeto Supabase `evvvnarpwcdybxdvcwjh`
+- acesso ao projeto Vercel `aiox-license-server`
+- operador sabe se o pedido inclui criacao de senha ou apenas restauracao
+
+---
+
+## Acceptance Criteria
+
+- `check-email` termina com `isBuyer=true` e `hasAccount=true`
+- `login` retorna token valido
+- `verify-status` retorna email verificado
+- `activate-pro` retorna sucesso
+- instalacao guiada passa no source path e no tarball path quando houver mudanca de codigo
+- suporte fecha o caso com evidencias sem expor token ou license key completos
+
+---
+
+## Source Of Truth
+
+- `docs/guides/pro/access-grant-ops-playbook.md`
+- `.aiox-core/development/tasks/devops-pro-access-grant.md`
+- `docs/stories/PRO-11.1-auth-contract-hardening-and-pro-access-ops.md`