brain-dev 0.1.0

package/bin/lib/security.cjs

@@ -0,0 +1,237 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+/**
+ * Secret detection patterns for security scanning.
+ * Each pattern has a name, regex, and severity level.
+ */
+const PATTERNS = [
+  {
+    name: 'Stripe Key',
+    regex: /sk_(?:live|test)_[a-zA-Z0-9]{10,}/,
+    severity: 'block'
+  },
+  {
+    name: 'OpenAI Key',
+    regex: /sk-(?:proj-)?[a-zA-Z0-9_-]{20,}/,
+    severity: 'block'
+  },
+  {
+    name: 'AWS Access Key',
+    regex: /AKIA[0-9A-Z]{16}/,
+    severity: 'block'
+  },
+  {
+    name: 'GitHub Token',
+    regex: /gh[ps]_[A-Za-z0-9_]{36,}/,
+    severity: 'block'
+  },
+  {
+    name: 'Password Assignment',
+    regex: /(?:password|passwd|pwd)\s*[:=]\s*['"][^'"]+['"]/i,
+    severity: 'block'
+  },
+  {
+    name: 'PEM Key',
+    regex: /-----BEGIN (?:RSA |EC |DSA )?PRIVATE KEY-----/,
+    severity: 'block'
+  },
+  {
+    name: 'MongoDB URI',
+    regex: /mongodb(?:\+srv)?:\/\/[^\s]+/,
+    severity: 'block'
+  },
+  {
+    name: 'Postgres URI',
+    regex: /postgres(?:ql)?:\/\/[^\s]+/,
+    severity: 'block'
+  },
+  {
+    name: 'Bearer Token',
+    regex: /Bearer\s+[a-zA-Z0-9\-._~+/]+=*/,
+    severity: 'block'
+  }
+];
+
+/**
+ * Scan content string for secret patterns.
+ * @param {string} content - Content to scan
+ * @param {string} [filePath] - Optional file path for findings context
+ * @returns {{ findings: Array<{ name: string, pattern: string, match: string, file?: string, line?: number }> }}
+ */
+function scanContent(content, filePath) {
+  const findings = [];
+
+  for (const pattern of PATTERNS) {
+    const match = content.match(pattern.regex);
+    if (match) {
+      const finding = {
+        name: pattern.name,
+        pattern: pattern.regex.source,
+        match: match[0]
+      };
+      if (filePath) {
+        finding.file = filePath;
+      }
+      // Calculate line number if content has newlines
+      if (content.includes('\n')) {
+        const beforeMatch = content.slice(0, match.index);
+        finding.line = (beforeMatch.match(/\n/g) || []).length + 1;
+      }
+      findings.push(finding);
+    }
+  }
+
+  return { findings };
+}
+
+/**
+ * Parse .gitignore file from a root directory.
+ * Returns array of non-empty, non-comment patterns.
+ * @param {string} rootDir - Directory containing .gitignore
+ * @returns {string[]} Array of patterns
+ */
+function parseGitignore(rootDir) {
+  const gitignorePath = path.join(rootDir, '.gitignore');
+  if (!fs.existsSync(gitignorePath)) {
+    return [];
+  }
+
+  const content = fs.readFileSync(gitignorePath, 'utf8');
+  return content
+    .split('\n')
+    .map(line => line.trim())
+    .filter(line => line.length > 0 && !line.startsWith('#'));
+}
+
+/**
+ * Check if a file path matches any .gitignore-style pattern.
+ * Supports: exact prefix match, glob * matching, directory patterns.
+ * @param {string} filePath - Relative file path to check
+ * @param {string[]} patterns - Array of gitignore patterns
+ * @returns {boolean}
+ */
+function isIgnored(filePath, patterns) {
+  for (const pattern of patterns) {
+    const clean = pattern.replace(/\/$/, '');
+
+    // Glob pattern with *
+    if (clean.includes('*')) {
+      const regexStr = clean
+        .replace(/\./g, '\\.')
+        .replace(/\*\*/g, '{{DOUBLESTAR}}')
+        .replace(/\*/g, '[^/]*')
+        .replace(/\{\{DOUBLESTAR\}\}/g, '.*');
+      const regex = new RegExp(`(^|/)${regexStr}$`);
+      if (regex.test(filePath)) return true;
+    } else {
+      // Exact or prefix match
+      if (filePath === clean || filePath.startsWith(clean + '/') || filePath.startsWith(clean + path.sep)) {
+        return true;
+      }
+      // Also check basename match
+      const basename = path.basename(filePath);
+      if (basename === clean) return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Recursively walk a directory, returning relative file paths.
+ * Skips .git, node_modules, and binary files by default.
+ * @param {string} dir - Directory to walk
+ * @param {string} rootDir - Root directory for relative paths
+ * @param {string[]} ignorePatterns - Gitignore patterns to skip
+ * @returns {string[]} Array of relative file paths
+ */
+function walkDir(dir, rootDir, ignorePatterns) {
+  const results = [];
+  const SKIP_DIRS = new Set(['.git', 'node_modules', '.brain']);
+  const BINARY_EXTS = new Set(['.png', '.jpg', '.jpeg', '.gif', '.ico', '.woff', '.woff2', '.ttf', '.eot', '.zip', '.tar', '.gz']);
+
+  let entries;
+  try {
+    entries = fs.readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return results;
+  }
+
+  for (const entry of entries) {
+    const fullPath = path.join(dir, entry.name);
+    const relPath = path.relative(rootDir, fullPath);
+
+    if (entry.isDirectory()) {
+      if (SKIP_DIRS.has(entry.name)) continue;
+      if (isIgnored(relPath, ignorePatterns)) continue;
+      results.push(...walkDir(fullPath, rootDir, ignorePatterns));
+    } else if (entry.isFile()) {
+      const ext = path.extname(entry.name).toLowerCase();
+      if (BINARY_EXTS.has(ext)) continue;
+      if (isIgnored(relPath, ignorePatterns)) continue;
+      results.push(relPath);
+    }
+  }
+
+  return results;
+}
+
+/**
+ * Scan all files in a directory tree for secrets.
+ * Respects .gitignore patterns. Relaxes severity for test directories.
+ * @param {string} rootDir - Root directory to scan
+ * @param {object} [options] - Scan options
+ * @param {string[]} [options.relaxDirs] - Directories where findings are warnings instead of blockers (e.g. ['test/', '__tests__/'])
+ * @returns {{ findings: object[], blockers: object[], warnings: object[] }}
+ */
+function scanFiles(rootDir, options = {}) {
+  const relaxDirs = options.relaxDirs || ['test/', '__tests__/'];
+  const ignorePatterns = parseGitignore(rootDir);
+  const files = walkDir(rootDir, rootDir, ignorePatterns);
+
+  const allFindings = [];
+  const blockers = [];
+  const warnings = [];
+
+  for (const relPath of files) {
+    const fullPath = path.join(rootDir, relPath);
+    let content;
+    try {
+      content = fs.readFileSync(fullPath, 'utf8');
+    } catch {
+      continue;
+    }
+
+    const result = scanContent(content, relPath);
+    if (result.findings.length === 0) continue;
+
+    // Check if file is in a relaxed directory
+    const isRelaxed = relaxDirs.some(dir => {
+      const clean = dir.replace(/\/$/, '');
+      return relPath.startsWith(clean + '/') || relPath.startsWith(clean + path.sep) || relPath === clean;
+    });
+
+    for (const finding of result.findings) {
+      finding.severity = isRelaxed ? 'warning' : 'block';
+      allFindings.push(finding);
+
+      if (isRelaxed) {
+        warnings.push(finding);
+      } else {
+        blockers.push(finding);
+      }
+    }
+  }
+
+  return { findings: allFindings, blockers, warnings };
+}
+
+module.exports = {
+  PATTERNS,
+  scanContent,
+  parseGitignore,
+  scanFiles,
+  isIgnored
+};

package/bin/lib/state.cjs

@@ -0,0 +1,353 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const CURRENT_SCHEMA = 'brain/v1';
+const CURRENT_VERSION = '0.7.0';
+
+/**
+ * Atomic write: write to temp file, then rename.
+ * Prevents corruption on crash (rename is atomic on all major filesystems).
+ * @param {string} filePath - Target file path
+ * @param {string} content - Content to write
+ */
+function atomicWriteSync(filePath, content) {
+  // Guard: if target is a directory, remove it first
+  try {
+    if (fs.existsSync(filePath) && fs.statSync(filePath).isDirectory()) {
+      fs.rmSync(filePath, { recursive: true, force: true });
+    }
+  } catch { /* ignore stat errors */ }
+  const dir = path.dirname(filePath);
+  const tmpPath = path.join(dir, `.${path.basename(filePath)}.${process.pid}.tmp`);
+  fs.writeFileSync(tmpPath, content, 'utf8');
+  fs.renameSync(tmpPath, filePath);
+}
+
+/**
+ * Read brain.json from the given directory.
+ * Returns null if file does not exist.
+ * Triggers migration on schema version mismatch.
+ * @param {string} brainDir - Path to .brain/ directory
+ * @returns {object|null}
+ */
+function readState(brainDir) {
+  const jsonPath = path.join(brainDir, 'brain.json');
+
+  if (!fs.existsSync(jsonPath)) {
+    return null;
+  }
+
+  let data;
+  try {
+    data = JSON.parse(fs.readFileSync(jsonPath, 'utf8'));
+  } catch {
+    return null;
+  }
+
+  // Schema migration if version mismatch
+  if (data.$schema !== CURRENT_SCHEMA) {
+    // Backup before migration (pitfall #6)
+    const backupPath = path.join(brainDir, 'brain.json.backup');
+    fs.copyFileSync(jsonPath, backupPath);
+
+    data = migrateState(data);
+
+    // Write migrated state (both brain.json and STATE.md)
+    writeState(brainDir, data);
+  }
+
+  return data;
+}
+
+/**
+ * Migrate state to current schema version.
+ * Additive only: adds new fields with defaults, never removes fields.
+ * @param {object} data - Old state object
+ * @returns {object} Migrated state object
+ */
+function migrateState(data) {
+  const migrated = { ...data };
+
+  // Always update schema version
+  migrated.$schema = CURRENT_SCHEMA;
+  migrated.version = CURRENT_VERSION;
+
+  // Ensure required fields exist with defaults
+  if (!migrated.project) {
+    migrated.project = { name: null, created: today() };
+  }
+  if (!migrated.platform) {
+    migrated.platform = 'claude-code';
+  }
+  if (!migrated.phase || typeof migrated.phase !== 'object') {
+    migrated.phase = { current: 0, status: 'initialized' };
+  }
+  if (!Array.isArray(migrated.phase.phases)) {
+    migrated.phase.phases = [];
+  }
+  if (!('total' in migrated.phase)) {
+    migrated.phase.total = migrated.phase.phases.length || 0;
+  }
+
+  // v0.2.0 fields
+  if (!migrated.milestone) {
+    migrated.milestone = { current: 'v1.0', name: null, history: [] };
+  }
+  if (!migrated.session) {
+    migrated.session = { lastPaused: null, snapshotPath: null, contextWarningShown: false };
+  }
+  if (migrated.project && !('initialized' in migrated.project)) {
+    migrated.project.initialized = false;
+  }
+  if (migrated.project && !('projectType' in migrated.project)) {
+    migrated.project.projectType = null;
+  }
+
+  // v0.3.0 fields (skill system)
+  if (!migrated.skills) {
+    migrated.skills = {};
+  }
+
+  // v0.4.0 fields (agent orchestration)
+  if (!migrated.agents) {
+    migrated.agents = { model: 'inherit', models: {} };
+  }
+  if (!migrated.workflow) {
+    migrated.workflow = { parallelization: false, mapper_parallelization: true };
+  }
+
+  // v0.5.0 fields (recovery and monitoring)
+  if (!migrated.monitoring) {
+    migrated.monitoring = { warning_threshold: 35, critical_threshold: 25, enabled: true };
+  }
+  if (migrated.workflow && !('auto_recover' in migrated.workflow)) {
+    migrated.workflow.auto_recover = false;
+  }
+
+  // v0.6.0 fields (differentiators)
+  if (migrated.workflow && !('advocate' in migrated.workflow)) {
+    migrated.workflow.advocate = true;
+  }
+  if (!migrated.complexity) {
+    migrated.complexity = { default_budget: 60, phase_overrides: {} };
+  }
+  if (!migrated.storm) {
+    migrated.storm = { port: 3456, auto_open: true };
+  }
+  if (!migrated.adr) {
+    migrated.adr = { auto_create: true, status_lifecycle: true };
+  }
+
+  // v0.7.0 fields (configuration system)
+  if (!migrated.mode) {
+    migrated.mode = 'interactive';
+  }
+  if (!migrated.depth) {
+    migrated.depth = 'deep';
+  }
+  if (!migrated.enforcement) {
+    migrated.enforcement = { level: 'hard', business_paths: [], non_business_paths: [] };
+  }
+  if (migrated.agents && !migrated.agents.profile) {
+    migrated.agents.profile = 'quality';
+  }
+  if (migrated.agents && !migrated.agents.profiles) {
+    migrated.agents.profiles = {};
+  }
+  if (!migrated.quick) {
+    migrated.quick = { count: 0 };
+  }
+
+  return migrated;
+}
+
+/**
+ * Write state to brain.json and STATE.md atomically.
+ * @param {string} brainDir - Path to .brain/ directory
+ * @param {object} state - State object to write
+ */
+function writeState(brainDir, state) {
+  // Validate required fields
+  const required = ['$schema', 'version', 'project', 'platform', 'phase'];
+  for (const field of required) {
+    if (!(field in state)) {
+      throw new Error(`State missing required field: ${field}`);
+    }
+  }
+
+  // Write brain.json atomically
+  const jsonPath = path.join(brainDir, 'brain.json');
+  atomicWriteSync(jsonPath, JSON.stringify(state, null, 2));
+
+  // Generate and write STATE.md atomically
+  const mdPath = path.join(brainDir, 'STATE.md');
+  atomicWriteSync(mdPath, generateStateMd(state));
+}
+
+/**
+ * Generate STATE.md content from state object.
+ * Uses bullet-list-under-headers format (not YAML frontmatter).
+ * @param {object} state - State object
+ * @returns {string} Markdown content
+ */
+function generateStateMd(state) {
+  const phase = state.phase || {};
+  const session = state.session || {};
+  const milestone = state.milestone || {};
+  const blockers = state.blockers;
+
+  // Support both old (number/string) and new (object) milestone format
+  const milestoneVersion = typeof milestone === 'object' ? milestone.current : milestone;
+  const milestoneName = typeof milestone === 'object' ? milestone.name : null;
+
+  const lines = [
+    '# Brain State',
+    '',
+    '## Current Position',
+    `- Phase: ${phase.current ?? 0}`,
+    `- Status: ${phase.status || 'initialized'}`,
+    `- Milestone: ${milestoneVersion || 'v1.0'}${milestoneName ? ` (${milestoneName})` : ''}`,
+    '',
+  ];
+
+  // Phases list (v0.2.0)
+  if (Array.isArray(phase.phases) && phase.phases.length > 0) {
+    lines.push('## Phases');
+    for (const p of phase.phases) {
+      // Handle both string and object formats
+      if (typeof p === 'string') {
+        lines.push(`- ${p}`);
+      } else if (p && typeof p === 'object') {
+        lines.push(`- Phase ${p.number}: ${p.name} [${p.status || 'Pending'}]`);
+      }
+    }
+    lines.push('');
+  }
+
+  // Session section (v0.2.0 format)
+  lines.push('## Session');
+  if (session.lastPaused) {
+    lines.push(`- Last paused: ${session.lastPaused}`);
+  }
+  if (session.snapshotPath) {
+    lines.push(`- Snapshot: ${session.snapshotPath}`);
+  }
+  // Legacy fields
+  if (session.stoppedAt) {
+    lines.push(`- Stopped at: ${session.stoppedAt}`);
+  }
+  if (session.resume) {
+    lines.push(`- Resume: ${session.resume}`);
+  }
+  if (!session.lastPaused && !session.snapshotPath && !session.stoppedAt && !session.resume) {
+    lines.push('- No active session');
+  }
+  lines.push('');
+
+  lines.push('## Blockers');
+
+  if (Array.isArray(blockers) && blockers.length > 0) {
+    for (const b of blockers) {
+      lines.push(`- ${b}`);
+    }
+  } else {
+    lines.push('- None');
+  }
+
+  lines.push('');
+  return lines.join('\n');
+}
+
+/**
+ * Create a default state object for a new brain project.
+ * @param {string} platform - Detected platform identifier
+ * @returns {object} Default brain.json state
+ */
+function createDefaultState(platform) {
+  return {
+    $schema: CURRENT_SCHEMA,
+    version: CURRENT_VERSION,
+    project: {
+      name: null,
+      created: today(),
+      initialized: false,
+      projectType: null
+    },
+    platform: platform || 'claude-code',
+    phase: {
+      current: 0,
+      status: 'initialized',
+      total: 0,
+      phases: []
+    },
+    milestone: {
+      current: 'v1.0',
+      name: null,
+      history: []
+    },
+    session: {
+      lastPaused: null,
+      snapshotPath: null,
+      contextWarningShown: false
+    },
+    mode: 'interactive',
+    depth: 'deep',
+    agents: {
+      model: 'inherit',
+      models: {},
+      profile: 'quality',
+      profiles: {}
+    },
+    monitoring: {
+      warning_threshold: 35,
+      critical_threshold: 25,
+      enabled: true
+    },
+    skills: {},
+    workflow: {
+      parallelization: false,
+      mapper_parallelization: true,
+      advocate: true,
+      auto_recover: false
+    },
+    enforcement: {
+      level: 'hard',
+      business_paths: [],
+      non_business_paths: []
+    },
+    complexity: {
+      default_budget: 60,
+      phase_overrides: {}
+    },
+    storm: {
+      port: 3456,
+      auto_open: true
+    },
+    adr: {
+      auto_create: true,
+      status_lifecycle: true
+    },
+    quick: {
+      count: 0
+    }
+  };
+}
+
+/**
+ * Get today's date in ISO format (YYYY-MM-DD).
+ * @returns {string}
+ */
+function today() {
+  return new Date().toISOString().slice(0, 10);
+}
+
+module.exports = {
+  atomicWriteSync,
+  readState,
+  writeState,
+  generateStateMd,
+  createDefaultState,
+  migrateState
+};

package/bin/lib/templates.cjs

@@ -0,0 +1,48 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const TEMPLATES_DIR = path.join(__dirname, '..', 'templates');
+
+/**
+ * Load a template file from bin/templates/{name}.md.
+ * @param {string} name - Template name (without .md extension)
+ * @returns {string} Template content
+ */
+function loadTemplate(name) {
+  const filePath = path.join(TEMPLATES_DIR, `${name}.md`);
+  return fs.readFileSync(filePath, 'utf8');
+}
+
+/**
+ * Replace {{variable}} placeholders with values from vars object.
+ * Supports dot notation for nested access (e.g., {{project.name}}).
+ * @param {string} template - Template string with {{var}} placeholders
+ * @param {object} vars - Variables to interpolate
+ * @returns {string} Interpolated string
+ */
+function interpolate(template, vars) {
+  return template.replace(/\{\{(\w+(?:\.\w+)*)\}\}/g, (match, key) => {
+    const value = resolvePath(vars, key);
+    return value !== undefined ? String(value) : match;
+  });
+}
+
+/**
+ * Resolve a dot-notation path on an object.
+ * @param {object} obj
+ * @param {string} dotPath - e.g., "project.name"
+ * @returns {*}
+ */
+function resolvePath(obj, dotPath) {
+  const parts = dotPath.split('.');
+  let current = obj;
+  for (const part of parts) {
+    if (current == null || typeof current !== 'object') return undefined;
+    current = current[part];
+  }
+  return current;
+}
+
+module.exports = { loadTemplate, interpolate };