mega-brain-ai 1.3.0

package/bin/lib/validate-email.js

@@ -0,0 +1,113 @@
+/**
+ * Mega Brain - Email Validation Module
+ * Validates MoneyClub buyer emails via Supabase RPC
+ *
+ * Uses native fetch (Node.js 18+) instead of Supabase client
+ * to avoid assertion errors from dangling WebSocket handles.
+ *
+ * On successful validation, returns a premium_token for
+ * accessing the premium content repository.
+ */
+
+// Supabase connection — loaded from environment variables.
+// SUPABASE_URL and SUPABASE_ANON_KEY must be set in .env
+// Supabase anon keys are public by design (protected by RLS),
+// but we load from env to avoid hardcoding in source control.
+// See: https://supabase.com/docs/guides/auth#api-keys
+const SUPABASE_URL = process.env.SUPABASE_URL || '';
+const SUPABASE_ANON_KEY = process.env.SUPABASE_ANON_KEY || '';
+
+const TIMEOUT_MS = 10000;
+const MAX_ATTEMPTS = 3;
+
+let attemptCount = 0;
+
+/**
+ * Validate a buyer email against MoneyClub database
+ * @param {string} email - Email to validate
+ * @returns {Promise<{valid: boolean, name?: string, reason?: string, installCount?: number, premium_token?: string}>}
+ */
+export async function validateEmail(email) {
+  if (attemptCount >= MAX_ATTEMPTS) {
+    return {
+      valid: false,
+      reason: 'max_attempts_exceeded',
+    };
+  }
+
+  attemptCount++;
+
+  if (!email || !email.includes('@')) {
+    return {
+      valid: false,
+      reason: 'invalid_email_format',
+    };
+  }
+
+  try {
+    const response = await fetch(
+      `${SUPABASE_URL}/rest/v1/rpc/validate_buyer_email`,
+      {
+        method: 'POST',
+        headers: {
+          'apikey': SUPABASE_ANON_KEY,
+          'Authorization': `Bearer ${SUPABASE_ANON_KEY}`,
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ buyer_email: email.trim().toLowerCase() }),
+        signal: AbortSignal.timeout(TIMEOUT_MS),
+      }
+    );
+
+    if (!response.ok) {
+      return {
+        valid: false,
+        reason: 'validation_error',
+      };
+    }
+
+    const data = await response.json();
+
+    return {
+      valid: data.valid,
+      name: data.name || null,
+      reason: data.reason || null,
+      installCount: data.install_count || 0,
+      premium_token: data.premium_token || null,
+    };
+  } catch (err) {
+    if (err.name === 'TimeoutError' || err.name === 'AbortError') {
+      return {
+        valid: false,
+        reason: 'timeout',
+      };
+    }
+
+    return {
+      valid: false,
+      reason: 'network_error',
+    };
+  }
+}
+
+/**
+ * Get user-friendly error messages in Portuguese
+ * @param {string} reason - Error reason code
+ * @returns {string} Human-readable message
+ */
+export function getErrorMessage(reason) {
+  const messages = {
+    email_not_found: 'Email não autorizado.\nAcesse a página do produto para adquirir acesso.',
+    invalid_email_format: 'Formato de email inválido. Verifique e tente novamente.',
+    max_attempts_exceeded: 'Número máximo de tentativas excedido. Reinicie o instalador.',
+    timeout: 'Tempo de conexão esgotado. Verifique sua internet e tente novamente.',
+    network_error: 'Erro de conexão. Verifique sua internet e tente novamente.',
+    validation_error: 'Erro na validação. Tente novamente em alguns minutos.',
+  };
+
+  return messages[reason] || 'Erro desconhecido. Tente novamente.';
+}
+
+export function resetAttempts() {
+  attemptCount = 0;
+}

package/bin/mega-brain.js

@@ -0,0 +1,136 @@
+#!/usr/bin/env node
+
+/**
+ * Mega Brain - AI Knowledge Management System
+ * CLI Entry Point
+ *
+ * Usage:
+ *   npx mega-brain-ai install [name] - Install Mega Brain (optional project name)
+ *   npx mega-brain-ai validate   - Validate MoneyClub email
+ *   npx mega-brain-ai push       - Push to Layer 1/2/3 remote
+ *   npx mega-brain-ai upgrade    - Upgrade Community to Premium
+ *   npx mega-brain-ai status     - Show Pro license status
+ *   npx mega-brain-ai features   - List available vs locked features
+ *   npx mega-brain-ai --help     - Show help
+ */
+
+import { createRequire } from 'module';
+import { fileURLToPath } from 'url';
+import { dirname, resolve } from 'path';
+import { readFileSync, existsSync } from 'fs';
+
+// Load .env from project root (Node.js 21+ native, no dependencies)
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const envPath = resolve(__dirname, '..', '.env');
+if (existsSync(envPath)) {
+  try { process.loadEnvFile(envPath); } catch {}
+}
+
+const require = createRequire(import.meta.url);
+
+const pkg = JSON.parse(readFileSync(resolve(__dirname, '..', 'package.json'), 'utf-8'));
+
+const args = process.argv.slice(2);
+const command = args[0];
+
+async function main() {
+  const { showBanner } = await import('./lib/ascii-art.js');
+
+  showBanner(pkg.version);
+
+  if (!command || command === '--help' || command === '-h') {
+    showHelp();
+    process.exit(0);
+  }
+
+  // Auto-trigger setup if .env is missing (skip for install/setup/help)
+  const skipEnvCheck = ['install', 'setup', 'push'].includes(command);
+  if (!skipEnvCheck) {
+    const projectEnv = resolve(process.cwd(), '.env');
+    if (!existsSync(projectEnv)) {
+      const boxen = (await import('boxen')).default;
+      console.log(boxen(
+        '  First time? Let\'s set up your environment.\n' +
+        '  Running setup wizard...\n\n' +
+        '  (You can run this anytime with: npx mega-brain-ai setup)',
+        { padding: 1, borderColor: 'cyan', borderStyle: 'round' }
+      ));
+      const { runSetup } = await import('./lib/setup-wizard.js');
+      await runSetup();
+      process.exit(0);
+    }
+  }
+
+  if (command === 'install') {
+    const { runInstaller } = await import('./lib/installer.js');
+    await runInstaller(pkg.version, args[1]);
+  } else if (command === 'validate') {
+    const { validateEmail } = await import('./lib/validate-email.js');
+    const email = args[1];
+    if (!email) {
+      console.error('\n  Uso: mega-brain validate <email>\n');
+      process.exit(1);
+    }
+    const result = await validateEmail(email);
+    console.log(result.valid ? `\n  Email válido: ${result.name}` : `\n  Email inválido: ${result.reason}`);
+    setTimeout(() => process.exit(result.valid ? 0 : 1), 100);
+  } else if (command === 'push') {
+    // Dynamic import of push module
+    await import('./push.js');
+  } else if (command === 'upgrade') {
+    const { runUpgrade } = await import('./lib/installer.js');
+    if (typeof runUpgrade === 'function') {
+      await runUpgrade(pkg.version);
+    } else {
+      console.log('\n  Funcionalidade de upgrade será disponibilizada em breve.');
+      console.log('  Por enquanto, reinstale com: mega-brain install\n');
+    }
+  } else if (command === 'status') {
+    const { showStatus } = await import('./lib/pro-commands.js');
+    showStatus();
+  } else if (command === 'features') {
+    const { showFeatures } = await import('./lib/pro-commands.js');
+    showFeatures();
+  } else if (command === 'setup') {
+    const { runSetup } = await import('./lib/setup-wizard.js');
+    await runSetup();
+  } else {
+    console.error(`\n  Comando desconhecido: ${command}`);
+    showHelp();
+    process.exit(1);
+  }
+}
+
+function showHelp() {
+  console.log(`
+  Mega Brain v${pkg.version}
+  AI Knowledge Management System
+
+  Comandos:
+    install [nome]  Instalar Mega Brain (PREMIUM ou Community)
+    setup       Configurar API keys e dependencias (wizard interativo)
+    validate    Validar email MoneyClub (mega-brain validate <email>)
+    push        Push para Layer 1/2/3 (mega-brain push [--layer N])
+    upgrade     Atualizar Community para Premium
+    status      Mostrar status da licenca Pro
+    features    Listar features disponiveis vs bloqueadas
+    --help      Mostrar esta mensagem
+
+  Layers:
+    Layer 1     Community (público) — shell sem conteúdo
+    Layer 2     Premium (MoneyClub) — shell + cérebro
+    Layer 3     Full Backup (pessoal) — tudo incluindo dados sensíveis
+
+  Exemplos:
+    npx mega-brain-ai install
+    npx mega-brain-ai install meu-projeto
+    npx mega-brain-ai push --layer 1
+    npx mega-brain-ai push
+`);
+}
+
+main().catch((err) => {
+  console.error('\n  Erro inesperado:', err.message);
+  setTimeout(() => process.exit(1), 100);
+});

package/bin/pre-publish-gate.js

@@ -0,0 +1,229 @@
+#!/usr/bin/env node
+
+/**
+ * Mega Brain — Pre-Publish Security Gate (PHYSICAL BLOCK)
+ *
+ * PURPOSE: Scan npm package contents for secrets AND verify only L1 content
+ *          is included BEFORE publishing.
+ * DESIGN: fail-CLOSED — if scanning fails, publish is BLOCKED.
+ * INSTALLED: 2026-02-20 (post-incident hardening)
+ * UPDATED: 2026-02-27 (added L1 layer validation)
+ *
+ * Runs automatically via: "prepublishOnly": "node bin/pre-publish-gate.js"
+ */
+
+import { execSync } from 'child_process';
+import { readFileSync, existsSync, mkdirSync, rmSync } from 'fs';
+import { resolve, dirname } from 'path';
+import { fileURLToPath } from 'url';
+import { validatePackageSync } from './validate-package.js';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const PROJECT_ROOT = resolve(__dirname, '..');
+
+// ANSI colors
+const RED = '\x1b[31m';
+const GREEN = '\x1b[32m';
+const YELLOW = '\x1b[33m';
+const CYAN = '\x1b[36m';
+const NC = '\x1b[0m';
+
+// === SECRET PATTERNS ===
+const SECRET_PATTERNS = [
+  // GitHub tokens
+  /ghp_[A-Za-z0-9]{36}/,
+  /github_pat_[A-Za-z0-9_]{82}/,
+  /gho_[A-Za-z0-9]{36}/,
+  /ghs_[A-Za-z0-9]{36}/,
+  /ghr_[A-Za-z0-9]{36}/,
+  // Anthropic
+  /sk-ant-[A-Za-z0-9-]{90,}/,
+  // OpenAI
+  /sk-[A-Za-z0-9]{48}/,
+  // AWS
+  /AKIA[0-9A-Z]{16}/,
+  // ElevenLabs
+  /sk_[a-f0-9]{48}/,
+  // N8N webhooks
+  /https?:\/\/[^/]*\.app\.n8n\.cloud\/webhook/,
+  // Notion
+  /ntn_[A-Za-z0-9]{40,}/,
+  /secret_[A-Za-z0-9]{40,}/,
+  // JWT tokens (Supabase, etc.)
+  /eyJ[A-Za-z0-9_-]{20,}\.eyJ[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}/,
+  // Generic secrets in code
+  /(?:password|api_key|secret|token|private_key)\s*[:=]\s*['"][^'"]{12,}['"]/i,
+  // Brazilian CPF (11 digits)
+  /\d{3}\.\d{3}\.\d{3}-\d{2}/,
+  // Brazilian CNPJ
+  /\d{2}\.\d{3}\.\d{3}\/\d{4}-\d{2}/,
+  // Email addresses in bulk (PII indicator)
+  /[\w.+-]+@[\w-]+\.[\w.]+/,
+];
+
+// Files that should NEVER be in the package
+const FORBIDDEN_FILE_PATTERNS = [
+  /\.env($|\.)/i,
+  /credentials\.json$/i,
+  /service.account.*\.json$/i,
+  /\.pem$/i,
+  /\.key$/i,
+  /id_rsa/i,
+  /id_ed25519/i,
+  /\.sqlite$/i,
+  /\.db$/i,
+  /memory\.db$/i,
+  /DOSSIE-SEGURANCA/i,
+  /trufflehog/i,
+];
+
+// Maximum emails allowed (more than this = PII leak)
+const MAX_EMAILS_PER_FILE = 3;
+
+console.log(`${YELLOW}[pre-publish] Running security gate before npm publish...${NC}`);
+
+let foundIssues = 0;
+
+// === STEP 1: Clean __pycache__ (original prepublishOnly behavior) ===
+try {
+  execSync('find . -type d -name __pycache__ -exec rm -rf {} + 2>/dev/null', {
+    cwd: PROJECT_ROOT,
+    stdio: 'ignore',
+  });
+} catch {
+  // Ignore cleanup errors
+}
+
+// === STEP 2: Get list of files that would be published ===
+let packFiles = [];
+try {
+  const packOutput = execSync('npm pack --dry-run --json 2>/dev/null', {
+    cwd: PROJECT_ROOT,
+    encoding: 'utf-8',
+    stdio: ['pipe', 'pipe', 'pipe'],
+  });
+
+  const packData = JSON.parse(packOutput);
+  if (packData && packData[0] && packData[0].files) {
+    packFiles = packData[0].files.map(f => f.path);
+  }
+} catch {
+  // Fallback: use the files field from package.json
+  console.log(`${YELLOW}[pre-publish] npm pack --dry-run failed, using files field fallback.${NC}`);
+  try {
+    const pkg = JSON.parse(readFileSync(resolve(PROJECT_ROOT, 'package.json'), 'utf-8'));
+    packFiles = pkg.files || [];
+  } catch {
+    console.error(`${RED}[BLOCKED] Cannot determine package files. Blocking publish.${NC}`);
+    process.exit(1);
+  }
+}
+
+console.log(`${CYAN}[pre-publish] Scanning ${packFiles.length} files...${NC}`);
+
+// === STEP 3: Check file names for forbidden patterns ===
+for (const file of packFiles) {
+  for (const pattern of FORBIDDEN_FILE_PATTERNS) {
+    if (pattern.test(file)) {
+      console.error(`${RED}[BLOCKED] Forbidden file in package: ${file}${NC}`);
+      foundIssues++;
+    }
+  }
+}
+
+// === STEP 4: Scan file contents for secrets ===
+const BINARY_EXTENSIONS = new Set([
+  '.png', '.jpg', '.jpeg', '.gif', '.ico', '.svg',
+  '.woff', '.woff2', '.ttf', '.eot',
+  '.pdf', '.zip', '.tar', '.gz', '.bz2',
+  '.mp3', '.mp4', '.wav', '.webm',
+]);
+
+for (const file of packFiles) {
+  // Skip binary files
+  const ext = file.substring(file.lastIndexOf('.')).toLowerCase();
+  if (BINARY_EXTENSIONS.has(ext)) continue;
+
+  const filePath = resolve(PROJECT_ROOT, file);
+  if (!existsSync(filePath)) continue;
+
+  let content;
+  try {
+    content = readFileSync(filePath, 'utf-8');
+  } catch {
+    continue;
+  }
+
+  // Check for secret patterns
+  for (const pattern of SECRET_PATTERNS) {
+    const matches = content.match(new RegExp(pattern.source, 'g'));
+    if (matches) {
+      // Special handling for emails: allow up to MAX_EMAILS_PER_FILE
+      if (pattern.source.includes('@')) {
+        if (matches.length > MAX_EMAILS_PER_FILE) {
+          console.error(`${RED}[BLOCKED] Bulk PII (${matches.length} emails) in: ${file}${NC}`);
+          foundIssues++;
+        }
+        continue;
+      }
+
+      // Redact the actual values
+      const redacted = matches[0].substring(0, 12) + '**REDACTED**';
+      console.error(`${RED}[BLOCKED] Secret found in: ${file} → ${redacted}${NC}`);
+      foundIssues++;
+    }
+  }
+}
+
+// === STEP 5: Optional trufflehog scan ===
+try {
+  execSync('trufflehog --version', { stdio: 'pipe' });
+  console.log(`${YELLOW}[pre-publish] Running trufflehog deep scan...${NC}`);
+  const result = execSync(
+    `trufflehog filesystem "${PROJECT_ROOT}" --only-verified --no-update --json`,
+    { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], timeout: 120000 }
+  );
+  if (result.trim()) {
+    console.error(`${RED}[BLOCKED] trufflehog found VERIFIED secrets.${NC}`);
+    foundIssues++;
+  }
+} catch {
+  // trufflehog not available, pattern scan is sufficient
+}
+
+// === STEP 6: Layer validation (L1 only) ===
+console.log(`${CYAN}[pre-publish] Running layer validation...${NC}`);
+try {
+  const validation = validatePackageSync(PROJECT_ROOT);
+  if (validation.status === 'FAILED') {
+    console.error(`${RED}[BLOCKED] ${validation.violations.length} non-L1 file(s) in package:${NC}`);
+    for (const v of validation.violations) {
+      console.error(`${RED}  [${v.layer}] ${v.path} — ${v.reason}${NC}`);
+    }
+    foundIssues += validation.violations.length;
+  } else {
+    console.log(`${GREEN}[pre-publish] Layer validation PASSED: ${validation.totalFiles} files, all L1.${NC}`);
+  }
+} catch (err) {
+  // Layer validation is best-effort in pre-publish gate.
+  // If Python or audit_layers.py not available, WARN but don't block.
+  console.warn(`${YELLOW}[pre-publish] Layer validation skipped: ${err.message}${NC}`);
+  console.warn(`${YELLOW}[pre-publish] Run 'node bin/validate-package.js' manually to validate.${NC}`);
+}
+
+// === VERDICT ===
+if (foundIssues > 0) {
+  console.error('');
+  console.error(`${RED}=====================================================${NC}`);
+  console.error(`${RED}  NPM PUBLISH BLOCKED: ${foundIssues} security issue(s) found  ${NC}`);
+  console.error(`${RED}=====================================================${NC}`);
+  console.error('');
+  console.error(`${YELLOW}  Fix the issues above before publishing.${NC}`);
+  console.error(`${YELLOW}  Run 'npm pack --dry-run' to see what would be published.${NC}`);
+  console.error('');
+  process.exit(1);
+}
+
+console.log(`${GREEN}[pre-publish] Security gate PASSED. ${packFiles.length} files scanned, 0 issues.${NC}`);
+console.log(`${GREEN}[pre-publish] Package is safe to publish.${NC}`);