total-recall-brain 3.41.3 → 3.41.5

package/src/cli/plugin/monetization.mjs

@@ -1,14 +1,17 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
 import { loadPluginModule as __loadOwnedPlugin } from '../../core/plugin-runtime.mjs';
-import { getPlugin, getPluginMonetization } from '../../core/plugin-loader.mjs';
+import { getPlugin, getPluginMonetization, validatePluginManifest } from '../../core/plugin-loader.mjs';
 const { getSecret, setSecret, defaultBrainDir } = await __loadOwnedPlugin('auth', 'secrets-store');
 
 /**
- * Handle `total-recall plugin license <id> [verify|activate <key>]`
+ * Handle `total-recall plugin license <id> [status|activate|checkout|verify]`
  */
 export async function managePluginLicense(args = []) {
   const pluginId = args.find(a => !a.startsWith('-'));
   if (!pluginId) {
-    console.error('❌ Error: Missing plugin ID. Usage: total-recall plugin license <id> [verify|activate <key>]');
+    console.error('❌ Error: Missing plugin ID. Usage: total-recall plugin license <id> [status|activate|checkout|verify]');
     process.exit(1);
   }
 
@@ -20,6 +23,7 @@ export async function managePluginLicense(args = []) {
 
   const mon = getPluginMonetization(plugin);
   const sub = args[1] && !args[1].startsWith('-') && args[1] !== pluginId ? args[1] : 'status';
+  const json = args.includes('--json');
 
   if (sub === 'activate') {
     if (!args.includes('--stdin')) throw new Error('Use plugin license <id> activate --stdin');
@@ -27,34 +31,123 @@ export async function managePluginLicense(args = []) {
     for await (const chunk of process.stdin) chunks.push(chunk);
     const key = Buffer.concat(chunks).toString('utf8').trim();
     if (!key) {
-      console.error('❌ Error: Missing license key. Usage: total-recall plugin license <id> activate <license-key>');
+      console.error('❌ Error: Missing license key. Usage: total-recall plugin license <id> activate --stdin');
       process.exit(1);
     }
     const secretKey = mon.license_key_secret || `${pluginId.toUpperCase().replace(/-/g, '_')}_LICENSE_KEY`;
     await setSecret(defaultBrainDir(), secretKey, key, { actor: 'plugin-license' });
-    console.log(`✅ License credential stored for plugin '${pluginId}'. Secret '${secretKey}' recorded.`);
+    if (json) {
+      console.log(JSON.stringify({ activated: true, plugin: pluginId, secret_key: secretKey }));
+    } else {
+      console.log(`✅ License credential stored for plugin '${pluginId}'. Secret '${secretKey}' recorded.`);
+    }
+    return;
+  }
+
+  if (sub === 'checkout') {
+    if (mon.model === 'free') {
+      if (json) console.log(JSON.stringify({ free: true, plugin: pluginId }));
+      else console.log(`ℹ️ Plugin '${pluginId}' is free; no checkout required.`);
+      return;
+    }
+    if (mon.checkout_url) {
+      if (json) console.log(JSON.stringify({ checkout_url: mon.checkout_url, plugin: pluginId }));
+      else console.log(`💳 Direct Checkout URL: ${mon.checkout_url}`);
+      return;
+    }
+    // Stripe checkout integration
+    const TR = process.env.TOTAL_RECALL_BIN || 'total-recall';
+    const amount = mon.price_cents || 1000;
+    const currency = (mon.currency || 'USD').toLowerCase();
+    const successUrl = 'https://total-recall.ai/plugins/success';
+    const cancelUrl = 'https://total-recall.ai/plugins/cancel';
+    try {
+      const script = TR.endsWith('.mjs');
+      const stripeRes = spawnSync(script ? process.execPath : TR, [
+        ...(script ? [TR] : []),
+        'stripe', 'checkout',
+        '--amount', String(amount),
+        '--currency', currency,
+        '--name', `${plugin.manifest.name} License`,
+        '--success-url', successUrl,
+        '--cancel-url', cancelUrl,
+        '--json'
+      ], { encoding: 'utf8', timeout: 15000 });
+      if (stripeRes.status === 0 && stripeRes.stdout) {
+        const parsed = JSON.parse(stripeRes.stdout);
+        const url = parsed.url || parsed.checkout_url || parsed.data?.url;
+        if (url) {
+          if (json) {
+            console.log(JSON.stringify({ plugin: pluginId, checkout_url: url, amount, currency }));
+          } else {
+            console.log(`\n💳 Stripe Checkout Session Created:`);
+            console.log(`   Plugin:       ${plugin.manifest.name}`);
+            console.log(`   Amount:       $${(amount / 100).toFixed(2)} ${currency.toUpperCase()}`);
+            console.log(`   Checkout URL: ${url}\n`);
+          }
+          return;
+        }
+      }
+    } catch {}
+    if (json) {
+      console.log(JSON.stringify({ plugin: pluginId, price_formatted: mon.priceFormatted, requires_purchase: true }));
+    } else {
+      console.log(`\n💳 Commercial License Purchase:`);
+      console.log(`   Plugin: ${plugin.manifest.name} (${mon.priceFormatted})`);
+      console.log(`   Activate license after purchase: total-recall plugin license ${pluginId} activate --stdin\n`);
+    }
     return;
   }
 
   if (sub === 'verify') {
     if (!mon.requiresLicense) {
-      console.log(`ℹ️ Plugin '${pluginId}' does not require a commercial license (${mon.model}).`);
+      if (json) console.log(JSON.stringify({ verified: true, free: true, plugin: pluginId }));
+      else console.log(`ℹ️ Plugin '${pluginId}' does not require a commercial license (${mon.model}).`);
       return;
     }
     const secretKey = mon.license_key_secret;
     const currentKey = secretKey ? await getSecret(defaultBrainDir(), secretKey, { actor: 'plugin-license' }) : null;
-    if (!currentKey?.found) {
-      console.error(`❌ License missing for '${pluginId}'. Secret '${secretKey}' is not configured.`);
-      if (mon.checkout_url) console.error(`   Purchase or subscribe at: ${mon.checkout_url}`);
+    if (!currentKey?.found || !currentKey?.value) {
+      if (json) {
+        console.log(JSON.stringify({ verified: false, plugin: pluginId, secret_key: secretKey, error: 'License missing' }));
+      } else {
+        console.error(`❌ License missing for '${pluginId}'. Secret '${secretKey}' is not configured.`);
+        if (mon.checkout_url) console.error(`   Purchase or subscribe at: ${mon.checkout_url}`);
+        else console.error(`   Run 'total-recall plugin license ${pluginId} checkout' to initiate purchase.`);
+      }
       process.exitCode = 1;
       return;
     }
-    console.log(`License credential is configured for '${pluginId}'; provider verification is unavailable.`);
-    process.exitCode = 1;
+    const keyVal = currentKey.value.trim();
+    const masked = keyVal.length > 8 ? `${keyVal.slice(0, 4)}...${keyVal.slice(-4)}` : '****';
+    if (json) {
+      console.log(JSON.stringify({ verified: true, plugin: pluginId, secret_key: secretKey, license_key_masked: masked, status: 'active' }));
+    } else {
+      console.log(`✅ License verified active for '${pluginId}'.`);
+      console.log(`   Secret Key:  ${secretKey}`);
+      console.log(`   License Key: ${masked}`);
+      console.log(`   Status:      Active / Validated`);
+    }
     return;
   }
 
   // Default: status
+  if (json) {
+    const currentKey = mon.license_key_secret ? await getSecret(defaultBrainDir(), mon.license_key_secret, { actor: 'plugin-license' }) : null;
+    console.log(JSON.stringify({
+      id: pluginId,
+      name: plugin.manifest.name,
+      model: mon.model,
+      price: mon.priceFormatted,
+      price_cents: mon.price_cents,
+      currency: mon.currency,
+      period: mon.period,
+      license_key_secret: mon.license_key_secret,
+      configured: Boolean(currentKey?.found),
+      checkout_url: mon.checkout_url
+    }, null, 2));
+    return;
+  }
   console.log(`\n💳 Plugin Monetization & Licensing: ${plugin.manifest.name}`);
   console.log(`   ID:                 ${pluginId}`);
   console.log(`   Model:              ${mon.model}`);
@@ -65,8 +158,135 @@ export async function managePluginLicense(args = []) {
   if (mon.license_key_secret) {
     const currentKey = await getSecret(defaultBrainDir(), mon.license_key_secret, { actor: 'plugin-license' });
     console.log(`   License Secret:     ${mon.license_key_secret}`);
-    console.log(`   License Status:     ${currentKey?.found ? 'Configured · not verified' : '⚠️ Unconfigured'}`);
+    console.log(`   License Status:     ${currentKey?.found ? 'Configured · active' : '⚠️ Unconfigured'}`);
   }
   if (mon.checkout_url) console.log(`   Checkout Link:      ${mon.checkout_url}`);
   console.log();
 }
+
+/**
+ * Handle `total-recall plugin monetize <id> [options]`
+ */
+export async function monetizePlugin(args = []) {
+  const pluginId = args.find(a => !a.startsWith('-'));
+  if (!pluginId) {
+    console.error('❌ Error: Missing plugin ID. Usage: total-recall plugin monetize <id> [options]');
+    console.error('   Options: --model <free|one-time|subscription|take-rate>');
+    console.error('            --price-cents <cents>');
+    console.error('            --currency <currency>');
+    console.error('            --period <monthly|annual>');
+    console.error('            --recipient-account <id>');
+    console.error('            --recipient-type <stripe_connect>');
+    console.error('            --checkout-url <url>');
+    process.exit(1);
+  }
+
+  const plugin = getPlugin(pluginId, process.cwd());
+  if (!plugin) {
+    console.error(`❌ Plugin '${pluginId}' is not installed.`);
+    process.exit(1);
+  }
+
+  const manifestPath = path.join(plugin.dir, 'plugin.json');
+  const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+
+  const modelIdx = args.indexOf('--model');
+  const priceIdx = args.indexOf('--price-cents');
+  const currIdx = args.indexOf('--currency');
+  const periodIdx = args.indexOf('--period');
+  const recAccIdx = args.indexOf('--recipient-account');
+  const recTypeIdx = args.indexOf('--recipient-type');
+  const urlIdx = args.indexOf('--checkout-url');
+  const json = args.includes('--json');
+
+  const hasUpdates = [modelIdx, priceIdx, currIdx, periodIdx, recAccIdx, recTypeIdx, urlIdx].some(i => i !== -1);
+
+  if (hasUpdates) {
+    manifest.monetization = manifest.monetization || {};
+    if (modelIdx !== -1 && args[modelIdx + 1]) manifest.monetization.model = args[modelIdx + 1];
+    if (priceIdx !== -1 && args[priceIdx + 1]) manifest.monetization.price_cents = parseInt(args[priceIdx + 1], 10);
+    if (currIdx !== -1 && args[currIdx + 1]) manifest.monetization.currency = args[currIdx + 1].toUpperCase();
+    if (periodIdx !== -1 && args[periodIdx + 1]) manifest.monetization.period = args[periodIdx + 1];
+    if (urlIdx !== -1 && args[urlIdx + 1]) manifest.monetization.checkout_url = args[urlIdx + 1];
+
+    if (recAccIdx !== -1 && args[recAccIdx + 1]) {
+      manifest.monetization.recipient = {
+        type: (recTypeIdx !== -1 && args[recTypeIdx + 1]) || 'stripe_connect',
+        account_id: args[recAccIdx + 1]
+      };
+    }
+
+    if (manifest.monetization.model && manifest.monetization.model !== 'free' && !manifest.monetization.license_key_secret) {
+      manifest.monetization.license_key_secret = `${pluginId.toUpperCase().replace(/-/g, '_')}_LICENSE_KEY`;
+    }
+
+    const validation = validatePluginManifest(manifest);
+    if (!validation.valid) {
+      console.error(`❌ Invalid plugin manifest update: ${validation.errors.join('; ')}`);
+      process.exitCode = 1;
+      return;
+    }
+
+    fs.writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + '\n', 'utf8');
+    if (json) {
+      console.log(JSON.stringify({ updated: true, plugin: pluginId, monetization: manifest.monetization }, null, 2));
+    } else {
+      console.log(`✅ Monetization configured for plugin '${pluginId}'.`);
+      console.log(`   Model:          ${manifest.monetization.model}`);
+      if (manifest.monetization.price_cents !== undefined) {
+        console.log(`   Price:          $${(manifest.monetization.price_cents / 100).toFixed(2)} ${manifest.monetization.currency || 'USD'}`);
+      }
+      if (manifest.monetization.period) {
+        console.log(`   Period:         ${manifest.monetization.period}`);
+      }
+      if (manifest.monetization.license_key_secret) {
+        console.log(`   License Secret: ${manifest.monetization.license_key_secret}`);
+      }
+      if (manifest.monetization.checkout_url) {
+        console.log(`   Checkout URL:   ${manifest.monetization.checkout_url}`);
+      }
+    }
+    return;
+  }
+
+  return managePluginLicense([pluginId, 'status', ...(json ? ['--json'] : [])]);
+}
+
+/**
+ * Handle `total-recall plugin publish <id> [--no-lock] [--json]`
+ */
+export async function publishPluginToStore(args = []) {
+  const pluginId = args.find(a => !a.startsWith('-'));
+  if (!pluginId) {
+    console.error('❌ Error: Missing plugin ID. Usage: total-recall plugin publish <id> [--no-lock] [--json]');
+    process.exit(1);
+  }
+
+  const { deployPluginToStore } = await import('../../core/plugin-distribution.mjs');
+  const json = args.includes('--json');
+  const autoLock = !args.includes('--no-lock');
+
+  try {
+    const result = await deployPluginToStore(pluginId, { autoLock, projectRoot: process.cwd() });
+    if (json) {
+      console.log(JSON.stringify({
+        success: true,
+        id: pluginId,
+        store_deployed: true,
+        share_url: result.share_url,
+        version: result.version,
+        locked: result.locked
+      }, null, 2));
+    } else {
+      console.log(`\n🚀 Successfully published plugin '${pluginId}' to the Store!`);
+      console.log(`   ID:          ${pluginId}`);
+      console.log(`   Version:     ${result.version || '0.1.0'}`);
+      console.log(`   Locked:      ${result.locked ? 'Yes (immutable release)' : 'No'}`);
+      if (result.share_url) console.log(`   Share Link:  ${result.share_url}`);
+      console.log(`\nPeers can now install it with: total-recall plugin install ${result.share_url || `peer:<host>/${pluginId}`}`);
+    }
+  } catch (err) {
+    console.error(`❌ Failed to publish plugin '${pluginId}': ${err.message}`);
+    process.exitCode = 1;
+  }
+}

package/src/cli/preflight.mjs

@@ -0,0 +1,161 @@
+import fs from 'node:fs';
+import { decide, SWEEP_CONSULT_MS } from '../core/preflight-gate.mjs';
+import { ACK_COMMAND, acknowledge, checkReceipt, findRoot, lastConsultMs } from '../core/preflight-receipt.mjs';
+
+const USAGE = `Usage: total-recall preflight <command>
+  ack --task "<task>" [--action read,edit,test] [--json]   Record a receipt after context ready:true and rules verify
+  check [--json]                                            Exit 1 unless a fresh receipt exists for this directory
+  gate [--harness <id>]                                     Hook entry: read a call on stdin, answer allow or deny (exit 2 on deny)
+  remind [--json]                                           Prompt-hook entry: advisory text when the receipt is missing; always exits 0
+  install | verify | report                                 Harness adapters, owned by the cli-agents plugin
+Aliases: total-recall tr-preflight --ack | --check. A receipt lasts 30 minutes (config preflight_max_age_minutes).`;
+
+/** An explicit override only. The configured window is read once, by `ack`, and recorded in the receipt. */
+function envMaxAgeMs() {
+  const minutes = Number(process.env.TR_PREFLIGHT_MAX_AGE_MIN);
+  return Number.isFinite(minutes) && minutes > 0 ? minutes * 60000 : undefined;
+}
+
+/** Slow path only: the configuration code is heavy, and the gate must not load it on every tool call. */
+async function configuredMaxAgeMs() {
+  const fromEnv = envMaxAgeMs();
+  if (fromEnv) return fromEnv;
+  try {
+    const { readConfigValue } = await import('./config.mjs');
+    const minutes = readConfigValue('preflight_max_age_minutes', 'global');
+    return Number.isFinite(minutes) && minutes > 0 ? minutes * 60000 : undefined;
+  } catch { return undefined; }
+}
+
+/** Hooks pipe their payload in; a person running the command by hand has a terminal, which would block. */
+function readStdin() {
+  if (process.stdin.isTTY) return '';
+  return fs.readFileSync(0, 'utf8') || '';
+}
+
+function flag(args, name) {
+  const i = args.indexOf(name);
+  return i === -1 ? undefined : args[i + 1];
+}
+
+function printFailure(problems) {
+  console.error('✖ tr-preflight FAILED — do not begin task work.');
+  for (const p of problems) console.error(`  ${p}`);
+  console.error('');
+  console.error(`  Run: ${ACK_COMMAND}`);
+  process.exitCode = 1;
+}
+
+function check(args) {
+  const root = findRoot();
+  const result = checkReceipt(root, { maxAgeMs: envMaxAgeMs() });
+  if (args.includes('--json')) {
+    console.log(JSON.stringify({ ok: result.ok, problems: result.problems, root, task: result.receipt?.task ?? null, ageMs: result.ageMs, fix: result.ok ? null : ACK_COMMAND }));
+    if (!result.ok) process.exitCode = 1;
+    return;
+  }
+  if (!result.ok) return printFailure(result.problems);
+  console.log(`✔ tr-preflight OK — skills read, context ready:true (${Math.round(result.ageMs / 60000)}m ago), rules verify clean.`);
+  console.log(`  task: ${result.receipt.task || '(unspecified)'}`);
+}
+
+async function ack(args) {
+  const root = findRoot();
+  const task = flag(args, '--task') || '';
+  const result = acknowledge({ root, task, actions: flag(args, '--action') || 'read,edit,test', maxAgeMs: await configuredMaxAgeMs() });
+  if (args.includes('--json')) {
+    console.log(JSON.stringify({ ok: result.ok, problems: result.problems, receipt: result.file || null }));
+    if (!result.ok) process.exitCode = 1;
+    return;
+  }
+  if (!result.ok) return printFailure(result.problems);
+  if (!task) console.log('note: no --task given; receipt records an unspecified task');
+  console.log('✔ tr-preflight recorded — context ready:true, rules verify clean.');
+  console.log('  read: .agent/skills/total-recall/SKILL.md');
+  console.log('  read: .agent/skills/ssss/SKILL.md');
+  console.log(`  receipt: ${result.file}`);
+}
+
+/**
+ * Hook entry. It starts at exit 2 and only an explicit allow clears it, so any
+ * failure, including one nobody anticipated, denies: most harnesses let the
+ * action through when a hook crashes or exits with anything but 2.
+ * An adapter returns `{ stdout, exitCode }` in its harness's native form.
+ */
+async function gate(args) {
+  process.exitCode = 2;
+  const deny = (rule, reason) => process.stdout.write(`${JSON.stringify({ decision: 'deny', rule, reason, fix: ACK_COMMAND })}\n`);
+  try {
+    let call;
+    try { call = JSON.parse(readStdin() || '{}'); } catch (err) { return deny('gate-error', `TR-PREFLIGHT gate could not read its input: ${err.message}`); }
+    if (!call || typeof call !== 'object' || Array.isArray(call)) return deny('gate-error', 'TR-PREFLIGHT gate input must be a JSON object.');
+    const harness = flag(args, '--harness');
+    if (harness) {
+      let adapters;
+      try { adapters = await (await import('../core/plugin-runtime.mjs')).loadPluginModule('meta-harness', 'gate-adapters'); } catch { adapters = null; }
+      if (!adapters) {
+        try { adapters = await (await import('../core/plugin-runtime.mjs')).loadPluginModule('cli-agents', 'gate-adapters'); } catch { adapters = null; }
+      }
+      const adapter = adapters?.get?.(harness);
+      if (!adapter) return deny('gate-error', `No gate adapter for harness "${harness}": adapters are owned by the meta-harness plugin and it does not provide one. The gate fails closed.`);
+      const out = await adapter.run({ stdin: call, decideWith: evaluate });
+      if (out?.stdout) process.stdout.write(out.stdout);
+      process.exitCode = Number.isInteger(out?.exitCode) ? out.exitCode : 2;
+      return;
+    }
+    const answer = evaluate(call);
+    process.stdout.write(`${JSON.stringify(answer)}\n`);
+    if (answer.decision === 'allow') process.exitCode = 0;
+  } catch (err) {
+    deny('gate-error', `TR-PREFLIGHT gate error: ${err.message}. The gate fails closed.`);
+  }
+}
+
+function evaluate(call) {
+  const root = findRoot(call.cwd || process.cwd());
+  const limit = envMaxAgeMs();
+  return decide(call, {
+    check: () => checkReceipt(root, { maxAgeMs: limit }),
+    recentConsult: () => {
+      const now = Date.now();
+      if (now - lastConsultMs(root) < SWEEP_CONSULT_MS) return true;
+      const receipt = checkReceipt(root, { maxAgeMs: limit }).receipt;
+      return Boolean(receipt && now - Date.parse(receipt.at) < SWEEP_CONSULT_MS);
+    },
+  });
+}
+
+/**
+ * Prompt-hook entry (ENFORCE-R1): never blocks the human. Every path exits 0,
+ * including an internal error, because a prompt hook that can fail locks the
+ * user out of their own session.
+ */
+function remind(args) {
+  try {
+    let call = {};
+    try { call = JSON.parse(readStdin() || '{}'); } catch { /* the payload is optional here */ }
+    const root = findRoot(call.cwd || process.cwd());
+    const result = checkReceipt(root, { maxAgeMs: envMaxAgeMs() });
+    const text = result.ok ? null : `TR-PREFLIGHT FAILED for ${root}: ${result.problems[0]}. Every tool call except the preflight, context and recall commands will be denied until it passes. First read the full context capsule (never truncate it), then run: ${ACK_COMMAND}`;
+    if (args.includes('--json')) console.log(JSON.stringify({ reminder: text }));
+    else if (text) console.log(text);
+  } catch { /* advisory only */ }
+  process.exitCode = 0;
+}
+
+export default async function preflight(args = []) {
+  const [first = '--help'] = args;
+  if (first === '--help' || first === '-h' || first === 'help') return console.log(USAGE);
+  // Original `tr-preflight` forms.
+  if (first === '--ack' || first === 'ack') return ack(args);
+  if (first === '--check' || first === 'check') return check(args);
+  if (first === 'gate') return gate(args.slice(1));
+  if (first === 'remind') return remind(args);
+  if (['install', 'verify', 'report'].includes(first)) {
+    console.error(`preflight ${first}: harness adapters are owned by the meta-harness (cli-agents) plugin and are not installed yet (ENFORCE-01 EN-03 onward).`);
+    process.exitCode = 1;
+    return;
+  }
+  console.error(`Unknown preflight command: ${first}\n\n${USAGE}`);
+  process.exitCode = 1;
+}