vibecheck-ai 2.0.2 → 5.0.1

package/bin/runners/lib/entitlements-v2.js

@@ -0,0 +1,265 @@
+/**
+ * VibeCheck Entitlements
+ * 
+ * Simple 2-tier model:
+ * - FREE ($0): Inspect & Observe
+ * - PRO ($49/mo): Fix, Prove & Enforce
+ */
+
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+
+// ============================================================================
+// EXIT CODES
+// ============================================================================
+const EXIT_SUCCESS = 0;
+const EXIT_FEATURE_NOT_ALLOWED = 3;
+
+// ============================================================================
+// TIERS
+// ============================================================================
+const TIERS = {
+  free: { name: "FREE", price: 0 },
+  pro: { name: "PRO", price: 69 },
+};
+
+// ============================================================================
+// GATED FEATURES
+// ============================================================================
+const FREE_FEATURES = [
+  // Setup & environment
+  "init", "doctor", "install", "status", "watch", "preflight",
+  // Scan & analysis
+  "scan", "runtime",
+  // AI verification
+  "ctx", "contracts", "verify",
+  // Reports
+  "report", "export",
+  // Account
+  "login", "logout", "whoami",
+  // Preview modes
+  "reality.preview", "firewall.observe",
+  // Misc
+  "labs", "mdc",
+];
+
+const PRO_FEATURES = [
+  // CI/CD & PR
+  "gate", "pr", "badge", "ship",
+  // Fixes
+  "fix", "fix.apply", "fix.analyze", "fix.diff", "fix.rules", "scan.autofix",
+  // Prove & verify
+  "prove", "replay", "permissions", "graph", "ai-test", "share",
+  // Advanced
+  "checkpoint", "polish", "guard", "context",
+  // Full modes
+  "firewall.enforce", "reality.full", "mcp.full",
+  // All FREE features
+  ...FREE_FEATURES,
+];
+
+/**
+ * Check if developer mode bypass is allowed.
+ * 
+ * SECURITY: VIBECHECK_DEV_PRO is ONLY allowed in non-production environments.
+ * This prevents environment variable injection from granting PRO access in production.
+ * 
+ * @returns {boolean} True only if in development AND VIBECHECK_DEV_PRO=1
+ */
+function isDevProBypassAllowed() {
+  // SECURITY: Never allow dev bypass in production
+  if (process.env.NODE_ENV === "production") {
+    return false;
+  }
+  // Also block in CI environments to prevent pipeline exploitation
+  if (process.env.CI === "true" || process.env.CI === "1") {
+    return false;
+  }
+  return process.env.VIBECHECK_DEV_PRO === "1";
+}
+
+function isPro(tier) {
+  // Developer mode bypass (blocked in production)
+  if (isDevProBypassAllowed()) return true;
+  return tier === "pro";
+}
+
+function tierHasFeature(tier, feature) {
+  // Developer mode bypass - grant all features (blocked in production)
+  if (isDevProBypassAllowed()) return true;
+  if (tier === "pro") return true; // PRO has everything
+  return FREE_FEATURES.includes(feature);
+}
+
+// ============================================================================
+// API
+// ============================================================================
+const API_BASE_URL = process.env.VIBECHECK_API_URL || "https://api.vibecheckai.dev";
+
+let _cachedTier = null;
+let _cachedTierExpiry = 0;
+
+async function getTier(options = {}) {
+  const { apiKey, forceRefresh = false } = options;
+  
+  // Developer mode: VIBECHECK_DEV_PRO=1 grants pro tier for local development
+  // SECURITY: This bypass is blocked in production environments
+  if (isDevProBypassAllowed()) {
+    _cachedTier = "pro";
+    _cachedTierExpiry = Date.now() + 86400000; // 24 hours
+    return "pro";
+  }
+  
+  if (!forceRefresh && _cachedTier && Date.now() < _cachedTierExpiry) {
+    return _cachedTier;
+  }
+  
+  if (!apiKey) {
+    _cachedTier = "free";
+    _cachedTierExpiry = Date.now() + 300000;
+    return "free";
+  }
+  
+  try {
+    const res = await fetch(`${API_BASE_URL}/v1/auth/whoami`, {
+      method: "GET",
+      headers: { "Authorization": `Bearer ${apiKey}` },
+      signal: AbortSignal.timeout(5000),
+    });
+    
+    if (res.ok) {
+      const data = await res.json();
+      // Map any paid tier to 'pro'
+      const plan = data.plan || data.tier || "free";
+      _cachedTier = (plan === "free") ? "free" : "pro";
+      _cachedTierExpiry = Date.now() + 300000;
+      return _cachedTier;
+    }
+  } catch {
+    // Network error - default to free
+  }
+  
+  return "free";
+}
+
+// ============================================================================
+// ENFORCE
+// ============================================================================
+async function enforce(feature, options = {}) {
+  const { apiKey, silent = false } = options;
+  const tier = await getTier({ apiKey });
+  
+  const hasAccess = tierHasFeature(tier, feature);
+  
+  if (hasAccess) {
+    return { allowed: true, tier };
+  }
+  
+  const message = formatUpgradeMessage(feature);
+  if (!silent) {
+    console.error(message);
+  }
+  
+  return {
+    allowed: false,
+    tier,
+    exitCode: EXIT_FEATURE_NOT_ALLOWED,
+    message,
+  };
+}
+
+async function enforceOrExit(feature, options = {}) {
+  const result = await enforce(feature, options);
+  if (!result.allowed) {
+    process.exit(result.exitCode);
+  }
+  return result;
+}
+
+async function checkCommand(command, options = {}) {
+  return enforce(command, { ...options, silent: true });
+}
+
+// ============================================================================
+// MESSAGING
+// ============================================================================
+const c = {
+  reset: "\x1b[0m",
+  bold: "\x1b[1m",
+  cyan: "\x1b[36m",
+  yellow: "\x1b[33m",
+};
+
+function formatUpgradeMessage(feature) {
+  return `
+${c.bold}This feature requires Pro.${c.reset}
+
+${c.yellow}${feature}${c.reset} is a Pro feature.
+
+Upgrade to Pro ($49/mo) to unlock Fix, Prove & Enforce capabilities.
+
+  vibecheck upgrade
+  https://vibecheckai.dev/pricing
+`;
+}
+
+// ============================================================================
+// TIER LIMITS
+// ============================================================================
+const TIER_LIMITS = {
+  free: {
+    reportFormats: ["html", "md", "json"],
+    maxScansPerMonth: 100,
+    maxFilesPerScan: 1000,
+  },
+  pro: {
+    reportFormats: ["html", "md", "json", "sarif", "csv", "pdf"],
+    maxScansPerMonth: -1, // unlimited
+    maxFilesPerScan: -1,  // unlimited
+  },
+};
+
+/**
+ * Get limits for a tier
+ */
+function getLimits(tier) {
+  return TIER_LIMITS[tier] || TIER_LIMITS.free;
+}
+
+/**
+ * Check if current tier meets minimum required tier
+ */
+function tierMeetsMinimum(current, required) {
+  const tierOrder = ['free', 'pro'];
+  const currentIndex = tierOrder.indexOf(current);
+  const requiredIndex = tierOrder.indexOf(required);
+  return currentIndex >= requiredIndex;
+}
+
+// ============================================================================
+// EXPORTS
+// ============================================================================
+module.exports = {
+  // Core
+  getTier,
+  enforce,
+  enforceOrExit,
+  checkCommand,
+  
+  // Helpers
+  isPro,
+  tierHasFeature,
+  getLimits,
+  tierMeetsMinimum,
+  
+  // Constants
+  TIERS,
+  TIER_LIMITS,
+  FREE_FEATURES,
+  PRO_FEATURES,
+  EXIT_SUCCESS,
+  EXIT_FEATURE_NOT_ALLOWED,
+};

package/bin/runners/lib/entitlements.js

@@ -0,0 +1,340 @@
+/**
+ * Entitlements System - CLI Wrapper
+ *
+ * @deprecated Use entitlements-v2.js for new code. This module wraps @vibecheck/core
+ * and is kept for backward compatibility only.
+ *
+ * ⚠️  AUTO-GENERATED FILE - DO NOT EDIT DIRECTLY
+ *
+ * This file wraps the canonical entitlements implementation from @vibecheck/core.
+ * The source of truth is packages/core/src/entitlements.ts
+ *
+ * To modify entitlements logic, edit packages/core/src/entitlements.ts
+ * then run `pnpm build` in packages/core.
+ *
+ * This wrapper exists to:
+ * 1. Provide CommonJS exports for CLI runners
+ * 2. Add CLI-specific functionality (server-usage integration)
+ * 3. Maintain backward compatibility with existing CLI code
+ */
+
+"use strict";
+
+// Import from compiled @vibecheck/core
+let coreEntitlements;
+let usingFallback = false;
+try {
+  coreEntitlements = require("@vibecheck/core");
+} catch (e) {
+  // Fallback for development: try direct path
+  try {
+    coreEntitlements = require("../../../packages/dist-core/index.js");
+  } catch (e2) {
+    // Silent fallback - only show warning in verbose mode or when DEBUG is set
+    if (process.env.DEBUG || process.env.VIBECHECK_DEBUG) {
+      console.error(
+        "[entitlements] Using fallback mode. Run `pnpm build` in packages/core for full features.",
+      );
+    }
+    usingFallback = true;
+    // Provide minimal fallback
+    coreEntitlements = {
+      TIER_CONFIG: {},
+      SEAT_PRICING: {},
+      entitlements: {
+        getCurrentTier: async () => "free",
+        checkFeature: async () => ({ allowed: true }),
+        checkLimit: async () => ({ allowed: true }),
+        enforceFeature: async () => {},
+        enforceLimit: async () => {},
+        trackUsage: async () => {},
+        getUsageSummary: async () => "Usage summary unavailable",
+        getTierConfig: () => ({}),
+        checkSeatLimit: () => ({ allowed: true, effectiveSeats: 1 }),
+      },
+      calculateEffectiveSeats: () => 1,
+      canAddMember: () => ({ allowed: true }),
+      formatSeatInfo: () => "1 seat",
+      validateSeatReduction: () => ({ safe: true }),
+    };
+  }
+}
+
+// Import server-usage for CLI-specific server-authoritative enforcement
+const { serverUsage } = require("./server-usage");
+
+// Re-export everything from core
+const {
+  TIER_CONFIG,
+  SEAT_PRICING,
+  entitlements,
+  calculateEffectiveSeats,
+  canAddMember,
+  formatSeatInfo,
+  validateSeatReduction,
+  isValidTier,
+  getTierConfig,
+  getMinimumTierForFeature,
+} = coreEntitlements;
+
+// ============================================================================
+// CLI-SPECIFIC WRAPPER
+// ============================================================================
+
+/**
+ * CLI Entitlements Manager
+ * Wraps core entitlements with CLI-specific server-authoritative checks
+ */
+class CLIEntitlementsManager {
+  constructor(coreManager) {
+    this._core = coreManager;
+  }
+
+  async getCurrentTier() {
+    return this._core.getCurrentTier();
+  }
+
+  async checkFeature(feature) {
+    return this._core.checkFeature(feature);
+  }
+
+  /**
+   * Check usage limits - SERVER-AUTHORITATIVE for CLI
+   */
+  async checkLimit(limitType) {
+    // Map old limit types to new action types
+    const actionMap = {
+      scans: "scan",
+      realityRuns: "reality",
+      aiAgentRuns: "agent",
+    };
+    const actionType = actionMap[limitType] || limitType;
+
+    // Use server-authoritative check
+    try {
+      const result = await serverUsage.checkUsage(actionType);
+
+      if (result.allowed) {
+        return {
+          allowed: true,
+          usage: result.current,
+          limit: result.limit === -1 ? Infinity : result.limit,
+          source: result.source,
+        };
+      }
+
+      const tier = await this.getCurrentTier();
+      return {
+        allowed: false,
+        reason:
+          result.reason ||
+          `Monthly ${limitType} limit reached (${result.current}/${result.limit})`,
+        usage: result.current,
+        limit: result.limit,
+        upgradePrompt: this._core.formatLimitUpgradePrompt(
+          tier,
+          limitType,
+          result.current,
+          result.limit,
+        ),
+        source: result.source,
+      };
+    } catch (error) {
+      // Fallback to core check if server is unreachable
+      return this._core.checkLimit(limitType);
+    }
+  }
+
+  /**
+   * Track usage - SERVER-AUTHORITATIVE for CLI
+   */
+  async trackUsage(type, count = 1) {
+    // Map old types to new action types
+    const actionMap = {
+      scans: "scan",
+      realityRuns: "reality",
+      aiAgentRuns: "agent",
+      gateRuns: "gate",
+      fixRuns: "fix",
+    };
+    const actionType = actionMap[type] || type;
+
+    // Record on server (authoritative)
+    try {
+      const result = await serverUsage.recordUsage(actionType, count);
+      // Also update local via core
+      await this._core.trackUsage(type, count);
+      return result;
+    } catch (error) {
+      // Still update local, mark as unsynced
+      await this._core.trackUsage(type, count);
+      return { success: false, error: error.message, queued: true };
+    }
+  }
+
+  async enforceFeature(feature) {
+    return this._core.enforceFeature(feature);
+  }
+
+  /**
+   * Enforce usage limits - SERVER-AUTHORITATIVE for CLI
+   */
+  async enforceLimit(limitType) {
+    // Check if sync is required first
+    const needsSync = await serverUsage.requiresSync();
+    if (needsSync) {
+      const syncResult = await serverUsage.syncOfflineUsage();
+      if (syncResult.error) {
+        // Allow offline mode by default - CLI should work without internet
+        console.warn(
+          "\x1b[33mWarning: Could not connect to vibecheck API, using offline mode\x1b[0m\n",
+        );
+        return { allowed: true, source: "offline" };
+      }
+    }
+
+    const check = await this.checkLimit(limitType);
+    if (!check.allowed) {
+      const error = new Error(check.reason);
+      error.code = "LIMIT_EXCEEDED";
+      error.upgradePrompt = check.upgradePrompt;
+      error.usage = check.usage;
+      error.limit = check.limit;
+      throw error;
+    }
+
+    return check;
+  }
+
+  async getUsageSummary() {
+    // Try to get server-authoritative summary
+    try {
+      const serverSummary = await serverUsage.getUsageSummary();
+
+      if (serverSummary.success !== false && serverSummary.usage) {
+        const tier = serverSummary.tier || (await this.getCurrentTier());
+        const config = TIER_CONFIG[tier];
+        const limits = serverSummary.limits || config.limits;
+
+        const formatLimit = (current, limit) => {
+          if (limit === -1) return `${current} (unlimited)`;
+          const pct = Math.round((current / limit) * 100);
+          const bar = this.progressBar(pct);
+          return `${current}/${limit} ${bar} ${pct}%`;
+        };
+
+        const lines = [
+          "",
+          `\x1b[1m📊 Usage Summary\x1b[0m (\x1b[36m${config.name}\x1b[0m tier - $${config.price}/mo)`,
+          "\x1b[90m" + "─".repeat(50) + "\x1b[0m",
+          `Scans:        ${formatLimit(serverSummary.usage.scan || 0, limits.scans || limits.scansPerMonth)}`,
+          `Reality Runs: ${formatLimit(serverSummary.usage.reality || 0, limits.reality || limits.realityRunsPerMonth)}`,
+          `AI Agent:     ${formatLimit(serverSummary.usage.agent || 0, limits.agent || limits.aiAgentRunsPerMonth)}`,
+          `Team Seats:   ${formatSeatInfo(tier)}`,
+          "\x1b[90m" + "─".repeat(50) + "\x1b[0m",
+        ];
+
+        if (serverSummary.period) {
+          lines.push(
+            `Period: ${serverSummary.period.start.split("T")[0]} to ${serverSummary.period.end.split("T")[0]}`,
+          );
+        }
+
+        if (serverSummary.pendingOffline > 0) {
+          lines.push(
+            `\x1b[33m⚠ ${serverSummary.pendingOffline} action(s) pending sync\x1b[0m`,
+          );
+        }
+
+        lines.push(
+          `\x1b[90mSource: ${serverSummary.source || "server"}\x1b[0m`,
+        );
+        lines.push("");
+
+        return lines.join("\n");
+      }
+    } catch {
+      // Fall through to core summary
+    }
+
+    return this._core.getUsageSummary();
+  }
+
+  getTierConfig(tier) {
+    return this._core.getTierConfig(tier);
+  }
+
+  getAllTiers() {
+    return this._core.getAllTiers();
+  }
+
+  // Seat management
+  checkSeatLimit(tier, currentMemberCount, purchasedExtraSeats) {
+    return this._core.checkSeatLimit(
+      tier,
+      currentMemberCount,
+      purchasedExtraSeats,
+    );
+  }
+
+  getOrganizationSeats(tier, purchasedExtraSeats, currentMembers) {
+    return this._core.getOrganizationSeats(
+      tier,
+      purchasedExtraSeats,
+      currentMembers,
+    );
+  }
+
+  progressBar(percent) {
+    const filled = Math.min(10, Math.round(percent / 10));
+    const empty = 10 - filled;
+    return `[${"█".repeat(filled)}${"░".repeat(empty)}]`;
+  }
+}
+
+// Create CLI-specific wrapper
+const cliEntitlements = new CLIEntitlementsManager(entitlements);
+
+// ============================================================================
+// EXPORTS
+// ============================================================================
+
+module.exports = {
+  // Main entitlements instance (CLI wrapper)
+  entitlements: cliEntitlements,
+
+  // Tier configuration
+  TIER_CONFIG,
+  SEAT_PRICING,
+
+  // Convenience functions
+  checkFeature: (feature) => cliEntitlements.checkFeature(feature),
+  checkLimit: (limitType) => cliEntitlements.checkLimit(limitType),
+  enforceFeature: (feature) => cliEntitlements.enforceFeature(feature),
+  enforceLimit: (limitType) => cliEntitlements.enforceLimit(limitType),
+  trackUsage: (type, count) => cliEntitlements.trackUsage(type, count),
+  getCurrentTier: () => cliEntitlements.getCurrentTier(),
+  getUsageSummary: () => cliEntitlements.getUsageSummary(),
+  getTierConfig: (tier) => cliEntitlements.getTierConfig(tier),
+
+  // Seat management
+  checkSeatLimit: (tier, currentMemberCount, purchasedExtraSeats) =>
+    cliEntitlements.checkSeatLimit(
+      tier,
+      currentMemberCount,
+      purchasedExtraSeats,
+    ),
+  calculateEffectiveSeats,
+  canAddMember,
+  formatSeatInfo,
+  validateSeatReduction,
+
+  // Tier helpers
+  isValidTier,
+  getMinimumTierForFeature,
+
+  // Server-authoritative usage enforcement
+  serverUsage,
+  syncOfflineUsage: () => serverUsage.syncOfflineUsage(),
+  requiresSync: () => serverUsage.requiresSync(),
+};