rosett-ai 1.3.3

data/lib/rosett_ai/thor/tasks/mcp.rb

@@ -0,0 +1,535 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+require 'terminal-table'
+
+module RosettAi
+  module Thor
+    module Tasks
+      # Thor CLI for MCP server and administration.
+      #
+      # Provides serve, list, validate, status, audit, key management,
+      # and trust source subcommands for MCP server management.
+      #
+      # @author hugo
+      # @author claude
+      class Mcp < ::Thor
+        namespace 'mcp'
+
+        desc 'serve', 'Start Rosett-AI as an MCP server'
+        long_desc <<~LONGDESC
+          Start Rosett-AI as a Model Context Protocol server.
+
+          By default, uses stdio transport. With --http, starts an HTTP server
+          on the specified port (default 8484) with the full security middleware
+          stack (request size, content type, origin validation, CORS,
+          authentication, rate limiting).
+
+          Exit codes: 0 success, 5 MCP error.
+
+          EXAMPLES
+
+            raictl mcp serve
+            raictl mcp serve --http
+            raictl mcp serve --http --port 9090
+            raictl mcp serve --http --tls-cert cert.pem --tls-key key.pem
+        LONGDESC
+        method_option :http, type: :boolean, default: false, desc: 'Use HTTP transport instead of stdio'
+        method_option :port, type: :numeric, default: 8484, desc: 'HTTP port'
+        method_option :host, type: :string, default: 'localhost', desc: 'HTTP bind address'
+        method_option :tls_cert, type: :string, desc: 'Path to TLS certificate'
+        method_option :tls_key, type: :string, desc: 'Path to TLS private key'
+        method_option :allow_remote, type: :boolean, default: false, desc: 'Allow non-localhost binding'
+        method_option :config, type: :string, desc: 'Path to server config YAML'
+        method_option :plugin, type: :array, default: [], desc: 'Plugin names to load'
+        def serve
+          server = RosettAi::Mcp::Server.new(
+            config_path: options[:config],
+            plugins: options[:plugin]
+          )
+
+          if options[:http]
+            unless ENV.fetch('RAI_MCP_API_KEY', nil)
+              warn Rainbow('[rosett-ai-mcp] WARNING: Starting HTTP server with no API key configured. ' \
+                           'Set RAI_MCP_API_KEY or use a keyfile for authentication.').yellow
+            end
+            server.serve_http(
+              port: options[:port],
+              host: options[:host],
+              tls_cert: options[:tls_cert],
+              tls_key: options[:tls_key],
+              allow_remote: options[:allow_remote]
+            )
+          else
+            server.serve
+          end
+        rescue RosettAi::McpError => e
+          warn Rainbow(e.message).red
+          exit(5)
+        end
+
+        desc 'list', 'List configured MCP servers'
+        long_desc <<~LONGDESC
+          List all MCP servers registered in the rai configuration.
+
+          Displays name, transport type, and command/URL for each server.
+          Use --format json for machine-readable output.
+
+          EXAMPLES
+
+            raictl mcp list
+            raictl mcp list --format json
+
+          Related: mcp status, mcp validate
+        LONGDESC
+        method_option :format, type: :string, default: 'table', enum: ['table', 'json'], desc: 'Output format'
+        def list
+          registry = build_registry
+          servers = registry.list
+
+          if servers.empty?
+            say(t('no_servers'))
+            return
+          end
+
+          render_server_list(servers)
+        end
+
+        desc 'validate', 'Validate MCP server configurations'
+        long_desc <<~LONGDESC
+          Validate all MCP server configurations against the MCP schema.
+
+          Checks transport settings, command paths, and required fields.
+          Exit codes: 0 all valid, 2 validation errors found.
+
+          EXAMPLES
+
+            raictl mcp validate
+            raictl mcp validate --format json
+
+          Related: mcp list, mcp status
+        LONGDESC
+        method_option :format, type: :string, default: 'table', enum: ['table', 'json'], desc: 'Output format'
+        def validate
+          registry = build_registry
+          validator = RosettAi::Mcp::Admin::SchemaValidator.new
+          results = validator.validate_all(registry)
+
+          render_validation_results(results)
+          all_valid = results.all? { |r| r[:valid] }
+          exit(all_valid ? 0 : 2)
+        end
+
+        desc 'status', 'Show MCP server health status'
+        long_desc <<~LONGDESC
+          Check the health of all configured MCP servers.
+
+          Probes each server's transport endpoint and reports availability.
+          Use --format json for machine-readable output.
+
+          EXAMPLES
+
+            raictl mcp status
+            raictl mcp status --format json
+
+          Related: mcp list, mcp validate
+        LONGDESC
+        method_option :format, type: :string, default: 'table', enum: ['table', 'json'], desc: 'Output format'
+        def status
+          registry = build_registry
+          checker = RosettAi::Mcp::Admin::HealthChecker.new
+          results = checker.check_all(registry)
+
+          if results.empty?
+            say(t('no_servers'))
+            return
+          end
+
+          render_health_results(results)
+        end
+
+        desc 'audit', 'Generate MCP compliance audit report'
+        long_desc <<~LONGDESC
+          Generate a compliance audit report for all configured MCP servers.
+
+          Combines health checks and schema validation into a single report
+          with summary statistics. Default output is JSON for integration
+          with CI/CD pipelines.
+
+          EXAMPLES
+
+            raictl mcp audit
+            raictl mcp audit --format table
+
+          Related: mcp validate, mcp status
+        LONGDESC
+        method_option :format, type: :string, default: 'json', enum: ['table', 'json'], desc: 'Output format'
+        def audit
+          registry = build_registry
+          checker = RosettAi::Mcp::Admin::HealthChecker.new
+          validator = RosettAi::Mcp::Admin::SchemaValidator.new
+          auditor = RosettAi::Mcp::Admin::Auditor.new(
+            registry: registry, health_checker: checker, schema_validator: validator
+          )
+
+          report = auditor.audit
+          render_audit_report(report)
+        end
+
+        desc 'add NAME URI', 'Install an MCP server from a trusted source'
+        long_desc <<~LONGDESC
+          Install an MCP server from a URI. The domain must be in the trust
+          sources list. Use `mcp trust-add` to add domains first.
+
+          Example: raictl mcp add my-server npx:@example/mcp-server
+
+          Exit codes: 0 success, 1 untrusted source, 2 validation error.
+
+          Related: mcp remove, mcp trust-sources
+        LONGDESC
+        method_option :transport, type: :string, default: 'stdio',
+                                  enum: ['stdio', 'http', 'streamable-http'],
+                                  desc: 'Transport type'
+        def add(name, uri)
+          installer = build_installer
+          result = installer.install(name: name, uri: uri, transport: options[:transport])
+
+          if result[:success]
+            say(Rainbow(result[:message]).green)
+          else
+            warn(Rainbow(result[:message]).red)
+            exit(result[:trusted] == false ? 1 : 2)
+          end
+        end
+
+        desc 'remove NAME', 'Remove a configured MCP server'
+        long_desc <<~LONGDESC
+          Remove a configured MCP server by name.
+
+          User-installed servers are removed directly. Managed servers
+          (from content packs) require --force.
+
+          EXAMPLES
+
+            raictl mcp remove my-server
+            raictl mcp remove managed-server --force
+
+          Related: mcp add, mcp list
+        LONGDESC
+        method_option :force, type: :boolean, default: false, desc: 'Force removal of managed servers'
+        def remove(name)
+          installer = build_installer
+          result = installer.remove(name: name, force: options[:force])
+
+          if result[:success]
+            say(Rainbow(result[:message]).green)
+          else
+            warn(Rainbow(result[:message]).red)
+            exit(1)
+          end
+        end
+
+        desc 'trust-sources', 'List configured trust sources'
+        long_desc <<~LONGDESC
+          List all configured trust sources for MCP server installation.
+
+          Shows built-in domains (e.g., modelcontextprotocol.io) and
+          user-added domains. Servers can only be installed from trusted sources.
+
+          EXAMPLES
+
+            raictl mcp trust-sources
+            raictl mcp trust-sources --format json
+
+          Related: mcp trust-add, mcp trust-remove
+        LONGDESC
+        method_option :format, type: :string, default: 'table', enum: ['table', 'json'], desc: 'Output format'
+        map 'trust-sources' => :trust_sources
+        def trust_sources
+          manager = build_trust_manager
+          sources = manager.list
+
+          render_trust_sources(sources)
+        end
+
+        desc 'trust-add DOMAIN', 'Add a trusted domain for MCP server installation'
+        long_desc <<~LONGDESC
+          Add a domain to the user trust sources list.
+
+          Once trusted, MCP servers from this domain can be installed with
+          `mcp add`. Use --description to document why the domain is trusted.
+
+          Example: raictl mcp trust-add example.com --description "Internal MCP server"
+
+          Related: mcp trust-remove, mcp trust-sources
+        LONGDESC
+        method_option :description, type: :string, default: 'User-trusted domain', desc: 'Trust source description'
+        map 'trust-add' => :trust_add
+        def trust_add(domain)
+          manager = build_trust_manager
+          manager.add_trust(domain, description: options[:description])
+          say(Rainbow("Trust added for: #{domain}").green)
+        end
+
+        desc 'trust-remove DOMAIN', 'Remove a trusted domain'
+        long_desc <<~LONGDESC
+          Remove a domain from the user trust sources list.
+
+          Built-in trust sources cannot be removed. Only user-added domains
+          can be removed.
+
+          EXAMPLES
+
+            raictl mcp trust-remove example.com
+
+          Related: mcp trust-add, mcp trust-sources
+        LONGDESC
+        map 'trust-remove' => :trust_remove
+        def trust_remove(domain)
+          manager = build_trust_manager
+          if manager.remove_trust(domain)
+            say(Rainbow("Trust removed for: #{domain}").green)
+          else
+            warn(Rainbow("Domain not found in user trust sources: #{domain}").red)
+            exit(1)
+          end
+        end
+
+        desc 'tools', 'List available MCP tools'
+        long_desc <<~LONGDESC
+          List all tools exposed by the Rosett-AI MCP server.
+
+          Shows tool name, description, and read-only hint for each tool.
+          These are the tools available to AI engines via the MCP protocol.
+
+          EXAMPLES
+
+            raictl mcp tools
+        LONGDESC
+        def tools
+          server = RosettAi::Mcp::Server.new
+          tool_list = server.tools
+
+          table = ::Terminal::Table.new(
+            headings: ['Tool', 'Description', 'Read-Only'],
+            rows: tool_list.map { |t| [t[:name], t[:description], t[:annotations]['readOnlyHint']] }
+          )
+          say(table)
+        end
+
+        desc 'generate-key', 'Generate a new MCP API key'
+        long_desc <<~LONGDESC
+          Generate a new API key for MCP server authentication.
+
+          The key is printed to stdout. The salted hash is stored in the
+          keyfile. Use --name to identify the key.
+
+          EXAMPLES
+
+            raictl mcp generate-key --name claude-code
+            raictl mcp generate-key --name ci-runner --keyfile /etc/rosett-ai/mcp/keys.yml
+        LONGDESC
+        method_option :name, type: :string, required: true, desc: 'Key name'
+        method_option :keyfile, type: :string, default: RosettAi::Mcp::Keyfile::DEFAULT_FILENAME, desc: 'Keyfile path'
+        map 'generate-key' => :generate_key
+        def generate_key
+          path = RosettAi::Mcp::Keyfile.create_if_missing(options[:keyfile])
+          plaintext = RosettAi::Mcp::KeyHasher.generate_key
+          key_hash = RosettAi::Mcp::KeyHasher.hash_key(plaintext)
+
+          keyfile = RosettAi::Mcp::Keyfile.new(path)
+          keyfile.load!
+          keyfile.add_key(name: options[:name], key_hash: key_hash)
+
+          say(Rainbow("API key generated for '#{options[:name]}':").green)
+          say(plaintext)
+          say(Rainbow('Store this key securely — it cannot be recovered.').yellow)
+        end
+
+        desc 'list-keys', 'List all MCP API keys'
+        long_desc <<~LONGDESC
+          List all API keys in the keyfile.
+
+          Shows key name, creation date, enabled status, and expiry.
+          Key hashes are never displayed.
+
+          EXAMPLES
+
+            raictl mcp list-keys
+            raictl mcp list-keys --keyfile /etc/rosett-ai/mcp/keys.yml
+        LONGDESC
+        method_option :keyfile, type: :string, default: RosettAi::Mcp::Keyfile::DEFAULT_FILENAME, desc: 'Keyfile path'
+        map 'list-keys' => :list_keys
+        def list_keys
+          path = File.expand_path(options[:keyfile])
+          unless File.exist?(path)
+            say(Rainbow('No keyfile found.').yellow)
+            return
+          end
+
+          keyfile = RosettAi::Mcp::Keyfile.new(path)
+          keyfile.load!
+          keys = keyfile.enabled_keys
+
+          if keys.empty?
+            say('No keys configured.')
+            return
+          end
+
+          table = ::Terminal::Table.new(
+            headings: ['Name', 'Created', 'Enabled', 'Expires'],
+            rows: keys.map { |k| [k[:name], k[:created_at], k[:enabled], k[:expires_at] || 'never'] }
+          )
+          say(table)
+        end
+
+        desc 'revoke-key', 'Revoke an MCP API key'
+        long_desc <<~LONGDESC
+          Disable an API key by name.
+
+          The key remains in the keyfile but is marked as disabled.
+          Revoked keys cannot be used for authentication.
+
+          EXAMPLES
+
+            raictl mcp revoke-key --name old-key
+        LONGDESC
+        method_option :name, type: :string, required: true, desc: 'Key name to revoke'
+        method_option :keyfile, type: :string, default: RosettAi::Mcp::Keyfile::DEFAULT_FILENAME, desc: 'Keyfile path'
+        map 'revoke-key' => :revoke_key
+        def revoke_key
+          keyfile = RosettAi::Mcp::Keyfile.new(File.expand_path(options[:keyfile]))
+          keyfile.load!
+
+          if keyfile.revoke_key(options[:name])
+            say(Rainbow("Key '#{options[:name]}' revoked.").green)
+          else
+            warn(Rainbow("Key '#{options[:name]}' not found.").red)
+            exit(1)
+          end
+        end
+
+        desc 'rotate-key', 'Rotate an MCP API key'
+        long_desc <<~LONGDESC
+          Revoke an existing key and generate a replacement.
+
+          The old key is disabled and a new key with the same name is
+          created. The new plaintext key is printed to stdout.
+
+          EXAMPLES
+
+            raictl mcp rotate-key --name claude-code
+        LONGDESC
+        method_option :name, type: :string, required: true, desc: 'Key name to rotate'
+        method_option :keyfile, type: :string, default: RosettAi::Mcp::Keyfile::DEFAULT_FILENAME, desc: 'Keyfile path'
+        map 'rotate-key' => :rotate_key
+        def rotate_key
+          keyfile = RosettAi::Mcp::Keyfile.new(File.expand_path(options[:keyfile]))
+          keyfile.load!
+
+          result = keyfile.rotate_key(options[:name])
+          if result
+            say(Rainbow("Key '#{options[:name]}' rotated. New key:").green)
+            say(result[:plaintext])
+            say(Rainbow('Store this key securely — it cannot be recovered.').yellow)
+          else
+            warn(Rainbow("Key '#{options[:name]}' not found.").red)
+            exit(1)
+          end
+        end
+
+        private
+
+        def t(key, **args)
+          ::I18n.t("rosett_ai.mcp.#{key}", **args)
+        end
+
+        def build_registry
+          RosettAi::Mcp::Admin::Registry.new
+        end
+
+        def build_trust_manager
+          RosettAi::Mcp::Settings::TrustManager.new
+        end
+
+        def build_installer
+          RosettAi::Mcp::Settings::ServerInstaller.new(
+            trust_manager: build_trust_manager,
+            registry: build_registry,
+            schema_validator: RosettAi::Mcp::Admin::SchemaValidator.new
+          )
+        end
+
+        def render_trust_sources(sources)
+          if options[:format] == 'json'
+            say(JSON.pretty_generate(sources))
+            return
+          end
+
+          table = ::Terminal::Table.new(
+            headings: ['Domain', 'Type', 'Description'],
+            rows: sources.map { |s| [s[:domain], s[:type], s[:description]] }
+          )
+          say(table)
+        end
+
+        def render_server_list(servers)
+          if options[:format] == 'json'
+            say(JSON.pretty_generate(servers))
+            return
+          end
+
+          table = ::Terminal::Table.new(
+            headings: ['Name', 'Transport', 'Command/URL'],
+            rows: servers.map { |s| [s[:name], s[:transport], s[:command] || s[:url]] }
+          )
+          say(table)
+        end
+
+        def render_validation_results(results)
+          if options[:format] == 'json'
+            say(JSON.pretty_generate(results))
+            return
+          end
+
+          results.each do |r|
+            status = r[:valid] ? Rainbow('valid').green : Rainbow('invalid').red
+            say("  #{r[:name]}: #{status}")
+            r[:errors]&.each { |e| say(Rainbow("    #{e}").red) }
+          end
+        end
+
+        def render_health_results(results)
+          if options[:format] == 'json'
+            say(JSON.pretty_generate(results))
+            return
+          end
+
+          table = ::Terminal::Table.new(
+            headings: ['Name', 'Transport', 'Status', 'Message'],
+            rows: results.map do |r|
+              status = r[:status] == :available ? Rainbow('available').green : Rainbow(r[:status].to_s).red
+              [r[:name], r[:transport], status, r[:message]]
+            end
+          )
+          say(table)
+        end
+
+        def render_audit_report(report)
+          if options[:format] == 'json'
+            say(JSON.pretty_generate(report))
+            return
+          end
+
+          say("Audit timestamp: #{report[:timestamp]}")
+          say("Servers: #{report[:summary][:total]}")
+          say("Healthy: #{report[:summary][:healthy]}")
+          say("Schema valid: #{report[:summary][:schema_valid]}")
+          say("Secure transport: #{report[:summary][:secure_transport]}")
+        end
+      end
+    end
+  end
+end

data/lib/rosett_ai/thor/tasks/migrate.rb

@@ -0,0 +1,121 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+require 'rainbow'
+
+module RosettAi
+  module Thor
+    module Tasks
+      # CLI task for `raictl migrate` — legacy namespace migration.
+      #
+      # Handles migration of:
+      # - ~/.config/nncc/ → ~/.config/rosett-ai/ (XDG global config)
+      # - .nncc/ → .rosett-ai/ (per-project marker directories)
+      #
+      # @author hugo
+      # @author claude
+      class Migrate < ::Thor
+        default_task :run_migrate
+
+        desc 'run_migrate', 'Migrate legacy .nncc and ~/.config/nncc paths'
+        long_desc <<~LONGDESC
+          Migrates legacy nncc namespace artifacts to rosett-ai:
+
+          - ~/.config/nncc/ → ~/.config/rosett-ai/ (global XDG config)
+          - .nncc/ → .rosett-ai/ (project marker in current directory)
+
+          With --workspace, scans the given path recursively for projects
+          containing .nncc/ directories and migrates them all.
+
+          EXAMPLES
+
+            raictl migrate
+            raictl migrate --workspace ~/git
+        LONGDESC
+        option :workspace, type: :string, desc: 'Scan and migrate all .nncc/ dirs under PATH'
+        option :dry_run, type: :boolean, default: false, desc: 'Show what would be migrated'
+        def run_migrate
+          migrate_xdg_config
+          migrate_projects
+        end
+
+        private
+
+        def migrate_xdg_config
+          migrator = RosettAi::Migration::NnccConfigMigrator.new
+          return report_no_config unless migrator.migration_needed?
+          return show_config_plan(migrator) if options[:dry_run]
+
+          result = migrator.migrate!
+          puts Rainbow("Migrated #{result.size} file(s) from ~/.config/nncc/").green
+          result.each { |file| puts "  #{file}" }
+        end
+
+        def report_no_config
+          puts Rainbow('~/.config/nncc/ not found — nothing to migrate').green
+        end
+
+        def migrate_projects
+          migrator = RosettAi::Migration::NnccProjectMigrator.new
+
+          if options[:workspace]
+            migrate_workspace(migrator)
+          else
+            migrate_current_project(migrator)
+          end
+        end
+
+        def migrate_workspace(migrator)
+          workspace = options[:workspace]
+          return show_workspace_plan(migrator, workspace) if options[:dry_run]
+
+          migrator.migrate_workspace(workspace)
+          show_project_results(migrator.results)
+        end
+
+        def show_workspace_plan(migrator, workspace)
+          projects = migrator.detect(workspace)
+          if projects.empty?
+            puts Rainbow("No .nncc/ directories found under #{workspace}").green
+          else
+            puts "Found #{projects.size} project(s) with .nncc/:"
+            projects.each { |project| puts "  #{project}" }
+          end
+        end
+
+        def migrate_current_project(migrator)
+          pwd = Dir.pwd
+          return show_current_plan(pwd) if options[:dry_run]
+
+          migrator.migrate_project(pwd)
+          show_project_results(migrator.results)
+        end
+
+        def show_current_plan(pwd)
+          nncc = Pathname.new(pwd).join('.nncc')
+          if nncc.directory?
+            puts "Would migrate: #{nncc} → #{pwd}/.rosett-ai/"
+          else
+            puts Rainbow('No .nncc/ in current directory').green
+          end
+        end
+
+        def show_config_plan(migrator)
+          plan = migrator.plan
+          puts "Would migrate #{plan.size} file(s) from ~/.config/nncc/:"
+          plan.each { |file| puts "  #{file[:path]} (#{file[:size]} bytes)" }
+        end
+
+        def show_project_results(results)
+          color_map = { migrated: :green, skipped: :yellow }
+          results.each do |entry|
+            color = color_map.fetch(entry[:status], :red)
+            puts Rainbow("  #{entry[:path]}: #{entry[:message]}").send(color)
+          end
+        end
+      end
+    end
+  end
+end