rosett-ai 1.3.3

data/packaging/scripts/postrm

@@ -0,0 +1,19 @@
+#!/bin/bash
+# Rosett-AI - Post-removal script
+set -e
+
+INSTALL_DIR="/opt/rosett-ai"
+CONFIG_DIR="/etc/rosett-ai"
+
+case "$1" in
+    purge)
+        # Remove configuration and installation directories entirely
+        [ -d "${CONFIG_DIR}" ] && rm -rf "${CONFIG_DIR}"
+        [ -d "${INSTALL_DIR}" ] && rm -rf "${INSTALL_DIR}"
+        ;;
+    remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
+        # Keep configuration files on plain remove/upgrade
+        ;;
+esac
+
+exit 0

data/packaging/scripts/prerm

@@ -0,0 +1,10 @@
+#!/bin/bash
+# Rosett-AI - Pre-removal script
+set -e
+
+# Remove PATH symlinks
+for link in /usr/local/bin/raictl /usr/local/bin/rai /usr/local/bin/rosett-ai; do
+    [ -L "$link" ] && rm -f "$link"
+done
+
+exit 0

data/packaging/wrapper.sh.template

@@ -0,0 +1,38 @@
+#!/bin/bash
+# Rosett-AI - Runtime wrapper
+# Invoked as /opt/rosett-ai/bin/raictl, symlinked from /usr/local/bin/raictl
+#
+# @@RUBY_ABI@@ and @@RUBY_ARCH@@ are substituted at build time by
+# install_wrapper! in lib/rosett_ai/thor/tasks/build.rb
+set -e
+
+INSTALL_DIR="/opt/rosett-ai"
+EMBEDDED_DIR="${INSTALL_DIR}/embedded"
+EMBEDDED_BIN="${EMBEDDED_DIR}/bin"
+EMBEDDED_LIB="${EMBEDDED_DIR}/lib"
+APP_DIR="${INSTALL_DIR}/app"
+
+# Ensure the embedded Ruby can find libruby.so
+export LD_LIBRARY_PATH="${EMBEDDED_LIB}${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
+
+# Ensure the embedded Ruby can find its standard library
+export RUBYLIB="${EMBEDDED_LIB}/ruby/@@RUBY_ABI@@:${EMBEDDED_LIB}/ruby/@@RUBY_ABI@@/@@RUBY_ARCH@@${RUBYLIB:+:$RUBYLIB}"
+
+export PATH="${EMBEDDED_BIN}:${PATH}"
+export GEM_HOME="${EMBEDDED_LIB}/ruby/gems/@@RUBY_ABI@@"
+export GEM_PATH="${GEM_HOME}"
+export BUNDLE_GEMFILE="${APP_DIR}/Gemfile"
+export BUNDLE_PATH="${APP_DIR}/vendor/bundle"
+export BUNDLE_DEPLOYMENT="true"
+
+# Ensure UTF-8 locale (raictl requires it)
+: "${LANG:=en_US.UTF-8}"
+: "${LC_ALL:=$LANG}"
+export LANG LC_ALL
+
+# Preserve the user's working directory before cd-ing into the app tree.
+# ProjectContext reads RAI_ORIGINAL_PWD to resolve the correct project.
+export RAI_ORIGINAL_PWD="${PWD}"
+
+cd "${APP_DIR}"
+exec "${EMBEDDED_BIN}/ruby" -I"${APP_DIR}/lib" "${APP_DIR}/bin/raictl" "$@"

data/rosett-ai.gemspec

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+require_relative 'lib/rosett_ai/version'
+
+Gem::Specification.new do |spec|
+  spec.name = 'rosett-ai'
+  spec.version = RosettAi::VERSION
+  spec.authors = ['Hugo Antonio Sepulveda Manriquez']
+  spec.email = ['query@neatnerds.be']
+
+  spec.summary = 'Rosett-AI — author AI assistant rules once, compile to many'
+  spec.description = 'Configuration management tool for AI-assisted development workflows. ' \
+                     'Author rules once, compile to Claude Code, Cursor, AGENTS.md, and more.'
+  spec.homepage = 'https://gitlab.neatnerds.be/foss/rosett-ai/rosett-ai'
+  spec.license = 'GPL-3.0-only'
+  spec.required_ruby_version = '>= 3.3.0'
+
+  spec.metadata['homepage_uri'] = spec.homepage
+  spec.metadata['source_code_uri'] = spec.homepage
+
+  spec.files = Dir.chdir(__dir__) do
+    files = if File.directory?('.git')
+              `git ls-files -z`.split("\x0")
+            else
+              Dir.glob('**/*', File::FNM_DOTMATCH).select { |f| File.file?(f) }
+            end
+    files.reject do |f|
+      (File.expand_path(f) == __FILE__) ||
+        f.start_with?('bin/', 'test/', 'spec/', 'features/', '.git', '.gitlab-ci', 'appveyor', 'Gemfile') ||
+        (f.start_with?('conf/behaviour/') && f != 'conf/behaviour/.gitkeep') ||
+        f.start_with?('doc/claude-sessions/', 'doc/context/memory/') ||
+        f.start_with?('.claude/', '.overcommit.yml', 'Dockerfile', 'TODO.md', 'SESSION_NOTES.md') ||
+        f.end_with?('.jsonl', '.mv2')
+    end
+  end
+  spec.bindir = 'bin'
+  spec.executables = ['rai']
+  spec.require_paths = ['lib']
+
+  # Runtime dependencies
+  spec.add_dependency 'ed25519', '~> 1.4'
+  spec.add_dependency 'faraday', '~> 2.14'
+  spec.add_dependency 'gettext', '~> 3.5'
+  spec.add_dependency 'i18n', '~> 1.14'
+  spec.add_dependency 'json', '~> 2.19'
+  spec.add_dependency 'json_schemer', '~> 2.5'
+  spec.add_dependency 'jwt', '~> 2.10'
+  spec.add_dependency 'jwt-eddsa', '~> 0.9'
+  spec.add_dependency 'paint', '~> 2.3'
+  spec.add_dependency 'rainbow', '~> 3.1'
+  spec.add_dependency 'rubyzip', '~> 2.4'
+  spec.add_dependency 'terminal-table', '~> 4.0'
+  spec.add_dependency 'thor', '~> 1.5'
+  spec.add_dependency 'tty-prompt', '~> 0.23'
+  spec.add_dependency 'tty-spinner', '~> 0.9'
+  spec.add_dependency 'zeitwerk', '~> 2.7'
+
+  # Optional MCP server support (loaded on demand via require 'mcp')
+  spec.add_dependency 'mcp', '~> 0.9.2'
+end

data/scripts/publish/pulp_upload.sh

@@ -0,0 +1,123 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+#
+# Upload .deb packages to Pulp 3 repository.
+#
+# Required environment variables:
+#   PULP_API_URL       — Pulp 3 API base URL
+#   PULP_API_TOKEN     — Bearer authentication token
+#   PULP_CHANNEL       — Channel name (stable, unstable)
+#   PULP_DISTRIBUTION  — Debian distribution (bookworm)
+#
+# Expected directory layout:
+#   release/*.deb      — for stable (tag) builds
+#   pkg/*.deb          — for unstable (main) builds
+#
+set -euo pipefail
+
+# --- Validation ---
+
+: "${PULP_API_URL:?PULP_API_URL is required}"
+: "${PULP_API_TOKEN:?PULP_API_TOKEN is required}" # gitleaks:allow
+: "${PULP_CHANNEL:?PULP_CHANNEL is required (stable or unstable)}"
+: "${PULP_DISTRIBUTION:=${PULP_DISTRIBUTION:-bookworm}}"
+
+readonly API="${PULP_API_URL}/pulp/api/v3"
+readonly AUTH_HEADER="Authorization: Bearer ${PULP_API_TOKEN}"
+
+# --- Locate packages ---
+
+if [ "${PULP_CHANNEL}" = "stable" ] && [ -d release ]; then
+  DEB_DIR="release"
+elif [ -d pkg ]; then
+  DEB_DIR="pkg"
+else
+  echo "ERROR: No package directory found (release/ or pkg/)" >&2
+  exit 1
+fi
+
+DEB_FILES=("${DEB_DIR}"/*.deb)
+if [ ${#DEB_FILES[@]} -eq 0 ]; then
+  echo "ERROR: No .deb files found in ${DEB_DIR}/" >&2
+  exit 1
+fi
+
+echo "Found ${#DEB_FILES[@]} package(s) in ${DEB_DIR}/"
+
+# --- GPG sign packages ---
+
+for deb in "${DEB_FILES[@]}"; do
+  echo "Signing ${deb}..."
+  dpkg-sig --sign builder "${deb}"
+  dpkg-sig --verify "${deb}"
+done
+
+# --- Upload to Pulp ---
+
+REPO_NAME="nncc-${PULP_CHANNEL}"
+
+# Look up the repository href
+REPO_HREF=$(curl -s -H "${AUTH_HEADER}" \
+  "${API}/repositories/deb/apt/?name=${REPO_NAME}" \
+  | jq -r '.results[0].pulp_href // empty')
+
+if [ -z "${REPO_HREF}" ]; then
+  echo "ERROR: Repository '${REPO_NAME}' not found in Pulp" >&2
+  echo "Create it first: pulp deb repository create --name ${REPO_NAME}" >&2
+  exit 1
+fi
+
+echo "Repository: ${REPO_NAME} (${REPO_HREF})"
+
+for deb in "${DEB_FILES[@]}"; do
+  echo "Uploading $(basename "${deb}")..."
+
+  # Create artifact
+  ARTIFACT_HREF=$(curl -s -H "${AUTH_HEADER}" \
+    -F "file=@${deb}" \
+    "${API}/artifacts/" \
+    | jq -r '.pulp_href')
+
+  if [ -z "${ARTIFACT_HREF}" ] || [ "${ARTIFACT_HREF}" = "null" ]; then
+    echo "ERROR: Failed to upload artifact for ${deb}" >&2
+    exit 1
+  fi
+
+  # Create content unit from artifact
+  TASK_HREF=$(curl -s -H "${AUTH_HEADER}" \
+    -H "Content-Type: application/json" \
+    -d "{\"artifact\": \"${ARTIFACT_HREF}\", \"relative_path\": \"$(basename "${deb}")\"}" \
+    "${API}/content/deb/packages/" \
+    | jq -r '.task // empty')
+
+  if [ -n "${TASK_HREF}" ]; then
+    echo "  Waiting for content creation task..."
+    # Poll task until complete (max 60s)
+    for i in $(seq 1 12); do
+      STATE=$(curl -s -H "${AUTH_HEADER}" "${API}${TASK_HREF}" | jq -r '.state')
+      if [ "${STATE}" = "completed" ]; then
+        break
+      elif [ "${STATE}" = "failed" ]; then
+        echo "ERROR: Content creation failed" >&2
+        curl -s -H "${AUTH_HEADER}" "${API}${TASK_HREF}" | jq '.error'
+        exit 1
+      fi
+      sleep 5
+    done
+  fi
+
+  echo "  Uploaded: $(basename "${deb}")"
+done
+
+# --- Publish ---
+
+echo "Publishing repository..."
+PUBLICATION_HREF=$(curl -s -H "${AUTH_HEADER}" \
+  -H "Content-Type: application/json" \
+  -d "{\"repository\": \"${REPO_HREF}\"}" \
+  "${API}/publications/deb/apt/" \
+  | jq -r '.task // .pulp_href // empty')
+
+echo "Publication triggered: ${PUBLICATION_HREF}"
+echo "Done. Packages available at: https://repo.neatnerds.be/${PULP_CHANNEL}"

data/settings.json

@@ -0,0 +1,29 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(rbenv versions:*)",
+      "Bash(rbenv install:*)",
+      "Bash(bundle:*)",
+      "Bash(gem:*)",
+      "Bash(bin/raictl:*)",
+      "Bash(yamllint:*)",
+      "WebSearch",
+      "WebFetch(domain:rubygems.org)",
+      "Bash(overcommit --run:*)"
+    ],
+    "deny": [
+      "Read(~/.ssh/**)",
+      "Read(~/.gnupg/**)",
+      "Read(~/.credentials.json)",
+      "Read(~/.claude/.credentials.json)",
+      "Read(~/**/.env)",
+      "Read(~/**/.env.*)",
+      "Read(~/**/secrets/**)",
+      "Read(~/.keepass.*/**)",
+      "Read(~/**/credentials.json)",
+      "Read(~/**/*.pem)",
+      "Read(~/**/*.key)"
+    ],
+    "additionalDirectories": []
+  }
+}

data/share/applications/be.neatnerds.rosettai.desktop

@@ -0,0 +1,29 @@
+[Desktop Entry]
+Type=Application
+Name=NeatNerds Code Companion
+GenericName=AI Configuration Tool
+Comment=Manage AI-assisted development configuration
+Exec=nncc desktop gtk4
+Icon=be.neatnerds.rosettai
+Terminal=false
+Categories=Development;Utility;
+Keywords=AI;Claude;Configuration;Development;
+StartupNotify=true
+DBusActivatable=true
+
+# GNOME-specific
+X-GNOME-UsesNotifications=true
+
+# Translation hints
+X-Ubuntu-Gettext-Domain=nncc
+
+# Actions
+Actions=compile;status;
+
+[Desktop Action compile]
+Name=Compile Rules
+Exec=nncc compile
+
+[Desktop Action status]
+Name=Show Status
+Exec=nncc dbus status

data/share/dbus-1/interfaces/be.neatnerds.rosettai.xml

@@ -0,0 +1,103 @@
+<!DOCTYPE node PUBLIC "-//freedesktop//DTD D-BUS Object Introspection 1.0//EN"
+  "http://www.freedesktop.org/standards/dbus/1.0/introspect.dtd">
+<node name="/be/neatnerds/nncc">
+  <interface name="be.neatnerds.rosettai.Manager">
+    <method name="Compile">
+      <arg name="engine" type="s" direction="in">
+        <doc:doc><doc:summary>Engine name (claude, generic, agents_md)</doc:summary></doc:doc>
+      </arg>
+      <arg name="result" type="s" direction="out">
+        <doc:doc><doc:summary>Compilation result message</doc:summary></doc:doc>
+      </arg>
+    </method>
+
+    <method name="SwitchContext">
+      <arg name="context_name" type="s" direction="in">
+        <doc:doc><doc:summary>Context name to switch to</doc:summary></doc:doc>
+      </arg>
+    </method>
+
+    <method name="GetStatus">
+      <arg name="status" type="a{sv}" direction="out">
+        <doc:doc><doc:summary>Status dictionary with version, running, current_context, pid, dbus_name</doc:summary></doc:doc>
+      </arg>
+    </method>
+
+    <method name="Shutdown">
+      <doc:doc><doc:summary>Initiate graceful service shutdown</doc:summary></doc:doc>
+    </method>
+
+    <method name="SetConfig">
+      <arg name="key" type="s" direction="in">
+        <doc:doc><doc:summary>Configuration key (e.g. default_engine)</doc:summary></doc:doc>
+      </arg>
+      <arg name="value" type="s" direction="in">
+        <doc:doc><doc:summary>New value for the configuration key</doc:summary></doc:doc>
+      </arg>
+      <arg name="result" type="s" direction="out">
+        <doc:doc><doc:summary>Result message (OK or Error)</doc:summary></doc:doc>
+      </arg>
+    </method>
+
+    <method name="ListEngines">
+      <arg name="engines" type="a(ss)" direction="out">
+        <doc:doc><doc:summary>Array of (name, display_name) tuples for available engines</doc:summary></doc:doc>
+      </arg>
+    </method>
+
+    <property name="Version" type="s" access="read">
+      <doc:doc><doc:summary>Service version string</doc:summary></doc:doc>
+    </property>
+
+    <signal name="ContextChanged">
+      <arg name="context_name" type="s">
+        <doc:doc><doc:summary>New context name after switch</doc:summary></doc:doc>
+      </arg>
+    </signal>
+  </interface>
+
+  <interface name="be.neatnerds.rosettai.FocusMonitor">
+    <method name="GetCurrentFocus">
+      <arg name="app_id" type="s" direction="out">
+        <doc:doc><doc:summary>Current focused application identifier</doc:summary></doc:doc>
+      </arg>
+      <arg name="title" type="s" direction="out">
+        <doc:doc><doc:summary>Current focused window title</doc:summary></doc:doc>
+      </arg>
+    </method>
+
+    <signal name="FocusChanged">
+      <arg name="app_id" type="s">
+        <doc:doc><doc:summary>Application identifier of newly focused window</doc:summary></doc:doc>
+      </arg>
+      <arg name="title" type="s">
+        <doc:doc><doc:summary>Title of newly focused window</doc:summary></doc:doc>
+      </arg>
+    </signal>
+  </interface>
+
+  <interface name="org.kde.StatusNotifierItem">
+    <method name="Activate">
+      <arg name="x" type="i" direction="in"/>
+      <arg name="y" type="i" direction="in"/>
+    </method>
+
+    <method name="ContextMenu">
+      <arg name="x" type="i" direction="in"/>
+      <arg name="y" type="i" direction="in"/>
+    </method>
+
+    <property name="Id" type="s" access="read"/>
+    <property name="Category" type="s" access="read"/>
+    <property name="Status" type="s" access="read"/>
+    <property name="Title" type="s" access="read"/>
+    <property name="IconName" type="s" access="read"/>
+    <property name="ToolTip" type="(sa(iiay)ss)" access="read"/>
+
+    <signal name="NewStatus">
+      <arg name="status" type="s"/>
+    </signal>
+
+    <signal name="NewTitle"/>
+  </interface>
+</node>

data/share/dbus-1/services/be.neatnerds.rosettai.service

@@ -0,0 +1,3 @@
+[D-BUS Service]
+Name=be.neatnerds.rosettai
+Exec=/usr/bin/nncc dbus start

data/share/templates/behaviour/criticalthinking.yml

@@ -0,0 +1,69 @@
+---
+name: criticalthinking
+description: >-
+  AI critical thinking rules — challenge assumptions, verify claims,
+  enforce methodology discipline, and search for contradictory evidence.
+  This is a starter template. Customise it for your workflow.
+version: 1.1.0
+author: rosett-ai
+created_at: '2026-01-25'
+modified_at: '2026-04-14'
+modified_by: rosett-ai
+sensitive: false
+used_in: []
+rules:
+  - id: rule_001
+    description: |
+      Use critical thinking at all times. Avoid pleasing the user —
+      instead, challenge ideas and assumptions with factual reasoning.
+    priority: 50
+    enabled: true
+  - id: rule_002
+    description: |
+      When challenging the user, always back up claims with factual
+      references: links to documentation, source material, articles,
+      mathematical proofs, or other verifiable information.
+    priority: 50
+    enabled: true
+  - id: rule_003
+    description: |
+      When a plan or brief specifies a methodology (TDD, design-first,
+      documentation-first), do not silently deviate from that methodology
+      for speed or convenience. If tempted to skip a mandated step
+      (e.g., writing implementation before tests when TDD is specified),
+      stop and flag the deviation to the user before proceeding.
+      Silently optimising for throughput at the expense of stated
+      methodology is a critical thinking failure, not an efficiency gain.
+    priority: 70
+    enabled: true
+  - id: rule_004
+    description: |
+      When asked to continue beyond the planned scope of a session or
+      sprint (e.g., "do the next phase too", "keep going"), evaluate
+      whether this removes quality gates that the plan designed in
+      (inter-session reviews, human checkpoints, course corrections).
+      If it does, flag it explicitly before proceeding. Do not silently
+      comply with scope expansion that eliminates oversight mechanisms.
+    priority: 65
+    enabled: true
+  - id: rule_005
+    description: |
+      When claiming compatibility with, or making assertions about, an
+      external tool, API, file format, or protocol, verify the claim
+      against the actual artifact — not infer it from documentation,
+      naming conventions, or prior assumptions. Read the real config
+      file. Call the real API. Parse the real output. An unverified
+      compatibility claim is worse than no claim because it creates
+      false confidence.
+    priority: 60
+    enabled: true
+  - id: rule_006
+    description: |
+      When presenting completion status ("done", "all targets met",
+      "complete"), actively search for evidence that contradicts the
+      claim before presenting it. Check: are there untested code paths?
+      Do the numbers actually add up? Was it verified on a real system
+      or only in mocked tests? The review process, not the user, should
+      catch these gaps.
+    priority: 65
+    enabled: true