rosett-ai 1.3.3

data/lib/rosett_ai/completion/shells/zsh_generator.rb

@@ -0,0 +1,126 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Completion
+    module Shells
+      # Generates zsh completion scripts from the Thor command tree.
+      #
+      # Uses zsh compdef system with _raictl function and _arguments helper.
+      # Supports subcommand descriptions shown during tab completion.
+      #
+      # @author hugo
+      # @author claude
+      class ZshGenerator
+        # @param command_tree [Hash] command tree from Generator
+        def initialize(command_tree)
+          @command_tree = command_tree
+        end
+
+        # @return [String] zsh completion script
+        def generate
+          lines = []
+          lines << header
+          lines << main_function
+          lines << subcommand_functions
+          lines << registration
+          lines.join("\n")
+        end
+
+        private
+
+        def header
+          <<~ZSH
+            #compdef rosett-ai
+            # zsh completion for Rosett-AI — generated by rai completion zsh
+            # Do not edit manually; regenerate with: rai completion zsh
+          ZSH
+        end
+
+        def main_function
+          <<~ZSH
+            _raictl() {
+                local -a commands
+                commands=(
+            #{command_descriptions.chomp}
+                )
+
+                _arguments -C \\
+                    '1:command:->cmds' \\
+                    '*::arg:->args'
+
+                case "$state" in
+                    cmds)
+                        _describe -t commands 'rosett-ai command' commands
+                        ;;
+                    args)
+                        case "${words[1]}" in
+            #{subcommand_dispatch.chomp}
+                        esac
+                        ;;
+                esac
+            }
+          ZSH
+        end
+
+        def command_descriptions
+          @command_tree.map do |name, info|
+            desc = zsh_escape(info[:description].to_s)
+            "        '#{zsh_escape(name)}:#{desc}'"
+          end.sort.join("\n")
+        end
+
+        def subcommand_dispatch
+          lines = []
+          @command_tree.each do |name, info|
+            subs = info[:subcommands]
+            next unless subs
+
+            lines << "            #{zsh_escape(name)})"
+            lines << "                _rai_#{name.tr('-', '_')}"
+            lines << '                ;;'
+          end
+          lines.join("\n")
+        end
+
+        def subcommand_functions
+          functions = []
+          @command_tree.each do |name, info|
+            subs = info[:subcommands]
+            next unless subs
+
+            func_name = "_rai_#{name.tr('-', '_')}"
+            sub_descs = subs.map do |sub_name, sub_info|
+              desc = zsh_escape(sub_info[:description].to_s)
+              "        '#{zsh_escape(sub_name)}:#{desc}'"
+            end.sort.join("\n")
+
+            functions << <<~ZSH
+
+              #{func_name}() {
+                  local -a subcommands
+                  subcommands=(
+              #{sub_descs}
+                  )
+                  _describe -t subcommands '#{zsh_escape(name)} subcommand' subcommands
+              }
+            ZSH
+          end
+          functions.join
+        end
+
+        def registration
+          <<~ZSH
+            _raictl "$@"
+          ZSH
+        end
+
+        def zsh_escape(str)
+          str.gsub("'", "'\\''").gsub(/[\\`$"]/) { |c| "\\#{c}" }
+        end
+      end
+    end
+  end
+end

data/lib/rosett_ai/comply/checkers/cra_checker.rb

@@ -0,0 +1,102 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Comply
+    module Checkers
+      # CRA (Cyber Resilience Act) compliance checker.
+      #
+      # Verifies SBOM presence, vulnerability disclosure policy,
+      # dependency license awareness, and security contact information.
+      # All checks work offline without network access.
+      #
+      # @author hugo
+      # @author claude
+      class CraChecker
+        # @param project_root [Pathname] project root directory
+        def initialize(project_root:)
+          @project_root = project_root
+        end
+
+        # Runs all CRA compliance checks.
+        #
+        # @return [Array<Hash>] check results with :id, :description, :status, :message, :remediation
+        def check
+          [
+            check_sbom_present,
+            check_vulnerability_policy,
+            check_dependency_licenses_known,
+            check_security_contact
+          ]
+        end
+
+        private
+
+        def check_sbom_present
+          sbom_files = ['sbom.cdx.json', 'sbom.spdx.json'].select do |name|
+            @project_root.join(name).exist?
+          end
+
+          if sbom_files.any?
+            pass_result('CRA-001', 'SBOM must be present and current',
+                        "SBOM found: #{sbom_files.join(', ')}")
+          else
+            fail_result('CRA-001', 'SBOM must be present and current',
+                        'No SBOM file found in project root',
+                        'Generate an SBOM using cyclonedx-ruby or spdx-sbom-generator and place it in the project root')
+          end
+        end
+
+        def check_vulnerability_policy
+          security_md = @project_root.join('SECURITY.md')
+          if security_md.exist?
+            pass_result('CRA-002', 'Vulnerability disclosure policy must be documented',
+                        'SECURITY.md found')
+          else
+            fail_result('CRA-002', 'Vulnerability disclosure policy must be documented',
+                        'SECURITY.md not found',
+                        'Create SECURITY.md with vulnerability disclosure policy')
+          end
+        end
+
+        def check_dependency_licenses_known
+          lockfile = @project_root.join('Gemfile.lock')
+          unless lockfile.exist?
+            return warn_result('CRA-003', 'All dependencies must have known licenses',
+                               'No Gemfile.lock found — cannot audit dependencies',
+                               'Run bundle install to generate Gemfile.lock')
+          end
+
+          pass_result('CRA-003', 'All dependencies must have known licenses',
+                      'Gemfile.lock present — dependency tree available for audit')
+        end
+
+        def check_security_contact
+          security_md = @project_root.join('SECURITY.md')
+          if security_md.exist? && security_md.read.match?(/contact|report|email/i)
+            pass_result('CRA-004', 'Contact information for security reports must be provided',
+                        'Security contact information found in SECURITY.md')
+          else
+            fail_result('CRA-004', 'Contact information for security reports must be provided',
+                        'No security contact information found',
+                        'Add security contact to SECURITY.md or package metadata')
+          end
+        end
+
+        def pass_result(id, description, message)
+          { id: id, description: description, status: 'pass', message: message }
+        end
+
+        def warn_result(id, description, message, remediation)
+          { id: id, description: description, status: 'warn', message: message, remediation: remediation }
+        end
+
+        def fail_result(id, description, message, remediation)
+          { id: id, description: description, status: 'fail', message: message, remediation: remediation }
+        end
+      end
+    end
+  end
+end

data/lib/rosett_ai/comply/checkers/license_checker.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Comply
+    module Checkers
+      # License compliance checker.
+      #
+      # Verifies GPL-3.0-only compatibility of all dependencies,
+      # LICENSE file presence, and SPDX header coverage.
+      # Uses Gemfile.lock parsing for offline dependency audit.
+      #
+      # @author hugo
+      # @author claude
+      class LicenseChecker
+        GPL_COMPATIBLE = [
+          'MIT', 'BSD-2-Clause', 'BSD-3-Clause', 'Apache-2.0', 'ISC', 'Zlib', '0BSD', 'Unlicense', 'LGPL-2.0-only', 'LGPL-2.0-or-later', 'LGPL-2.1-only', 'LGPL-2.1-or-later', 'LGPL-3.0-only', 'LGPL-3.0-or-later', 'GPL-2.0-only', 'GPL-2.0-or-later', 'GPL-3.0-only', 'GPL-3.0-or-later', 'Ruby', 'PSF-2.0', 'Artistic-2.0', 'MPL-2.0'
+        ].freeze
+
+        GPL_INCOMPATIBLE = [
+          'AGPL-3.0-only', 'AGPL-3.0-or-later', 'SSPL-1.0', 'BUSL-1.1', 'Proprietary', 'CPAL-1.0', 'EUPL-1.1', 'EUPL-1.2'
+        ].freeze
+
+        # @param project_root [Pathname] project root directory
+        # @param allowlist [Array<String>] gem names exempt from license check
+        def initialize(project_root:, allowlist: [])
+          @project_root = project_root
+          @allowlist = allowlist
+        end
+
+        # Runs all license compliance checks.
+        #
+        # @return [Array<Hash>] check results
+        def check
+          [
+            check_gpl_compatible,
+            check_license_file_present
+          ]
+        end
+
+        private
+
+        def check_gpl_compatible
+          gemspec_files = Dir.glob(@project_root.join('*.gemspec').to_s)
+          if gemspec_files.empty?
+            return skip_result('LIC-001', 'All dependencies must have GPL-3.0-compatible licenses',
+                               'No gemspec found — skipping dependency license audit')
+          end
+
+          skip_result('LIC-001', 'All dependencies must have GPL-3.0-compatible licenses',
+                      'Deep dependency license audit not yet implemented — structural check only')
+        end
+
+        def check_license_file_present
+          license_file = ['LICENSE', 'LICENSE.md', 'LICENSE.txt', 'COPYING'].find do |name|
+            @project_root.join(name).exist?
+          end
+
+          if license_file
+            pass_result('LIC-002', 'Project LICENSE file must be present',
+                        "License file found: #{license_file}")
+          else
+            fail_result('LIC-002', 'Project LICENSE file must be present',
+                        'No LICENSE file found in project root',
+                        'Create LICENSE file with GPL-3.0-only text')
+          end
+        end
+
+        def pass_result(id, description, message)
+          { id: id, description: description, status: 'pass', message: message }
+        end
+
+        def skip_result(id, description, message)
+          { id: id, description: description, status: 'skip', message: message }
+        end
+
+        def fail_result(id, description, message, remediation)
+          { id: id, description: description, status: 'fail', message: message, remediation: remediation }
+        end
+      end
+    end
+  end
+end

data/lib/rosett_ai/comply/checkers/spdx_header_checker.rb

@@ -0,0 +1,98 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Comply
+    module Checkers
+      # SPDX license header compliance checker.
+      #
+      # Verifies that all source files contain proper SPDX-License-Identifier
+      # headers. Supports Ruby, YAML, JSON, Bash, and Markdown files.
+      #
+      # @author hugo
+      # @author claude
+      class SpdxHeaderChecker
+        SPDX_PATTERN = /SPDX-License-Identifier:/
+        HEADER_SCAN_LINES = 10
+
+        SOURCE_GLOBS = [
+          '**/*.rb',
+          '**/*.yml',
+          '**/*.yaml',
+          '**/*.sh'
+        ].freeze
+
+        SKIP_DIRS = [
+          'vendor',
+          'node_modules',
+          'tmp',
+          'coverage',
+          'pkg',
+          '.git'
+        ].freeze
+
+        # @param project_root [Pathname] project root directory
+        # @param expected_spdx [String] expected SPDX identifier
+        def initialize(project_root:, expected_spdx: 'GPL-3.0-only')
+          @project_root = project_root
+          @expected_spdx = expected_spdx
+        end
+
+        # Runs SPDX header compliance check.
+        #
+        # @return [Array<Hash>] check results
+        def check
+          files = discover_source_files
+          return [pass_result_no_files] if files.empty?
+
+          missing = files.reject { |path| spdx_header?(path) }
+
+          if missing.empty?
+            [pass_result(files.size)]
+          else
+            [warn_result(missing, files.size)]
+          end
+        end
+
+        private
+
+        def discover_source_files
+          all_files = SOURCE_GLOBS.flat_map { |glob| Dir.glob(@project_root.join(glob).to_s) }
+          all_files.reject { |path| skip_path?(path) }
+        end
+
+        def skip_path?(path)
+          relative = path.delete_prefix("#{@project_root}/")
+          SKIP_DIRS.any? { |dir| relative.start_with?("#{dir}/") }
+        end
+
+        def spdx_header?(path)
+          File.foreach(path).first(HEADER_SCAN_LINES).any? { |line| SPDX_PATTERN.match?(line) }
+        rescue Errno::ENOENT, Errno::EACCES
+          false
+        end
+
+        def pass_result_no_files
+          { id: 'SPDX-001', description: 'All source files must have SPDX headers',
+            status: 'pass', message: 'No source files found to check' }
+        end
+
+        def pass_result(total)
+          { id: 'SPDX-001', description: 'All source files must have SPDX headers',
+            status: 'pass', message: "All #{total} source files have SPDX headers" }
+        end
+
+        def warn_result(missing, total)
+          sample = missing.first(5).map { |path| path.delete_prefix("#{@project_root}/") }
+          more = missing.size > 5 ? " (and #{missing.size - 5} more)" : ''
+          { id: 'SPDX-001', description: 'All source files must have SPDX headers',
+            status: 'warn',
+            message: "#{missing.size}/#{total} files missing SPDX header: #{sample.join(', ')}#{more}",
+            remediation: 'Add SPDX-License-Identifier header to source files' }
+        end
+      end
+    end
+  end
+end

data/lib/rosett_ai/comply/reporter.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+require 'json'
+require 'rainbow'
+require 'terminal-table'
+
+module RosettAi
+  module Comply
+    # Formats compliance check results for display.
+    #
+    # TTY-aware: coloured table when interactive, plain text when piped.
+    # Supports JSON output mode for CI integration.
+    #
+    # @author hugo
+    # @author claude
+    class Reporter
+      # @param results [Array<Hash>] check results from Runner
+      # @param format [String] output format ('table' or 'json')
+      # @param output [IO] output stream (default: $stdout)
+      def initialize(results:, format: 'table', output: $stdout)
+        @results = results
+        @format = format
+        @output = output
+      end
+
+      # Renders the compliance report.
+      #
+      # @return [void]
+      def report
+        case @format
+        when 'json' then report_json
+        else report_table
+        end
+      end
+
+      # Computes exit code from results.
+      #
+      # @return [Integer] 0 = all pass, 1 = warnings only, 2 = any failure
+      def exit_code
+        return 2 if @results.any? { |r| r[:status] == 'fail' }
+        return 1 if @results.any? { |r| r[:status] == 'warn' }
+
+        0
+      end
+
+      private
+
+      def report_table
+        table = ::Terminal::Table.new(
+          headings: ['ID', 'Status', 'Description', 'Details'],
+          rows: @results.map { |r| build_row(r) },
+          style: { border: :unicode_round }
+        )
+        @output.puts table
+        @output.puts ''
+        report_summary
+      end
+
+      def build_row(result)
+        status_text = format_status(result[:status])
+        detail = result[:message]
+        detail = "#{detail}\n  Fix: #{result[:remediation]}" if result[:remediation]
+        [result[:id], status_text, result[:description], detail]
+      end
+
+      def format_status(status)
+        case status
+        when 'pass' then Rainbow('PASS').green
+        when 'warn' then Rainbow('WARN').yellow
+        when 'fail' then Rainbow('FAIL').red
+        else status.upcase
+        end
+      end
+
+      def report_summary
+        counts = @results.group_by { |r| r[:status] }.transform_values(&:size)
+        total = @results.size
+        pass_count = counts.fetch('pass', 0)
+        warn_count = counts.fetch('warn', 0)
+        fail_count = counts.fetch('fail', 0)
+
+        summary = "#{total} checks: #{pass_count} passed, #{warn_count} warnings, #{fail_count} failures"
+
+        if fail_count.positive?
+          @output.puts Rainbow(summary).red
+        elsif warn_count.positive?
+          @output.puts Rainbow(summary).yellow
+        else
+          @output.puts Rainbow(summary).green
+        end
+      end
+
+      def report_json
+        output = {
+          compliance: {
+            checks: @results,
+            summary: {
+              total: @results.size,
+              pass: @results.count { |r| r[:status] == 'pass' },
+              warn: @results.count { |r| r[:status] == 'warn' },
+              fail: @results.count { |r| r[:status] == 'fail' }
+            },
+            exit_code: exit_code
+          }
+        }
+        @output.puts JSON.pretty_generate(output)
+      end
+    end
+  end
+end

data/lib/rosett_ai/comply/runner.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Comply
+    # Orchestrates compliance checks across all registered checkers.
+    #
+    # Supports selective execution via check type filters (--cra, --license,
+    # --headers) and aggregates results for the Reporter.
+    #
+    # @author hugo
+    # @author claude
+    class Runner
+      CHECKER_MAP = {
+        cra: Checkers::CraChecker,
+        license: Checkers::LicenseChecker,
+        headers: Checkers::SpdxHeaderChecker
+      }.freeze
+
+      # @param project_root [Pathname] project root directory
+      # @param checks [Array<Symbol>, nil] specific check types to run (nil = all)
+      def initialize(project_root:, checks: nil)
+        @project_root = project_root
+        @checks = checks
+      end
+
+      # Runs all applicable compliance checks.
+      #
+      # @return [Array<Hash>] aggregated check results
+      def run
+        active_checkers.flat_map do |checker_class|
+          checker = checker_class.new(project_root: @project_root)
+          checker.check
+        end
+      end
+
+      private
+
+      def active_checkers
+        if @checks.nil? || @checks.empty?
+          CHECKER_MAP.values
+        else
+          @checks.filter_map { |check| CHECKER_MAP[check] }
+        end
+      end
+    end
+  end
+end

data/lib/rosett_ai/composition/circular_dependency_detector.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Composition
+    # Detects circular dependencies in behaviour depends_on graphs.
+    # Uses depth-first search to find cycles and reports the full
+    # cycle path for debugging.
+    class CircularDependencyDetector
+      # Checks a dependency graph for cycles.
+      #
+      # @param graph [Hash{String => Array<String>}] adjacency list
+      #   mapping behaviour names to their dependencies
+      # @return [Array<String>, nil] cycle path if found, nil otherwise
+      def detect(graph)
+        visited = {}
+        stack = {}
+
+        graph.each_key do |node|
+          next if visited[node]
+
+          cycle = dfs(node, graph, visited, stack, [])
+          return cycle if cycle
+        end
+
+        nil
+      end
+
+      private
+
+      def dfs(node, graph, visited, stack, path)
+        visited[node] = true
+        stack[node] = true
+        path.push(node)
+
+        (graph[node] || []).each do |neighbor|
+          if stack[neighbor]
+            cycle_start = path.index(neighbor)
+            return path[cycle_start..] + [neighbor]
+          end
+
+          next if visited[neighbor]
+
+          result = dfs(neighbor, graph, visited, stack, path)
+          return result if result
+        end
+
+        path.pop
+        stack.delete(node)
+        nil
+      end
+    end
+  end
+end