rosett-ai 1.3.3

data/lib/rosett_ai/config/masking_secret_resolver.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Config
+    # Drop-in replacement for SecretResolver that masks all secret values
+    # instead of resolving them. Used by `config show` to display compiled
+    # JSON without exposing sensitive data.
+    #
+    # Follows the same interface as SecretResolver (resolve, resolve_all)
+    # and uses the same deterministic string parsing — no regex.
+    class MaskingSecretResolver
+      MASKED_VALUE = '***'
+
+      def resolve(value)
+        return value unless value.is_a?(String)
+        return value unless secret_reference?(value)
+
+        MASKED_VALUE
+      end
+
+      def resolve_all(obj)
+        case obj
+        when Hash  then obj.transform_values { |v| resolve_all(v) }
+        when Array then obj.map { |v| resolve_all(v) }
+        when String then resolve(obj)
+        else obj
+        end
+      end
+
+      private
+
+      def secret_reference?(value)
+        value.start_with?(SecretResolver::SECRET_PREFIX) && value.end_with?(SecretResolver::SECRET_SUFFIX)
+      end
+    end
+  end
+end

data/lib/rosett_ai/config/scope_router.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  # Configuration subsystem.
+  module Config
+    # Deprecated — use RosettAiEngine::Claude::ScopeRouter. Will be removed in v1.1.0.
+    # Only defined when rosett-ai-engine-claude gem is installed.
+    ScopeRouter = RosettAiEngine::Claude::ScopeRouter if defined?(RosettAiEngine::Claude::ScopeRouter)
+  end
+end

data/lib/rosett_ai/config/secret_resolver.rb

@@ -0,0 +1,125 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Config
+    # Resolves ${secret:backend:key} references in configuration values.
+    #
+    # Security constraints:
+    # - NO regex anywhere — deterministic string parsing only (ReDoS prevention)
+    # - Single-pass resolution — resolved values are never re-scanned
+    # - Fail loudly — raises on missing secrets, never returns nil
+    # - File backend: 0600 permissions, owned by Process.uid, 64 KiB cap
+    # - Path backend: rejects ".." traversal
+    class SecretResolver
+      SECRET_PREFIX = '${secret:'
+      SECRET_SUFFIX = '}'
+      VALID_BACKENDS = ['env', 'file', 'path'].freeze
+      MAX_FILE_SIZE = 65_536 # 64 KiB
+
+      class SecretError < RosettAi::Error; end
+
+      # Resolve a single secret reference string.
+      #
+      # Returns the original value unchanged if it is not a secret reference.
+      #
+      # @param value [Object] a string potentially containing a secret reference, or any other object
+      # @return [Object] the resolved secret value, or the original value if not a reference
+      # @raise [SecretError] if the secret backend is unknown or the secret cannot be resolved
+      def resolve(value)
+        return value unless value.is_a?(String)
+        return value unless secret_reference?(value)
+
+        inner = value[SECRET_PREFIX.length..-2]
+        backend, key = inner.split(':', 2)
+
+        validate_reference!(backend, key)
+
+        case backend
+        when 'env'  then resolve_env(key)
+        when 'file' then resolve_file(key)
+        when 'path' then resolve_path(key)
+        end
+      end
+
+      # Walk a nested structure and resolve all secret references.
+      #
+      # Single-pass: resolved values are never re-scanned.
+      #
+      # @param obj [Hash, Array, String, Object] nested structure to resolve
+      # @return [Object] structure with all secret references resolved
+      def resolve_all(obj)
+        case obj
+        when Hash  then obj.transform_values { |v| resolve_all(v) }
+        when Array then obj.map { |v| resolve_all(v) }
+        when String then resolve(obj)
+        else obj
+        end
+      end
+
+      private
+
+      def secret_reference?(value)
+        value.start_with?(SECRET_PREFIX) && value.end_with?(SECRET_SUFFIX)
+      end
+
+      def validate_reference!(backend, key)
+        raise SecretError, 'empty secret reference' if backend.nil? || backend.empty? || key.nil? || key.empty?
+
+        return if VALID_BACKENDS.include?(backend)
+
+        raise SecretError, "unknown secret backend: #{backend}. Valid: #{VALID_BACKENDS.join(', ')}"
+      end
+
+      def resolve_env(key)
+        ENV.fetch(key) do
+          raise SecretError, "environment variable #{key} is not set"
+        end
+      end
+
+      def resolve_file(path)
+        reject_traversal!(path)
+
+        expanded = File.expand_path(path)
+        raise SecretError, "secret file not found: #{expanded}" unless File.exist?(expanded)
+
+        stat = File.lstat(expanded)
+        validate_file_permissions!(expanded, stat)
+
+        content = File.read(expanded, MAX_FILE_SIZE + 1)
+        raise SecretError, "secret file #{expanded} exceeds 64 KiB" if content.bytesize > MAX_FILE_SIZE
+
+        content.chomp
+      end
+
+      def resolve_path(path)
+        reject_traversal!(path)
+
+        expanded = File.expand_path(path)
+        raise SecretError, "path not found: #{expanded}" unless File.exist?(expanded)
+
+        expanded
+      end
+
+      def reject_traversal!(path)
+        return unless path.include?('..')
+
+        raise SecretError, "path traversal rejected in secret reference: #{path}"
+      end
+
+      def validate_file_permissions!(expanded, stat)
+        unless (stat.mode & 0o777) == 0o600
+          raise SecretError,
+                "secret file #{expanded} permissions #{format('%04o', stat.mode & 0o777)} are not 0600"
+        end
+
+        return if stat.uid == Process.uid
+
+        raise SecretError,
+              "secret file #{expanded} owned by uid #{stat.uid}, expected #{Process.uid}"
+      end
+    end
+  end
+end

data/lib/rosett_ai/configuration.rb

@@ -0,0 +1,119 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+require 'json'
+require 'pathname'
+
+module RosettAi
+  # Manages hierarchical configuration for Rosett-AI
+  # Supports global -> group -> project configuration inheritance
+  class Configuration
+    SETTINGS_FILE = 'settings.json'
+    LOCAL_SETTINGS_FILE = 'settings.local.json'
+    BEHAVIOUR_DIR = 'conf/behaviour'
+    SCHEMA_DIR = 'conf/schemas'
+
+    attr_reader :root_path
+
+    # Initializes a new Configuration instance.
+    #
+    # @param root_path [String, Pathname, nil] path to the Rosett-AI root directory;
+    #   defaults to {RosettAi.root} when nil
+    # @return [Configuration] a new configuration instance
+    def initialize(root_path: nil)
+      @root_path = resolve_root_path(root_path)
+    end
+
+    # Returns the parsed global settings from settings.json.
+    #
+    # @return [Hash] global settings hash (memoized)
+    def settings
+      @settings ||= load_settings
+    end
+
+    # Returns the parsed local overrides from settings.local.json.
+    #
+    # @return [Hash] local settings hash (memoized)
+    def local_settings
+      @local_settings ||= load_local_settings
+    end
+
+    # Returns global settings deep-merged with local overrides.
+    #
+    # @return [Hash] merged settings hash (memoized)
+    def merged_settings
+      @merged_settings ||= deep_merge(settings, local_settings)
+    end
+
+    # Returns the list of behaviour YAML files found in the behaviour directory.
+    #
+    # @return [Array<String>] absolute paths to behaviour YAML files (memoized)
+    def behaviour_files
+      @behaviour_files ||= Dir.glob(behaviour_path.join('*.yml'))
+    end
+
+    # Returns the path to the behaviour configuration directory.
+    #
+    # @return [Pathname] path to conf/behaviour/
+    def behaviour_path
+      root_path.join(BEHAVIOUR_DIR)
+    end
+
+    # Returns the path to the JSON Schema directory.
+    #
+    # @return [Pathname] path to conf/schemas/
+    def schema_path
+      root_path.join(SCHEMA_DIR)
+    end
+
+    # Clears all memoized state so the next access re-reads from disk.
+    #
+    # @return [void]
+    def reload!
+      @settings = nil
+      @local_settings = nil
+      @merged_settings = nil
+      @behaviour_files = nil
+    end
+
+    private
+
+    def resolve_root_path(path)
+      Pathname.new(path || RosettAi.root)
+    end
+
+    def load_settings
+      load_json_file(SETTINGS_FILE)
+    end
+
+    def load_local_settings
+      load_json_file(LOCAL_SETTINGS_FILE)
+    end
+
+    def load_json_file(filename)
+      file_path = root_path.join(filename)
+      return {} unless file_path.exist?
+
+      JSON.parse(file_path.read)
+    rescue JSON::ParserError => e
+      raise ConfigurationError, "Invalid JSON in #{filename}: #{e.message}"
+    end
+
+    def deep_merge(base, overlay)
+      return base if overlay.to_h.empty?
+
+      base.merge(overlay) do |_key, base_val, overlay_val|
+        merge_values(base_val, overlay_val)
+      end
+    end
+
+    def merge_values(base_val, overlay_val)
+      return deep_merge(base_val, overlay_val) if base_val.is_a?(Hash) && overlay_val.is_a?(Hash)
+      return base_val | overlay_val if base_val.is_a?(Array) && overlay_val.is_a?(Array)
+
+      overlay_val
+    end
+  end
+end

data/lib/rosett_ai/content/content_client.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+require 'faraday'
+
+module RosettAi
+  module Content
+    # Faraday-based HTTP client for the NeatNerds content server.
+    #
+    # License key is sent as Bearer token. All requests use HTTPS.
+    # Gracefully handles offline scenarios.
+    class ContentClient
+      DEFAULT_BASE_URL = 'https://content.neatnerds.be/v1/'
+
+      def initialize(license_key:, base_url: DEFAULT_BASE_URL)
+        @license_key = license_key
+        @connection = Faraday.new(url: base_url) do |conn|
+          conn.request :authorization, 'Bearer', license_key
+          conn.adapter Faraday.default_adapter
+        end
+      end
+
+      def catalog(tier:)
+        response = @connection.get('packs', tier: tier)
+        raise RosettAi::ContentError, "Server error: #{response.status}" unless response.success?
+
+        YAML.safe_load(response.body, permitted_classes: [])
+      rescue Faraday::ConnectionFailed, Faraday::TimeoutError => e
+        raise RosettAi::ContentError, "Cannot reach content server: #{e.message}"
+      end
+
+      def download(pack_name, version:)
+        response = @connection.get("packs/#{pack_name}/#{version}/download")
+        raise RosettAi::ContentError, "Download failed: #{response.status}" unless response.success?
+
+        response.body
+      rescue Faraday::ConnectionFailed, Faraday::TimeoutError => e
+        raise RosettAi::ContentError, "Cannot reach content server: #{e.message}"
+      end
+
+      def download_signature(pack_name, version:)
+        response = @connection.get("packs/#{pack_name}/#{version}/signature")
+        raise RosettAi::ContentError, "Signature download failed: #{response.status}" unless response.success?
+
+        response.body
+      rescue Faraday::ConnectionFailed, Faraday::TimeoutError => e
+        raise RosettAi::ContentError, "Cannot reach content server: #{e.message}"
+      end
+
+      def available?(pack_name)
+        response = @connection.head("packs/#{pack_name}")
+        response.success?
+      rescue Faraday::ConnectionFailed, Faraday::TimeoutError
+        false
+      end
+    end
+  end
+end

data/lib/rosett_ai/content/pack_installer.rb

@@ -0,0 +1,117 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+require 'rubygems/package'
+require 'zlib'
+require 'ed25519'
+require 'tempfile'
+require 'fileutils'
+
+module RosettAi
+  module Content
+    # Verifies Ed25519 signatures and extracts content pack tarballs.
+    #
+    # Security:
+    # - Signature verified BEFORE extraction
+    # - Path traversal entries (../) rejected
+    # - Atomic install: extract to temp dir, validate manifest, then move
+    # - Uses same PUBLIC_KEY_HEX as LicenseKey for verification
+    class PackInstaller
+      SAFE_DIR_MODE = 0o700
+
+      # Verifies signature and installs a content pack atomically.
+      #
+      # @param tarball_bytes [String] raw .tar.gz bytes
+      # @param signature_bytes [String] Ed25519 signature bytes
+      # @param pack_name [String] target pack directory name
+      # @return [PackManifest] manifest from the installed pack
+      # @raise [RosettAi::ContentError] if signature is invalid or manifest is missing
+      def install(tarball_bytes, signature_bytes, pack_name)
+        verify_signature!(tarball_bytes, signature_bytes)
+
+        temp_dir = Dir.mktmpdir('rosett-ai-pack-')
+        extract_tarball(tarball_bytes, temp_dir)
+        manifest = validate_extracted_manifest(temp_dir)
+        move_to_final(temp_dir, pack_name)
+        manifest
+      rescue StandardError
+        FileUtils.rm_rf(temp_dir) if temp_dir && Dir.exist?(temp_dir)
+        raise
+      end
+
+      private
+
+      def verify_signature!(tarball_bytes, signature_bytes)
+        public_hex = RosettAi::Licensing::LicenseKey::PUBLIC_KEY_HEX
+        verify_key = Ed25519::VerifyKey.new([public_hex].pack('H*'))
+        verify_key.verify(signature_bytes, tarball_bytes)
+      rescue Ed25519::VerifyError
+        raise RosettAi::ContentError, 'Content pack signature invalid. Pack not installed.'
+      end
+
+      def extract_tarball(tarball_bytes, dest_dir)
+        io = StringIO.new(tarball_bytes)
+        gz = Zlib::GzipReader.new(io)
+        Gem::Package::TarReader.new(gz) do |tar|
+          tar.each do |entry|
+            reject_traversal!(entry.full_name)
+            extract_entry(entry, dest_dir)
+          end
+        end
+      ensure
+        gz&.close
+      end
+
+      def reject_traversal!(path)
+        # Reject parent directory traversal
+        raise RosettAi::ContentError, "Path traversal rejected in content pack: #{path}" if path.include?('..')
+
+        # Reject absolute paths (could escape extraction directory)
+        raise RosettAi::ContentError, "Absolute path rejected in content pack: #{path}" if path.start_with?('/')
+
+        # Reject paths that start with ~ (home directory expansion)
+        raise RosettAi::ContentError, "Home directory path rejected in content pack: #{path}" if path.start_with?('~')
+
+        # Reject paths containing null bytes (path truncation attack)
+        return unless path.include?("\x00")
+
+        raise RosettAi::ContentError, "Null byte rejected in content pack path: #{path.inspect}"
+      end
+
+      def extract_entry(entry, dest_dir)
+        target = File.join(dest_dir, entry.full_name)
+
+        # Canonicalize and verify target stays within extraction directory
+        canonical_target = File.expand_path(target)
+        canonical_dest = File.expand_path(dest_dir)
+        unless canonical_target.start_with?("#{canonical_dest}/")
+          raise RosettAi::ContentError, "Path escape rejected in content pack: #{entry.full_name}"
+        end
+
+        if entry.directory?
+          FileUtils.mkdir_p(target, mode: SAFE_DIR_MODE)
+        elsif entry.file?
+          FileUtils.mkdir_p(File.dirname(target), mode: SAFE_DIR_MODE)
+          File.write(target, entry.read, perm: 0o644)
+        end
+        # Symlinks are silently ignored (not extracted) for security
+      end
+
+      def validate_extracted_manifest(temp_dir)
+        manifest_path = File.join(temp_dir, 'manifest.yml')
+        raise RosettAi::ContentError, 'Content pack missing manifest.yml' unless File.exist?(manifest_path)
+
+        PackManifest.from_file(manifest_path)
+      end
+
+      def move_to_final(temp_dir, pack_name)
+        final_dir = RosettAi.paths.premium_content_dir.join(pack_name)
+        FileUtils.rm_rf(final_dir.to_s) if final_dir.exist?
+        FileUtils.mkdir_p(final_dir.dirname.to_s, mode: SAFE_DIR_MODE)
+        FileUtils.mv(temp_dir, final_dir.to_s)
+      end
+    end
+  end
+end

data/lib/rosett_ai/content/pack_manifest.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+require 'json_schemer'
+
+module RosettAi
+  module Content
+    # Loads, validates, and provides access to content pack manifest data.
+    #
+    # Manifest files are YAML (parsed with safe_load only) and validated
+    # against the content_pack_manifest_schema.json schema.
+    class PackManifest
+      attr_reader :data
+
+      def initialize(data)
+        @data = data
+        validate!
+      end
+
+      def self.from_file(path)
+        data = RosettAi::YamlLoader.load_file(path)
+        new(data)
+      end
+
+      def name = data['name']
+      def version = data['version']
+      def tier_required = data['tier_required']
+      def description = data['description']
+      def author = data['author']
+      def contents = data['contents'] || {}
+      def behaviour_files = contents['behaviours'] || []
+      def design_files = contents['designs'] || []
+
+      private
+
+      def validate!
+        schema_path = RosettAi.root.join('conf', 'schemas', 'content_pack_manifest_schema.json')
+        schema = JSON.parse(schema_path.read)
+        schemer = JSONSchemer.schema(schema)
+        errors = schemer.validate(data).to_a
+        return if errors.empty?
+
+        messages = errors.map { |err| "#{err['data_pointer']}: #{err['type']}" }
+        raise RosettAi::ContentError, "Invalid manifest: #{messages.join(', ')}"
+      end
+    end
+  end
+end

data/lib/rosett_ai/content/pack_registry.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Content
+    # Tracks installed content packs via filesystem scanning.
+    #
+    # No separate registry file — the filesystem IS the registry.
+    # Each pack directory under ~/.config/rosett-ai/premium/ contains a
+    # manifest.yml that describes the pack.
+    class PackRegistry
+      # Lists all installed content packs by scanning the premium directory.
+      #
+      # @return [Array<PackManifest>] manifests for each installed pack
+      def installed
+        return [] unless premium_dir.exist?
+
+        Dir.children(premium_dir.to_s).filter_map do |entry|
+          dir = premium_dir.join(entry)
+          manifest_path = dir.join('manifest.yml')
+          next unless dir.directory? && manifest_path.exist?
+
+          PackManifest.from_file(manifest_path.to_s)
+        rescue RosettAi::ContentError
+          nil
+        end
+      end
+
+      # Whether a pack with the given name is installed.
+      #
+      # @param pack_name [String] pack directory name
+      # @return [Boolean]
+      def installed?(pack_name)
+        manifest_path = premium_dir.join(pack_name, 'manifest.yml')
+        manifest_path.exist?
+      end
+
+      # Returns the installed version of a pack.
+      #
+      # @param pack_name [String] pack directory name
+      # @return [String, nil] version string or nil if not installed
+      def version(pack_name)
+        manifest_path = premium_dir.join(pack_name, 'manifest.yml')
+        return nil unless manifest_path.exist?
+
+        manifest = PackManifest.from_file(manifest_path.to_s)
+        manifest.version
+      end
+
+      # Removes an installed pack and its directory.
+      #
+      # @param pack_name [String] pack directory name
+      # @return [void]
+      def remove!(pack_name)
+        dir = premium_dir.join(pack_name)
+        FileUtils.rm_rf(dir.to_s) if dir.exist?
+      end
+
+      private
+
+      def premium_dir
+        RosettAi.paths.premium_content_dir
+      end
+    end
+  end
+end

data/lib/rosett_ai/content_packs/manager.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module ContentPacks
+    # MCP-facing facade for content pack operations.
+    #
+    # Delegates to {Content::PackRegistry} and {Content::PackInstaller}
+    # for the actual content pack logic, providing the simplified
+    # interface expected by {Mcp::Tools::ContentTool}.
+    #
+    # @author hugo
+    # @author claude
+    class Manager
+      def initialize
+        @registry = Content::PackRegistry
+        @installer = Content::PackInstaller.new
+      end
+
+      # Lists installed content packs.
+      #
+      # @return [Array<Hash>] installed packs with :name and :version
+      def list
+        @registry.installed.map do |pack|
+          { name: pack.name, version: pack.version }
+        end
+      end
+
+      # Installs a content pack by name.
+      #
+      # @param pack_name [String] name of the pack to install
+      # @return [Boolean] true on success
+      def install(pack_name)
+        @installer.install(pack_name)
+        pack_name
+      end
+
+      # Updates all installed content packs.
+      #
+      # @return [Array<String>] names of updated packs
+      def update_all
+        @registry.installed.filter_map do |pack|
+          @installer.update(pack.name) ? pack.name : nil
+        end
+      end
+    end
+  end
+end