rosett-ai 1.3.3

data/lib/rosett_ai/init/mcp_registrar.rb

@@ -0,0 +1,109 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+require 'json'
+
+module RosettAi
+  module Init
+    # Registers the rosett-ai MCP server in Claude Code settings.json.
+    #
+    # Called by `raictl init --global` to enable AI client auto-discovery
+    # of rosett-ai tools via the MCP protocol (DES-RAI-MCP-002).
+    #
+    # The registration is idempotent: if the rosett-ai entry already
+    # exists, no changes are made.
+    #
+    # @author hugo
+    # @author claude
+    class McpRegistrar
+      MCP_SERVER_NAME = 'rosett-ai'
+
+      # @param settings_path [String] path to Claude Code settings.json
+      def initialize(settings_path: nil)
+        @settings_path = settings_path || default_settings_path
+      end
+
+      # Registers the rosett-ai MCP server in settings.json.
+      #
+      # @return [Hash] result with :action (:registered, :already_registered, :skipped)
+      #   and :path
+      def register
+        return skip_result('Settings file not found') unless File.exist?(@settings_path)
+
+        settings = read_settings
+        return already_registered_result if registered?(settings)
+
+        settings['mcpServers'] ||= {}
+        settings['mcpServers'][MCP_SERVER_NAME] = server_entry
+        write_settings(settings)
+
+        { action: :registered, path: @settings_path }
+      rescue JSON::ParserError => e
+        skip_result("Invalid JSON in settings: #{e.message}")
+      end
+
+      private
+
+      # @return [String] default path to Claude Code settings.json
+      def default_settings_path
+        File.join(Dir.home, '.claude', 'settings.json')
+      end
+
+      # @return [Hash] the MCP server entry for settings.json
+      def server_entry
+        {
+          'command' => resolve_command,
+          'args' => ['mcp', 'serve']
+        }
+      end
+
+      # Resolves the raictl command path.
+      #
+      # Checks known install locations in order, falls back to
+      # absolute path from `which` so MCP clients without PATH
+      # can still find the binary.
+      #
+      # @return [String] absolute path or command name
+      def resolve_command
+        ['/usr/local/bin/raictl', '/usr/bin/raictl'].each do |path|
+          return path if File.executable?(path)
+        end
+
+        which_result = `which raictl 2>/dev/null`.strip
+        return which_result unless which_result.empty?
+
+        'raictl'
+      end
+
+      # @param settings [Hash] parsed settings
+      # @return [Boolean] true if rosett-ai is already registered
+      def registered?(settings)
+        settings.dig('mcpServers', MCP_SERVER_NAME).is_a?(Hash)
+      end
+
+      # @return [Hash] parsed settings.json
+      def read_settings
+        JSON.parse(File.read(@settings_path))
+      end
+
+      # @param settings [Hash] settings to write
+      # @return [void]
+      def write_settings(settings)
+        File.write(@settings_path, "#{JSON.pretty_generate(settings)}\n")
+      end
+
+      # @return [Hash] result for already registered case
+      def already_registered_result
+        { action: :already_registered, path: @settings_path }
+      end
+
+      # @param reason [String] why registration was skipped
+      # @return [Hash] result for skip case
+      def skip_result(reason)
+        { action: :skipped, path: @settings_path, reason: reason }
+      end
+    end
+  end
+end

data/lib/rosett_ai/init/project_initializer.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+require 'fileutils'
+
+module RosettAi
+  module Init
+    # MCP-facing facade for .rosett-ai/ project structure initialization.
+    #
+    # Creates the .rosett-ai/ directory with config.yml and conf/ subdirectories.
+    #
+    # @author hugo
+    # @author claude
+    class ProjectInitializer
+      PROJECT_DIR = '.rosett-ai'
+
+      # Sets up the .rosett-ai/ project directory structure.
+      #
+      # @return [Array<String>] created directories
+      def setup
+        base_dir = File.join(Dir.pwd, PROJECT_DIR)
+        subdirs = ['conf', 'conf/behaviour', 'conf/design']
+
+        created = DirectoryBuilder.create_directories(base_dir, subdirs)
+        write_config(base_dir) unless File.exist?(File.join(base_dir, 'config.yml'))
+        created
+      end
+
+      private
+
+      def write_config(base_dir)
+        ConfigFileWriter.write_project_config(base_dir)
+      end
+    end
+  end
+end

data/lib/rosett_ai/licensing/license_key.rb

@@ -0,0 +1,139 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+require 'jwt'
+require 'jwt/eddsa'
+require 'ed25519'
+
+module RosettAi
+  module Licensing
+    # Decodes and validates Ed25519-signed JWT license keys.
+    #
+    # The public verification key is safe to embed in source — it can
+    # only verify signatures, not forge them.  The private signing key
+    # is held server-side and NEVER distributed.
+    class LicenseKey
+      PUBLIC_KEY_HEX = '91f54336c0d42a7c88642b8d7f8bacab3adba4a4d633a33002fc15f676bfd8f0'
+      RAI_PREFIX = 'NNCC-'
+      GRACE_PERIOD_DAYS = 14
+      OFFLINE_GRACE_DAYS = 30
+
+      attr_reader :claims
+
+      # @param raw_key [String] JWT license key, optionally prefixed with "NNCC-"
+      def initialize(raw_key)
+        @raw_key = raw_key
+        @claims = nil
+        @decoded = false
+      end
+
+      # Decodes and verifies the Ed25519 JWT signature.
+      #
+      # @return [self]
+      # @raise [RosettAi::LicenseError] if signature verification or decoding fails
+      def decode
+        return self if @decoded
+
+        stripped = strip_prefix(@raw_key)
+        verify_key = Ed25519::VerifyKey.new([PUBLIC_KEY_HEX].pack('H*'))
+        decoded = JWT.decode(stripped, verify_key, true, algorithms: ['EdDSA'], verify_expiration: false)
+        @claims = decoded.first
+        @decoded = true
+        self
+      rescue Ed25519::VerifyError, JWT::DecodeError, JWT::VerificationError => e
+        raise RosettAi::LicenseError, "signature verification failed: #{e.message}"
+      rescue ArgumentError, TypeError => e
+        raise RosettAi::LicenseError, "invalid key format: #{e.message}"
+      end
+
+      # Whether the license is currently valid (not expired or within grace).
+      #
+      # @return [Boolean]
+      def valid?
+        decode
+        !expired? || within_grace?
+      rescue RosettAi::LicenseError
+        false
+      end
+
+      # Returns the license tier.
+      #
+      # @return [Tier] tier from claims, defaults to community
+      def tier
+        decode
+        Tier.new(claims['tier'] || 'community')
+      end
+
+      # Whether the license has passed its expiration timestamp.
+      #
+      # @return [Boolean]
+      def expired?
+        decode
+        return false if perpetual?
+
+        exp = claims['exp']
+        return false unless exp
+
+        Time.now.to_i > exp
+      end
+
+      # Whether the license is perpetual (never expires).
+      #
+      # @return [Boolean]
+      def perpetual?
+        decode
+        claims['perpetual'] == true
+      end
+
+      # Whether the license tier is subscriber or enterprise.
+      #
+      # @return [Boolean]
+      def subscriber?
+        decode
+        ['subscriber', 'enterprise'].include?(claims['tier'])
+      end
+
+      # Days remaining in the post-expiry grace period.
+      #
+      # @return [Integer, nil] days remaining (0 if exhausted, nil if perpetual or no expiry)
+      def grace_remaining
+        decode
+        return nil if perpetual?
+
+        exp = claims['exp']
+        return nil unless exp
+
+        elapsed = (Time.now.to_i - exp) / 86_400
+        return GRACE_PERIOD_DAYS if elapsed.negative?
+
+        remaining = GRACE_PERIOD_DAYS - elapsed
+        [remaining, 0].max
+      end
+
+      # Whether the license is valid for offline use.
+      #
+      # @return [Boolean]
+      def offline_valid?
+        decode
+        return true if perpetual?
+
+        exp = claims['exp']
+        return true unless exp
+
+        (Time.now.to_i - exp) < (OFFLINE_GRACE_DAYS * 86_400)
+      end
+
+      private
+
+      def strip_prefix(key)
+        key.start_with?(RAI_PREFIX) ? key[RAI_PREFIX.length..] : key
+      end
+
+      def within_grace?
+        grace_remaining&.positive?
+      end
+    end
+  end
+end

data/lib/rosett_ai/licensing/license_store.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Licensing
+    # Persists the license key at ~/.config/rosett-ai/license.key with
+    # strict file permissions (0600, owned by current uid).
+    class LicenseStore
+      SAFE_FILE_MODE = 0o600
+      SAFE_DIR_MODE = 0o700
+
+      def save(raw_key)
+        ensure_parent_directory!
+        File.write(license_path.to_s, raw_key, mode: 'w', perm: SAFE_FILE_MODE)
+        validate_permissions!
+      end
+
+      def load
+        return nil unless exists?
+
+        validate_permissions!
+        File.read(license_path.to_s).chomp
+      end
+
+      def remove!
+        File.delete(license_path.to_s) if exists?
+      end
+
+      def exists?
+        license_path.exist?
+      end
+
+      private
+
+      def license_path
+        RosettAi.paths.license_file
+      end
+
+      def ensure_parent_directory!
+        dir = license_path.dirname
+        return if dir.exist?
+
+        FileUtils.mkdir_p(dir.to_s, mode: SAFE_DIR_MODE)
+      end
+
+      def validate_permissions!
+        stat = File.stat(license_path.to_s)
+
+        mode = stat.mode & 0o777
+        unless mode == SAFE_FILE_MODE
+          raise RosettAi::LicenseError,
+                "license file permissions #{format('%04o', mode)} are not 0600"
+        end
+
+        return if stat.uid == Process.uid
+
+        raise RosettAi::LicenseError,
+              "license file owned by uid #{stat.uid}, expected #{Process.uid}"
+      end
+    end
+  end
+end

data/lib/rosett_ai/licensing/license_validator.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Licensing
+    # Orchestrates the full license validation flow:
+    # load from store -> decode -> verify signature -> check expiry.
+    #
+    # Returns a structured result hash. Never raises for expected
+    # states (missing license, expired subscription).
+    class LicenseValidator
+      # Runs the full license validation flow.
+      #
+      # @return [Hash{Symbol => Object}] result with :valid, :tier, :warnings, :errors keys
+      def validate
+        store = LicenseStore.new
+        return community_result unless store.exists?
+
+        raw_key = store.load
+        return community_result if raw_key.nil? || raw_key.empty?
+
+        validate_key(raw_key)
+      rescue RosettAi::LicenseError => e
+        error_result(e.message)
+      end
+
+      private
+
+      def validate_key(raw_key)
+        key = LicenseKey.new(raw_key)
+        key.decode
+
+        result = { valid: true, tier: key.tier, warnings: [], errors: [] }
+        add_expiry_warnings(key, result) if key.expired?
+        result
+      end
+
+      def add_expiry_warnings(key, result)
+        remaining = key.grace_remaining
+        if remaining&.positive?
+          result[:warnings] << "Subscription expired. Content available for #{remaining} " \
+                               'more day(s). Renew to continue receiving updates.'
+        else
+          result[:warnings] << 'Subscription expired. Premium content frozen at last installed version.'
+          result[:valid] = false
+        end
+      end
+
+      def community_result
+        { valid: true, tier: Tier.new(:community), warnings: [], errors: [] }
+      end
+
+      def error_result(message)
+        { valid: false, tier: Tier.new(:community), warnings: [], errors: [message] }
+      end
+    end
+  end
+end

data/lib/rosett_ai/licensing/tier.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Licensing
+    # Represents a license tier with comparable ordering.
+    #
+    # Tiers control access to premium content pack downloads — they
+    # NEVER restrict software functionality (GPL-3.0 compliance).
+    class Tier
+      include Comparable
+
+      HIERARCHY = { community: 0, supporter: 1, subscriber: 2, enterprise: 3 }.freeze
+      NAMES = HIERARCHY.keys.freeze
+
+      attr_reader :name, :level
+
+      def initialize(name)
+        sym = name.to_s.downcase.to_sym
+        raise RosettAi::LicenseError, "unknown tier: #{name}" unless HIERARCHY.key?(sym)
+
+        @name = sym
+        @level = HIERARCHY[sym]
+      end
+
+      def <=>(other)
+        level <=> other.level
+      end
+
+      def entitled_to?(required)
+        other = required.is_a?(Tier) ? required : Tier.new(required)
+        self >= other
+      end
+
+      def to_s
+        name.to_s.capitalize
+      end
+    end
+  end
+end

data/lib/rosett_ai/mcp/admin/auditor.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Mcp
+    module Admin
+      # Compliance auditor for MCP server configurations.
+      #
+      # Generates structured audit reports covering configuration
+      # provenance, validation status, and transport security.
+      # Supports CRA/NIS2/DORA audit documentation requirements.
+      #
+      # @author hugo
+      # @author claude
+      class Auditor
+        # @param registry [Registry] server registry
+        # @param health_checker [HealthChecker] health checker instance
+        # @param schema_validator [SchemaValidator] schema validator instance
+        def initialize(registry:, health_checker:, schema_validator:)
+          @registry = registry
+          @health_checker = health_checker
+          @schema_validator = schema_validator
+        end
+
+        # Generates a full audit report.
+        #
+        # @return [Hash] audit report with :timestamp, :servers, :summary
+        def audit
+          servers = @registry.list
+          health_results = @health_checker.check_all(@registry)
+          health_map = health_results.to_h { |r| [r[:name], r] }
+
+          entries = servers.map { |server| audit_server(server, health_map) }
+
+          {
+            timestamp: Time.now.utc.iso8601,
+            servers: entries,
+            summary: build_summary(entries)
+          }
+        end
+
+        private
+
+        def audit_server(server, health_map)
+          health = health_map[server[:name]] || { status: :unknown }
+          validation = @schema_validator.validate(server)
+
+          {
+            name: server[:name],
+            transport: server[:transport],
+            health_status: health[:status].to_s,
+            schema_valid: validation[:valid],
+            validation_errors: validation[:errors],
+            source_file: server[:source_file],
+            transport_security: assess_transport_security(server),
+            audited_at: Time.now.utc.iso8601
+          }
+        end
+
+        def assess_transport_security(server)
+          case server[:transport]
+          when 'stdio'
+            'local-only'
+          when 'http', 'streamable-http'
+            url = server[:url].to_s
+            url.start_with?('https://') ? 'tls-encrypted' : 'plaintext-warning'
+          else
+            'unknown'
+          end
+        end
+
+        SECURE_TRANSPORTS = ['local-only', 'tls-encrypted'].freeze
+        private_constant :SECURE_TRANSPORTS
+
+        def build_summary(entries)
+          {
+            total: entries.size,
+            healthy: entries.count { |e| e[:health_status] == 'available' },
+            schema_valid: entries.count { |e| e[:schema_valid] },
+            secure_transport: entries.count { |e| SECURE_TRANSPORTS.include?(e[:transport_security]) }
+          }
+        end
+      end
+    end
+  end
+end

data/lib/rosett_ai/mcp/admin/health_checker.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Mcp
+    module Admin
+      # Health checker for configured MCP servers.
+      #
+      # Probes each server with a configurable timeout (default 5s)
+      # to verify availability and capability negotiation.
+      #
+      # @author hugo
+      # @author claude
+      class HealthChecker
+        DEFAULT_TIMEOUT = 5
+
+        # @param timeout [Integer] maximum seconds per health check
+        def initialize(timeout: DEFAULT_TIMEOUT)
+          @timeout = timeout
+        end
+
+        # Checks health of a single server.
+        #
+        # @param server [Hash] server entry from Registry
+        # @return [Hash] result with :name, :status, :transport, :message
+        def check(server)
+          case server[:transport]
+          when 'stdio'
+            check_stdio(server)
+          when 'http', 'streamable-http'
+            check_http(server)
+          else
+            { name: server[:name], status: :unknown, transport: server[:transport],
+              message: "Unknown transport: #{server[:transport]}" }
+          end
+        end
+
+        # Checks health of all servers in a registry.
+        #
+        # @param registry [Registry] server registry
+        # @return [Array<Hash>] health results
+        def check_all(registry)
+          registry.list.map { |server| check(server) }
+        end
+
+        private
+
+        def check_stdio(server)
+          command = server[:command]
+          unless command && command_exists?(command)
+            return { name: server[:name], status: :unavailable, transport: 'stdio',
+                     message: "Command not found: #{command}" }
+          end
+
+          { name: server[:name], status: :available, transport: 'stdio',
+            message: 'Command found' }
+        end
+
+        def check_http(server)
+          url = server[:url]
+          unless url
+            return { name: server[:name], status: :unavailable, transport: server[:transport],
+                     message: 'No URL configured' }
+          end
+
+          { name: server[:name], status: :available, transport: server[:transport],
+            message: "URL configured: #{url}" }
+        end
+
+        def command_exists?(command)
+          cmd = command.is_a?(Array) ? command.first : command.split.first
+          ENV.fetch('PATH', '').split(File::PATH_SEPARATOR).any? do |dir|
+            File.executable?(File.join(dir, cmd))
+          end
+        end
+      end
+    end
+  end
+end