rosett-ai 1.3.3

data/lib/rosett_ai/packaging/variant_config.rb

@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+require 'json'
+require 'json_schemer'
+
+module RosettAi
+  module Packaging
+    # Loads and validates packaging variant configs from conf/packaging/<name>.yml.
+    #
+    # Each variant declares a Debian package with its metadata, system
+    # dependencies, and package dependencies. The special version keyword
+    # "current" resolves to ">= #{RosettAi::VERSION}" at load time, ensuring
+    # atomic version updates per lifecycle_management.yml constraints.
+    class VariantConfig
+      FIELDS = [
+        :name, :variant, :description, :ui_adapter,
+        :system_dependencies, :package_dependencies
+      ].freeze
+
+      attr_reader(*FIELDS)
+
+      def initialize(data)
+        FIELDS.each do |field|
+          instance_variable_set(:"@#{field}", data[field.to_s])
+        end
+        @system_dependencies ||= []
+        @package_dependencies ||= []
+      end
+
+      def self.load(variant_name)
+        path = variants_dir.join("#{variant_name}.yml")
+        unless path.exist?
+          raise RosettAi::ConfigurationError,
+                "Unknown variant: #{variant_name}. Available: #{available.join(', ')}"
+        end
+
+        data = RosettAi::YamlLoader.load_file(path)
+        validate!(data, path)
+        new(data)
+      end
+
+      def self.available
+        Dir.glob(variants_dir.join('*.yml')).map do |file|
+          File.basename(file, '.yml')
+        end.sort
+      end
+
+      def self.variants_dir
+        RosettAi.root.join('conf', 'packaging')
+      end
+
+      def fpm_depends
+        deps = system_dependencies.dup
+        package_dependencies.each do |dep|
+          version = resolve_version(dep['version'])
+          deps << "#{dep['name']} (#{version})"
+        end
+        deps
+      end
+
+      def depends_on_core?
+        package_dependencies.any? { |dep| dep['name'] == 'rosett-ai' }
+      end
+
+      def self.validate!(data, path)
+        schema_path = RosettAi.root.join('conf', 'schemas', 'packaging_schema.json')
+        schema = JSON.parse(schema_path.read)
+        schemer = JSONSchemer.schema(schema)
+        errors = schemer.validate(data).to_a
+        return if errors.empty?
+
+        messages = errors.map do |err|
+          pointer = err['data_pointer'].empty? ? 'root' : err['data_pointer']
+          "#{pointer}: #{err['type']}"
+        end
+        raise RosettAi::ConfigurationError, "Invalid variant config #{path}: #{messages.join(', ')}"
+      end
+      private_class_method :validate!
+
+      private
+
+      def resolve_version(constraint)
+        return ">= #{RosettAi::VERSION}" if constraint == 'current'
+
+        constraint
+      end
+    end
+  end
+end

data/lib/rosett_ai/path_resolver.rb

@@ -0,0 +1,115 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+# AI-Co-Author: Claude Opus 4.6 (Anthropic) <noreply@anthropic.com>
+
+module RosettAi
+  # Resolves filesystem paths for rai configuration directories.
+  # Uses instance methods for future multi-engine support (ADR-006).
+  class PathResolver
+    attr_reader :engine
+
+    # Create a new path resolver for the given engine.
+    #
+    # @param engine [Symbol] engine name
+    # @return [PathResolver]
+    def initialize(engine: :claude)
+      @engine = engine
+    end
+
+    # Engine-specific paths (upstream convention)
+
+    # Global configuration directory.
+    # @return [Pathname] ~/.claude/
+    def global_dir = Pathname.new(File.expand_path('~/.claude'))
+
+    # Compiled rules output directory.
+    # @return [Pathname] ~/.claude/rules/
+    def rules_dir = global_dir.join('rules')
+
+    # Project-local configuration directory.
+    # @return [Pathname] .claude/ in the user's working directory
+    def local_dir = Pathname.new(user_pwd).join('.claude')
+
+    # Project-level CLAUDE.md file.
+    # @return [Pathname] CLAUDE.md in the user's working directory
+    def project_claude_md = Pathname.new(user_pwd).join('CLAUDE.md')
+
+    # Rosett-AI domain (XDG-compliant)
+
+    # XDG-compliant rai configuration directory.
+    # @return [Pathname] $XDG_CONFIG_HOME/rosett-ai or ~/.config/rosett-ai
+    def rai_config_dir
+      xdg = ENV.fetch('XDG_CONFIG_HOME', File.join(Dir.home, '.config'))
+      Pathname.new(xdg).join('rosett-ai')
+    end
+
+    # XDG-compliant rai behaviour/design conf directory.
+    # This is where user-level behaviours live — the global compile source.
+    # @return [Pathname] $XDG_CONFIG_HOME/rosett-ai/conf or ~/.config/rosett-ai/conf
+    def rai_conf_dir = rai_config_dir.join('conf')
+
+    # Packaged defaults directory (from .deb install).
+    # @return [Pathname] /opt/rosett-ai/app/conf
+    def packaged_conf_dir = Pathname.new('/opt/rosett-ai/app/conf')
+
+    # Encrypted secrets store.
+    # @return [Pathname] secrets.yml inside the rosett-ai config directory
+    def secrets_file = rai_config_dir.join('secrets.yml')
+
+    # Ed25519-signed JWT license key file.
+    # @return [Pathname] license.key inside the rosett-ai config directory
+    def license_file = rai_config_dir.join('license.key')
+
+    # Premium content packs directory.
+    # @return [Pathname] premium/ inside the rosett-ai config directory
+    def premium_content_dir = rai_config_dir.join('premium')
+
+    # Content pack cache directory.
+    # @return [Pathname] cache/content/ inside the rosett-ai config directory
+    def content_cache_dir = rai_config_dir.join('cache', 'content')
+
+    # Engine settings target paths
+
+    # System-wide managed settings (enterprise).
+    # @return [Pathname] /etc/claude-code/managed-settings.json
+    def managed_settings_path
+      Pathname.new('/etc/claude-code/managed-settings.json')
+    end
+
+    # Global user settings file.
+    # @return [Pathname] settings.json inside ~/.claude/
+    def user_settings_path = global_dir.join('settings.json')
+
+    # Project-level settings file.
+    # @return [Pathname] settings.json inside .claude/
+    def project_settings_path = local_dir.join('settings.json')
+
+    # Local settings override (gitignored).
+    # @return [Pathname] settings.local.json inside .claude/
+    def local_settings_path = local_dir.join('settings.local.json')
+
+    # Claude engine configuration source directory.
+    # @return [Pathname] conf/engines/claude/config/ relative to Rosett-AI root
+    def claude_code_config_dir = RosettAi.root.join('conf', 'engines', 'claude', 'config')
+
+    # Tilde-form display path for lockfile output.
+    # @return [String] ~/.claude/rules
+    def rules_display_path = '~/.claude/rules'
+
+    # The user's original working directory.
+    # When running from the .deb wrapper, Dir.pwd is /opt/rosett-ai/app, so
+    # RAI_ORIGINAL_PWD (set by the wrapper) preserves the real directory.
+    # @return [String] user's working directory
+    def user_pwd
+      ENV.fetch('RAI_ORIGINAL_PWD', Dir.pwd)
+    end
+
+    # Memoized default instance for single-engine usage.
+    # @return [PathResolver] instance with engine set to :claude
+    def self.default
+      @default ||= new
+    end
+  end
+end

data/lib/rosett_ai/plugins/contract.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Plugins
+    # Base contract module shared by all plugin types (engines, GUIs, MCPs).
+    #
+    # Every Rosett-AI plugin gem must include this module (or a type-specific
+    # subcontract that itself includes Contract) and implement the required
+    # class methods.  The registry uses these methods for discovery,
+    # display, and version negotiation.
+    module Contract
+      def self.included(base)
+        base.extend(ClassMethods)
+      end
+
+      # Class-level interface that every plugin must implement.
+      module ClassMethods
+        # @return [Symbol] one of :engine, :gui, :mcp
+        def plugin_type
+          raise NotImplementedError, "#{self}#plugin_type must return :engine, :gui, or :mcp"
+        end
+
+        # @return [String] machine-readable plugin name (e.g. 'claude', 'gtk4')
+        def plugin_name
+          raise NotImplementedError, "#{self}#plugin_name must return the plugin identifier"
+        end
+
+        # @return [String] human-readable display name (e.g. 'ACME AI Tool (Example)')
+        def display_name
+          raise NotImplementedError, "#{self}#display_name must return a human-readable name"
+        end
+
+        # @return [String] SemVer version string
+        def version
+          raise NotImplementedError, "#{self}#version must return a SemVer string"
+        end
+      end
+    end
+  end
+end

data/lib/rosett_ai/plugins/engine_contract.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Plugins
+    # Contract module for engine plugins.
+    #
+    # Engine plugins compile behaviour YAML into tool-specific formats,
+    # detect installed AI tools, execute API calls, and compile
+    # tool-native configuration.
+    #
+    # Include this module in your engine's registration module and
+    # implement all required class methods.
+    module EngineContract
+      def self.included(base)
+        base.include(Contract)
+        base.extend(ClassMethods)
+      end
+
+      # Engine-specific class methods beyond the base Contract.
+      module ClassMethods
+        def plugin_type = :engine
+
+        # @return [String] engine identifier (e.g. 'claude', 'goose')
+        def engine_name
+          raise NotImplementedError, "#{self}#engine_name must return the engine identifier"
+        end
+
+        # @return [Class] the Backend subclass for rule compilation
+        def backend_class
+          raise NotImplementedError, "#{self}#backend_class must return the backend class"
+        end
+
+        # @return [Class, nil] optional Detector subclass for system probing
+        def detector_class = nil
+
+        # @return [Class, nil] optional Executor subclass for API calls
+        def executor_class = nil
+
+        # @return [Class, nil] optional ConfigCompiler subclass for settings compilation
+        def config_compiler_class = nil
+
+        # @return [Pathname] path to the engine's manifest.yml
+        def manifest_path
+          raise NotImplementedError, "#{self}#manifest_path must return the manifest path"
+        end
+
+        # @return [Pathname] path to the engine's target profile YAML
+        def target_profile_path
+          manifest_path.dirname.join('target.yml')
+        end
+
+        # Convenience alias — delegates to plugin_name for Contract compatibility.
+        def plugin_name = engine_name
+      end
+    end
+  end
+end

data/lib/rosett_ai/plugins/gui_contract.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Plugins
+    # Contract module for GUI plugins.
+    #
+    # GUI plugins provide desktop interfaces (GTK4, Qt6, etc.) that
+    # communicate with Rosett-AI core via D-Bus IPC.
+    #
+    # Include this module in your GUI's registration module and
+    # implement all required class methods.
+    #
+    # @author hugo
+    # @author claude
+    module GuiContract
+      def self.included(base)
+        base.include(Contract)
+        base.extend(ClassMethods)
+      end
+
+      # GUI-specific class methods beyond the base Contract.
+      module ClassMethods
+        def plugin_type = :gui
+
+        # @return [String] GUI identifier (e.g. 'gtk4', 'qt6')
+        def gui_name
+          raise NotImplementedError, "#{self}#gui_name must return the GUI identifier"
+        end
+
+        # @return [Symbol] toolkit identifier (:gtk4, :qt6, etc.)
+        def toolkit
+          raise NotImplementedError, "#{self}#toolkit must return a toolkit symbol"
+        end
+
+        # @return [Class] the main application class
+        def application_class
+          raise NotImplementedError, "#{self}#application_class must return the application class"
+        end
+
+        # Check if system dependencies for this GUI are available.
+        #
+        # @return [Boolean]
+        def available?
+          false
+        end
+
+        # Launch the GUI application.
+        #
+        # @param argv [Array<String>] command-line arguments
+        # @return [Integer] exit code
+        def launch(argv)
+          app = application_class.new
+          app.run(argv)
+        end
+
+        # List system packages required by this GUI.
+        #
+        # @return [Array<String>] package names (e.g. ['libgtk-4-1'])
+        def required_system_packages
+          []
+        end
+
+        # @return [Class, nil] optional D-Bus interface class
+        def dbus_interface_class = nil
+
+        # Convenience alias — delegates to plugin_name for Contract compatibility.
+        def plugin_name = gui_name
+      end
+    end
+  end
+end

data/lib/rosett_ai/plugins/mcp_contract.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Plugins
+    # Contract module for MCP (Model Context Protocol) plugins.
+    #
+    # MCP plugins expose rosett-ai functionality as MCP servers with
+    # tool and resource definitions.
+    #
+    # Include this module in your MCP's registration module and
+    # implement all required class methods.
+    module McpContract
+      def self.included(base)
+        base.include(Contract)
+        base.extend(ClassMethods)
+      end
+
+      # MCP-specific class methods beyond the base Contract.
+      module ClassMethods
+        def plugin_type = :mcp
+
+        # @return [String] MCP server identifier (e.g. 'server')
+        def mcp_name
+          raise NotImplementedError, "#{self}#mcp_name must return the MCP identifier"
+        end
+
+        # @return [Class] the MCP server class
+        def server_class
+          raise NotImplementedError, "#{self}#server_class must return the server class"
+        end
+
+        # @return [Array<Hash>] MCP tool schema definitions
+        def tool_definitions
+          raise NotImplementedError, "#{self}#tool_definitions must return tool schemas"
+        end
+
+        # @return [Array<Hash>] MCP resource definitions (optional)
+        def resource_definitions = []
+
+        # Convenience alias — delegates to plugin_name for Contract compatibility.
+        def plugin_name = mcp_name
+      end
+    end
+  end
+end

data/lib/rosett_ai/plugins/registry.rb

@@ -0,0 +1,150 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Plugins
+    # Dynamic, multi-type plugin registry.
+    #
+    # Plugins self-register via `RosettAi::Plugins::Registry.register(:engine, 'claude', MyModule)`.
+    # External plugin gems are discovered via `Gem.find_files` — install a gem,
+    # and it becomes available automatically.
+    #
+    # Replaces the hardcoded ENGINES and BACKENDS maps from
+    # RosettAi::Engines::Registry and RosettAi::Compiler::Backend.
+    class Registry
+      PLUGIN_TYPES = [:engine, :gui, :mcp].freeze
+
+      class PluginNotFoundError < RosettAi::Error; end
+
+      @plugins = Hash.new { |h, k| h[k] = {} }
+      @discovered = false
+
+      class << self
+        # Register a plugin module under a type and name.
+        #
+        # @param type [Symbol] one of :engine, :gui, :mcp
+        # @param name [String, Symbol] plugin identifier
+        # @param plugin_module [Module] the module including the appropriate contract
+        def register(type, name, plugin_module)
+          validate_type!(type)
+          @plugins[type][name.to_s] = plugin_module
+        end
+
+        # @param type [Symbol] plugin type
+        # @return [Array<String>] sorted list of registered plugin names
+        def available(type)
+          validate_type!(type)
+          @plugins[type].keys.sort
+        end
+
+        # @param type [Symbol] plugin type
+        # @param name [String, Symbol] plugin identifier
+        # @return [Module] the registered plugin module
+        # @raise [PluginNotFoundError] if not found
+        def plugin_module(type, name)
+          validate_type!(type)
+          @plugins[type].fetch(name.to_s) do
+            raise PluginNotFoundError,
+                  "Unknown #{type} plugin: #{name}. Available: #{available(type).join(', ')}"
+          end
+        end
+
+        # @param type [Symbol] plugin type
+        # @param name [String, Symbol] plugin identifier
+        # @return [Boolean]
+        def registered?(type, name)
+          validate_type!(type)
+          @plugins[type].key?(name.to_s)
+        end
+
+        # Convenience accessors for each plugin type.
+        def engines = @plugins[:engine]
+        def guis    = @plugins[:gui]
+        def mcps    = @plugins[:mcp]
+
+        # Discover and load all installed plugin gems.
+        #
+        # Scans for `rosett_ai_engine/*/register.rb`, `rosett_ai_gui/*/register.rb`,
+        # and `rosett_ai_mcp/*/register.rb` across all gem load paths.
+        # Each register.rb is expected to call `Registry.register`.
+        def discover!
+          return if @discovered
+
+          discover_type('rosett_ai_engine')
+          discover_type('rosett_ai_gui')
+          discover_type('rosett_ai_mcp')
+          @discovered = true
+        end
+
+        # Reset the registry. Intended for testing only.
+        def reset!
+          @plugins = Hash.new { |h, k| h[k] = {} }
+          @discovered = false
+        end
+
+        private
+
+        def validate_type!(type)
+          return if PLUGIN_TYPES.include?(type)
+
+          raise ArgumentError, "Invalid plugin type: #{type}. Valid: #{PLUGIN_TYPES.join(', ')}"
+        end
+
+        def discover_type(prefix)
+          # 1. Standard gem discovery (works when GEM_PATH matches Ruby ABI)
+          Gem.find_files("#{prefix}/*/register.rb").each do |path|
+            require path
+          rescue LoadError => e
+            RosettAi.logger.warn("Failed to load plugin from #{path}: #{e.message}")
+          end
+
+          # 2. Fallback: version-agnostic scan of embedded gem tree
+          #    Covers Ruby ABI mismatch between embedded Ruby and engine gems
+          discover_embedded_gems(prefix)
+
+          # 3. Custom engine path (dev/testing via RAI_ENGINE_PATH)
+          discover_custom_path(prefix)
+        end
+
+        # Scan `/opt/rosett-ai/embedded/lib/ruby/gems/*/gems/*/lib/` for plugin
+        # register.rb files. Handles Ruby ABI version mismatches between
+        # the embedded Ruby and engine gems built with a different minor version.
+        #
+        # @param prefix [String] plugin namespace prefix (e.g. 'rosett_ai_engine')
+        def discover_embedded_gems(prefix)
+          embedded_gems = Pathname.new('/opt/rosett-ai/embedded/lib/ruby/gems')
+          return unless embedded_gems.directory?
+
+          Dir.glob(embedded_gems.join('*', 'gems', '*', 'lib', prefix, '*', 'register.rb').to_s).each do |path|
+            lib_dir = File.expand_path('../../..', path)
+            $LOAD_PATH.unshift(lib_dir) unless $LOAD_PATH.include?(lib_dir)
+            require path
+          rescue LoadError => e
+            RosettAi.logger.warn("Failed to load embedded plugin from #{path}: #{e.message}")
+          end
+        end
+
+        # Scan directories listed in `RAI_ENGINE_PATH` (colon-separated)
+        # for plugin register.rb files. Useful for development and testing.
+        #
+        # @param prefix [String] plugin namespace prefix (e.g. 'rosett_ai_engine')
+        def discover_custom_path(prefix)
+          custom_path = ENV.fetch('RAI_ENGINE_PATH', nil)
+          return unless custom_path
+
+          custom_path.split(':').each do |dir|
+            Dir.glob(File.join(dir, 'lib', prefix, '*', 'register.rb')).each do |path|
+              lib_dir = File.expand_path('../../..', path)
+              $LOAD_PATH.unshift(lib_dir) unless $LOAD_PATH.include?(lib_dir)
+              require path
+            rescue LoadError => e
+              RosettAi.logger.warn("Failed to load custom plugin from #{path}: #{e.message}")
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rosett_ai/policy/auditor.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Policy
+    # Generates compliance audit reports for the current project.
+    #
+    # Audit results include deny list coverage, protected files,
+    # opt-out markers, and tier hierarchy validation.
+    class Auditor
+      # @param deny_list [DenyList] active deny list
+      # @param protected_files [ProtectedFiles] active protected files
+      # @param opt_out_scanner [OptOutScanner] scanner instance
+      def initialize(deny_list:, protected_files:, opt_out_scanner: OptOutScanner.new)
+        @deny_list = deny_list
+        @protected_files = protected_files
+        @opt_out_scanner = opt_out_scanner
+      end
+
+      # Generates an audit report.
+      #
+      # @param project_files [Array<String>] list of project files to audit
+      # @return [Hash] audit report
+      def audit(project_files: [])
+        denied = project_files.select { |path| @deny_list.denied?(path) }
+        opted_out = @opt_out_scanner.scan(project_files)
+
+        {
+          deny_list_patterns: @deny_list.size,
+          denied_files: denied.size,
+          protected_files: @protected_files.size,
+          opted_out_files: opted_out.size,
+          opted_out_paths: opted_out,
+          compliant: true
+        }
+      end
+    end
+  end
+end