rosett-ai 1.3.3

data/lib/rosett_ai/policy/deny_list.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Policy
+    # Manages glob-based deny list patterns for AI tool access control.
+    #
+    # Deny list patterns prevent AI tools from reading or modifying
+    # sensitive files such as SSH keys, credentials, and secrets.
+    # Patterns are compiled to engine-specific formats during compilation.
+    #
+    # All patterns are sanitized (ANSI/control chars stripped) and
+    # validated (path traversal rejected) on initialization.
+    #
+    # @author hugo
+    # @author claude
+    class DenyList
+      PATH_TRAVERSAL_PATTERN = %r{(?:^|/)\.\./} # matches ../ at start or after /
+
+      attr_reader :patterns
+
+      # @param patterns [Array<String>] glob patterns to deny
+      # @raise [RosettAi::PolicyError] if any pattern contains path traversal
+      def initialize(patterns: [])
+        sanitized = patterns.map { |pat| RosettAi::TextSanitizer.strip_ansi(pat) }
+        validate_patterns!(sanitized)
+        @patterns = sanitized.map(&:freeze).freeze
+      end
+
+      # Tests whether a file path matches any deny pattern.
+      #
+      # @param path [String] relative file path to test
+      # @return [Boolean] true if the path matches any deny pattern
+      def denied?(path)
+        @patterns.any? { |pattern| File.fnmatch?(pattern, path, File::FNM_PATHNAME | File::FNM_DOTMATCH) }
+      end
+
+      # Merges another deny list into this one (union of patterns).
+      #
+      # @param other [DenyList] deny list to merge
+      # @return [DenyList] new deny list with combined patterns
+      def merge(other)
+        self.class.new(patterns: (@patterns + other.patterns).uniq)
+      end
+
+      # @return [Integer] number of patterns
+      def size
+        @patterns.size
+      end
+
+      # @return [Boolean] true if no patterns defined
+      def empty?
+        @patterns.empty?
+      end
+
+      private
+
+      def validate_patterns!(patterns)
+        patterns.each do |pattern|
+          next unless PATH_TRAVERSAL_PATTERN.match?(pattern)
+
+          raise RosettAi::PolicyError,
+                "Deny-list pattern contains path traversal: '#{pattern}'. " \
+                'Patterns must not reference parent directories with ..'
+        end
+      end
+    end
+  end
+end

data/lib/rosett_ai/policy/opt_out_scanner.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Policy
+    # Scans files for AI-MODIFICATION opt-out markers.
+    #
+    # Files containing +# AI-MODIFICATION: disabled+ are added to the
+    # protected files list during compilation.
+    class OptOutScanner
+      MARKER = 'AI-MODIFICATION: disabled'
+
+      # Scans a single file for opt-out markers.
+      #
+      # @param path [String] absolute or relative file path
+      # @return [Boolean] true if the file contains an opt-out marker
+      def opted_out?(path)
+        return false unless File.exist?(path)
+        return false unless File.readable?(path)
+
+        File.foreach(path).any? { |line| line.include?(MARKER) }
+      rescue StandardError
+        false
+      end
+
+      # Scans multiple files and returns those with opt-out markers.
+      #
+      # @param paths [Array<String>] file paths to scan
+      # @return [Array<String>] paths that contain opt-out markers
+      def scan(paths)
+        paths.select { |path| opted_out?(path) }
+      end
+    end
+  end
+end

data/lib/rosett_ai/policy/policy_compiler.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Policy
+    # Compiles policy definitions to engine-specific output.
+    #
+    # Translates deny lists, protected files, and rate limits into
+    # engine-native configuration formats. When a parent policy is
+    # provided, enforces tighten-only inheritance at compile time.
+    #
+    # @author hugo
+    # @author claude
+    class PolicyCompiler
+      # @param deny_list [DenyList] deny list to compile
+      # @param protected_files [ProtectedFiles] protected files to compile
+      # @param parent_deny_list [DenyList, nil] parent policy deny list for scope enforcement
+      def initialize(deny_list:, protected_files:, parent_deny_list: nil)
+        @deny_list = deny_list
+        @protected_files = protected_files
+        @parent_deny_list = parent_deny_list
+      end
+
+      # Compiles policies for a specific engine.
+      #
+      # @param engine [String] target engine name
+      # @return [Hash] with +:settings+ (Hash), +:annotations+ (String), +:warnings+ (Array)
+      def compile(engine:)
+        warnings = []
+        enforce_scope!(warnings)
+        settings = compile_deny_list(engine, warnings)
+        annotations = compile_protected_files(engine)
+
+        { settings: settings, annotations: annotations, warnings: warnings }
+      end
+
+      private
+
+      def enforce_scope!(warnings)
+        return unless @parent_deny_list
+
+        hierarchy = RosettAi::Policy::TierHierarchy.new
+        result = hierarchy.validate_tighten_only(parent: @parent_deny_list, child: @deny_list)
+        return if result[:valid]
+
+        result[:violations].each { |v| warnings << v }
+      end
+
+      def compile_deny_list(engine, warnings)
+        return {} if @deny_list.empty?
+
+        case engine
+        when 'claude'
+          { 'deniedPaths' => @deny_list.patterns }
+        when 'cursor'
+          { 'ignore_patterns' => @deny_list.patterns }
+        when 'agents_md'
+          { 'denied_access' => @deny_list.patterns }
+        else
+          warnings << "Engine '#{engine}' may not support deny list compilation"
+          { 'deny_patterns' => @deny_list.patterns }
+        end
+      end
+
+      def compile_protected_files(engine)
+        return '' if @protected_files.empty?
+
+        case engine
+        when 'agents_md'
+          lines = @protected_files.paths.map { |path| "- `#{path}`: READ-ONLY (AI must not modify)" }
+          "## Protected Files\n\n#{lines.join("\n")}"
+        when 'claude', 'cursor'
+          lines = @protected_files.paths.map { |path| "# Protected (read-only): #{path}" }
+          lines.join("\n")
+        else
+          lines = @protected_files.paths.map { |path| "- #{path} (read-only)" }
+          lines.join("\n")
+        end
+      end
+    end
+  end
+end

data/lib/rosett_ai/policy/protected_files.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Policy
+    # Manages the list of files that AI tools may read but not modify.
+    #
+    # Protected files are compiled to engine-specific read-only annotations.
+    # Human override requires an explicit waiver in the policy configuration.
+    class ProtectedFiles
+      attr_reader :paths
+
+      # @param paths [Array<String>] relative file paths
+      def initialize(paths: [])
+        @paths = paths.map(&:freeze).freeze
+      end
+
+      # Tests whether a file path is protected (read-only for AI).
+      #
+      # @param path [String] relative file path
+      # @return [Boolean] true if the file is protected
+      def protected?(path)
+        @paths.include?(path)
+      end
+
+      # Merges another protected files list (union of paths).
+      #
+      # @param other [ProtectedFiles] protected files to merge
+      # @return [ProtectedFiles] new list with combined paths
+      def merge(other)
+        self.class.new(paths: (@paths + other.paths).uniq)
+      end
+
+      # @return [Integer] number of protected files
+      def size
+        @paths.size
+      end
+
+      # @return [Boolean] true if no files protected
+      def empty?
+        @paths.empty?
+      end
+    end
+  end
+end

data/lib/rosett_ai/policy/tier_hierarchy.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Policy
+    # Enforces tighten-only policy inheritance across organisational tiers.
+    #
+    # Policy hierarchy: org > team > project. Child tiers can add patterns
+    # or restrictions but can never remove patterns set by parent tiers.
+    class TierHierarchy
+      TIERS = ['mandatory', 'advisory', 'informational'].freeze
+      SCOPES = ['org', 'team', 'project'].freeze
+
+      # Validates that a child policy does not loosen a parent policy.
+      #
+      # @param parent [DenyList] parent deny list
+      # @param child [DenyList] child deny list
+      # @return [Hash] with +:valid+ (Boolean) and +:violations+ (Array<String>)
+      def validate_tighten_only(parent:, child:)
+        removed = parent.patterns - child.patterns
+        return { valid: true, violations: [] } if removed.empty?
+
+        violations = removed.map do |pattern|
+          "Cannot remove deny-list pattern from parent policy: #{pattern}"
+        end
+        { valid: false, violations: violations }
+      end
+
+      # Validates that a policy tier is valid.
+      #
+      # @param tier [String] policy tier name
+      # @return [Boolean] true if valid
+      def valid_tier?(tier)
+        TIERS.include?(tier)
+      end
+
+      # Validates that a scope is valid.
+      #
+      # @param scope [String] scope name
+      # @return [Boolean] true if valid
+      def valid_scope?(scope)
+        SCOPES.include?(scope)
+      end
+    end
+  end
+end

data/lib/rosett_ai/policy/validator.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+require 'json_schemer'
+
+module RosettAi
+  module Policy
+    # Validates policy files against the policy JSON Schema.
+    #
+    # Sanitizes all string values (ANSI/control char stripping) before
+    # schema validation to prevent injection via policy definitions.
+    #
+    # @author hugo
+    # @author claude
+    class Validator
+      SCHEMA_PATH = File.expand_path('../../../conf/schemas/policy_schema.json', __dir__)
+
+      # @return [Array<String>] validation errors (empty if valid)
+      def validate(data)
+        sanitized = RosettAi::TextSanitizer.sanitize_for_display(data)
+        schema = JSONSchemer.schema(Pathname.new(SCHEMA_PATH))
+        schema.validate(sanitized).map do |error|
+          "#{error['data_pointer']}: #{error['type']}"
+        end
+      end
+
+      # @return [Boolean] true if data passes schema validation
+      def valid?(data)
+        validate(data).empty?
+      end
+    end
+  end
+end

data/lib/rosett_ai/profiler.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  # Lightweight profiler for CLI command performance measurement.
+  #
+  # Enabled via `RAI_PROFILE=1` environment variable.
+  # Output goes to stderr to preserve piped command compatibility.
+  # Uses monotonic clock for accurate elapsed time measurement.
+  #
+  # @example
+  #   profiler = RosettAi::Profiler.new('compile')
+  #   profiler.measure('load') { load_files }
+  #   profiler.measure('validate') { validate_files }
+  #   profiler.report
+  #
+  # @author hugo
+  # @author claude
+  class Profiler
+    # @return [Boolean] true if profiling is enabled
+    def self.enabled?
+      ENV['RAI_PROFILE'] == '1'
+    end
+
+    # @return [Profiler] real profiler if enabled, no-op otherwise
+    def self.for(command_name)
+      enabled? ? new(command_name) : NullProfiler.new
+    end
+
+    attr_reader :command_name, :phases
+
+    # @param command_name [String]
+    def initialize(command_name)
+      @command_name = command_name
+      @phases = []
+      @start_time = monotonic_now
+    end
+
+    # Measure a named phase.
+    #
+    # @param phase_name [String]
+    # @return [Object] block return value
+    def measure(phase_name)
+      start = monotonic_now
+      result = yield
+      elapsed = monotonic_now - start
+      @phases << { name: phase_name, elapsed_ms: (elapsed * 1000).round(1) }
+      result
+    end
+
+    # Print profiling summary to stderr.
+    #
+    # @return [void]
+    def report
+      total = (monotonic_now - @start_time) * 1000
+      parts = @phases.map { |phase| "#{phase[:name]}: #{phase[:elapsed_ms]}ms" }
+      parts << "total: #{total.round(1)}ms"
+      warn "[profile] #{parts.join(' | ')}"
+    end
+
+    private
+
+    def monotonic_now
+      Process.clock_gettime(Process::CLOCK_MONOTONIC)
+    end
+
+    # No-op profiler when RAI_PROFILE is not set.
+    # Zero overhead — all methods are empty.
+    class NullProfiler
+      def measure(_phase_name)
+        yield
+      end
+
+      def report; end
+    end
+  end
+end

data/lib/rosett_ai/project/drift_detector.rb

@@ -0,0 +1,126 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+require 'yaml'
+require 'digest'
+
+module RosettAi
+  module Project
+    # Detects configuration drift in rosett-ai-managed projects.
+    #
+    # Supports two drift types:
+    # - Forward drift: source YAML differs from compiled native config
+    # - Template drift: project config differs from template baseline
+    #
+    # @author hugo
+    # @author claude
+    class DriftDetector
+      DRIFT_TYPES = ['forward', 'template'].freeze
+
+      # @param project_root [Pathname] root directory of the project
+      def initialize(project_root:)
+        @project_root = project_root
+        @project_dir = project_root.join('.rosett-ai')
+      end
+
+      # Detects drift of the specified type.
+      #
+      # @param type [String, nil] 'forward', 'template', or nil (both)
+      # @return [Hash] drift results with :forward and/or :template keys
+      def detect(type: nil)
+        results = {}
+
+        results[:forward] = detect_forward_drift if type.nil? || type == 'forward'
+
+        results[:template] = detect_template_drift if type.nil? || type == 'template'
+
+        results
+      end
+
+      # @return [Boolean] true if any drift detected
+      def drifted?(type: nil)
+        results = detect(type: type)
+        results.values.any?(&:any?)
+      end
+
+      private
+
+      def detect_forward_drift
+        drifts = []
+        source_dir = @project_dir.join('conf', 'behaviour')
+        return drifts unless source_dir.directory?
+
+        Dir.glob(source_dir.join('*.yml').to_s).each do |src_path|
+          src = Pathname.new(src_path)
+          compiled_name = File.basename(src_path, '.yml')
+          compiled = find_compiled_file(compiled_name)
+          next unless compiled&.exist?
+
+          src_hash = Digest::SHA256.file(src.to_s).hexdigest
+          compiled_hash = Digest::SHA256.file(compiled.to_s).hexdigest
+
+          next if src_hash == compiled_hash
+
+          drifts << {
+            file: src.relative_path_from(@project_root).to_s,
+            compiled: compiled.relative_path_from(@project_root).to_s,
+            type: 'forward'
+          }
+        end
+
+        drifts
+      end
+
+      def detect_template_drift
+        drifts = []
+        origin_file = @project_dir.join('.template_origin.yml')
+        return drifts unless origin_file.exist?
+
+        template_dir = resolve_template_dir(origin_file)
+        return drifts unless template_dir&.directory?
+
+        collect_template_drifts(template_dir, drifts)
+      end
+
+      def resolve_template_dir(origin_file)
+        origin = YAML.safe_load(origin_file.read)
+        RosettAi.root.join(TemplateApplier::TEMPLATES_DIR, origin['template'])
+      end
+
+      def collect_template_drifts(template_dir, drifts)
+        Dir.glob(template_dir.join('**', '*').to_s).each do |tmpl_path|
+          tmpl = Pathname.new(tmpl_path)
+          next if tmpl.directory?
+
+          check_template_file_drift(tmpl, template_dir, drifts)
+        end
+
+        drifts
+      end
+
+      def check_template_file_drift(tmpl, template_dir, drifts)
+        relative = tmpl.relative_path_from(template_dir)
+        project_file = @project_dir.join(relative)
+        return unless project_file.exist?
+        return if Digest::SHA256.file(tmpl.to_s).hexdigest == Digest::SHA256.file(project_file.to_s).hexdigest
+
+        drifts << {
+          file: project_file.relative_path_from(@project_root).to_s,
+          template: relative.to_s,
+          type: 'template'
+        }
+      end
+
+      def find_compiled_file(name)
+        # Check common compiled output locations
+        candidates = [
+          @project_root.join('.claude', 'rules', "#{name}.md"),
+          @project_root.join('rules', "#{name}.md")
+        ]
+        candidates.find(&:exist?)
+      end
+    end
+  end
+end

data/lib/rosett_ai/project/manager.rb

@@ -0,0 +1,115 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+require 'yaml'
+require_relative 'template_applier'
+require_relative 'drift_detector'
+require_relative 'sync_manager'
+
+module RosettAi
+  module Project
+    # High-level project lifecycle manager.
+    #
+    # Orchestrates template application, drift detection, upstream sync,
+    # and project health reporting. Delegates to specialised classes.
+    #
+    # @author hugo
+    # @author claude
+    class Manager
+      # @param project_root [Pathname] root directory of the project
+      def initialize(project_root:)
+        @project_root = project_root
+        @project_dir = project_root.join('.rosett-ai')
+      end
+
+      # Returns project metadata and health status.
+      #
+      # @return [Hash] project info including name, engine, template, behaviours
+      def info
+        validate_project!
+
+        config = load_project_config
+        origin = load_template_origin
+
+        {
+          project_name: config['project_name'] || File.basename(@project_root),
+          default_engine: config['default_engine'] || 'generic',
+          template: origin&.fetch('template', nil),
+          template_applied_at: origin&.fetch('applied_at', nil),
+          behaviours: count_behaviours,
+          designs: count_designs,
+          project_root: @project_root.to_s,
+          project_dir: @project_dir.to_s
+        }
+      end
+
+      # Returns comprehensive project status.
+      #
+      # @return [Hash] status with :info, :drift, :health
+      def status
+        project_info = info
+        drift = DriftDetector.new(project_root: @project_root)
+        drift_results = drift.detect
+
+        {
+          info: project_info,
+          drift: drift_results,
+          health: compute_health(project_info, drift_results)
+        }
+      end
+
+      private
+
+      def validate_project!
+        return if @project_dir.directory?
+
+        raise RosettAi::ProjectError,
+              'Not inside an rai project. Run rai init --project first.'
+      end
+
+      def load_project_config
+        config_path = @project_dir.join('config.yml')
+        return {} unless config_path.exist?
+
+        YAML.safe_load(config_path.read) || {}
+      end
+
+      def load_template_origin
+        origin_path = @project_dir.join('.template_origin.yml')
+        return nil unless origin_path.exist?
+
+        YAML.safe_load(origin_path.read)
+      end
+
+      def count_behaviours
+        dir = @project_dir.join('conf', 'behaviour')
+        return 0 unless dir.directory?
+
+        Dir.glob(dir.join('*.yml').to_s).size
+      end
+
+      def count_designs
+        dir = @project_dir.join('conf', 'design')
+        return 0 unless dir.directory?
+
+        Dir.glob(dir.join('*.yml').to_s).size
+      end
+
+      def compute_health(project_info, drift_results)
+        issues = []
+        issues << 'No template applied' unless project_info[:template]
+        issues << 'No behaviours defined' if project_info[:behaviours].zero?
+
+        forward_drift = drift_results.fetch(:forward, [])
+        template_drift = drift_results.fetch(:template, [])
+
+        issues << "Forward drift detected (#{forward_drift.size} files)" unless forward_drift.empty?
+        issues << "Template drift detected (#{template_drift.size} files)" unless template_drift.empty?
+
+        { healthy: issues.empty?, issues: issues }
+      end
+    end
+  end
+end