rosett-ai 1.3.3

data/lib/rosett_ai/retrofit/parsers/agents_md_parser.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Retrofit
+    module Parsers
+      # Retrofit parser for AGENTS.md files.
+      #
+      # Discovers and parses AGENTS.md in the project root into
+      # a structured Rosett-AI YAML representation.
+      #
+      # @author hugo
+      # @author claude
+      class AgentsMdParser < BaseParser
+        def engine_name
+          'agents_md'
+        end
+
+        def discover
+          project_root = Pathname.new(ENV.fetch('RAI_ORIGINAL_PWD', Dir.pwd))
+          agents_md = project_root.join('AGENTS.md')
+
+          return [agents_md] if agents_md.exist? && safe_path?(agents_md)
+
+          []
+        end
+
+        def parse(path)
+          validate_path!(path)
+          content = File.read(path)
+
+          {
+            data: { 'agents_md_content' => content },
+            unknown_keys: [],
+            source_file: path.to_s,
+            scope: 'project'
+          }
+        end
+
+        private
+
+        def validate_path!(path)
+          raise RosettAi::RetrofitError, "Path not safe: #{path}" unless safe_path?(path)
+        end
+      end
+    end
+  end
+end

data/lib/rosett_ai/retrofit/parsers/claude_parser.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+require 'json'
+
+module RosettAi
+  module Retrofit
+    module Parsers
+      # Retrofit parser for Claude Code configuration files.
+      #
+      # Discovers and parses ~/.claude/settings.json and project-level
+      # .claude/settings.json into Rosett-AI YAML structure.
+      #
+      # @author hugo
+      # @author claude
+      class ClaudeParser < BaseParser
+        KNOWN_KEYS = [
+          'permissions', 'allowedTools', 'deniedTools', 'trustedTools', 'env', 'hooks', 'mcpServers', 'customApiKeyResponses', 'contextProviders', 'preferences'
+        ].freeze
+
+        def engine_name
+          'claude'
+        end
+
+        def discover
+          paths = []
+          global = Pathname.new(Dir.home).join('.claude', 'settings.json')
+          paths << global if global.exist? && safe_path?(global)
+
+          local = Pathname.new(ENV.fetch('RAI_ORIGINAL_PWD', Dir.pwd)).join('.claude', 'settings.json')
+          paths << local if local.exist? && safe_path?(local) && local != global
+
+          paths
+        end
+
+        def parse(path)
+          validate_path!(path)
+          content = File.read(path)
+          data = JSON.parse(content)
+
+          unknown_keys = data.keys.reject { |key| KNOWN_KEYS.include?(key) }
+
+          {
+            data: data,
+            unknown_keys: unknown_keys.map { |key| sanitize(key) },
+            source_file: path.to_s,
+            scope: detect_scope(path)
+          }
+        end
+
+        private
+
+        def validate_path!(path)
+          raise RosettAi::RetrofitError, "Path not safe: #{path}" unless safe_path?(path)
+        end
+
+        def detect_scope(path)
+          if path.to_s.start_with?(Dir.home)
+            'user'
+          else
+            'project'
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rosett_ai/retrofit/parsers/cursor_parser.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+require 'json'
+
+module RosettAi
+  module Retrofit
+    module Parsers
+      # Retrofit parser for Cursor configuration files.
+      #
+      # Discovers and parses .cursor/settings.json and .cursorrules
+      # into Rosett-AI YAML structure.
+      #
+      # @author hugo
+      # @author claude
+      class CursorParser < BaseParser
+        KNOWN_KEYS = [
+          'rules', 'model', 'temperature', 'maxTokens', 'contextFiles', 'ignoreFiles'
+        ].freeze
+
+        def engine_name
+          'cursor'
+        end
+
+        def discover
+          paths = []
+          project_root = Pathname.new(ENV.fetch('RAI_ORIGINAL_PWD', Dir.pwd))
+
+          settings = project_root.join('.cursor', 'settings.json')
+          paths << settings if settings.exist? && safe_path?(settings)
+
+          rules = project_root.join('.cursorrules')
+          paths << rules if rules.exist? && safe_path?(rules)
+
+          paths
+        end
+
+        def parse(path)
+          validate_path!(path)
+
+          if path.extname == '.json'
+            parse_json(path)
+          else
+            parse_rules(path)
+          end
+        end
+
+        private
+
+        def validate_path!(path)
+          raise RosettAi::RetrofitError, "Path not safe: #{path}" unless safe_path?(path)
+        end
+
+        def parse_json(path)
+          content = File.read(path)
+          data = JSON.parse(content)
+          unknown_keys = data.keys.reject { |key| KNOWN_KEYS.include?(key) }
+
+          {
+            data: data,
+            unknown_keys: unknown_keys.map { |key| sanitize(key) },
+            source_file: path.to_s,
+            scope: 'project'
+          }
+        end
+
+        def parse_rules(path)
+          content = File.read(path)
+
+          {
+            data: { 'rules' => content },
+            unknown_keys: [],
+            source_file: path.to_s,
+            scope: 'project'
+          }
+        end
+      end
+    end
+  end
+end

data/lib/rosett_ai/retrofit/round_trip_validator.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Retrofit
+    # Validates that retrofit output round-trips through compilation.
+    #
+    # Compares the original native config with the result of compiling
+    # the retrofitted YAML to verify semantic equivalence.
+    #
+    # @author hugo
+    # @author claude
+    class RoundTripValidator
+      # @param original [Hash] parsed original native config
+      # @param compiled [Hash] parsed output of compiling retrofitted YAML
+      # @return [Hash] validation result with :valid and :differences keys
+      def validate(original:, compiled:)
+        differences = find_differences(original, compiled)
+
+        {
+          valid: differences.empty?,
+          differences: differences
+        }
+      end
+
+      private
+
+      def find_differences(original, compiled, path = '')
+        diffs = []
+        compare_original_keys(original, compiled, path, diffs)
+        find_added_keys(original, compiled, path, diffs)
+        diffs
+      end
+
+      def compare_original_keys(original, compiled, path, diffs)
+        original.each do |key, orig_val|
+          full_path = build_path(path, key)
+          comp_val = compiled[key]
+
+          if comp_val.nil?
+            diffs << { path: full_path, type: 'missing', original: orig_val }
+          elsif orig_val.is_a?(Hash) && comp_val.is_a?(Hash)
+            diffs.concat(find_differences(orig_val, comp_val, full_path))
+          elsif orig_val != comp_val
+            diffs << { path: full_path, type: 'changed', original: orig_val, compiled: comp_val }
+          end
+        end
+      end
+
+      def find_added_keys(original, compiled, path, diffs)
+        compiled.each_key do |key|
+          next if original.key?(key)
+
+          diffs << { path: build_path(path, key), type: 'added', compiled: compiled[key] }
+        end
+      end
+
+      def build_path(path, key)
+        path.empty? ? key.to_s : "#{path}.#{key}"
+      end
+    end
+  end
+end

data/lib/rosett_ai/retrofit/scanner.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Retrofit
+    # MCP-facing facade for retrofit operations.
+    #
+    # Delegates to {Engine} for the actual retrofit logic, providing
+    # the simplified interface expected by {Mcp::Tools::RetrofitTool}.
+    #
+    # @author hugo
+    # @author claude
+    class Scanner
+      def initialize(output_dir: Pathname.new(Dir.pwd))
+        @output_dir = output_dir
+      end
+
+      # @return [Array<String>] available parser/engine names
+      def available_parsers
+        Engine.available_engines
+      end
+
+      # Scans for native AI tool configs without writing files.
+      #
+      # @return [Array<Hash>] scan findings
+      def scan
+        engine = Engine.new(output_dir: @output_dir)
+        engine.simulate[:generated]
+      end
+
+      # Converts native configs to Rosett-AI YAML.
+      #
+      # @param engine [String, nil] specific engine name
+      # @param options [Hash] :dry_run for simulation mode
+      # @return [Hash] with :converted and :files keys
+      def convert(engine: nil, options: {})
+        dry_run = options.fetch(:dry_run, true)
+        engines = engine ? [engine] : nil
+        retrofitter = Engine.new(output_dir: @output_dir, engines: engines)
+        result = dry_run ? retrofitter.simulate : retrofitter.retrofit
+        { converted: result[:generated].size, files: result[:generated] }
+      end
+    end
+  end
+end

data/lib/rosett_ai/retrofit/secret_detector.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module Retrofit
+    # Detects sensitive values in parsed configuration data and replaces
+    # them with ${secret:env:NAME} references.
+    #
+    # Recognises API keys, tokens, passwords, and other secrets by
+    # key name patterns and value heuristics (length, entropy, prefixes).
+    #
+    # @author hugo
+    # @author claude
+    class SecretDetector
+      SENSITIVE_KEY_PATTERNS = [
+        /api[_-]?key/i,
+        /secret/i,
+        /token/i,
+        /password/i,
+        /credential/i,
+        /auth/i,
+        /private[_-]?key/i
+      ].freeze
+
+      SECRET_VALUE_PREFIXES = ['sk-', 'pk-', 'ghp_', 'gho_', 'ghs_', 'github_pat_', 'xoxb-', 'xoxp-'].freeze
+
+      MIN_SECRET_LENGTH = 20
+
+      # @param warnings [Array<String>] mutable array for warning messages
+      def initialize(warnings: [])
+        @warnings = warnings
+      end
+
+      # Scans a hash and replaces sensitive values with secret references.
+      #
+      # @param data [Hash] parsed configuration data
+      # @param prefix [String] key path prefix for env var naming
+      # @return [Hash] data with secrets replaced
+      def redact(data, prefix: '')
+        data.each_with_object({}) do |(key, value), result|
+          full_key = prefix.empty? ? key.to_s : "#{prefix}_#{key}"
+          result[key] = redact_value(key.to_s, value, full_key)
+        end
+      end
+
+      private
+
+      def redact_value(key, value, full_key)
+        case value
+        when Hash
+          redact(value, prefix: full_key)
+        when Array
+          value.map.with_index { |item, idx| redact_value("#{key}_#{idx}", item, "#{full_key}_#{idx}") }
+        when String
+          maybe_redact_string(key, value, full_key)
+        else
+          value
+        end
+      end
+
+      def maybe_redact_string(key, value, full_key)
+        return value unless sensitive?(key, value)
+
+        env_name = full_key.upcase.gsub(/[^A-Z0-9]/, '_').squeeze('_')
+        @warnings << "Sensitive value detected for '#{key}' — replaced with secret reference. " \
+                     "Set #{env_name} in your environment."
+        "${secret:env:#{env_name}}"
+      end
+
+      def sensitive?(key, value)
+        return true if SENSITIVE_KEY_PATTERNS.any? { |pattern| key.match?(pattern) } && value.length >= 8
+        return true if SECRET_VALUE_PREFIXES.any? { |prefix| value.start_with?(prefix) }
+        return true if value.length >= MIN_SECRET_LENGTH && high_entropy?(value)
+
+        false
+      end
+
+      def high_entropy?(value)
+        chars = value.chars
+        unique_ratio = chars.uniq.size.to_f / chars.size
+        unique_ratio > 0.6 && value.match?(/[a-zA-Z]/) && value.match?(/[0-9]/)
+      end
+    end
+  end
+end

data/lib/rosett_ai/secrets_resolver.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  # Resolves secrets through an ordered fallback chain.
+  # Resolution order: ENV variable > secrets file (0600).
+  # System keyring support planned for GUI phase (P3).
+  module SecretsResolver
+    SAFE_PERMISSIONS = 0o600
+
+    module_function
+
+    # Resolves a secret through the fallback chain (ENV > secrets file).
+    #
+    # @param env_key [String] the environment variable name to look up
+    # @return [String] the resolved secret value
+    # @raise [RosettAi::Error] if the key is not found in any source
+    def resolve(env_key)
+      from_env(env_key) || from_secrets_file(env_key) || raise_missing(env_key)
+    end
+
+    # Reads a secret from the environment.
+    #
+    # @param env_key [String] the environment variable name
+    # @return [String, nil] the value, or nil if unset or empty
+    def from_env(env_key)
+      value = ENV.fetch(env_key, nil)
+      value unless value.nil? || value.empty?
+    end
+
+    # Reads a secret from the secrets YAML file.
+    #
+    # @param env_key [String] the key to look up in the secrets file
+    # @return [String, nil] the value, or nil if the file is missing or key absent
+    def from_secrets_file(env_key)
+      secrets_path = RosettAi.paths.secrets_file.to_s
+      return nil unless File.exist?(secrets_path)
+
+      validate_permissions!(secrets_path)
+      data = RosettAi::YamlLoader.load_file(secrets_path)
+      return nil unless data.is_a?(Hash)
+
+      data[env_key]
+    end
+
+    # Validates that the file has strict 0600 permissions.
+    #
+    # @param path [String] absolute path to the file
+    # @return [void]
+    # @raise [RosettAi::Error] if the file permissions are not 0600
+    def validate_permissions!(path)
+      mode = File.stat(path).mode & 0o777
+      return if mode == SAFE_PERMISSIONS
+
+      raise RosettAi::Error,
+            "Secrets file #{path} has insecure permissions #{format('%04o', mode)}. " \
+            "Expected 0600. Fix with: chmod 600 #{path}"
+    end
+
+    def raise_missing(env_key)
+      secrets_path = RosettAi.paths.secrets_file
+      raise RosettAi::Error, <<~MSG.chomp
+        #{env_key} not found. Set it via one of:
+          1. export #{env_key}=<value>
+          2. Add '#{env_key}: <value>' to #{secrets_path} (chmod 600)
+      MSG
+    end
+  end
+end

data/lib/rosett_ai/smart_feedback/suggester.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module SmartFeedback
+    # Provides "Did you mean?" suggestions using Levenshtein distance.
+    #
+    # Matches mistyped commands, subcommands, and flags against known
+    # candidates. Returns up to MAX_SUGGESTIONS closest matches within
+    # the distance threshold.
+    #
+    # @author hugo
+    # @author claude
+    class Suggester
+      MAX_SUGGESTIONS = 3
+      COMMAND_THRESHOLD = 2
+      FLAG_THRESHOLD = 3
+
+      # Find suggestion matches for a given input.
+      #
+      # @param input [String] the mistyped word
+      # @param candidates [Array<String>] valid options
+      # @param threshold [Integer] maximum edit distance
+      # @return [Array<String>] sorted suggestions (closest first)
+      def suggest(input, candidates, threshold: COMMAND_THRESHOLD)
+        input = input.to_s.downcase
+        matches = candidates.filter_map do |candidate|
+          candidate = candidate.to_s
+          dist = levenshtein(input, candidate.downcase)
+          [candidate, dist] if dist <= threshold
+        end
+
+        matches.sort_by(&:last)
+          .first(MAX_SUGGESTIONS)
+          .map(&:first)
+      end
+
+      # Format suggestion message.
+      #
+      # @param type [String] 'command', 'subcommand', or 'option'
+      # @param input [String] the mistyped word
+      # @param suggestions [Array<String>] suggested alternatives
+      # @return [String] formatted message
+      def format_message(type, input, suggestions)
+        if suggestions.empty?
+          "Unknown #{type} '#{input}'. Run `raictl help` for available #{type}s."
+        elsif suggestions.size == 1
+          "Unknown #{type} '#{input}'. Did you mean `#{suggestions.first}`?"
+        else
+          list = suggestions.map { |s| "`#{s}`" }.join(', ')
+          "Unknown #{type} '#{input}'. Did you mean one of: #{list}?"
+        end
+      end
+
+      private
+
+      # Compute Levenshtein edit distance between two strings.
+      #
+      # @param str_a [String] first string
+      # @param str_b [String] second string
+      # @return [Integer] edit distance
+      def levenshtein(str_a, str_b) # rubocop:disable Metrics/AbcSize -- Wagner-Fischer algorithm is inherently branchy
+        return str_b.length if str_a.empty?
+        return str_a.length if str_b.empty?
+
+        matrix = Array.new(str_a.length + 1) { |i| i }
+        (1..str_b.length).each do |j|
+          prev = matrix[0]
+          matrix[0] = j
+          (1..str_a.length).each do |i|
+            temp = matrix[i]
+            cost = str_a[i - 1] == str_b[j - 1] ? 0 : 1
+            matrix[i] = [matrix[i] + 1, matrix[i - 1] + 1, prev + cost].min
+            prev = temp
+          end
+        end
+        matrix[str_a.length]
+      end
+    end
+  end
+end

data/lib/rosett_ai/smart_feedback/thor_middleware.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Hugo Antonio Sepulveda Manriquez / NeatNerds
+
+module RosettAi
+  module SmartFeedback
+    # Middleware that intercepts Thor::UndefinedCommandError and
+    # Thor::UnknownArgumentError to provide "Did you mean?" suggestions.
+    #
+    # Integrates with Thor's error handling to enhance error messages
+    # without replacing the standard error flow.
+    #
+    # @author hugo
+    # @author claude
+    module ThorMiddleware
+      # Enhance a Thor CLI class with smart feedback.
+      #
+      # @param cli_class [Class] the Thor CLI class to enhance
+      def self.install(cli_class)
+        cli_class.singleton_class.prepend(CommandDispatch)
+      end
+
+      # Prepended module that wraps Thor command dispatch with smart feedback.
+      module CommandDispatch
+        def dispatch(meth, given_args, given_opts, config)
+          super
+        rescue ::Thor::UndefinedCommandError => e
+          handle_unknown_command(e, given_args)
+        rescue ::Thor::UnknownArgumentError => e
+          handle_unknown_argument(e)
+        end
+
+        private
+
+        def handle_unknown_command(error, given_args)
+          command_name = given_args&.first.to_s
+          candidates = all_commands.keys.reject { |k| k == 'help' }
+          suggester = Suggester.new
+          suggestions = suggester.suggest(command_name, candidates)
+          message = suggester.format_message('command', command_name, suggestions)
+          raise ::Thor::Error, message
+        rescue ::Thor::Error
+          raise
+        rescue StandardError
+          raise error
+        end
+
+        def handle_unknown_argument(error)
+          msg = error.message
+          flag_match = msg.match(/Unknown switches ['"]([^'"]+)['"]/) ||
+                       msg.match(/could not be found.*['"]([^'"]+)['"]/)
+
+          raise error unless flag_match
+
+          flag = flag_match[1]
+          suggester = Suggester.new
+          suggestions = suggester.suggest(
+            flag.delete_prefix('--'),
+            available_flags,
+            threshold: Suggester::FLAG_THRESHOLD
+          )
+
+          raise error if suggestions.empty?
+
+          message = suggester.format_message('option', flag, suggestions.map { |s| "--#{s}" })
+          raise ::Thor::Error, message
+        rescue ::Thor::Error
+          raise
+        rescue StandardError
+          raise error
+        end
+
+        def available_flags
+          all_commands.each_value.flat_map do |cmd|
+            next [] unless cmd.respond_to?(:options) && cmd.options
+
+            cmd.options.keys.map(&:to_s)
+          end.uniq
+        end
+      end
+    end
+  end
+end