@complior/engine 0.9.0 → 0.9.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +7 -9
- package/.well-known/ai-compliance.json +0 -16
- package/COMPLIANCE.md +0 -64
- package/engine.log +0 -7
- package/vitest.config.ts +0 -9
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@complior/engine",
|
|
3
|
-
"version": "0.9.
|
|
3
|
+
"version": "0.9.1",
|
|
4
4
|
"type": "module",
|
|
5
5
|
"main": "src/index.ts",
|
|
6
6
|
"description": "AI Act Compliance Engine — deterministic scanner, auto-fixer, reporter, and MCP server for EU AI Act. Powers the Complior CLI daemon.",
|
|
@@ -39,6 +39,11 @@
|
|
|
39
39
|
"regulation",
|
|
40
40
|
"agent-passport"
|
|
41
41
|
],
|
|
42
|
+
"files": [
|
|
43
|
+
"src/",
|
|
44
|
+
"data/",
|
|
45
|
+
"tsconfig.json"
|
|
46
|
+
],
|
|
42
47
|
"engines": {
|
|
43
48
|
"node": ">=22"
|
|
44
49
|
},
|
|
@@ -52,22 +57,15 @@
|
|
|
52
57
|
"@ai-sdk/anthropic": "^2.0.65",
|
|
53
58
|
"@ai-sdk/openai": "^2.0.91",
|
|
54
59
|
"@hono/node-server": "^1.19.10",
|
|
55
|
-
"@modelcontextprotocol/sdk": "^1.26.0",
|
|
56
60
|
"ai": "^5.0.135",
|
|
57
|
-
"better-sqlite3": "^11.0.0",
|
|
58
61
|
"chokidar": "^4.0.0",
|
|
59
|
-
"cosmiconfig": "^9.0.0",
|
|
60
62
|
"hono": "^4.12.7",
|
|
61
|
-
"p-queue": "^8.0.0",
|
|
62
|
-
"pdfkit": "^0.17.2",
|
|
63
63
|
"simple-git": "^3.27.0",
|
|
64
|
-
"tsx": "^4.21.0",
|
|
65
64
|
"zod": "^3.23.0"
|
|
66
65
|
},
|
|
67
66
|
"devDependencies": {
|
|
68
|
-
"@types/better-sqlite3": "^7.6.0",
|
|
69
67
|
"@types/node": "^22.0.0",
|
|
70
|
-
"
|
|
68
|
+
"tsx": "^4.21.0",
|
|
71
69
|
"typescript": "^5.7.0",
|
|
72
70
|
"vitest": "^3.0.0"
|
|
73
71
|
}
|
|
@@ -1,16 +0,0 @@
|
|
|
1
|
-
{
|
|
2
|
-
"version": "1.0",
|
|
3
|
-
"scanner": "complior/1.0.0",
|
|
4
|
-
"scannedAt": "[SCAN_DATE]",
|
|
5
|
-
"organization": "[TO BE SET]",
|
|
6
|
-
"ai_systems": [
|
|
7
|
-
{
|
|
8
|
-
"name": "[TO BE SET]",
|
|
9
|
-
"provider": "[TO BE SET]",
|
|
10
|
-
"risk_level": "[TO BE SET]",
|
|
11
|
-
"compliance_score": 0
|
|
12
|
-
}
|
|
13
|
-
],
|
|
14
|
-
"jurisdiction": "EU",
|
|
15
|
-
"regulation": "EU AI Act (Regulation (EU) 2024/1689)"
|
|
16
|
-
}
|
package/COMPLIANCE.md
DELETED
|
@@ -1,64 +0,0 @@
|
|
|
1
|
-
# Compliance Report
|
|
2
|
-
|
|
3
|
-
> Generated by Complior v1.0.0 on 2026-03-15T18:52:53.383Z
|
|
4
|
-
|
|
5
|
-
## Score
|
|
6
|
-
|
|
7
|
-
| Metric | Value |
|
|
8
|
-
|--------|-------|
|
|
9
|
-
| Total Score | **22.18%** |
|
|
10
|
-
| Zone | red |
|
|
11
|
-
| Checks | 93 total, 56 passed, 36 failed |
|
|
12
|
-
|
|
13
|
-
## Findings Summary
|
|
14
|
-
|
|
15
|
-
| Check ID | Severity | Message |
|
|
16
|
-
|----------|----------|---------|
|
|
17
|
-
| l3-banned-emotion-recognition | critical | Art. 5 REVIEW: "emotion-recognition" detected — Emotion recognition. Prohibited under Art. 5(1)(f) when: Infers emotions in workplace or educational settings, except for medical or safety purposes. Verify: Is this used to detect emotions of employees or students? (Medical/safety use is exempt) |
|
|
18
|
-
| cross-permission-passport-mismatch | critical | 14 undeclared permission(s) with unwrapped LLM calls — compounding governance failure per Art. 26(4) |
|
|
19
|
-
| undeclared-permission | high | Tool 'kb_search' (langchain) used in code but not declared in Agent Passport — Art. 26(4) |
|
|
20
|
-
| undeclared-permission | high | Tool 'ticket_history' (langchain) used in code but not declared in Agent Passport — Art. 26(4) |
|
|
21
|
-
| undeclared-permission | high | Tool 'kb_search' (langchain) used in code but not declared in Agent Passport — Art. 26(4) |
|
|
22
|
-
| undeclared-permission | high | Tool 'ticket_history' (langchain) used in code but not declared in Agent Passport — Art. 26(4) |
|
|
23
|
-
| undeclared-permission | high | Tool 'kb_search' (langchain) used in code but not declared in Agent Passport — Art. 26(4) |
|
|
24
|
-
| undeclared-permission | high | Tool 'ticket_history' (langchain) used in code but not declared in Agent Passport — Art. 26(4) |
|
|
25
|
-
| undeclared-permission | high | Tool 'kb_search' (langchain) used in code but not declared in Agent Passport — Art. 26(4) |
|
|
26
|
-
| undeclared-permission | high | Tool 'ticket_history' (langchain) used in code but not declared in Agent Passport — Art. 26(4) |
|
|
27
|
-
| undeclared-permission | high | Tool 'kb_search' (langchain) used in code but not declared in Agent Passport — Art. 26(4) |
|
|
28
|
-
| undeclared-permission | high | Tool 'ticket_history' (langchain) used in code but not declared in Agent Passport — Art. 26(4) |
|
|
29
|
-
| undeclared-permission | high | Tool 'kb_search' (langchain) used in code but not declared in Agent Passport — Art. 26(4) |
|
|
30
|
-
| undeclared-permission | high | Tool 'ticket_history' (langchain) used in code but not declared in Agent Passport — Art. 26(4) |
|
|
31
|
-
| undeclared-permission | high | Tool 'kb_search' (langchain) used in code but not declared in Agent Passport — Art. 26(4) |
|
|
32
|
-
| undeclared-permission | high | Tool 'ticket_history' (langchain) used in code but not declared in Agent Passport — Art. 26(4) |
|
|
33
|
-
| art5-screening | high | No art. 5 screening document found (Art. 5) |
|
|
34
|
-
| technical-documentation | high | No technical documentation found (Art. 11) |
|
|
35
|
-
| declaration-of-conformity | high | No declaration of conformity found (Art. 47) |
|
|
36
|
-
| risk-management | high | No risk management documentation found (Art. 9) |
|
|
37
|
-
| ai-literacy | medium | No AI literacy policy or training documentation found (Art. 4) |
|
|
38
|
-
| incident-report | medium | No incident report template found (Art. 73) |
|
|
39
|
-
| monitoring-policy | medium | No monitoring policy found (Art. 26) |
|
|
40
|
-
| data-governance | medium | No data governance documentation found (Art. 10) |
|
|
41
|
-
| qms | medium | No quality management system found (Art. 17) |
|
|
42
|
-
| instructions-for-use | medium | No instructions for use found (Art. 13) |
|
|
43
|
-
| l4-bare-llm | medium | WARNING: Anthropic bare API call in src/chat/anthropic.ts:8 — eu-ai-act-OBL-015 Art. 50(1) |
|
|
44
|
-
| l4-bare-llm | medium | WARNING: OpenAI bare API call in src/chat/handler.ts:11 — eu-ai-act-OBL-015 Art. 50(1) |
|
|
45
|
-
| l4-security-risk | medium | WARNING: Unsafe eval() with user input in src/screening/hr-filter.ts:16 — eu-ai-act-OBL-008 Art. 15(4) |
|
|
46
|
-
| l4-security-risk | medium | WARNING: Unsafe eval() with user input in src/security/unsafe-eval.ts:11 — eu-ai-act-OBL-008 Art. 15(4) |
|
|
47
|
-
| l4-security-risk | medium | WARNING: Unsafe pickle deserialization in src/security/unsafe-pickle.py:14 — eu-ai-act-OBL-008 Art. 15(4) |
|
|
48
|
-
| cross-banned-with-wrapper | medium | Prohibited package detected but compliance controls (disclosure, oversight, kill-switch) are present. Review whether usage falls under an Art. 5 exception. |
|
|
49
|
-
| cross-logging-no-retention | medium | AI logging implemented in code but no log retention configuration found. Art. 12 requires log retention >= 180 days. |
|
|
50
|
-
| l3-missing-bias-testing | low | AI SDKs detected but no bias testing library found. Consider adding fairlearn, aif360, or aequitas. |
|
|
51
|
-
| l3-log-retention | low | docker-compose.yml: Logging configured but no retention policy found. Ensure >= 180 days retention (Art. 12). |
|
|
52
|
-
| cross-kill-switch-no-test | low | AI kill switch pattern found in code but no automated tests detected for it. Safety mechanisms should be tested. |
|
|
53
|
-
|
|
54
|
-
## Top Issues
|
|
55
|
-
|
|
56
|
-
1. **[CRITICAL]** l3-banned-emotion-recognition: Art. 5 REVIEW: "emotion-recognition" detected — Emotion recognition. Prohibited under Art. 5(1)(f) when: Infers emotions in workplace or educational settings, except for medical or safety purposes. Verify: Is this used to detect emotions of employees or students? (Medical/safety use is exempt)
|
|
57
|
-
2. **[CRITICAL]** cross-permission-passport-mismatch: 14 undeclared permission(s) with unwrapped LLM calls — compounding governance failure per Art. 26(4)
|
|
58
|
-
3. **[HIGH]** undeclared-permission: Tool 'kb_search' (langchain) used in code but not declared in Agent Passport — Art. 26(4)
|
|
59
|
-
4. **[HIGH]** undeclared-permission: Tool 'ticket_history' (langchain) used in code but not declared in Agent Passport — Art. 26(4)
|
|
60
|
-
5. **[HIGH]** undeclared-permission: Tool 'kb_search' (langchain) used in code but not declared in Agent Passport — Art. 26(4)
|
|
61
|
-
|
|
62
|
-
---
|
|
63
|
-
|
|
64
|
-
|
package/engine.log
DELETED
|
@@ -1,7 +0,0 @@
|
|
|
1
|
-
[server] Loading regulation data...
|
|
2
|
-
[app] Loaded 108 obligations
|
|
3
|
-
[app] Loaded persisted scan result from disk
|
|
4
|
-
[server] Complior Engine v1.0.0 running on http://127.0.0.1:3099
|
|
5
|
-
[file-watcher] Watching /home/openclaw/complior/engine/core for compliance-relevant changes
|
|
6
|
-
[server] Graceful shutdown...
|
|
7
|
-
[server] Server closed
|