@complior/engine 0.9.0

package/src/e2e/smoke.test.ts

@@ -0,0 +1,101 @@
+/**
+ * E2E Smoke Test — validates the full engine pipeline works end-to-end.
+ *
+ * Uses Hono's `app.request()` (no real HTTP server needed).
+ * Scans the `test-projects/acme-ai-support/` fixture project.
+ */
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { existsSync } from 'node:fs';
+import { loadApplication, type Application } from '../composition-root.js';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const TEST_PROJECT = process.env['COMPLIOR_TEST_PROJECT']
+  ?? resolve(__dirname, '../../../../..', 'test-projects/acme-ai-support');
+
+const canRunE2E = existsSync(resolve(TEST_PROJECT, 'package.json'));
+
+describe.skipIf(!canRunE2E)('E2E Smoke Test', () => {
+  let application: Application;
+
+  beforeAll(async () => {
+    process.env['COMPLIOR_PROJECT_PATH'] = TEST_PROJECT;
+    application = await loadApplication();
+  }, 30_000);
+
+  afterAll(() => {
+    application?.shutdown();
+    delete process.env['COMPLIOR_PROJECT_PATH'];
+  });
+
+  it('GET /health returns ok', async () => {
+    const res = await application.app.request('/health');
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body).toEqual({ ok: true });
+  });
+
+  it('GET /status returns engine status', async () => {
+    const res = await application.app.request('/status');
+    expect(res.status).toBe(200);
+    const body = await res.json() as Record<string, unknown>;
+    expect(body['ready']).toBe(true);
+    expect(typeof body['version']).toBe('string');
+    expect(typeof body['mode']).toBe('string');
+  });
+
+  it('POST /scan returns a valid ScanResult', async () => {
+    const res = await application.app.request('/scan', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ path: TEST_PROJECT }),
+    });
+    expect(res.status).toBe(200);
+    const body = await res.json() as Record<string, unknown>;
+
+    // Top-level fields
+    expect(typeof body['projectPath']).toBe('string');
+    expect(typeof body['scannedAt']).toBe('string');
+    expect(typeof body['duration']).toBe('number');
+    expect(typeof body['filesScanned']).toBe('number');
+    expect(Array.isArray(body['findings'])).toBe(true);
+
+    // Score breakdown
+    const score = body['score'] as Record<string, unknown>;
+    expect(typeof score['totalScore']).toBe('number');
+    expect(['red', 'yellow', 'green']).toContain(score['zone']);
+    expect(typeof score['totalChecks']).toBe('number');
+    expect(typeof score['passedChecks']).toBe('number');
+    expect(typeof score['failedChecks']).toBe('number');
+  }, 30_000);
+
+  it('POST /scan with invalid body returns 400', async () => {
+    const res = await application.app.request('/scan', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({}),
+    });
+    expect(res.status).toBe(400);
+  });
+
+  it('scan produces findings for test project', async () => {
+    const res = await application.app.request('/scan', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ path: TEST_PROJECT }),
+    });
+    const body = await res.json() as Record<string, unknown>;
+    const findings = body['findings'] as Array<Record<string, unknown>>;
+
+    // Test project should have some findings
+    expect(findings.length).toBeGreaterThan(0);
+
+    // Each finding should have required fields
+    for (const f of findings) {
+      expect(typeof f['checkId']).toBe('string');
+      expect(['pass', 'fail', 'skip', 'info']).toContain(f['type']);
+      expect(typeof f['message']).toBe('string');
+    }
+  }, 30_000);
+});

package/src/hooks/hooks-export.test.ts

@@ -0,0 +1,81 @@
+import { describe, it, expect } from 'vitest';
+import { resolve } from 'node:path';
+import { mkdtemp, readFile, access, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import type { ScanResult, Finding, ScoreBreakdown } from '../types/common.types.js';
+import { installHooks } from './installer.js';
+import { toGithubIssue } from '../output/github-issue.js';
+
+
+// --- Helpers ---
+
+const makeScore = (overrides?: Partial<ScoreBreakdown>): ScoreBreakdown => ({
+  totalScore: 42,
+  zone: 'red',
+  categoryScores: [],
+  criticalCapApplied: false,
+  totalChecks: 10,
+  passedChecks: 4,
+  failedChecks: 5,
+  skippedChecks: 1,
+  ...overrides,
+});
+
+const makeFinding = (overrides?: Partial<Finding>): Finding => ({
+  checkId: 'test-check',
+  type: 'fail',
+  message: 'Test failure',
+  severity: 'high',
+  ...overrides,
+});
+
+const makeResult = (overrides?: Partial<ScanResult>): ScanResult => ({
+  score: makeScore(),
+  findings: [
+    makeFinding({ checkId: 'ai-disclosure', severity: 'high', articleReference: 'Art. 50(1)', fix: 'Add disclosure' }),
+    makeFinding({ checkId: 'logging', severity: 'medium', file: 'src/app.ts' }),
+  ],
+  projectPath: '/test',
+  scannedAt: '2026-01-01T00:00:00Z',
+  duration: 100,
+  filesScanned: 50,
+  ...overrides,
+});
+
+// --- Hook install tests ---
+
+describe('installHooks', () => {
+  let tmpDir: string;
+
+  it('installs 3 hooks in .git/hooks/', async () => {
+    tmpDir = await mkdtemp(resolve(tmpdir(), 'complior-hooks-'));
+    const { mkdir } = await import('node:fs/promises');
+    await mkdir(resolve(tmpDir, '.git', 'hooks'), { recursive: true });
+
+    const installed = await installHooks(tmpDir);
+    expect(installed).toEqual(['pre-commit', 'pre-push', 'commit-msg']);
+
+    // Verify files exist
+    for (const name of installed) {
+      await access(resolve(tmpDir, '.git', 'hooks', name));
+      const content = await readFile(resolve(tmpDir, '.git', 'hooks', name), 'utf-8');
+      expect(content).toContain('complior');
+    }
+
+    await rm(tmpDir, { recursive: true });
+  });
+});
+
+// --- GitHub Issue export ---
+
+describe('toGithubIssue', () => {
+  it('produces Markdown checklist', () => {
+    const md = toGithubIssue(makeResult());
+    expect(md).toContain('## EU AI Act Compliance Checklist');
+    expect(md).toContain('- [ ] **[HIGH]** ai-disclosure');
+    expect(md).toContain('Art. 50(1)');
+    expect(md).toContain('Fix: Add disclosure');
+    expect(md).toContain('Generated by [Complior]');
+  });
+});
+

package/src/hooks/installer.ts

@@ -0,0 +1,113 @@
+import { resolve } from 'node:path';
+import { writeFile, chmod, readFile, mkdir } from 'node:fs/promises';
+
+const PRE_COMMIT_TEMPLATE = (threshold: number) => `#!/bin/sh
+# Complior pre-commit hook — warns about compliance score (non-blocking)
+# Installed by: complior hook install
+
+RESULT=$(npx ai-comply scan --ci --threshold ${threshold} --fail-on critical 2>&1)
+STATUS=$?
+if [ $STATUS -ne 0 ]; then
+  echo ""
+  echo "⚠ [Complior] Compliance warning:"
+  echo "$RESULT"
+  echo ""
+fi
+exit 0
+`;
+
+const PRE_PUSH_TEMPLATE = `#!/bin/sh
+# Complior pre-push hook — compliance scan report (non-blocking)
+# Installed by: complior hook install
+
+RESULT=$(npx ai-comply scan --ci --json 2>&1)
+STATUS=$?
+if [ $STATUS -ne 0 ]; then
+  echo ""
+  echo "⚠ [Complior] Compliance issues detected (push continues):"
+  echo "$RESULT" | head -20
+  echo ""
+fi
+exit 0
+`;
+
+const COMMIT_MSG_TEMPLATE = `#!/bin/sh
+# Complior commit-msg hook — appends compliance score to commit messages
+# Installed by: complior hook install
+
+SCORE=$(npx ai-comply scan --ci --json 2>/dev/null | grep -o '"score":[0-9]*' | head -1 | cut -d: -f2)
+if [ -n "$SCORE" ]; then
+  echo "" >> "$1"
+  echo "[Complior: $SCORE/100]" >> "$1"
+fi
+`;
+
+export interface HookConfig {
+  readonly threshold: number;
+}
+
+const DEFAULT_CONFIG: HookConfig = { threshold: 60 };
+
+export const installHooks = async (
+  projectPath: string,
+  config?: Partial<HookConfig>,
+): Promise<readonly string[]> => {
+  const cfg = { ...DEFAULT_CONFIG, ...config };
+  const hooksDir = resolve(projectPath, '.git', 'hooks');
+  await mkdir(hooksDir, { recursive: true });
+
+  const hooks: { name: string; content: string }[] = [
+    { name: 'pre-commit', content: PRE_COMMIT_TEMPLATE(cfg.threshold) },
+    { name: 'pre-push', content: PRE_PUSH_TEMPLATE },
+    { name: 'commit-msg', content: COMMIT_MSG_TEMPLATE },
+  ];
+
+  const installed: string[] = [];
+  for (const hook of hooks) {
+    const hookPath = resolve(hooksDir, hook.name);
+
+    // Backup existing hook
+    try {
+      const existing = await readFile(hookPath, 'utf-8');
+      if (existing && !existing.includes('complior')) {
+        await writeFile(`${hookPath}.backup`, existing, 'utf-8');
+      }
+    } catch {
+      // No existing hook
+    }
+
+    await writeFile(hookPath, hook.content, 'utf-8');
+    await chmod(hookPath, 0o755);
+    installed.push(hook.name);
+  }
+
+  return installed;
+};
+
+export const uninstallHooks = async (projectPath: string): Promise<readonly string[]> => {
+  const hooksDir = resolve(projectPath, '.git', 'hooks');
+  const hookNames = ['pre-commit', 'pre-push', 'commit-msg'];
+  const removed: string[] = [];
+
+  for (const name of hookNames) {
+    const hookPath = resolve(hooksDir, name);
+    try {
+      const content = await readFile(hookPath, 'utf-8');
+      if (content.includes('complior')) {
+        // Restore backup if exists
+        try {
+          const backup = await readFile(`${hookPath}.backup`, 'utf-8');
+          await writeFile(hookPath, backup, 'utf-8');
+        } catch {
+          const { unlink } = await import('node:fs/promises');
+          await unlink(hookPath);
+        }
+        removed.push(name);
+      }
+    } catch {
+      // Hook doesn't exist
+    }
+  }
+
+  return removed;
+};

package/src/http/cors.test.ts

@@ -0,0 +1,38 @@
+/**
+ * US-S0201: CORS middleware tests
+ *
+ * Verifies that the router only allows localhost origins and blocks external ones.
+ */
+import { describe, it, expect } from 'vitest';
+
+// Isolated CORS origin-checker extracted from create-router.ts logic
+function isCorsAllowed(origin: string | null): boolean {
+  if (!origin) return true; // same-origin requests pass through
+  try {
+    const { hostname } = new URL(origin);
+    return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1';
+  } catch {
+    return false;
+  }
+}
+
+// US-S0201: named tests
+
+describe('CORS origin policy', () => {
+  it('test_cors_allows_localhost', () => {
+    expect(isCorsAllowed('http://localhost:3000')).toBe(true);
+    expect(isCorsAllowed('http://localhost:5173')).toBe(true);
+    expect(isCorsAllowed('http://127.0.0.1:3099')).toBe(true);
+  });
+
+  it('test_cors_blocks_external', () => {
+    expect(isCorsAllowed('https://evil.example.com')).toBe(false);
+    expect(isCorsAllowed('https://app.complior.ai')).toBe(false);
+    expect(isCorsAllowed('https://attacker.io')).toBe(false);
+  });
+
+  it('test_cors_same_origin', () => {
+    // null/undefined origin = same-origin request, should pass through
+    expect(isCorsAllowed(null)).toBe(true);
+  });
+});

package/src/http/create-router.ts

@@ -0,0 +1,259 @@
+import { Hono } from 'hono';
+import { cors } from 'hono/cors';
+import { AppError } from '../types/errors.js';
+import { createLogger } from '../infra/logger.js';
+import type { ScanService } from '../services/scan-service.js';
+import type { ChatService } from '../services/chat-service.js';
+import type { FileService } from '../services/file-service.js';
+import type { FixService } from '../services/fix-service.js';
+import type { UndoService } from '../services/undo-service.js';
+import type { BadgeService } from '../services/badge-service.js';
+import type { ShareService } from '../services/share-service.js';
+import type { ReportService } from '../services/report-service.js';
+import type { ExternalScanService } from '../services/external-scan-service.js';
+import type { StatusService } from '../services/status-service.js';
+import type { PassportService } from '../services/passport-service.js';
+import type { CostService } from '../services/cost-service.js';
+import type { DebtService } from '../services/debt-service.js';
+import type { LlmPort } from '../ports/llm.port.js';
+import type { ScoreBreakdown } from '../types/common.types.js';
+import type { ToolExecutorDeps } from '../llm/tool-executors.js';
+import type { AgentMode } from '../llm/tools/types.js';
+import type { OnboardingWizard } from '../onboarding/wizard.js';
+import type { OnboardingProfile } from '../onboarding/profile.js';
+import type { FrameworkService } from '../services/framework-service.js';
+import type { EvidenceStore } from '../domain/scanner/evidence-store.js';
+import type { AuditStore } from '../domain/audit/audit-trail.js';
+import type { EventBusPort } from '../ports/events.port.js';
+import type { WhatIfRequest, WhatIfResult } from '../domain/whatif/scenario-engine.js';
+import type { GeneratedConfig } from '../domain/whatif/config-fixer.js';
+import type { SimulationInput, SimulationResult } from '../domain/whatif/simulate-actions.js';
+import { createScanRoute } from './routes/scan.route.js';
+import { createStatusRoute } from './routes/status.route.js';
+import { createChatRoute } from './routes/chat.route.js';
+import { createFileRoute } from './routes/file.route.js';
+import { createFixRoute } from './routes/fix.route.js';
+import { createBadgeRoute } from './routes/badge.route.js';
+import { createShareRoute } from './routes/share.route.js';
+import { createReportRoute } from './routes/report.route.js';
+import { createExternalScanRoute } from './routes/external-scan.route.js';
+import { createShellRoute } from './routes/shell.route.js';
+import { createGitRoute } from './routes/git.route.js';
+import { createProviderRoute } from './routes/provider.route.js';
+import { createDisclaimerRoute } from './routes/disclaimer.route.js';
+import { createOnboardingRoute } from './routes/onboarding.route.js';
+import { createWhatIfRoute } from './routes/whatif.route.js';
+import { createAgentRoute } from './routes/agent.route.js';
+import { createObligationsRoute } from './routes/obligations.route.js';
+import { createSyncRoute } from './routes/sync.route.js';
+import { createCertRoute } from './routes/cert.route.js';
+import { createGuidedOnboardingRoute } from './routes/guided-onboarding.route.js';
+import { createSupplyChainRoute } from './routes/supply-chain.route.js';
+import { createEventsRoute } from './routes/events.route.js';
+import { createCostRoute } from './routes/cost.route.js';
+import { createDebtRoute } from './routes/debt.route.js';
+import { createFrameworksRoute } from './routes/frameworks.route.js';
+import { createJurisdictionRoute } from './routes/jurisdiction.route.js';
+import { createProxyRoute } from './routes/proxy.route.js';
+import { createImportRoute } from './routes/import.route.js';
+import { createRedteamRoute } from './routes/redteam.route.js';
+import { createToolsRoute } from './routes/tools.route.js';
+import { createEvalRoute } from './routes/eval.route.js';
+import { createAuditRoute } from './routes/audit.route.js';
+import type { ToolManager } from '../infra/tool-manager.js';
+import type { ProxyService } from '../services/proxy-service.js';
+import type { EvalService } from '../services/eval-service.js';
+
+export interface RouterDeps {
+  readonly scanService: ScanService;
+  readonly chatService: ChatService;
+  readonly fileService: FileService;
+  readonly fixService: FixService;
+  readonly undoService: UndoService;
+  readonly badgeService: BadgeService;
+  readonly shareService: ShareService;
+  readonly reportService: ReportService;
+  readonly getExternalScanService: () => Promise<ExternalScanService>;
+  readonly statusService: StatusService;
+  readonly passportService: PassportService;
+  readonly costService?: CostService;
+  readonly debtService?: DebtService;
+  readonly llm: LlmPort;
+  readonly toolExecutorDeps: ToolExecutorDeps;
+  readonly getMode: () => AgentMode;
+  readonly setMode: (mode: AgentMode) => void;
+  readonly onboardingWizard: OnboardingWizard;
+  readonly getVersion: () => string;
+  readonly loadProfile: () => Promise<OnboardingProfile | null>;
+  readonly getLastScore: () => ScoreBreakdown | null;
+  readonly obligations: readonly Record<string, unknown>[];
+  readonly getLastScan: () => import('../types/common.types.js').ScanResult | null;
+  readonly getProjectPath: () => string;
+  readonly callLlm?: (prompt: string, systemPrompt?: string) => Promise<string>;
+  readonly evidenceStore?: EvidenceStore;
+  readonly auditStore?: AuditStore;
+  readonly events?: EventBusPort;
+  readonly analyzeScenario?: (request: WhatIfRequest) => WhatIfResult;
+  readonly generateAllConfigs?: (profile: OnboardingProfile) => readonly GeneratedConfig[];
+  readonly simulateActions?: (input: SimulationInput) => SimulationResult;
+  readonly onboardingService?: import('../services/onboarding-service.js').OnboardingService;
+  readonly frameworkService?: FrameworkService;
+  readonly proxyService?: ProxyService;
+  readonly maxRequestsPerHour?: number;
+  readonly importDeps?: { readonly evidenceStore?: EvidenceStore; readonly getProjectPath: () => string };
+  readonly redteamDeps?: { readonly callLlm: (prompt: string, systemPrompt?: string) => Promise<string>; readonly evidenceStore?: EvidenceStore; readonly auditStore?: AuditStore; readonly getProjectPath: () => string };
+  readonly toolManager?: ToolManager;
+  readonly evalService?: EvalService;
+}
+
+export const createRouter = (deps: RouterDeps) => {
+  const app = new Hono();
+  const log = createLogger('http');
+
+  // US-S0201: CORS — allow TUI (localhost) and any local dev origin
+  app.use('*', cors({
+    origin: (origin) => {
+      if (!origin) return null; // same-origin requests pass through
+      try {
+        const { hostname } = new URL(origin);
+        if (hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1') {
+          return origin;
+        }
+      } catch {
+        // malformed origin — ignore
+      }
+      return null;
+    },
+    allowMethods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
+    allowHeaders: ['Content-Type', 'Authorization'],
+    exposeHeaders: ['X-Complior-Version'],
+  }));
+
+  // Global error handler
+  app.onError((err, c) => {
+    if (err instanceof AppError) {
+      const status = err.statusCode === 400 ? 400
+        : err.statusCode === 404 ? 404
+        : err.statusCode === 502 ? 502
+        : 500;
+      return c.json(
+        { error: err.code, message: err.message },
+        status,
+      );
+    }
+    log.error('Unexpected error:', err);
+    return c.json(
+      { error: 'INTERNAL', message: 'Internal server error' },
+      500,
+    );
+  });
+
+  // Mount routes
+  app.route('/', createStatusRoute({ statusService: deps.statusService, llm: deps.llm }));
+  app.route('/', createScanRoute({ scanService: deps.scanService, getLastScan: deps.getLastScan }));
+  app.route('/', createChatRoute({ chatService: deps.chatService, llm: deps.llm, toolExecutorDeps: deps.toolExecutorDeps, getMode: deps.getMode, setMode: deps.setMode, maxRequestsPerHour: deps.maxRequestsPerHour }));
+  app.route('/', createFileRoute(deps.fileService));
+  app.route('/', createFixRoute({ fixService: deps.fixService, undoService: deps.undoService }));
+  app.route('/', createBadgeRoute(deps.badgeService));
+  app.route('/', createShareRoute(deps.shareService));
+  app.route('/', createReportRoute(deps.reportService));
+  app.route('/', createExternalScanRoute(deps.getExternalScanService));
+  app.route('/', createShellRoute());
+  app.route('/', createGitRoute());
+  app.route('/', createProviderRoute(deps.llm));
+  app.route('/', createDisclaimerRoute({ getVersion: deps.getVersion }));
+  app.route('/', createOnboardingRoute(deps.onboardingWizard));
+  app.route('/', createWhatIfRoute({
+    loadProfile: deps.loadProfile,
+    getLastScore: deps.getLastScore,
+    getLastScan: deps.getLastScan,
+    analyzeScenario: deps.analyzeScenario!,
+    generateAllConfigs: deps.generateAllConfigs!,
+    simulateActions: deps.simulateActions!,
+  }));
+  app.route('/', createAgentRoute(deps.passportService));
+  app.route('/', createCertRoute({
+    passportService: deps.passportService,
+    callLlm: deps.callLlm,
+    evidenceStore: deps.evidenceStore,
+    auditStore: deps.auditStore,
+    getProjectPath: deps.getProjectPath,
+  }));
+  app.route('/', createGuidedOnboardingRoute({
+    onboardingService: deps.onboardingService!,
+  }));
+  app.route('/', createObligationsRoute({ obligations: deps.obligations, getLastScan: deps.getLastScan }));
+  app.route('/', createSupplyChainRoute({
+    evidenceStore: deps.evidenceStore,
+    auditStore: deps.auditStore,
+  }));
+  app.route('/', createSyncRoute({
+    getProjectPath: deps.getProjectPath,
+    getLastScan: deps.getLastScan,
+    passportService: deps.passportService,
+    getAuditEntries: (filter) => deps.passportService.getAuditTrail(filter),
+  }));
+
+  // US-S05-27: Cost estimation endpoint
+  if (deps.costService) {
+    app.route('/', createCostRoute({ costService: deps.costService }));
+  }
+
+  // US-S05-22: Compliance debt score endpoint
+  if (deps.debtService) {
+    app.route('/', createDebtRoute({ debtService: deps.debtService }));
+  }
+
+  // E-105/E-106/E-107: Multi-framework scoring
+  if (deps.frameworkService) {
+    app.route('/', createFrameworksRoute({ frameworkService: deps.frameworkService }));
+  }
+
+  // US-S06-01: MCP Compliance Proxy + US-S06-02: Policy Engine
+  if (deps.proxyService) {
+    app.route('/', createProxyRoute({
+      proxyService: deps.proxyService,
+      getProjectPath: deps.getProjectPath,
+    }));
+  }
+
+  // US-S06-14: Multi-jurisdiction data
+  app.route('/', createJurisdictionRoute());
+
+  // US-S05-26: SSE events endpoint
+  if (deps.events) {
+    app.route('/', createEventsRoute({ events: deps.events }));
+  }
+
+  // US-S10-05: Promptfoo import endpoint
+  if (deps.importDeps) {
+    app.route('/', createImportRoute(deps.importDeps));
+  }
+
+  // US-S10-04: Red-team endpoint
+  if (deps.redteamDeps) {
+    app.route('/', createRedteamRoute(deps.redteamDeps));
+  }
+
+  // E-115: External tools management
+  if (deps.toolManager) {
+    app.route('/', createToolsRoute({ toolManager: deps.toolManager }));
+  }
+
+  // US-EVAL-29: Eval endpoint
+  if (deps.evalService) {
+    app.route('/', createEvalRoute({
+      evalService: deps.evalService,
+    }));
+    app.route('/', createAuditRoute({
+      evalService: deps.evalService,
+      scanService: deps.scanService,
+      getProjectPath: deps.getProjectPath,
+    }));
+  }
+
+  // Health check
+  app.get('/health', (c) => c.json({ ok: true }));
+
+  return app;
+};