@complior/engine 0.9.0

package/src/infra/bundle-fetcher.ts

@@ -0,0 +1,77 @@
+import { readFile, writeFile, mkdir } from 'node:fs/promises';
+import { join, dirname } from 'node:path';
+import { createSaasClient } from './saas-client.js';
+import { createLogger } from './logger.js';
+
+const log = createLogger('bundle');
+
+export interface BundleFetcher {
+  readonly fetchIfUpdated: () => Promise<Record<string, unknown> | null>;
+  readonly getBundle: () => Promise<Record<string, unknown> | null>;
+}
+
+export const createBundleFetcher = (saasUrl: string, cacheDir: string): BundleFetcher => {
+  const client = createSaasClient(saasUrl);
+  const bundlePath = join(cacheDir, 'bundle.json');
+  const etagPath = join(cacheDir, 'bundle.etag');
+
+  const readEtag = async (): Promise<string | undefined> => {
+    try {
+      return (await readFile(etagPath, 'utf-8')).trim();
+    } catch {
+      return undefined;
+    }
+  };
+
+  const saveBundle = async (data: Record<string, unknown>, etag?: string): Promise<void> => {
+    await mkdir(dirname(bundlePath), { recursive: true });
+    await writeFile(bundlePath, JSON.stringify(data), 'utf-8');
+    if (etag) {
+      await writeFile(etagPath, etag, 'utf-8');
+    }
+  };
+
+  const loadCachedBundle = async (): Promise<Record<string, unknown> | null> => {
+    try {
+      const content = await readFile(bundlePath, 'utf-8');
+      const data: Record<string, unknown> = JSON.parse(content);
+      return data;
+    } catch {
+      return null;
+    }
+  };
+
+  return Object.freeze({
+    fetchIfUpdated: async () => {
+      try {
+        const etag = await readEtag();
+        const result = await client.fetchDataBundle(etag);
+        if (result.data === null) {
+          log.debug('Bundle not modified (304)');
+          return null;
+        }
+        await saveBundle(result.data, result.etag);
+        log.info('Bundle updated from SaaS');
+        return result.data;
+      } catch (err) {
+        log.warn('Bundle fetch failed:', err);
+        return null;
+      }
+    },
+
+    getBundle: async () => {
+      // Try fetch first, fallback to cache
+      try {
+        const etag = await readEtag();
+        const result = await client.fetchDataBundle(etag);
+        if (result.data !== null) {
+          await saveBundle(result.data, result.etag);
+          return result.data;
+        }
+      } catch {
+        log.debug('Online fetch failed, using cache');
+      }
+      return loadCachedBundle();
+    },
+  });
+};

package/src/infra/cache-storage.ts

@@ -0,0 +1,34 @@
+/**
+ * Infra adapter for CacheStorage port.
+ * File-based persistence for scan cache.
+ * Domain port defined in: domain/scanner/scan-cache.ts
+ */
+
+import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import type { CacheStorage, ScanCacheData } from '../domain/scanner/scan-cache.js';
+
+export const createFileCacheStorage = (projectPath: string): CacheStorage => {
+  const path = join(projectPath, '.complior', 'cache', 'scan-cache.json');
+
+  return Object.freeze({
+    load: (): ScanCacheData | undefined => {
+      if (!existsSync(path)) return undefined;
+      try {
+        const raw = readFileSync(path, 'utf-8');
+        const parsed: unknown = JSON.parse(raw);
+        // Basic shape validation (Zod would be ideal for full validation)
+        if (typeof parsed === 'object' && parsed !== null && 'version' in parsed && 'entries' in parsed) {
+          return parsed as ScanCacheData;
+        }
+        return undefined;
+      } catch {
+        return undefined;
+      }
+    },
+    save: (data: ScanCacheData): void => {
+      mkdirSync(dirname(path), { recursive: true });
+      writeFileSync(path, JSON.stringify(data), 'utf-8');
+    },
+  });
+};

package/src/infra/event-bus.ts

@@ -0,0 +1,31 @@
+import type { EventMap, EventHandler, EventBusPort } from '../ports/events.port.js';
+
+export const createEventBus = (): EventBusPort => {
+  // Handlers stored as (payload: never) => void exploiting contravariance:
+  // (payload: T) => void is assignable to (payload: never) => void for all T
+  const listeners = new Map<string, Set<(payload: never) => void>>();
+
+  const on = <K extends keyof EventMap>(event: K, handler: EventHandler<EventMap[K]>): void => {
+    if (!listeners.has(event)) {
+      listeners.set(event, new Set());
+    }
+    listeners.get(event)!.add(handler);
+  };
+
+  const off = <K extends keyof EventMap>(event: K, handler: EventHandler<EventMap[K]>): void => {
+    listeners.get(event)?.delete(handler);
+  };
+
+  const emit = <K extends keyof EventMap>(event: K, payload: EventMap[K]): void => {
+    const handlers = listeners.get(event);
+    if (handlers !== undefined) {
+      for (const handler of handlers) {
+        Reflect.apply(handler, undefined, [payload]);
+      }
+    }
+  };
+
+  return Object.freeze({ on, off, emit });
+};
+
+export type EventBus = ReturnType<typeof createEventBus>;

package/src/infra/file-collector.ts

@@ -0,0 +1,61 @@
+/**
+ * Infrastructure adapter for file collection.
+ * Reads filesystem to build ScanContext. Domain stays I/O-free (Clean Architecture).
+ */
+import { readdir, readFile, stat } from 'node:fs/promises';
+import { join, extname, relative } from 'node:path';
+import type { ScanContext, FileInfo } from '../ports/scanner.port.js';
+import { ALL_SCANNABLE_EXTENSIONS, EXCLUDED_DIRS } from '../data/scanner-constants.js';
+import limitsData from '../../data/scanner/limits.json' with { type: 'json' };
+
+const MAX_FILES = limitsData.max_files;
+const MAX_FILE_SIZE = limitsData.max_file_size_bytes;
+
+const collectFilesRecursive = async (
+  dirPath: string,
+  projectPath: string,
+  accumulated: FileInfo[],
+): Promise<void> => {
+  if (accumulated.length >= MAX_FILES) return;
+
+  const entries = await readdir(dirPath, { withFileTypes: true });
+
+  for (const entry of entries) {
+    if (accumulated.length >= MAX_FILES) return;
+
+    const fullPath = join(dirPath, entry.name);
+
+    if (entry.isDirectory()) {
+      if (!EXCLUDED_DIRS.has(entry.name)) {
+        await collectFilesRecursive(fullPath, projectPath, accumulated);
+      }
+      continue;
+    }
+
+    if (!entry.isFile()) continue;
+
+    const ext = extname(entry.name).toLowerCase();
+    if (!ALL_SCANNABLE_EXTENSIONS.has(ext)) continue;
+
+    const fileStat = await stat(fullPath);
+    if (fileStat.size > MAX_FILE_SIZE) continue;
+
+    const content = await readFile(fullPath, 'utf-8');
+    accumulated.push({
+      path: fullPath,
+      content,
+      extension: ext,
+      relativePath: relative(projectPath, fullPath),
+    });
+  }
+};
+
+export const collectFiles = async (projectPath: string): Promise<ScanContext> => {
+  const files: FileInfo[] = [];
+  await collectFilesRecursive(projectPath, projectPath, files);
+
+  return {
+    files,
+    projectPath,
+  };
+};

package/src/infra/file-ops-adapter.ts

@@ -0,0 +1,95 @@
+import { readFile as fsReadFile, writeFile, readdir, mkdir } from 'node:fs/promises';
+import { join, resolve, relative, extname } from 'node:path';
+import { ToolError, NotFoundError } from '../types/errors.js';
+
+const BLOCKED_PATHS = ['/etc', '/usr', '/bin', '/sbin', '/var', '/proc', '/sys', '/dev'];
+
+const validatePath = (filePath: string): string => {
+  const resolved = resolve(filePath);
+
+  for (const blocked of BLOCKED_PATHS) {
+    if (resolved.startsWith(blocked)) {
+      throw new ToolError(`Access denied: path ${resolved} is in a protected directory`);
+    }
+  }
+
+  return resolved;
+};
+
+export const createFile = async (filePath: string, content: string): Promise<void> => {
+  const resolved = validatePath(filePath);
+  const dir = resolve(resolved, '..');
+  await mkdir(dir, { recursive: true });
+  await writeFile(resolved, content, 'utf-8');
+};
+
+export const editFile = async (
+  filePath: string,
+  oldContent: string,
+  newContent: string,
+): Promise<void> => {
+  const resolved = validatePath(filePath);
+
+  const existing = await fsReadFile(resolved, 'utf-8').catch(() => {
+    throw new NotFoundError(`File not found: ${filePath}`);
+  });
+
+  if (!existing.includes(oldContent)) {
+    throw new ToolError('oldContent not found in file');
+  }
+
+  const updated = existing.replace(oldContent, newContent);
+  await writeFile(resolved, updated, 'utf-8');
+};
+
+export const readFile = async (filePath: string): Promise<string> => {
+  const resolved = validatePath(filePath);
+
+  return fsReadFile(resolved, 'utf-8').catch(() => {
+    throw new NotFoundError(`File not found: ${filePath}`);
+  });
+};
+
+const RELEVANT_EXTENSIONS = new Set([
+  '.ts', '.tsx', '.js', '.jsx', '.json', '.md',
+  '.yaml', '.yml', '.py', '.html', '.css', '.toml',
+]);
+
+export const listFiles = async (
+  dirPath: string,
+  pattern?: string,
+): Promise<readonly string[]> => {
+  const resolved = validatePath(dirPath);
+  const results: string[] = [];
+
+  const walk = async (dir: string, depth: number): Promise<void> => {
+    if (depth > 10 || results.length > 1000) return;
+
+    const entries = await readdir(dir, { withFileTypes: true }).catch(() => []);
+
+    for (const entry of entries) {
+      const fullPath = join(dir, entry.name);
+      const relPath = relative(resolved, fullPath);
+
+      if (entry.name.startsWith('.') || entry.name === 'node_modules' || entry.name === 'dist') {
+        continue;
+      }
+
+      if (entry.isDirectory()) {
+        await walk(fullPath, depth + 1);
+      } else if (entry.isFile()) {
+        const ext = extname(entry.name);
+        if (pattern !== undefined) {
+          if (entry.name.includes(pattern) || relPath.includes(pattern)) {
+            results.push(relPath);
+          }
+        } else if (RELEVANT_EXTENSIONS.has(ext)) {
+          results.push(relPath);
+        }
+      }
+    }
+  };
+
+  await walk(resolved, 0);
+  return results;
+};

package/src/infra/file-watcher.test.ts

@@ -0,0 +1,90 @@
+/**
+ * US-S0202: File Watcher — named tests
+ *
+ * Tests for the chokidar-based file watcher that drives the Compliance Gate.
+ * The watcher emits `file.changed` events on the shared event bus.
+ */
+import { describe, it, expect } from 'vitest';
+import { EXCLUDED_DIRS } from '../data/scanner-constants.js';
+
+// --- Helpers ---
+
+/** Reproduces the extension filter from file-watcher.ts */
+const WATCHED_EXTENSIONS = /\.(ts|tsx|js|jsx|mjs|cjs|json|yaml|yml|md)$/i;
+
+function isWatched(filePath: string): boolean {
+  return WATCHED_EXTENSIONS.test(filePath);
+}
+
+function isIgnoredDir(filePath: string): boolean {
+  const segments = filePath.split('/');
+  return segments.some((s) => EXCLUDED_DIRS.has(s));
+}
+
+// US-S0202: named tests
+
+describe('FileWatcher — extension filter', () => {
+  it('test_file_watcher_filters_extensions', () => {
+    expect(isWatched('src/app.ts')).toBe(true);
+    expect(isWatched('src/app.tsx')).toBe(true);
+    expect(isWatched('src/app.js')).toBe(true);
+    expect(isWatched('config.json')).toBe(true);
+    expect(isWatched('README.md')).toBe(true);
+    expect(isWatched('policy.yaml')).toBe(true);
+    // Non-compliance files should NOT be watched
+    expect(isWatched('image.png')).toBe(false);
+    expect(isWatched('data.csv')).toBe(false);
+    expect(isWatched('binary.exe')).toBe(false);
+  });
+});
+
+describe('FileWatcher — ignored directories', () => {
+  it('test_file_watcher_ignores_node_modules', () => {
+    expect(isIgnoredDir('node_modules/lodash/index.js')).toBe(true);
+    expect(isIgnoredDir('src/node_modules/foo/bar.ts')).toBe(true);
+    expect(isIgnoredDir('.git/config')).toBe(true);
+    expect(isIgnoredDir('dist/index.js')).toBe(true);
+    // .complior internal files should be ignored
+    expect(isIgnoredDir('.complior/evidence/chain.json')).toBe(true);
+    expect(isIgnoredDir('.complior/reports/fria-agent.json')).toBe(true);
+    expect(isIgnoredDir('.complior/agents/my-agent-manifest.json')).toBe(true);
+    expect(isIgnoredDir('/home/user/project/.complior/evidence/chain.json')).toBe(true);
+    // Regular source files should NOT be ignored
+    expect(isIgnoredDir('src/app.ts')).toBe(false);
+    expect(isIgnoredDir('docs/compliance/fria.md')).toBe(false);
+  });
+});
+
+describe('FileWatcher — debounce logic', () => {
+  it('test_file_watcher_debounce', async () => {
+    // Simulate rapid events — only the last one should fire
+    const emitted: string[] = [];
+    const DEBOUNCE_MS = 200;
+
+    let timer: ReturnType<typeof setTimeout> | null = null;
+    let pendingFile: string | null = null;
+
+    const scheduleEmit = (filePath: string): void => {
+      pendingFile = filePath;
+      if (timer !== null) clearTimeout(timer);
+      timer = setTimeout(() => {
+        if (pendingFile !== null) {
+          emitted.push(pendingFile);
+          pendingFile = null;
+        }
+        timer = null;
+      }, DEBOUNCE_MS);
+    };
+
+    // Fire 3 rapid events
+    scheduleEmit('src/a.ts');
+    scheduleEmit('src/b.ts');
+    scheduleEmit('src/c.ts');
+
+    // Wait for debounce to settle
+    await new Promise((r) => setTimeout(r, DEBOUNCE_MS + 50));
+
+    expect(emitted).toHaveLength(1);
+    expect(emitted[0]).toBe('src/c.ts'); // last one wins
+  });
+});

package/src/infra/file-watcher.ts

@@ -0,0 +1,106 @@
+/**
+ * File Watcher — watches project files and emits `file.changed` events.
+ *
+ * US-S0202: JS/TS/JSON file change → debounce 200 ms → compliance gate re-scan.
+ *
+ * Uses chokidar for cross-platform fs watching (Linux inotify / macOS FSEvents).
+ * Ignores node_modules, .git, dist, build, coverage, and hidden directories.
+ */
+import chokidar, { type FSWatcher } from 'chokidar';
+import { createLogger } from './logger.js';
+import type { EventBus } from './event-bus.js';
+import { EXCLUDED_DIRS } from '../data/scanner-constants.js';
+
+const log = createLogger('file-watcher');
+
+/** File extensions that can affect compliance score. */
+const WATCHED_EXTENSIONS = /\.(ts|tsx|js|jsx|mjs|cjs|json|yaml|yml|md)$/i;
+
+/** Check if a file path should be ignored (any segment matches EXCLUDED_DIRS). */
+const isIgnored = (filePath: string): boolean => {
+  const segments = filePath.split('/');
+  return segments.some((s) => EXCLUDED_DIRS.has(s));
+};
+
+/** Debounce interval matching the 200ms Compliance Gate requirement. */
+const DEBOUNCE_MS = 200;
+
+export interface FileWatcher {
+  start: () => void;
+  stop: () => Promise<void>;
+}
+
+/**
+ * Create a file watcher for the given project directory.
+ *
+ * Call `start()` to begin watching; the watcher emits `file.changed` on the
+ * shared event bus whenever a relevant file is created or modified.
+ */
+export const createFileWatcher = (
+  projectPath: string,
+  events: EventBus,
+): FileWatcher => {
+  let watcher: FSWatcher | null = null;
+  let debounceTimer: ReturnType<typeof setTimeout> | null = null;
+  let pendingFile: string | null = null;
+
+  const scheduleEmit = (filePath: string): void => {
+    pendingFile = filePath;
+    if (debounceTimer !== null) {
+      clearTimeout(debounceTimer);
+    }
+    debounceTimer = setTimeout(() => {
+      if (pendingFile !== null) {
+        log.info(`File changed: ${pendingFile} — triggering compliance gate`);
+        events.emit('file.changed', { path: pendingFile, action: 'edit' });
+        pendingFile = null;
+      }
+      debounceTimer = null;
+    }, DEBOUNCE_MS);
+  };
+
+  const start = (): void => {
+    if (watcher !== null) {
+      log.warn('File watcher already running');
+      return;
+    }
+
+    watcher = chokidar.watch(projectPath, {
+      ignored: isIgnored,
+      persistent: true,
+      ignoreInitial: true,       // don't fire on startup
+      awaitWriteFinish: {
+        stabilityThreshold: 100, // wait 100 ms after last write
+        pollInterval: 50,
+      },
+    });
+
+    watcher
+      .on('add', (filePath: string) => {
+        if (WATCHED_EXTENSIONS.test(filePath) && !isIgnored(filePath)) scheduleEmit(filePath);
+      })
+      .on('change', (filePath: string) => {
+        if (WATCHED_EXTENSIONS.test(filePath) && !isIgnored(filePath)) scheduleEmit(filePath);
+      })
+      .on('error', (err: unknown) => {
+        log.error('File watcher error:', err);
+      })
+      .on('ready', () => {
+        log.info(`Watching ${projectPath} for compliance-relevant changes`);
+      });
+  };
+
+  const stop = async (): Promise<void> => {
+    if (debounceTimer !== null) {
+      clearTimeout(debounceTimer);
+      debounceTimer = null;
+    }
+    if (watcher !== null) {
+      await watcher.close();
+      watcher = null;
+      log.info('File watcher stopped');
+    }
+  };
+
+  return { start, stop };
+};

package/src/infra/git-adapter.ts

@@ -0,0 +1,93 @@
+import simpleGit from 'simple-git';
+import { ToolError } from '../types/errors.js';
+
+export interface GitResult {
+  readonly action: string;
+  readonly data: unknown;
+}
+
+export const gitOperation = async (
+  action: string,
+  args?: Record<string, unknown>,
+  cwd?: string,
+): Promise<GitResult> => {
+  const git = simpleGit(cwd);
+
+  switch (action) {
+    case 'status': {
+      const status = await git.status();
+      return {
+        action: 'status',
+        data: {
+          current: status.current,
+          tracking: status.tracking,
+          files: status.files.map((f) => ({
+            path: f.path,
+            index: f.index,
+            working_dir: f.working_dir,
+          })),
+          ahead: status.ahead,
+          behind: status.behind,
+        },
+      };
+    }
+
+    case 'diff': {
+      const staged = typeof args?.['staged'] === 'boolean' && args['staged'];
+      const diff = staged ? await git.diff(['--staged']) : await git.diff();
+      return { action: 'diff', data: { diff } };
+    }
+
+    case 'log': {
+      const maxCount = typeof args?.['maxCount'] === 'number' ? args['maxCount'] : 10;
+      const log = await git.log({ maxCount });
+      return {
+        action: 'log',
+        data: {
+          all: log.all.map((entry) => ({
+            hash: entry.hash,
+            date: entry.date,
+            message: entry.message,
+            author_name: entry.author_name,
+          })),
+        },
+      };
+    }
+
+    case 'add': {
+      const files = args?.['files'];
+      if (Array.isArray(files) && files.every((f): f is string => typeof f === 'string')) {
+        await git.add(files);
+      } else {
+        await git.add('.');
+      }
+      return { action: 'add', data: { success: true } };
+    }
+
+    case 'commit': {
+      const message = args?.['message'];
+      if (typeof message !== 'string' || message.length === 0) {
+        throw new ToolError('Commit message is required');
+      }
+      const result = await git.commit(message);
+      return {
+        action: 'commit',
+        data: { hash: result.commit, summary: result.summary },
+      };
+    }
+
+    case 'branch': {
+      const branches = await git.branch();
+      return {
+        action: 'branch',
+        data: {
+          current: branches.current,
+          all: branches.all,
+        },
+      };
+    }
+
+    default:
+      throw new ToolError(`Unknown git action: ${action}`);
+  }
+};

package/src/infra/git-history-adapter.ts

@@ -0,0 +1,41 @@
+/**
+ * Infra adapter for GitHistoryPort.
+ * Uses child_process.execSync for git log analysis.
+ * Domain port defined in: domain/scanner/checks/git-history.ts
+ */
+
+import { execSync } from 'node:child_process';
+import type { GitHistoryPort } from '../domain/scanner/checks/git-history.js';
+
+export const createGitHistoryAdapter = (): GitHistoryPort => Object.freeze({
+  isGitRepo: (projectPath) => {
+    try {
+      execSync('git rev-parse --is-inside-work-tree', { cwd: projectPath, stdio: 'pipe' });
+      return true;
+    } catch {
+      return false;
+    }
+  },
+  listTrackedFiles: (projectPath) => {
+    try {
+      const output = execSync('git ls-files', { cwd: projectPath, encoding: 'utf-8' });
+      return output.trim().split('\n').filter(Boolean);
+    } catch {
+      return [];
+    }
+  },
+  getFileLog: (projectPath, filePath) => {
+    try {
+      const output = execSync(
+        `git log --follow --format="%H|%aI|%an" -- "${filePath}"`,
+        { cwd: projectPath, encoding: 'utf-8', timeout: 5000 },
+      );
+      return output.trim().split('\n').filter(Boolean).map((line) => {
+        const [hash = '', date = '', author = ''] = line.split('|');
+        return { hash, date, author };
+      });
+    } catch {
+      return [];
+    }
+  },
+});