@complior/engine 0.9.0

package/src/server.ts

@@ -0,0 +1,134 @@
+import { mkdir, writeFile, unlinkSync, readFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { serve } from '@hono/node-server';
+import { loadApplication } from './composition-root.js';
+import { createLogger } from './infra/logger.js';
+import { withRetry } from './infra/retry.js';
+import { ENGINE_VERSION } from './version.js';
+
+// ── Load user's .complior/.env (API keys for LLM judge, fix --ai, etc.) ────────
+// Users place their API keys in <project>/.complior/.env.
+// We never load the project root .env (it may contain PORT, DATABASE_URL, etc. for the user's own app).
+const loadEnvFile = (filePath: string): void => {
+  try {
+    const content = readFileSync(filePath, 'utf-8');
+    for (const line of content.split('\n')) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith('#')) continue;
+      const eqIdx = trimmed.indexOf('=');
+      if (eqIdx < 1) continue;
+      const key = trimmed.slice(0, eqIdx).trim();
+      const val = trimmed.slice(eqIdx + 1).trim().replace(/^["']|["']$/g, '');
+      if (process.env[key] === undefined) {
+        process.env[key] = val;
+      }
+    }
+  } catch {
+    // File doesn't exist — expected
+  }
+};
+
+const projectDir = process.env['COMPLIOR_PROJECT_PATH'] ?? process.cwd();
+loadEnvFile(resolve(projectDir, '.complior', '.env'));
+
+const log = createLogger('server');
+const PORT = Number(process.env['PORT'] ?? 3099);
+const isMcpMode = process.argv.includes('mcp-server');
+
+const pidFilePath = process.env['COMPLIOR_PID_FILE'] ?? '';
+const watchMode = process.env['COMPLIOR_WATCH'] === '1';
+
+const writePidFile = (port: number): void => {
+  if (!pidFilePath) return;
+  const info = JSON.stringify({
+    pid: process.pid,
+    port,
+    started_at: new Date().toISOString(),
+  });
+  mkdir(dirname(pidFilePath), { recursive: true }, (mkdirErr) => {
+    if (mkdirErr) {
+      log.warn(`Failed to create PID dir: ${mkdirErr.message}`);
+      return;
+    }
+    writeFile(pidFilePath, info, (writeErr) => {
+      if (writeErr) log.warn(`Failed to write PID file: ${writeErr.message}`);
+      else log.info(`PID file written: ${pidFilePath}`);
+    });
+  });
+};
+
+const removePidFile = (): void => {
+  if (!pidFilePath) return;
+  try {
+    unlinkSync(pidFilePath);
+    log.info('PID file removed');
+  } catch {
+    // Already gone or never written — fine
+  }
+};
+
+const startHttp = async (): Promise<void> => {
+  log.info('Loading regulation data...');
+  const { app, startWatcher } = await loadApplication();
+
+  const server = serve({ fetch: app.fetch, port: PORT }, () => {
+    log.info(`Complior Engine v${ENGINE_VERSION} running on http://127.0.0.1:${PORT}`);
+
+    // Write PID file after server binds (daemon mode)
+    writePidFile(PORT);
+
+    // Start file watcher: always in daemon watch mode, or legacy default
+    if (watchMode) {
+      startWatcher();
+      log.info('File watcher started (daemon mode)');
+    } else {
+      // US-S0202: start file watcher for Compliance Gate (legacy default)
+      startWatcher();
+    }
+  });
+
+  // Background: fetch data bundle from SaaS (5s delay, then every 5min)
+  const saasUrl = process.env['PROJECT_API_URL'] ?? '';
+  if (saasUrl && process.env['OFFLINE_MODE'] !== '1') {
+    const { createBundleFetcher } = await import('./infra/bundle-fetcher.js');
+    const cacheDir = process.env['COMPLIOR_CACHE_DIR'] ?? '/tmp/complior-cache';
+    const bundleFetcher = createBundleFetcher(saasUrl, cacheDir);
+    const fetchBundle = () => withRetry(() => bundleFetcher.fetchIfUpdated()).catch((err: unknown) => { log.warn('Background bundle fetch failed:', err); });
+    setTimeout(fetchBundle, 5_000);
+    setInterval(fetchBundle, 300_000);
+  }
+
+  const shutdown = (): void => {
+    log.info('Graceful shutdown...');
+    removePidFile();
+    server.close(() => {
+      log.info('Server closed');
+      process.exit(0);
+    });
+  };
+
+  process.on('SIGINT', shutdown);
+  process.on('SIGTERM', shutdown);
+};
+
+const startMcp = async (): Promise<void> => {
+  const application = await loadApplication();
+  const { state, setLastScanResult } = application;
+  const { createMcpStack } = await import('./mcp/create-mcp-stack.js');
+
+  const { mcpServer } = await createMcpStack({
+    regulationData: state.regulationData,
+    projectPath: state.projectPath,
+    getLastScanResult: () => state.lastScanResult,
+    setLastScanResult,
+    version: state.version,
+  });
+
+  await mcpServer.start();
+};
+
+const main = isMcpMode ? startMcp : startHttp;
+main().catch((err: unknown) => {
+  log.error(`Failed to start engine${isMcpMode ? ' (MCP mode)' : ''}:`, err);
+  process.exit(1);
+});

package/src/services/badge-service.ts

@@ -0,0 +1,67 @@
+import { resolve, dirname } from 'node:path';
+import { mkdir, writeFile } from 'node:fs/promises';
+import type { ScanResult } from '../types/common.types.js';
+import type { EventBusPort } from '../ports/events.port.js';
+import { generateBadgeSvg } from '../domain/reporter/badge-generator.js';
+import { generateComplianceMd } from '../domain/reporter/compliance-md.js';
+
+export interface BadgeServiceDeps {
+  readonly events: EventBusPort;
+  readonly getProjectPath: () => string;
+  readonly getLastScanResult: () => ScanResult | null;
+  readonly getVersion: () => string;
+}
+
+export const createBadgeService = (deps: BadgeServiceDeps) => {
+  const { events, getProjectPath, getLastScanResult, getVersion } = deps;
+
+  let cachedSvg = '';
+
+  const generateBadge = async (): Promise<{ svg: string; md: string; embedCode: string }> => {
+    const scanResult = getLastScanResult();
+    if (!scanResult) {
+      throw new Error('No scan result available. Run a scan first.');
+    }
+
+    const { score } = scanResult;
+    const date = new Date().toISOString().slice(0, 10);
+    const svg = generateBadgeSvg(score.totalScore, score.zone, 'EU', date);
+    const md = generateComplianceMd(scanResult, getVersion());
+
+    const projectPath = getProjectPath();
+    const badgePath = resolve(projectPath, '.complior', 'badge.svg');
+    const mdPath = resolve(projectPath, 'COMPLIANCE.md');
+
+    await mkdir(dirname(badgePath), { recursive: true });
+    await writeFile(badgePath, svg, 'utf-8');
+    await writeFile(mdPath, md, 'utf-8');
+
+    cachedSvg = svg;
+
+    events.emit('badge.generated', {
+      path: badgePath,
+      score: score.totalScore,
+      zone: score.zone,
+    });
+
+    const embedCode = `![Compliance Badge](.complior/badge.svg)`;
+
+    return { svg, md, embedCode };
+  };
+
+  const getBadgeSvg = (): string => {
+    if (cachedSvg) return cachedSvg;
+
+    const scanResult = getLastScanResult();
+    if (!scanResult) return '';
+
+    const { score } = scanResult;
+    const date = new Date().toISOString().slice(0, 10);
+    cachedSvg = generateBadgeSvg(score.totalScore, score.zone, 'EU', date);
+    return cachedSvg;
+  };
+
+  return Object.freeze({ generateBadge, getBadgeSvg });
+};
+
+export type BadgeService = ReturnType<typeof createBadgeService>;

package/src/services/chat-service.test.ts

@@ -0,0 +1,162 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { mkdtemp, readFile, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import type { CoreMessage } from 'ai';
+import { createChatService, type ChatServiceDeps } from './chat-service.js';
+
+const createTestDeps = (overrides: Partial<ChatServiceDeps> = {}): ChatServiceDeps => {
+  const history: CoreMessage[] = [];
+  return {
+    getConversationHistory: () => history,
+    appendConversationHistory: (msg) => { history.push(msg); },
+    getProjectPath: () => '/test/project',
+    getVersion: () => '1.0.0-test',
+    getLastScanResult: () => null,
+    getRegulationData: () => ({
+      obligations: { obligations: [] },
+      scoring: undefined,
+    }),
+    getPassportSummary: async () => null,
+    getChatHistoryPath: () => '/tmp/test-chat-history.json',
+    ...overrides,
+  };
+};
+
+describe('ChatService', () => {
+  describe('buildSystemPrompt', () => {
+    it('includes deadline', async () => {
+      const svc = createChatService(createTestDeps());
+      const prompt = await svc.buildSystemPrompt();
+      expect(prompt).toContain('EU AI Act full enforcement deadline: 2 August 2026');
+      expect(prompt).toMatch(/\d+d left/);
+    });
+
+    it('includes passport data when available', async () => {
+      const svc = createChatService(createTestDeps({
+        getPassportSummary: async () => ({
+          name: 'test-agent',
+          type: 'chatbot',
+          riskClass: 'high',
+          autonomyLevel: 'L3',
+          completeness: 75,
+        }),
+      }));
+      const prompt = await svc.buildSystemPrompt();
+      expect(prompt).toContain('Agent Passport');
+      expect(prompt).toContain('Name: test-agent');
+      expect(prompt).toContain('Risk class: high');
+      expect(prompt).toContain('Autonomy level: L3');
+      expect(prompt).toContain('Completeness: 75%');
+    });
+
+    it('includes top findings from last scan', async () => {
+      const svc = createChatService(createTestDeps({
+        getLastScanResult: () => ({
+          score: { totalScore: 42, zone: 'red', breakdown: {} as never },
+          filesScanned: 10,
+          findings: [
+            { checkId: 'l1-risk', message: 'Missing risk assessment', severity: 'critical', type: 'fail', layer: 'L1', category: 'risk' },
+            { checkId: 'l2-fria', message: 'Incomplete FRIA', severity: 'high', type: 'fail', layer: 'L2', category: 'docs' },
+            { checkId: 'l3-sdk', message: 'No SDK wrapper', severity: 'medium', type: 'fail', layer: 'L3', category: 'code' },
+          ],
+          timestamp: new Date().toISOString(),
+        } as never),
+      }));
+      const prompt = await svc.buildSystemPrompt();
+      expect(prompt).toContain('[CRITICAL] l1-risk: Missing risk assessment');
+      expect(prompt).toContain('[HIGH] l2-fria: Incomplete FRIA');
+      // medium severity should not be in top findings
+      expect(prompt).not.toContain('l3-sdk');
+    });
+
+    it('skips passport section when unavailable', async () => {
+      const svc = createChatService(createTestDeps());
+      const prompt = await svc.buildSystemPrompt();
+      expect(prompt).not.toContain('Agent Passport');
+    });
+  });
+
+  describe('loadHistory / saveHistory', () => {
+    let tmpDir: string;
+
+    beforeEach(async () => {
+      tmpDir = await mkdtemp(join(tmpdir(), 'chat-test-'));
+    });
+
+    afterEach(async () => {
+      await rm(tmpDir, { recursive: true, force: true });
+    });
+
+    it('round-trips chat history through disk', async () => {
+      const historyPath = join(tmpDir, 'chat-history.json');
+      const history: CoreMessage[] = [];
+
+      const svc = createChatService(createTestDeps({
+        getConversationHistory: () => history,
+        appendConversationHistory: (msg) => { history.push(msg); },
+        getChatHistoryPath: () => historyPath,
+      }));
+
+      // Add messages
+      svc.appendConversationHistory({ role: 'user', content: 'Hello' });
+      svc.appendConversationHistory({ role: 'assistant', content: 'Hi there!' });
+      await svc.saveHistory();
+
+      // Verify file exists
+      const raw = await readFile(historyPath, 'utf-8');
+      const saved = JSON.parse(raw) as CoreMessage[];
+      expect(saved).toHaveLength(2);
+      expect(saved[0]!.role).toBe('user');
+      expect(saved[1]!.role).toBe('assistant');
+
+      // Load into a fresh service
+      const history2: CoreMessage[] = [];
+      const svc2 = createChatService(createTestDeps({
+        getConversationHistory: () => history2,
+        appendConversationHistory: (msg) => { history2.push(msg); },
+        getChatHistoryPath: () => historyPath,
+      }));
+      await svc2.loadHistory();
+      expect(history2).toHaveLength(2);
+      expect(history2[0]!.content).toBe('Hello');
+    });
+
+    it('truncates history to 100 messages', async () => {
+      const historyPath = join(tmpDir, 'chat-history.json');
+
+      // Write 120 messages directly
+      const messages: CoreMessage[] = Array.from({ length: 120 }, (_, i) => ({
+        role: (i % 2 === 0 ? 'user' : 'assistant') as 'user' | 'assistant',
+        content: `Message ${i}`,
+      }));
+      const { writeFile } = await import('node:fs/promises');
+      await writeFile(historyPath, JSON.stringify(messages), 'utf-8');
+
+      const history: CoreMessage[] = [];
+      const svc = createChatService(createTestDeps({
+        getConversationHistory: () => history,
+        appendConversationHistory: (msg) => { history.push(msg); },
+        getChatHistoryPath: () => historyPath,
+      }));
+      await svc.loadHistory();
+
+      // Should only load last 100
+      expect(history).toHaveLength(100);
+      expect(history[0]!.content).toBe('Message 20');
+    });
+
+    it('handles missing history file gracefully', async () => {
+      const historyPath = join(tmpDir, 'nonexistent.json');
+      const history: CoreMessage[] = [];
+
+      const svc = createChatService(createTestDeps({
+        getConversationHistory: () => history,
+        appendConversationHistory: (msg) => { history.push(msg); },
+        getChatHistoryPath: () => historyPath,
+      }));
+      await svc.loadHistory();
+      expect(history).toHaveLength(0);
+    });
+  });
+});

package/src/services/chat-service.ts

@@ -0,0 +1,152 @@
+import { readFile, writeFile, mkdir } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { z } from 'zod';
+import { createLogger } from '../infra/logger.js';
+import type { CoreMessage } from 'ai';
+import type { ScanResult } from '../types/common.types.js';
+import type { PassportSummary } from '../types/passport.types.js';
+import type { RegulationData } from '../data/regulation/regulation-loader.js';
+import { EU_AI_ACT_DEADLINE } from '../domain/shared/compliance-constants.js';
+
+/** Maximum chat messages retained in history (disk + memory). */
+const MAX_HISTORY = 100;
+
+/** Maximum top findings shown in system prompt. */
+const MAX_TOP_FINDINGS = 5;
+
+/** Zod schema for validating CoreMessage from disk. */
+const CoreMessageSchema = z.object({
+  role: z.enum(['user', 'assistant', 'system', 'tool']),
+  content: z.unknown(),
+});
+const ChatHistorySchema = z.array(CoreMessageSchema);
+
+export interface ChatServiceDeps {
+  readonly getConversationHistory: () => CoreMessage[];
+  readonly appendConversationHistory: (message: CoreMessage) => void;
+  readonly getProjectPath: () => string;
+  readonly getVersion: () => string;
+  readonly getLastScanResult: () => ScanResult | null;
+  readonly getRegulationData: () => RegulationData;
+  readonly getPassportSummary: () => Promise<PassportSummary | null>;
+  readonly getChatHistoryPath: () => string;
+}
+
+const log = createLogger('chat-service');
+
+export const createChatService = (deps: ChatServiceDeps) => {
+  const {
+    getConversationHistory,
+    appendConversationHistory,
+    getProjectPath,
+    getVersion,
+    getLastScanResult,
+    getRegulationData,
+    getPassportSummary,
+    getChatHistoryPath,
+  } = deps;
+
+  const buildSystemPrompt = async (): Promise<string> => {
+    const parts: string[] = [];
+
+    parts.push('You are Complior — an EU AI Act compliance assistant and AI coding agent.');
+    parts.push('You help developers ensure their AI systems comply with the EU AI Act regulation.');
+    parts.push('');
+    parts.push('## Capabilities');
+    parts.push('You have access to tools for scanning projects, reading/writing files, searching code, running commands, and git operations.');
+    parts.push('When asked to analyze or fix compliance issues, use the available tools to inspect the codebase and make changes.');
+    parts.push('');
+    parts.push('## Guidelines');
+    parts.push('- Always think step-by-step before acting');
+    parts.push('- Read files before editing them');
+    parts.push('- After making changes that affect compliance, run a scan to verify the impact');
+    parts.push('- Be precise and concise in explanations');
+    parts.push('- Reference specific EU AI Act articles when relevant');
+    parts.push('');
+    parts.push(`## Current Context`);
+    parts.push(`- Project path: ${getProjectPath()}`);
+    parts.push(`- Engine version: ${getVersion()}`);
+
+    // Deadline
+    const daysLeft = Math.max(0, Math.ceil((EU_AI_ACT_DEADLINE.getTime() - Date.now()) / (1000 * 60 * 60 * 24)));
+    parts.push(`- EU AI Act full enforcement deadline: 2 August 2026 (${daysLeft}d left)`);
+
+    const lastScan = getLastScanResult();
+    if (lastScan) {
+      const { totalScore, zone } = lastScan.score;
+      parts.push(`- Last scan score: ${totalScore}/100 (${zone} zone)`);
+      parts.push(`- Files scanned: ${lastScan.filesScanned}`);
+
+      // Top critical/high findings
+      const topFindings = lastScan.findings
+        .filter(f => f.severity === 'critical' || f.severity === 'high')
+        .slice(0, MAX_TOP_FINDINGS);
+      if (topFindings.length > 0) {
+        parts.push('');
+        parts.push('## Top Findings');
+        for (const f of topFindings) {
+          parts.push(`- [${f.severity.toUpperCase()}] ${f.checkId}: ${f.message}`);
+        }
+      }
+    }
+
+    // Passport summary
+    try {
+      const passport = await getPassportSummary();
+      if (passport) {
+        parts.push('');
+        parts.push('## Agent Passport');
+        parts.push(`- Name: ${passport.name}`);
+        parts.push(`- Type: ${passport.type}`);
+        parts.push(`- Risk class: ${passport.riskClass}`);
+        parts.push(`- Autonomy level: ${passport.autonomyLevel}`);
+        parts.push(`- Completeness: ${passport.completeness}%`);
+      }
+    } catch { /* passport unavailable — skip */ }
+
+    const regulationData = getRegulationData();
+    const obligations = regulationData.obligations.obligations;
+    if (obligations.length > 0) {
+      parts.push('');
+      parts.push('## Key EU AI Act Obligations');
+      for (const ob of obligations.slice(0, 10)) {
+        const riskLevels = ob.applies_to_risk_level.join(', ');
+        parts.push(`- ${ob.obligation_id}: ${ob.title} (${riskLevels})`);
+      }
+    }
+
+    return parts.join('\n');
+  };
+
+  const loadHistory = async (): Promise<void> => {
+    try {
+      const raw = await readFile(getChatHistoryPath(), 'utf-8');
+      const parsed = ChatHistorySchema.safeParse(JSON.parse(raw));
+      if (!parsed.success) { log.warn('Invalid chat history on disk:', parsed.error.message); return; }
+      const recent = parsed.data.slice(-MAX_HISTORY);
+      for (const msg of recent) {
+        appendConversationHistory(msg as CoreMessage);
+      }
+    } catch { /* no history file — expected on first run */ }
+  };
+
+  const saveHistory = async (): Promise<void> => {
+    const historyPath = getChatHistoryPath();
+    const history = getConversationHistory().slice(-MAX_HISTORY);
+    try {
+      await mkdir(dirname(historyPath), { recursive: true });
+      await writeFile(historyPath, JSON.stringify(history), 'utf-8');
+    } catch { /* ignore write errors */ }
+  };
+
+  return Object.freeze({
+    buildSystemPrompt,
+    getConversationHistory,
+    appendConversationHistory,
+    getProjectPath,
+    loadHistory,
+    saveHistory,
+  });
+};
+
+export type ChatService = ReturnType<typeof createChatService>;

package/src/services/cost-service.ts

@@ -0,0 +1,52 @@
+/**
+ * US-S05-27: Cost Estimation Service
+ *
+ * Orchestrates cost estimation by gathering scan results, passport completeness,
+ * and evidence chain state, then delegates to the pure domain function.
+ */
+
+import type { ScanResult } from '../types/common.types.js';
+import type { CostEstimateResult } from '../domain/cost/cost-estimator.js';
+import { computeCostEstimate } from '../domain/cost/cost-estimator.js';
+import { DEFAULT_HOURLY_RATE } from '../domain/shared/compliance-constants.js';
+
+export interface CostServiceDeps {
+  readonly getLastScanResult: () => ScanResult | null;
+  readonly getPassportCompleteness: (
+    name?: string,
+  ) => Promise<{ score: number; friaCompleted: boolean }>;
+  readonly getEvidenceValid: () => Promise<boolean>;
+}
+
+export interface CostService {
+  readonly estimate: (
+    hourlyRate?: number,
+    agentName?: string,
+  ) => Promise<CostEstimateResult>;
+}
+
+export const createCostService = (deps: CostServiceDeps): CostService => {
+  const estimate = async (
+    hourlyRate = DEFAULT_HOURLY_RATE,
+    agentName?: string,
+  ): Promise<CostEstimateResult> => {
+    const scan = deps.getLastScanResult();
+    const findings = scan?.findings ?? [];
+    const completeness = await deps.getPassportCompleteness(agentName);
+    const evidenceValid = await deps.getEvidenceValid();
+
+    return computeCostEstimate({
+      findings: findings.map((f) => ({
+        severity: f.severity,
+        checkId: f.checkId,
+        status: f.type ?? 'fail',
+      })),
+      passportCompleteness: completeness.score,
+      friaCompleted: completeness.friaCompleted,
+      evidenceValid,
+      hourlyRate,
+    });
+  };
+
+  return Object.freeze({ estimate });
+};

package/src/services/debt-service.ts

@@ -0,0 +1,65 @@
+/**
+ * US-S05-22: Compliance Debt Service
+ *
+ * Application service that gathers inputs from scan results, passport, and
+ * evidence store, then delegates to the pure domain computeDebt function.
+ */
+
+import type { ScanResult } from '../types/common.types.js';
+import type { DebtResult } from '../domain/scanner/debt-calculator.js';
+import { computeDebt } from '../domain/scanner/debt-calculator.js';
+
+export interface DebtServiceDeps {
+  readonly getLastScanResult: () => ScanResult | null;
+  readonly getPassportCompleteness: () => Promise<number>;
+  readonly getEvidenceFreshness: () => Promise<number>;
+}
+
+/** Extended result with optional trend data (previous debt score). */
+export interface DebtResultWithTrend extends DebtResult {
+  readonly previousDebt?: number;
+}
+
+export interface DebtService {
+  readonly getDebt: (includeTrend?: boolean) => Promise<DebtResultWithTrend>;
+}
+
+export const createDebtService = (deps: DebtServiceDeps): DebtService => {
+  /** In-memory previous debt score for trend comparison. */
+  let previousDebt: number | undefined;
+
+  const getDebt = async (includeTrend = false): Promise<DebtResultWithTrend> => {
+    const scan = deps.getLastScanResult();
+    const findings = scan?.findings ?? [];
+    const passportCompleteness = await deps.getPassportCompleteness();
+    const evidenceFreshness = await deps.getEvidenceFreshness();
+
+    // Calculate days since last scan
+    const daysSinceLastScan = scan?.scannedAt
+      ? Math.max(0, (Date.now() - new Date(scan.scannedAt).getTime()) / (1000 * 60 * 60 * 24))
+      : 30;
+
+    const result = computeDebt({
+      findings: findings.map((f) => ({
+        severity: f.severity,
+        status: f.type ?? 'fail',
+        checkId: f.checkId,
+        createdAt: undefined,
+      })),
+      passportCompleteness,
+      evidenceFreshness,
+      daysSinceLastScan: Math.round(daysSinceLastScan),
+    });
+
+    const withTrend: DebtResultWithTrend = includeTrend && previousDebt !== undefined
+      ? { ...result, previousDebt }
+      : result;
+
+    // Store current for next trend comparison
+    previousDebt = result.totalDebt;
+
+    return withTrend;
+  };
+
+  return Object.freeze({ getDebt });
+};