@complior/engine 0.9.0

package/src/services/scan-service.ts

@@ -0,0 +1,335 @@
+import { randomUUID, createHash } from 'node:crypto';
+import type { ScanResult, Finding, AgentSummary, Role } from '../types/common.types.js';
+import type { ScanContext } from '../ports/scanner.port.js';
+import type { EventBusPort } from '../ports/events.port.js';
+import type { Scanner } from '../domain/scanner/create-scanner.js';
+import { detectDrift } from '../domain/scanner/drift.js';
+import { generateSbom, type CycloneDxBom } from '../domain/scanner/sbom.js';
+import { parseDepsFromContext } from '../domain/shared/parse-dependencies.js';
+import { discoverAgents } from '../domain/passport/discovery/agent-discovery.js';
+import { attributeFindings, expandPerAgentFindings, type AgentInfo } from '../domain/scanner/finding-attribution.js';
+import { buildImportGraph } from '../domain/scanner/import-graph.js';
+import type { EvidenceStore } from '../domain/scanner/evidence-store.js';
+import { createEvidence } from '../domain/scanner/evidence.js';
+import type { AuditStore } from '../domain/audit/audit-trail.js';
+import { computeComplianceDiff, formatDiffMarkdown, type ComplianceDiff } from '../domain/scanner/compliance-diff.js';
+import { loadCustomBannedPackages } from '../domain/scanner/rules/banned-packages.js';
+import { filterFindingsByRole } from '../domain/scanner/role-filter.js';
+import type { ScanCache } from '../domain/scanner/scan-cache.js';
+
+export interface ScanServiceDeps {
+  readonly scanner: Scanner;
+  readonly collectFiles: (projectPath: string) => Promise<ScanContext>;
+  readonly events: EventBusPort;
+  readonly getLastScanResult: () => ScanResult | null;
+  readonly setLastScanResult: (result: ScanResult) => void;
+  readonly evidenceStore?: EvidenceStore;
+  readonly auditStore?: AuditStore;
+  /** E-11: Per-file scan cache (SHA-256 + mtime). Persisted to .complior/cache/. */
+  readonly scanCache?: ScanCache;
+  /** Optional passport service for per-agent finding enrichment + post-scan update. */
+  readonly passportService?: {
+    readonly listPassports: (path?: string) => Promise<readonly { name: string; source_files?: readonly string[] }[]>;
+    readonly updatePassportsAfterScan?: (result: ScanResult, projectPath?: string) => Promise<void>;
+    readonly initPassport?: (projectPath?: string) => Promise<{ manifests: readonly unknown[]; savedPaths: readonly string[]; skipped: readonly string[] }>;
+  };
+  /** Project role from onboarding profile. Injected via composition-root. */
+  readonly getProjectRole?: (projectPath: string) => Promise<Role>;
+}
+
+/** E-11: Compute a fast project-level hash from all file contents. */
+const computeProjectHash = (ctx: ScanContext): string => {
+  const hash = createHash('sha256');
+  // Sort for determinism, then hash path + content
+  const sorted = [...ctx.files].sort((a, b) => a.relativePath.localeCompare(b.relativePath));
+  for (const f of sorted) {
+    hash.update(f.relativePath);
+    hash.update(f.content);
+  }
+  return hash.digest('hex');
+};
+
+/** US-S05-34: Result of a compliance diff scan. */
+export interface ScanDiffResult extends ComplianceDiff {
+  readonly markdown?: string;
+}
+
+
+/** Recalculate score after role filtering (some fails → skip). */
+const recalcScore = (findings: readonly Finding[], original: ScanResult['score']): ScanResult['score'] => {
+  const passed = findings.filter(f => f.type === 'pass').length;
+  const failed = findings.filter(f => f.type === 'fail').length;
+  const skipped = findings.filter(f => f.type === 'skip').length;
+  const applicable = passed + failed;
+  const totalScore = applicable === 0 ? 100 : Math.round((passed / applicable) * 100);
+  return {
+    ...original,
+    totalScore,
+    zone: totalScore >= 80 ? 'green' : totalScore >= 50 ? 'yellow' : 'red',
+    passedChecks: passed,
+    failedChecks: failed,
+    skippedChecks: skipped,
+    totalChecks: findings.length,
+  };
+};
+
+/** Enrich scan findings with agentId from passport source_files mapping. */
+const enrichWithAgentIds = async (
+  result: ScanResult,
+  projectPath: string,
+  passportService?: ScanServiceDeps['passportService'],
+  ctx?: ScanContext,
+): Promise<ScanResult> => {
+  if (!passportService && !ctx) return result;
+
+  let passports: { name: string; source_files?: readonly string[] }[] = [];
+
+  if (passportService) {
+    try { passports = [...await passportService.listPassports(projectPath)]; }
+    catch { /* continue to fallback */ }
+  }
+
+  // Fallback: no persisted passports → auto-discover from code patterns
+  if (passports.length === 0 && ctx) {
+    const discovered = discoverAgents(ctx, parseDepsFromContext(ctx));
+    if (discovered.length === 0) return result;
+    passports = discovered.map(a => ({ name: a.name, source_files: a.sourceFiles }));
+  }
+
+  if (passports.length === 0) return result;
+
+  // Map passports to AgentInfo for attribution
+  const agents: AgentInfo[] = passports.map(p => ({
+    name: p.name,
+    sourceFiles: p.source_files ?? [],
+  }));
+
+  // Build import graph from scan context for graph-based attribution
+  const importGraph = ctx ? buildImportGraph(ctx.files) : null;
+
+  const enrichedFindings: readonly Finding[] = importGraph
+    ? attributeFindings(result.findings, agents, importGraph)
+    : result.findings.map(f => agents.length === 1 ? { ...f, agentId: agents[0].name } : f);
+
+  // Per-agent document requirements: each agent gets its own doc-presence findings
+  const expandedFindings = expandPerAgentFindings(enrichedFindings, agents);
+
+  // Per-agent summaries — include ALL passports (even those with 0 findings)
+  const byAgent = new Map<string, Finding[]>();
+  for (const f of expandedFindings) {
+    if (!f.agentId) continue;
+    if (!byAgent.has(f.agentId)) byAgent.set(f.agentId, []);
+    byAgent.get(f.agentId)!.push(f);
+  }
+
+  const agentSummaries: AgentSummary[] = passports.map(p => {
+    const findings = byAgent.get(p.name) ?? [];
+    return {
+      agentId: p.name,
+      agentName: p.name,
+      findingCount: findings.filter(f => f.type === 'fail').length,
+      criticalCount: findings.filter(f => f.severity === 'critical').length,
+      highCount: findings.filter(f => f.severity === 'high').length,
+      fileCount: new Set(findings.map(f => f.file).filter(Boolean)).size,
+    };
+  });
+
+  return {
+    ...result,
+    findings: expandedFindings,
+    agentSummaries,
+  };
+};
+
+export const createScanService = (deps: ScanServiceDeps) => {
+  const { scanner, collectFiles, events, setLastScanResult } = deps;
+
+  // E-11: In-memory project-level scan cache (hash of all files → ScanResult)
+  let cachedProjectHash: string | null = null;
+  let cachedResult: ScanResult | null = null;
+
+  /** Synchronous post-scan: auto-discover agents + update passports before returning result. */
+  const syncPassportUpdate = async (result: ScanResult, projectPath: string): Promise<void> => {
+    if (!deps.passportService?.updatePassportsAfterScan) return;
+    try {
+      // 1. Auto-discover new agents (idempotent — skips existing)
+      if (deps.passportService.initPassport) {
+        await deps.passportService.initPassport(projectPath).catch(() => ({ manifests: [], savedPaths: [], skipped: [] }));
+      }
+      // 2. Update scores on ALL passports
+      await deps.passportService.updatePassportsAfterScan(result, projectPath);
+    } catch { /* non-fatal */ }
+  };
+
+  /** Apply role filtering to a scan result (pure, no caching side effects). */
+  const applyRoleFilter = async (scanResult: ScanResult, projectPath: string): Promise<ScanResult> => {
+    const projectRole = deps.getProjectRole
+      ? await deps.getProjectRole(projectPath)
+      : 'both' as Role;
+    const filtered = filterFindingsByRole(scanResult.findings, projectRole);
+    if (filtered === scanResult.findings) return scanResult;
+    return { ...scanResult, findings: filtered, score: recalcScore(filtered, scanResult.score) };
+  };
+
+  const scan = async (projectPath: string): Promise<ScanResult> => {
+    events.emit('scan.started', { projectPath });
+
+    const previousResult = deps.getLastScanResult();
+    await loadCustomBannedPackages(projectPath);
+    const ctx = await collectFiles(projectPath);
+
+    // E-11: Check if project content unchanged since last scan
+    const projectHash = computeProjectHash(ctx);
+    if (cachedProjectHash === projectHash && cachedResult !== null) {
+      // Content identical — apply role filter (role may have changed) and return
+      const result = await applyRoleFilter({
+        ...cachedResult,
+        scannedAt: new Date().toISOString(),
+      }, projectPath);
+      events.emit('scan.completed', { result });
+      return result;
+    }
+
+    const rawResult = scanner.scan(ctx);
+    const enriched = await enrichWithAgentIds(rawResult, projectPath, deps.passportService, ctx);
+
+    // E-11: Update in-memory cache with pre-filter result (role-independent)
+    cachedProjectHash = projectHash;
+    cachedResult = enriched;
+
+    // Apply role-based filtering after caching
+    const result = await applyRoleFilter(enriched, projectPath);
+
+    // E-11: Persist file-level cache to disk (survives daemon restarts)
+    if (deps.scanCache) {
+      for (const file of ctx.files) {
+        deps.scanCache.set(file.relativePath, file.content, 0, [], 'L4');
+      }
+      deps.scanCache.save();
+    }
+
+    setLastScanResult(result);
+    events.emit('scan.completed', { result });
+
+    // US-S05-14: Record scan completion in audit trail
+    if (deps.auditStore) {
+      await deps.auditStore.append('scan.completed', {
+        score: result.score.totalScore,
+        zone: result.score.zone,
+        findings: result.findings.length,
+      });
+    }
+
+    // C.R20: Persist scan summary evidence to chain (not individual findings)
+    if (deps.evidenceStore) {
+      const scanId = randomUUID();
+      const uniqueCheckIds = [...new Set(result.findings.map(f => f.checkId))];
+      const summaryEvidence = createEvidence(
+        `scan-${scanId}`,
+        'scan-summary',
+        'pattern-match',
+        {
+          snippet: JSON.stringify({
+            score: result.score.totalScore,
+            zone: result.score.zone,
+            findings: result.findings.length,
+            checks: uniqueCheckIds.length,
+          }),
+        },
+      );
+      await deps.evidenceStore.append([summaryEvidence], scanId);
+    }
+
+    // Drift detection: compare with previous scan
+    if (previousResult !== null) {
+      const drift = detectDrift(result, previousResult);
+      if (drift.hasDrift) {
+        events.emit('scan.drift', { drift });
+      }
+    }
+
+    // Synchronous passport update (ensures passport is current before HTTP response)
+    await syncPassportUpdate(result, projectPath);
+
+    return result;
+  };
+
+  const scanDeep = async (projectPath: string): Promise<ScanResult> => {
+    if (scanner.scanDeep === undefined) {
+      return scan(projectPath);
+    }
+
+    events.emit('scan.started', { projectPath });
+
+    const ctx = await collectFiles(projectPath);
+
+    // Build file contents map for L5 analysis
+    const fileContents = new Map<string, string>();
+    for (const file of ctx.files) {
+      fileContents.set(file.relativePath, file.content);
+    }
+
+    const rawResult = await scanner.scanDeep(ctx, fileContents);
+    const enriched = await enrichWithAgentIds(rawResult, projectPath, deps.passportService, ctx);
+    const result = await applyRoleFilter(enriched, projectPath);
+
+    setLastScanResult(result);
+    events.emit('scan.completed', { result });
+    await syncPassportUpdate(result, projectPath);
+
+    return result;
+  };
+
+  const getSbom = async (projectPath: string): Promise<CycloneDxBom> => {
+    const ctx = await collectFiles(projectPath);
+    return generateSbom(parseDepsFromContext(ctx));
+  };
+
+  /** US-S05-34: Compliance Diff — run scan and compare against baseline. */
+  const scanDiff = async (
+    projectPath: string,
+    changedFiles?: readonly string[],
+    options?: { readonly markdown?: boolean },
+  ): Promise<ScanDiffResult> => {
+    // 1. Get baseline (previous scan result, if any)
+    const baseline = deps.getLastScanResult();
+
+    // 2. Run fresh scan
+    const current = await scan(projectPath);
+
+    // 3. Compute diff using pure domain function
+    const diff = computeComplianceDiff(baseline, current, changedFiles);
+
+    // 4. Generate markdown if requested
+    const markdown = options?.markdown ? formatDiffMarkdown(diff) : undefined;
+
+    return Object.freeze({ ...diff, markdown });
+  };
+
+  const scanTier2 = async (projectPath: string): Promise<ScanResult> => {
+    if (scanner.scanTier2 === undefined) {
+      return scan(projectPath);
+    }
+
+    events.emit('scan.started', { projectPath });
+
+    await loadCustomBannedPackages(projectPath);
+    const ctx = await collectFiles(projectPath);
+    const rawResult = await scanner.scanTier2(ctx);
+    const enriched = await enrichWithAgentIds(rawResult, projectPath, deps.passportService, ctx);
+    const result = await applyRoleFilter(enriched, projectPath);
+
+    setLastScanResult(result);
+    events.emit('scan.completed', { result });
+    await syncPassportUpdate(result, projectPath);
+
+    return result;
+  };
+
+  /** Alias for scanDeep — L5 LLM analysis. */
+  const scanLlm = scanDeep;
+
+  return Object.freeze({ scan, scanDeep, scanTier2, scanLlm, getSbom, scanDiff });
+};
+
+export type ScanService = ReturnType<typeof createScanService>;

package/src/services/share-service.ts

@@ -0,0 +1,108 @@
+import { mkdir, writeFile, readFile, readdir } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { z } from 'zod';
+import type { ScanResult } from '../types/common.types.js';
+import type { EventBusPort } from '../ports/events.port.js';
+import { createSharePayload } from '../domain/reporter/share.js';
+import type { SharePayload } from '../domain/reporter/share.js';
+
+const ShareFindingSchema = z.object({
+  obligationId: z.string(),
+  article: z.string(),
+  severity: z.string(),
+  title: z.string(),
+  recommendation: z.string(),
+});
+
+const SharePayloadSchema = z.object({
+  id: z.string(),
+  createdAt: z.string(),
+  expiresAt: z.string(),
+  score: z.number(),
+  jurisdiction: z.string(),
+  findingsCount: z.object({
+    critical: z.number(),
+    high: z.number(),
+    medium: z.number(),
+    low: z.number(),
+  }),
+  topFindings: z.array(ShareFindingSchema),
+  scanType: z.enum(['code', 'external']),
+  compliorVersion: z.string(),
+});
+
+export interface ShareServiceDeps {
+  readonly events: EventBusPort;
+  readonly getProjectPath: () => string;
+  readonly getLastScanResult: () => ScanResult | null;
+  readonly getVersion: () => string;
+}
+
+export const createShareService = (deps: ShareServiceDeps) => {
+  const { events, getProjectPath, getLastScanResult, getVersion } = deps;
+
+  const getShareDir = () => resolve(getProjectPath(), '.complior', 'shares');
+
+  const createShare = async (options?: {
+    readonly jurisdiction?: string;
+    readonly scanType?: 'code' | 'external';
+    readonly expirationDays?: number;
+  }): Promise<SharePayload> => {
+    const scanResult = getLastScanResult();
+    if (!scanResult) {
+      throw new Error('No scan result available. Run a scan first.');
+    }
+
+    const payload = createSharePayload(scanResult, getVersion(), options);
+
+    const dir = getShareDir();
+    await mkdir(dir, { recursive: true });
+    await writeFile(resolve(dir, `${payload.id}.json`), JSON.stringify(payload, null, 2));
+
+    events.emit('scan.completed', { result: scanResult });
+    return payload;
+  };
+
+  const getShare = async (id: string): Promise<SharePayload | null> => {
+    try {
+      const raw = await readFile(resolve(getShareDir(), `${id}.json`), 'utf-8');
+      const payload = SharePayloadSchema.parse(JSON.parse(raw));
+      if (new Date(payload.expiresAt) < new Date()) {
+        return null;
+      }
+      return payload;
+    } catch {
+      return null;
+    }
+  };
+
+  const listShares = async (): Promise<readonly SharePayload[]> => {
+    try {
+      const dir = getShareDir();
+      const files = await readdir(dir);
+      const now = new Date();
+      const results: SharePayload[] = [];
+
+      for (const file of files) {
+        if (!file.endsWith('.json')) continue;
+        try {
+          const raw = await readFile(resolve(dir, file), 'utf-8');
+          const payload = SharePayloadSchema.parse(JSON.parse(raw));
+          if (new Date(payload.expiresAt) >= now) {
+            results.push(payload);
+          }
+        } catch {
+          // skip corrupt files
+        }
+      }
+
+      return results.sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+    } catch {
+      return [];
+    }
+  };
+
+  return Object.freeze({ createShare, getShare, listShares });
+};
+
+export type ShareService = ReturnType<typeof createShareService>;

package/src/services/shared/backup.ts

@@ -0,0 +1,23 @@
+import { resolve } from 'node:path';
+import { mkdir, copyFile } from 'node:fs/promises';
+
+/**
+ * Create a timestamped backup of a project file.
+ * Returns the backup path. If the source file doesn't exist (e.g. a create action),
+ * the backup is silently skipped but the path is still returned for undo tracking.
+ */
+export const backupFile = async (
+  filePath: string,
+  projectPath: string,
+): Promise<string> => {
+  const backupDir = resolve(projectPath, '.complior', 'backups');
+  await mkdir(backupDir, { recursive: true });
+  const timestamp = Date.now();
+  const backupPath = resolve(backupDir, `${timestamp}-${filePath.replace(/[\\/]/g, '_')}`);
+  try {
+    await copyFile(resolve(projectPath, filePath), backupPath);
+  } catch {
+    // File doesn't exist yet (create action) — no backup needed
+  }
+  return backupPath;
+};

package/src/services/status-service.ts

@@ -0,0 +1,38 @@
+import type { EngineStatus, ScanResult } from '../types/common.types.js';
+
+export interface StatusServiceDeps {
+  readonly getVersion: () => string;
+  readonly getMode: () => string;
+  readonly getStartedAt: () => number;
+  readonly getLastScanResult: () => ScanResult | null;
+}
+
+export const createStatusService = (deps: StatusServiceDeps) => {
+  const { getVersion, getMode, getStartedAt, getLastScanResult } = deps;
+
+  const getStatus = (): EngineStatus => {
+    const lastScan = getLastScanResult();
+
+    return {
+      ready: true,
+      version: getVersion(),
+      mode: getMode(),
+      uptime: Date.now() - getStartedAt(),
+      lastScan: lastScan
+        ? {
+            score: lastScan.score.totalScore,
+            zone: lastScan.score.zone,
+            findingsCount: lastScan.findings.length,
+            criticalCount: lastScan.findings.filter(
+              (f) => f.severity === 'critical',
+            ).length,
+            timestamp: lastScan.scannedAt,
+          }
+        : undefined,
+    };
+  };
+
+  return Object.freeze({ getStatus });
+};
+
+export type StatusService = ReturnType<typeof createStatusService>;

package/src/services/undo-service.test.ts

@@ -0,0 +1,190 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { resolve } from 'node:path';
+import { createUndoService } from './undo-service.js';
+import type { FixPlan, FixResult } from '../domain/fixer/types.js';
+import { createMockScanResult, createMockFinding } from '../test-helpers/factories.js';
+
+const PROJECT_PATH = '/tmp/test-undo';
+const HISTORY_PATH = resolve(PROJECT_PATH, '.complior', 'history.json');
+
+// In-memory fs simulation
+let files: Map<string, string>;
+
+vi.mock('node:fs/promises', () => ({
+  readFile: vi.fn(async (path: string) => {
+    const content = files.get(path);
+    if (content === undefined) throw new Error(`ENOENT: ${path}`);
+    return content;
+  }),
+  writeFile: vi.fn(async (path: string, content: string) => {
+    files.set(path, content);
+  }),
+  mkdir: vi.fn(async () => {}),
+  copyFile: vi.fn(async (src: string, dest: string) => {
+    const content = files.get(src);
+    if (content === undefined) throw new Error(`ENOENT: ${src}`);
+    files.set(dest, content);
+  }),
+  unlink: vi.fn(async (path: string) => {
+    files.delete(path);
+  }),
+}));
+
+const createMockPlan = (overrides?: Partial<FixPlan>): FixPlan => ({
+  obligationId: 'OBL-015',
+  checkId: 'ai-disclosure',
+  article: 'Art. 52',
+  fixType: 'template_generation',
+  framework: 'Next.js',
+  actions: [{ type: 'create', path: 'ai-disclosure.md', content: '# AI', description: 'Create' }],
+  diff: '+# AI',
+  scoreImpact: 5,
+  commitMessage: 'feat: add AI disclosure',
+  description: 'Add disclosure',
+  ...overrides,
+});
+
+const createMockResult = (overrides?: Partial<FixResult>): FixResult => ({
+  plan: createMockPlan(),
+  applied: true,
+  scoreBefore: 60,
+  scoreAfter: 70,
+  backedUpFiles: ['/tmp/test-undo/.complior/backups/123-ai-disclosure.md'],
+  ...overrides,
+});
+
+describe('undo-service', () => {
+  let currentScore: number;
+
+  beforeEach(() => {
+    files = new Map();
+    currentScore = 70;
+  });
+
+  const createTestService = () => {
+    const events = { on: vi.fn(), off: vi.fn(), emit: vi.fn() };
+    const scanService = {
+      scan: vi.fn().mockImplementation(async () =>
+        createMockScanResult({
+          score: {
+            totalScore: currentScore,
+            zone: currentScore >= 80 ? 'green' : 'yellow',
+            categoryScores: [],
+            criticalCapApplied: false,
+            totalChecks: 10,
+            passedChecks: 7,
+            failedChecks: 2,
+            skippedChecks: 1,
+          },
+          findings: [
+            createMockFinding({ checkId: 'ai-disclosure', type: currentScore <= 60 ? 'fail' : 'pass' }),
+          ],
+        }),
+      ),
+    };
+
+    const service = createUndoService({
+      events,
+      scanService,
+      getProjectPath: () => PROJECT_PATH,
+      getHistoryPath: () => HISTORY_PATH,
+      getLastScanResult: () => createMockScanResult({
+        score: {
+          totalScore: currentScore,
+          zone: currentScore >= 80 ? 'green' : 'yellow',
+          categoryScores: [],
+          criticalCapApplied: false,
+          totalChecks: 10,
+          passedChecks: 7,
+          failedChecks: 2,
+          skippedChecks: 1,
+        },
+      }),
+    });
+
+    return { service, events, scanService };
+  };
+
+  it('records fix then undoes it, restoring file', async () => {
+    const { service, events, scanService } = createTestService();
+    const plan = createMockPlan();
+    const result = createMockResult();
+
+    // Set up backup file
+    files.set(result.backedUpFiles[0]!, 'original content');
+
+    await service.recordFix(result, plan);
+
+    // After fix, current score is 70. Undo will re-scan and get 60.
+    scanService.scan.mockImplementationOnce(async () => {
+      currentScore = 60;
+      return createMockScanResult({
+        score: {
+          totalScore: 60,
+          zone: 'yellow',
+          categoryScores: [],
+          criticalCapApplied: false,
+          totalChecks: 10,
+          passedChecks: 6,
+          failedChecks: 3,
+          skippedChecks: 1,
+        },
+        findings: [createMockFinding({ checkId: 'ai-disclosure', type: 'fail' })],
+      });
+    });
+    const validation = await service.undoLast();
+
+    expect(validation.checkId).toBe('ai-disclosure');
+    expect(validation.scoreDelta).toBe(-10); // 60 - 70
+    expect(events.emit).toHaveBeenCalledWith('fix.undone', {
+      checkId: 'ai-disclosure',
+      restoredFiles: ['ai-disclosure.md'],
+    });
+  });
+
+  it('undoes by specific ID when multiple fixes exist', async () => {
+    const { service } = createTestService();
+
+    // Record 3 fixes
+    await service.recordFix(
+      createMockResult({ scoreBefore: 50, scoreAfter: 55 }),
+      createMockPlan({ checkId: 'check-1', obligationId: 'OBL-001' }),
+    );
+    await service.recordFix(
+      createMockResult({ scoreBefore: 55, scoreAfter: 60, backedUpFiles: ['/tmp/test-undo/.complior/backups/456-file2.md'] }),
+      createMockPlan({ checkId: 'check-2', obligationId: 'OBL-002', actions: [{ type: 'edit', path: 'file2.md', oldContent: 'old', newContent: 'new', description: 'Edit' }] }),
+    );
+    await service.recordFix(
+      createMockResult({ scoreBefore: 60, scoreAfter: 65 }),
+      createMockPlan({ checkId: 'check-3', obligationId: 'OBL-003' }),
+    );
+
+    // Set up backup for fix #2
+    files.set('/tmp/test-undo/.complior/backups/456-file2.md', 'backup of file2');
+
+    currentScore = 58;
+    const validation = await service.undoById(2);
+
+    expect(validation.checkId).toBe('check-2');
+    // Should have restored file2.md from backup
+    expect(files.get(resolve(PROJECT_PATH, 'file2.md'))).toBe('backup of file2');
+  });
+
+  it('persists history with correct statuses after apply and undo', async () => {
+    const { service } = createTestService();
+
+    await service.recordFix(createMockResult(), createMockPlan());
+
+    let history = await service.getHistory();
+    expect(history.fixes).toHaveLength(1);
+    expect(history.fixes[0]!.status).toBe('applied');
+
+    currentScore = 60;
+    // Need backup file for create undo (delete)
+    await service.undoLast();
+
+    history = await service.getHistory();
+    expect(history.fixes).toHaveLength(1);
+    expect(history.fixes[0]!.status).toBe('undone');
+  });
+});