@complior/engine 0.9.0

package/src/domain/fixer/fixer.test.ts

@@ -0,0 +1,306 @@
+import { describe, it, expect } from 'vitest';
+import type { Finding } from '../../types/common.types.js';
+import { createFixer } from './create-fixer.js';
+import { generateUnifiedDiff, generateCreateDiff } from './diff.js';
+import type { FixContext } from './types.js';
+
+// --- Helpers ---
+
+const makeContext = (overrides?: Partial<FixContext>): FixContext => ({
+  projectPath: '/test/project',
+  framework: 'generic',
+  existingFiles: [],
+  ...overrides,
+});
+
+const makeFinding = (overrides: Partial<Finding> & { checkId: string }): Finding => ({
+  type: 'fail',
+  message: 'Test finding',
+  severity: 'high',
+  ...overrides,
+});
+
+// --- Diff tests ---
+
+describe('generateUnifiedDiff', () => {
+  it('generates diff for modified content', () => {
+    const diff = generateUnifiedDiff('src/app.ts', 'line1\nline2\n', 'line1\nchanged\n');
+    expect(diff).toContain('--- a/src/app.ts');
+    expect(diff).toContain('+++ b/src/app.ts');
+    expect(diff).toContain('-line2');
+    expect(diff).toContain('+changed');
+  });
+});
+
+describe('generateCreateDiff', () => {
+  it('generates diff for new file', () => {
+    const diff = generateCreateDiff('new.ts', 'const x = 1;\n');
+    expect(diff).toContain('--- /dev/null');
+    expect(diff).toContain('+++ b/new.ts');
+    expect(diff).toContain('+const x = 1;');
+  });
+});
+
+// --- Fixer factory tests ---
+
+describe('createFixer', () => {
+  const fixer = createFixer({
+    getFramework: () => 'Next.js',
+    getProjectPath: () => '/test/project',
+    getExistingFiles: () => [],
+  });
+
+  it('generateFix returns plan for fixable finding', () => {
+    const finding = makeFinding({ checkId: 'ai-disclosure' });
+    const plan = fixer.generateFix(finding);
+    expect(plan).not.toBeNull();
+    expect(plan!.framework).toBe('Next.js');
+  });
+
+  it('generateFix returns null for pass findings', () => {
+    const finding: Finding = {
+      checkId: 'ai-disclosure',
+      type: 'pass',
+      message: 'OK',
+      severity: 'info',
+    };
+    const plan = fixer.generateFix(finding);
+    expect(plan).toBeNull();
+  });
+
+  it('generateFixes processes multiple findings', () => {
+    const findings: Finding[] = [
+      makeFinding({ checkId: 'ai-disclosure' }),
+      makeFinding({ checkId: 'interaction-logging' }),
+      makeFinding({ checkId: 'unknown' }),
+    ];
+    const plans = fixer.generateFixes(findings);
+    expect(plans).toHaveLength(2);
+  });
+
+  it('generateFixes deduplicates plans with same output path', () => {
+    const findings: Finding[] = [
+      makeFinding({ checkId: 'l4-security-risk' }),
+      makeFinding({ checkId: 'l4-security-risk' }),
+      makeFinding({ checkId: 'l4-ast-missing-error-handling' }),
+    ];
+    const plans = fixer.generateFixes(findings);
+    // All three produce src/middleware/ai-error-handler.ts — should deduplicate to 1
+    expect(plans).toHaveLength(1);
+    expect(plans[0].checkId).toBe('l4-security-risk');
+  });
+
+  it('previewFix returns same as generateFix', () => {
+    const finding = makeFinding({ checkId: 'content-marking' });
+    const plan = fixer.previewFix(finding);
+    expect(plan).not.toBeNull();
+    expect(plan!.fixType).toBe('config_fix');
+  });
+});
+
+// --- Inline fix from fixDiff ---
+
+describe('inline fix from fixDiff', () => {
+  const fixer = createFixer({
+    getFramework: () => 'generic',
+    getProjectPath: () => '/test/project',
+    getExistingFiles: () => [],
+  });
+
+  it('generates splice plan when finding has fixDiff', () => {
+    const finding = makeFinding({
+      checkId: 'l4-security-risk',
+      fixDiff: {
+        filePath: 'src/handler.ts',
+        startLine: 5,
+        before: ['return eval(req.body.code);'],
+        after: ['return /* COMPLIOR: eval() disabled */ undefined;'],
+        importLine: undefined,
+      },
+    });
+    const plan = fixer.generateFix(finding);
+    expect(plan).not.toBeNull();
+    expect(plan!.actions[0].type).toBe('splice');
+    expect(plan!.actions[0].startLine).toBe(5);
+    expect(plan!.actions[0].beforeLines).toEqual(['return eval(req.body.code);']);
+    expect(plan!.actions[0].afterLines).toEqual(['return /* COMPLIOR: eval() disabled */ undefined;']);
+    expect(plan!.fixType).toBe('code_injection');
+    expect(plan!.scoreImpact).toBe(6);
+  });
+
+  it('inline fix takes priority over scaffold strategy', () => {
+    const finding = makeFinding({
+      checkId: 'l4-nhi-api-key',
+      fixDiff: {
+        filePath: 'src/config.ts',
+        startLine: 10,
+        before: ["const API_KEY = 'sk-1234567890abcdef';"],
+        after: ["const API_KEY = process.env.API_KEY ?? '';"],
+      },
+    });
+    const plan = fixer.generateFix(finding);
+    expect(plan).not.toBeNull();
+    // Should be splice (inline), not create (scaffold)
+    expect(plan!.actions[0].type).toBe('splice');
+    expect(plan!.actions[0].path).toBe('src/config.ts');
+  });
+
+  it('returns null for info findings (no fix needed)', () => {
+    const finding = makeFinding({ checkId: 'l4-bare-llm', type: 'info', severity: 'info' });
+    const plan = fixer.generateFix(finding);
+    expect(plan).toBeNull();
+  });
+
+  it('dedup by path:startLine for splice — different lines produce 2 plans', () => {
+    const findings = [
+      makeFinding({
+        checkId: 'l4-nhi-api-key',
+        fixDiff: { filePath: 'src/config.ts', startLine: 5, before: ["const A = 'sk-123';"], after: ["const A = process.env.A ?? '';"] },
+      }),
+      makeFinding({
+        checkId: 'l4-nhi-api-key',
+        fixDiff: { filePath: 'src/config.ts', startLine: 20, before: ["const B = 'sk-456';"], after: ["const B = process.env.B ?? '';"] },
+      }),
+    ];
+    const plans = fixer.generateFixes(findings);
+    expect(plans).toHaveLength(2);
+  });
+
+  it('dedup catches identical splice — same file same line produces 1 plan', () => {
+    const findings = [
+      makeFinding({
+        checkId: 'l4-nhi-api-key',
+        fixDiff: { filePath: 'src/config.ts', startLine: 5, before: ["const A = 'sk-123';"], after: ["const A = process.env.A ?? '';"] },
+      }),
+      makeFinding({
+        checkId: 'l4-nhi-api-key',
+        fixDiff: { filePath: 'src/config.ts', startLine: 5, before: ["const A = 'sk-123';"], after: ["const A = process.env.A ?? '';"] },
+      }),
+    ];
+    const plans = fixer.generateFixes(findings);
+    expect(plans).toHaveLength(1);
+  });
+});
+
+// --- Inline fix for new fix types ---
+
+describe('NHI inline fix', () => {
+  const fixer = createFixer({
+    getFramework: () => 'generic',
+    getProjectPath: () => '/test/project',
+    getExistingFiles: () => [],
+  });
+
+  it('generates splice plan with process.env replacement', () => {
+    const finding = makeFinding({
+      checkId: 'l4-nhi-openai-key',
+      fixDiff: {
+        filePath: 'src/config.ts',
+        startLine: 3,
+        before: ["const API_KEY = 'sk-1234567890abcdef';"],
+        after: ["const API_KEY = process.env.API_KEY ?? ''"],
+      },
+    });
+    const plan = fixer.generateFix(finding);
+    expect(plan).not.toBeNull();
+    expect(plan!.actions[0].type).toBe('splice');
+    expect(plan!.description).toContain('externalize secret');
+  });
+
+  it('generates splice plan with os.environ for Python', () => {
+    const finding = makeFinding({
+      checkId: 'l4-nhi-generic-secret',
+      fixDiff: {
+        filePath: 'config.py',
+        startLine: 5,
+        before: ['API_KEY = "sk-1234"'],
+        after: ["API_KEY = os.environ.get('API_KEY', '')"],
+        importLine: 'import os',
+      },
+    });
+    const plan = fixer.generateFix(finding);
+    expect(plan).not.toBeNull();
+    expect(plan!.actions[0].importLine).toBe('import os');
+  });
+});
+
+describe('security risk inline fix', () => {
+  const fixer = createFixer({
+    getFramework: () => 'generic',
+    getProjectPath: () => '/test/project',
+    getExistingFiles: () => [],
+  });
+
+  it('generates splice plan for security pattern', () => {
+    const finding = makeFinding({
+      checkId: 'l4-security-risk',
+      fixDiff: {
+        filePath: 'src/ml/pipeline.py',
+        startLine: 10,
+        before: ['model = pickle.load(f)'],
+        after: ['model = json.load(f)'],
+        importLine: 'import json',
+      },
+    });
+    const plan = fixer.generateFix(finding);
+    expect(plan).not.toBeNull();
+    expect(plan!.actions[0].type).toBe('splice');
+    expect(plan!.description).toContain('security risk');
+  });
+});
+
+describe('error handling inline fix', () => {
+  const fixer = createFixer({
+    getFramework: () => 'generic',
+    getProjectPath: () => '/test/project',
+    getExistingFiles: () => [],
+  });
+
+  it('generates splice plan with try/catch wrapping', () => {
+    const finding = makeFinding({
+      checkId: 'l4-ast-missing-error-handling',
+      fixDiff: {
+        filePath: 'src/chat/agent.ts',
+        startLine: 15,
+        before: ['  const result = await client.messages.create({ model: "claude-3" });'],
+        after: [
+          '  try {',
+          '    const result = await client.messages.create({ model: "claude-3" });',
+          '  } catch (err) {',
+          "    console.error('LLM call failed:', err);",
+          '    throw err;',
+          '  }',
+        ],
+      },
+    });
+    const plan = fixer.generateFix(finding);
+    expect(plan).not.toBeNull();
+    expect(plan!.actions[0].type).toBe('splice');
+    expect(plan!.description).toContain('error handling');
+  });
+});
+
+describe('banned dep inline fix', () => {
+  const fixer = createFixer({
+    getFramework: () => 'generic',
+    getProjectPath: () => '/test/project',
+    getExistingFiles: () => [],
+  });
+
+  it('generates splice plan removing banned dep line', () => {
+    const finding = makeFinding({
+      checkId: 'l3-banned-emotion-recognition',
+      fixDiff: {
+        filePath: 'package.json',
+        startLine: 8,
+        before: ['    "emotion-recognition": "^1.0.0",'],
+        after: [],
+      },
+    });
+    const plan = fixer.generateFix(finding);
+    expect(plan).not.toBeNull();
+    expect(plan!.actions[0].type).toBe('splice');
+    expect(plan!.actions[0].afterLines).toEqual([]);
+    expect(plan!.description).toContain('banned dependency');
+  });
+});

package/src/domain/fixer/index.ts

@@ -0,0 +1,9 @@
+export { createFixer } from './create-fixer.js';
+export type { FixerDeps, Fixer } from './create-fixer.js';
+export { generateUnifiedDiff, generateCreateDiff } from './diff.js';
+export { createEmptyHistory, addEntry, markUndone, getLastApplied, getById } from './fix-history.js';
+export { fillTemplate, getTemplateForObligation, getAvailableTemplates } from './template-engine.js';
+export type { TemplateData } from './template-engine.js';
+export type { FixType, FixAction, FixPlan, FixResult, FixContext } from './types.js';
+export type { FixValidation, FixHistoryFile, FixHistoryEntry, FixHistory, FixStrategy, TemplateMapping } from './types.js';
+export { findStrategy } from './strategies/index.js';

package/src/domain/fixer/strategies/bandit-fix.ts

@@ -0,0 +1,61 @@
+import type { FixStrategy, FixAction } from '../types.js';
+import { generateCreateDiff } from '../diff.js';
+import { ENGINE_VERSION } from '../../../version.js';
+
+// --- Strategy: Bandit Fix (Art. 15.4) ---
+
+const BANDIT_FIXES: Record<string, { issue: string; fix: string }> = {
+  'B301': { issue: 'Use of pickle (deserialization risk)', fix: 'Replace pickle with json or yaml for data serialization' },
+  'B603': { issue: 'subprocess call with shell=True', fix: 'Use subprocess.run() with a list of arguments instead of shell=True' },
+  'B608': { issue: 'SQL injection via string formatting', fix: 'Use parameterized queries instead of string concatenation' },
+  'B105': { issue: 'Hardcoded password in source code', fix: 'Move password to environment variable or secrets manager' },
+};
+
+export const banditFixStrategy: FixStrategy = (finding, context) => {
+  if (!finding.checkId.startsWith('ext-bandit-')) return null;
+
+  const ruleId = finding.checkId.replace('ext-bandit-', '').toUpperCase();
+  const known = BANDIT_FIXES[ruleId];
+
+  const lines = [`# Security Fixes — Bandit Findings\n`];
+  lines.push(`Generated by Complior v${ENGINE_VERSION}\n`);
+
+  if (known) {
+    lines.push(`## ${ruleId}: ${known.issue}\n`);
+    lines.push(`**Fix:** ${known.fix}\n`);
+  } else {
+    lines.push(`## ${ruleId}: Security finding\n`);
+    lines.push(`**Fix:** Review the flagged code and apply the recommended remediation from Bandit documentation.\n`);
+  }
+
+  if (finding.message) {
+    lines.push(`### Details\n`);
+    lines.push(`${finding.message}\n`);
+  }
+
+  lines.push(`## Verification\n`);
+  lines.push(`- [ ] Fix applied\n- [ ] Re-run \`bandit\` to verify\n- [ ] Peer review completed\n`);
+
+  const content = lines.join('\n');
+  const filePath = 'complior-security-fixes.md';
+
+  const action: FixAction = {
+    type: 'create',
+    path: filePath,
+    content,
+    description: `Create security fix plan for Bandit ${ruleId}`,
+  };
+
+  return {
+    obligationId: finding.obligationId ?? 'eu-ai-act-OBL-008',
+    checkId: finding.checkId,
+    article: finding.articleReference ?? 'Art. 15(4)',
+    fixType: 'template_generation',
+    framework: context.framework,
+    actions: [action],
+    diff: generateCreateDiff(filePath, content),
+    scoreImpact: 4,
+    commitMessage: `fix: add Bandit ${ruleId} remediation plan (Art. 15.4) -- via Complior`,
+    description: `Create security remediation plan for Bandit finding ${ruleId}`,
+  };
+};

package/src/domain/fixer/strategies/bias-testing.ts

@@ -0,0 +1,49 @@
+import type { FixStrategy, FixAction } from '../types.js';
+import { generateCreateDiff } from '../diff.js';
+
+// --- Strategy: Bias Testing (Art. 10) ---
+
+export const biasTestingStrategy: FixStrategy = (finding, context) => {
+  if (finding.checkId !== 'l3-missing-bias-testing') return null;
+
+  const filePath = 'bias-testing.config.json';
+  const content = JSON.stringify({
+    version: '1.0',
+    protectedAttributes: ['gender', 'race', 'age', 'disability', 'religion', 'nationality'],
+    fairnessMetrics: {
+      equalized_odds: { enabled: true, threshold: 0.1 },
+      demographic_parity: { enabled: true, threshold: 0.1 },
+      predictive_parity: { enabled: true, threshold: 0.15 },
+    },
+    testDataset: {
+      path: 'tests/bias/',
+      format: 'jsonl',
+      minSamplesPerGroup: 100,
+    },
+    reporting: {
+      outputDir: 'reports/bias/',
+      format: 'json',
+      includeConfidenceIntervals: true,
+    },
+  }, null, 2);
+
+  const action: FixAction = {
+    type: 'create',
+    path: filePath,
+    content,
+    description: 'Create bias testing configuration',
+  };
+
+  return {
+    obligationId: finding.obligationId ?? 'eu-ai-act-OBL-004',
+    checkId: finding.checkId,
+    article: finding.articleReference ?? 'Art. 10',
+    fixType: 'config_fix',
+    framework: context.framework,
+    actions: [action],
+    diff: generateCreateDiff(filePath, content),
+    scoreImpact: 4,
+    commitMessage: 'fix: add bias testing configuration (Art. 10) -- via Complior',
+    description: 'Add bias testing configuration with fairness metrics and thresholds',
+  };
+};

package/src/domain/fixer/strategies/ci-compliance.ts

@@ -0,0 +1,57 @@
+import type { FixStrategy, FixAction } from '../types.js';
+import { generateCreateDiff } from '../diff.js';
+
+// --- Strategy: CI Compliance (Art. 17) ---
+
+export const ciComplianceStrategy: FixStrategy = (finding, context) => {
+  if (finding.checkId !== 'l3-ci-compliance') return null;
+
+  const filePath = '.github/workflows/compliance-check.yml';
+  const content = `name: Compliance Check
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main]
+
+jobs:
+  compliance:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Run Complior scan
+        run: npx complior scan --ci --threshold 70
+
+      - name: Upload SARIF
+        if: always()
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: complior-report.sarif
+`;
+
+  const action: FixAction = {
+    type: 'create',
+    path: filePath,
+    content,
+    description: 'Create GitHub Actions compliance check workflow',
+  };
+
+  return {
+    obligationId: finding.obligationId ?? 'eu-ai-act-OBL-010',
+    checkId: finding.checkId,
+    article: finding.articleReference ?? 'Art. 17',
+    fixType: 'config_fix',
+    framework: context.framework,
+    actions: [action],
+    diff: generateCreateDiff(filePath, content),
+    scoreImpact: 4,
+    commitMessage: 'fix: add CI compliance check workflow (Art. 17) -- via Complior',
+    description: 'Add GitHub Actions workflow for automated compliance scanning',
+  };
+};

package/src/domain/fixer/strategies/content-marking.ts

@@ -0,0 +1,45 @@
+import type { FixStrategy, FixAction } from '../types.js';
+import { generateCreateDiff } from '../diff.js';
+
+export const contentMarkingStrategy: FixStrategy = (finding, context) => {
+  if (finding.checkId !== 'content-marking') return null;
+
+  const configPath = 'complior-content-marking.json';
+  const content = JSON.stringify({
+    version: '1.0',
+    standard: 'C2PA',
+    marking: {
+      enabled: true,
+      method: 'metadata',
+      fields: {
+        'dc:creator': 'AI-generated',
+        'ai:model': '[PASSPORT:model.model_id]',
+        'ai:provider': '[PASSPORT:model.provider]',
+        'xmp:CreatorTool': 'Complior Content Marking',
+      },
+    },
+    iptc: {
+      'Iptc4xmpExt:DigitalSourceType': 'trainedAlgorithmicMedia',
+    },
+  }, null, 2);
+
+  const action: FixAction = {
+    type: 'create',
+    path: configPath,
+    content,
+    description: 'Create C2PA/IPTC content marking configuration',
+  };
+
+  return {
+    obligationId: finding.obligationId ?? 'eu-ai-act-OBL-016',
+    checkId: finding.checkId,
+    article: finding.articleReference ?? 'Art. 50(2)',
+    fixType: 'config_fix',
+    framework: context.framework,
+    actions: [action],
+    diff: generateCreateDiff(configPath, content),
+    scoreImpact: 5,
+    commitMessage: 'fix: add C2PA content marking config (Art. 50.2) -- via Complior',
+    description: 'Add C2PA/IPTC content marking configuration for AI-generated content',
+  };
+};

package/src/domain/fixer/strategies/cve-upgrade.ts

@@ -0,0 +1,66 @@
+import type { FixStrategy, FixAction } from '../types.js';
+import { generateCreateDiff } from '../diff.js';
+import { ENGINE_VERSION } from '../../../version.js';
+
+// --- Strategy: CVE Upgrade (Art. 15) ---
+
+export const cveUpgradeStrategy: FixStrategy = (finding, context) => {
+  if (finding.checkId !== 'l3-dep-vuln') return null;
+
+  const filePath = 'complior-upgrade-plan.md';
+  const content = `# Dependency Vulnerability Upgrade Plan
+
+Generated by Complior v${ENGINE_VERSION}
+
+## Vulnerability Summary
+
+${finding.message || 'Vulnerable dependency detected — see scan results for details.'}
+
+## Upgrade Commands
+
+### npm / Node.js
+\`\`\`bash
+npm audit fix
+npm update <package-name>
+\`\`\`
+
+### pip / Python
+\`\`\`bash
+pip install --upgrade <package-name>
+pip-audit --fix
+\`\`\`
+
+### cargo / Rust
+\`\`\`bash
+cargo update <package-name>
+cargo audit fix
+\`\`\`
+
+## Verification Checklist
+
+- [ ] Run \`npm audit\` / \`pip-audit\` / \`cargo audit\` after upgrade
+- [ ] Run full test suite to verify no regressions
+- [ ] Update lock file and commit
+- [ ] Review changelog for breaking changes
+`;
+
+  const action: FixAction = {
+    type: 'create',
+    path: filePath,
+    content,
+    description: 'Create dependency upgrade plan for CVE remediation',
+  };
+
+  return {
+    obligationId: finding.obligationId ?? 'eu-ai-act-OBL-008',
+    checkId: finding.checkId,
+    article: finding.articleReference ?? 'Art. 15',
+    fixType: 'dependency_fix',
+    framework: context.framework,
+    actions: [action],
+    diff: generateCreateDiff(filePath, content),
+    scoreImpact: 5,
+    commitMessage: 'fix: add dependency vulnerability upgrade plan (Art. 15) -- via Complior',
+    description: 'Create upgrade plan for vulnerable dependencies',
+  };
+};

package/src/domain/fixer/strategies/data-governance.ts

@@ -0,0 +1,65 @@
+import type { FixStrategy, FixAction } from '../types.js';
+import { generateCreateDiff } from '../diff.js';
+
+// --- Strategy: Data Governance (Art. 10) ---
+
+export const dataGovernanceStrategy: FixStrategy = (finding, context) => {
+  if (finding.checkId !== 'l4-data-governance') return null;
+
+  const filePath = 'src/middleware/data-governance.ts';
+  const content = `// Data Governance Middleware (EU AI Act, Art. 10)
+// Input validation, PII detection, and data quality checks
+
+export interface DataQualityReport {
+  readonly timestamp: string;
+  readonly inputSize: number;
+  readonly piiDetected: boolean;
+  readonly validationPassed: boolean;
+  readonly issues: string[];
+}
+
+const PII_PATTERNS = [
+  /\\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\\.[A-Z]{2,}\\b/i,
+  /\\b\\d{3}-\\d{2}-\\d{4}\\b/,
+  /\\b\\d{16}\\b/,
+];
+
+export const detectPII = (text: string): boolean =>
+  PII_PATTERNS.some((p) => p.test(text));
+
+export const validateInput = (input: string): DataQualityReport => {
+  const issues: string[] = [];
+  if (!input.trim()) issues.push('Empty input');
+  if (input.length > 100_000) issues.push('Input exceeds maximum length');
+  const piiDetected = detectPII(input);
+  if (piiDetected) issues.push('PII detected in input');
+  return {
+    timestamp: new Date().toISOString(),
+    inputSize: input.length,
+    piiDetected,
+    validationPassed: issues.length === 0,
+    issues,
+  };
+};
+`;
+
+  const action: FixAction = {
+    type: 'create',
+    path: filePath,
+    content,
+    description: 'Create data governance middleware with PII detection',
+  };
+
+  return {
+    obligationId: finding.obligationId ?? 'eu-ai-act-OBL-004',
+    checkId: finding.checkId,
+    article: finding.articleReference ?? 'Art. 10',
+    fixType: 'code_injection',
+    framework: context.framework,
+    actions: [action],
+    diff: generateCreateDiff(filePath, content),
+    scoreImpact: 5,
+    commitMessage: 'fix: add data governance middleware (Art. 10) -- via Complior',
+    description: 'Add data governance middleware with input validation and PII detection',
+  };
+};