@complior/engine 0.9.0

package/src/domain/scanner/layers/layer4-patterns.test.ts

@@ -0,0 +1,397 @@
+import { describe, it, expect } from 'vitest';
+import { runLayer4, layer4ToCheckResults } from './layer4-patterns.js';
+import type { L3CheckResult } from './layer3-config.js';
+import { createScanFile, createScanCtx } from '../../../test-helpers/factories.js';
+
+const withAiSdk: readonly L3CheckResult[] = [{
+  type: 'ai-sdk-detected',
+  status: 'OK',
+  message: 'AI SDK detected: OpenAI',
+  packageName: 'openai',
+  ecosystem: 'npm',
+}];
+
+const noAiSdk: readonly L3CheckResult[] = [];
+
+describe('runLayer4', () => {
+  it('detects bare LLM calls and missing disclosure in Next.js project', () => {
+    const ctx = createScanCtx([
+      createScanFile('src/api/chat.ts', `
+import OpenAI from 'openai';
+const client = new OpenAI();
+try {
+  const response = await openai.chat.completions.create({
+  model: 'gpt-4',
+  messages: [{ role: 'user', content: 'Hello' }],
+  });
+} catch (err) {
+  console.error('LLM call failed:', err);
+  throw err;
+}
+`),
+    ]);
+
+    const results = runLayer4(ctx, withAiSdk);
+
+    const bareLlm = results.filter((r) => r.category === 'bare-llm');
+    expect(bareLlm.length).toBeGreaterThan(0);
+    expect(bareLlm[0].status).toBe('FOUND');
+    expect(bareLlm[0].patternType).toBe('negative');
+    expect(bareLlm[0].file).toBe('src/api/chat.ts');
+    expect(bareLlm[0].line).toBeGreaterThan(0);
+
+    const disclosure = results.filter((r) => r.category === 'disclosure');
+    expect(disclosure.some((r) => r.status === 'NOT_FOUND')).toBe(true);
+  });
+
+  it('detects bare LLM calls and logging in Express project', () => {
+    const ctx = createScanCtx([
+      createScanFile('src/api.ts', `
+import Anthropic from '@anthropic-ai/sdk';
+const client = new Anthropic();
+try {
+  const msg = await anthropic.messages.create({
+  model: 'claude-3-opus',
+  messages: [],
+  });
+} catch (err) {
+  console.error('LLM call failed:', err);
+  throw err;
+}
+`),
+      createScanFile('src/middleware/logger.ts', `
+export function logAiCall(req, res, input, output) {
+  auditLog({ timestamp: Date.now(), input, output });
+}
+`),
+    ]);
+
+    const results = runLayer4(ctx, withAiSdk);
+
+    const bareLlm = results.filter((r) => r.category === 'bare-llm');
+    expect(bareLlm.some((r) => r.status === 'FOUND')).toBe(true);
+
+    const logging = results.filter((r) => r.category === 'logging');
+    expect(logging.some((r) => r.status === 'FOUND')).toBe(true);
+  });
+
+  it('returns no findings when no AI dependencies and no bare calls', () => {
+    const ctx = createScanCtx([
+      createScanFile('src/app.ts', `
+function main() {
+  console.log('Hello world');
+}
+`),
+      createScanFile('src/utils.ts', `
+export function add(a: number, b: number) {
+  return a + b;
+}
+`),
+    ]);
+
+    const results = runLayer4(ctx, noAiSdk);
+
+    // No AI SDK detected and no bare LLM calls → no findings
+    expect(results).toHaveLength(0);
+  });
+
+  it('scans both .ts and .py files in multi-framework project', () => {
+    const ctx = createScanCtx([
+      createScanFile('frontend/src/chat.tsx', `
+try {
+  const response = await openai.chat.completions.create({ model: 'gpt-4' });
+} catch (err) {
+  console.error('LLM call failed:', err);
+  throw err;
+}
+<div className="AIDisclosure">Powered by AI</div>
+`),
+      createScanFile('backend/api.py', `
+import anthropic
+client = anthropic.Anthropic()
+try {
+  message = anthropic.messages.create(model="claude-3")
+} catch (err) {
+  console.error('LLM call failed:', err);
+  throw err;
+}
+`),
+    ]);
+
+    const results = runLayer4(ctx, withAiSdk);
+
+    // Should find bare LLM calls from both files
+    const bareLlm = results.filter((r) => r.category === 'bare-llm');
+    expect(bareLlm.length).toBeGreaterThanOrEqual(2);
+
+    // Should find disclosure from tsx
+    const disclosure = results.filter((r) => r.category === 'disclosure' && r.status === 'FOUND');
+    expect(disclosure).toHaveLength(1);
+  });
+
+  it('ignores files in excluded directories', () => {
+    const ctx = createScanCtx([
+      createScanFile('node_modules/openai/index.js', `openai.chat.completions.create()`),
+      createScanFile('dist/api.js', `openai.chat.completions.create()`),
+      createScanFile('.git/hooks/pre-commit', `openai.chat.completions.create()`),
+    ]);
+
+    const results = runLayer4(ctx, withAiSdk);
+
+    // All files are in ignored dirs, no bare-llm findings from them
+    const bareLlm = results.filter((r) => r.category === 'bare-llm' && r.status === 'FOUND');
+    expect(bareLlm).toHaveLength(0);
+  });
+});
+
+  it('detects data governance patterns', () => {
+    const ctx = createScanCtx([
+      createScanFile('src/data/validator.ts', `
+export class DataValidator {
+  validateData(input: unknown) { return true; }
+  checkDataLineage(record: Record<string, unknown>) { return record; }
+}
+`),
+    ]);
+
+    const results = runLayer4(ctx, withAiSdk);
+    const dataGov = results.filter((r) => r.category === 'data-governance');
+    expect(dataGov.some((r) => r.status === 'FOUND')).toBe(true);
+  });
+
+  it('detects record-keeping patterns', () => {
+    const ctx = createScanCtx([
+      createScanFile('src/audit/trail.ts', `
+export class AuditTrail {
+  persistAudit(entry: unknown) {}
+  complianceRecord(data: unknown) {}
+}
+`),
+    ]);
+
+    const results = runLayer4(ctx, withAiSdk);
+    const records = results.filter((r) => r.category === 'record-keeping');
+    expect(records.some((r) => r.status === 'FOUND')).toBe(true);
+  });
+
+  it('detects accuracy/robustness patterns', () => {
+    const ctx = createScanCtx([
+      createScanFile('src/test/model-validation.ts', `
+export function modelValidation(model: unknown) { return true; }
+export function adversarialTest(input: unknown) { return input; }
+`),
+    ]);
+
+    const results = runLayer4(ctx, withAiSdk);
+    const accuracy = results.filter((r) => r.category === 'accuracy-robustness');
+    expect(accuracy.some((r) => r.status === 'FOUND')).toBe(true);
+  });
+
+  it('detects cybersecurity patterns', () => {
+    const ctx = createScanCtx([
+      createScanFile('src/middleware/security.ts', `
+export const rateLimiter = new RateLimiter({ max: 100 });
+export function sanitizeInput(text: string) { return text.replace(/[<>]/g, ''); }
+`),
+    ]);
+
+    const results = runLayer4(ctx, withAiSdk);
+    const cyber = results.filter((r) => r.category === 'cybersecurity');
+    expect(cyber.some((r) => r.status === 'FOUND')).toBe(true);
+  });
+
+  it('detects deployer monitoring patterns', () => {
+    const ctx = createScanCtx([
+      createScanFile('src/monitoring/drift.ts', `
+export class ModelMonitor {
+  driftDetect(current: number[], baseline: number[]) {}
+  reportIncident(details: unknown) {}
+}
+`),
+    ]);
+
+    const results = runLayer4(ctx, withAiSdk);
+    const monitoring = results.filter((r) => r.category === 'deployer-monitoring');
+    expect(monitoring.some((r) => r.status === 'FOUND')).toBe(true);
+  });
+
+  it('detects GPAI transparency patterns', () => {
+    const ctx = createScanCtx([
+      createScanFile('src/docs/model-card.ts', `
+export const modelCard = { name: 'gpt-4', capabilities: [], limitations: [] };
+`),
+    ]);
+
+    const results = runLayer4(ctx, withAiSdk);
+    const gpai = results.filter((r) => r.category === 'gpai-transparency');
+    expect(gpai.some((r) => r.status === 'FOUND')).toBe(true);
+  });
+
+  it('detects security risk: unsafe eval', () => {
+    const ctx = createScanCtx([
+      createScanFile('src/handler.ts', `
+function handleRequest(req: any) {
+  return eval(req.body.code);
+}
+`),
+    ]);
+
+    const results = runLayer4(ctx, withAiSdk);
+    const securityRisks = results.filter((r) => r.category === 'security-risk' && r.status === 'FOUND');
+    expect(securityRisks.length).toBeGreaterThan(0);
+    expect(securityRisks[0].patternType).toBe('negative');
+  });
+
+  it('detects security risk: pickle.load', () => {
+    const ctx = createScanCtx([
+      createScanFile('src/loader.py', `
+import pickle
+data = pickle.load(open('model.pkl', 'rb'))
+`),
+    ]);
+
+    const results = runLayer4(ctx, withAiSdk);
+    const pickle = results.filter((r) => r.matchedPattern.includes('pickle'));
+    expect(pickle.length).toBeGreaterThan(0);
+  });
+
+  it('reports missing new positive categories when AI SDK detected', () => {
+    const ctx = createScanCtx([
+      createScanFile('src/app.ts', 'const x = 1;'),
+    ]);
+
+    const results = runLayer4(ctx, withAiSdk);
+    const missingCategories = results
+      .filter((r) => r.patternType === 'positive' && r.status === 'NOT_FOUND')
+      .map((r) => r.category);
+
+    expect(missingCategories).toContain('data-governance');
+    expect(missingCategories).toContain('record-keeping');
+    expect(missingCategories).toContain('deployer-monitoring');
+  });
+
+  it('detects conformity assessment patterns', () => {
+    const ctx = createScanCtx([
+      createScanFile('src/compliance/declaration.ts', `
+export const conformityDeclaration = { system: 'AI', standard: 'EU AI Act' };
+`),
+    ]);
+
+    const results = runLayer4(ctx, withAiSdk);
+    const conformity = results.filter((r) => r.category === 'conformity-assessment');
+    expect(conformity.some((r) => r.status === 'FOUND')).toBe(true);
+  });
+
+  it('excludes test and spec files from pattern scanning', () => {
+    const ctx = createScanCtx([
+      createScanFile('src/api/chat.test.ts', `
+try {
+  const response = await openai.chat.completions.create({ model: 'gpt-4' });
+} catch (err) {
+  console.error('LLM call failed:', err);
+  throw err;
+}
+`),
+      createScanFile('src/api/chat.spec.ts', `
+try {
+  const response = await openai.chat.completions.create({ model: 'gpt-4' });
+} catch (err) {
+  console.error('LLM call failed:', err);
+  throw err;
+}
+`),
+      createScanFile('__tests__/api.ts', `
+try {
+  const response = await openai.chat.completions.create({ model: 'gpt-4' });
+} catch (err) {
+  console.error('LLM call failed:', err);
+  throw err;
+}
+`),
+    ]);
+
+    const results = runLayer4(ctx, withAiSdk);
+
+    // Test/spec files should be excluded — no bare-llm findings from them
+    const bareLlm = results.filter((r) => r.category === 'bare-llm' && r.status === 'FOUND');
+    expect(bareLlm).toHaveLength(0);
+  });
+
+describe('layer4ToCheckResults', () => {
+  it('converts bare-llm negative FOUND to info (not fail)', () => {
+    const checkResults = layer4ToCheckResults([{
+      obligationId: 'eu-ai-act-OBL-015',
+      article: 'Art. 50(1)',
+      category: 'bare-llm',
+      patternType: 'negative',
+      status: 'FOUND',
+      file: 'src/chat.ts',
+      line: 5,
+      matchedPattern: 'OpenAI bare API call',
+      recommendation: 'Wrap LLM calls',
+    }]);
+
+    expect(checkResults).toHaveLength(1);
+    expect(checkResults[0].type).toBe('info');
+    if (checkResults[0].type === 'info') {
+      expect(checkResults[0].severity).toBe('info');
+      expect(checkResults[0].message).toContain('src/chat.ts:5');
+      expect(checkResults[0].message).toContain('Consider @complior/sdk');
+    }
+  });
+
+  it('converts non-bare-llm negative FOUND to fail', () => {
+    const checkResults = layer4ToCheckResults([{
+      obligationId: 'eu-ai-act-OBL-006',
+      article: 'Art. 15',
+      category: 'security-risk',
+      patternType: 'negative',
+      status: 'FOUND',
+      file: 'src/handler.ts',
+      line: 3,
+      matchedPattern: 'eval() usage',
+      recommendation: 'Remove eval',
+    }]);
+
+    expect(checkResults).toHaveLength(1);
+    expect(checkResults[0].type).toBe('fail');
+    if (checkResults[0].type === 'fail') {
+      expect(checkResults[0].severity).toBe('medium');
+    }
+  });
+
+  it('converts positive FOUND to pass', () => {
+    const checkResults = layer4ToCheckResults([{
+      obligationId: 'eu-ai-act-OBL-015',
+      article: 'Art. 50(1)',
+      category: 'disclosure',
+      patternType: 'positive',
+      status: 'FOUND',
+      file: 'src/Chat.tsx',
+      line: 10,
+      matchedPattern: 'AI disclosure component/attribute',
+      recommendation: 'Add AI disclosure',
+    }]);
+
+    expect(checkResults).toHaveLength(1);
+    expect(checkResults[0].type).toBe('pass');
+  });
+
+  it('converts positive NOT_FOUND to fail', () => {
+    const checkResults = layer4ToCheckResults([{
+      obligationId: 'eu-ai-act-OBL-010',
+      article: 'Art. 14',
+      category: 'kill-switch',
+      patternType: 'positive',
+      status: 'NOT_FOUND',
+      matchedPattern: 'AI kill switch / feature flag',
+      recommendation: 'Add an AI kill switch',
+    }]);
+
+    expect(checkResults).toHaveLength(1);
+    expect(checkResults[0].type).toBe('fail');
+    if (checkResults[0].type === 'fail') {
+      expect(checkResults[0].severity).toBe('low');
+    }
+  });
+});

package/src/domain/scanner/layers/layer4-patterns.ts

@@ -0,0 +1,216 @@
+import type { CheckResult } from '../../../types/common.types.js';
+import type { ScanContext } from '../../../ports/scanner.port.js';
+import type { L3CheckResult } from './layer3-config.js';
+import { PATTERN_RULES } from '../rules/pattern-rules.js';
+import type { PatternCategory } from '../rules/pattern-rules.js';
+import { isSourceFile, getLineNumber } from '../source-filter.js';
+import { stripCommentsOnly } from '../rules/comment-filter.js';
+
+// --- Types ---
+
+export interface L4CheckResult {
+  readonly obligationId: string;
+  readonly article: string;
+  readonly category: PatternCategory;
+  readonly patternType: 'positive' | 'negative';
+  readonly status: 'FOUND' | 'NOT_FOUND';
+  readonly file?: string;
+  readonly line?: number;
+  readonly matchedPattern: string;
+  readonly recommendation: string;
+}
+
+// --- L4 Runner ---
+
+export const runLayer4 = (
+  ctx: ScanContext,
+  l3Results: readonly L3CheckResult[],
+): readonly L4CheckResult[] => {
+  const results: L4CheckResult[] = [];
+
+  // Determine which AI SDKs were detected by L3
+  const detectedSdks = l3Results
+    .filter((r) => r.type === 'ai-sdk-detected')
+    .map((r) => r.packageName ?? '');
+  const hasAiSdk = detectedSdks.length > 0;
+
+  // Get scannable source files
+  const sourceFiles = ctx.files.filter((f) =>
+    isSourceFile(f.relativePath, f.extension),
+  );
+
+  if (sourceFiles.length === 0) return results;
+
+  // Track which positive categories were found across all files
+  const positiveFound = new Map<PatternCategory, L4CheckResult>();
+  const negativeFound: L4CheckResult[] = [];
+
+  // Pre-compute comment-stripped content per file (E-109)
+  const strippedCache = new Map<string, string>();
+  for (const file of sourceFiles) {
+    strippedCache.set(file.relativePath, stripCommentsOnly(file.content, file.extension));
+  }
+
+  for (const file of sourceFiles) {
+    const stripped = strippedCache.get(file.relativePath) ?? file.content;
+    for (const rule of PATTERN_RULES) {
+      // Reset regex lastIndex for global patterns
+      rule.regex.lastIndex = 0;
+
+      // For negative patterns, find ALL matches (each is a separate violation).
+      // For positive patterns, first match is enough.
+      if (rule.patternType === 'negative') {
+        let match: RegExpExecArray | null;
+        while ((match = rule.regex.exec(stripped)) !== null) {
+          negativeFound.push({
+            obligationId: rule.obligationId,
+            article: rule.article,
+            category: rule.category,
+            patternType: rule.patternType,
+            status: 'FOUND',
+            file: file.relativePath,
+            line: getLineNumber(file.content, match.index),
+            matchedPattern: rule.label,
+            recommendation: rule.recommendation,
+          });
+          if (!rule.regex.global) break;
+        }
+      } else {
+        const match = rule.regex.exec(stripped);
+        if (match !== null && !positiveFound.has(rule.category)) {
+          positiveFound.set(rule.category, {
+            obligationId: rule.obligationId,
+            article: rule.article,
+            category: rule.category,
+            patternType: rule.patternType,
+            status: 'FOUND',
+            file: file.relativePath,
+            line: getLineNumber(file.content, match.index),
+            matchedPattern: rule.label,
+            recommendation: rule.recommendation,
+          });
+        }
+      }
+    }
+  }
+
+  // Filter out bare-llm findings from files that already use @complior/sdk wrapper.
+  // When a file imports @complior/sdk AND wraps constructors with complior(), method
+  // calls like `anthropic.messages.create()` are already compliant.
+  const wrappedFiles = new Set<string>();
+  for (const file of sourceFiles) {
+    if (file.content.includes('@complior/sdk') && /complior\s*\(/.test(file.content)) {
+      wrappedFiles.add(file.relativePath);
+    }
+  }
+
+  // Add negative findings, skipping bare-llm in wrapped files
+  for (const r of negativeFound) {
+    if (r.category === 'bare-llm' && r.file !== undefined && wrappedFiles.has(r.file)) continue;
+    results.push(r);
+  }
+
+  // Add positive findings (good patterns found)
+  for (const result of positiveFound.values()) {
+    results.push(result);
+  }
+
+  // Check for missing positive patterns (only if AI SDK detected)
+  const shouldCheckPositives = hasAiSdk;
+
+  if (shouldCheckPositives) {
+    const positiveCategories: PatternCategory[] = [
+      'disclosure', 'human-oversight', 'kill-switch', 'content-marking', 'logging',
+      'data-governance', 'record-keeping', 'deployer-monitoring',
+    ];
+
+    for (const category of positiveCategories) {
+      if (!positiveFound.has(category)) {
+        const rule = PATTERN_RULES.find((r) => r.category === category);
+        if (rule !== undefined) {
+          results.push({
+            obligationId: rule.obligationId,
+            article: rule.article,
+            category,
+            patternType: 'positive',
+            status: 'NOT_FOUND',
+            matchedPattern: rule.label,
+            recommendation: rule.recommendation,
+          });
+        }
+      }
+    }
+  }
+
+  return results;
+};
+
+// --- Convert to CheckResults ---
+
+export const layer4ToCheckResults = (l4Results: readonly L4CheckResult[]): readonly CheckResult[] => {
+  return l4Results.map((r): CheckResult => {
+    // Bare LLM calls are informational — not a compliance violation
+    if (r.patternType === 'negative' && r.status === 'FOUND' && r.category === 'bare-llm') {
+      const location = r.file !== undefined ? ` in ${r.file}:${r.line}` : '';
+      return {
+        type: 'info',
+        checkId: `l4-${r.category}`,
+        message: `Bare LLM API call detected${location}. Consider @complior/sdk for runtime compliance.`,
+        severity: 'info',
+        obligationId: r.obligationId,
+        articleReference: r.article,
+        fix: 'Optional: wrap with @complior/sdk for runtime Art. 50/12/14 enforcement',
+        file: r.file,
+        line: r.line,
+      };
+    }
+
+    // Negative pattern found → warning (bad)
+    if (r.patternType === 'negative' && r.status === 'FOUND') {
+      const location = r.file !== undefined ? ` in ${r.file}:${r.line}` : '';
+      return {
+        type: 'fail',
+        checkId: `l4-${r.category}`,
+        message: `WARNING: ${r.matchedPattern}${location} — ${r.obligationId} ${r.article}`,
+        severity: 'medium',
+        obligationId: r.obligationId,
+        articleReference: r.article,
+        fix: r.recommendation,
+        file: r.file,
+        line: r.line,
+      };
+    }
+
+    // Positive pattern found → pass (good)
+    if (r.patternType === 'positive' && r.status === 'FOUND') {
+      const location = r.file !== undefined ? ` in ${r.file}:${r.line}` : '';
+      return {
+        type: 'pass',
+        checkId: `l4-${r.category}`,
+        message: `${r.matchedPattern} found${location} (${r.article})`,
+      };
+    }
+
+    // Positive pattern NOT found → warning (missing)
+    if (r.patternType === 'positive' && r.status === 'NOT_FOUND') {
+      return {
+        type: 'fail',
+        checkId: `l4-${r.category}`,
+        message: `WARNING: No ${r.category} pattern found — ${r.obligationId} ${r.article}`,
+        severity: 'low',
+        obligationId: r.obligationId,
+        articleReference: r.article,
+        fix: r.recommendation,
+        file: r.file,
+        line: r.line,
+      };
+    }
+
+    // Negative NOT_FOUND = pass (absence of bad pattern is good)
+    return {
+      type: 'pass',
+      checkId: `l4-${r.category}`,
+      message: `No ${r.category} issues detected`,
+    };
+  });
+};