atabey 0.0.16 → 0.0.17

package/framework-mcp/dist/framework-mcp/src/utils/fs.js

@@ -1,47 +0,0 @@
-import fs from "fs";
-import path from "path";
-/**
- * Ensures directory existence.
- */
-export function ensureDir(dirPath) {
-    if (!fs.existsSync(dirPath)) {
-        fs.mkdirSync(dirPath, { recursive: true });
-    }
-}
-/**
- * Atomically writes a text file.
- * Uses a temp file + rename pattern to prevent partial writes.
- * Compatible with src/shared/fs.ts writeTextFile API.
- */
-export function writeTextFile(filePath, content) {
-    const dir = path.dirname(filePath);
-    ensureDir(dir);
-    const tempPath = `${filePath}.${Math.random().toString(36).slice(2, 9)}.tmp`;
-    const finalContent = content.endsWith("\n") ? content : `${content}\n`;
-    try {
-        fs.writeFileSync(tempPath, finalContent, "utf8");
-        fs.renameSync(tempPath, filePath);
-    }
-    catch (err) {
-        if (fs.existsSync(tempPath)) {
-            try {
-                fs.unlinkSync(tempPath);
-            }
-            catch { /* ignore */ }
-        }
-        throw err;
-    }
-}
-/** @deprecated Use writeTextFile instead */
-export const writeTextFileAtomic = writeTextFile;
-/**
- * Appends content to a file. Creates parent directories if missing.
- * Compatible with src/shared/fs.ts appendFile API.
- */
-export function appendFile(filePath, content) {
-    const dir = path.dirname(filePath);
-    ensureDir(dir);
-    fs.appendFileSync(filePath, content, "utf8");
-}
-/** @deprecated Use appendFile instead */
-export const appendFileSafe = appendFile;

package/framework-mcp/dist/framework-mcp/src/utils/human-in-loop.js

@@ -1,319 +0,0 @@
-/**
- * ─── HUMAN-IN-THE-LOOP (In-CLI Approval) ──────────────────────────
- *
- * Allows risk-gated approvals without the developer leaving their AI CLI chat.
- *
- * Key Innovation: Instead of forcing developers to switch to a web dashboard
- * or another terminal, approval requests are sent as MCP notifications into
- * the developer's existing chat interface.
- *
- * Flow:
- * 1. Tool call triggers risk detection
- * 2. If risk >= threshold, tool is blocked with a structured error
- * 3. Error message includes the traceId and approval command
- * 4. Developer types "atabey approve <traceId>" in the same chat
- * 5. Hermes message status updates → retry succeeds
- *
- * Risk Levels:
- * - LOW (0-30): Silent pass (no approval needed)
- * - MEDIUM (31-59): Stealth warning to stderr only
- * - HIGH (60-100): Blocked until approval
- */
-import { AtabeyStorage } from "../../../src/shared/storage.js";
-import { asAgentID, asTraceID } from "../../../src/shared/types.js";
-// ─── Configuration ────────────────────────────────────────────────
-const CONFIG = {
-    /** Risk threshold for blocking (0-100) */
-    HIGH_RISK_THRESHOLD: parseInt(process.env.MCP_HIGH_RISK_THRESHOLD || "60", 10),
-    /** Risk threshold for medium warning */
-    MEDIUM_RISK_THRESHOLD: parseInt(process.env.MCP_MEDIUM_RISK_THRESHOLD || "30", 10),
-    /** Auto-approve low risk operations */
-    AUTO_APPROVE_LOW_RISK: process.env.MCP_AUTO_APPROVE_LOW_RISK !== "false",
-    /** Approval timeout in seconds */
-    APPROVAL_TIMEOUT_SECONDS: parseInt(process.env.MCP_APPROVAL_TIMEOUT || "300", 10), // 5 min
-    /**
-     * Minimum risk score requiring Lead/Admin approval (legacy compat).
-     * Superseded by ROLE_RISK_MAP below — kept for backward compatibility with env var.
-     */
-    RBAC_HIGH_RISK_THRESHOLD: parseInt(process.env.MCP_RBAC_HIGH_RISK_THRESHOLD || "80", 10),
-};
-/**
- * Maximum risk score each role is allowed to approve.
- * A role can approve any operation with riskScore <= its max.
- * Override via MCP_RBAC_ROLE_* env vars.
- *
- *   junior    → cannot approve anything (max = -1)
- *   developer → can approve MEDIUM risk (0–59)
- *   lead      → can approve HIGH risk (0–79)
- *   admin     → can approve any risk (0–100)
- */
-export const ROLE_RISK_MAP = {
-    admin: parseInt(process.env.MCP_RBAC_ROLE_ADMIN || "100", 10),
-    lead: parseInt(process.env.MCP_RBAC_ROLE_LEAD || "79", 10),
-    developer: parseInt(process.env.MCP_RBAC_ROLE_DEVELOPER || "59", 10),
-    junior: parseInt(process.env.MCP_RBAC_ROLE_JUNIOR || "-1", 10), // cannot approve
-};
-/**
- * Returns the minimum role required to approve an operation at the given risk score.
- */
-export function getMinimumRoleForScore(riskScore) {
-    if (riskScore <= ROLE_RISK_MAP.developer)
-        return "developer";
-    if (riskScore <= ROLE_RISK_MAP.lead)
-        return "lead";
-    return "admin";
-}
-/**
- * Reads the active user role from environment only.
- * AI-supplied userRole arguments are NOT trusted.
- */
-function getActiveUserRole() {
-    const envRole = process.env.MCP_USER_ROLE?.trim().toLowerCase();
-    if (envRole === "admin" || envRole === "lead" || envRole === "developer" || envRole === "junior") {
-        return envRole;
-    }
-    return "junior"; // safest default
-}
-// ─── Active Approval Requests ─────────────────────────────────────
-const activeApprovals = new Map();
-/**
- * Determine risk level from risk score.
- */
-export function getRiskLevel(score) {
-    if (score >= CONFIG.HIGH_RISK_THRESHOLD)
-        return "HIGH";
-    if (score >= CONFIG.MEDIUM_RISK_THRESHOLD)
-        return "MEDIUM";
-    return "LOW";
-}
-/**
- * Create an approval request for a high-risk operation.
- * Returns the approval request and a message for the AI/developer.
- */
-function generatePasscode() {
-    const chars = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
-    let code = "";
-    for (let i = 0; i < 5; i++) {
-        code += chars.charAt(Math.floor(Math.random() * chars.length));
-    }
-    return code;
-}
-/**
- * Create an approval request for a high-risk operation.
- * Returns the approval request and a message for the AI/developer.
- */
-export function createApprovalRequest(traceId, toolName, agent, riskScore, reason, args) {
-    const now = Date.now();
-    const passcode = generatePasscode();
-    const request = {
-        traceId,
-        toolName,
-        agent,
-        riskScore,
-        riskLevel: getRiskLevel(riskScore),
-        reason,
-        args,
-        createdAt: now,
-        expiresAt: now + CONFIG.APPROVAL_TIMEOUT_SECONDS * 1000,
-        status: "PENDING",
-        passcode,
-    };
-    activeApprovals.set(traceId, request);
-    // Print passcode to stderr so the human developer sees it but AI cannot access it
-    process.stderr.write(`\n[ATABEY SECURITY GATES] APPROVAL PASSCODE FOR TRACE ${traceId}: ${passcode}\n\n`);
-    // Create a Hermes approval message
-    AtabeyStorage.saveMessage({
-        from: asAgentID(agent),
-        to: asAgentID("@manager"),
-        category: "ALERT",
-        content: JSON.stringify({
-            type: "APPROVAL_REQUIRED",
-            traceId,
-            tool: toolName,
-            riskScore,
-            reason,
-        }),
-        traceId: asTraceID(traceId),
-        timestamp: new Date().toISOString(),
-        status: "PENDING",
-        priority: "HIGH",
-        requiresApproval: true,
-    });
-    // Build the in-chat approval message
-    // This is what the developer sees in their AI CLI chat
-    const message = [
-        `[RISK GATE] Operation blocked: ${reason}`,
-        "",
-        `  Tool:       ${toolName}`,
-        `  Agent:      ${agent}`,
-        `  Risk Score: ${riskScore}/100 (${request.riskLevel})`,
-        `  Trace ID:   ${traceId}`,
-        "",
-        "─── IN-CHAT APPROVAL ────────────────────────────────────────",
-        "This is a high-risk operation. To prevent autonomous bypass,",
-        "Atabey has printed a 5-character PASSCODE to your terminal's stderr.",
-        "",
-        "Ask the user for the passcode, then call the approve_operation tool:",
-        `  approve_operation { "action": "approve", "traceId": "${traceId}", "passcode": "<passcode_from_user>" }`,
-        "─────────────────────────────────────────────────────────────",
-        "",
-        `Alternative: Run 'atabey approve ${traceId}' in your local terminal.`,
-    ].join("\n");
-    return { request, message };
-}
-/**
- * Check if an operation should be blocked based on risk score.
- * Returns:
- * - null if allowed (LOW risk or auto-approved)
- * - { blocked: true, message } if blocked (HIGH risk)
- * - { blocked: false, warning } if warning only (MEDIUM risk)
- */
-export function checkRiskGate(traceId, toolName, agent, riskScore, reason, args) {
-    const level = getRiskLevel(riskScore);
-    // LOW risk: always pass
-    if (level === "LOW") {
-        return null;
-    }
-    // MEDIUM risk: warning only
-    if (level === "MEDIUM") {
-        return {
-            blocked: false,
-            message: null,
-            warning: `[RISK WARNING] ${reason} (risk: ${riskScore}/100). Monitor this operation.`,
-        };
-    }
-    // HIGH risk: block and create approval request
-    const { message } = createApprovalRequest(traceId, toolName, agent, riskScore, reason, args);
-    return {
-        blocked: true,
-        message,
-    };
-}
-/**
- * Check if an approval request exists and is still valid.
- */
-export function getApprovalStatus(traceId) {
-    const request = activeApprovals.get(traceId);
-    if (!request)
-        return null;
-    // Check if expired
-    if (Date.now() > request.expiresAt) {
-        request.status = "EXPIRED";
-        return request;
-    }
-    return request;
-}
-/**
- * Approve a pending operation.
- *
- * RBAC enforcement (AI Governance layer):
- * - Role is read from process.env.MCP_USER_ROLE ONLY.
- * - The userRole parameter is accepted for API compatibility but completely IGNORED.
- *   This prevents AI agents (Claude Code, Gemini, Cursor) from escalating privilege
- *   by passing {userRole: "admin"} in the tool call arguments.
- * - The passcode printed to stderr is the second factor — AI cannot read stderr.
- */
-export function approveOperation(traceId, passcode, _userRoleIgnored // kept for API compat — value is intentionally ignored
-) {
-    const request = activeApprovals.get(traceId);
-    if (!request) {
-        return { success: false, message: `No pending approval found for trace: ${traceId}` };
-    }
-    if (request.status !== "PENDING") {
-        return { success: false, message: `Approval for ${traceId} is already ${request.status}` };
-    }
-    // ── RBAC Check ──────────────────────────────────────────────────────────
-    // Role is read exclusively from the environment — not from the tool argument.
-    // This ensures Claude Code, Gemini CLI, Cursor, or any MCP client cannot
-    // escalate privilege by injecting a role in the tool args.
-    const role = getActiveUserRole();
-    const maxApprovable = ROLE_RISK_MAP[role];
-    if (request.riskScore <= maxApprovable) {
-        // Role is allowed — proceed to passcode check
-    }
-    else {
-        const requiredRole = getMinimumRoleForScore(request.riskScore);
-        return {
-            success: false,
-            message: `[RBAC] Approval denied: Risk score ${request.riskScore}/100 requires at least '${requiredRole}' role. ` +
-                `Current role: '${role}' (max approvable: ${maxApprovable}). ` +
-                "Set MCP_USER_ROLE env var to a role with sufficient authority."
-        };
-    }
-    // ── End RBAC Check ──────────────────────────────────────────────────────
-    // Passcode second-factor (printed to stderr — AI cannot intercept)
-    if (request.passcode && (!passcode || passcode.trim().toUpperCase() !== request.passcode)) {
-        return { success: false, message: "Invalid or missing approval passcode. Verify the passcode printed to stderr." };
-    }
-    request.status = "APPROVED";
-    // Update Hermes message status
-    const messages = AtabeyStorage.getPendingMessages();
-    const pendingMsgs = messages.filter(m => m.traceId === traceId && m.category === "ALERT" && m.status === "PENDING");
-    for (const msg of pendingMsgs) {
-        if (msg.id !== undefined) {
-            AtabeyStorage.updateMessageStatus(msg.id, "APPROVED");
-        }
-    }
-    return { success: true, message: `Operation ${traceId} approved by '${role}'. You may retry.` };
-}
-/**
- * Reject a pending operation.
- *
- * RBAC: junior-role users cannot reject HIGH/CRITICAL operations.
- * This prevents rogue or misconfigured recon agents from killing
- * manager-delegated critical operations.
- */
-export function rejectOperation(traceId, _userRoleIgnored // kept for API compat — value intentionally ignored
-) {
-    const request = activeApprovals.get(traceId);
-    if (!request) {
-        return { success: false, message: `No pending approval found for trace: ${traceId}` };
-    }
-    if (request.status !== "PENDING") {
-        return { success: false, message: `Approval for ${traceId} is already ${request.status}` };
-    }
-    // RBAC: reject also requires minimum role for HIGH+ operations
-    const role = getActiveUserRole();
-    const canReject = !(role === "junior" && request.riskScore >= CONFIG.HIGH_RISK_THRESHOLD);
-    if (!canReject) {
-        return {
-            success: false,
-            message: `[RBAC] Reject denied: Risk score ${request.riskScore}/100 operations cannot be rejected by '${role}'. ` +
-                "Minimum role required to reject is 'developer'. Set MCP_USER_ROLE env var."
-        };
-    }
-    request.status = "REJECTED";
-    // Update Hermes message status
-    const messages = AtabeyStorage.getPendingMessages();
-    const pendingMsgs = messages.filter(m => m.traceId === traceId && m.category === "ALERT" && m.status === "PENDING");
-    for (const msg of pendingMsgs) {
-        if (msg.id !== undefined) {
-            AtabeyStorage.updateMessageStatus(msg.id, "REJECTED");
-        }
-    }
-    return { success: true, message: `Operation ${traceId} rejected by '${role}'.` };
-}
-/**
- * Get all pending approval requests.
- */
-export function getPendingApprovals() {
-    const now = Date.now();
-    const pending = [];
-    // Clean expired
-    for (const [, request] of activeApprovals) {
-        if (request.status === "PENDING" && now > request.expiresAt) {
-            request.status = "EXPIRED";
-        }
-        if (request.status === "PENDING") {
-            pending.push(request);
-        }
-    }
-    return pending;
-}
-/**
- * Get HITL config.
- */
-export function getHumanInLoopConfig() {
-    return { ...CONFIG };
-}
-export { CONFIG as HumanInLoopConfig };

package/framework-mcp/dist/framework-mcp/src/utils/license-scanner.js

@@ -1,283 +0,0 @@
-/**
- * ─── LICENSE / COPYRIGHT SCANNER ──────────────────────────────────
- *
- * Detects restrictive license blocks in AI-generated code before
- * it reaches the developer's project. Prevents GPL, AGPL, and other
- * copyleft license violations at the MCP middleware layer.
- *
- * Features:
- * - Recognizes SPDX license identifiers
- * - Detects known open-source license headers (GPL, AGPL, LGPL, MPL)
- * - Checks against corporate allowlist/blocklist
- * - Source code similarity detection for known OSS snippets
- * - Warning vs. blocking based on license severity
- *
- * License Severity:
- *   CRITICAL: GPL-3.0, AGPL-3.0 (copyleft, automatic blocking)
- *   HIGH:    GPL-2.0, LGPL-3.0, MPL-2.0 (file-level copyleft)
- *   MEDIUM:  MIT, Apache-2.0, BSD (permissive, allowed with attribution)
- *   LOW:     CC0, Unlicense (public domain, no restrictions)
- */
-import path from "path";
-// ─── Configuration ────────────────────────────────────────────────
-const CONFIG = {
-    /** Enable license scanning */
-    ENABLED: process.env.ATABEY_LICENSE_SCAN !== "false",
-    /** Automatically block copyleft licenses */
-    BLOCK_COPYLEFT: process.env.ATABEY_BLOCK_COPYLEFT !== "false",
-    /** SPDX blocklist – these licenses are automatically blocked */
-    BLOCKLIST: (process.env.ATABEY_LICENSE_BLOCKLIST || "GPL-3.0,AGPL-3.0,GPL-2.0").split(",").map(l => l.trim()),
-    /** SPDX allowlist – these licenses are always allowed */
-    ALLOWLIST: (process.env.ATABEY_LICENSE_ALLOWLIST || "MIT,Apache-2.0,BSD-2-Clause,BSD-3-Clause,ISC,CC0-1.0,Unlicense").split(",").map(l => l.trim()),
-    /** Detect known OSS snippets by hash (requires snippet database) */
-    ENABLE_SNIPPET_DETECTION: process.env.ATABEY_LICENSE_SNIPPET_CHECK === "true",
-    /** Path to snippet hash database */
-    SNIPPET_DB_PATH: process.env.ATABEY_SNIPPET_DB_PATH || "",
-};
-const SPDX_LICENSES = {
-    // Critical – Copyleft
-    "GPL-3.0": { name: "GNU General Public License v3.0", severity: "CRITICAL", copyleft: true, requiresAttribution: true },
-    "GPL-3.0-only": { name: "GNU General Public License v3.0 only", severity: "CRITICAL", copyleft: true, requiresAttribution: true },
-    "GPL-3.0-or-later": { name: "GNU General Public License v3.0 or later", severity: "CRITICAL", copyleft: true, requiresAttribution: true },
-    "AGPL-3.0": { name: "GNU Affero General Public License v3.0", severity: "CRITICAL", copyleft: true, requiresAttribution: true },
-    "AGPL-3.0-only": { name: "GNU Affero General Public License v3.0 only", severity: "CRITICAL", copyleft: true, requiresAttribution: true },
-    "SSPL-1.0": { name: "Server Side Public License v1", severity: "CRITICAL", copyleft: true, requiresAttribution: true },
-    // High – File-level copyleft
-    "GPL-2.0": { name: "GNU General Public License v2.0", severity: "HIGH", copyleft: true, requiresAttribution: true },
-    "GPL-2.0-only": { name: "GNU General Public License v2.0 only", severity: "HIGH", copyleft: true, requiresAttribution: true },
-    "LGPL-3.0": { name: "GNU Lesser General Public License v3.0", severity: "HIGH", copyleft: true, requiresAttribution: true },
-    "LGPL-3.0-only": { name: "GNU Lesser General Public License v3.0 only", severity: "HIGH", copyleft: true, requiresAttribution: true },
-    "MPL-2.0": { name: "Mozilla Public License 2.0", severity: "HIGH", copyleft: true, requiresAttribution: true },
-    "EUPL-1.2": { name: "European Union Public License 1.2", severity: "HIGH", copyleft: true, requiresAttribution: true },
-    // Medium – Permissive
-    "MIT": { name: "MIT License", severity: "MEDIUM", copyleft: false, requiresAttribution: true },
-    "Apache-2.0": { name: "Apache License 2.0", severity: "MEDIUM", copyleft: false, requiresAttribution: true },
-    "BSD-2-Clause": { name: "BSD 2-Clause License", severity: "MEDIUM", copyleft: false, requiresAttribution: true },
-    "BSD-3-Clause": { name: "BSD 3-Clause License", severity: "MEDIUM", copyleft: false, requiresAttribution: true },
-    "ISC": { name: "ISC License", severity: "MEDIUM", copyleft: false, requiresAttribution: true },
-    // Low – Public domain
-    "CC0-1.0": { name: "Creative Commons Zero v1.0", severity: "LOW", copyleft: false, requiresAttribution: false },
-    "Unlicense": { name: "The Unlicense", severity: "LOW", copyleft: false, requiresAttribution: false },
-};
-// ─── License Header Patterns ──────────────────────────────────────
-const LICENSE_HEADER_PATTERNS = [
-    {
-        name: "GNU General Public License v3.0",
-        spdxId: "GPL-3.0",
-        patterns: [
-            /GNU GENERAL PUBLIC LICENSE[\s\S]*Version 3/i,
-            /GNU General Public License v3/i,
-            /GPL-3\.0/,
-        ],
-    },
-    {
-        name: "GNU Affero General Public License v3.0",
-        spdxId: "AGPL-3.0",
-        patterns: [
-            /GNU AFFERO GENERAL PUBLIC LICENSE/i,
-            /Affero General Public License/i,
-            /AGPL-3\.0/,
-        ],
-    },
-    {
-        name: "GNU General Public License v2.0",
-        spdxId: "GPL-2.0",
-        patterns: [
-            /GNU GENERAL PUBLIC LICENSE[\s\S]*Version 2/i,
-            /GNU General Public License v2/i,
-            /GPL-2\.0/,
-        ],
-    },
-    {
-        name: "MIT License",
-        spdxId: "MIT",
-        patterns: [
-            /MIT License/i,
-            /Permission is hereby granted, free of charge, to any person obtaining a copy/i,
-        ],
-    },
-    {
-        name: "Apache License 2.0",
-        spdxId: "Apache-2.0",
-        patterns: [
-            /Apache License[\s\S]*Version 2\.0/i,
-            /Licensed under the Apache License, Version 2\.0/i,
-            /Apache-2\.0/,
-        ],
-    },
-    {
-        name: "BSD 2-Clause License",
-        spdxId: "BSD-2-Clause",
-        patterns: [
-            /BSD 2-Clause/i,
-            /Redistributions of source code must retain the above copyright notice/i,
-        ],
-    },
-    {
-        name: "BSD 3-Clause License",
-        spdxId: "BSD-3-Clause",
-        patterns: [
-            /BSD 3-Clause/i,
-            /BSD-3-Clause/,
-            /Neither the name of/i,
-        ],
-    },
-    {
-        name: "Mozilla Public License 2.0",
-        spdxId: "MPL-2.0",
-        patterns: [
-            /Mozilla Public License/i,
-            /MPL-2\.0/,
-        ],
-    },
-];
-// ─── Scanner Implementation ───────────────────────────────────────
-/**
- * Scan code content for license violations.
- * Returns array of license matches found in the content.
- */
-export function scanForLicenses(filePath, content) {
-    if (!CONFIG.ENABLED)
-        return [];
-    const ext = path.extname(filePath).toLowerCase();
-    // Only scan source files
-    if (![".ts", ".tsx", ".js", ".jsx", ".py", ".go", ".java", ".rb", ".php", ".c", ".cpp", ".h", ".hpp", ".rs", ".swift", ".kt"].includes(ext)) {
-        return [];
-    }
-    const matches = [];
-    const lines = content.split("\n");
-    // 1. Check for SPDX identifiers (e.g., `SPDX-License-Identifier: MIT`)
-    const spdxRegex = /SPDX-License-Identifier:\s*([^\s\n]+)/gi;
-    let spdxMatch;
-    while ((spdxMatch = spdxRegex.exec(content)) !== null) {
-        const spdxId = spdxMatch[1].trim();
-        const lineNo = getLineNumber(content, spdxMatch.index);
-        const licenseInfo = SPDX_LICENSES[spdxId];
-        if (licenseInfo) {
-            const blocked = CONFIG.BLOCKLIST.includes(spdxId) && CONFIG.BLOCK_COPYLEFT;
-            matches.push({
-                license: licenseInfo.name,
-                severity: licenseInfo.severity,
-                spdxId,
-                source: "spdx",
-                line: lineNo,
-                snippet: spdxMatch[0].substring(0, 80),
-                blocked,
-                requiresAttribution: licenseInfo.requiresAttribution,
-            });
-        }
-        else {
-            // Unknown SPDX identifier
-            matches.push({
-                license: `Unknown (${spdxId})`,
-                severity: "UNKNOWN",
-                spdxId,
-                source: "spdx",
-                line: lineNo,
-                snippet: spdxMatch[0].substring(0, 80),
-                blocked: CONFIG.BLOCK_COPYLEFT,
-                requiresAttribution: true,
-            });
-        }
-    }
-    // 2. Check for license header patterns in the first 50 lines
-    const headerRegion = lines.slice(0, 50).join("\n");
-    for (const header of LICENSE_HEADER_PATTERNS) {
-        for (const pattern of header.patterns) {
-            const headerMatch = headerRegion.match(pattern);
-            if (headerMatch) {
-                const lineNo = getLineNumber(headerRegion, headerMatch.index);
-                const licenseInfo = SPDX_LICENSES[header.spdxId] || {
-                    name: header.name,
-                    severity: "UNKNOWN",
-                    copyleft: true,
-                    requiresAttribution: true,
-                };
-                const blocked = CONFIG.BLOCKLIST.includes(header.spdxId) && CONFIG.BLOCK_COPYLEFT;
-                // Avoid duplicates from SPDX check
-                if (!matches.some(m => m.spdxId === header.spdxId && m.source === "header")) {
-                    matches.push({
-                        license: header.name,
-                        severity: licenseInfo.severity,
-                        spdxId: header.spdxId,
-                        source: "header",
-                        line: lineNo,
-                        snippet: headerMatch[0].substring(0, 80),
-                        blocked,
-                        requiresAttribution: licenseInfo.requiresAttribution,
-                    });
-                }
-                break;
-            }
-        }
-    }
-    return matches;
-}
-/**
- * Validate content for license compliance before allowing file write.
- * Returns error message if blocked, null if allowed.
- */
-export function validateLicenseCompliance(filePath, content) {
-    const matches = scanForLicenses(filePath, content);
-    if (matches.length === 0)
-        return null;
-    // Check for blocked licenses
-    const blocked = matches.filter(m => m.blocked);
-    if (blocked.length > 0) {
-        const details = blocked.map(m => `  Line ${m.line}: ${m.license} (${m.spdxId}) [${m.severity}]`).join("\n");
-        return [
-            "[LICENSE] ⛔ Copyleft license detected – operation blocked",
-            "",
-            "The generated code contains copyleft-licensed content that",
-            "is incompatible with corporate IP policies:",
-            "",
-            details,
-            "",
-            `Blocked licenses: ${CONFIG.BLOCKLIST.join(", ")}`,
-            `Allowed licenses: ${CONFIG.ALLOWLIST.join(", ")}`,
-            "",
-            "Please rewrite this code without using copyleft-licensed sources.",
-        ].join("\n");
-    }
-    // Check for licenses requiring attribution
-    const needsAttribution = matches.filter(m => m.requiresAttribution);
-    if (needsAttribution.length > 0) {
-        const details = needsAttribution.map(m => `  ${m.license} (${m.spdxId}) – found at line ${m.line}`).join("\n");
-        process.stderr.write(`[LICENSE] ⚠️ Attribution required for:\n${details}\n`);
-        // Don't block, just warn
-    }
-    return null;
-}
-/**
- * Get the severity summary of a set of license matches.
- */
-export function getLicenseSeveritySummary(matches) {
-    let highestSeverity = "LOW";
-    const severityOrder = ["CRITICAL", "HIGH", "MEDIUM", "LOW", "UNKNOWN"];
-    const uniqueLicenses = new Set();
-    for (const match of matches) {
-        uniqueLicenses.add(match.spdxId);
-        const currentIdx = severityOrder.indexOf(match.severity);
-        const highestIdx = severityOrder.indexOf(highestSeverity);
-        if (currentIdx < highestIdx || highestIdx === -1) {
-            highestSeverity = match.severity;
-        }
-    }
-    return {
-        hasBlocked: matches.some(m => m.blocked),
-        highestSeverity,
-        requiresAttribution: matches.some(m => m.requiresAttribution),
-        uniqueLicenses: Array.from(uniqueLicenses),
-    };
-}
-/**
- * Get scanner config.
- */
-export function getLicenseScannerConfig() {
-    return { ...CONFIG };
-}
-// ─── Helper ───────────────────────────────────────────────────────
-function getLineNumber(content, index) {
-    return content.substring(0, index).split("\n").length;
-}
-export { CONFIG as LicenseScannerConfig };