globalproof-ai 0.2.3__py3-none-any.whl

globalproof.py

@@ -0,0 +1,1202 @@
+#!/usr/bin/env python3
+"""
+GlobalProof AI — Local-first AI training data compliance scanner.
+
+Scans a directory for open-source license contamination and PII leakage.
+Only SHA-256 hashes, file paths, and finding counts are sent to the backend.
+Raw file contents never leave your machine.
+
+Usage:
+    python globalproof.py register
+    python globalproof.py login
+    python globalproof.py scan ./training-data --project acme-llm-v3
+    python globalproof.py passport
+    python globalproof.py pdf
+    python globalproof.py verify
+
+Environment:
+    GLOBALPROOF_API_URL    Override backend URL
+    GLOBALPROOF_TOKEN      Override stored token
+    GLOBALPROOF_CONFIG     Override config file path
+"""
+
+__version__ = "0.2.3"
+
+# ────────────────────────────────────────────────────────────────────────────
+# SELF-IDENTIFICATION MARKER
+# ────────────────────────────────────────────────────────────────────────────
+# This unique string is embedded in the scanner's own source. The scanner
+# uses it to detect and skip itself during a scan, so that it never matches
+# its own pattern-definition tables as findings. If you fork this file and
+# change the marker, the scanner will no longer recognize your copy — that
+# is intentional. To skip a renamed fork, add its name to DEFAULT_SKIP.
+GLOBALPROOF_SELF_MARKER = b"GLOBALPROOF_SCANNER_SOURCE_MARKER_7f3a9c2e4b8d"
+
+import argparse
+import hashlib
+import json
+import os
+import re
+import secrets
+import sys
+import tempfile
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Tuple
+
+try:
+    import requests
+except ImportError:
+    sys.stderr.write("Missing dependency: pip install requests\n")
+    sys.exit(2)
+
+try:
+    import getpass
+except ImportError:
+    getpass = None
+
+
+# ────────────────────────────────────────────────────────────────────────────
+# CONFIG
+# ────────────────────────────────────────────────────────────────────────────
+
+DEFAULT_BASE = "http://localhost:8080"
+
+
+def _config_path() -> Path:
+    override = os.environ.get("GLOBALPROOF_CONFIG")
+    if override:
+        return Path(override)
+    return Path.home() / ".globalproof" / "config.json"
+
+
+CFG = _config_path()
+
+
+def load() -> Dict[str, Any]:
+    try:
+        return json.loads(CFG.read_text())
+    except FileNotFoundError:
+        return {}
+    except json.JSONDecodeError:
+        backup = CFG.with_suffix(".corrupt.json")
+        try:
+            CFG.rename(backup)
+        except OSError:
+            pass
+        print("Warning: config was corrupt. Backed up to %s" % backup,
+              file=sys.stderr)
+        return {}
+
+
+def save(c: Dict[str, Any]) -> None:
+    CFG.parent.mkdir(parents=True, exist_ok=True)
+    fd, tmp = tempfile.mkstemp(dir=str(CFG.parent), prefix=".config-", suffix=".json")
+    try:
+        with os.fdopen(fd, "w") as f:
+            json.dump(c, f, indent=2)
+        os.replace(tmp, CFG)
+        try:
+            os.chmod(CFG, 0o600)
+        except OSError:
+            pass
+    except Exception:
+        try:
+            os.unlink(tmp)
+        except OSError:
+            pass
+        raise
+
+
+def get_base(c: Optional[Dict[str, Any]] = None) -> str:
+    if c is None:
+        c = load()
+    return (
+            os.environ.get("GLOBALPROOF_API_URL")
+            or c.get("baseUrl")
+            or DEFAULT_BASE
+    ).rstrip("/")
+
+
+def get_token(c: Optional[Dict[str, Any]] = None) -> Optional[str]:
+    return os.environ.get("GLOBALPROOF_TOKEN") or (c or load()).get("token")
+
+
+# ────────────────────────────────────────────────────────────────────────────
+# API CLIENT
+# ────────────────────────────────────────────────────────────────────────────
+
+class ApiError(Exception):
+    def __init__(self, status: int, message: str, url: str = "",
+                 session_expired: bool = False):
+        self.status = status
+        self.message = message
+        self.url = url
+        self.session_expired = session_expired
+        super().__init__("HTTP %d: %s" % (status, message[:300]))
+
+
+def _looks_like_expired_token(status: int, body: str) -> bool:
+    """True if the error body signals an expired or invalid JWT."""
+    if status != 401:
+        return False
+    low = (body or "").lower()
+    # Match the specific error codes the backend emits.
+    return ("token_invalid" in low
+            or "token_expired" in low
+            or "invalid or expired token" in low)
+
+
+def api(method: str, path: str, body: Optional[dict] = None,
+        tok: Optional[str] = None, base: Optional[str] = None) -> dict:
+    base = base or get_base()
+    url = base + path
+    headers = {"Content-Type": "application/json",
+               "User-Agent": "globalproof-cli/%s" % __version__}
+    if tok:
+        headers["Authorization"] = "Bearer " + tok
+    try:
+        r = requests.request(method, url, headers=headers,
+                             data=json.dumps(body) if body is not None else None,
+                             timeout=30)
+    except requests.RequestException as e:
+        raise ApiError(0, "network error: %s" % e, url) from e
+    if r.status_code >= 400:
+        text = r.text or r.reason or ""
+        expired = _looks_like_expired_token(r.status_code, text)
+        raise ApiError(r.status_code, text, url, session_expired=expired)
+    if not r.text:
+        return {}
+    try:
+        return r.json()
+    except ValueError:
+        raise ApiError(r.status_code, "non-JSON response: %r" % r.text[:120], url)
+
+
+def api_download(path: str, tok: Optional[str] = None,
+                 base: Optional[str] = None) -> bytes:
+    base = base or get_base()
+    url = base + path
+    headers = {"User-Agent": "globalproof-cli/%s" % __version__}
+    if tok:
+        headers["Authorization"] = "Bearer " + tok
+    try:
+        r = requests.get(url, headers=headers, timeout=120)
+    except requests.RequestException as e:
+        raise ApiError(0, "network error: %s" % e, url) from e
+    if r.status_code >= 400:
+        text = r.text or r.reason or ""
+        expired = _looks_like_expired_token(r.status_code, text)
+        raise ApiError(r.status_code, text, url, session_expired=expired)
+    return r.content
+
+
+def require_token(c: Optional[Dict[str, Any]] = None) -> str:
+    tok = get_token(c)
+    if not tok:
+        die("Not logged in. Run:  globalproof login --email <your-email>")
+    return tok
+
+
+def die(msg: str, code: int = 1) -> None:
+    print(msg, file=sys.stderr)
+    sys.exit(code)
+
+
+# ────────────────────────────────────────────────────────────────────────────
+# LICENSE DETECTION
+# ────────────────────────────────────────────────────────────────────────────
+
+LICENSE_PATTERNS = [
+    ("gnu affero general public license", "AGPL-3.0", "NETWORK_COPYLEFT"),
+    ("gnu general public license, version 3", "GPL-3.0", "STRONG_COPYLEFT"),
+    ("gnu general public license version 3", "GPL-3.0", "STRONG_COPYLEFT"),
+    ("gnu general public license, version 2", "GPL-2.0", "STRONG_COPYLEFT"),
+    ("gnu general public license version 2", "GPL-2.0", "STRONG_COPYLEFT"),
+    ("gnu lesser general public license", "LGPL-3.0", "WEAK_COPYLEFT"),
+    ("mozilla public license version 2", "MPL-2.0", "WEAK_COPYLEFT"),
+    ("eclipse public license", "EPL-2.0", "WEAK_COPYLEFT"),
+    ("apache license, version 2.0", "Apache-2.0", "PERMISSIVE"),
+    ("apache license version 2.0", "Apache-2.0", "PERMISSIVE"),
+    ("permission is hereby granted, free of charge", "MIT", "PERMISSIVE"),
+    ("isc license", "ISC", "PERMISSIVE"),
+    ("redistribution and use in source and binary forms", "BSD-3-Clause", "PERMISSIVE"),
+    ("this is free and unencumbered software released into the public domain",
+     "Unlicense", "PERMISSIVE"),
+    ("server side public license", "SSPL-1.0", "STRONG_COPYLEFT"),
+    ("business source license", "BSL-1.1", "PROPRIETARY"),
+    ("creative commons attribution-noncommercial",
+     "CC-BY-NC-4.0", "PROPRIETARY"),
+]
+
+
+def license_risk(spdx: str) -> str:
+    s = (spdx or "").upper()
+    if s.startswith("AGPL"):
+        return "NETWORK_COPYLEFT"
+    if s.startswith(("GPL-2", "GPL-3")):
+        return "STRONG_COPYLEFT"
+    if s.startswith(("LGPL", "MPL", "EPL")):
+        return "WEAK_COPYLEFT"
+    if s.startswith(("MIT", "APACHE", "BSD", "ISC", "UNLICENSE")):
+        return "PERMISSIVE"
+    if s.startswith(("SSPL", "BSL")):
+        return "STRONG_COPYLEFT"
+    if s.startswith("CC-BY-NC"):
+        return "PROPRIETARY"
+    return "UNKNOWN"
+
+
+LICENSE_FILENAMES = {
+    "license", "license.txt", "license.md", "license.rst",
+    "copying", "copying.txt", "notice", "notice.txt", "notice.md",
+    "unlicense", "unlicense.txt",
+}
+
+CODE_EXTENSIONS = {
+    ".py", ".js", ".jsx", ".ts", ".tsx", ".java", ".kt", ".scala",
+    ".go", ".rs", ".rb", ".php", ".swift", ".m", ".mm",
+    ".c", ".h", ".cc", ".cpp", ".hpp", ".cs",
+    ".sh", ".bash", ".zsh", ".fish",
+    ".lua", ".pl", ".r", ".jl", ".dart", ".ex", ".exs", ".erl", ".hs",
+}
+
+TEXT_EXTENSIONS = CODE_EXTENSIONS | {
+    ".txt", ".md", ".rst", ".json", ".yaml", ".yml", ".toml", ".ini",
+    ".cfg", ".conf", ".properties", ".env",
+    ".csv", ".tsv", ".log", ".sql", ".xml", ".html", ".css", ".scss",
+    ".tf", ".tfvars", ".hcl", ".dockerfile", ".makefile",
+    ".ipynb",
+}
+
+# Canonical SPDX suffixes are lowercase. When a source file writes
+# "GPL-3.0-ONLY", normalizing to "GPL-3.0-only" makes the passport match
+# what SPDX-aware auditors expect.
+_SPDX_SUFFIX_NORMALIZE = re.compile(r"-(ONLY|OR-LATER)$", re.IGNORECASE)
+
+
+def normalize_spdx_id(spdx: str) -> str:
+    """Return the SPDX identifier in canonical form.
+
+    Preserves the casing of the base identifier (GPL-3.0, MIT, Apache-2.0)
+    and lowercases the recognized suffix (``-only``, ``-or-later``). Any
+    other identifier is returned unchanged.
+    """
+    if not spdx:
+        return spdx
+    return _SPDX_SUFFIX_NORMALIZE.sub(
+        lambda m: "-" + m.group(1).lower(), spdx
+    )
+
+
+def detect_license(path: Path) -> Tuple[str, str]:
+    """Return (license_id, risk). SPDX header wins; then content match."""
+    try:
+        raw = path.read_bytes()[:16384]
+    except OSError:
+        return "UNKNOWN", "UNKNOWN"
+
+    text = raw.decode("utf-8", errors="ignore").lower()
+
+    m = re.search(r"spdx-license-identifier:\s*([a-z0-9.\-+()]+)", text)
+    if m:
+        # The regex is case-sensitive only in the operator; the identifier
+        # portion is matched loosely. Read the identifier as it appears in
+        # the file so we do not lose suffix casing.
+        raw_expr = m.group(1)
+        # Handle OR/AND/WITH expressions — take the first identifier.
+        first = re.split(r"\s+(?:or|and|with)\s+", raw_expr)[0]
+        # Uppercase the base name for enum-consistency but normalize suffixes.
+        spdx = normalize_spdx_id(first.upper().strip("()"))
+        return spdx, license_risk(spdx)
+
+    name_lower = path.name.lower()
+    ext_lower = path.suffix.lower()
+    is_license_file = name_lower in LICENSE_FILENAMES
+    is_code_file = ext_lower in CODE_EXTENSIONS
+    if not (is_license_file or is_code_file):
+        return "UNKNOWN", "UNKNOWN"
+
+    if is_license_file:
+        for needle, lid, risk in LICENSE_PATTERNS:
+            if needle in text:
+                return lid, risk
+
+    m = re.search(r"\b(agpl-3\.0|gpl-3\.0|gpl-2\.0|lgpl-3\.0|mpl-2\.0|"
+                  r"apache-2\.0|mit|bsd-3-clause|isc)\b", text)
+    if m:
+        spdx = normalize_spdx_id(m.group(1).upper())
+        return spdx, license_risk(spdx)
+
+    return "UNKNOWN", "UNKNOWN"
+
+
+# ────────────────────────────────────────────────────────────────────────────
+# PII DETECTION
+# ────────────────────────────────────────────────────────────────────────────
+
+PII_PATTERNS = {
+    "EMAIL": re.compile(r"\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b"),
+    "AWS_ACCESS_KEY": re.compile(r"\bAKIA[0-9A-Z]{16}\b"),
+    "AWS_SECRET_KEY": re.compile(
+        r"(?i)aws[_\- ]?(?:secret|access)[_\- ]?(?:access)?[_\- ]?key['\"\s:=]+"
+        r"([0-9a-zA-Z/+]{40})\b"
+    ),
+    "GITHUB_TOKEN": re.compile(r"\bgh[psru]_[A-Za-z0-9_]{36,255}\b"),
+    "GITLAB_TOKEN": re.compile(r"\bglpat-[A-Za-z0-9_-]{20}\b"),
+    "STRIPE_KEY": re.compile(r"\b(?:sk|pk|rk)_(?:live|test)_[0-9a-zA-Z]{24,99}\b"),
+    "SLACK_TOKEN": re.compile(r"\bxox[baprs]-[0-9a-zA-Z-]{10,}\b"),
+    "GOOGLE_API_KEY": re.compile(r"\bAIza[0-9A-Za-z\-_]{35}\b"),
+    "JWT": re.compile(
+        r"\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b"
+    ),
+    "PRIVATE_KEY": re.compile(
+        r"-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY-----"
+    ),
+    "CREDIT_CARD": re.compile(
+        r"\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|"
+        r"3[47][0-9]{13}|6(?:011|5[0-9]{2})[0-9]{12})\b"
+    ),
+    "US_SSN": re.compile(r"\b\d{3}-\d{2}-\d{4}\b"),
+    "ZA_ID": re.compile(r"\b\d{13}\b"),
+    "IBAN": re.compile(r"\b[A-Z]{2}\d{2}[A-Z0-9]{10,30}\b"),
+    "SA_PHONE": re.compile(r"\b(?:\+27|0)[6-8][0-9]{8}\b"),
+    "IPV4": re.compile(
+        r"\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}"
+        r"(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b"
+    ),
+    "PHONE_US": re.compile(
+        r"\b(?:\+1[-.\s]?)?\(?[2-9][0-9]{2}\)?[-.\s]?[2-9][0-9]{2}[-.\s]?[0-9]{4}\b"
+    ),
+}
+
+
+def luhn_valid(digits: str) -> bool:
+    nums = [int(c) for c in digits if c.isdigit()]
+    if len(nums) < 13:
+        return False
+    total = 0
+    for i, d in enumerate(reversed(nums)):
+        if i % 2 == 1:
+            d *= 2
+            if d > 9:
+                d -= 9
+        total += d
+    return total % 10 == 0
+
+
+def detect_pii(path: Path) -> Dict[str, int]:
+    """Return a dict mapping entity type → count. Never returns raw values."""
+    if path.suffix.lower() not in TEXT_EXTENSIONS:
+        return {}
+    try:
+        raw = path.read_bytes()[:2 * 1024 * 1024]
+    except OSError:
+        return {}
+    text = raw.decode("utf-8", errors="ignore")
+
+    counts: Dict[str, int] = {}
+    for kind, pattern in PII_PATTERNS.items():
+        matches = pattern.findall(text)
+        if not matches:
+            continue
+        if kind == "CREDIT_CARD":
+            matches = [m for m in matches if luhn_valid(m)]
+        if kind == "ZA_ID":
+            matches = [m for m in matches if luhn_valid(m)]
+        if kind == "IPV4":
+            matches = [
+                m for m in matches
+                if not m.startswith(("127.", "0.", "255.", "10.", "192.168.", "169.254."))
+                   and not m.startswith("172.")
+            ]
+        if matches:
+            counts[kind] = len(matches)
+    return counts
+
+
+# ────────────────────────────────────────────────────────────────────────────
+# FILESYSTEM SCAN
+# ────────────────────────────────────────────────────────────────────────────
+
+# Directories to skip entirely. Any directory named in this set is pruned
+# before its contents are examined.
+DEFAULT_SKIP = {
+    ".git", ".hg", ".svn",
+    "node_modules", "__pycache__", ".venv", "venv", "env",
+    ".idea", ".vscode", ".vs",
+    "dist", "build", "target", "out", "bin", "obj",
+    ".next", ".nuxt", ".cache", ".parcel-cache",
+    ".pytest_cache", ".mypy_cache", ".ruff_cache", ".tox",
+    ".gradle", ".mvn",
+    "checkpoints", "runs", "logs",
+    ".huggingface", "wandb", ".ipynb_checkpoints",
+    "site-packages",
+}
+
+# Filenames to skip. The scanner never reports findings against its own
+# source file — doing so would match its pattern tables against themselves
+# and produce false positives on every scan.
+SCANNER_FILENAMES = {
+    "globalproof.py",
+    "globalproof",
+    "globalproof.pyc",
+}
+
+MAX_FILE_BYTES = 25 * 1024 * 1024  # 25 MB
+
+
+def load_ignore_patterns(root: Path) -> List[re.Pattern]:
+    patterns: List[re.Pattern] = []
+    ignore_file = root / ".globalproofignore"
+    if not ignore_file.is_file():
+        return patterns
+    try:
+        lines = ignore_file.read_text().splitlines()
+    except OSError:
+        return patterns
+    for line in lines:
+        line = line.strip()
+        if not line or line.startswith("#"):
+            continue
+        regex = re.escape(line).replace(r"\*", ".*").replace(r"\?", ".")
+        try:
+            patterns.append(re.compile(regex))
+        except re.error:
+            continue
+    return patterns
+
+
+def is_ignored(rel_path: str, extra: List[re.Pattern]) -> bool:
+    for pat in extra:
+        if pat.search(rel_path):
+            return True
+    return False
+
+
+def is_scanner_source(name: str, data: bytes) -> bool:
+    """True if the file is the GlobalProof scanner itself (or a copy).
+
+    Two independent checks:
+      1. The filename matches a known scanner filename.
+      2. The file content contains the unique self-identification marker.
+
+    Either match means the file is the scanner and must be skipped.
+    """
+    if name.lower() in SCANNER_FILENAMES:
+        return True
+    if GLOBALPROOF_SELF_MARKER in data[:65536]:
+        return True
+    return False
+
+
+def sha256_bytes(b: bytes) -> str:
+    return hashlib.sha256(b).hexdigest()
+
+
+def sha256_str(s: str) -> str:
+    return hashlib.sha256(s.encode("utf-8")).hexdigest()
+
+
+def scan_directory(root: Path, verbose: bool = False,
+                   no_self_skip: bool = False) -> Dict[str, Any]:
+    """Walk root and produce the scan manifest.
+
+    Never reads more than MAX_FILE_BYTES per file. Never sends file content.
+    """
+    if not root.is_dir():
+        die("Not a directory: %s" % root)
+
+    extra_ignore = load_ignore_patterns(root)
+    artifacts: List[Dict[str, Any]] = []
+    pii_totals: Dict[str, int] = {}
+    license_by_risk: Dict[str, int] = {}
+    license_by_id: Dict[str, int] = {}
+    copyleft_findings: List[Dict[str, Any]] = []
+    pii_findings: List[Dict[str, Any]] = []
+    total_bytes = 0
+    file_count = 0
+    skipped_large = 0
+    skipped_self = 0
+
+    for dirpath, dirnames, filenames in os.walk(root):
+        dirnames[:] = sorted(
+            d for d in dirnames
+            if d not in DEFAULT_SKIP and not d.startswith(".")
+        )
+        for name in sorted(filenames):
+            if name.startswith("."):
+                continue
+            path = Path(dirpath) / name
+            rel = str(path.relative_to(root)).replace("\\", "/")
+            if is_ignored(rel, extra_ignore):
+                continue
+            try:
+                size = path.stat().st_size
+            except OSError:
+                continue
+            if size > MAX_FILE_BYTES:
+                skipped_large += 1
+                if verbose:
+                    print("  skip (too large): %s" % rel, file=sys.stderr)
+                continue
+            try:
+                data = path.read_bytes()
+            except OSError:
+                continue
+
+            if not no_self_skip and is_scanner_source(name, data):
+                skipped_self += 1
+                if verbose:
+                    print("  skip (scanner source): %s" % rel, file=sys.stderr)
+                continue
+
+            license_id, risk = detect_license(path)
+            pii = detect_pii(path)
+
+            artifacts.append({
+                "path": rel,
+                "sha256": sha256_bytes(data),
+                "license": license_id,
+                "bytes": len(data),
+            })
+            total_bytes += len(data)
+            file_count += 1
+
+            license_by_risk[risk] = license_by_risk.get(risk, 0) + 1
+            if license_id and license_id != "UNKNOWN":
+                license_by_id[license_id] = license_by_id.get(license_id, 0) + 1
+
+            if risk in ("NETWORK_COPYLEFT", "STRONG_COPYLEFT", "WEAK_COPYLEFT"):
+                copyleft_findings.append({
+                    "path": rel,
+                    "licenseId": license_id,
+                    "risk": risk,
+                })
+
+            for kind, n in pii.items():
+                pii_totals[kind] = pii_totals.get(kind, 0) + n
+                pii_findings.append({
+                    "path": rel,
+                    "entityType": kind,
+                    "count": n,
+                })
+
+    if not artifacts:
+        die("No files found in %s (after ignore rules)." % root)
+
+    if skipped_large:
+        print("  (skipped %d file(s) larger than %d MB)"
+              % (skipped_large, MAX_FILE_BYTES // (1024 * 1024)))
+    if skipped_self:
+        print("  (skipped %d scanner source file(s))" % skipped_self)
+
+    return {
+        "artifacts": artifacts,
+        "file_count": file_count,
+        "total_bytes": total_bytes,
+        "license_by_risk": license_by_risk,
+        "license_by_id": license_by_id,
+        "pii_totals": pii_totals,
+        "copyleft_findings": copyleft_findings,
+        "pii_findings": pii_findings,
+    }
+
+
+# ────────────────────────────────────────────────────────────────────────────
+# HELPERS
+# ────────────────────────────────────────────────────────────────────────────
+
+def _unwrap_page(resp: dict) -> List[dict]:
+    data = resp.get("data", resp)
+    if isinstance(data, list):
+        return data
+    if isinstance(data, dict):
+        for key in ("content", "items", "results"):
+            if isinstance(data.get(key), list):
+                return data[key]
+    return []
+
+
+def _extract_token(resp: dict) -> Optional[str]:
+    for container in (resp.get("data"), resp):
+        if isinstance(container, dict):
+            for key in ("accessToken", "access_token", "token"):
+                v = container.get(key)
+                if isinstance(v, str) and v:
+                    return v
+    return None
+
+
+def _highest_risk(by_risk: Dict[str, int]) -> Optional[str]:
+    order = ["NETWORK_COPYLEFT", "STRONG_COPYLEFT", "WEAK_COPYLEFT",
+             "PROPRIETARY", "PERMISSIVE"]
+    for r in order:
+        if by_risk.get(r):
+            return r
+    return None
+
+
+def _human_bytes(n: int) -> str:
+    for unit in ("B", "KB", "MB", "GB", "TB"):
+        if n < 1024 or unit == "TB":
+            return "%.1f %s" % (n, unit) if unit != "B" else "%d B" % n
+        n /= 1024.0
+    return "%d B" % n
+
+
+def _clear_scan_context_if_user_changed(c: Dict[str, Any], email: str) -> None:
+    """Preserve scan/passport context when re-logging in as the same user."""
+    previous = c.get("email")
+    if previous and previous != email:
+        for k in ("lastScanId", "lastProjectId", "lastPassportId"):
+            c.pop(k, None)
+
+
+# ────────────────────────────────────────────────────────────────────────────
+# COMMANDS — AUTH
+# ────────────────────────────────────────────────────────────────────────────
+
+def cmd_register(a) -> None:
+    c = load()
+    email = a.email or input("Email: ").strip()
+    password = a.password or (getpass.getpass("Password: ") if getpass else "")
+    if not email or not password:
+        die("Email and password required.")
+    base = a.api_url or get_base(c)
+    r = api("POST", "/api/v1/auth/register", {
+        "email": email,
+        "password": password,
+        "displayName": email.split("@")[0],
+        "acceptedTerms": True,
+    }, base=base)
+    tok = _extract_token(r)
+    if not tok:
+        die("Registration succeeded but no access token in response.")
+    _clear_scan_context_if_user_changed(c, email)
+    c.update({"baseUrl": base, "token": tok, "email": email})
+    save(c)
+    print("OK  Registered %s" % email)
+
+
+def cmd_login(a) -> None:
+    c = load()
+    email = a.email or input("Email: ").strip()
+    password = a.password or (getpass.getpass("Password: ") if getpass else "")
+    if not email or not password:
+        die("Email and password required.")
+    base = a.api_url or get_base(c)
+    r = api("POST", "/api/v1/auth/login",
+            {"email": email, "password": password}, base=base)
+    tok = _extract_token(r)
+    if not tok:
+        die("Login succeeded but no access token in response.")
+    _clear_scan_context_if_user_changed(c, email)
+    c.update({"baseUrl": base, "token": tok, "email": email})
+    save(c)
+    print("OK  Logged in as %s" % email)
+
+
+def cmd_logout(a) -> None:
+    c = load()
+    for k in ("token", "lastScanId", "lastProjectId", "lastPassportId"):
+        c.pop(k, None)
+    save(c)
+    print("OK  Logged out.")
+
+
+def cmd_status(a) -> None:
+    c = load()
+    if a.json:
+        safe = dict(c)
+        if safe.get("token"):
+            safe["token"] = safe["token"][:6] + "…" + safe["token"][-4:]
+        print(json.dumps(safe, indent=2))
+        return
+    if not c.get("token"):
+        print("Not logged in.")
+        return
+    base = get_base(c)
+    print("Email:      %s" % c.get("email", "?"))
+    print("Backend:    %s" % base)
+    if c.get("lastProjectId"):
+        print("Project:    %s" % c["lastProjectId"])
+    if c.get("lastScanId"):
+        print("Scan:       %s" % c["lastScanId"])
+    if c.get("lastPassportId"):
+        pid = c["lastPassportId"]
+        print("Passport:   %s" % pid)
+        print("Verify:     %s/public/verify/%s" % (base, pid))
+        print("Verify JSON:%s/public/verify/%s.json" % (base, pid))
+    print("Config:     %s" % CFG)
+
+
+# ────────────────────────────────────────────────────────────────────────────
+# COMMANDS — SCAN
+# ────────────────────────────────────────────────────────────────────────────
+
+def cmd_scan(a) -> None:
+    c = load()
+    tok = require_token(c)
+    base = a.api_url or get_base(c)
+
+    root = Path(a.directory).expanduser().resolve()
+    if not root.is_dir():
+        die("Not a directory: %s" % root)
+
+    project = a.project or ("proj-" + secrets.token_hex(3))
+
+    print()
+    print("  Project:   %s" % project)
+    print("  Directory: %s" % root)
+    print()
+
+    try:
+        api("POST", "/api/v1/projects", {
+            "projectId": project,
+            "displayName": root.name,
+            "description": "CLI scan",
+        }, tok, base=base)
+    except ApiError as e:
+        if e.status in (409, 422):
+            pass
+        elif e.session_expired:
+            die("Session expired. Run:  globalproof login --email <your-email>")
+        else:
+            die("Could not create project: HTTP %d %s" % (e.status, e.message))
+
+    print("  Scanning files...")
+    result = scan_directory(root, verbose=a.verbose,
+                            no_self_skip=getattr(a, "no_self_skip", False))
+
+    file_count = result["file_count"]
+    total_bytes = result["total_bytes"]
+    license_by_risk = result["license_by_risk"]
+    license_by_id = result["license_by_id"]
+    pii_totals = result["pii_totals"]
+    copyleft_findings = result["copyleft_findings"]
+    pii_findings = result["pii_findings"]
+    artifacts = result["artifacts"]
+
+    manifest = json.dumps(
+        {"schemaVersion": "1.0", "artifacts": artifacts},
+        separators=(",", ":"),
+        sort_keys=True,
+    )
+    manifest_hash = "SHA256:" + sha256_str(manifest)
+
+    copyleft_count = len(copyleft_findings)
+    pii_count = sum(pii_totals.values())
+
+    summary = {
+        "totalFindings": copyleft_count + pii_count,
+        "piiByType": pii_totals,
+        "licenseByRisk": {k: v for k, v in license_by_risk.items() if k != "UNKNOWN"},
+        "licenseById": license_by_id,
+        "copyleftLicenses": copyleft_findings,
+        "piiFindings": pii_findings,
+        "highestPiiSeverity": None,
+        "highestLicenseRisk": _highest_risk(license_by_risk),
+        "detectors": [
+            "cli-python-%s" % __version__,
+            "license-regex-v1",
+            "pii-regex-v1",
+            ],
+    }
+
+    print()
+    print("  %d files, %s" % (file_count, _human_bytes(total_bytes)))
+    print()
+    if license_by_risk:
+        print("  License risk:")
+        for k in ("NETWORK_COPYLEFT", "STRONG_COPYLEFT", "WEAK_COPYLEFT",
+                  "PROPRIETARY", "PERMISSIVE", "UNKNOWN"):
+            n = license_by_risk.get(k, 0)
+            if n:
+                marker = "!!" if k in ("STRONG_COPYLEFT", "NETWORK_COPYLEFT") else "  "
+                print("    %s %5d  %s" % (marker, n, k))
+    if pii_totals:
+        print("  PII entities:")
+        for k in sorted(pii_totals):
+            print("      %5d  %s" % (pii_totals[k], k))
+    if not license_by_risk and not pii_totals:
+        print("  No findings.")
+    print()
+    print("  Manifest: %s" % manifest_hash)
+
+    scan_id = "sc_" + secrets.token_hex(8)
+    print()
+    print("  Uploading scan %s ..." % scan_id)
+
+    try:
+        resp = api("POST", "/api/v1/scans", {
+            "projectId": project,
+            "scanId": scan_id,
+            "scanManifestHash": manifest_hash,
+            "canonicalManifestJson": manifest,
+            "fileCount": file_count,
+            "totalBytes": total_bytes,
+            "findingSummary": summary,
+            "scannerCliVersion": __version__,
+        }, tok, base=base)
+    except ApiError as e:
+        if e.session_expired:
+            die("Session expired. Run:  globalproof login --email <your-email>")
+        die("Upload failed: HTTP %d %s" % (e.status, e.message))
+
+    data = resp.get("data") or resp
+    real_id = data.get("scanId") or data.get("id") or scan_id
+    if real_id != scan_id:
+        print("  (server returned existing scan: %s)" % real_id)
+        print("  note: deduplicated scans may belong to a different project;")
+        print("        if passport issuance 404s, pass --project explicitly.")
+
+    c["lastScanId"] = real_id
+    c["lastProjectId"] = project
+    c.pop("lastPassportId", None)
+    save(c)
+
+    print()
+    print("  OK  Scan accepted: %s" % real_id)
+    print()
+    print("  Next:  globalproof passport")
+
+
+# ────────────────────────────────────────────────────────────────────────────
+# COMMANDS — PASSPORT
+# ────────────────────────────────────────────────────────────────────────────
+
+def cmd_passport(a) -> None:
+    c = load()
+    tok = require_token(c)
+    base = a.api_url or get_base(c)
+
+    scan_id = a.scan_id or c.get("lastScanId")
+    project = a.project or c.get("lastProjectId")
+    if not scan_id or not project:
+        die("No scan in config. Run: globalproof scan <dir>")
+
+    print("  Issuing passport for scan %s (project %s) ..." % (scan_id, project))
+
+    try:
+        resp = api("POST", "/api/v1/passports", {
+            "projectId": project,
+            "scanId": scan_id,
+            "expiresInMonths": a.expires_in_months,
+        }, tok, base=base)
+    except ApiError as e:
+        if e.session_expired:
+            die("Session expired. Run:  globalproof login --email <your-email>")
+        die("Passport issuance failed: HTTP %d %s" % (e.status, e.message))
+
+    data = resp.get("data") or resp
+    pid = data.get("passportId") or data.get("id")
+    if not pid:
+        die("No passportId in response:\n" + json.dumps(resp, indent=2))
+
+    c["lastPassportId"] = pid
+    save(c)
+
+    if a.json:
+        print(json.dumps(resp, indent=2))
+        return
+
+    print()
+    print("  OK  Passport: %s" % pid)
+    print()
+    print("      Verify (page): %s/public/verify/%s" % (base, pid))
+    print("      Verify (JSON): %s/public/verify/%s.json" % (base, pid))
+    print()
+    print("      Download PDF:  globalproof pdf %s" % pid)
+    print("      Show details:  globalproof show %s" % pid)
+    print("      Revoke:        globalproof revoke %s" % pid)
+
+
+def cmd_pdf(a) -> None:
+    c = load()
+    tok = require_token(c)
+    base = a.api_url or get_base(c)
+    pid = a.passport_id or c.get("lastPassportId")
+    if not pid:
+        die("No passport id. Pass one, or run: globalproof passport")
+
+    out = Path(a.output) if a.output else Path("%s.pdf" % pid)
+    try:
+        body = api_download("/api/v1/passports/%s/pdf" % pid, tok, base=base)
+    except ApiError as e:
+        if e.session_expired:
+            die("Session expired. Run:  globalproof login --email <your-email>")
+        die("PDF download failed: HTTP %d %s" % (e.status, e.message))
+    out.write_bytes(body)
+
+    is_pdf = body[:5] == b"%PDF-"
+    if not is_pdf:
+        print("Warning: response is not a PDF (head=%r)" % body[:16], file=sys.stderr)
+        sys.exit(1)
+    print("OK  Saved %s (%s)" % (out, _human_bytes(len(body))))
+
+
+def cmd_verify(a) -> None:
+    c = load()
+    base = a.api_url or get_base(c)
+    pid = a.passport_id or c.get("lastPassportId")
+    if not pid:
+        die("No passport id. Pass one, or run: globalproof passport", 2)
+
+    try:
+        r = requests.get(base + "/public/verify/%s.json" % pid, timeout=30)
+    except requests.RequestException as e:
+        die("Network error: %s" % e, 2)
+
+    if r.status_code >= 400:
+        die("HTTP %d: %s" % (r.status_code, r.text[:300]), 2)
+
+    try:
+        d = r.json()
+    except ValueError:
+        die("Non-JSON response from verify endpoint.", 2)
+
+    if a.json:
+        print(json.dumps(d, indent=2))
+        sys.exit(0 if d.get("valid") else 1)
+
+    ok = bool(d.get("valid"))
+    print("%s  %s" % ("VALID  " if ok else "INVALID", pid))
+    for label, key in [
+        ("status", "status"),
+        ("signatureValid", "signatureValid"),
+        ("timestampValid", "timestampValid"),
+        ("expired", "expired"),
+        ("issuedAt", "issuedAt"),
+        ("expiresAt", "expiresAt"),
+    ]:
+        print("    %-16s %s" % (label + ":", d.get(key)))
+    iss = d.get("issuer") or {}
+    print("    %-16s %s" % ("keyId:", iss.get("signingKeyId")))
+    print("    %-16s %s" % ("fingerprint:", iss.get("publicKeyFingerprint")))
+    for w in (d.get("warnings") or []):
+        print("    warning:         %s" % w)
+    sys.exit(0 if ok else 1)
+
+
+def cmd_show(a) -> None:
+    c = load()
+    tok = require_token(c)
+    base = a.api_url or get_base(c)
+    pid = a.passport_id or c.get("lastPassportId")
+    if not pid:
+        die("No passport id. Pass one, or run: globalproof passport")
+    try:
+        r = api("GET", "/api/v1/passports/" + pid, tok=tok, base=base)
+    except ApiError as e:
+        if e.session_expired:
+            die("Session expired. Run:  globalproof login --email <your-email>")
+        die("HTTP %d: %s" % (e.status, e.message))
+    print(json.dumps(r, indent=2))
+
+
+def cmd_revoke(a) -> None:
+    c = load()
+    tok = require_token(c)
+    base = a.api_url or get_base(c)
+    pid = a.passport_id or c.get("lastPassportId")
+    if not pid:
+        die("No passport id. Pass one, or run: globalproof passport")
+    reason = a.reason or "revoked by user"
+    try:
+        r = api("POST", "/api/v1/passports/%s/revoke" % pid, {"reason": reason},
+                tok, base=base)
+    except ApiError as e:
+        if e.session_expired:
+            die("Session expired. Run:  globalproof login --email <your-email>")
+        die("Revoke failed: HTTP %d %s" % (e.status, e.message))
+    print("OK  Revoked %s (%s)" % (pid, reason))
+    if a.json:
+        print(json.dumps(r, indent=2))
+
+
+# ────────────────────────────────────────────────────────────────────────────
+# COMMANDS — LIST
+# ────────────────────────────────────────────────────────────────────────────
+
+def cmd_scans(a) -> None:
+    c = load()
+    tok = require_token(c)
+    base = a.api_url or get_base(c)
+    try:
+        r = api("GET", "/api/v1/scans?page=0&size=%d" % a.limit, tok=tok, base=base)
+    except ApiError as e:
+        if e.session_expired:
+            die("Session expired. Run:  globalproof login --email <your-email>")
+        die("HTTP %d: %s" % (e.status, e.message))
+    items = _unwrap_page(r)
+    if a.json:
+        print(json.dumps(items, indent=2))
+        return
+    if not items:
+        print("(no scans)")
+        return
+    for s in items:
+        print("  %-20s %-20s %5s files  %10s  %s"
+              % (s.get("scanId", "?"),
+                 s.get("projectId", "?"),
+                 s.get("fileCount", "?"),
+                 _human_bytes(int(s.get("totalBytes", 0) or 0)),
+                 s.get("createdAt", "")))
+
+
+def cmd_passports(a) -> None:
+    c = load()
+    tok = require_token(c)
+    base = a.api_url or get_base(c)
+    try:
+        r = api("GET", "/api/v1/passports?page=0&size=%d" % a.limit, tok=tok, base=base)
+    except ApiError as e:
+        if e.session_expired:
+            die("Session expired. Run:  globalproof login --email <your-email>")
+        die("HTTP %d: %s" % (e.status, e.message))
+    items = _unwrap_page(r)
+    if a.json:
+        print(json.dumps(items, indent=2))
+        return
+    if not items:
+        print("(no passports)")
+        return
+    for p in items:
+        print("  %-28s %-10s %s  expires %s"
+              % (p.get("passportId", "?"),
+                 p.get("status", "?"),
+                 p.get("issuedAt", ""),
+                 p.get("expiresAt", "")))
+
+
+def cmd_projects(a) -> None:
+    c = load()
+    tok = require_token(c)
+    base = a.api_url or get_base(c)
+    try:
+        r = api("GET", "/api/v1/projects?page=0&size=%d" % a.limit, tok=tok, base=base)
+    except ApiError as e:
+        if e.session_expired:
+            die("Session expired. Run:  globalproof login --email <your-email>")
+        die("HTTP %d: %s" % (e.status, e.message))
+    items = _unwrap_page(r)
+    if a.json:
+        print(json.dumps(items, indent=2))
+        return
+    if not items:
+        print("(no projects)")
+        return
+    for p in items:
+        print("  %-24s  %s" % (p.get("projectId", "?"),
+                               p.get("displayName", "")))
+
+
+# ────────────────────────────────────────────────────────────────────────────
+# ARGUMENT PARSING
+# ────────────────────────────────────────────────────────────────────────────
+
+def build_parser() -> argparse.ArgumentParser:
+    common = argparse.ArgumentParser(add_help=False)
+    common.add_argument("--json", action="store_true",
+                        help="Emit machine-readable JSON output.")
+    common.add_argument("--api-url", default=None,
+                        help="Override backend URL (default: %s or config)."
+                             % DEFAULT_BASE)
+    common.add_argument("--verbose", "-v", action="store_true",
+                        help="Verbose progress output.")
+
+    p = argparse.ArgumentParser(
+        prog="globalproof",
+        description="Local-first AI training data compliance scanner.",
+        epilog="Docs: https://globalproof.ai",
+    )
+    p.add_argument("--version", action="version", version="globalproof %s" % __version__)
+
+    sub = p.add_subparsers(dest="cmd", required=True)
+
+    s = sub.add_parser("register", parents=[common], help="Create a new account.")
+    s.add_argument("--email")
+    s.add_argument("--password")
+    s.set_defaults(f=cmd_register)
+
+    s = sub.add_parser("login", parents=[common], help="Log in to an existing account.")
+    s.add_argument("--email")
+    s.add_argument("--password")
+    s.set_defaults(f=cmd_login)
+
+    s = sub.add_parser("logout", parents=[common], help="Remove stored credentials.")
+    s.set_defaults(f=cmd_logout)
+
+    s = sub.add_parser("status", parents=[common], help="Show current login status.")
+    s.set_defaults(f=cmd_status)
+
+    s = sub.add_parser("scan", parents=[common], help="Scan a directory.")
+    s.add_argument("directory")
+    s.add_argument("--project", help="Project identifier (default: random).")
+    s.add_argument("--no-self-skip", action="store_true", dest="no_self_skip",
+                   help="Disable the scanner self-skip heuristic (debugging only).")
+    s.set_defaults(f=cmd_scan)
+
+    s = sub.add_parser("passport", parents=[common], help="Issue a passport for the last scan.")
+    s.add_argument("scan_id", nargs="?")
+    s.add_argument("--project")
+    s.add_argument("--expires-in-months", type=int, default=12, dest="expires_in_months")
+    s.set_defaults(f=cmd_passport)
+
+    s = sub.add_parser("pdf", parents=[common], help="Download the passport PDF.")
+    s.add_argument("passport_id", nargs="?")
+    s.add_argument("-o", "--output")
+    s.set_defaults(f=cmd_pdf)
+
+    s = sub.add_parser("verify", parents=[common], help="Verify a passport (public).")
+    s.add_argument("passport_id", nargs="?")
+    s.set_defaults(f=cmd_verify)
+
+    s = sub.add_parser("show", parents=[common], help="Show full passport details (auth).")
+    s.add_argument("passport_id", nargs="?")
+    s.set_defaults(f=cmd_show)
+
+    s = sub.add_parser("revoke", parents=[common], help="Revoke a passport.")
+    s.add_argument("passport_id", nargs="?")
+    s.add_argument("--reason")
+    s.set_defaults(f=cmd_revoke)
+
+    s = sub.add_parser("scans", parents=[common], help="List scans.")
+    s.add_argument("--limit", type=int, default=20)
+    s.set_defaults(f=cmd_scans)
+
+    s = sub.add_parser("passports", parents=[common], help="List passports.")
+    s.add_argument("--limit", type=int, default=20)
+    s.set_defaults(f=cmd_passports)
+
+    s = sub.add_parser("projects", parents=[common], help="List projects.")
+    s.add_argument("--limit", type=int, default=20)
+    s.set_defaults(f=cmd_projects)
+
+    return p
+
+
+def main(argv: Optional[List[str]] = None) -> int:
+    parser = build_parser()
+    args = parser.parse_args(argv)
+    try:
+        args.f(args)
+        return 0
+    except ApiError as e:
+        if e.session_expired:
+            print("Session expired. Run:  globalproof login --email <your-email>",
+                  file=sys.stderr)
+        else:
+            print("HTTP %d: %s" % (e.status, e.message), file=sys.stderr)
+            if getattr(args, "verbose", False) and e.url:
+                print("  URL: %s" % e.url, file=sys.stderr)
+        return 1
+    except KeyboardInterrupt:
+        print("\nInterrupted.", file=sys.stderr)
+        return 130
+    except BrokenPipeError:
+        return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

globalproof_ai-0.2.3.dist-info/METADATA

@@ -0,0 +1,57 @@
+Metadata-Version: 2.4
+Name: globalproof-ai
+Version: 0.2.3
+Summary: Local-first AI training data compliance scanner
+Author-email: Mandla Lucky <mandlalucky99@gmail.com>
+License: Apache-2.0
+Project-URL: Homepage, https://github.com/globalproof/globalproof
+Project-URL: Documentation, https://github.com/globalproof/globalproof#readme
+Project-URL: Issues, https://github.com/globalproof/globalproof/issues
+Keywords: ai,compliance,cli,license,pii
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+Requires-Dist: requests>=2.28
+
+# GlobalProof
+
+Local-first AI training data compliance scanner.
+
+Scans a dataset for open-source license contamination and PII leakage.
+Only SHA-256 hashes and finding counts are sent to the backend.
+Raw training data never leaves your machine.
+
+## Install
+
+    pip install globalproof
+
+## Usage
+
+    globalproof register --email you@company.com
+    globalproof scan ./training-data --project my-model
+    globalproof passport
+    globalproof pdf
+    globalproof verify
+
+## What it detects
+
+- Copyleft licenses (GPL, AGPL, LGPL, MPL, SSPL)
+- Undeclared open-source components
+- PII (emails, phone numbers, SSNs, IBANs, API keys, credit cards)
+- Provenance gaps (missing C2PA manifests)
+
+## Links
+
+- [GitHub](https://github.com/globalproof/globalproof)
+- [Sample passport](https://globalproof.ai/verify/gp_6bdd4e2948cfb11e)
+- [Documentation](https://github.com/globalproof/globalproof#readme)
+
+## License
+
+Apache-2.0

globalproof_ai-0.2.3.dist-info/RECORD

@@ -0,0 +1,6 @@
+globalproof.py,sha256=oPu_Jsw4ZJ2WxFax_NoJ33lFbld-2MmIYuQQjpAf0cU,46024
+globalproof_ai-0.2.3.dist-info/METADATA,sha256=_dmQUYbbe_2VlFh81xHAUOJDzbQ4enDDGkDBKX30g_I,1837
+globalproof_ai-0.2.3.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+globalproof_ai-0.2.3.dist-info/entry_points.txt,sha256=AMjkQVvKkzlqdcmKqeEHAg3v2QIy8MS-OcSrSs-TpmA,49
+globalproof_ai-0.2.3.dist-info/top_level.txt,sha256=tFvwfK2oT0jnQdbaPYyWRFi21j1X1Plp8HD3CirvtJc,12
+globalproof_ai-0.2.3.dist-info/RECORD,,

globalproof_ai-0.2.3.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

globalproof_ai-0.2.3.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+globalproof = globalproof:main

globalproof_ai-0.2.3.dist-info/top_level.txt

@@ -0,0 +1 @@
+globalproof