License Compliance in AI-Generated Code

from dataclasses import dataclass
from enum import Enum
from typing import Optional
 
class LicenseType(Enum):
    PERMISSIVE = "permissive"       # MIT, BSD, Apache 2.0
    WEAK_COPYLEFT = "weak_copyleft"  # LGPL, MPL
    STRONG_COPYLEFT = "strong_copyleft"  # GPL, AGPL
    PROPRIETARY = "proprietary"
    UNKNOWN = "unknown"
 
class RiskLevel(Enum):
    LOW = "low"
    MEDIUM = "medium"
    HIGH = "high"
    CRITICAL = "critical"
 
@dataclass
class LicenseRisk:
    """Model of license risk from AI-generated code."""
    scenario: str
    detected_license: LicenseType
    organizational_license: LicenseType
    risk_level: RiskLevel
    legal_exposure: str
    remediation: str
 
LICENSE_RISK_SCENARIOS = [
    LicenseRisk(
        scenario="AI generates code matching GPL-licensed project",
        detected_license=LicenseType.STRONG_COPYLEFT,
        organizational_license=LicenseType.PROPRIETARY,
        risk_level=RiskLevel.CRITICAL,
        legal_exposure=(
            "GPL requires derivative works to be distributed under GPL. "
            "If AI output is a derivative of GPL code, the entire codebase "
            "touching that code may need to be GPL-licensed."
        ),
        remediation=(
            "Remove or rewrite the matching code. Implement detection to "
            "prevent future GPL code introduction."
        ),
    ),
    LicenseRisk(
        scenario="AI generates code matching AGPL-licensed project",
        detected_license=LicenseType.STRONG_COPYLEFT,
        organizational_license=LicenseType.PROPRIETARY,
        risk_level=RiskLevel.CRITICAL,
        legal_exposure=(
            "AGPL extends GPL to network use. If the generated code "
            "is in a web service, AGPL may require releasing the "
            "entire service source code."
        ),
        remediation=(
            "Immediate removal and rewrite. AGPL is the highest-risk "
            "license for proprietary web services."
        ),
    ),
    LicenseRisk(
        scenario="AI generates code matching MIT-licensed project without attribution",
        detected_license=LicenseType.PERMISSIVE,
        organizational_license=LicenseType.PROPRIETARY,
        risk_level=RiskLevel.MEDIUM,
        legal_exposure=(
            "MIT license requires including the copyright notice. "
            "Missing attribution is technically a violation."
        ),
        remediation=(
            "Add attribution to the project's license file or NOTICES file."
        ),
    ),
    LicenseRisk(
        scenario="AI generates code with no identifiable source",
        detected_license=LicenseType.UNKNOWN,
        organizational_license=LicenseType.PROPRIETARY,
        risk_level=RiskLevel.LOW,
        legal_exposure=(
            "Low immediate risk, but the code may match a licensed "
            "project not yet identified."
        ),
        remediation=(
            "Run code similarity detection periodically as databases "
            "are updated."
        ),
    ),
]

@dataclass
class AIToolLicenseProfile:
    """License profile of an AI coding tool."""
    tool_name: str
    training_data_sources: list[str]
    copyleft_in_training: bool
    indemnification: str
    attribution_provided: bool
    opt_out_available: bool
    terms_summary: str
 
AI_TOOL_PROFILES = [
    AIToolLicenseProfile(
        tool_name="GitHub Copilot",
        training_data_sources=["Public GitHub repositories", "OpenAI models"],
        copyleft_in_training=True,
        indemnification="Available with Copilot Business/Enterprise",
        attribution_provided=False,  # No automatic attribution
        opt_out_available=True,  # Repository owners can opt out
        terms_summary=(
            "GitHub offers IP indemnification for Copilot Business "
            "customers. Individual plan has no indemnification."
        ),
    ),
    AIToolLicenseProfile(
        tool_name="Cursor",
        training_data_sources=["Depends on underlying model (OpenAI, Anthropic)"],
        copyleft_in_training=True,
        indemnification="Depends on model provider",
        attribution_provided=False,
        opt_out_available=False,  # Cursor doesn't control training data
        terms_summary=(
            "Cursor relies on upstream model providers. License risk "
            "follows the provider's training data and policies."
        ),
    ),
    AIToolLicenseProfile(
        tool_name="Claude Code",
        training_data_sources=["Anthropic training corpus"],
        copyleft_in_training=True,
        indemnification="Available with certain enterprise plans",
        attribution_provided=False,
        opt_out_available=False,
        terms_summary=(
            "Anthropic's usage policies govern output. Enterprise "
            "agreements may include IP provisions."
        ),
    ),
    AIToolLicenseProfile(
        tool_name="Aider",
        training_data_sources=["Uses API of chosen model provider"],
        copyleft_in_training=True,
        indemnification="None from Aider (open-source tool)",
        attribution_provided=False,
        opt_out_available=False,
        terms_summary=(
            "Aider is MIT-licensed itself but provides no coverage "
            "for generated code. Risk follows the model provider."
        ),
    ),
]

import hashlib
import re
from pathlib import Path
from typing import Optional
 
class CodeSimilarityScanner:
    """Scan AI-generated code for similarity to known licensed code."""
 
    def __init__(self):
        # In production, this would be a database of code fingerprints
        # from licensed projects
        self.known_fingerprints: dict[str, dict] = {}
 
    def normalize_code(self, code: str) -> str:
        """Normalize code for comparison (remove whitespace, comments)."""
        # Remove single-line comments
        code = re.sub(r"#.*$", "", code, flags=re.MULTILINE)
        code = re.sub(r"//.*$", "", code, flags=re.MULTILINE)
        # Remove multi-line comments
        code = re.sub(r"/\*.*?\*/", "", code, flags=re.DOTALL)
        code = re.sub(r'""".*?"""', "", code, flags=re.DOTALL)
        code = re.sub(r"'''.*?'''", "", code, flags=re.DOTALL)
        # Normalize whitespace
        code = re.sub(r"\s+", " ", code).strip()
        return code
 
    def fingerprint_code(self, code: str, window_size: int = 50) -> list[str]:
        """Generate rolling hash fingerprints for code similarity detection."""
        normalized = self.normalize_code(code)
        tokens = normalized.split()
 
        fingerprints = []
        for i in range(len(tokens) - window_size + 1):
            window = " ".join(tokens[i : i + window_size])
            fp = hashlib.sha256(window.encode()).hexdigest()[:16]
            fingerprints.append(fp)
 
        return fingerprints
 
    def check_similarity(
        self, code: str, threshold: float = 0.3
    ) -> list[dict]:
        """Check code against known licensed code fingerprints."""
        code_fps = set(self.fingerprint_code(code))
        matches = []
 
        for project_name, project_data in self.known_fingerprints.items():
            project_fps = set(project_data["fingerprints"])
            if not project_fps:
                continue
 
            overlap = len(code_fps & project_fps) / min(
                len(code_fps), len(project_fps)
            )
 
            if overlap >= threshold:
                matches.append({
                    "project": project_name,
                    "license": project_data["license"],
                    "similarity": round(overlap * 100, 1),
                    "risk": self._assess_risk(project_data["license"], overlap),
                })
 
        return sorted(matches, key=lambda x: x["similarity"], reverse=True)
 
    def _assess_risk(self, license_type: str, similarity: float) -> str:
        if similarity > 0.7:
            if "GPL" in license_type or "AGPL" in license_type:
                return "critical"
            return "high"
        elif similarity > 0.5:
            if "GPL" in license_type or "AGPL" in license_type:
                return "high"
            return "medium"
        return "low"
 
 
def scan_project_for_license_risk(project_path: str) -> dict:
    """Scan an entire project for license contamination."""
    scanner = CodeSimilarityScanner()
    # In production, load fingerprint database here
    # scanner.load_fingerprint_db("path/to/db")
 
    findings = {
        "files_scanned": 0,
        "matches": [],
        "risk_summary": {"critical": 0, "high": 0, "medium": 0, "low": 0},
    }
 
    code_extensions = {".py", ".js", ".ts", ".jsx", ".tsx", ".java", ".go", ".rs"}
    for filepath in Path(project_path).rglob("*"):
        if filepath.suffix in code_extensions and "node_modules" not in str(filepath):
            findings["files_scanned"] += 1
            try:
                code = filepath.read_text()
                matches = scanner.check_similarity(code)
                for match in matches:
                    match["file"] = str(filepath.relative_to(project_path))
                    findings["matches"].append(match)
                    findings["risk_summary"][match["risk"]] += 1
            except (UnicodeDecodeError, PermissionError):
                pass
 
    return findings

#!/bin/bash
# License compliance scanning pipeline for AI-generated code
 
echo "=== AI-Generated Code License Compliance Scan ==="
 
PROJECT_DIR="${1:-.}"
 
# Step 1: ScanCode Toolkit (open-source license detection)
echo ""
echo "--- ScanCode License Detection ---"
if command -v scancode &>/dev/null; then
    scancode --license --copyright \
        --json /tmp/scancode-results.json \
        "$PROJECT_DIR" \
        --ignore "node_modules/*" --ignore ".git/*" --ignore "venv/*"
 
    python3 -c "
import json
with open('/tmp/scancode-results.json') as f:
    data = json.load(f)
copyleft_files = []
for fdata in data.get('files', []):
    for lic in fdata.get('licenses', []):
        if 'gpl' in lic.get('key', '').lower():
            copyleft_files.append({
                'file': fdata['path'],
                'license': lic['key'],
                'score': lic.get('score', 0),
            })
if copyleft_files:
    print(f'WARNING: Found {len(copyleft_files)} files with copyleft licenses:')
    for f in copyleft_files:
        print(f\"  {f['file']}: {f['license']} (score: {f['score']})\")
else:
    print('No copyleft licenses detected.')
"
else
    echo "ScanCode not installed. Install with: pip install scancode-toolkit"
fi
 
# Step 2: Check for verbatim code matches using git
echo ""
echo "--- AI-Generated Code Identification ---"
echo "Looking for common AI code generation markers..."
grep -rn "Generated by\|AI-generated\|Copilot\|ChatGPT\|Claude" \
    "$PROJECT_DIR" --include="*.py" --include="*.js" --include="*.ts" \
    | head -20
 
# Step 3: Check NOTICE and LICENSE files
echo ""
echo "--- Attribution Files ---"
for f in LICENSE LICENSE.md NOTICE NOTICE.md THIRD-PARTY-NOTICES; do
    if [ -f "$PROJECT_DIR/$f" ]; then
        echo "Found: $f"
    fi
done
 
echo ""
echo "=== Scan Complete ==="

# Detecting potential verbatim reproductions from AI code generation
import difflib
 
class VerbatimDetector:
    """Detect when AI-generated code may be verbatim from training data."""
 
    # Indicators that suggest verbatim reproduction
    VERBATIM_INDICATORS = [
        "Very specific variable names matching a well-known project",
        "Exact comment text matching published code",
        "Unusual coding style inconsistent with the project",
        "Specific magic numbers or constants from another project",
        "Copyright notices or license headers in generated code",
    ]
 
    def __init__(self):
        self.known_snippets: dict[str, dict] = {}
 
    def check_for_copyright_headers(self, code: str) -> list[dict]:
        """Check if AI-generated code contains copyright headers."""
        findings = []
        lines = code.split("\n")
 
        copyright_patterns = [
            r"Copyright\s+\(c\)\s+\d{4}",
            r"Licensed under",
            r"Permission is hereby granted",  # MIT
            r"GNU General Public License",    # GPL
            r"Apache License",                # Apache
            r"BSD \d-Clause",                 # BSD
            r"Mozilla Public License",        # MPL
            r"All rights reserved",
        ]
 
        import re
        for i, line in enumerate(lines):
            for pattern in copyright_patterns:
                if re.search(pattern, line, re.IGNORECASE):
                    findings.append({
                        "line": i + 1,
                        "content": line.strip(),
                        "pattern": pattern,
                        "severity": "high",
                        "message": (
                            "Copyright/license header found in code. "
                            "This may indicate verbatim reproduction from "
                            "a licensed project."
                        ),
                    })
 
        return findings
 
    def estimate_originality(self, code: str) -> dict:
        """Estimate how likely code is to be original vs. reproduced."""
        indicators = {
            "has_copyright_headers": bool(self.check_for_copyright_headers(code)),
            "has_specific_comments": self._has_project_specific_comments(code),
            "consistent_style": True,  # Would need project context to assess
            "uses_common_patterns": self._uses_only_common_patterns(code),
        }
 
        if indicators["has_copyright_headers"]:
            originality = "low"
            risk = "high"
        elif indicators["has_specific_comments"]:
            originality = "medium"
            risk = "medium"
        else:
            originality = "high"
            risk = "low"
 
        return {
            "estimated_originality": originality,
            "license_risk": risk,
            "indicators": indicators,
        }
 
    def _has_project_specific_comments(self, code: str) -> bool:
        """Check for comments that reference specific projects."""
        import re
        project_refs = re.findall(
            r"#.*(?:from|based on|adapted from|see)\s+\S+",
            code, re.IGNORECASE,
        )
        return len(project_refs) > 0
 
    def _uses_only_common_patterns(self, code: str) -> bool:
        """Check if code uses only common/generic patterns."""
        # Heuristic: very short functions with common names are likely generic
        lines = [l.strip() for l in code.split("\n") if l.strip()]
        return len(lines) < 20

# AI Code Generation License Governance Framework
 
GOVERNANCE_FRAMEWORK = {
    "policy_elements": [
        {
            "element": "Tool Approval",
            "requirement": (
                "All AI code generation tools must be approved by legal "
                "and security teams before deployment."
            ),
            "controls": [
                "Maintain approved tool list with license profiles",
                "Review tool terms of service for IP provisions",
                "Verify indemnification coverage",
            ],
        },
        {
            "element": "Developer Training",
            "requirement": (
                "All developers using AI coding tools must complete "
                "license compliance training."
            ),
            "controls": [
                "Training covers copyleft risk identification",
                "Developers know how to use license scanning tools",
                "Clear escalation path for license concerns",
            ],
        },
        {
            "element": "Code Review Process",
            "requirement": (
                "AI-generated code must undergo the same license review "
                "as third-party code."
            ),
            "controls": [
                "Automated license scanning in CI/CD pipeline",
                "Manual review for code flagged by scanners",
                "Documented review decisions for audit trail",
            ],
        },
        {
            "element": "Incident Response",
            "requirement": (
                "Process for handling discovered license violations "
                "in AI-generated code."
            ),
            "controls": [
                "Immediate isolation of violating code",
                "Legal team notification within 24 hours",
                "Remediation plan (rewrite, license, or remove)",
                "Root cause analysis to prevent recurrence",
            ],
        },
        {
            "element": "Record Keeping",
            "requirement": (
                "Maintain records of AI code generation tool usage "
                "and license compliance decisions."
            ),
            "controls": [
                "Log which tool generated which code",
                "Retain license scan results",
                "Document policy exceptions with justification",
            ],
        },
    ],
}
 
def generate_compliance_checklist(project_name: str) -> str:
    """Generate a license compliance checklist for a project using AI code generation."""
    checklist = f"# {project_name} — AI Code Generation License Compliance Checklist\n\n"
 
    items = [
        "[ ] AI coding tools used are on the approved tools list",
        "[ ] Tool terms of service reviewed by legal within last 12 months",
        "[ ] IP indemnification active for commercial tools",
        "[ ] .cursorignore / .aiderignore configured to exclude licensed third-party code",
        "[ ] Automated license scanning enabled in CI/CD pipeline",
        "[ ] NOTICE file updated with any identified attributions",
        "[ ] Developers completed AI license compliance training",
        "[ ] Code review checklist includes license verification step",
        "[ ] No copyleft-flagged code in proprietary components",
        "[ ] Incident response plan documented for license violations",
    ]
 
    for item in items:
        checklist += f"- {item}\n"
 
    return checklist