undefined

undefined

undefined

undefined

#!/bin/bash

---

#!/bin/bash

undefined

#!/usr/bin/env python3
"""scan_agent_output.py - Scan AI agent output for leaked secrets."""

import re
import sys
from pathlib import Path

SECRET_PATTERNS = [
    (r'AKIA[0-9A-Z]{16}', 'AWS Access Key'),
    (r'(?i)aws_secret_access_key\s*[:=]\s*\S+', 'AWS Secret Key'),
    (r'ghp_[a-zA-Z0-9]{36}', 'GitHub Personal Access Token'),
    (r'gho_[a-zA-Z0-9]{36}', 'GitHub OAuth Token'),
    (r'sk-[a-zA-Z0-9]{48,}', 'OpenAI/Anthropic API Key'),
    (r'xox[baprs]-[0-9a-zA-Z\-]{10,}', 'Slack Token'),
    (r'-----BEGIN (RSA |EC |DSA )?PRIVATE KEY-----', 'Private Key'),
    (r'(?i)(password|passwd|pwd)\s*[:=]\s*["\x27][^\s]{4,}', 'Hardcoded Password'),
    (r'(?i)(api[_-]?key|apikey)\s*[:=]\s*["\x27][^\s]{8,}', 'API Key'),
    (r'eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}', 'JWT Token'),
    (r'(?i)database_url\s*[:=]\s*\S+', 'Database Connection String'),
]


def scan_file(filepath: str) -> list[dict]:
    findings = []
    content = Path(filepath).read_text(errors="ignore")
    for line_num, line in enumerate(content.splitlines(), 1):
        for pattern, label in SECRET_PATTERNS:
            if re.search(pattern, line):
                findings.append({
                    "file": filepath,
                    "line": line_num,
                    "type": label,
                    "content": line.strip()[:120],
                })
    return findings


def main():
    files = sys.argv[1:]
    if not files:
        print("Usage: scan_agent_output.py <file1> [file2] ...")
        sys.exit(1)

    all_findings = []
    for f in files:
        all_findings.extend(scan_file(f))

    if all_findings:
        print(f"BLOCKED: {len(all_findings)} potential secret(s) detected:\n")
        for finding in all_findings:
            print(f"  [{finding['type']}] {finding['file']}:{finding['line']}")
            print(f"    {finding['content']}\n")
        sys.exit(1)

    print("OK: No secrets detected in agent output.")
    sys.exit(0)


if __name__ == "__main__":
    main()

#!/bin/bash

---

undefined

```bash
#!/bin/bash

undefined

{
  "defaultAction": "SCMP_ACT_ERRNO",
  "comment": "seccomp-agent.json - Restrictive profile for AI coding agents",
  "syscalls": [
    {
      "names": [
        "read", "write", "open", "close", "stat", "fstat", "lstat",
        "poll", "lseek", "mmap", "mprotect", "munmap", "brk",
        "access", "pipe", "select", "sched_yield", "mremap",
        "dup", "dup2", "nanosleep", "getpid", "getuid", "getgid",
        "geteuid", "getegid", "getppid", "getpgrp", "setsid",
        "getgroups", "uname", "fcntl", "flock", "fsync",
        "getcwd", "chdir", "readlink", "chmod", "mkdir",
        "rmdir", "unlink", "rename", "symlink", "readlinkat",
        "openat", "mkdirat", "newfstatat", "unlinkat", "renameat",
        "faccessat", "pselect6", "ppoll", "set_robust_list",
        "get_robust_list", "epoll_create1", "epoll_ctl", "epoll_wait",
        "eventfd2", "pipe2", "dup3", "pread64", "pwrite64",
        "futex", "clock_gettime", "clock_getres", "exit_group",
        "wait4", "clone", "execve", "arch_prctl", "set_tid_address",
        "exit", "getdents64", "rt_sigaction", "rt_sigprocmask",
        "rt_sigreturn", "ioctl", "writev", "madvise", "getrandom"
      ],
      "action": "SCMP_ACT_ALLOW"
    },
    {
      "names": [
        "socket", "connect", "bind", "listen", "accept",
        "sendto", "recvfrom", "sendmsg", "recvmsg"
      ],
      "action": "SCMP_ACT_ERRNO",
      "comment": "Block all network syscalls"
    },
    {
      "names": ["ptrace", "process_vm_readv", "process_vm_writev"],
      "action": "SCMP_ACT_ERRNO",
      "comment": "Block debugging and process inspection"
    }
  ]
}

undefined

      IS_AGENT="false"
      if [[ "$BRANCH" == ai/* ]] || [[ "$BRANCH" == agent/* ]]; then
        IS_AGENT="true"
      fi
      if echo "$BODY" | grep -qi "generated with.*claude\|generated by.*copilot\|generated by.*cursor\|generated by.*codex"; then
        IS_AGENT="true"
      fi
      if [[ "$AUTHOR" == *"bot"* ]] || [[ "$AUTHOR" == *"agent"* ]]; then
        IS_AGENT="true"
      fi
      echo "is_agent=$IS_AGENT" >> "$GITHUB_OUTPUT"

  - name: Run Semgrep security scan
    uses: semgrep/semgrep-action@v1
    with:
      config: >-
        p/default
        p/owasp-top-ten
        p/command-injection
        p/sql-injection
        p/xss

  - name: Scan for secrets with Trufflehog
    uses: trufflesecurity/trufflehog@main
    with:
      extra_args: --only-verified

  - name: Check for dependency changes
    run: |
      CHANGED_FILES=$(git diff --name-only origin/main...HEAD)
      DEP_FILES="package.json package-lock.json requirements.txt Pipfile.lock go.sum Cargo.lock"

      for dep_file in $DEP_FILES; do
        if echo "$CHANGED_FILES" | grep -q "$dep_file"; then
          echo "::warning::Agent modified dependency file: $dep_file"
          echo "DEPENDENCY_CHANGED=true" >> "$GITHUB_ENV"
        fi
      done

  - name: Require extra review for dependency changes
    if: env.DEPENDENCY_CHANGED == 'true'
    run: |
      gh pr edit "${{ github.event.pull_request.number }}" \
        --add-label "agent-dependency-change" \
        --add-label "requires-security-review"
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  - name: Enforce minimum reviewers
    run: |
      echo "Agent-generated PR detected."
      echo "This PR requires at least 2 human approvals before merge."

undefined

#!/bin/bash

---

undefined

undefined

undefined

undefined

<!-- codex.md or AGENTS.md for Codex CLI -->

---

#!/bin/bash

undefined

undefined

undefined

undefined

---

#!/bin/bash

undefined

#!/usr/bin/env python3
"""agent_audit_logger.py - Log all AI agent actions for compliance."""

import json
import logging
import os
import time
from datetime import datetime, timezone
from pathlib import Path

LOG_DIR = Path(os.environ.get("AGENT_LOG_DIR", "/var/log/ai-agents"))
LOG_DIR.mkdir(parents=True, exist_ok=True)

logger = logging.getLogger("agent_audit")
handler = logging.FileHandler(LOG_DIR / "agent-actions.jsonl")
handler.setFormatter(logging.Formatter("%(message)s"))
logger.addHandler(handler)
logger.setLevel(logging.INFO)


def log_action(
    agent: str,
    action: str,
    target: str,
    details: dict | None = None,
    user: str = "system",
) -> None:
    entry = {
        "timestamp": datetime.now(timezone.utc).isoformat(),
        "agent": agent,
        "user": user,
        "action": action,
        "target": target,
        "details": details or {},
        "session_id": os.environ.get("AGENT_SESSION_ID", "unknown"),
    }
    logger.info(json.dumps(entry))


def log_file_read(agent: str, filepath: str) -> None:
    log_action(agent, "file_read", filepath)


def log_file_write(agent: str, filepath: str, lines_changed: int) -> None:
    log_action(agent, "file_write", filepath, {"lines_changed": lines_changed})


def log_command(agent: str, command: str, exit_code: int) -> None:
    log_action(agent, "command_exec", command, {"exit_code": exit_code})


def log_pr_created(agent: str, pr_url: str, files_changed: list[str]) -> None:
    log_action(agent, "pr_created", pr_url, {"files_changed": files_changed})

undefined

#!/bin/bash

---

undefined

undefined

undefined

---

undefined

  - name: Detect changed files
    id: changes
    run: |
      FILES=$(git diff --name-only origin/main...HEAD -- '*.py' '*.js' '*.ts' '*.go')
      echo "changed_files=$FILES" >> "$GITHUB_OUTPUT"

  - name: Run tests with coverage
    run: |
      # Python
      if ls tests/*.py &>/dev/null; then
        pip install pytest pytest-cov
        pytest --cov=src --cov-report=json --cov-fail-under=80
      fi

      # Node.js
      if [ -f package.json ]; then
        npm ci
        npm test -- --coverage --coverageThreshold='{"global":{"branches":80,"functions":80,"lines":80}}'
      fi

  - name: Verify new code has tests
    run: |
      NEW_FILES=$(git diff --name-only --diff-filter=A origin/main...HEAD -- 'src/**')
      for file in $NEW_FILES; do
        base=$(basename "$file" | sed 's/\.[^.]*$//')
        if ! find tests/ -name "*${base}*" | grep -q .; then
          echo "::error::New file $file has no corresponding test file"
          exit 1
        fi
      done

  - name: Run Bandit (Python)
    if: hashFiles('**/*.py') != ''
    run: |
      pip install bandit
      bandit -r src/ -f json -o bandit-report.json || true
      ISSUES=$(jq '.results | length' bandit-report.json)
      if [ "$ISSUES" -gt 0 ]; then
        echo "::warning::Bandit found $ISSUES security issue(s) in agent-generated code"
        jq -r '.results[] | "  \(.severity): \(.issue_text) in \(.filename):\(.line_number)"' bandit-report.json
      fi

  - name: Run ESLint security plugin (JavaScript/TypeScript)
    if: hashFiles('**/*.js') != '' || hashFiles('**/*.ts') != ''
    run: |
      npm ci
      npx eslint --no-eslintrc \
        --plugin security \
        --rule '{"security/detect-eval-with-expression": "error"}' \
        --rule '{"security/detect-non-literal-fs-filename": "warn"}' \
        --rule '{"security/detect-possible-timing-attacks": "error"}' \
        --rule '{"security/detect-no-csrf-before-method-override": "error"}' \
        src/ || true

  - name: Run mutation testing on agent-changed files
    run: |
      CHANGED=$(git diff --name-only origin/main...HEAD -- 'src/**/*.py')
      if [ -n "$CHANGED" ]; then
        pip install mutmut
        for file in $CHANGED; do
          echo "Mutation testing: $file"
          mutmut run --paths-to-mutate="$file" --no-progress || true
        done
        mutmut results
      fi

undefined

#!/bin/bash

---