#!/usr/bin/env node
// ═══════════════════════════════════════════════════════════════════════════
// Vertical Slice: Secrets i kod blockeras (S-004) v2
// Med Policy Registry och Runtime Trace v2
// ═══════════════════════════════════════════════════════════════════════════

import { AgentRuntimeV3 } from './agent-runtime-v3.mjs';

/**
 * EOS Policy för secrets med Policy Registry-integration
 */
function checkSecretsPolicy(task) {
  const hasFiles = task.files && task.files.length > 0;
  
  if (hasFiles) {
    const secretPatterns = [
      /password\s*[:=]\s*["'][^"']+["']/i,
      /secret\s*[:=]\s*["'][^"']+["']/i,
      /token\s*[:=]\s*["'][^"']+["']/i,
      /api[_-]?key\s*[:=]\s*["'][^"']+["']/i,
      /aws_access_key_id\s*[:=]\s*["'][^"']+["']/i,
      /private[_-]?key/i,
      /-----BEGIN\s+(RSA\s+)?PRIVATE\s+KEY-----/,
      /AKIA[0-9A-Z]{16}/
    ];
    
    for (const file of task.files) {
      for (const pattern of secretPatterns) {
        if (pattern.test(file.content)) {
          return {
            passed: false,
            policyId: 'POL-SEC-002',
            rule: 'no-hardcoded-secrets',
            reason: `Hemlighet hittad i ${file.path} enligt EOS Policy POL-SEC-002`,
            severity: 'CRITICAL',
            action: 'STOP',
            evidence: {
              file: file.path,
              pattern: pattern.toString()
            }
          };
        }
      }
    }
  }
  
  return { passed: true };
}

class AgentRuntimeSecretsSliceV2 extends AgentRuntimeV3 {
  constructor(task) {
    super(task);
    this.policies = [checkSecretsPolicy];
  }
}

export { AgentRuntimeSecretsSliceV2, checkSecretsPolicy };