boc/EOS/vertical-slice-secrets.mjs

#!/usr/bin/env node
// ═══════════════════════════════════════════════════════════════════════════
// Vertical Slice: Secrets i kod blockeras (S-004)
// Mål: Gå från rött till grönt för ETT test
// Princip: "En regel i taget, bevisat genom test"
// ═══════════════════════════════════════════════════════════════════════════

import { AgentRuntimeV2 } from './agent-runtime-v2.mjs';

/**
 * EOS Policy för secret-detection
 * Denna policy ska blockera alla försök att checka in hemligheter
 */
function checkSecretsPolicy(task) {
  // Om det inte finns filer, inget att kontrollera
  if (!task.files || task.files.length === 0) {
    return { passed: true };
  }
  
  // Patterns för att hitta hemligheter
  const secretPatterns = [
    { pattern: /password\s*=\s*["'][^"']+["']/i, name: 'hardcoded-password' },
    { pattern: /secret\s*=\s*["'][^"']+["']/i, name: 'hardcoded-secret' },
    { pattern: /token\s*=\s*["'][^"']+["']/i, name: 'hardcoded-token' },
    { pattern: /api_key\s*=\s*["'][^"']+["']/i, name: 'hardcoded-api-key' },
    { pattern: /JWT_SECRET\s*=\s*["'][^"']+["']/i, name: 'hardcoded-jwt' },
    { pattern: /AWS_ACCESS_KEY_ID\s*=\s*["'][^"']+["']/i, name: 'hardcoded-aws-key' },
    { pattern: /PRIVATE_KEY\s*=\s*["'][^"']+["']/i, name: 'hardcoded-private-key' }
  ];
  
  const foundSecrets = [];
  
  for (const file of task.files) {
    for (const { pattern, name } of secretPatterns) {
      if (pattern.test(file.content)) {
        foundSecrets.push({
          file: file.path,
          type: name,
          line: file.content.match(pattern)[0]
        });
      }
    }
  }
  
  if (foundSecrets.length > 0) {
    return {
      passed: false,
      rule: 'no-hardcoded-secrets',
      reason: `Hittade ${foundSecrets.length} hemlighet(er) i kod: ${foundSecrets.map(s => s.type).join(', ')}`,
      severity: 'CRITICAL',
      action: 'STOP',
      evidence: foundSecrets
    };
  }
  
  return { passed: true };
}

/**
 * Uppdaterad Agent Runtime med secret-detection
 */
class AgentRuntimeSecretsSlice extends AgentRuntimeV2 {
  constructor(task) {
    super(task);
    this.policies = [checkSecretsPolicy];
  }

  async runEOSCheck() {
    const node = this.trace.addNode('EOS', { rules: this.policies.length });
    
    // Kör alla policyer
    const results = [];
    for (const policy of this.policies) {
      const result = policy(this.task);
      results.push(result);
      
      if (!result.passed) {
        this.trace.blockNode(node.id, result.reason);
        
        return {
          passed: false,
          blockedBy: result.rule,
          reason: result.reason,
          severity: result.severity,
          evidence: result.evidence
        };
      }
    }
    
    this.trace.completeNode(node.id, { passed: results.length, failed: 0 });
    
    return { passed: true, results };
  }
}

// ═══════════════════════════════════════════════════════════════════════════
// TEST
// ═══════════════════════════════════════════════════════════════════════════

async function testSecretsBlock() {
  console.log('═══════════════════════════════════════════════════════════════');
  console.log('  VERTICAL SLICE: Secrets i kod blockeras (S-004)');
  console.log('═══════════════════════════════════════════════════════════════\n');

  const test = {
    id: 'S-004',
    name: 'Secrets i kod blockeras',
    input: {
      id: 'S-004',
      description: 'Lägg till API-nyckel',
      type: 'code',
      files: [
        { path: 'config.mjs', content: 'const API_KEY = "***";' }
      ]
    }
  };

  console.log(`Test: ${test.name}`);
  console.log(`Input: ${JSON.stringify(test.input)}\n`);

  const startTime = Date.now();
  
  try {
    const runtime = new AgentRuntimeSecretsSlice(test.input);
    const result = await runtime.execute();
    const duration = Date.now() - startTime;
    
    // Verifiera
    const passed = result.status === 'blocked';
    
    console.log(`Result: ${result.status}`);
    console.log(`Reason: ${result.reason}`);
    console.log(`Duration: ${duration}ms\n`);
    
    console.log('Runtime Trace:');
    console.log(runtime.getTrace().toText());
    
    if (passed) {
      console.log('\n✅ PASS — Secrets i kod blockeras korrekt');
      console.log('Vertical Slice complete!');
    } else {
      console.log('\n❌ FAIL — Secrets blockades inte korrekt');
    }
    
    return { passed, duration, trace: runtime.getTrace().toJSON() };
    
  } catch (error) {
    console.log(`\n❌ FAIL — Exception: ${error.message}`);
    return { passed: false, duration: Date.now() - startTime, error: error.message };
  }
}

// Kör testet endast om filen körs direkt
if (process.argv[1] === new URL(import.meta.url).pathname) {
  import('fs').then(({ writeFileSync }) => {
    testSecretsBlock().then(result => {
      writeFileSync(
        '/home/bernt/.openclaw/workspace/EOS/vertical-slice-secrets-result.json',
        JSON.stringify(result, null, 2)
      );
      process.exit(result.passed ? 0 : 1);
    });
  });
}

export { AgentRuntimeSecretsSlice, checkSecretsPolicy };