cgalo5758
5829091881
The contained runner that drove the 2026-09 security audit, the README review and four rounds of design ideation lived only inside the ignored notebook. It moves to scripts/agent-runner/: the prepare, tools, audit, ideation and teardown scripts, the compose and container files, the allowlist proxy and the prompt templates, with the paths that assumed the notebook fixed and findings written to a caller-named directory. Run outputs, transcripts and the round-specific sheet scripts stay behind. docs/agent-runner.md states the method: the disposable git archive copy and the fail-closed proxy, how a task is shaped, union rather than intersection of findings across models, separate adjudication of every finding against the source, and the evidence a finding must carry.
64 lines
2.5 KiB
Bash
Executable File
64 lines
2.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Prepare the sandbox both lanes share: export a disposable copy of HEAD, seed
|
|
# it with the auditor config and scope, build the images, and pre-start the
|
|
# egress proxy. Nothing here touches the real working tree or the live stack.
|
|
# Run it once per session; then ./run-tools.sh and ./run-audit.sh (security),
|
|
# or ./run-ux.sh (ideation).
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")"
|
|
HERE="$(pwd)"
|
|
REPO="$(git rev-parse --show-toplevel)" # the runner lives under scripts/, not at the root
|
|
PROJECT=member-console-audit
|
|
|
|
AUTH_JSON="${AUDIT_AUTH_JSON:-$HOME/.local/share/opencode/auth.json}"
|
|
if [[ ! -f "$AUTH_JSON" ]]; then
|
|
echo "ERROR: opencode auth file not found at $AUTH_JSON" >&2
|
|
echo "Log in on the host first (opencode auth login) or set AUDIT_AUTH_JSON." >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "==> Exporting a disposable copy of HEAD into .code/ (real repo untouched)"
|
|
rm -rf .code && mkdir -p .code
|
|
git -C "$REPO" archive HEAD | tar -x -C .code
|
|
# The export carries the repo's own .opencode/ skills (OpenSpec workflow
|
|
# helpers). They are irrelevant to a security audit and a model that notices
|
|
# them wastes a turn on them, so they do not travel.
|
|
rm -rf .code/.opencode .code/.claude
|
|
|
|
# Seed the throwaway copy with the auditor's config, instructions, and scope.
|
|
cp opencode.json .code/opencode.json
|
|
cp AUDITOR.md .code/AUDITOR.md
|
|
cp CONTEXT.md .code/CONTEXT.md
|
|
rm -rf .code/scope && cp -r scope .code/scope
|
|
|
|
[[ -f .code/go.mod && -f .code/go.sum ]] || {
|
|
echo "ERROR: .code/go.mod missing; the image bakes the module cache from it." >&2
|
|
exit 1
|
|
}
|
|
COMMIT="$(git -C "$REPO" rev-parse --short HEAD)"
|
|
echo "$COMMIT" > .code/AUDIT_COMMIT.txt
|
|
|
|
echo "==> Building images (auditor + egress proxy) — first build pulls the"
|
|
echo " Go toolchain, opencode, the scanners, the semgrep rules, the Go"
|
|
echo " vulnerability database, and this project's module cache."
|
|
docker compose build
|
|
|
|
echo "==> Starting the egress proxy (deny-by-default; allowlist.txt governs)"
|
|
docker compose up -d egress-proxy
|
|
|
|
cat <<MSG
|
|
|
|
Ready.
|
|
Audited commit : $COMMIT
|
|
Auth (ro) : $AUTH_JSON
|
|
Egress : proxy only, allowlist = $(grep -c . allowlist.txt) host patterns
|
|
Runner : $HERE
|
|
|
|
Findings go where you send them: export OUT to a directory outside this one.
|
|
|
|
Next: OUT=<dir> ./run-tools.sh # offline scanner pass -> <dir>/tools/
|
|
OUT=<dir> ./run-audit.sh # all models x all scope tasks
|
|
./run-ux.sh <brief-dir> # the ideation lane
|
|
./teardown.sh # remove the containers and the copy
|
|
MSG
|