auth-yes/.forum/src/agents/adversary.ts

/**
 * Agent Forum v4 - Adversary Agent
 *
 * Role: The Security Auditor, Quality Engineer, and Performance Engineer.
 * Inputs: SCIP graphs, CFGs (Control Flow Graphs), Mutation scores, OTel Traces
 * Outputs: Edge-case tests, mutations, bottlenecks
 */

import { parseArgs } from "https://deno.land/std@0.224.0/cli/parse_args.ts";
import { join } from "https://deno.land/std@0.224.0/path/mod.ts";
import { existsSync } from "https://deno.land/std@0.224.0/fs/exists.ts";

const CWD = Deno.cwd();

async function runCommand(
  cmd: string,
  args: string[],
): Promise<{ code: number; stdout: string; stderr: string }> {
  const command = new Deno.Command(cmd, {
    args,
    stdout: "piped",
    stderr: "piped",
  });
  const { code, stdout, stderr } = await command.output();
  const decoder = new TextDecoder();
  return {
    code,
    stdout: decoder.decode(stdout).trim(),
    stderr: decoder.decode(stderr).trim(),
  };
}

/**
 * Helper to write a JSON payload to a specific Git Note namespace.
 */
async function writeGitNote(
  namespace: string,
  payload: Record<string, unknown>,
  commitRef = "HEAD",
) {
  const jsonString = JSON.stringify(payload);
  const ref = `refs/notes/${namespace}`;

  const cmd = await runCommand("git", [
    "notes",
    "--ref",
    ref,
    "add",
    "-f",
    "-m",
    jsonString,
    commitRef,
  ]);

  if (cmd.code !== 0) {
    console.error(`Failed to write Git Note to ${ref}:`, cmd.stderr);
    throw new Error("Git Note write failed.");
  }
  return true;
}

async function runAdversaryAnalysis() {
  console.log(
    "-> Adversary Agent: Initiating full-spectrum attack and analysis...",
  );

  const findings: any = {
    agent: "Adversary",
    timestamp: Date.now(),
    securityAudits: [],
    qualityMutations: [],
    performanceBottlenecks: [],
  };

  // 1. Security Auditor (Reads SCIP/AST/CFGs and Semgrep results)
  console.log(
    "   [Security] Analyzing Control Flow Graphs and Static Analysis...",
  );
  const semgrepPath = join(CWD, ".forum", "security", "semgrep_baseline.json");
  if (existsSync(semgrepPath)) {
    try {
      const semgrepData = JSON.parse(Deno.readTextFileSync(semgrepPath));
      findings.securityAudits.push({ source: "Semgrep", results: semgrepData });
    } catch (_e) {
      console.warn("   Could not parse Semgrep JSON payload.");
    }
  } else {
    findings.securityAudits.push({
      source: "Simulated",
      threat: "Unsanitized input reaching SQL query in routes/admin.ts",
    });
  }

  // 2. Quality Engineer (Reads Mutation Testing Scores)
  console.log("   [Quality] Analyzing Mutation Scores (e.g., Stryker)...");
  try {
    const strykerCmd = await runCommand("stryker", ["run"]);
    if (strykerCmd.code !== 0) {
      const mutationReportPath = join(CWD, "reports", "mutation", "mutation.json");
      if (existsSync(mutationReportPath)) {
        const mutationData = JSON.parse(Deno.readTextFileSync(mutationReportPath));
        if (mutationData.files) {
          for (const [file, fileData] of Object.entries<any>(mutationData.files)) {
            const surviving = fileData.mutants.filter((m: any) => m.status === "Survived");
            if (surviving.length > 0) {
              findings.qualityMutations.push({
                file,
                survivingMutants: surviving.length,
                mutantIds: surviving.map((m: any) => m.id),
              });
            }
          }
        }
      } else {
        console.warn("   Stryker run failed, but reports/mutation/mutation.json not found.");
      }
    }
  } catch (e) {
    console.warn("   Failed to execute Stryker or parse mutation results:", e);
  }

  // 3. Performance Engineer (Reads OTel Traces)
  console.log("   [Performance] Ingesting OpenTelemetry Traces...");
  const telemetryDir = join(CWD, ".forum", "telemetry");
  if (existsSync(telemetryDir)) {
    try {
      for (const entry of Deno.readDirSync(telemetryDir)) {
        if (entry.isFile && entry.name.endsWith(".trace.json")) {
          const tracePath = join(telemetryDir, entry.name);
          const traceData = JSON.parse(Deno.readTextFileSync(tracePath));

          // Distill traces down to adhere to Zero-Token Rule
          const distilledTraces = [];
          if (Array.isArray(traceData)) {
            for (const trace of traceData) {
              if (trace.durationMs > 100) { // e.g., bottleneck threshold
                distilledTraces.push({
                  id: trace.id,
                  operationName: trace.operationName,
                  durationMs: trace.durationMs
                });
              }
            }
          }

          if (distilledTraces.length > 0) {
            findings.performanceBottlenecks.push({
              source: tracePath,
              slowTraces: distilledTraces
            });
          }
        }
      }
    } catch (e) {
      console.warn("   Failed to parse OTel traces:", e);
    }
  }

  console.log("-> Adversary Agent: Analysis complete.");

  try {
    await writeGitNote("adversary_report", findings);
    console.log(
      "-> Threat vectors and edge-cases written to Git Notes (refs/notes/adversary_report).",
    );
  } catch (e) {
    console.warn("⚠️ Failed to write adversary report to Git Notes:", e);
  }
}

async function main() {
  const args = parseArgs(Deno.args, {
    boolean: ["run"],
  });

  if (args["run"]) {
    await runAdversaryAnalysis();
  } else {
    console.log("Adversary Agent installed. Run with --run flag.");
  }
}

if (import.meta.main) {
  await main();
}