需求 → 設計 → 開發 → 測試 → 安全掃描 → 部署 → 監控 → 優化
         ↑                                           |
         └───────── 持續回饋與改進 ─────────────────┘

# 1. 安裝 Python（使用 winget）
winget install Python.Python.3.12

# 2. 確認安裝
python --version
pip --version

# 3. 建立虛擬環境
python -m venv .venv
.\.venv\Scripts\Activate.ps1

# 4. 升級 pip
python -m pip install --upgrade pip

# 5. 安裝基礎套件
pip install torch numpy pandas scikit-learn pytest black ruff

# 1. 安裝 Python（使用 pyenv）
curl https://pyenv.run | bash
pyenv install 3.12.0
pyenv global 3.12.0

# 2. 建立虛擬環境
python -m venv .venv
source .venv/bin/activate

# 3. 安裝基礎套件
pip install torch numpy pandas scikit-learn pytest black ruff

# 安裝（Windows 使用 winget）
winget install Git.Git

# 基本設定
git config --global user.name "Your Name"
git config --global user.email "your.email@company.com"

# 安全設定：啟用 GPG 簽章
git config --global commit.gpgsign true
git config --global tag.gpgsign true

# 設定預設分支名稱
git config --global init.defaultBranch main

# 安裝 GitHub CLI
winget install GitHub.cli

# 驗證登入
gh auth login

# macOS / Linux
curl -LsSf https://astral.sh/uv/install.sh | sh

# Windows PowerShell
powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"

# 1. Clone AutoResearch 專案
git clone https://github.com/karpathy/autoresearch.git
cd autoresearch

# 2. 安裝相依套件（使用 uv）
uv sync

# 3. 下載資料並訓練 tokenizer（一次性，約 2 分鐘）
uv run prepare.py

# 4. 手動執行一次訓練實驗（約 5 分鐘，驗證環境正常）
uv run train.py

# Windows PowerShell
$env:AUTORESEARCH_HOME = "$(Get-Location)"
$env:AUTORESEARCH_TIME_BUDGET = "300"  # 5 分鐘

# Linux / macOS
export AUTORESEARCH_HOME=$(pwd)
export AUTORESEARCH_TIME_BUDGET=300

# 啟動 Claude Code / Codex 等 AI Agent，然後給予以下 Prompt：
# "Hi have a look at program.md and let's kick off a new experiment!
#  let's do the setup first."
# program.md 本質上是一個輕量級的 "skill" 指令檔

# macOS / Linux / WSL（推薦 — 原生安裝，自動背景更新）
curl -fsSL https://claude.ai/install.sh | bash

# Windows PowerShell
irm https://claude.ai/install.ps1 | iex

# Windows CMD
curl -fsSL https://claude.ai/install.cmd -o install.cmd && install.cmd && del install.cmd

# ---- 套件管理器安裝（不自動更新，需手動升級）----

# Homebrew (macOS) — stable channel
brew install --cask claude-code
# 或 latest channel（最新版，可能有回歸）
brew install --cask claude-code@latest

# WinGet (Windows)
winget install Anthropic.ClaudeCode

# Linux 套件管理器
sudo apt install claude-code        # Debian / Ubuntu
sudo dnf install claude-code        # Fedora / RHEL
sudo apk add claude-code            # Alpine

# macOS（Intel + Apple Silicon）
# 下載：https://claude.ai/api/desktop/darwin/universal/dmg/latest/redirect

# Windows x64
# 下載：https://claude.ai/api/desktop/win32/x64/setup/latest/redirect

# Windows ARM64
# 下載：https://claude.ai/api/desktop/win32/arm64/setup/latest/redirect

# 功能：平行 sessions、Git 隔離、排程任務、視覺化 diff、PR 監控

# 1. 在專案目錄啟動 Claude Code（首次會引導登入）
cd your-project
claude

# 支援的帳號類型：
# - Claude Pro / Max / Team / Enterprise（推薦）
# - Claude Console（API 存取，預付費額度）
# - Amazon Bedrock / Google Vertex AI / Microsoft Foundry（企業雲端供應商）

# 2. 驗證安裝
claude --version

# 3. 在 CLI 輸入 /help 查看可用指令

# .env（加入 .gitignore）
ANTHROPIC_API_KEY=sk-ant-xxxxx
OPENAI_API_KEY=sk-xxxxx
GITHUB_TOKEN=ghp_xxxxx

# .gitignore
.env
.env.*
!.env.example

# 1. 在 VS Code 中安裝 GitHub Copilot 擴充套件
code --install-extension GitHub.copilot
code --install-extension GitHub.copilot-chat

# 2. 登入 GitHub 帳號（在 VS Code 中操作）
# VS Code → Accounts → Sign in with GitHub

# 3. 驗證 Copilot 啟用狀態
# 開啟任意程式碼檔案，確認右下角顯示 Copilot 圖示

# 安裝 GitHub CLI（若尚未安裝）
winget install GitHub.cli          # Windows
brew install gh                     # macOS
sudo apt install gh                 # Linux (Debian/Ubuntu)

# 登入 GitHub
gh auth login

# 安裝 Copilot CLI 擴充
gh extension install github/copilot-cli

# 啟動 Copilot CLI（進入互動式 Agent 模式）
gh copilot

# 或直接給予任務
gh copilot "fix the failing tests in src/auth/"

# 專案層級的 Copilot CLI 設定
permissions:
  allow:
    - tool: bash
      commands: ["npm test", "npm run lint", "pytest"]
    - tool: file_edit
      paths: ["src/**", "tests/**"]
  deny:
    - tool: bash
      commands: ["rm -rf", "git push --force"]

hooks:
  post_edit:
    - command: "npm run format"
      description: "Auto-format after edit"

custom_instructions: |
  This is a Python FastAPI project using PostgreSQL.
  Always write tests before implementing features (TDD).
  Follow OWASP Top 10 security guidelines.

# 下載 Copilot App（獨立桌面應用，非 VS Code 擴充）
# 從 https://github.com/features/copilot 下載
# 支援 macOS、Windows、Linux

# 功能：
# - 多個平行 Agent sessions（各自獨立 Git branch）
# - Canvas extensions（互動式協作界面）
# - Issues 與 PR 生命週期管理
# - Automations（排程任務）
# - Deep links（從外部工具直接開啟）

# 1. 安裝 VS Code（Windows）
winget install Microsoft.VisualStudioCode

# 2. 安裝必要擴充套件
code --install-extension GitHub.copilot
code --install-extension GitHub.copilot-chat
code --install-extension ms-python.python
code --install-extension ms-python.vscode-pylance
code --install-extension eamodio.gitlens
code --install-extension GitHub.vscode-pull-request-github
code --install-extension ms-vscode.vscode-github-actions

{
  "editor.formatOnSave": true,
  "editor.defaultFormatter": "ms-python.black-formatter",
  "python.analysis.typeCheckingMode": "basic",
  "python.testing.pytestEnabled": true,
  "github.copilot.enable": {
    "*": true,
    "markdown": true,
    "yaml": true
  },
  "files.exclude": {
    "**/__pycache__": true,
    "**/.pytest_cache": true
  },
  "[python]": {
    "editor.defaultFormatter": "ms-python.black-formatter",
    "editor.codeActionsOnSave": {
      "source.organizeImports": "explicit"
    }
  }
}

#!/usr/bin/env pwsh
# AutoResearch + SSDLC 環境一鍵安裝腳本

Write-Host "=== AutoResearch SSDLC 環境安裝 ===" -ForegroundColor Cyan

# 檢查 Python
if (-not (Get-Command python -ErrorAction SilentlyContinue)) {
    Write-Host "安裝 Python 3.12..." -ForegroundColor Yellow
    winget install Python.Python.3.12
}

# 檢查 Git
if (-not (Get-Command git -ErrorAction SilentlyContinue)) {
    Write-Host "安裝 Git..." -ForegroundColor Yellow
    winget install Git.Git
}

# 檢查 GitHub CLI
if (-not (Get-Command gh -ErrorAction SilentlyContinue)) {
    Write-Host "安裝 GitHub CLI..." -ForegroundColor Yellow
    winget install GitHub.cli
}

# 安裝 uv 套件管理器
if (-not (Get-Command uv -ErrorAction SilentlyContinue)) {
    Write-Host "安裝 uv..." -ForegroundColor Yellow
    powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"
}

# 建立虛擬環境
Write-Host "建立 Python 虛擬環境..." -ForegroundColor Yellow
python -m venv .venv
.\.venv\Scripts\Activate.ps1

# 安裝 Python 套件（使用 uv）
uv sync

# 安裝 Claude Code（原生安裝）
Write-Host "安裝 Claude Code..." -ForegroundColor Yellow
irm https://claude.ai/install.ps1 | iex

# 安裝 GitHub Copilot CLI
Write-Host "安裝 GitHub Copilot CLI..." -ForegroundColor Yellow
gh extension install github/copilot-cli

# 安裝 VS Code 擴充套件
$extensions = @(
    "GitHub.copilot",
    "GitHub.copilot-chat",
    "ms-python.python",
    "eamodio.gitlens"
)
foreach ($ext in $extensions) {
    code --install-extension $ext
}

Write-Host "=== 安裝完成 ===" -ForegroundColor Green

#!/bin/bash
set -euo pipefail

echo "=== AutoResearch SSDLC 環境安裝 ==="

# 檢查並安裝 Python
if ! command -v python3 &> /dev/null; then
    echo "請先安裝 Python 3.10+"
    exit 1
fi

# 建立虛擬環境
python3 -m venv .venv
source .venv/bin/activate

# 安裝相依套件（使用 uv）
uv sync

# 安裝 Claude Code（原生安裝）
curl -fsSL https://claude.ai/install.sh | bash

echo "=== 安裝完成 ==="

# train.py - AutoResearch 可修改的目標檔案
"""
AutoResearch Target Script
==========================
此檔案可被 AI Agent 修改以優化模型效能。
評估指標：validation accuracy（越高越好）
"""

import torch
import torch.nn as nn
import torch.optim as optim
from prepare import load_data, evaluate_model

# === 可調整區域 START ===

class SimpleModel(nn.Module):
    """模型架構 - AI 可修改"""
    def __init__(self, input_dim: int = 784, hidden_dim: int = 256, output_dim: int = 10):
        super().__init__()
        self.layers = nn.Sequential(
            nn.Linear(input_dim, hidden_dim),
            nn.ReLU(),
            nn.Dropout(0.2),
            nn.Linear(hidden_dim, output_dim)
        )

    def forward(self, x):
        return self.layers(x)


def get_optimizer(model: nn.Module) -> optim.Optimizer:
    """優化器設定 - AI 可修改"""
    return optim.Adam(model.parameters(), lr=1e-3, weight_decay=1e-4)


def get_scheduler(optimizer: optim.Optimizer):
    """學習率排程 - AI 可修改"""
    return optim.lr_scheduler.StepLR(optimizer, step_size=10, gamma=0.1)


BATCH_SIZE = 64
EPOCHS = 20

# === 可調整區域 END ===


def train():
    """主訓練函式"""
    train_loader, val_loader = load_data(batch_size=BATCH_SIZE)
    model = SimpleModel()
    optimizer = get_optimizer(model)
    scheduler = get_scheduler(optimizer)
    criterion = nn.CrossEntropyLoss()

    best_accuracy = 0.0

    for epoch in range(EPOCHS):
        model.train()
        for batch_x, batch_y in train_loader:
            optimizer.zero_grad()
            output = model(batch_x)
            loss = criterion(output, batch_y)
            loss.backward()
            optimizer.step()
        scheduler.step()

        # 評估
        accuracy = evaluate_model(model, val_loader)
        if accuracy > best_accuracy:
            best_accuracy = accuracy
            torch.save(model.state_dict(), "best_model.pt")

    # 輸出最終指標（AutoResearch 依據此決定 Keep/Revert）
    print(f"METRIC:val_accuracy={best_accuracy:.4f}")
    return best_accuracy


if __name__ == "__main__":
    train()

# prepare.py - 固定工具層（不可被 AI 修改）
"""
Data Preparation & Evaluation Tools
====================================
此檔案為固定基礎設施，確保評估一致性。
AutoResearch Agent 不得修改此檔案。
"""

import torch
from torch.utils.data import DataLoader, TensorDataset
from typing import Tuple


def load_data(batch_size: int = 64) -> Tuple[DataLoader, DataLoader]:
    """載入並準備訓練/驗證資料集"""
    # 實際專案中替換為真實資料載入邏輯
    train_x = torch.randn(10000, 784)
    train_y = torch.randint(0, 10, (10000,))
    val_x = torch.randn(2000, 784)
    val_y = torch.randint(0, 10, (2000,))

    train_dataset = TensorDataset(train_x, train_y)
    val_dataset = TensorDataset(val_x, val_y)

    train_loader = DataLoader(train_dataset, batch_size=batch_size, shuffle=True)
    val_loader = DataLoader(val_dataset, batch_size=batch_size, shuffle=False)

    return train_loader, val_loader


def evaluate_model(model: torch.nn.Module, val_loader: DataLoader) -> float:
    """評估模型準確率（固定評估邏輯）"""
    model.eval()
    correct = 0
    total = 0

    with torch.no_grad():
        for batch_x, batch_y in val_loader:
            output = model(batch_x)
            _, predicted = torch.max(output, 1)
            total += batch_y.size(0)
            correct += (predicted == batch_y).sum().item()

    return correct / total if total > 0 else 0.0


def get_baseline_metric() -> float:
    """取得基線指標，用於判斷改善幅度"""
    return 0.85  # 基線準確率

# AutoResearch Program Instructions

## 目標
優化 train.py 中的模型效能，提升 validation accuracy。

## 約束條件
- 只能修改 train.py 中「可調整區域」標記的程式碼
- 不能修改 prepare.py
- 每次修改後必須執行完整測試
- 修改不能引入新的安全漏洞
- 不能安裝新的外部套件

## 策略優先順序
1. 調整模型架構（增加層數、改變激活函式）
2. 調整超參數（learning rate、batch size、epochs）
3. 加入正規化策略（Dropout、BatchNorm、Weight Decay）
4. 嘗試不同的優化器（SGD、AdamW、RAdam）

## 評估標準
- 主要指標：`METRIC:val_accuracy` 越高越好
- 次要約束：訓練時間不超過 60 秒
- 安全約束：不使用 eval()、exec() 等危險函式

## Keep/Revert 規則
- 如果 val_accuracy 提升 >= 0.5%：KEEP
- 如果 val_accuracy 下降：REVERT
- 如果程式執行失敗：REVERT
- 如果訓練時間超過限制：REVERT

# autoresearch_engine.py - 核心執行引擎
"""
AutoResearch Engine
===================
管理 AI 修改 → 測試 → 評估 → Keep/Revert 迴圈
"""

import subprocess
import time
import re
import os
from dataclasses import dataclass
from typing import Optional


@dataclass
class IterationResult:
    """單次迭代結果"""
    iteration: int
    metric_before: float
    metric_after: float
    action: str  # "KEEP" or "REVERT"
    duration_seconds: float
    change_description: str


def run_autoresearch(
    time_budget_seconds: int = 300,
    target_file: str = "train.py",
    program_file: str = "program.md"
) -> list[IterationResult]:
    """執行 AutoResearch 主迴圈"""
    results: list[IterationResult] = []
    start_time = time.time()
    iteration = 0
    current_metric = get_current_metric()

    while (time.time() - start_time) < time_budget_seconds:
        iteration += 1
        iter_start = time.time()

        # 1. 讀取策略指令
        program = read_file(program_file)

        # 2. AI 生成修改
        change_desc = ai_modify(target_file, program, current_metric)

        # 3. 執行測試與評估
        new_metric = execute_and_evaluate()

        # 4. 決定 Keep / Revert
        if new_metric is not None and new_metric > current_metric + 0.005:
            git_commit(f"AutoResearch iter {iteration}: {change_desc}")
            action = "KEEP"
            current_metric = new_metric
        else:
            git_revert()
            action = "REVERT"
            new_metric = new_metric or current_metric

        result = IterationResult(
            iteration=iteration,
            metric_before=current_metric if action == "REVERT" else current_metric,
            metric_after=new_metric,
            action=action,
            duration_seconds=time.time() - iter_start,
            change_description=change_desc
        )
        results.append(result)
        print(f"[Iter {iteration}] {action} | "
              f"Metric: {new_metric:.4f} | "
              f"Time: {result.duration_seconds:.1f}s")

    return results


def get_current_metric() -> float:
    """執行目前程式碼並取得指標"""
    result = subprocess.run(
        ["python", "train.py"],
        capture_output=True, text=True, timeout=120
    )
    match = re.search(r"METRIC:val_accuracy=([\d.]+)", result.stdout)
    return float(match.group(1)) if match else 0.0


def read_file(filepath: str) -> str:
    """安全讀取檔案"""
    with open(filepath, "r", encoding="utf-8") as f:
        return f.read()


def ai_modify(target_file: str, program: str, current_metric: float) -> str:
    """呼叫 LLM 修改目標檔案（簡化示意）"""
    # 實際實作會呼叫 Claude API 或 Copilot API
    # 此處為示意
    result = subprocess.run(
        ["claude", "--print",
         f"根據以下策略修改 {target_file}，"
         f"目前指標為 {current_metric}。"
         f"策略：{program[:500]}"],
        capture_output=True, text=True, timeout=60
    )
    return result.stdout[:100] if result.returncode == 0 else "modification failed"


def execute_and_evaluate() -> Optional[float]:
    """執行修改後的程式並評估"""
    try:
        result = subprocess.run(
            ["python", "train.py"],
            capture_output=True, text=True, timeout=120
        )
        if result.returncode != 0:
            return None
        match = re.search(r"METRIC:val_accuracy=([\d.]+)", result.stdout)
        return float(match.group(1)) if match else None
    except subprocess.TimeoutExpired:
        return None


def git_commit(message: str) -> None:
    """提交變更"""
    subprocess.run(["git", "add", "-A"], check=True)
    subprocess.run(["git", "commit", "-m", message], check=True)


def git_revert() -> None:
    """回滾變更"""
    subprocess.run(["git", "checkout", "--", "."], check=True)


if __name__ == "__main__":
    budget = int(os.environ.get("AUTORESEARCH_TIME_BUDGET", 300))
    results = run_autoresearch(time_budget_seconds=budget)
    print(f"\n=== 完成 {len(results)} 次迭代 ===")
    keeps = sum(1 for r in results if r.action == "KEEP")
    print(f"保留: {keeps} / 回滾: {len(results) - keeps}")

# 使用 Claude Code 分析需求文件
claude "請分析以下需求文件，進行 STRIDE 威脅建模分析：

需求：實作一個使用者登入 API，支援 JWT 認證、OAuth 2.0 整合。

請：
1. 列出每個 STRIDE 類別的潛在威脅
2. 評估風險等級（高/中/低）
3. 建議對應的安全控制措施
4. 產出 threat-model.md 文件"

# Threat Model: User Login API

## STRIDE Analysis

| 類別 | 威脅 | 風險 | 緩解措施 |
|------|------|------|---------|
| Spoofing | JWT Token 偽造 | 高 | 使用 RS256 簽章 |
| Tampering | Token 內容竄改 | 高 | JWT 簽章驗證 |
| Repudiation | 登入行為否認 | 中 | Audit Log 記錄 |
| Info Disclosure | Token 資訊外洩 | 高 | HTTPS + HttpOnly Cookie |
| DoS | 暴力破解登入 | 高 | Rate Limiting + CAPTCHA |
| Elevation | 權限提升 | 高 | RBAC + 最小權限原則 |

# requirement_analyzer.py
"""需求品質分析 - AutoResearch 觸發"""

SECURITY_KEYWORDS = [
    "authentication", "authorization", "encryption",
    "input validation", "rate limiting", "audit log",
    "session management", "error handling"
]

def analyze_requirement(requirement_doc: str) -> dict:
    """分析需求文件的安全覆蓋度"""
    doc_lower = requirement_doc.lower()
    coverage = {}

    for keyword in SECURITY_KEYWORDS:
        coverage[keyword] = keyword in doc_lower

    covered = sum(1 for v in coverage.values() if v)
    total = len(SECURITY_KEYWORDS)
    score = covered / total * 100

    return {
        "security_coverage_score": score,
        "missing_topics": [k for k, v in coverage.items() if not v],
        "recommendation": "通過" if score >= 75 else "需補充安全需求"
    }

@workspace 請審查目前的系統架構設計，
從安全性角度分析以下面向：
1. 認證與授權機制
2. 資料加密（傳輸中 + 靜態）
3. 網路隔離與防火牆規則
4. 日誌與監控
5. 備份與災難復原

# Autopilot 模式：自主完成 OWASP Top 10 防護實作
gh copilot "implement OWASP Top 10 protections for the login API in src/auth/
  Requirements:
  1. Input validation (email format, password complexity)
  2. bcrypt password hashing
  3. JWT RS256 signing with key rotation
  4. Rate limiting (5 req/min per IP)
  5. Audit logging for all auth events
  Run tests after each change."

# /fleet 平行開發：同時修補多個安全問題
gh copilot "/fleet fix all HIGH severity issues from reports/sast.json
  Each sub-agent handles one issue independently.
  Create separate branches: security-fix/<issue-id>"

# /research 安全研究：深度分析 codebase 安全現狀
gh copilot "/research analyze the authentication and authorization
  architecture in this codebase. Check for:
  - Broken access control patterns
  - Cryptographic failures
  - Injection vulnerabilities
  Output a security-assessment.md report."

# Auto Mode：不中斷地完成安全修補
claude --auto "掃描 src/ 目錄找出所有 SQL injection 和 XSS 漏洞，
  逐一修補，每次修補後執行 pytest 確認不影響功能。
  產出 security-fixes.md 報告。"

# 搭配 Sandbox 隔離執行不信任的測試
claude --sandbox "在隔離環境中執行 DAST 腳本，
  模擬攻擊行為驗證防護是否生效"

# 在 VS Code 中撰寫註解，讓 Copilot 生成安全程式碼

# TODO: 實作安全的使用者登入 API
# 要求：
# 1. 輸入驗證（email 格式、密碼複雜度）
# 2. 密碼使用 bcrypt 雜湊
# 3. JWT Token 使用 RS256 簽章
# 4. Rate Limiting（每 IP 每分鐘 5 次）
# 5. Audit Log 記錄

from fastapi import FastAPI, HTTPException, Depends, Request
from fastapi.security import HTTPBearer
from pydantic import BaseModel, EmailStr, field_validator
from slowapi import Limiter
from slowapi.util import get_remote_address
import bcrypt
import jwt
import logging
from datetime import datetime, timedelta, timezone

# --- Copilot 生成的安全程式碼 ---

app = FastAPI()
limiter = Limiter(key_func=get_remote_address)
security = HTTPBearer()
audit_logger = logging.getLogger("audit")

# JWT 設定（使用環境變數，不 hardcode）
import os
JWT_PRIVATE_KEY = os.environ["JWT_PRIVATE_KEY"]
JWT_PUBLIC_KEY = os.environ["JWT_PUBLIC_KEY"]
JWT_ALGORITHM = "RS256"
JWT_EXPIRATION_HOURS = 1


class LoginRequest(BaseModel):
    email: EmailStr
    password: str

    @field_validator("password")
    @classmethod
    def validate_password(cls, v: str) -> str:
        if len(v) < 8:
            raise ValueError("密碼長度不足 8 字元")
        if len(v) > 128:
            raise ValueError("密碼長度超過 128 字元")
        return v


class LoginResponse(BaseModel):
    access_token: str
    token_type: str = "bearer"
    expires_in: int


@app.post("/api/v1/auth/login", response_model=LoginResponse)
@limiter.limit("5/minute")
async def login(request: Request, body: LoginRequest):
    """安全登入 API"""
    # 1. 查詢使用者（示意）
    user = await get_user_by_email(body.email)
    if not user:
        # 避免使用者枚舉攻擊：回傳相同錯誤訊息
        raise HTTPException(status_code=401, detail="Invalid credentials")

    # 2. 驗證密碼（使用 bcrypt + constant-time comparison）
    if not bcrypt.checkpw(
        body.password.encode("utf-8"),
        user.password_hash.encode("utf-8")
    ):
        audit_logger.warning(
            f"Failed login attempt for {body.email} "
            f"from {get_remote_address(request)}"
        )
        raise HTTPException(status_code=401, detail="Invalid credentials")

    # 3. 產生 JWT Token
    now = datetime.now(timezone.utc)
    payload = {
        "sub": str(user.id),
        "email": user.email,
        "iat": now,
        "exp": now + timedelta(hours=JWT_EXPIRATION_HOURS),
        "jti": os.urandom(16).hex()  # 防止 Token Replay
    }
    token = jwt.encode(payload, JWT_PRIVATE_KEY, algorithm=JWT_ALGORITHM)

    # 4. Audit Log
    audit_logger.info(
        f"Successful login for {body.email} "
        f"from {get_remote_address(request)}"
    )

    return LoginResponse(
        access_token=token,
        expires_in=JWT_EXPIRATION_HOURS * 3600
    )

# 請 Claude Code 審查目前程式碼的安全性
claude "請掃描 src/ 目錄下的所有 Python 檔案，找出以下安全問題：
1. SQL Injection
2. XSS
3. 硬編碼的密碼/金鑰
4. 不安全的反序列化
5. Path Traversal
6. 不安全的隨機數生成

對每個問題：
- 指出檔案與行號
- 說明風險
- 提供修復建議
- 產出 security-review.md"

# 安裝安全相關 VS Code 擴充套件
code --install-extension SonarSource.sonarlint-vscode    # SonarLint 即時掃描
code --install-extension snyk-security.snyk-vulnerability-scanner  # Snyk 漏洞掃描
code --install-extension redhat.vscode-yaml              # YAML Schema 驗證

# test_login_security.py - AI 自動生成的安全測試

import pytest
from fastapi.testclient import TestClient
from unittest.mock import patch, AsyncMock
from app import app


client = TestClient(app)


class TestLoginSecurity:
    """登入 API 安全測試套件"""

    def test_sql_injection_in_email(self):
        """測試 SQL Injection 防護"""
        malicious_emails = [
            "admin'--@test.com",
            "admin' OR '1'='1@test.com",
            "'; DROP TABLE users;--@test.com"
        ]
        for email in malicious_emails:
            response = client.post("/api/v1/auth/login", json={
                "email": email,
                "password": "ValidP@ss123"
            })
            # 應回傳 422（驗證錯誤）而非 500（伺服器錯誤）
            assert response.status_code in [401, 422], \
                f"潛在 SQL Injection：{email}"

    def test_brute_force_protection(self):
        """測試暴力破解防護（Rate Limiting）"""
        for i in range(6):
            response = client.post("/api/v1/auth/login", json={
                "email": "test@example.com",
                "password": f"wrong_password_{i}"
            })
        # 第 6 次請求應被限速
        assert response.status_code == 429, "Rate Limiting 未生效"

    def test_user_enumeration_prevention(self):
        """測試使用者枚舉防護"""
        # 不存在的使用者
        resp1 = client.post("/api/v1/auth/login", json={
            "email": "nonexist@example.com",
            "password": "ValidP@ss123"
        })
        # 存在但密碼錯誤的使用者
        resp2 = client.post("/api/v1/auth/login", json={
            "email": "admin@example.com",
            "password": "WrongPassword"
        })
        # 錯誤訊息應該相同
        assert resp1.json()["detail"] == resp2.json()["detail"], \
            "不同錯誤情境回傳不同訊息，可能導致使用者枚舉"

    def test_password_not_in_response(self):
        """測試回應中不包含密碼資訊"""
        response = client.post("/api/v1/auth/login", json={
            "email": "admin@example.com",
            "password": "ValidP@ss123"
        })
        response_text = response.text.lower()
        assert "password" not in response_text, "回應中包含密碼相關資訊"

    def test_jwt_token_expiration(self):
        """測試 JWT Token 有效期限"""
        response = client.post("/api/v1/auth/login", json={
            "email": "admin@example.com",
            "password": "ValidP@ss123"
        })
        if response.status_code == 200:
            data = response.json()
            assert data["expires_in"] <= 3600, \
                "Token 有效期不應超過 1 小時"

    def test_xss_in_email_field(self):
        """測試 XSS 防護"""
        xss_payloads = [
            "<script>alert('xss')</script>@test.com",
            "test@<img src=x onerror=alert(1)>.com"
        ]
        for payload in xss_payloads:
            response = client.post("/api/v1/auth/login", json={
                "email": payload,
                "password": "ValidP@ss123"
            })
            assert "<script>" not in response.text, \
                f"潛在 XSS 漏洞：{payload}"

    def test_oversized_password_rejection(self):
        """測試超長密碼防護（防止 DoS）"""
        response = client.post("/api/v1/auth/login", json={
            "email": "test@example.com",
            "password": "a" * 10000  # 超長密碼
        })
        assert response.status_code == 422, "未拒絕超長密碼"

# 安裝 Security Guidance Plugin
claude plugin install security-guidance

# 啟用後，Claude Code 會在每次程式碼變更時自動：
# 1. 檢查 OWASP Top 10 合規性
# 2. 偵測不安全的密碼學用法
# 3. 標記潛在的注入漏洞
# 4. 建議安全最佳實踐

# 自訂安全規則（.claude/security-rules.yaml）

# .claude/security-rules.yaml
rules:
  - id: no-hardcoded-secrets
    severity: critical
    pattern: "(password|secret|api_key)\\s*=\\s*['\"][^'\"]+['\"]"
    message: "禁止硬編碼機密資訊，請使用環境變數或 Secret Manager"

  - id: require-input-validation
    severity: high
    scope: ["api", "controller"]
    check: "所有外部輸入必須經過驗證"

  - id: require-parameterized-queries
    severity: critical
    scope: ["repository", "dao"]
    check: "資料庫查詢必須使用參數化查詢"

# .github/copilot-code-review.yml
# 在 PR 開啟時自動觸發 Copilot Code Review
on:
  pull_request:
    types: [opened, synchronize]

copilot_review:
  enabled: true
  focus_areas:
    - security          # 安全漏洞
    - performance       # 效能問題
    - best_practices    # 最佳實踐
  auto_comment: true    # 自動在 PR 中留下審查意見
  block_on_critical: true  # Critical 問題阻擋合併

#!/bin/bash
# security_scan.sh - 完整安全掃描流程

set -euo pipefail

echo "=== SSDLC 安全掃描啟動 ==="

# 1. Secret Scanning（Pre-commit 層級）
echo "[1/5] Secret Scanning..."
gitleaks detect --source . --report-format json --report-path reports/secrets.json
if [ $? -ne 0 ]; then
    echo "⛔ 發現機密資訊洩漏！"
    exit 1
fi

# 2. SAST - 靜態分析
echo "[2/5] SAST - Static Analysis..."
semgrep scan --config auto --json --output reports/sast.json .

# 3. SCA - 依賴掃描
echo "[3/5] SCA - Dependency Scanning..."
pip-audit --format json --output reports/sca.json

# 4. Container Scanning（如果有 Dockerfile）
if [ -f Dockerfile ]; then
    echo "[4/5] Container Scanning..."
    trivy image --format json --output reports/container.json \
        $(docker build -q .)
fi

# 5. AI 分析掃描結果
echo "[5/5] AI 分析掃描結果..."
claude "請分析以下安全掃描報告，
產出 prioritized 修復建議：
$(cat reports/sast.json | head -c 5000)
$(cat reports/sca.json | head -c 5000)

請按風險等級排序（Critical > High > Medium > Low），
並為每個 Critical/High 問題提供修復程式碼。"

echo "=== 安全掃描完成 ==="

# security_autofix.py - AutoResearch 安全修補引擎

import json
import subprocess
from pathlib import Path


def auto_fix_security_issues(scan_report: str) -> dict:
    """AutoResearch 自動修補安全問題"""
    issues = json.loads(Path(scan_report).read_text())
    results = {"fixed": [], "skipped": [], "failed": []}

    for issue in sorted(issues, key=lambda x: severity_score(x)):
        if issue["severity"] not in ["CRITICAL", "HIGH"]:
            results["skipped"].append(issue["id"])
            continue

        # 1. 建立修補分支
        branch = f"security-fix/{issue['id']}"
        subprocess.run(["git", "checkout", "-b", branch], check=True)

        try:
            # 2. AI 生成修補程式碼
            fix_prompt = (
                f"修補安全漏洞：{issue['title']}\n"
                f"檔案：{issue['file']}:{issue['line']}\n"
                f"類型：{issue['category']}\n"
                f"說明：{issue['description']}\n"
                f"請只修改必要的程式碼，不要改變功能行為。"
            )
            subprocess.run(
                ["claude", "--print", fix_prompt],
                check=True, timeout=60
            )

            # 3. 執行測試驗證
            test_result = subprocess.run(
                ["pytest", "--tb=short", "-q"],
                capture_output=True, text=True, timeout=120
            )

            if test_result.returncode == 0:
                # 4. 驗證安全問題已修復
                rescan = subprocess.run(
                    ["semgrep", "scan", "--config", "auto",
                     "--json", issue["file"]],
                    capture_output=True, text=True
                )
                rescan_issues = json.loads(rescan.stdout)

                if not any(i["id"] == issue["id"] for i in rescan_issues.get("results", [])):
                    subprocess.run(["git", "add", "-A"], check=True)
                    subprocess.run(
                        ["git", "commit", "-m",
                         f"fix(security): {issue['title']} [{issue['id']}]"],
                        check=True
                    )
                    results["fixed"].append(issue["id"])
                else:
                    raise RuntimeError("修補後問題仍存在")
            else:
                raise RuntimeError(f"測試失敗：{test_result.stderr[:200]}")

        except Exception as e:
            subprocess.run(["git", "checkout", "--", "."])
            results["failed"].append({"id": issue["id"], "error": str(e)})

        finally:
            subprocess.run(["git", "checkout", "main"], check=True)

    return results


def severity_score(issue: dict) -> int:
    """安全嚴重度排序分數"""
    scores = {"CRITICAL": 0, "HIGH": 1, "MEDIUM": 2, "LOW": 3}
    return scores.get(issue.get("severity", "LOW"), 4)

# .github/workflows/agentic-deploy.yml
name: Agentic Deployment Pipeline

on:
  push:
    branches: [main]

jobs:
  agentic-deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: AI 風險評估
        uses: github/copilot-agent-action@v1
        with:
          task: |
            Analyze the changes in this push.
            Determine deployment risk level (low/medium/high).
            If high risk: create a staging deployment first and run security scan.
            If medium risk: deploy with canary strategy.
            If low risk: deploy directly with rolling update.
          permissions: deploy, comment

      - name: Claude Code 部署驗證
        uses: anthropic/claude-code-action@v1
        with:
          prompt: |
            驗證部署後的系統健康狀態：
            1. 執行 smoke test
            2. 檢查 API 回應時間
            3. 確認無新的安全警告
            如果有問題，自動建立 revert PR。

# 設定每日自動部署驗證 Routine
claude routine create \
  --name "daily-deploy-health-check" \
  --schedule "0 9 * * *" \
  --task "檢查 production 環境：
    1. 確認所有 service healthy
    2. 執行安全掃描（semgrep + trivy）
    3. 檢查 dependency CVE
    4. 如有 Critical 問題，自動建立 hotfix PR 並通知 #security channel"

# 設定 PR merge 後自動部署驗證
claude routine create \
  --name "post-deploy-validation" \
  --trigger "github:deployment_status:success" \
  --task "部署完成後驗證：
    1. 執行 E2E 安全測試
    2. 比較部署前後的 error rate
    3. 驗證 HTTPS、CORS、CSP 設定
    4. 產出部署驗證報告"

# deploy_decision.py - AI 部署策略決策

import os
import subprocess
import json
from typing import Literal


DeployStrategy = Literal["rolling", "canary", "blue-green"]


def assess_change_risk(changed_files: list[str]) -> DeployStrategy:
    """根據變更檔案評估部署風險並選擇策略"""
    high_risk_patterns = [
        "auth", "payment", "database", "migration",
        "security", "encryption", "core"
    ]
    medium_risk_patterns = [
        "api", "service", "controller", "model"
    ]

    risk_score = 0
    for f in changed_files:
        f_lower = f.lower()
        if any(p in f_lower for p in high_risk_patterns):
            risk_score += 3
        elif any(p in f_lower for p in medium_risk_patterns):
            risk_score += 1

    if risk_score >= 5:
        return "blue-green"
    elif risk_score >= 2:
        return "canary"
    else:
        return "rolling"


def get_changed_files() -> list[str]:
    """取得自上次部署以來的變更檔案"""
    result = subprocess.run(
        ["git", "diff", "--name-only", "HEAD~1"],
        capture_output=True, text=True, check=True
    )
    return result.stdout.strip().split("\n")


if __name__ == "__main__":
    files = get_changed_files()
    strategy = assess_change_risk(files)
    print(f"建議部署策略：{strategy}")
    print(f"變更檔案數：{len(files)}")

    # 輸出給 CI/CD 使用
    if os.environ.get("GITHUB_OUTPUT"):
        with open(os.environ["GITHUB_OUTPUT"], "a") as f:
            f.write(f"deploy_strategy={strategy}\n")

# 設定 Channel：將監控告警推送至 Claude Code
claude channel create \
  --name "security-alerts" \
  --source "prometheus-alertmanager" \
  --webhook-url "$CLAUDE_CHANNEL_WEBHOOK"

# Channel 收到告警後，Claude Code 自動：
# 1. 分析告警上下文
# 2. 關聯 git blame 找出變更來源
# 3. 判斷是否為安全事件
# 4. 自動產生修補 PR 或通知 on-call

# channel_handler.py - 監控告警處理邏輯
# 此腳本由 Claude Code Channel 觸發

import json
from datetime import datetime


def handle_security_alert(alert: dict) -> str:
    """處理安全告警的 Channel handler"""
    severity = alert.get("severity", "unknown")
    metric = alert.get("metric_name", "")

    if severity == "critical" and "auth" in metric:
        return (
            "立即分析認證相關異常，"
            "檢查是否有暴力破解攻擊，"
            "如確認攻擊則自動啟用 IP 封鎖"
        )
    elif severity == "high":
        return (
            "分析根因並建立修補 PR，"
            "通知 security team 進行審核"
        )
    else:
        return "記錄至 security backlog，排入下次迭代"

# .claude/analytics.yaml - Claude Code Analytics 設定
analytics:
  enabled: true
  export:
    format: opentelemetry
    endpoint: "https://otel-collector.internal:4318"

  metrics:
    - name: security_fixes_per_day
      description: "每日自動安全修補次數"
      type: counter
    - name: fix_success_rate
      description: "修補成功率（%）"
      type: gauge
    - name: mean_time_to_fix
      description: "平均修補時間（分鐘）"
      type: histogram
    - name: agent_cost_per_fix
      description: "每次修補的 AI Credits 消耗"
      type: histogram

  dashboard:
    refresh_interval: 5m
    panels:
      - title: "SSDLC Agent 活動總覽"
        metrics: [security_fixes_per_day, fix_success_rate]
      - title: "成本效益分析"
        metrics: [mean_time_to_fix, agent_cost_per_fix]

# anomaly_detector.py - AI 驅動的異常偵測

import json
from dataclasses import dataclass
from typing import Optional


@dataclass
class AnomalyAlert:
    """異常告警"""
    metric_name: str
    current_value: float
    expected_range: tuple[float, float]
    severity: str
    root_cause_hypothesis: str
    suggested_action: str


def detect_anomalies(metrics: dict[str, float]) -> list[AnomalyAlert]:
    """偵測系統指標異常"""
    alerts = []
    thresholds = {
        "api_latency_p99_ms": (0, 500),
        "error_rate_percent": (0, 1.0),
        "cpu_usage_percent": (0, 80),
        "memory_usage_percent": (0, 85),
        "request_rate_per_sec": (10, 10000),
    }

    for metric, (low, high) in thresholds.items():
        value = metrics.get(metric)
        if value is None:
            continue

        if value < low or value > high:
            severity = "CRITICAL" if value > high * 1.5 else "WARNING"
            alerts.append(AnomalyAlert(
                metric_name=metric,
                current_value=value,
                expected_range=(low, high),
                severity=severity,
                root_cause_hypothesis=analyze_root_cause(metric, value),
                suggested_action=suggest_action(metric, value, severity)
            ))

    return alerts


def analyze_root_cause(metric: str, value: float) -> str:
    """根因分析（簡化版本，實際可呼叫 LLM）"""
    causes = {
        "api_latency_p99_ms": "可能原因：資料庫查詢變慢、外部 API 超時、記憶體不足",
        "error_rate_percent": "可能原因：上游服務異常、輸入驗證失敗、部署問題",
        "cpu_usage_percent": "可能原因：無限迴圈、密集運算、並發過高",
        "memory_usage_percent": "可能原因：記憶體洩漏、快取未清理、大物件未釋放",
    }
    return causes.get(metric, "需進一步分析")


def suggest_action(metric: str, value: float, severity: str) -> str:
    """建議回應動作"""
    if severity == "CRITICAL":
        return "觸發 AutoResearch 自動修補 + 通知 On-Call 工程師"
    return "記錄異常 + 排入下次 AutoResearch 優化週期"

# Before（AutoResearch 偵測到效能問題）
def get_user_orders(user_id: int) -> list[dict]:
    """取得使用者訂單 - 效能瓶頸"""
    orders = db.query("SELECT * FROM orders WHERE user_id = %s", (user_id,))
    result = []
    for order in orders:
        # N+1 Query 問題
        items = db.query(
            "SELECT * FROM order_items WHERE order_id = %s",
            (order["id"],)
        )
        order["items"] = items
        result.append(order)
    return result


# After（AutoResearch 自動修復 N+1 Query）
def get_user_orders(user_id: int) -> list[dict]:
    """取得使用者訂單 - 已優化"""
    orders = db.query(
        """
        SELECT o.*, json_agg(oi.*) as items
        FROM orders o
        LEFT JOIN order_items oi ON o.id = oi.order_id
        WHERE o.user_id = %s
        GROUP BY o.id
        """,
        (user_id,)
    )
    return orders

# Before（O(n²) 複雜度）
def find_duplicates(items: list[str]) -> list[str]:
    duplicates = []
    for i in range(len(items)):
        for j in range(i + 1, len(items)):
            if items[i] == items[j] and items[i] not in duplicates:
                duplicates.append(items[i])
    return duplicates


# After（AutoResearch 優化為 O(n)）
def find_duplicates(items: list[str]) -> list[str]:
    seen: set[str] = set()
    duplicates: set[str] = set()
    for item in items:
        if item in seen:
            duplicates.add(item)
        seen.add(item)
    return list(duplicates)

# Before（SQL Injection 風險）
def search_products(query: str) -> list[dict]:
    sql = f"SELECT * FROM products WHERE name LIKE '%{query}%'"
    return db.execute(sql)


# After（AutoResearch 自動修補）
def search_products(query: str) -> list[dict]:
    sql = "SELECT * FROM products WHERE name LIKE %s"
    return db.execute(sql, (f"%{query}%",))

# evaluator.py - 多維度評估引擎

from dataclasses import dataclass
from typing import Optional


@dataclass
class EvaluationResult:
    """評估結果"""
    overall_decision: str  # "KEEP" or "REVERT"
    performance_delta: float  # 效能變化百分比
    security_score_delta: float  # 安全分數變化
    test_pass_rate: float  # 測試通過率
    code_quality_delta: float  # 程式碼品質變化
    reasons: list[str]


def evaluate(
    perf_before: float,
    perf_after: float,
    security_before: float,
    security_after: float,
    tests_passed: int,
    tests_total: int,
    quality_before: float,
    quality_after: float
) -> EvaluationResult:
    """多維度評估決策"""
    reasons = []
    veto = False  # 一票否決

    # 1. 測試通過率（硬性要求）
    test_rate = tests_passed / tests_total if tests_total > 0 else 0
    if test_rate < 1.0:
        veto = True
        reasons.append(f"⛔ 測試通過率不足：{test_rate:.0%}")

    # 2. 安全分數（不可降低）
    security_delta = security_after - security_before
    if security_delta < 0:
        veto = True
        reasons.append(f"⛔ 安全分數下降：{security_delta:+.2f}")
    elif security_delta > 0:
        reasons.append(f"✅ 安全分數提升：{security_delta:+.2f}")

    # 3. 效能指標
    perf_delta = ((perf_after - perf_before) / perf_before * 100
                  if perf_before > 0 else 0)
    if perf_delta > 5:
        reasons.append(f"✅ 效能提升：{perf_delta:+.1f}%")
    elif perf_delta < -10:
        reasons.append(f"⚠️ 效能下降：{perf_delta:+.1f}%")

    # 4. 程式碼品質
    quality_delta = quality_after - quality_before
    if quality_delta > 0:
        reasons.append(f"✅ 品質提升：{quality_delta:+.2f}")

    # 最終決策
    decision = "REVERT" if veto else "KEEP"

    return EvaluationResult(
        overall_decision=decision,
        performance_delta=perf_delta,
        security_score_delta=security_delta,
        test_pass_rate=test_rate,
        code_quality_delta=quality_delta,
        reasons=reasons
    )

# program.md - Code Quality 優化策略

## 目標
提升程式碼品質分數（使用 pylint / radon 量測）

## 策略
1. 降低圈複雜度（Cyclomatic Complexity）至 10 以下
2. 消除重複程式碼（DRY 原則）
3. 改善命名一致性
4. 拆分過長函式（> 50 行）

## 評估指標
METRIC:quality_score=<pylint 分數>
METRIC:complexity=<平均圈複雜度>

## 約束
- 不可改變程式行為（所有測試必須通過）
- 不可引入新的依賴

# program.md - Performance 優化策略

## 目標
降低 API P99 延遲至 200ms 以下

## 策略
1. 識別 N+1 Query 並修復
2. 加入適當的快取層
3. 優化資料結構與演算法
4. 減少不必要的 I/O 操作

## 評估指標
METRIC:p99_latency_ms=<P99 延遲毫秒>
METRIC:throughput_rps=<每秒請求數>

## 約束
- 記憶體使用不可增加超過 20%
- 不可犧牲程式碼可讀性

# program.md - Security 強化策略

## 目標
消除所有 Critical 和 High 安全漏洞

## 策略
1. 修補 SAST 掃描出的漏洞
2. 升級有已知 CVE 的依賴
3. 強化輸入驗證
4. 改善錯誤處理（避免資訊洩漏）

## 評估指標
METRIC:critical_vulns=<Critical 漏洞數>
METRIC:high_vulns=<High 漏洞數>
METRIC:security_score=<安全評分>

## 約束
- 不可降低測試覆蓋率
- 不可影響既有功能
- 依賴升級需保持向後相容

# .github/workflows/ssdlc-pipeline.yml
name: SSDLC Pipeline with AutoResearch

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]
  schedule:
    # 每日凌晨 2 點執行 AutoResearch 優化
    - cron: '0 2 * * *'

permissions:
  contents: write
  pull-requests: write
  security-events: write

env:
  PYTHON_VERSION: '3.12'
  AUTORESEARCH_TIME_BUDGET: 300

jobs:
  # === 階段 1：建置與測試 ===
  build-and-test:
    name: Build & Test
    runs-on: ubuntu-latest
    outputs:
      test_coverage: ${{ steps.coverage.outputs.coverage }}
    steps:
      - uses: actions/checkout@v4

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install uv
        uses: astral-sh/setup-uv@v4

      - name: Install Dependencies
        run: |
          uv sync
          uv pip install -r requirements-dev.txt

      - name: Run Linting
        run: |
          ruff check .
          black --check .

      - name: Run Unit Tests
        run: |
          pytest tests/ \
            --cov=src \
            --cov-report=xml:coverage.xml \
            --cov-report=term-missing \
            --junitxml=test-results.xml \
            -v

      - name: Extract Coverage
        id: coverage
        run: |
          COVERAGE=$(python -c "
          import xml.etree.ElementTree as ET
          tree = ET.parse('coverage.xml')
          root = tree.getroot()
          print(f'{float(root.attrib[\"line-rate\"]) * 100:.1f}')
          ")
          echo "coverage=$COVERAGE" >> $GITHUB_OUTPUT

      - name: Upload Test Results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: test-results
          path: |
            coverage.xml
            test-results.xml

  # === 階段 2：安全掃描 ===
  security-scan:
    name: Security Scanning
    runs-on: ubuntu-latest
    needs: build-and-test
    outputs:
      critical_count: ${{ steps.scan_results.outputs.critical }}
      high_count: ${{ steps.scan_results.outputs.high }}
    steps:
      - uses: actions/checkout@v4

      - name: Secret Scanning
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: SAST - Semgrep
        uses: semgrep/semgrep-action@v1
        with:
          config: >-
            p/security-audit
            p/owasp-top-ten
            p/python
          generateSarif: true

      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: semgrep.sarif

      - name: SCA - Dependency Check
        run: |
          pip install pip-audit safety
          pip-audit --format json --output sca-report.json || true
          safety check --json --output safety-report.json || true

      - name: Container Scanning
        if: hashFiles('Dockerfile') != ''
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          format: 'json'
          output: 'trivy-report.json'
          severity: 'CRITICAL,HIGH'

      - name: Aggregate Scan Results
        id: scan_results
        run: |
          python scripts/aggregate_security.py \
            --sast semgrep.sarif \
            --sca sca-report.json \
            --output security-summary.json
          CRITICAL=$(jq '.critical_count' security-summary.json)
          HIGH=$(jq '.high_count' security-summary.json)
          echo "critical=$CRITICAL" >> $GITHUB_OUTPUT
          echo "high=$HIGH" >> $GITHUB_OUTPUT

      - name: Upload Security Reports
        uses: actions/upload-artifact@v4
        with:
          name: security-reports
          path: |
            semgrep.sarif
            sca-report.json
            security-summary.json

  # === 階段 3：安全閘門 ===
  security-gate:
    name: Security Gate
    runs-on: ubuntu-latest
    needs: security-scan
    steps:
      - name: Check Security Gate
        run: |
          CRITICAL=${{ needs.security-scan.outputs.critical_count }}
          HIGH=${{ needs.security-scan.outputs.high_count }}

          echo "Critical: $CRITICAL | High: $HIGH"

          if [ "$CRITICAL" -gt 0 ]; then
            echo "⛔ Security Gate FAILED: $CRITICAL critical vulnerabilities"
            exit 1
          fi

          if [ "$HIGH" -gt 5 ]; then
            echo "⚠️ Security Gate WARNING: $HIGH high vulnerabilities"
            exit 1
          fi

          echo "✅ Security Gate PASSED"

  # === 階段 4：AutoResearch 優化（排程觸發） ===
  autoresearch-optimize:
    name: AutoResearch Optimization
    runs-on: ubuntu-latest
    if: github.event_name == 'schedule'
    needs: [build-and-test, security-scan]
    steps:
      - uses: actions/checkout@v4
        with:
          token: ${{ secrets.AUTORESEARCH_PAT }}

      - name: Install uv
        uses: astral-sh/setup-uv@v4

      - name: Setup Environment
        run: |
          uv sync
          uv pip install -r requirements-dev.txt

      - name: Download Security Reports
        uses: actions/download-artifact@v4
        with:
          name: security-reports
          path: reports/

      - name: Run AutoResearch
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          AUTORESEARCH_TIME_BUDGET: ${{ env.AUTORESEARCH_TIME_BUDGET }}
        run: |
          python autoresearch_engine.py \
            --program program.md \
            --target src/ \
            --time-budget $AUTORESEARCH_TIME_BUDGET \
            --output-report reports/optimization.json

      - name: Create Pull Request
        if: success()
        uses: peter-evans/create-pull-request@v6
        with:
          token: ${{ secrets.AUTORESEARCH_PAT }}
          commit-message: "chore(autoresearch): automated optimization"
          title: "🤖 AutoResearch: 自動優化建議"
          body: |
            ## AutoResearch 自動優化報告

            **執行時間**：${{ env.AUTORESEARCH_TIME_BUDGET }} 秒
            **觸發方式**：排程（每日凌晨 2 點）

            ### 變更摘要
            請查看 commit history 了解詳細變更。

            ### 驗證狀態
            - ✅ 所有測試通過
            - ✅ 安全掃描通過
            - 📊 效能指標見報告

            > ⚠️ 此 PR 由 AI 自動生成，請人工審核後再合併。
          branch: autoresearch/optimization
          labels: |
            autoresearch
            automated

  # === 階段 5：AutoResearch 安全修補（安全閘門失敗時觸發） ===
  autoresearch-security-fix:
    name: AutoResearch Security Fix
    runs-on: ubuntu-latest
    needs: security-gate
    if: failure()
    steps:
      - uses: actions/checkout@v4
        with:
          token: ${{ secrets.AUTORESEARCH_PAT }}

      - name: Install uv
        uses: astral-sh/setup-uv@v4

      - name: Setup Environment
        run: uv sync

      - name: Download Security Reports
        uses: actions/download-artifact@v4
        with:
          name: security-reports

      - name: Run AutoResearch Security Fix
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |
          python security_autofix.py \
            --scan-report security-summary.json \
            --severity CRITICAL,HIGH \
            --output-report security-fix-report.json

      - name: Create Security Fix PR
        uses: peter-evans/create-pull-request@v6
        with:
          token: ${{ secrets.AUTORESEARCH_PAT }}
          commit-message: "fix(security): automated vulnerability fix"
          title: "🔒 AutoResearch: 安全漏洞自動修補"
          body: |
            ## 安全漏洞自動修補報告

            安全閘門偵測到 Critical/High 漏洞，AutoResearch 已自動修補。

            > ⚠️ 安全修補必須由安全工程師審核後再合併。
          branch: autoresearch/security-fix
          labels: |
            security
            autoresearch
            urgent

  # === 階段 6：部署 ===
  deploy-staging:
    name: Deploy to Staging
    runs-on: ubuntu-latest
    needs: security-gate
    if: github.ref == 'refs/heads/main'
    environment: staging
    steps:
      - uses: actions/checkout@v4

      - name: Assess Deployment Risk
        id: risk
        run: |
          python deploy_decision.py
          echo "strategy=$(cat deploy-strategy.txt)" >> $GITHUB_OUTPUT

      - name: Deploy
        run: |
          echo "Deploying with strategy: ${{ steps.risk.outputs.strategy }}"
          # 實際部署指令依據策略不同而異

# .github/workflows/claude-code-review.yml
name: Claude Code PR Review

on:
  pull_request:
    types: [opened, synchronize]

jobs:
  claude-review:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v4

      - name: Claude Code Review
        uses: anthropic/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          prompt: |
            審查此 PR 的安全性：
            1. 檢查是否引入新的安全漏洞
            2. 驗證輸入驗證是否完整
            3. 確認無硬編碼 secrets
            4. 檢查權限控制是否正確
            在 PR 中留下逐項審查意見。
          mode: review

# .github/copilot-automations.yml
automations:
  - name: "Security Issue Auto-Fix"
    trigger:
      event: issues
      conditions:
        labels: ["security", "critical"]
    action:
      agent: copilot
      task: |
        Read the security issue details.
        Reproduce the vulnerability in a test.
        Implement the fix following OWASP guidelines.
        Create a PR with the fix and test.
      environment: ubuntu-latest
      permissions: [contents:write, pull-requests:write]

  - name: "Post-Deploy Smoke Test"
    trigger:
      event: deployment_status
      conditions:
        state: success
    action:
      agent: copilot
      task: |
        Run security smoke tests against the deployed environment.
        Check HTTPS, CORS, CSP headers.
        Verify no sensitive data in API responses.
        Comment results on the deployment.

# .github/workflows/autoresearch-manual.yml
name: AutoResearch Manual Trigger

on:
  workflow_dispatch:
    inputs:
      optimization_target:
        description: '優化目標'
        required: true
        type: choice
        options:
          - performance
          - security
          - quality
      time_budget:
        description: '時間預算（秒）'
        required: true
        default: '300'
      target_path:
        description: '目標路徑'
        required: true
        default: 'src/'

jobs:
  autoresearch:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run AutoResearch
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |
          python autoresearch_engine.py \
            --program "programs/${{ inputs.optimization_target }}.md" \
            --target "${{ inputs.target_path }}" \
            --time-budget ${{ inputs.time_budget }}

# scripts/aggregate_security.py
"""彙總多個安全掃描工具的結果"""

import json
import argparse
from pathlib import Path


def aggregate(sast_path: str, sca_path: str, output_path: str):
    """彙總安全掃描結果"""
    summary = {
        "critical_count": 0,
        "high_count": 0,
        "medium_count": 0,
        "low_count": 0,
        "issues": []
    }

    # 解析 SARIF（SAST）
    if Path(sast_path).exists():
        sarif = json.loads(Path(sast_path).read_text())
        for run in sarif.get("runs", []):
            for result in run.get("results", []):
                severity = map_sarif_severity(
                    result.get("level", "note")
                )
                summary[f"{severity.lower()}_count"] += 1
                summary["issues"].append({
                    "source": "SAST",
                    "severity": severity,
                    "rule": result.get("ruleId", ""),
                    "message": result.get("message", {}).get("text", ""),
                    "file": get_sarif_location(result)
                })

    # 解析 SCA
    if Path(sca_path).exists():
        sca = json.loads(Path(sca_path).read_text())
        for vuln in sca.get("vulnerabilities", []):
            severity = vuln.get("severity", "LOW").upper()
            summary[f"{severity.lower()}_count"] += 1
            summary["issues"].append({
                "source": "SCA",
                "severity": severity,
                "package": vuln.get("package", ""),
                "version": vuln.get("version", ""),
                "cve": vuln.get("cve", ""),
                "fix_version": vuln.get("fix_version", "")
            })

    # 排序：Critical > High > Medium > Low
    severity_order = {"CRITICAL": 0, "HIGH": 1, "MEDIUM": 2, "LOW": 3}
    summary["issues"].sort(
        key=lambda x: severity_order.get(x["severity"], 4)
    )

    Path(output_path).write_text(json.dumps(summary, indent=2))
    print(f"Security Summary: "
          f"C={summary['critical_count']} "
          f"H={summary['high_count']} "
          f"M={summary['medium_count']} "
          f"L={summary['low_count']}")


def map_sarif_severity(level: str) -> str:
    """SARIF severity 映射"""
    mapping = {
        "error": "HIGH",
        "warning": "MEDIUM",
        "note": "LOW"
    }
    return mapping.get(level, "LOW")


def get_sarif_location(result: dict) -> str:
    """從 SARIF 結果中提取檔案位置"""
    locations = result.get("locations", [])
    if locations:
        physical = locations[0].get("physicalLocation", {})
        artifact = physical.get("artifactLocation", {})
        region = physical.get("region", {})
        return f"{artifact.get('uri', '')}:{region.get('startLine', '')}"
    return ""


if __name__ == "__main__":
    parser = argparse.ArgumentParser()
    parser.add_argument("--sast", required=True)
    parser.add_argument("--sca", required=True)
    parser.add_argument("--output", required=True)
    args = parser.parse_args()
    aggregate(args.sast, args.sca, args.output)

# Performance Optimization: Order API

## 目標
降低 GET /api/v1/orders P99 延遲至 200ms 以下

## 目前狀態
- P99 延遲：2000ms
- 平均延遲：800ms
- 吞吐量：50 RPS

## 可修改檔案
- src/api/orders.py
- src/services/order_service.py
- src/repositories/order_repository.py

## 策略
1. 修復 N+1 Query（使用 JOIN 或 eager loading）
2. 加入 Redis 快取（TTL: 60 秒）
3. 使用更高效的序列化方式
4. 加入資料庫索引建議

## 評估指標
METRIC:p99_latency_ms=<p99 延遲>
METRIC:avg_latency_ms=<平均延遲>
METRIC:throughput_rps=<每秒請求數>

# Before - 迭代 1：N+1 Query 問題
class OrderRepository:
    def get_user_orders(self, user_id: int) -> list[dict]:
        orders = self.db.query(
            "SELECT * FROM orders WHERE user_id = %s", (user_id,)
        )
        for order in orders:
            # N+1 Query！每筆訂單都查詢一次
            items = self.db.query(
                "SELECT * FROM order_items WHERE order_id = %s",
                (order["id"],)
            )
            order["items"] = items
        return orders


# After - AutoResearch 修復
class OrderRepository:
    def get_user_orders(self, user_id: int) -> list[dict]:
        """取得使用者訂單（已優化：使用 JOIN 消除 N+1）"""
        query = """
            SELECT
                o.id, o.status, o.created_at, o.total_amount,
                json_agg(
                    json_build_object(
                        'item_id', oi.id,
                        'product_name', oi.product_name,
                        'quantity', oi.quantity,
                        'price', oi.price
                    )
                ) FILTER (WHERE oi.id IS NOT NULL) as items
            FROM orders o
            LEFT JOIN order_items oi ON o.id = oi.order_id
            WHERE o.user_id = %s
            GROUP BY o.id
            ORDER BY o.created_at DESC
        """
        return self.db.query(query, (user_id,))

# After - 迭代 2：加入 Redis 快取
import hashlib
import json
from functools import wraps

import redis

cache = redis.Redis(host="localhost", port=6379, db=0)


def cached(ttl_seconds: int = 60):
    """Redis 快取裝飾器"""
    def decorator(func):
        @wraps(func)
        def wrapper(*args, **kwargs):
            # 生成快取 key
            key_data = f"{func.__name__}:{args}:{kwargs}"
            cache_key = hashlib.sha256(key_data.encode()).hexdigest()

            # 嘗試讀取快取
            cached_result = cache.get(cache_key)
            if cached_result:
                return json.loads(cached_result)

            # 執行原函式
            result = func(*args, **kwargs)

            # 寫入快取
            cache.setex(cache_key, ttl_seconds, json.dumps(result, default=str))

            return result
        return wrapper
    return decorator


class OrderService:
    @cached(ttl_seconds=60)
    def get_user_orders(self, user_id: int) -> list[dict]:
        return self.repository.get_user_orders(user_id)

╔═══════════════════════════════════════════════╗
║     AutoResearch Performance Report           ║
╠═══════════════════════════════════════════════╣
║ Target:    GET /api/v1/orders                 ║
║ Duration:  237 seconds (5 iterations)         ║
║                                               ║
║ ┌─────────────┬──────────┬──────────┐         ║
║ │ Metric      │  Before  │  After   │         ║
║ ├─────────────┼──────────┼──────────┤         ║
║ │ P99 Latency │ 2000ms   │ 150ms ↓ │         ║
║ │ Avg Latency │  800ms   │  45ms ↓ │         ║
║ │ Throughput  │  50 RPS  │ 500 RPS ↑│        ║
║ │ Error Rate  │  0.5%    │ 0.1%  ↓ │         ║
║ └─────────────┴──────────┴──────────┘         ║
║                                               ║
║ Changes: 3 KEEP / 1 REVERT                   ║
║ Tests:   48/48 passed ✅                      ║
║ Security: No new vulnerabilities ✅           ║
╚═══════════════════════════════════════════════╝

# Before（CVE-2024-XXXX：SQL Injection）
@app.get("/api/v1/products/search")
async def search_products(q: str):
    # ⛔ 直接拼接 SQL，存在 SQL Injection
    query = f"SELECT * FROM products WHERE name LIKE '%{q}%'"
    results = db.execute(query)
    return {"products": results}


# After（AutoResearch 自動修補）
@app.get("/api/v1/products/search")
async def search_products(q: str = Query(max_length=100)):
    # ✅ 使用參數化查詢
    query = "SELECT * FROM products WHERE name LIKE %s"
    results = db.execute(query, (f"%{q}%",))
    return {"products": results}

# Before（Hardcoded API Key）
# ⛔ API Key 直接寫在程式碼中
API_KEY = "sk-prod-a1b2c3d4e5f6"
STRIPE_SECRET = "sk_live_xxxxx"


# After（AutoResearch 自動修補）
import os

# ✅ 從環境變數讀取
API_KEY = os.environ["API_KEY"]
STRIPE_SECRET = os.environ["STRIPE_SECRET"]

# Before（Insecure Deserialization）
import pickle

def load_session(session_data: bytes):
    # ⛔ pickle.loads 可執行任意程式碼
    return pickle.loads(session_data)


# After（AutoResearch 自動修補）
import json
import base64

def load_session(session_data: str) -> dict:
    # ✅ 使用安全的 JSON 反序列化
    try:
        decoded = base64.b64decode(session_data)
        return json.loads(decoded)
    except (json.JSONDecodeError, base64.binascii.Error):
        return {}

{
  "timestamp": "2026-04-14T02:15:30.000Z",
  "level": "INFO",
  "component": "autoresearch",
  "event": "iteration_complete",
  "iteration": 3,
  "action": "KEEP",
  "metrics": {
    "before": {"val_accuracy": 0.8750},
    "after": {"val_accuracy": 0.8820}
  },
  "duration_seconds": 45.2,
  "git_commit": "a1b2c3d",
  "change_description": "增加 BatchNorm 層並調整 learning rate"
}

# kibana/autoresearch-dashboard.ndjson（關鍵欄位）
panels:
  - title: "AutoResearch 迭代成功率"
    type: "metric"
    query: "component:autoresearch AND event:iteration_complete"
    aggregation: "terms:action"

  - title: "指標趨勢"
    type: "line"
    query: "component:autoresearch"
    y_axis: "metrics.after.val_accuracy"
    x_axis: "@timestamp"

  - title: "每日安全修補數"
    type: "bar"
    query: "component:autoresearch AND event:security_fix"
    aggregation: "date_histogram:@timestamp"

# drift_detector.py - 模型 Drift 偵測

import json
from pathlib import Path
from datetime import datetime, timedelta, timezone


def detect_drift(
    history_file: str = "autoresearch_history.json",
    window_days: int = 7
) -> dict:
    """偵測 AutoResearch 效能 drift"""
    history = json.loads(Path(history_file).read_text())

    now = datetime.now(timezone.utc)
    recent = [
        h for h in history
        if datetime.fromisoformat(h["timestamp"]) > now - timedelta(days=window_days)
    ]
    older = [
        h for h in history
        if datetime.fromisoformat(h["timestamp"]) <= now - timedelta(days=window_days)
    ]

    if not recent or not older:
        return {"drift_detected": False, "reason": "資料不足"}

    # 計算 KEEP 率
    recent_keep_rate = sum(1 for h in recent if h["action"] == "KEEP") / len(recent)
    older_keep_rate = sum(1 for h in older if h["action"] == "KEEP") / len(older)

    # 計算平均改善幅度
    recent_improvement = avg_improvement(recent)
    older_improvement = avg_improvement(older)

    drift_detected = (
        recent_keep_rate < older_keep_rate * 0.7 or  # KEEP 率下降超過 30%
        recent_improvement < older_improvement * 0.5   # 改善幅度下降超過 50%
    )

    return {
        "drift_detected": drift_detected,
        "recent_keep_rate": recent_keep_rate,
        "older_keep_rate": older_keep_rate,
        "recent_avg_improvement": recent_improvement,
        "older_avg_improvement": older_improvement,
        "recommendation": (
            "建議更新 program.md 策略或檢查 LLM API 版本"
            if drift_detected else "正常"
        )
    }


def avg_improvement(records: list[dict]) -> float:
    """計算平均改善幅度"""
    improvements = []
    for r in records:
        if r["action"] == "KEEP":
            before = r["metrics"]["before"].get("primary", 0)
            after = r["metrics"]["after"].get("primary", 0)
            if before > 0:
                improvements.append((after - before) / before)
    return sum(improvements) / len(improvements) if improvements else 0

# AutoResearch 產出的版本標籤格式
# v{版本}-ar{迭代次數}
git tag -a "v1.2.1-ar5" -m "AutoResearch: 5 次迭代優化"

#!/bin/bash
# rollback.sh - AutoResearch 變更回滾腳本

set -euo pipefail

COMPONENT=${1:-"all"}  # 回滾目標：all / specific-commit

echo "=== AutoResearch Rollback ==="

# 找到最近的 AutoResearch commit
AR_COMMITS=$(git log --oneline --grep="AutoResearch" -5)
echo "最近 AutoResearch commits："
echo "$AR_COMMITS"

if [ "$COMPONENT" == "all" ]; then
    # 回滾所有 AutoResearch 變更
    LAST_SAFE=$(git log --oneline --grep="AutoResearch" --invert-grep -1 | cut -d' ' -f1)
    echo "回滾至安全版本：$LAST_SAFE"
    git revert --no-commit HEAD..$LAST_SAFE
    git commit -m "rollback: 回滾所有 AutoResearch 變更"
else
    # 回滾特定 commit
    echo "回滾 commit：$COMPONENT"
    git revert --no-edit "$COMPONENT"
fi

# 驗證
echo "執行測試驗證..."
pytest tests/ -q
echo "=== 回滾完成 ==="

# config/agents.yaml - 多 Agent 設定
orchestrator:
  max_concurrent_agents: 4
  conflict_resolution: "priority-based"  # priority-based / lock-based / queue-based
  shared_lock:
    type: redis
    host: localhost
    port: 6379

agents:
  - name: performance-agent
    priority: 2
    program: programs/performance.md
    target_paths:
      - src/api/
      - src/services/
    schedule: "0 2 * * 1,3,5"  # 週一三五
    time_budget: 300

  - name: security-agent
    priority: 1  # 最高優先
    program: programs/security.md
    target_paths:
      - src/
    schedule: "0 2 * * 2,4"  # 週二四
    time_budget: 600
    triggers:
      - security_gate_failure

  - name: quality-agent
    priority: 3
    program: programs/quality.md
    target_paths:
      - src/
      - tests/
    schedule: "0 3 * * 6"  # 週六
    time_budget: 300

  - name: test-agent
    priority: 2
    program: programs/testing.md
    target_paths:
      - tests/
    schedule: "0 3 * * 0"  # 週日
    time_budget: 300

# conflict_resolver.py - 多 Agent 衝突解決

import redis
from contextlib import contextmanager
from typing import Generator


class ConflictResolver:
    """多 Agent 衝突解決器"""

    def __init__(self, redis_url: str = "redis://localhost:6379"):
        self.redis = redis.from_url(redis_url)

    @contextmanager
    def acquire_file_lock(
        self, file_path: str, agent_name: str, timeout: int = 60
    ) -> Generator[bool, None, None]:
        """取得檔案級別的分散式鎖"""
        lock_key = f"autoresearch:lock:{file_path}"
        lock = self.redis.lock(lock_key, timeout=timeout)

        acquired = lock.acquire(blocking=True, blocking_timeout=10)
        try:
            if acquired:
                self.redis.set(
                    f"autoresearch:owner:{file_path}",
                    agent_name,
                    ex=timeout
                )
            yield acquired
        finally:
            if acquired:
                lock.release()
                self.redis.delete(f"autoresearch:owner:{file_path}")

    def check_conflict(
        self, agent_name: str, files_to_modify: list[str]
    ) -> dict:
        """檢查是否與其他 Agent 衝突"""
        conflicts = {}
        for f in files_to_modify:
            owner = self.redis.get(f"autoresearch:owner:{f}")
            if owner and owner.decode() != agent_name:
                conflicts[f] = owner.decode()
        return conflicts

# config/distributed.yaml
regions:
  - name: asia-east
    endpoint: https://ar-asia.company.internal
    llm_provider: anthropic
    llm_region: asia-southeast-1
    capabilities:
      - performance
      - quality

  - name: us-west
    endpoint: https://ar-us.company.internal
    llm_provider: anthropic
    llm_region: us-west-2
    capabilities:
      - security
      - testing

routing:
  strategy: capability-based  # 根據能力路由
  fallback: round-robin

sync:
  method: git  # 透過 Git 同步結果
  conflict_resolution: last-writer-wins
  merge_strategy: rebase

# k8s/autoresearch-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: autoresearch-agent
  labels:
    app: autoresearch
spec:
  replicas: 3
  selector:
    matchLabels:
      app: autoresearch
  template:
    metadata:
      labels:
        app: autoresearch
    spec:
      containers:
        - name: autoresearch
          image: company-registry/autoresearch:latest
          resources:
            requests:
              cpu: "2"
              memory: "8Gi"
            limits:
              cpu: "4"
              memory: "16Gi"
          env:
            - name: ANTHROPIC_API_KEY
              valueFrom:
                secretKeyRef:
                  name: autoresearch-secrets
                  key: anthropic-api-key
            - name: AUTORESEARCH_TIME_BUDGET
              value: "300"
          volumeMounts:
            - name: workspace
              mountPath: /workspace
            - name: programs
              mountPath: /programs
      volumes:
        - name: workspace
          persistentVolumeClaim:
            claimName: autoresearch-workspace
        - name: programs
          configMap:
            name: autoresearch-programs
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: autoresearch-programs
data:
  performance.md: |
    # Performance Optimization Program
    ## 目標
    降低 API P99 延遲
    ...
  security.md: |
    # Security Hardening Program
    ## 目標
    消除所有 Critical 漏洞
    ...

# k8s/autoresearch-hpa.yaml
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: autoresearch-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: autoresearch-agent
  minReplicas: 1
  maxReplicas: 10
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70
    - type: Pods
      pods:
        metric:
          name: autoresearch_queue_depth
        target:
          type: AverageValue
          averageValue: "5"

# SSDLC Project Rules

## Security（安全）
- 所有 SQL 查詢必須使用參數化查詢，禁止字串拼接
- 密碼儲存必須使用 bcrypt 或 Argon2，禁止 MD5/SHA1
- API Key 不得出現在程式碼中，必須使用環境變數
- 禁止使用 eval()、exec()、pickle.loads() 等危險函式

## Testing（測試）
- 每個 API endpoint 必須有對應的安全測試
- 跑測試指令：pytest tests/ --cov=src --cov-fail-under=80
- 型態檢查指令：mypy src/ --strict

## Code Style（程式碼風格）
- 使用 ruff 進行 linting：ruff check .
- 使用 black 進行格式化：black .

## Git Workflow
- Commit message 遵循 Conventional Commits
- Branch naming: feature/*, fix/*, autoresearch/*

See @README.md for project overview and @package.json for available commands.

# Additional Instructions
- Git workflow: @docs/git-instructions.md
- Personal overrides: @~/.claude/my-project-instructions.md

# .claude/skills/security-scan/SKILL.md
---
name: security-scan
description: Run comprehensive security scanning on the codebase
---
# Security Scanning Workflow

1. Run `semgrep scan --config auto --json` for SAST
2. Run `pip-audit --format json` for dependency scanning
3. Run `gitleaks detect --source .` for secret scanning
4. Aggregate results and prioritize by severity
5. For CRITICAL issues, generate fix suggestions
6. Output report to `reports/security-scan.md`

# .claude/skills/fix-issue/SKILL.md
---
name: fix-issue
description: Fix a GitHub issue end-to-end
disable-model-invocation: true
---
Analyze and fix the GitHub issue: $ARGUMENTS.

1. Use `gh issue view` to get the issue details
2. Understand the problem described in the issue
3. Search the codebase for relevant files
4. Implement the necessary changes
5. Write and run tests to verify the fix
6. Ensure code passes linting and type checking
7. Create a descriptive commit message
8. Push and create a PR

// .claude/settings.json
{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Write|Edit",
        "hooks": [
          {
            "type": "command",
            "command": "ruff check --fix $CLAUDE_FILE_PATH && semgrep scan --config auto --quiet $CLAUDE_FILE_PATH"
          }
        ]
      }
    ],
    "PreToolUse": [
      {
        "matcher": "Write",
        "hooks": [
          {
            "type": "command",
            "command": "echo $CLAUDE_FILE_PATH | grep -qE '(migrations/|.env|secrets)' && echo 'BLOCK: Protected file' && exit 1 || exit 0"
          }
        ]
      }
    ]
  }
}

# .claude/agents/security-reviewer.md
---
name: security-reviewer
description: Reviews code for security vulnerabilities
tools: Read, Grep, Glob, Bash
model: opus
---
You are a senior security engineer. Review code for:
- Injection vulnerabilities (SQL, XSS, command injection)
- Authentication and authorization flaws
- Secrets or credentials in code
- Insecure data handling
- OWASP Top 10 compliance

Provide specific line references and suggested fixes.
Output findings in SARIF format when possible.

# 新增 GitHub MCP Server
claude mcp add github

# 新增自定義 MCP Server
claude mcp add my-security-db --command "python security_db_server.py"

# 使用 @ 語法存取 MCP 資源
@github:repos/my-org/my-repo/issues       # 列出 Issues
@github:repos/my-org/my-repo/pulls         # 列出 PR
Show me the data from @my-security-db:latest-scan

# 啟動 Plan Mode
claude --permission-mode plan

# 在 Plan Mode 中進行安全分析
# > 分析認證系統的安全架構，找出潛在弱點，制定修復計畫

# Headless 模式（CI/CD 中使用）
claude --permission-mode plan -p "分析 src/ 目錄的安全風險並產出報告"

# 使用 ultrathink 關鍵字觸發深度推理（Opus 4.6 / Sonnet 4.6）
# > ultrathink 分析此系統的認證流程，找出所有可能的攻擊向量

# 調整推理深度
/effort        # 互動式調整
/model         # 在模型設定中調整

# 啟動隔離的 Worktree 會話
claude --worktree feature-auth      # 建立 .claude/worktrees/feature-auth/
claude --worktree bugfix-123        # 建立 .claude/worktrees/bugfix-123/
claude --worktree                   # 自動產生隨機名稱

# Subagent 也可使用 Worktree 隔離
# 在 .claude/agents/my-agent.md 中設定：
# isolation: worktree

# .worktreeinclude - 自動複製 gitignored 檔案到新 Worktree
.env
.env.local
config/secrets.json

# 每日安全掃描（Cloud Scheduled Task - claude.ai/code 設定）
# Prompt: "掃描 src/ 目錄的安全漏洞，對 Critical 問題建立 fix PR，
#          將摘要發送到 #security-alerts Slack 頻道"

# 每週依賴更新檢查（GitHub Actions）
# 見第 7 章 CI/CD 整合

# 即時監控（/loop）
/loop 每 5 分鐘檢查 API 健康狀態，若有異常則分析根因

# security_agent.py - 使用 Claude Code Agent SDK 建構安全掃描 Agent
from claude_code_sdk import Agent, Tool, Guardrail, Runner
from claude_code_sdk.types import RunResult


# 定義工具
@Tool(description="Run SAST scan on specified files")
async def sast_scan(file_paths: list[str]) -> dict:
    """執行靜態安全掃描"""
    import subprocess, json
    result = subprocess.run(
        ["semgrep", "scan", "--config", "auto", "--json"] + file_paths,
        capture_output=True, text=True
    )
    return json.loads(result.stdout)


@Tool(description="Fix a security vulnerability")
async def apply_fix(file_path: str, fix_description: str) -> str:
    """套用安全修補"""
    # Agent SDK 內建檔案編輯能力
    ...


# 定義安全護欄
@Guardrail(name="no-secrets-in-output")
async def check_no_secrets(output: str) -> bool:
    """確保 Agent 輸出不包含機密資訊"""
    import re
    patterns = [
        r"[A-Za-z0-9+/]{40,}",  # Base64 長字串
        r"sk-[a-zA-Z0-9]{48}",  # API keys
        r"ghp_[a-zA-Z0-9]{36}",  # GitHub PAT
    ]
    return not any(re.search(p, output) for p in patterns)


# 建構 Agent
security_agent = Agent(
    name="SSDLC Security Agent",
    instructions="""You are a security expert.
    Scan code for vulnerabilities, prioritize by severity,
    and apply fixes following OWASP guidelines.
    Never expose secrets in your output.""",
    tools=[sast_scan, apply_fix],
    guardrails=[check_no_secrets],
    model="claude-sonnet-4-20250514",
)


# 執行
async def main():
    result: RunResult = await Runner.run(
        security_agent,
        input="Scan src/ for SQL injection and XSS vulnerabilities. Fix all CRITICAL issues."
    )
    print(result.final_output)

// security-agent.ts - TypeScript Agent SDK
import { Agent, Tool, run } from '@anthropic-ai/claude-code-sdk';

const sastScan = new Tool({
  name: 'sast_scan',
  description: 'Run SAST scan on the codebase',
  parameters: { paths: { type: 'array', items: { type: 'string' } } },
  execute: async ({ paths }) => {
    const { execSync } = await import('child_process');
    return JSON.parse(
      execSync(`semgrep scan --config auto --json ${paths.join(' ')}`).toString()
    );
  },
});

const agent = new Agent({
  name: 'SSDLC Security Agent',
  instructions: 'You are a security expert...',
  tools: [sastScan],
});

const result = await run(agent, { input: 'Scan and fix critical vulnerabilities' });

# 搜尋 Plugin
claude plugin search security

# 安裝 Plugin
claude plugin install security-guidance
claude plugin install aws-toolkit
claude plugin install docker-helper

# 列出已安裝
claude plugin list

# 移除
claude plugin remove security-guidance

# my-ssdlc-plugin/manifest.yaml
name: ssdlc-compliance
version: 1.0.0
description: Enterprise SSDLC compliance checks
author: security-team

hooks:
  post_edit:
    - check_owasp_compliance
    - validate_input_sanitization
  pre_commit:
    - run_security_scan
    - check_secrets

tools:
  - name: compliance_report
    description: Generate SSDLC compliance report
    command: python tools/compliance.py

settings:
  owasp_version: "2025"
  severity_threshold: "MEDIUM"
  auto_fix: true

# 啟用 Remote Control
claude --remote-control

# Claude Code 會顯示一個 URL，可從任何裝置存取
# > Remote Control enabled: https://claude.ai/remote/abc123xyz
# > Scan the QR code or open the URL to continue this session

# 從手機端可以：
# - 查看 Agent 執行進度
# - 核准/拒絕權限請求
# - 傳送新指令
# - 中斷正在執行的任務

# 建立 Channel
claude channel create --name "security-alerts"

# 取得 webhook URL
claude channel info security-alerts
# > Webhook: https://api.claude.ai/channels/ch_xxxx/webhook
# > Events received: 42
# > Last event: 2 minutes ago

# 外部系統推送事件
curl -X POST https://api.claude.ai/channels/ch_xxxx/webhook \
  -H "Authorization: Bearer $CHANNEL_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"type": "security_alert", "severity": "critical", "message": "SQL injection detected in /api/users"}'

# 啟動 Desktop App（安裝後可直接開啟）
# 功能：
# 1. 多個平行 Agent sessions，各自獨立 Git branch
# 2. 視覺化 diff 預覽（比 CLI 更直觀）
# 3. PR 監控面板（查看所有 Agent 建立的 PR）
# 4. Routines 排程管理 UI
# 5. Analytics 視覺化儀表板
# 6. Team 管理（多人協作）

# 安裝 Claude Code Chrome Extension 後：
# 1. 在任何網頁按 Cmd+Shift+Y 呼叫 Claude Code
# 2. 自動擷取當前頁面的 console errors
# 3. 可直接修改對應的前端程式碼
# 4. 即時預覽修改效果

# SSDLC 場景：
# - 偵測 XSS 漏洞（觀察 DOM 注入行為）
# - 驗證 CSP 設定是否正確
# - 測試 CORS 設定

# 觸發 Ultrareview（自動拆分為多個 Agent 審查）
claude review --ultra PR_URL

# 或在 CI 中使用
claude --headless -p "ultrareview this PR focusing on security" \
  --context "$(gh pr diff 123)"

# 啟用 Auto Mode
claude --auto "完成以下安全修補任務：
  1. 掃描所有 Python 檔案的 SQL injection
  2. 修補每個問題
  3. 為每個修補撰寫測試
  4. 確認所有測試通過
  5. 產出修補報告"

# 或在互動中切換
/auto on     # 啟用
/auto off    # 關閉

# 在 Sandbox 中執行安全測試
claude --sandbox "執行 DAST 掃描腳本，
  模擬 OWASP Top 10 攻擊向量，
  驗證防護機制是否生效"

# Sandbox 限制：
# - 隔離的檔案系統（不影響實際程式碼）
# - 受限的網路存取
# - 獨立的 process namespace
# - 時間限制

# 查看使用統計
claude analytics

# 匯出 OpenTelemetry traces
claude --otel-endpoint "http://otel-collector:4318"

# 設定全域（.claude/settings.json）

{
  "analytics": {
    "enabled": true,
    "opentelemetry": {
      "endpoint": "http://otel-collector:4318",
      "service_name": "claude-code-ssdlc",
      "export_format": "otlp"
    }
  }
}

# grafana/dashboards/claude-code-ssdlc.json（簡化）
panels:
  - title: "Security Fixes per Day"
    type: timeseries
    query: "rate(claude_code_security_fixes_total[1d])"

  - title: "Mean Time to Fix (MTTF)"
    type: stat
    query: "histogram_quantile(0.5, claude_code_fix_duration_seconds)"

  - title: "Agent Cost Efficiency"
    type: gauge
    query: "claude_code_cost_per_fix_usd"

  - title: "SSDLC Compliance Score"
    type: gauge
    query: "claude_code_compliance_score"

.github/skills/
├── security-audit/
│   └── SKILL.md
├── performance-check/
│   └── SKILL.md
└── deploy-review/
    └── SKILL.md

# .github/skills/security-audit/SKILL.md
---
name: security-audit
description: Comprehensive security audit for OWASP Top 10 compliance
---
# Security Audit Workflow

## Steps
1. Scan for injection vulnerabilities (SQL, XSS, Command Injection)
2. Check authentication and session management
3. Verify authorization controls and access patterns
4. Audit cryptographic usage and key management
5. Check for sensitive data exposure
6. Verify API security (rate limiting, input validation)
7. Check dependency vulnerabilities via SCA
8. Review error handling for information leakage

## Output Format
- Severity: CRITICAL / HIGH / MEDIUM / LOW
- File and line reference
- Description of vulnerability
- Suggested fix with code example
- OWASP category reference

# .github/workflows/copilot-review.yml
name: Copilot Security Review
on:
  pull_request:
    types: [opened, synchronize]

jobs:
  copilot-review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Request Copilot Review
        run: |
          gh pr review ${{ github.event.pull_request.number }} \
            --request-review copilot

# 啟用 Autopilot（需先設定 trust level）
gh copilot config set trust-level high

# Autopilot 安全修補範例
gh copilot "scan all Python files for hardcoded secrets,
  replace them with environment variable references,
  add the env vars to .env.example,
  update documentation,
  run tests to verify nothing breaks"

# 平行修補多個安全問題
gh copilot "/fleet fix all items in security-report.json
  Each sub-agent handles one vulnerability independently.
  Constraints:
  - Create separate branch per fix
  - Run tests after each fix
  - Don't modify shared config files"

# /fleet 狀態監控
gh copilot "/fleet status"
# > Fleet: 5 agents running
# > Agent 1: fixing SQL injection in users.py [DONE ✅]
# > Agent 2: fixing XSS in templates/ [IN PROGRESS 🔄]
# > Agent 3: updating insecure dependency [DONE ✅]
# > Agent 4: fixing path traversal in uploads.py [IN PROGRESS 🔄]
# > Agent 5: adding rate limiting to /api/auth [DONE ✅]

# 安全架構研究
gh copilot "/research analyze the complete authentication flow
  in this codebase. Document:
  1. All entry points
  2. Token lifecycle (creation, validation, refresh, revocation)
  3. Permission model and access control patterns
  4. Session management strategy
  5. Potential attack vectors
  Output: security-architecture-review.md"

# 搜尋過去的安全修補記錄
gh copilot "/chronicle search security fix"
# > 2026-06-28: Fixed SQL injection in /api/search (PR #234)
# > 2026-06-25: Updated dependencies for CVE-2026-1234 (PR #231)
# > 2026-06-20: Added rate limiting to auth endpoints (PR #228)

# 產生 standup 報告
gh copilot "/chronicle standup"

# 在 Copilot App 中（圖形化介面操作）：

# 1. 建立安全修補 Session
#    Input: 從 GitHub Security Advisory 連結
#    → Agent 自動分析影響、搜尋受影響程式碼、產生修補

# 2. 平行 Session 管理
#    Session A: 修補 CVE-2026-5678（branch: fix/cve-2026-5678）
#    Session B: 重構認證模組（branch: refactor/auth-module）
#    Session C: 撰寫安全測試（branch: test/security-suite）

# 3. Automations 設定
#    觸發條件: "High severity security alert on this repo"
#    動作: "自動建立修補 PR 並通知 security team"

// copilot-security-bot.ts - 使用 Copilot SDK 建構安全機器人
import { CopilotSDK } from '@github/copilot-sdk';

const copilot = new CopilotSDK({
  appId: process.env.GITHUB_APP_ID,
  privateKey: process.env.GITHUB_APP_PRIVATE_KEY,
});

// 建立安全掃描任務
const session = await copilot.createSession({
  repo: 'my-org/my-app',
  task: `Scan the codebase for OWASP Top 10 vulnerabilities.
    For each finding, create a separate fix PR with:
    - Description of the vulnerability
    - CVSS score estimate
    - Fix implementation
    - Test case`,
  permissions: ['contents:write', 'pull-requests:write'],
});

// 監控進度
session.on('progress', (event) => {
  console.log(`[${event.step}/${event.total}] ${event.message}`);
});

// 取得結果
const result = await session.waitForCompletion();
console.log(`Created ${result.pullRequests.length} fix PRs`);

# 在 GitHub Issue 中 @mention agent
# @copilot fix this security vulnerability
# @claude-agent perform deep security analysis on this PR
# @custom-security-agent run compliance check

# 在 GitHub Actions 中使用
- uses: anthropic/claude-code-action@v1
  with:
    prompt: "Security review this PR"

# .github/agentic-workflows/security-response.yml
name: Automated Security Response

triggers:
  - event: security_advisory
    severity: [critical, high]
  - event: dependabot_alert
    severity: [critical, high]

workflow:
  steps:
    - name: Assess Impact
      agent: copilot
      action: |
        Analyze the security advisory.
        Determine which files in this repo are affected.
        Estimate the blast radius.

    - name: Generate Fix
      agent: copilot
      action: |
        Create a fix for the vulnerability.
        Follow the project's security guidelines in SECURITY.md.
        Ensure backward compatibility.

    - name: Validate
      action: run-ci
      checks: [tests, security-scan, linting]

    - name: Create PR
      action: create-pr
      reviewers: [security-team]
      labels: [security, automated, urgent]
      
    - name: Notify
      action: notify
      channels: [slack:#security-alerts, email:security@company.com]

# 在 Copilot CLI 中安裝 Plugin
gh copilot plugin install security-scanner
gh copilot plugin install compliance-checker
gh copilot plugin install test-generator

# 在 VS Code 中（Copilot Chat Settings）
# Settings → GitHub Copilot → Plugins → Install

# plugins/ssdlc-compliance/plugin.yaml
name: ssdlc-compliance
version: 2.0.0
publisher: internal-security-team
visibility: organization  # 僅組織內可見

capabilities:
  - name: security_scan
    description: Run enterprise security scanning
    permissions: [contents:read]
  - name: compliance_check
    description: Check against internal security policies
    permissions: [contents:read]
  - name: auto_fix
    description: Automatically fix compliance violations
    permissions: [contents:write, pull-requests:write]

enterprise_controls:
  require_approval: true
  audit_log: true
  data_residency: "us-east-1"

# GitHub Enterprise 設定（Organization Settings → Copilot → Budgets）
budget_controls:
  organization_monthly_limit: 10000  # USD
  per_user_monthly_limit: 500       # USD
  alert_threshold: 80               # 80% 時告警

  cost_allocation:
    - team: security
      budget: 3000
      priority: high      # 安全任務優先保障額度
    - team: development
      budget: 5000
      priority: medium
    - team: documentation
      budget: 2000
      priority: low

  overage_policy: block  # block | alert | allow

# 查詢 Copilot 操作稽核紀錄
gh api /orgs/MY-ORG/audit-log \
  --jq '.[] | select(.action | startswith("copilot"))' \
  --paginate

# 典型稽核事件：
# copilot.agent_session_created
# copilot.code_suggestion_accepted
# copilot.pull_request_created_by_agent
# copilot.security_fix_applied
# copilot.budget_threshold_reached

# [面向] Optimization Program

## 目標
[明確、可量化的目標描述]

## 目前狀態
- 指標 A：[目前值]
- 指標 B：[目前值]

## 可修改範圍
- [檔案/目錄清單]

## 禁止範圍
- [檔案/目錄/操作清單]

## 策略（依優先順序）
1. [策略一]
2. [策略二]
3. [策略三]

## 評估指標
METRIC:[指標名]=[值]

## Keep/Revert 規則
- KEEP 條件：[條件]
- REVERT 條件：[條件]

## 安全約束
- [安全限制清單]

# .autoresearch/security-policy.yaml
security_policy:
  # AI Agent 權限控制
  agent_permissions:
    can_modify_production: false
    can_access_secrets: false
    can_install_packages: false
    can_execute_shell: restricted  # 僅允許白名單命令
    allowed_commands:
      - python
      - pytest
      - ruff
      - black
      - semgrep

  # 變更限制
  change_limits:
    max_files_per_iteration: 5
    max_lines_changed_per_iteration: 100
    banned_patterns:
      - "eval("
      - "exec("
      - "os.system("
      - "subprocess.call(.*shell=True"
      - "__import__("
      - "pickle.loads("

  # 安全掃描要求
  scan_requirements:
    pre_commit:
      - gitleaks  # Secret scan
    pre_merge:
      - semgrep   # SAST
      - pip-audit # SCA
    post_deploy:
      - trivy     # Container scan

<type>(<scope>): <description>

[optional body]

[optional footer]

{
  "main": {
    "required_reviews": 2,
    "required_status_checks": [
      "build-and-test",
      "security-scan",
      "security-gate"
    ],
    "enforce_admins": true,
    "dismiss_stale_reviews": true,
    "require_signed_commits": true
  },
  "develop": {
    "required_reviews": 1,
    "required_status_checks": [
      "build-and-test",
      "security-scan"
    ]
  }
}

# AutoResearch 分支命名規範
autoresearch/optimization/{date}    # 日常優化
autoresearch/security-fix/{cve-id}  # 安全修補
autoresearch/quality/{metric}       # 品質改善

# 範例
autoresearch/optimization/2026-04-14
autoresearch/security-fix/CVE-2024-12345
autoresearch/quality/complexity-reduction

# 成本監控告警設定
# .github/copilot-budget.yml
budget:
  monthly_limit_usd: 5000
  alert_at_percent: [50, 75, 90]
  notify:
    - channel: slack:#engineering-costs
    - email: engineering-lead@company.com
  overage_action: throttle  # throttle | block | alert-only

# .autoresearch/agent-guardrails.yaml
guardrails:
  # 禁止操作
  deny:
    - pattern: "rm -rf /"
    - pattern: "DROP TABLE"
    - pattern: "git push --force"
    - pattern: "chmod 777"
    - file_patterns: ["*.env", "secrets/*", "production.yml"]

  # 需要人工確認
  require_approval:
    - action: "modify database schema"
    - action: "change authentication logic"
    - action: "update production config"
    - action: "install new dependency"

  # 自動回滾條件
  auto_rollback:
    - condition: "test_coverage < previous_coverage"
    - condition: "security_score < previous_score"
    - condition: "build_fails"

  # 操作稽核
  audit:
    enabled: true
    retention_days: 90
    export_to: "siem"
    alert_on: ["Level 3+ operations", "deny rule triggered"]

# ❌ 錯誤：沒有回滾機制
def deploy_ai_changes():
    changes = autoresearch.run()
    apply_to_production(changes)  # 直接部署，無法回滾！

# ✅ 正確：完整的回滾機制
def deploy_ai_changes():
    changes = autoresearch.run()
    snapshot = create_snapshot()  # 建立快照

    try:
        apply_to_staging(changes)
        run_smoke_tests()
        apply_to_production(changes)
    except Exception:
        rollback_to_snapshot(snapshot)  # 回滾
        alert_team("部署失敗，已自動回滾")

# ❌ 錯誤的 CI/CD Pipeline：跳過測試
jobs:
  deploy:
    steps:
      - uses: actions/checkout@v4
      - run: autoresearch --optimize
      - run: deploy.sh  # 直接部署！沒有測試！

# ✅ 正確的 CI/CD Pipeline：完整驗證
jobs:
  test:
    steps:
      - run: pytest tests/ --cov=src
      - run: semgrep scan --config auto
  security-gate:
    needs: test
    steps:
      - run: check_security_gate.sh
  deploy:
    needs: security-gate
    steps:
      - run: deploy.sh

# ❌ 錯誤的 program.md
## 目標
讓程式碼變得更好

## 策略
盡量優化

# ✅ 正確的 program.md
## 目標
降低 GET /api/v1/orders 的 P99 延遲從 2000ms 至 200ms 以下

## 策略（依優先順序）
1. 修復 N+1 Query（使用 JOIN）
2. 加入 Redis 快取（TTL: 60s）
3. 加入資料庫連線池

## 評估標準
METRIC:p99_latency_ms 低於 200 才 KEEP

# ❌ 錯誤：給 AI Agent 過多權限
agent_permissions:
  can_access_production_db: true
  can_modify_infrastructure: true
  can_delete_files: true
  can_install_any_package: true

# ✅ 正確：最小權限原則
agent_permissions:
  can_access_production_db: false
  can_modify_infrastructure: false
  can_delete_files: false
  can_install_any_package: false
  allowed_operations:
    - read_source_code
    - modify_source_code  # 限定範圍內
    - run_tests
    - run_linter

# ❌ 錯誤：直接信任 AI 生成的套件名稱
# AI 可能生成不存在的套件，導致 Supply Chain Attack
def install_ai_suggested_packages(packages: list[str]):
    for pkg in packages:
        subprocess.run(["pip", "install", pkg])  # 危險！

# ✅ 正確：驗證套件合法性
ALLOWED_PACKAGES = {"requests", "flask", "pytest", "numpy", "pandas"}

def install_ai_suggested_packages(packages: list[str]):
    for pkg in packages:
        if pkg not in ALLOWED_PACKAGES:
            raise ValueError(
                f"套件 {pkg} 不在允許清單中，需人工審核"
            )
        subprocess.run(["pip", "install", pkg], check=True)

# docker-compose.yml
version: '3.9'

services:
  # AutoResearch Agent
  autoresearch:
    build:
      context: .
      dockerfile: Dockerfile.autoresearch
    container_name: ar-agent
    environment:
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
      - AUTORESEARCH_TIME_BUDGET=${AR_TIME_BUDGET:-300}
      - REDIS_URL=redis://redis:6379
      - GIT_REPO_URL=${GIT_REPO_URL}
    volumes:
      - workspace:/workspace
      - ./programs:/programs:ro
    depends_on:
      - redis
    networks:
      - ar-network

  # Redis（快取 + 分散式鎖）
  redis:
    image: redis:7-alpine
    container_name: ar-redis
    ports:
      - "6379:6379"
    volumes:
      - redis-data:/data
    networks:
      - ar-network

  # Elasticsearch（日誌儲存）
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.12.0
    container_name: ar-elasticsearch
    environment:
      - discovery.type=single-node
      - xpack.security.enabled=false
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    ports:
      - "9200:9200"
    volumes:
      - es-data:/usr/share/elasticsearch/data
    networks:
      - ar-network

  # Kibana（日誌視覺化）
  kibana:
    image: docker.elastic.co/kibana/kibana:8.12.0
    container_name: ar-kibana
    ports:
      - "5601:5601"
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
    depends_on:
      - elasticsearch
    networks:
      - ar-network

  # Prometheus（指標收集）
  prometheus:
    image: prom/prometheus:latest
    container_name: ar-prometheus
    ports:
      - "9090:9090"
    volumes:
      - ./config/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prom-data:/prometheus
    networks:
      - ar-network

  # Grafana（指標視覺化）
  grafana:
    image: grafana/grafana:latest
    container_name: ar-grafana
    ports:
      - "3000:3000"
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD:-admin}
    volumes:
      - grafana-data:/var/lib/grafana
    depends_on:
      - prometheus
    networks:
      - ar-network

volumes:
  workspace:
  redis-data:
  es-data:
  prom-data:
  grafana-data:

networks:
  ar-network:
    driver: bridge

# .env.example（複製為 .env 並填入實際值）

# === LLM API Keys ===
ANTHROPIC_API_KEY=sk-ant-your-key-here
OPENAI_API_KEY=sk-your-key-here

# === Git ===
GIT_REPO_URL=https://github.com/your-org/your-repo.git
GITHUB_TOKEN=ghp_your-token-here

# === AutoResearch ===
AR_TIME_BUDGET=300
AR_MAX_ITERATIONS=10

# === Infrastructure ===
REDIS_URL=redis://localhost:6379
GRAFANA_PASSWORD=your-secure-password

# === Security ===
SEMGREP_APP_TOKEN=your-semgrep-token
SNYK_TOKEN=your-snyk-token

# Dockerfile.autoresearch
FROM python:3.12-slim

WORKDIR /app

# 安裝系統依賴
RUN apt-get update && apt-get install -y --no-install-recommends \
    git \
    curl \
    && rm -rf /var/lib/apt/lists/*

# 安裝 Claude Code（原生安裝，不再需要 Node.js）
RUN curl -fsSL https://claude.ai/install.sh | bash

# 安裝 uv（AutoResearch 使用 uv 管理依賴）
RUN curl -LsSf https://astral.sh/uv/install.sh | sh

# 安裝 Python 依賴（使用 uv）
COPY pyproject.toml uv.lock ./
RUN uv sync --frozen

# 安裝安全掃描工具
RUN pip install --no-cache-dir semgrep pip-audit safety

# 複製應用程式碼
COPY . .

# 非 root 使用者（安全最佳實踐）
RUN useradd --create-home appuser
USER appuser

ENTRYPOINT ["python", "autoresearch_engine.py"]

autoresearch-ssdlc/
├── .github/
│   ├── workflows/
│   │   ├── ssdlc-pipeline.yml        # 主 CI/CD Pipeline
│   │   ├── autoresearch-manual.yml    # 手動觸發
│   │   └── autoresearch-schedule.yml  # 排程觸發
│   └── CODEOWNERS                     # 程式碼擁有者
├── config/
│   ├── agents.yaml                    # 多 Agent 設定
│   ├── distributed.yaml               # 分散式設定
│   ├── prometheus.yml                 # Prometheus 設定
│   └── security-policy.yaml           # 安全策略
├── programs/
│   ├── performance.md                 # 效能優化策略
│   ├── security.md                    # 安全強化策略
│   ├── quality.md                     # 品質改善策略
│   └── testing.md                     # 測試生成策略
├── scripts/
│   ├── setup.ps1                      # Windows 安裝腳本
│   ├── setup.sh                       # Linux 安裝腳本
│   ├── security_scan.sh               # 安全掃描腳本
│   ├── aggregate_security.py          # 掃描結果彙總
│   ├── rollback.sh                    # 回滾腳本
│   └── drift_detector.py             # Drift 偵測
├── src/
│   ├── api/                           # API 層
│   ├── services/                      # 服務層
│   ├── repositories/                  # 資料存取層
│   └── models/                        # 資料模型
├── tests/
│   ├── unit/                          # 單元測試
│   ├── integration/                   # 整合測試
│   ├── security/                      # 安全測試
│   └── performance/                   # 效能測試
├── k8s/
│   ├── autoresearch-deployment.yaml   # K8s 部署
│   └── autoresearch-hpa.yaml          # 自動擴縮
├── .autoresearch/
│   └── security-policy.yaml           # Agent 安全策略
├── .vscode/
│   └── settings.json                  # VS Code 設定
├── autoresearch_engine.py             # 核心執行引擎
├── security_autofix.py                # 安全自動修補
├── deploy_decision.py                 # 部署決策引擎
├── conflict_resolver.py               # 衝突解決器
├── evaluator.py                       # 多維度評估引擎
├── docker-compose.yml                 # Docker Compose
├── Dockerfile.autoresearch            # Dockerfile
├── pyproject.toml                     # uv 專案定義與 Python 相依
├── uv.lock                            # uv 鎖定檔
├── requirements-dev.txt               # 開發相依
├── .env.example                       # 環境變數範例
├── .gitignore                         # Git 忽略規則
└── README.md                          # 專案說明