需求 → 設計 → 開發 → 測試 → 安全掃描 → 部署 → 監控 → 優化
         ↑                                           |
         └───────── 持續回饋與改進 ─────────────────┘

# 1. 安裝 Python（使用 winget）
winget install Python.Python.3.12

# 2. 確認安裝
python --version
pip --version

# 3. 建立虛擬環境
python -m venv .venv
.\.venv\Scripts\Activate.ps1

# 4. 升級 pip
python -m pip install --upgrade pip

# 5. 安裝基礎套件
pip install torch numpy pandas scikit-learn pytest black ruff

# 1. 安裝 Python（使用 pyenv）
curl https://pyenv.run | bash
pyenv install 3.12.0
pyenv global 3.12.0

# 2. 建立虛擬環境
python -m venv .venv
source .venv/bin/activate

# 3. 安裝基礎套件
pip install torch numpy pandas scikit-learn pytest black ruff

# 安裝（Windows 使用 winget）
winget install Git.Git

# 基本設定
git config --global user.name "Your Name"
git config --global user.email "your.email@company.com"

# 安全設定：啟用 GPG 簽章
git config --global commit.gpgsign true
git config --global tag.gpgsign true

# 設定預設分支名稱
git config --global init.defaultBranch main

# 安裝 GitHub CLI
winget install GitHub.cli

# 驗證登入
gh auth login

# macOS / Linux
curl -LsSf https://astral.sh/uv/install.sh | sh

# Windows PowerShell
powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"

# 1. Clone AutoResearch 專案
git clone https://github.com/karpathy/autoresearch.git
cd autoresearch

# 2. 安裝相依套件（使用 uv）
uv sync

# 3. 下載資料並訓練 tokenizer（一次性，約 2 分鐘）
uv run prepare.py

# 4. 手動執行一次訓練實驗（約 5 分鐘，驗證環境正常）
uv run train.py

# Windows PowerShell
$env:AUTORESEARCH_HOME = "$(Get-Location)"
$env:AUTORESEARCH_TIME_BUDGET = "300"  # 5 分鐘

# Linux / macOS
export AUTORESEARCH_HOME=$(pwd)
export AUTORESEARCH_TIME_BUDGET=300

# 啟動 Claude Code / Codex 等 AI Agent，然後給予以下 Prompt：
# "Hi have a look at program.md and let's kick off a new experiment!
#  let's do the setup first."
# program.md 本質上是一個輕量級的 "skill" 指令檔

# macOS / Linux / WSL（推薦）
curl -fsSL https://claude.ai/install.sh | bash

# Windows PowerShell
irm https://claude.ai/install.ps1 | iex

# Windows CMD
curl -fsSL https://claude.ai/install.cmd -o install.cmd && install.cmd && del install.cmd

# 也可透過套件管理器安裝
# Homebrew (macOS)
brew install claude-code

# WinGet (Windows)
winget install Anthropic.ClaudeCode

# 1. 在專案目錄啟動 Claude Code（首次會引導登入）
cd your-project
claude

# 支援的帳號類型：
# - Claude Pro / Max / Team / Enterprise（推薦）
# - Claude Console（API 存取，預付費額度）
# - Amazon Bedrock / Google Vertex AI / Microsoft Foundry（企業雲端供應商）

# 2. 驗證安裝
claude --version

# 3. 在 CLI 輸入 /help 查看可用指令

# .env（加入 .gitignore）
ANTHROPIC_API_KEY=sk-ant-xxxxx
OPENAI_API_KEY=sk-xxxxx
GITHUB_TOKEN=ghp_xxxxx

# .gitignore
.env
.env.*
!.env.example

# 1. 在 VS Code 中安裝 GitHub Copilot 擴充套件
code --install-extension GitHub.copilot
code --install-extension GitHub.copilot-chat

# 2. 登入 GitHub 帳號（在 VS Code 中操作）
# VS Code → Accounts → Sign in with GitHub

# 3. 驗證 Copilot 啟用狀態
# 開啟任意程式碼檔案，確認右下角顯示 Copilot 圖示

# 1. 安裝 VS Code（Windows）
winget install Microsoft.VisualStudioCode

# 2. 安裝必要擴充套件
code --install-extension GitHub.copilot
code --install-extension GitHub.copilot-chat
code --install-extension ms-python.python
code --install-extension ms-python.vscode-pylance
code --install-extension eamodio.gitlens
code --install-extension GitHub.vscode-pull-request-github
code --install-extension ms-vscode.vscode-github-actions

{
  "editor.formatOnSave": true,
  "editor.defaultFormatter": "ms-python.black-formatter",
  "python.analysis.typeCheckingMode": "basic",
  "python.testing.pytestEnabled": true,
  "github.copilot.enable": {
    "*": true,
    "markdown": true,
    "yaml": true
  },
  "files.exclude": {
    "**/__pycache__": true,
    "**/.pytest_cache": true
  },
  "[python]": {
    "editor.defaultFormatter": "ms-python.black-formatter",
    "editor.codeActionsOnSave": {
      "source.organizeImports": "explicit"
    }
  }
}

#!/usr/bin/env pwsh
# AutoResearch + SSDLC 環境一鍵安裝腳本

Write-Host "=== AutoResearch SSDLC 環境安裝 ===" -ForegroundColor Cyan

# 檢查 Python
if (-not (Get-Command python -ErrorAction SilentlyContinue)) {
    Write-Host "安裝 Python 3.12..." -ForegroundColor Yellow
    winget install Python.Python.3.12
}

# 檢查 Node.js
if (-not (Get-Command node -ErrorAction SilentlyContinue)) {
    Write-Host "安裝 Node.js..." -ForegroundColor Yellow
    winget install OpenJS.NodeJS.LTS
}

# 檢查 Git
if (-not (Get-Command git -ErrorAction SilentlyContinue)) {
    Write-Host "安裝 Git..." -ForegroundColor Yellow
    winget install Git.Git
}

# 安裝 uv 套件管理器
if (-not (Get-Command uv -ErrorAction SilentlyContinue)) {
    Write-Host "安裝 uv..." -ForegroundColor Yellow
    powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"
}

# 建立虛擬環境
Write-Host "建立 Python 虛擬環境..." -ForegroundColor Yellow
python -m venv .venv
.\.venv\Scripts\Activate.ps1

# 安裝 Python 套件（使用 uv）
uv sync

# 安裝 Claude Code（原生安裝）
Write-Host "安裝 Claude Code..." -ForegroundColor Yellow
irm https://claude.ai/install.ps1 | iex

# 安裝 VS Code 擴充套件
$extensions = @(
    "GitHub.copilot",
    "GitHub.copilot-chat",
    "ms-python.python",
    "eamodio.gitlens"
)
foreach ($ext in $extensions) {
    code --install-extension $ext
}

Write-Host "=== 安裝完成 ===" -ForegroundColor Green

#!/bin/bash
set -euo pipefail

echo "=== AutoResearch SSDLC 環境安裝 ==="

# 檢查並安裝 Python
if ! command -v python3 &> /dev/null; then
    echo "請先安裝 Python 3.10+"
    exit 1
fi

# 建立虛擬環境
python3 -m venv .venv
source .venv/bin/activate

# 安裝相依套件（使用 uv）
uv sync

# 安裝 Claude Code（原生安裝）
curl -fsSL https://claude.ai/install.sh | bash

echo "=== 安裝完成 ==="

# train.py - AutoResearch 可修改的目標檔案
"""
AutoResearch Target Script
==========================
此檔案可被 AI Agent 修改以優化模型效能。
評估指標：validation accuracy（越高越好）
"""

import torch
import torch.nn as nn
import torch.optim as optim
from prepare import load_data, evaluate_model

# === 可調整區域 START ===

class SimpleModel(nn.Module):
    """模型架構 - AI 可修改"""
    def __init__(self, input_dim: int = 784, hidden_dim: int = 256, output_dim: int = 10):
        super().__init__()
        self.layers = nn.Sequential(
            nn.Linear(input_dim, hidden_dim),
            nn.ReLU(),
            nn.Dropout(0.2),
            nn.Linear(hidden_dim, output_dim)
        )

    def forward(self, x):
        return self.layers(x)


def get_optimizer(model: nn.Module) -> optim.Optimizer:
    """優化器設定 - AI 可修改"""
    return optim.Adam(model.parameters(), lr=1e-3, weight_decay=1e-4)


def get_scheduler(optimizer: optim.Optimizer):
    """學習率排程 - AI 可修改"""
    return optim.lr_scheduler.StepLR(optimizer, step_size=10, gamma=0.1)


BATCH_SIZE = 64
EPOCHS = 20

# === 可調整區域 END ===


def train():
    """主訓練函式"""
    train_loader, val_loader = load_data(batch_size=BATCH_SIZE)
    model = SimpleModel()
    optimizer = get_optimizer(model)
    scheduler = get_scheduler(optimizer)
    criterion = nn.CrossEntropyLoss()

    best_accuracy = 0.0

    for epoch in range(EPOCHS):
        model.train()
        for batch_x, batch_y in train_loader:
            optimizer.zero_grad()
            output = model(batch_x)
            loss = criterion(output, batch_y)
            loss.backward()
            optimizer.step()
        scheduler.step()

        # 評估
        accuracy = evaluate_model(model, val_loader)
        if accuracy > best_accuracy:
            best_accuracy = accuracy
            torch.save(model.state_dict(), "best_model.pt")

    # 輸出最終指標（AutoResearch 依據此決定 Keep/Revert）
    print(f"METRIC:val_accuracy={best_accuracy:.4f}")
    return best_accuracy


if __name__ == "__main__":
    train()

# prepare.py - 固定工具層（不可被 AI 修改）
"""
Data Preparation & Evaluation Tools
====================================
此檔案為固定基礎設施，確保評估一致性。
AutoResearch Agent 不得修改此檔案。
"""

import torch
from torch.utils.data import DataLoader, TensorDataset
from typing import Tuple


def load_data(batch_size: int = 64) -> Tuple[DataLoader, DataLoader]:
    """載入並準備訓練/驗證資料集"""
    # 實際專案中替換為真實資料載入邏輯
    train_x = torch.randn(10000, 784)
    train_y = torch.randint(0, 10, (10000,))
    val_x = torch.randn(2000, 784)
    val_y = torch.randint(0, 10, (2000,))

    train_dataset = TensorDataset(train_x, train_y)
    val_dataset = TensorDataset(val_x, val_y)

    train_loader = DataLoader(train_dataset, batch_size=batch_size, shuffle=True)
    val_loader = DataLoader(val_dataset, batch_size=batch_size, shuffle=False)

    return train_loader, val_loader


def evaluate_model(model: torch.nn.Module, val_loader: DataLoader) -> float:
    """評估模型準確率（固定評估邏輯）"""
    model.eval()
    correct = 0
    total = 0

    with torch.no_grad():
        for batch_x, batch_y in val_loader:
            output = model(batch_x)
            _, predicted = torch.max(output, 1)
            total += batch_y.size(0)
            correct += (predicted == batch_y).sum().item()

    return correct / total if total > 0 else 0.0


def get_baseline_metric() -> float:
    """取得基線指標，用於判斷改善幅度"""
    return 0.85  # 基線準確率

# AutoResearch Program Instructions

## 目標
優化 train.py 中的模型效能，提升 validation accuracy。

## 約束條件
- 只能修改 train.py 中「可調整區域」標記的程式碼
- 不能修改 prepare.py
- 每次修改後必須執行完整測試
- 修改不能引入新的安全漏洞
- 不能安裝新的外部套件

## 策略優先順序
1. 調整模型架構（增加層數、改變激活函式）
2. 調整超參數（learning rate、batch size、epochs）
3. 加入正規化策略（Dropout、BatchNorm、Weight Decay）
4. 嘗試不同的優化器（SGD、AdamW、RAdam）

## 評估標準
- 主要指標：`METRIC:val_accuracy` 越高越好
- 次要約束：訓練時間不超過 60 秒
- 安全約束：不使用 eval()、exec() 等危險函式

## Keep/Revert 規則
- 如果 val_accuracy 提升 >= 0.5%：KEEP
- 如果 val_accuracy 下降：REVERT
- 如果程式執行失敗：REVERT
- 如果訓練時間超過限制：REVERT

# autoresearch_engine.py - 核心執行引擎
"""
AutoResearch Engine
===================
管理 AI 修改 → 測試 → 評估 → Keep/Revert 迴圈
"""

import subprocess
import time
import re
import os
from dataclasses import dataclass
from typing import Optional


@dataclass
class IterationResult:
    """單次迭代結果"""
    iteration: int
    metric_before: float
    metric_after: float
    action: str  # "KEEP" or "REVERT"
    duration_seconds: float
    change_description: str


def run_autoresearch(
    time_budget_seconds: int = 300,
    target_file: str = "train.py",
    program_file: str = "program.md"
) -> list[IterationResult]:
    """執行 AutoResearch 主迴圈"""
    results: list[IterationResult] = []
    start_time = time.time()
    iteration = 0
    current_metric = get_current_metric()

    while (time.time() - start_time) < time_budget_seconds:
        iteration += 1
        iter_start = time.time()

        # 1. 讀取策略指令
        program = read_file(program_file)

        # 2. AI 生成修改
        change_desc = ai_modify(target_file, program, current_metric)

        # 3. 執行測試與評估
        new_metric = execute_and_evaluate()

        # 4. 決定 Keep / Revert
        if new_metric is not None and new_metric > current_metric + 0.005:
            git_commit(f"AutoResearch iter {iteration}: {change_desc}")
            action = "KEEP"
            current_metric = new_metric
        else:
            git_revert()
            action = "REVERT"
            new_metric = new_metric or current_metric

        result = IterationResult(
            iteration=iteration,
            metric_before=current_metric if action == "REVERT" else current_metric,
            metric_after=new_metric,
            action=action,
            duration_seconds=time.time() - iter_start,
            change_description=change_desc
        )
        results.append(result)
        print(f"[Iter {iteration}] {action} | "
              f"Metric: {new_metric:.4f} | "
              f"Time: {result.duration_seconds:.1f}s")

    return results


def get_current_metric() -> float:
    """執行目前程式碼並取得指標"""
    result = subprocess.run(
        ["python", "train.py"],
        capture_output=True, text=True, timeout=120
    )
    match = re.search(r"METRIC:val_accuracy=([\d.]+)", result.stdout)
    return float(match.group(1)) if match else 0.0


def read_file(filepath: str) -> str:
    """安全讀取檔案"""
    with open(filepath, "r", encoding="utf-8") as f:
        return f.read()


def ai_modify(target_file: str, program: str, current_metric: float) -> str:
    """呼叫 LLM 修改目標檔案（簡化示意）"""
    # 實際實作會呼叫 Claude API 或 Copilot API
    # 此處為示意
    result = subprocess.run(
        ["claude", "--print",
         f"根據以下策略修改 {target_file}，"
         f"目前指標為 {current_metric}。"
         f"策略：{program[:500]}"],
        capture_output=True, text=True, timeout=60
    )
    return result.stdout[:100] if result.returncode == 0 else "modification failed"


def execute_and_evaluate() -> Optional[float]:
    """執行修改後的程式並評估"""
    try:
        result = subprocess.run(
            ["python", "train.py"],
            capture_output=True, text=True, timeout=120
        )
        if result.returncode != 0:
            return None
        match = re.search(r"METRIC:val_accuracy=([\d.]+)", result.stdout)
        return float(match.group(1)) if match else None
    except subprocess.TimeoutExpired:
        return None


def git_commit(message: str) -> None:
    """提交變更"""
    subprocess.run(["git", "add", "-A"], check=True)
    subprocess.run(["git", "commit", "-m", message], check=True)


def git_revert() -> None:
    """回滾變更"""
    subprocess.run(["git", "checkout", "--", "."], check=True)


if __name__ == "__main__":
    budget = int(os.environ.get("AUTORESEARCH_TIME_BUDGET", 300))
    results = run_autoresearch(time_budget_seconds=budget)
    print(f"\n=== 完成 {len(results)} 次迭代 ===")
    keeps = sum(1 for r in results if r.action == "KEEP")
    print(f"保留: {keeps} / 回滾: {len(results) - keeps}")

# 使用 Claude Code 分析需求文件
claude "請分析以下需求文件，進行 STRIDE 威脅建模分析：

需求：實作一個使用者登入 API，支援 JWT 認證、OAuth 2.0 整合。

請：
1. 列出每個 STRIDE 類別的潛在威脅
2. 評估風險等級（高/中/低）
3. 建議對應的安全控制措施
4. 產出 threat-model.md 文件"

# Threat Model: User Login API

## STRIDE Analysis

| 類別 | 威脅 | 風險 | 緩解措施 |
|------|------|------|---------|
| Spoofing | JWT Token 偽造 | 高 | 使用 RS256 簽章 |
| Tampering | Token 內容竄改 | 高 | JWT 簽章驗證 |
| Repudiation | 登入行為否認 | 中 | Audit Log 記錄 |
| Info Disclosure | Token 資訊外洩 | 高 | HTTPS + HttpOnly Cookie |
| DoS | 暴力破解登入 | 高 | Rate Limiting + CAPTCHA |
| Elevation | 權限提升 | 高 | RBAC + 最小權限原則 |

# requirement_analyzer.py
"""需求品質分析 - AutoResearch 觸發"""

SECURITY_KEYWORDS = [
    "authentication", "authorization", "encryption",
    "input validation", "rate limiting", "audit log",
    "session management", "error handling"
]

def analyze_requirement(requirement_doc: str) -> dict:
    """分析需求文件的安全覆蓋度"""
    doc_lower = requirement_doc.lower()
    coverage = {}

    for keyword in SECURITY_KEYWORDS:
        coverage[keyword] = keyword in doc_lower

    covered = sum(1 for v in coverage.values() if v)
    total = len(SECURITY_KEYWORDS)
    score = covered / total * 100

    return {
        "security_coverage_score": score,
        "missing_topics": [k for k, v in coverage.items() if not v],
        "recommendation": "通過" if score >= 75 else "需補充安全需求"
    }

@workspace 請審查目前的系統架構設計，
從安全性角度分析以下面向：
1. 認證與授權機制
2. 資料加密（傳輸中 + 靜態）
3. 網路隔離與防火牆規則
4. 日誌與監控
5. 備份與災難復原

# 在 VS Code 中撰寫註解，讓 Copilot 生成安全程式碼

# TODO: 實作安全的使用者登入 API
# 要求：
# 1. 輸入驗證（email 格式、密碼複雜度）
# 2. 密碼使用 bcrypt 雜湊
# 3. JWT Token 使用 RS256 簽章
# 4. Rate Limiting（每 IP 每分鐘 5 次）
# 5. Audit Log 記錄

from fastapi import FastAPI, HTTPException, Depends, Request
from fastapi.security import HTTPBearer
from pydantic import BaseModel, EmailStr, field_validator
from slowapi import Limiter
from slowapi.util import get_remote_address
import bcrypt
import jwt
import logging
from datetime import datetime, timedelta, timezone

# --- Copilot 生成的安全程式碼 ---

app = FastAPI()
limiter = Limiter(key_func=get_remote_address)
security = HTTPBearer()
audit_logger = logging.getLogger("audit")

# JWT 設定（使用環境變數，不 hardcode）
import os
JWT_PRIVATE_KEY = os.environ["JWT_PRIVATE_KEY"]
JWT_PUBLIC_KEY = os.environ["JWT_PUBLIC_KEY"]
JWT_ALGORITHM = "RS256"
JWT_EXPIRATION_HOURS = 1


class LoginRequest(BaseModel):
    email: EmailStr
    password: str

    @field_validator("password")
    @classmethod
    def validate_password(cls, v: str) -> str:
        if len(v) < 8:
            raise ValueError("密碼長度不足 8 字元")
        if len(v) > 128:
            raise ValueError("密碼長度超過 128 字元")
        return v


class LoginResponse(BaseModel):
    access_token: str
    token_type: str = "bearer"
    expires_in: int


@app.post("/api/v1/auth/login", response_model=LoginResponse)
@limiter.limit("5/minute")
async def login(request: Request, body: LoginRequest):
    """安全登入 API"""
    # 1. 查詢使用者（示意）
    user = await get_user_by_email(body.email)
    if not user:
        # 避免使用者枚舉攻擊：回傳相同錯誤訊息
        raise HTTPException(status_code=401, detail="Invalid credentials")

    # 2. 驗證密碼（使用 bcrypt + constant-time comparison）
    if not bcrypt.checkpw(
        body.password.encode("utf-8"),
        user.password_hash.encode("utf-8")
    ):
        audit_logger.warning(
            f"Failed login attempt for {body.email} "
            f"from {get_remote_address(request)}"
        )
        raise HTTPException(status_code=401, detail="Invalid credentials")

    # 3. 產生 JWT Token
    now = datetime.now(timezone.utc)
    payload = {
        "sub": str(user.id),
        "email": user.email,
        "iat": now,
        "exp": now + timedelta(hours=JWT_EXPIRATION_HOURS),
        "jti": os.urandom(16).hex()  # 防止 Token Replay
    }
    token = jwt.encode(payload, JWT_PRIVATE_KEY, algorithm=JWT_ALGORITHM)

    # 4. Audit Log
    audit_logger.info(
        f"Successful login for {body.email} "
        f"from {get_remote_address(request)}"
    )

    return LoginResponse(
        access_token=token,
        expires_in=JWT_EXPIRATION_HOURS * 3600
    )

# 請 Claude Code 審查目前程式碼的安全性
claude "請掃描 src/ 目錄下的所有 Python 檔案，找出以下安全問題：
1. SQL Injection
2. XSS
3. 硬編碼的密碼/金鑰
4. 不安全的反序列化
5. Path Traversal
6. 不安全的隨機數生成

對每個問題：
- 指出檔案與行號
- 說明風險
- 提供修復建議
- 產出 security-review.md"

# 安裝安全相關 VS Code 擴充套件
code --install-extension SonarSource.sonarlint-vscode    # SonarLint 即時掃描
code --install-extension snyk-security.snyk-vulnerability-scanner  # Snyk 漏洞掃描
code --install-extension redhat.vscode-yaml              # YAML Schema 驗證

# test_login_security.py - AI 自動生成的安全測試

import pytest
from fastapi.testclient import TestClient
from unittest.mock import patch, AsyncMock
from app import app


client = TestClient(app)


class TestLoginSecurity:
    """登入 API 安全測試套件"""

    def test_sql_injection_in_email(self):
        """測試 SQL Injection 防護"""
        malicious_emails = [
            "admin'--@test.com",
            "admin' OR '1'='1@test.com",
            "'; DROP TABLE users;--@test.com"
        ]
        for email in malicious_emails:
            response = client.post("/api/v1/auth/login", json={
                "email": email,
                "password": "ValidP@ss123"
            })
            # 應回傳 422（驗證錯誤）而非 500（伺服器錯誤）
            assert response.status_code in [401, 422], \
                f"潛在 SQL Injection：{email}"

    def test_brute_force_protection(self):
        """測試暴力破解防護（Rate Limiting）"""
        for i in range(6):
            response = client.post("/api/v1/auth/login", json={
                "email": "test@example.com",
                "password": f"wrong_password_{i}"
            })
        # 第 6 次請求應被限速
        assert response.status_code == 429, "Rate Limiting 未生效"

    def test_user_enumeration_prevention(self):
        """測試使用者枚舉防護"""
        # 不存在的使用者
        resp1 = client.post("/api/v1/auth/login", json={
            "email": "nonexist@example.com",
            "password": "ValidP@ss123"
        })
        # 存在但密碼錯誤的使用者
        resp2 = client.post("/api/v1/auth/login", json={
            "email": "admin@example.com",
            "password": "WrongPassword"
        })
        # 錯誤訊息應該相同
        assert resp1.json()["detail"] == resp2.json()["detail"], \
            "不同錯誤情境回傳不同訊息，可能導致使用者枚舉"

    def test_password_not_in_response(self):
        """測試回應中不包含密碼資訊"""
        response = client.post("/api/v1/auth/login", json={
            "email": "admin@example.com",
            "password": "ValidP@ss123"
        })
        response_text = response.text.lower()
        assert "password" not in response_text, "回應中包含密碼相關資訊"

    def test_jwt_token_expiration(self):
        """測試 JWT Token 有效期限"""
        response = client.post("/api/v1/auth/login", json={
            "email": "admin@example.com",
            "password": "ValidP@ss123"
        })
        if response.status_code == 200:
            data = response.json()
            assert data["expires_in"] <= 3600, \
                "Token 有效期不應超過 1 小時"

    def test_xss_in_email_field(self):
        """測試 XSS 防護"""
        xss_payloads = [
            "<script>alert('xss')</script>@test.com",
            "test@<img src=x onerror=alert(1)>.com"
        ]
        for payload in xss_payloads:
            response = client.post("/api/v1/auth/login", json={
                "email": payload,
                "password": "ValidP@ss123"
            })
            assert "<script>" not in response.text, \
                f"潛在 XSS 漏洞：{payload}"

    def test_oversized_password_rejection(self):
        """測試超長密碼防護（防止 DoS）"""
        response = client.post("/api/v1/auth/login", json={
            "email": "test@example.com",
            "password": "a" * 10000  # 超長密碼
        })
        assert response.status_code == 422, "未拒絕超長密碼"

#!/bin/bash
# security_scan.sh - 完整安全掃描流程

set -euo pipefail

echo "=== SSDLC 安全掃描啟動 ==="

# 1. Secret Scanning（Pre-commit 層級）
echo "[1/5] Secret Scanning..."
gitleaks detect --source . --report-format json --report-path reports/secrets.json
if [ $? -ne 0 ]; then
    echo "⛔ 發現機密資訊洩漏！"
    exit 1
fi

# 2. SAST - 靜態分析
echo "[2/5] SAST - Static Analysis..."
semgrep scan --config auto --json --output reports/sast.json .

# 3. SCA - 依賴掃描
echo "[3/5] SCA - Dependency Scanning..."
pip-audit --format json --output reports/sca.json

# 4. Container Scanning（如果有 Dockerfile）
if [ -f Dockerfile ]; then
    echo "[4/5] Container Scanning..."
    trivy image --format json --output reports/container.json \
        $(docker build -q .)
fi

# 5. AI 分析掃描結果
echo "[5/5] AI 分析掃描結果..."
claude "請分析以下安全掃描報告，
產出 prioritized 修復建議：
$(cat reports/sast.json | head -c 5000)
$(cat reports/sca.json | head -c 5000)

請按風險等級排序（Critical > High > Medium > Low），
並為每個 Critical/High 問題提供修復程式碼。"

echo "=== 安全掃描完成 ==="

# security_autofix.py - AutoResearch 安全修補引擎

import json
import subprocess
from pathlib import Path


def auto_fix_security_issues(scan_report: str) -> dict:
    """AutoResearch 自動修補安全問題"""
    issues = json.loads(Path(scan_report).read_text())
    results = {"fixed": [], "skipped": [], "failed": []}

    for issue in sorted(issues, key=lambda x: severity_score(x)):
        if issue["severity"] not in ["CRITICAL", "HIGH"]:
            results["skipped"].append(issue["id"])
            continue

        # 1. 建立修補分支
        branch = f"security-fix/{issue['id']}"
        subprocess.run(["git", "checkout", "-b", branch], check=True)

        try:
            # 2. AI 生成修補程式碼
            fix_prompt = (
                f"修補安全漏洞：{issue['title']}\n"
                f"檔案：{issue['file']}:{issue['line']}\n"
                f"類型：{issue['category']}\n"
                f"說明：{issue['description']}\n"
                f"請只修改必要的程式碼，不要改變功能行為。"
            )
            subprocess.run(
                ["claude", "--print", fix_prompt],
                check=True, timeout=60
            )

            # 3. 執行測試驗證
            test_result = subprocess.run(
                ["pytest", "--tb=short", "-q"],
                capture_output=True, text=True, timeout=120
            )

            if test_result.returncode == 0:
                # 4. 驗證安全問題已修復
                rescan = subprocess.run(
                    ["semgrep", "scan", "--config", "auto",
                     "--json", issue["file"]],
                    capture_output=True, text=True
                )
                rescan_issues = json.loads(rescan.stdout)

                if not any(i["id"] == issue["id"] for i in rescan_issues.get("results", [])):
                    subprocess.run(["git", "add", "-A"], check=True)
                    subprocess.run(
                        ["git", "commit", "-m",
                         f"fix(security): {issue['title']} [{issue['id']}]"],
                        check=True
                    )
                    results["fixed"].append(issue["id"])
                else:
                    raise RuntimeError("修補後問題仍存在")
            else:
                raise RuntimeError(f"測試失敗：{test_result.stderr[:200]}")

        except Exception as e:
            subprocess.run(["git", "checkout", "--", "."])
            results["failed"].append({"id": issue["id"], "error": str(e)})

        finally:
            subprocess.run(["git", "checkout", "main"], check=True)

    return results


def severity_score(issue: dict) -> int:
    """安全嚴重度排序分數"""
    scores = {"CRITICAL": 0, "HIGH": 1, "MEDIUM": 2, "LOW": 3}
    return scores.get(issue.get("severity", "LOW"), 4)

# deploy_decision.py - AI 部署策略決策

import os
import subprocess
import json
from typing import Literal


DeployStrategy = Literal["rolling", "canary", "blue-green"]


def assess_change_risk(changed_files: list[str]) -> DeployStrategy:
    """根據變更檔案評估部署風險並選擇策略"""
    high_risk_patterns = [
        "auth", "payment", "database", "migration",
        "security", "encryption", "core"
    ]
    medium_risk_patterns = [
        "api", "service", "controller", "model"
    ]

    risk_score = 0
    for f in changed_files:
        f_lower = f.lower()
        if any(p in f_lower for p in high_risk_patterns):
            risk_score += 3
        elif any(p in f_lower for p in medium_risk_patterns):
            risk_score += 1

    if risk_score >= 5:
        return "blue-green"
    elif risk_score >= 2:
        return "canary"
    else:
        return "rolling"


def get_changed_files() -> list[str]:
    """取得自上次部署以來的變更檔案"""
    result = subprocess.run(
        ["git", "diff", "--name-only", "HEAD~1"],
        capture_output=True, text=True, check=True
    )
    return result.stdout.strip().split("\n")


if __name__ == "__main__":
    files = get_changed_files()
    strategy = assess_change_risk(files)
    print(f"建議部署策略：{strategy}")
    print(f"變更檔案數：{len(files)}")

    # 輸出給 CI/CD 使用
    if os.environ.get("GITHUB_OUTPUT"):
        with open(os.environ["GITHUB_OUTPUT"], "a") as f:
            f.write(f"deploy_strategy={strategy}\n")

# anomaly_detector.py - AI 驅動的異常偵測

import json
from dataclasses import dataclass
from typing import Optional


@dataclass
class AnomalyAlert:
    """異常告警"""
    metric_name: str
    current_value: float
    expected_range: tuple[float, float]
    severity: str
    root_cause_hypothesis: str
    suggested_action: str


def detect_anomalies(metrics: dict[str, float]) -> list[AnomalyAlert]:
    """偵測系統指標異常"""
    alerts = []
    thresholds = {
        "api_latency_p99_ms": (0, 500),
        "error_rate_percent": (0, 1.0),
        "cpu_usage_percent": (0, 80),
        "memory_usage_percent": (0, 85),
        "request_rate_per_sec": (10, 10000),
    }

    for metric, (low, high) in thresholds.items():
        value = metrics.get(metric)
        if value is None:
            continue

        if value < low or value > high:
            severity = "CRITICAL" if value > high * 1.5 else "WARNING"
            alerts.append(AnomalyAlert(
                metric_name=metric,
                current_value=value,
                expected_range=(low, high),
                severity=severity,
                root_cause_hypothesis=analyze_root_cause(metric, value),
                suggested_action=suggest_action(metric, value, severity)
            ))

    return alerts


def analyze_root_cause(metric: str, value: float) -> str:
    """根因分析（簡化版本，實際可呼叫 LLM）"""
    causes = {
        "api_latency_p99_ms": "可能原因：資料庫查詢變慢、外部 API 超時、記憶體不足",
        "error_rate_percent": "可能原因：上游服務異常、輸入驗證失敗、部署問題",
        "cpu_usage_percent": "可能原因：無限迴圈、密集運算、並發過高",
        "memory_usage_percent": "可能原因：記憶體洩漏、快取未清理、大物件未釋放",
    }
    return causes.get(metric, "需進一步分析")


def suggest_action(metric: str, value: float, severity: str) -> str:
    """建議回應動作"""
    if severity == "CRITICAL":
        return "觸發 AutoResearch 自動修補 + 通知 On-Call 工程師"
    return "記錄異常 + 排入下次 AutoResearch 優化週期"

# Before（AutoResearch 偵測到效能問題）
def get_user_orders(user_id: int) -> list[dict]:
    """取得使用者訂單 - 效能瓶頸"""
    orders = db.query("SELECT * FROM orders WHERE user_id = %s", (user_id,))
    result = []
    for order in orders:
        # N+1 Query 問題
        items = db.query(
            "SELECT * FROM order_items WHERE order_id = %s",
            (order["id"],)
        )
        order["items"] = items
        result.append(order)
    return result


# After（AutoResearch 自動修復 N+1 Query）
def get_user_orders(user_id: int) -> list[dict]:
    """取得使用者訂單 - 已優化"""
    orders = db.query(
        """
        SELECT o.*, json_agg(oi.*) as items
        FROM orders o
        LEFT JOIN order_items oi ON o.id = oi.order_id
        WHERE o.user_id = %s
        GROUP BY o.id
        """,
        (user_id,)
    )
    return orders

# Before（O(n²) 複雜度）
def find_duplicates(items: list[str]) -> list[str]:
    duplicates = []
    for i in range(len(items)):
        for j in range(i + 1, len(items)):
            if items[i] == items[j] and items[i] not in duplicates:
                duplicates.append(items[i])
    return duplicates


# After（AutoResearch 優化為 O(n)）
def find_duplicates(items: list[str]) -> list[str]:
    seen: set[str] = set()
    duplicates: set[str] = set()
    for item in items:
        if item in seen:
            duplicates.add(item)
        seen.add(item)
    return list(duplicates)

# Before（SQL Injection 風險）
def search_products(query: str) -> list[dict]:
    sql = f"SELECT * FROM products WHERE name LIKE '%{query}%'"
    return db.execute(sql)


# After（AutoResearch 自動修補）
def search_products(query: str) -> list[dict]:
    sql = "SELECT * FROM products WHERE name LIKE %s"
    return db.execute(sql, (f"%{query}%",))

# evaluator.py - 多維度評估引擎

from dataclasses import dataclass
from typing import Optional


@dataclass
class EvaluationResult:
    """評估結果"""
    overall_decision: str  # "KEEP" or "REVERT"
    performance_delta: float  # 效能變化百分比
    security_score_delta: float  # 安全分數變化
    test_pass_rate: float  # 測試通過率
    code_quality_delta: float  # 程式碼品質變化
    reasons: list[str]


def evaluate(
    perf_before: float,
    perf_after: float,
    security_before: float,
    security_after: float,
    tests_passed: int,
    tests_total: int,
    quality_before: float,
    quality_after: float
) -> EvaluationResult:
    """多維度評估決策"""
    reasons = []
    veto = False  # 一票否決

    # 1. 測試通過率（硬性要求）
    test_rate = tests_passed / tests_total if tests_total > 0 else 0
    if test_rate < 1.0:
        veto = True
        reasons.append(f"⛔ 測試通過率不足：{test_rate:.0%}")

    # 2. 安全分數（不可降低）
    security_delta = security_after - security_before
    if security_delta < 0:
        veto = True
        reasons.append(f"⛔ 安全分數下降：{security_delta:+.2f}")
    elif security_delta > 0:
        reasons.append(f"✅ 安全分數提升：{security_delta:+.2f}")

    # 3. 效能指標
    perf_delta = ((perf_after - perf_before) / perf_before * 100
                  if perf_before > 0 else 0)
    if perf_delta > 5:
        reasons.append(f"✅ 效能提升：{perf_delta:+.1f}%")
    elif perf_delta < -10:
        reasons.append(f"⚠️ 效能下降：{perf_delta:+.1f}%")

    # 4. 程式碼品質
    quality_delta = quality_after - quality_before
    if quality_delta > 0:
        reasons.append(f"✅ 品質提升：{quality_delta:+.2f}")

    # 最終決策
    decision = "REVERT" if veto else "KEEP"

    return EvaluationResult(
        overall_decision=decision,
        performance_delta=perf_delta,
        security_score_delta=security_delta,
        test_pass_rate=test_rate,
        code_quality_delta=quality_delta,
        reasons=reasons
    )

# program.md - Code Quality 優化策略

## 目標
提升程式碼品質分數（使用 pylint / radon 量測）

## 策略
1. 降低圈複雜度（Cyclomatic Complexity）至 10 以下
2. 消除重複程式碼（DRY 原則）
3. 改善命名一致性
4. 拆分過長函式（> 50 行）

## 評估指標
METRIC:quality_score=<pylint 分數>
METRIC:complexity=<平均圈複雜度>

## 約束
- 不可改變程式行為（所有測試必須通過）
- 不可引入新的依賴

# program.md - Performance 優化策略

## 目標
降低 API P99 延遲至 200ms 以下

## 策略
1. 識別 N+1 Query 並修復
2. 加入適當的快取層
3. 優化資料結構與演算法
4. 減少不必要的 I/O 操作

## 評估指標
METRIC:p99_latency_ms=<P99 延遲毫秒>
METRIC:throughput_rps=<每秒請求數>

## 約束
- 記憶體使用不可增加超過 20%
- 不可犧牲程式碼可讀性

# program.md - Security 強化策略

## 目標
消除所有 Critical 和 High 安全漏洞

## 策略
1. 修補 SAST 掃描出的漏洞
2. 升級有已知 CVE 的依賴
3. 強化輸入驗證
4. 改善錯誤處理（避免資訊洩漏）

## 評估指標
METRIC:critical_vulns=<Critical 漏洞數>
METRIC:high_vulns=<High 漏洞數>
METRIC:security_score=<安全評分>

## 約束
- 不可降低測試覆蓋率
- 不可影響既有功能
- 依賴升級需保持向後相容

# .github/workflows/ssdlc-pipeline.yml
name: SSDLC Pipeline with AutoResearch

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]
  schedule:
    # 每日凌晨 2 點執行 AutoResearch 優化
    - cron: '0 2 * * *'

permissions:
  contents: write
  pull-requests: write
  security-events: write

env:
  PYTHON_VERSION: '3.12'
  AUTORESEARCH_TIME_BUDGET: 300

jobs:
  # === 階段 1：建置與測試 ===
  build-and-test:
    name: Build & Test
    runs-on: ubuntu-latest
    outputs:
      test_coverage: ${{ steps.coverage.outputs.coverage }}
    steps:
      - uses: actions/checkout@v4

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install uv
        uses: astral-sh/setup-uv@v4

      - name: Install Dependencies
        run: |
          uv sync
          uv pip install -r requirements-dev.txt

      - name: Run Linting
        run: |
          ruff check .
          black --check .

      - name: Run Unit Tests
        run: |
          pytest tests/ \
            --cov=src \
            --cov-report=xml:coverage.xml \
            --cov-report=term-missing \
            --junitxml=test-results.xml \
            -v

      - name: Extract Coverage
        id: coverage
        run: |
          COVERAGE=$(python -c "
          import xml.etree.ElementTree as ET
          tree = ET.parse('coverage.xml')
          root = tree.getroot()
          print(f'{float(root.attrib[\"line-rate\"]) * 100:.1f}')
          ")
          echo "coverage=$COVERAGE" >> $GITHUB_OUTPUT

      - name: Upload Test Results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: test-results
          path: |
            coverage.xml
            test-results.xml

  # === 階段 2：安全掃描 ===
  security-scan:
    name: Security Scanning
    runs-on: ubuntu-latest
    needs: build-and-test
    outputs:
      critical_count: ${{ steps.scan_results.outputs.critical }}
      high_count: ${{ steps.scan_results.outputs.high }}
    steps:
      - uses: actions/checkout@v4

      - name: Secret Scanning
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: SAST - Semgrep
        uses: semgrep/semgrep-action@v1
        with:
          config: >-
            p/security-audit
            p/owasp-top-ten
            p/python
          generateSarif: true

      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: semgrep.sarif

      - name: SCA - Dependency Check
        run: |
          pip install pip-audit safety
          pip-audit --format json --output sca-report.json || true
          safety check --json --output safety-report.json || true

      - name: Container Scanning
        if: hashFiles('Dockerfile') != ''
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          format: 'json'
          output: 'trivy-report.json'
          severity: 'CRITICAL,HIGH'

      - name: Aggregate Scan Results
        id: scan_results
        run: |
          python scripts/aggregate_security.py \
            --sast semgrep.sarif \
            --sca sca-report.json \
            --output security-summary.json
          CRITICAL=$(jq '.critical_count' security-summary.json)
          HIGH=$(jq '.high_count' security-summary.json)
          echo "critical=$CRITICAL" >> $GITHUB_OUTPUT
          echo "high=$HIGH" >> $GITHUB_OUTPUT

      - name: Upload Security Reports
        uses: actions/upload-artifact@v4
        with:
          name: security-reports
          path: |
            semgrep.sarif
            sca-report.json
            security-summary.json

  # === 階段 3：安全閘門 ===
  security-gate:
    name: Security Gate
    runs-on: ubuntu-latest
    needs: security-scan
    steps:
      - name: Check Security Gate
        run: |
          CRITICAL=${{ needs.security-scan.outputs.critical_count }}
          HIGH=${{ needs.security-scan.outputs.high_count }}

          echo "Critical: $CRITICAL | High: $HIGH"

          if [ "$CRITICAL" -gt 0 ]; then
            echo "⛔ Security Gate FAILED: $CRITICAL critical vulnerabilities"
            exit 1
          fi

          if [ "$HIGH" -gt 5 ]; then
            echo "⚠️ Security Gate WARNING: $HIGH high vulnerabilities"
            exit 1
          fi

          echo "✅ Security Gate PASSED"

  # === 階段 4：AutoResearch 優化（排程觸發） ===
  autoresearch-optimize:
    name: AutoResearch Optimization
    runs-on: ubuntu-latest
    if: github.event_name == 'schedule'
    needs: [build-and-test, security-scan]
    steps:
      - uses: actions/checkout@v4
        with:
          token: ${{ secrets.AUTORESEARCH_PAT }}

      - name: Install uv
        uses: astral-sh/setup-uv@v4

      - name: Setup Environment
        run: |
          uv sync
          uv pip install -r requirements-dev.txt

      - name: Download Security Reports
        uses: actions/download-artifact@v4
        with:
          name: security-reports
          path: reports/

      - name: Run AutoResearch
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          AUTORESEARCH_TIME_BUDGET: ${{ env.AUTORESEARCH_TIME_BUDGET }}
        run: |
          python autoresearch_engine.py \
            --program program.md \
            --target src/ \
            --time-budget $AUTORESEARCH_TIME_BUDGET \
            --output-report reports/optimization.json

      - name: Create Pull Request
        if: success()
        uses: peter-evans/create-pull-request@v6
        with:
          token: ${{ secrets.AUTORESEARCH_PAT }}
          commit-message: "chore(autoresearch): automated optimization"
          title: "🤖 AutoResearch: 自動優化建議"
          body: |
            ## AutoResearch 自動優化報告

            **執行時間**：${{ env.AUTORESEARCH_TIME_BUDGET }} 秒
            **觸發方式**：排程（每日凌晨 2 點）

            ### 變更摘要
            請查看 commit history 了解詳細變更。

            ### 驗證狀態
            - ✅ 所有測試通過
            - ✅ 安全掃描通過
            - 📊 效能指標見報告

            > ⚠️ 此 PR 由 AI 自動生成，請人工審核後再合併。
          branch: autoresearch/optimization
          labels: |
            autoresearch
            automated

  # === 階段 5：AutoResearch 安全修補（安全閘門失敗時觸發） ===
  autoresearch-security-fix:
    name: AutoResearch Security Fix
    runs-on: ubuntu-latest
    needs: security-gate
    if: failure()
    steps:
      - uses: actions/checkout@v4
        with:
          token: ${{ secrets.AUTORESEARCH_PAT }}

      - name: Install uv
        uses: astral-sh/setup-uv@v4

      - name: Setup Environment
        run: uv sync

      - name: Download Security Reports
        uses: actions/download-artifact@v4
        with:
          name: security-reports

      - name: Run AutoResearch Security Fix
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |
          python security_autofix.py \
            --scan-report security-summary.json \
            --severity CRITICAL,HIGH \
            --output-report security-fix-report.json

      - name: Create Security Fix PR
        uses: peter-evans/create-pull-request@v6
        with:
          token: ${{ secrets.AUTORESEARCH_PAT }}
          commit-message: "fix(security): automated vulnerability fix"
          title: "🔒 AutoResearch: 安全漏洞自動修補"
          body: |
            ## 安全漏洞自動修補報告

            安全閘門偵測到 Critical/High 漏洞，AutoResearch 已自動修補。

            > ⚠️ 安全修補必須由安全工程師審核後再合併。
          branch: autoresearch/security-fix
          labels: |
            security
            autoresearch
            urgent

  # === 階段 6：部署 ===
  deploy-staging:
    name: Deploy to Staging
    runs-on: ubuntu-latest
    needs: security-gate
    if: github.ref == 'refs/heads/main'
    environment: staging
    steps:
      - uses: actions/checkout@v4

      - name: Assess Deployment Risk
        id: risk
        run: |
          python deploy_decision.py
          echo "strategy=$(cat deploy-strategy.txt)" >> $GITHUB_OUTPUT

      - name: Deploy
        run: |
          echo "Deploying with strategy: ${{ steps.risk.outputs.strategy }}"
          # 實際部署指令依據策略不同而異

# .github/workflows/autoresearch-manual.yml
name: AutoResearch Manual Trigger

on:
  workflow_dispatch:
    inputs:
      optimization_target:
        description: '優化目標'
        required: true
        type: choice
        options:
          - performance
          - security
          - quality
      time_budget:
        description: '時間預算（秒）'
        required: true
        default: '300'
      target_path:
        description: '目標路徑'
        required: true
        default: 'src/'

jobs:
  autoresearch:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run AutoResearch
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |
          python autoresearch_engine.py \
            --program "programs/${{ inputs.optimization_target }}.md" \
            --target "${{ inputs.target_path }}" \
            --time-budget ${{ inputs.time_budget }}

# scripts/aggregate_security.py
"""彙總多個安全掃描工具的結果"""

import json
import argparse
from pathlib import Path


def aggregate(sast_path: str, sca_path: str, output_path: str):
    """彙總安全掃描結果"""
    summary = {
        "critical_count": 0,
        "high_count": 0,
        "medium_count": 0,
        "low_count": 0,
        "issues": []
    }

    # 解析 SARIF（SAST）
    if Path(sast_path).exists():
        sarif = json.loads(Path(sast_path).read_text())
        for run in sarif.get("runs", []):
            for result in run.get("results", []):
                severity = map_sarif_severity(
                    result.get("level", "note")
                )
                summary[f"{severity.lower()}_count"] += 1
                summary["issues"].append({
                    "source": "SAST",
                    "severity": severity,
                    "rule": result.get("ruleId", ""),
                    "message": result.get("message", {}).get("text", ""),
                    "file": get_sarif_location(result)
                })

    # 解析 SCA
    if Path(sca_path).exists():
        sca = json.loads(Path(sca_path).read_text())
        for vuln in sca.get("vulnerabilities", []):
            severity = vuln.get("severity", "LOW").upper()
            summary[f"{severity.lower()}_count"] += 1
            summary["issues"].append({
                "source": "SCA",
                "severity": severity,
                "package": vuln.get("package", ""),
                "version": vuln.get("version", ""),
                "cve": vuln.get("cve", ""),
                "fix_version": vuln.get("fix_version", "")
            })

    # 排序：Critical > High > Medium > Low
    severity_order = {"CRITICAL": 0, "HIGH": 1, "MEDIUM": 2, "LOW": 3}
    summary["issues"].sort(
        key=lambda x: severity_order.get(x["severity"], 4)
    )

    Path(output_path).write_text(json.dumps(summary, indent=2))
    print(f"Security Summary: "
          f"C={summary['critical_count']} "
          f"H={summary['high_count']} "
          f"M={summary['medium_count']} "
          f"L={summary['low_count']}")


def map_sarif_severity(level: str) -> str:
    """SARIF severity 映射"""
    mapping = {
        "error": "HIGH",
        "warning": "MEDIUM",
        "note": "LOW"
    }
    return mapping.get(level, "LOW")


def get_sarif_location(result: dict) -> str:
    """從 SARIF 結果中提取檔案位置"""
    locations = result.get("locations", [])
    if locations:
        physical = locations[0].get("physicalLocation", {})
        artifact = physical.get("artifactLocation", {})
        region = physical.get("region", {})
        return f"{artifact.get('uri', '')}:{region.get('startLine', '')}"
    return ""


if __name__ == "__main__":
    parser = argparse.ArgumentParser()
    parser.add_argument("--sast", required=True)
    parser.add_argument("--sca", required=True)
    parser.add_argument("--output", required=True)
    args = parser.parse_args()
    aggregate(args.sast, args.sca, args.output)

# Performance Optimization: Order API

## 目標
降低 GET /api/v1/orders P99 延遲至 200ms 以下

## 目前狀態
- P99 延遲：2000ms
- 平均延遲：800ms
- 吞吐量：50 RPS

## 可修改檔案
- src/api/orders.py
- src/services/order_service.py
- src/repositories/order_repository.py

## 策略
1. 修復 N+1 Query（使用 JOIN 或 eager loading）
2. 加入 Redis 快取（TTL: 60 秒）
3. 使用更高效的序列化方式
4. 加入資料庫索引建議

## 評估指標
METRIC:p99_latency_ms=<p99 延遲>
METRIC:avg_latency_ms=<平均延遲>
METRIC:throughput_rps=<每秒請求數>

# Before - 迭代 1：N+1 Query 問題
class OrderRepository:
    def get_user_orders(self, user_id: int) -> list[dict]:
        orders = self.db.query(
            "SELECT * FROM orders WHERE user_id = %s", (user_id,)
        )
        for order in orders:
            # N+1 Query！每筆訂單都查詢一次
            items = self.db.query(
                "SELECT * FROM order_items WHERE order_id = %s",
                (order["id"],)
            )
            order["items"] = items
        return orders


# After - AutoResearch 修復
class OrderRepository:
    def get_user_orders(self, user_id: int) -> list[dict]:
        """取得使用者訂單（已優化：使用 JOIN 消除 N+1）"""
        query = """
            SELECT
                o.id, o.status, o.created_at, o.total_amount,
                json_agg(
                    json_build_object(
                        'item_id', oi.id,
                        'product_name', oi.product_name,
                        'quantity', oi.quantity,
                        'price', oi.price
                    )
                ) FILTER (WHERE oi.id IS NOT NULL) as items
            FROM orders o
            LEFT JOIN order_items oi ON o.id = oi.order_id
            WHERE o.user_id = %s
            GROUP BY o.id
            ORDER BY o.created_at DESC
        """
        return self.db.query(query, (user_id,))

# After - 迭代 2：加入 Redis 快取
import hashlib
import json
from functools import wraps

import redis

cache = redis.Redis(host="localhost", port=6379, db=0)


def cached(ttl_seconds: int = 60):
    """Redis 快取裝飾器"""
    def decorator(func):
        @wraps(func)
        def wrapper(*args, **kwargs):
            # 生成快取 key
            key_data = f"{func.__name__}:{args}:{kwargs}"
            cache_key = hashlib.sha256(key_data.encode()).hexdigest()

            # 嘗試讀取快取
            cached_result = cache.get(cache_key)
            if cached_result:
                return json.loads(cached_result)

            # 執行原函式
            result = func(*args, **kwargs)

            # 寫入快取
            cache.setex(cache_key, ttl_seconds, json.dumps(result, default=str))

            return result
        return wrapper
    return decorator


class OrderService:
    @cached(ttl_seconds=60)
    def get_user_orders(self, user_id: int) -> list[dict]:
        return self.repository.get_user_orders(user_id)

╔═══════════════════════════════════════════════╗
║     AutoResearch Performance Report           ║
╠═══════════════════════════════════════════════╣
║ Target:    GET /api/v1/orders                 ║
║ Duration:  237 seconds (5 iterations)         ║
║                                               ║
║ ┌─────────────┬──────────┬──────────┐         ║
║ │ Metric      │  Before  │  After   │         ║
║ ├─────────────┼──────────┼──────────┤         ║
║ │ P99 Latency │ 2000ms   │ 150ms ↓ │         ║
║ │ Avg Latency │  800ms   │  45ms ↓ │         ║
║ │ Throughput  │  50 RPS  │ 500 RPS ↑│        ║
║ │ Error Rate  │  0.5%    │ 0.1%  ↓ │         ║
║ └─────────────┴──────────┴──────────┘         ║
║                                               ║
║ Changes: 3 KEEP / 1 REVERT                   ║
║ Tests:   48/48 passed ✅                      ║
║ Security: No new vulnerabilities ✅           ║
╚═══════════════════════════════════════════════╝

# Before（CVE-2024-XXXX：SQL Injection）
@app.get("/api/v1/products/search")
async def search_products(q: str):
    # ⛔ 直接拼接 SQL，存在 SQL Injection
    query = f"SELECT * FROM products WHERE name LIKE '%{q}%'"
    results = db.execute(query)
    return {"products": results}


# After（AutoResearch 自動修補）
@app.get("/api/v1/products/search")
async def search_products(q: str = Query(max_length=100)):
    # ✅ 使用參數化查詢
    query = "SELECT * FROM products WHERE name LIKE %s"
    results = db.execute(query, (f"%{q}%",))
    return {"products": results}

# Before（Hardcoded API Key）
# ⛔ API Key 直接寫在程式碼中
API_KEY = "sk-prod-a1b2c3d4e5f6"
STRIPE_SECRET = "sk_live_xxxxx"


# After（AutoResearch 自動修補）
import os

# ✅ 從環境變數讀取
API_KEY = os.environ["API_KEY"]
STRIPE_SECRET = os.environ["STRIPE_SECRET"]

# Before（Insecure Deserialization）
import pickle

def load_session(session_data: bytes):
    # ⛔ pickle.loads 可執行任意程式碼
    return pickle.loads(session_data)


# After（AutoResearch 自動修補）
import json
import base64

def load_session(session_data: str) -> dict:
    # ✅ 使用安全的 JSON 反序列化
    try:
        decoded = base64.b64decode(session_data)
        return json.loads(decoded)
    except (json.JSONDecodeError, base64.binascii.Error):
        return {}

{
  "timestamp": "2026-04-14T02:15:30.000Z",
  "level": "INFO",
  "component": "autoresearch",
  "event": "iteration_complete",
  "iteration": 3,
  "action": "KEEP",
  "metrics": {
    "before": {"val_accuracy": 0.8750},
    "after": {"val_accuracy": 0.8820}
  },
  "duration_seconds": 45.2,
  "git_commit": "a1b2c3d",
  "change_description": "增加 BatchNorm 層並調整 learning rate"
}

# kibana/autoresearch-dashboard.ndjson（關鍵欄位）
panels:
  - title: "AutoResearch 迭代成功率"
    type: "metric"
    query: "component:autoresearch AND event:iteration_complete"
    aggregation: "terms:action"

  - title: "指標趨勢"
    type: "line"
    query: "component:autoresearch"
    y_axis: "metrics.after.val_accuracy"
    x_axis: "@timestamp"

  - title: "每日安全修補數"
    type: "bar"
    query: "component:autoresearch AND event:security_fix"
    aggregation: "date_histogram:@timestamp"

# drift_detector.py - 模型 Drift 偵測

import json
from pathlib import Path
from datetime import datetime, timedelta, timezone


def detect_drift(
    history_file: str = "autoresearch_history.json",
    window_days: int = 7
) -> dict:
    """偵測 AutoResearch 效能 drift"""
    history = json.loads(Path(history_file).read_text())

    now = datetime.now(timezone.utc)
    recent = [
        h for h in history
        if datetime.fromisoformat(h["timestamp"]) > now - timedelta(days=window_days)
    ]
    older = [
        h for h in history
        if datetime.fromisoformat(h["timestamp"]) <= now - timedelta(days=window_days)
    ]

    if not recent or not older:
        return {"drift_detected": False, "reason": "資料不足"}

    # 計算 KEEP 率
    recent_keep_rate = sum(1 for h in recent if h["action"] == "KEEP") / len(recent)
    older_keep_rate = sum(1 for h in older if h["action"] == "KEEP") / len(older)

    # 計算平均改善幅度
    recent_improvement = avg_improvement(recent)
    older_improvement = avg_improvement(older)

    drift_detected = (
        recent_keep_rate < older_keep_rate * 0.7 or  # KEEP 率下降超過 30%
        recent_improvement < older_improvement * 0.5   # 改善幅度下降超過 50%
    )

    return {
        "drift_detected": drift_detected,
        "recent_keep_rate": recent_keep_rate,
        "older_keep_rate": older_keep_rate,
        "recent_avg_improvement": recent_improvement,
        "older_avg_improvement": older_improvement,
        "recommendation": (
            "建議更新 program.md 策略或檢查 LLM API 版本"
            if drift_detected else "正常"
        )
    }


def avg_improvement(records: list[dict]) -> float:
    """計算平均改善幅度"""
    improvements = []
    for r in records:
        if r["action"] == "KEEP":
            before = r["metrics"]["before"].get("primary", 0)
            after = r["metrics"]["after"].get("primary", 0)
            if before > 0:
                improvements.append((after - before) / before)
    return sum(improvements) / len(improvements) if improvements else 0

# AutoResearch 產出的版本標籤格式
# v{版本}-ar{迭代次數}
git tag -a "v1.2.1-ar5" -m "AutoResearch: 5 次迭代優化"

#!/bin/bash
# rollback.sh - AutoResearch 變更回滾腳本

set -euo pipefail

COMPONENT=${1:-"all"}  # 回滾目標：all / specific-commit

echo "=== AutoResearch Rollback ==="

# 找到最近的 AutoResearch commit
AR_COMMITS=$(git log --oneline --grep="AutoResearch" -5)
echo "最近 AutoResearch commits："
echo "$AR_COMMITS"

if [ "$COMPONENT" == "all" ]; then
    # 回滾所有 AutoResearch 變更
    LAST_SAFE=$(git log --oneline --grep="AutoResearch" --invert-grep -1 | cut -d' ' -f1)
    echo "回滾至安全版本：$LAST_SAFE"
    git revert --no-commit HEAD..$LAST_SAFE
    git commit -m "rollback: 回滾所有 AutoResearch 變更"
else
    # 回滾特定 commit
    echo "回滾 commit：$COMPONENT"
    git revert --no-edit "$COMPONENT"
fi

# 驗證
echo "執行測試驗證..."
pytest tests/ -q
echo "=== 回滾完成 ==="

# config/agents.yaml - 多 Agent 設定
orchestrator:
  max_concurrent_agents: 4
  conflict_resolution: "priority-based"  # priority-based / lock-based / queue-based
  shared_lock:
    type: redis
    host: localhost
    port: 6379

agents:
  - name: performance-agent
    priority: 2
    program: programs/performance.md
    target_paths:
      - src/api/
      - src/services/
    schedule: "0 2 * * 1,3,5"  # 週一三五
    time_budget: 300

  - name: security-agent
    priority: 1  # 最高優先
    program: programs/security.md
    target_paths:
      - src/
    schedule: "0 2 * * 2,4"  # 週二四
    time_budget: 600
    triggers:
      - security_gate_failure

  - name: quality-agent
    priority: 3
    program: programs/quality.md
    target_paths:
      - src/
      - tests/
    schedule: "0 3 * * 6"  # 週六
    time_budget: 300

  - name: test-agent
    priority: 2
    program: programs/testing.md
    target_paths:
      - tests/
    schedule: "0 3 * * 0"  # 週日
    time_budget: 300

# conflict_resolver.py - 多 Agent 衝突解決

import redis
from contextlib import contextmanager
from typing import Generator


class ConflictResolver:
    """多 Agent 衝突解決器"""

    def __init__(self, redis_url: str = "redis://localhost:6379"):
        self.redis = redis.from_url(redis_url)

    @contextmanager
    def acquire_file_lock(
        self, file_path: str, agent_name: str, timeout: int = 60
    ) -> Generator[bool, None, None]:
        """取得檔案級別的分散式鎖"""
        lock_key = f"autoresearch:lock:{file_path}"
        lock = self.redis.lock(lock_key, timeout=timeout)

        acquired = lock.acquire(blocking=True, blocking_timeout=10)
        try:
            if acquired:
                self.redis.set(
                    f"autoresearch:owner:{file_path}",
                    agent_name,
                    ex=timeout
                )
            yield acquired
        finally:
            if acquired:
                lock.release()
                self.redis.delete(f"autoresearch:owner:{file_path}")

    def check_conflict(
        self, agent_name: str, files_to_modify: list[str]
    ) -> dict:
        """檢查是否與其他 Agent 衝突"""
        conflicts = {}
        for f in files_to_modify:
            owner = self.redis.get(f"autoresearch:owner:{f}")
            if owner and owner.decode() != agent_name:
                conflicts[f] = owner.decode()
        return conflicts

# config/distributed.yaml
regions:
  - name: asia-east
    endpoint: https://ar-asia.company.internal
    llm_provider: anthropic
    llm_region: asia-southeast-1
    capabilities:
      - performance
      - quality

  - name: us-west
    endpoint: https://ar-us.company.internal
    llm_provider: anthropic
    llm_region: us-west-2
    capabilities:
      - security
      - testing

routing:
  strategy: capability-based  # 根據能力路由
  fallback: round-robin

sync:
  method: git  # 透過 Git 同步結果
  conflict_resolution: last-writer-wins
  merge_strategy: rebase

# k8s/autoresearch-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: autoresearch-agent
  labels:
    app: autoresearch
spec:
  replicas: 3
  selector:
    matchLabels:
      app: autoresearch
  template:
    metadata:
      labels:
        app: autoresearch
    spec:
      containers:
        - name: autoresearch
          image: company-registry/autoresearch:latest
          resources:
            requests:
              cpu: "2"
              memory: "8Gi"
            limits:
              cpu: "4"
              memory: "16Gi"
          env:
            - name: ANTHROPIC_API_KEY
              valueFrom:
                secretKeyRef:
                  name: autoresearch-secrets
                  key: anthropic-api-key
            - name: AUTORESEARCH_TIME_BUDGET
              value: "300"
          volumeMounts:
            - name: workspace
              mountPath: /workspace
            - name: programs
              mountPath: /programs
      volumes:
        - name: workspace
          persistentVolumeClaim:
            claimName: autoresearch-workspace
        - name: programs
          configMap:
            name: autoresearch-programs
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: autoresearch-programs
data:
  performance.md: |
    # Performance Optimization Program
    ## 目標
    降低 API P99 延遲
    ...
  security.md: |
    # Security Hardening Program
    ## 目標
    消除所有 Critical 漏洞
    ...

# k8s/autoresearch-hpa.yaml
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: autoresearch-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: autoresearch-agent
  minReplicas: 1
  maxReplicas: 10
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70
    - type: Pods
      pods:
        metric:
          name: autoresearch_queue_depth
        target:
          type: AverageValue
          averageValue: "5"

# SSDLC Project Rules

## Security（安全）
- 所有 SQL 查詢必須使用參數化查詢，禁止字串拼接
- 密碼儲存必須使用 bcrypt 或 Argon2，禁止 MD5/SHA1
- API Key 不得出現在程式碼中，必須使用環境變數
- 禁止使用 eval()、exec()、pickle.loads() 等危險函式

## Testing（測試）
- 每個 API endpoint 必須有對應的安全測試
- 跑測試指令：pytest tests/ --cov=src --cov-fail-under=80
- 型態檢查指令：mypy src/ --strict

## Code Style（程式碼風格）
- 使用 ruff 進行 linting：ruff check .
- 使用 black 進行格式化：black .

## Git Workflow
- Commit message 遵循 Conventional Commits
- Branch naming: feature/*, fix/*, autoresearch/*

See @README.md for project overview and @package.json for available commands.

# Additional Instructions
- Git workflow: @docs/git-instructions.md
- Personal overrides: @~/.claude/my-project-instructions.md

# .claude/skills/security-scan/SKILL.md
---
name: security-scan
description: Run comprehensive security scanning on the codebase
---
# Security Scanning Workflow

1. Run `semgrep scan --config auto --json` for SAST
2. Run `pip-audit --format json` for dependency scanning
3. Run `gitleaks detect --source .` for secret scanning
4. Aggregate results and prioritize by severity
5. For CRITICAL issues, generate fix suggestions
6. Output report to `reports/security-scan.md`

# .claude/skills/fix-issue/SKILL.md
---
name: fix-issue
description: Fix a GitHub issue end-to-end
disable-model-invocation: true
---
Analyze and fix the GitHub issue: $ARGUMENTS.

1. Use `gh issue view` to get the issue details
2. Understand the problem described in the issue
3. Search the codebase for relevant files
4. Implement the necessary changes
5. Write and run tests to verify the fix
6. Ensure code passes linting and type checking
7. Create a descriptive commit message
8. Push and create a PR

// .claude/settings.json
{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Write|Edit",
        "hooks": [
          {
            "type": "command",
            "command": "ruff check --fix $CLAUDE_FILE_PATH && semgrep scan --config auto --quiet $CLAUDE_FILE_PATH"
          }
        ]
      }
    ],
    "PreToolUse": [
      {
        "matcher": "Write",
        "hooks": [
          {
            "type": "command",
            "command": "echo $CLAUDE_FILE_PATH | grep -qE '(migrations/|.env|secrets)' && echo 'BLOCK: Protected file' && exit 1 || exit 0"
          }
        ]
      }
    ]
  }
}

# .claude/agents/security-reviewer.md
---
name: security-reviewer
description: Reviews code for security vulnerabilities
tools: Read, Grep, Glob, Bash
model: opus
---
You are a senior security engineer. Review code for:
- Injection vulnerabilities (SQL, XSS, command injection)
- Authentication and authorization flaws
- Secrets or credentials in code
- Insecure data handling
- OWASP Top 10 compliance

Provide specific line references and suggested fixes.
Output findings in SARIF format when possible.

# 新增 GitHub MCP Server
claude mcp add github

# 新增自定義 MCP Server
claude mcp add my-security-db --command "python security_db_server.py"

# 使用 @ 語法存取 MCP 資源
@github:repos/my-org/my-repo/issues       # 列出 Issues
@github:repos/my-org/my-repo/pulls         # 列出 PR
Show me the data from @my-security-db:latest-scan

# 啟動 Plan Mode
claude --permission-mode plan

# 在 Plan Mode 中進行安全分析
# > 分析認證系統的安全架構，找出潛在弱點，制定修復計畫

# Headless 模式（CI/CD 中使用）
claude --permission-mode plan -p "分析 src/ 目錄的安全風險並產出報告"

# 使用 ultrathink 關鍵字觸發深度推理（Opus 4.6 / Sonnet 4.6）
# > ultrathink 分析此系統的認證流程，找出所有可能的攻擊向量

# 調整推理深度
/effort        # 互動式調整
/model         # 在模型設定中調整

# 啟動隔離的 Worktree 會話
claude --worktree feature-auth      # 建立 .claude/worktrees/feature-auth/
claude --worktree bugfix-123        # 建立 .claude/worktrees/bugfix-123/
claude --worktree                   # 自動產生隨機名稱

# Subagent 也可使用 Worktree 隔離
# 在 .claude/agents/my-agent.md 中設定：
# isolation: worktree

# .worktreeinclude - 自動複製 gitignored 檔案到新 Worktree
.env
.env.local
config/secrets.json

# 每日安全掃描（Cloud Scheduled Task - claude.ai/code 設定）
# Prompt: "掃描 src/ 目錄的安全漏洞，對 Critical 問題建立 fix PR，
#          將摘要發送到 #security-alerts Slack 頻道"

# 每週依賴更新檢查（GitHub Actions）
# 見第 7 章 CI/CD 整合

# 即時監控（/loop）
/loop 每 5 分鐘檢查 API 健康狀態，若有異常則分析根因

.github/skills/
├── security-audit/
│   └── SKILL.md
├── performance-check/
│   └── SKILL.md
└── deploy-review/
    └── SKILL.md

# .github/skills/security-audit/SKILL.md
---
name: security-audit
description: Comprehensive security audit for OWASP Top 10 compliance
---
# Security Audit Workflow

## Steps
1. Scan for injection vulnerabilities (SQL, XSS, Command Injection)
2. Check authentication and session management
3. Verify authorization controls and access patterns
4. Audit cryptographic usage and key management
5. Check for sensitive data exposure
6. Verify API security (rate limiting, input validation)
7. Check dependency vulnerabilities via SCA
8. Review error handling for information leakage

## Output Format
- Severity: CRITICAL / HIGH / MEDIUM / LOW
- File and line reference
- Description of vulnerability
- Suggested fix with code example
- OWASP category reference

# .github/workflows/copilot-review.yml
name: Copilot Security Review
on:
  pull_request:
    types: [opened, synchronize]

jobs:
  copilot-review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Request Copilot Review
        run: |
          gh pr review ${{ github.event.pull_request.number }} \
            --request-review copilot

# [面向] Optimization Program

## 目標
[明確、可量化的目標描述]

## 目前狀態
- 指標 A：[目前值]
- 指標 B：[目前值]

## 可修改範圍
- [檔案/目錄清單]

## 禁止範圍
- [檔案/目錄/操作清單]

## 策略（依優先順序）
1. [策略一]
2. [策略二]
3. [策略三]

## 評估指標
METRIC:[指標名]=[值]

## Keep/Revert 規則
- KEEP 條件：[條件]
- REVERT 條件：[條件]

## 安全約束
- [安全限制清單]

# .autoresearch/security-policy.yaml
security_policy:
  # AI Agent 權限控制
  agent_permissions:
    can_modify_production: false
    can_access_secrets: false
    can_install_packages: false
    can_execute_shell: restricted  # 僅允許白名單命令
    allowed_commands:
      - python
      - pytest
      - ruff
      - black
      - semgrep

  # 變更限制
  change_limits:
    max_files_per_iteration: 5
    max_lines_changed_per_iteration: 100
    banned_patterns:
      - "eval("
      - "exec("
      - "os.system("
      - "subprocess.call(.*shell=True"
      - "__import__("
      - "pickle.loads("

  # 安全掃描要求
  scan_requirements:
    pre_commit:
      - gitleaks  # Secret scan
    pre_merge:
      - semgrep   # SAST
      - pip-audit # SCA
    post_deploy:
      - trivy     # Container scan

<type>(<scope>): <description>

[optional body]

[optional footer]

{
  "main": {
    "required_reviews": 2,
    "required_status_checks": [
      "build-and-test",
      "security-scan",
      "security-gate"
    ],
    "enforce_admins": true,
    "dismiss_stale_reviews": true,
    "require_signed_commits": true
  },
  "develop": {
    "required_reviews": 1,
    "required_status_checks": [
      "build-and-test",
      "security-scan"
    ]
  }
}

# AutoResearch 分支命名規範
autoresearch/optimization/{date}    # 日常優化
autoresearch/security-fix/{cve-id}  # 安全修補
autoresearch/quality/{metric}       # 品質改善

# 範例
autoresearch/optimization/2026-04-14
autoresearch/security-fix/CVE-2024-12345
autoresearch/quality/complexity-reduction

# ❌ 錯誤：沒有回滾機制
def deploy_ai_changes():
    changes = autoresearch.run()
    apply_to_production(changes)  # 直接部署，無法回滾！

# ✅ 正確：完整的回滾機制
def deploy_ai_changes():
    changes = autoresearch.run()
    snapshot = create_snapshot()  # 建立快照

    try:
        apply_to_staging(changes)
        run_smoke_tests()
        apply_to_production(changes)
    except Exception:
        rollback_to_snapshot(snapshot)  # 回滾
        alert_team("部署失敗，已自動回滾")

# ❌ 錯誤的 CI/CD Pipeline：跳過測試
jobs:
  deploy:
    steps:
      - uses: actions/checkout@v4
      - run: autoresearch --optimize
      - run: deploy.sh  # 直接部署！沒有測試！

# ✅ 正確的 CI/CD Pipeline：完整驗證
jobs:
  test:
    steps:
      - run: pytest tests/ --cov=src
      - run: semgrep scan --config auto
  security-gate:
    needs: test
    steps:
      - run: check_security_gate.sh
  deploy:
    needs: security-gate
    steps:
      - run: deploy.sh

# ❌ 錯誤的 program.md
## 目標
讓程式碼變得更好

## 策略
盡量優化

# ✅ 正確的 program.md
## 目標
降低 GET /api/v1/orders 的 P99 延遲從 2000ms 至 200ms 以下

## 策略（依優先順序）
1. 修復 N+1 Query（使用 JOIN）
2. 加入 Redis 快取（TTL: 60s）
3. 加入資料庫連線池

## 評估標準
METRIC:p99_latency_ms 低於 200 才 KEEP

# ❌ 錯誤：給 AI Agent 過多權限
agent_permissions:
  can_access_production_db: true
  can_modify_infrastructure: true
  can_delete_files: true
  can_install_any_package: true

# ✅ 正確：最小權限原則
agent_permissions:
  can_access_production_db: false
  can_modify_infrastructure: false
  can_delete_files: false
  can_install_any_package: false
  allowed_operations:
    - read_source_code
    - modify_source_code  # 限定範圍內
    - run_tests
    - run_linter

# ❌ 錯誤：直接信任 AI 生成的套件名稱
# AI 可能生成不存在的套件，導致 Supply Chain Attack
def install_ai_suggested_packages(packages: list[str]):
    for pkg in packages:
        subprocess.run(["pip", "install", pkg])  # 危險！

# ✅ 正確：驗證套件合法性
ALLOWED_PACKAGES = {"requests", "flask", "pytest", "numpy", "pandas"}

def install_ai_suggested_packages(packages: list[str]):
    for pkg in packages:
        if pkg not in ALLOWED_PACKAGES:
            raise ValueError(
                f"套件 {pkg} 不在允許清單中，需人工審核"
            )
        subprocess.run(["pip", "install", pkg], check=True)

# docker-compose.yml
version: '3.9'

services:
  # AutoResearch Agent
  autoresearch:
    build:
      context: .
      dockerfile: Dockerfile.autoresearch
    container_name: ar-agent
    environment:
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
      - AUTORESEARCH_TIME_BUDGET=${AR_TIME_BUDGET:-300}
      - REDIS_URL=redis://redis:6379
      - GIT_REPO_URL=${GIT_REPO_URL}
    volumes:
      - workspace:/workspace
      - ./programs:/programs:ro
    depends_on:
      - redis
    networks:
      - ar-network

  # Redis（快取 + 分散式鎖）
  redis:
    image: redis:7-alpine
    container_name: ar-redis
    ports:
      - "6379:6379"
    volumes:
      - redis-data:/data
    networks:
      - ar-network

  # Elasticsearch（日誌儲存）
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.12.0
    container_name: ar-elasticsearch
    environment:
      - discovery.type=single-node
      - xpack.security.enabled=false
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    ports:
      - "9200:9200"
    volumes:
      - es-data:/usr/share/elasticsearch/data
    networks:
      - ar-network

  # Kibana（日誌視覺化）
  kibana:
    image: docker.elastic.co/kibana/kibana:8.12.0
    container_name: ar-kibana
    ports:
      - "5601:5601"
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
    depends_on:
      - elasticsearch
    networks:
      - ar-network

  # Prometheus（指標收集）
  prometheus:
    image: prom/prometheus:latest
    container_name: ar-prometheus
    ports:
      - "9090:9090"
    volumes:
      - ./config/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prom-data:/prometheus
    networks:
      - ar-network

  # Grafana（指標視覺化）
  grafana:
    image: grafana/grafana:latest
    container_name: ar-grafana
    ports:
      - "3000:3000"
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD:-admin}
    volumes:
      - grafana-data:/var/lib/grafana
    depends_on:
      - prometheus
    networks:
      - ar-network

volumes:
  workspace:
  redis-data:
  es-data:
  prom-data:
  grafana-data:

networks:
  ar-network:
    driver: bridge

# .env.example（複製為 .env 並填入實際值）

# === LLM API Keys ===
ANTHROPIC_API_KEY=sk-ant-your-key-here
OPENAI_API_KEY=sk-your-key-here

# === Git ===
GIT_REPO_URL=https://github.com/your-org/your-repo.git
GITHUB_TOKEN=ghp_your-token-here

# === AutoResearch ===
AR_TIME_BUDGET=300
AR_MAX_ITERATIONS=10

# === Infrastructure ===
REDIS_URL=redis://localhost:6379
GRAFANA_PASSWORD=your-secure-password

# === Security ===
SEMGREP_APP_TOKEN=your-semgrep-token
SNYK_TOKEN=your-snyk-token

# Dockerfile.autoresearch
FROM python:3.12-slim

WORKDIR /app

# 安裝系統依賴
RUN apt-get update && apt-get install -y --no-install-recommends \
    git \
    curl \
    && rm -rf /var/lib/apt/lists/*

# 安裝 Claude Code（原生安裝，不再需要 Node.js）
RUN curl -fsSL https://claude.ai/install.sh | bash

# 安裝 uv（AutoResearch 使用 uv 管理依賴）
RUN curl -LsSf https://astral.sh/uv/install.sh | sh

# 安裝 Python 依賴（使用 uv）
COPY pyproject.toml uv.lock ./
RUN uv sync --frozen

# 安裝安全掃描工具
RUN pip install --no-cache-dir semgrep pip-audit safety

# 複製應用程式碼
COPY . .

# 非 root 使用者（安全最佳實踐）
RUN useradd --create-home appuser
USER appuser

ENTRYPOINT ["python", "autoresearch_engine.py"]

autoresearch-ssdlc/
├── .github/
│   ├── workflows/
│   │   ├── ssdlc-pipeline.yml        # 主 CI/CD Pipeline
│   │   ├── autoresearch-manual.yml    # 手動觸發
│   │   └── autoresearch-schedule.yml  # 排程觸發
│   └── CODEOWNERS                     # 程式碼擁有者
├── config/
│   ├── agents.yaml                    # 多 Agent 設定
│   ├── distributed.yaml               # 分散式設定
│   ├── prometheus.yml                 # Prometheus 設定
│   └── security-policy.yaml           # 安全策略
├── programs/
│   ├── performance.md                 # 效能優化策略
│   ├── security.md                    # 安全強化策略
│   ├── quality.md                     # 品質改善策略
│   └── testing.md                     # 測試生成策略
├── scripts/
│   ├── setup.ps1                      # Windows 安裝腳本
│   ├── setup.sh                       # Linux 安裝腳本
│   ├── security_scan.sh               # 安全掃描腳本
│   ├── aggregate_security.py          # 掃描結果彙總
│   ├── rollback.sh                    # 回滾腳本
│   └── drift_detector.py             # Drift 偵測
├── src/
│   ├── api/                           # API 層
│   ├── services/                      # 服務層
│   ├── repositories/                  # 資料存取層
│   └── models/                        # 資料模型
├── tests/
│   ├── unit/                          # 單元測試
│   ├── integration/                   # 整合測試
│   ├── security/                      # 安全測試
│   └── performance/                   # 效能測試
├── k8s/
│   ├── autoresearch-deployment.yaml   # K8s 部署
│   └── autoresearch-hpa.yaml          # 自動擴縮
├── .autoresearch/
│   └── security-policy.yaml           # Agent 安全策略
├── .vscode/
│   └── settings.json                  # VS Code 設定
├── autoresearch_engine.py             # 核心執行引擎
├── security_autofix.py                # 安全自動修補
├── deploy_decision.py                 # 部署決策引擎
├── conflict_resolver.py               # 衝突解決器
├── evaluator.py                       # 多維度評估引擎
├── docker-compose.yml                 # Docker Compose
├── Dockerfile.autoresearch            # Dockerfile
├── pyproject.toml                     # uv 專案定義與 Python 相依
├── uv.lock                            # uv 鎖定檔
├── requirements-dev.txt               # 開發相依
├── .env.example                       # 環境變數範例
├── .gitignore                         # Git 忽略規則
└── README.md                          # 專案說明