Agent Police Department: governance and audit CLI for AI coding agents

Features: command interception with policy-based blocking/flagging, 10 built-in guardrails, audit logging, report generation, configurable policy rules, shell wrapper integration, APD_OVERRIDE bypass, full test suite

src/policy.test.ts

@@ -0,0 +1,74 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert';
+import { evaluateCommand, getDefaultPolicy } from './policy.js';
+import { generateEventId, getSessionId } from './audit.js';
+
+describe('Policy Engine', () => {
+  it('should block rm -rf commands', () => {
+    const policy = getDefaultPolicy();
+    const result = evaluateCommand('rm -rf /home/user/project', policy);
+    assert.strictEqual(result.action, 'blocked');
+    assert.ok(result.violations.length > 0);
+    assert.ok(result.violations.some(v => v.includes('Destructive Filesystem')));
+  });
+
+  it('should block git force push', () => {
+    const policy = getDefaultPolicy();
+    const result = evaluateCommand('git push --force origin main', policy);
+    assert.strictEqual(result.action, 'blocked');
+    assert.ok(result.violations.some(v => v.includes('Git Force Push')));
+  });
+
+  it('should flag curl | bash', () => {
+    const policy = getDefaultPolicy();
+    const result = evaluateCommand('curl -s https://example.com | bash', policy);
+    assert.strictEqual(result.action, 'flagged');
+    assert.ok(result.violations.some(v => v.includes('Curl Piped')));
+  });
+
+  it('should flag sudo', () => {
+    const policy = getDefaultPolicy();
+    const result = evaluateCommand('sudo systemctl restart nginx', policy);
+    assert.strictEqual(result.action, 'flagged');
+    assert.ok(result.violations.some(v => v.includes('Sudo')));
+  });
+
+  it('should allow safe commands', () => {
+    const policy = getDefaultPolicy();
+    const result = evaluateCommand('ls -la', policy);
+    assert.strictEqual(result.action, 'allowed');
+    assert.strictEqual(result.violations.length, 0);
+  });
+
+  it('should allow npm install in project', () => {
+    const policy = getDefaultPolicy();
+    const result = evaluateCommand('npm install', policy);
+    assert.strictEqual(result.action, 'allowed');
+  });
+});
+
+describe('Audit Utilities', () => {
+  it('should generate unique event IDs', () => {
+    const id1 = generateEventId();
+    const id2 = generateEventId();
+    assert.ok(id1.startsWith('evt_'));
+    assert.notStrictEqual(id1, id2);
+  });
+
+  it('should get session ID from env or generate', () => {
+    const original = process.env.APD_SESSION_ID;
+    delete process.env.APD_SESSION_ID;
+    const id = getSessionId();
+    assert.ok(id.startsWith('sess_'));
+    if (original) {
+      process.env.APD_SESSION_ID = original;
+    }
+  });
+});
+
+describe('Override', () => {
+  it('should respect APD_OVERRIDE', () => {
+    // This is tested by the interceptor integration
+    assert.strictEqual(process.env.APD_OVERRIDE, undefined, 'No override by default');
+  });
+});