Mai/.planning/phases/02-safety-sandboxing/02-01-PLAN.md

phase, plan, type, wave, depends_on, files_modified, autonomous, must_haves

phase	plan	type	wave	depends_on	files_modified	autonomous	must_haves
02-safety-sandboxing	01	execute	1		src/security/__init__.py src/security/assessor.py requirements.txt config/security.yaml	true	truths artifacts key_links Security assessment runs before any code execution Code is categorized as LOW/MEDIUM/HIGH/BLOCKED Assessment is fast and doesn't block user workflow path provides min_lines src/security/assessor.py Security assessment engine 40 path provides contains requirements.txt Security analysis dependencies bandit, semgrep path provides contains config/security.yaml Security assessment policies BLOCKED, HIGH, MEDIUM, LOW from to via pattern src/security/assessor.py bandit CLI subprocess.run bandit.*-f.*json from to via pattern src/security/assessor.py semgrep CLI subprocess.run semgrep.*--config

Create multi-level security assessment infrastructure to analyze code before execution.

Purpose: Prevent malicious or unsafe code from executing by implementing configurable security assessment with Bandit and Semgrep integration. Output: Working security assessor that categorizes code as LOW/MEDIUM/HIGH/BLOCKED with specific thresholds.

<execution_context> @/.opencode/get-shit-done/workflows/execute-plan.md @/.opencode/get-shit-done/templates/summary.md </execution_context>

@.planning/PROJECT.md @.planning/ROADMAP.md @.planning/STATE.md

Research references

@.planning/phases/02-safety-sandboxing/02-RESEARCH.md

Task 1: Create security assessment module src/security/__init__.py, src/security/assessor.py Create SecurityAssessor class with assess(code: str) method that runs both Bandit and Semgrep analysis. Use subprocess to run bandit -f json - and semgrep --config=p/python commands. Parse results, categorize by severity levels per CONTEXT.md decisions (BLOCKED for malicious patterns + known threats, HIGH for privileged access attempts). Return SecurityLevel enum with detailed findings. python -c "from src.security.assessor import SecurityAssessor; print('SecurityAssessor imported successfully')" SecurityAssessor class runs Bandit and Semgrep, returns correct severity levels, handles malformed input gracefully Task 2: Add security dependencies and configuration requirements.txt, config/security.yaml Add bandit>=1.7.7, semgrep>=1.99 to requirements.txt. Create config/security.yaml with security assessment policies: BLOCKED triggers (malicious patterns, known threats), HIGH triggers (admin/root access, system file modifications), threshold levels, and trusted code patterns. Follow CONTEXT.md decisions for user override requirements. pip install -r requirements.txt && python -c "import bandit, semgrep; print('Security dependencies installed')" Security analysis tools install successfully, configuration file defines assessment policies matching CONTEXT.md decisions - SecurityAssessor class successfully imports and runs analysis - Bandit and Semgrep can be executed via subprocess - Security levels align with CONTEXT.md decisions (BLOCKED, HIGH, MEDIUM, LOW) - Configuration file exists with correct policy definitions - Analysis completes within reasonable time (<5 seconds for typical code)

<success_criteria> Security assessment infrastructure ready to categorize code by severity before execution, with both static analysis tools integrated and user-configurable policies. </success_criteria>

After completion, create `.planning/phases/02-safety-sandboxing/02-01-SUMMARY.md`