Code Assistant

import {
  TealEngineV12,
  TealGuard,
  TealSecrets,
  TealRegistry,
  TealMemory,
  PolicyMode,
} from 'tealtiger';

// --- Initialize modules ---

const guard = new TealGuard({
  promptInjection: { enabled: true, mode: PolicyMode.ENFORCE },
});

const secrets = new TealSecrets({
  patterns: 'all', // 500+ built-in patterns
  confidence: { minimum: 'MEDIUM' },
  action: 'REDACT', // Replace secrets with placeholders
});

const registry = new TealRegistry({
  models: {
    allowlist: ['gpt-4-turbo', 'gpt-4o', 'claude-3-5-sonnet'],
  },
});

const memory = new TealMemory({
  defaultScope: 'session',
  allowedScopes: ['session', 'request'], // No persistent scopes
  purgeOnSessionEnd: true,
  classification: {
    codeContext: 'INTERNAL', // Treat all code context as internal
  },
});

const engine = new TealEngineV12({
  modules: [guard, secrets, registry, memory],
  mode: PolicyMode.ENFORCE,
});

// --- Orchestration flow ---

async function handleCodeRequest(prompt: string, sessionId: string) {
  const context = engine.createContext({
    sessionId,
    agentId: 'code-assistant',
    environment: 'development',
  });

  // Step 1: TealGuard scans the developer prompt
  const guardResult = await guard.scan({
    content: prompt,
    direction: 'input',
    context,
  });

  if (guardResult.action === 'DENY') {
    return {
      blocked: true,
      reason: guardResult.reasonCodes,
      correlationId: context.correlationId,
    };
  }

  // Step 2: TealRegistry verifies the model is allowlisted
  const modelCheck = await registry.checkModel({
    model: 'gpt-4-turbo',
    context,
  });

  if (modelCheck.action === 'DENY') {
    return {
      blocked: true,
      reason: ['MODEL_NOT_ALLOWLISTED'],
      correlationId: context.correlationId,
    };
  }

  // Step 3: Agent generates code (your LLM call)
  const generatedCode = await generateCode(prompt);

  // Step 4: TealSecrets scans the generated output
  const secretsScan = await secrets.scan({
    content: generatedCode,
    direction: 'output',
    context,
  });

  let finalCode = generatedCode;

  if (secretsScan.findings.length > 0) {
    // Secrets detected — use the redacted version
    finalCode = secretsScan.redactedContent;

    // Log each finding
    for (const finding of secretsScan.findings) {
      console.warn(
        `Secret detected: ${finding.type} (confidence: ${finding.confidence})`
      );
    }
  }

  // Step 5: TealMemory stores context in session scope only
  await memory.store({
    key: `code-context:${context.correlationId}`,
    value: { prompt, responseLength: finalCode.length },
    scope: 'session',
    classification: 'INTERNAL',
    context,
  });

  return {
    code: finalCode,
    secretsDetected: secretsScan.findings.length,
    warnings: secretsScan.findings.map((f) => ({
      type: f.type,
      message: `Hardcoded ${f.type} detected and replaced with environment variable`,
    })),
    model: 'gpt-4-turbo',
    correlationId: context.correlationId,
  };
}

// --- Example usage ---

const result = await handleCodeRequest(
  'Write a function that connects to our PostgreSQL database and queries the users table.',
  'session-dev-abc'
);

// result.code contains clean code with env var placeholders
// result.secretsDetected = 1
// result.warnings = [{ type: 'database_connection_string', message: '...' }]