aiox-core 5.0.3 → 5.0.4

package/pro/squads/squad-creator-pro/scripts/security_scanner.py

@@ -1,378 +1,378 @@
-#!/usr/bin/env python3
-"""
-Script: security_scanner.py
-Purpose: Scan squad directory for security issues (secrets, API keys, credentials)
-Version: 1.0.0
-Ported from: validate-squad.sh check_security()
-
-Usage:
-    python scripts/security_scanner.py squads/{squad-name}/
-    python scripts/security_scanner.py squads/{squad-name}/ --output json
-    python scripts/security_scanner.py squads/{squad-name}/ --strict  # No exclusions
-
-Operations: 15+ security checks
-- API keys and tokens
-- Cloud credentials (AWS, GCP)
-- Private keys (content and files)
-- Database URLs with passwords
-- Sensitive files (.env, credentials)
-"""
-
-import argparse
-import json
-import os
-import re
-import sys
-from dataclasses import dataclass, field, asdict
-from pathlib import Path
-from typing import List, Dict, Optional, Tuple
-
-# =============================================================================
-# SECURITY PATTERNS
-# =============================================================================
-
-SECURITY_CHECKS = {
-    "SEC-001": {
-        "name": "API Keys",
-        "pattern": r"(api[_-]?key|apikey)\s*[:=]\s*['\"][^'\"\$\{]{8,}",
-        "exclude": r"(\{\{|\$\{|process\.env|[Ee]xample|placeholder|grep|pattern|EXAMPLE|sk-1234|your-key|#.*api)",
-        "severity": "critical",
-        "category": "api_tokens"
-    },
-    "SEC-002": {
-        "name": "Secrets/Passwords",
-        "pattern": r"(secret|password)\s*[:=]\s*['\"][^'\"\$\{]{8,}",
-        "exclude": r"(\{\{|\$\{|process\.env|[Ee]xample|placeholder|grep|pattern|EXAMPLE|secret_key|your-secret|#.*secret|#.*password|mySecret|super-secret|-secret-|-here)",
-        "severity": "critical",
-        "category": "api_tokens"
-    },
-    "SEC-003": {
-        "name": "AWS Access Key",
-        "pattern": r"AKIA[A-Z0-9]{16}",
-        "exclude": r"(EXAMPLE|grep|pattern|\.sh:|\.md:.*grep|action:|check:|Match:)",
-        "severity": "critical",
-        "category": "cloud_credentials"
-    },
-    "SEC-004": {
-        "name": "GCP Service Account",
-        "pattern": r'"type"\s*:\s*"service_account"',
-        "exclude": None,
-        "severity": "critical",
-        "category": "cloud_credentials"
-    },
-    "SEC-005": {
-        "name": "Private Key Content",
-        "pattern": r"-----BEGIN.*(PRIVATE|RSA|DSA|EC).*KEY-----",
-        "exclude": r"(grep|pattern|action:|check:|Match:|example|#.*BEGIN|\"-----BEGIN)",
-        "severity": "critical",
-        "category": "private_keys"
-    },
-    "SEC-007": {
-        "name": "Database URL with Password",
-        "pattern": r"(postgres|mysql|mongodb|redis)://[^:]+:[^@]+@",
-        "exclude": r"(\{\{|\[PASSWORD\]|[Ee]xample|localhost|user:pass|:password@|:secret@|grep|pattern)",
-        "severity": "critical",
-        "category": "database"
-    },
-    "SEC-009": {
-        "name": "Bearer/JWT Token",
-        "pattern": r"(bearer|jwt[_-]?secret)\s*[:=]\s*['\"][^'\"]{20,}",
-        "exclude": r"(\{\{|\$\{|[Ee]xample|placeholder|super-secret|-here|action:|check:|Match:|#.*jwt)",
-        "severity": "critical",
-        "category": "api_tokens"
-    },
-    "SEC-010": {
-        "name": "Supabase Service Role Key",
-        "pattern": r"supabase.*service[_-]?role.*eyJ",
-        "exclude": None,
-        "severity": "critical",
-        "category": "cloud_credentials"
-    },
-    "SEC-011": {
-        "name": "GitHub Token",
-        "pattern": r"gh[pousr]_[A-Za-z0-9_]{36,}",
-        "exclude": r"([Ee]xample|placeholder)",
-        "severity": "critical",
-        "category": "api_tokens"
-    },
-    "SEC-012": {
-        "name": "Slack Token",
-        "pattern": r"xox[baprs]-[0-9]{10,13}-[0-9]{10,13}-[a-zA-Z0-9]{24}",
-        "exclude": None,
-        "severity": "critical",
-        "category": "api_tokens"
-    }
-}
-
-# File-based checks (not regex on content)
-FILE_CHECKS = {
-    "SEC-006": {
-        "name": "Private Key Files",
-        "patterns": ["*.pem", "*.key", "id_rsa", "id_rsa.*", "id_ecdsa", "id_ecdsa.*", "id_ed25519", "id_ed25519.*"],
-        "severity": "critical",
-        "category": "private_keys"
-    },
-    "SEC-008": {
-        "name": ".env Files",
-        "patterns": [".env", ".env.*", "*.env"],
-        "severity": "critical",
-        "category": "sensitive_files"
-    },
-    "SEC-013": {
-        "name": "Credential Files",
-        "patterns": ["credentials*.json", "service-account*.json", "secrets.yaml", "secrets.yml"],
-        "severity": "critical",
-        "category": "sensitive_files"
-    }
-}
-
-# =============================================================================
-# DATA CLASSES
-# =============================================================================
-
-@dataclass
-class SecurityIssue:
-    check_id: str
-    name: str
-    severity: str
-    category: str
-    file: str
-    line: Optional[int] = None
-    match: Optional[str] = None
-
-@dataclass
-class SecurityResult:
-    squad_path: str
-    status: str  # "pass" or "fail"
-    issues_count: int
-    critical_count: int
-    warning_count: int
-    checks_run: int
-    checks_passed: int
-    issues: List[SecurityIssue] = field(default_factory=list)
-    summary_by_category: Dict[str, int] = field(default_factory=dict)
-
-# =============================================================================
-# SCANNER FUNCTIONS
-# =============================================================================
-
-def scan_file_content(file_path: Path, check_id: str, check: dict, strict: bool = False) -> List[SecurityIssue]:
-    """Scan a single file for security issues."""
-    issues = []
-
-    # Skip test files (they contain intentional examples)
-    if not strict and file_path.name.startswith("test_"):
-        return issues
-
-    try:
-        content = file_path.read_text(encoding='utf-8', errors='ignore')
-        lines = content.split('\n')
-
-        pattern = re.compile(check["pattern"], re.IGNORECASE)
-        exclude = re.compile(check["exclude"], re.IGNORECASE) if check.get("exclude") and not strict else None
-
-        for line_num, line in enumerate(lines, 1):
-            matches = pattern.findall(line)
-            if matches:
-                # Check exclusions
-                if exclude and exclude.search(line):
-                    continue
-
-                # Found a real issue
-                issues.append(SecurityIssue(
-                    check_id=check_id,
-                    name=check["name"],
-                    severity=check["severity"],
-                    category=check["category"],
-                    file=str(file_path),
-                    line=line_num,
-                    match=line[:100] + "..." if len(line) > 100 else line
-                ))
-    except Exception as e:
-        pass  # Skip files that can't be read
-
-    return issues
-
-def scan_for_files(squad_path: Path, check_id: str, check: dict) -> List[SecurityIssue]:
-    """Scan for sensitive files by pattern."""
-    issues = []
-
-    for pattern in check["patterns"]:
-        # Use glob to find matching files
-        for file_path in squad_path.rglob(pattern):
-            if file_path.is_file():
-                issues.append(SecurityIssue(
-                    check_id=check_id,
-                    name=check["name"],
-                    severity=check["severity"],
-                    category=check["category"],
-                    file=str(file_path)
-                ))
-
-    return issues
-
-def scan_squad(squad_path: str, strict: bool = False) -> SecurityResult:
-    """Run all security checks on a squad directory."""
-    path = Path(squad_path)
-
-    if not path.exists():
-        return SecurityResult(
-            squad_path=squad_path,
-            status="error",
-            issues_count=0,
-            critical_count=0,
-            warning_count=0,
-            checks_run=0,
-            checks_passed=0,
-            issues=[SecurityIssue(
-                check_id="SEC-000",
-                name="Path Error",
-                severity="critical",
-                category="error",
-                file=squad_path,
-                match=f"Directory not found: {squad_path}"
-            )]
-        )
-
-    all_issues = []
-    checks_run = 0
-    checks_passed = 0
-
-    # Get all text files to scan
-    text_extensions = {'.md', '.yaml', '.yml', '.json', '.py', '.js', '.ts', '.sh', '.txt', '.env'}
-    files_to_scan = [
-        f for f in path.rglob('*')
-        if f.is_file()
-        and f.suffix in text_extensions
-        and '__pycache__' not in str(f)
-        and '.git' not in str(f)
-    ]
-
-    # Run content-based checks
-    for check_id, check in SECURITY_CHECKS.items():
-        checks_run += 1
-        check_issues = []
-
-        for file_path in files_to_scan:
-            check_issues.extend(scan_file_content(file_path, check_id, check, strict))
-
-        if not check_issues:
-            checks_passed += 1
-        else:
-            all_issues.extend(check_issues)
-
-    # Run file-based checks
-    for check_id, check in FILE_CHECKS.items():
-        checks_run += 1
-        check_issues = scan_for_files(path, check_id, check)
-
-        if not check_issues:
-            checks_passed += 1
-        else:
-            all_issues.extend(check_issues)
-
-    # Calculate summary
-    critical_count = sum(1 for i in all_issues if i.severity == "critical")
-    warning_count = sum(1 for i in all_issues if i.severity == "warning")
-
-    summary_by_category = {}
-    for issue in all_issues:
-        summary_by_category[issue.category] = summary_by_category.get(issue.category, 0) + 1
-
-    return SecurityResult(
-        squad_path=squad_path,
-        status="fail" if all_issues else "pass",
-        issues_count=len(all_issues),
-        critical_count=critical_count,
-        warning_count=warning_count,
-        checks_run=checks_run,
-        checks_passed=checks_passed,
-        issues=all_issues,
-        summary_by_category=summary_by_category
-    )
-
-# =============================================================================
-# OUTPUT FORMATTERS
-# =============================================================================
-
-def format_text(result: SecurityResult) -> str:
-    """Format result as human-readable text."""
-    lines = []
-    lines.append("")
-    lines.append(f"Security Scan: {Path(result.squad_path).name}")
-    lines.append("=" * 60)
-
-    status_icon = "✓" if result.status == "pass" else "✗"
-    lines.append(f"Status: {status_icon} {result.status.upper()}")
-    lines.append(f"Checks: {result.checks_passed}/{result.checks_run} passed")
-    lines.append(f"Issues: {result.issues_count} ({result.critical_count} critical, {result.warning_count} warnings)")
-
-    if result.summary_by_category:
-        lines.append("")
-        lines.append("By Category:")
-        for category, count in sorted(result.summary_by_category.items()):
-            lines.append(f"  {category}: {count}")
-
-    if result.issues:
-        lines.append("")
-        lines.append("Issues Found:")
-        lines.append("-" * 60)
-
-        for issue in result.issues:
-            icon = "✗" if issue.severity == "critical" else "⚠"
-            lines.append(f"  {icon} [{issue.check_id}] {issue.name}")
-            lines.append(f"    File: {issue.file}")
-            if issue.line:
-                lines.append(f"    Line: {issue.line}")
-            if issue.match:
-                # Redact potential secrets
-                redacted = re.sub(r'[a-zA-Z0-9]{20,}', '[REDACTED]', issue.match)
-                lines.append(f"    Match: {redacted}")
-            lines.append("")
-    else:
-        lines.append("")
-        lines.append("✓ No security issues found!")
-
-    return "\n".join(lines)
-
-def format_json(result: SecurityResult) -> str:
-    """Format result as JSON."""
-    # Convert dataclasses to dict
-    data = asdict(result)
-    # Convert issues list
-    data["issues"] = [asdict(i) if hasattr(i, '__dataclass_fields__') else i for i in result.issues]
-    return json.dumps(data, indent=2)
-
-# =============================================================================
-# MAIN
-# =============================================================================
-
-def main():
-    parser = argparse.ArgumentParser(
-        description="Scan squad directory for security issues",
-        formatter_class=argparse.RawDescriptionHelpFormatter,
-        epilog="""
-Examples:
-    python security_scanner.py squads/copy/
-    python security_scanner.py squads/copy/ --output json
-    python security_scanner.py squads/copy/ --strict
-        """
-    )
-    parser.add_argument("squad_path", help="Path to squad directory")
-    parser.add_argument("--output", "-o", choices=["text", "json"], default="text", help="Output format")
-    parser.add_argument("--strict", action="store_true", help="Disable exclusion patterns (catch more, may have false positives)")
-
-    args = parser.parse_args()
-
-    result = scan_squad(args.squad_path, args.strict)
-
-    if args.output == "json":
-        print(format_json(result))
-    else:
-        print(format_text(result))
-
-    # Exit with error code if issues found
-    sys.exit(1 if result.status == "fail" else 0)
-
-if __name__ == "__main__":
-    main()
+#!/usr/bin/env python3
+"""
+Script: security_scanner.py
+Purpose: Scan squad directory for security issues (secrets, API keys, credentials)
+Version: 1.0.0
+Ported from: validate-squad.sh check_security()
+
+Usage:
+    python scripts/security_scanner.py squads/{squad-name}/
+    python scripts/security_scanner.py squads/{squad-name}/ --output json
+    python scripts/security_scanner.py squads/{squad-name}/ --strict  # No exclusions
+
+Operations: 15+ security checks
+- API keys and tokens
+- Cloud credentials (AWS, GCP)
+- Private keys (content and files)
+- Database URLs with passwords
+- Sensitive files (.env, credentials)
+"""
+
+import argparse
+import json
+import os
+import re
+import sys
+from dataclasses import dataclass, field, asdict
+from pathlib import Path
+from typing import List, Dict, Optional, Tuple
+
+# =============================================================================
+# SECURITY PATTERNS
+# =============================================================================
+
+SECURITY_CHECKS = {
+    "SEC-001": {
+        "name": "API Keys",
+        "pattern": r"(api[_-]?key|apikey)\s*[:=]\s*['\"][^'\"\$\{]{8,}",
+        "exclude": r"(\{\{|\$\{|process\.env|[Ee]xample|placeholder|grep|pattern|EXAMPLE|sk-1234|your-key|#.*api)",
+        "severity": "critical",
+        "category": "api_tokens"
+    },
+    "SEC-002": {
+        "name": "Secrets/Passwords",
+        "pattern": r"(secret|password)\s*[:=]\s*['\"][^'\"\$\{]{8,}",
+        "exclude": r"(\{\{|\$\{|process\.env|[Ee]xample|placeholder|grep|pattern|EXAMPLE|secret_key|your-secret|#.*secret|#.*password|mySecret|super-secret|-secret-|-here)",
+        "severity": "critical",
+        "category": "api_tokens"
+    },
+    "SEC-003": {
+        "name": "AWS Access Key",
+        "pattern": r"AKIA[A-Z0-9]{16}",
+        "exclude": r"(EXAMPLE|grep|pattern|\.sh:|\.md:.*grep|action:|check:|Match:)",
+        "severity": "critical",
+        "category": "cloud_credentials"
+    },
+    "SEC-004": {
+        "name": "GCP Service Account",
+        "pattern": r'"type"\s*:\s*"service_account"',
+        "exclude": None,
+        "severity": "critical",
+        "category": "cloud_credentials"
+    },
+    "SEC-005": {
+        "name": "Private Key Content",
+        "pattern": r"-----BEGIN.*(PRIVATE|RSA|DSA|EC).*KEY-----",
+        "exclude": r"(grep|pattern|action:|check:|Match:|example|#.*BEGIN|\"-----BEGIN)",
+        "severity": "critical",
+        "category": "private_keys"
+    },
+    "SEC-007": {
+        "name": "Database URL with Password",
+        "pattern": r"(postgres|mysql|mongodb|redis)://[^:]+:[^@]+@",
+        "exclude": r"(\{\{|\[PASSWORD\]|[Ee]xample|localhost|user:pass|:password@|:secret@|grep|pattern)",
+        "severity": "critical",
+        "category": "database"
+    },
+    "SEC-009": {
+        "name": "Bearer/JWT Token",
+        "pattern": r"(bearer|jwt[_-]?secret)\s*[:=]\s*['\"][^'\"]{20,}",
+        "exclude": r"(\{\{|\$\{|[Ee]xample|placeholder|super-secret|-here|action:|check:|Match:|#.*jwt)",
+        "severity": "critical",
+        "category": "api_tokens"
+    },
+    "SEC-010": {
+        "name": "Supabase Service Role Key",
+        "pattern": r"supabase.*service[_-]?role.*eyJ",
+        "exclude": None,
+        "severity": "critical",
+        "category": "cloud_credentials"
+    },
+    "SEC-011": {
+        "name": "GitHub Token",
+        "pattern": r"gh[pousr]_[A-Za-z0-9_]{36,}",
+        "exclude": r"([Ee]xample|placeholder)",
+        "severity": "critical",
+        "category": "api_tokens"
+    },
+    "SEC-012": {
+        "name": "Slack Token",
+        "pattern": r"xox[baprs]-[0-9]{10,13}-[0-9]{10,13}-[a-zA-Z0-9]{24}",
+        "exclude": None,
+        "severity": "critical",
+        "category": "api_tokens"
+    }
+}
+
+# File-based checks (not regex on content)
+FILE_CHECKS = {
+    "SEC-006": {
+        "name": "Private Key Files",
+        "patterns": ["*.pem", "*.key", "id_rsa", "id_rsa.*", "id_ecdsa", "id_ecdsa.*", "id_ed25519", "id_ed25519.*"],
+        "severity": "critical",
+        "category": "private_keys"
+    },
+    "SEC-008": {
+        "name": ".env Files",
+        "patterns": [".env", ".env.*", "*.env"],
+        "severity": "critical",
+        "category": "sensitive_files"
+    },
+    "SEC-013": {
+        "name": "Credential Files",
+        "patterns": ["credentials*.json", "service-account*.json", "secrets.yaml", "secrets.yml"],
+        "severity": "critical",
+        "category": "sensitive_files"
+    }
+}
+
+# =============================================================================
+# DATA CLASSES
+# =============================================================================
+
+@dataclass
+class SecurityIssue:
+    check_id: str
+    name: str
+    severity: str
+    category: str
+    file: str
+    line: Optional[int] = None
+    match: Optional[str] = None
+
+@dataclass
+class SecurityResult:
+    squad_path: str
+    status: str  # "pass" or "fail"
+    issues_count: int
+    critical_count: int
+    warning_count: int
+    checks_run: int
+    checks_passed: int
+    issues: List[SecurityIssue] = field(default_factory=list)
+    summary_by_category: Dict[str, int] = field(default_factory=dict)
+
+# =============================================================================
+# SCANNER FUNCTIONS
+# =============================================================================
+
+def scan_file_content(file_path: Path, check_id: str, check: dict, strict: bool = False) -> List[SecurityIssue]:
+    """Scan a single file for security issues."""
+    issues = []
+
+    # Skip test files (they contain intentional examples)
+    if not strict and file_path.name.startswith("test_"):
+        return issues
+
+    try:
+        content = file_path.read_text(encoding='utf-8', errors='ignore')
+        lines = content.split('\n')
+
+        pattern = re.compile(check["pattern"], re.IGNORECASE)
+        exclude = re.compile(check["exclude"], re.IGNORECASE) if check.get("exclude") and not strict else None
+
+        for line_num, line in enumerate(lines, 1):
+            matches = pattern.findall(line)
+            if matches:
+                # Check exclusions
+                if exclude and exclude.search(line):
+                    continue
+
+                # Found a real issue
+                issues.append(SecurityIssue(
+                    check_id=check_id,
+                    name=check["name"],
+                    severity=check["severity"],
+                    category=check["category"],
+                    file=str(file_path),
+                    line=line_num,
+                    match=line[:100] + "..." if len(line) > 100 else line
+                ))
+    except Exception as e:
+        pass  # Skip files that can't be read
+
+    return issues
+
+def scan_for_files(squad_path: Path, check_id: str, check: dict) -> List[SecurityIssue]:
+    """Scan for sensitive files by pattern."""
+    issues = []
+
+    for pattern in check["patterns"]:
+        # Use glob to find matching files
+        for file_path in squad_path.rglob(pattern):
+            if file_path.is_file():
+                issues.append(SecurityIssue(
+                    check_id=check_id,
+                    name=check["name"],
+                    severity=check["severity"],
+                    category=check["category"],
+                    file=str(file_path)
+                ))
+
+    return issues
+
+def scan_squad(squad_path: str, strict: bool = False) -> SecurityResult:
+    """Run all security checks on a squad directory."""
+    path = Path(squad_path)
+
+    if not path.exists():
+        return SecurityResult(
+            squad_path=squad_path,
+            status="error",
+            issues_count=0,
+            critical_count=0,
+            warning_count=0,
+            checks_run=0,
+            checks_passed=0,
+            issues=[SecurityIssue(
+                check_id="SEC-000",
+                name="Path Error",
+                severity="critical",
+                category="error",
+                file=squad_path,
+                match=f"Directory not found: {squad_path}"
+            )]
+        )
+
+    all_issues = []
+    checks_run = 0
+    checks_passed = 0
+
+    # Get all text files to scan
+    text_extensions = {'.md', '.yaml', '.yml', '.json', '.py', '.js', '.ts', '.sh', '.txt', '.env'}
+    files_to_scan = [
+        f for f in path.rglob('*')
+        if f.is_file()
+        and f.suffix in text_extensions
+        and '__pycache__' not in str(f)
+        and '.git' not in str(f)
+    ]
+
+    # Run content-based checks
+    for check_id, check in SECURITY_CHECKS.items():
+        checks_run += 1
+        check_issues = []
+
+        for file_path in files_to_scan:
+            check_issues.extend(scan_file_content(file_path, check_id, check, strict))
+
+        if not check_issues:
+            checks_passed += 1
+        else:
+            all_issues.extend(check_issues)
+
+    # Run file-based checks
+    for check_id, check in FILE_CHECKS.items():
+        checks_run += 1
+        check_issues = scan_for_files(path, check_id, check)
+
+        if not check_issues:
+            checks_passed += 1
+        else:
+            all_issues.extend(check_issues)
+
+    # Calculate summary
+    critical_count = sum(1 for i in all_issues if i.severity == "critical")
+    warning_count = sum(1 for i in all_issues if i.severity == "warning")
+
+    summary_by_category = {}
+    for issue in all_issues:
+        summary_by_category[issue.category] = summary_by_category.get(issue.category, 0) + 1
+
+    return SecurityResult(
+        squad_path=squad_path,
+        status="fail" if all_issues else "pass",
+        issues_count=len(all_issues),
+        critical_count=critical_count,
+        warning_count=warning_count,
+        checks_run=checks_run,
+        checks_passed=checks_passed,
+        issues=all_issues,
+        summary_by_category=summary_by_category
+    )
+
+# =============================================================================
+# OUTPUT FORMATTERS
+# =============================================================================
+
+def format_text(result: SecurityResult) -> str:
+    """Format result as human-readable text."""
+    lines = []
+    lines.append("")
+    lines.append(f"Security Scan: {Path(result.squad_path).name}")
+    lines.append("=" * 60)
+
+    status_icon = "✓" if result.status == "pass" else "✗"
+    lines.append(f"Status: {status_icon} {result.status.upper()}")
+    lines.append(f"Checks: {result.checks_passed}/{result.checks_run} passed")
+    lines.append(f"Issues: {result.issues_count} ({result.critical_count} critical, {result.warning_count} warnings)")
+
+    if result.summary_by_category:
+        lines.append("")
+        lines.append("By Category:")
+        for category, count in sorted(result.summary_by_category.items()):
+            lines.append(f"  {category}: {count}")
+
+    if result.issues:
+        lines.append("")
+        lines.append("Issues Found:")
+        lines.append("-" * 60)
+
+        for issue in result.issues:
+            icon = "✗" if issue.severity == "critical" else "⚠"
+            lines.append(f"  {icon} [{issue.check_id}] {issue.name}")
+            lines.append(f"    File: {issue.file}")
+            if issue.line:
+                lines.append(f"    Line: {issue.line}")
+            if issue.match:
+                # Redact potential secrets
+                redacted = re.sub(r'[a-zA-Z0-9]{20,}', '[REDACTED]', issue.match)
+                lines.append(f"    Match: {redacted}")
+            lines.append("")
+    else:
+        lines.append("")
+        lines.append("✓ No security issues found!")
+
+    return "\n".join(lines)
+
+def format_json(result: SecurityResult) -> str:
+    """Format result as JSON."""
+    # Convert dataclasses to dict
+    data = asdict(result)
+    # Convert issues list
+    data["issues"] = [asdict(i) if hasattr(i, '__dataclass_fields__') else i for i in result.issues]
+    return json.dumps(data, indent=2)
+
+# =============================================================================
+# MAIN
+# =============================================================================
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Scan squad directory for security issues",
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+        epilog="""
+Examples:
+    python security_scanner.py squads/copy/
+    python security_scanner.py squads/copy/ --output json
+    python security_scanner.py squads/copy/ --strict
+        """
+    )
+    parser.add_argument("squad_path", help="Path to squad directory")
+    parser.add_argument("--output", "-o", choices=["text", "json"], default="text", help="Output format")
+    parser.add_argument("--strict", action="store_true", help="Disable exclusion patterns (catch more, may have false positives)")
+
+    args = parser.parse_args()
+
+    result = scan_squad(args.squad_path, args.strict)
+
+    if args.output == "json":
+        print(format_json(result))
+    else:
+        print(format_text(result))
+
+    # Exit with error code if issues found
+    sys.exit(1 if result.status == "fail" else 0)
+
+if __name__ == "__main__":
+    main()