# scripts/ci-audit.ps1 — a scheduled, headless Grok run done structurally.
#
# There is nobody to approve in a scheduled job, so every guarantee here is a
# flag, not a prompt: a strict kernel sandbox (applies under WSL/Linux/macOS —
# on native Windows it logs a warning and continues unenforced), dontAsk with a
# read-only tool allow-list, the cheap model, and JSON out for whatever reads it.
#
# Run from Task Scheduler (pwsh -File scripts\ci-audit.ps1) or cron under WSL.
# Requires XAI_API_KEY in the environment — never in this file.

param(
    [string]$Repo   = (Get-Location).Path,
    [string]$Out    = "audit-$(Get-Date -Format yyyyMMdd).json",
    [string]$Model  = "grok-build",
    [string]$Prompt = @"
Audit every controller under src/ for endpoints that lack an authorisation
attribute or middleware. For each, give file, line, route, and why it is
reachable without auth. Report only genuine gaps; say "no findings" if the
codebase is clean. Do not modify any file.
"@
)

if (-not $env:XAI_API_KEY) { Write-Error "XAI_API_KEY is not set"; exit 2 }

Push-Location $Repo
try {
    grok -p $Prompt `
        --sandbox strict `
        --permission-mode dontAsk `
        --tools read,grep,glob `
        --disallowed-tools write,edit,shell `
        --rules "You are read-only. Never modify, create or delete files." `
        -m $Model `
        --output-format json `
        | Set-Content -Path $Out -Encoding utf8

    $code = $LASTEXITCODE
    if ($code -ne 0) { Write-Error "grok exited $code"; exit $code }
    Write-Output "audit written to $Out"
}
finally { Pop-Location }