n8n-pilot: Command for Claude Code

Security Dialogs — Deep Credential Scan

Purpose: Use AI agent to analyze dialog files for context-dependent credentials that regex cannot detect.

When to use:

• Before creating GitHub release (paranoia mode)
• When bash cleanup found credentials and you want deeper analysis
• Manual security audit of dialog history
• Suspected credential leak in conversations

---

Implementation

Step 0: Check Why Agent Was Invoked

This command can be invoked in two ways:

1. Manual: User types /security-dialogs
2. Automatic: Triggered by security/auto-invoke-agent.sh based on risk triggers

echo ""
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo "🔒 Security Dialogs — Deep AI Credential Scan"
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo ""

# Check if auto-invoked (environment variables set by auto-invoke-agent.sh)
if [ -n "$DEEP_SCAN_TRIGGER_LEVEL" ]; then
  echo "🤖 Auto-invoked due to: $DEEP_SCAN_TRIGGER_LEVEL trigger level"
  echo ""
  echo "Trigger reasons:"
  echo "$DEEP_SCAN_TRIGGER_REASONS" | grep -o '"reasons": *\[[^]]*\]' | sed 's/.*\[\(.*\)\].*/\1/' | tr ',' '\n' | sed 's/^ *"/  • /' | sed 's/"$//'
  echo ""
else
  echo "🔍 Manual deep scan requested by user"
  echo ""
fi

Step 1: Run Regex Cleanup First

# Layer 1-3: Run standard bash cleanup (if not already run)
if [ ! -f "security/reports/"*"cleanup-report"* ] || [ -z "$CLEANUP_EXIT" ]; then
  echo "Step 1: Running regex-based cleanup (fast)..."
  bash security/cleanup-dialogs.sh --last
  REGEX_EXIT_CODE=$?

  if [ $REGEX_EXIT_CODE -eq 0 ]; then
    echo "✓ Regex cleanup: No credentials detected"
  else
    echo "⚠️  Regex cleanup: Credentials found and redacted"
  fi
else
  echo "Step 1: Regex cleanup already completed"
  REGEX_EXIT_CODE=$CLEANUP_EXIT
fi

echo ""

Step 2: Identify Sprint Changes to Analyze

Key principle: Analyze ONLY changes from current sprint, not entire codebase.

echo "Step 2: Identifying sprint changes for deep scan..."
echo ""

# 1. Get last dialog (current session)
LAST_DIALOG=$(find dialog -name "*.md" 2>/dev/null | sort -r | head -1)

if [ -z "$LAST_DIALOG" ]; then
  echo "⚠️  No dialog files found"
  exit 0
fi

DIALOG_SIZE=$(du -h "$LAST_DIALOG" | awk '{print $1}')
echo "  • Dialog: $(basename $LAST_DIALOG) ($DIALOG_SIZE)"

# 2. Get git diff (changed files in sprint)
CHANGED_FILES=$(git diff --name-only HEAD~5..HEAD 2>/dev/null)
CHANGED_COUNT=$(echo "$CHANGED_FILES" | grep -v '^$' | wc -l | tr -d ' ')

if [ "$CHANGED_COUNT" -gt 0 ]; then
  echo "  • Changed files: $CHANGED_COUNT files in last 5 commits"

  # Show file types for context
  echo "$CHANGED_FILES" | grep '\.' | sed 's/.*\.//' | sort | uniq -c | while read count ext; do
    echo "    - $count .$ext files"
  done
else
  echo "  • Changed files: No git changes detected"
fi

echo ""
echo "Scope: Sprint changes only (NOT entire codebase)"
echo ""