cloudsecurity-af/agentfield-package.yaml at main · Agent-Field/cloudsecurity-af · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
config_version: v1            # manifest schema version (omit = legacy v0)
name: cloudsecurity-af
version: 0.1.0
description: Cloud security posture agent node (read-only scans of AWS/GCP/Azure)
author: Agent-Field

# The Go node in go/ is the maintained CloudSecurity node: same reasoners, same
# interface, one static binary, no per-node venv to build. Installing this repo
# installs that instead — so
# `af install https://github.com/Agent-Field/cloudsecurity-af` is the one thing a
# user has to know, before and after the switch.
#
# go/ declares this same name deliberately, so the switch is a replacement in
# place: same node id, same triggers, node-scoped secrets kept. Only one of the
# two can be installed at a time, which is the point.
#
# This manifest stays here as the redirect, so the Python node is still what
# `python -m cloudsecurity_af.app` and docker-compose run. The redirect is a
# git-install behaviour only: to install this node deliberately, clone the repo
# and install the checkout as a local path.
superseded_by: https://github.com/Agent-Field/cloudsecurity-af//go

entrypoint:
  start: python -m cloudsecurity_af.app
  healthcheck: /health

agent_node:
  # `cloudsecurity`, not `cloudsecurity-af`: src/cloudsecurity_af/app.py uses
  # `NODE_ID = os.getenv("NODE_ID", "cloudsecurity")`, so that is the id the
  # process registers and reports on /health, and every reasoner target in
  # reasoners/phases.py and orchestrator.py is f"{NODE_ID}.<reasoner>".
  # `af run` compares the manifest's node_id against /health's node_id and
  # kills the process when they differ, so the stale `cloudsecurity-af` broke
  # the local-path install documented above.
  node_id: cloudsecurity
  default_port: 8005

user_environment:
  required:
    - name: OPENROUTER_API_KEY
      description: LLM provider key (OpenRouter)
      type: secret
      scope: global
  optional:
    - name: AGENTFIELD_SERVER
      description: Control-plane URL
      default: http://localhost:8080
    - name: AGENTFIELD_API_KEY
      description: Control-plane API key (if auth is enabled)
      type: secret
      scope: global
    - name: HARNESS_PROVIDER
      description: Coding-agent harness provider (aforge by default; opencode for rollback)
      default: aforge
    - name: AGENTFIELD_AFORGE_COMMAND
      description: AForge headless command
      default: exec
    - name: CLOUDSECURITY_AFORGE_BIN
      description: Optional path to the AForge binary (defaults to aforge on PATH)
    - name: HARNESS_MODEL
      description: Model the harness uses
      default: deepseek/deepseek-v4-flash-0731
    - name: AI_MODEL
      description: Model for direct AI calls
      default: deepseek/deepseek-v4-flash-0731
    - name: AWS_ACCESS_KEY_ID
      description: AWS access key for read-only scanning
      type: secret
      scope: node
    - name: AWS_SECRET_ACCESS_KEY
      description: AWS secret key for read-only scanning
      type: secret
      scope: node
    - name: AWS_DEFAULT_REGION
      description: Default AWS region to scan
      default: us-east-1