refactoring-agent 3.12.2

Security Remediation Agent for Python codebases

cat << 'EOF' > README.md

Refactoring Agent 🛡️

Autonomous Technical Debt & Security Remediation Agent.

Refactoring Agent goes beyond simple linting. It is an infrastructure layer for Continuous Modernization that:

1. Scans legacy code for technical debt and Critical Security Vulnerabilities.
2. Fixes issues automatically using a deterministic Rule Engine and LLMs (OpenAI/Ollama).
3. Protects your codebase with strict CI/CD gates.

"Snyk finds the vulnerability. Refactoring Agent fixes it."

---

🚀 Key Features

🛡️ Security Scanning (New in v3.11)

Proactively hunts for critical vulnerabilities that static linters often miss:

• 🚫 Arbitrary Code Execution: Detects and blocks eval() and exec().
• 🚫 Shell Injection: Flags dangerous os.system() calls.
• 🚫 Safe I/O: Enforces modern input() over insecure legacy alternatives.

Example Output: ```text [ERROR] src/payment_gateway.py:12 Security Risk: usage of eval() detected. This allows arbitrary code execution. [ERROR] src/utils.py:45 Security Risk: usage of os.system() detected. Vulnerable to shell injection. ```

Installation

From PyPI (recommended)

```bash pip install "refactoring-agent>=3.11.1" ```

From source

```bash git clone https://github.com/StasLee1982/refactoring-agent.git cd refactoring-agent

python -m venv .venv source .venv/bin/activate # On Windows: .venv\Scripts\activate

pip install . ```

If you want to hack on the project itself: ```bash pip install -e . pytest -v ```

CLI usage

The main entrypoint is the `refactor-agent` CLI.

1) Basic scan (no AI)

Scan the current repository and fail on critical issues:

```bash refactor-agent check . ```

Typical findings:

• Legacy `raw_input` usage in Python 2 style code.
• Dangerous `eval()`, `exec()` and `os.system()` calls.
• Legacy `print` statements in production code.
• Syntax errors in broken / half‑migrated files.

Exclude additional directories: ```bash refactor-agent check . --exclude "venv,node_modules,dist" ```

Generate an HTML report: ```bash refactor-agent check . --html-report refactoring-report.html ```

2) AI‑powered fixes with OpenAI

Use OpenAI to propose automatic fixes without touching files:

```bash export OPENAI_API_KEY="sk-..." # your key refactor-agent check demo_legacy
--provider openai
--model gpt-4o-mini
--ai-fix
--dry-run ```

What happens:

• `--ai-fix` – ask the LLM to propose patches.
• `--dry-run` – print unified diffs, do not modify files on disk.
• Without `--dry-run`, the patches are applied in place.

You can also pass API key explicitly (useful in CI): ```bash refactor-agent check demo_legacy
--provider openai
--model gpt-4o-mini
--api-key "$OPENAI_API_KEY"
--ai-fix --dry-run ```

3) AI‑powered fixes with Ollama (local LLM)

Run against a local Ollama model:

```bash

Example: llama3 pulled in Ollama beforehand

refactor-agent check demo_legacy
--provider ollama
--model llama3
--ai-fix
--dry-run ```

If your Ollama endpoint is not the default, you can override it: ```bash refactor-agent check demo_legacy
--provider ollama
--model llama3
--base-url http://localhost:11434
--ai-fix --dry-run ```

4) Mock provider for demos and tests

Use the built‑in mock provider to demonstrate the workflow or run tests without calling any real LLM:

```bash refactor-agent check demo_legacy
--provider mock
--ai-fix
--dry-run ``` The mock provider returns a deterministic, safe patch so you can see the end‑to‑end flow of Refactoring Agent in CI and docs.

Configuration

You can configure Refactoring Agent via `pyproject.toml`. Run `refactor-agent init` to generate a config interactively, or add this manually:

```toml [tool.refactoring-agent]

Security strictness: "strict" (fail on risk) or "relaxed" (only warn)

security_level = "strict"

How to handle legacy print statements: "error", "warn", or "ignore"

legacy_print = "warn"

AI Provider settings (optional, can also be set via env vars)

ai_provider = "openai" ai_model = "gpt-4o-mini" ```

Option	Values	Description
`security_level`	`strict`, `relaxed`	`strict` makes CI fail if dangerous code (e.g., `eval`, `os.system`) is found.
`legacy_print`	`error`, `warn`, `ignore`	Controls whether Python 2 style prints fail the build or just emit a warning.

GitHub Action example

You can run Refactoring Agent on every push / pull request as part of your security and modernization gate.

Option A – plain CLI in a workflow

```yaml name: Security & Legacy Scan on: push: branches: [ main ] pull_request:

jobs: refactoring-agent: runs-on: ubuntu-latest

steps:
  - name: Checkout
    uses: actions/checkout@v4

  - name: Setup Python
    uses: actions/setup-python@v5
    with:
      python-version: "3.11"

  - name: Install Refactoring Agent
    run: |
      python -m pip install --upgrade pip
      pip install "refactoring-agent>=3.11.1"

  - name: Run Refactoring Agent (AI dry-run)
    env:
      OPENAI_API_KEY: \${{ secrets.OPENAI_API_KEY }}
    run: |
      refactor-agent check . \
        --provider openai \
        --model gpt-4o-mini \
        --ai-fix \
        --dry-run \
        --html-report refactoring-report.html

  - name: Upload HTML report
    uses: actions/upload-artifact@v4
    with:
      name: refactoring-agent-report
      path: refactoring-report.html

```

Option B – using the bundled Action (this repo)

If you publish `action.yml` in this repository, you can also wire it like this:

```yaml jobs: refactoring-agent: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4

  - name: Run Refactoring Agent Action
    uses: StasLee1982/refactoring-agent@v3.11.1
    with:
      # Adapt these inputs to match your action.yml
      path: .
      args: "--html-report refactoring-report.html --provider openai --ai-fix --dry-run"
      api_key: \${{ secrets.OPENAI_API_KEY }}

``` EOF