Cursor Cloud Agents (formerly Background Agents): CI Gates That Catch Hallucinated AWS Changes

"""Bound what an agent PR may touch. Usage: blast_radius.py <base-ref> [label ...]"""
import fnmatch
import subprocess
import sys

MAX_FILES = 25
NEEDS_HUMAN = {                                   # path pattern -> label a human must add
    "infra/*": "infra-approved",
    ".github/workflows/*": "ci-approved",
    "ci/*": "ci-approved",
}
NEVER = ["*/generated/*", "*.pem", ".env*"]


def changed_files(base: str) -> list[str]:
    out = subprocess.run(["git", "diff", "--name-only", f"{base}...HEAD"],
                         capture_output=True, text=True, check=True).stdout
    return [f for f in out.splitlines() if f]


def check(files: list[str], labels: set[str]) -> list[str]:
    errors = []
    if len(files) > MAX_FILES:
        errors.append(f"{len(files)} files changed (max {MAX_FILES}); split the PR into layers")
    for f in files:
        if any(fnmatch.fnmatch(f, pat) for pat in NEVER):
            errors.append(f"{f}: agents may not change this path")
        for pat, label in NEEDS_HUMAN.items():
            if fnmatch.fnmatch(f, pat) and label not in labels:
                errors.append(f"{f}: needs label '{label}' from a human reviewer")
    lock_changed = any(f.endswith(("package-lock.json", "pnpm-lock.yaml")) for f in files)
    if lock_changed and not any(f.endswith("package.json") for f in files):
        errors.append("lockfile changed without a package.json change")
    return errors


if __name__ == "__main__":
    errors = check(changed_files(sys.argv[1]), set(sys.argv[2:]))
    print("\n".join(errors) or "blast_radius: OK")
    sys.exit(1 if errors else 0)

$ python ci/blast_radius.py main
infra/lib/s.ts: needs label 'infra-approved' from a human reviewer
lockfile changed without a package.json change
$ python ci/blast_radius.py main infra-approved
lockfile changed without a package.json change

# Agent PRs touching these paths need a platform reviewer (enable "Require review from Code Owners").
/infra/              @acme/platform
/.github/workflows/  @acme/platform
/ci/                 @acme/platform

lib/hallucinated.ts(7,10): error TS2339: Property 'grantMagic' does not exist on type 'Bucket'.

import { Stack, StackProps, Duration } from "aws-cdk-lib";
import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
import * as iam from "aws-cdk-lib/aws-iam";
import * as lambda from "aws-cdk-lib/aws-lambda";
import { Construct } from "constructs";

export interface OrdersStackProps extends StackProps { agentVariant?: boolean }

export class OrdersStack extends Stack {
  constructor(scope: Construct, id: string, props: OrdersStackProps = {}) {
    super(scope, id, props);
    const table = new dynamodb.Table(this, "Orders", {
      partitionKey: { name: "pk", type: dynamodb.AttributeType.STRING },
      billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
    });
    const fn = new lambda.Function(this, "GetOrder", {
      runtime: lambda.Runtime.PYTHON_3_12, handler: "index.handler",
      code: lambda.Code.fromInline("def handler(e, c):\n    return {}"),
      timeout: Duration.seconds(5),
    });
    table.grantReadData(fn);                       // least privilege: scoped to this table

    if (props.agentVariant) {
      // What an agent writes "to unblock" a failing deploy:
      fn.addToRolePolicy(new iam.PolicyStatement({ actions: ["*"], resources: ["*"] }));
      fn.role!.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName("AdministratorAccess"));
    }
  }
}

E3006 Resource type 'AWS::Lambda::FunctionCache' does not exist in 'us-east-1'
E3030 'python3.99' is not one of ['dotnet10', 'dotnet6', ... 'python3.12', 'python3.13', ...]

"""Fail agent PRs on AI-shaped AWS mistakes in synthesized CloudFormation (cdk.out/*.template.json)."""
import glob
import json
import sys

ALLOWED_TYPES = {
    "AWS::CDK::Metadata", "AWS::DynamoDB::Table", "AWS::IAM::Role", "AWS::IAM::Policy",
    "AWS::Lambda::Function", "AWS::Logs::LogGroup", "AWS::SQS::Queue", "AWS::S3::Bucket",
    "AWS::S3::BucketPolicy", "AWS::EC2::SecurityGroup",
}
ADMIN_POLICIES = ("AdministratorAccess", "PowerUserAccess", "IAMFullAccess")


def as_list(x):
    return x if isinstance(x, list) else [x]


def flat(x) -> str:
    return json.dumps(x)                            # Fn::Join / Ref structures searched as text


def check_statements(rid, statements, hits):
    for st in as_list(statements):
        if st.get("Effect") != "Allow":
            continue
        actions = [a for a in as_list(st.get("Action", [])) if isinstance(a, str)]
        resources = as_list(st.get("Resource", []))
        if any(a == "*" or a.endswith(":*") for a in actions):
            hits.append(f"{rid}: wildcard action {actions}")
        if "*" in resources and any(not a.endswith(("Describe*", "List*", "Get*")) for a in actions):
            hits.append(f"{rid}: Resource '*' with {actions}")
        if flat(st.get("Principal", "")) in ('"*"', '{"AWS": "*"}'):
            hits.append(f"{rid}: Principal '*'")


def scan(template: dict) -> list[str]:
    hits = []
    for rid, res in template.get("Resources", {}).items():
        rtype, props = res.get("Type", ""), res.get("Properties", {})
        if rtype not in ALLOWED_TYPES:
            hits.append(f"{rid}: resource type {rtype} needs human review")
        if rtype in ("AWS::IAM::Policy", "AWS::IAM::ManagedPolicy", "AWS::S3::BucketPolicy"):
            check_statements(rid, props.get("PolicyDocument", {}).get("Statement", []), hits)
        if rtype == "AWS::IAM::Role":
            for pol in props.get("Policies", []):
                check_statements(rid, pol["PolicyDocument"].get("Statement", []), hits)
            for arn in props.get("ManagedPolicyArns", []):
                if any(f"policy/{name}" in flat(arn) for name in ADMIN_POLICIES):
                    hits.append(f"{rid}: managed policy {flat(arn)}")
        if rtype == "AWS::EC2::SecurityGroup":
            for rule in props.get("SecurityGroupIngress", []):
                if rule.get("CidrIp") == "0.0.0.0/0" or rule.get("CidrIpv6") == "::/0":
                    if rule.get("FromPort") not in (80, 443):
                        hits.append(f"{rid}: world-open ingress on port {rule.get('FromPort')}")
    return hits


if __name__ == "__main__":
    out_dir = sys.argv[1] if len(sys.argv) > 1 else "cdk.out"
    hits = []
    for path in glob.glob(f"{out_dir}/*.template.json"):
        hits += [f"{path} :: {h}" for h in scan(json.load(open(path)))]
    print("\n".join(hits) or "template_gate: OK")
    sys.exit(1 if hits else 0)

$ python ci/template_gate.py infra/out-good
template_gate: OK
$ python ci/template_gate.py infra/out-bad
Orders.template.json :: GetOrderServiceRoleD549F451: managed policy {"Fn::Join": ["", ["arn:", {"Ref": "AWS::Partition"}, ":iam::aws:policy/AdministratorAccess"]]}
Orders.template.json :: GetOrderServiceRoleDefaultPolicy9E15AD89: wildcard action ['*']
Orders.template.json :: GetOrderServiceRoleDefaultPolicy9E15AD89: Resource '*' with ['*']

name: agent-pr-gates
on:
  pull_request:
    types: [opened, synchronize, reopened, labeled]
permissions:
  contents: read
jobs:
  gates:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Blast radius
        env:
          BASE: ${{ github.base_ref }}
          LABELS: ${{ join(github.event.pull_request.labels.*.name, ' ') }}
        run: python ci/blast_radius.py "origin/$BASE" $LABELS
      - name: Typecheck and synth (no AWS credentials in this job)
        working-directory: infra
        run: |
          npm ci
          npx tsc -p .
          npx cdk synth -q -o cdk.out
      - name: CloudFormation lint
        run: |
          pip install cfn-lint
          cfn-lint --non-zero-exit-code error infra/cdk.out/*.template.json
      - name: AWS-shaped mistakes
        run: python ci/template_gate.py infra/cdk.out

---
description: AWS CDK changes in infra/
globs: infra/**/*.ts
alwaysApply: false
---
- Use grant methods on the resource (table.grantReadData(fn)); never actions "*" or resources "*".
- Never attach AdministratorAccess, PowerUserAccess or IAMFullAccess.
- Do not hard-code account IDs or regions; use Stack.of(this).account / .region.
- Only use constructs and methods that exist in the installed aws-cdk-lib; run `npx tsc -p infra` to check.
- Before finishing, run: cd infra && npx tsc -p . && npx cdk synth -q && python ../ci/template_gate.py cdk.out
- Changes under infra/ need a human label; say so in the PR description instead of working around it.

// New API lands first; the old export stays as a thin adapter until every caller has moved.
export interface Session { userId: string; expiresAt: Date }

export function getSession(token: string): Session {
  return { userId: token.slice(0, 8), expiresAt: new Date(Date.now() + 3_600_000) };
}

/** @deprecated Use getSession(). Removed in a separate PR once no callers remain. */
export function getUser(token: string): { id: string } {
  return { id: getSession(token).userId };
}