Emergency Kill Switch

#!/bin/bash
# kill-switch.sh - Emergency agent shutdown

set -e

RED='\033[0;31m'
GREEN='\033[0;32m'
NC='\033[0m'

echo -e "${RED}🔴 EMERGENCY KILL SWITCH ACTIVATED${NC}"
echo ""

# 1. Kill agent processes
echo "Stopping agent processes..."
pkill -f "clawdbot" 2>/dev/null || true
pkill -f "claude" 2>/dev/null || true
pkill -f "opencode" 2>/dev/null || true

# 2. Revoke API tokens (Anthropic example)
if [ -n "$ANTHROPIC_API_KEY" ]; then
  echo "Note: Anthropic keys must be revoked via console.anthropic.com"
fi

# 3. Block outbound (optional - uncomment if needed)
# sudo pfctl -e 2>/dev/null || true
# echo "block out all" | sudo pfctl -f -

# 4. Create incident log
TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
INCIDENT_FILE="$HOME/clawd/memory/incidents/${TIMESTAMP}-kill-switch.md"
mkdir -p "$HOME/clawd/memory/incidents"
cat > "$INCIDENT_FILE" << EOF
# Kill Switch Activated

**Time:** $TIMESTAMP
**Reason:** Manual activation
**Actions taken:**
- Agent processes killed
- Network block: [enabled/disabled]
- API tokens: [manual revocation required]

## Post-Incident
- [ ] Investigate root cause
- [ ] Review audit logs
- [ ] Rotate API keys
- [ ] Resume operations
EOF

echo ""
echo -e "${GREEN}✓ Agent stopped${NC}"
echo -e "${GREEN}✓ Incident logged: $INCIDENT_FILE${NC}"
echo ""
echo "Next steps:"
echo "  1. Check audit logs: ./scripts/audit-verify.sh"
echo "  2. Revoke API keys at provider console"
echo "  3. Investigate what happened"