feat(challenges): add AI coding-agent transcript challenge

[kekubhai]

What kind of changes does this PR include?

• Fixes or refactors
• A new challenge
• Additional documentation
• Something else

Description

Adds Challenge 71 for the AI category, demonstrating how sensitive information can persist inside an AI coding-agent session transcript.

The transcript was generated from a genuine OpenAI Codex CLI session during a debugging task involving a fake staging deployment token. The captured transcript contains realistic session metadata, commands, tool calls, outputs, errors, and agent reasoning.

The challenge requires finding the leaked secret from the persistent agent transcript rather than directly from the original .env file.

Also updates the challenge category configuration from ai_other_tech to ai and adds the Challenge 71 configuration and tests.

Relations

Closes #2657

References

The transcript was generated using OpenAI Codex CLI and preserved as the captured session artifact rather than being manually authored.

Checklist:

• All the contributions made are solely the work of me and my co-authors
• I used AI to generate parts of the content.
• I tested the changes in this PR (if applicable)
• I added unit tests to ensure my change works (when change in Java or on front-end code)
• I added UI tests to ensure my UI changes work (when change in the overall UI, not needed if just adding a challenge)
• The PR passes pre-commit hooks and automated tests

[commjoen]

Hi @kekubhai ! thank you for another challenge! Can you please:

• rename the challenge to 72, as 71 is assigned to feat(docker): introduce Java 26 dev/build container and build-secret challenge 71 #2650
• fix the failing actions
  and then i can have another go over the files (probably next week)

[kekubhai]

Sure, thanks! I’ll rename the challenge to 72 and fix the failing actions. I’ll update the related files and references consistently and let you know once it’s ready for another review.

[kekubhai]

Updated the challenge from 71 → 72 and fixed the failing CI issue. I’ve committed the changes and verified the related references and resource paths are consistent.

Ready for another review. Thanks!

[commjoen]

can you update the css file to include this div for rendering, similar to the other challenge divs?

[commjoen]

@kekubhai can you please add https://staging.internal.wrongsecrets.example.com/ to the ignore list of our dead link checker? that would be in https://github.com/OWASP/wrongsecrets/blob/master/.lycheeignore

[commjoen]

It looks like https://github.com/OWASP/wrongsecrets/actions/runs/35295861096/job/105448131045?pr=2660 is failing, can you have a look please?

[kekubhai]

i will look into that just now

[kekubhai]

Fixed the requested items:

• Added the Challenge 72 container styling to dark.css, following the existing challenge patterns.
• Added staging.internal.wrongsecrets.example.com to .lycheeignore.
• Fixed the Thymeleaf expression in challenge-72.snippet that was causing the Maven test failure due to nested ${} syntax.

The CI failure was traced to that Thymeleaf expression; Challenges 69/70 use the same correct expression pattern.

I couldn’t reproduce the Maven tests locally because the environment is missing a JDK, but the failing expression has been corrected to match the known-working pattern used by the neighboring challenges.

I’ll push the changes and let CI verify the full workflow.

[commjoen]

@kekubhai have you tried our devcontainers for fixing the tests? see https://github.com/OWASP/wrongsecrets/blob/master/CONTRIBUTING.md#1-open-in-dev-container it also works in intellij :)

[kekubhai]

I also ran the test suite inside the project's devcontainer as suggested.

The Challenge 72 tests pass. Overall, 301 tests ran with 1 failure and 3 errors, all from existing infrastructure-dependent tests:

• Challenge 64 — requires Docker
• Challenges 44/45 — require a Kubernetes cluster
• Cypress integration — requires Docker + Cypress

None are related to Challenge 72 or the changes in this PR.

I also couldn't reproduce the Visual Template Diff locally because it requires Docker/Playwright. The current CI failure is the HttpError: Resource not accessible by integration from the visual-diff workflow.

So the Challenge 72 implementation is verified in the project's devcontainer; the remaining failures are environment/CI infrastructure related.