@agentic-qe/v3 3.0.0-alpha.5 → 3.0.0-alpha.7

package/src/workers/workers/regression-monitor.ts

@@ -1,357 +0,0 @@
-/**
- * Agentic QE v3 - Regression Monitor Worker
- * ADR-014: Background Workers for QE Monitoring
- *
- * Watches for regressions including:
- * - Test result regressions
- * - Performance regressions
- * - Coverage regressions
- * - Quality metric regressions
- */
-
-import { BaseWorker } from '../base-worker';
-import {
-  WorkerConfig,
-  WorkerContext,
-  WorkerResult,
-  WorkerFinding,
-  WorkerRecommendation,
-} from '../interfaces';
-
-const CONFIG: WorkerConfig = {
-  id: 'regression-monitor',
-  name: 'Regression Monitor',
-  description: 'Monitors for regressions in test results, performance, coverage, and quality metrics',
-  intervalMs: 10 * 60 * 1000, // 10 minutes
-  priority: 'high',
-  targetDomains: ['test-execution', 'coverage-analysis', 'quality-assessment'],
-  enabled: true,
-  timeoutMs: 120000,
-  retryCount: 2,
-  retryDelayMs: 10000,
-};
-
-interface MetricSnapshot {
-  timestamp: Date;
-  testPassRate: number;
-  coverage: {
-    line: number;
-    branch: number;
-  };
-  avgTestDuration: number;
-  failedTests: string[];
-  qualityScore: number;
-}
-
-interface RegressionResult {
-  type: 'test' | 'performance' | 'coverage' | 'quality';
-  metric: string;
-  previousValue: number;
-  currentValue: number;
-  changePercent: number;
-  severity: 'critical' | 'high' | 'medium' | 'low';
-  affectedTests?: string[];
-}
-
-export class RegressionMonitorWorker extends BaseWorker {
-  constructor() {
-    super(CONFIG);
-  }
-
-  protected async doExecute(context: WorkerContext): Promise<WorkerResult> {
-    const startTime = Date.now();
-    context.logger.info('Starting regression monitoring');
-
-    const findings: WorkerFinding[] = [];
-    const recommendations: WorkerRecommendation[] = [];
-
-    // Get current snapshot
-    const currentSnapshot = await this.collectCurrentSnapshot(context);
-
-    // Get baseline (previous snapshot)
-    const baseline = await context.memory.get<MetricSnapshot>('regression:baseline');
-
-    // Detect regressions
-    let regressions: RegressionResult[] = [];
-    if (baseline) {
-      regressions = this.detectRegressions(baseline, currentSnapshot);
-      this.analyzeRegressions(regressions, findings, recommendations);
-    }
-
-    // Store current as new baseline
-    await context.memory.set('regression:baseline', currentSnapshot);
-
-    // Store regression history
-    const history = await context.memory.get<RegressionResult[]>('regression:history') || [];
-    if (regressions.length > 0) {
-      history.push(...regressions);
-      // Keep last 100 regressions
-      while (history.length > 100) history.shift();
-      await context.memory.set('regression:history', history);
-    }
-
-    const healthScore = this.calculateHealthScore(regressions);
-
-    context.logger.info('Regression monitoring complete', {
-      healthScore,
-      regressionsDetected: regressions.length,
-    });
-
-    return this.createResult(
-      Date.now() - startTime,
-      {
-        itemsAnalyzed: 5, // Number of metrics checked
-        issuesFound: regressions.length,
-        healthScore,
-        trend: regressions.length > 0 ? 'degrading' : 'stable',
-        domainMetrics: {
-          testPassRate: `${currentSnapshot.testPassRate}%`,
-          lineCoverage: `${currentSnapshot.coverage.line}%`,
-          avgTestDuration: `${currentSnapshot.avgTestDuration}ms`,
-          qualityScore: currentSnapshot.qualityScore,
-          regressionsDetected: regressions.length,
-        },
-      },
-      findings,
-      recommendations
-    );
-  }
-
-  private async collectCurrentSnapshot(_context: WorkerContext): Promise<MetricSnapshot> {
-    // In a real implementation, this would query actual metrics
-    return {
-      timestamp: new Date(),
-      testPassRate: 98.2,
-      coverage: {
-        line: 78.5,
-        branch: 65.2,
-      },
-      avgTestDuration: 245,
-      failedTests: [
-        'test-execution/retry-handler.test.ts::should retry failed tests',
-        'coordination/workflow.test.ts::should handle concurrent workflows',
-      ],
-      qualityScore: 82,
-    };
-  }
-
-  private detectRegressions(
-    baseline: MetricSnapshot,
-    current: MetricSnapshot
-  ): RegressionResult[] {
-    const regressions: RegressionResult[] = [];
-
-    // Test pass rate regression
-    if (current.testPassRate < baseline.testPassRate - 1) {
-      const change = current.testPassRate - baseline.testPassRate;
-      regressions.push({
-        type: 'test',
-        metric: 'testPassRate',
-        previousValue: baseline.testPassRate,
-        currentValue: current.testPassRate,
-        changePercent: change,
-        severity: change < -5 ? 'critical' : change < -2 ? 'high' : 'medium',
-        affectedTests: current.failedTests,
-      });
-    }
-
-    // Coverage regression
-    if (current.coverage.line < baseline.coverage.line - 2) {
-      const change = current.coverage.line - baseline.coverage.line;
-      regressions.push({
-        type: 'coverage',
-        metric: 'lineCoverage',
-        previousValue: baseline.coverage.line,
-        currentValue: current.coverage.line,
-        changePercent: change,
-        severity: change < -5 ? 'high' : 'medium',
-      });
-    }
-
-    if (current.coverage.branch < baseline.coverage.branch - 3) {
-      const change = current.coverage.branch - baseline.coverage.branch;
-      regressions.push({
-        type: 'coverage',
-        metric: 'branchCoverage',
-        previousValue: baseline.coverage.branch,
-        currentValue: current.coverage.branch,
-        changePercent: change,
-        severity: change < -5 ? 'high' : 'medium',
-      });
-    }
-
-    // Performance regression
-    const durationChange = ((current.avgTestDuration - baseline.avgTestDuration) / baseline.avgTestDuration) * 100;
-    if (durationChange > 20) {
-      regressions.push({
-        type: 'performance',
-        metric: 'avgTestDuration',
-        previousValue: baseline.avgTestDuration,
-        currentValue: current.avgTestDuration,
-        changePercent: durationChange,
-        severity: durationChange > 50 ? 'high' : 'medium',
-      });
-    }
-
-    // Quality score regression
-    if (current.qualityScore < baseline.qualityScore - 5) {
-      const change = current.qualityScore - baseline.qualityScore;
-      regressions.push({
-        type: 'quality',
-        metric: 'qualityScore',
-        previousValue: baseline.qualityScore,
-        currentValue: current.qualityScore,
-        changePercent: change,
-        severity: change < -10 ? 'critical' : change < -5 ? 'high' : 'medium',
-      });
-    }
-
-    // New test failures
-    const newFailures = current.failedTests.filter(t => !baseline.failedTests.includes(t));
-    if (newFailures.length > 0) {
-      regressions.push({
-        type: 'test',
-        metric: 'newFailures',
-        previousValue: 0,
-        currentValue: newFailures.length,
-        changePercent: 100,
-        severity: newFailures.length > 5 ? 'critical' : newFailures.length > 2 ? 'high' : 'medium',
-        affectedTests: newFailures,
-      });
-    }
-
-    return regressions;
-  }
-
-  private analyzeRegressions(
-    regressions: RegressionResult[],
-    findings: WorkerFinding[],
-    recommendations: WorkerRecommendation[]
-  ): void {
-    for (const regression of regressions) {
-      const domain = this.getDomainForType(regression.type);
-
-      findings.push({
-        type: `${regression.type}-regression`,
-        severity: regression.severity,
-        domain,
-        title: `${this.formatMetricName(regression.metric)} Regression Detected`,
-        description: this.formatRegressionDescription(regression),
-        context: {
-          previousValue: regression.previousValue,
-          currentValue: regression.currentValue,
-          changePercent: regression.changePercent.toFixed(2),
-          affectedTests: regression.affectedTests,
-        },
-      });
-    }
-
-    // Generate recommendations based on regression types
-    const testRegressions = regressions.filter(r => r.type === 'test');
-    if (testRegressions.length > 0) {
-      const criticalOrHigh = testRegressions.filter(r =>
-        r.severity === 'critical' || r.severity === 'high'
-      );
-
-      if (criticalOrHigh.length > 0) {
-        recommendations.push({
-          priority: 'p0',
-          domain: 'test-execution',
-          action: 'Investigate Test Regressions Immediately',
-          description: `${criticalOrHigh.length} significant test regressions detected. Review recent changes.`,
-          estimatedImpact: 'high',
-          effort: 'medium',
-          autoFixable: false,
-        });
-      }
-    }
-
-    const coverageRegressions = regressions.filter(r => r.type === 'coverage');
-    if (coverageRegressions.length > 0) {
-      recommendations.push({
-        priority: 'p1',
-        domain: 'coverage-analysis',
-        action: 'Address Coverage Regression',
-        description: 'Code coverage has decreased. Add tests for new/changed code.',
-        estimatedImpact: 'medium',
-        effort: 'medium',
-        autoFixable: true,
-      });
-    }
-
-    const performanceRegressions = regressions.filter(r => r.type === 'performance');
-    if (performanceRegressions.length > 0) {
-      recommendations.push({
-        priority: 'p2',
-        domain: 'test-execution',
-        action: 'Investigate Performance Regression',
-        description: 'Test execution has slowed. Review for new slow tests or infrastructure issues.',
-        estimatedImpact: 'medium',
-        effort: 'low',
-        autoFixable: false,
-      });
-    }
-  }
-
-  private getDomainForType(type: string): 'test-execution' | 'coverage-analysis' | 'quality-assessment' {
-    switch (type) {
-      case 'test':
-      case 'performance':
-        return 'test-execution';
-      case 'coverage':
-        return 'coverage-analysis';
-      case 'quality':
-        return 'quality-assessment';
-      default:
-        return 'quality-assessment';
-    }
-  }
-
-  private formatMetricName(metric: string): string {
-    const names: Record<string, string> = {
-      testPassRate: 'Test Pass Rate',
-      lineCoverage: 'Line Coverage',
-      branchCoverage: 'Branch Coverage',
-      avgTestDuration: 'Test Duration',
-      qualityScore: 'Quality Score',
-      newFailures: 'New Test Failures',
-    };
-    return names[metric] || metric;
-  }
-
-  private formatRegressionDescription(regression: RegressionResult): string {
-    if (regression.metric === 'newFailures') {
-      return `${regression.currentValue} new test failures detected since last check`;
-    }
-
-    const direction = regression.changePercent > 0 ? 'increased' : 'decreased';
-    const unit = regression.type === 'performance' ? 'ms' : '%';
-
-    return `${this.formatMetricName(regression.metric)} ${direction} from ${regression.previousValue}${unit} to ${regression.currentValue}${unit} (${regression.changePercent > 0 ? '+' : ''}${regression.changePercent.toFixed(1)}%)`;
-  }
-
-  private calculateHealthScore(regressions: RegressionResult[]): number {
-    if (regressions.length === 0) return 100;
-
-    let score = 100;
-
-    for (const regression of regressions) {
-      switch (regression.severity) {
-        case 'critical':
-          score -= 25;
-          break;
-        case 'high':
-          score -= 15;
-          break;
-        case 'medium':
-          score -= 8;
-          break;
-        case 'low':
-          score -= 3;
-          break;
-      }
-    }
-
-    return Math.max(0, Math.round(score));
-  }
-}

package/src/workers/workers/security-scan.ts

@@ -1,349 +0,0 @@
-/**
- * Agentic QE v3 - Security Scan Worker
- * ADR-014: Background Workers for QE Monitoring
- *
- * Performs security vulnerability scanning including:
- * - Dependency vulnerability checks
- * - Code pattern analysis for security issues
- * - Secret detection
- * - Security configuration validation
- */
-
-import { BaseWorker } from '../base-worker';
-import {
-  WorkerConfig,
-  WorkerContext,
-  WorkerResult,
-  WorkerFinding,
-  WorkerRecommendation,
-} from '../interfaces';
-
-const CONFIG: WorkerConfig = {
-  id: 'security-scan',
-  name: 'Security Vulnerability Scanner',
-  description: 'Scans for security vulnerabilities in dependencies, code patterns, and configurations',
-  intervalMs: 30 * 60 * 1000, // 30 minutes
-  priority: 'critical',
-  targetDomains: ['security-compliance'],
-  enabled: true,
-  timeoutMs: 300000,
-  retryCount: 3,
-  retryDelayMs: 30000,
-};
-
-interface DependencyVulnerability {
-  package: string;
-  version: string;
-  severity: 'critical' | 'high' | 'medium' | 'low';
-  cve: string;
-  title: string;
-  description: string;
-  fixedIn?: string;
-}
-
-interface CodeSecurityIssue {
-  file: string;
-  line: number;
-  rule: string;
-  severity: 'critical' | 'high' | 'medium' | 'low';
-  message: string;
-  category: 'injection' | 'secrets' | 'auth' | 'crypto' | 'config' | 'other';
-}
-
-interface SecurityScanResult {
-  dependencyVulnerabilities: DependencyVulnerability[];
-  codeSecurityIssues: CodeSecurityIssue[];
-  secretsDetected: number;
-  configurationIssues: number;
-  scanDurationMs: number;
-}
-
-export class SecurityScanWorker extends BaseWorker {
-  constructor() {
-    super(CONFIG);
-  }
-
-  protected async doExecute(context: WorkerContext): Promise<WorkerResult> {
-    const startTime = Date.now();
-    context.logger.info('Starting security vulnerability scan');
-
-    const findings: WorkerFinding[] = [];
-    const recommendations: WorkerRecommendation[] = [];
-
-    // Run security scans
-    const scanResult = await this.runSecurityScans(context);
-
-    // Analyze dependency vulnerabilities
-    this.analyzeDependencyVulnerabilities(scanResult.dependencyVulnerabilities, findings, recommendations);
-
-    // Analyze code security issues
-    this.analyzeCodeSecurityIssues(scanResult.codeSecurityIssues, findings, recommendations);
-
-    // Check for secrets
-    if (scanResult.secretsDetected > 0) {
-      this.reportSecretsDetected(scanResult.secretsDetected, findings, recommendations);
-    }
-
-    // Store results
-    await context.memory.set('security:lastScan', scanResult);
-    await context.memory.set('security:lastScanTime', new Date().toISOString());
-
-    const healthScore = this.calculateHealthScore(scanResult);
-    const totalIssues = scanResult.dependencyVulnerabilities.length +
-      scanResult.codeSecurityIssues.length +
-      scanResult.secretsDetected +
-      scanResult.configurationIssues;
-
-    context.logger.info('Security scan complete', {
-      healthScore,
-      totalIssues,
-      criticalIssues: scanResult.dependencyVulnerabilities.filter(v => v.severity === 'critical').length +
-        scanResult.codeSecurityIssues.filter(i => i.severity === 'critical').length,
-    });
-
-    return this.createResult(
-      Date.now() - startTime,
-      {
-        itemsAnalyzed: totalIssues,
-        issuesFound: findings.length,
-        healthScore,
-        trend: 'stable',
-        domainMetrics: {
-          dependencyVulnerabilities: scanResult.dependencyVulnerabilities.length,
-          codeSecurityIssues: scanResult.codeSecurityIssues.length,
-          secretsDetected: scanResult.secretsDetected,
-          configurationIssues: scanResult.configurationIssues,
-          scanDuration: `${scanResult.scanDurationMs}ms`,
-        },
-      },
-      findings,
-      recommendations
-    );
-  }
-
-  private async runSecurityScans(_context: WorkerContext): Promise<SecurityScanResult> {
-    // In a real implementation, this would:
-    // 1. Run npm audit or similar for dependencies
-    // 2. Run static analysis for code issues
-    // 3. Scan for secrets with tools like gitleaks
-    // 4. Check security configurations
-
-    return {
-      dependencyVulnerabilities: [
-        {
-          package: 'lodash',
-          version: '4.17.15',
-          severity: 'high',
-          cve: 'CVE-2021-23337',
-          title: 'Command Injection',
-          description: 'Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.',
-          fixedIn: '4.17.21',
-        },
-        {
-          package: 'minimist',
-          version: '1.2.5',
-          severity: 'critical',
-          cve: 'CVE-2021-44906',
-          title: 'Prototype Pollution',
-          description: 'Prototype pollution vulnerability allows attackers to manipulate JavaScript object prototypes.',
-          fixedIn: '1.2.6',
-        },
-      ],
-      codeSecurityIssues: [
-        {
-          file: 'src/shared/http/http-client.ts',
-          line: 45,
-          rule: 'no-eval',
-          severity: 'high',
-          message: 'Avoid using eval() as it can execute arbitrary code',
-          category: 'injection',
-        },
-        {
-          file: 'src/kernel/memory-backend.ts',
-          line: 122,
-          rule: 'sql-injection',
-          severity: 'medium',
-          message: 'Potential SQL injection - use parameterized queries',
-          category: 'injection',
-        },
-      ],
-      secretsDetected: 0,
-      configurationIssues: 1,
-      scanDurationMs: 2500,
-    };
-  }
-
-  private analyzeDependencyVulnerabilities(
-    vulnerabilities: DependencyVulnerability[],
-    findings: WorkerFinding[],
-    recommendations: WorkerRecommendation[]
-  ): void {
-    const critical = vulnerabilities.filter(v => v.severity === 'critical');
-    const high = vulnerabilities.filter(v => v.severity === 'high');
-
-    for (const vuln of critical) {
-      findings.push({
-        type: 'critical-vulnerability',
-        severity: 'critical',
-        domain: 'security-compliance',
-        title: `Critical Vulnerability in ${vuln.package}`,
-        description: `${vuln.title}: ${vuln.description}`,
-        resource: vuln.package,
-        context: {
-          cve: vuln.cve,
-          currentVersion: vuln.version,
-          fixedIn: vuln.fixedIn,
-        },
-      });
-    }
-
-    for (const vuln of high) {
-      findings.push({
-        type: 'high-vulnerability',
-        severity: 'high',
-        domain: 'security-compliance',
-        title: `High Severity Vulnerability in ${vuln.package}`,
-        description: `${vuln.title}: ${vuln.description}`,
-        resource: vuln.package,
-        context: {
-          cve: vuln.cve,
-          currentVersion: vuln.version,
-          fixedIn: vuln.fixedIn,
-        },
-      });
-    }
-
-    if (critical.length > 0) {
-      recommendations.push({
-        priority: 'p0',
-        domain: 'security-compliance',
-        action: 'Update Critical Vulnerabilities Immediately',
-        description: `${critical.length} packages have critical vulnerabilities. Update immediately to patched versions.`,
-        estimatedImpact: 'high',
-        effort: 'low',
-        autoFixable: true,
-      });
-    }
-
-    if (high.length > 0) {
-      recommendations.push({
-        priority: 'p1',
-        domain: 'security-compliance',
-        action: 'Address High Severity Vulnerabilities',
-        description: `${high.length} packages have high severity vulnerabilities. Plan updates within current sprint.`,
-        estimatedImpact: 'high',
-        effort: 'low',
-        autoFixable: true,
-      });
-    }
-  }
-
-  private analyzeCodeSecurityIssues(
-    issues: CodeSecurityIssue[],
-    findings: WorkerFinding[],
-    recommendations: WorkerRecommendation[]
-  ): void {
-    const byCategory = new Map<string, CodeSecurityIssue[]>();
-
-    for (const issue of issues) {
-      const existing = byCategory.get(issue.category) || [];
-      existing.push(issue);
-      byCategory.set(issue.category, existing);
-    }
-
-    for (const issue of issues) {
-      findings.push({
-        type: `code-security-${issue.category}`,
-        severity: issue.severity,
-        domain: 'security-compliance',
-        title: `Security Issue: ${issue.rule}`,
-        description: issue.message,
-        resource: `${issue.file}:${issue.line}`,
-        context: {
-          rule: issue.rule,
-          category: issue.category,
-        },
-      });
-    }
-
-    // Category-specific recommendations
-    const injectionIssues = byCategory.get('injection') || [];
-    if (injectionIssues.length > 0) {
-      recommendations.push({
-        priority: 'p0',
-        domain: 'security-compliance',
-        action: 'Fix Injection Vulnerabilities',
-        description: `${injectionIssues.length} potential injection vulnerabilities found. Use parameterized queries and avoid eval().`,
-        estimatedImpact: 'high',
-        effort: 'medium',
-        autoFixable: false,
-      });
-    }
-
-    const cryptoIssues = byCategory.get('crypto') || [];
-    if (cryptoIssues.length > 0) {
-      recommendations.push({
-        priority: 'p1',
-        domain: 'security-compliance',
-        action: 'Review Cryptographic Implementations',
-        description: `${cryptoIssues.length} cryptographic issues found. Ensure using secure algorithms and proper key management.`,
-        estimatedImpact: 'high',
-        effort: 'high',
-        autoFixable: false,
-      });
-    }
-  }
-
-  private reportSecretsDetected(
-    count: number,
-    findings: WorkerFinding[],
-    recommendations: WorkerRecommendation[]
-  ): void {
-    findings.push({
-      type: 'secrets-detected',
-      severity: 'critical',
-      domain: 'security-compliance',
-      title: 'Secrets Detected in Codebase',
-      description: `${count} potential secrets/credentials found in source code`,
-      context: { count },
-    });
-
-    recommendations.push({
-      priority: 'p0',
-      domain: 'security-compliance',
-      action: 'Remove Secrets from Codebase',
-      description: 'Immediately rotate any exposed credentials and move them to secure secret management.',
-      estimatedImpact: 'high',
-      effort: 'medium',
-      autoFixable: false,
-    });
-  }
-
-  private calculateHealthScore(result: SecurityScanResult): number {
-    let score = 100;
-
-    // Critical vulnerabilities: -20 each
-    const criticalVulns = result.dependencyVulnerabilities.filter(v => v.severity === 'critical').length;
-    score -= criticalVulns * 20;
-
-    // High vulnerabilities: -10 each
-    const highVulns = result.dependencyVulnerabilities.filter(v => v.severity === 'high').length;
-    score -= highVulns * 10;
-
-    // Critical code issues: -15 each
-    const criticalCode = result.codeSecurityIssues.filter(i => i.severity === 'critical').length;
-    score -= criticalCode * 15;
-
-    // High code issues: -8 each
-    const highCode = result.codeSecurityIssues.filter(i => i.severity === 'high').length;
-    score -= highCode * 8;
-
-    // Secrets: -30 each
-    score -= result.secretsDetected * 30;
-
-    // Config issues: -5 each
-    score -= result.configurationIssues * 5;
-
-    return Math.max(0, Math.round(score));
-  }
-}