@arcadialdev/arcality 2.4.24 → 2.4.26

package/tests/_helpers/agentic-runner.bundle.spec.js

@@ -303,6 +303,113 @@ var qaAdvancedTools = [
   scrollPageTool
 ];
 
+// tests/_helpers/qa-security-tools.ts
+async function audit_http_headers(page) {
+  console.log(`[QA-SEC] Auditing HTTP Headers for: ${page.url()}`);
+  const response = await page.reload({ waitUntil: "domcontentloaded" });
+  const headers = response?.headers();
+  const vulnerabilities = [];
+  const securityHeaders = {
+    "Content-Security-Policy": {
+      severity: "Medium",
+      remediation: "Implement a strict Content-Security-Policy (CSP) to mitigate XSS and other injection attacks. Start with a restrictive policy and gradually allow trusted sources.",
+      impact: "If an injection issue exists elsewhere in the application, the lack of CSP may increase exploitability and impact.",
+      cwe: "CWE-16"
+    },
+    "Strict-Transport-Security": {
+      severity: "Medium",
+      remediation: "Implement HTTP Strict Transport Security (HSTS) to force browsers to communicate over HTTPS, preventing downgrade attacks.",
+      impact: "Man-in-the-middle attacks could downgrade the connection to HTTP, allowing traffic interception.",
+      cwe: "CWE-319"
+    },
+    "X-Content-Type-Options": {
+      severity: "Low",
+      remediation: "Set `X-Content-Type-Options: nosniff` to prevent browsers from MIME-sniffing a response away from the declared content-type.",
+      impact: "Browsers may interpret non-executable MIME types as executable, leading to potential XSS.",
+      cwe: "CWE-430"
+    },
+    "X-Frame-Options": {
+      severity: "Medium",
+      remediation: "Set `X-Frame-Options: SAMEORIGIN` or `DENY` to protect against clickjacking attacks by preventing the page from being loaded in an iframe on other domains.",
+      impact: "Attackers could trick users into clicking visually hidden elements, causing unintended actions (Clickjacking).",
+      cwe: "CWE-1021"
+    }
+  };
+  for (const [header, info] of Object.entries(securityHeaders)) {
+    if (!headers || !Object.keys(headers).find((h) => h.toLowerCase() === header.toLowerCase())) {
+      vulnerabilities.push({
+        type: "security_misconfiguration",
+        category: "Missing Security Header",
+        subcategory: header,
+        severity: info.severity,
+        confidence: "High",
+        exploitability: "not_confirmed",
+        status: "detected",
+        description: `The '${header}' HTTP header is missing. This header is crucial for defending against various web attacks.`,
+        impact: info.impact,
+        evidence: {
+          url: page.url(),
+          missingHeader: header
+        },
+        reproductionSteps: [
+          `Navigate to ${page.url()}`,
+          `Inspect the response headers.`,
+          `Verify that ${header} is absent.`
+        ],
+        remediation: info.remediation,
+        classification: {
+          owaspTop10: "A05:2021 Security Misconfiguration",
+          cwe: info.cwe
+        }
+      });
+    }
+  }
+  console.log(`[QA-SEC] Found ${vulnerabilities.length} missing security headers.`);
+  return vulnerabilities;
+}
+async function scan_sensitive_data_exposure(page) {
+  console.log(`[QA-SEC] Scanning localStorage and sessionStorage for sensitive data.`);
+  const vulnerabilities = [];
+  const sensitiveKeywords = ["token", "password", "secret", "key", "jwt", "auth"];
+  const storages = {
+    localStorage: await page.evaluate(() => Object.entries(window.localStorage)),
+    sessionStorage: await page.evaluate(() => Object.entries(window.sessionStorage))
+  };
+  for (const [storageType, items] of Object.entries(storages)) {
+    for (const [key, value] of items) {
+      if (sensitiveKeywords.some((keyword) => key.toLowerCase().includes(keyword))) {
+        vulnerabilities.push({
+          type: "potential_issue",
+          category: "Sensitive Data Exposure",
+          subcategory: "Browser Storage",
+          severity: "Medium",
+          confidence: "Medium",
+          exploitability: "unknown",
+          status: "detected",
+          description: `Potentially sensitive data was found in ${storageType}. Storing sensitive information like tokens or keys in browser storage is insecure.`,
+          impact: "If an attacker discovers an XSS vulnerability, they can read localStorage/sessionStorage and exfiltrate secrets.",
+          evidence: {
+            storage: storageType,
+            key,
+            valuePreview: value ? `${value.substring(0, 10)}...` : "(empty)"
+          },
+          reproductionSteps: [
+            `Open Developer Tools on ${page.url()}`,
+            `Check ${storageType} for the key '${key}'.`
+          ],
+          remediation: "Avoid storing sensitive data in browser storage. Use secure, HttpOnly cookies for session tokens. If you must store data, encrypt it first.",
+          classification: {
+            owaspTop10: "A04:2021 Insecure Design",
+            cwe: "CWE-312"
+          }
+        });
+      }
+    }
+  }
+  console.log(`[QA-SEC] Found ${vulnerabilities.length} instances of sensitive data in browser storage.`);
+  return vulnerabilities;
+}
+
 // tests/_helpers/ai-agent-helper.ts
 var fs = __toESM(require("fs"));
 var path = __toESM(require("path"));
@@ -637,6 +744,41 @@ async function getKnownFieldIdentifiers(pathUrl) {
 }
 
 // tests/_helpers/ai-agent-helper.ts
+var qaSecurityTools = [
+  {
+    name: "test_xss_injection",
+    description: "Injects a standard XSS payload into an input field to test for reflected XSS vulnerabilities. Reports a vulnerability if an alert is triggered.",
+    parameters: {
+      type: "object",
+      properties: {
+        selector: { type: "string", description: "The CSS selector of the input field to test." }
+      },
+      required: ["selector"]
+    }
+  },
+  {
+    name: "test_auth_bypass",
+    description: "Attempts to directly navigate to a URL that should be protected to check for authentication bypass vulnerabilities.",
+    parameters: {
+      type: "object",
+      properties: {
+        url: { type: "string", description: "The protected URL to test." },
+        redirectUrl: { type: "string", description: "The expected URL to be redirected to if unauthorized (e.g., '/login')." }
+      },
+      required: ["url", "redirectUrl"]
+    }
+  },
+  {
+    name: "audit_http_headers",
+    description: "Audits the current page's HTTP response headers for common security headers like CSP, HSTS, etc.",
+    parameters: { type: "object", properties: {} }
+  },
+  {
+    name: "scan_sensitive_data_exposure",
+    description: "Scans localStorage and sessionStorage for keys that might contain sensitive data (e.g., 'token', 'password').",
+    parameters: { type: "object", properties: {} }
+  }
+];
 var _sessionFieldCache = /* @__PURE__ */ new Set();
 var AIAgentHelper = class {
   page;
@@ -981,8 +1123,9 @@ ${relevantFailures.map((m) => `- ${m.prompt}`).join("\n")}
         }
         const memStep = m.steps_data[historyLength];
         if (!memStep) return false;
-        const memUrl = (memStep.url || "").split("?")[0];
-        const currUrl = currentUrl.split("?")[0];
+        const normalizeUrl = (u) => u.replace(/\/[a-z]{2}-[A-Z]{2}\//g, "/{locale}/").replace(/\/[a-z]{2}\//g, "/{lang}/");
+        const memUrl = normalizeUrl((memStep.url || "").split("?")[0]);
+        const currUrl = normalizeUrl(currentUrl.split("?")[0]);
         if (memUrl !== currUrl) return false;
         const foundComponent = state.components.find((c) => {
           const cleanMemName = (memStep.componentName || "").replace(/\[.*?\]/g, "").replace(/\(.*?\)/g, "").trim().toLowerCase();
@@ -1030,7 +1173,7 @@ ${relevantFailures.map((m) => `- ${m.prompt}`).join("\n")}
     }
     return null;
   }
-  async askIA(prompt, history = []) {
+  async askIA(prompt, history = [], stepCount) {
     if (!process.env.ARCALITY_API_URL && !process.env.ANTHROPIC_API_KEY) {
       throw new Error("ANTHROPIC_API_KEY missing and ARCALITY_API_URL not configured");
     }
@@ -1115,6 +1258,11 @@ ${relevantFailures.map((m) => `- ${m.prompt}`).join("\n")}
         name: t.name,
         description: t.description,
         parameters: t.input_schema || t.parameters
+      })),
+      ...qaSecurityTools.map((t) => ({
+        name: t.name,
+        description: t.description,
+        parameters: t.input_schema || t.parameters
       }))
     ];
     const credentialsContext = process.env.LOGIN_USER && process.env.LOGIN_PASSWORD ? `
@@ -1304,12 +1452,15 @@ ${history.slice(-25).join("\n") || "None"}`
       while (true) {
         const isProxyMode = !!process.env.ARCALITY_API_URL;
         const endpointUrl = isProxyMode ? `${process.env.ARCALITY_API_URL}/api/v1/ai/proxy` : "https://api.anthropic.com/v1/messages";
-        console.log(`>>ARCALITY_STATUS>> \u{1F4E1} Llamando a: ${endpointUrl} (turno ${turn + 1})`);
+        const displayTurn = stepCount !== void 0 ? stepCount : turn + 1;
+        console.log(`>>ARCALITY_STATUS>> \u{1F4E1} Llamando a: ${endpointUrl} (turno IA ${displayTurn}${turn > 0 ? `, reintento ${turn}` : ""})`);
         const headers = {
           "Content-Type": "application/json"
         };
         if (isProxyMode) {
           headers["x-api-key"] = process.env.ARCALITY_API_KEY || "";
+          const missionId = process.env.ARCALITY_MISSION_ID || "";
+          if (missionId) headers["x-mission-id"] = missionId;
         } else {
           headers["x-api-key"] = process.env.ANTHROPIC_API_KEY;
           headers["anthropic-version"] = "2023-06-01";
@@ -1610,6 +1761,73 @@ ${history.slice(-25).join("\n") || "None"}`
               toolResults.push({ type: "tool_result", tool_use_id: toolUse.id, content: `Error restoring checkpoint: ${e.message}` });
             }
           }
+        } else if (toolName === "test_xss_injection") {
+          const { idx, payload_type } = toolInput;
+          const el = state.components.find((c) => c.idx === idx);
+          if (!el) {
+            toolResults.push({ type: "tool_result", tool_use_id: toolUse.id, content: `Element idx ${idx} not found.` });
+          } else {
+            console.log(`>>ARCALITY_STATUS>> \u{1F6E1}\uFE0F [Security] Probando inyecci\xF3n XSS en IDX ${idx}...`);
+            let payload = "<script>alert(1)</script>";
+            if (payload_type === "image") payload = "<img src=x onerror=alert(1)>";
+            if (payload_type === "svg") payload = "<svg onload=alert(1)>";
+            try {
+              const locator = this.page.locator(`xpath=${el.selector}`).first();
+              await locator.fill(payload);
+              toolResults.push({ type: "tool_result", tool_use_id: toolUse.id, content: `Payload inyectado. Aseg\xFArate de probar si el payload fue ejecutado revisando el DOM, o realiza el sumbit y observa si el input regres\xF3 renderizado tal cual o sanitizado.` });
+              if (this.testInfo) this.testInfo.attach("security_tool_call", { body: JSON.stringify({ action: "test_xss_injection", target: idx, payload }), contentType: "application/json" });
+            } catch (e) {
+              toolResults.push({ type: "tool_result", tool_use_id: toolUse.id, content: `Error injecting payload: ${e.message}` });
+            }
+          }
+        } else if (toolName === "test_auth_bypass") {
+          const { target_url } = toolInput;
+          console.log(`>>ARCALITY_STATUS>> \u{1F6E1}\uFE0F [Security] Intentando Auth Bypass en ${target_url}...`);
+          try {
+            const baseUrl = new URL(this.page.url()).origin;
+            const fullUrl = new URL(target_url, baseUrl).toString();
+            await this.page.goto(fullUrl);
+            await this.page.waitForLoadState("networkidle", { timeout: 3e3 }).catch(() => {
+            });
+            const resultingUrl = this.page.url();
+            let resultData = `Navegado a ${fullUrl}. 
+URL resultante: ${resultingUrl}. 
+`;
+            if (resultingUrl !== fullUrl) resultData += `Posiblemente redirigido (el bypass fall\xF3 o te enviaron a Login).`;
+            else resultData += `URL se mantuvo igual. \xA1Esto podr\xEDa ser un IDOR o Auth Bypass si ves datos a los que no deber\xEDas acceder!`;
+            toolResults.push({ type: "tool_result", tool_use_id: toolUse.id, content: resultData });
+          } catch (e) {
+            toolResults.push({ type: "tool_result", tool_use_id: toolUse.id, content: `Error test_auth_bypass: ${e.message}` });
+          }
+        } else if (toolName === "scan_sensitive_data_exposure") {
+          console.log(`>>ARCALITY_STATUS>> \u{1F6E1}\uFE0F [Security] Escaneando datos sensibles...`);
+          try {
+            const issues = await scan_sensitive_data_exposure(this.page);
+            if (issues.length > 0) {
+              const report = issues.map((i) => `- ${i.category}: ${i.description}
+  Evidence: ${JSON.stringify(i.evidence)}`).join("\n");
+              toolResults.push({ type: "tool_result", tool_use_id: toolUse.id, content: `Vulnerabilidades detectadas:
+${report}` });
+            } else {
+              toolResults.push({ type: "tool_result", tool_use_id: toolUse.id, content: "No se detectaron datos sensibles en LocalStorage/SessionStorage en este chequeo." });
+            }
+          } catch (e) {
+            toolResults.push({ type: "tool_result", tool_use_id: toolUse.id, content: `Error scan_sensitive_data_exposure: ${e.message}` });
+          }
+        } else if (toolName === "audit_http_headers") {
+          console.log(`>>ARCALITY_STATUS>> \u{1F6E1}\uFE0F [Security] Auditando headers HTTP...`);
+          try {
+            const issues = await audit_http_headers(this.page);
+            if (issues.length > 0) {
+              const report = issues.map((i) => `- ${i.category}: ${i.description}`).join("\n");
+              toolResults.push({ type: "tool_result", tool_use_id: toolUse.id, content: `Vulnerabilidades de Headers detectadas:
+${report}` });
+            } else {
+              toolResults.push({ type: "tool_result", tool_use_id: toolUse.id, content: "No se detectaron problemas en los headers de seguridad b\xE1sicos." });
+            }
+          } catch (e) {
+            toolResults.push({ type: "tool_result", tool_use_id: toolUse.id, content: `Error audit_http_headers: ${e.message}` });
+          }
         } else if (toolName === "create_test_evidence") {
           const { evidence_type, annotations, save_as, description, finish_run = false } = toolInput;
           console.log(`\u{1F4F8} [SKILL] Creating test evidence: "${save_as}"...`);
@@ -1817,6 +2035,8 @@ ${history.slice(-25).join("\n") || "None"}`
           } catch (e) {
             toolResults.push({ type: "tool_result", tool_use_id: toolUse.id, content: `Error scrolling: ${e.message}` });
           }
+        } else {
+          toolResults.push({ type: "tool_result", tool_use_id: toolUse.id, content: `Error: Tool '${toolName}' not recognized by this version.` });
         }
       }
       if (toolResults.length > 0) {
@@ -1860,6 +2080,8 @@ ${history.slice(-25).join("\n") || "None"}`
       };
       if (isProxyMode) {
         headers["x-api-key"] = process.env.ARCALITY_API_KEY || "";
+        const missionId = process.env.ARCALITY_MISSION_ID || "";
+        if (missionId) headers["x-mission-id"] = missionId;
       } else {
         headers["x-api-key"] = process.env.ANTHROPIC_API_KEY;
         headers["anthropic-version"] = "2023-06-01";
@@ -1904,6 +2126,8 @@ ${history.join("\n")}` }
       };
       if (isProxyMode) {
         headers["x-api-key"] = process.env.ARCALITY_API_KEY || "";
+        const missionId = process.env.ARCALITY_MISSION_ID || "";
+        if (missionId) headers["x-mission-id"] = missionId;
       } else {
         headers["x-api-key"] = process.env.ANTHROPIC_API_KEY;
         headers["anthropic-version"] = "2023-06-01";
@@ -1954,6 +2178,101 @@ ${historyStr}` }
   }
 };
 
+// src/services/securityScanner.ts
+var SecurityScanner = class {
+  page;
+  report = [];
+  constructor(page) {
+    this.page = page;
+  }
+  /**
+   * Runs a series of automated scans against the current state of the page.
+   * This is intended to be called at the end of a test run to aggregate findings.
+   * @returns A promise that resolves to an array of found vulnerabilities.
+   */
+  async runAllScans() {
+    console.log("[QA-SEC] Starting comprehensive security scan...");
+    const headerVulnerabilities = await audit_http_headers(this.page);
+    this.report.push(...headerVulnerabilities);
+    const storageVulnerabilities = await scan_sensitive_data_exposure(this.page);
+    this.report.push(...storageVulnerabilities);
+    await this.testOpenRedirect();
+    console.log(`[QA-SEC] Comprehensive scan finished. Found ${this.report.length} potential vulnerabilities.`);
+    return this.getReport();
+  }
+  /**
+   * A basic test for open redirect vulnerabilities on the current URL.
+   */
+  async testOpenRedirect() {
+    const url = new URL(this.page.url());
+    const redirectParams = ["redirect", "next", "url", "returnTo", "dest"];
+    for (const param of redirectParams) {
+      if (url.searchParams.has(param)) {
+        const originalValue = url.searchParams.get(param);
+        const payload = "https://www.evil-redirect.com";
+        url.searchParams.set(param, payload);
+        console.log(`[QA-SEC] Testing Open Redirect on param: ${param}`);
+        try {
+          await this.page.goto(url.toString(), { waitUntil: "networkidle" });
+          if (this.page.url().startsWith(payload)) {
+            const vulnerability = {
+              type: "confirmed_vulnerability",
+              category: "Open Redirect",
+              severity: "Medium",
+              confidence: "High",
+              exploitability: "confirmed",
+              status: "detected",
+              description: `The application is vulnerable to Open Redirect. The '${param}' parameter was manipulated to redirect the user to an external, malicious site.`,
+              impact: "Attackers can use this to craft phishing links that appear to come from the trusted domain but redirect to malicious sites.",
+              evidence: {
+                vulnerableUrl: url.toString(),
+                parameter: param,
+                payload
+              },
+              reproductionSteps: [
+                `Navigate to: ${url.toString()}`,
+                "Observe that the page redirects to the payload domain."
+              ],
+              remediation: "Validate all redirection URLs against a whitelist of allowed domains. Do not blindly redirect to user-supplied URLs.",
+              classification: {
+                cwe: "CWE-601"
+              }
+            };
+            this.report.push(vulnerability);
+            await this.page.goBack();
+          }
+        } catch (error) {
+          console.log(`[QA-SEC] Error during open redirect test, this might be expected if the navigation was blocked. Continuing scan.`);
+          await this.page.goBack();
+        }
+      }
+    }
+  }
+  /**
+   * Adds a vulnerability to the report. Can be used by other parts of the system
+   * to feed into this scanner's report.
+   * @param vuln - The vulnerability to add.
+   */
+  addVulnerability(vuln) {
+    this.report.push(vuln);
+  }
+  /**
+   * Returns the final list of vulnerabilities.
+   */
+  getReport() {
+    const uniqueReport = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const vuln of this.report) {
+      const key = `${vuln.category}|${vuln.description}|${vuln.evidence.selector || ""}`;
+      if (!seen.has(key)) {
+        uniqueReport.push(vuln);
+        seen.add(key);
+      }
+    }
+    return uniqueReport;
+  }
+};
+
 // tests/_helpers/agentic-runner.spec.ts
 var import_config = require("dotenv/config");
 var fs2 = __toESM(require("fs"));
@@ -2204,7 +2523,7 @@ function captureValidationRule(errorMessage, context) {
     if (!response) {
       stepCount++;
       console.log(`>>ARCALITY_STATUS>> \u23F3 Turno IA ${stepCount} de ${maxSteps} (Gu\xEDa us\xF3 ${guideStepCount} turnos gratis)...`);
-      response = await agent.askIA(prompt, history);
+      response = await agent.askIA(prompt, history, stepCount);
     }
     console.log(`\u{1F9E0} Pensamiento: ${response.thought}`);
     if (!response.finish && history.length >= 6) {
@@ -2412,6 +2731,7 @@ function captureValidationRule(errorMessage, context) {
             stepsData.push({
               url: urlBeforeAction,
               // USAR URL CAPTURADA ANTES
+              url_normalized: urlBeforeAction.replace(/\/[a-z]{2}-[A-Z]{2}\//g, "/{locale}/").replace(/\/[a-z]{2}\//g, "/{lang}/"),
               componentName: compName,
               componentType: step.type,
               action_data: { action: step.action, value: step.value },
@@ -2439,6 +2759,7 @@ function captureValidationRule(errorMessage, context) {
         if (!response.actions || response.actions.length === 0) {
           stepsData.push({
             url: page.url(),
+            url_normalized: page.url().replace(/\/[a-z]{2}-[A-Z]{2}\//g, "/{locale}/").replace(/\/[a-z]{2}\//g, "/{lang}/"),
             componentName: "MISSION_END",
             componentType: "FINISH_SIGNAL",
             action_data: { action: "finish" },
@@ -2538,6 +2859,37 @@ function captureValidationRule(errorMessage, context) {
       });
     }
   }
+  try {
+    const scanner = new SecurityScanner(page);
+    const securityReport = await scanner.runAllScans();
+    if (securityReport && securityReport.length > 0) {
+      await testInfo.attach("security_report", {
+        body: JSON.stringify(securityReport, null, 2),
+        contentType: "application/json"
+      });
+      console.log(`>>ARCALITY_STATUS>> \u{1F6E1}\uFE0F Escaneo de seguridad completado. ${securityReport.length} problemas encontrados.`);
+      try {
+        for (const v of securityReport) {
+          const sev = v.severity || "Info";
+          const mappedSeverity = sev === "Critical" ? "critical" : sev === "High" ? "important" : "suggestion";
+          await pushRule({
+            rule_type: "SECURITY",
+            title: `Security: ${v.category} (${v.severity})`,
+            description: `${v.description}
+Evidence: ${JSON.stringify(v.evidence).substring(0, 400)}`,
+            severity: mappedSeverity
+          }).catch(() => {
+          });
+        }
+      } catch (e) {
+        console.warn(">>ARCALITY_STATUS>> \u26A0\uFE0F Fall\xF3 persistir hallazgos de seguridad en Memoria Colectiva.");
+      }
+    } else {
+      console.log(`>>ARCALITY_STATUS>> \u{1F6E1}\uFE0F Escaneo de seguridad completado. No se encontraron problemas.`);
+    }
+  } catch (e) {
+    console.error("Error in Security Scan:", e.message);
+  }
   saveMissionResults();
   if (!aiMarkedSuccess) {
     throw new Error("Misi\xF3n no completada o finalizada con errores.");

package/tests/_helpers/agentic-runner.spec.ts

@@ -1,6 +1,7 @@
 import { test, expect } from '@playwright/test';
 import { AIAgentHelper, AgentAction } from './ai-agent-helper';
 import { pushKnowledge, pushRule } from '../../src/services/collectiveMemoryService';
+import { SecurityScanner } from '../../src/services/securityScanner';
 import 'dotenv/config';
 import * as fs from 'fs';
 import * as path from 'path';
@@ -327,7 +328,7 @@ test('Arcality AI Runner', async ({ page }, testInfo) => {
             // 2. CONSULTAR IA — ESTE turno SÍ cuenta contra maxSteps
             stepCount++;
             console.log(`>>ARCALITY_STATUS>> ⏳ Turno IA ${stepCount} de ${maxSteps} (Guía usó ${guideStepCount} turnos gratis)...`);
-            response = await agent.askIA(prompt, history);
+            response = await agent.askIA(prompt, history, stepCount);
         }
 
         console.log(`🧠 Pensamiento: ${response.thought}`);
@@ -580,6 +581,7 @@ test('Arcality AI Runner', async ({ page }, testInfo) => {
                     if (compName.length < 100) { // Skip guide storage for misidentified giant text blobs
                         stepsData.push({
                             url: urlBeforeAction, // USAR URL CAPTURADA ANTES
+                            url_normalized: urlBeforeAction.replace(/\/[a-z]{2}-[A-Z]{2}\//g, '/{locale}/').replace(/\/[a-z]{2}\//g, '/{lang}/'),
                             componentName: compName,
                             componentType: (step as any).type,
                             action_data: { action: step.action, value: step.value },
@@ -616,6 +618,7 @@ test('Arcality AI Runner', async ({ page }, testInfo) => {
                 if (!response.actions || response.actions.length === 0) {
                     stepsData.push({
                         url: page.url(),
+                        url_normalized: page.url().replace(/\/[a-z]{2}-[A-Z]{2}\//g, '/{locale}/').replace(/\/[a-z]{2}\//g, '/{lang}/'),
                         componentName: "MISSION_END",
                         componentType: "FINISH_SIGNAL",
                         action_data: { action: 'finish' },
@@ -739,6 +742,39 @@ test('Arcality AI Runner', async ({ page }, testInfo) => {
         }
     }
 
+    // --- SECURITY SCAN ---
+    try {
+        const scanner = new SecurityScanner(page);
+        const securityReport = await scanner.runAllScans();
+        
+        if (securityReport && securityReport.length > 0) {
+            await testInfo.attach('security_report', {
+                body: JSON.stringify(securityReport, null, 2),
+                contentType: 'application/json'
+            });
+            console.log(`>>ARCALITY_STATUS>> 🛡️ Escaneo de seguridad completado. ${securityReport.length} problemas encontrados.`);
+            try {
+                // Persistir hallazgos en Memoria Colectiva como reglas de tipo SECURITY
+                for (const v of securityReport) {
+                    const sev = (v.severity || 'Info') as string;
+                    const mappedSeverity = sev === 'Critical' ? 'critical' : (sev === 'High' ? 'important' : 'suggestion');
+                    await pushRule({
+                        rule_type: 'SECURITY',
+                        title: `Security: ${v.category} (${v.severity})`,
+                        description: `${v.description}\nEvidence: ${JSON.stringify(v.evidence).substring(0, 400)}`,
+                        severity: mappedSeverity as any
+                    }).catch(() => { /* silencioso */ });
+                }
+            } catch (e) {
+                console.warn('>>ARCALITY_STATUS>> ⚠️ Falló persistir hallazgos de seguridad en Memoria Colectiva.');
+            }
+        } else {
+            console.log(`>>ARCALITY_STATUS>> 🛡️ Escaneo de seguridad completado. No se encontraron problemas.`);
+        }
+    } catch (e: any) {
+        console.error('Error in Security Scan:', e.message);
+    }
+
     saveMissionResults();
 
     if (!aiMarkedSuccess) {