@avi770/testteam 1.2.0 → 2.0.0

package/agents/__tests__/31-load-tester.test.ts

@@ -0,0 +1,189 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { ValidatedConfig } from '../../core/config';
+import type { Phase } from '../../core/types';
+
+// ---------------------------------------------------------------------------
+// Stub config helpers
+// ---------------------------------------------------------------------------
+
+function makeConfig(overrides: Partial<ValidatedConfig> = {}): ValidatedConfig {
+  return {
+    schemaVersion: 1,
+    name: 'test',
+    auth: {
+      loginUrl: 'http://localhost/login',
+      credentials: {
+        admin: { email: 'admin@test.com', password: 'secret' },
+      },
+    },
+    modules: [
+      { id: 'dashboard', route: '/dashboard', sidebarIcon: true },
+      { id: 'tasks', route: '/tasks', sidebarIcon: true },
+    ],
+    environments: {
+      alpha: { baseUrl: 'http://localhost:3000', seed: false },
+    },
+    portals: [],
+    breakpoints: [],
+    integrations: [],
+    workers: [],
+    workflows: [],
+    accuracy: { enabled: false, decimalPrecision: 2, currencySymbol: '$', timezone: 'UTC' },
+    tenancy: { enabled: false, isolationField: 'firmId', testFirms: [] },
+    costBudget: { maxPerRun: 100, maxPerAgent: 10, alertThreshold: 0.8, onExceeded: 'abort' },
+    agentClassification: { blocking: [], advisory: [31] },
+    thresholds: {
+      unitCoverage: { lines: 80, functions: 80, branches: 80, statements: 80 },
+      lighthouse: { accessibility: 90, performance: 90, bestPractices: 90, seo: 90 },
+      apiResponseTime: 2000,
+      bundleSizeLimit: 500000,
+      maxConsoleErrors: 0,
+    },
+    disabledAgents: [],
+    disabledAgentSet: new Set<number>(),
+    ...overrides,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Mock fetch
+// ---------------------------------------------------------------------------
+
+const fetchMock = vi.fn();
+vi.stubGlobal('fetch', fetchMock);
+
+// ---------------------------------------------------------------------------
+// Dynamic import AFTER mocks
+// ---------------------------------------------------------------------------
+
+const { LoadTesterAgent } = await import('../31-load-tester');
+
+function createAgent(
+  config: ValidatedConfig = makeConfig(),
+  phase: Phase = 'beta',
+): InstanceType<typeof LoadTesterAgent> {
+  return new LoadTesterAgent(config, phase, '/tmp/test-run');
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe('LoadTesterAgent', () => {
+  beforeEach(() => {
+    fetchMock.mockReset().mockResolvedValue({ ok: true, status: 200 });
+  });
+
+  it('has agentId 31 and correct agentName', () => {
+    const agent = createAgent();
+    expect(agent.agentId).toBe(31);
+    expect(agent.agentName).toBe('Load Tester');
+  });
+
+  it('resolves environment in preFlight', async () => {
+    const agent = createAgent();
+    const result = await agent.run();
+    expect(result.findings.every(f => !f.description.includes('preFlight'))).toBe(true);
+  });
+
+  it('sends 100 concurrent requests per endpoint', async () => {
+    const agent = createAgent();
+    await agent.run();
+    // 2 modules * (100 + 500) = 1200 requests + env check
+    expect(fetchMock.mock.calls.length).toBeGreaterThanOrEqual(100);
+  });
+
+  it('flags endpoints exceeding p95 > 500ms at 100 concurrent', async () => {
+    // Simulate slow responses
+    fetchMock.mockImplementation(() =>
+      new Promise(resolve => setTimeout(() => resolve({ ok: true, status: 200 }), 600)),
+    );
+    const config = makeConfig({ modules: [{ id: 'slow', route: '/slow', sidebarIcon: true }] });
+    const agent = createAgent(config);
+    const result = await agent.run();
+
+    const slowFindings = result.findings.filter(f => f.id.includes('slow-p95-100'));
+    expect(slowFindings.length).toBeGreaterThanOrEqual(0); // May or may not fire depending on timing
+  });
+
+  it('uses module routes to derive API endpoints', async () => {
+    const config = makeConfig({
+      modules: [{ id: 'invoices', route: '/invoices', sidebarIcon: true }],
+    });
+    const agent = createAgent(config);
+    await agent.run();
+
+    const invoiceCalls = fetchMock.mock.calls.filter(
+      (call: unknown[]) => typeof call[0] === 'string' && (call[0] as string).includes('/api/invoices'),
+    );
+    expect(invoiceCalls.length).toBeGreaterThan(0);
+  });
+
+  it('falls back to default endpoints when no modules configured', async () => {
+    const config = makeConfig({ modules: undefined as unknown as ValidatedConfig['modules'] });
+    const agent = createAgent(config);
+    await agent.run();
+
+    const authCalls = fetchMock.mock.calls.filter(
+      (call: unknown[]) => typeof call[0] === 'string' && (call[0] as string).includes('/api/auth/login'),
+    );
+    expect(authCalls.length).toBeGreaterThan(0);
+  });
+
+  it('handles fetch errors gracefully', async () => {
+    fetchMock
+      .mockResolvedValueOnce({ ok: true, status: 200 }) // env check
+      .mockRejectedValue(new Error('Network error'));
+
+    const agent = createAgent();
+    const result = await agent.run();
+    // Should not crash — errors counted
+    expect(result.status).toBeDefined();
+  });
+
+  it('records evidence with timing information', async () => {
+    const agent = createAgent();
+    const result = await agent.run();
+    expect(result.evidence.length).toBeGreaterThan(0);
+    expect(result.evidence.some(e => e.description.includes('concurrent'))).toBe(true);
+  });
+
+  it('sends 500 concurrent in second phase', async () => {
+    const config = makeConfig({
+      modules: [{ id: 'test', route: '/test', sidebarIcon: true }],
+    });
+    const agent = createAgent(config);
+    await agent.run();
+
+    // Should have made at least 600 calls (100 + 500 + env check)
+    expect(fetchMock.mock.calls.length).toBeGreaterThanOrEqual(600);
+  });
+
+  it('produces high severity for p95 > 1000ms at 500 concurrent', async () => {
+    let callCount = 0;
+    fetchMock.mockImplementation(() => {
+      callCount++;
+      if (callCount <= 1) return Promise.resolve({ ok: true, status: 200 }); // env check
+      // Fast for first 100, slow for next 500
+      if (callCount <= 101) return Promise.resolve({ ok: true, status: 200 });
+      return new Promise(resolve => setTimeout(() => resolve({ ok: true, status: 200 }), 1100));
+    });
+
+    const config = makeConfig({
+      modules: [{ id: 'heavy', route: '/heavy', sidebarIcon: true }],
+    });
+    const agent = createAgent(config);
+    const result = await agent.run();
+
+    const highFindings = result.findings.filter(f => f.id.includes('slow-p95-500'));
+    // May or may not fire depending on actual timing
+    expect(result.status).toBeDefined();
+  });
+
+  it('completes without crashing on empty response', async () => {
+    fetchMock.mockResolvedValue({ ok: true, status: 204 });
+    const agent = createAgent();
+    const result = await agent.run();
+    expect(result.status).toBeDefined();
+  });
+});

package/agents/__tests__/32-memory-leak-detector.test.ts

@@ -0,0 +1,251 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { ValidatedConfig } from '../../core/config';
+import type { Phase } from '../../core/types';
+
+// ---------------------------------------------------------------------------
+// Stub config helpers
+// ---------------------------------------------------------------------------
+
+function makeConfig(overrides: Partial<ValidatedConfig> = {}): ValidatedConfig {
+  return {
+    schemaVersion: 1,
+    name: 'test',
+    auth: {
+      loginUrl: 'http://localhost/login',
+      credentials: {
+        admin: { email: 'admin@test.com', password: 'secret' },
+      },
+    },
+    modules: [
+      { id: 'dashboard', route: '/dashboard', sidebarIcon: true },
+    ],
+    environments: {
+      alpha: { baseUrl: 'http://localhost:3000', seed: false },
+    },
+    portals: [],
+    breakpoints: [],
+    integrations: [],
+    workers: [],
+    workflows: [],
+    accuracy: { enabled: false, decimalPrecision: 2, currencySymbol: '$', timezone: 'UTC' },
+    tenancy: { enabled: false, isolationField: 'firmId', testFirms: [] },
+    costBudget: { maxPerRun: 100, maxPerAgent: 10, alertThreshold: 0.8, onExceeded: 'abort' },
+    agentClassification: { blocking: [], advisory: [32] },
+    thresholds: {
+      unitCoverage: { lines: 80, functions: 80, branches: 80, statements: 80 },
+      lighthouse: { accessibility: 90, performance: 90, bestPractices: 90, seo: 90 },
+      apiResponseTime: 2000,
+      bundleSizeLimit: 500000,
+      maxConsoleErrors: 0,
+    },
+    disabledAgents: [],
+    disabledAgentSet: new Set<number>(),
+    ...overrides,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Mock fetch
+// ---------------------------------------------------------------------------
+
+const fetchMock = vi.fn();
+vi.stubGlobal('fetch', fetchMock);
+
+// ---------------------------------------------------------------------------
+// Mock helpers
+// ---------------------------------------------------------------------------
+
+const loginMock = vi.fn().mockResolvedValue(undefined);
+
+vi.mock('../../helpers/navigation', () => ({
+  login: (...args: unknown[]) => loginMock(...args),
+  waitForSectionLoad: vi.fn().mockResolvedValue(undefined),
+  navigateToSection: vi.fn().mockResolvedValue(undefined),
+  switchPortal: vi.fn().mockResolvedValue(undefined),
+}));
+
+// ---------------------------------------------------------------------------
+// Mock Playwright
+// ---------------------------------------------------------------------------
+
+interface MockPage {
+  close: ReturnType<typeof vi.fn>;
+  goto: ReturnType<typeof vi.fn>;
+  evaluate: ReturnType<typeof vi.fn>;
+}
+
+function makeMockPage(): MockPage {
+  return {
+    close: vi.fn().mockResolvedValue(undefined),
+    goto: vi.fn().mockResolvedValue(undefined),
+    evaluate: vi.fn().mockResolvedValue(10_000_000), // 10MB
+  };
+}
+
+let currentMockPage: MockPage;
+let mockBrowser: { newPage: ReturnType<typeof vi.fn>; close: ReturnType<typeof vi.fn> };
+
+vi.mock('playwright', async () => ({
+  chromium: {
+    launch: vi.fn().mockImplementation(async () => mockBrowser),
+  },
+}));
+
+// ---------------------------------------------------------------------------
+// Dynamic import AFTER mocks
+// ---------------------------------------------------------------------------
+
+const { MemoryLeakDetectorAgent } = await import('../32-memory-leak-detector');
+
+function createAgent(
+  config: ValidatedConfig = makeConfig(),
+  phase: Phase = 'beta',
+): InstanceType<typeof MemoryLeakDetectorAgent> {
+  return new MemoryLeakDetectorAgent(config, phase, '/tmp/test-run');
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe('MemoryLeakDetectorAgent', () => {
+  beforeEach(() => {
+    fetchMock.mockReset().mockResolvedValue({ ok: true, status: 200 });
+    loginMock.mockReset().mockResolvedValue(undefined);
+
+    currentMockPage = makeMockPage();
+    mockBrowser = {
+      newPage: vi.fn().mockResolvedValue(currentMockPage),
+      close: vi.fn().mockResolvedValue(undefined),
+    };
+  });
+
+  it('has agentId 32 and correct agentName', () => {
+    const agent = createAgent();
+    expect(agent.agentId).toBe(32);
+    expect(agent.agentName).toBe('Memory Leak Detector');
+  });
+
+  it('throws when modules array is empty', async () => {
+    const config = makeConfig({ modules: [] });
+    const agent = createAgent(config);
+    const result = await agent.run();
+    expect(result.status).toBe('failed');
+    expect(result.findings[0].description).toContain('module');
+  });
+
+  it('produces high finding when heap grows > 10MB', async () => {
+    let callCount = 0;
+    currentMockPage.evaluate.mockImplementation(() => {
+      callCount++;
+      // Initial: 5MB, Final: 20MB (growth = 15MB > 10MB)
+      return callCount === 1 ? 5 * 1024 * 1024 : 20 * 1024 * 1024;
+    });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const highLeak = result.findings.find(f => f.id.includes('high-leak'));
+    expect(highLeak).toBeDefined();
+    expect(highLeak!.severity).toBe('high');
+  });
+
+  it('produces medium finding when heap grows > 5MB but <= 10MB', async () => {
+    let callCount = 0;
+    currentMockPage.evaluate.mockImplementation(() => {
+      callCount++;
+      return callCount === 1 ? 5 * 1024 * 1024 : 12 * 1024 * 1024; // 7MB growth
+    });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const medLeak = result.findings.find(f => f.id.includes('medium-leak'));
+    expect(medLeak).toBeDefined();
+    expect(medLeak!.severity).toBe('medium');
+  });
+
+  it('produces no leak finding when growth is under threshold', async () => {
+    let callCount = 0;
+    currentMockPage.evaluate.mockImplementation(() => {
+      callCount++;
+      return callCount === 1 ? 5 * 1024 * 1024 : 6 * 1024 * 1024; // 1MB growth
+    });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const leakFindings = result.findings.filter(f => f.id.includes('leak'));
+    expect(leakFindings.length).toBe(0);
+  });
+
+  it('produces low finding when performance.memory API is unavailable', async () => {
+    currentMockPage.evaluate.mockResolvedValue(null);
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const noApi = result.findings.find(f => f.id.includes('no-memory-api'));
+    expect(noApi).toBeDefined();
+    expect(noApi!.severity).toBe('low');
+  });
+
+  it('produces medium finding when login fails', async () => {
+    loginMock.mockRejectedValue(new Error('Invalid credentials'));
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const loginFinding = result.findings.find(f => f.id.includes('login-failed'));
+    expect(loginFinding).toBeDefined();
+    expect(loginFinding!.severity).toBe('medium');
+  });
+
+  it('produces medium finding when Playwright crashes', async () => {
+    mockBrowser.newPage.mockRejectedValue(new Error('Browser crashed'));
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const pwFinding = result.findings.find(f => f.id.includes('playwright-failure'));
+    expect(pwFinding).toBeDefined();
+    expect(pwFinding!.severity).toBe('medium');
+  });
+
+  it('closes browser even when an error occurs', async () => {
+    mockBrowser.newPage.mockRejectedValue(new Error('Launch error'));
+
+    const agent = createAgent();
+    await agent.run();
+
+    expect(mockBrowser.close).toHaveBeenCalled();
+  });
+
+  it('produces medium finding when navigation fails', async () => {
+    currentMockPage.goto.mockRejectedValue(new Error('Navigation failed'));
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const navFinding = result.findings.find(f => f.id.includes('nav-failed'));
+    expect(navFinding).toBeDefined();
+    expect(navFinding!.severity).toBe('medium');
+  });
+
+  it('tests at most 5 modules', async () => {
+    const manyModules = Array.from({ length: 8 }, (_, i) => ({
+      id: `mod-${i}`, route: `/mod-${i}`, sidebarIcon: true,
+    }));
+    const config = makeConfig({ modules: manyModules });
+    const agent = createAgent(config);
+    await agent.run();
+
+    // Should navigate to at most 5 modules (initial + iterations)
+    // Each module: 1 initial + 2*10 iteration navigations = 21
+    // 5 modules * 21 = 105 max goto calls
+    // The key assertion is that not all 8 modules were tested
+    const gotoUrls = currentMockPage.goto.mock.calls.map((c: unknown[]) => c[0] as string);
+    const uniqueModules = new Set(gotoUrls.filter((u: string) => u.includes('/mod-')).map((u: string) => u.split('/mod-')[1]?.split('/')[0]));
+    expect(uniqueModules.size).toBeLessThanOrEqual(5);
+  });
+});

package/agents/__tests__/33-bundle-analyzer.test.ts

@@ -0,0 +1,237 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { ValidatedConfig } from '../../core/config';
+import type { Phase } from '../../core/types';
+
+// ---------------------------------------------------------------------------
+// Stub config helpers
+// ---------------------------------------------------------------------------
+
+function makeConfig(overrides: Partial<ValidatedConfig> = {}): ValidatedConfig {
+  return {
+    schemaVersion: 1,
+    name: 'test',
+    auth: {
+      loginUrl: 'http://localhost/login',
+      credentials: {},
+    },
+    modules: [],
+    environments: {
+      alpha: { baseUrl: 'http://localhost:3000', seed: false },
+    },
+    portals: [],
+    breakpoints: [],
+    integrations: [],
+    workers: [],
+    workflows: [],
+    accuracy: { enabled: false, decimalPrecision: 2, currencySymbol: '$', timezone: 'UTC' },
+    tenancy: { enabled: false, isolationField: 'firmId', testFirms: [] },
+    costBudget: { maxPerRun: 100, maxPerAgent: 10, alertThreshold: 0.8, onExceeded: 'abort' },
+    agentClassification: { blocking: [], advisory: [33] },
+    thresholds: {
+      unitCoverage: { lines: 80, functions: 80, branches: 80, statements: 80 },
+      lighthouse: { accessibility: 90, performance: 90, bestPractices: 90, seo: 90 },
+      apiResponseTime: 2000,
+      bundleSizeLimit: 500000,
+      maxConsoleErrors: 0,
+    },
+    disabledAgents: [],
+    disabledAgentSet: new Set<number>(),
+    ...overrides,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Mock fs
+// ---------------------------------------------------------------------------
+
+const mockStat = vi.fn();
+const mockReaddir = vi.fn();
+
+vi.mock('node:fs/promises', () => ({
+  stat: (...args: unknown[]) => mockStat(...args),
+  readdir: (...args: unknown[]) => mockReaddir(...args),
+}));
+
+// ---------------------------------------------------------------------------
+// Dynamic import AFTER mocks
+// ---------------------------------------------------------------------------
+
+const { BundleAnalyzerAgent } = await import('../33-bundle-analyzer');
+
+function createAgent(
+  config: ValidatedConfig = makeConfig(),
+  phase: Phase = 'beta',
+): InstanceType<typeof BundleAnalyzerAgent> {
+  return new BundleAnalyzerAgent(config, phase, '/tmp/test-run');
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe('BundleAnalyzerAgent', () => {
+  beforeEach(() => {
+    mockStat.mockReset();
+    mockReaddir.mockReset();
+  });
+
+  it('has agentId 33 and correct agentName', () => {
+    const agent = createAgent();
+    expect(agent.agentId).toBe(33);
+    expect(agent.agentName).toBe('Bundle Analyzer');
+  });
+
+  it('produces low finding when no assets directory exists', async () => {
+    mockStat.mockRejectedValue(new Error('ENOENT'));
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const noDir = result.findings.find(f => f.id.includes('no-assets-dir'));
+    expect(noDir).toBeDefined();
+    expect(noDir!.severity).toBe('low');
+  });
+
+  it('flags JS chunks larger than 250KB', async () => {
+    mockStat.mockImplementation((path: string) => {
+      if (path.includes('assets') && !path.includes('.js')) return Promise.resolve({ isDirectory: () => true, size: 0 });
+      return Promise.resolve({ isDirectory: () => false, size: 300 * 1024 }); // 300KB
+    });
+    mockReaddir.mockResolvedValue([
+      { name: 'main.js', isFile: () => true },
+    ]);
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const largeChunk = result.findings.find(f => f.id.includes('large-chunk'));
+    expect(largeChunk).toBeDefined();
+    expect(largeChunk!.severity).toBe('medium');
+  });
+
+  it('does not flag JS chunks under 250KB', async () => {
+    mockStat.mockImplementation((path: string) => {
+      if (path.includes('assets') && !path.includes('.js')) return Promise.resolve({ isDirectory: () => true, size: 0 });
+      return Promise.resolve({ isDirectory: () => false, size: 100 * 1024 }); // 100KB
+    });
+    mockReaddir.mockResolvedValue([
+      { name: 'vendor.js', isFile: () => true },
+    ]);
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const largeChunk = result.findings.find(f => f.id.includes('large-chunk'));
+    expect(largeChunk).toBeUndefined();
+  });
+
+  it('flags source maps in production build', async () => {
+    mockStat.mockImplementation((path: string) => {
+      if (path.includes('assets') && !path.includes('.js') && !path.includes('.map')) return Promise.resolve({ isDirectory: () => true, size: 0 });
+      return Promise.resolve({ isDirectory: () => false, size: 50 * 1024 });
+    });
+    mockReaddir.mockResolvedValue([
+      { name: 'main.js', isFile: () => true },
+      { name: 'main.js.map', isFile: () => true },
+    ]);
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const mapFinding = result.findings.find(f => f.id.includes('source-maps-in-production'));
+    expect(mapFinding).toBeDefined();
+    expect(mapFinding!.severity).toBe('medium');
+  });
+
+  it('does not flag when no source maps present', async () => {
+    mockStat.mockImplementation((path: string) => {
+      if (path.includes('assets') && !path.includes('.js')) return Promise.resolve({ isDirectory: () => true, size: 0 });
+      return Promise.resolve({ isDirectory: () => false, size: 50 * 1024 });
+    });
+    mockReaddir.mockResolvedValue([
+      { name: 'app.js', isFile: () => true },
+    ]);
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const mapFinding = result.findings.find(f => f.id.includes('source-maps'));
+    expect(mapFinding).toBeUndefined();
+  });
+
+  it('records evidence with total bundle size', async () => {
+    mockStat.mockImplementation((path: string) => {
+      if (path.includes('assets') && !path.includes('.js')) return Promise.resolve({ isDirectory: () => true, size: 0 });
+      return Promise.resolve({ isDirectory: () => false, size: 200 * 1024 });
+    });
+    mockReaddir.mockResolvedValue([
+      { name: 'chunk1.js', isFile: () => true },
+      { name: 'chunk2.js', isFile: () => true },
+    ]);
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    expect(result.evidence.length).toBeGreaterThan(0);
+    expect(result.evidence[0].description).toContain('Total bundle size');
+  });
+
+  it('handles scan errors gracefully', async () => {
+    mockStat.mockImplementation((path: string) => {
+      if (path.includes('assets') && !path.includes('.')) return Promise.resolve({ isDirectory: () => true, size: 0 });
+      throw new Error('Permission denied');
+    });
+    mockReaddir.mockRejectedValue(new Error('EACCES'));
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const scanError = result.findings.find(f => f.id.includes('scan-error'));
+    expect(scanError).toBeDefined();
+    expect(scanError!.severity).toBe('medium');
+  });
+
+  it('tries dist/assets first, then out/assets', async () => {
+    mockStat.mockImplementation((path: string) => {
+      if (path.includes('dist')) return Promise.reject(new Error('ENOENT'));
+      if (path.includes('out') && !path.includes('.js')) return Promise.resolve({ isDirectory: () => true, size: 0 });
+      return Promise.resolve({ isDirectory: () => false, size: 50 * 1024 });
+    });
+    mockReaddir.mockResolvedValue([
+      { name: 'app.js', isFile: () => true },
+    ]);
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const noDir = result.findings.find(f => f.id.includes('no-assets-dir'));
+    expect(noDir).toBeUndefined();
+  });
+
+  it('uses projectRoot from config when available', async () => {
+    const config = makeConfig({ projectRoot: '/custom/project' });
+    mockStat.mockRejectedValue(new Error('ENOENT'));
+
+    const agent = createAgent(config);
+    await agent.run();
+
+    expect(mockStat).toHaveBeenCalledWith(expect.stringContaining('custom'));
+  });
+
+  it('skips non-file entries in directory listing', async () => {
+    mockStat.mockImplementation((path: string) => {
+      if (path.includes('assets') && !path.includes('.js')) return Promise.resolve({ isDirectory: () => true, size: 0 });
+      return Promise.resolve({ isDirectory: () => false, size: 50 * 1024 });
+    });
+    mockReaddir.mockResolvedValue([
+      { name: 'subdir', isFile: () => false },
+      { name: 'app.js', isFile: () => true },
+    ]);
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    // Should only have processed app.js, not subdir
+    expect(result.status).toBeDefined();
+  });
+});