@avi770/testteam 1.2.0 → 2.0.0

package/agents/31-load-tester.ts

@@ -0,0 +1,134 @@
+import { BaseAgent } from './base-agent';
+import type { Finding } from '../core/types';
+import { resolveEnvironment } from '../helpers/env-resolver';
+
+/** Default API endpoints to test when no route scanning is available. */
+const DEFAULT_ENDPOINTS = [
+  '/api/auth/login',
+  '/api/tasks',
+  '/api/clients',
+  '/api/dashboard',
+  '/api/users',
+] as const;
+
+/** Timeout (ms) for individual requests during load testing. */
+const REQUEST_TIMEOUT_MS = 10_000;
+
+interface TimingResult {
+  endpoint: string;
+  durations: number[];
+  errors: number;
+}
+
+function percentile(sorted: number[], p: number): number {
+  if (sorted.length === 0) return 0;
+  const idx = Math.ceil((p / 100) * sorted.length) - 1;
+  return sorted[Math.max(0, idx)];
+}
+
+export class LoadTesterAgent extends BaseAgent {
+  readonly agentId = 31;
+  readonly agentName = 'Load Tester';
+  private baseUrl = '';
+
+  protected async preFlight(): Promise<void> {
+    const { env } = await resolveEnvironment(this.config, this.phase);
+    this.baseUrl = env.baseUrl;
+  }
+
+  protected async execute(): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    const endpoints = this.discoverEndpoints();
+
+    // Phase 1: 100 concurrent requests
+    for (const endpoint of endpoints) {
+      const timing = await this.runConcurrent(endpoint, 100);
+      const sorted = [...timing.durations].sort((a, b) => a - b);
+      const avg = sorted.length > 0 ? sorted.reduce((s, v) => s + v, 0) / sorted.length : 0;
+      const p95 = percentile(sorted, 95);
+      const p99 = percentile(sorted, 99);
+
+      this.addEvidence({
+        type: 'log',
+        path: `load-test-100-${endpoint.replace(/\//g, '_')}`,
+        description: `100 concurrent: avg=${avg.toFixed(0)}ms p95=${p95.toFixed(0)}ms p99=${p99.toFixed(0)}ms errors=${timing.errors}`,
+      });
+
+      if (p95 > 500) {
+        findings.push({
+          id: `${this.agentId}-slow-p95-100-${endpoint.replace(/\//g, '_')}`,
+          type: 'test-bug',
+          severity: 'medium',
+          agentId: this.agentId,
+          module: 'load-test',
+          description: `Endpoint ${endpoint} p95=${p95.toFixed(0)}ms exceeds 500ms threshold at 100 concurrent requests (avg=${avg.toFixed(0)}ms, p99=${p99.toFixed(0)}ms)`,
+        });
+      }
+    }
+
+    // Phase 2: 500 concurrent requests
+    for (const endpoint of endpoints) {
+      const timing = await this.runConcurrent(endpoint, 500);
+      const sorted = [...timing.durations].sort((a, b) => a - b);
+      const avg = sorted.length > 0 ? sorted.reduce((s, v) => s + v, 0) / sorted.length : 0;
+      const p95 = percentile(sorted, 95);
+      const p99 = percentile(sorted, 99);
+
+      this.addEvidence({
+        type: 'log',
+        path: `load-test-500-${endpoint.replace(/\//g, '_')}`,
+        description: `500 concurrent: avg=${avg.toFixed(0)}ms p95=${p95.toFixed(0)}ms p99=${p99.toFixed(0)}ms errors=${timing.errors}`,
+      });
+
+      if (p95 > 1000) {
+        findings.push({
+          id: `${this.agentId}-slow-p95-500-${endpoint.replace(/\//g, '_')}`,
+          type: 'test-bug',
+          severity: 'high',
+          agentId: this.agentId,
+          module: 'load-test',
+          description: `Endpoint ${endpoint} p95=${p95.toFixed(0)}ms exceeds 1000ms threshold at 500 concurrent requests (avg=${avg.toFixed(0)}ms, p99=${p99.toFixed(0)}ms)`,
+        });
+      }
+    }
+
+    return findings;
+  }
+
+  private discoverEndpoints(): string[] {
+    // Use configured modules to derive API endpoints, or fall back to defaults
+    if (this.config.modules && this.config.modules.length > 0) {
+      return this.config.modules.map(m => `/api${m.route}`);
+    }
+    return [...DEFAULT_ENDPOINTS];
+  }
+
+  private async runConcurrent(endpoint: string, count: number): Promise<TimingResult> {
+    const url = `${this.baseUrl}${endpoint}`;
+    const durations: number[] = [];
+    let errors = 0;
+
+    const promises = Array.from({ length: count }, async () => {
+      const start = Date.now();
+      try {
+        await Promise.race([
+          fetch(url, {
+            method: 'GET',
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+          }),
+          new Promise<never>((_, reject) =>
+            setTimeout(() => reject(new Error('Load test timeout')), REQUEST_TIMEOUT_MS),
+          ),
+        ]);
+        durations.push(Date.now() - start);
+      } catch {
+        errors++;
+        durations.push(Date.now() - start);
+      }
+    });
+
+    await Promise.all(promises);
+
+    return { endpoint, durations, errors };
+  }
+}

package/agents/32-memory-leak-detector.ts

@@ -0,0 +1,194 @@
+import type { Browser, Page } from 'playwright';
+import type { Finding } from '../core/types';
+import { BaseAgent } from './base-agent';
+import { resolveEnvironment } from '../helpers/env-resolver';
+import { login } from '../helpers/navigation';
+
+/** Threshold in bytes for heap growth. */
+const MEDIUM_THRESHOLD_BYTES = 5 * 1024 * 1024; // 5MB
+const HIGH_THRESHOLD_BYTES = 10 * 1024 * 1024; // 10MB
+const NAV_TIMEOUT_MS = 5_000;
+const ITERATION_COUNT = 10;
+const MAX_MODULES = 5;
+
+export class MemoryLeakDetectorAgent extends BaseAgent {
+  readonly agentId = 32;
+  readonly agentName = 'Memory Leak Detector';
+  private baseUrl = '';
+
+  protected async preFlight(): Promise<void> {
+    if (!this.config.modules || this.config.modules.length === 0) {
+      throw new Error('MemoryLeakDetectorAgent requires at least one module in config.modules');
+    }
+    const { env } = await resolveEnvironment(this.config, this.phase);
+    this.baseUrl = env.baseUrl;
+  }
+
+  protected async execute(): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    const rawLoginUrl = this.config.auth.loginUrl ?? '/login';
+    const loginUrl = rawLoginUrl.startsWith('http') ? rawLoginUrl : `${this.baseUrl}${rawLoginUrl}`;
+    const credentials =
+      this.config.auth.credentials?.['admin'] ??
+      Object.values(this.config.auth.credentials ?? {})[0];
+
+    const { chromium } = await import('playwright');
+    let browser: Browser | null = null;
+
+    try {
+      browser = await chromium.launch({ headless: true });
+      const page = await browser.newPage();
+
+      if (credentials) {
+        try {
+          await login(page, credentials, loginUrl);
+        } catch (loginError) {
+          findings.push({
+            id: `${this.agentId}-login-failed`,
+            type: 'infra-issue',
+            severity: 'medium',
+            agentId: this.agentId,
+            module: 'memory-leak-detector',
+            description: `Login failed — continuing anonymously: ${loginError instanceof Error ? loginError.message.split('\n')[0] : String(loginError)}`,
+          });
+        }
+      }
+
+      const modules = this.config.modules.slice(0, MAX_MODULES);
+
+      for (const mod of modules) {
+        const moduleFindings = await this.testModuleMemory(page, mod.id, mod.route);
+        findings.push(...moduleFindings);
+      }
+
+      await page.close().catch(() => undefined);
+    } catch (playwrightError) {
+      findings.push({
+        id: `${this.agentId}-playwright-failure`,
+        type: 'infra-issue',
+        severity: 'medium',
+        agentId: this.agentId,
+        module: 'memory-leak-detector',
+        description: `Playwright execution failed: ${playwrightError instanceof Error ? playwrightError.message.split('\n')[0] : String(playwrightError)}`,
+      });
+    } finally {
+      if (browser) await browser.close().catch(() => undefined);
+    }
+
+    return findings;
+  }
+
+  private async testModuleMemory(
+    page: Page,
+    moduleId: string,
+    moduleRoute: string,
+  ): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    const fullUrl = moduleRoute.startsWith('http')
+      ? moduleRoute
+      : `${this.baseUrl}${moduleRoute}`;
+
+    try {
+      await Promise.race([
+        page.goto(fullUrl, { waitUntil: 'domcontentloaded' }),
+        new Promise((_, reject) =>
+          setTimeout(() => reject(new Error('Navigation timeout')), NAV_TIMEOUT_MS),
+        ),
+      ]);
+    } catch {
+      findings.push({
+        id: `${this.agentId}-nav-failed-${moduleId}`,
+        type: 'test-bug',
+        severity: 'medium',
+        agentId: this.agentId,
+        module: moduleId,
+        description: `Failed to navigate to module ${moduleId} at ${moduleRoute}`,
+      });
+      return findings;
+    }
+
+    // Record initial heap size
+    const initialHeap = await this.getHeapSize(page);
+    if (initialHeap === null) {
+      findings.push({
+        id: `${this.agentId}-no-memory-api-${moduleId}`,
+        type: 'infra-issue',
+        severity: 'low',
+        agentId: this.agentId,
+        module: moduleId,
+        description: `performance.memory API not available for module ${moduleId}`,
+      });
+      return findings;
+    }
+
+    // Navigate away and back N times
+    for (let i = 0; i < ITERATION_COUNT; i++) {
+      try {
+        await Promise.race([
+          page.goto('about:blank', { waitUntil: 'domcontentloaded' }),
+          new Promise((_, reject) =>
+            setTimeout(() => reject(new Error('Timeout')), NAV_TIMEOUT_MS),
+          ),
+        ]);
+        await Promise.race([
+          page.goto(fullUrl, { waitUntil: 'domcontentloaded' }),
+          new Promise((_, reject) =>
+            setTimeout(() => reject(new Error('Timeout')), NAV_TIMEOUT_MS),
+          ),
+        ]);
+      } catch {
+        // Non-fatal — continue iterations
+      }
+    }
+
+    // Record final heap size
+    const finalHeap = await this.getHeapSize(page);
+    if (finalHeap === null) {
+      return findings;
+    }
+
+    const growth = finalHeap - initialHeap;
+
+    this.addEvidence({
+      type: 'log',
+      path: `memory-${moduleId}`,
+      description: `Module ${moduleId}: initial=${(initialHeap / 1024 / 1024).toFixed(2)}MB final=${(finalHeap / 1024 / 1024).toFixed(2)}MB growth=${(growth / 1024 / 1024).toFixed(2)}MB`,
+    });
+
+    if (growth > HIGH_THRESHOLD_BYTES) {
+      findings.push({
+        id: `${this.agentId}-high-leak-${moduleId}`,
+        type: 'code-bug-logic',
+        severity: 'high',
+        agentId: this.agentId,
+        module: moduleId,
+        description: `Potential memory leak in module ${moduleId}: heap grew ${(growth / 1024 / 1024).toFixed(2)}MB after ${ITERATION_COUNT} navigation cycles (threshold: 10MB)`,
+      });
+    } else if (growth > MEDIUM_THRESHOLD_BYTES) {
+      findings.push({
+        id: `${this.agentId}-medium-leak-${moduleId}`,
+        type: 'code-bug-logic',
+        severity: 'medium',
+        agentId: this.agentId,
+        module: moduleId,
+        description: `Possible memory leak in module ${moduleId}: heap grew ${(growth / 1024 / 1024).toFixed(2)}MB after ${ITERATION_COUNT} navigation cycles (threshold: 5MB)`,
+      });
+    }
+
+    return findings;
+  }
+
+  private async getHeapSize(page: Page): Promise<number | null> {
+    try {
+      const heapSize = await page.evaluate(() => {
+        const perf = performance as Performance & {
+          memory?: { usedJSHeapSize: number };
+        };
+        return perf.memory?.usedJSHeapSize ?? null;
+      });
+      return heapSize;
+    } catch {
+      return null;
+    }
+  }
+}

package/agents/33-bundle-analyzer.ts

@@ -0,0 +1,132 @@
+import { readdir, stat } from 'node:fs/promises';
+import { join, extname } from 'node:path';
+import type { Finding } from '../core/types';
+import { BaseAgent } from './base-agent';
+
+/** Maximum individual chunk size before flagging. */
+const CHUNK_SIZE_THRESHOLD_BYTES = 250 * 1024; // 250KB
+
+interface FileInfo {
+  name: string;
+  path: string;
+  sizeBytes: number;
+}
+
+export class BundleAnalyzerAgent extends BaseAgent {
+  readonly agentId = 33;
+  readonly agentName = 'Bundle Analyzer';
+
+  protected async preFlight(): Promise<void> {
+    // No special pre-conditions — we'll report if assets dir is missing
+  }
+
+  protected async execute(): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    const projectRoot = this.config.projectRoot ?? process.cwd();
+
+    const assetsDirs = [
+      join(projectRoot, 'dist', 'assets'),
+      join(projectRoot, 'out', 'assets'),
+    ];
+
+    let assetsDir: string | null = null;
+    for (const dir of assetsDirs) {
+      try {
+        const s = await stat(dir);
+        if (s.isDirectory()) {
+          assetsDir = dir;
+          break;
+        }
+      } catch {
+        // Directory does not exist — try next
+      }
+    }
+
+    if (!assetsDir) {
+      findings.push({
+        id: `${this.agentId}-no-assets-dir`,
+        type: 'infra-issue',
+        severity: 'low',
+        agentId: this.agentId,
+        module: 'bundle-analyzer',
+        description: `No assets directory found at dist/assets or out/assets in ${projectRoot}`,
+      });
+      return findings;
+    }
+
+    let files: FileInfo[];
+    try {
+      files = await this.scanAssets(assetsDir);
+    } catch (scanError) {
+      findings.push({
+        id: `${this.agentId}-scan-error`,
+        type: 'infra-issue',
+        severity: 'medium',
+        agentId: this.agentId,
+        module: 'bundle-analyzer',
+        description: `Failed to scan assets directory: ${scanError instanceof Error ? scanError.message : String(scanError)}`,
+      });
+      return findings;
+    }
+
+    const jsFiles = files.filter(f => extname(f.name) === '.js');
+    const mapFiles = files.filter(f => extname(f.name) === '.map');
+    let totalBundleSize = 0;
+
+    // Check each JS chunk size
+    for (const file of jsFiles) {
+      totalBundleSize += file.sizeBytes;
+
+      if (file.sizeBytes > CHUNK_SIZE_THRESHOLD_BYTES) {
+        findings.push({
+          id: `${this.agentId}-large-chunk-${file.name}`,
+          type: 'test-bug',
+          severity: 'medium',
+          agentId: this.agentId,
+          module: 'bundle-analyzer',
+          file: file.path,
+          description: `JS chunk ${file.name} is ${(file.sizeBytes / 1024).toFixed(1)}KB — exceeds 250KB threshold`,
+        });
+      }
+    }
+
+    // Check for source maps in production
+    if (mapFiles.length > 0) {
+      findings.push({
+        id: `${this.agentId}-source-maps-in-production`,
+        type: 'code-bug-security',
+        severity: 'medium',
+        agentId: this.agentId,
+        module: 'bundle-analyzer',
+        description: `Found ${mapFiles.length} source map file(s) in production build — these expose source code: ${mapFiles.map(f => f.name).join(', ')}`,
+      });
+    }
+
+    this.addEvidence({
+      type: 'report',
+      path: 'bundle-analysis',
+      description: `Total bundle size: ${(totalBundleSize / 1024).toFixed(1)}KB across ${jsFiles.length} JS files. Source maps: ${mapFiles.length}`,
+    });
+
+    return findings;
+  }
+
+  private async scanAssets(dir: string): Promise<FileInfo[]> {
+    const entries = await readdir(dir, { withFileTypes: true });
+    const files: FileInfo[] = [];
+
+    for (const entry of entries) {
+      const fullPath = join(dir, entry.name);
+      if (entry.isFile()) {
+        const fileStat = await stat(fullPath);
+        files.push({
+          name: entry.name,
+          path: fullPath,
+          sizeBytes: fileStat.size,
+        });
+      }
+    }
+
+    return files;
+  }
+}

package/agents/34-xss-scanner.ts

@@ -0,0 +1,191 @@
+import type { Browser, Page } from 'playwright';
+import type { Finding } from '../core/types';
+import { BaseAgent } from './base-agent';
+import { resolveEnvironment } from '../helpers/env-resolver';
+import { login } from '../helpers/navigation';
+
+const XSS_PAYLOADS = [
+  '<script>alert(\'xss\')</script>',
+  '"><img onerror=alert(1) src=x>',
+  'javascript:alert(1)',
+] as const;
+
+const INPUT_SELECTORS = 'input[type="text"], textarea';
+const NAV_TIMEOUT_MS = 5_000;
+const MAX_MODULES = 3;
+
+export class XssScannerAgent extends BaseAgent {
+  readonly agentId = 34;
+  readonly agentName = 'XSS Scanner';
+  private baseUrl = '';
+
+  protected async preFlight(): Promise<void> {
+    if (!this.config.modules || this.config.modules.length === 0) {
+      throw new Error('XssScannerAgent requires at least one module in config.modules');
+    }
+    const { env } = await resolveEnvironment(this.config, this.phase);
+    this.baseUrl = env.baseUrl;
+  }
+
+  protected async execute(): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    const rawLoginUrl = this.config.auth.loginUrl ?? '/login';
+    const loginUrl = rawLoginUrl.startsWith('http') ? rawLoginUrl : `${this.baseUrl}${rawLoginUrl}`;
+    const credentials =
+      this.config.auth.credentials?.['admin'] ??
+      Object.values(this.config.auth.credentials ?? {})[0];
+
+    const { chromium } = await import('playwright');
+    let browser: Browser | null = null;
+
+    try {
+      browser = await chromium.launch({ headless: true });
+      const page = await browser.newPage();
+
+      if (credentials) {
+        try {
+          await login(page, credentials, loginUrl);
+        } catch (loginError) {
+          findings.push({
+            id: `${this.agentId}-login-failed`,
+            type: 'infra-issue',
+            severity: 'medium',
+            agentId: this.agentId,
+            module: 'xss-scanner',
+            description: `Login failed — continuing anonymously: ${loginError instanceof Error ? loginError.message.split('\n')[0] : String(loginError)}`,
+          });
+        }
+      }
+
+      const modules = this.config.modules.slice(0, MAX_MODULES);
+      for (const mod of modules) {
+        const moduleFindings = await this.testModuleXss(page, mod.id, mod.route);
+        findings.push(...moduleFindings);
+      }
+
+      await page.close().catch(() => undefined);
+    } catch (playwrightError) {
+      findings.push({
+        id: `${this.agentId}-playwright-failure`,
+        type: 'infra-issue',
+        severity: 'medium',
+        agentId: this.agentId,
+        module: 'xss-scanner',
+        description: `Playwright execution failed: ${playwrightError instanceof Error ? playwrightError.message.split('\n')[0] : String(playwrightError)}`,
+      });
+    } finally {
+      if (browser) await browser.close().catch(() => undefined);
+    }
+
+    return findings;
+  }
+
+  private async testModuleXss(
+    page: Page,
+    moduleId: string,
+    moduleRoute: string,
+  ): Promise<Finding[]> {
+    const findings: Finding[] = [];
+    const fullUrl = moduleRoute.startsWith('http')
+      ? moduleRoute
+      : `${this.baseUrl}${moduleRoute}`;
+
+    try {
+      await Promise.race([
+        page.goto(fullUrl, { waitUntil: 'domcontentloaded' }),
+        new Promise((_, reject) =>
+          setTimeout(() => reject(new Error('Navigation timeout')), NAV_TIMEOUT_MS),
+        ),
+      ]);
+    } catch {
+      findings.push({
+        id: `${this.agentId}-nav-failed-${moduleId}`,
+        type: 'test-bug',
+        severity: 'medium',
+        agentId: this.agentId,
+        module: moduleId,
+        description: `Failed to navigate to module ${moduleId} at ${moduleRoute}`,
+      });
+      return findings;
+    }
+
+    // Find input fields
+    let inputCount = 0;
+    try {
+      inputCount = await Promise.race([
+        page.locator(INPUT_SELECTORS).count(),
+        new Promise<number>((_, reject) =>
+          setTimeout(() => reject(new Error('Timeout')), NAV_TIMEOUT_MS),
+        ),
+      ]) as number;
+    } catch {
+      // Timeout discovering inputs
+    }
+
+    if (inputCount === 0) {
+      findings.push({
+        id: `${this.agentId}-no-inputs-${moduleId}`,
+        type: 'test-bug',
+        severity: 'low',
+        agentId: this.agentId,
+        module: moduleId,
+        description: `No text inputs or textareas found in module ${moduleId}`,
+      });
+      return findings;
+    }
+
+    // Test each payload on each input
+    for (const payload of XSS_PAYLOADS) {
+      for (let i = 0; i < inputCount; i++) {
+        let dialogFired = false;
+        const dialogHandler = (): void => {
+          dialogFired = true;
+        };
+
+        page.on('dialog', dialogHandler);
+
+        try {
+          const input = page.locator(INPUT_SELECTORS).nth(i);
+          await Promise.race([
+            input.fill(payload),
+            new Promise((_, reject) =>
+              setTimeout(() => reject(new Error('Timeout')), NAV_TIMEOUT_MS),
+            ),
+          ]);
+
+          // Brief wait to see if dialog fires
+          await new Promise(resolve => setTimeout(resolve, 500));
+
+          if (dialogFired) {
+            findings.push({
+              id: `${this.agentId}-xss-found-${moduleId}-input${i}`,
+              type: 'code-bug-security',
+              severity: 'critical',
+              agentId: this.agentId,
+              module: moduleId,
+              description: `XSS vulnerability found in module ${moduleId} input #${i} with payload: ${payload}`,
+            });
+          }
+        } catch {
+          // Input interaction failed — non-critical
+        } finally {
+          page.removeListener('dialog', dialogHandler);
+        }
+
+        // Re-navigate to reset state
+        try {
+          await Promise.race([
+            page.goto(fullUrl, { waitUntil: 'domcontentloaded' }),
+            new Promise((_, reject) =>
+              setTimeout(() => reject(new Error('Timeout')), NAV_TIMEOUT_MS),
+            ),
+          ]);
+        } catch {
+          // Navigation reset failed
+        }
+      }
+    }
+
+    return findings;
+  }
+}