@avi770/testteam 1.2.0 → 3.0.0

package/agents/__tests__/59-ssl-tls-auditor.test.ts

@@ -0,0 +1,179 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { ValidatedConfig } from '../../core/config';
+import type { Phase } from '../../core/types';
+
+function makeConfig(overrides: Partial<ValidatedConfig> = {}): ValidatedConfig {
+  return {
+    schemaVersion: 1, name: 'test',
+    auth: { loginUrl: '/login', credentials: { admin: { email: 'a@t.com', password: 's' } } },
+    modules: [{ id: 'dashboard', route: '/dashboard', sidebarIcon: true }],
+    environments: { alpha: { baseUrl: 'https://example.com', seed: false } },
+    portals: [], breakpoints: [], integrations: [], workers: [], workflows: [],
+    accuracy: { enabled: false, decimalPrecision: 2, currencySymbol: '$', timezone: 'UTC' },
+    tenancy: { enabled: false, isolationField: 'firmId', testFirms: [] },
+    costBudget: { maxPerRun: 100, maxPerAgent: 10, alertThreshold: 0.8, onExceeded: 'abort' },
+    agentClassification: { blocking: [], advisory: [] },
+    thresholds: { unitCoverage: { lines: 80, functions: 80, branches: 80, statements: 80 }, lighthouse: { accessibility: 90, performance: 90, bestPractices: 90, seo: 90 }, apiResponseTime: 2000, bundleSizeLimit: 500000, maxConsoleErrors: 0 },
+    disabledAgents: [], disabledAgentSet: new Set<number>(),
+    ...overrides,
+  };
+}
+
+const fetchMock = vi.fn();
+vi.stubGlobal('fetch', fetchMock);
+
+vi.mock('../../helpers/navigation', () => ({
+  login: vi.fn().mockResolvedValue(undefined),
+  waitForSectionLoad: vi.fn().mockResolvedValue(undefined),
+  navigateToSection: vi.fn().mockResolvedValue(undefined),
+  switchPortal: vi.fn().mockResolvedValue(undefined),
+}));
+
+const httpsGetMock = vi.fn();
+vi.mock('node:https', () => ({
+  get: (...args: unknown[]) => httpsGetMock(...args),
+}));
+
+const { SslTlsAuditorAgent } = await import('../59-ssl-tls-auditor');
+
+function createAgent(config: ValidatedConfig = makeConfig(), phase: Phase = 'beta') {
+  return new SslTlsAuditorAgent(config, phase, '/tmp/test-run');
+}
+
+describe('SslTlsAuditorAgent', () => {
+  beforeEach(() => {
+    fetchMock.mockReset().mockResolvedValue({
+      ok: true,
+      status: 200,
+      headers: new Map([['strict-transport-security', 'max-age=31536000']]),
+    });
+    fetchMock.mockResolvedValue({
+      ok: true,
+      status: 200,
+      headers: { get: vi.fn().mockReturnValue('max-age=31536000') },
+    });
+    httpsGetMock.mockReset();
+    httpsGetMock.mockImplementation((_opts: unknown, cb: Function) => {
+      const mockRes = {
+        socket: {
+          getPeerCertificate: () => ({
+            valid_to: new Date(Date.now() + 90 * 24 * 60 * 60 * 1000).toUTCString(),
+          }),
+        },
+      };
+      cb(mockRes);
+      return { on: vi.fn(), destroy: vi.fn() };
+    });
+  });
+
+  it('has agentId 59 and correct name', () => {
+    const agent = createAgent();
+    expect(agent.agentId).toBe(59);
+    expect(agent.agentName).toBe('SSL/TLS Auditor');
+  });
+
+  it('reports missing HSTS header', async () => {
+    fetchMock.mockResolvedValue({
+      ok: true, status: 200,
+      headers: { get: vi.fn().mockReturnValue(null) },
+    });
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('no-hsts'));
+    expect(finding).toBeDefined();
+    expect(finding!.severity).toBe('medium');
+  });
+
+  it('reports short HSTS max-age', async () => {
+    fetchMock.mockResolvedValue({
+      ok: true, status: 200,
+      headers: { get: vi.fn().mockReturnValue('max-age=3600') },
+    });
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('short-hsts'));
+    expect(finding).toBeDefined();
+  });
+
+  it('reports no HTTPS when base URL is HTTP', async () => {
+    const config = makeConfig({ environments: { alpha: { baseUrl: 'http://example.com', seed: false } } });
+    const agent = createAgent(config);
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('no-https'));
+    expect(finding).toBeDefined();
+    expect(finding!.severity).toBe('high');
+  });
+
+  it('reports cert expiring soon', async () => {
+    httpsGetMock.mockImplementation((_opts: unknown, cb: Function) => {
+      cb({
+        socket: {
+          getPeerCertificate: () => ({
+            valid_to: new Date(Date.now() + 15 * 24 * 60 * 60 * 1000).toUTCString(),
+          }),
+        },
+      });
+      return { on: vi.fn(), destroy: vi.fn() };
+    });
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('cert-expiring-soon'));
+    expect(finding).toBeDefined();
+    expect(finding!.severity).toBe('high');
+  });
+
+  it('reports expired cert as critical', async () => {
+    httpsGetMock.mockImplementation((_opts: unknown, cb: Function) => {
+      cb({
+        socket: {
+          getPeerCertificate: () => ({
+            valid_to: new Date(Date.now() - 5 * 24 * 60 * 60 * 1000).toUTCString(),
+          }),
+        },
+      });
+      return { on: vi.fn(), destroy: vi.fn() };
+    });
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('cert-expired'));
+    expect(finding).toBeDefined();
+    expect(finding!.severity).toBe('critical');
+  });
+
+  it('handles fetch failure', async () => {
+    fetchMock.mockRejectedValue(new Error('Fetch failed'));
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('fetch-failed'));
+    expect(finding).toBeDefined();
+  });
+
+  it('handles cert check failure', async () => {
+    httpsGetMock.mockImplementation((_opts: unknown, _cb: Function) => {
+      return {
+        on: (event: string, handler: Function) => {
+          if (event === 'error') handler(new Error('Cert error'));
+        },
+        destroy: vi.fn(),
+      };
+    });
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('cert-check-failed'));
+    expect(finding).toBeDefined();
+  });
+
+  it('no finding when cert is valid and HSTS present', async () => {
+    const agent = createAgent();
+    const result = await agent.run();
+    const certIssue = result.findings.find(f => f.id.includes('cert-expired') || f.id.includes('cert-expiring'));
+    expect(certIssue).toBeUndefined();
+  });
+
+  it('valid HSTS produces no finding', async () => {
+    const agent = createAgent();
+    const result = await agent.run();
+    const hstsFinding = result.findings.find(f => f.id.includes('no-hsts'));
+    expect(hstsFinding).toBeUndefined();
+  });
+});

package/agents/__tests__/60-dns-cdn-tester.test.ts

@@ -0,0 +1,176 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { ValidatedConfig } from '../../core/config';
+import type { Phase } from '../../core/types';
+
+function makeConfig(overrides: Partial<ValidatedConfig> = {}): ValidatedConfig {
+  return {
+    schemaVersion: 1, name: 'test',
+    auth: { loginUrl: '/login', credentials: { admin: { email: 'a@t.com', password: 's' } } },
+    modules: [{ id: 'dashboard', route: '/dashboard', sidebarIcon: true }],
+    environments: { alpha: { baseUrl: 'http://localhost:3000', seed: false } },
+    portals: [], breakpoints: [], integrations: [], workers: [], workflows: [],
+    accuracy: { enabled: false, decimalPrecision: 2, currencySymbol: '$', timezone: 'UTC' },
+    tenancy: { enabled: false, isolationField: 'firmId', testFirms: [] },
+    costBudget: { maxPerRun: 100, maxPerAgent: 10, alertThreshold: 0.8, onExceeded: 'abort' },
+    agentClassification: { blocking: [], advisory: [] },
+    thresholds: { unitCoverage: { lines: 80, functions: 80, branches: 80, statements: 80 }, lighthouse: { accessibility: 90, performance: 90, bestPractices: 90, seo: 90 }, apiResponseTime: 2000, bundleSizeLimit: 500000, maxConsoleErrors: 0 },
+    disabledAgents: [], disabledAgentSet: new Set<number>(),
+    ...overrides,
+  };
+}
+
+const fetchMock = vi.fn();
+vi.stubGlobal('fetch', fetchMock);
+
+vi.mock('../../helpers/navigation', () => ({
+  login: vi.fn().mockResolvedValue(undefined),
+  waitForSectionLoad: vi.fn().mockResolvedValue(undefined),
+  navigateToSection: vi.fn().mockResolvedValue(undefined),
+  switchPortal: vi.fn().mockResolvedValue(undefined),
+}));
+
+const { DnsCdnTesterAgent } = await import('../60-dns-cdn-tester');
+
+function createAgent(config: ValidatedConfig = makeConfig(), phase: Phase = 'beta') {
+  return new DnsCdnTesterAgent(config, phase, '/tmp/test-run');
+}
+
+describe('DnsCdnTesterAgent', () => {
+  beforeEach(() => {
+    fetchMock.mockReset();
+    fetchMock.mockResolvedValue({
+      ok: true, status: 200,
+      headers: { get: vi.fn().mockReturnValue(null) },
+    });
+  });
+
+  it('has agentId 60 and correct name', () => {
+    const agent = createAgent();
+    expect(agent.agentId).toBe(60);
+    expect(agent.agentName).toBe('DNS & CDN Tester');
+  });
+
+  it('reports no CDN when no CDN headers present', async () => {
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('no-cdn'));
+    expect(finding).toBeDefined();
+    expect(finding!.severity).toBe('low');
+  });
+
+  it('reports no cache-control header', async () => {
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('no-cache-control'));
+    expect(finding).toBeDefined();
+  });
+
+  it('detects Cloudflare CDN', async () => {
+    fetchMock.mockResolvedValue({
+      ok: true, status: 200,
+      headers: {
+        get: (name: string) => {
+          if (name === 'cf-ray') return 'abc123';
+          if (name === 'cache-control') return 'public, max-age=3600';
+          return null;
+        },
+      },
+    });
+    const agent = createAgent();
+    const result = await agent.run();
+    const cdnFinding = result.findings.find(f => f.id.includes('no-cdn'));
+    expect(cdnFinding).toBeUndefined();
+  });
+
+  it('reports slow response time', async () => {
+    // Simulate slow response by delaying fetch
+    fetchMock.mockImplementation(async () => {
+      await new Promise(resolve => setTimeout(resolve, 50));
+      return {
+        ok: true, status: 200,
+        headers: { get: vi.fn().mockReturnValue(null) },
+      };
+    });
+    // Can't easily test timing, but verify structure
+    const agent = createAgent();
+    const result = await agent.run();
+    expect(result.status).toBeDefined();
+  });
+
+  it('handles fetch failure', async () => {
+    fetchMock.mockRejectedValue(new Error('Network error'));
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('fetch-failed'));
+    expect(finding).toBeDefined();
+  });
+
+  it('reports cache-control present', async () => {
+    fetchMock.mockResolvedValue({
+      ok: true, status: 200,
+      headers: {
+        get: (name: string) => {
+          if (name === 'cache-control') return 'public, max-age=3600';
+          return null;
+        },
+      },
+    });
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('no-cache-control'));
+    expect(finding).toBeUndefined();
+  });
+
+  it('detects no-store cache control', async () => {
+    fetchMock.mockResolvedValue({
+      ok: true, status: 200,
+      headers: {
+        get: (name: string) => {
+          if (name === 'cache-control') return 'no-store';
+          return null;
+        },
+      },
+    });
+    const agent = createAgent();
+    const result = await agent.run();
+    expect(result.status).toBeDefined();
+  });
+
+  it('detects Vercel CDN', async () => {
+    fetchMock.mockResolvedValue({
+      ok: true, status: 200,
+      headers: {
+        get: (name: string) => {
+          if (name === 'x-vercel-cache') return 'HIT';
+          if (name === 'cache-control') return 'public';
+          return null;
+        },
+      },
+    });
+    const agent = createAgent();
+    const result = await agent.run();
+    const cdnFinding = result.findings.find(f => f.id.includes('no-cdn'));
+    expect(cdnFinding).toBeUndefined();
+  });
+
+  it('runs without error for valid response', async () => {
+    fetchMock.mockResolvedValue({
+      ok: true, status: 200,
+      headers: {
+        get: (name: string) => {
+          if (name === 'cache-control') return 'max-age=300';
+          return null;
+        },
+      },
+    });
+    const agent = createAgent();
+    const result = await agent.run();
+    expect(result.status).toBe('passed');
+  });
+
+  it('resolves environment in preFlight', async () => {
+    const agent = createAgent();
+    const result = await agent.run();
+    expect(result.findings.every(f => !f.description.includes('preFlight'))).toBe(true);
+  });
+});

package/agents/__tests__/61-docker-health-checker.test.ts

@@ -0,0 +1,150 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { ValidatedConfig } from '../../core/config';
+import type { Phase } from '../../core/types';
+
+function makeConfig(overrides: Partial<ValidatedConfig> = {}): ValidatedConfig {
+  return {
+    schemaVersion: 1, name: 'test',
+    projectRoot: '/fake/project',
+    auth: { loginUrl: '/login', credentials: { admin: { email: 'a@t.com', password: 's' } } },
+    modules: [{ id: 'dashboard', route: '/dashboard', sidebarIcon: true }],
+    environments: { alpha: { baseUrl: 'http://localhost:3000', seed: false } },
+    portals: [], breakpoints: [], integrations: [], workers: [], workflows: [],
+    accuracy: { enabled: false, decimalPrecision: 2, currencySymbol: '$', timezone: 'UTC' },
+    tenancy: { enabled: false, isolationField: 'firmId', testFirms: [] },
+    costBudget: { maxPerRun: 100, maxPerAgent: 10, alertThreshold: 0.8, onExceeded: 'abort' },
+    agentClassification: { blocking: [], advisory: [] },
+    thresholds: { unitCoverage: { lines: 80, functions: 80, branches: 80, statements: 80 }, lighthouse: { accessibility: 90, performance: 90, bestPractices: 90, seo: 90 }, apiResponseTime: 2000, bundleSizeLimit: 500000, maxConsoleErrors: 0 },
+    disabledAgents: [], disabledAgentSet: new Set<number>(),
+    ...overrides,
+  };
+}
+
+const fetchMock = vi.fn().mockResolvedValue({ ok: true, status: 200 });
+vi.stubGlobal('fetch', fetchMock);
+
+vi.mock('../../helpers/navigation', () => ({
+  login: vi.fn().mockResolvedValue(undefined),
+  waitForSectionLoad: vi.fn().mockResolvedValue(undefined),
+  navigateToSection: vi.fn().mockResolvedValue(undefined),
+  switchPortal: vi.fn().mockResolvedValue(undefined),
+}));
+
+const existsSyncMock = vi.fn();
+const readFileSyncMock = vi.fn();
+const statSyncMock = vi.fn();
+
+vi.mock('node:fs', () => ({
+  existsSync: (...args: unknown[]) => existsSyncMock(...args),
+  readFileSync: (...args: unknown[]) => readFileSyncMock(...args),
+  statSync: (...args: unknown[]) => statSyncMock(...args),
+}));
+
+const { DockerHealthCheckerAgent } = await import('../61-docker-health-checker');
+
+function createAgent(config: ValidatedConfig = makeConfig(), phase: Phase = 'beta') {
+  return new DockerHealthCheckerAgent(config, phase, '/tmp/test-run');
+}
+
+describe('DockerHealthCheckerAgent', () => {
+  beforeEach(() => {
+    existsSyncMock.mockReset();
+    readFileSyncMock.mockReset();
+    statSyncMock.mockReset().mockReturnValue({ size: 500 });
+  });
+
+  it('has agentId 61 and correct name', () => {
+    const agent = createAgent();
+    expect(agent.agentId).toBe(61);
+    expect(agent.agentName).toBe('Docker Health Checker');
+  });
+
+  it('reports no Dockerfile when not found', async () => {
+    existsSyncMock.mockReturnValue(false);
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('no-dockerfile'));
+    expect(finding).toBeDefined();
+  });
+
+  it('reports USER root as high severity', async () => {
+    existsSyncMock.mockImplementation((p: string) => p.includes('Dockerfile'));
+    readFileSyncMock.mockReturnValue('FROM node:18\nCOPY . .\nUSER root\nCMD ["node", "app.js"]');
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('user-root'));
+    expect(finding).toBeDefined();
+    expect(finding!.severity).toBe('high');
+  });
+
+  it('reports missing HEALTHCHECK', async () => {
+    existsSyncMock.mockImplementation((p: string) => p.includes('Dockerfile') || p.includes('.dockerignore'));
+    readFileSyncMock.mockReturnValue('FROM node:18\nUSER app\nCMD ["node", "app.js"]');
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('no-healthcheck'));
+    expect(finding).toBeDefined();
+    expect(finding!.severity).toBe('medium');
+  });
+
+  it('reports missing .dockerignore', async () => {
+    existsSyncMock.mockImplementation((p: string) => p.includes('Dockerfile') && !p.includes('.dockerignore'));
+    readFileSyncMock.mockReturnValue('FROM node:18\nHEALTHCHECK CMD curl -f http://localhost/ || exit 1\nUSER app\nCMD ["node", "app.js"]');
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('no-dockerignore'));
+    expect(finding).toBeDefined();
+    expect(finding!.severity).toBe('low');
+  });
+
+  it('no findings when Dockerfile is well configured', async () => {
+    existsSyncMock.mockReturnValue(true);
+    readFileSyncMock.mockReturnValue('FROM node:18\nHEALTHCHECK CMD curl -f http://localhost/ || exit 1\nUSER app\nCMD ["node", "app.js"]');
+    const agent = createAgent();
+    const result = await agent.run();
+    expect(result.findings.filter(f => f.severity === 'high' || f.severity === 'critical').length).toBe(0);
+  });
+
+  it('handles read error gracefully', async () => {
+    existsSyncMock.mockReturnValue(true);
+    readFileSyncMock.mockImplementation(() => { throw new Error('Read error'); });
+    const agent = createAgent();
+    const result = await agent.run();
+    expect(result.status).toBe('failed');
+  });
+
+  it('adds evidence with Dockerfile size', async () => {
+    existsSyncMock.mockReturnValue(true);
+    readFileSyncMock.mockReturnValue('FROM node:18\nHEALTHCHECK CMD curl\nUSER app');
+    statSyncMock.mockReturnValue({ size: 150 });
+    const agent = createAgent();
+    const result = await agent.run();
+    expect(result.evidence.length).toBeGreaterThan(0);
+  });
+
+  it('detects HEALTHCHECK when present', async () => {
+    existsSyncMock.mockReturnValue(true);
+    readFileSyncMock.mockReturnValue('FROM node:18\nHEALTHCHECK CMD curl -f http://localhost/ || exit 1\nUSER app');
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('no-healthcheck'));
+    expect(finding).toBeUndefined();
+  });
+
+  it('detects non-root USER as safe', async () => {
+    existsSyncMock.mockReturnValue(true);
+    readFileSyncMock.mockReturnValue('FROM node:18\nHEALTHCHECK CMD curl\nUSER appuser');
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('user-root'));
+    expect(finding).toBeUndefined();
+  });
+
+  it('handles empty Dockerfile', async () => {
+    existsSyncMock.mockReturnValue(true);
+    readFileSyncMock.mockReturnValue('');
+    const agent = createAgent();
+    const result = await agent.run();
+    expect(result.status).toBeDefined();
+  });
+});

package/agents/__tests__/62-env-config-validator.test.ts

@@ -0,0 +1,166 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { ValidatedConfig } from '../../core/config';
+import type { Phase } from '../../core/types';
+
+function makeConfig(overrides: Partial<ValidatedConfig> = {}): ValidatedConfig {
+  return {
+    schemaVersion: 1, name: 'test',
+    projectRoot: '/fake/project',
+    auth: { loginUrl: '/login', credentials: { admin: { email: 'a@t.com', password: 's' } } },
+    modules: [{ id: 'dashboard', route: '/dashboard', sidebarIcon: true }],
+    environments: { alpha: { baseUrl: 'http://localhost:3000', seed: false } },
+    portals: [], breakpoints: [], integrations: [], workers: [], workflows: [],
+    accuracy: { enabled: false, decimalPrecision: 2, currencySymbol: '$', timezone: 'UTC' },
+    tenancy: { enabled: false, isolationField: 'firmId', testFirms: [] },
+    costBudget: { maxPerRun: 100, maxPerAgent: 10, alertThreshold: 0.8, onExceeded: 'abort' },
+    agentClassification: { blocking: [], advisory: [] },
+    thresholds: { unitCoverage: { lines: 80, functions: 80, branches: 80, statements: 80 }, lighthouse: { accessibility: 90, performance: 90, bestPractices: 90, seo: 90 }, apiResponseTime: 2000, bundleSizeLimit: 500000, maxConsoleErrors: 0 },
+    disabledAgents: [], disabledAgentSet: new Set<number>(),
+    ...overrides,
+  };
+}
+
+const fetchMock = vi.fn().mockResolvedValue({ ok: true, status: 200 });
+vi.stubGlobal('fetch', fetchMock);
+
+vi.mock('../../helpers/navigation', () => ({
+  login: vi.fn().mockResolvedValue(undefined),
+  waitForSectionLoad: vi.fn().mockResolvedValue(undefined),
+  navigateToSection: vi.fn().mockResolvedValue(undefined),
+  switchPortal: vi.fn().mockResolvedValue(undefined),
+}));
+
+const existsSyncMock = vi.fn();
+const readFileSyncMock = vi.fn();
+
+vi.mock('node:fs', () => ({
+  existsSync: (...args: unknown[]) => existsSyncMock(...args),
+  readFileSync: (...args: unknown[]) => readFileSyncMock(...args),
+}));
+
+const { EnvConfigValidatorAgent } = await import('../62-env-config-validator');
+
+function createAgent(config: ValidatedConfig = makeConfig(), phase: Phase = 'beta') {
+  return new EnvConfigValidatorAgent(config, phase, '/tmp/test-run');
+}
+
+describe('EnvConfigValidatorAgent', () => {
+  beforeEach(() => {
+    existsSyncMock.mockReset();
+    readFileSyncMock.mockReset();
+  });
+
+  it('has agentId 62 and correct name', () => {
+    const agent = createAgent();
+    expect(agent.agentId).toBe(62);
+    expect(agent.agentName).toBe('Env Config Validator');
+  });
+
+  it('reports no env files when none found', async () => {
+    existsSyncMock.mockReturnValue(false);
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('no-env-files'));
+    expect(finding).toBeDefined();
+  });
+
+  it('reports missing env var when defined in example but not env', async () => {
+    existsSyncMock.mockReturnValue(true);
+    readFileSyncMock.mockImplementation((p: string) => {
+      if (p.includes('.env.example')) return 'DB_HOST=localhost\nDB_PORT=5432\nAPI_KEY=secret';
+      return 'DB_HOST=localhost';
+    });
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('missing-env-var'));
+    expect(finding).toBeDefined();
+  });
+
+  it('reports invalid URL format', async () => {
+    existsSyncMock.mockReturnValue(true);
+    readFileSyncMock.mockImplementation((p: string) => {
+      if (p.includes('.env.example')) return 'API_URL=url';
+      return 'API_URL=not-a-url';
+    });
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('invalid-url'));
+    expect(finding).toBeDefined();
+  });
+
+  it('reports invalid port format', async () => {
+    existsSyncMock.mockReturnValue(true);
+    readFileSyncMock.mockImplementation((p: string) => {
+      if (p.includes('.env.example')) return 'DB_PORT=5432';
+      return 'DB_PORT=abc';
+    });
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('invalid-port'));
+    expect(finding).toBeDefined();
+  });
+
+  it('reports placeholder values', async () => {
+    existsSyncMock.mockReturnValue(true);
+    readFileSyncMock.mockImplementation((p: string) => {
+      if (p.includes('.env.example')) return 'SECRET=change';
+      return 'SECRET=your-secret-here';
+    });
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('placeholder'));
+    expect(finding).toBeDefined();
+  });
+
+  it('no findings when env matches example', async () => {
+    existsSyncMock.mockReturnValue(true);
+    readFileSyncMock.mockImplementation((p: string) => {
+      if (p.includes('.env.example')) return 'DB_HOST=\nDB_PORT=';
+      return 'DB_HOST=localhost\nDB_PORT=5432';
+    });
+    const agent = createAgent();
+    const result = await agent.run();
+    const missing = result.findings.find(f => f.id.includes('missing-env-var'));
+    expect(missing).toBeUndefined();
+  });
+
+  it('handles only .env existing (no example)', async () => {
+    existsSyncMock.mockImplementation((p: string) => !p.includes('.env.example'));
+    readFileSyncMock.mockReturnValue('DB_HOST=localhost');
+    const agent = createAgent();
+    const result = await agent.run();
+    expect(result.status).toBeDefined();
+  });
+
+  it('handles only .env.example existing', async () => {
+    existsSyncMock.mockImplementation((p: string) => p.includes('.env.example'));
+    readFileSyncMock.mockReturnValue('DB_HOST=localhost');
+    const agent = createAgent();
+    const result = await agent.run();
+    expect(result.status).toBeDefined();
+  });
+
+  it('skips comments and empty lines', async () => {
+    existsSyncMock.mockReturnValue(true);
+    readFileSyncMock.mockImplementation((p: string) => {
+      if (p.includes('.env.example')) return '# Comment\n\nDB_HOST=localhost';
+      return '# Comment\n\nDB_HOST=localhost';
+    });
+    const agent = createAgent();
+    const result = await agent.run();
+    const missing = result.findings.find(f => f.id.includes('missing-env-var'));
+    expect(missing).toBeUndefined();
+  });
+
+  it('valid URL passes validation', async () => {
+    existsSyncMock.mockReturnValue(true);
+    readFileSyncMock.mockImplementation((p: string) => {
+      if (p.includes('.env.example')) return 'API_URL=url';
+      return 'API_URL=https://api.example.com';
+    });
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('invalid-url'));
+    expect(finding).toBeUndefined();
+  });
+});