@avi770/testteam 1.2.0 → 3.0.0

package/agents/__tests__/63-log-quality-auditor.test.ts

@@ -0,0 +1,175 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { ValidatedConfig } from '../../core/config';
+import type { Phase } from '../../core/types';
+
+function makeConfig(overrides: Partial<ValidatedConfig> = {}): ValidatedConfig {
+  return {
+    schemaVersion: 1, name: 'test',
+    projectRoot: '/fake/project',
+    auth: { loginUrl: '/login', credentials: { admin: { email: 'a@t.com', password: 's' } } },
+    modules: [{ id: 'dashboard', route: '/dashboard', sidebarIcon: true }],
+    environments: { alpha: { baseUrl: 'http://localhost:3000', seed: false } },
+    portals: [], breakpoints: [], integrations: [], workers: [], workflows: [],
+    accuracy: { enabled: false, decimalPrecision: 2, currencySymbol: '$', timezone: 'UTC' },
+    tenancy: { enabled: false, isolationField: 'firmId', testFirms: [] },
+    costBudget: { maxPerRun: 100, maxPerAgent: 10, alertThreshold: 0.8, onExceeded: 'abort' },
+    agentClassification: { blocking: [], advisory: [] },
+    thresholds: { unitCoverage: { lines: 80, functions: 80, branches: 80, statements: 80 }, lighthouse: { accessibility: 90, performance: 90, bestPractices: 90, seo: 90 }, apiResponseTime: 2000, bundleSizeLimit: 500000, maxConsoleErrors: 0 },
+    disabledAgents: [], disabledAgentSet: new Set<number>(),
+    ...overrides,
+  };
+}
+
+const fetchMock = vi.fn().mockResolvedValue({ ok: true, status: 200 });
+vi.stubGlobal('fetch', fetchMock);
+
+vi.mock('../../helpers/navigation', () => ({
+  login: vi.fn().mockResolvedValue(undefined),
+  waitForSectionLoad: vi.fn().mockResolvedValue(undefined),
+  navigateToSection: vi.fn().mockResolvedValue(undefined),
+  switchPortal: vi.fn().mockResolvedValue(undefined),
+}));
+
+const existsSyncMock = vi.fn();
+const readFileSyncMock = vi.fn();
+const readdirSyncMock = vi.fn();
+
+vi.mock('node:fs', () => ({
+  existsSync: (...args: unknown[]) => existsSyncMock(...args),
+  readFileSync: (...args: unknown[]) => readFileSyncMock(...args),
+  readdirSync: (...args: unknown[]) => readdirSyncMock(...args),
+}));
+
+const { LogQualityAuditorAgent } = await import('../63-log-quality-auditor');
+
+function createAgent(config: ValidatedConfig = makeConfig(), phase: Phase = 'beta') {
+  return new LogQualityAuditorAgent(config, phase, '/tmp/test-run');
+}
+
+describe('LogQualityAuditorAgent', () => {
+  beforeEach(() => {
+    existsSyncMock.mockReset().mockReturnValue(true);
+    readFileSyncMock.mockReset();
+    readdirSyncMock.mockReset();
+  });
+
+  it('has agentId 63 and correct name', () => {
+    const agent = createAgent();
+    expect(agent.agentId).toBe(63);
+    expect(agent.agentName).toBe('Log Quality Auditor');
+  });
+
+  it('reports no src dir when missing', async () => {
+    existsSyncMock.mockReturnValue(false);
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('no-src-dir'));
+    expect(finding).toBeDefined();
+  });
+
+  it('detects console.log calls', async () => {
+    readdirSyncMock.mockReturnValue([
+      { name: 'app.ts', isFile: () => true, isDirectory: () => false },
+    ]);
+    readFileSyncMock.mockReturnValue('const x = 1;\nconsole.log("debug");\nreturn x;');
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('console-log'));
+    expect(finding).toBeDefined();
+    expect(finding!.severity).toBe('low');
+  });
+
+  it('detects unstructured console.error', async () => {
+    readdirSyncMock.mockReturnValue([
+      { name: 'app.ts', isFile: () => true, isDirectory: () => false },
+    ]);
+    readFileSyncMock.mockReturnValue('console.error("something failed");');
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('unstructured-error'));
+    expect(finding).toBeDefined();
+    expect(finding!.severity).toBe('medium');
+  });
+
+  it('reports no structured logging when none found', async () => {
+    readdirSyncMock.mockReturnValue([
+      { name: 'app.ts', isFile: () => true, isDirectory: () => false },
+    ]);
+    readFileSyncMock.mockReturnValue('const x = 1;');
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('no-structured-logging'));
+    expect(finding).toBeDefined();
+  });
+
+  it('no logging finding when pino detected', async () => {
+    readdirSyncMock.mockReturnValue([
+      { name: 'app.ts', isFile: () => true, isDirectory: () => false },
+    ]);
+    readFileSyncMock.mockReturnValue('import pino from "pino";\nconst logger = pino();');
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('no-structured-logging'));
+    expect(finding).toBeUndefined();
+  });
+
+  it('skips test files', async () => {
+    readdirSyncMock.mockReturnValue([
+      { name: 'app.test.ts', isFile: () => true, isDirectory: () => false },
+    ]);
+    const agent = createAgent();
+    const result = await agent.run();
+    // Should not find console.log in test files
+    expect(result.status).toBeDefined();
+  });
+
+  it('recurses into subdirectories', async () => {
+    readdirSyncMock
+      .mockReturnValueOnce([
+        { name: 'utils', isFile: () => false, isDirectory: () => true },
+      ])
+      .mockReturnValueOnce([
+        { name: 'helper.ts', isFile: () => true, isDirectory: () => false },
+      ]);
+    readFileSyncMock.mockReturnValue('const x = 1;');
+    const agent = createAgent();
+    const result = await agent.run();
+    expect(result.status).toBeDefined();
+  });
+
+  it('limits console.log findings to 5', async () => {
+    readdirSyncMock.mockReturnValue([
+      { name: 'app.ts', isFile: () => true, isDirectory: () => false },
+    ]);
+    readFileSyncMock.mockReturnValue(
+      Array(10).fill('console.log("x");').join('\n'),
+    );
+    const agent = createAgent();
+    const result = await agent.run();
+    const logFindings = result.findings.filter(f => f.id.match(/console-log-\d+/));
+    expect(logFindings.length).toBe(5);
+    const summary = result.findings.find(f => f.id.includes('console-log-summary'));
+    expect(summary).toBeDefined();
+  });
+
+  it('adds evidence with scan stats', async () => {
+    readdirSyncMock.mockReturnValue([
+      { name: 'app.ts', isFile: () => true, isDirectory: () => false },
+    ]);
+    readFileSyncMock.mockReturnValue('const x = 1;');
+    const agent = createAgent();
+    const result = await agent.run();
+    expect(result.evidence.length).toBeGreaterThan(0);
+  });
+
+  it('detects winston as structured logging', async () => {
+    readdirSyncMock.mockReturnValue([
+      { name: 'logger.ts', isFile: () => true, isDirectory: () => false },
+    ]);
+    readFileSyncMock.mockReturnValue('import winston from "winston";');
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('no-structured-logging'));
+    expect(finding).toBeUndefined();
+  });
+});

package/agents/__tests__/64-analytics-tracker-tester.test.ts

@@ -0,0 +1,158 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { ValidatedConfig } from '../../core/config';
+import type { Phase } from '../../core/types';
+
+function makeConfig(overrides: Partial<ValidatedConfig> = {}): ValidatedConfig {
+  return {
+    schemaVersion: 1, name: 'test',
+    auth: { loginUrl: 'http://localhost/login', credentials: { admin: { email: 'a@t.com', password: 's' } } },
+    modules: [
+      { id: 'dashboard', route: '/dashboard', sidebarIcon: true },
+      { id: 'tasks', route: '/tasks', sidebarIcon: true },
+    ],
+    environments: { alpha: { baseUrl: 'http://localhost:3000', seed: false } },
+    portals: [], breakpoints: [], integrations: [], workers: [], workflows: [],
+    accuracy: { enabled: false, decimalPrecision: 2, currencySymbol: '$', timezone: 'UTC' },
+    tenancy: { enabled: false, isolationField: 'firmId', testFirms: [] },
+    costBudget: { maxPerRun: 100, maxPerAgent: 10, alertThreshold: 0.8, onExceeded: 'abort' },
+    agentClassification: { blocking: [], advisory: [] },
+    thresholds: { unitCoverage: { lines: 80, functions: 80, branches: 80, statements: 80 }, lighthouse: { accessibility: 90, performance: 90, bestPractices: 90, seo: 90 }, apiResponseTime: 2000, bundleSizeLimit: 500000, maxConsoleErrors: 0 },
+    disabledAgents: [], disabledAgentSet: new Set<number>(),
+    ...overrides,
+  };
+}
+
+const fetchMock = vi.fn();
+vi.stubGlobal('fetch', fetchMock);
+
+const loginMock = vi.fn().mockResolvedValue(undefined);
+vi.mock('../../helpers/navigation', () => ({
+  login: (...args: unknown[]) => loginMock(...args),
+  waitForSectionLoad: vi.fn().mockResolvedValue(undefined),
+  navigateToSection: vi.fn().mockResolvedValue(undefined),
+  switchPortal: vi.fn().mockResolvedValue(undefined),
+}));
+
+function makeMockPage() {
+  return {
+    close: vi.fn().mockResolvedValue(undefined),
+    goto: vi.fn().mockResolvedValue(undefined),
+    on: vi.fn(),
+    locator: vi.fn().mockReturnValue({ count: vi.fn().mockResolvedValue(0) }),
+  };
+}
+
+let currentMockPage: ReturnType<typeof makeMockPage>;
+let mockBrowser: { newPage: ReturnType<typeof vi.fn>; close: ReturnType<typeof vi.fn> };
+
+vi.mock('playwright', async () => ({
+  chromium: { launch: vi.fn().mockImplementation(async () => mockBrowser) },
+}));
+
+const { AnalyticsTrackerTesterAgent } = await import('../64-analytics-tracker-tester');
+
+function createAgent(config: ValidatedConfig = makeConfig(), phase: Phase = 'beta') {
+  return new AnalyticsTrackerTesterAgent(config, phase, '/tmp/test-run');
+}
+
+describe('AnalyticsTrackerTesterAgent', () => {
+  beforeEach(() => {
+    fetchMock.mockReset().mockResolvedValue({ ok: true, status: 200 });
+    loginMock.mockReset().mockResolvedValue(undefined);
+    currentMockPage = makeMockPage();
+    mockBrowser = {
+      newPage: vi.fn().mockResolvedValue(currentMockPage),
+      close: vi.fn().mockResolvedValue(undefined),
+    };
+  });
+
+  it('has agentId 64 and correct name', () => {
+    const agent = createAgent();
+    expect(agent.agentId).toBe(64);
+    expect(agent.agentName).toBe('Analytics Tracker Tester');
+  });
+
+  it('throws when modules empty', async () => {
+    const agent = createAgent(makeConfig({ modules: [] }));
+    const result = await agent.run();
+    expect(result.status).toBe('failed');
+  });
+
+  it('reports no analytics when none detected', async () => {
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('no-analytics'));
+    expect(finding).toBeDefined();
+    expect(finding!.severity).toBe('low');
+  });
+
+  it('detects analytics requests via event handler', async () => {
+    currentMockPage.on.mockImplementation((event: string, handler: Function) => {
+      if (event === 'request') {
+        handler({ url: () => 'https://www.google-analytics.com/collect?v=1&t=pageview' });
+      }
+    });
+    const agent = createAgent();
+    const result = await agent.run();
+    const noAnalytics = result.findings.find(f => f.id.includes('no-analytics'));
+    expect(noAnalytics).toBeUndefined();
+  });
+
+  it('detects duplicate pageviews', async () => {
+    currentMockPage.on.mockImplementation((event: string, handler: Function) => {
+      if (event === 'request') {
+        // Fire many pageview events
+        for (let i = 0; i < 10; i++) {
+          handler({ url: () => `https://www.google-analytics.com/collect?v=1&t=pageview&_=${i}` });
+        }
+      }
+    });
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('duplicate-pageviews'));
+    expect(finding).toBeDefined();
+  });
+
+  it('handles login failure', async () => {
+    loginMock.mockRejectedValue(new Error('Login failed'));
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('login-failed'));
+    expect(finding).toBeDefined();
+  });
+
+  it('handles playwright crash', async () => {
+    mockBrowser.newPage.mockRejectedValue(new Error('Crash'));
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('playwright-failure'));
+    expect(finding).toBeDefined();
+  });
+
+  it('closes browser in finally', async () => {
+    mockBrowser.newPage.mockRejectedValue(new Error('Crash'));
+    const agent = createAgent();
+    await agent.run();
+    expect(mockBrowser.close).toHaveBeenCalled();
+  });
+
+  it('handles nav failure for module', async () => {
+    currentMockPage.goto.mockRejectedValue(new Error('Nav failed'));
+    const agent = createAgent();
+    const result = await agent.run();
+    expect(result.status).toBeDefined();
+  });
+
+  it('registers request event listener', async () => {
+    const agent = createAgent();
+    await agent.run();
+    expect(currentMockPage.on).toHaveBeenCalledWith('request', expect.any(Function));
+  });
+
+  it('no credentials continues', async () => {
+    const config = makeConfig({ auth: { loginUrl: '/login', credentials: {} } });
+    const agent = createAgent(config);
+    const result = await agent.run();
+    expect(result.status).toBeDefined();
+  });
+});

package/agents/__tests__/65-gdpr-compliance-tester.test.ts

@@ -0,0 +1,174 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { ValidatedConfig } from '../../core/config';
+import type { Phase } from '../../core/types';
+
+function makeConfig(overrides: Partial<ValidatedConfig> = {}): ValidatedConfig {
+  return {
+    schemaVersion: 1, name: 'test',
+    auth: { loginUrl: 'http://localhost/login', credentials: { admin: { email: 'a@t.com', password: 's' } } },
+    modules: [{ id: 'dashboard', route: '/dashboard', sidebarIcon: true }],
+    environments: { alpha: { baseUrl: 'http://localhost:3000', seed: false } },
+    portals: [], breakpoints: [], integrations: [], workers: [], workflows: [],
+    accuracy: { enabled: false, decimalPrecision: 2, currencySymbol: '$', timezone: 'UTC' },
+    tenancy: { enabled: false, isolationField: 'firmId', testFirms: [] },
+    costBudget: { maxPerRun: 100, maxPerAgent: 10, alertThreshold: 0.8, onExceeded: 'abort' },
+    agentClassification: { blocking: [], advisory: [] },
+    thresholds: { unitCoverage: { lines: 80, functions: 80, branches: 80, statements: 80 }, lighthouse: { accessibility: 90, performance: 90, bestPractices: 90, seo: 90 }, apiResponseTime: 2000, bundleSizeLimit: 500000, maxConsoleErrors: 0 },
+    disabledAgents: [], disabledAgentSet: new Set<number>(),
+    ...overrides,
+  };
+}
+
+const fetchMock = vi.fn();
+vi.stubGlobal('fetch', fetchMock);
+
+const loginMock = vi.fn().mockResolvedValue(undefined);
+vi.mock('../../helpers/navigation', () => ({
+  login: (...args: unknown[]) => loginMock(...args),
+  waitForSectionLoad: vi.fn().mockResolvedValue(undefined),
+  navigateToSection: vi.fn().mockResolvedValue(undefined),
+  switchPortal: vi.fn().mockResolvedValue(undefined),
+}));
+
+function makeMockLocator(countVal = 0) {
+  const loc: Record<string, ReturnType<typeof vi.fn>> = {
+    count: vi.fn().mockResolvedValue(countVal),
+    first: vi.fn(),
+  };
+  loc.first.mockReturnValue(loc);
+  return loc;
+}
+
+function makeMockPage() {
+  return {
+    close: vi.fn().mockResolvedValue(undefined),
+    goto: vi.fn().mockResolvedValue(undefined),
+    evaluate: vi.fn().mockResolvedValue(''),
+    locator: vi.fn().mockReturnValue(makeMockLocator(0)),
+    on: vi.fn(),
+  };
+}
+
+let mockFreshPage: ReturnType<typeof makeMockPage>;
+let mockMainPage: ReturnType<typeof makeMockPage>;
+let contextCallCount: number;
+let mockBrowser: { newPage: ReturnType<typeof vi.fn>; newContext: ReturnType<typeof vi.fn>; close: ReturnType<typeof vi.fn> };
+
+vi.mock('playwright', async () => ({
+  chromium: { launch: vi.fn().mockImplementation(async () => mockBrowser) },
+}));
+
+const { GdprComplianceTesterAgent } = await import('../65-gdpr-compliance-tester');
+
+function createAgent(config: ValidatedConfig = makeConfig(), phase: Phase = 'beta') {
+  return new GdprComplianceTesterAgent(config, phase, '/tmp/test-run');
+}
+
+describe('GdprComplianceTesterAgent', () => {
+  beforeEach(() => {
+    fetchMock.mockReset().mockResolvedValue({ ok: true, status: 200 });
+    loginMock.mockReset().mockResolvedValue(undefined);
+    mockFreshPage = makeMockPage();
+    mockMainPage = makeMockPage();
+    contextCallCount = 0;
+    mockBrowser = {
+      newPage: vi.fn().mockResolvedValue(mockMainPage),
+      newContext: vi.fn().mockResolvedValue({
+        newPage: vi.fn().mockResolvedValue(mockFreshPage),
+        close: vi.fn().mockResolvedValue(undefined),
+      }),
+      close: vi.fn().mockResolvedValue(undefined),
+    };
+  });
+
+  it('has agentId 65 and correct name', () => {
+    const agent = createAgent();
+    expect(agent.agentId).toBe(65);
+    expect(agent.agentName).toBe('GDPR Compliance Tester');
+  });
+
+  it('reports no cookie consent when not found', async () => {
+    mockFreshPage.evaluate.mockResolvedValue('welcome to our app');
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('no-cookie-consent'));
+    expect(finding).toBeDefined();
+    expect(finding!.severity).toBe('high');
+  });
+
+  it('detects cookie consent text', async () => {
+    mockFreshPage.evaluate.mockResolvedValue('we use cookies to improve your experience');
+    mockFreshPage.locator.mockReturnValue(makeMockLocator(1)); // accept button
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('no-cookie-consent'));
+    expect(finding).toBeUndefined();
+  });
+
+  it('reports no privacy policy link', async () => {
+    mockFreshPage.evaluate.mockResolvedValue('cookie consent here');
+    mockMainPage.locator.mockReturnValue(makeMockLocator(0));
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('no-privacy-policy'));
+    expect(finding).toBeDefined();
+  });
+
+  it('reports no delete account option', async () => {
+    mockFreshPage.evaluate.mockResolvedValue('cookie consent');
+    mockMainPage.evaluate.mockResolvedValue(false); // no delete account
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('no-delete-account'));
+    expect(finding).toBeDefined();
+  });
+
+  it('handles login failure', async () => {
+    loginMock.mockRejectedValue(new Error('Login failed'));
+    mockFreshPage.evaluate.mockResolvedValue('cookie');
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('login-failed'));
+    expect(finding).toBeDefined();
+  });
+
+  it('handles playwright crash', async () => {
+    mockBrowser.newContext.mockRejectedValue(new Error('Crash'));
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('playwright-failure'));
+    expect(finding).toBeDefined();
+  });
+
+  it('closes browser in finally', async () => {
+    mockBrowser.newContext.mockRejectedValue(new Error('Crash'));
+    const agent = createAgent();
+    await agent.run();
+    expect(mockBrowser.close).toHaveBeenCalled();
+  });
+
+  it('reports consent text but no accept button', async () => {
+    mockFreshPage.evaluate.mockResolvedValue('we use cookies');
+    mockFreshPage.locator.mockReturnValue(makeMockLocator(0)); // no accept button
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('no-consent-button'));
+    expect(finding).toBeDefined();
+  });
+
+  it('handles nav failure', async () => {
+    mockFreshPage.goto.mockRejectedValue(new Error('Nav failed'));
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('nav-failed'));
+    expect(finding).toBeDefined();
+  });
+
+  it('no credentials skips delete account check gracefully', async () => {
+    const config = makeConfig({ auth: { loginUrl: '/login', credentials: {} } });
+    mockFreshPage.evaluate.mockResolvedValue('cookie consent');
+    const agent = createAgent(config);
+    const result = await agent.run();
+    expect(result.status).toBeDefined();
+  });
+});

package/agents/__tests__/66-soc2-control-validator.test.ts

@@ -0,0 +1,183 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { ValidatedConfig } from '../../core/config';
+import type { Phase } from '../../core/types';
+
+function makeConfig(overrides: Partial<ValidatedConfig> = {}): ValidatedConfig {
+  return {
+    schemaVersion: 1, name: 'test',
+    projectRoot: '/fake/project',
+    auth: { loginUrl: '/login', credentials: { admin: { email: 'a@t.com', password: 's' } } },
+    modules: [{ id: 'dashboard', route: '/dashboard', sidebarIcon: true }],
+    environments: { alpha: { baseUrl: 'http://localhost:3000', seed: false } },
+    portals: [], breakpoints: [], integrations: [], workers: [], workflows: [],
+    accuracy: { enabled: false, decimalPrecision: 2, currencySymbol: '$', timezone: 'UTC' },
+    tenancy: { enabled: false, isolationField: 'firmId', testFirms: [] },
+    costBudget: { maxPerRun: 100, maxPerAgent: 10, alertThreshold: 0.8, onExceeded: 'abort' },
+    agentClassification: { blocking: [], advisory: [] },
+    thresholds: { unitCoverage: { lines: 80, functions: 80, branches: 80, statements: 80 }, lighthouse: { accessibility: 90, performance: 90, bestPractices: 90, seo: 90 }, apiResponseTime: 2000, bundleSizeLimit: 500000, maxConsoleErrors: 0 },
+    disabledAgents: [], disabledAgentSet: new Set<number>(),
+    ...overrides,
+  };
+}
+
+const fetchMock = vi.fn().mockResolvedValue({ ok: true, status: 200 });
+vi.stubGlobal('fetch', fetchMock);
+
+vi.mock('../../helpers/navigation', () => ({
+  login: vi.fn().mockResolvedValue(undefined),
+  waitForSectionLoad: vi.fn().mockResolvedValue(undefined),
+  navigateToSection: vi.fn().mockResolvedValue(undefined),
+  switchPortal: vi.fn().mockResolvedValue(undefined),
+}));
+
+const existsSyncMock = vi.fn();
+const readFileSyncMock = vi.fn();
+const readdirSyncMock = vi.fn();
+
+vi.mock('node:fs', () => ({
+  existsSync: (...args: unknown[]) => existsSyncMock(...args),
+  readFileSync: (...args: unknown[]) => readFileSyncMock(...args),
+  readdirSync: (...args: unknown[]) => readdirSyncMock(...args),
+}));
+
+function makeMockPage() {
+  return {
+    close: vi.fn().mockResolvedValue(undefined),
+    goto: vi.fn().mockResolvedValue(undefined),
+    evaluate: vi.fn().mockResolvedValue(''),
+    on: vi.fn(),
+  };
+}
+
+let mockPage: ReturnType<typeof makeMockPage>;
+let mockBrowser: { newPage: ReturnType<typeof vi.fn>; close: ReturnType<typeof vi.fn> };
+
+vi.mock('playwright', async () => ({
+  chromium: { launch: vi.fn().mockImplementation(async () => mockBrowser) },
+}));
+
+const { Soc2ControlValidatorAgent } = await import('../66-soc2-control-validator');
+
+function createAgent(config: ValidatedConfig = makeConfig(), phase: Phase = 'beta') {
+  return new Soc2ControlValidatorAgent(config, phase, '/tmp/test-run');
+}
+
+describe('Soc2ControlValidatorAgent', () => {
+  beforeEach(() => {
+    existsSyncMock.mockReset().mockReturnValue(true);
+    readFileSyncMock.mockReset().mockReturnValue('');
+    readdirSyncMock.mockReset().mockReturnValue([]);
+    mockPage = makeMockPage();
+    mockBrowser = {
+      newPage: vi.fn().mockResolvedValue(mockPage),
+      close: vi.fn().mockResolvedValue(undefined),
+    };
+  });
+
+  it('has agentId 66 and correct name', () => {
+    const agent = createAgent();
+    expect(agent.agentId).toBe(66);
+    expect(agent.agentName).toBe('SOC2 Control Validator');
+  });
+
+  it('reports no audit logging when not found', async () => {
+    readdirSyncMock.mockReturnValue([
+      { name: 'app.ts', isFile: () => true, isDirectory: () => false },
+    ]);
+    readFileSyncMock.mockReturnValue('const x = 1;');
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('no-audit-logging'));
+    expect(finding).toBeDefined();
+  });
+
+  it('detects audit logging', async () => {
+    readdirSyncMock.mockReturnValue([
+      { name: 'audit.ts', isFile: () => true, isDirectory: () => false },
+    ]);
+    readFileSyncMock.mockReturnValue('function auditLog(event) { log(event); }');
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('no-audit-logging'));
+    expect(finding).toBeUndefined();
+  });
+
+  it('reports no session timeout', async () => {
+    readdirSyncMock.mockReturnValue([
+      { name: 'app.ts', isFile: () => true, isDirectory: () => false },
+    ]);
+    readFileSyncMock.mockReturnValue('const x = 1;');
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('no-session-timeout'));
+    expect(finding).toBeDefined();
+  });
+
+  it('detects session timeout', async () => {
+    readdirSyncMock.mockReturnValue([
+      { name: 'session.ts', isFile: () => true, isDirectory: () => false },
+    ]);
+    readFileSyncMock.mockReturnValue('const sessionTimeout = 30 * 60 * 1000;');
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('no-session-timeout'));
+    expect(finding).toBeUndefined();
+  });
+
+  it('reports no MFA UI', async () => {
+    readdirSyncMock.mockReturnValue([]);
+    mockPage.evaluate.mockResolvedValue('welcome');
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('no-mfa'));
+    expect(finding).toBeDefined();
+  });
+
+  it('detects MFA UI text', async () => {
+    readdirSyncMock.mockReturnValue([]);
+    mockPage.evaluate.mockResolvedValue('enable two-factor authentication');
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('no-mfa'));
+    expect(finding).toBeUndefined();
+  });
+
+  it('reports no RBAC when not found', async () => {
+    readdirSyncMock.mockReturnValue([
+      { name: 'app.ts', isFile: () => true, isDirectory: () => false },
+    ]);
+    readFileSyncMock.mockReturnValue('const x = 1;');
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('no-rbac'));
+    expect(finding).toBeDefined();
+  });
+
+  it('detects RBAC', async () => {
+    readdirSyncMock.mockReturnValue([
+      { name: 'guard.ts', isFile: () => true, isDirectory: () => false },
+    ]);
+    readFileSyncMock.mockReturnValue('function roleGuard(role) { authorize(role); }');
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('no-rbac'));
+    expect(finding).toBeUndefined();
+  });
+
+  it('handles no src directory', async () => {
+    existsSyncMock.mockReturnValue(false);
+    const agent = createAgent();
+    const result = await agent.run();
+    const finding = result.findings.find(f => f.id.includes('no-src'));
+    expect(finding).toBeDefined();
+  });
+
+  it('handles playwright crash for MFA check', async () => {
+    readdirSyncMock.mockReturnValue([]);
+    mockBrowser.newPage.mockRejectedValue(new Error('Crash'));
+    const agent = createAgent();
+    const result = await agent.run();
+    // Should not crash the whole agent
+    expect(result.status).toBeDefined();
+  });
+});