@avi770/testteam 1.2.0

package/core/license-gen.ts

@@ -0,0 +1,212 @@
+import * as crypto from 'node:crypto';
+import * as readline from 'node:readline';
+
+import type { LicensePayload, LicenseTier } from './license';
+
+// ── Base64url helpers ────────────────────────────────────────────────
+
+function base64urlEncode(data: Buffer): string {
+  return data.toString('base64url');
+}
+
+// ── Key generation ───────────────────────────────────────────────────
+
+/** Generate an ES256 (ECDSA P-256) keypair in PEM format. */
+export function generateKeyPair(): { publicKey: string; privateKey: string } {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync('ec', {
+    namedCurve: 'P-256',
+    publicKeyEncoding: { type: 'spki', format: 'pem' },
+    privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+  });
+  return { publicKey, privateKey };
+}
+
+// ── License key generation ───────────────────────────────────────────
+
+/**
+ * Generate a signed JWT license key using ES256.
+ * Uses only Node.js built-in `crypto` — no external JWT libraries.
+ */
+export function generateLicenseKey(
+  payload: Omit<LicensePayload, 'iat'>,
+  privateKey: string,
+): string {
+  const header = { alg: 'ES256', typ: 'JWT' };
+  const fullPayload: LicensePayload = {
+    ...payload,
+    iat: Math.floor(Date.now() / 1000),
+  };
+
+  const headerB64 = base64urlEncode(Buffer.from(JSON.stringify(header)));
+  const payloadB64 = base64urlEncode(Buffer.from(JSON.stringify(fullPayload)));
+  const signedContent = `${headerB64}.${payloadB64}`;
+
+  // Sign with ECDSA P-256 / SHA-256
+  const signer = crypto.createSign('SHA256');
+  signer.update(signedContent);
+  const derSignature = signer.sign({ key: privateKey, dsaEncoding: 'der' });
+
+  // Convert DER to raw (r || s) for compact JWT representation
+  const rawSignature = derToRaw(derSignature);
+  const signatureB64 = base64urlEncode(rawSignature);
+
+  return `${signedContent}.${signatureB64}`;
+}
+
+// ── Tier defaults ────────────────────────────────────────────────────
+
+interface TierDefaults {
+  maxProjects: number;
+  maxRunsPerMonth: number;
+}
+
+const TIER_DEFAULTS: Record<LicenseTier, TierDefaults> = {
+  free:       { maxProjects: 1,   maxRunsPerMonth: 10 },
+  pro:        { maxProjects: 3,   maxRunsPerMonth: 100 },
+  enterprise: { maxProjects: 999, maxRunsPerMonth: 999999 },
+};
+
+// ── Interactive CLI ──────────────────────────────────────────────────
+
+async function prompt(rl: readline.Interface, question: string): Promise<string> {
+  return new Promise((resolve) => {
+    rl.question(question, (answer) => resolve(answer.trim()));
+  });
+}
+
+async function main(): Promise<void> {
+  const rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stdout,
+  });
+
+  try {
+    console.log('\n=== TestTeam License Generator ===\n');
+
+    // Tier
+    const tierInput = await prompt(rl, 'Tier (free / pro / enterprise): ');
+    const tier = tierInput as LicenseTier;
+    if (!['free', 'pro', 'enterprise'].includes(tier)) {
+      console.error(`Invalid tier: ${tierInput}`);
+      process.exit(1);
+    }
+
+    // Email / Customer ID
+    const sub = await prompt(rl, 'Customer email or ID: ');
+    if (!sub) {
+      console.error('Customer identifier is required.');
+      process.exit(1);
+    }
+
+    // Expiry
+    const daysInput = await prompt(rl, 'License duration in days (default: 365): ');
+    const days = daysInput ? parseInt(daysInput, 10) : 365;
+    if (isNaN(days) || days <= 0) {
+      console.error('Invalid duration.');
+      process.exit(1);
+    }
+
+    // Features
+    const featuresInput = await prompt(rl, 'Feature flags (comma-separated, or empty): ');
+    const features = featuresInput
+      ? featuresInput.split(',').map((f) => f.trim()).filter(Boolean)
+      : [];
+
+    // Generate keypair
+    const { publicKey, privateKey } = generateKeyPair();
+
+    const defaults = TIER_DEFAULTS[tier];
+    const exp = Math.floor(Date.now() / 1000) + days * 86400;
+
+    const licenseKey = generateLicenseKey(
+      {
+        tier,
+        exp,
+        sub,
+        maxProjects: defaults.maxProjects,
+        maxRunsPerMonth: defaults.maxRunsPerMonth,
+        features,
+      },
+      privateKey,
+    );
+
+    console.log('\n--- LICENSE KEY ---');
+    console.log(licenseKey);
+    console.log('\n--- PUBLIC KEY (embed in .testteam-license or set TF_LICENSE_PUBLIC_KEY) ---');
+    console.log(publicKey);
+    console.log('--- PRIVATE KEY (keep secret — for generating new keys only) ---');
+    console.log(privateKey);
+
+    console.log('--- .testteam-license file content ---');
+    console.log(`${licenseKey}\n\n${publicKey}`);
+  } finally {
+    rl.close();
+  }
+}
+
+// ── DER to raw conversion ────────────────────────────────────────────
+
+/**
+ * Convert a DER-encoded ECDSA signature to raw (r || s) format (64 bytes for P-256).
+ */
+function derToRaw(der: Buffer): Buffer {
+  // DER: 0x30 <len> 0x02 <rLen> <r> 0x02 <sLen> <s>
+  let offset = 2; // skip 0x30 and total length
+
+  // Read r
+  if (der[offset] !== 0x02) throw new Error('Invalid DER: expected 0x02 for r');
+  offset++;
+  const rLen = der[offset];
+  offset++;
+  let r = der.subarray(offset, offset + rLen);
+  offset += rLen;
+
+  // Read s
+  if (der[offset] !== 0x02) throw new Error('Invalid DER: expected 0x02 for s');
+  offset++;
+  const sLen = der[offset];
+  offset++;
+  let s = der.subarray(offset, offset + sLen);
+
+  // Normalize to exactly 32 bytes each (strip leading zero padding, or left-pad)
+  r = normalizeInteger(r, 32);
+  s = normalizeInteger(s, 32);
+
+  return Buffer.concat([r, s]);
+}
+
+function normalizeInteger(buf: Buffer, targetLen: number): Buffer {
+  if (buf.length === targetLen) return buf;
+  if (buf.length > targetLen) {
+    // Strip leading zeros
+    return buf.subarray(buf.length - targetLen);
+  }
+  // Left-pad with zeros
+  const padded = Buffer.alloc(targetLen, 0);
+  buf.copy(padded, targetLen - buf.length);
+  return padded;
+}
+
+// ── ESM entry point detection ────────────────────────────────────────
+
+const isDirectRun = (() => {
+  try {
+    // In ESM, check if this module is the entry point
+    const moduleUrl = import.meta.url;
+    const argv1 = process.argv[1];
+    if (!argv1) return false;
+
+    // Normalize for comparison
+    const scriptUrl = new URL(`file:///${argv1.replace(/\\/g, '/')}`).href;
+    return moduleUrl === scriptUrl || moduleUrl.endsWith(argv1.replace(/\\/g, '/'));
+  } catch {
+    return false;
+  }
+})();
+
+if (isDirectRun) {
+  main().catch((err: unknown) => {
+    console.error('License generation failed:', err);
+    process.exit(1);
+  });
+}

package/core/license.ts

@@ -0,0 +1,211 @@
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+/** License tiers supported by TestTeam. */
+export type LicenseTier = 'free' | 'pro' | 'enterprise';
+
+/** JWT payload embedded in a TestTeam license key. */
+export interface LicensePayload {
+  tier: LicenseTier;
+  exp: number;
+  iat: number;
+  sub: string;
+  maxProjects: number;
+  maxRunsPerMonth: number;
+  features: string[];
+}
+
+/** In-memory cache so we only validate once per process. */
+let cachedLicense: LicensePayload | null | undefined;
+
+const LICENSE_FILENAME = '.testteam-license';
+
+// ── Base64url helpers ────────────────────────────────────────────────
+
+function base64urlEncode(data: Buffer): string {
+  return data.toString('base64url');
+}
+
+function base64urlDecode(str: string): Buffer {
+  return Buffer.from(str, 'base64url');
+}
+
+// ── JWT helpers (ES256 / ECDSA P-256 with SHA-256) ───────────────────
+
+/**
+ * Decode and verify a JWT signed with ES256.
+ * Returns the payload on success or `null` on any failure
+ * (bad format, invalid signature, expired, malformed JSON).
+ */
+export function validateLicense(
+  key: string,
+  publicKey: string,
+): LicensePayload | null {
+  try {
+    const parts = key.trim().split('.');
+    if (parts.length !== 3) return null;
+
+    const [headerB64, payloadB64, signatureB64] = parts;
+
+    // Verify header declares ES256
+    const header: unknown = JSON.parse(
+      base64urlDecode(headerB64).toString('utf8'),
+    );
+    if (
+      typeof header !== 'object' ||
+      header === null ||
+      (header as Record<string, unknown>)['alg'] !== 'ES256'
+    ) {
+      return null;
+    }
+
+    // Verify signature
+    const signedContent = `${headerB64}.${payloadB64}`;
+    const signature = base64urlDecode(signatureB64);
+
+    // ES256 produces a 64-byte raw (r || s) signature.
+    // Node.js crypto.verify expects DER encoding, so convert if raw.
+    const derSignature = rawToDer(signature);
+
+    const verifier = crypto.createVerify('SHA256');
+    verifier.update(signedContent);
+    const valid = verifier.verify(
+      { key: publicKey, dsaEncoding: 'der' },
+      derSignature,
+    );
+    if (!valid) return null;
+
+    // Decode payload
+    const payloadJson = base64urlDecode(payloadB64).toString('utf8');
+    const payload: unknown = JSON.parse(payloadJson);
+
+    if (!isLicensePayload(payload)) return null;
+
+    // Check expiry
+    const nowSec = Math.floor(Date.now() / 1000);
+    if (payload.exp <= nowSec) return null;
+
+    return payload;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Load a license from the `.testteam-license` file in the given directory.
+ * The file must contain the JWT on the first non-empty line.
+ * A second non-empty line, if present, is treated as the PEM public key
+ * (or the public key can be embedded as `TF_LICENSE_PUBLIC_KEY` env var).
+ */
+export function loadLicense(configDir: string): LicensePayload | null {
+  // Return cached result if available
+  if (cachedLicense !== undefined) return cachedLicense;
+
+  try {
+    const filePath = path.join(configDir, LICENSE_FILENAME);
+    if (!fs.existsSync(filePath)) {
+      cachedLicense = null;
+      return null;
+    }
+
+    const content = fs.readFileSync(filePath, 'utf8').trim();
+    if (!content) {
+      cachedLicense = null;
+      return null;
+    }
+
+    // Split into sections separated by blank lines
+    const sections = content.split(/\n\s*\n/);
+    const licenseKey = sections[0].trim();
+
+    // Public key: either embedded after the JWT or from env
+    let publicKey = process.env['TF_LICENSE_PUBLIC_KEY'] ?? '';
+    if (sections.length > 1) {
+      publicKey = sections.slice(1).join('\n\n').trim();
+    }
+
+    if (!publicKey) {
+      cachedLicense = null;
+      return null;
+    }
+
+    const result = validateLicense(licenseKey, publicKey);
+    cachedLicense = result;
+    return result;
+  } catch {
+    cachedLicense = null;
+    return null;
+  }
+}
+
+/**
+ * Get the license tier for the current project.
+ * Falls back to `'free'` when no valid license is found.
+ */
+export function getLicenseTier(configDir?: string): LicenseTier {
+  const dir = configDir ?? process.cwd();
+  const license = loadLicense(dir);
+  return license?.tier ?? 'free';
+}
+
+/** Reset the in-memory license cache (useful for testing). */
+export function resetLicenseCache(): void {
+  cachedLicense = undefined;
+}
+
+// ── Internal helpers ─────────────────────────────────────────────────
+
+/** Type guard for LicensePayload. */
+function isLicensePayload(value: unknown): value is LicensePayload {
+  if (typeof value !== 'object' || value === null) return false;
+  const obj = value as Record<string, unknown>;
+
+  if (!['free', 'pro', 'enterprise'].includes(obj['tier'] as string)) return false;
+  if (typeof obj['exp'] !== 'number') return false;
+  if (typeof obj['iat'] !== 'number') return false;
+  if (typeof obj['sub'] !== 'string') return false;
+  if (typeof obj['maxProjects'] !== 'number') return false;
+  if (typeof obj['maxRunsPerMonth'] !== 'number') return false;
+  if (!Array.isArray(obj['features'])) return false;
+  if (!obj['features'].every((f: unknown) => typeof f === 'string')) return false;
+
+  return true;
+}
+
+/**
+ * Convert a raw ECDSA signature (r || s, 64 bytes for P-256) to DER encoding.
+ * If the input is already DER-encoded (starts with 0x30), return as-is.
+ */
+function rawToDer(raw: Buffer): Buffer {
+  // If already DER-encoded, return as-is
+  if (raw.length > 0 && raw[0] === 0x30) return raw;
+
+  if (raw.length !== 64) return raw; // Not a valid raw P-256 signature
+
+  const r = raw.subarray(0, 32);
+  const s = raw.subarray(32, 64);
+
+  const encodeInteger = (int: Buffer): Buffer => {
+    // Strip leading zeros but keep at least one byte
+    let start = 0;
+    while (start < int.length - 1 && int[start] === 0) start++;
+    let trimmed = int.subarray(start);
+
+    // If high bit is set, prepend a 0x00 byte
+    if (trimmed[0] & 0x80) {
+      trimmed = Buffer.concat([Buffer.from([0x00]), trimmed]);
+    }
+
+    return Buffer.concat([
+      Buffer.from([0x02, trimmed.length]),
+      trimmed,
+    ]);
+  };
+
+  const rDer = encodeInteger(r);
+  const sDer = encodeInteger(s);
+  const body = Buffer.concat([rDer, sDer]);
+
+  return Buffer.concat([Buffer.from([0x30, body.length]), body]);
+}

package/core/messages.ts

@@ -0,0 +1,67 @@
+import type { LicenseTier } from './license';
+
+const PRICING_URL = 'https://testteam.dev/pricing';
+
+/** Agent names keyed by agent number. */
+const AGENT_NAMES: Record<number, string> = {
+  1: 'Analyst',
+  2: 'Seed Architect',
+  3: 'Test Generator',
+  4: 'Unit Runner',
+  5: 'Browser Crawler',
+  6: 'API Exerciser',
+  7: 'Security Scout',
+  8: 'A11y Guardian',
+  9: 'Healer',
+  10: 'Reporter',
+  11: 'Fixer',
+  12: 'UX Inspector',
+  13: 'Performance Profiler',
+  14: 'Data Integrity Auditor',
+  15: 'Regression Sentinel',
+  16: 'Chaos Agent',
+  17: 'Documentation Validator',
+  18: 'Integration Watchdog',
+  19: 'Tenant Isolation Auditor',
+  20: 'Workflow Completion Tester',
+  21: 'State & Session Tester',
+  22: 'Email Notification Verifier',
+  23: 'Migration Tester',
+};
+
+/** Look up the display name for an agent number. */
+export function getAgentDisplayName(agentNumber: number): string {
+  return AGENT_NAMES[agentNumber] ?? `Agent ${agentNumber}`;
+}
+
+/** Message shown when an agent is gated by license tier. */
+export function agentGatedMessage(
+  agentNumber: number,
+  agentName: string,
+  requiredTier: LicenseTier,
+  currentTier: LicenseTier,
+): string {
+  return `[Agent ${agentNumber}: ${agentName}] requires ${capitalise(requiredTier)} tier — skipped (current: ${currentTier})`;
+}
+
+/** Message shown when a phase is gated by license tier. */
+export function phaseGatedMessage(
+  phase: string,
+  requiredTier: LicenseTier,
+  currentTier: LicenseTier,
+): string {
+  return `${capitalise(phase)} phase requires ${capitalise(requiredTier)} tier — upgrade at ${PRICING_URL} (current: ${currentTier})`;
+}
+
+/** Message shown when the run limit has been reached. */
+export function runLimitMessage(
+  used: number,
+  limit: number,
+  tier: LicenseTier,
+): string {
+  return `Run limit reached: ${used}/${limit} runs used on ${capitalise(tier)} tier — upgrade at ${PRICING_URL}`;
+}
+
+function capitalise(str: string): string {
+  return str.charAt(0).toUpperCase() + str.slice(1);
+}

package/core/multi-browser.ts

@@ -0,0 +1,136 @@
+import type { AgentResult, Finding, Phase } from './types';
+import type { TestTeamConfig } from './config';
+import type { BaseAgent } from '../agents/base-agent';
+
+export type BrowserEngine = 'chromium' | 'firefox' | 'webkit';
+
+export interface MultiBrowserConfig {
+  engines: BrowserEngine[];
+  parallel: boolean;
+  compareResults: boolean;
+}
+
+export interface MultiBrowserResult {
+  engine: BrowserEngine;
+  result: AgentResult;
+  duration: number;
+}
+
+export interface CrossBrowserDiff {
+  engine1: BrowserEngine;
+  engine2: BrowserEngine;
+  differences: Finding[];
+}
+
+/** Default configuration for multi-browser execution. */
+export const DEFAULT_MULTI_BROWSER_CONFIG: MultiBrowserConfig = {
+  engines: ['chromium'],
+  parallel: true,
+  compareResults: true,
+};
+
+/**
+ * Run an agent across multiple browser engines, optionally in parallel,
+ * and compare findings across browsers.
+ */
+export async function runMultiBrowser(
+  agent: BaseAgent,
+  _config: TestTeamConfig,
+  _phase: Phase,
+  browserConfig: MultiBrowserConfig,
+): Promise<{ results: MultiBrowserResult[]; diffs: CrossBrowserDiff[] }> {
+  const runSingleEngine = async (engine: BrowserEngine): Promise<MultiBrowserResult> => {
+    const start = Date.now();
+    const result = await agent.run();
+    const duration = Date.now() - start;
+
+    // Tag each finding with the browser engine for traceability
+    const taggedFindings: Finding[] = result.findings.map(f => ({
+      ...f,
+      description: `[${engine}] ${f.description}`,
+    }));
+
+    return {
+      engine,
+      result: { ...result, findings: taggedFindings },
+      duration,
+    };
+  };
+
+  let results: MultiBrowserResult[];
+
+  if (browserConfig.parallel) {
+    results = await Promise.all(
+      browserConfig.engines.map(engine => runSingleEngine(engine)),
+    );
+  } else {
+    results = [];
+    for (const engine of browserConfig.engines) {
+      results.push(await runSingleEngine(engine));
+    }
+  }
+
+  const diffs = browserConfig.compareResults
+    ? compareBrowserResults(results)
+    : [];
+
+  return { results, diffs };
+}
+
+/**
+ * Compare findings across browser results.
+ * A finding is considered unique to a browser if no finding in the other
+ * browser shares the same base description (stripping the engine prefix tag).
+ */
+export function compareBrowserResults(
+  results: MultiBrowserResult[],
+): CrossBrowserDiff[] {
+  if (results.length < 2) {
+    return [];
+  }
+
+  const diffs: CrossBrowserDiff[] = [];
+
+  for (let i = 0; i < results.length; i++) {
+    for (let j = i + 1; j < results.length; j++) {
+      const r1 = results[i];
+      const r2 = results[j];
+
+      const descriptions1 = new Set(r1.result.findings.map(f => stripEngineTag(f.description)));
+      const descriptions2 = new Set(r2.result.findings.map(f => stripEngineTag(f.description)));
+
+      const differences: Finding[] = [];
+
+      // Findings in engine1 but not in engine2
+      for (const finding of r1.result.findings) {
+        const baseDesc = stripEngineTag(finding.description);
+        if (!descriptions2.has(baseDesc)) {
+          differences.push(finding);
+        }
+      }
+
+      // Findings in engine2 but not in engine1
+      for (const finding of r2.result.findings) {
+        const baseDesc = stripEngineTag(finding.description);
+        if (!descriptions1.has(baseDesc)) {
+          differences.push(finding);
+        }
+      }
+
+      if (differences.length > 0) {
+        diffs.push({
+          engine1: r1.engine,
+          engine2: r2.engine,
+          differences,
+        });
+      }
+    }
+  }
+
+  return diffs;
+}
+
+/** Strip the "[engine] " prefix tag from a finding description. */
+function stripEngineTag(description: string): string {
+  return description.replace(/^\[(chromium|firefox|webkit)\]\s*/, '');
+}