@avi770/testteam 1.2.0

package/dist/agents/17-documentation-validator.js

@@ -0,0 +1,246 @@
+import { readdir, readFile, stat } from 'node:fs/promises';
+import { join } from 'path';
+import { BaseAgent } from './base-agent';
+/** Regex to extract URLs from markdown link syntax [text](url) */
+const MARKDOWN_LINK_REGEX = /\[.*?\]\((https?:\/\/[^)]+)\)/g;
+/** Regex to extract bare URLs (not inside markdown link parens) */
+const BARE_URL_REGEX = /(?<!\()(https?:\/\/[^\s"'<>)\]]+)/g;
+/** Regex to find catch blocks that swallow errors with just a log */
+const BARE_CATCH_LOG_REGEX = /catch\s*\([^)]*\)\s*\{[^}]*(?:console\.log|console\.error|logger\.\w+)\s*\(\s*(?:\w+\.message|error\.message)\s*\)[^}]*\}/g;
+async function fileExists(p) {
+    try {
+        await stat(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function isDirectory(p) {
+    try {
+        return (await stat(p)).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+export class DocumentationValidatorAgent extends BaseAgent {
+    agentId = 17;
+    agentName = 'Documentation Validator';
+    async preFlight() {
+        const projectRoot = this.resolveProjectRoot();
+        const readmeExists = await fileExists(join(projectRoot, 'README.md'));
+        const docsExists = await fileExists(join(projectRoot, 'docs'));
+        if (!readmeExists && !docsExists) {
+            throw new Error('No README.md or docs/ directory found — nothing to validate');
+        }
+    }
+    async execute() {
+        const findings = [];
+        const projectRoot = this.resolveProjectRoot();
+        // 1. Collect all markdown files from project root and docs/
+        const markdownFiles = await this.collectMarkdownFiles(projectRoot);
+        // 2. Extract all URLs from markdown files
+        const urlSources = await this.extractUrlsFromFiles(markdownFiles);
+        // 3. HTTP HEAD each URL — create finding for 404/5xx
+        const brokenLinkFindings = await this.checkUrls(urlSources);
+        findings.push(...brokenLinkFindings);
+        // 4. Scan source code for catch blocks that only log error.message
+        const catchFindings = await this.scanForBareCatchLogs(projectRoot);
+        findings.push(...catchFindings);
+        return findings;
+    }
+    // ---------------------------------------------------------------------------
+    // Helpers
+    // ---------------------------------------------------------------------------
+    /**
+     * Resolve the project root. The runDir is typically a subdirectory created
+     * for the current test run; the actual project root is the repo root.
+     * We walk upward from runDir until we find a package.json or use CWD.
+     */
+    resolveProjectRoot() {
+        // Prefer process.cwd() — the test runner / CLI always sets CWD to repo root
+        return process.cwd();
+    }
+    /** Recursively collect .md files from projectRoot and any docs/ sub-directory. */
+    async collectMarkdownFiles(projectRoot) {
+        const files = [];
+        // Root-level .md files
+        try {
+            const rootEntries = await readdir(projectRoot);
+            for (const entry of rootEntries) {
+                if (entry.endsWith('.md')) {
+                    files.push(join(projectRoot, entry));
+                }
+            }
+        }
+        catch {
+            // Cannot read project root — return empty
+            return files;
+        }
+        // docs/ sub-directory (recursive)
+        const docsDir = join(projectRoot, 'docs');
+        const docsIsDir = await isDirectory(docsDir);
+        if (docsIsDir) {
+            await this.walkMarkdownFiles(docsDir, files);
+        }
+        return files;
+    }
+    async walkMarkdownFiles(dir, results) {
+        let entries;
+        try {
+            entries = await readdir(dir);
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            const fullPath = join(dir, entry);
+            try {
+                const s = await stat(fullPath);
+                if (s.isDirectory()) {
+                    await this.walkMarkdownFiles(fullPath, results);
+                }
+                else if (entry.endsWith('.md')) {
+                    results.push(fullPath);
+                }
+            }
+            catch {
+                // Skip unreadable entries
+            }
+        }
+    }
+    /**
+     * Extract all HTTP/HTTPS URLs from the given markdown files.
+     * Returns a map: url → source file path.
+     */
+    async extractUrlsFromFiles(files) {
+        const urlMap = new Map();
+        for (const filePath of files) {
+            let content;
+            try {
+                content = await readFile(filePath, 'utf-8');
+            }
+            catch {
+                continue;
+            }
+            // Markdown link syntax
+            for (const match of content.matchAll(MARKDOWN_LINK_REGEX)) {
+                const url = match[1];
+                if (url && !urlMap.has(url)) {
+                    urlMap.set(url, filePath);
+                }
+            }
+            // Bare URLs not already captured via markdown links
+            for (const match of content.matchAll(BARE_URL_REGEX)) {
+                const url = match[0];
+                if (url && !urlMap.has(url)) {
+                    urlMap.set(url, filePath);
+                }
+            }
+        }
+        return urlMap;
+    }
+    /** HEAD each URL; create a 'low' finding for 404 or 5xx responses. */
+    async checkUrls(urlSources) {
+        const findings = [];
+        let findingIndex = 0;
+        for (const [url, sourceFile] of urlSources) {
+            let status = null;
+            try {
+                const response = await fetch(url, {
+                    method: 'HEAD',
+                    signal: AbortSignal.timeout(10_000),
+                    redirect: 'follow',
+                });
+                status = response.status;
+            }
+            catch {
+                // Network error — treat as unreachable
+                status = null;
+            }
+            const isBroken = status === null ||
+                status === 404 ||
+                status >= 500;
+            if (isBroken) {
+                const statusLabel = status !== null ? String(status) : 'unreachable';
+                findings.push({
+                    id: `${this.agentId}-broken-link-${findingIndex++}`,
+                    type: 'test-bug',
+                    severity: 'low',
+                    agentId: this.agentId,
+                    module: 'documentation',
+                    description: `Broken link [${statusLabel}]: ${url}`,
+                    file: sourceFile,
+                });
+            }
+        }
+        return findings;
+    }
+    /**
+     * Scan TypeScript / JavaScript source files for catch blocks that only log
+     * error.message without providing a user-friendly message.
+     */
+    async scanForBareCatchLogs(projectRoot) {
+        const findings = [];
+        const srcDirs = ['src', 'apps', 'libs', 'packages'];
+        for (const dir of srcDirs) {
+            const fullDir = join(projectRoot, dir);
+            const dirExists = await fileExists(fullDir);
+            if (!dirExists)
+                continue;
+            const sourceFiles = [];
+            await this.walkSourceFiles(fullDir, sourceFiles);
+            for (const filePath of sourceFiles) {
+                let content;
+                try {
+                    content = await readFile(filePath, 'utf-8');
+                }
+                catch {
+                    continue;
+                }
+                const matches = content.match(BARE_CATCH_LOG_REGEX);
+                if (matches && matches.length > 0) {
+                    findings.push({
+                        id: `${this.agentId}-bare-catch-${filePath.replace(/[^a-z0-9]/gi, '-').slice(-60)}`,
+                        type: 'code-bug-logic',
+                        severity: 'low',
+                        agentId: this.agentId,
+                        module: 'error-handling',
+                        description: `${matches.length} catch block(s) in "${filePath}" only log error.message without a user-friendly message`,
+                        file: filePath,
+                        suggestedFix: 'Replace bare error.message logs with structured error responses that include user-friendly messages',
+                    });
+                }
+            }
+        }
+        return findings;
+    }
+    async walkSourceFiles(dir, results) {
+        let entries;
+        try {
+            entries = await readdir(dir);
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (entry === 'node_modules' || entry === 'dist' || entry === '.git')
+                continue;
+            const fullPath = join(dir, entry);
+            try {
+                const s = await stat(fullPath);
+                if (s.isDirectory()) {
+                    await this.walkSourceFiles(fullPath, results);
+                }
+                else if (entry.endsWith('.ts') || entry.endsWith('.js')) {
+                    results.push(fullPath);
+                }
+            }
+            catch {
+                // Skip unreadable entries
+            }
+        }
+    }
+}
+//# sourceMappingURL=17-documentation-validator.js.map

package/dist/agents/17-documentation-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"17-documentation-validator.js","sourceRoot":"","sources":["../../agents/17-documentation-validator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,kEAAkE;AAClE,MAAM,mBAAmB,GAAG,gCAAgC,CAAC;AAE7D,mEAAmE;AACnE,MAAM,cAAc,GAAG,oCAAoC,CAAC;AAE5D,qEAAqE;AACrE,MAAM,oBAAoB,GAAG,4HAA4H,CAAC;AAE1J,KAAK,UAAU,UAAU,CAAC,CAAS;IACjC,IAAI,CAAC;QAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,CAAS;IAClC,IAAI,CAAC;QAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AACvE,CAAC;AAED,MAAM,OAAO,2BAA4B,SAAQ,SAAS;IAC/C,OAAO,GAAG,EAAE,CAAC;IACb,SAAS,GAAG,yBAAyB,CAAC;IAErC,KAAK,CAAC,SAAS;QACvB,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAE9C,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;QACtE,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QAE/D,IAAI,CAAC,YAAY,IAAI,CAAC,UAAU,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAE9C,4DAA4D;QAC5D,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAEnE,0CAA0C;QAC1C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;QAElE,qDAAqD;QACrD,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC5D,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,CAAC;QAErC,mEAAmE;QACnE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;QACnE,QAAQ,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC;QAEhC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,8EAA8E;IAC9E,UAAU;IACV,8EAA8E;IAE9E;;;;OAIG;IACK,kBAAkB;QACxB,4EAA4E;QAC5E,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC;IACvB,CAAC;IAED,kFAAkF;IAC1E,KAAK,CAAC,oBAAoB,CAAC,WAAmB;QACpD,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,uBAAuB;QACvB,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;YAC/C,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;gBAChC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC1B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;gBACvC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;YAC1C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,kCAAkC;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/C,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,GAAW,EAAE,OAAiB;QAC5D,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC/B,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;oBACpB,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAClD,CAAC;qBAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;oBACjC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,oBAAoB,CAAC,KAAe;QAChD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;QAEzC,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;YAC7B,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YAED,uBAAuB;YACvB,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBAC1D,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACrB,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC;YAED,oDAAoD;YACpD,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;gBACrD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACrB,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,sEAAsE;IAC9D,KAAK,CAAC,SAAS,CAAC,UAA+B;QACrD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,IAAI,YAAY,GAAG,CAAC,CAAC;QAErB,KAAK,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3C,IAAI,MAAM,GAAkB,IAAI,CAAC;YAEjC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;oBAChC,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;oBACnC,QAAQ,EAAE,QAAQ;iBACnB,CAAC,CAAC;gBACH,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,uCAAuC;gBACvC,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;YAED,MAAM,QAAQ,GACZ,MAAM,KAAK,IAAI;gBACf,MAAM,KAAK,GAAG;gBACd,MAAM,IAAI,GAAG,CAAC;YAEhB,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,WAAW,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;gBACrE,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,gBAAgB,YAAY,EAAE,EAAE;oBACnD,IAAI,EAAE,UAAU;oBAChB,QAAQ,EAAE,KAAK;oBACf,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,eAAe;oBACvB,WAAW,EAAE,gBAAgB,WAAW,MAAM,GAAG,EAAE;oBACnD,IAAI,EAAE,UAAU;iBACjB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,oBAAoB,CAAC,WAAmB;QACpD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAEpD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YACvC,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,CAAC,SAAS;gBAAE,SAAS;YAEzB,MAAM,WAAW,GAAa,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAEjD,KAAK,MAAM,QAAQ,IAAI,WAAW,EAAE,CAAC;gBACnC,IAAI,OAAe,CAAC;gBACpB,IAAI,CAAC;oBACH,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAC9C,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBAED,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;gBACpD,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAClC,QAAQ,CAAC,IAAI,CAAC;wBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,eAAe,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE;wBACnF,IAAI,EAAE,gBAAgB;wBACtB,QAAQ,EAAE,KAAK;wBACf,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,MAAM,EAAE,gBAAgB;wBACxB,WAAW,EAAE,GAAG,OAAO,CAAC,MAAM,uBAAuB,QAAQ,0DAA0D;wBACvH,IAAI,EAAE,QAAQ;wBACd,YAAY,EAAE,qGAAqG;qBACpH,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,GAAW,EAAE,OAAiB;QAC1D,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,KAAK,cAAc,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM;gBAAE,SAAS;YAC/E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC/B,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;oBACpB,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAChD,CAAC;qBAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC1D,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/agents/18-integration-watchdog.d.ts

@@ -0,0 +1,10 @@
+import { BaseAgent } from './base-agent';
+import type { Finding } from '../core/types';
+export declare class IntegrationWatchdogAgent extends BaseAgent {
+    readonly agentId = 18;
+    readonly agentName = "Integration Watchdog";
+    private repoRoot;
+    protected preFlight(): Promise<void>;
+    protected execute(): Promise<Finding[]>;
+}
+//# sourceMappingURL=18-integration-watchdog.d.ts.map

package/dist/agents/18-integration-watchdog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"18-integration-watchdog.d.ts","sourceRoot":"","sources":["../../agents/18-integration-watchdog.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AA4B7C,qBAAa,wBAAyB,SAAQ,SAAS;IACrD,QAAQ,CAAC,OAAO,MAAM;IACtB,QAAQ,CAAC,SAAS,0BAA0B;IAC5C,OAAO,CAAC,QAAQ,CAAM;cAEN,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cAgB1B,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;CA4H9C"}

package/dist/agents/18-integration-watchdog.js

@@ -0,0 +1,138 @@
+import { execFile } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { BaseAgent } from './base-agent';
+function runVitest(vitestConfigPath, cwd) {
+    return new Promise((resolveP, rejectP) => {
+        execFile('npx', ['vitest', 'run', '--config', vitestConfigPath], { cwd, shell: true }, (err, stdout, stderr) => {
+            if (err) {
+                const enriched = Object.assign(new Error(err.message), {
+                    stdout: stdout ?? '',
+                    stderr: stderr ?? '',
+                });
+                rejectP(enriched);
+                return;
+            }
+            resolveP({ stdout: stdout ?? '', stderr: stderr ?? '' });
+        });
+    });
+}
+export class IntegrationWatchdogAgent extends BaseAgent {
+    agentId = 18;
+    agentName = 'Integration Watchdog';
+    repoRoot = '';
+    async preFlight() {
+        this.repoRoot = this.config.projectRoot ?? process.cwd();
+        if (this.config.integrations.length === 0) {
+            throw new Error('IntegrationWatchdogAgent requires at least one integration in config.integrations');
+        }
+        // Verify worker directories exist
+        const workersDir = resolve(this.repoRoot, 'apps', 'workers');
+        if (!existsSync(workersDir)) {
+            throw new Error(`Worker directory not found: ${workersDir}`);
+        }
+    }
+    async execute() {
+        const findings = [];
+        // -----------------------------------------------------------------------
+        // Worker coverage checks
+        // -----------------------------------------------------------------------
+        for (const worker of this.config.workers) {
+            const workerName = worker.name;
+            // Check source file exists
+            const workerSrcCandidates = [
+                resolve(this.repoRoot, 'apps', 'workers', 'src', `${workerName}.ts`),
+                resolve(this.repoRoot, 'apps', 'workers', 'src', workerName, 'index.ts'),
+                resolve(this.repoRoot, 'apps', 'workers', `${workerName}.ts`),
+            ];
+            const workerSrcExists = workerSrcCandidates.some((p) => existsSync(p));
+            if (!workerSrcExists) {
+                findings.push({
+                    id: `${this.agentId}-worker-missing-${workerName}`,
+                    type: 'infra-issue',
+                    severity: 'medium',
+                    agentId: this.agentId,
+                    module: `worker:${workerName}`,
+                    description: `Worker source file not found for "${workerName}". ` +
+                        `Searched: ${workerSrcCandidates.join(', ')}`,
+                    suggestedFix: `Create the worker source file at apps/workers/src/${workerName}.ts`,
+                });
+                continue;
+            }
+            // Check test files exist
+            const workerTestCandidates = [
+                resolve(this.repoRoot, 'apps', 'workers', 'src', `${workerName}.test.ts`),
+                resolve(this.repoRoot, 'apps', 'workers', 'src', `${workerName}.spec.ts`),
+                resolve(this.repoRoot, 'apps', 'workers', '__tests__', `${workerName}.test.ts`),
+                resolve(this.repoRoot, 'apps', 'workers', 'src', workerName, `${workerName}.test.ts`),
+            ];
+            const workerTestExists = workerTestCandidates.some((p) => existsSync(p));
+            if (!workerTestExists) {
+                findings.push({
+                    id: `${this.agentId}-worker-no-tests-${workerName}`,
+                    type: 'test-bug',
+                    severity: 'medium',
+                    agentId: this.agentId,
+                    module: `worker:${workerName}`,
+                    description: `No test file found for worker "${workerName}".`,
+                    suggestedFix: `Add tests at apps/workers/src/${workerName}.test.ts`,
+                });
+            }
+        }
+        // -----------------------------------------------------------------------
+        // Run worker tests if workers config and vitest config exist
+        // -----------------------------------------------------------------------
+        if (this.config.workers.length > 0) {
+            const vitestConfig = resolve(this.repoRoot, 'apps', 'workers', 'vitest.config.ts');
+            if (existsSync(vitestConfig)) {
+                try {
+                    await runVitest(vitestConfig, this.repoRoot);
+                }
+                catch (error) {
+                    const stderr = error instanceof Error && 'stderr' in error
+                        ? String(error.stderr)
+                        : String(error);
+                    const stdout = error instanceof Error && 'stdout' in error
+                        ? String(error.stdout)
+                        : '';
+                    findings.push({
+                        id: `${this.agentId}-worker-tests-failed`,
+                        type: 'test-bug',
+                        severity: 'high',
+                        agentId: this.agentId,
+                        module: 'workers',
+                        description: `Worker test suite failed.\n${stderr || stdout}`,
+                        suggestedFix: 'Fix the failing worker tests before promoting to UAT.',
+                    });
+                }
+            }
+        }
+        // -----------------------------------------------------------------------
+        // Integration sandbox checks
+        // -----------------------------------------------------------------------
+        for (const integration of this.config.integrations) {
+            const integrationName = integration.name;
+            // Detect sandbox availability — look for connection config
+            const connectionConfigCandidates = [
+                resolve(this.repoRoot, 'apps', 'workers', 'src', 'integrations', `${integrationName}.ts`),
+                resolve(this.repoRoot, 'apps', 'api', 'src', 'integrations', `${integrationName}.ts`),
+                resolve(this.repoRoot, 'apps', 'workers', 'src', 'integrations', `${integrationName}-sandbox.ts`),
+            ];
+            const sandboxAvailable = connectionConfigCandidates.some((p) => existsSync(p));
+            if (!sandboxAvailable) {
+                findings.push({
+                    id: `${this.agentId}-integration-no-sandbox-${integrationName}`,
+                    type: 'infra-issue',
+                    severity: 'low',
+                    agentId: this.agentId,
+                    module: `integration:${integrationName}`,
+                    description: `Advisory: No sandbox connection config found for integration "${integrationName}". ` +
+                        `End-to-end integration testing cannot be performed automatically.`,
+                    suggestedFix: `Add a sandbox configuration at apps/workers/src/integrations/${integrationName}.ts`,
+                });
+            }
+        }
+        return findings;
+    }
+}
+//# sourceMappingURL=18-integration-watchdog.js.map

package/dist/agents/18-integration-watchdog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"18-integration-watchdog.js","sourceRoot":"","sources":["../../agents/18-integration-watchdog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAQzC,SAAS,SAAS,CAAC,gBAAwB,EAAE,GAAW;IACtD,OAAO,IAAI,OAAO,CAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;QACnD,QAAQ,CACN,KAAK,EACL,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,EAC/C,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EACpB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACtB,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;oBACrD,MAAM,EAAE,MAAM,IAAI,EAAE;oBACpB,MAAM,EAAE,MAAM,IAAI,EAAE;iBACrB,CAAC,CAAC;gBACH,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAClB,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;QAC3D,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,OAAO,wBAAyB,SAAQ,SAAS;IAC5C,OAAO,GAAG,EAAE,CAAC;IACb,SAAS,GAAG,sBAAsB,CAAC;IACpC,QAAQ,GAAG,EAAE,CAAC;IAEZ,KAAK,CAAC,SAAS;QACvB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAEzD,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;QACJ,CAAC;QAED,kCAAkC;QAClC,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAC7D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,+BAA+B,UAAU,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,0EAA0E;QAC1E,yBAAyB;QACzB,0EAA0E;QAC1E,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;YAE/B,2BAA2B;YAC3B,MAAM,mBAAmB,GAAG;gBAC1B,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,UAAU,KAAK,CAAC;gBACpE,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC;gBACxE,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,UAAU,KAAK,CAAC;aAC9D,CAAC;YAEF,MAAM,eAAe,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YACvE,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,mBAAmB,UAAU,EAAE;oBAClD,IAAI,EAAE,aAAa;oBACnB,QAAQ,EAAE,QAAQ;oBAClB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,UAAU,UAAU,EAAE;oBAC9B,WAAW,EACT,qCAAqC,UAAU,KAAK;wBACpD,aAAa,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBAC/C,YAAY,EAAE,qDAAqD,UAAU,KAAK;iBACnF,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,yBAAyB;YACzB,MAAM,oBAAoB,GAAG;gBAC3B,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,UAAU,UAAU,CAAC;gBACzE,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,UAAU,UAAU,CAAC;gBACzE,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,UAAU,UAAU,CAAC;gBAC/E,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,UAAU,UAAU,CAAC;aACtF,CAAC;YAEF,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YACzE,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,oBAAoB,UAAU,EAAE;oBACnD,IAAI,EAAE,UAAU;oBAChB,QAAQ,EAAE,QAAQ;oBAClB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,UAAU,UAAU,EAAE;oBAC9B,WAAW,EAAE,kCAAkC,UAAU,IAAI;oBAC7D,YAAY,EAAE,iCAAiC,UAAU,UAAU;iBACpE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,6DAA6D;QAC7D,0EAA0E;QAC1E,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;YACnF,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC7B,IAAI,CAAC;oBACH,MAAM,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC/C,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,MAAM,GACV,KAAK,YAAY,KAAK,IAAI,QAAQ,IAAI,KAAK;wBACzC,CAAC,CAAC,MAAM,CAAE,KAAqD,CAAC,MAAM,CAAC;wBACvE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACpB,MAAM,MAAM,GACV,KAAK,YAAY,KAAK,IAAI,QAAQ,IAAI,KAAK;wBACzC,CAAC,CAAC,MAAM,CAAE,KAAqD,CAAC,MAAM,CAAC;wBACvE,CAAC,CAAC,EAAE,CAAC;oBAET,QAAQ,CAAC,IAAI,CAAC;wBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,sBAAsB;wBACzC,IAAI,EAAE,UAAU;wBAChB,QAAQ,EAAE,MAAM;wBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,MAAM,EAAE,SAAS;wBACjB,WAAW,EAAE,8BAA8B,MAAM,IAAI,MAAM,EAAE;wBAC7D,YAAY,EAAE,uDAAuD;qBACtE,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,6BAA6B;QAC7B,0EAA0E;QAC1E,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YACnD,MAAM,eAAe,GAAG,WAAW,CAAC,IAAI,CAAC;YAEzC,2DAA2D;YAC3D,MAAM,0BAA0B,GAAG;gBACjC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,eAAe,KAAK,CAAC;gBACzF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,eAAe,KAAK,CAAC;gBACrF,OAAO,CACL,IAAI,CAAC,QAAQ,EACb,MAAM,EACN,SAAS,EACT,KAAK,EACL,cAAc,EACd,GAAG,eAAe,aAAa,CAChC;aACF,CAAC;YAEF,MAAM,gBAAgB,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YAE/E,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,2BAA2B,eAAe,EAAE;oBAC/D,IAAI,EAAE,aAAa;oBACnB,QAAQ,EAAE,KAAK;oBACf,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,eAAe,eAAe,EAAE;oBACxC,WAAW,EACT,iEAAiE,eAAe,KAAK;wBACrF,mEAAmE;oBACrE,YAAY,EAAE,gEAAgE,eAAe,KAAK;iBACnG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/agents/19-tenant-isolation-auditor.d.ts

@@ -0,0 +1,9 @@
+import type { Finding } from '../core/types';
+import { BaseAgent } from './base-agent';
+export declare class TenantIsolationAuditorAgent extends BaseAgent {
+    readonly agentId = 19;
+    readonly agentName = "Tenant Isolation Auditor";
+    protected preFlight(): Promise<void>;
+    protected execute(): Promise<Finding[]>;
+}
+//# sourceMappingURL=19-tenant-isolation-auditor.d.ts.map

package/dist/agents/19-tenant-isolation-auditor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"19-tenant-isolation-auditor.d.ts","sourceRoot":"","sources":["../../agents/19-tenant-isolation-auditor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAIzC,qBAAa,2BAA4B,SAAQ,SAAS;IACxD,QAAQ,CAAC,OAAO,MAAM;IACtB,QAAQ,CAAC,SAAS,8BAA8B;cAEhC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cAc1B,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;CA+K9C"}

package/dist/agents/19-tenant-isolation-auditor.js

@@ -0,0 +1,166 @@
+import { BaseAgent } from './base-agent';
+import { ApiClient } from '../helpers/api-client';
+import { resolveEnvironment } from '../helpers/env-resolver';
+export class TenantIsolationAuditorAgent extends BaseAgent {
+    agentId = 19;
+    agentName = 'Tenant Isolation Auditor';
+    async preFlight() {
+        if (!this.config.tenancy.enabled) {
+            throw new Error('TenantIsolationAuditorAgent requires config.tenancy.enabled to be true');
+        }
+        if (this.config.tenancy.testFirms.length < 1) {
+            throw new Error('TenantIsolationAuditorAgent requires at least one firm in config.tenancy.testFirms');
+        }
+    }
+    async execute() {
+        const findings = [];
+        const { env, fallback } = await resolveEnvironment(this.config, this.phase);
+        if (!env) {
+            findings.push({
+                id: `${this.agentId}-no-env`,
+                type: 'infra-issue',
+                severity: 'critical',
+                agentId: this.agentId,
+                module: 'tenancy',
+                description: 'No environment configured — cannot run tenant isolation audit',
+            });
+            return findings;
+        }
+        const credentials = this.config.auth.credentials?.['admin'] ??
+            Object.values(this.config.auth.credentials ?? {})[0];
+        if (!credentials) {
+            findings.push({
+                id: `${this.agentId}-no-credentials`,
+                type: 'infra-issue',
+                severity: 'critical',
+                agentId: this.agentId,
+                module: 'tenancy',
+                description: 'No credentials configured — cannot authenticate for tenant isolation audit',
+            });
+            return findings;
+        }
+        const firmA = this.config.tenancy.testFirms[0];
+        const firmB = this.config.tenancy.testFirms.length > 1 ? this.config.tenancy.testFirms[1] : null;
+        const isolationField = this.config.tenancy.isolationField;
+        let client;
+        try {
+            client = await ApiClient.createAuthenticated(env.baseUrl, credentials);
+        }
+        catch (error) {
+            // Auth failure is always medium — indicates missing API or wrong credentials, not a tenant isolation bug
+            const authSeverity = 'medium';
+            findings.push({
+                id: `${this.agentId}-auth-failed`,
+                type: 'infra-issue',
+                severity: authSeverity,
+                agentId: this.agentId,
+                module: 'tenancy',
+                description: `Authentication failed for tenant isolation audit: ${error instanceof Error ? error.message : String(error)}`,
+            });
+            return findings;
+        }
+        // -----------------------------------------------------------------------
+        // Test 1: URL tampering — access resources with wrong firmId in URL
+        // -----------------------------------------------------------------------
+        const urlTamperPaths = [
+            `/api/clients?${isolationField}=${firmA}`,
+            `/api/invoices?${isolationField}=${firmA}`,
+            `/api/transactions?${isolationField}=${firmA}`,
+        ];
+        // Use firmB if available, otherwise try a synthetic non-existent firm
+        const wrongFirm = firmB ?? 'wrong-firm-99999';
+        for (const basePath of urlTamperPaths) {
+            const tamperedPath = basePath.replace(`${isolationField}=${firmA}`, `${isolationField}=${wrongFirm}`);
+            let response;
+            try {
+                response = await client.get(tamperedPath);
+            }
+            catch {
+                // Network or parse error — skip this path
+                continue;
+            }
+            if (response.status === 200) {
+                const hasData = Array.isArray(response.body)
+                    ? response.body.length > 0
+                    : response.body !== null && typeof response.body === 'object';
+                if (hasData) {
+                    findings.push({
+                        id: `${this.agentId}-url-tamper-${tamperedPath.replace(/[^a-zA-Z0-9]/g, '-')}`,
+                        type: 'code-bug-security',
+                        severity: 'critical',
+                        agentId: this.agentId,
+                        module: 'tenancy',
+                        description: `URL tampering data leak: GET ${tamperedPath} returned 200 with data while authenticated as firm "${firmA}". ` +
+                            `Firm "${wrongFirm}" data should not be accessible.`,
+                        suggestedFix: `Enforce tenant scoping in all query handlers — always filter by the authenticated user's ${isolationField}, ignoring URL parameters.`,
+                    });
+                }
+            }
+        }
+        // -----------------------------------------------------------------------
+        // Test 2: API parameter tampering — POST with different firmId
+        // -----------------------------------------------------------------------
+        const postPaths = ['/api/clients/search', '/api/invoices/search', '/api/reports/generate'];
+        for (const path of postPaths) {
+            let response;
+            try {
+                response = await client.post(path, { [isolationField]: wrongFirm, limit: 5 });
+            }
+            catch {
+                continue;
+            }
+            if (response.status === 200) {
+                const hasData = Array.isArray(response.body)
+                    ? response.body.length > 0
+                    : response.body !== null && typeof response.body === 'object';
+                if (hasData) {
+                    findings.push({
+                        id: `${this.agentId}-param-tamper-${path.replace(/\//g, '-')}`,
+                        type: 'code-bug-security',
+                        severity: 'critical',
+                        agentId: this.agentId,
+                        module: 'tenancy',
+                        description: `API parameter tampering data leak: POST ${path} with ${isolationField}=${wrongFirm} returned 200 with data ` +
+                            `while authenticated as firm "${firmA}".`,
+                        suggestedFix: `Never trust ${isolationField} from the request body — always derive it from the authenticated user's JWT claims.`,
+                    });
+                }
+            }
+        }
+        // -----------------------------------------------------------------------
+        // Test 3: Search isolation — search for firm B data while logged in as firm A
+        // -----------------------------------------------------------------------
+        if (firmB !== null) {
+            const searchPaths = [
+                { path: `/api/clients/search`, body: { query: firmB, limit: 5 } },
+                { path: `/api/invoices/search`, body: { query: firmB, limit: 5 } },
+            ];
+            for (const { path, body } of searchPaths) {
+                let response;
+                try {
+                    response = await client.post(path, body);
+                }
+                catch {
+                    continue;
+                }
+                if (response.status === 200) {
+                    const results = Array.isArray(response.body) ? response.body : [];
+                    if (results.length > 0) {
+                        findings.push({
+                            id: `${this.agentId}-search-isolation-${path.replace(/\//g, '-')}`,
+                            type: 'code-bug-security',
+                            severity: 'critical',
+                            agentId: this.agentId,
+                            module: 'tenancy',
+                            description: `Search isolation failure: POST ${path} with query for firm "${firmB}" ` +
+                                `returned ${results.length} result(s) while authenticated as firm "${firmA}".`,
+                            suggestedFix: 'All search handlers must apply tenant scoping before executing the query.',
+                        });
+                    }
+                }
+            }
+        }
+        return findings;
+    }
+}
+//# sourceMappingURL=19-tenant-isolation-auditor.js.map

package/dist/agents/19-tenant-isolation-auditor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"19-tenant-isolation-auditor.js","sourceRoot":"","sources":["../../agents/19-tenant-isolation-auditor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D,MAAM,OAAO,2BAA4B,SAAQ,SAAS;IAC/C,OAAO,GAAG,EAAE,CAAC;IACb,SAAS,GAAG,0BAA0B,CAAC;IAEtC,KAAK,CAAC,SAAS;QACvB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;QACJ,CAAC;IACH,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAE5E,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,SAAS;gBAC5B,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,UAAU;gBACpB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,SAAS;gBACjB,WAAW,EAAE,+DAA+D;aAC7E,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,WAAW,GACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC;YACvC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAEvD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,iBAAiB;gBACpC,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,UAAU;gBACpB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,SAAS;gBACjB,WAAW,EAAE,4EAA4E;aAC1F,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC;QAChD,MAAM,KAAK,GACT,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrF,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC;QAE1D,IAAI,MAAiB,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,SAAS,CAAC,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yGAAyG;YACzG,MAAM,YAAY,GAAG,QAAiB,CAAC;YACvC,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,cAAc;gBACjC,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,YAAY;gBACtB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,SAAS;gBACjB,WAAW,EAAE,qDAAqD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aAC3H,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,0EAA0E;QAC1E,oEAAoE;QACpE,0EAA0E;QAC1E,MAAM,cAAc,GAAG;YACrB,gBAAgB,cAAc,IAAI,KAAK,EAAE;YACzC,iBAAiB,cAAc,IAAI,KAAK,EAAE;YAC1C,qBAAqB,cAAc,IAAI,KAAK,EAAE;SAC/C,CAAC;QAEF,sEAAsE;QACtE,MAAM,SAAS,GAAG,KAAK,IAAI,kBAAkB,CAAC;QAE9C,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;YACtC,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,cAAc,IAAI,KAAK,EAAE,EAAE,GAAG,cAAc,IAAI,SAAS,EAAE,CAAC,CAAC;YACtG,IAAI,QAAQ,CAAC;YACb,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,0CAA0C;gBAC1C,SAAS;YACX,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,OAAO,GACX,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAC1B,CAAC,CAAE,QAAQ,CAAC,IAAkB,CAAC,MAAM,GAAG,CAAC;oBACzC,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC;gBAElE,IAAI,OAAO,EAAE,CAAC;oBACZ,QAAQ,CAAC,IAAI,CAAC;wBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,eAAe,YAAY,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,EAAE;wBAC9E,IAAI,EAAE,mBAAmB;wBACzB,QAAQ,EAAE,UAAU;wBACpB,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,MAAM,EAAE,SAAS;wBACjB,WAAW,EACT,gCAAgC,YAAY,wDAAwD,KAAK,KAAK;4BAC9G,SAAS,SAAS,kCAAkC;wBACtD,YAAY,EACV,4FAA4F,cAAc,4BAA4B;qBACzI,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,+DAA+D;QAC/D,0EAA0E;QAC1E,MAAM,SAAS,GAAG,CAAC,qBAAqB,EAAE,sBAAsB,EAAE,uBAAuB,CAAC,CAAC;QAE3F,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,QAAQ,CAAC;YACb,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YAChF,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,OAAO,GACX,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAC1B,CAAC,CAAE,QAAQ,CAAC,IAAkB,CAAC,MAAM,GAAG,CAAC;oBACzC,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC;gBAElE,IAAI,OAAO,EAAE,CAAC;oBACZ,QAAQ,CAAC,IAAI,CAAC;wBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,iBAAiB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE;wBAC9D,IAAI,EAAE,mBAAmB;wBACzB,QAAQ,EAAE,UAAU;wBACpB,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,MAAM,EAAE,SAAS;wBACjB,WAAW,EACT,2CAA2C,IAAI,SAAS,cAAc,IAAI,SAAS,0BAA0B;4BAC7G,gCAAgC,KAAK,IAAI;wBAC3C,YAAY,EACV,eAAe,cAAc,qFAAqF;qBACrH,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,8EAA8E;QAC9E,0EAA0E;QAC1E,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,WAAW,GAAG;gBAClB,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACjE,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;aACnE,CAAC;YAEF,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC;gBACzC,IAAI,QAAQ,CAAC;gBACb,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAC3C,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,QAAQ,CAAC,IAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACvB,QAAQ,CAAC,IAAI,CAAC;4BACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,qBAAqB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE;4BAClE,IAAI,EAAE,mBAAmB;4BACzB,QAAQ,EAAE,UAAU;4BACpB,OAAO,EAAE,IAAI,CAAC,OAAO;4BACrB,MAAM,EAAE,SAAS;4BACjB,WAAW,EACT,kCAAkC,IAAI,yBAAyB,KAAK,IAAI;gCACxE,YAAY,OAAO,CAAC,MAAM,2CAA2C,KAAK,IAAI;4BAChF,YAAY,EACV,2EAA2E;yBAC9E,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/agents/20-workflow-completion-tester.d.ts

@@ -0,0 +1,12 @@
+import type { Finding } from '../core/types';
+import { BaseAgent } from './base-agent';
+export declare class WorkflowCompletionTesterAgent extends BaseAgent {
+    readonly agentId = 20;
+    readonly agentName = "Workflow Completion Tester";
+    private baseUrl;
+    protected preFlight(): Promise<void>;
+    protected execute(): Promise<Finding[]>;
+    private runWorkflow;
+    private executeStep;
+}
+//# sourceMappingURL=20-workflow-completion-tester.d.ts.map

package/dist/agents/20-workflow-completion-tester.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20-workflow-completion-tester.d.ts","sourceRoot":"","sources":["../../agents/20-workflow-completion-tester.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAMzC,qBAAa,6BAA8B,SAAQ,SAAS;IAC1D,QAAQ,CAAC,OAAO,MAAM;IACtB,QAAQ,CAAC,SAAS,gCAAgC;IAClD,OAAO,CAAC,OAAO,CAAM;cAEL,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cAW1B,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YAiE/B,WAAW;YA8DX,WAAW;CAkD1B"}