@avi770/testteam 2.0.0 → 3.2.0

package/agents/31-load-tester.ts

@@ -1,134 +0,0 @@
-import { BaseAgent } from './base-agent';
-import type { Finding } from '../core/types';
-import { resolveEnvironment } from '../helpers/env-resolver';
-
-/** Default API endpoints to test when no route scanning is available. */
-const DEFAULT_ENDPOINTS = [
-  '/api/auth/login',
-  '/api/tasks',
-  '/api/clients',
-  '/api/dashboard',
-  '/api/users',
-] as const;
-
-/** Timeout (ms) for individual requests during load testing. */
-const REQUEST_TIMEOUT_MS = 10_000;
-
-interface TimingResult {
-  endpoint: string;
-  durations: number[];
-  errors: number;
-}
-
-function percentile(sorted: number[], p: number): number {
-  if (sorted.length === 0) return 0;
-  const idx = Math.ceil((p / 100) * sorted.length) - 1;
-  return sorted[Math.max(0, idx)];
-}
-
-export class LoadTesterAgent extends BaseAgent {
-  readonly agentId = 31;
-  readonly agentName = 'Load Tester';
-  private baseUrl = '';
-
-  protected async preFlight(): Promise<void> {
-    const { env } = await resolveEnvironment(this.config, this.phase);
-    this.baseUrl = env.baseUrl;
-  }
-
-  protected async execute(): Promise<Finding[]> {
-    const findings: Finding[] = [];
-    const endpoints = this.discoverEndpoints();
-
-    // Phase 1: 100 concurrent requests
-    for (const endpoint of endpoints) {
-      const timing = await this.runConcurrent(endpoint, 100);
-      const sorted = [...timing.durations].sort((a, b) => a - b);
-      const avg = sorted.length > 0 ? sorted.reduce((s, v) => s + v, 0) / sorted.length : 0;
-      const p95 = percentile(sorted, 95);
-      const p99 = percentile(sorted, 99);
-
-      this.addEvidence({
-        type: 'log',
-        path: `load-test-100-${endpoint.replace(/\//g, '_')}`,
-        description: `100 concurrent: avg=${avg.toFixed(0)}ms p95=${p95.toFixed(0)}ms p99=${p99.toFixed(0)}ms errors=${timing.errors}`,
-      });
-
-      if (p95 > 500) {
-        findings.push({
-          id: `${this.agentId}-slow-p95-100-${endpoint.replace(/\//g, '_')}`,
-          type: 'test-bug',
-          severity: 'medium',
-          agentId: this.agentId,
-          module: 'load-test',
-          description: `Endpoint ${endpoint} p95=${p95.toFixed(0)}ms exceeds 500ms threshold at 100 concurrent requests (avg=${avg.toFixed(0)}ms, p99=${p99.toFixed(0)}ms)`,
-        });
-      }
-    }
-
-    // Phase 2: 500 concurrent requests
-    for (const endpoint of endpoints) {
-      const timing = await this.runConcurrent(endpoint, 500);
-      const sorted = [...timing.durations].sort((a, b) => a - b);
-      const avg = sorted.length > 0 ? sorted.reduce((s, v) => s + v, 0) / sorted.length : 0;
-      const p95 = percentile(sorted, 95);
-      const p99 = percentile(sorted, 99);
-
-      this.addEvidence({
-        type: 'log',
-        path: `load-test-500-${endpoint.replace(/\//g, '_')}`,
-        description: `500 concurrent: avg=${avg.toFixed(0)}ms p95=${p95.toFixed(0)}ms p99=${p99.toFixed(0)}ms errors=${timing.errors}`,
-      });
-
-      if (p95 > 1000) {
-        findings.push({
-          id: `${this.agentId}-slow-p95-500-${endpoint.replace(/\//g, '_')}`,
-          type: 'test-bug',
-          severity: 'high',
-          agentId: this.agentId,
-          module: 'load-test',
-          description: `Endpoint ${endpoint} p95=${p95.toFixed(0)}ms exceeds 1000ms threshold at 500 concurrent requests (avg=${avg.toFixed(0)}ms, p99=${p99.toFixed(0)}ms)`,
-        });
-      }
-    }
-
-    return findings;
-  }
-
-  private discoverEndpoints(): string[] {
-    // Use configured modules to derive API endpoints, or fall back to defaults
-    if (this.config.modules && this.config.modules.length > 0) {
-      return this.config.modules.map(m => `/api${m.route}`);
-    }
-    return [...DEFAULT_ENDPOINTS];
-  }
-
-  private async runConcurrent(endpoint: string, count: number): Promise<TimingResult> {
-    const url = `${this.baseUrl}${endpoint}`;
-    const durations: number[] = [];
-    let errors = 0;
-
-    const promises = Array.from({ length: count }, async () => {
-      const start = Date.now();
-      try {
-        await Promise.race([
-          fetch(url, {
-            method: 'GET',
-            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-          }),
-          new Promise<never>((_, reject) =>
-            setTimeout(() => reject(new Error('Load test timeout')), REQUEST_TIMEOUT_MS),
-          ),
-        ]);
-        durations.push(Date.now() - start);
-      } catch {
-        errors++;
-        durations.push(Date.now() - start);
-      }
-    });
-
-    await Promise.all(promises);
-
-    return { endpoint, durations, errors };
-  }
-}

package/agents/32-memory-leak-detector.ts

@@ -1,194 +0,0 @@
-import type { Browser, Page } from 'playwright';
-import type { Finding } from '../core/types';
-import { BaseAgent } from './base-agent';
-import { resolveEnvironment } from '../helpers/env-resolver';
-import { login } from '../helpers/navigation';
-
-/** Threshold in bytes for heap growth. */
-const MEDIUM_THRESHOLD_BYTES = 5 * 1024 * 1024; // 5MB
-const HIGH_THRESHOLD_BYTES = 10 * 1024 * 1024; // 10MB
-const NAV_TIMEOUT_MS = 5_000;
-const ITERATION_COUNT = 10;
-const MAX_MODULES = 5;
-
-export class MemoryLeakDetectorAgent extends BaseAgent {
-  readonly agentId = 32;
-  readonly agentName = 'Memory Leak Detector';
-  private baseUrl = '';
-
-  protected async preFlight(): Promise<void> {
-    if (!this.config.modules || this.config.modules.length === 0) {
-      throw new Error('MemoryLeakDetectorAgent requires at least one module in config.modules');
-    }
-    const { env } = await resolveEnvironment(this.config, this.phase);
-    this.baseUrl = env.baseUrl;
-  }
-
-  protected async execute(): Promise<Finding[]> {
-    const findings: Finding[] = [];
-    const rawLoginUrl = this.config.auth.loginUrl ?? '/login';
-    const loginUrl = rawLoginUrl.startsWith('http') ? rawLoginUrl : `${this.baseUrl}${rawLoginUrl}`;
-    const credentials =
-      this.config.auth.credentials?.['admin'] ??
-      Object.values(this.config.auth.credentials ?? {})[0];
-
-    const { chromium } = await import('playwright');
-    let browser: Browser | null = null;
-
-    try {
-      browser = await chromium.launch({ headless: true });
-      const page = await browser.newPage();
-
-      if (credentials) {
-        try {
-          await login(page, credentials, loginUrl);
-        } catch (loginError) {
-          findings.push({
-            id: `${this.agentId}-login-failed`,
-            type: 'infra-issue',
-            severity: 'medium',
-            agentId: this.agentId,
-            module: 'memory-leak-detector',
-            description: `Login failed — continuing anonymously: ${loginError instanceof Error ? loginError.message.split('\n')[0] : String(loginError)}`,
-          });
-        }
-      }
-
-      const modules = this.config.modules.slice(0, MAX_MODULES);
-
-      for (const mod of modules) {
-        const moduleFindings = await this.testModuleMemory(page, mod.id, mod.route);
-        findings.push(...moduleFindings);
-      }
-
-      await page.close().catch(() => undefined);
-    } catch (playwrightError) {
-      findings.push({
-        id: `${this.agentId}-playwright-failure`,
-        type: 'infra-issue',
-        severity: 'medium',
-        agentId: this.agentId,
-        module: 'memory-leak-detector',
-        description: `Playwright execution failed: ${playwrightError instanceof Error ? playwrightError.message.split('\n')[0] : String(playwrightError)}`,
-      });
-    } finally {
-      if (browser) await browser.close().catch(() => undefined);
-    }
-
-    return findings;
-  }
-
-  private async testModuleMemory(
-    page: Page,
-    moduleId: string,
-    moduleRoute: string,
-  ): Promise<Finding[]> {
-    const findings: Finding[] = [];
-    const fullUrl = moduleRoute.startsWith('http')
-      ? moduleRoute
-      : `${this.baseUrl}${moduleRoute}`;
-
-    try {
-      await Promise.race([
-        page.goto(fullUrl, { waitUntil: 'domcontentloaded' }),
-        new Promise((_, reject) =>
-          setTimeout(() => reject(new Error('Navigation timeout')), NAV_TIMEOUT_MS),
-        ),
-      ]);
-    } catch {
-      findings.push({
-        id: `${this.agentId}-nav-failed-${moduleId}`,
-        type: 'test-bug',
-        severity: 'medium',
-        agentId: this.agentId,
-        module: moduleId,
-        description: `Failed to navigate to module ${moduleId} at ${moduleRoute}`,
-      });
-      return findings;
-    }
-
-    // Record initial heap size
-    const initialHeap = await this.getHeapSize(page);
-    if (initialHeap === null) {
-      findings.push({
-        id: `${this.agentId}-no-memory-api-${moduleId}`,
-        type: 'infra-issue',
-        severity: 'low',
-        agentId: this.agentId,
-        module: moduleId,
-        description: `performance.memory API not available for module ${moduleId}`,
-      });
-      return findings;
-    }
-
-    // Navigate away and back N times
-    for (let i = 0; i < ITERATION_COUNT; i++) {
-      try {
-        await Promise.race([
-          page.goto('about:blank', { waitUntil: 'domcontentloaded' }),
-          new Promise((_, reject) =>
-            setTimeout(() => reject(new Error('Timeout')), NAV_TIMEOUT_MS),
-          ),
-        ]);
-        await Promise.race([
-          page.goto(fullUrl, { waitUntil: 'domcontentloaded' }),
-          new Promise((_, reject) =>
-            setTimeout(() => reject(new Error('Timeout')), NAV_TIMEOUT_MS),
-          ),
-        ]);
-      } catch {
-        // Non-fatal — continue iterations
-      }
-    }
-
-    // Record final heap size
-    const finalHeap = await this.getHeapSize(page);
-    if (finalHeap === null) {
-      return findings;
-    }
-
-    const growth = finalHeap - initialHeap;
-
-    this.addEvidence({
-      type: 'log',
-      path: `memory-${moduleId}`,
-      description: `Module ${moduleId}: initial=${(initialHeap / 1024 / 1024).toFixed(2)}MB final=${(finalHeap / 1024 / 1024).toFixed(2)}MB growth=${(growth / 1024 / 1024).toFixed(2)}MB`,
-    });
-
-    if (growth > HIGH_THRESHOLD_BYTES) {
-      findings.push({
-        id: `${this.agentId}-high-leak-${moduleId}`,
-        type: 'code-bug-logic',
-        severity: 'high',
-        agentId: this.agentId,
-        module: moduleId,
-        description: `Potential memory leak in module ${moduleId}: heap grew ${(growth / 1024 / 1024).toFixed(2)}MB after ${ITERATION_COUNT} navigation cycles (threshold: 10MB)`,
-      });
-    } else if (growth > MEDIUM_THRESHOLD_BYTES) {
-      findings.push({
-        id: `${this.agentId}-medium-leak-${moduleId}`,
-        type: 'code-bug-logic',
-        severity: 'medium',
-        agentId: this.agentId,
-        module: moduleId,
-        description: `Possible memory leak in module ${moduleId}: heap grew ${(growth / 1024 / 1024).toFixed(2)}MB after ${ITERATION_COUNT} navigation cycles (threshold: 5MB)`,
-      });
-    }
-
-    return findings;
-  }
-
-  private async getHeapSize(page: Page): Promise<number | null> {
-    try {
-      const heapSize = await page.evaluate(() => {
-        const perf = performance as Performance & {
-          memory?: { usedJSHeapSize: number };
-        };
-        return perf.memory?.usedJSHeapSize ?? null;
-      });
-      return heapSize;
-    } catch {
-      return null;
-    }
-  }
-}

package/agents/33-bundle-analyzer.ts

@@ -1,132 +0,0 @@
-import { readdir, stat } from 'node:fs/promises';
-import { join, extname } from 'node:path';
-import type { Finding } from '../core/types';
-import { BaseAgent } from './base-agent';
-
-/** Maximum individual chunk size before flagging. */
-const CHUNK_SIZE_THRESHOLD_BYTES = 250 * 1024; // 250KB
-
-interface FileInfo {
-  name: string;
-  path: string;
-  sizeBytes: number;
-}
-
-export class BundleAnalyzerAgent extends BaseAgent {
-  readonly agentId = 33;
-  readonly agentName = 'Bundle Analyzer';
-
-  protected async preFlight(): Promise<void> {
-    // No special pre-conditions — we'll report if assets dir is missing
-  }
-
-  protected async execute(): Promise<Finding[]> {
-    const findings: Finding[] = [];
-    const projectRoot = this.config.projectRoot ?? process.cwd();
-
-    const assetsDirs = [
-      join(projectRoot, 'dist', 'assets'),
-      join(projectRoot, 'out', 'assets'),
-    ];
-
-    let assetsDir: string | null = null;
-    for (const dir of assetsDirs) {
-      try {
-        const s = await stat(dir);
-        if (s.isDirectory()) {
-          assetsDir = dir;
-          break;
-        }
-      } catch {
-        // Directory does not exist — try next
-      }
-    }
-
-    if (!assetsDir) {
-      findings.push({
-        id: `${this.agentId}-no-assets-dir`,
-        type: 'infra-issue',
-        severity: 'low',
-        agentId: this.agentId,
-        module: 'bundle-analyzer',
-        description: `No assets directory found at dist/assets or out/assets in ${projectRoot}`,
-      });
-      return findings;
-    }
-
-    let files: FileInfo[];
-    try {
-      files = await this.scanAssets(assetsDir);
-    } catch (scanError) {
-      findings.push({
-        id: `${this.agentId}-scan-error`,
-        type: 'infra-issue',
-        severity: 'medium',
-        agentId: this.agentId,
-        module: 'bundle-analyzer',
-        description: `Failed to scan assets directory: ${scanError instanceof Error ? scanError.message : String(scanError)}`,
-      });
-      return findings;
-    }
-
-    const jsFiles = files.filter(f => extname(f.name) === '.js');
-    const mapFiles = files.filter(f => extname(f.name) === '.map');
-    let totalBundleSize = 0;
-
-    // Check each JS chunk size
-    for (const file of jsFiles) {
-      totalBundleSize += file.sizeBytes;
-
-      if (file.sizeBytes > CHUNK_SIZE_THRESHOLD_BYTES) {
-        findings.push({
-          id: `${this.agentId}-large-chunk-${file.name}`,
-          type: 'test-bug',
-          severity: 'medium',
-          agentId: this.agentId,
-          module: 'bundle-analyzer',
-          file: file.path,
-          description: `JS chunk ${file.name} is ${(file.sizeBytes / 1024).toFixed(1)}KB — exceeds 250KB threshold`,
-        });
-      }
-    }
-
-    // Check for source maps in production
-    if (mapFiles.length > 0) {
-      findings.push({
-        id: `${this.agentId}-source-maps-in-production`,
-        type: 'code-bug-security',
-        severity: 'medium',
-        agentId: this.agentId,
-        module: 'bundle-analyzer',
-        description: `Found ${mapFiles.length} source map file(s) in production build — these expose source code: ${mapFiles.map(f => f.name).join(', ')}`,
-      });
-    }
-
-    this.addEvidence({
-      type: 'report',
-      path: 'bundle-analysis',
-      description: `Total bundle size: ${(totalBundleSize / 1024).toFixed(1)}KB across ${jsFiles.length} JS files. Source maps: ${mapFiles.length}`,
-    });
-
-    return findings;
-  }
-
-  private async scanAssets(dir: string): Promise<FileInfo[]> {
-    const entries = await readdir(dir, { withFileTypes: true });
-    const files: FileInfo[] = [];
-
-    for (const entry of entries) {
-      const fullPath = join(dir, entry.name);
-      if (entry.isFile()) {
-        const fileStat = await stat(fullPath);
-        files.push({
-          name: entry.name,
-          path: fullPath,
-          sizeBytes: fileStat.size,
-        });
-      }
-    }
-
-    return files;
-  }
-}

package/agents/34-xss-scanner.ts

@@ -1,191 +0,0 @@
-import type { Browser, Page } from 'playwright';
-import type { Finding } from '../core/types';
-import { BaseAgent } from './base-agent';
-import { resolveEnvironment } from '../helpers/env-resolver';
-import { login } from '../helpers/navigation';
-
-const XSS_PAYLOADS = [
-  '<script>alert(\'xss\')</script>',
-  '"><img onerror=alert(1) src=x>',
-  'javascript:alert(1)',
-] as const;
-
-const INPUT_SELECTORS = 'input[type="text"], textarea';
-const NAV_TIMEOUT_MS = 5_000;
-const MAX_MODULES = 3;
-
-export class XssScannerAgent extends BaseAgent {
-  readonly agentId = 34;
-  readonly agentName = 'XSS Scanner';
-  private baseUrl = '';
-
-  protected async preFlight(): Promise<void> {
-    if (!this.config.modules || this.config.modules.length === 0) {
-      throw new Error('XssScannerAgent requires at least one module in config.modules');
-    }
-    const { env } = await resolveEnvironment(this.config, this.phase);
-    this.baseUrl = env.baseUrl;
-  }
-
-  protected async execute(): Promise<Finding[]> {
-    const findings: Finding[] = [];
-    const rawLoginUrl = this.config.auth.loginUrl ?? '/login';
-    const loginUrl = rawLoginUrl.startsWith('http') ? rawLoginUrl : `${this.baseUrl}${rawLoginUrl}`;
-    const credentials =
-      this.config.auth.credentials?.['admin'] ??
-      Object.values(this.config.auth.credentials ?? {})[0];
-
-    const { chromium } = await import('playwright');
-    let browser: Browser | null = null;
-
-    try {
-      browser = await chromium.launch({ headless: true });
-      const page = await browser.newPage();
-
-      if (credentials) {
-        try {
-          await login(page, credentials, loginUrl);
-        } catch (loginError) {
-          findings.push({
-            id: `${this.agentId}-login-failed`,
-            type: 'infra-issue',
-            severity: 'medium',
-            agentId: this.agentId,
-            module: 'xss-scanner',
-            description: `Login failed — continuing anonymously: ${loginError instanceof Error ? loginError.message.split('\n')[0] : String(loginError)}`,
-          });
-        }
-      }
-
-      const modules = this.config.modules.slice(0, MAX_MODULES);
-      for (const mod of modules) {
-        const moduleFindings = await this.testModuleXss(page, mod.id, mod.route);
-        findings.push(...moduleFindings);
-      }
-
-      await page.close().catch(() => undefined);
-    } catch (playwrightError) {
-      findings.push({
-        id: `${this.agentId}-playwright-failure`,
-        type: 'infra-issue',
-        severity: 'medium',
-        agentId: this.agentId,
-        module: 'xss-scanner',
-        description: `Playwright execution failed: ${playwrightError instanceof Error ? playwrightError.message.split('\n')[0] : String(playwrightError)}`,
-      });
-    } finally {
-      if (browser) await browser.close().catch(() => undefined);
-    }
-
-    return findings;
-  }
-
-  private async testModuleXss(
-    page: Page,
-    moduleId: string,
-    moduleRoute: string,
-  ): Promise<Finding[]> {
-    const findings: Finding[] = [];
-    const fullUrl = moduleRoute.startsWith('http')
-      ? moduleRoute
-      : `${this.baseUrl}${moduleRoute}`;
-
-    try {
-      await Promise.race([
-        page.goto(fullUrl, { waitUntil: 'domcontentloaded' }),
-        new Promise((_, reject) =>
-          setTimeout(() => reject(new Error('Navigation timeout')), NAV_TIMEOUT_MS),
-        ),
-      ]);
-    } catch {
-      findings.push({
-        id: `${this.agentId}-nav-failed-${moduleId}`,
-        type: 'test-bug',
-        severity: 'medium',
-        agentId: this.agentId,
-        module: moduleId,
-        description: `Failed to navigate to module ${moduleId} at ${moduleRoute}`,
-      });
-      return findings;
-    }
-
-    // Find input fields
-    let inputCount = 0;
-    try {
-      inputCount = await Promise.race([
-        page.locator(INPUT_SELECTORS).count(),
-        new Promise<number>((_, reject) =>
-          setTimeout(() => reject(new Error('Timeout')), NAV_TIMEOUT_MS),
-        ),
-      ]) as number;
-    } catch {
-      // Timeout discovering inputs
-    }
-
-    if (inputCount === 0) {
-      findings.push({
-        id: `${this.agentId}-no-inputs-${moduleId}`,
-        type: 'test-bug',
-        severity: 'low',
-        agentId: this.agentId,
-        module: moduleId,
-        description: `No text inputs or textareas found in module ${moduleId}`,
-      });
-      return findings;
-    }
-
-    // Test each payload on each input
-    for (const payload of XSS_PAYLOADS) {
-      for (let i = 0; i < inputCount; i++) {
-        let dialogFired = false;
-        const dialogHandler = (): void => {
-          dialogFired = true;
-        };
-
-        page.on('dialog', dialogHandler);
-
-        try {
-          const input = page.locator(INPUT_SELECTORS).nth(i);
-          await Promise.race([
-            input.fill(payload),
-            new Promise((_, reject) =>
-              setTimeout(() => reject(new Error('Timeout')), NAV_TIMEOUT_MS),
-            ),
-          ]);
-
-          // Brief wait to see if dialog fires
-          await new Promise(resolve => setTimeout(resolve, 500));
-
-          if (dialogFired) {
-            findings.push({
-              id: `${this.agentId}-xss-found-${moduleId}-input${i}`,
-              type: 'code-bug-security',
-              severity: 'critical',
-              agentId: this.agentId,
-              module: moduleId,
-              description: `XSS vulnerability found in module ${moduleId} input #${i} with payload: ${payload}`,
-            });
-          }
-        } catch {
-          // Input interaction failed — non-critical
-        } finally {
-          page.removeListener('dialog', dialogHandler);
-        }
-
-        // Re-navigate to reset state
-        try {
-          await Promise.race([
-            page.goto(fullUrl, { waitUntil: 'domcontentloaded' }),
-            new Promise((_, reject) =>
-              setTimeout(() => reject(new Error('Timeout')), NAV_TIMEOUT_MS),
-            ),
-          ]);
-        } catch {
-          // Navigation reset failed
-        }
-      }
-    }
-
-    return findings;
-  }
-}