@avi770/testteam 2.0.0 → 3.2.0

package/agents/__tests__/59-ssl-tls-auditor.test.ts

@@ -1,179 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import type { ValidatedConfig } from '../../core/config';
-import type { Phase } from '../../core/types';
-
-function makeConfig(overrides: Partial<ValidatedConfig> = {}): ValidatedConfig {
-  return {
-    schemaVersion: 1, name: 'test',
-    auth: { loginUrl: '/login', credentials: { admin: { email: 'a@t.com', password: 's' } } },
-    modules: [{ id: 'dashboard', route: '/dashboard', sidebarIcon: true }],
-    environments: { alpha: { baseUrl: 'https://example.com', seed: false } },
-    portals: [], breakpoints: [], integrations: [], workers: [], workflows: [],
-    accuracy: { enabled: false, decimalPrecision: 2, currencySymbol: '$', timezone: 'UTC' },
-    tenancy: { enabled: false, isolationField: 'firmId', testFirms: [] },
-    costBudget: { maxPerRun: 100, maxPerAgent: 10, alertThreshold: 0.8, onExceeded: 'abort' },
-    agentClassification: { blocking: [], advisory: [] },
-    thresholds: { unitCoverage: { lines: 80, functions: 80, branches: 80, statements: 80 }, lighthouse: { accessibility: 90, performance: 90, bestPractices: 90, seo: 90 }, apiResponseTime: 2000, bundleSizeLimit: 500000, maxConsoleErrors: 0 },
-    disabledAgents: [], disabledAgentSet: new Set<number>(),
-    ...overrides,
-  };
-}
-
-const fetchMock = vi.fn();
-vi.stubGlobal('fetch', fetchMock);
-
-vi.mock('../../helpers/navigation', () => ({
-  login: vi.fn().mockResolvedValue(undefined),
-  waitForSectionLoad: vi.fn().mockResolvedValue(undefined),
-  navigateToSection: vi.fn().mockResolvedValue(undefined),
-  switchPortal: vi.fn().mockResolvedValue(undefined),
-}));
-
-const httpsGetMock = vi.fn();
-vi.mock('node:https', () => ({
-  get: (...args: unknown[]) => httpsGetMock(...args),
-}));
-
-const { SslTlsAuditorAgent } = await import('../59-ssl-tls-auditor');
-
-function createAgent(config: ValidatedConfig = makeConfig(), phase: Phase = 'beta') {
-  return new SslTlsAuditorAgent(config, phase, '/tmp/test-run');
-}
-
-describe('SslTlsAuditorAgent', () => {
-  beforeEach(() => {
-    fetchMock.mockReset().mockResolvedValue({
-      ok: true,
-      status: 200,
-      headers: new Map([['strict-transport-security', 'max-age=31536000']]),
-    });
-    fetchMock.mockResolvedValue({
-      ok: true,
-      status: 200,
-      headers: { get: vi.fn().mockReturnValue('max-age=31536000') },
-    });
-    httpsGetMock.mockReset();
-    httpsGetMock.mockImplementation((_opts: unknown, cb: Function) => {
-      const mockRes = {
-        socket: {
-          getPeerCertificate: () => ({
-            valid_to: new Date(Date.now() + 90 * 24 * 60 * 60 * 1000).toUTCString(),
-          }),
-        },
-      };
-      cb(mockRes);
-      return { on: vi.fn(), destroy: vi.fn() };
-    });
-  });
-
-  it('has agentId 59 and correct name', () => {
-    const agent = createAgent();
-    expect(agent.agentId).toBe(59);
-    expect(agent.agentName).toBe('SSL/TLS Auditor');
-  });
-
-  it('reports missing HSTS header', async () => {
-    fetchMock.mockResolvedValue({
-      ok: true, status: 200,
-      headers: { get: vi.fn().mockReturnValue(null) },
-    });
-    const agent = createAgent();
-    const result = await agent.run();
-    const finding = result.findings.find(f => f.id.includes('no-hsts'));
-    expect(finding).toBeDefined();
-    expect(finding!.severity).toBe('medium');
-  });
-
-  it('reports short HSTS max-age', async () => {
-    fetchMock.mockResolvedValue({
-      ok: true, status: 200,
-      headers: { get: vi.fn().mockReturnValue('max-age=3600') },
-    });
-    const agent = createAgent();
-    const result = await agent.run();
-    const finding = result.findings.find(f => f.id.includes('short-hsts'));
-    expect(finding).toBeDefined();
-  });
-
-  it('reports no HTTPS when base URL is HTTP', async () => {
-    const config = makeConfig({ environments: { alpha: { baseUrl: 'http://example.com', seed: false } } });
-    const agent = createAgent(config);
-    const result = await agent.run();
-    const finding = result.findings.find(f => f.id.includes('no-https'));
-    expect(finding).toBeDefined();
-    expect(finding!.severity).toBe('high');
-  });
-
-  it('reports cert expiring soon', async () => {
-    httpsGetMock.mockImplementation((_opts: unknown, cb: Function) => {
-      cb({
-        socket: {
-          getPeerCertificate: () => ({
-            valid_to: new Date(Date.now() + 15 * 24 * 60 * 60 * 1000).toUTCString(),
-          }),
-        },
-      });
-      return { on: vi.fn(), destroy: vi.fn() };
-    });
-    const agent = createAgent();
-    const result = await agent.run();
-    const finding = result.findings.find(f => f.id.includes('cert-expiring-soon'));
-    expect(finding).toBeDefined();
-    expect(finding!.severity).toBe('high');
-  });
-
-  it('reports expired cert as critical', async () => {
-    httpsGetMock.mockImplementation((_opts: unknown, cb: Function) => {
-      cb({
-        socket: {
-          getPeerCertificate: () => ({
-            valid_to: new Date(Date.now() - 5 * 24 * 60 * 60 * 1000).toUTCString(),
-          }),
-        },
-      });
-      return { on: vi.fn(), destroy: vi.fn() };
-    });
-    const agent = createAgent();
-    const result = await agent.run();
-    const finding = result.findings.find(f => f.id.includes('cert-expired'));
-    expect(finding).toBeDefined();
-    expect(finding!.severity).toBe('critical');
-  });
-
-  it('handles fetch failure', async () => {
-    fetchMock.mockRejectedValue(new Error('Fetch failed'));
-    const agent = createAgent();
-    const result = await agent.run();
-    const finding = result.findings.find(f => f.id.includes('fetch-failed'));
-    expect(finding).toBeDefined();
-  });
-
-  it('handles cert check failure', async () => {
-    httpsGetMock.mockImplementation((_opts: unknown, _cb: Function) => {
-      return {
-        on: (event: string, handler: Function) => {
-          if (event === 'error') handler(new Error('Cert error'));
-        },
-        destroy: vi.fn(),
-      };
-    });
-    const agent = createAgent();
-    const result = await agent.run();
-    const finding = result.findings.find(f => f.id.includes('cert-check-failed'));
-    expect(finding).toBeDefined();
-  });
-
-  it('no finding when cert is valid and HSTS present', async () => {
-    const agent = createAgent();
-    const result = await agent.run();
-    const certIssue = result.findings.find(f => f.id.includes('cert-expired') || f.id.includes('cert-expiring'));
-    expect(certIssue).toBeUndefined();
-  });
-
-  it('valid HSTS produces no finding', async () => {
-    const agent = createAgent();
-    const result = await agent.run();
-    const hstsFinding = result.findings.find(f => f.id.includes('no-hsts'));
-    expect(hstsFinding).toBeUndefined();
-  });
-});

package/agents/__tests__/60-dns-cdn-tester.test.ts

@@ -1,176 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import type { ValidatedConfig } from '../../core/config';
-import type { Phase } from '../../core/types';
-
-function makeConfig(overrides: Partial<ValidatedConfig> = {}): ValidatedConfig {
-  return {
-    schemaVersion: 1, name: 'test',
-    auth: { loginUrl: '/login', credentials: { admin: { email: 'a@t.com', password: 's' } } },
-    modules: [{ id: 'dashboard', route: '/dashboard', sidebarIcon: true }],
-    environments: { alpha: { baseUrl: 'http://localhost:3000', seed: false } },
-    portals: [], breakpoints: [], integrations: [], workers: [], workflows: [],
-    accuracy: { enabled: false, decimalPrecision: 2, currencySymbol: '$', timezone: 'UTC' },
-    tenancy: { enabled: false, isolationField: 'firmId', testFirms: [] },
-    costBudget: { maxPerRun: 100, maxPerAgent: 10, alertThreshold: 0.8, onExceeded: 'abort' },
-    agentClassification: { blocking: [], advisory: [] },
-    thresholds: { unitCoverage: { lines: 80, functions: 80, branches: 80, statements: 80 }, lighthouse: { accessibility: 90, performance: 90, bestPractices: 90, seo: 90 }, apiResponseTime: 2000, bundleSizeLimit: 500000, maxConsoleErrors: 0 },
-    disabledAgents: [], disabledAgentSet: new Set<number>(),
-    ...overrides,
-  };
-}
-
-const fetchMock = vi.fn();
-vi.stubGlobal('fetch', fetchMock);
-
-vi.mock('../../helpers/navigation', () => ({
-  login: vi.fn().mockResolvedValue(undefined),
-  waitForSectionLoad: vi.fn().mockResolvedValue(undefined),
-  navigateToSection: vi.fn().mockResolvedValue(undefined),
-  switchPortal: vi.fn().mockResolvedValue(undefined),
-}));
-
-const { DnsCdnTesterAgent } = await import('../60-dns-cdn-tester');
-
-function createAgent(config: ValidatedConfig = makeConfig(), phase: Phase = 'beta') {
-  return new DnsCdnTesterAgent(config, phase, '/tmp/test-run');
-}
-
-describe('DnsCdnTesterAgent', () => {
-  beforeEach(() => {
-    fetchMock.mockReset();
-    fetchMock.mockResolvedValue({
-      ok: true, status: 200,
-      headers: { get: vi.fn().mockReturnValue(null) },
-    });
-  });
-
-  it('has agentId 60 and correct name', () => {
-    const agent = createAgent();
-    expect(agent.agentId).toBe(60);
-    expect(agent.agentName).toBe('DNS & CDN Tester');
-  });
-
-  it('reports no CDN when no CDN headers present', async () => {
-    const agent = createAgent();
-    const result = await agent.run();
-    const finding = result.findings.find(f => f.id.includes('no-cdn'));
-    expect(finding).toBeDefined();
-    expect(finding!.severity).toBe('low');
-  });
-
-  it('reports no cache-control header', async () => {
-    const agent = createAgent();
-    const result = await agent.run();
-    const finding = result.findings.find(f => f.id.includes('no-cache-control'));
-    expect(finding).toBeDefined();
-  });
-
-  it('detects Cloudflare CDN', async () => {
-    fetchMock.mockResolvedValue({
-      ok: true, status: 200,
-      headers: {
-        get: (name: string) => {
-          if (name === 'cf-ray') return 'abc123';
-          if (name === 'cache-control') return 'public, max-age=3600';
-          return null;
-        },
-      },
-    });
-    const agent = createAgent();
-    const result = await agent.run();
-    const cdnFinding = result.findings.find(f => f.id.includes('no-cdn'));
-    expect(cdnFinding).toBeUndefined();
-  });
-
-  it('reports slow response time', async () => {
-    // Simulate slow response by delaying fetch
-    fetchMock.mockImplementation(async () => {
-      await new Promise(resolve => setTimeout(resolve, 50));
-      return {
-        ok: true, status: 200,
-        headers: { get: vi.fn().mockReturnValue(null) },
-      };
-    });
-    // Can't easily test timing, but verify structure
-    const agent = createAgent();
-    const result = await agent.run();
-    expect(result.status).toBeDefined();
-  });
-
-  it('handles fetch failure', async () => {
-    fetchMock.mockRejectedValue(new Error('Network error'));
-    const agent = createAgent();
-    const result = await agent.run();
-    const finding = result.findings.find(f => f.id.includes('fetch-failed'));
-    expect(finding).toBeDefined();
-  });
-
-  it('reports cache-control present', async () => {
-    fetchMock.mockResolvedValue({
-      ok: true, status: 200,
-      headers: {
-        get: (name: string) => {
-          if (name === 'cache-control') return 'public, max-age=3600';
-          return null;
-        },
-      },
-    });
-    const agent = createAgent();
-    const result = await agent.run();
-    const finding = result.findings.find(f => f.id.includes('no-cache-control'));
-    expect(finding).toBeUndefined();
-  });
-
-  it('detects no-store cache control', async () => {
-    fetchMock.mockResolvedValue({
-      ok: true, status: 200,
-      headers: {
-        get: (name: string) => {
-          if (name === 'cache-control') return 'no-store';
-          return null;
-        },
-      },
-    });
-    const agent = createAgent();
-    const result = await agent.run();
-    expect(result.status).toBeDefined();
-  });
-
-  it('detects Vercel CDN', async () => {
-    fetchMock.mockResolvedValue({
-      ok: true, status: 200,
-      headers: {
-        get: (name: string) => {
-          if (name === 'x-vercel-cache') return 'HIT';
-          if (name === 'cache-control') return 'public';
-          return null;
-        },
-      },
-    });
-    const agent = createAgent();
-    const result = await agent.run();
-    const cdnFinding = result.findings.find(f => f.id.includes('no-cdn'));
-    expect(cdnFinding).toBeUndefined();
-  });
-
-  it('runs without error for valid response', async () => {
-    fetchMock.mockResolvedValue({
-      ok: true, status: 200,
-      headers: {
-        get: (name: string) => {
-          if (name === 'cache-control') return 'max-age=300';
-          return null;
-        },
-      },
-    });
-    const agent = createAgent();
-    const result = await agent.run();
-    expect(result.status).toBe('passed');
-  });
-
-  it('resolves environment in preFlight', async () => {
-    const agent = createAgent();
-    const result = await agent.run();
-    expect(result.findings.every(f => !f.description.includes('preFlight'))).toBe(true);
-  });
-});

package/agents/__tests__/61-docker-health-checker.test.ts

@@ -1,150 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import type { ValidatedConfig } from '../../core/config';
-import type { Phase } from '../../core/types';
-
-function makeConfig(overrides: Partial<ValidatedConfig> = {}): ValidatedConfig {
-  return {
-    schemaVersion: 1, name: 'test',
-    projectRoot: '/fake/project',
-    auth: { loginUrl: '/login', credentials: { admin: { email: 'a@t.com', password: 's' } } },
-    modules: [{ id: 'dashboard', route: '/dashboard', sidebarIcon: true }],
-    environments: { alpha: { baseUrl: 'http://localhost:3000', seed: false } },
-    portals: [], breakpoints: [], integrations: [], workers: [], workflows: [],
-    accuracy: { enabled: false, decimalPrecision: 2, currencySymbol: '$', timezone: 'UTC' },
-    tenancy: { enabled: false, isolationField: 'firmId', testFirms: [] },
-    costBudget: { maxPerRun: 100, maxPerAgent: 10, alertThreshold: 0.8, onExceeded: 'abort' },
-    agentClassification: { blocking: [], advisory: [] },
-    thresholds: { unitCoverage: { lines: 80, functions: 80, branches: 80, statements: 80 }, lighthouse: { accessibility: 90, performance: 90, bestPractices: 90, seo: 90 }, apiResponseTime: 2000, bundleSizeLimit: 500000, maxConsoleErrors: 0 },
-    disabledAgents: [], disabledAgentSet: new Set<number>(),
-    ...overrides,
-  };
-}
-
-const fetchMock = vi.fn().mockResolvedValue({ ok: true, status: 200 });
-vi.stubGlobal('fetch', fetchMock);
-
-vi.mock('../../helpers/navigation', () => ({
-  login: vi.fn().mockResolvedValue(undefined),
-  waitForSectionLoad: vi.fn().mockResolvedValue(undefined),
-  navigateToSection: vi.fn().mockResolvedValue(undefined),
-  switchPortal: vi.fn().mockResolvedValue(undefined),
-}));
-
-const existsSyncMock = vi.fn();
-const readFileSyncMock = vi.fn();
-const statSyncMock = vi.fn();
-
-vi.mock('node:fs', () => ({
-  existsSync: (...args: unknown[]) => existsSyncMock(...args),
-  readFileSync: (...args: unknown[]) => readFileSyncMock(...args),
-  statSync: (...args: unknown[]) => statSyncMock(...args),
-}));
-
-const { DockerHealthCheckerAgent } = await import('../61-docker-health-checker');
-
-function createAgent(config: ValidatedConfig = makeConfig(), phase: Phase = 'beta') {
-  return new DockerHealthCheckerAgent(config, phase, '/tmp/test-run');
-}
-
-describe('DockerHealthCheckerAgent', () => {
-  beforeEach(() => {
-    existsSyncMock.mockReset();
-    readFileSyncMock.mockReset();
-    statSyncMock.mockReset().mockReturnValue({ size: 500 });
-  });
-
-  it('has agentId 61 and correct name', () => {
-    const agent = createAgent();
-    expect(agent.agentId).toBe(61);
-    expect(agent.agentName).toBe('Docker Health Checker');
-  });
-
-  it('reports no Dockerfile when not found', async () => {
-    existsSyncMock.mockReturnValue(false);
-    const agent = createAgent();
-    const result = await agent.run();
-    const finding = result.findings.find(f => f.id.includes('no-dockerfile'));
-    expect(finding).toBeDefined();
-  });
-
-  it('reports USER root as high severity', async () => {
-    existsSyncMock.mockImplementation((p: string) => p.includes('Dockerfile'));
-    readFileSyncMock.mockReturnValue('FROM node:18\nCOPY . .\nUSER root\nCMD ["node", "app.js"]');
-    const agent = createAgent();
-    const result = await agent.run();
-    const finding = result.findings.find(f => f.id.includes('user-root'));
-    expect(finding).toBeDefined();
-    expect(finding!.severity).toBe('high');
-  });
-
-  it('reports missing HEALTHCHECK', async () => {
-    existsSyncMock.mockImplementation((p: string) => p.includes('Dockerfile') || p.includes('.dockerignore'));
-    readFileSyncMock.mockReturnValue('FROM node:18\nUSER app\nCMD ["node", "app.js"]');
-    const agent = createAgent();
-    const result = await agent.run();
-    const finding = result.findings.find(f => f.id.includes('no-healthcheck'));
-    expect(finding).toBeDefined();
-    expect(finding!.severity).toBe('medium');
-  });
-
-  it('reports missing .dockerignore', async () => {
-    existsSyncMock.mockImplementation((p: string) => p.includes('Dockerfile') && !p.includes('.dockerignore'));
-    readFileSyncMock.mockReturnValue('FROM node:18\nHEALTHCHECK CMD curl -f http://localhost/ || exit 1\nUSER app\nCMD ["node", "app.js"]');
-    const agent = createAgent();
-    const result = await agent.run();
-    const finding = result.findings.find(f => f.id.includes('no-dockerignore'));
-    expect(finding).toBeDefined();
-    expect(finding!.severity).toBe('low');
-  });
-
-  it('no findings when Dockerfile is well configured', async () => {
-    existsSyncMock.mockReturnValue(true);
-    readFileSyncMock.mockReturnValue('FROM node:18\nHEALTHCHECK CMD curl -f http://localhost/ || exit 1\nUSER app\nCMD ["node", "app.js"]');
-    const agent = createAgent();
-    const result = await agent.run();
-    expect(result.findings.filter(f => f.severity === 'high' || f.severity === 'critical').length).toBe(0);
-  });
-
-  it('handles read error gracefully', async () => {
-    existsSyncMock.mockReturnValue(true);
-    readFileSyncMock.mockImplementation(() => { throw new Error('Read error'); });
-    const agent = createAgent();
-    const result = await agent.run();
-    expect(result.status).toBe('failed');
-  });
-
-  it('adds evidence with Dockerfile size', async () => {
-    existsSyncMock.mockReturnValue(true);
-    readFileSyncMock.mockReturnValue('FROM node:18\nHEALTHCHECK CMD curl\nUSER app');
-    statSyncMock.mockReturnValue({ size: 150 });
-    const agent = createAgent();
-    const result = await agent.run();
-    expect(result.evidence.length).toBeGreaterThan(0);
-  });
-
-  it('detects HEALTHCHECK when present', async () => {
-    existsSyncMock.mockReturnValue(true);
-    readFileSyncMock.mockReturnValue('FROM node:18\nHEALTHCHECK CMD curl -f http://localhost/ || exit 1\nUSER app');
-    const agent = createAgent();
-    const result = await agent.run();
-    const finding = result.findings.find(f => f.id.includes('no-healthcheck'));
-    expect(finding).toBeUndefined();
-  });
-
-  it('detects non-root USER as safe', async () => {
-    existsSyncMock.mockReturnValue(true);
-    readFileSyncMock.mockReturnValue('FROM node:18\nHEALTHCHECK CMD curl\nUSER appuser');
-    const agent = createAgent();
-    const result = await agent.run();
-    const finding = result.findings.find(f => f.id.includes('user-root'));
-    expect(finding).toBeUndefined();
-  });
-
-  it('handles empty Dockerfile', async () => {
-    existsSyncMock.mockReturnValue(true);
-    readFileSyncMock.mockReturnValue('');
-    const agent = createAgent();
-    const result = await agent.run();
-    expect(result.status).toBeDefined();
-  });
-});

package/agents/__tests__/62-env-config-validator.test.ts

@@ -1,166 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import type { ValidatedConfig } from '../../core/config';
-import type { Phase } from '../../core/types';
-
-function makeConfig(overrides: Partial<ValidatedConfig> = {}): ValidatedConfig {
-  return {
-    schemaVersion: 1, name: 'test',
-    projectRoot: '/fake/project',
-    auth: { loginUrl: '/login', credentials: { admin: { email: 'a@t.com', password: 's' } } },
-    modules: [{ id: 'dashboard', route: '/dashboard', sidebarIcon: true }],
-    environments: { alpha: { baseUrl: 'http://localhost:3000', seed: false } },
-    portals: [], breakpoints: [], integrations: [], workers: [], workflows: [],
-    accuracy: { enabled: false, decimalPrecision: 2, currencySymbol: '$', timezone: 'UTC' },
-    tenancy: { enabled: false, isolationField: 'firmId', testFirms: [] },
-    costBudget: { maxPerRun: 100, maxPerAgent: 10, alertThreshold: 0.8, onExceeded: 'abort' },
-    agentClassification: { blocking: [], advisory: [] },
-    thresholds: { unitCoverage: { lines: 80, functions: 80, branches: 80, statements: 80 }, lighthouse: { accessibility: 90, performance: 90, bestPractices: 90, seo: 90 }, apiResponseTime: 2000, bundleSizeLimit: 500000, maxConsoleErrors: 0 },
-    disabledAgents: [], disabledAgentSet: new Set<number>(),
-    ...overrides,
-  };
-}
-
-const fetchMock = vi.fn().mockResolvedValue({ ok: true, status: 200 });
-vi.stubGlobal('fetch', fetchMock);
-
-vi.mock('../../helpers/navigation', () => ({
-  login: vi.fn().mockResolvedValue(undefined),
-  waitForSectionLoad: vi.fn().mockResolvedValue(undefined),
-  navigateToSection: vi.fn().mockResolvedValue(undefined),
-  switchPortal: vi.fn().mockResolvedValue(undefined),
-}));
-
-const existsSyncMock = vi.fn();
-const readFileSyncMock = vi.fn();
-
-vi.mock('node:fs', () => ({
-  existsSync: (...args: unknown[]) => existsSyncMock(...args),
-  readFileSync: (...args: unknown[]) => readFileSyncMock(...args),
-}));
-
-const { EnvConfigValidatorAgent } = await import('../62-env-config-validator');
-
-function createAgent(config: ValidatedConfig = makeConfig(), phase: Phase = 'beta') {
-  return new EnvConfigValidatorAgent(config, phase, '/tmp/test-run');
-}
-
-describe('EnvConfigValidatorAgent', () => {
-  beforeEach(() => {
-    existsSyncMock.mockReset();
-    readFileSyncMock.mockReset();
-  });
-
-  it('has agentId 62 and correct name', () => {
-    const agent = createAgent();
-    expect(agent.agentId).toBe(62);
-    expect(agent.agentName).toBe('Env Config Validator');
-  });
-
-  it('reports no env files when none found', async () => {
-    existsSyncMock.mockReturnValue(false);
-    const agent = createAgent();
-    const result = await agent.run();
-    const finding = result.findings.find(f => f.id.includes('no-env-files'));
-    expect(finding).toBeDefined();
-  });
-
-  it('reports missing env var when defined in example but not env', async () => {
-    existsSyncMock.mockReturnValue(true);
-    readFileSyncMock.mockImplementation((p: string) => {
-      if (p.includes('.env.example')) return 'DB_HOST=localhost\nDB_PORT=5432\nAPI_KEY=secret';
-      return 'DB_HOST=localhost';
-    });
-    const agent = createAgent();
-    const result = await agent.run();
-    const finding = result.findings.find(f => f.id.includes('missing-env-var'));
-    expect(finding).toBeDefined();
-  });
-
-  it('reports invalid URL format', async () => {
-    existsSyncMock.mockReturnValue(true);
-    readFileSyncMock.mockImplementation((p: string) => {
-      if (p.includes('.env.example')) return 'API_URL=url';
-      return 'API_URL=not-a-url';
-    });
-    const agent = createAgent();
-    const result = await agent.run();
-    const finding = result.findings.find(f => f.id.includes('invalid-url'));
-    expect(finding).toBeDefined();
-  });
-
-  it('reports invalid port format', async () => {
-    existsSyncMock.mockReturnValue(true);
-    readFileSyncMock.mockImplementation((p: string) => {
-      if (p.includes('.env.example')) return 'DB_PORT=5432';
-      return 'DB_PORT=abc';
-    });
-    const agent = createAgent();
-    const result = await agent.run();
-    const finding = result.findings.find(f => f.id.includes('invalid-port'));
-    expect(finding).toBeDefined();
-  });
-
-  it('reports placeholder values', async () => {
-    existsSyncMock.mockReturnValue(true);
-    readFileSyncMock.mockImplementation((p: string) => {
-      if (p.includes('.env.example')) return 'SECRET=change';
-      return 'SECRET=your-secret-here';
-    });
-    const agent = createAgent();
-    const result = await agent.run();
-    const finding = result.findings.find(f => f.id.includes('placeholder'));
-    expect(finding).toBeDefined();
-  });
-
-  it('no findings when env matches example', async () => {
-    existsSyncMock.mockReturnValue(true);
-    readFileSyncMock.mockImplementation((p: string) => {
-      if (p.includes('.env.example')) return 'DB_HOST=\nDB_PORT=';
-      return 'DB_HOST=localhost\nDB_PORT=5432';
-    });
-    const agent = createAgent();
-    const result = await agent.run();
-    const missing = result.findings.find(f => f.id.includes('missing-env-var'));
-    expect(missing).toBeUndefined();
-  });
-
-  it('handles only .env existing (no example)', async () => {
-    existsSyncMock.mockImplementation((p: string) => !p.includes('.env.example'));
-    readFileSyncMock.mockReturnValue('DB_HOST=localhost');
-    const agent = createAgent();
-    const result = await agent.run();
-    expect(result.status).toBeDefined();
-  });
-
-  it('handles only .env.example existing', async () => {
-    existsSyncMock.mockImplementation((p: string) => p.includes('.env.example'));
-    readFileSyncMock.mockReturnValue('DB_HOST=localhost');
-    const agent = createAgent();
-    const result = await agent.run();
-    expect(result.status).toBeDefined();
-  });
-
-  it('skips comments and empty lines', async () => {
-    existsSyncMock.mockReturnValue(true);
-    readFileSyncMock.mockImplementation((p: string) => {
-      if (p.includes('.env.example')) return '# Comment\n\nDB_HOST=localhost';
-      return '# Comment\n\nDB_HOST=localhost';
-    });
-    const agent = createAgent();
-    const result = await agent.run();
-    const missing = result.findings.find(f => f.id.includes('missing-env-var'));
-    expect(missing).toBeUndefined();
-  });
-
-  it('valid URL passes validation', async () => {
-    existsSyncMock.mockReturnValue(true);
-    readFileSyncMock.mockImplementation((p: string) => {
-      if (p.includes('.env.example')) return 'API_URL=url';
-      return 'API_URL=https://api.example.com';
-    });
-    const agent = createAgent();
-    const result = await agent.run();
-    const finding = result.findings.find(f => f.id.includes('invalid-url'));
-    expect(finding).toBeUndefined();
-  });
-});