@avi770/testteam 2.0.0 → 3.2.0

package/dist/agents/118-insecure-crypto-auditor.js

@@ -0,0 +1,232 @@
+/**
+ * Insecure Crypto Auditor — static scan for broken/weak cryptography and
+ * insecure randomness. These are classic, high-signal real bugs that no other
+ * static agent (#87–117) catches.
+ *
+ * Flagged:
+ *   - 118-weak-hash          medium   crypto.createHash('md5'|'sha1') — broken
+ *                                      for signatures/passwords (collisions).
+ *   - 118-weak-hmac          medium   createHmac('md5'|'sha1', …)
+ *   - 118-deprecated-cipher  high     createCipher / createDecipher — no IV,
+ *                                      deprecated, insecure (use createCipheriv).
+ *   - 118-weak-cipher        high     DES / RC4 / ECB-mode cipher algorithms.
+ *   - 118-insecure-random    high     Math.random() used in a security context
+ *                                      (token / secret / password / nonce / …)
+ *                                      — not cryptographically secure; use
+ *                                      crypto.randomBytes / randomUUID.
+ *   - 118-clean / 118-summary  info
+ *
+ * Persists `evidence/insecure-crypto-audit.json`. Read-only, parallel-safe,
+ * static analysis only.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { BaseAgent } from './base-agent.js';
+import { maskNonCode, isTestPath } from './lib/source-scan.js';
+const SRC_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
+const SKIP_DIRS = new Set([
+    'node_modules', '.git', 'dist', 'build', '.next', '.nuxt', 'coverage', 'reports', 'baselines', 'evidence',
+]);
+/** Security-sensitive names that make a `Math.random()` nearby a real risk. */
+const SECURITY_CONTEXT_RE = /\b(?:token|secret|password|passwd|pwd|api[_-]?key|apikey|access[_-]?key|nonce|salt|otp|session[_-]?id|sessionid|csrf|xsrf|reset[_-]?(?:token|code)|verif|uuid|guid|random[_-]?(?:id|key)|auth[_-]?(?:token|code))\b/i;
+function walk(dir, results = []) {
+    if (!fs.existsSync(dir))
+        return results;
+    let entries;
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return results;
+    }
+    for (const entry of entries) {
+        if (SKIP_DIRS.has(entry.name))
+            continue;
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            walk(full, results);
+        }
+        else if (entry.isFile() && SRC_EXTENSIONS.has(path.extname(entry.name))) {
+            results.push(full);
+        }
+    }
+    return results;
+}
+function relativise(absPath, root) {
+    return path.relative(root, absPath).split(path.sep).join('/');
+}
+function lineOf(content, index) {
+    return content.slice(0, index).split('\n').length;
+}
+function snippetOf(content, index) {
+    const start = content.lastIndexOf('\n', index) + 1;
+    let end = content.indexOf('\n', index);
+    if (end === -1)
+        end = content.length;
+    return content.slice(start, end).trim().slice(0, 160);
+}
+/** Scan a file for weak-crypto / insecure-randomness sinks. */
+export function scanInsecureCrypto(content) {
+    const hits = [];
+    const seen = new Set();
+    // Match against code only — algorithm names live inside string literals, so
+    // keep strings (the signal `'md5'` is in one); only comments are blanked.
+    const masked = maskNonCode(content, { maskStrings: false });
+    const record = (kind, idx, detail) => {
+        const line = lineOf(content, idx);
+        const key = `${kind}:${line}:${detail}`;
+        if (seen.has(key))
+            return;
+        seen.add(key);
+        hits.push({ kind, line, detail, snippet: snippetOf(content, idx) });
+    };
+    let m;
+    // Weak hash / HMAC: createHash('md5'|'sha1') / createHmac('md5'|'sha1', …)
+    const hashRe = /\bcreate(Hash|Hmac)\s*\(\s*['"`](md5|sha1)['"`]/gi;
+    while ((m = hashRe.exec(masked)) !== null) {
+        const kind = /hmac/i.test(m[1]) ? 'weak-hmac' : 'weak-hash';
+        record(kind, m.index, m[2].toLowerCase());
+    }
+    // Deprecated createCipher / createDecipher (no IV).
+    const depRe = /\bcreate(?:De)?cipher\s*\(/gi;
+    while ((m = depRe.exec(masked)) !== null) {
+        // createCipheriv / createDecipheriv are the SAFE forms — exclude.
+        if (/iv\s*\($/i.test(m[0]) || /createCipheriv|createDecipheriv/i.test(masked.slice(m.index, m.index + 18)))
+            continue;
+        record('deprecated-cipher', m.index, m[0].replace(/\s*\($/, '()'));
+    }
+    // Weak cipher algorithms: DES / 3DES(des-ede) / RC4 / any ECB mode.
+    const weakCipherRe = /['"`]((?:des|des-ede|des-ede3|rc4|rc2)\b[^'"`]*|[^'"`]*-ecb(?:-[^'"`]*)?)['"`]/gi;
+    while ((m = weakCipherRe.exec(masked)) !== null) {
+        record('weak-cipher', m.index, m[1].toLowerCase());
+    }
+    // Insecure randomness: Math.random() in a security context (same statement).
+    const randRe = /\bMath\s*\.\s*random\s*\(\s*\)/g;
+    while ((m = randRe.exec(masked)) !== null) {
+        // Look at the enclosing statement (from the previous `;`/`{`/newline to here).
+        const stmtStart = Math.max(masked.lastIndexOf('\n', m.index), masked.lastIndexOf(';', m.index), masked.lastIndexOf('{', m.index));
+        const context = masked.slice(stmtStart + 1, m.index + 40);
+        if (SECURITY_CONTEXT_RE.test(context)) {
+            record('insecure-random', m.index, 'Math.random()');
+        }
+    }
+    return hits;
+}
+const SEVERITY = {
+    'weak-hash': 'medium',
+    'weak-hmac': 'medium',
+    'deprecated-cipher': 'high',
+    'weak-cipher': 'high',
+    'insecure-random': 'high',
+};
+const MESSAGE = {
+    'weak-hash': (d) => `weak hash algorithm "${d}" — MD5/SHA-1 are broken (practical collisions). Unsafe for signatures, password hashing, or integrity. Use SHA-256+ (or bcrypt/scrypt/argon2 for passwords).`,
+    'weak-hmac': (d) => `HMAC with weak digest "${d}" — prefer SHA-256+. MD5/SHA-1 HMACs are deprecated.`,
+    'deprecated-cipher': () => `createCipher/createDecipher is deprecated and insecure — it derives a key with no IV (predictable). Use createCipheriv/createDecipheriv with a random IV.`,
+    'weak-cipher': (d) => `weak cipher "${d}" — DES/3DES/RC4 and any ECB mode are broken or leak structure. Use AES-256-GCM (or another authenticated cipher).`,
+    'insecure-random': () => `Math.random() used in a security context — it is NOT cryptographically secure and is predictable. Use crypto.randomBytes() / crypto.randomUUID() / crypto.getRandomValues() for tokens, secrets, IDs, salts, etc.`,
+};
+export class InsecureCryptoAuditorAgent extends BaseAgent {
+    agentId = 118;
+    agentName = 'Insecure Crypto Auditor';
+    async preFlight() {
+        const root = this.config.projectRoot ?? process.cwd();
+        if (!fs.existsSync(root)) {
+            throw new Error(`projectRoot does not exist: ${root}`);
+        }
+    }
+    async execute() {
+        const findings = [];
+        const projectRoot = this.config.projectRoot ?? process.cwd();
+        const sourceFiles = new Set();
+        const mapPath = path.join(this.runDir, 'evidence', 'connection-map.json');
+        try {
+            const map = JSON.parse(fs.readFileSync(mapPath, 'utf-8'));
+            for (const f of map.files) {
+                if (!f.isTest)
+                    sourceFiles.add(path.join(projectRoot, f.path));
+            }
+        }
+        catch {
+            for (const f of walk(projectRoot))
+                sourceFiles.add(f);
+        }
+        const allHits = [];
+        let filesScanned = 0;
+        for (const file of sourceFiles) {
+            if (isTestPath(file, projectRoot))
+                continue;
+            let content;
+            try {
+                content = fs.readFileSync(file, 'utf-8');
+            }
+            catch {
+                continue;
+            }
+            filesScanned++;
+            const rel = relativise(file, projectRoot);
+            for (const hit of scanInsecureCrypto(content)) {
+                allHits.push({ ...hit, file: rel });
+            }
+        }
+        if (allHits.length === 0) {
+            findings.push({
+                id: `${this.agentId}-clean`,
+                type: 'infra-issue',
+                severity: 'info',
+                agentId: this.agentId,
+                module: 'insecure-crypto-auditor',
+                description: `Scanned ${filesScanned} non-test file(s) — no weak hashes/ciphers or insecure randomness found.`,
+            });
+            this.persistAudit(projectRoot, filesScanned, allHits);
+            return findings;
+        }
+        for (const hit of allHits.slice(0, 100)) {
+            const slug = `${hit.file.replace(/[^\w]/g, '_')}-${hit.line}`;
+            findings.push({
+                id: `${this.agentId}-${hit.kind}-${slug}`,
+                type: 'code-bug-security',
+                severity: SEVERITY[hit.kind],
+                agentId: this.agentId,
+                module: 'insecure-crypto-auditor',
+                description: `${MESSAGE[hit.kind](hit.detail)} (${hit.file}:${hit.line}) \`${hit.snippet}\``,
+                file: hit.file,
+                line: hit.line,
+            });
+        }
+        this.persistAudit(projectRoot, filesScanned, allHits);
+        const count = (k) => allHits.filter((h) => h.kind === k).length;
+        findings.push({
+            id: `${this.agentId}-summary`,
+            type: 'infra-issue',
+            severity: 'info',
+            agentId: this.agentId,
+            module: 'insecure-crypto-auditor',
+            description: `Insecure-crypto audit: ${count('weak-hash') + count('weak-hmac')} weak hash/hmac, ${count('deprecated-cipher')} deprecated cipher, ${count('weak-cipher')} weak cipher, ${count('insecure-random')} insecure random, across ${filesScanned} file(s).`,
+        });
+        return findings;
+    }
+    persistAudit(projectRoot, filesScanned, hits) {
+        const audit = {
+            version: 1,
+            generatedAt: new Date().toISOString(),
+            projectRoot,
+            filesScanned,
+            hits,
+        };
+        try {
+            const evidenceDir = path.join(this.runDir, 'evidence');
+            fs.mkdirSync(evidenceDir, { recursive: true });
+            fs.writeFileSync(path.join(evidenceDir, 'insecure-crypto-audit.json'), JSON.stringify(audit, null, 2), 'utf-8');
+            this.addEvidence({
+                type: 'report',
+                path: 'evidence/insecure-crypto-audit.json',
+                description: `Insecure-crypto audit: ${hits.length} finding(s) across ${filesScanned} file(s)`,
+            });
+        }
+        catch {
+            // non-fatal
+        }
+    }
+}
+//# sourceMappingURL=118-insecure-crypto-auditor.js.map

package/dist/agents/118-insecure-crypto-auditor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"118-insecure-crypto-auditor.js","sourceRoot":"","sources":["../../agents/118-insecure-crypto-auditor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE5D,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACpG,MAAM,SAAS,GAAwB,IAAI,GAAG,CAAC;IAC7C,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU;CAC1G,CAAC,CAAC;AAoBH,+EAA+E;AAC/E,MAAM,mBAAmB,GACvB,sNAAsN,CAAC;AAEzN,SAAS,IAAI,CAAC,GAAW,EAAE,UAAoB,EAAE;IAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACxC,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACtB,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC1E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,IAAY;IAC/C,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,MAAM,CAAC,OAAe,EAAE,KAAa;IAC5C,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AACpD,CAAC;AAED,SAAS,SAAS,CAAC,OAAe,EAAE,KAAa;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IACrC,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,IAAI,GAAmC,EAAE,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,4EAA4E;IAC5E,0EAA0E;IAC1E,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IAE5D,MAAM,MAAM,GAAG,CAAC,IAAgB,EAAE,GAAW,EAAE,MAAc,EAAQ,EAAE;QACrE,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;QACxC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO;QAC1B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC,CAAC;IAEF,IAAI,CAAyB,CAAC;IAE9B,2EAA2E;IAC3E,MAAM,MAAM,GAAG,mDAAmD,CAAC;IACnE,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAe,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC;QACxE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,oDAAoD;IACpD,MAAM,KAAK,GAAG,8BAA8B,CAAC;IAC7C,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACzC,kEAAkE;QAClE,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,kCAAkC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;YAAE,SAAS;QACrH,MAAM,CAAC,mBAAmB,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,oEAAoE;IACpE,MAAM,YAAY,GAAG,kFAAkF,CAAC;IACxG,OAAO,CAAC,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,6EAA6E;IAC7E,MAAM,MAAM,GAAG,iCAAiC,CAAC;IACjD,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1C,+EAA+E;QAC/E,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CACxB,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EACjC,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAChC,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CACjC,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;QAC1D,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACtC,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,QAAQ,GAA4C;IACxD,WAAW,EAAE,QAAQ;IACrB,WAAW,EAAE,QAAQ;IACrB,mBAAmB,EAAE,MAAM;IAC3B,aAAa,EAAE,MAAM;IACrB,iBAAiB,EAAE,MAAM;CAC1B,CAAC;AAEF,MAAM,OAAO,GAA8C;IACzD,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAwB,CAAC,+JAA+J;IAC5M,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,0BAA0B,CAAC,sDAAsD;IACrG,mBAAmB,EAAE,GAAG,EAAE,CAAC,2JAA2J;IACtL,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,oHAAoH;IAC3J,iBAAiB,EAAE,GAAG,EAAE,CAAC,mNAAmN;CAC7O,CAAC;AAEF,MAAM,OAAO,0BAA2B,SAAQ,SAAS;IAC9C,OAAO,GAAG,GAAG,CAAC;IACd,SAAS,GAAG,yBAAyB,CAAC;IAErC,KAAK,CAAC,SAAS;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAE7D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC;QAC1E,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAkB,CAAC;YAC3E,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC1B,IAAI,CAAC,CAAC,CAAC,MAAM;oBAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC;gBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,OAAO,GAAgB,EAAE,CAAC;QAChC,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,IAAI,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC;gBAAE,SAAS;YAC5C,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,YAAY,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC1C,KAAK,MAAM,GAAG,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9C,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,QAAQ;gBAC3B,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,yBAAyB;gBACjC,WAAW,EAAE,WAAW,YAAY,0EAA0E;aAC/G,CAAC,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YACtD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9D,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE;gBACzC,IAAI,EAAE,mBAAmB;gBACzB,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;gBAC5B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,yBAAyB;gBACjC,WAAW,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,OAAO,IAAI;gBAC5F,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,IAAI,EAAE,GAAG,CAAC,IAAI;aACf,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QAEtD,MAAM,KAAK,GAAG,CAAC,CAAa,EAAU,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACpF,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU;YAC7B,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,yBAAyB;YACjC,WAAW,EAAE,0BAA0B,KAAK,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,oBAAoB,KAAK,CAAC,mBAAmB,CAAC,uBAAuB,KAAK,CAAC,aAAa,CAAC,iBAAiB,KAAK,CAAC,iBAAiB,CAAC,4BAA4B,YAAY,WAAW;SACpQ,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,YAAY,CAAC,WAAmB,EAAE,YAAoB,EAAE,IAAiB;QAC/E,MAAM,KAAK,GAAwB;YACjC,OAAO,EAAE,CAAC;YACV,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,WAAW;YACX,YAAY;YACZ,IAAI;SACL,CAAC;QACF,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACvD,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,4BAA4B,CAAC,EACpD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAC9B,OAAO,CACR,CAAC;YACF,IAAI,CAAC,WAAW,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,qCAAqC;gBAC3C,WAAW,EAAE,0BAA0B,IAAI,CAAC,MAAM,sBAAsB,YAAY,UAAU;aAC/F,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/agents/119-secrets-scanner.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Hardcoded Secrets Scanner (static, free tier) — finds real credentials
+ * committed as source literals. Complements #93 (which audits `.env*`) and the
+ * Pro #38 runtime secrets agent; this one runs in the free alpha static pass.
+ *
+ * Flagged:
+ *   - 119-provider-secret   critical  a high-confidence provider credential
+ *                                      (AWS AKIA…, GitHub ghp_…, Stripe sk_live_…,
+ *                                      Slack xox…, Google AIza…, OpenAI sk-…,
+ *                                      PEM PRIVATE KEY block).
+ *   - 119-generic-secret    medium    a long, high-entropy literal assigned to a
+ *                                      secret-named variable (token/secret/…).
+ *   - 119-clean / 119-summary  info
+ *
+ * Placeholder / env-indirected / templated values are excluded. Persists
+ * `evidence/secrets-audit.json`. Read-only, parallel-safe, static only.
+ */
+import type { Finding } from '../core/types.js';
+import { BaseAgent } from './base-agent.js';
+export type SecretKind = 'provider-secret' | 'generic-secret';
+export interface SecretHit {
+    kind: SecretKind;
+    provider: string;
+    file: string;
+    line: number;
+    snippet: string;
+}
+export interface SecretsAudit {
+    version: 1;
+    generatedAt: string;
+    projectRoot: string;
+    filesScanned: number;
+    hits: SecretHit[];
+}
+/** Scan a file for hardcoded secrets. */
+export declare function scanSecrets(content: string): Array<Omit<SecretHit, 'file'>>;
+export declare class SecretsScannerStaticAgent extends BaseAgent {
+    readonly agentId = 119;
+    readonly agentName = "Hardcoded Secrets Scanner";
+    protected preFlight(): Promise<void>;
+    protected execute(): Promise<Finding[]>;
+    private persistAudit;
+}
+//# sourceMappingURL=119-secrets-scanner.d.ts.map

package/dist/agents/119-secrets-scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"119-secrets-scanner.d.ts","sourceRoot":"","sources":["../../agents/119-secrets-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AASzC,MAAM,MAAM,UAAU,GAAG,iBAAiB,GAAG,gBAAgB,CAAC;AAE9D,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,CAAC,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,SAAS,EAAE,CAAC;CACnB;AAkFD,yCAAyC;AACzC,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAgC3E;AAED,qBAAa,yBAA0B,SAAQ,SAAS;IACtD,QAAQ,CAAC,OAAO,OAAO;IACvB,QAAQ,CAAC,SAAS,+BAA+B;cAEjC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cAO1B,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IA2E7C,OAAO,CAAC,YAAY;CAyBrB"}

package/dist/agents/119-secrets-scanner.js

@@ -0,0 +1,242 @@
+/**
+ * Hardcoded Secrets Scanner (static, free tier) — finds real credentials
+ * committed as source literals. Complements #93 (which audits `.env*`) and the
+ * Pro #38 runtime secrets agent; this one runs in the free alpha static pass.
+ *
+ * Flagged:
+ *   - 119-provider-secret   critical  a high-confidence provider credential
+ *                                      (AWS AKIA…, GitHub ghp_…, Stripe sk_live_…,
+ *                                      Slack xox…, Google AIza…, OpenAI sk-…,
+ *                                      PEM PRIVATE KEY block).
+ *   - 119-generic-secret    medium    a long, high-entropy literal assigned to a
+ *                                      secret-named variable (token/secret/…).
+ *   - 119-clean / 119-summary  info
+ *
+ * Placeholder / env-indirected / templated values are excluded. Persists
+ * `evidence/secrets-audit.json`. Read-only, parallel-safe, static only.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { BaseAgent } from './base-agent.js';
+import { maskNonCode, isTestPath } from './lib/source-scan.js';
+const SRC_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
+const SKIP_DIRS = new Set([
+    'node_modules', '.git', 'dist', 'build', '.next', '.nuxt', 'coverage', 'reports', 'baselines', 'evidence',
+]);
+/** High-confidence provider credential patterns (very low false-positive rate). */
+const PROVIDER_PATTERNS = [
+    { provider: 'AWS access key', re: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g },
+    { provider: 'GitHub token', re: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/g },
+    { provider: 'Stripe secret key', re: /\b(?:sk|rk)_live_[A-Za-z0-9]{16,}\b/g },
+    { provider: 'Slack token', re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
+    { provider: 'Google API key', re: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+    { provider: 'OpenAI/Anthropic key', re: /\bsk-(?:ant-)?[A-Za-z0-9_-]{20,}\b/g },
+    { provider: 'private key (PEM)', re: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/g },
+    { provider: 'Google OAuth client secret', re: /\bGOCSPX-[A-Za-z0-9_-]{20,}\b/g },
+];
+/** Variable / key names whose value, if a long literal, is likely a real secret. */
+const SECRET_NAME_RE = /\b(?:secret|token|passwd|password|pwd|api[_-]?key|apikey|access[_-]?key|access[_-]?token|auth[_-]?token|client[_-]?secret|private[_-]?key|encryption[_-]?key|signing[_-]?key)\b/i;
+/** Obvious non-secret placeholder values. */
+const PLACEHOLDER_RE = /^(?:x{3,}|\.{3,}|changeme|change[_-]?me|placeholder|example|sample|dummy|test|todo|fixme|none|null|undefined|your[_-].*|my[_-].*|<.*>|\$\{.*\}|process\.env\..*|import\.meta\.env\..*|[a-z]+)$/i;
+function walk(dir, results = []) {
+    if (!fs.existsSync(dir))
+        return results;
+    let entries;
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return results;
+    }
+    for (const entry of entries) {
+        if (SKIP_DIRS.has(entry.name))
+            continue;
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            walk(full, results);
+        }
+        else if (entry.isFile() && SRC_EXTENSIONS.has(path.extname(entry.name))) {
+            results.push(full);
+        }
+    }
+    return results;
+}
+function relativise(absPath, root) {
+    return path.relative(root, absPath).split(path.sep).join('/');
+}
+function lineOf(content, index) {
+    return content.slice(0, index).split('\n').length;
+}
+function snippetOf(content, index) {
+    const start = content.lastIndexOf('\n', index) + 1;
+    let end = content.indexOf('\n', index);
+    if (end === -1)
+        end = content.length;
+    // Redact long secret-ish runs in the snippet so we don't echo the credential.
+    return content.slice(start, end).trim().replace(/[A-Za-z0-9_-]{12,}/g, (s) => `${s.slice(0, 4)}…[redacted]`).slice(0, 160);
+}
+/** Shannon entropy (bits/char) — used to gate the generic secret heuristic. */
+function entropy(s) {
+    const freq = {};
+    for (const ch of s)
+        freq[ch] = (freq[ch] ?? 0) + 1;
+    let h = 0;
+    for (const ch in freq) {
+        const p = freq[ch] / s.length;
+        h -= p * Math.log2(p);
+    }
+    return h;
+}
+/** A literal that looks like a real high-entropy secret (not a word/placeholder). */
+function looksHighEntropy(value) {
+    if (value.length < 20)
+        return false;
+    if (PLACEHOLDER_RE.test(value))
+        return false;
+    if (/\s/.test(value))
+        return false; // secrets have no spaces
+    if (/^https?:\/\//i.test(value))
+        return false; // a URL, not a secret
+    const hasLetter = /[A-Za-z]/.test(value);
+    const hasDigit = /[0-9]/.test(value);
+    // Require a mixed charset and real randomness (entropy ≥ 3.5 bits/char).
+    return hasLetter && hasDigit && entropy(value) >= 3.5;
+}
+/** Scan a file for hardcoded secrets. */
+export function scanSecrets(content) {
+    const hits = [];
+    const seen = new Set();
+    // Keep strings (the secret lives in one); only comments are blanked.
+    const masked = maskNonCode(content, { maskStrings: false });
+    const record = (kind, provider, idx) => {
+        const line = lineOf(content, idx);
+        const key = `${line}:${provider}`;
+        if (seen.has(key))
+            return;
+        seen.add(key);
+        hits.push({ kind, provider, line, snippet: snippetOf(content, idx) });
+    };
+    let m;
+    for (const { provider, re } of PROVIDER_PATTERNS) {
+        const r = new RegExp(re.source, re.flags);
+        while ((m = r.exec(masked)) !== null)
+            record('provider-secret', provider, m.index);
+    }
+    // Generic: secretName = "<long high-entropy literal>" (or key: "value").
+    const assignRe = /([A-Za-z_$][\w$]*)\s*[:=]\s*['"`]([^'"`\n]{20,})['"`]/g;
+    while ((m = assignRe.exec(masked)) !== null) {
+        // Normalise camelCase + separators to spaces so `apiSecret`/`access_token`
+        // match the \b-anchored keywords (but `secretary` still doesn't).
+        if (!SECRET_NAME_RE.test(m[1].replace(/([a-z0-9])([A-Z])/g, '$1 $2').replace(/[_-]/g, ' ')))
+            continue;
+        if (!looksHighEntropy(m[2]))
+            continue;
+        record('generic-secret', `hardcoded ${m[1]}`, m.index);
+    }
+    return hits;
+}
+export class SecretsScannerStaticAgent extends BaseAgent {
+    agentId = 119;
+    agentName = 'Hardcoded Secrets Scanner';
+    async preFlight() {
+        const root = this.config.projectRoot ?? process.cwd();
+        if (!fs.existsSync(root)) {
+            throw new Error(`projectRoot does not exist: ${root}`);
+        }
+    }
+    async execute() {
+        const findings = [];
+        const projectRoot = this.config.projectRoot ?? process.cwd();
+        const sourceFiles = new Set();
+        const mapPath = path.join(this.runDir, 'evidence', 'connection-map.json');
+        try {
+            const map = JSON.parse(fs.readFileSync(mapPath, 'utf-8'));
+            for (const f of map.files) {
+                if (!f.isTest)
+                    sourceFiles.add(path.join(projectRoot, f.path));
+            }
+        }
+        catch {
+            for (const f of walk(projectRoot))
+                sourceFiles.add(f);
+        }
+        const allHits = [];
+        let filesScanned = 0;
+        for (const file of sourceFiles) {
+            if (isTestPath(file, projectRoot))
+                continue;
+            let content;
+            try {
+                content = fs.readFileSync(file, 'utf-8');
+            }
+            catch {
+                continue;
+            }
+            filesScanned++;
+            const rel = relativise(file, projectRoot);
+            for (const hit of scanSecrets(content)) {
+                allHits.push({ ...hit, file: rel });
+            }
+        }
+        if (allHits.length === 0) {
+            findings.push({
+                id: `${this.agentId}-clean`,
+                type: 'infra-issue',
+                severity: 'info',
+                agentId: this.agentId,
+                module: 'secrets-scanner',
+                description: `Scanned ${filesScanned} non-test file(s) — no hardcoded credentials found.`,
+            });
+            this.persistAudit(projectRoot, filesScanned, allHits);
+            return findings;
+        }
+        for (const hit of allHits.slice(0, 100)) {
+            const slug = `${hit.file.replace(/[^\w]/g, '_')}-${hit.line}`;
+            findings.push({
+                id: `${this.agentId}-${hit.kind}-${slug}`,
+                type: 'code-bug-security',
+                severity: hit.kind === 'provider-secret' ? 'critical' : 'medium',
+                agentId: this.agentId,
+                module: 'secrets-scanner',
+                description: hit.kind === 'provider-secret'
+                    ? `Hardcoded ${hit.provider} committed in source at ${hit.file}:${hit.line}. Rotate it immediately (it is now in git history) and load it from an environment variable / secret manager instead. \`${hit.snippet}\``
+                    : `Likely hardcoded secret (${hit.provider}) at ${hit.file}:${hit.line} — a long high-entropy literal assigned to a secret-named field. Move it to an env var / secret manager. \`${hit.snippet}\``,
+                file: hit.file,
+                line: hit.line,
+            });
+        }
+        this.persistAudit(projectRoot, filesScanned, allHits);
+        findings.push({
+            id: `${this.agentId}-summary`,
+            type: 'infra-issue',
+            severity: 'info',
+            agentId: this.agentId,
+            module: 'secrets-scanner',
+            description: `Secrets audit: ${allHits.filter((h) => h.kind === 'provider-secret').length} provider credential(s), ${allHits.filter((h) => h.kind === 'generic-secret').length} generic, across ${filesScanned} file(s).`,
+        });
+        return findings;
+    }
+    persistAudit(projectRoot, filesScanned, hits) {
+        const audit = {
+            version: 1,
+            generatedAt: new Date().toISOString(),
+            projectRoot,
+            filesScanned,
+            hits,
+        };
+        try {
+            const evidenceDir = path.join(this.runDir, 'evidence');
+            fs.mkdirSync(evidenceDir, { recursive: true });
+            fs.writeFileSync(path.join(evidenceDir, 'secrets-audit.json'), JSON.stringify(audit, null, 2), 'utf-8');
+            this.addEvidence({
+                type: 'report',
+                path: 'evidence/secrets-audit.json',
+                description: `Secrets audit: ${hits.length} finding(s) across ${filesScanned} file(s)`,
+            });
+        }
+        catch {
+            // non-fatal
+        }
+    }
+}
+//# sourceMappingURL=119-secrets-scanner.js.map

package/dist/agents/119-secrets-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"119-secrets-scanner.js","sourceRoot":"","sources":["../../agents/119-secrets-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE5D,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACpG,MAAM,SAAS,GAAwB,IAAI,GAAG,CAAC;IAC7C,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU;CAC1G,CAAC,CAAC;AAoBH,mFAAmF;AACnF,MAAM,iBAAiB,GAAoD;IACzE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,EAAE,EAAE,gCAAgC,EAAE;IACpE,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,EAAE,iCAAiC,EAAE;IACnE,EAAE,QAAQ,EAAE,mBAAmB,EAAE,EAAE,EAAE,sCAAsC,EAAE;IAC7E,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,EAAE,mCAAmC,EAAE;IACpE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,EAAE,EAAE,4BAA4B,EAAE;IAChE,EAAE,QAAQ,EAAE,sBAAsB,EAAE,EAAE,EAAE,qCAAqC,EAAE;IAC/E,EAAE,QAAQ,EAAE,mBAAmB,EAAE,EAAE,EAAE,8DAA8D,EAAE;IACrG,EAAE,QAAQ,EAAE,4BAA4B,EAAE,EAAE,EAAE,gCAAgC,EAAE;CACjF,CAAC;AAEF,oFAAoF;AACpF,MAAM,cAAc,GAClB,kLAAkL,CAAC;AAErL,6CAA6C;AAC7C,MAAM,cAAc,GAClB,iMAAiM,CAAC;AAEpM,SAAS,IAAI,CAAC,GAAW,EAAE,UAAoB,EAAE;IAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACxC,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACtB,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC1E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,IAAY;IAC/C,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,MAAM,CAAC,OAAe,EAAE,KAAa;IAC5C,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AACpD,CAAC;AAED,SAAS,SAAS,CAAC,OAAe,EAAE,KAAa;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IACrC,8EAA8E;IAC9E,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7H,CAAC;AAED,+EAA+E;AAC/E,SAAS,OAAO,CAAC,CAAS;IACxB,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,KAAK,MAAM,EAAE,IAAI,CAAC;QAAE,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QAC9B,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,qFAAqF;AACrF,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,yBAAyB;IAC7D,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,sBAAsB;IACrE,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,yEAAyE;IACzE,OAAO,SAAS,IAAI,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC;AACxD,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,MAAM,IAAI,GAAmC,EAAE,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,qEAAqE;IACrE,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IAE5D,MAAM,MAAM,GAAG,CAAC,IAAgB,EAAE,QAAgB,EAAE,GAAW,EAAQ,EAAE;QACvE,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO;QAC1B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC,CAAC;IAEF,IAAI,CAAyB,CAAC;IAE9B,KAAK,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,iBAAiB,EAAE,CAAC;QACjD,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QAC1C,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI;YAAE,MAAM,CAAC,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IACrF,CAAC;IAED,yEAAyE;IACzE,MAAM,QAAQ,GAAG,wDAAwD,CAAC;IAC1E,OAAO,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5C,2EAA2E;QAC3E,kEAAkE;QAClE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAAE,SAAS;QACtG,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QACtC,MAAM,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,yBAA0B,SAAQ,SAAS;IAC7C,OAAO,GAAG,GAAG,CAAC;IACd,SAAS,GAAG,2BAA2B,CAAC;IAEvC,KAAK,CAAC,SAAS;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAE7D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC;QAC1E,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAkB,CAAC;YAC3E,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC1B,IAAI,CAAC,CAAC,CAAC,MAAM;oBAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC;gBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,OAAO,GAAgB,EAAE,CAAC;QAChC,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,IAAI,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC;gBAAE,SAAS;YAC5C,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,YAAY,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC1C,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,QAAQ;gBAC3B,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,iBAAiB;gBACzB,WAAW,EAAE,WAAW,YAAY,qDAAqD;aAC1F,CAAC,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YACtD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9D,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE;gBACzC,IAAI,EAAE,mBAAmB;gBACzB,QAAQ,EAAE,GAAG,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;gBAChE,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,iBAAiB;gBACzB,WAAW,EAAE,GAAG,CAAC,IAAI,KAAK,iBAAiB;oBACzC,CAAC,CAAC,aAAa,GAAG,CAAC,QAAQ,2BAA2B,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,2HAA2H,GAAG,CAAC,OAAO,IAAI;oBACpN,CAAC,CAAC,4BAA4B,GAAG,CAAC,QAAQ,QAAQ,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,8GAA8G,GAAG,CAAC,OAAO,IAAI;gBACrM,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,IAAI,EAAE,GAAG,CAAC,IAAI;aACf,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QAEtD,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU;YAC7B,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,iBAAiB;YACzB,WAAW,EAAE,kBAAkB,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC,MAAM,4BAA4B,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,MAAM,oBAAoB,YAAY,WAAW;SAC1N,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,YAAY,CAAC,WAAmB,EAAE,YAAoB,EAAE,IAAiB;QAC/E,MAAM,KAAK,GAAiB;YAC1B,OAAO,EAAE,CAAC;YACV,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,WAAW;YACX,YAAY;YACZ,IAAI;SACL,CAAC;QACF,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACvD,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,oBAAoB,CAAC,EAC5C,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAC9B,OAAO,CACR,CAAC;YACF,IAAI,CAAC,WAAW,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,6BAA6B;gBACnC,WAAW,EAAE,kBAAkB,IAAI,CAAC,MAAM,sBAAsB,YAAY,UAAU;aACvF,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/agents/12-ux-inspector.d.ts

@@ -1,5 +1,5 @@
-import type { Finding } from '../core/types';
-import { BaseAgent } from './base-agent';
+import type { Finding } from '../core/types.js';
+import { BaseAgent } from './base-agent.js';
 export declare class UxInspectorAgent extends BaseAgent {
     readonly agentId = 12;
     readonly agentName = "UX Inspector";

package/dist/agents/12-ux-inspector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"12-ux-inspector.d.ts","sourceRoot":"","sources":["../../agents/12-ux-inspector.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAiCzC,qBAAa,gBAAiB,SAAQ,SAAS;IAC7C,QAAQ,CAAC,OAAO,MAAM;IACtB,QAAQ,CAAC,SAAS,kBAAkB;cAEpB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cAkB1B,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YA6D/B,aAAa;YAqEb,uBAAuB;YAsBvB,4BAA4B;YA8D5B,gBAAgB;YAwDhB,mBAAmB;YA+DnB,kBAAkB;CAoDjC"}
+{"version":3,"file":"12-ux-inspector.d.ts","sourceRoot":"","sources":["../../agents/12-ux-inspector.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAkCzC,qBAAa,gBAAiB,SAAQ,SAAS;IAC7C,QAAQ,CAAC,OAAO,MAAM;IACtB,QAAQ,CAAC,SAAS,kBAAkB;cAEpB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cAkB1B,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YAgE/B,aAAa;YAqEb,uBAAuB;YAsBvB,4BAA4B;YA8D5B,gBAAgB;YAwDhB,mBAAmB;YA+DnB,kBAAkB;CAoDjC"}

package/dist/agents/12-ux-inspector.js

@@ -1,5 +1,6 @@
 import { stat, readdir } from 'node:fs/promises';
-import { BaseAgent } from './base-agent';
+import { BaseAgent } from './base-agent.js';
+import { launchOptions, startScreencast } from '../core/run-mode/index.js';
 async function fileExists(p) {
     try {
         await stat(p);
@@ -9,8 +10,8 @@ async function fileExists(p) {
         return false;
     }
 }
-import { login, navigateToSection } from '../helpers/navigation';
-import { captureScreenshot } from '../helpers/screenshot';
+import { login, navigateToSection } from '../helpers/navigation.js';
+import { captureScreenshot } from '../helpers/screenshot.js';
 /** Selectors that indicate an ErrorBoundary rendered in the application. */
 const ERROR_BOUNDARY_SELECTORS = [
     '[data-testid="error-boundary"]',
@@ -83,9 +84,11 @@ export class UxInspectorAgent extends BaseAgent {
         const { chromium } = await import('playwright');
         let browser = null;
         let page = null;
+        let screencast = null;
         try {
-            browser = await chromium.launch({ headless: true });
+            browser = await chromium.launch(launchOptions(this.runMode));
             page = await browser.newPage();
+            screencast = this.frames ? startScreencast(page, this.frames) : null;
             await login(page, credentials, loginUrl);
             for (const module of this.config.modules) {
                 const moduleFindings = await this.inspectModule(page, module.id);
@@ -93,6 +96,7 @@ export class UxInspectorAgent extends BaseAgent {
             }
         }
         finally {
+            screencast?.stop();
             if (page)
                 await page.close().catch(() => undefined);
             if (browser)