@avi770/testteam 3.0.0 → 3.2.0

package/agents/13-performance-profiler.ts

@@ -1,271 +0,0 @@
-import type { Browser, Page } from 'playwright';
-import type { Finding } from '../core/types';
-import { BaseAgent } from './base-agent';
-import { login, navigateToSection } from '../helpers/navigation';
-import { resolveEnvironment, isUrlReachable } from '../helpers/env-resolver';
-
-/** LCP threshold in milliseconds (Core Web Vitals "Good" boundary). */
-const LCP_THRESHOLD_MS = 2500;
-
-/** FCP threshold in milliseconds (Core Web Vitals "Good" boundary). */
-const FCP_THRESHOLD_MS = 1800;
-
-/** JS heap size threshold: 100 MB in bytes. */
-const HEAP_SIZE_THRESHOLD_BYTES = 100 * 1024 * 1024;
-
-interface NavigationEntry {
-  loadEventEnd: number;
-  startTime: number;
-}
-
-interface PaintEntry {
-  name: string;
-  startTime: number;
-}
-
-interface MemoryInfo {
-  usedJSHeapSize: number;
-}
-
-interface ExtendedPerformance extends Performance {
-  memory?: MemoryInfo;
-}
-
-export class PerformanceProfilerAgent extends BaseAgent {
-  readonly agentId = 13;
-  readonly agentName = 'Performance Profiler';
-  private baseUrl = '';
-
-  protected async preFlight(): Promise<void> {
-    const { env } = await resolveEnvironment(this.config, this.phase);
-    this.baseUrl = env.baseUrl;
-  }
-
-  protected async execute(): Promise<Finding[]> {
-    const findings: Finding[] = [];
-
-    const rawLoginUrl = this.config.auth.loginUrl ?? '/login';
-    const loginUrl = rawLoginUrl.startsWith('http') ? rawLoginUrl : `${this.baseUrl}${rawLoginUrl}`;
-    const credentials =
-      this.config.auth.credentials?.['admin'] ??
-      Object.values(this.config.auth.credentials ?? {})[0];
-
-    if (!credentials) {
-      findings.push({
-        id: '13-no-credentials',
-        type: 'infra-issue',
-        severity: 'critical',
-        agentId: this.agentId,
-        module: 'performance-profiler',
-        description: 'No credentials configured in auth.credentials — cannot log in',
-      });
-      return findings;
-    }
-
-    const { chromium } = await import('playwright');
-
-    let browser: Browser | null = null;
-    let page: Page | null = null;
-
-    try {
-      browser = await chromium.launch({ headless: true });
-      page = await browser.newPage();
-
-      await login(page, credentials, loginUrl);
-
-      for (const module of this.config.modules) {
-        const moduleFindings = await this.profileModule(page, module.id);
-        findings.push(...moduleFindings);
-      }
-
-      // Check memory after navigating all sections (Chromium only)
-      const memoryFindings = await this.checkMemoryUsage(page);
-      findings.push(...memoryFindings);
-
-      // Run Lighthouse if available
-      const lighthouseFindings = await this.runLighthouse(this.baseUrl);
-      findings.push(...lighthouseFindings);
-    } finally {
-      if (page) await page.close().catch(() => undefined);
-      if (browser) await browser.close().catch(() => undefined);
-    }
-
-    return findings;
-  }
-
-  private async profileModule(page: Page, moduleId: string): Promise<Finding[]> {
-    const findings: Finding[] = [];
-
-    try {
-      await navigateToSection(page, moduleId, this.config);
-    } catch (navErr) {
-      findings.push({
-        id: `13-nav-${moduleId}`,
-        type: 'infra-issue',
-        severity: 'high',
-        agentId: this.agentId,
-        module: moduleId,
-        description: `Navigation to module "${moduleId}" failed: ${navErr instanceof Error ? navErr.message : String(navErr)}`,
-      });
-      return findings;
-    }
-
-    // Measure navigation load time
-    const loadTimeMs = await page
-      .evaluate((): number => {
-        const entries = performance.getEntriesByType('navigation') as unknown as NavigationEntry[];
-        if (entries.length === 0) return 0;
-        const nav = entries[0];
-        return nav.loadEventEnd - nav.startTime;
-      })
-      .catch(() => 0);
-
-    this.addEvidence({
-      type: 'log',
-      path: `${this.runDir}/perf-${moduleId}.json`,
-      description: `Performance metrics for module "${moduleId}" — loadTime: ${loadTimeMs}ms`,
-    });
-
-    // Measure paint timings (FCP / LCP)
-    const paintEntriesRaw = await page
-      .evaluate((): PaintEntry[] => {
-        return performance.getEntriesByType('paint').map((e) => ({
-          name: e.name,
-          startTime: e.startTime,
-        }));
-      })
-      .catch(() => [] as PaintEntry[]);
-
-    const paintEntries: PaintEntry[] = Array.isArray(paintEntriesRaw) ? paintEntriesRaw : [];
-    const fcpEntry = paintEntries.find((e) => e.name === 'first-contentful-paint');
-    const fcpMs = fcpEntry?.startTime ?? 0;
-
-    // LCP is reported via PerformanceObserver; use largest-contentful-paint entries if present
-    const lcpMs = await page
-      .evaluate((): number => {
-        const entries = performance.getEntriesByType(
-          'largest-contentful-paint',
-        ) as Array<{ startTime: number }>;
-        if (entries.length === 0) return 0;
-        return entries[entries.length - 1].startTime;
-      })
-      .catch(() => 0);
-
-    if (fcpMs > FCP_THRESHOLD_MS) {
-      findings.push({
-        id: `13-fcp-${moduleId}`,
-        type: 'code-bug-logic',
-        severity: 'medium',
-        agentId: this.agentId,
-        module: moduleId,
-        description: `First Contentful Paint for module "${moduleId}" is ${fcpMs.toFixed(0)}ms (threshold: ${FCP_THRESHOLD_MS}ms)`,
-        suggestedFix:
-          'Reduce server response time, eliminate render-blocking resources, or defer non-critical scripts',
-      });
-    }
-
-    if (lcpMs > LCP_THRESHOLD_MS) {
-      findings.push({
-        id: `13-lcp-${moduleId}`,
-        type: 'code-bug-logic',
-        severity: 'high',
-        agentId: this.agentId,
-        module: moduleId,
-        description: `Largest Contentful Paint for module "${moduleId}" is ${lcpMs.toFixed(0)}ms (threshold: ${LCP_THRESHOLD_MS}ms)`,
-        suggestedFix:
-          'Optimise hero images, preload critical assets, or reduce Time To First Byte',
-      });
-    }
-
-    if (loadTimeMs > 0 && loadTimeMs > this.config.thresholds.apiResponseTime * 2) {
-      findings.push({
-        id: `13-load-time-${moduleId}`,
-        type: 'code-bug-logic',
-        severity: 'medium',
-        agentId: this.agentId,
-        module: moduleId,
-        description: `Page load time for module "${moduleId}" is ${loadTimeMs.toFixed(0)}ms (threshold: ${this.config.thresholds.apiResponseTime * 2}ms)`,
-        suggestedFix: 'Review waterfall of network requests and defer non-critical loading',
-      });
-    }
-
-    return findings;
-  }
-
-  private async checkMemoryUsage(page: Page): Promise<Finding[]> {
-    const findings: Finding[] = [];
-
-    try {
-      const usedHeap = await page
-        .evaluate((): number => {
-          const perf = performance as ExtendedPerformance;
-          return perf.memory?.usedJSHeapSize ?? 0;
-        })
-        .catch(() => 0);
-
-      if (usedHeap > HEAP_SIZE_THRESHOLD_BYTES) {
-        const usedMb = (usedHeap / 1024 / 1024).toFixed(1);
-        const thresholdMb = (HEAP_SIZE_THRESHOLD_BYTES / 1024 / 1024).toFixed(0);
-        findings.push({
-          id: '13-memory-heap',
-          type: 'code-bug-logic',
-          severity: 'high',
-          agentId: this.agentId,
-          module: 'memory',
-          description: `JS heap size after navigating all modules is ${usedMb}MB (threshold: ${thresholdMb}MB). Possible memory leak.`,
-          suggestedFix:
-            'Profile with Chrome DevTools Memory panel, check for event listener leaks and large retained objects',
-        });
-      }
-    } catch {
-      // memory API is Chromium-only; ignore on other browsers
-    }
-
-    return findings;
-  }
-
-  private async runLighthouse(baseUrl: string): Promise<Finding[]> {
-    const findings: Finding[] = [];
-
-    try {
-      // Dynamically import lighthouse — it is an optional peer dependency.
-      // Use a variable to prevent TypeScript from statically resolving the module.
-      const lighthouseModuleName = 'lighthouse';
-      const lighthouse = await import(/* webpackIgnore: true */ lighthouseModuleName).catch((): null => null) as { default?: (...args: unknown[]) => Promise<unknown> } | null;
-      if (!lighthouse?.default) return findings;
-
-      const run = lighthouse.default as (url: string, opts: Record<string, unknown>) => Promise<{ lhr: { categories: Record<string, { score: number | null }> } } | undefined>;
-
-      const result = await run(baseUrl, {
-        onlyCategories: ['performance'],
-        output: 'json',
-        logLevel: 'silent',
-      });
-
-      if (!result) return findings;
-
-      const perfScore = (result.lhr.categories['performance']?.score ?? null);
-      if (perfScore === null) return findings;
-
-      const perfPercent = Math.round(perfScore * 100);
-      const threshold = this.config.thresholds.lighthouse.performance;
-
-      if (perfPercent < threshold) {
-        findings.push({
-          id: '13-lighthouse-performance',
-          type: 'code-bug-logic',
-          severity: 'medium',
-          agentId: this.agentId,
-          module: 'lighthouse',
-          description: `Lighthouse performance score is ${perfPercent} (threshold: ${threshold})`,
-          suggestedFix:
-            'Address Lighthouse performance opportunities: reduce unused JavaScript, serve next-gen images, avoid large layout shifts',
-        });
-      }
-    } catch {
-      // Lighthouse not installed or audit failed — skip without failing
-    }
-
-    return findings;
-  }
-}

package/agents/14-data-integrity-auditor.ts

@@ -1,417 +0,0 @@
-import type { Finding } from '../core/types';
-import { BaseAgent } from './base-agent';
-import { ApiClient } from '../helpers/api-client';
-import { resolveEnvironment, isUrlReachable } from '../helpers/env-resolver';
-
-/** Shape returned by the /api/clients endpoint for a single client record. */
-interface ClientRecord {
-  id: string;
-  name: string;
-  email: string;
-  amount?: number;
-  createdAt?: string;
-  [key: string]: unknown;
-}
-
-/** Payload used when creating a test client. */
-interface CreateClientPayload {
-  name: string;
-  email: string;
-  amount?: number;
-  testRecord?: boolean;
-  timezone?: string;
-}
-
-export class DataIntegrityAuditorAgent extends BaseAgent {
-  readonly agentId = 14;
-  readonly agentName = 'Data Integrity Auditor';
-
-  protected async preFlight(): Promise<void> {
-    if (!this.config.accuracy.enabled) {
-      throw new Error(
-        'config.accuracy.enabled is false — Data Integrity Auditor requires accuracy checks to be enabled',
-      );
-    }
-
-    const { env, fallback } = await resolveEnvironment(this.config, this.phase);
-
-    if (!env) {
-      throw new Error('No environment configured — cannot verify API reachability');
-    }
-
-    // If we fell back to alpha, don't throw on unreachable — execute() will handle it gracefully
-    if (!fallback) {
-      const reachable = await isUrlReachable(env.baseUrl);
-      if (!reachable) {
-        throw new Error(`API base URL is not reachable: ${env.baseUrl}`);
-      }
-    }
-  }
-
-  protected async execute(): Promise<Finding[]> {
-    const findings: Finding[] = [];
-
-    const { env, fallback } = await resolveEnvironment(this.config, this.phase);
-
-    if (!env) {
-      findings.push({
-        id: '14-no-env',
-        type: 'infra-issue',
-        severity: 'critical',
-        agentId: this.agentId,
-        module: 'data-integrity',
-        description: 'No environment configured — cannot determine base URL',
-      });
-      return findings;
-    }
-
-    const credentials =
-      this.config.auth.credentials?.['admin'] ??
-      Object.values(this.config.auth.credentials ?? {})[0];
-
-    if (!credentials) {
-      findings.push({
-        id: '14-no-credentials',
-        type: 'infra-issue',
-        severity: 'critical',
-        agentId: this.agentId,
-        module: 'data-integrity',
-        description: 'No credentials configured in auth.credentials — cannot authenticate',
-      });
-      return findings;
-    }
-
-    let client: ApiClient;
-    try {
-      client = await ApiClient.createAuthenticated(env.baseUrl, credentials);
-    } catch (authErr) {
-      // Auth failure is always medium — indicates missing API or wrong credentials, not a data integrity bug
-      const authSeverity = 'medium' as const;
-      findings.push({
-        id: '14-auth-failed',
-        type: 'infra-issue',
-        severity: authSeverity,
-        agentId: this.agentId,
-        module: 'data-integrity',
-        description: `Authentication failed: ${authErr instanceof Error ? authErr.message : String(authErr)}`,
-      });
-      return findings;
-    }
-
-    // CRUD round-trip tests
-    const crudFindings = await this.testCrudRoundTrip(client);
-    findings.push(...crudFindings);
-
-    // Decimal precision test
-    const decimalFindings = await this.testDecimalPrecision(client);
-    findings.push(...decimalFindings);
-
-    // Timezone test
-    const timezoneFindings = await this.testTimezone(client);
-    findings.push(...timezoneFindings);
-
-    return findings;
-  }
-
-  private async testCrudRoundTrip(client: ApiClient): Promise<Finding[]> {
-    const findings: Finding[] = [];
-    let createdId: string | null = null;
-
-    const createPayload: CreateClientPayload = {
-      name: 'TF-DataIntegrity-Test',
-      email: `tf-integrity-${Date.now()}@test.invalid`,
-      testRecord: true,
-    };
-
-    // CREATE
-    let createResp;
-    try {
-      createResp = await client.post('/api/clients', createPayload);
-    } catch (err) {
-      findings.push({
-        id: '14-crud-create-error',
-        type: 'infra-issue',
-        severity: 'critical',
-        agentId: this.agentId,
-        module: 'data-integrity',
-        description: `POST /api/clients failed: ${err instanceof Error ? err.message : String(err)}`,
-      });
-      return findings;
-    }
-
-    if (createResp.status !== 200 && createResp.status !== 201) {
-      findings.push({
-        id: '14-crud-create-status',
-        type: 'code-bug-logic',
-        severity: 'high',
-        agentId: this.agentId,
-        module: 'data-integrity',
-        description: `POST /api/clients returned ${createResp.status} — expected 200 or 201`,
-      });
-      return findings;
-    }
-
-    const created = createResp.body as ClientRecord;
-    createdId = created?.id ?? null;
-
-    if (!createdId) {
-      findings.push({
-        id: '14-crud-create-no-id',
-        type: 'code-bug-logic',
-        severity: 'high',
-        agentId: this.agentId,
-        module: 'data-integrity',
-        description: 'POST /api/clients response did not include an `id` field',
-      });
-      return findings;
-    }
-
-    // READ — verify all fields match what was sent
-    let readResp;
-    try {
-      readResp = await client.get(`/api/clients/${createdId}`);
-    } catch (err) {
-      findings.push({
-        id: `14-crud-read-error-${createdId}`,
-        type: 'infra-issue',
-        severity: 'critical',
-        agentId: this.agentId,
-        module: 'data-integrity',
-        description: `GET /api/clients/${createdId} failed: ${err instanceof Error ? err.message : String(err)}`,
-      });
-      return findings;
-    }
-
-    if (readResp.status !== 200) {
-      findings.push({
-        id: `14-crud-read-status-${createdId}`,
-        type: 'code-bug-logic',
-        severity: 'high',
-        agentId: this.agentId,
-        module: 'data-integrity',
-        description: `GET /api/clients/${createdId} returned ${readResp.status} — expected 200 after create`,
-      });
-    } else {
-      const read = readResp.body as ClientRecord;
-      // Verify fields match
-      const mismatches: string[] = [];
-      if (read.name !== createPayload.name) {
-        mismatches.push(`name: sent "${createPayload.name}", got "${read.name}"`);
-      }
-      if (read.email !== createPayload.email) {
-        mismatches.push(`email: sent "${createPayload.email}", got "${read.email}"`);
-      }
-
-      if (mismatches.length > 0) {
-        findings.push({
-          id: `14-crud-field-mismatch-${createdId}`,
-          type: 'code-bug-logic',
-          severity: 'high',
-          agentId: this.agentId,
-          module: 'data-integrity',
-          description: `CREATE→READ field mismatch for client ${createdId}: ${mismatches.join('; ')}`,
-          suggestedFix: 'Verify the API serialises and persists all fields from the request body',
-        });
-      }
-    }
-
-    // UPDATE
-    const updatePayload = { name: 'TF-DataIntegrity-Updated' };
-    let updateResp;
-    try {
-      updateResp = await client.put(`/api/clients/${createdId}`, updatePayload);
-    } catch (err) {
-      findings.push({
-        id: `14-crud-update-error-${createdId}`,
-        type: 'infra-issue',
-        severity: 'high',
-        agentId: this.agentId,
-        module: 'data-integrity',
-        description: `PUT /api/clients/${createdId} failed: ${err instanceof Error ? err.message : String(err)}`,
-      });
-    }
-
-    if (updateResp && (updateResp.status === 200 || updateResp.status === 204)) {
-      // Read back and verify update was applied
-      const afterUpdateResp = await client.get(`/api/clients/${createdId}`).catch(() => null);
-      if (afterUpdateResp && afterUpdateResp.status === 200) {
-        const updated = afterUpdateResp.body as ClientRecord;
-        if (updated.name !== updatePayload.name) {
-          findings.push({
-            id: `14-crud-update-mismatch-${createdId}`,
-            type: 'code-bug-logic',
-            severity: 'high',
-            agentId: this.agentId,
-            module: 'data-integrity',
-            description:
-              `UPDATE→READ mismatch for client ${createdId}: name should be "${updatePayload.name}" but got "${updated.name}"`,
-            suggestedFix: 'Verify the API persists PUT request body fields correctly',
-          });
-        }
-      }
-    }
-
-    // DELETE
-    let deleteResp;
-    try {
-      deleteResp = await client.delete(`/api/clients/${createdId}`);
-    } catch (err) {
-      findings.push({
-        id: `14-crud-delete-error-${createdId}`,
-        type: 'infra-issue',
-        severity: 'high',
-        agentId: this.agentId,
-        module: 'data-integrity',
-        description: `DELETE /api/clients/${createdId} failed: ${err instanceof Error ? err.message : String(err)}`,
-      });
-      return findings;
-    }
-
-    if (deleteResp.status !== 200 && deleteResp.status !== 204) {
-      findings.push({
-        id: `14-crud-delete-status-${createdId}`,
-        type: 'code-bug-logic',
-        severity: 'medium',
-        agentId: this.agentId,
-        module: 'data-integrity',
-        description: `DELETE /api/clients/${createdId} returned ${deleteResp.status} — expected 200 or 204`,
-      });
-    }
-
-    // Verify 404 after delete
-    const afterDeleteResp = await client.get(`/api/clients/${createdId}`).catch(() => null);
-    if (afterDeleteResp && afterDeleteResp.status !== 404) {
-      findings.push({
-        id: `14-crud-delete-verify-${createdId}`,
-        type: 'code-bug-logic',
-        severity: 'high',
-        agentId: this.agentId,
-        module: 'data-integrity',
-        description: `GET /api/clients/${createdId} returned ${afterDeleteResp.status} after DELETE — expected 404`,
-        suggestedFix: 'Ensure DELETE removes the record and subsequent GET returns 404',
-      });
-    }
-
-    return findings;
-  }
-
-  private async testDecimalPrecision(client: ApiClient): Promise<Finding[]> {
-    const findings: Finding[] = [];
-    const precision = this.config.accuracy.decimalPrecision;
-    const testAmount = 1000.105;
-
-    let createdId: string | null = null;
-
-    try {
-      const createPayload: CreateClientPayload = {
-        name: 'TF-Decimal-Test',
-        email: `tf-decimal-${Date.now()}@test.invalid`,
-        amount: testAmount,
-        testRecord: true,
-      };
-
-      const createResp = await client.post('/api/clients', createPayload);
-      if (createResp.status !== 200 && createResp.status !== 201) {
-        // API may not support amount field — skip precision check
-        return findings;
-      }
-
-      const created = createResp.body as ClientRecord;
-      createdId = created?.id ?? null;
-      if (!createdId) return findings;
-
-      const readResp = await client.get(`/api/clients/${createdId}`);
-      if (readResp.status !== 200) return findings;
-
-      const record = readResp.body as ClientRecord;
-      const storedAmount = record?.amount;
-
-      if (storedAmount !== undefined && storedAmount !== null) {
-        // Check drift: compare to expected precision
-        const factor = Math.pow(10, precision);
-        const expected = Math.round(testAmount * factor) / factor;
-        const stored = Math.round(Number(storedAmount) * factor) / factor;
-
-        if (expected !== stored) {
-          findings.push({
-            id: `14-decimal-drift-${createdId}`,
-            type: 'code-bug-logic',
-            severity: 'high',
-            agentId: this.agentId,
-            module: 'data-integrity',
-            description:
-              `Decimal precision drift: sent amount ${testAmount}, stored as ${storedAmount}. ` +
-              `Expected ${expected} at ${precision} decimal places, got ${stored}`,
-            suggestedFix:
-              'Use NUMERIC/DECIMAL SQL types with explicit precision rather than FLOAT. ' +
-              'Validate and round amounts to configured decimal precision on input.',
-          });
-        }
-      }
-    } catch {
-      // Endpoint may not support amount — skip
-    } finally {
-      if (createdId) {
-        await client.delete(`/api/clients/${createdId}`).catch(() => undefined);
-      }
-    }
-
-    return findings;
-  }
-
-  private async testTimezone(client: ApiClient): Promise<Finding[]> {
-    const findings: Finding[] = [];
-    const expectedTimezone = this.config.accuracy.timezone;
-    let createdId: string | null = null;
-
-    try {
-      const createPayload: CreateClientPayload = {
-        name: 'TF-Timezone-Test',
-        email: `tf-tz-${Date.now()}@test.invalid`,
-        testRecord: true,
-      };
-
-      const createResp = await client.post('/api/clients', createPayload);
-      if (createResp.status !== 200 && createResp.status !== 201) return findings;
-
-      const created = createResp.body as ClientRecord;
-      createdId = created?.id ?? null;
-      if (!createdId) return findings;
-
-      const readResp = await client.get(`/api/clients/${createdId}`);
-      if (readResp.status !== 200) return findings;
-
-      const record = readResp.body as ClientRecord;
-      const createdAt = record?.createdAt;
-
-      if (createdAt && typeof createdAt === 'string') {
-        // ISO 8601 dates should end with Z (UTC) or include timezone offset
-        const isUtc = createdAt.endsWith('Z') || createdAt.includes('+00:00');
-        const isConfiguredTz = expectedTimezone === 'UTC' ? isUtc : createdAt.includes(expectedTimezone);
-
-        if (!isConfiguredTz && !isUtc) {
-          findings.push({
-            id: `14-timezone-mismatch-${createdId}`,
-            type: 'code-bug-logic',
-            severity: 'medium',
-            agentId: this.agentId,
-            module: 'data-integrity',
-            description:
-              `Timezone mismatch: createdAt "${createdAt}" does not reflect configured timezone "${expectedTimezone}"`,
-            suggestedFix:
-              'Ensure all datetime fields are stored and returned in the configured timezone. ' +
-              'Store as UTC and convert on display, or consistently use the configured timezone.',
-          });
-        }
-      }
-    } catch {
-      // Endpoint may not return createdAt — skip
-    } finally {
-      if (createdId) {
-        await client.delete(`/api/clients/${createdId}`).catch(() => undefined);
-      }
-    }
-
-    return findings;
-  }
-}