@avi770/testteam 3.0.0 → 3.2.0

package/dist/agents/100-error-handling-auditor.js

@@ -0,0 +1,334 @@
+/**
+ * Error-Handling Auditor — static scan for swallowed errors. A caught
+ * exception that's silently discarded turns a loud failure into a silent
+ * one: the bug still happens, but no log, no alert, no stack trace. Same
+ * for a promise rejection handled by a no-op `.catch(() => {})`.
+ *
+ * Detected patterns:
+ *   - Empty catch block:        try { ... } catch (e) { }   (body is only
+ *     whitespace / comments)
+ *   - No-op promise catch:      .catch(() => {})  /  .catch(() => null)  /
+ *     .catch(function () {})  (arrow or function with an empty / trivial
+ *     body)
+ *
+ * Findings:
+ *   - 100-empty-catch          medium  code-bug-logic
+ *   - 100-swallowed-rejection  medium  code-bug-logic
+ *   - 100-summary              info    infra-issue
+ *
+ * Severity is medium, not high: some swallows are deliberate (best-effort
+ * cleanup). The agent flags them for review rather than asserting a bug.
+ *
+ * Persists `evidence/error-handling-audit.json`. Read-only, parallel-safe,
+ * static analysis only.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { BaseAgent } from './base-agent.js';
+import { maskNonCode, isTestPath } from './lib/source-scan.js';
+const SRC_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
+const SKIP_DIRS = new Set([
+    'node_modules', '.git', 'dist', 'build', '.next', '.nuxt', 'coverage', 'reports', 'baselines', 'evidence',
+]);
+function walk(dir, results = []) {
+    if (!fs.existsSync(dir))
+        return results;
+    let entries;
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return results;
+    }
+    for (const entry of entries) {
+        if (SKIP_DIRS.has(entry.name))
+            continue;
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            walk(full, results);
+        }
+        else if (entry.isFile() && SRC_EXTENSIONS.has(path.extname(entry.name))) {
+            results.push(full);
+        }
+    }
+    return results;
+}
+function relativise(absPath, root) {
+    return path.relative(root, absPath).split(path.sep).join('/');
+}
+/** Read a balanced delimiter slice (`{}` or `()`), string- and comment-aware. */
+function readBalanced(content, openIdx, open) {
+    const close = open === '{' ? '}' : ')';
+    if (content[openIdx] !== open)
+        return null;
+    let depth = 0;
+    let inString = null;
+    let escape = false;
+    let inLineComment = false;
+    let inBlockComment = false;
+    for (let i = openIdx; i < content.length; i++) {
+        const ch = content[i];
+        const next = content[i + 1];
+        if (escape) {
+            escape = false;
+            continue;
+        }
+        if (inLineComment) {
+            if (ch === '\n')
+                inLineComment = false;
+            continue;
+        }
+        if (inBlockComment) {
+            if (ch === '*' && next === '/') {
+                inBlockComment = false;
+                i++;
+            }
+            continue;
+        }
+        if (inString) {
+            if (ch === '\\')
+                escape = true;
+            else if (ch === inString)
+                inString = null;
+            continue;
+        }
+        if (ch === '/' && next === '/') {
+            inLineComment = true;
+            i++;
+            continue;
+        }
+        if (ch === '/' && next === '*') {
+            inBlockComment = true;
+            i++;
+            continue;
+        }
+        if (ch === '"' || ch === "'" || ch === '`') {
+            inString = ch;
+            continue;
+        }
+        if (ch === open)
+            depth++;
+        else if (ch === close) {
+            depth--;
+            if (depth === 0)
+                return { text: content.slice(openIdx, i + 1), endIdx: i };
+        }
+    }
+    return null;
+}
+/**
+ * A catch block is a *silent* swallow only when its body is completely empty
+ * (whitespace). A body containing a comment is treated as an INTENTIONAL,
+ * documented swallow and is NOT reported — matching ESLint's `no-empty`, which
+ * lets a comment record why the error is deliberately ignored.
+ */
+export function catchBodyIsEmpty(blockText) {
+    // blockText includes the outer braces. A comment makes the body non-empty.
+    return blockText.slice(1, -1).trim() === '';
+}
+/**
+ * Is this `.catch(...)` argument a no-op handler? Recognises empty arrow
+ * bodies and `=> undefined` / `=> null` / `=> {}`.
+ */
+export function isNoopCatchArg(argText) {
+    // argText is the full (...) slice including parens.
+    const inner = argText.slice(1, -1).trim();
+    // () => {}  | (e) => {}  | err => {}
+    const arrowEmptyBlock = /^\(?[\w\s,{}]*\)?\s*=>\s*\{\s*\}$/;
+    // () => undefined | () => null | (e) => undefined
+    const arrowTrivial = /^\(?[\w\s,]*\)?\s*=>\s*(?:undefined|null|void 0)$/;
+    // function () {} | function (e) {}
+    const fnEmpty = /^function\s*\*?\s*\w*\s*\([^)]*\)\s*\{\s*\}$/;
+    const normalized = inner.replace(/\/\*[\s\S]*?\*\//g, '').replace(/\/\/[^\n]*/g, '').trim();
+    return arrowEmptyBlock.test(normalized) || arrowTrivial.test(normalized) || fnEmpty.test(normalized);
+}
+function lineOf(content, index) {
+    return content.slice(0, index).split('\n').length;
+}
+function snippetOf(content, index) {
+    const start = content.lastIndexOf('\n', index) + 1;
+    let end = content.indexOf('\n', index);
+    if (end === -1)
+        end = content.length;
+    return content.slice(start, end).trim().slice(0, 160);
+}
+/**
+ * Receivers where a no-op `.catch()` is idiomatic best-effort teardown rather
+ * than a swallowed bug — e.g. `await page.close().catch(() => {})`. Matches when
+ * one of these calls sits immediately before the `.catch(`.
+ */
+const CLEANUP_RECEIVER_RE = /\.(?:close|destroy|disconnect|end|quit|cancel|endSession|dispose|release|abort|unref|kill|stop|teardown|cleanup|removeAllListeners)\s*\([^()]*\)\s*$/;
+/** Scan one file's content for swallowed-error patterns. */
+export function scanErrorHandling(content) {
+    const hits = [];
+    // Search for catch keywords in a comment/string-masked copy so example code in
+    // doc comments (e.g. this file's own `catch (e) { }` docstring) and string
+    // literals aren't matched. maskNonCode preserves offsets/length, so indices
+    // map back to `content`. Emptiness is judged on the ORIGINAL block, so a
+    // comment-only body still counts as an intentional (non-empty) swallow.
+    const masked = maskNonCode(content);
+    // Empty catch blocks: catch [ (param) ] { ... }
+    const catchRe = /\bcatch\s*(?:\([^)]*\))?\s*\{/g;
+    let m;
+    while ((m = catchRe.exec(masked)) !== null) {
+        const braceIdx = m.index + m[0].length - 1;
+        const block = readBalanced(content, braceIdx, '{');
+        if (!block)
+            continue;
+        if (catchBodyIsEmpty(block.text)) {
+            hits.push({ kind: 'empty-catch', line: lineOf(content, m.index), snippet: snippetOf(content, m.index) });
+        }
+    }
+    // No-op .catch(...) handlers
+    const catchCallRe = /\.catch\s*\(/g;
+    while ((m = catchCallRe.exec(masked)) !== null) {
+        const parenIdx = m.index + m[0].length - 1;
+        const arg = readBalanced(content, parenIdx, '(');
+        if (!arg)
+            continue;
+        if (!isNoopCatchArg(arg.text))
+            continue;
+        // Skip best-effort cleanup: `x.close().catch(() => {})` and friends.
+        // Swallowing a teardown failure is idiomatic, not a defect.
+        const before = content.slice(Math.max(0, m.index - 80), m.index);
+        if (CLEANUP_RECEIVER_RE.test(before))
+            continue;
+        // Recover-to-sentinel that's consumed is not a swallow: `const x = p().catch(
+        // () => null)` turns the rejection into null/undefined the caller branches on.
+        // (A bare-statement `p().catch(() => null);` has no `=`/`return` → still flagged.)
+        const inner = arg.text.slice(1, -1).trim();
+        if (/=>\s*(?:null|undefined|void 0)\s*$/.test(inner)) {
+            const lhs = content.slice(content.lastIndexOf('\n', m.index) + 1, m.index);
+            if (/(?:=|\breturn\b)\s*[^=]*$/.test(lhs))
+                continue; // assigned or returned → consumed
+        }
+        hits.push({
+            kind: 'swallowed-rejection',
+            line: lineOf(content, m.index),
+            snippet: snippetOf(content, m.index),
+        });
+    }
+    return hits;
+}
+export class ErrorHandlingAuditorAgent extends BaseAgent {
+    agentId = 100;
+    agentName = 'Error-Handling Auditor';
+    async preFlight() {
+        const root = this.config.projectRoot ?? process.cwd();
+        if (!fs.existsSync(root)) {
+            throw new Error(`projectRoot does not exist: ${root}`);
+        }
+    }
+    async execute() {
+        const findings = [];
+        const projectRoot = this.config.projectRoot ?? process.cwd();
+        const sourceFiles = new Set();
+        const mapPath = path.join(this.runDir, 'evidence', 'connection-map.json');
+        try {
+            const map = JSON.parse(fs.readFileSync(mapPath, 'utf-8'));
+            for (const f of map.files)
+                sourceFiles.add(path.join(projectRoot, f.path));
+        }
+        catch {
+            for (const f of walk(projectRoot))
+                sourceFiles.add(f);
+        }
+        const allHits = [];
+        let filesScanned = 0;
+        for (const file of sourceFiles) {
+            // Skip test files — empty catches in tests are usually deliberate.
+            if (isTestPath(file, projectRoot)) {
+                continue;
+            }
+            let content;
+            try {
+                content = fs.readFileSync(file, 'utf-8');
+            }
+            catch {
+                continue;
+            }
+            filesScanned++;
+            const rel = relativise(file, projectRoot);
+            for (const hit of scanErrorHandling(content)) {
+                allHits.push({ ...hit, file: rel });
+            }
+        }
+        if (allHits.length === 0) {
+            findings.push({
+                id: `${this.agentId}-clean`,
+                type: 'infra-issue',
+                severity: 'info',
+                agentId: this.agentId,
+                module: 'error-handling-auditor',
+                description: `Scanned ${filesScanned} non-test file(s) — no empty catch blocks or no-op promise handlers found.`,
+            });
+            this.persistAudit(projectRoot, filesScanned, allHits);
+            return findings;
+        }
+        const seen = new Set();
+        for (const hit of allHits) {
+            const key = `${hit.kind}:${hit.file}:${hit.line}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            findings.push(this.toFinding(hit));
+            if (seen.size >= 100)
+                break;
+        }
+        this.persistAudit(projectRoot, filesScanned, allHits);
+        const empties = allHits.filter((h) => h.kind === 'empty-catch').length;
+        const swallowed = allHits.filter((h) => h.kind === 'swallowed-rejection').length;
+        findings.push({
+            id: `${this.agentId}-summary`,
+            type: 'infra-issue',
+            severity: 'info',
+            agentId: this.agentId,
+            module: 'error-handling-auditor',
+            description: `Error-handling audit: ${empties} empty catch block(s), ${swallowed} no-op promise handler(s) across ${filesScanned} file(s).`,
+        });
+        return findings;
+    }
+    toFinding(hit) {
+        const slug = `${hit.file.replace(/[^\w]/g, '_')}-${hit.line}`;
+        const base = { agentId: this.agentId, module: 'error-handling-auditor', file: hit.file, line: hit.line };
+        if (hit.kind === 'empty-catch') {
+            return {
+                ...base,
+                id: `${this.agentId}-empty-catch-${slug}`,
+                type: 'code-bug-logic',
+                severity: 'medium',
+                description: `Empty catch block at ${hit.file}:${hit.line} swallows the exception — the failure happens silently with no log, alert, or stack trace. Log or rethrow, or comment why it's safe to ignore. \`${hit.snippet}\``,
+            };
+        }
+        return {
+            ...base,
+            id: `${this.agentId}-swallowed-rejection-${slug}`,
+            type: 'code-bug-logic',
+            severity: 'medium',
+            description: `No-op .catch() handler at ${hit.file}:${hit.line} swallows the promise rejection — the async failure is silently discarded. Handle or surface the error. \`${hit.snippet}\``,
+        };
+    }
+    persistAudit(projectRoot, filesScanned, hits) {
+        const audit = {
+            version: 1,
+            generatedAt: new Date().toISOString(),
+            projectRoot,
+            filesScanned,
+            hits,
+        };
+        try {
+            const evidenceDir = path.join(this.runDir, 'evidence');
+            fs.mkdirSync(evidenceDir, { recursive: true });
+            fs.writeFileSync(path.join(evidenceDir, 'error-handling-audit.json'), JSON.stringify(audit, null, 2), 'utf-8');
+            this.addEvidence({
+                type: 'report',
+                path: 'evidence/error-handling-audit.json',
+                description: `Error-handling audit: ${hits.length} issue(s) across ${filesScanned} file(s)`,
+            });
+        }
+        catch {
+            // non-fatal
+        }
+    }
+}
+//# sourceMappingURL=100-error-handling-auditor.js.map

package/dist/agents/100-error-handling-auditor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"100-error-handling-auditor.js","sourceRoot":"","sources":["../../agents/100-error-handling-auditor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAG5D,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACpG,MAAM,SAAS,GAAwB,IAAI,GAAG,CAAC;IAC7C,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU;CAC1G,CAAC,CAAC;AAmBH,SAAS,IAAI,CAAC,GAAW,EAAE,UAAoB,EAAE;IAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACxC,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACtB,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC1E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,IAAY;IAC/C,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChE,CAAC;AAED,iFAAiF;AACjF,SAAS,YAAY,CAAC,OAAe,EAAE,OAAe,EAAE,IAAe;IACrE,MAAM,KAAK,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACvC,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,QAAQ,GAA2B,IAAI,CAAC;IAC5C,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,GAAG,KAAK,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,EAAE,KAAK,IAAI;gBAAE,aAAa,GAAG,KAAK,CAAC;YACvC,SAAS;QACX,CAAC;QACD,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAC/B,cAAc,GAAG,KAAK,CAAC;gBACvB,CAAC,EAAE,CAAC;YACN,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,EAAE,KAAK,IAAI;gBAAE,MAAM,GAAG,IAAI,CAAC;iBAC1B,IAAI,EAAE,KAAK,QAAQ;gBAAE,QAAQ,GAAG,IAAI,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC/B,aAAa,GAAG,IAAI,CAAC;YACrB,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC/B,cAAc,GAAG,IAAI,CAAC;YACtB,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC3C,QAAQ,GAAG,EAAE,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,IAAI;YAAE,KAAK,EAAE,CAAC;aACpB,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;YACtB,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,KAAK,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QAC7E,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,2EAA2E;IAC3E,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,oDAAoD;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,qCAAqC;IACrC,MAAM,eAAe,GAAG,mCAAmC,CAAC;IAC5D,kDAAkD;IAClD,MAAM,YAAY,GAAG,mDAAmD,CAAC;IACzE,mCAAmC;IACnC,MAAM,OAAO,GAAG,8CAA8C,CAAC;IAC/D,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5F,OAAO,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACvG,CAAC;AAED,SAAS,MAAM,CAAC,OAAe,EAAE,KAAa;IAC5C,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AACpD,CAAC;AAED,SAAS,SAAS,CAAC,OAAe,EAAE,KAAa;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IACrC,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,mBAAmB,GACvB,sJAAsJ,CAAC;AAEzJ,4DAA4D;AAC5D,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,IAAI,GAA0C,EAAE,CAAC;IAEvD,+EAA+E;IAC/E,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,wEAAwE;IACxE,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAEpC,gDAAgD;IAChD,MAAM,OAAO,GAAG,gCAAgC,CAAC;IACjD,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3G,CAAC;IACH,CAAC;IAED,6BAA6B;IAC7B,MAAM,WAAW,GAAG,eAAe,CAAC;IACpC,OAAO,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACxC,qEAAqE;QACrE,4DAA4D;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,SAAS;QAC/C,8EAA8E;QAC9E,+EAA+E;QAC/E,mFAAmF;QACnF,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAC3E,IAAI,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,SAAS,CAAC,kCAAkC;QACzF,CAAC;QACD,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,qBAAqB;YAC3B,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC;YAC9B,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC;SACrC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,yBAA0B,SAAQ,SAAS;IAC7C,OAAO,GAAG,GAAG,CAAC;IACd,SAAS,GAAG,wBAAwB,CAAC;IAEpC,KAAK,CAAC,SAAS;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAE7D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC;QAC1E,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAkB,CAAC;YAC3E,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK;gBAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC;gBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,OAAO,GAAuB,EAAE,CAAC;QACvC,IAAI,YAAY,GAAG,CAAC,CAAC;QAErB,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,mEAAmE;YACnE,IAAI,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;gBAClC,SAAS;YACX,CAAC;YACD,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,YAAY,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC1C,KAAK,MAAM,GAAG,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7C,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,QAAQ;gBAC3B,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,wBAAwB;gBAChC,WAAW,EAAE,WAAW,YAAY,4EAA4E;aACjH,CAAC,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YACtD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAClD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;YACnC,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG;gBAAE,MAAM;QAC9B,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QAEtD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,MAAM,CAAC;QACvE,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC,MAAM,CAAC;QACjF,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU;YAC7B,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,wBAAwB;YAChC,WAAW,EAAE,yBAAyB,OAAO,0BAA0B,SAAS,oCAAoC,YAAY,WAAW;SAC5I,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,SAAS,CAAC,GAAqB;QACrC,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;QACzG,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAC/B,OAAO;gBACL,GAAG,IAAI;gBACP,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,gBAAgB,IAAI,EAAE;gBACzC,IAAI,EAAE,gBAAgB;gBACtB,QAAQ,EAAE,QAAQ;gBAClB,WAAW,EAAE,wBAAwB,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,oJAAoJ,GAAG,CAAC,OAAO,IAAI;aAC7N,CAAC;QACJ,CAAC;QACD,OAAO;YACL,GAAG,IAAI;YACP,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,wBAAwB,IAAI,EAAE;YACjD,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,QAAQ;YAClB,WAAW,EAAE,6BAA6B,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,6GAA6G,GAAG,CAAC,OAAO,IAAI;SAC3L,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,WAAmB,EAAE,YAAoB,EAAE,IAAwB;QACtF,MAAM,KAAK,GAAuB;YAChC,OAAO,EAAE,CAAC;YACV,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,WAAW;YACX,YAAY;YACZ,IAAI;SACL,CAAC;QACF,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACvD,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,2BAA2B,CAAC,EACnD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAC9B,OAAO,CACR,CAAC;YACF,IAAI,CAAC,WAAW,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,oCAAoC;gBAC1C,WAAW,EAAE,yBAAyB,IAAI,CAAC,MAAM,oBAAoB,YAAY,UAAU;aAC5F,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/agents/101-rate-limit-auditor.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Rate-Limit Auditor — opt-in probe that checks whether authentication and
+ * other sensitive endpoints throttle rapid requests. An unthrottled login
+ * is an open door for credential stuffing and brute force; the auth-flow
+ * checks in #88 verify correctness but say nothing about brute-force
+ * protection. This fills that gap.
+ *
+ * Triggered only when `config.rateLimit.enabled === true` (default off):
+ * bursting endpoints can trip real limiters, pollute logs, or — if keyed
+ * on account — lock the account. To stay safe, the burst uses a
+ * NON-EXISTENT email + random password, so a real account is never locked
+ * and we exercise IP-based limiting (the common case).
+ *
+ * The agent owns its own dev-server lifecycle (it does not piggyback on
+ * #88). It targets the login endpoint plus any sensitive-shaped routes
+ * (signup, password-reset, OTP, verify) discovered by #87.
+ *
+ * Findings:
+ *   - 101-no-rate-limit-<endpoint>  high (auth) / medium (other)
+ *     A burst of N requests never produced a 429 (or 423 lockout) — the
+ *     endpoint has no observable rate limiting.
+ *   - 101-disabled / 101-summary    info
+ *
+ * Persists `evidence/rate-limit-audit.json`. Free tier.
+ */
+import { spawn, type ChildProcess } from 'node:child_process';
+import type { Finding } from '../core/types.js';
+import { BaseAgent } from './base-agent.js';
+export interface RateLimitTarget {
+    url: string;
+    label: string;
+    path: string;
+}
+export interface RateLimitProbeResult {
+    url: string;
+    label: string;
+    requestsSent: number;
+    statuses: number[];
+    throttled: boolean;
+}
+export interface RateLimitAudit {
+    version: 1;
+    generatedAt: string;
+    burstSize: number;
+    results: RateLimitProbeResult[];
+}
+/**
+ * Resolve the set of endpoints to probe: the login URL (always, if one
+ * resolves) plus sensitive-shaped POST routes from the connection-map.
+ */
+export declare function resolveRateLimitTargets(loginUrl: string | null, routes: ReadonlyArray<{
+    method: string;
+    path: string;
+}>, baseUrl: string): RateLimitTarget[];
+export declare class RateLimitAuditorAgent extends BaseAgent {
+    readonly agentId = 101;
+    readonly agentName = "Rate-Limit Auditor";
+    /** Test seam — defaults to real spawn. */
+    protected spawnImpl: typeof spawn;
+    /** Test seam — readiness check; defaults to polling the health URL. */
+    protected checkReady(url: string, timeoutMs: number, child: ChildProcess): Promise<boolean>;
+    protected preFlight(): Promise<void>;
+    protected execute(): Promise<Finding[]>;
+    /**
+     * Fire `burstSize` rapid POSTs at a target using a fake account, and
+     * report whether any response was a 429 (rate limited) or 423 (locked).
+     * Requests run concurrently to better simulate a burst. Test seam:
+     * subclasses can override to avoid real network calls.
+     */
+    protected burstEndpoint(target: RateLimitTarget, burstSize: number): Promise<RateLimitProbeResult>;
+}
+//# sourceMappingURL=101-rate-limit-auditor.d.ts.map

package/dist/agents/101-rate-limit-auditor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"101-rate-limit-auditor.d.ts","sourceRoot":"","sources":["../../agents/101-rate-limit-auditor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,KAAK,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAI9D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAkCzC,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,CAAC,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,oBAAoB,EAAE,CAAC;CACjC;AAsCD;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,MAAM,EAAE,aAAa,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,EACvD,OAAO,EAAE,MAAM,GACd,eAAe,EAAE,CAuBnB;AAED,qBAAa,qBAAsB,SAAQ,SAAS;IAClD,QAAQ,CAAC,OAAO,OAAO;IACvB,QAAQ,CAAC,SAAS,wBAAwB;IAE1C,0CAA0C;IAC1C,SAAS,CAAC,SAAS,EAAE,OAAO,KAAK,CAAS;IAE1C,uEAAuE;IACvE,SAAS,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC;cAI3E,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cAO1B,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAwI7C;;;;;OAKG;cACa,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;CAyBzG"}