@yasserkhanorg/impact-gate 2.0.0

package/dist/esm/qa-agent/phase3/spec_generator.js

@@ -0,0 +1,62 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+import { spawnSync } from 'child_process';
+import { mkdirSync, writeFileSync } from 'fs';
+import { join } from 'path';
+import { logger } from '../../logger.js';
+import { safeEnv } from '../safe_env.js';
+export function generateSpecsForFindings(findings, config) {
+    // Only generate specs for bugs and gaps (not visual/UX issues)
+    const actionable = findings.filter((f) => f.type === 'bug' || f.type === 'gap');
+    if (actionable.length === 0) {
+        logger.info('No actionable findings for spec generation');
+        return [];
+    }
+    const scenarios = actionable.map((f) => ({
+        title: `Verify: ${f.summary}`,
+        flow: f.flow,
+        steps: f.evidence.reproSteps,
+        expected: `The issue "${f.summary}" should not occur`,
+        priority: f.severity === 'critical' || f.severity === 'high' ? 'P0' : 'P1',
+    }));
+    // Write scenarios to a temp file
+    const outputDir = config.outputDir || '.e2e-ai-agents';
+    mkdirSync(outputDir, { recursive: true });
+    const scenariosPath = join(outputDir, 'qa-findings-scenarios.json');
+    writeFileSync(scenariosPath, JSON.stringify(scenarios, null, 2), 'utf-8');
+    // Call impact-gate generate with the scenarios
+    const args = [
+        'impact-gate', 'generate',
+        '--scenarios', scenariosPath,
+    ];
+    if (config.testsRoot) {
+        args.push('--tests-root', config.testsRoot);
+    }
+    if (config.baseUrl) {
+        args.push('--pipeline-base-url', config.baseUrl);
+    }
+    logger.info('Generating specs for findings', { count: scenarios.length });
+    const result = spawnSync('npx', args, {
+        cwd: config.testsRoot || process.cwd(),
+        encoding: 'utf-8',
+        timeout: 300000,
+        maxBuffer: 4 * 1024 * 1024,
+        env: safeEnv(),
+    });
+    if (result.status !== 0) {
+        logger.warn('Spec generation exited with non-zero', {
+            status: result.status,
+            stderr: (result.stderr || '').slice(0, 500),
+        });
+    }
+    // Parse generated spec paths from output
+    const generatedPaths = [];
+    const lines = (result.stdout || '').split('\n');
+    for (const line of lines) {
+        const match = line.match(/generated.*?:\s*(.+\.spec\.ts)/i);
+        if (match) {
+            generatedPaths.push(match[1].trim());
+        }
+    }
+    return generatedPaths;
+}

package/dist/esm/qa-agent/phase3/verdict.js

@@ -0,0 +1,66 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+export function computeVerdict(phase1, phase2) {
+    const findings = phase2.findings;
+    const critical = findings.filter((f) => f.severity === 'critical').length;
+    const high = findings.filter((f) => f.severity === 'high').length;
+    const medium = findings.filter((f) => f.severity === 'medium').length;
+    const low = findings.filter((f) => f.severity === 'low' || f.severity === 'info').length;
+    // Flow sign-offs
+    const flowSignoffs = buildFlowSignoffs(phase1.flows, phase2);
+    // Decision logic
+    let decision;
+    let reason;
+    if (critical > 0) {
+        decision = 'no-go';
+        reason = `${critical} critical finding(s) — must fix before release.`;
+    }
+    else if (high > 0) {
+        decision = 'no-go';
+        reason = `${high} high-severity finding(s) — requires triage before release.`;
+    }
+    else if (medium > 0) {
+        decision = 'conditional';
+        reason = `${medium} medium-severity finding(s) — review and decide if acceptable.`;
+    }
+    else {
+        decision = 'go';
+        reason = findings.length === 0
+            ? 'No issues found across all tested flows.'
+            : `Only low/info findings (${low}). Safe to proceed.`;
+    }
+    // Check for untested flows (P0/P1 not tested → downgrade to conditional)
+    const untestedP0P1 = flowSignoffs.filter((s) => s.status === 'not-tested' && phase1.flows.find((f) => f.id === s.flowId && (f.priority === 'P0' || f.priority === 'P1')));
+    if (untestedP0P1.length > 0 && decision === 'go') {
+        decision = 'conditional';
+        reason += ` ${untestedP0P1.length} P0/P1 flow(s) were not tested.`;
+    }
+    // Check Phase 1 spec failures
+    const specFailures = phase1.specResults.reduce((sum, r) => sum + r.failed, 0);
+    if (specFailures > 0 && decision === 'go') {
+        decision = 'conditional';
+        reason += ` ${specFailures} existing spec(s) failed in Phase 1.`;
+    }
+    return {
+        decision,
+        reason,
+        flowSignoffs,
+        criticalFindings: critical,
+        highFindings: high,
+        mediumFindings: medium,
+        lowFindings: low,
+    };
+}
+function buildFlowSignoffs(flows, phase2) {
+    return flows.map((flow) => {
+        const explored = phase2.flowsExplored.includes(flow.id);
+        const flowFindings = phase2.findings.filter((f) => f.flow === flow.id);
+        const hasIssues = flowFindings.some((f) => f.type === 'bug' || f.severity === 'critical' || f.severity === 'high');
+        return {
+            flowId: flow.id,
+            flowName: flow.name,
+            status: explored ? (hasIssues ? 'failed' : 'passed') : 'not-tested',
+            findings: flowFindings.map((f) => f.id),
+        };
+    });
+}

package/dist/esm/qa-agent/safe_env.js

@@ -0,0 +1,23 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+/** Build a minimal env for child processes — only forward what's needed. */
+export function safeEnv(extra) {
+    const env = {
+        PATH: process.env.PATH,
+        HOME: process.env.HOME,
+        NODE_PATH: process.env.NODE_PATH,
+        ANTHROPIC_API_KEY: process.env.ANTHROPIC_API_KEY,
+        OPENAI_API_KEY: process.env.OPENAI_API_KEY,
+        LLM_PROVIDER: process.env.LLM_PROVIDER,
+        LOG_LEVEL: process.env.LOG_LEVEL,
+        // Node needs LANG/LC_ALL for proper string handling
+        LANG: process.env.LANG,
+        // npm/npx need these
+        npm_config_prefix: process.env.npm_config_prefix,
+        NVM_DIR: process.env.NVM_DIR,
+        NVM_BIN: process.env.NVM_BIN,
+    };
+    if (extra)
+        Object.assign(env, extra);
+    return env;
+}

package/dist/esm/qa-agent/types.js

@@ -0,0 +1,3 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+export {};

package/dist/esm/reporters/junit.js

@@ -0,0 +1,86 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+function escapeXml(str) {
+    return str
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&apos;');
+}
+function buildTestCase(tc, flowName) {
+    const className = escapeXml(flowName.replace(/\s+/g, '.'));
+    const testName = escapeXml(tc.name);
+    return `      <testcase classname="${className}" name="${testName}" status="${escapeXml(tc.priority)}">\n` +
+        `        <properties>\n` +
+        `          <property name="type" value="${escapeXml(tc.type)}" />\n` +
+        `          <property name="priority" value="${escapeXml(tc.priority)}" />\n` +
+        `        </properties>\n` +
+        `      </testcase>`;
+}
+function buildFailureCase(finding) {
+    const name = escapeXml(finding.title);
+    return `      <testcase classname="findings" name="${name}">\n` +
+        `        <failure message="${escapeXml(finding.title)}" type="${escapeXml(finding.severity)}">${escapeXml(finding.description)}</failure>\n` +
+        `      </testcase>`;
+}
+export const junitReporter = {
+    name: 'junit',
+    extension: '.xml',
+    format(results) {
+        const suites = [];
+        // Build a lookup from flowName -> test cases
+        const designsByFlow = new Map();
+        for (const design of results.testDesigns) {
+            designsByFlow.set(design.flowName, design.testCases);
+        }
+        // High-severity findings as failure cases
+        const highFindings = results.findings.filter((f) => f.severity === 'high');
+        // Each strategy entry becomes a test suite
+        for (const entry of results.strategyEntries) {
+            const testCases = designsByFlow.get(entry.flowName) ?? [];
+            const failures = highFindings.filter((f) => f.title.includes(entry.flowName));
+            const totalTests = testCases.length + failures.length;
+            const casesXml = testCases.map((tc) => buildTestCase(tc, entry.flowName)).join('\n');
+            const failuresXml = failures.map((f) => buildFailureCase(f)).join('\n');
+            const allCases = [casesXml, failuresXml].filter(Boolean).join('\n');
+            // Warnings as system-out
+            const warningsText = results.warnings.length > 0
+                ? `      <system-out>${escapeXml(results.warnings.join('\n'))}</system-out>`
+                : '';
+            suites.push(`    <testsuite name="${escapeXml(entry.flowName)}" tests="${totalTests}" failures="${failures.length}" ` +
+                `id="${escapeXml(entry.flowId)}">\n` +
+                `      <properties>\n` +
+                `        <property name="priority" value="${escapeXml(entry.priority)}" />\n` +
+                `        <property name="approach" value="${escapeXml(entry.approach)}" />\n` +
+                `        <property name="rationale" value="${escapeXml(entry.rationale)}" />\n` +
+                `      </properties>\n` +
+                (allCases ? allCases + '\n' : '') +
+                (warningsText ? warningsText + '\n' : '') +
+                `    </testsuite>`);
+        }
+        // Remaining high findings not tied to a strategy entry
+        const coveredFlowNames = new Set(results.strategyEntries.map((e) => e.flowName));
+        const uncoveredFindings = highFindings.filter((f) => !Array.from(coveredFlowNames).some((name) => f.title.includes(name)));
+        if (uncoveredFindings.length > 0) {
+            const failureCases = uncoveredFindings.map((f) => buildFailureCase(f)).join('\n');
+            suites.push(`    <testsuite name="findings" tests="${uncoveredFindings.length}" failures="${uncoveredFindings.length}">\n` +
+                failureCases + '\n' +
+                `    </testsuite>`);
+        }
+        const totalTests = results.testDesigns.reduce((sum, d) => sum + d.testCases.length, 0) + highFindings.length;
+        const totalFailures = highFindings.length;
+        return `<?xml version="1.0" encoding="UTF-8"?>\n` +
+            `<testsuites name="impact-gate: ${escapeXml(results.workflow)}" ` +
+            `tests="${totalTests}" failures="${totalFailures}" ` +
+            `time="0">\n` +
+            `  <properties>\n` +
+            `    <property name="changedFiles" value="${results.changedFiles}" />\n` +
+            `    <property name="impactedFlows" value="${results.impactedFlows}" />\n` +
+            `    <property name="cost" value="${results.cost}" />\n` +
+            `    <property name="tokens" value="${results.tokens}" />\n` +
+            `  </properties>\n` +
+            suites.join('\n') + '\n' +
+            `</testsuites>\n`;
+    },
+};

package/dist/esm/reporters/reporter.js

@@ -0,0 +1,3 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+export {};

package/dist/esm/reporters/sarif.js

@@ -0,0 +1,132 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+import { getVersion } from '../version.js';
+function severityToLevel(severity) {
+    switch (severity.toLowerCase()) {
+        case 'high':
+        case 'critical':
+            return 'error';
+        case 'medium':
+            return 'warning';
+        case 'low':
+        case 'info':
+            return 'note';
+        default:
+            return 'note';
+    }
+}
+function riskToLevel(risk) {
+    switch (risk.toLowerCase()) {
+        case 'high':
+            return 'warning';
+        case 'medium':
+            return 'note';
+        default:
+            return 'none';
+    }
+}
+export const sarifReporter = {
+    name: 'sarif',
+    extension: '.sarif',
+    format(results) {
+        const rules = [];
+        const sarifResults = [];
+        const ruleIds = new Set();
+        function ensureRule(id, description, level) {
+            if (!ruleIds.has(id)) {
+                ruleIds.add(id);
+                rules.push({
+                    id,
+                    shortDescription: { text: description },
+                    defaultConfiguration: { level },
+                });
+            }
+        }
+        // Findings -> results
+        for (const finding of results.findings) {
+            const level = severityToLevel(finding.severity);
+            const ruleId = `finding/${finding.severity}`;
+            ensureRule(ruleId, `Finding (${finding.severity})`, level);
+            sarifResults.push({
+                ruleId,
+                level,
+                message: { text: `${finding.title}: ${finding.description}` },
+                properties: {
+                    severity: finding.severity,
+                },
+            });
+        }
+        // Strategy entries without matching test designs -> coverage gap results
+        const designedFlows = new Set(results.testDesigns.map((d) => d.flowName));
+        for (const entry of results.strategyEntries) {
+            if (!designedFlows.has(entry.flowName)) {
+                const ruleId = 'coverage/gap';
+                ensureRule(ruleId, 'Missing test coverage for impacted flow', 'warning');
+                sarifResults.push({
+                    ruleId,
+                    level: 'warning',
+                    message: {
+                        text: `Flow "${entry.flowName}" (${entry.flowId}) has strategy but no test design. ` +
+                            `Priority: ${entry.priority}, approach: ${entry.approach}.`,
+                    },
+                    properties: {
+                        flowId: entry.flowId,
+                        priority: entry.priority,
+                    },
+                });
+            }
+        }
+        // High-risk cross-impacts -> warning results
+        for (const impact of results.crossImpacts) {
+            const level = riskToLevel(impact.riskLevel);
+            if (level === 'none') {
+                continue;
+            }
+            const ruleId = `cross-impact/${impact.riskLevel}`;
+            ensureRule(ruleId, `Cross-impact (${impact.riskLevel} risk)`, level);
+            sarifResults.push({
+                ruleId,
+                level,
+                message: {
+                    text: `Cross-impact: "${impact.sourceFamily}" affects "${impact.affectedFamily}" ` +
+                        `with ${impact.riskLevel} risk.`,
+                },
+                properties: {
+                    sourceFamily: impact.sourceFamily,
+                    affectedFamily: impact.affectedFamily,
+                    riskLevel: impact.riskLevel,
+                },
+            });
+        }
+        const run = {
+            tool: {
+                driver: {
+                    name: 'impact-gate',
+                    version: getVersion(),
+                    informationUri: 'https://github.com/yasserfaraazkhan/impact-gate',
+                    rules,
+                },
+            },
+            results: sarifResults,
+            invocations: [
+                {
+                    executionSuccessful: true,
+                    properties: {
+                        workflow: results.workflow,
+                        changedFiles: results.changedFiles,
+                        impactedFlows: results.impactedFlows,
+                        cost: results.cost,
+                        tokens: results.tokens,
+                        warnings: results.warnings,
+                    },
+                },
+            ],
+        };
+        const sarif = {
+            $schema: 'https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json',
+            version: '2.1.0',
+            runs: [run],
+        };
+        return JSON.stringify(sarif, null, 2) + '\n';
+    },
+};

package/dist/esm/resilience/circuit_breaker.js

@@ -0,0 +1,78 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+const DEFAULT_CONFIG = {
+    failureThreshold: 3,
+    cooldownMs: 60000,
+};
+export class CircuitBreaker {
+    constructor(config = {}) {
+        this.state = 'closed';
+        this.failures = 0;
+        this.lastFailureTime = 0;
+        this.config = { ...DEFAULT_CONFIG, ...config };
+    }
+    /** Returns the derived state without mutating internal state. */
+    get currentState() {
+        if (this.state === 'open' && Date.now() - this.lastFailureTime >= this.config.cooldownMs) {
+            return 'half-open';
+        }
+        return this.state;
+    }
+    get isOpen() {
+        return this.currentState === 'open';
+    }
+    /**
+     * Execute a function with circuit breaker protection.
+     * If the circuit is open, the fallback is called instead.
+     */
+    async call(fn, fallback) {
+        // Transition from open to half-open if cooldown has elapsed
+        if (this.state === 'open') {
+            if (Date.now() - this.lastFailureTime >= this.config.cooldownMs) {
+                this.state = 'half-open';
+            }
+            else {
+                return fallback();
+            }
+        }
+        // At this point state is 'closed' or 'half-open'
+        const stateBeforeCall = this.state;
+        try {
+            const result = await fn();
+            this.onSuccess();
+            return result;
+        }
+        catch (error) {
+            const shouldCount = !this.config.shouldCount || this.config.shouldCount(error);
+            if (shouldCount) {
+                this.onFailure();
+            }
+            // In half-open state, a failure re-opens the circuit
+            if (stateBeforeCall === 'half-open') {
+                throw error;
+            }
+            // In closed state, if failures hit threshold the circuit opened
+            if (shouldCount && this.failures >= this.config.failureThreshold) {
+                return fallback();
+            }
+            throw error;
+        }
+    }
+    onSuccess() {
+        this.failures = 0;
+        this.state = 'closed';
+    }
+    onFailure() {
+        this.failures++;
+        this.lastFailureTime = Date.now();
+        if (this.failures >= this.config.failureThreshold) {
+            this.state = 'open';
+        }
+    }
+    /** Reset the circuit breaker to closed state */
+    reset() {
+        this.state = 'closed';
+        this.failures = 0;
+        this.lastFailureTime = 0;
+    }
+}

package/dist/esm/resilience/retry.js

@@ -0,0 +1,56 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+const DEFAULT_RETRY_CONFIG = {
+    maxRetries: 2,
+    baseDelayMs: 1000,
+    maxDelayMs: 10000,
+    jitter: true,
+};
+/** Errors that should be retried (transient failures) */
+function isRetryable(error) {
+    if (!(error instanceof Error))
+        return false;
+    const msg = error.message.toLowerCase();
+    // Rate limits
+    if (msg.includes('rate limit') || msg.includes('429') || msg.includes('too many requests'))
+        return true;
+    // Server errors
+    if (msg.includes('500') || msg.includes('502') || msg.includes('503') || msg.includes('504'))
+        return true;
+    if (msg.includes('internal server error') || msg.includes('bad gateway') || msg.includes('service unavailable'))
+        return true;
+    // Network errors
+    if (msg.includes('econnreset') || msg.includes('econnrefused') || msg.includes('etimedout'))
+        return true;
+    if (msg.includes('socket hang up') || msg.includes('network error'))
+        return true;
+    // Overloaded
+    if (msg.includes('overloaded') || msg.includes('capacity'))
+        return true;
+    return false;
+}
+function computeDelay(attempt, config) {
+    const exponential = Math.min(config.baseDelayMs * Math.pow(2, attempt), config.maxDelayMs);
+    if (!config.jitter)
+        return exponential;
+    // Full jitter: random between 0 and exponential
+    return Math.floor(Math.random() * exponential);
+}
+export async function withRetry(fn, config = {}) {
+    const cfg = { ...DEFAULT_RETRY_CONFIG, ...config };
+    let lastError;
+    for (let attempt = 0; attempt <= cfg.maxRetries; attempt++) {
+        try {
+            return await fn();
+        }
+        catch (error) {
+            lastError = error;
+            if (attempt >= cfg.maxRetries || !isRetryable(error)) {
+                throw error;
+            }
+            const delay = computeDelay(attempt, cfg);
+            await new Promise((resolve) => setTimeout(resolve, delay));
+        }
+    }
+    throw lastError;
+}

package/dist/esm/sanitize.js

@@ -0,0 +1,66 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+/**
+ * Secret scanning and sanitization utilities.
+ * Prevents API keys and credentials from leaking into artifacts, logs, and output.
+ *
+ * Patterns are stored WITHOUT the global flag to avoid shared mutable lastIndex state.
+ * New RegExp instances with /g are created per call for safe concurrent usage.
+ */
+const SECRET_PATTERNS = [
+    // Anthropic API keys (must be checked before generic sk- pattern)
+    /sk-ant-[a-zA-Z0-9_-]{20,}/,
+    // OpenAI API keys (negative lookahead to avoid matching Anthropic keys)
+    /sk-(?!ant-)[a-zA-Z0-9]{20,}/,
+    // Generic API key patterns
+    /(?:api[_-]?key|api[_-]?secret|access[_-]?token|auth[_-]?token)['":\s=]+['"]?([a-zA-Z0-9_\-./]{20,})['"]?/i,
+    // Bearer tokens
+    /Bearer\s+[a-zA-Z0-9_\-./]{20,}/,
+    // AWS keys
+    /AKIA[0-9A-Z]{16}/,
+    // GitHub tokens
+    /gh[ps]_[a-zA-Z0-9]{36,}/,
+    /github_pat_[a-zA-Z0-9_]{22,}/,
+];
+/**
+ * Sanitize a string by replacing detected secrets with [REDACTED].
+ */
+export function sanitizeSecrets(text) {
+    let result = text;
+    for (const pattern of SECRET_PATTERNS) {
+        result = result.replace(new RegExp(pattern, 'gi'), '[REDACTED]');
+    }
+    return result;
+}
+/**
+ * Check if a string contains any detectable secrets.
+ */
+export function containsSecrets(text) {
+    for (const pattern of SECRET_PATTERNS) {
+        if (new RegExp(pattern, 'i').test(text))
+            return true;
+    }
+    return false;
+}
+/**
+ * Deep-sanitize a JSON-serializable object.
+ * Recursively walks all string values and sanitizes them.
+ * Tracks seen objects to prevent stack overflow on circular references.
+ */
+export function sanitizeObject(obj, _seen) {
+    if (typeof obj === 'string')
+        return sanitizeSecrets(obj);
+    if (obj === null || typeof obj !== 'object')
+        return obj;
+    const seen = _seen ?? new WeakSet();
+    if (seen.has(obj))
+        return '[Circular]';
+    seen.add(obj);
+    if (Array.isArray(obj))
+        return obj.map((item) => sanitizeObject(item, seen));
+    const result = {};
+    for (const [key, value] of Object.entries(obj)) {
+        result[key] = sanitizeObject(value, seen);
+    }
+    return result;
+}