agentic-qe 3.3.3 → 3.3.4

package/scripts/fetch-content.js

@@ -0,0 +1,460 @@
+#!/usr/bin/env node
+/**
+ * Fetch Content CLI - 5-Tier Browser Cascade with Per-Tier Timeouts
+ *
+ * Single entry point for all browser content fetching operations.
+ * Automatically cascades through tiers with 30s timeout each.
+ *
+ * Usage:
+ *   node scripts/fetch-content.js <URL> <OUTPUT_DIR> [OPTIONS]
+ *
+ * Options:
+ *   --timeout <ms>      Per-tier timeout (default: 30000)
+ *   --skip-tiers <list> Comma-separated tiers to skip
+ *   --locale <locale>   Browser locale (default: en-US)
+ *
+ * Output:
+ *   - <OUTPUT_DIR>/content.html       Fetched HTML content
+ *   - <OUTPUT_DIR>/screenshot.png     Page screenshot
+ *   - <OUTPUT_DIR>/fetch-result.json  Structured result with metadata
+ *
+ * Exit codes:
+ *   0 - Success
+ *   1 - All tiers failed
+ *   2 - Invalid arguments
+ *
+ * @version 1.0.0
+ * @since v3
+ */
+
+const { exec, execSync, spawn } = require('child_process');
+const { promisify } = require('util');
+const fs = require('fs');
+const path = require('path');
+
+const execAsync = promisify(exec);
+
+// ============================================================================
+// Configuration
+// ============================================================================
+
+const DEFAULT_TIER_TIMEOUT = 30000; // 30 seconds per tier
+const DEFAULT_USER_AGENT = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36';
+
+const TIERS = [
+  'vibium',
+  'playwright-stealth',
+  'http-fetch',
+  'websearch-fallback'
+];
+
+// ============================================================================
+// Argument Parsing
+// ============================================================================
+
+function parseArgs() {
+  const args = process.argv.slice(2);
+
+  if (args.length < 2) {
+    console.error('Usage: node fetch-content.js <URL> <OUTPUT_DIR> [OPTIONS]');
+    console.error('');
+    console.error('Options:');
+    console.error('  --timeout <ms>      Per-tier timeout (default: 30000)');
+    console.error('  --skip-tiers <list> Comma-separated tiers to skip');
+    console.error('  --locale <locale>   Browser locale (default: en-US)');
+    process.exit(2);
+  }
+
+  const options = {
+    url: args[0],
+    outputDir: args[1],
+    timeout: DEFAULT_TIER_TIMEOUT,
+    skipTiers: [],
+    locale: 'en-US',
+    userAgent: DEFAULT_USER_AGENT
+  };
+
+  for (let i = 2; i < args.length; i++) {
+    switch (args[i]) {
+      case '--timeout':
+        options.timeout = parseInt(args[++i], 10);
+        break;
+      case '--skip-tiers':
+        options.skipTiers = args[++i].split(',').map(t => t.trim());
+        break;
+      case '--locale':
+        options.locale = args[++i];
+        break;
+    }
+  }
+
+  return options;
+}
+
+// ============================================================================
+// Utility Functions
+// ============================================================================
+
+function log(tier, message, data = {}) {
+  const entry = {
+    timestamp: new Date().toISOString(),
+    tier,
+    message,
+    ...data
+  };
+  console.error(`[${entry.timestamp}] [${tier}] ${message}`);
+  return entry;
+}
+
+function withTimeout(promise, ms, tierName) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      reject(new Error(`${tierName} timed out after ${ms}ms`));
+    }, ms);
+
+    promise
+      .then(result => {
+        clearTimeout(timer);
+        resolve(result);
+      })
+      .catch(err => {
+        clearTimeout(timer);
+        reject(err);
+      });
+  });
+}
+
+// ============================================================================
+// Tier Implementations
+// ============================================================================
+
+/**
+ * Tier 1: Vibium MCP Browser
+ * Note: Vibium requires MCP context - skip in CLI mode
+ */
+async function fetchWithVibium(options) {
+  log('vibium', 'Skipping - requires MCP context');
+  throw new Error('Vibium requires MCP context, not available in CLI');
+}
+
+/**
+ * Tier 2: Playwright + Stealth (PRIMARY for CLI)
+ */
+async function fetchWithPlaywrightStealth(options) {
+  log('playwright-stealth', 'Starting fetch', { url: options.url });
+
+  const workDir = path.join(options.outputDir, '.playwright-work');
+  fs.mkdirSync(workDir, { recursive: true });
+
+  // Check if playwright is installed globally or locally
+  const packageJsonPath = path.join(workDir, 'package.json');
+  if (!fs.existsSync(path.join(workDir, 'node_modules', 'playwright-extra'))) {
+    fs.writeFileSync(packageJsonPath, JSON.stringify({ name: 'pw-fetch', type: 'commonjs' }));
+
+    log('playwright-stealth', 'Installing dependencies...');
+    try {
+      execSync('npm install playwright-extra puppeteer-extra-plugin-stealth playwright 2>/dev/null', {
+        cwd: workDir,
+        stdio: 'pipe',
+        timeout: 60000
+      });
+    } catch (e) {
+      log('playwright-stealth', 'Install warning', { error: e.message });
+    }
+  }
+
+  const scriptPath = path.join(workDir, 'fetch.js');
+  const contentPath = path.join(options.outputDir, 'content.html');
+  const screenshotPath = path.join(options.outputDir, 'screenshot.png');
+
+  const script = `
+const { chromium } = require('playwright-extra');
+const stealth = require('puppeteer-extra-plugin-stealth')();
+chromium.use(stealth);
+
+(async () => {
+  const browser = await chromium.launch({
+    headless: true,
+    args: ['--no-sandbox', '--disable-setuid-sandbox', '--disable-dev-shm-usage', '--disable-gpu']
+  });
+
+  const context = await browser.newContext({
+    userAgent: ${JSON.stringify(options.userAgent)},
+    viewport: { width: 1920, height: 1080 },
+    locale: ${JSON.stringify(options.locale)}
+  });
+
+  const page = await context.newPage();
+
+  try {
+    await page.goto(${JSON.stringify(options.url)}, {
+      waitUntil: 'domcontentloaded',
+      timeout: ${options.timeout - 5000}
+    });
+
+    await page.waitForTimeout(2000);
+
+    // Dismiss cookie banners
+    const cookieSelectors = [
+      '[data-testid="consent-accept-all"]',
+      '#onetrust-accept-btn-handler',
+      'button[id*="accept"]',
+      '[class*="cookie"] button',
+      'button:has-text("Accept")',
+      'button:has-text("Acceptă")'
+    ];
+
+    for (const sel of cookieSelectors) {
+      try {
+        const btn = await page.$(sel);
+        if (btn) {
+          await btn.click();
+          await page.waitForTimeout(1000);
+          break;
+        }
+      } catch (e) {}
+    }
+
+    const content = await page.content();
+    require('fs').writeFileSync(${JSON.stringify(contentPath)}, content);
+    await page.screenshot({ path: ${JSON.stringify(screenshotPath)} });
+
+    console.log(JSON.stringify({
+      success: true,
+      size: content.length,
+      title: await page.title(),
+      url: page.url()
+    }));
+  } finally {
+    await browser.close();
+  }
+})().catch(e => {
+  console.log(JSON.stringify({ success: false, error: e.message }));
+  process.exit(1);
+});
+`;
+
+  fs.writeFileSync(scriptPath, script);
+
+  const { stdout } = await execAsync(`node "${scriptPath}"`, {
+    cwd: workDir,
+    timeout: options.timeout
+  });
+
+  const result = JSON.parse(stdout.trim());
+  if (!result.success) {
+    throw new Error(result.error);
+  }
+
+  const content = fs.readFileSync(contentPath, 'utf8');
+
+  return {
+    success: true,
+    content,
+    contentSize: content.length,
+    screenshotPath,
+    metadata: { title: result.title, finalUrl: result.url }
+  };
+}
+
+/**
+ * Tier 3: HTTP Fetch (for simple/static sites)
+ */
+async function fetchWithHttp(options) {
+  log('http-fetch', 'Starting fetch', { url: options.url });
+
+  const response = await fetch(options.url, {
+    headers: {
+      'User-Agent': options.userAgent,
+      'Accept': 'text/html,application/xhtml+xml,*/*',
+      'Accept-Language': `${options.locale},en;q=0.5`
+    },
+    signal: AbortSignal.timeout(options.timeout)
+  });
+
+  if (!response.ok) {
+    throw new Error(`HTTP ${response.status}: ${response.statusText}`);
+  }
+
+  const content = await response.text();
+
+  if (content.length < 500) {
+    throw new Error('HTTP fetch returned insufficient content (bot blocked?)');
+  }
+
+  const contentPath = path.join(options.outputDir, 'content.html');
+  fs.writeFileSync(contentPath, content);
+
+  return {
+    success: true,
+    content,
+    contentSize: content.length,
+    metadata: { statusCode: response.status }
+  };
+}
+
+/**
+ * Tier 4: WebSearch Fallback (research-based, degraded mode)
+ */
+async function fetchWithWebSearch(options) {
+  log('websearch-fallback', 'Creating research-based content', { url: options.url });
+
+  // This tier creates a placeholder indicating manual research is needed
+  const urlObj = new URL(options.url);
+  const domain = urlObj.hostname;
+
+  const researchContent = `
+<!DOCTYPE html>
+<html>
+<head>
+  <title>Research Required: ${options.url}</title>
+  <meta name="fetch-method" content="websearch-fallback">
+  <meta name="fetch-status" content="degraded">
+  <meta name="original-url" content="${options.url}">
+  <meta name="fetch-date" content="${new Date().toISOString()}">
+</head>
+<body>
+  <h1>Manual Research Required</h1>
+  <p><strong>Status:</strong> All automated fetch tiers failed.</p>
+  <p><strong>Target URL:</strong> ${options.url}</p>
+  <p><strong>Domain:</strong> ${domain}</p>
+  <hr>
+  <h2>Recommended Actions:</h2>
+  <ol>
+    <li>Use WebSearch tool to research "${domain} features functionality"</li>
+    <li>Check if site requires authentication or has strict bot protection</li>
+    <li>Consider manual browser inspection</li>
+  </ol>
+  <p><em>This is a degraded fallback. Analysis based on this content will be limited.</em></p>
+</body>
+</html>
+`;
+
+  const contentPath = path.join(options.outputDir, 'content.html');
+  fs.writeFileSync(contentPath, researchContent);
+
+  return {
+    success: true,
+    content: researchContent,
+    contentSize: researchContent.length,
+    metadata: {
+      note: 'Degraded mode - research-based content',
+      manualResearchRequired: true
+    }
+  };
+}
+
+// ============================================================================
+// Tier Dispatcher
+// ============================================================================
+
+const TIER_HANDLERS = {
+  'vibium': fetchWithVibium,
+  'playwright-stealth': fetchWithPlaywrightStealth,
+  'http-fetch': fetchWithHttp,
+  'websearch-fallback': fetchWithWebSearch
+};
+
+// ============================================================================
+// Main Cascade Logic
+// ============================================================================
+
+async function fetchWithCascade(options) {
+  fs.mkdirSync(options.outputDir, { recursive: true });
+
+  const result = {
+    success: false,
+    url: options.url,
+    tier: null,
+    status: 'failed',
+    content: null,
+    contentSize: 0,
+    screenshotPath: null,
+    tiersAttempted: [],
+    tierErrors: {},
+    metadata: {}
+  };
+
+  const tiersToTry = TIERS.filter(t => !options.skipTiers.includes(t));
+
+  for (const tier of tiersToTry) {
+    result.tiersAttempted.push(tier);
+    log(tier, `Attempting fetch (timeout: ${options.timeout}ms)`);
+
+    try {
+      const handler = TIER_HANDLERS[tier];
+      const tierResult = await withTimeout(
+        handler(options),
+        options.timeout,
+        tier
+      );
+
+      if (tierResult.success && tierResult.content) {
+        result.success = true;
+        result.tier = tier;
+        result.status = tier === 'websearch-fallback' ? 'degraded' : 'success';
+        result.content = tierResult.content;
+        result.contentSize = tierResult.contentSize;
+        result.screenshotPath = tierResult.screenshotPath || null;
+        result.metadata = tierResult.metadata || {};
+
+        log(tier, `SUCCESS: ${result.contentSize} bytes`);
+        break;
+      }
+    } catch (error) {
+      const errorMsg = error.message || String(error);
+      result.tierErrors[tier] = errorMsg;
+      log(tier, `FAILED: ${errorMsg}`);
+    }
+  }
+
+  // Save result metadata
+  const resultPath = path.join(options.outputDir, 'fetch-result.json');
+  const resultData = { ...result };
+  delete resultData.content; // Don't duplicate content in JSON
+  fs.writeFileSync(resultPath, JSON.stringify(resultData, null, 2));
+
+  return result;
+}
+
+// ============================================================================
+// Entry Point
+// ============================================================================
+
+async function main() {
+  const options = parseArgs();
+
+  console.error('');
+  console.error('╔════════════════════════════════════════════════════════════════╗');
+  console.error('║              FETCH CONTENT - 5-TIER CASCADE                    ║');
+  console.error('╠════════════════════════════════════════════════════════════════╣');
+  console.error(`║  URL: ${options.url.substring(0, 54).padEnd(54)} ║`);
+  console.error(`║  Output: ${options.outputDir.substring(0, 51).padEnd(51)} ║`);
+  console.error(`║  Timeout per tier: ${options.timeout}ms                                  ║`);
+  console.error('╚════════════════════════════════════════════════════════════════╝');
+  console.error('');
+
+  try {
+    const result = await fetchWithCascade(options);
+
+    // Output final result to stdout (for programmatic use)
+    console.log(JSON.stringify({
+      success: result.success,
+      tier: result.tier,
+      status: result.status,
+      contentSize: result.contentSize,
+      screenshotPath: result.screenshotPath,
+      contentPath: path.join(options.outputDir, 'content.html'),
+      resultPath: path.join(options.outputDir, 'fetch-result.json'),
+      tiersAttempted: result.tiersAttempted,
+      tierErrors: result.tierErrors
+    }, null, 2));
+
+    process.exit(result.success ? 0 : 1);
+  } catch (error) {
+    console.error(`Fatal error: ${error.message}`);
+    process.exit(1);
+  }
+}
+
+main();

package/v3/CHANGELOG.md

@@ -5,6 +5,107 @@ All notable changes to Agentic QE will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.3.4] - 2026-01-29
+
+### 🎯 Highlights
+
+**QCSD Ideation Phase Complete** - Full Quality Conscious Software Delivery (QCSD) Ideation phase implementation with HTSM v6.3 quality criteria analysis, SFDIPOT product factors assessment, and cross-phase memory feedback loops.
+
+**Cross-Phase Memory System** - New persistent memory architecture enabling automated learning between QCSD phases (Production→Ideation, Production→Grooming, CI/CD→Development, Development→Grooming).
+
+**Comprehensive Test Coverage** - 358 files changed with 83,990+ lines of new tests across all 12 domains, kernel, MCP handlers, routing, and workers.
+
+### Added
+
+#### QCSD Ideation Phase Agents
+- **qe-quality-criteria-recommender** - HTSM v6.3 quality criteria analysis with 10 categories
+- **qe-product-factors-assessor** - SFDIPOT framework with 7 factors, 37 subcategories
+- **qe-risk-assessor** - Multi-factor risk scoring with mitigation recommendations
+- **qe-test-idea-rewriter** - Transform passive "Verify X" patterns to active test actions
+
+#### Cross-Phase Memory System
+- **CrossPhaseMemoryService** - File-based persistence for QCSD feedback loops
+- **Cross-phase MCP handlers** - 8 new tools for signal storage/retrieval
+- **Hook executor** - Automatic trigger of cross-phase hooks on agent completion
+- **4 feedback loops** - Strategic, Tactical, Operational, Quality Criteria
+
+#### New Skills
+- **a11y-ally** - Comprehensive WCAG accessibility audit with video caption generation
+- **qcsd-ideation-swarm** - Multi-agent swarm for QCSD Ideation phase
+- **skills-manifest.json** - Centralized skill registration
+
+#### Comprehensive Test Coverage (83,990+ lines)
+- **Kernel tests** - unified-memory, hybrid-backend, kernel, plugin-loader
+- **MCP handler tests** - All domain handlers, handler-factory, task-handlers
+- **Domain tests** - All 12 domain plugins with coordinator tests
+- **Learning tests** - pattern-store, experience-capture, v2-to-v3-migration
+- **Routing tests** - tiny-dancer-router, task-classifier, routing-config
+- **Sync tests** - claude-flow-bridge, sync-agent, json/sqlite readers
+- **Worker tests** - All 10 background workers
+
+#### E2E Test Framework
+- Moved e2e tests to v3/tests/e2e/
+- Sauce Demo test suite with accessibility, cart, checkout, security specs
+- Page Object Model with BasePage, CartPage, CheckoutPage, etc.
+
+#### Documentation Updates
+- Updated agent catalog with QCSD Ideation agents
+- Added HTSM v6.3 quality categories reference
+- Added SFDIPOT framework documentation
+- Updated skill counts: 61 → 63 QE Skills
+- Updated agent counts with new QCSD agents
+
+### Changed
+
+#### Handler Factory Migration
+- All 11 domain handlers now use centralized handler-factory.ts
+- Experience capture middleware wraps all domain operations
+- Consistent error handling across handlers
+
+#### Security Scanner Refactoring
+- Split monolithic security-scanner.ts into modular components
+- New scanner-orchestrator.ts for coordinating SAST/DAST scans
+- Separate sast-scanner.ts and dast-scanner.ts modules
+- security-patterns.ts for pattern definitions
+
+#### E2E Runner Modularization
+- Split e2e-runner.ts into 9 focused modules
+- browser-orchestrator.ts - Browser session management
+- step-executors.ts - Step execution logic
+- assertion-handlers.ts - Assertion processing
+- result-collector.ts - Test result aggregation
+
+### Fixed
+
+#### Test Timeout Fixes
+- Fixed 6 timeout failures in security-compliance/coordinator.test.ts
+- Added proper class-based mocks for SecurityScannerService
+- Added mocks for SecurityAuditorService and ComplianceValidatorService
+
+#### TypeScript Compilation
+- Fixed all TypeScript errors from PR #215 merge
+- Fixed history.length on unknown type casting
+- Fixed performTask payload access patterns
+- Fixed Map iteration with Array.from()
+
+#### Architecture Cleanup
+- Removed wrong-pattern TypeScript agent classes (QualityCriteriaRecommenderAgent, RiskAssessorAgent)
+- Removed orphaned QCSD agent tests
+- Moved n8n-validator to v3/packages/
+
+### Security
+
+- SSRF protection recommendations for DAST scanner (private IP blocking)
+- Path traversal edge case fix recommendation (startsWith + path.sep)
+- npm audit: 0 vulnerabilities
+
+### Deprecated
+
+- Root-level tests/e2e/ directory (moved to v3/tests/e2e/)
+- Root-level src/agents/ TypeScript classes (use .claude/agents/v3/*.md instead)
+
+---
+
 ## [3.3.3] - 2026-01-27
 
 ### 🎯 Highlights

package/v3/README.md

@@ -5,7 +5,7 @@
 [![TypeScript](https://img.shields.io/badge/TypeScript-5.0+-blue.svg)](https://www.typescriptlang.org/)
 [![Node.js](https://img.shields.io/badge/Node.js-18+-green.svg)](https://nodejs.org/)
 
-> Domain-Driven Quality Engineering with Mathematical Coherence Verification, 12 Bounded Contexts, 51 Specialized QE Agents, 61 QE Skills, and ReasoningBank Learning
+> Domain-Driven Quality Engineering with Mathematical Coherence Verification, 12 Bounded Contexts, 51 Specialized QE Agents, 63 QE Skills, and ReasoningBank Learning
 
 ## Quick Start
 
@@ -38,7 +38,7 @@ npx aqe test generate src/
 ## Why Agentic QE?
 
 - **51 Specialized QE Agents** - Domain-focused quality engineering agents (44 main + 7 subagents)
-- **61 QE Skills** - Domain-specific skills for testing, security, accessibility, and more
+- **63 QE Skills** - Domain-specific skills for testing, security, accessibility, QCSD, and more
 - **12 DDD Bounded Contexts** - Modular, extensible architecture
 - **TinyDancer Model Routing** - 3-tier intelligent routing for cost optimization
 - **O(log n) Coverage Analysis** - Sublinear performance with HNSW indexing
@@ -48,6 +48,7 @@ npx aqe test generate src/
 - **MinCut Topology** - Graph-based self-healing agent coordination
 - **Coherence Verification** (v3.3.0) - Mathematical proof of belief consistency using WASM engines
 - **MinCut/Consensus Integration** (v3.3.3) - Full 12/12 domain integration with self-healing
+- **Cross-Phase Memory Unification** (v3.3.4) - Unified SQLite storage for QCSD feedback loops
 - **Zero-Breaking-Changes Migration** - Full v2 backward compatibility
 - **Browser Automation** (v3.1.0) - @claude-flow/browser integration with 9 workflow templates
 
@@ -490,7 +491,7 @@ console.log(`Quality gate: ${gate.value.passed ? 'PASSED' : 'FAILED'}`);
 | Memory | SQLite only | HNSW + SQLite hybrid |
 | Learning | Basic patterns | ReasoningBank + SONA + Dream Cycles |
 | Agents | 32 | 51 QE agents (44 main + 7 subagents) |
-| Skills | 35 | 61 QE skills (v2 + v3 domain skills) |
+| Skills | 35 | 63 QE skills (v2 + v3 domain skills) |
 | Coverage | O(n) | O(log n) |
 | Pattern Search | Linear | O(log n) HNSW indexing |
 | Coordination | Sequential | Queen + Work Stealing + Consensus |
@@ -606,12 +607,12 @@ Agentic QE includes 51 specialized quality engineering agents (44 main + 7 subag
 ### Additional Agents (New in v3)
 `qe-product-factors-assessor` (SFDIPOT analysis), `qe-quality-criteria-recommender` (HTSM v6.3 Quality Criteria), `qe-test-idea-rewriter` (passive→active test transforms)
 
-## 61 QE Skills
+## 63 QE Skills
 
-Agentic QE includes 61 domain-specific quality engineering skills that agents automatically apply:
+Agentic QE includes 63 domain-specific quality engineering skills that agents automatically apply:
 
 <details>
-<summary><b>View All 61 QE Skills</b></summary>
+<summary><b>View All 63 QE Skills</b></summary>
 
 ### Core Testing & Methodologies (12)
 - `agentic-quality-engineering` - Core PACT principles for AI-powered QE
@@ -685,6 +686,10 @@ Agentic QE includes 61 domain-specific quality engineering skills that agents au
 - `n8n-trigger-testing-strategies` - Webhook and event testing
 - `n8n-integration-testing-patterns` - API contract testing for n8n
 
+### QCSD & Accessibility (2)
+- `qcsd-ideation-swarm` - QCSD Ideation phase swarm using HTSM v6.3, Risk Storming, Testability analysis
+- `a11y-ally` - Comprehensive WCAG auditing with multi-tool testing, video captions, and EU compliance
+
 </details>
 
 > **Note**: Claude Flow platform skills (agentdb, github, flow-nexus, etc.) are managed separately by the claude-flow package and not counted in QE skills.