devassist-agent 1.0.0

package/tests/test-layer2.js

@@ -0,0 +1,461 @@
+/**
+ * DevAssist Layer 2 Integration Tests
+ *
+ * Tests the 6 runtime base code modules:
+ * 1. ToolRegistry - register/unregister/invoke/healthCheck/reload
+ * 2. ChannelAgent - protocol handling/routing/FSM/telemetry
+ * 3. ChannelMiddleware - compose/auth/rateLimit/schema
+ * 4. InfrastructureGuard - probes/FSM/adaptive frequency
+ * 5. NotificationCenter - channels/dedup/rate limit
+ * 6. SchemaGatekeeper - 4-layer validation/security checks
+ * 7. Integration: full request flow (middleware -> agent -> tool -> response)
+ */
+
+let passed = 0;
+let failed = 0;
+const failures = [];
+
+function assert(condition, message) {
+  if (condition) {
+    passed++;
+  } else {
+    failed++;
+    failures.push(message);
+    console.log(`  FAIL: ${message}`);
+  }
+}
+
+async function runTests() {
+  console.log('\n  DevAssist Layer 2 Integration Tests\n  ===================================\n');
+
+  // --- Test 1: ToolRegistry ---
+  console.log('  [1] ToolRegistry...');
+  const { ToolRegistry, MODULE_TYPES } = require('../src/modules/runtime/tool-registry');
+
+  const reg = new ToolRegistry();
+
+  // Register a tool
+  const testTool = {
+    id: 'test.echo',
+    name: 'Echo Tool',
+    version: '1.0.0',
+    type: MODULE_TYPES.RESIDENT,
+    category: 'test',
+    schema: {
+      input: { required: ['message'], properties: { message: 'string' } },
+      output: { required: ['echo'], properties: { echo: 'string' } },
+    },
+    handler: async (input) => ({ echo: input.message }),
+    healthCheck: async () => ({ healthy: true, details: { note: 'always healthy' } }),
+  };
+  await reg.register(testTool);
+  assert(reg.get('test.echo') !== null, 'Tool should be registered');
+  assert(reg.list().length === 1, 'Should list 1 tool');
+  assert(reg.getManifest()[0].id === 'test.echo', 'Manifest should include tool');
+
+  // Invoke tool
+  const result = await reg.invoke('test.echo', { message: 'hello' }, { requestId: 't1' });
+  assert(result.echo === 'hello', 'Tool should echo the message');
+
+  // Health check
+  const health = await reg.healthCheck();
+  assert(health.healthy === true, 'All tools should be healthy');
+  assert(health.tools[0].id === 'test.echo', 'Health check should include tool id');
+
+  // Stats
+  const stats = reg.getStats();
+  assert(stats.totalTools === 1, 'Stats should show 1 tool');
+  assert(stats.totalInvocations === 1, 'Stats should show 1 invocation');
+
+  // Unregister
+  await reg.unregister('test.echo');
+  assert(reg.get('test.echo') === null, 'Tool should be unregistered');
+  assert(reg.list().length === 0, 'Should list 0 tools after unregister');
+
+  // Register validation: missing field
+  try {
+    await reg.register({ id: 'bad', name: 'Bad' }); // missing required fields
+    assert(false, 'Should reject tool with missing fields');
+  } catch (e) {
+    assert(true, 'Should reject tool with missing fields');
+  }
+
+  // Register validation: duplicate id
+  await reg.register(testTool);
+  try {
+    await reg.register(testTool);
+    assert(false, 'Should reject duplicate tool id');
+  } catch (e) {
+    assert(true, 'Should reject duplicate tool id');
+  }
+
+  // Error in handler
+  const errorTool = {
+    id: 'test.error',
+    name: 'Error Tool',
+    version: '1.0.0',
+    type: MODULE_TYPES.RESIDENT,
+    category: 'test',
+    schema: { input: { required: [], properties: {} }, output: { required: [], properties: {} } },
+    handler: async () => { throw new Error('intentional error'); },
+  };
+  await reg.register(errorTool);
+  try {
+    await reg.invoke('test.error', {}, {});
+    assert(false, 'Should throw on tool error');
+  } catch (e) {
+    assert(e.message === 'intentional error', 'Should propagate tool error');
+    assert(stats.totalErrors === 0 || reg.getStats().totalErrors > 0, 'Should track error count');
+  }
+
+  console.log('  OK\n');
+
+  // --- Test 2: ChannelAgent ---
+  console.log('  [2] ChannelAgent...');
+  const { ChannelAgent, PROTOCOL_VERSION, STATE, PRIORITY } = require('../src/modules/runtime/channel-agent');
+
+  const reg2 = new ToolRegistry();
+  await reg2.register({
+    id: 'chat.send',
+    name: 'Chat Send',
+    version: '1.0.0',
+    type: MODULE_TYPES.RESIDENT,
+    category: 'chat',
+    schema: { input: { required: ['message'], properties: { message: 'string' } }, output: { required: [], properties: {} } },
+    handler: async (input) => ({ reply: `Echo: ${input.message}` }),
+  });
+
+  const agent = new ChannelAgent({ registry: reg2 });
+  await agent.init();
+  assert(agent.state === STATE.ONLINE, 'Agent should be ONLINE after init');
+
+  // Route action to tool
+  agent.route('chat.send', 'chat.send', { priority: PRIORITY.NORMAL });
+
+  // Handle protocol request
+  const reqBody = {
+    protocol: PROTOCOL_VERSION,
+    seq: 1,
+    action: 'chat.send',
+    timestamp: Date.now(),
+    token: 'test-token',
+    payload: { message: 'hello world' },
+    signature: '',
+  };
+  const response = await agent.handleRequest(reqBody, { ip: '127.0.0.1' });
+  assert(response.protocol === PROTOCOL_VERSION, 'Response should have protocol version');
+  assert(response.code === 200, 'Response should be 200 OK');
+  assert(response.data.reply === 'Echo: hello world', 'Response data should contain echo');
+
+  // Unknown action
+  const unknownReq = { ...reqBody, action: 'unknown.action', seq: 2 };
+  const unknownRes = await agent.handleRequest(unknownReq, {});
+  assert(unknownRes.code === 404, 'Unknown action should return 404');
+
+  // Built-in heartbeat
+  const hbReq = { protocol: PROTOCOL_VERSION, seq: 3, action: 'heartbeat.ping', timestamp: Date.now(), payload: {} };
+  const hbRes = await agent.handleRequest(hbReq, {});
+  assert(hbRes.code === 200, 'Heartbeat should return 200');
+  assert(hbRes.data.alive === true, 'Heartbeat should say alive');
+
+  // Server state
+  const stateReq = { protocol: PROTOCOL_VERSION, seq: 4, action: 'channel.state', timestamp: Date.now(), payload: {} };
+  const stateRes = await agent.handleRequest(stateReq, {});
+  assert(stateRes.code === 200, 'State request should return 200');
+  assert(stateRes.data.state === STATE.ONLINE, 'State should be ONLINE');
+
+  // Learning report
+  const report = agent.getLearningReport();
+  assert(report.totalRequests >= 1, 'Learning should track requests');
+
+  // Telemetry
+  agent.storeTelemetry('client-1', { state: 'online', queue_length: 0 });
+  const serverState = agent.getServerState();
+  assert(serverState.activeClients >= 1, 'Should have at least 1 active client');
+
+  agent.destroy();
+  assert(agent.state === STATE.OFFLINE, 'Agent should be OFFLINE after destroy');
+
+  console.log('  OK\n');
+
+  // --- Test 3: ChannelMiddleware ---
+  console.log('  [3] ChannelMiddleware...');
+  const { compose, requestLogger, authGuard, rateLimiter, schemaValidator, errorHandler } = require('../src/modules/runtime/channel-middleware');
+
+  // compose basic
+  const order = [];
+  const mw1 = async (ctx, next) => { order.push('mw1-before'); await next(); order.push('mw1-after'); };
+  const mw2 = async (ctx, next) => { order.push('mw2-before'); await next(); order.push('mw2-after'); };
+  const composed = compose([mw1, mw2]);
+  await composed({}, async () => { order.push('handler'); });
+  assert(JSON.stringify(order) === JSON.stringify(['mw1-before','mw2-before','handler','mw2-after','mw1-after']),
+    'Middleware should execute in onion order');
+
+  // Auth guard: excluded action should pass
+  const authCtx = { body: { action: 'heartbeat.ping' } };
+  let authNextCalled = false;
+  await authGuard()({ ...authCtx }, async () => { authNextCalled = true; });
+  assert(authNextCalled, 'Auth guard should allow excluded actions');
+
+  // Auth guard: non-excluded without token should be blocked
+  const authCtx2 = { body: { action: 'chat.send', seq: 1 } };
+  let authNextCalled2 = false;
+  await authGuard()(authCtx2, async () => { authNextCalled2 = true; });
+  assert(!authNextCalled2, 'Auth guard should block requests without token');
+  assert(authCtx2.response?.code === 401, 'Auth guard should return 401');
+
+  // Auth guard: with token should pass
+  const authCtx3 = { body: { action: 'chat.send', token: 'fake.jwt.token', seq: 1 } };
+  let authNextCalled3 = false;
+  await authGuard()(authCtx3, async () => { authNextCalled3 = true; });
+  assert(authNextCalled3, 'Auth guard should allow requests with token');
+
+  // Rate limiter
+  const rlCtx = { ip: '10.0.0.1' };
+  const rl = rateLimiter({ windowMs: 1000, max: 2 });
+  let rlPassed = 0;
+  for (let i = 0; i < 3; i++) {
+    let called = false;
+    await rl({ ...rlCtx }, async () => { called = true; });
+    if (called) rlPassed++;
+  }
+  assert(rlPassed === 2, 'Rate limiter should allow 2 of 3 requests');
+
+  // Schema validator
+  const sv = schemaValidator({
+    getSchema: (action) => action === 'test' ? { required: ['name'], properties: { name: 'string' } } : null,
+  });
+  const svCtx = { body: { action: 'test', payload: { name: 123 }, seq: 1 } };
+  let svCalled = false;
+  await sv(svCtx, async () => { svCalled = true; });
+  assert(!svCalled, 'Schema validator should block type mismatch');
+  assert(svCtx.response?.code === 400, 'Schema validator should return 400');
+
+  // Error handler catches errors
+  let ehResponse = null;
+  await errorHandler()({}, async () => { throw new Error('test error'); }).then(() => {});
+  // errorHandler sets ctx.response but ctx is a new object each time
+  // So we need to pass a persistent ctx
+  const ehCtx = {};
+  await errorHandler()(ehCtx, async () => { throw new Error('test error'); });
+  assert(ehCtx.response?.code === 500, 'Error handler should return 500');
+
+  console.log('  OK\n');
+
+  // --- Test 4: InfrastructureGuard ---
+  console.log('  [4] InfrastructureGuard...');
+  const { InfrastructureGuard, MemoryProbe, DiskProbe, HEALTH_STATE } = require('../src/modules/runtime/infrastructure-guard');
+
+  const guard = new InfrastructureGuard();
+  guard.addMemoryProbe({ maxHeapMB: 4096, interval: 999999 }); // High limit so it's always healthy
+  guard.addDiskProbe({ path: process.cwd(), minFreeMB: 1, interval: 999999 });
+
+  // Check now
+  const checkResult = await guard.checkNow();
+  assert(checkResult.healthy === true, 'Guard should be healthy with high limits');
+  assert(checkResult.probes.memory !== undefined, 'Should have memory probe result');
+  assert(checkResult.probes.disk !== undefined, 'Should have disk probe result');
+  assert(checkResult.state === HEALTH_STATE.HEALTHY, 'State should be HEALTHY');
+
+  // Learning
+  const learning = checkResult.learning;
+  assert(learning.totalChecks >= 1, 'Learning should track checks');
+
+  // Status
+  const status = guard.getStatus();
+  assert(status.state === HEALTH_STATE.HEALTHY, 'Status state should be HEALTHY');
+  assert(status.probes.memory !== undefined, 'Status should have memory probe');
+
+  // Probe that fails
+  const guard2 = new InfrastructureGuard();
+  guard2.addMemoryProbe({ maxHeapMB: 1, interval: 999999 }); // Very low limit → always fails
+  const failResult = await guard2.checkNow();
+  assert(failResult.healthy === false, 'Guard should be unhealthy with 1MB heap limit');
+  assert(failResult.probes.memory.healthy === false, 'Memory probe should fail');
+
+  console.log('  OK\n');
+
+  // --- Test 5: NotificationCenter ---
+  console.log('  [5] NotificationCenter...');
+  const { NotificationCenter, LogChannel, LEVELS } = require('../src/modules/runtime/notification-center');
+
+  const nc = new NotificationCenter();
+  // Log channel is registered by default
+  assert(nc.getChannels().includes('log'), 'Log channel should be registered by default');
+
+  // Send notification
+  await nc.info('Test Info', 'This is a test info message', 'test');
+  await nc.warn('Test Warn', 'This is a test warning', 'test');
+  await nc.error('Test Error', 'This is a test error', 'test');
+  await nc.critical('Test Critical', 'This is a test critical', 'test');
+
+  const ncStats = nc.getStats();
+  assert(ncStats.totalSent >= 4, 'Should have sent at least 4 notifications');
+
+  // Dedup test
+  const nc2 = new NotificationCenter();
+  await nc2.error('Same Error', 'Same message', 'same-source');
+  await nc2.error('Same Error', 'Same message', 'same-source'); // Should be deduped
+  assert(nc2.getStats().totalSent === 1, 'Duplicate notification should be deduped');
+
+  // Level filtering: log channel has minLevel INFO, so INFO should pass
+  const nc3 = new NotificationCenter();
+  // Register a channel with high min level
+  const { Channel } = require('../src/modules/runtime/notification-center');
+  class TestChannel extends Channel {
+    constructor() { super('test', { minLevel: LEVELS.ERROR }); this.received = []; }
+    async send(n) { this.received.push(n); this._sentCount++; return true; }
+  }
+  const tc = new TestChannel();
+  nc3.registerChannel(tc);
+  await nc3.info('Info', 'info msg', 'test'); // Should NOT reach test channel
+  await nc3.error('Error', 'error msg', 'test'); // Should reach test channel
+  assert(tc.received.length === 1, 'Test channel should only receive ERROR, not INFO');
+
+  console.log('  OK\n');
+
+  // --- Test 6: SchemaGatekeeper ---
+  console.log('  [6] SchemaGatekeeper...');
+  const { gatekeeper, LAYERS } = require('../src/modules/runtime/schema-gatekeeper');
+
+  // Valid data
+  const validData = { name: 'test', age: 25 };
+  const validSchema = { required: ['name'], properties: { name: 'string', age: 'number' } };
+  const validResult = gatekeeper.validate(validData, validSchema, { direction: 'request' });
+  assert(validResult.passed === true, 'Valid data should pass validation');
+
+  // Missing required field
+  const missingData = { age: 25 };
+  const missingResult = gatekeeper.validate(missingData, validSchema, { direction: 'request' });
+  assert(missingResult.passed === false, 'Missing required field should fail');
+  assert(missingResult.rejections.length > 0, 'Should have rejection details');
+
+  // Type mismatch
+  const badTypeData = { name: 123, age: 'twenty' };
+  const badTypeResult = gatekeeper.validate(badTypeData, validSchema, { direction: 'request' });
+  assert(badTypeResult.passed === false, 'Type mismatch should fail');
+
+  // SQL injection
+  const sqlData = { query: "'; DROP TABLE users; --" };
+  const sqlResult = gatekeeper.validate(sqlData, null, { direction: 'request' });
+  assert(sqlResult.passed === false, 'SQL injection should be rejected');
+
+  // XSS
+  const xssData = { html: '<script>alert(1)</script>' };
+  const xssResult = gatekeeper.validate(xssData, null, { direction: 'request' });
+  assert(xssResult.passed === false, 'XSS should be rejected');
+
+  // Path traversal
+  const pathData = { file: '../../../etc/passwd' };
+  const pathResult = gatekeeper.validate(pathData, null, { direction: 'request' });
+  assert(pathResult.passed === false, 'Path traversal should be rejected');
+
+  // Undefined values
+  const undefData = { a: undefined, b: 'ok' };
+  const undefResult = gatekeeper.validate(undefData, null, { direction: 'request' });
+  assert(undefResult.passed === false, 'Undefined values should be rejected');
+
+  // Sensitive fields in response
+  const sensitiveData = { code: 200, data: { password: 'secret123', name: 'user' } };
+  const sensitiveResult = gatekeeper.validate(sensitiveData, null, { direction: 'response' });
+  assert(sensitiveResult.warnings.some(w => w.message.includes('Sensitive')), 'Sensitive fields should trigger warning');
+
+  // Stats
+  const gkStats = gatekeeper.getStats();
+  assert(gkStats.totalChecks >= 8, 'Should have tracked all checks');
+  assert(gkStats.ruleCount >= 13, 'Should have at least 13 rules registered');
+
+  // List rules
+  const rules = gatekeeper.listRules();
+  assert(rules.length >= 13, 'Should list all rules');
+  const layers = new Set(rules.map(r => r.layer));
+  assert(layers.has(LAYERS.SYNTAX), 'Should have syntax layer rules');
+  assert(layers.has(LAYERS.SCHEMA), 'Should have schema layer rules');
+  assert(layers.has(LAYERS.SEMANTIC), 'Should have semantic layer rules');
+  assert(layers.has(LAYERS.SECURITY), 'Should have security layer rules');
+
+  console.log('  OK\n');
+
+  // --- Test 7: Full Integration (middleware -> agent -> tool -> response) ---
+  console.log('  [7] Full Integration Flow...');
+  const { registry: sharedRegistry } = require('../src/modules/runtime/tool-registry');
+
+  // Create fresh registry for integration test
+  const intReg = new ToolRegistry();
+  await intReg.register({
+    id: 'echo.tool',
+    name: 'Echo',
+    version: '1.0.0',
+    type: MODULE_TYPES.RESIDENT,
+    category: 'test',
+    schema: {
+      input: { required: ['message'], properties: { message: 'string' } },
+      output: { required: ['reply'], properties: { reply: 'string' } },
+    },
+    handler: async (input) => ({ reply: input.message }),
+  });
+
+  const intAgent = new ChannelAgent({ registry: intReg });
+  await intAgent.init();
+  intAgent.route('echo', 'echo.tool', { priority: PRIORITY.NORMAL });
+
+  // Build middleware chain
+  const intMiddleware = compose([
+    errorHandler(),
+    requestLogger(),
+    rateLimiter({ windowMs: 60000, max: 100 }),
+  ]);
+
+  // Simulate a full request
+  const intReqBody = {
+    protocol: PROTOCOL_VERSION,
+    seq: 100,
+    action: 'echo',
+    timestamp: Date.now(),
+    payload: { message: 'integration test' },
+  };
+
+  const intCtx = {
+    body: intReqBody,
+    ip: '192.168.1.1',
+    headers: {},
+  };
+
+  let intResponse = null;
+  await intMiddleware(intCtx, async () => {
+    intResponse = await intAgent.handleRequest(intReqBody, intCtx);
+  });
+
+  assert(intResponse !== null, 'Should get a response from integration flow');
+  assert(intResponse.code === 200, 'Integration response should be 200');
+  assert(intResponse.data.reply === 'integration test', 'Integration response should contain echo');
+
+  // Verify learning tracked it
+  const intReport = intAgent.getLearningReport();
+  assert(intReport.totalRequests >= 1, 'Learning should track integration request');
+  assert(intReport.totalErrors === 0, 'Should have no errors in integration flow');
+
+  intAgent.destroy();
+
+  console.log('  OK\n');
+
+  // --- Summary ---
+  console.log('  ===================================');
+  console.log(`  Layer 2 Tests: ${passed} passed, ${failed} failed\n`);
+
+  if (failed > 0) {
+    console.log('  Failures:');
+    failures.forEach(f => console.log(`    - ${f}`));
+    console.log('');
+  }
+
+  return { passed, failed };
+}
+
+// Run
+runTests().then(({ passed, failed }) => {
+  process.exit(failed > 0 ? 1 : 0);
+}).catch(err => {
+  console.error('Test runner error:', err);
+  process.exit(1);
+});

package/tests/test-new-rules.js

@@ -0,0 +1,157 @@
+// Test file to verify new security and performance rules trigger correctly
+const fs = require('fs');
+const path = require('path');
+const { execSync } = require('child_process');
+
+let passed = 0;
+let failed = 0;
+
+function assert(condition, msg) {
+  if (condition) {
+    console.log('  OK - ' + msg);
+    passed++;
+  } else {
+    console.log('  FAIL - ' + msg);
+    failed++;
+  }
+}
+
+// Sample code with security issues
+const securityTestCode = `
+const crypto = require('crypto');
+const { exec } = require('child_process');
+
+// sec-eval-usage
+function parseConfig(str) {
+  return eval(str);
+}
+
+// sec-sql-injection
+function getUser(name) {
+  const query = \`SELECT * FROM users WHERE name = '\${name}'\`;
+  return db.query(query);
+}
+
+// sec-hardcoded-secrets
+const apiKey = 'sk-1234567890abcdef1234567890abcdef';
+const password = 'supersecret123';
+
+// sec-command-injection
+function runCommand(userInput) {
+  exec('ls ' + userInput, (err, stdout) => {});
+}
+
+// sec-insecure-crypto
+function hashPassword(pwd) {
+  return crypto.createHash('md5').update(pwd).digest('hex');
+}
+
+// sec-xss-risk
+function renderContent(userInput) {
+  document.getElementById('output').innerHTML = userInput;
+}
+
+// sec-proto-pollution
+function mergeConfig(userBody) {
+  return Object.assign({}, JSON.parse(userBody));
+}
+`;
+
+// Sample code with performance issues
+const perfTestCode = `
+const fs = require('fs');
+const path = require('path');
+
+// perf-sync-io-in-async
+async function readFile(filePath) {
+  const content = fs.readFileSync(filePath, 'utf-8');
+  return content;
+}
+
+// perf-n-plus-1
+async function processUsers(users) {
+  for (const user of users) {
+    const profile = await fetchProfile(user.id);
+    console.log(profile);
+  }
+}
+
+// perf-string-concat-loop
+function buildHTML(items) {
+  let html = '';
+  for (const item of items) {
+    html += '<li>' + item + '</li>';
+  }
+  return html;
+}
+
+// perf-regex-in-loop
+function validateAll(inputs) {
+  for (const input of inputs) {
+    const re = new RegExp('^[a-z]+$');
+    if (!re.test(input)) return false;
+  }
+  return true;
+}
+
+// perf-json-parse-unsafe
+function parseData(raw) {
+  const data = JSON.parse(raw);
+  return data;
+}
+
+// perf-no-pagination
+async function getAllUsers() {
+  const users = await User.find({});
+  return users;
+}
+`;
+
+console.log('\n[22] new security and performance rules...');
+
+// Run check on the test code
+const { engine } = require('../src/core/rule-engine');
+const { codeQualityRules } = require('../src/modules/dev-time/code-quality-guard');
+
+engine.registerBatch(codeQualityRules);
+
+const ctx = {
+  files: [
+    { path: 'security-sample.js', content: securityTestCode },
+    { path: 'perf-sample.js', content: perfTestCode },
+  ],
+  projectRoot: '.',
+  config: {},
+};
+
+const { findings } = engine.run(ctx);
+
+// Check each new rule
+const ruleIds = findings.map(f => f.ruleId);
+
+assert(ruleIds.includes('sec-eval-usage'), 'sec-eval-usage triggers on eval()');
+assert(ruleIds.includes('sec-sql-injection'), 'sec-sql-injection triggers on string concat SQL');
+assert(ruleIds.includes('sec-hardcoded-secrets'), 'sec-hardcoded-secrets triggers on hardcoded API key');
+assert(ruleIds.includes('sec-command-injection'), 'sec-command-injection triggers on exec + concat');
+assert(ruleIds.includes('sec-insecure-crypto'), 'sec-insecure-crypto triggers on MD5');
+assert(ruleIds.includes('sec-xss-risk'), 'sec-xss-risk triggers on innerHTML');
+assert(ruleIds.includes('sec-proto-pollution'), 'sec-proto-pollution triggers on Object.assign + user input');
+
+assert(ruleIds.includes('perf-sync-io-in-async'), 'perf-sync-io-in-async triggers on readFileSync in async');
+assert(ruleIds.includes('perf-n-plus-1'), 'perf-n-plus-1 triggers on await in loop');
+assert(ruleIds.includes('perf-string-concat-loop'), 'perf-string-concat-loop triggers on += in loop');
+assert(ruleIds.includes('perf-regex-in-loop'), 'perf-regex-in-loop triggers on new RegExp in loop');
+assert(ruleIds.includes('perf-json-parse-unsafe'), 'perf-json-parse-unsafe triggers on JSON.parse without try/catch');
+assert(ruleIds.includes('perf-no-pagination'), 'perf-no-pagination triggers on find() without limit');
+
+// Verify security rules have severity 'block'
+const blockSecFindings = findings.filter(f => f.category === 'security' && f.severity === 'block');
+assert(blockSecFindings.length >= 4, 'at least 4 security BLOCK findings (eval, sql, secrets, cmd injection, xss)');
+
+// Verify performance rules have correct severity
+const perfFindings = findings.filter(f => f.category === 'performance');
+assert(perfFindings.length >= 5, 'at least 5 performance findings');
+
+console.log('  ' + findings.length + ' total findings from new rules');
+console.log('');
+console.log('  ' + passed + ' passed, ' + failed + ' failed');