qa-engineer 0.9.2 → 0.10.0

package/shared/analysis/lib/qa_analysis/evidence.py

@@ -1,128 +0,0 @@
-"""The evidence and finding model shared by every analyzer.
-
-Every finding an analyzer produces carries the same structure, so downstream
-skills (qa-debug, qa-report, qa-fix) consume one shape regardless of which
-analyzer or framework produced it. Text fields are redacted at construction.
-"""
-
-from dataclasses import dataclass, field, asdict
-from datetime import datetime, timezone
-
-from .redaction import redact_text
-
-EVIDENCE_TYPES = {
-    "trace", "har", "junit", "report", "console", "network", "stdout",
-    "stderr", "screenshot", "video", "log", "file", "diff",
-}
-
-
-def utc_now():
-    """ISO 8601 UTC timestamp. Isolated so tests can monkeypatch it."""
-    return datetime.now(timezone.utc).isoformat()
-
-
-@dataclass
-class Evidence:
-    """One observation supporting a finding. Excerpts are redacted."""
-    type: str
-    description: str
-    source: str
-    excerpt: str = ""
-
-    def __post_init__(self):
-        if self.type not in EVIDENCE_TYPES:
-            raise ValueError(f"unknown evidence type: {self.type}")
-        self.excerpt = redact_text(self.excerpt)
-
-    def to_dict(self):
-        data = {"type": self.type, "description": self.description, "source": self.source}
-        if self.excerpt:
-            data["excerpt"] = self.excerpt
-        return data
-
-
-@dataclass
-class Finding:
-    """A single diagnostic conclusion, traceable to a specific artifact.
-
-    Carries everything the evidence model requires: the artifact and location
-    it came from, when, why, the supporting evidence, a calibrated confidence,
-    the affected tests, related artifacts, and recommended actions.
-    """
-    classification: str
-    reason: str
-    artifact: str
-    location: str
-    confidence: float = None
-    timestamp: str = field(default_factory=utc_now)
-    evidence: list = field(default_factory=list)
-    affected_tests: list = field(default_factory=list)
-    related_artifacts: list = field(default_factory=list)
-    recommendations: list = field(default_factory=list)
-
-    def to_dict(self):
-        data = {
-            "classification": self.classification,
-            "reason": self.reason,
-            "artifact": self.artifact,
-            "location": self.location,
-            "timestamp": self.timestamp,
-            "evidence": [e.to_dict() if isinstance(e, Evidence) else e for e in self.evidence],
-            "affectedTests": self.affected_tests,
-            "relatedArtifacts": self.related_artifacts,
-            "recommendations": self.recommendations,
-        }
-        if self.confidence is not None:
-            data["confidence"] = self.confidence
-        return data
-
-
-@dataclass
-class AnalyzerOutput:
-    """The envelope an analyzer emits: findings plus the artifacts it examined.
-
-    A downstream skill wraps this in its own output contract; on its own it is
-    the deterministic, machine-readable result of one analysis.
-    """
-    analyzer: str
-    findings: list = field(default_factory=list)
-    artifacts: list = field(default_factory=list)
-    warnings: list = field(default_factory=list)
-    generated_at: str = field(default_factory=utc_now)
-
-    def to_dict(self):
-        return {
-            "analyzer": self.analyzer,
-            "generatedAt": self.generated_at,
-            "findings": [f.to_dict() if isinstance(f, Finding) else f for f in self.findings],
-            "artifacts": [a.to_dict() if hasattr(a, "to_dict") else a for a in self.artifacts],
-            "warnings": self.warnings,
-        }
-
-
-@dataclass
-class Artifact:
-    """A discovered artifact, in the common model shared with the execution engine."""
-    type: str
-    location: str
-    framework: str = "unknown"
-    ownership: str = "qa-analysis"
-    timestamp: str = field(default_factory=utc_now)
-    media_type: str = ""
-    test_ref: str = ""
-    present: bool = True
-
-    def to_dict(self):
-        data = {
-            "type": self.type,
-            "location": self.location,
-            "framework": self.framework,
-            "timestamp": self.timestamp,
-            "ownership": self.ownership,
-            "present": self.present,
-        }
-        if self.media_type:
-            data["mediaType"] = self.media_type
-        if self.test_ref:
-            data["testRef"] = self.test_ref
-        return data

package/shared/analysis/lib/qa_analysis/har.py

@@ -1,87 +0,0 @@
-"""HAR (HTTP Archive) parser.
-
-Framework-agnostic: a HAR is a standard JSON format, whoever produced it.
-Extracts request outcomes, flags failures and slow calls, and redacts headers
-and credentialed URLs before anything is exposed. A malformed HAR raises.
-"""
-
-import json
-
-from .redaction import redact_text, redact_headers
-from .junit import MalformedArtifact
-
-
-def parse_har(path, slow_ms=1000):
-    """Parse a HAR file into a redacted network summary.
-
-    Returns {entries, failures, slow, redacted: True}, where each entry is
-    {method, url, status, durationMs, headersRedacted}. Failures are entries
-    with status >= 400 or status 0 (no response). Raises MalformedArtifact on
-    unreadable input.
-    """
-    try:
-        with open(path, "r", encoding="utf-8") as handle:
-            data = json.load(handle)
-    except (json.JSONDecodeError, OSError, UnicodeDecodeError) as exc:
-        raise MalformedArtifact(f"could not parse HAR at {path}: {exc}") from exc
-
-    try:
-        raw_entries = data["log"]["entries"]
-    except (KeyError, TypeError) as exc:
-        raise MalformedArtifact(f"not a HAR document at {path}") from exc
-
-    # The shape has to be checked, not assumed. `log.entries` being a *string*
-    # satisfies the subscripting above, and iterating it then yields characters,
-    # so the parser died on `'str' object has no attribute 'get'` — an
-    # AttributeError, which the CLI does not catch, so the caller got a traceback
-    # instead of the documented exit 2. Found by the Node port's parity gate.
-    if not isinstance(raw_entries, list):
-        raise MalformedArtifact(f"HAR log.entries is not a list at {path}")
-
-    entries = []
-    for item in raw_entries:
-        if not isinstance(item, dict):
-            raise MalformedArtifact(f"HAR log.entries contains a non-object at {path}")
-        request = item.get("request") or {}
-        response = item.get("response") or {}
-        status = _int(response.get("status"))
-        entry = {
-            "method": request.get("method", ""),
-            # Redaction strips any credentials embedded in the URL.
-            "url": redact_text(request.get("url", "")),
-            "status": status,
-            "durationMs": _millis(item.get("time"), path),
-            "requestHeaders": redact_headers(request.get("headers", [])),
-            "responseHeaders": redact_headers(response.get("headers", [])),
-        }
-        entries.append(entry)
-
-    failures = [e for e in entries if e["status"] == 0 or e["status"] >= 400]
-    slow = [e for e in entries if e["durationMs"] >= slow_ms]
-    return {"entries": entries, "failures": failures, "slow": slow, "redacted": True}
-
-
-def _int(value, default=0):
-    try:
-        return int(value)
-    except (TypeError, ValueError):
-        return default
-
-
-def _millis(raw, path):
-    """HAR `time` is already milliseconds, rounded to a whole number.
-
-    A value that is present but not a number raises rather than becoming 0 — the
-    same rule as the JUnit parser, and for the same reason: a fabricated duration
-    makes a malformed document look like a clean measurement. Before this, the
-    bare `float()` escaped as a ValueError and reached the caller as a traceback.
-    """
-    if raw is None or raw == "":
-        return 0
-    try:
-        value = float(raw)
-    except (TypeError, ValueError):
-        raise MalformedArtifact(f"entry time={raw!r} is not a number at {path}") from None
-    if value != value or value in (float("inf"), float("-inf")):
-        raise MalformedArtifact(f"entry time={raw!r} is not a finite number at {path}")
-    return int(round(value))

package/shared/analysis/lib/qa_analysis/junit.py

@@ -1,104 +0,0 @@
-"""JUnit XML parser.
-
-Framework-agnostic: Playwright, Selenium, Cypress, WebdriverIO, and most unit
-runners emit JUnit XML, so this one parser normalizes them all into the pack's
-per-test result shape. This is the concrete proof that different frameworks
-share one contract — only where the file lives differs, not how it is read.
-
-Parses deterministically; a malformed document raises rather than guessing.
-"""
-
-import xml.etree.ElementTree as ET
-
-from .redaction import redact_text
-
-
-class MalformedArtifact(ValueError):
-    """Raised when an artifact cannot be parsed. Never swallowed into a guess."""
-
-
-def _int(value, default=0):
-    try:
-        return int(value)
-    except (TypeError, ValueError):
-        return default
-
-
-def _duration_ms(raw, path):
-    """`time` in seconds as whole milliseconds.
-
-    An absent or empty attribute is zero — plenty of runners omit it. A value
-    that is present but not a finite number means the document is not what it
-    claims to be, so it raises: found by the Node port's parity corpus, where
-    `time="not-a-number"` escaped as a bare ValueError and `time="nan"` as
-    "cannot convert float NaN to integer". Both reached the caller as a traceback
-    and exit 1, while the CLI's documented failure mode is exit 2 with
-    {error, detail}.
-    """
-    if raw is None or raw == "":
-        return 0
-    try:
-        seconds = float(raw)
-    except (TypeError, ValueError):
-        raise MalformedArtifact(
-            f"testcase time={raw!r} is not a number at {path}"
-        ) from None
-    if seconds != seconds or seconds in (float("inf"), float("-inf")):
-        raise MalformedArtifact(f"testcase time={raw!r} is not a finite number at {path}")
-    return int(round(seconds * 1000))
-
-
-def parse_junit(path):
-    """Parse a JUnit XML file into a normalized result.
-
-    Returns a dict: {tests: {total, passed, failed, skipped}, executed: [...]}.
-    Each executed entry: {title, file, status, durationMs, message?}.
-    Raises MalformedArtifact if the XML is unreadable or not JUnit-shaped.
-    """
-    try:
-        tree = ET.parse(path)
-    except (ET.ParseError, OSError) as exc:
-        raise MalformedArtifact(f"could not parse JUnit XML at {path}: {exc}") from exc
-
-    root = tree.getroot()
-    # Accept either a <testsuites> root or a single <testsuite> root.
-    if root.tag == "testsuites":
-        suites = root.findall("testsuite")
-    elif root.tag == "testsuite":
-        suites = [root]
-    else:
-        raise MalformedArtifact(f"not a JUnit document (root <{root.tag}>) at {path}")
-
-    executed = []
-    for suite in suites:
-        for case in suite.findall("testcase"):
-            failure = case.find("failure")
-            error = case.find("error")
-            skipped = case.find("skipped")
-            if failure is not None or error is not None:
-                status = "failed"
-                node = failure if failure is not None else error
-                message = redact_text((node.get("message") or node.text or "").strip())
-            elif skipped is not None:
-                status = "skipped"
-                message = redact_text((skipped.get("message") or "").strip())
-            else:
-                status = "passed"
-                message = ""
-            entry = {
-                "title": case.get("name", ""),
-                "file": case.get("classname", ""),
-                "status": status,
-                "durationMs": _duration_ms(case.get("time"), path),
-            }
-            if message:
-                entry["message"] = message
-            executed.append(entry)
-
-    counts = {
-        "total": len(executed),
-        "passed": sum(1 for e in executed if e["status"] == "passed"),
-        "failed": sum(1 for e in executed if e["status"] == "failed"),
-        "skipped": sum(1 for e in executed if e["status"] == "skipped"),
-    }
-    return {"tests": counts, "executed": executed}

package/shared/analysis/lib/qa_analysis/redaction.py

@@ -1,107 +0,0 @@
-"""Credential, secret, token, and PII redaction.
-
-Every analyzer runs artifact text through redaction before it appears in a
-finding, a report, or stdout. Redaction happens as evidence is captured, not
-after — a secret must never reach a model's context or a log. Standard library
-only; deterministic.
-"""
-
-import re
-
-# Ordered (name, pattern, replacement). Order matters: match structured,
-# high-signal secrets (JWTs, provider keys) before generic fallbacks.
-_RULES = [
-    ("jwt", re.compile(r"eyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}")),
-    ("aws-access-key", re.compile(r"AKIA[0-9A-Z]{16}")),
-    ("github-token", re.compile(r"gh[pousr]_[A-Za-z0-9]{20,}")),
-    ("slack-token", re.compile(r"xox[baprs]-[A-Za-z0-9-]{10,}")),
-    ("openai-key", re.compile(r"sk-[A-Za-z0-9]{20,}")),
-    ("bearer", re.compile(r"(?i)\bBearer\s+[A-Za-z0-9._~+/-]+=*")),
-    # Sensitive header lines: keep the header name, mask the value.
-    #
-    # The value is `[^\r\n]+` rather than `.+$`, and the indent is `[ \t]*` rather
-    # than `\s*`, for one reason: on CRLF text, `.+` swallows the carriage return
-    # and `$` matches before the newline, so redacting a header silently rewrote
-    # the line ending to LF and corrupted the rest of the document's endings.
-    # Horizontal whitespace is also what a header indent actually is. Found by the
-    # Node port's parity corpus, where the two languages disagreed here and
-    # JavaScript was right.
-    ("auth-header", re.compile(r"(?im)^([ \t]*(?:authorization|proxy-authorization)[ \t]*[:=][ \t]*)[^\r\n]+")),
-    ("cookie-header", re.compile(r"(?im)^([ \t]*(?:set-cookie|cookie)[ \t]*[:=][ \t]*)[^\r\n]+")),
-    # Secret-like assignments: key=value / "key": "value".
-    ("assigned-secret", re.compile(
-        r'(?i)(\b(?:password|passwd|pwd|secret|token|api[_-]?key|access[_-]?key|client[_-]?secret)\b\s*[:=]\s*["\']?)'
-        r'([^\s"\'&]{4,})')),
-    # Credentials in URLs and query strings.
-    ("url-credential", re.compile(r"(?i)(://[^:/@\s]+:)([^@/\s]+)(@)")),
-    ("query-secret", re.compile(
-        r"(?i)([?&](?:password|passwd|pwd|token|secret|api[_-]?key|access[_-]?key)=)([^&\s#]+)")),
-    # PII: email addresses.
-    ("email", re.compile(r"\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b")),
-]
-
-# Rules whose replacement preserves a leading captured group (the label/prefix).
-_PREFIX_PRESERVING = {
-    "auth-header": r"\1[REDACTED:auth-header]",
-    "cookie-header": r"\1[REDACTED:cookie-header]",
-    "assigned-secret": r"\1[REDACTED:secret]",
-    "url-credential": r"\1[REDACTED:credential]\3",
-    "query-secret": r"\1[REDACTED:secret]",
-}
-
-
-def redact_text(text):
-    """Return text with every recognized secret or PII value masked."""
-    if not text:
-        return text
-    result = text
-    for name, pattern in _RULES:
-        if name in _PREFIX_PRESERVING:
-            result = pattern.sub(_PREFIX_PRESERVING[name], result)
-        else:
-            result = pattern.sub(f"[REDACTED:{name}]", result)
-    return result
-
-
-def detect_secrets(text):
-    """Return a list of {type, start, end} for secrets found — never the values.
-
-    Used to decide whether an artifact is safe to expose, without surfacing the
-    secret itself.
-    """
-    findings = []
-    if not text:
-        return findings
-    for name, pattern in _RULES:
-        for match in pattern.finditer(text):
-            findings.append({"type": name, "start": match.start(), "end": match.end()})
-    findings.sort(key=lambda f: f["start"])
-    return findings
-
-
-_SENSITIVE_HEADERS = {
-    "authorization", "proxy-authorization", "cookie", "set-cookie",
-    "x-api-key", "x-auth-token", "api-key", "x-csrf-token",
-}
-
-
-def redact_headers(headers):
-    """Mask the values of sensitive HTTP headers.
-
-    Accepts a dict, or a list of {"name","value"} entries (HAR shape), and
-    returns the same shape with sensitive values replaced.
-    """
-    def mask(name, value):
-        return "[REDACTED:header]" if name.strip().lower() in _SENSITIVE_HEADERS else redact_text(value)
-
-    if isinstance(headers, dict):
-        return {k: mask(k, str(v)) for k, v in headers.items()}
-    if isinstance(headers, list):
-        out = []
-        for entry in headers:
-            if isinstance(entry, dict) and "name" in entry:
-                out.append({**entry, "value": mask(str(entry["name"]), str(entry.get("value", "")))})
-            else:
-                out.append(entry)
-        return out
-    return headers