specforge-mcp 0.2.2 → 0.4.0

package/dist/tools/generate-tests/generators/security-test-generator.js

@@ -0,0 +1,318 @@
+// tools/generate-tests/generators/security-test-generator.ts — SPEC-058b Section G
+// Generates security test scaffolds:
+// OWASP Top 10, auth flows, file upload, API rate limiting.
+const AUTH_SIGNALS = [
+    'jwt',
+    'oauth',
+    'passport',
+    'keycloak',
+    'auth0',
+    'clerk',
+    'supabase',
+    'session',
+    'cookie-session',
+    'express-session',
+    'next-auth',
+    'lucia',
+    'better-auth',
+];
+const UPLOAD_SIGNALS = [
+    'multer',
+    'formidable',
+    'busboy',
+    'sharp',
+    'jimp',
+    'imagemagick',
+    'file-upload',
+    'multipart',
+];
+export function detectAuth(knowledge) {
+    const stackLower = knowledge.stack.map((s) => s.toLowerCase());
+    for (const sig of AUTH_SIGNALS) {
+        if (stackLower.some((s) => s.includes(sig))) {
+            return sig;
+        }
+    }
+    return null;
+}
+export function detectFileUpload(knowledge) {
+    const stackLower = knowledge.stack.map((s) => s.toLowerCase());
+    for (const sig of UPLOAD_SIGNALS) {
+        if (stackLower.some((s) => s.includes(sig))) {
+            return sig;
+        }
+    }
+    return null;
+}
+export function hasPublicApi(knowledge) {
+    if (knowledge.apiContracts.length > 0) {
+        return true;
+    }
+    return knowledge.apps.some((a) => a.type === 'backend');
+}
+export function isSecurityTestProject(knowledge) {
+    if (detectAuth(knowledge) !== null) {
+        return true;
+    }
+    if (hasPublicApi(knowledge)) {
+        return true;
+    }
+    return knowledge.apps.some((a) => a.type === 'backend' || a.type === 'frontend');
+}
+export function generateSecurityTestDefs(title, testDir, _testExt, knowledge) {
+    const defs = [];
+    if (hasPublicApi(knowledge)) {
+        defs.push({
+            name: `${title} — OWASP Top 10: injection, XSS, CSRF, auth bypass`,
+            type: 'integration',
+            file: `${testDir}/security/`,
+            description: 'Verify protection against OWASP Top 10 vulnerabilities on public endpoints',
+            priority: 'critical',
+            automatable: true,
+        });
+    }
+    if (detectAuth(knowledge) !== null) {
+        defs.push({
+            name: `${title} — auth: token expiration, refresh flow, privilege escalation`,
+            type: 'integration',
+            file: `${testDir}/security/`,
+            description: 'Verify auth token lifecycle, refresh flow, and privilege escalation prevention',
+            priority: 'critical',
+            automatable: true,
+        });
+    }
+    if (detectFileUpload(knowledge) !== null) {
+        defs.push({
+            name: `${title} — file upload: type validation, size limits, path traversal`,
+            type: 'integration',
+            file: `${testDir}/security/`,
+            description: 'Verify file upload security: type validation, size limits, path traversal prevention',
+            priority: 'high',
+            automatable: true,
+        });
+    }
+    if (hasPublicApi(knowledge)) {
+        defs.push({
+            name: `${title} — API security: rate limiting, CORS, API key rotation`,
+            type: 'integration',
+            file: `${testDir}/security/`,
+            description: 'Verify rate limiting effectiveness, CORS policy, and API key rotation support',
+            priority: 'high',
+            automatable: true,
+        });
+    }
+    return defs;
+}
+// ---------------------------------------------------------------------------
+// Scaffold builders
+// ---------------------------------------------------------------------------
+function buildTsSecurityTest(title, auth, upload, publicApi) {
+    const owaspSection = publicApi
+        ? `
+  describe('OWASP Top 10', () => {
+    it('rejects SQL injection in query parameters', async () => {
+      // const res = await request(app).get("/api/users?id=' OR 1=1 --");
+      // expect(res.status).toBe(400);
+      expect(true).toBe(true);
+    });
+
+    it('escapes XSS payloads in response', async () => {
+      // const res = await request(app).post('/api/comments')
+      //   .send({ body: '<script>alert("xss")</script>' });
+      // expect(res.body.body).not.toContain('<script>');
+      expect(true).toBe(true);
+    });
+
+    it('validates CSRF token on state-changing requests', async () => {
+      expect(true).toBe(true);
+    });
+
+    it('rejects auth bypass attempts', async () => {
+      expect(true).toBe(true);
+    });
+  });
+`
+        : '';
+    const authSection = auth
+        ? `
+  describe('Authentication (${auth})', () => {
+    it('rejects expired token with 401', async () => {
+      // const expiredToken = signToken({ exp: Math.floor(Date.now()/1000) - 60 });
+      // const res = await request(app).get('/api/me').set('Authorization', \`Bearer \${expiredToken}\`);
+      // expect(res.status).toBe(401);
+      expect(true).toBe(true);
+    });
+
+    it('refresh token returns new access token', async () => {
+      expect(true).toBe(true);
+    });
+
+    it('prevents privilege escalation (user cannot access admin)', async () => {
+      expect(true).toBe(true);
+    });
+
+    it('prevents session fixation attack', async () => {
+      expect(true).toBe(true);
+    });
+  });
+`
+        : '';
+    const uploadSection = upload
+        ? `
+  describe('File upload (${upload})', () => {
+    it('rejects disallowed file types', async () => {
+      // const res = await request(app).post('/api/upload')
+      //   .attach('file', Buffer.from('#!/bin/sh'), { filename: 'evil.sh' });
+      // expect(res.status).toBe(400);
+      expect(true).toBe(true);
+    });
+
+    it('enforces maximum file size', async () => {
+      expect(true).toBe(true);
+    });
+
+    it('prevents path traversal in filename', async () => {
+      // filename: '../../etc/passwd' → should be sanitized
+      expect(true).toBe(true);
+    });
+
+    it('scans for malicious content', async () => {
+      expect(true).toBe(true);
+    });
+  });
+`
+        : '';
+    const apiSection = publicApi
+        ? `
+  describe('API security', () => {
+    it('rate limiter blocks excessive requests', async () => {
+      // for (let i = 0; i < 101; i++) await request(app).get('/api/data');
+      // const res = await request(app).get('/api/data');
+      // expect(res.status).toBe(429);
+      expect(true).toBe(true);
+    });
+
+    it('CORS rejects requests from unauthorized origins', async () => {
+      expect(true).toBe(true);
+    });
+
+    it('supports API key rotation without downtime', async () => {
+      expect(true).toBe(true);
+    });
+  });
+`
+        : '';
+    return `// Security tests for: ${title}
+// Generated by SpecForge SDD MCP Server (SPEC-058b)
+import { describe, it, expect } from 'vitest';
+
+describe('${title} — Security Tests', () => {
+${owaspSection}${authSection}${uploadSection}${apiSection}});
+`;
+}
+function buildPythonSecurityTest(title, auth, upload, publicApi) {
+    const cls = title.replace(/[^a-zA-Z0-9]/g, '');
+    const owaspSection = publicApi
+        ? `
+    def test_sql_injection_rejected(self) -> None:
+        """SQL injection in query parameters is rejected."""
+        # response = client.get("/api/users?id=' OR 1=1 --")
+        # assert response.status_code == 400
+        pass
+
+    def test_xss_payload_escaped(self) -> None:
+        """XSS payloads are escaped in response."""
+        pass
+
+    def test_csrf_token_validated(self) -> None:
+        """CSRF token is required on state-changing requests."""
+        pass
+
+    def test_auth_bypass_rejected(self) -> None:
+        """Auth bypass attempts are rejected."""
+        pass
+`
+        : '';
+    const authSection = auth
+        ? `
+    def test_expired_token_returns_401(self) -> None:
+        """Expired token is rejected with 401."""
+        pass
+
+    def test_refresh_token_returns_new_access_token(self) -> None:
+        """Refresh token flow issues a new access token."""
+        pass
+
+    def test_privilege_escalation_prevented(self) -> None:
+        """User cannot access admin-only endpoints."""
+        pass
+
+    def test_session_fixation_prevented(self) -> None:
+        """Session fixation attack is prevented."""
+        pass
+`
+        : '';
+    const uploadSection = upload
+        ? `
+    def test_disallowed_file_type_rejected(self) -> None:
+        """Disallowed file types are rejected on upload."""
+        pass
+
+    def test_max_file_size_enforced(self) -> None:
+        """Files exceeding size limit are rejected."""
+        pass
+
+    def test_path_traversal_in_filename_prevented(self) -> None:
+        """Path traversal in filename is sanitized."""
+        pass
+
+    def test_malicious_content_detected(self) -> None:
+        """Malicious file content is detected and rejected."""
+        pass
+`
+        : '';
+    const apiSection = publicApi
+        ? `
+    def test_rate_limiter_blocks_excess(self) -> None:
+        """Rate limiter returns 429 after threshold."""
+        pass
+
+    def test_cors_rejects_unauthorized_origin(self) -> None:
+        """CORS policy rejects requests from unauthorized origins."""
+        pass
+
+    def test_api_key_rotation_supported(self) -> None:
+        """API key rotation works without downtime."""
+        pass
+`
+        : '';
+    return `"""Security tests for: ${title}
+Generated by SpecForge SDD MCP Server (SPEC-058b).
+"""
+import pytest
+
+
+class Test${cls}Security:
+    """Security test suite for ${title}."""
+${owaspSection}${authSection}${uploadSection}${apiSection}`;
+}
+export function generateSecurityTestFiles(spec, testDir, framework, language, testExt, autoGenerate, knowledge) {
+    const auth = detectAuth(knowledge);
+    const upload = detectFileUpload(knowledge);
+    const publicApi = hasPublicApi(knowledge);
+    const isPython = language === 'python';
+    const ext = isPython ? 'py' : testExt;
+    const fw = isPython ? 'pytest' : framework;
+    const content = isPython
+        ? buildPythonSecurityTest(spec.title, auth, upload, publicApi)
+        : buildTsSecurityTest(spec.title, auth, upload, publicApi);
+    return [
+        {
+            path: `${testDir}/security/${spec.slug}.security.test.${ext}`,
+            framework: fw,
+            content,
+            ready: autoGenerate,
+        },
+    ];
+}
+//# sourceMappingURL=security-test-generator.js.map

package/dist/tools/generate-tests/generators/security-test-generator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-test-generator.js","sourceRoot":"","sources":["../../../../src/tools/generate-tests/generators/security-test-generator.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,qCAAqC;AACrC,4DAA4D;AAI5D,MAAM,YAAY,GAAG;IACnB,KAAK;IACL,OAAO;IACP,UAAU;IACV,UAAU;IACV,OAAO;IACP,OAAO;IACP,UAAU;IACV,SAAS;IACT,gBAAgB;IAChB,iBAAiB;IACjB,WAAW;IACX,OAAO;IACP,aAAa;CACd,CAAC;AACF,MAAM,cAAc,GAAG;IACrB,QAAQ;IACR,YAAY;IACZ,QAAQ;IACR,OAAO;IACP,MAAM;IACN,aAAa;IACb,aAAa;IACb,WAAW;CACZ,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,SAA2B;IACpD,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/D,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5C,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAA2B;IAC1D,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/D,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5C,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,SAA2B;IACtD,IAAI,SAAS,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,SAA2B;IAC/D,IAAI,UAAU,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,KAAa,EACb,OAAe,EACf,QAAgB,EAChB,SAA2B;IAE3B,MAAM,IAAI,GAAqB,EAAE,CAAC;IAElC,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,GAAG,KAAK,oDAAoD;YAClE,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,GAAG,OAAO,YAAY;YAC5B,WAAW,EAAE,4EAA4E;YACzF,QAAQ,EAAE,UAAU;YACpB,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,UAAU,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,GAAG,KAAK,+DAA+D;YAC7E,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,GAAG,OAAO,YAAY;YAC5B,WAAW,EAAE,gFAAgF;YAC7F,QAAQ,EAAE,UAAU;YACpB,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,gBAAgB,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,GAAG,KAAK,8DAA8D;YAC5E,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,GAAG,OAAO,YAAY;YAC5B,WAAW,EACT,sFAAsF;YACxF,QAAQ,EAAE,MAAM;YAChB,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,GAAG,KAAK,wDAAwD;YACtE,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,GAAG,OAAO,YAAY;YAC5B,WAAW,EAAE,+EAA+E;YAC5F,QAAQ,EAAE,MAAM;YAChB,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,SAAS,mBAAmB,CAC1B,KAAa,EACb,IAAmB,EACnB,MAAqB,EACrB,SAAkB;IAElB,MAAM,YAAY,GAAG,SAAS;QAC5B,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;CAuBL;QACG,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,WAAW,GAAG,IAAI;QACtB,CAAC,CAAC;8BACwB,IAAI;;;;;;;;;;;;;;;;;;;;CAoBjC;QACG,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,aAAa,GAAG,MAAM;QAC1B,CAAC,CAAC;2BACqB,MAAM;;;;;;;;;;;;;;;;;;;;;CAqBhC;QACG,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,UAAU,GAAG,SAAS;QAC1B,CAAC,CAAC;;;;;;;;;;;;;;;;;CAiBL;QACG,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO,0BAA0B,KAAK;;;;YAI5B,KAAK;EACf,YAAY,GAAG,WAAW,GAAG,aAAa,GAAG,UAAU;CACxD,CAAC;AACF,CAAC;AAED,SAAS,uBAAuB,CAC9B,KAAa,EACb,IAAmB,EACnB,MAAqB,EACrB,SAAkB;IAElB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,SAAS;QAC5B,CAAC,CAAC;;;;;;;;;;;;;;;;;;CAkBL;QACG,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,WAAW,GAAG,IAAI;QACtB,CAAC,CAAC;;;;;;;;;;;;;;;;CAgBL;QACG,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,aAAa,GAAG,MAAM;QAC1B,CAAC,CAAC;;;;;;;;;;;;;;;;CAgBL;QACG,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,UAAU,GAAG,SAAS;QAC1B,CAAC,CAAC;;;;;;;;;;;;CAYL;QACG,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO,0BAA0B,KAAK;;;;;;YAM5B,GAAG;iCACkB,KAAK;EACpC,YAAY,GAAG,WAAW,GAAG,aAAa,GAAG,UAAU,EAAE,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,IAAqC,EACrC,OAAe,EACf,SAAiB,EACjB,QAAgB,EAChB,OAAe,EACf,YAAqB,EACrB,SAA2B;IAE3B,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,QAAQ,KAAK,QAAQ,CAAC;IACvC,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;IACtC,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3C,MAAM,OAAO,GAAG,QAAQ;QACtB,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC;QAC9D,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAE7D,OAAO;QACL;YACE,IAAI,EAAE,GAAG,OAAO,aAAa,IAAI,CAAC,IAAI,kBAAkB,GAAG,EAAE;YAC7D,SAAS,EAAE,EAAE;YACb,OAAO;YACP,KAAK,EAAE,YAAY;SACpB;KACF,CAAC;AACJ,CAAC"}

package/dist/tools/generate-tests/generators/visual-regression-generator.d.ts

@@ -0,0 +1,19 @@
+import type { ProjectKnowledge, TestDefinition, TestFile } from '../../../types/index.js';
+/**
+ * Returns true when the project has at least one frontend/fullstack app with a UI framework.
+ */
+export declare function isVisualRegressionProject(knowledge: ProjectKnowledge): boolean;
+declare function hasDarkModeSupport(knowledge: ProjectKnowledge): boolean;
+/**
+ * Generate visual regression test definitions.
+ */
+export declare function generateVisualRegressionTestDefs(title: string, testDir: string, _testExt: string): TestDefinition[];
+/**
+ * Generate visual regression test files for the given spec.
+ */
+export declare function generateVisualRegressionTestFiles(spec: {
+    title: string;
+    slug: string;
+}, testDir: string, framework: string, language: string, testExt: string, autoGenerate: boolean): TestFile[];
+export { hasDarkModeSupport };
+//# sourceMappingURL=visual-regression-generator.d.ts.map

package/dist/tools/generate-tests/generators/visual-regression-generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"visual-regression-generator.d.ts","sourceRoot":"","sources":["../../../../src/tools/generate-tests/generators/visual-regression-generator.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAuC1F;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,gBAAgB,GAAG,OAAO,CAiB9E;AAED,iBAAS,kBAAkB,CAAC,SAAS,EAAE,gBAAgB,GAAG,OAAO,CAGhE;AAED;;GAEG;AACH,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,cAAc,EAAE,CA4ClB;AAsMD;;GAEG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACrC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,OAAO,GACpB,QAAQ,EAAE,CAaZ;AAGD,OAAO,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/tools/generate-tests/generators/visual-regression-generator.js

@@ -0,0 +1,304 @@
+// tools/generate-tests/generators/visual-regression-generator.ts — SPEC-058a Section C
+// Generates visual regression and frontend screenshot test scaffolds.
+const UI_FRAMEWORKS = [
+    'react',
+    'vue',
+    'angular',
+    'svelte',
+    'next',
+    'nextjs',
+    'next.js',
+    'nuxt',
+    'sveltekit',
+    'svelte-kit',
+    'solid',
+    'solidjs',
+    'preact',
+    'qwik',
+    'remix',
+    'gatsby',
+    'astro',
+];
+const DARK_MODE_SIGNALS = [
+    'tailwind',
+    'shadcn',
+    'radix',
+    'mui',
+    'chakra',
+    'mantine',
+    'daisy',
+    'daisyui',
+    'styled-components',
+    'emotion',
+];
+const BP_MOBILE = { label: 'mobile', width: 375, height: 812 };
+const BP_TABLET = { label: 'tablet', width: 768, height: 1024 };
+const BP_DESKTOP = { label: 'desktop', width: 1280, height: 800 };
+/**
+ * Returns true when the project has at least one frontend/fullstack app with a UI framework.
+ */
+export function isVisualRegressionProject(knowledge) {
+    const frontendApps = knowledge.apps.filter((app) => app.type === 'frontend');
+    for (const app of frontendApps) {
+        const fw = (app.framework ?? '').toLowerCase();
+        if (UI_FRAMEWORKS.some((uif) => fw.includes(uif))) {
+            return true;
+        }
+    }
+    // Fall back to top-level framework when no frontend apps matched
+    if (frontendApps.length === 0) {
+        const topFw = (knowledge.framework ?? '').toLowerCase();
+        return UI_FRAMEWORKS.some((uif) => topFw.includes(uif));
+    }
+    return false;
+}
+function hasDarkModeSupport(knowledge) {
+    const stackLower = knowledge.stack.map((s) => s.toLowerCase());
+    return DARK_MODE_SIGNALS.some((sig) => stackLower.some((s) => s.includes(sig)));
+}
+/**
+ * Generate visual regression test definitions.
+ */
+export function generateVisualRegressionTestDefs(title, testDir, _testExt) {
+    const defs = [
+        {
+            name: `${title} — Visual: screenshot baseline matches approved snapshot`,
+            type: 'e2e',
+            file: `${testDir}/visual/`,
+            description: 'Capture full-page screenshot and compare against approved baseline snapshot — fails on unexpected visual changes',
+            priority: 'critical',
+            automatable: true,
+        },
+        {
+            name: `${title} — Visual: responsive layout at 375px, 768px, 1280px`,
+            type: 'e2e',
+            file: `${testDir}/visual/`,
+            description: 'Verify layout integrity across mobile (375px), tablet (768px), and desktop (1280px) breakpoints',
+            priority: 'high',
+            automatable: true,
+        },
+        {
+            name: `${title} — Visual: component renders without layout shift`,
+            type: 'unit',
+            file: `${testDir}/visual/`,
+            description: 'Component snapshot test — verify no unintended style or markup changes in isolated render',
+            priority: 'medium',
+            automatable: true,
+        },
+    ];
+    // Dark mode def added unconditionally — caller controls knowledge, but we always include it
+    // since isVisualRegressionProject already filtered for UI projects that commonly support dark mode
+    defs.push({
+        name: `${title} — Visual: dark mode toggle does not break layout`,
+        type: 'e2e',
+        file: `${testDir}/visual/`,
+        description: 'Toggle dark/light mode and verify screenshot matches approved dark-mode snapshot without overflow or invisible text',
+        priority: 'medium',
+        automatable: true,
+    });
+    return defs;
+}
+// === Language-specific content generators ===
+function generatePlaywrightTest(title, slug) {
+    return `// Visual regression tests for ${title}
+// Requires: @playwright/test with --update-snapshots for initial baseline
+import { test, expect } from '@playwright/test';
+
+const BASE_URL = process.env.BASE_URL ?? 'http://localhost:3000';
+
+test.describe('${title} — Visual Regression', () => {
+  test('full-page screenshot matches baseline', async ({ page }) => {
+    await page.goto(BASE_URL);
+    await page.waitForLoadState('networkidle');
+    await expect(page).toHaveScreenshot('${slug}-baseline.png', {
+      fullPage: true,
+      maxDiffPixelRatio: 0.02,
+    });
+  });
+
+  test('responsive — mobile 375px', async ({ page }) => {
+    await page.setViewportSize({ width: ${BP_MOBILE.width}, height: ${BP_MOBILE.height} });
+    await page.goto(BASE_URL);
+    await page.waitForLoadState('networkidle');
+    await expect(page).toHaveScreenshot('${slug}-mobile.png', {
+      maxDiffPixelRatio: 0.02,
+    });
+  });
+
+  test('responsive — tablet 768px', async ({ page }) => {
+    await page.setViewportSize({ width: ${BP_TABLET.width}, height: ${BP_TABLET.height} });
+    await page.goto(BASE_URL);
+    await page.waitForLoadState('networkidle');
+    await expect(page).toHaveScreenshot('${slug}-tablet.png', {
+      maxDiffPixelRatio: 0.02,
+    });
+  });
+
+  test('responsive — desktop 1280px', async ({ page }) => {
+    await page.setViewportSize({ width: ${BP_DESKTOP.width}, height: ${BP_DESKTOP.height} });
+    await page.goto(BASE_URL);
+    await page.waitForLoadState('networkidle');
+    await expect(page).toHaveScreenshot('${slug}-desktop.png', {
+      maxDiffPixelRatio: 0.02,
+    });
+  });
+
+  test('component renders without layout shift', async ({ page }) => {
+    await page.goto(\`\${BASE_URL}/components\`);
+    // TODO: navigate to your component preview/Storybook URL
+    await page.waitForLoadState('networkidle');
+    await expect(page).toHaveScreenshot('${slug}-component.png');
+  });
+
+  test('dark mode toggle does not break layout', async ({ page }) => {
+    await page.goto(BASE_URL);
+    await page.waitForLoadState('networkidle');
+    // TODO: adjust selector to match your dark mode toggle
+    await page.click('[data-testid="theme-toggle"], button[aria-label*="dark"], button[aria-label*="theme"]');
+    await page.waitForTimeout(300); // allow CSS transition
+    await expect(page).toHaveScreenshot('${slug}-dark-mode.png', {
+      maxDiffPixelRatio: 0.02,
+    });
+  });
+});
+`;
+}
+function generatePytestPlaywrightTest(title, slug) {
+    const pySlug = slug.replace(/-/g, '_');
+    return `"""Visual regression tests for ${title} — pytest-playwright."""
+# Requires: pytest-playwright + pytest-playwright-snapshot
+# Install: pip install pytest-playwright playwright-pytest-snapshot
+# Run: pytest --update-snapshots (first time to create baseline)
+import pytest
+from playwright.sync_api import Page, expect
+
+
+BASE_URL = "http://localhost:3000"
+
+
+@pytest.fixture(scope="session")
+def base_url() -> str:
+    import os
+    return os.environ.get("BASE_URL", BASE_URL)
+
+
+def test_${pySlug}_full_page_screenshot(page: Page, base_url: str, assert_snapshot: object) -> None:
+    """Full-page screenshot matches approved baseline."""
+    page.goto(base_url)
+    page.wait_for_load_state("networkidle")
+    assert_snapshot(page.screenshot(full_page=True), name="${slug}-baseline.png")
+
+
+def test_${pySlug}_responsive_mobile(page: Page, base_url: str, assert_snapshot: object) -> None:
+    """Layout intact at 375px (mobile)."""
+    page.set_viewport_size({"width": ${BP_MOBILE.width}, "height": ${BP_MOBILE.height}})
+    page.goto(base_url)
+    page.wait_for_load_state("networkidle")
+    assert_snapshot(page.screenshot(), name="${slug}-mobile.png")
+
+
+def test_${pySlug}_responsive_tablet(page: Page, base_url: str, assert_snapshot: object) -> None:
+    """Layout intact at 768px (tablet)."""
+    page.set_viewport_size({"width": ${BP_TABLET.width}, "height": ${BP_TABLET.height}})
+    page.goto(base_url)
+    page.wait_for_load_state("networkidle")
+    assert_snapshot(page.screenshot(), name="${slug}-tablet.png")
+
+
+def test_${pySlug}_responsive_desktop(page: Page, base_url: str, assert_snapshot: object) -> None:
+    """Layout intact at 1280px (desktop)."""
+    page.set_viewport_size({"width": ${BP_DESKTOP.width}, "height": ${BP_DESKTOP.height}})
+    page.goto(base_url)
+    page.wait_for_load_state("networkidle")
+    assert_snapshot(page.screenshot(), name="${slug}-desktop.png")
+
+
+def test_${pySlug}_dark_mode(page: Page, base_url: str, assert_snapshot: object) -> None:
+    """Dark mode toggle does not break layout."""
+    page.goto(base_url)
+    page.wait_for_load_state("networkidle")
+    # TODO: adjust selector to match your dark mode toggle
+    page.click('[data-testid="theme-toggle"]')
+    page.wait_for_timeout(300)
+    assert_snapshot(page.screenshot(), name="${slug}-dark-mode.png")
+`;
+}
+function generateCypressVisualTest(title, slug) {
+    return `// Visual regression tests for ${title} — Cypress + cypress-image-snapshot
+// Install: npm install --save-dev cypress-image-snapshot
+// Config: import 'cypress-image-snapshot/command' in cypress/support/commands.ts
+describe('${title} — Visual Regression', () => {
+  const BASE_URL = Cypress.env('BASE_URL') ?? 'http://localhost:3000';
+
+  it('full-page screenshot matches baseline', () => {
+    cy.visit(BASE_URL);
+    cy.matchImageSnapshot('${slug}-baseline', { failureThreshold: 0.02 });
+  });
+
+  it('responsive — mobile 375px', () => {
+    cy.viewport(${BP_MOBILE.width}, ${BP_MOBILE.height});
+    cy.visit(BASE_URL);
+    cy.matchImageSnapshot('${slug}-mobile', { failureThreshold: 0.02 });
+  });
+
+  it('responsive — tablet 768px', () => {
+    cy.viewport(${BP_TABLET.width}, ${BP_TABLET.height});
+    cy.visit(BASE_URL);
+    cy.matchImageSnapshot('${slug}-tablet', { failureThreshold: 0.02 });
+  });
+
+  it('responsive — desktop 1280px', () => {
+    cy.viewport(${BP_DESKTOP.width}, ${BP_DESKTOP.height});
+    cy.visit(BASE_URL);
+    cy.matchImageSnapshot('${slug}-desktop', { failureThreshold: 0.02 });
+  });
+
+  it('dark mode toggle does not break layout', () => {
+    cy.visit(BASE_URL);
+    // TODO: adjust selector to match your dark mode toggle
+    cy.get('[data-testid="theme-toggle"]').click();
+    cy.wait(300); // allow CSS transition
+    cy.matchImageSnapshot('${slug}-dark-mode', { failureThreshold: 0.02 });
+  });
+});
+`;
+}
+function generateVisualTestContent(title, slug, framework, language) {
+    if (language === 'python') {
+        return generatePytestPlaywrightTest(title, slug);
+    }
+    if (framework === 'cypress') {
+        return generateCypressVisualTest(title, slug);
+    }
+    return generatePlaywrightTest(title, slug);
+}
+function getFileExtension(language) {
+    const exts = {
+        python: 'py',
+        go: 'go',
+        ruby: 'rb',
+        java: 'java',
+        javascript: 'test.ts',
+        typescript: 'test.ts',
+    };
+    return exts[language] ?? 'test.ts';
+}
+/**
+ * Generate visual regression test files for the given spec.
+ */
+export function generateVisualRegressionTestFiles(spec, testDir, framework, language, testExt, autoGenerate) {
+    const ext = language === 'python' ? 'py' : getFileExtension(language);
+    const resolvedFramework = framework === 'cypress' ? 'cypress' : 'playwright';
+    const content = generateVisualTestContent(spec.title, spec.slug, framework, language);
+    return [
+        {
+            path: `${testDir}/visual/${spec.slug}.visual.${ext === 'test.ts' ? testExt : ext}`,
+            framework: resolvedFramework,
+            content,
+            ready: autoGenerate,
+        },
+    ];
+}
+// Re-export for dark mode detection utility (used in spec-dispatcher if needed)
+export { hasDarkModeSupport };
+//# sourceMappingURL=visual-regression-generator.js.map

package/dist/tools/generate-tests/generators/visual-regression-generator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"visual-regression-generator.js","sourceRoot":"","sources":["../../../../src/tools/generate-tests/generators/visual-regression-generator.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,sEAAsE;AAItE,MAAM,aAAa,GAAG;IACpB,OAAO;IACP,KAAK;IACL,SAAS;IACT,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,SAAS;IACT,MAAM;IACN,WAAW;IACX,YAAY;IACZ,OAAO;IACP,SAAS;IACT,QAAQ;IACR,MAAM;IACN,OAAO;IACP,QAAQ;IACR,OAAO;CACR,CAAC;AAEF,MAAM,iBAAiB,GAAG;IACxB,UAAU;IACV,QAAQ;IACR,OAAO;IACP,KAAK;IACL,QAAQ;IACR,SAAS;IACT,OAAO;IACP,SAAS;IACT,mBAAmB;IACnB,SAAS;CACV,CAAC;AAEF,MAAM,SAAS,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAW,CAAC;AACxE,MAAM,SAAS,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAW,CAAC;AACzE,MAAM,UAAU,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAW,CAAC;AAE3E;;GAEG;AACH,MAAM,UAAU,yBAAyB,CAAC,SAA2B;IACnE,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IAE7E,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/C,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,iEAAiE;IACjE,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACxD,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,SAA2B;IACrD,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/D,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gCAAgC,CAC9C,KAAa,EACb,OAAe,EACf,QAAgB;IAEhB,MAAM,IAAI,GAAqB;QAC7B;YACE,IAAI,EAAE,GAAG,KAAK,0DAA0D;YACxE,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,GAAG,OAAO,UAAU;YAC1B,WAAW,EACT,kHAAkH;YACpH,QAAQ,EAAE,UAAU;YACpB,WAAW,EAAE,IAAI;SAClB;QACD;YACE,IAAI,EAAE,GAAG,KAAK,sDAAsD;YACpE,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,GAAG,OAAO,UAAU;YAC1B,WAAW,EACT,iGAAiG;YACnG,QAAQ,EAAE,MAAM;YAChB,WAAW,EAAE,IAAI;SAClB;QACD;YACE,IAAI,EAAE,GAAG,KAAK,mDAAmD;YACjE,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,GAAG,OAAO,UAAU;YAC1B,WAAW,EACT,2FAA2F;YAC7F,QAAQ,EAAE,QAAQ;YAClB,WAAW,EAAE,IAAI;SAClB;KACF,CAAC;IAEF,4FAA4F;IAC5F,mGAAmG;IACnG,IAAI,CAAC,IAAI,CAAC;QACR,IAAI,EAAE,GAAG,KAAK,mDAAmD;QACjE,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,GAAG,OAAO,UAAU;QAC1B,WAAW,EACT,qHAAqH;QACvH,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+CAA+C;AAE/C,SAAS,sBAAsB,CAAC,KAAa,EAAE,IAAY;IACzD,OAAO,kCAAkC,KAAK;;;;;;iBAM/B,KAAK;;;;2CAIqB,IAAI;;;;;;;0CAOL,SAAS,CAAC,KAAK,aAAa,SAAS,CAAC,MAAM;;;2CAG3C,IAAI;;;;;;0CAML,SAAS,CAAC,KAAK,aAAa,SAAS,CAAC,MAAM;;;2CAG3C,IAAI;;;;;;0CAML,UAAU,CAAC,KAAK,aAAa,UAAU,CAAC,MAAM;;;2CAG7C,IAAI;;;;;;;;;2CASJ,IAAI;;;;;;;;;2CASJ,IAAI;;;;;CAK9C,CAAC;AACF,CAAC;AAED,SAAS,4BAA4B,CAAC,KAAa,EAAE,IAAY;IAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACvC,OAAO,kCAAkC,KAAK;;;;;;;;;;;;;;;;;WAiBrC,MAAM;;;;6DAI4C,IAAI;;;WAGtD,MAAM;;uCAEsB,SAAS,CAAC,KAAK,eAAe,SAAS,CAAC,MAAM;;;+CAGtC,IAAI;;;WAGxC,MAAM;;uCAEsB,SAAS,CAAC,KAAK,eAAe,SAAS,CAAC,MAAM;;;+CAGtC,IAAI;;;WAGxC,MAAM;;uCAEsB,UAAU,CAAC,KAAK,eAAe,UAAU,CAAC,MAAM;;;+CAGxC,IAAI;;;WAGxC,MAAM;;;;;;;+CAO8B,IAAI;CAClD,CAAC;AACF,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAa,EAAE,IAAY;IAC5D,OAAO,kCAAkC,KAAK;;;YAGpC,KAAK;;;;;6BAKY,IAAI;;;;kBAIf,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC,MAAM;;6BAEzB,IAAI;;;;kBAIf,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC,MAAM;;6BAEzB,IAAI;;;;kBAIf,UAAU,CAAC,KAAK,KAAK,UAAU,CAAC,MAAM;;6BAE3B,IAAI;;;;;;;;6BAQJ,IAAI;;;CAGhC,CAAC;AACF,CAAC;AAED,SAAS,yBAAyB,CAChC,KAAa,EACb,IAAY,EACZ,SAAiB,EACjB,QAAgB;IAEhB,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,4BAA4B,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,yBAAyB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,MAAM,IAAI,GAA2B;QACnC,MAAM,EAAE,IAAI;QACZ,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,MAAM;QACZ,UAAU,EAAE,SAAS;QACrB,UAAU,EAAE,SAAS;KACtB,CAAC;IACF,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iCAAiC,CAC/C,IAAqC,EACrC,OAAe,EACf,SAAiB,EACjB,QAAgB,EAChB,OAAe,EACf,YAAqB;IAErB,MAAM,GAAG,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACtE,MAAM,iBAAiB,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;IAC7E,MAAM,OAAO,GAAG,yBAAyB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAEtF,OAAO;QACL;YACE,IAAI,EAAE,GAAG,OAAO,WAAW,IAAI,CAAC,IAAI,WAAW,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE;YAClF,SAAS,EAAE,iBAAiB;YAC5B,OAAO;YACP,KAAK,EAAE,YAAY;SACpB;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,OAAO,EAAE,kBAAkB,EAAE,CAAC"}