feat: add UI tests with vscode-extension-tester

Author: fcasal

.gitignore

@@ -10,3 +10,6 @@ node_modules
 # Test coverage
 coverage/
 .nyc_output/
+
+# ExTester storage
+.test-extensions/

.vscode-test-ui.mjs

@@ -0,0 +1,11 @@
+export default {
+    vscodeVersion: "stable",
+    extensions: [],
+    settings: {
+        mocha: {
+            ui: "bdd",
+            timeout: 20000,
+            color: true,
+        },
+    },
+};

CLAUDE.md

@@ -0,0 +1,31 @@
+# Claude Code AI Agents
+
+This project includes AI agents powered by Claude Code to assist with development tasks.
+
+## Available Agents
+
+For detailed information about the available AI agents, their capabilities, and usage instructions, please see:
+
+**[AGENTS.md](./AGENTS.md)**
+
+## What are AI Agents?
+
+AI agents are specialized Claude Code tools that can autonomously perform complex tasks such as:
+- Writing security vulnerability reports
+- Searching historical audit findings
+- Creating executive summaries for security audits
+- Analyzing code for security issues
+
+## Getting Started
+
+1. Ensure you have Claude Code installed and configured
+2. Review the [AGENTS.md](./AGENTS.md) file for available agents
+3. Invoke agents using the `/` command syntax described in the documentation
+
+## Contributing
+
+When adding new agents, please update the [AGENTS.md](./AGENTS.md) file with:
+- Agent name and description
+- Usage examples
+- Required inputs/parameters
+- Expected outputs

TESTING.md

@@ -7,6 +7,7 @@
 | `mocha` + `chai` | Unit test runner and assertions |
 | `sinon` | Stubs and mocks |
 | `@vscode/test-electron` | Extension-host tests with real VS Code APIs |
+| `vscode-extension-tester` | **NEW**: UI automation with Selenium WebDriver |
 | `jsdom` | Webview DOM simulation |
 | `nyc` | Coverage reporting (target: 80% for `types.ts`, 60% overall) |
 
@@ -16,11 +17,69 @@
 test/
 ├── unit/           # Pure logic, no VS Code host (fast)
 ├── extension/      # Extension-host tests via @vscode/test-electron
+├── ui/             # **NEW**: UI tests with vscode-extension-tester
+│   └── suite/      # UI automation tests (InputBox, QuickPick, TreeView)
 ├── webview/        # DOM tests with jsdom
 ├── mocks/          # Shared mock factories
 └── fixtures/       # Sample workspaces and .weaudit files
 ```
 
+## UI Testing with vscode-extension-tester
+
+**NEW**: We use [vscode-extension-tester](https://github.com/redhat-developer/vscode-extension-tester) (ExTester) for full UI automation. This allows us to:
+- Type into InputBox and QuickPick elements programmatically
+- Interact with tree views (click, expand, verify content)
+- Test the actual user experience, not just the API
+
+### Key Capabilities
+
+- **InputBox Interaction**: Can type custom titles for findings/notes
+- **TreeView Testing**: Can click items, verify labels, test drag-and-drop
+- **Command Palette**: Can invoke commands via UI
+- **Full User Experience**: Tests what users actually see and interact with
+
+### Running UI Tests
+
+```bash
+# Run all tests (unit + integration + UI)
+npm run test:all
+
+# Run only UI tests
+npm run test:ui
+
+# Setup UI test environment (download VS Code + ChromeDriver)
+npm run test:ui-setup
+```
+
+### Example UI Test
+
+```typescript
+import { InputBox, Workbench } from 'vscode-extension-tester';
+
+it("should create finding with custom title", async () => {
+    const workbench = new Workbench();
+
+    // Execute command
+    await workbench.executeCommand("weAudit: New Finding from Selection");
+
+    // Type into input box (impossible with @vscode/test-electron!)
+    const input = await InputBox.create();
+    await input.setText("SQL Injection Vulnerability");
+    await input.confirm();
+
+    // Verify in tree view
+    // ... assertions
+});
+```
+
+### Hybrid Testing Strategy
+
+We use **both** testing frameworks:
+- `@vscode/test-electron` - Fast integration tests for API-level operations
+- `vscode-extension-tester` - UI tests for InputBox, QuickPick, TreeView interactions
+
+This gives us the best of both worlds: speed + comprehensive coverage.
+
 ---
 
 ## Phase 1: Data Integrity (P0)