@maintainabilityai/research-runner 0.1.22 → 0.1.23

package/dist/runner/skills.js

@@ -468,6 +468,36 @@ const SearchQueriesInput = zod_1.z.object({
     queries: zod_1.z.array(zod_1.z.string().min(1)).min(1),
     maxResults: zod_1.z.number().int().positive().optional(),
 });
+/**
+ * Decide whether a per-query envelope set means "the provider was reachable
+ * at least once" (=> `ok: true`) or "every single query failed" (=> `ok:
+ * false, reason: all-queries-failed`).
+ *
+ * Why this matters: previously the handlers returned `ok: true` even when
+ * 100% of queries failed (because `runTavilySearch` etc. use
+ * `Promise.allSettled` and never throw). That made `result_count: 0`
+ * ambiguous — could be "API reached, no matches" OR "firewall blocked
+ * every call." The agentic-SDLC evidence-honesty gate (§11.1.7) counts
+ * ok=true as a successful provider call; this fix is what makes that
+ * count actually meaningful.
+ *
+ * Returns `null` when at least one query reached the provider (the
+ * skill returns ok:true). Otherwise returns the failure reason string
+ * the skill should surface in `reason`.
+ */
+function detectAllQueriesFailed(envelopes, skill) {
+    if (envelopes.length === 0) {
+        return null;
+    }
+    const allErrored = envelopes.every(e => e.error !== undefined && e.error.length > 0);
+    if (!allErrored) {
+        return null;
+    }
+    const firstError = envelopes[0].error ?? 'unknown';
+    // `all-queries-failed:` prefix is load-bearing for the audit-validate gate's
+    // pattern matching of firewall-block vs query-quality failures.
+    return `all-queries-failed: ${skill} — ${firstError}`;
+}
 const handleTavilySearch = async (input) => {
     const parsed = SearchQueriesInput.safeParse(input);
     if (!parsed.success) {
@@ -483,6 +513,10 @@ const handleTavilySearch = async (input) => {
             queries: parsed.data.queries,
             maxResultsPerQuery: parsed.data.maxResults,
         });
+        const failure = detectAllQueriesFailed(res.envelopes, 'tavily-search');
+        if (failure) {
+            return { ok: false, reason: failure, envelopes: res.envelopes };
+        }
         return { ok: true, envelopes: res.envelopes, results: res.results };
     }
     catch (err) {
@@ -499,6 +533,10 @@ const handleArxivSearch = async (input) => {
             queries: parsed.data.queries,
             maxResultsPerQuery: parsed.data.maxResults,
         });
+        const failure = detectAllQueriesFailed(res.envelopes, 'arxiv-search');
+        if (failure) {
+            return { ok: false, reason: failure, envelopes: res.envelopes };
+        }
         return { ok: true, envelopes: res.envelopes, results: res.results };
     }
     catch (err) {
@@ -520,6 +558,10 @@ const handleUsptoSearch = async (input) => {
             queries: parsed.data.queries,
             maxResultsPerQuery: parsed.data.maxResults,
         });
+        const failure = detectAllQueriesFailed(res.envelopes, 'uspto-search');
+        if (failure) {
+            return { ok: false, reason: failure, envelopes: res.envelopes };
+        }
         return { ok: true, envelopes: res.envelopes, results: res.results };
     }
     catch (err) {
@@ -536,6 +578,10 @@ const handleHackerNewsSearch = async (input) => {
             queries: parsed.data.queries,
             hitsPerQuery: parsed.data.maxResults,
         });
+        const failure = detectAllQueriesFailed(res.envelopes, 'hackernews-search');
+        if (failure) {
+            return { ok: false, reason: failure, envelopes: res.envelopes };
+        }
         return { ok: true, envelopes: res.envelopes, results: res.results };
     }
     catch (err) {

package/dist/search/arxiv-client.js

@@ -14,7 +14,12 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.arxivSearch = arxivSearch;
 exports.parseArxivAtom = parseArxivAtom;
-const DEFAULT_ENDPOINT = 'http://export.arxiv.org/api/query';
+// HTTPS — arXiv has supported it for years. Using plain HTTP previously
+// caused agentic-SDLC runs to be blocked by the Copilot Coding Agent
+// firewall, which allow-lists `https://export.arxiv.org/` (the canonical
+// HTTPS form); a plain-http GET against the same host is a protocol-
+// mismatch and rejected as `http block`. See B-PR1f forensics.
+const DEFAULT_ENDPOINT = 'https://export.arxiv.org/api/query';
 async function arxivSearch(opts) {
     const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
     const endpoint = opts.endpoint ?? DEFAULT_ENDPOINT;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maintainabilityai/research-runner",
-  "version": "0.1.22",
+  "version": "0.1.23",
   "description": "Research + PRD agent runner — orchestrates the Archeologist and PRD pipelines for the MaintainabilityAI governance mesh",
   "license": "MIT",
   "author": "MaintainabilityAI",