agentic-qe 3.14.2 → 3.14.3

package/dist/coordination/handlers/security-handlers.js

@@ -7,48 +7,47 @@
 import * as fs from 'fs/promises';
 import * as path from 'path';
 import { ok, err } from '../../shared/types/index.js';
+import { createHash } from 'node:crypto';
 import { toError } from '../../shared/error-utils.js';
 import { FilePath } from '../../shared/value-objects/index.js';
-import { discoverSourceFiles, generateSecurityRecommendations } from './handler-utils.js';
+import { generateSecurityRecommendations } from './handler-utils.js';
+import { discoverSecurityFiles, isSecuritySourceFile } from '../../domains/security-compliance/scan-discovery.js';
 export function registerSecurityHandlers(ctx) {
     // Register security scan handler - REAL IMPLEMENTATION
     ctx.registerHandler('scan-security', async (task) => {
         const payload = task.payload;
         try {
-            const scanner = ctx.getSecurityScanner();
-            const targetPath = payload.target || process.cwd();
-            // Discover files to scan
-            const filesToScan = await discoverSourceFiles(targetPath);
-            if (filesToScan.length === 0) {
-                return ok({
-                    vulnerabilities: 0,
-                    critical: 0,
-                    high: 0,
-                    medium: 0,
-                    low: 0,
-                    informational: 0,
-                    topVulnerabilities: [],
-                    recommendations: ['No source files found to scan'],
-                    scanTypes: {
-                        sast: payload.sast !== false,
-                        dast: payload.dast || false,
-                    },
-                    warning: `No source files found in ${targetPath}`,
-                });
-            }
+            const targetPath = path.resolve(payload.target || process.cwd());
+            const sastRequested = payload.sast !== false;
+            const discoveryResult = sastRequested ? await discoverSecurityFiles(targetPath) : undefined;
+            const filesToScan = discoveryResult?.files ?? [];
+            const fileEvidence = [];
+            const engines = [];
+            const genericRules = new Map();
+            const genericErrors = [];
+            const manifestErrors = [];
+            const manifestRules = new Map();
+            const limitations = [];
             // Separate files by language capability
-            const jstsFiles = filesToScan.filter(f => /\.(ts|tsx|js|jsx|mjs|cjs)$/.test(f));
-            const otherFiles = filesToScan.filter(f => !/\.(ts|tsx|js|jsx|mjs|cjs)$/.test(f));
+            const jstsFiles = filesToScan.filter(f => /\.(ts|tsx|js|jsx|mjs|cjs)$/i.test(f));
+            const otherFiles = filesToScan.filter(f => !/\.(ts|tsx|js|jsx|mjs|cjs)$/i.test(f));
             // Run basic cross-language security patterns on non-JS/TS files
             const crossLangVulns = [];
             // Run secret/CORS patterns on ALL files (not just otherFiles) to catch JS/TS secrets too
             for (const filePath of filesToScan) {
+                if (!isSecuritySourceFile(filePath)) {
+                    fileEvidence.push({ path: filePath, engineId: 'generic-patterns', status: 'unsupported',
+                        readLines: 0, analyzedLines: 0, reason: 'Outside the declared source-language policy.' });
+                    continue;
+                }
                 try {
-                    const content = await fs.readFile(filePath, 'utf-8');
+                    const source = await fs.readFile(filePath);
+                    const content = source.toString('utf-8');
                     const lines = content.split('\n');
-                    const relPath = filePath.startsWith(targetPath)
-                        ? filePath.slice(targetPath.length).replace(/^\//, '')
-                        : filePath;
+                    fileEvidence.push({ path: filePath, engineId: 'generic-patterns', status: 'analyzed',
+                        sourceDigest: createHash('sha256').update(source).digest('hex'),
+                        readLines: lines.length, analyzedLines: lines.length });
+                    const relPath = path.relative(targetPath, filePath) || path.basename(filePath);
                     // Pattern: Hardcoded secrets/keys
                     // Fix #287: Use \w* around keywords to match SECRET_KEY, JWT_SECRET, API_TOKEN, etc.
                     const secretPatterns = [
@@ -56,7 +55,8 @@ export function registerSecurityHandlers(ctx) {
                         { regex: /\w*(?:token|auth_token|access_key|secret_key)\w*\s*[=:]\s*['"][^'"]{8,}['"]/gi, title: 'Hardcoded credential', severity: 'critical' },
                         { regex: /(?:AWS_SECRET|GITHUB_TOKEN|SLACK_TOKEN|OPENAI_API_KEY)\s*[=:]\s*['"][^'"]+['"]/gi, title: 'Hardcoded cloud credential', severity: 'critical' },
                     ];
-                    for (const pattern of secretPatterns) {
+                    for (const [index, pattern] of secretPatterns.entries()) {
+                        genericRules.set(`secret-${index}`, pattern.regex.toString());
                         for (let i = 0; i < lines.length; i++) {
                             // Use matchAll to find ALL secrets on a single line (not just first)
                             const matches = [...lines[i].matchAll(pattern.regex)];
@@ -73,6 +73,7 @@ export function registerSecurityHandlers(ctx) {
                     }
                     // Pattern: SQL injection risks
                     const sqlPatterns = /(?:execute|query|cursor\.execute)\s*\(\s*(?:f['"]|['"].*%s|['"].*\+\s*\w)/gi;
+                    genericRules.set('sql-interpolation', sqlPatterns.toString());
                     for (let i = 0; i < lines.length; i++) {
                         if (sqlPatterns.test(lines[i])) {
                             crossLangVulns.push({
@@ -93,7 +94,8 @@ export function registerSecurityHandlers(ctx) {
                         /@CrossOrigin\(\s*origins?\s*=\s*["']\*["']/i, // Spring Boot
                         /\.Header\(\)\.Set\(["']Access-Control-Allow-Origin["'],\s*["']\*["']/i, // Go
                     ];
-                    for (const corsPattern of corsPatterns) {
+                    for (const [index, corsPattern] of corsPatterns.entries()) {
+                        genericRules.set(`cors-${index}`, corsPattern.toString());
                         if (corsPattern.test(content)) {
                             crossLangVulns.push({
                                 title: 'CORS wildcard origin',
@@ -106,6 +108,7 @@ export function registerSecurityHandlers(ctx) {
                         }
                     }
                     // Pattern: Debug/development mode enabled
+                    genericRules.set('debug-mode', /(?:DEBUG|debug)\s*[=:]\s*(?:True|true|1)/i.toString());
                     if (/(?:DEBUG|debug)\s*[=:]\s*(?:True|true|1)/i.test(content)) {
                         crossLangVulns.push({
                             title: 'Debug mode enabled',
@@ -116,6 +119,7 @@ export function registerSecurityHandlers(ctx) {
                         });
                     }
                     // Pattern: Eval/exec usage
+                    genericRules.set('eval-exec', /\b(?:eval|exec)\s*\(/i.toString());
                     if (/\b(?:eval|exec)\s*\(/i.test(content)) {
                         crossLangVulns.push({
                             title: 'Dangerous eval/exec usage',
@@ -126,16 +130,24 @@ export function registerSecurityHandlers(ctx) {
                         });
                     }
                 }
-                catch {
-                    // Skip unreadable files
+                catch (error) {
+                    const reason = `Source read failed: ${safeErrorCode(error)}`;
+                    genericErrors.push(`${filePath}: ${reason}`);
+                    fileEvidence.push({ path: filePath, engineId: 'generic-patterns', status: 'unreadable',
+                        readLines: 0, analyzedLines: 0, reason });
                 }
             }
             // Also check dependency manifests for known vulnerable packages
             const depManifests = ['requirements.txt', 'pyproject.toml', 'Gemfile', 'go.mod', 'Cargo.toml'];
-            for (const manifest of depManifests) {
+            for (const manifest of sastRequested ? depManifests : []) {
                 const manifestPath = path.join(targetPath, manifest);
                 try {
-                    const manifestContent = await fs.readFile(manifestPath, 'utf-8');
+                    const manifestSource = await fs.readFile(manifestPath);
+                    const manifestContent = manifestSource.toString('utf-8');
+                    const manifestLines = manifestContent.split('\n').length;
+                    fileEvidence.push({ path: manifestPath, engineId: 'dependency-manifest-patterns', status: 'analyzed',
+                        sourceDigest: createHash('sha256').update(manifestSource).digest('hex'), readLines: manifestLines, analyzedLines: manifestLines });
+                    manifestRules.set('dependency-audit-advisory', 'Presence of a supported dependency manifest');
                     crossLangVulns.push({
                         title: 'Dependency audit recommended',
                         severity: 'informational',
@@ -151,6 +163,7 @@ export function registerSecurityHandlers(ctx) {
                             { pkg: 'python-multipart', pattern: /python-multipart/i, cve: 'CVE-2026-24486', severity: 'critical', title: 'python-multipart DoS (CVE-2026-24486)', description: 'python-multipart denial of service via crafted multipart data — upgrade to >=0.0.18' },
                         ];
                         for (const known of knownCVEs) {
+                            manifestRules.set(known.cve, known.pattern.toString());
                             if (known.pattern.test(manifestContent)) {
                                 crossLangVulns.push({
                                     title: known.title,
@@ -163,32 +176,108 @@ export function registerSecurityHandlers(ctx) {
                         }
                     }
                 }
-                catch {
-                    // Manifest doesn't exist
+                catch (error) {
+                    const code = error.code;
+                    if (code !== 'ENOENT' && code !== 'ENOTDIR') {
+                        const reason = `Manifest read failed: ${safeErrorCode(error)}`;
+                        manifestErrors.push(`${manifestPath}: ${reason}`);
+                        fileEvidence.push({ path: manifestPath, engineId: 'dependency-manifest-patterns', status: 'unreadable',
+                            readLines: 0, analyzedLines: 0, reason });
+                    }
                 }
             }
+            const genericAnalyzed = fileEvidence.filter(file => file.engineId === 'generic-patterns' && file.status === 'analyzed').length;
+            const manifestsAnalyzed = fileEvidence.filter(file => file.engineId === 'dependency-manifest-patterns' && file.status === 'analyzed').length;
+            engines.push({ id: 'dependency-manifest-patterns', requested: sastRequested, required: false,
+                status: !sastRequested ? 'disabled' : manifestErrors.length > 0 ? (manifestsAnalyzed > 0 ? 'partial' : 'failed') : manifestsAnalyzed > 0 ? 'completed' : 'not-run',
+                scope: 'parent-directory', target: targetPath, analyzedFiles: manifestsAnalyzed,
+                ruleIds: [...manifestRules.keys()].sort(), rulesetDigest: createHash('sha256').update(JSON.stringify([...manifestRules.entries()].sort())).digest('hex'),
+                ruleCoverage: 'known', errors: manifestErrors, limitations: ['Manifest name patterns are advisories, not a resolved dependency or version audit.'] });
+            const genericLimitations = ['Generic text patterns do not establish language-specific or dependency vulnerability coverage.'];
+            engines.push({ id: 'generic-patterns', requested: sastRequested, required: sastRequested,
+                status: !sastRequested ? 'disabled' : genericErrors.length > 0 ? (genericAnalyzed > 0 ? 'partial' : 'failed')
+                    : genericAnalyzed === filesToScan.length && genericAnalyzed > 0 ? 'completed'
+                        : genericAnalyzed > 0 ? 'partial' : filesToScan.length > 0 ? 'unavailable' : 'not-run',
+                scope: 'requested-files', analyzedFiles: genericAnalyzed,
+                ruleIds: [...genericRules.keys()].sort(),
+                rulesetDigest: createHash('sha256').update(JSON.stringify([...genericRules.entries()].sort())).digest('hex'),
+                ruleCoverage: 'known', errors: genericErrors, limitations: genericLimitations });
             // Convert JS/TS file paths to FilePath value objects for the SAST scanner
             const filePathObjects = jstsFiles.map(filePath => FilePath.create(filePath));
-            // Run SAST scan on JS/TS files if requested and files exist
+            // Only returned execution receipts can establish SAST coverage.
             let sastResult = null;
-            if (payload.sast !== false && filePathObjects.length > 0) {
-                const result = await scanner.scanFiles(filePathObjects);
-                if (result.success) {
-                    sastResult = result.value;
+            if (sastRequested && filePathObjects.length > 0) {
+                try {
+                    const result = await ctx.getSecurityScanner().scanFiles(filePathObjects);
+                    if (result.success) {
+                        sastResult = result.value;
+                        if (sastResult.evidence) {
+                            fileEvidence.push(...sastResult.evidence.files);
+                            engines.push(...sastResult.evidence.engines);
+                            limitations.push(...sastResult.evidence.limitations);
+                        }
+                        else {
+                            engines.push(unverifiedEngine('sast', 'requested-files'));
+                        }
+                    }
+                    else {
+                        engines.push(failedEngine('sast', 'requested-files', result.error));
+                    }
+                }
+                catch (error) {
+                    engines.push(failedEngine('sast', 'requested-files', error));
                 }
             }
-            // Run DAST scan if URL provided and dast is enabled
+            else {
+                engines.push({ id: 'sast', requested: sastRequested, required: false,
+                    status: sastRequested ? 'not-run' : 'disabled', scope: 'requested-files', analyzedFiles: 0,
+                    ruleCoverage: 'unknown', errors: [], limitations: sastRequested ? ['No JS/TS files were available for language-specific SAST.'] : [] });
+            }
             let dastResult = null;
             if (payload.dast && payload.targetUrl) {
-                const result = await scanner.scanUrl(payload.targetUrl, {
-                    activeScanning: true,
-                    maxDepth: 3,
-                    timeout: 30000,
-                });
-                if (result.success) {
-                    dastResult = result.value;
+                try {
+                    const result = await ctx.getSecurityScanner().scanUrl(payload.targetUrl, {
+                        activeScanning: true, maxDepth: 3, timeout: 30000,
+                    });
+                    if (result.success) {
+                        dastResult = result.value;
+                        // Legacy DAST results contain findings, but no execution coverage receipt.
+                        engines.push({ ...unverifiedEngine('dast', 'url'), target: payload.targetUrl });
+                    }
+                    else {
+                        engines.push({ ...failedEngine('dast', 'url', result.error), target: payload.targetUrl });
+                    }
                 }
+                catch (error) {
+                    engines.push({ ...failedEngine('dast', 'url', error), target: payload.targetUrl });
+                }
+            }
+            else {
+                engines.push({ id: 'dast', requested: payload.dast === true, required: payload.dast === true,
+                    status: payload.dast ? 'not-run' : 'disabled', scope: 'url', ruleCoverage: 'unknown',
+                    errors: payload.dast ? ['DAST was requested without targetUrl.'] : [], limitations: [] });
             }
+            if (payload.compliance?.length) {
+                engines.push({ id: 'compliance', requested: true, required: true, status: 'not-run',
+                    scope: 'requested-files', ruleCoverage: 'unknown', errors: [],
+                    limitations: ['Requested compliance checks are not executed by this task handler.'] });
+            }
+            const requestedPaths = new Set(filesToScan);
+            const analyzedPaths = new Set(fileEvidence.filter(file => file.status === 'analyzed' && requestedPaths.has(file.path)).map(file => file.path));
+            const requiredEngines = engines.filter(engine => engine.requested && engine.required);
+            const hasExecuted = analyzedPaths.size > 0;
+            const complete = hasExecuted && requiredEngines.every(engine => engine.status === 'completed') &&
+                (!discoveryResult || discoveryResult.discovery.status === 'complete');
+            const evidence = {
+                schemaVersion: 1, completeness: complete ? 'complete' : hasExecuted ? 'partial' : 'none',
+                requestedFiles: filesToScan.length, requestedPaths: filesToScan, duplicateInputs: 0,
+                files: fileEvidence, engines,
+                limitations: [...new Set([...limitations, ...engines.flatMap(engine => [...engine.limitations, ...engine.errors]),
+                        ...(discoveryResult?.discovery.issues.map(issue => `${issue.path}: ${issue.reason}`) ?? [])])],
+                ...(discoveryResult ? { discovery: discoveryResult.discovery } : {}),
+            };
+            const deepAnalysisPerformed = Boolean(sastResult?.evidence?.engines.some(engine => engine.id === 'patterns' && (engine.status === 'completed' || engine.status === 'partial') &&
+                (engine.analyzedFiles ?? 0) > 0));
             // Combine results from all scan sources - SAST, DAST, and cross-language patterns
             const crossLangSeverityCounts = {
                 critical: crossLangVulns.filter(v => v.severity === 'critical').length,
@@ -224,7 +313,9 @@ export function registerSecurityHandlers(ctx) {
                 description: v.description,
             }));
             // Generate recommendations based on findings
-            const recommendations = generateSecurityRecommendations(allVulns);
+            const recommendations = allVulns.length === 0 && evidence.completeness !== 'complete'
+                ? ['No findings reported; requested analysis is incomplete or unverified. Inspect execution receipts.']
+                : generateSecurityRecommendations(allVulns);
             return ok({
                 vulnerabilities: allVulns.length,
                 critical: summary.critical,
@@ -233,33 +324,24 @@ export function registerSecurityHandlers(ctx) {
                 low: summary.low,
                 informational: summary.informational,
                 topVulnerabilities,
+                findings: allVulns,
                 recommendations,
                 scanTypes: {
                     sast: payload.sast !== false,
                     dast: payload.dast || false,
                 },
-                filesScanned: filesToScan.length,
-                jstsFilesScanned: jstsFiles.length,
-                otherFilesScanned: otherFiles.length,
-                coverage: sastResult?.coverage,
-                // #569 (companion note): "zero findings" from a scan that ran no
-                // language-specific analysis is not evidence of absence, and combined
-                // with a coverage number it reads as "this code is clean and covered".
-                // Say plainly which depth of analysis actually ran.
-                deepAnalysisPerformed: jstsFiles.length > 0,
-                analysisDepth: jstsFiles.length > 0
-                    ? (otherFiles.length > 0 ? 'full-sast-on-js-ts; pattern-matching-on-other-languages' : 'full-sast')
-                    : 'pattern-matching-only',
-                ...(jstsFiles.length === 0 ? {
-                    note: otherFiles.length > 0
-                        ? 'NO LANGUAGE-SPECIFIC ANALYSIS RAN. Only cross-language pattern matching ' +
-                            '(secrets, CORS, eval/exec) was applied to these files — full SAST is ' +
-                            'implemented for JS/TS only. A zero-finding result here means "nothing ' +
-                            'matched a generic pattern", NOT "no vulnerabilities". Run a ' +
-                            'language-specific tool (cargo audit / clippy, bandit, gosec, semgrep) ' +
-                            'for real coverage of this codebase.'
-                        : 'No source files were analyzed.',
-                } : {}),
+                status: evidence.completeness === 'complete' ? 'completed' : evidence.completeness === 'partial' ? 'partial' : 'unavailable',
+                evidence,
+                limitations: evidence.limitations,
+                filesScanned: analyzedPaths.size,
+                jstsFilesScanned: jstsFiles.filter(file => analyzedPaths.has(file)).length,
+                otherFilesScanned: otherFiles.filter(file => analyzedPaths.has(file)).length,
+                ...(sastResult?.evidence ? { coverage: sastResult.coverage } : {}),
+                deepAnalysisPerformed,
+                analysisDepth: deepAnalysisPerformed
+                    ? (otherFiles.length > 0 ? 'sast-patterns-on-js-ts; generic-patterns-on-other-languages' : 'sast-patterns')
+                    : genericAnalyzed > 0 ? 'pattern-matching-only' : 'none',
+                ...(!deepAnalysisPerformed ? { note: 'No verified language-specific SAST ran. Generic pattern matches and partial findings do not establish that the target is free of vulnerabilities.' } : {}),
             });
         }
         catch (error) {
@@ -267,4 +349,18 @@ export function registerSecurityHandlers(ctx) {
         }
     });
 }
+function failedEngine(id, scope, error) {
+    const reason = id === 'sast' && error instanceof Error && error.message.startsWith('No valid rule sets found:')
+        ? 'No valid rule sets configured.' : `${id} execution failed (${safeErrorCode(error)}).`;
+    return { id, requested: true, required: true, status: 'failed', scope,
+        ruleCoverage: 'unknown', errors: [reason], limitations: [] };
+}
+function safeErrorCode(error) {
+    const code = error?.code;
+    return typeof code === 'string' && /^[A-Z0-9_]{1,32}$/.test(code) ? code : 'UNKNOWN';
+}
+function unverifiedEngine(id, scope) {
+    return { id, requested: true, required: true, status: 'unverified', scope,
+        ruleCoverage: 'unknown', errors: [], limitations: [`${id} returned no execution receipt; coverage is unverified.`] };
+}
 //# sourceMappingURL=security-handlers.js.map

package/dist/coordination/handlers/test-execution-handlers.js

@@ -8,6 +8,8 @@ import { v4 as uuidv4 } from 'uuid';
 import * as fs from 'fs/promises';
 import { ok, err } from '../../shared/types/index.js';
 import { toError } from '../../shared/error-utils.js';
+import { getTestRunnerExecutionError, TestRunnerExecutionError } from '../../shared/test-runner-verdict.js';
+import { createVitestJsonReport } from '../../shared/vitest-json-report.js';
 function escapeRegExp(s) {
     return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
@@ -160,73 +162,65 @@ export function registerTestExecutionHandlers(ctx) {
             return err(toError(error));
         }
     });
+    // execute-tests accepts a nonempty list of concrete paths; callers expand globs.
     // Register test execution handler - runs real tests via child process
     ctx.registerHandler('execute-tests', async (task) => {
         const payload = task.payload;
         try {
             const testFiles = payload.testFiles || [];
             if (testFiles.length === 0) {
-                return ok({
-                    total: 0, passed: 0, failed: 0, skipped: 0,
-                    duration: 0, coverage: 0, failedTests: [],
-                    warning: 'No test files specified. Provide testFiles array with paths to test files.',
-                });
+                return err(new TestRunnerExecutionError('No test files specified. Provide testFiles array with paths to test files.'));
             }
-            // Attempt to run tests using common test runners
-            const cwd = process.cwd();
-            let output;
-            // Validate test file paths to prevent command injection
-            const safePathPattern = /^[a-zA-Z0-9_.\/\-@]+$/;
-            const safeFiles = testFiles.filter(f => safePathPattern.test(f));
-            if (safeFiles.length !== testFiles.length) {
-                return ok({
-                    total: 0, passed: 0, failed: 0, skipped: 0,
-                    duration: 0, coverage: 0, failedTests: [],
-                    warning: 'Some test file paths contain invalid characters and were rejected.',
-                });
+            // Validate test file paths before invoking a runner.
+            const safePathPattern = /^[a-zA-Z0-9_./@-]+$/;
+            if (testFiles.some(file => !safePathPattern.test(file))) {
+                return err(new TestRunnerExecutionError('Some test file paths contain invalid characters and were rejected. Provide concrete paths; expand glob patterns before calling.'));
             }
+            const { spawnSync } = await import('child_process');
+            const options = { cwd: process.cwd(), timeout: 120000, encoding: 'utf-8' };
+            let runner = 'vitest';
+            // Vitest 5 writes the JSON report to a file rather than stdout; an explicit
+            // --outputFile gives Vitest 4 and 5 the same contract.
+            const report = createVitestJsonReport();
+            let execution;
+            let output;
             try {
-                // Use spawnSync with argument arrays to prevent command injection
-                const { spawnSync } = await import('child_process');
-                const vitestResult = spawnSync('npx', ['vitest', 'run', ...safeFiles, '--reporter=json'], {
-                    cwd, timeout: 120000, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'],
-                });
-                output = vitestResult.stdout || '';
-                // If vitest failed (not just test failures), try jest
-                if (!output.includes('{') && vitestResult.status !== 0) {
-                    const jestResult = spawnSync('npx', ['jest', ...safeFiles, '--json'], {
-                        cwd, timeout: 120000, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'],
-                    });
-                    output = jestResult.stdout || '';
-                }
+                execution = spawnSync('npx', ['vitest', 'run', ...testFiles, '--reporter=json', ...report.args], options);
+                output = report.read(execution.stdout || '');
+            }
+            finally {
+                report.cleanup();
             }
-            catch (execError) {
-                // Test runner may exit non-zero when tests fail — that's expected
-                output = execError.stdout || '';
+            // Preserve the existing Jest fallback when Vitest cannot produce a report.
+            if (!output.includes('{') && execution.status !== 0) {
+                runner = 'jest';
+                execution = spawnSync('npx', ['jest', ...testFiles, '--json'], options);
+                output = execution.stdout || '';
+            }
+            const diagnostics = [execution.error?.message, execution.stderr, output].filter(Boolean).join('\n');
+            if (execution.error) {
+                return err(new TestRunnerExecutionError(`${runner} could not complete: ${diagnostics.slice(0, 4000)}`));
             }
-            // Try to parse JSON output from test runner
             try {
                 const jsonStart = output.indexOf('{');
                 if (jsonStart >= 0) {
                     const json = JSON.parse(output.slice(jsonStart));
-                    // vitest format
                     if (json.testResults) {
                         const total = json.numTotalTests || 0;
                         const passed = json.numPassedTests || 0;
                         const failed = json.numFailedTests || 0;
-                        return ok({ total, passed, failed, skipped: total - passed - failed, duration: 0, coverage: 0, failedTests: [] });
+                        const skipped = total - passed - failed;
+                        const executionError = getTestRunnerExecutionError(runner, testFiles.join(', '), execution.status, { passed, failed, skipped }, diagnostics, json);
+                        if (executionError)
+                            return err(executionError);
+                        return ok({ total, passed, failed, skipped, duration: 0, coverage: 0, failedTests: [] });
                     }
                 }
             }
             catch {
-                // JSON parsing failed — return raw info
+                // A malformed report cannot establish that the requested tests completed.
             }
-            return ok({
-                total: testFiles.length, passed: 0, failed: 0, skipped: 0,
-                duration: 0, coverage: 0, failedTests: [],
-                warning: 'Could not parse test runner output. Check that vitest or jest is installed.',
-                rawOutput: output.slice(0, 500),
-            });
+            return err(new TestRunnerExecutionError(`Could not parse ${runner} results (exit code ${execution.status ?? 'unknown'}):\n${diagnostics.slice(0, 4000)}`));
         }
         catch (error) {
             return err(toError(error));

package/dist/coordination/protocols/security-audit.d.ts

@@ -61,6 +61,8 @@ export interface SecurityAuditResult {
     readonly overallRiskScore: RiskScore;
     readonly recommendations: string[];
     readonly deploymentDecision: DeploymentDecision;
+    /** Requested checks without complete execution evidence; findings remain usable. */
+    readonly incompleteChecks?: readonly string[];
 }
 /**
  * Triaged vulnerability findings
@@ -219,6 +221,7 @@ export declare class SecurityAuditProtocol {
     private cleanupAgents;
     private getAuditOptionsForTrigger;
     private updatePhase;
+    private recordIncompleteCheck;
     private createEmptyTriagedFindings;
     private calculateSummary;
     private calculateRiskValue;