agentic-qe 3.14.2 → 3.14.3

package/dist/coordination/protocols/security-audit.js

@@ -111,16 +111,25 @@ export class SecurityAuditProtocol {
                 triagedFindings: this.createEmptyTriagedFindings(),
                 overallRiskScore: RiskScore.create(0),
                 recommendations: [],
-                deploymentDecision: { allowed: true, reason: '', blockingIssues: [], warnings: [] },
+                incompleteChecks: [],
+                deploymentDecision: { allowed: false, reason: 'Audit not completed', blockingIssues: [], warnings: [] },
             };
             // Adjust scope based on trigger
             const auditOptions = this.getAuditOptionsForTrigger(trigger);
             // Phase 1: Vulnerability Scan (SAST)
-            this.updatePhase('vulnerability-scan');
-            const sastResult = await this.scanVulnerabilities(auditOptions);
-            if (sastResult.success) {
-                this.currentAudit = { ...this.currentAudit, sastResult: sastResult.value };
-                await this.publishVulnerabilities(sastResult.value.vulnerabilities);
+            if (auditOptions.includeSAST) {
+                this.updatePhase('vulnerability-scan');
+                const sastResult = await this.scanVulnerabilities(auditOptions);
+                if (sastResult.success) {
+                    this.currentAudit = { ...this.currentAudit, sastResult: sastResult.value };
+                    await this.publishVulnerabilities(sastResult.value.vulnerabilities);
+                    if (sastResult.value.evidence?.completeness !== 'complete') {
+                        this.recordIncompleteCheck('SAST coverage is incomplete or unverified');
+                    }
+                }
+                else {
+                    this.recordIncompleteCheck('SAST scan did not complete');
+                }
             }
             // Phase 2: Dependency Scan
             this.updatePhase('dependency-scan');
@@ -129,32 +138,51 @@ export class SecurityAuditProtocol {
                 this.currentAudit = { ...this.currentAudit, dependencyResult: depResult.value };
                 await this.publishDependencyVulnerabilities(depResult.value.vulnerabilities);
             }
+            else {
+                this.recordIncompleteCheck('Dependency scan did not complete');
+            }
             // Phase 3: Secret Scan (if enabled)
-            if (this.config.enableSecretScan) {
+            if (auditOptions.includeSecrets) {
                 this.updatePhase('secret-scan');
                 const secretResult = await this.auditSecrets();
                 if (secretResult.success) {
                     this.currentAudit = { ...this.currentAudit, secretResult: secretResult.value };
                     await this.publishSecretExposures(secretResult.value.secretsFound);
                 }
+                else {
+                    this.recordIncompleteCheck('Secret scan is unavailable');
+                }
             }
             // Phase 4: DAST Scan (if enabled and URL provided)
-            if (this.config.enableDAST && this.config.targetUrl) {
+            if (auditOptions.includeDAST && this.config.targetUrl) {
                 const dastResult = await this.runDASTScan(this.config.targetUrl);
                 if (dastResult.success) {
                     this.currentAudit = { ...this.currentAudit, dastResult: dastResult.value };
+                    this.recordIncompleteCheck('DAST coverage is unverified: the scanner returned no execution receipt');
                     await this.publishVulnerabilities(dastResult.value.vulnerabilities);
                 }
+                else {
+                    this.recordIncompleteCheck('DAST scan did not complete');
+                }
+            }
+            else if (auditOptions.includeDAST) {
+                this.recordIncompleteCheck('DAST requested without a target URL');
             }
             // Phase 5: Compliance Validation
-            this.updatePhase('compliance-validation');
-            const complianceResult = await this.validateCompliance();
-            if (complianceResult.success) {
-                this.currentAudit = {
-                    ...this.currentAudit,
-                    complianceReports: complianceResult.value,
-                };
-                await this.publishComplianceResults(complianceResult.value);
+            if (this.config.complianceStandards.length > 0) {
+                this.updatePhase('compliance-validation');
+                const complianceResult = await this.validateCompliance();
+                if (complianceResult.success) {
+                    this.currentAudit = {
+                        ...this.currentAudit,
+                        complianceReports: complianceResult.value,
+                    };
+                    await this.publishComplianceResults(complianceResult.value);
+                    this.recordIncompleteCheck('Protocol compliance checks have no verified execution receipt');
+                }
+                else {
+                    this.recordIncompleteCheck('Compliance validation did not complete');
+                }
             }
             // Phase 6: Triage Findings
             this.updatePhase('triage');
@@ -296,26 +324,9 @@ export class SecurityAuditProtocol {
      * Audit for exposed secrets/credentials
      */
     async auditSecrets() {
-        try {
-            const agentId = await this.spawnAgent('secret-scanner', ['secret-scan', 'credential-audit']);
-            if (!agentId.success) {
-                return err(agentId.error);
-            }
-            const secretsFound = [];
-            // In production, this would scan actual files with patterns like:
-            // - API keys: /(?:api[_-]?key|apikey)/gi
-            // - Passwords: /(?:password|passwd|pwd)/gi
-            // - Tokens: /(?:secret|token|bearer)/gi
-            // - Private keys: /-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/gi
-            // For now, report no secrets found (clean scan)
-            return ok({
-                secretsFound,
-                filesScanned: this.config.scanPaths.length * 10, // Estimate
-            });
-        }
-        catch (error) {
-            return err(toError(error));
-        }
+        // Agent allocation is not scan execution. Until this protocol has a real
+        // secret-scanner adapter, retain an explicit unavailable result.
+        return err(new Error('Secret scanning is unavailable in SecurityAuditProtocol: no scanner is implemented.'));
     }
     /**
      * Run DAST scan against target URL
@@ -383,7 +394,7 @@ export class SecurityAuditProtocol {
             return {
                 riskScore: RiskScore.create(0),
                 recommendations: [],
-                deploymentDecision: { allowed: true, reason: 'No audit data', blockingIssues: [], warnings: [] },
+                deploymentDecision: { allowed: false, reason: 'No audit data', blockingIssues: ['No audit evidence'], warnings: [] },
             };
         }
         // Calculate risk score
@@ -641,6 +652,14 @@ export class SecurityAuditProtocol {
             this.currentAudit = { ...this.currentAudit, phase };
         }
     }
+    recordIncompleteCheck(reason) {
+        if (this.currentAudit) {
+            this.currentAudit = {
+                ...this.currentAudit,
+                incompleteChecks: [...(this.currentAudit.incompleteChecks ?? []), reason],
+            };
+        }
+    }
     createEmptyTriagedFindings() {
         return {
             critical: [],
@@ -717,6 +736,9 @@ export class SecurityAuditProtocol {
         const recommendations = [];
         if (!this.currentAudit)
             return recommendations;
+        for (const check of this.currentAudit.incompleteChecks ?? []) {
+            recommendations.push(`Complete the required security check before approving deployment: ${check}`);
+        }
         const { triagedFindings, complianceReports } = this.currentAudit;
         // Critical findings
         if (triagedFindings.critical.length > 0) {
@@ -747,10 +769,10 @@ export class SecurityAuditProtocol {
         return recommendations;
     }
     determineDeploymentDecision(_riskScore) {
-        const blockingIssues = [];
+        const blockingIssues = [...(this.currentAudit?.incompleteChecks ?? [])];
         const warnings = [];
         if (!this.currentAudit) {
-            return { allowed: true, reason: 'No audit data', blockingIssues, warnings };
+            return { allowed: false, reason: 'No audit data', blockingIssues: ['No audit evidence'], warnings };
         }
         const { triagedFindings, complianceReports } = this.currentAudit;
         // Check critical vulnerabilities

package/dist/coordination/result-saver.js

@@ -6,6 +6,11 @@ import * as fs from 'fs/promises';
 import * as path from 'path';
 import { createHash } from 'crypto';
 import { safeJsonParse } from '../shared/safe-json.js';
+function securityReportExecution(data) {
+    return data.evidence?.completeness === 'complete' ? 'completed'
+        : data.evidence?.completeness === 'partial' ? 'partial'
+            : data.evidence ? 'unavailable' : 'unverified';
+}
 // ============================================================================
 // Test File Patterns by Language/Framework
 // ============================================================================
@@ -319,6 +324,8 @@ end_of_record
 `;
     }
     generateSarif(data) {
+        const status = securityReportExecution(data);
+        const findings = data.findings ?? data.topVulnerabilities;
         return JSON.stringify({
             $schema: 'https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json',
             version: '2.1.0',
@@ -330,14 +337,23 @@ end_of_record
                             informationUri: 'https://github.com/ruvnet/agentic-qe',
                         },
                     },
-                    results: data.topVulnerabilities.map((v, i) => ({
+                    properties: { securityScan: { status, evidence: data.evidence, coverage: data.coverage,
+                            limitations: data.limitations, analysisDepth: data.analysisDepth } },
+                    invocations: [{
+                            executionSuccessful: data.evidence?.completeness === 'complete',
+                            ...(data.evidence?.completeness === 'complete' ? {} : {
+                                toolExecutionNotifications: [{ level: 'warning',
+                                        message: { text: `Security analysis ${status}; findings do not establish complete coverage.` } }],
+                            }),
+                        }],
+                    results: findings.map((v, i) => ({
                         ruleId: `VULN-${String(i + 1).padStart(3, '0')}`,
                         level: v.severity === 'critical' ? 'error' : v.severity === 'high' ? 'error' : 'warning',
-                        message: { text: v.type },
+                        message: { text: v.type ?? v.title ?? 'Security finding' },
                         locations: [{
                                 physicalLocation: {
-                                    artifactLocation: { uri: v.file },
-                                    region: { startLine: v.line },
+                                    artifactLocation: { uri: v.file ?? v.location?.file ?? '' },
+                                    ...((v.line ?? v.location?.line ?? 0) > 0 ? { region: { startLine: v.line ?? v.location?.line } } : {}),
                                 },
                             }],
                     })),
@@ -411,6 +427,14 @@ ${data.gaps.length === 0 ? 'No significant gaps detected.' : data.gaps.map(g =>
 
 **Generated:** ${new Date().toISOString()}
 **Scanner:** Agentic QE v3 Security
+**Execution:** ${securityReportExecution(data)}
+
+## Execution receipts
+
+\`\`\`json
+${JSON.stringify({ evidence: data.evidence, coverage: data.coverage, limitations: data.limitations,
+            analysisDepth: data.analysisDepth }, null, 2)}
+\`\`\`
 
 ## Summary
 
@@ -430,6 +454,12 @@ ${data.topVulnerabilities.map(v => `### ${v.type}
 - **Line:** ${v.line}
 `).join('\n')}
 
+## All findings
+
+\`\`\`json
+${JSON.stringify(data.findings ?? data.topVulnerabilities, null, 2)}
+\`\`\`
+
 ## Recommendations
 
 ${data.recommendations.map((r, i) => `${i + 1}. ${r}`).join('\n')}
@@ -443,7 +473,7 @@ ${data.recommendations.map((r, i) => `${i + 1}. ${r}`).join('\n')}
 
 ## Quality Score
 
-**${data.qualityScore.toFixed(1)}** / 100
+${typeof data.qualityScore === 'number' ? `**${data.qualityScore.toFixed(1)}** / 100` : 'N/A — measured gate uses individual checks.'}
 
 ## Metrics
 
@@ -500,6 +530,7 @@ ${data.recommendations.length === 0 ? 'No recommendations - all quality gates pa
         switch (taskType) {
             case 'scan-security':
                 return {
+                    status: securityReportExecution(data),
                     vulnerabilities: data.vulnerabilities,
                     critical: data.critical,
                     high: data.high,

package/dist/coordination/task-executor.d.ts

@@ -13,7 +13,7 @@
  * Handler implementations are extracted into ./handlers/ modules.
  */
 import { DomainName } from '../shared/types';
-import { EventBus, QEKernel } from '../kernel/interfaces';
+import { EventBus, QEKernel, MemoryBackend } from '../kernel/interfaces';
 import { TaskType, QueenTask } from './queen-coordinator';
 import type { QualityFeedbackLoop } from '../feedback/feedback-loop.js';
 import type { TestGeneratorService } from '../domains/test-generation';
@@ -63,6 +63,8 @@ export declare class DomainTaskExecutor implements TaskHandlerContext {
     private coherenceActionGate;
     private readonly taskHandlers;
     constructor(kernel: QEKernel, eventBus: EventBus, config?: Partial<TaskExecutorConfig>);
+    /** Share the initialized kernel store with handlers that consume measured evidence. */
+    get memory(): MemoryBackend;
     /** Expose config to handler modules */
     get config(): {
         defaultLanguage: string;

package/dist/coordination/task-executor.js

@@ -150,6 +150,10 @@ export class DomainTaskExecutor {
     // ============================================================================
     // TaskHandlerContext implementation (used by handler modules)
     // ============================================================================
+    /** Share the initialized kernel store with handlers that consume measured evidence. */
+    get memory() {
+        return this.kernel.memory;
+    }
     /** Expose config to handler modules */
     get config() {
         return this._config;

package/dist/domains/security-compliance/interfaces.d.ts

@@ -1,3 +1,4 @@
+import type { SecurityScanEvidence } from './scan-evidence.js';
 /**
  * Agentic QE v3 - Security & Compliance Domain Interfaces
  *
@@ -133,6 +134,8 @@ export interface SASTResult {
     readonly vulnerabilities: Vulnerability[];
     readonly summary: ScanSummary;
     readonly coverage: SecurityCoverage;
+    /** Absent on legacy adapters; absence does not prove completed analysis. */
+    readonly evidence?: SecurityScanEvidence;
 }
 export interface RuleSet {
     readonly id: string;
@@ -147,6 +150,8 @@ export interface FalsePositiveCheck {
     readonly reason?: string;
 }
 export interface SecurityCoverage {
+    /** Counter scope; external engine rule coverage is described in evidence. */
+    readonly rulesAppliedScope?: 'built-in-patterns';
     readonly filesScanned: number;
     readonly linesScanned: number;
     readonly rulesApplied: number;

package/dist/domains/security-compliance/interfaces.js

@@ -1,8 +1,2 @@
-/**
- * Agentic QE v3 - Security & Compliance Domain Interfaces
- *
- * Bounded Context: Security & Compliance
- * Responsibility: SAST/DAST scanning, vulnerability analysis, compliance validation
- */
 export {};
 //# sourceMappingURL=interfaces.js.map

package/dist/domains/security-compliance/scan-discovery.d.ts

@@ -0,0 +1,12 @@
+import type { SecurityDiscoveryEvidence } from './scan-evidence.js';
+export declare function isSecuritySourceFile(filePath: string): boolean;
+export interface SecurityDiscoveryOptions {
+    readonly maxFiles?: number;
+    readonly maxDepth?: number;
+}
+/** Discover source inputs without turning failures or truncation into empty success. */
+export declare function discoverSecurityFiles(target: string, options?: SecurityDiscoveryOptions): Promise<{
+    files: string[];
+    discovery: SecurityDiscoveryEvidence;
+}>;
+//# sourceMappingURL=scan-discovery.d.ts.map

package/dist/domains/security-compliance/scan-discovery.js

@@ -0,0 +1,105 @@
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+// The established security task's source-language scope. A direct file target
+// is retained even when unsupported, so its scanner disposition is observable.
+const SOURCE_EXTENSIONS = new Set([
+    '.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs', '.py', '.pyw', '.go', '.rs',
+    '.java', '.kt', '.kts', '.rb', '.cs', '.php', '.swift', '.c', '.h', '.cpp',
+    '.hpp', '.cc', '.scala',
+]);
+const EXCLUDED_DIRECTORIES = new Set([
+    'node_modules', '.git', 'dist', 'build', 'coverage', '.nyc_output',
+    '__pycache__', '.venv', 'venv', '.tox', '.mypy_cache', 'target', '.gradle',
+    'vendor', '.bundle', '.agentic-qe', '.claude', '.cache', '.npm', '.yarn',
+    '.next', '.nuxt', '.svelte-kit', 'out', '.turbo', 'tmp', 'temp', '.tmp',
+]);
+export function isSecuritySourceFile(filePath) {
+    return SOURCE_EXTENSIONS.has(path.extname(filePath).toLowerCase());
+}
+/** Discover source inputs without turning failures or truncation into empty success. */
+export async function discoverSecurityFiles(target, options = {}) {
+    const maxFiles = options.maxFiles ?? 5000;
+    const maxDepth = options.maxDepth ?? 64;
+    if (!Number.isSafeInteger(maxFiles) || maxFiles < 1
+        || !Number.isSafeInteger(maxDepth) || maxDepth < 0) {
+        throw new Error('Security discovery requires a positive file limit and non-negative depth limit.');
+    }
+    const files = [];
+    const issues = [];
+    const excludedPaths = [];
+    const root = path.resolve(target);
+    let rootFailed = false;
+    let truncated = false;
+    function recordError(location, error) {
+        const code = error?.code;
+        // Raw errors can include source text, arguments, URLs, or credentials.
+        issues.push({ path: location, reason: typeof code === 'string' && /^[A-Z0-9_]{1,32}$/.test(code)
+                ? code : 'DISCOVERY_FAILED' });
+    }
+    async function walk(directory, depth) {
+        if (depth > maxDepth) {
+            issues.push({ path: directory, reason: 'DEPTH_LIMIT' });
+            return;
+        }
+        let entries;
+        try {
+            entries = await fs.readdir(directory, { withFileTypes: true });
+        }
+        catch (error) {
+            recordError(directory, error);
+            if (directory === root)
+                rootFailed = true;
+            return;
+        }
+        entries.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+        for (const entry of entries) {
+            if (truncated)
+                return;
+            const entryPath = path.join(directory, entry.name);
+            if (entry.isSymbolicLink()) {
+                // Observed symlinks are explicitly excluded; their targets are not
+                // claimed as scanned. Discovery does not guarantee an atomic snapshot.
+                excludedPaths.push(entryPath);
+            }
+            else if (entry.isDirectory()) {
+                if (EXCLUDED_DIRECTORIES.has(entry.name))
+                    excludedPaths.push(entryPath);
+                else
+                    await walk(entryPath, depth + 1);
+            }
+            else if (entry.isFile() && isSecuritySourceFile(entry.name)) {
+                if (files.length === maxFiles) {
+                    issues.push({ path: entryPath, reason: 'FILE_LIMIT' });
+                    truncated = true;
+                    return;
+                }
+                files.push(entryPath);
+            }
+        }
+    }
+    try {
+        const stat = await fs.lstat(root);
+        if (stat.isFile())
+            files.push(root);
+        else if (stat.isDirectory())
+            await walk(root, 0);
+        else {
+            rootFailed = true;
+            issues.push({ path: root, reason: stat.isSymbolicLink() ? 'SYMLINK_TARGET' : 'NOT_REGULAR_INPUT' });
+        }
+    }
+    catch (error) {
+        rootFailed = true;
+        recordError(root, error);
+    }
+    return {
+        files,
+        discovery: {
+            status: rootFailed ? 'failed' : issues.length > 0 ? 'partial' : 'complete',
+            policy: 'aqe-security-source-files@1',
+            issues,
+            excludedPaths,
+        },
+    };
+}
+//# sourceMappingURL=scan-discovery.js.map

package/dist/domains/security-compliance/scan-evidence.d.ts

@@ -0,0 +1,57 @@
+/** Evidence of executed security analysis; findings alone do not establish coverage. */
+export type SecurityFileDisposition = 'analyzed' | 'unsupported' | 'unreadable' | 'excluded' | 'failed' | 'unavailable' | 'not-run';
+export interface SecurityFileEvidence {
+    /** Normalized absolute path; normalization does not resolve symlinks. */
+    readonly path: string;
+    readonly engineId: string;
+    readonly status: SecurityFileDisposition;
+    /** SHA-256 of the exact source bytes read by this engine. */
+    readonly sourceDigest?: string;
+    readonly readLines: number;
+    readonly analyzedLines: number;
+    /** A bounded error code or static description; never source contents. */
+    readonly reason?: string;
+}
+export interface SecurityEngineEvidence {
+    readonly id: string;
+    readonly requested: boolean;
+    /** Whether this engine is required for the declared analysis scope. */
+    readonly required: boolean;
+    readonly status: 'completed' | 'partial' | 'failed' | 'unavailable' | 'disabled' | 'unverified' | 'not-run';
+    readonly scope: 'requested-files' | 'parent-directory' | 'url';
+    readonly target?: string;
+    /** Only populated when input membership was actually established. */
+    readonly analyzedFiles?: number;
+    readonly ruleIds?: readonly string[];
+    /** SHA-256 of selected rule definitions, when these are locally known. */
+    readonly rulesetDigest?: string;
+    readonly ruleCoverage: 'known' | 'unknown';
+    readonly version?: string;
+    readonly errors: readonly string[];
+    readonly limitations: readonly string[];
+}
+export interface SecurityScanEvidence {
+    readonly schemaVersion: 1;
+    /** Completeness of required declared scope, not absence of vulnerabilities. */
+    readonly completeness: 'complete' | 'partial' | 'none';
+    /** Unique normalized absolute requested paths, without resolving symlinks. */
+    readonly requestedFiles: number;
+    readonly requestedPaths: readonly string[];
+    readonly duplicateInputs: number;
+    /** A path may have separate receipts for independently executed engines. */
+    readonly files: readonly SecurityFileEvidence[];
+    readonly engines: readonly SecurityEngineEvidence[];
+    readonly limitations: readonly string[];
+    /** Discovery describes the declared source-file policy, not every repository file. */
+    readonly discovery?: SecurityDiscoveryEvidence;
+}
+export interface SecurityDiscoveryEvidence {
+    readonly status: 'complete' | 'partial' | 'failed';
+    readonly policy: 'aqe-security-source-files@1';
+    readonly issues: readonly {
+        readonly path: string;
+        readonly reason: string;
+    }[];
+    readonly excludedPaths: readonly string[];
+}
+//# sourceMappingURL=scan-evidence.d.ts.map

package/dist/domains/security-compliance/scan-evidence.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=scan-evidence.js.map

package/dist/domains/security-compliance/services/scanners/sast-scanner.d.ts

@@ -2,8 +2,8 @@
  * Agentic QE v3 - SAST (Static Application Security Testing) Scanner
  * Performs static code analysis to detect security vulnerabilities
  */
+import { FilePath } from '@shared/value-objects/index.js';
 import { Result } from '@shared/types/index.js';
-import type { FilePath } from '@shared/value-objects/index.js';
 import type { SecurityScannerConfig, Vulnerability, RemediationAdvice, SASTResult, RuleSet, FalsePositiveCheck, MemoryBackend, HybridRouter, ScanStatus } from './scanner-types.js';
 export declare class SASTScanner {
     private readonly config;
@@ -27,7 +27,7 @@ export declare class SASTScanner {
     private runPatternScanning;
     /**
      * Run semgrep scanning when enabled and available.
-     * Returns converted vulnerabilities or empty array on failure/unavailability.
+     * Optional engine failure preserves completed pattern analysis and its findings.
      */
     private runSemgrepScanning;
     /**
@@ -54,6 +54,7 @@ export declare class SASTScanner {
     /**
      * Analyze a file for security vulnerabilities using pattern-based detection
      */
+    private getApplicablePatterns;
     private analyzeFile;
     /**
      * Find all matches of a security pattern in the file content