agentic-qe 3.14.2 → 3.14.4

package/dist/cli/commands/security.js

@@ -5,7 +5,8 @@
  */
 import { Command } from 'commander';
 import chalk from 'chalk';
-import { walkSourceFiles } from '../utils/file-discovery.js';
+import { discoverSecurityFiles } from '../../domains/security-compliance/scan-discovery.js';
+import { FilePath } from '../../shared/value-objects/index.js';
 import { writeOutput, toJSON, toSARIF, securityToMarkdown } from '../utils/ci-output.js';
 export function createSecurityCommand(context, cleanupAndExit, ensureInitialized) {
     const securityCmd = new Command('security')
@@ -84,126 +85,192 @@ export function createSecurityCommand(context, cleanupAndExit, ensureInitialized
             }
             return; // Don't fall through to SAST/DAST path
         }
+        const format = options.format;
+        const runSAST = options.sast || (!options.dast && !options.compliance);
+        const frameworks = options.compliance
+            ? options.compliance.split(',').map((value) => value.trim()).filter(Boolean)
+            : [];
+        const scanResult = {
+            vulnerabilities: [], target: options.target,
+            scanType: [runSAST && 'SAST', options.dast && 'DAST', frameworks.length > 0 && 'Compliance'].filter(Boolean).join('+'),
+            checks: [], status: 'not-run',
+        };
+        const checks = scanResult.checks;
         try {
-            const format = options.format;
-            if (format === 'text') {
-                console.log(chalk.blue(`\n Running security scan on ${options.target}...\n`));
-            }
             const securityAPI = await context.kernel.getDomainAPIAsync('security-compliance');
             if (!securityAPI) {
-                console.log(chalk.red('Security domain not available'));
-                return;
-            }
-            const path = await import('path');
-            const targetPath = path.resolve(options.target);
-            // Fix #280: Use shared file discovery supporting all languages
-            const files = walkSourceFiles(targetPath, { includeTests: true });
-            if (files.length === 0) {
-                console.log(chalk.yellow('No files found to scan'));
-                return;
-            }
-            if (format === 'text') {
-                console.log(chalk.gray(`  Scanning ${files.length} files...\n`));
+                checks.push({ name: scanResult.scanType, status: 'failed', reason: 'Security domain not available' });
             }
-            const scanResult = {
-                vulnerabilities: [],
-                target: options.target,
-                scanType: [options.sast && 'SAST', options.dast && 'DAST', options.compliance && 'Compliance'].filter(Boolean).join('+') || 'SAST',
-            };
-            // Run SAST if requested
-            if (options.sast) {
-                if (format === 'text')
-                    console.log(chalk.blue(' SAST Scan:'));
-                const sastResult = await securityAPI.runSASTScan(files);
-                if (sastResult.success && sastResult.value) {
-                    const result = sastResult.value;
-                    const vulns = result.vulnerabilities || [];
-                    scanResult.vulnerabilities = vulns;
-                    if (format === 'text') {
-                        if (vulns.length === 0) {
-                            console.log(chalk.green('  * No vulnerabilities found'));
-                        }
-                        else {
-                            console.log(chalk.yellow(`  ! Found ${vulns.length} potential issues:`));
-                            for (const v of vulns.slice(0, 10)) {
-                                const color = v.severity === 'high' ? chalk.red : v.severity === 'medium' ? chalk.yellow : chalk.gray;
-                                console.log(color(`    [${v.severity}] ${v.type}: ${v.file}:${v.line}`));
-                                console.log(chalk.gray(`           ${v.message}`));
+            else {
+                if (runSAST) {
+                    const { files, discovery } = await discoverSecurityFiles(options.target);
+                    scanResult.discovery = discovery;
+                    if (files.length === 0) {
+                        checks.push({ name: 'SAST', status: 'not-run', reason: 'No analyzable input was discovered; no SAST scan ran.' });
+                    }
+                    else {
+                        try {
+                            const sastResult = await securityAPI.runSASTScan(files.map(file => FilePath.create(file)));
+                            if (sastResult.success && sastResult.value) {
+                                const result = sastResult.value;
+                                scanResult.vulnerabilities = result.vulnerabilities.map(formatVulnerability);
+                                scanResult.coverage = result.evidence ? result.coverage : undefined;
+                                scanResult.evidence = result.evidence;
+                                checks.push({
+                                    name: 'SAST', status: result.evidence?.completeness ?? 'unverified',
+                                    ...(!result.evidence ? { reason: 'The scanner returned no execution receipts.' } : {}),
+                                });
                             }
-                            if (vulns.length > 10) {
-                                console.log(chalk.gray(`    ... and ${vulns.length - 10} more`));
+                            else {
+                                checks.push({ name: 'SAST', status: 'failed', reason: !sastResult.success ? securityFailureReason('SAST scan', sastResult.error) : 'SAST scan returned no result' });
                             }
                         }
+                        catch (error) {
+                            checks.push({ name: 'SAST', status: 'failed', reason: securityFailureReason('SAST scan', error) });
+                        }
+                    }
+                    if (discovery.status !== 'complete') {
+                        checks.push({ name: 'Source discovery', status: discovery.status, reason: 'Requested source discovery did not complete; inspect discovery issues.' });
                     }
                 }
-                else if (format === 'text') {
-                    console.log(chalk.red(`  x SAST failed: ${sastResult.error?.message || 'Unknown error'}`));
-                }
-                if (format === 'text')
-                    console.log('');
-            }
-            // Run compliance check if requested
-            if (options.compliance) {
-                const frameworks = options.compliance.split(',');
-                if (format === 'text')
-                    console.log(chalk.blue(` Compliance Check (${frameworks.join(', ')}):`));
-                // Run compliance check for each framework
-                const compResults = await Promise.all(frameworks.map((f) => securityAPI.runComplianceCheck(f.trim())));
-                const compResult = compResults[0]; // Primary result for display
-                if (compResult.success && compResult.value) {
-                    const result = compResult.value;
-                    scanResult.compliance = result;
-                    if (format === 'text') {
-                        if (result.compliant) {
-                            console.log(chalk.green('  * Compliant with all frameworks'));
-                        }
-                        else {
-                            console.log(chalk.yellow('  ! Compliance issues found:'));
-                            for (const issue of (result.issues || []).slice(0, 5)) {
-                                console.log(chalk.yellow(`    [${issue.framework}] ${issue.issue}`));
+                if (frameworks.length > 0) {
+                    const issues = [];
+                    let compliant = true;
+                    for (const framework of frameworks) {
+                        try {
+                            const outcome = await securityAPI.runComplianceCheck(framework);
+                            if (!outcome.success || !outcome.value) {
+                                compliant = false;
+                                checks.push({ name: `Compliance:${framework}`, status: 'failed', reason: !outcome.success ? securityFailureReason('Compliance check', outcome.error) : 'Compliance check returned no result' });
+                                continue;
                             }
+                            const report = outcome.value;
+                            const legacy = report;
+                            const violations = report.violations ?? [];
+                            const skipped = report.skippedRules ?? [];
+                            const passed = report.passedRules ?? [];
+                            const measured = Array.isArray(report.violations) && Array.isArray(report.passedRules) && Array.isArray(report.skippedRules);
+                            const status = !measured ? 'unverified' : skipped.length > 0 ? 'partial' : passed.length + violations.length > 0 ? 'complete' : 'none';
+                            checks.push({ name: `Compliance:${framework}`, status, ...(skipped.length ? { reason: `${skipped.length} compliance rules were skipped.` } : {}) });
+                            issues.push(...violations.map(violation => ({ framework, issue: violation.details })));
+                            if (legacy.issues)
+                                issues.push(...legacy.issues);
+                            if (status !== 'complete' || violations.length > 0 || legacy.compliant === false)
+                                compliant = false;
+                        }
+                        catch (error) {
+                            compliant = false;
+                            checks.push({ name: `Compliance:${framework}`, status: 'failed', reason: securityFailureReason('Compliance check', error) });
                         }
                     }
+                    scanResult.compliance = { compliant, issues };
                 }
-                else if (format === 'text') {
-                    console.log(chalk.red(`  x Compliance check failed: ${compResult.error?.message || 'Unknown error'}`));
-                }
-                if (format === 'text')
-                    console.log('');
             }
-            // DAST note
-            if (options.dast && format === 'text') {
-                console.log(chalk.gray('Note: DAST requires running application URLs. Use --target with URLs for DAST scanning.'));
+            if (options.dast) {
+                checks.push({ name: 'DAST', status: 'not-run', reason: 'This CLI command does not execute DAST. A running application URL and DAST execution path are required.' });
             }
-            // Format-aware output
-            if (format === 'json') {
+        }
+        catch (error) {
+            checks.push({ name: scanResult.scanType, status: 'failed', reason: securityFailureReason('Security scan', error) });
+        }
+        scanResult.status = summarizeChecks(checks);
+        try {
+            if (format === 'json')
                 writeOutput(toJSON(scanResult), options.output);
-            }
-            else if (format === 'sarif') {
+            else if (format === 'sarif')
                 writeOutput(toSARIF(scanResult), options.output);
-            }
-            else if (format === 'markdown') {
+            else if (format === 'markdown')
                 writeOutput(securityToMarkdown(scanResult), options.output);
-            }
-            else {
-                console.log(chalk.green(' Security scan complete\n'));
-            }
-            // Exit codes: 1 = critical/high vulns, 2 = medium-only vulns, 0 = low/none
-            const hasHighSeverity = scanResult.vulnerabilities.some(v => v.severity === 'high' || v.severity === 'critical');
-            const hasMediumSeverity = scanResult.vulnerabilities.some(v => v.severity === 'medium');
-            if (hasHighSeverity) {
-                await cleanupAndExit(1);
-            }
-            else if (hasMediumSeverity) {
-                await cleanupAndExit(2);
-            }
-            await cleanupAndExit(0);
+            else
+                printSecurityResult(scanResult);
         }
-        catch (err) {
-            console.error(chalk.red('\nFailed:'), err);
-            await cleanupAndExit(1);
+        catch (error) {
+            console.error(chalk.red('Failed to write security report:'), error);
+            return cleanupAndExit(1);
         }
+        // Incomplete execution never has a clean exit, even if it found no vulnerabilities.
+        if (scanResult.status !== 'complete' || scanResult.compliance?.compliant === false)
+            return cleanupAndExit(1);
+        if (scanResult.vulnerabilities.some(v => v.severity === 'high' || v.severity === 'critical'))
+            return cleanupAndExit(1);
+        if (scanResult.vulnerabilities.some(v => v.severity === 'medium'))
+            return cleanupAndExit(2);
+        return cleanupAndExit(0);
     });
     return securityCmd;
 }
+/** Provider exceptions can contain credentials or source; expose only an operation and errno. */
+function securityFailureReason(operation, error) {
+    const code = error && typeof error === 'object' && 'code' in error ? error.code : undefined;
+    return typeof code === 'string' && /^[A-Z0-9_]{1,32}$/.test(code)
+        ? `${operation} failed (${code}).`
+        : `${operation} failed.`;
+}
+function summarizeChecks(checks) {
+    if (checks.length === 0)
+        return 'not-run';
+    if (checks.every(check => check.status === 'complete'))
+        return 'complete';
+    if (checks.some(check => check.status === 'partial' || check.status === 'complete'))
+        return 'partial';
+    if (checks.some(check => check.status === 'failed'))
+        return 'failed';
+    if (checks.some(check => check.status === 'unverified'))
+        return 'unverified';
+    if (checks.some(check => check.status === 'none'))
+        return 'none';
+    return 'not-run';
+}
+function formatVulnerability(value) {
+    if ('location' in value) {
+        return {
+            severity: value.severity, type: value.title || value.category,
+            file: value.location.file, line: value.location.line ?? 1,
+            message: value.description,
+        };
+    }
+    return value;
+}
+function printSecurityResult(result) {
+    console.log(chalk.blue(`\n Security scan on ${result.target}\n`));
+    for (const check of result.checks ?? []) {
+        const color = check.status === 'complete' ? chalk.green : chalk.yellow;
+        console.log(color(`  ${check.name}: ${check.status}${check.reason ? ` — ${check.reason}` : ''}`));
+    }
+    if (result.coverage) {
+        console.log(`  Analyzed ${result.coverage.filesScanned} files, ${result.coverage.linesScanned} lines; ${result.coverage.rulesApplied} rules applied${result.coverage.rulesAppliedScope ? ` (${result.coverage.rulesAppliedScope})` : ''}.`);
+    }
+    if (result.vulnerabilities.length === 0) {
+        console.log(result.status === 'complete'
+            ? '  No vulnerabilities found in completed checks.'
+            : '  No vulnerabilities reported; requested analysis is incomplete or unverified.');
+    }
+    else {
+        console.log(chalk.yellow(`  Found ${result.vulnerabilities.length} potential issues:`));
+        for (const vulnerability of result.vulnerabilities.slice(0, 10)) {
+            console.log(`    [${vulnerability.severity}] ${vulnerability.type}: ${vulnerability.file}:${vulnerability.line}`);
+            console.log(`           ${vulnerability.message}`);
+        }
+        if (result.vulnerabilities.length > 10)
+            console.log(`    ... and ${result.vulnerabilities.length - 10} more`);
+    }
+    if (result.compliance) {
+        console.log(`  Compliance: ${result.compliance.compliant ? 'compliant in completed checks' : 'failed or incomplete'}`);
+        for (const issue of result.compliance.issues ?? [])
+            console.log(`    [${issue.framework}] ${issue.issue}`);
+    }
+    const limitations = [
+        ...(result.evidence?.limitations ?? []),
+        ...(result.evidence?.engines.flatMap(engine => engine.status === 'completed' ? [] : [`${engine.id}: ${engine.status}`, ...engine.errors]) ?? []),
+        ...(result.evidence?.files.filter(file => file.status !== 'analyzed' && file.status !== 'excluded').map(file => `${file.path}: ${file.status}${file.reason ? ` (${file.reason})` : ''}`) ?? []),
+        ...(result.discovery?.issues.map(issue => `${issue.path}: ${issue.reason}`) ?? []),
+    ];
+    for (const limitation of limitations.slice(0, 10))
+        console.log(chalk.yellow(`  ${limitation}`));
+    if (limitations.length > 10)
+        console.log(`  ... ${limitations.length - 10} additional limitations; use JSON, Markdown, or SARIF for full receipts.`);
+    if (result.evidence)
+        console.log('  Scope: completed checks of the declared required engines; this is not full SAST assurance.');
+    console.log(`\n Security analysis: ${result.status}\n`);
+}
 //# sourceMappingURL=security.js.map

package/dist/cli/commands/test.js

@@ -179,6 +179,7 @@ export function createTestCommand(context, cleanupAndExit, ensureInitialized) {
                 }
                 else {
                     console.log(chalk.red(`Failed: ${result.error?.message || 'Unknown error'}`));
+                    await cleanupAndExit(1);
                 }
             }
             else if (action === 'schedule') {

package/dist/cli/commands/workflow.js

@@ -29,7 +29,6 @@ export function createWorkflowCommand(context, cleanupAndExit, ensureInitialized
         .action(async (file, options) => {
         if (!await ensureInitialized())
             return;
-        const fs = await import('fs');
         const pathModule = await import('path');
         const filePath = pathModule.resolve(file);
         try {
@@ -123,6 +122,9 @@ export function createWorkflowCommand(context, cleanupAndExit, ensureInitialized
                         console.log(chalk.yellow(`Workflow ${finalStatus.status}`));
                     }
                 }
+                console.log('');
+                await cleanupAndExit(finalStatus?.status === 'completed' ? 0 : 1);
+                return;
             }
             else {
                 console.log(chalk.green('Workflow execution started'));
@@ -424,6 +426,12 @@ export function createWorkflowCommand(context, cleanupAndExit, ensureInitialized
             if (status.error) {
                 console.log(chalk.red(`\n  Error: ${status.error}`));
             }
+            for (const receipt of status.parallelCompositionReceipts ?? []) {
+                console.log(`  Composition ${receipt.groupId}: ${receipt.disposition}`);
+                for (const conflict of receipt.conflicts) {
+                    console.log(`    ${conflict.kind}: ${conflict.stepA}.${conflict.pathA} / ${conflict.stepB}.${conflict.pathB}`);
+                }
+            }
             if (options.verbose && status.stepResults.size > 0) {
                 console.log(chalk.cyan('\n  Step Results:'));
                 for (const [stepId, result] of status.stepResults) {

package/dist/cli/handlers/task-handler.js

@@ -68,7 +68,7 @@ export class TaskHandler {
     }
     async executeSubmit(type, options, context) {
         if (!await this.ensureInitialized())
-            return;
+            return this.cleanupAndExit(1);
         try {
             const taskType = type;
             const payload = parseJsonOption(options.payload, 'payload');
@@ -112,9 +112,9 @@ export class TaskHandler {
                                 waitSpinner.succeed('Task completed successfully');
                                 completed = true;
                             }
-                            else if (taskStatus.status === 'failed') {
-                                waitSpinner.fail(`Task failed: ${taskStatus.error || 'Unknown error'}`);
-                                completed = true;
+                            else if (taskStatus.status === 'failed' || taskStatus.status === 'cancelled') {
+                                waitSpinner.fail(`Task ${taskStatus.status}: ${taskStatus.error || 'No successful result'}`);
+                                return this.cleanupAndExit(1);
                             }
                             else {
                                 // Update spinner with progress info
@@ -127,11 +127,13 @@ export class TaskHandler {
                     }
                     if (!completed) {
                         waitSpinner.fail('Task timed out');
+                        return this.cleanupAndExit(1);
                     }
                 }
             }
             else {
                 console.log(chalk.red(`   Error: ${result.error.message}`));
+                return this.cleanupAndExit(1);
             }
             console.log('');
         }
@@ -142,7 +144,7 @@ export class TaskHandler {
     }
     async executeList(options, context) {
         if (!await this.ensureInitialized())
-            return;
+            return this.cleanupAndExit(1);
         try {
             const tasks = context.queen.listTasks({
                 status: options.status,
@@ -155,6 +157,7 @@ export class TaskHandler {
                     taskId: task.taskId,
                     type: task.task.type,
                     status: task.status,
+                    cancellationResultPending: task.cancellationResultPending,
                     priority: task.task.priority,
                     domain: task.assignedDomain || null,
                     startedAt: task.startedAt?.toISOString() || null,
@@ -189,11 +192,14 @@ export class TaskHandler {
     }
     async executeCancel(taskId, context) {
         if (!await this.ensureInitialized())
-            return;
+            return this.cleanupAndExit(1);
         try {
             const result = await context.queen.cancelTask(taskId);
             if (result.success) {
-                console.log(chalk.green(`\n  Task cancelled: ${taskId}\n`));
+                console.log(chalk.green(`\n  Cancellation requested: ${taskId}\n`));
+                if (context.queen.getTaskStatus(taskId)?.cancellationResultPending) {
+                    console.log(chalk.yellow('  Task result pending; work may continue.'));
+                }
             }
             else {
                 console.log(chalk.red(`\n  Failed to cancel task: ${result.error.message}\n`));
@@ -206,12 +212,12 @@ export class TaskHandler {
     }
     async executeTaskStatus(taskId, options, context) {
         if (!await this.ensureInitialized())
-            return;
+            return this.cleanupAndExit(1);
         try {
             const task = context.queen.getTaskStatus(taskId);
             if (!task) {
                 console.log(chalk.red(`\n  Task not found: ${taskId}\n`));
-                return;
+                return this.cleanupAndExit(1);
             }
             const format = (options.format || 'text');
             if (format === 'json') {
@@ -219,6 +225,7 @@ export class TaskHandler {
                     taskId,
                     type: task.task.type,
                     status: task.status,
+                    cancellationResultPending: task.cancellationResultPending,
                     priority: task.task.priority,
                     domain: task.assignedDomain || null,
                     agents: task.assignedAgents,
@@ -237,6 +244,9 @@ export class TaskHandler {
             console.log(chalk.blue(`\n  Task: ${taskId}\n`));
             console.log(`  Type: ${task.task.type}`);
             console.log(`  Status: ${getStatusColor(task.status)}`);
+            if (task.cancellationResultPending) {
+                console.log(chalk.yellow('  Task result pending; work may continue.'));
+            }
             console.log(`  Priority: ${task.task.priority}`);
             if (task.assignedDomain) {
                 console.log(`  Domain: ${task.assignedDomain}`);

package/dist/cli/helpers/domain-plugins.d.ts

@@ -0,0 +1,5 @@
+import type { DomainPlugin, PluginLoader } from '../../kernel/interfaces.js';
+import type { DomainName } from '../../shared/types/index.js';
+/** Supply the Queen with the actual plugin instances that execute CLI tasks. */
+export declare function loadCLIDomainPlugins(loader: PluginLoader): Promise<Map<DomainName, DomainPlugin>>;
+//# sourceMappingURL=domain-plugins.d.ts.map

package/dist/cli/helpers/domain-plugins.js

@@ -0,0 +1,11 @@
+/** Supply the Queen with the actual plugin instances that execute CLI tasks. */
+export async function loadCLIDomainPlugins(loader) {
+    await loader.loadAll();
+    const plugins = new Map();
+    for (const domain of loader.getLoaded()) {
+        // load() returns the cached instance after loadAll(), including dependencies.
+        plugins.set(domain, await loader.load(domain));
+    }
+    return plugins;
+}
+//# sourceMappingURL=domain-plugins.js.map

package/dist/cli/index.js

@@ -98,6 +98,7 @@ async function autoInitialize() {
     const { WorkflowOrchestrator } = await import('../coordination/workflow-orchestrator.js');
     const { createQueenCoordinator } = await import('../coordination/queen-coordinator.js');
     const { createPersistentScheduler } = await import('./scheduler/index.js');
+    const { loadCLIDomainPlugins } = await import('./helpers/domain-plugins.js');
     context.kernel = new QEKernelImpl({
         maxConcurrentAgents: 15,
         memoryBackend: 'sqlite',
@@ -105,10 +106,11 @@ async function autoInitialize() {
         lazyLoading: true,
         enabledDomains: [...ALL_DOMAINS],
         // CLI commands are short-lived and don't benefit from the bridge's
-        // event-driven domain reactions. Skip the eager plugin-load cost.
+        // event-driven domain reactions.
         enableExperienceBridge: false,
     });
     await context.kernel.initialize();
+    const domainPlugins = await loadCLIDomainPlugins(context.kernel.plugins);
     context.router = new CrossDomainEventRouter(context.kernel.eventBus);
     await context.router.initialize();
     const getDomainAPI = (domain) => {
@@ -119,7 +121,7 @@ async function autoInitialize() {
     await context.workflowOrchestrator.initialize();
     registerDomainWorkflowActions(context.kernel, context.workflowOrchestrator);
     context.persistentScheduler = createPersistentScheduler();
-    context.queen = createQueenCoordinator(context.kernel, context.router, protocolExecutor, undefined);
+    context.queen = createQueenCoordinator(context.kernel, context.router, protocolExecutor, undefined, domainPlugins);
     await context.queen.initialize();
     // Bridge the CLI-initialized components into the MCP handlers' fleet state.
     // The memory/agent/task/team/pipeline handlers are shared between the MCP
@@ -400,12 +402,19 @@ async function main() {
         console.log(VERSION);
         process.exit(0);
     }
-    const { bootstrapTokenTracking } = await import('../init/token-bootstrap.js');
-    await bootstrapTokenTracking({
-        enableOptimization: true,
-        enablePersistence: true,
-        verbose: process.env.AQE_VERBOSE === 'true',
-    });
+    // File recovery must validate its input before anything opens, migrates, or
+    // auto-restores the project's database. Commander accepts `--` separators.
+    const commandArgs = process.argv.slice(2).filter(arg => arg !== '--');
+    const learningSnapshot = commandArgs[0] === 'learning'
+        && (commandArgs[1] === 'backup' || commandArgs[1] === 'restore');
+    if (!learningSnapshot) {
+        const { bootstrapTokenTracking } = await import('../init/token-bootstrap.js');
+        await bootstrapTokenTracking({
+            enableOptimization: true,
+            enablePersistence: true,
+            verbose: process.env.AQE_VERBOSE === 'true',
+        });
+    }
     await program.parseAsync();
     // Foreground commands own their process lifetime after command dispatch.
     if (isForegroundCommandActive())

package/dist/cli/utils/ci-config.d.ts

@@ -72,7 +72,10 @@ export interface CIRunResult {
     completedAt: Date;
     duration: number;
     phases: CIPhaseResult[];
+    /** True only when at least one gate ran and every gate passed. */
     qualityGatePassed: boolean;
+    qualityGateStatus: 'passed' | 'failed' | 'not-run';
+    qualityGateEnforced: boolean;
     overallStatus: 'passed' | 'failed' | 'warning';
     exitCode: number;
 }

package/dist/cli/utils/ci-output.d.ts

@@ -4,6 +4,9 @@
  * Provides structured output formatting for CI/CD pipeline integration.
  * Supports: text (default), json, sarif, junit, markdown
  */
+import type { SecurityCoverage } from '../../domains/security-compliance/interfaces.js';
+import type { SecurityScanEvidence } from '../../domains/security-compliance/scan-evidence.js';
+import type { discoverSecurityFiles } from '../../domains/security-compliance/scan-discovery.js';
 export type OutputFormat = 'text' | 'json' | 'sarif' | 'junit' | 'markdown';
 export interface CIOutputOptions {
     format: OutputFormat;
@@ -29,7 +32,21 @@ export interface SecurityScanResult {
     };
     target: string;
     scanType: string;
+    /** Execution completeness is independent of finding severity. */
+    status?: SecurityExecutionStatus;
+    checks?: SecurityCheckResult[];
+    coverage?: SecurityCoverage;
+    evidence?: SecurityScanEvidence;
+    discovery?: Awaited<ReturnType<typeof discoverSecurityFiles>>['discovery'];
 }
+export type SecurityExecutionStatus = 'complete' | 'partial' | 'none' | 'failed' | 'not-run' | 'unverified';
+export interface SecurityCheckResult {
+    name: string;
+    status: SecurityExecutionStatus;
+    reason?: string;
+}
+/** Legacy finding-only reports carry no evidence that the requested work ran. */
+export declare function securityExecutionStatus(result: SecurityScanResult): SecurityExecutionStatus;
 export interface TestResult {
     name: string;
     passed: boolean;

package/dist/cli/utils/ci-output.js

@@ -29,6 +29,10 @@ function getPackageVersion() {
     catch { /* fallback */ }
     return 'unknown';
 }
+/** Legacy finding-only reports carry no evidence that the requested work ran. */
+export function securityExecutionStatus(result) {
+    return result.status ?? result.evidence?.completeness ?? 'unverified';
+}
 // ============================================================================
 // Commander Option Helpers
 // ============================================================================
@@ -70,6 +74,7 @@ export function toJSON(data) {
 // ============================================================================
 const SARIF_SCHEMA = 'https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json';
 export function toSARIF(result) {
+    const status = securityExecutionStatus(result);
     const severityToLevel = (severity) => {
         switch (severity.toLowerCase()) {
             case 'critical':
@@ -124,9 +129,20 @@ export function toSARIF(result) {
                     },
                 },
                 results,
+                properties: {
+                    securityScan: {
+                        status, target: result.target, scanType: result.scanType, coverage: result.evidence ? result.coverage : undefined,
+                        evidence: result.evidence, discovery: result.discovery, checks: result.checks,
+                    },
+                },
                 invocations: [{
-                        executionSuccessful: true,
-                        commandLine: `aqe security --sast --format sarif -t ${result.target}`,
+                        executionSuccessful: status === 'complete',
+                        ...(status === 'complete' ? {} : {
+                            toolExecutionNotifications: [{
+                                    level: 'warning',
+                                    message: { text: `Security analysis ${status}; findings do not establish complete coverage.` },
+                                }],
+                        }),
                     }],
             }],
     };
@@ -236,7 +252,23 @@ export function securityToMarkdown(result) {
     let md = `# Security Scan Report\n\n`;
     md += `**Target:** ${result.target}\n`;
     md += `**Scan Type:** ${result.scanType}\n`;
+    md += `**Execution:** ${securityExecutionStatus(result)}\n`;
     md += `**Vulnerabilities Found:** ${result.vulnerabilities.length}\n\n`;
+    if (result.checks?.length) {
+        md += `## Check execution\n\n`;
+        for (const check of result.checks) {
+            md += `- **${check.name}:** ${check.status}${check.reason ? ` — ${check.reason}` : ''}\n`;
+        }
+        md += '\n';
+    }
+    if (result.coverage && result.evidence) {
+        md += `**Analyzed files:** ${result.coverage.filesScanned}\n`;
+        md += `**Analyzed lines:** ${result.coverage.linesScanned}\n`;
+        md += `**Rules applied:** ${result.coverage.rulesApplied}${result.coverage.rulesAppliedScope ? ` (${result.coverage.rulesAppliedScope})` : ''}\n\n`;
+    }
+    if (result.evidence || result.discovery) {
+        md += `## Execution receipts\n\n\`\`\`json\n${toJSON({ evidence: result.evidence, discovery: result.discovery })}\n\`\`\`\n\n`;
+    }
     if (result.vulnerabilities.length > 0) {
         md += `## Vulnerabilities\n\n`;
         md += `| Severity | Type | File | Line | Message |\n`;

package/dist/context/sources/git-source.d.ts

@@ -3,10 +3,12 @@
  */
 import type { ContextSource, ContextRequest, ContextFragment } from './types.js';
 export declare class GitContextSource implements ContextSource {
+    private readonly cwd?;
     id: string;
     name: string;
     priority: number;
     maxTokens: number;
+    constructor(cwd?: string | undefined);
     gather(request: ContextRequest): Promise<ContextFragment[]>;
 }
 //# sourceMappingURL=git-source.d.ts.map