agentic-qe 3.15.11 → 3.15.13

package/dist/domains/quality-assessment/coordinator.d.ts

@@ -19,6 +19,7 @@ import { EventBus, MemoryBackend, AgentCoordinator } from '../../kernel/interfac
 import type { HybridRouter } from '../../shared/llm/router/hybrid-router.js';
 import { QualityAssessmentAPI, GateEvaluationRequest, GateResult, QualityAnalysisRequest, QualityReport, DeploymentRequest, DeploymentAdvice, ComplexityRequest, ComplexityReport, QualityMetrics } from './interfaces';
 import { ClaimVerifierService } from '../../agents/claim-verifier/index.js';
+import * as ReportHelpers from './coordinator-reports.js';
 import type { QueenMinCutBridge } from '../../coordination/mincut/queen-integration';
 import type { ConsensusStats } from '../../coordination/consensus';
 import { BaseDomainCoordinator, type BaseDomainCoordinatorConfig } from '../base-domain-coordinator.js';
@@ -154,19 +155,13 @@ export declare class QualityAssessmentCoordinator extends BaseDomainCoordinator<
     generateReport(options: {
         format: 'json' | 'html' | 'markdown';
         includeRecommendations?: boolean;
-    }): Promise<Result<{
-        content: string;
-        format: string;
-    }, Error>>;
+    }): ReturnType<typeof ReportHelpers.generateReport>;
     /**
-     * Get quality dashboard overview
+     * Get quality dashboard overview. #1020: built from measured evidence only;
+     * unmeasured metrics are -1 and listed in `unmeasured`.
      * @returns Result containing dashboard data
      */
-    getQualityDashboard(): Promise<Result<{
-        overallScore: number;
-        metrics: QualityMetrics;
-        trends: Record<string, number>;
-    }, Error>>;
+    getQualityDashboard(): ReturnType<typeof ReportHelpers.getQualityDashboard>;
     /**
      * Analyze project risks
      * @param options - Risk analysis options
@@ -175,17 +170,10 @@ export declare class QualityAssessmentCoordinator extends BaseDomainCoordinator<
     analyzeRisks(options: {
         scope: 'project' | 'module' | 'file';
         includeSecurityRisks?: boolean;
-    }): Promise<Result<{
-        risks: Array<{
-            id: string;
-            severity: string;
-            description: string;
-            category: string;
-        }>;
-        overallRiskLevel: 'low' | 'medium' | 'high' | 'critical';
-    }, Error>>;
+    }): ReturnType<typeof ReportHelpers.analyzeRisks>;
     /**
-     * Evaluate a quality gate (simplified API)
+     * Evaluate a quality gate (simplified API). #1020: a metric the caller does
+     * not supply is unmeasured, so the gate cannot pass on it.
      * @param options - Quality gate evaluation options
      * @returns Result containing gate evaluation
      */
@@ -194,26 +182,21 @@ export declare class QualityAssessmentCoordinator extends BaseDomainCoordinator<
         metrics: Partial<QualityMetrics>;
     }): Promise<Result<{
         passed: boolean;
+        /** 0-100; -1 when a configured check is unmeasured. */
         score: number;
         violations: string[];
+        evidenceStatus?: GateResult['evidenceStatus'];
+        unmeasured?: string[];
     }, Error>>;
     /**
-     * Assess deployment readiness
+     * Assess deployment readiness. #1020: never ready while an input is unmeasured.
      * @param options - Deployment readiness options
      * @returns Result containing readiness assessment
      */
     assessDeploymentReadiness(options: {
         environment: 'development' | 'staging' | 'production';
         changeSet: string[];
-    }): Promise<Result<{
-        ready: boolean;
-        risks: Array<{
-            id: string;
-            severity: string;
-            description: string;
-        }>;
-        score: number;
-    }, Error>>;
+    }): ReturnType<typeof ReportHelpers.assessDeploymentReadiness>;
     /**
      * Analyze technical debt
      * @param options - Technical debt analysis options
@@ -222,16 +205,7 @@ export declare class QualityAssessmentCoordinator extends BaseDomainCoordinator<
     analyzeTechnicalDebt(options: {
         projectPath: string;
         includeCodeSmells?: boolean;
-    }): Promise<Result<{
-        totalDebt: number;
-        items: Array<{
-            file: string;
-            type: string;
-            effort: number;
-            description: string;
-        }>;
-        debtRatio: number;
-    }, Error>>;
+    }): ReturnType<typeof ReportHelpers.analyzeTechnicalDebt>;
     private spawnQualityGateAgent;
     private spawnQualityAnalyzerAgent;
     private spawnDeploymentAdvisorAgent;

package/dist/domains/quality-assessment/coordinator.js

@@ -236,7 +236,9 @@ export class QualityAssessmentCoordinator extends BaseDomainCoordinator {
             // V3 Integration: Use consensus for borderline cases (CONSENSUS-MIXIN-001)
             // Borderline cases are pass/fail decisions where metrics are close to thresholds
             let finalResult = result.value;
-            if (this.config.enableConsensus && this.isBorderlineGateResult(request.metrics, request.thresholds, result.value)) {
+            // #1020: a verdict on missing evidence is not borderline; it is not a verdict.
+            if (this.config.enableConsensus && result.value.evidenceStatus !== 'insufficient-evidence'
+                && this.isBorderlineGateResult(request.metrics, request.thresholds, result.value)) {
                 const consensusResult = await this.verifyGateVerdictWithConsensus(effectiveRequest, result.value);
                 if (consensusResult) {
                     finalResult = consensusResult;
@@ -544,7 +546,8 @@ export class QualityAssessmentCoordinator extends BaseDomainCoordinator {
         return ReportHelpers.generateReport(this.memory, options);
     }
     /**
-     * Get quality dashboard overview
+     * Get quality dashboard overview. #1020: built from measured evidence only;
+     * unmeasured metrics are -1 and listed in `unmeasured`.
      * @returns Result containing dashboard data
      */
     async getQualityDashboard() {
@@ -559,7 +562,8 @@ export class QualityAssessmentCoordinator extends BaseDomainCoordinator {
         return ReportHelpers.analyzeRisks(this.memory, options);
     }
     /**
-     * Evaluate a quality gate (simplified API)
+     * Evaluate a quality gate (simplified API). #1020: a metric the caller does
+     * not supply is unmeasured, so the gate cannot pass on it.
      * @param options - Quality gate evaluation options
      * @returns Result containing gate evaluation
      */
@@ -573,10 +577,12 @@ export class QualityAssessmentCoordinator extends BaseDomainCoordinator {
             passed: result.value.passed,
             score: result.value.overallScore,
             violations: result.value.failedChecks,
+            ...(result.value.evidenceStatus ? { evidenceStatus: result.value.evidenceStatus } : {}),
+            ...(result.value.unmeasured ? { unmeasured: result.value.unmeasured } : {}),
         });
     }
     /**
-     * Assess deployment readiness
+     * Assess deployment readiness. #1020: never ready while an input is unmeasured.
      * @param options - Deployment readiness options
      * @returns Result containing readiness assessment
      */

package/dist/domains/quality-assessment/interfaces.d.ts

@@ -54,7 +54,9 @@ export interface GateResult {
     gateName: string;
     passed: boolean;
     checks: GateCheck[];
+    /** 0-100; -1 when any configured check is unmeasured (#1020). */
     overallScore: number;
+    /** Measured checks that failed their threshold; unmeasured checks are not listed (#1020). */
     failedChecks: string[];
     /** Gate service evidence state; absent for other gate implementations. */
     evidenceStatus?: 'measured' | 'insufficient-evidence';

package/dist/domains/quality-assessment/services/coherence-gate.js

@@ -11,7 +11,10 @@ import { QualityTier, DEFAULT_COHERENCE_GATE_POLICY, } from '../coherence/index.
 import { createLambdaCalculator, } from '../coherence/lambda-calculator.js';
 import { createCoherenceGateController, } from '../coherence/gate-controller.js';
 import { toError } from '../../../shared/error-utils.js';
+import { isMeasuredMetricValue } from '../evidence-sufficiency.js';
 import { createPartitionDetector, } from '../coherence/partition-detector.js';
+/** #996: the sentinel for an input with no measured value. */
+const UNMEASURED = -1;
 /**
  * Default service configuration
  */
@@ -175,13 +178,23 @@ export class CoherenceGateService extends QualityGateService {
      * Convert QualityMetrics to coherence input format
      */
     convertToCoherenceMetrics(metrics, previousLambda) {
+        // #1020: QualityMetrics carries no latency or flaky-test data, so those
+        // inputs are unmeasured (-1) instead of an invented "fast, not flaky"
+        // value. The total vulnerability count is weighted as critical, so the
+        // high/medium breakdown adds nothing when the total was measured.
+        const vulns = isMeasuredMetricValue(metrics.securityVulnerabilities) ? 0 : UNMEASURED;
         return {
             lineCoverage: metrics.coverage,
             testPassRate: metrics.testsPassing,
             criticalVulns: metrics.securityVulnerabilities,
-            p95Latency: 100, // Default if not provided
+            highVulns: vulns,
+            mediumVulns: vulns,
+            p95Latency: UNMEASURED,
             targetLatency: 200, // Default target
-            maintainabilityIndex: 100 - metrics.technicalDebt * 10, // Convert debt hours to index
+            maintainabilityIndex: isMeasuredMetricValue(metrics.technicalDebt)
+                ? 100 - metrics.technicalDebt * 10 // Convert debt hours to index
+                : UNMEASURED,
+            flakyTestRatio: UNMEASURED,
             duplicationPercent: metrics.duplications,
             previousLambda,
         };

package/dist/domains/quality-assessment/services/quality-gate.js

@@ -87,14 +87,16 @@ export class QualityGateService {
             const unmeasured = checks
                 .filter((check) => !isMeasuredMetricValue(check.value))
                 .map((check) => check.name);
-            // Collect failed checks
+            // Collect failed checks. #1020: an unmeasured check did not fail a
+            // threshold; it is listed in `unmeasured` only.
             for (const check of checks) {
-                if (!check.passed) {
+                if (!check.passed && isMeasuredMetricValue(check.value)) {
                     failedChecks.push(check.name);
                 }
             }
-            // Calculate overall score (0-100)
-            const overallScore = this.calculateOverallScore(checks);
+            // Calculate overall score (0-100). #1020: -1 = no measured score, the
+            // same sentinel quality_assess uses; never a score over partial data.
+            const overallScore = unmeasured.length === 0 ? this.calculateOverallScore(checks) : -1;
             // Determine pass/fail based on critical checks
             const passed = unmeasured.length === 0 && this.determineGateStatus(checks);
             const result = {

package/dist/domains/security-compliance/index.d.ts

@@ -9,5 +9,5 @@ export { SecurityComplianceCoordinator, type IExtendedSecurityComplianceCoordina
 export { SecurityScannerService, type ISecurityScannerService, type SecurityScannerConfig, type FullScanResult, } from './services/security-scanner.js';
 export { SecurityAuditorService, type ISecurityAuditorService, type SecurityAuditorConfig, type SecurityPostureSummary, type TriagedVulnerabilities, } from './services/security-auditor.js';
 export { ComplianceValidatorService, type IExtendedComplianceValidationService, type ComplianceValidatorConfig, type MultiStandardReport, type DataType, type DataHandlingReport, type DataLocation, type ComplianceEvidence, type ControlEvidence, } from './services/compliance-validator.js';
-export type { Vulnerability, VulnerabilitySeverity, VulnerabilityCategory, VulnerabilityLocation, DependencyInfo, RemediationAdvice, ComplianceStandard, ComplianceRule, ComplianceViolation, ComplianceContext, ComplianceReport, GapAnalysis, ComplianceGap, RemediationAction, SASTResult, DASTResult, DASTOptions, DependencyScanResult, SecretScanResult, DetectedSecret, ScanSummary, ScanStatus, RuleSet, FalsePositiveCheck, SecurityCoverage, AuthCredentials, PackageSecurityInfo, OutdatedPackage, UpgradeRecommendation, SecurityAuditOptions, SecurityAuditReport, SecurityPosture, ISASTService, IDASTService, IDependencySecurityService, IComplianceValidationService, ISecurityComplianceCoordinator, IVulnerabilityRepository, IComplianceReportRepository, SecurityScanCompletedEvent, VulnerabilityDetectedEvent, ComplianceCheckCompletedEvent, } from './interfaces.js';
+export type { Vulnerability, VulnerabilitySeverity, VulnerabilityCategory, VulnerabilityLocation, DependencyInfo, RemediationAdvice, ComplianceStandard, ComplianceRule, ComplianceViolation, ComplianceContext, ComplianceReport, GapAnalysis, ComplianceGap, RemediationAction, SASTResult, DASTResult, DASTScanStatus, DASTRequestFailure, DASTOptions, DependencyScanResult, SecretScanResult, DetectedSecret, ScanSummary, ScanStatus, RuleSet, FalsePositiveCheck, SecurityCoverage, AuthCredentials, PackageSecurityInfo, OutdatedPackage, UpgradeRecommendation, SecurityAuditOptions, SecurityAuditReport, SecurityPosture, ISASTService, IDASTService, IDependencySecurityService, IComplianceValidationService, ISecurityComplianceCoordinator, IVulnerabilityRepository, IComplianceReportRepository, SecurityScanCompletedEvent, VulnerabilityDetectedEvent, ComplianceCheckCompletedEvent, } from './interfaces.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/domains/security-compliance/interfaces.d.ts

@@ -179,12 +179,32 @@ export interface DASTOptions {
     readonly activeScanning?: boolean;
     readonly timeout?: number;
 }
+/**
+ * Completeness of a DAST scan (#1135), on the model of DependencyScanStatus (#1049).
+ * - complete: every planned request was answered; the findings (or none) are a measurement.
+ * - incomplete: the target answered, some probes did not; the findings are real, the rest is unmeasured.
+ * - failed: the target could not be scanned. Never read as "no findings".
+ */
+export type DASTScanStatus = 'complete' | 'incomplete' | 'failed';
+/** A DAST request the target did not answer (#1135). */
+export interface DASTRequestFailure {
+    /** Origin and path of the request; query strings and credentials are not kept. */
+    readonly url: string;
+    /** DAST_REQUEST_FAILED, DAST_REQUEST_TIMEOUT, DAST_TLS_FAILED, DAST_RATE_LIMITED, ... */
+    readonly code: string;
+    readonly reason: string;
+}
 export interface DASTResult {
     readonly scanId: string;
     readonly targetUrl: string;
     readonly vulnerabilities: Vulnerability[];
     readonly summary: ScanSummary;
     readonly crawledUrls: number;
+    readonly status: DASTScanStatus;
+    /** Requests the target did not answer; non-empty means the scan is not complete. */
+    readonly failedRequests: DASTRequestFailure[];
+    /** Why the scan is incomplete/failed; absent when complete. */
+    readonly error?: string;
 }
 export interface AuthCredentials {
     readonly type: 'basic' | 'bearer' | 'cookie' | 'oauth';
@@ -213,6 +233,16 @@ export interface IDependencySecurityService {
 export interface DependencyScanResult {
     readonly vulnerabilities: Vulnerability[];
     readonly outdatedPackages: OutdatedPackage[];
+    /**
+     * #1221: whether the latest version of every dependency was looked up. Only
+     * 'complete' means `outdatedPackages` is the full list; 'incomplete' and
+     * 'failed' list the packages not checked in `outdatedUnchecked`, and
+     * 'not-run' means this scan does not look up latest versions. An empty
+     * `outdatedPackages` is "up to date" only when this is 'complete'.
+     */
+    readonly outdatedStatus: 'complete' | 'incomplete' | 'failed' | 'not-run';
+    /** #1221: dependencies whose latest version could not be looked up, and why. */
+    readonly outdatedUnchecked: UncheckedDependency[];
     readonly summary: ScanSummary;
     /**
      * #1049: whether the advisory lookup covered every dependency. Only
@@ -227,7 +257,7 @@ export interface DependencyScanResult {
     /** Why the scan is incomplete/failed; absent when complete. */
     readonly error?: string;
 }
-/** A dependency whose advisories could not be checked, and why (#1049). */
+/** A dependency whose advisories (#1049) or latest version (#1221) could not be checked, and why. */
 export interface UncheckedDependency {
     readonly name: string;
     /** The spec as declared in the manifest. */
@@ -249,8 +279,13 @@ export interface PackageSecurityInfo {
     readonly name: string;
     readonly version: string;
     readonly vulnerabilities: Vulnerability[];
-    readonly latestVersion: string;
-    readonly isDeprecated: boolean;
+    /** null when the registry lookup failed (#1052). */
+    readonly latestVersion: string | null;
+    /** null when deprecation could not be checked, never `false` (#1052). */
+    readonly isDeprecated: boolean | null;
+    /** incomplete when a registry lookup failed; `unchecked` says which and why. */
+    readonly status: 'complete' | 'incomplete';
+    readonly unchecked?: string[];
 }
 export interface OutdatedPackage {
     readonly name: string;
@@ -261,9 +296,13 @@ export interface OutdatedPackage {
 export interface UpgradeRecommendation {
     readonly package: string;
     readonly fromVersion: string;
-    readonly toVersion: string;
+    /** null when the registry lookup failed; see `unchecked` (#1052). */
+    readonly toVersion: string | null;
     readonly fixesVulnerabilities: string[];
-    readonly breakingChanges: boolean;
+    /** null when the target version is unknown. */
+    readonly breakingChanges: boolean | null;
+    /** Why no target version could be looked up; absent when it was. */
+    readonly unchecked?: string;
 }
 /**
  * Compliance Validation Service
@@ -358,6 +397,8 @@ export interface SecurityAuditReport {
     readonly secretScanResults?: SecretScanResult;
     readonly overallRiskScore: RiskScore;
     readonly recommendations: string[];
+    /** Checks that ran but could not complete (#1052); absent when every included check completed. */
+    readonly incompleteChecks?: string[];
 }
 export interface SecretScanResult {
     readonly secretsFound: DetectedSecret[];

package/dist/domains/security-compliance/services/scanners/dast-auth-testing.d.ts

@@ -2,15 +2,15 @@
  * Agentic QE v3 - DAST Authorization Testing
  * Authorization bypass and IDOR testing utilities
  */
-import type { Vulnerability, AuthCredentials } from './scanner-types.js';
+import type { Vulnerability, AuthCredentials, DASTRequestFailure } from './scanner-types.js';
 /**
  * Test for authorization bypass on protected endpoints
  */
-export declare function testAuthorizationBypass(parsedUrl: URL, authHeaders: Record<string, string>, crawledUrls: number, maxDepth: number, vulnerabilities: Vulnerability[]): Promise<number>;
+export declare function testAuthorizationBypass(parsedUrl: URL, authHeaders: Record<string, string>, crawledUrls: number, maxDepth: number, vulnerabilities: Vulnerability[], failures?: DASTRequestFailure[]): Promise<number>;
 /**
  * Test for Insecure Direct Object References (IDOR)
  */
-export declare function testIDOR(parsedUrl: URL, authHeaders: Record<string, string>, crawledUrls: number, maxDepth: number, vulnerabilities: Vulnerability[]): Promise<number>;
+export declare function testIDOR(parsedUrl: URL, authHeaders: Record<string, string>, crawledUrls: number, maxDepth: number, vulnerabilities: Vulnerability[], failures?: DASTRequestFailure[]): Promise<number>;
 /**
  * Validate authentication credentials
  */

package/dist/domains/security-compliance/services/scanners/dast-auth-testing.js

@@ -3,13 +3,14 @@
  * Authorization bypass and IDOR testing utilities
  */
 import { v4 as uuidv4 } from 'uuid';
+import { probe } from './dast-requests.js';
 // ============================================================================
 // Authorization Testing
 // ============================================================================
 /**
  * Test for authorization bypass on protected endpoints
  */
-export async function testAuthorizationBypass(parsedUrl, authHeaders, crawledUrls, maxDepth, vulnerabilities) {
+export async function testAuthorizationBypass(parsedUrl, authHeaders, crawledUrls, maxDepth, vulnerabilities, failures) {
     const protectedEndpoints = [
         '/admin',
         '/dashboard',
@@ -23,21 +24,21 @@ export async function testAuthorizationBypass(parsedUrl, authHeaders, crawledUrl
             break;
         const testUrl = new URL(endpoint, parsedUrl.origin).toString();
         // Try with authentication
-        const authResponse = await fetch(testUrl, {
+        const authResponse = await probe(testUrl, {
             method: 'GET',
             headers: { ...authHeaders },
             signal: AbortSignal.timeout(5000),
-        });
-        if (authResponse.ok) {
+        }, failures);
+        if (authResponse?.ok) {
             crawledUrls++;
             // Try without authentication
-            const unauthResponse = await fetch(testUrl, {
+            const unauthResponse = await probe(testUrl, {
                 method: 'GET',
                 signal: AbortSignal.timeout(5000),
-            });
-            if (unauthResponse.ok && unauthResponse.status === 200) {
-                const authText = await authResponse.text();
-                const unauthText = await unauthResponse.text();
+            }, failures);
+            if (unauthResponse?.ok && unauthResponse.status === 200) {
+                const authText = authResponse.text;
+                const unauthText = unauthResponse.text;
                 if (authText.length > 100 && unauthText.length > 100 &&
                     Math.abs(authText.length - unauthText.length) < authText.length * 0.1) {
                     vulnerabilities.push({
@@ -59,7 +60,7 @@ export async function testAuthorizationBypass(parsedUrl, authHeaders, crawledUrl
 /**
  * Test for Insecure Direct Object References (IDOR)
  */
-export async function testIDOR(parsedUrl, authHeaders, crawledUrls, maxDepth, vulnerabilities) {
+export async function testIDOR(parsedUrl, authHeaders, crawledUrls, maxDepth, vulnerabilities, failures) {
     const idorEndpoints = [
         '/api/users/1',
         '/api/users/2',
@@ -70,14 +71,14 @@ export async function testIDOR(parsedUrl, authHeaders, crawledUrls, maxDepth, vu
         if (crawledUrls >= maxDepth * 15)
             break;
         const testUrl = new URL(endpoint, parsedUrl.origin).toString();
-        const response = await fetch(testUrl, {
+        const response = await probe(testUrl, {
             method: 'GET',
             headers: { ...authHeaders },
             signal: AbortSignal.timeout(5000),
-        });
-        if (response.ok) {
+        }, failures);
+        if (response?.ok) {
             crawledUrls++;
-            const text = await response.text();
+            const text = response.text;
             if (text.includes('email') || text.includes('password') || text.includes('phone')) {
                 vulnerabilities.push({
                     id: uuidv4(),

package/dist/domains/security-compliance/services/scanners/dast-helpers.d.ts

@@ -2,7 +2,7 @@
  * Agentic QE v3 - DAST Scanner Helper Functions
  * Utility functions for dynamic security analysis
  */
-import type { Vulnerability, ScanSummary, MemoryBackend } from './scanner-types.js';
+import type { Vulnerability, ScanSummary, MemoryBackend, DASTRequestFailure } from './scanner-types.js';
 export { testXSS, testSQLi } from './dast-injection-testing.js';
 export { testAuthorizationBypass, testIDOR, validateCredentials, buildAuthHeaders, } from './dast-auth-testing.js';
 /**
@@ -20,23 +20,19 @@ export declare function analyzeServerHeaders(headers: Headers, targetUrl: string
 /**
  * Scan for sensitive file exposure
  */
-export declare function scanSensitiveFiles(parsedUrl: URL, crawledUrls: number, maxDepth: number, vulnerabilities: Vulnerability[]): Promise<number>;
+export declare function scanSensitiveFiles(parsedUrl: URL, crawledUrls: number, maxDepth: number, vulnerabilities: Vulnerability[], failures?: DASTRequestFailure[]): Promise<number>;
 /**
  * Analyze CORS configuration
  */
-export declare function analyzeCORS(targetUrl: string, vulnerabilities: Vulnerability[]): Promise<void>;
+export declare function analyzeCORS(targetUrl: string, vulnerabilities: Vulnerability[], failures?: DASTRequestFailure[]): Promise<void>;
 /**
  * Extract links from HTML and crawl discovered pages
  */
-export declare function extractAndCrawlLinks(html: string, baseUrl: URL, currentCrawled: number, maxDepth: number, vulnerabilities: Vulnerability[]): Promise<number>;
+export declare function extractAndCrawlLinks(html: string, baseUrl: URL, currentCrawled: number, maxDepth: number, vulnerabilities: Vulnerability[], failures?: DASTRequestFailure[]): Promise<number>;
 /**
  * Analyze HTML forms for security issues
  */
 export declare function analyzeFormsForSecurityIssues(html: string, baseUrl: string, vulnerabilities: Vulnerability[]): void;
-/**
- * Handle fetch errors and add appropriate vulnerabilities
- */
-export declare function handleFetchError(fetchError: unknown, targetUrl: string, vulnerabilities: Vulnerability[]): void;
 /**
  * Calculate scan summary from vulnerabilities
  */
@@ -44,5 +40,8 @@ export declare function calculateSummary(vulnerabilities: Vulnerability[], total
 /**
  * Store scan results in memory
  */
-export declare function storeScanResults(memory: MemoryBackend, scanId: string, scanType: string, vulnerabilities: Vulnerability[], summary: ScanSummary): Promise<void>;
+export declare function storeScanResults(memory: MemoryBackend, scanId: string, scanType: string, vulnerabilities: Vulnerability[], summary: ScanSummary, completeness?: {
+    status: string;
+    failedRequests: DASTRequestFailure[];
+}): Promise<void>;
 //# sourceMappingURL=dast-helpers.d.ts.map

package/dist/domains/security-compliance/services/scanners/dast-helpers.js

@@ -3,7 +3,7 @@
  * Utility functions for dynamic security analysis
  */
 import { v4 as uuidv4 } from 'uuid';
-import { toErrorMessage } from '../../../../shared/error-utils.js';
+import { probe } from './dast-requests.js';
 // Re-export from specialized modules for convenience
 export { testXSS, testSQLi } from './dast-injection-testing.js';
 export { testAuthorizationBypass, testIDOR, validateCredentials, buildAuthHeaders, } from './dast-auth-testing.js';
@@ -100,7 +100,7 @@ export function analyzeServerHeaders(headers, targetUrl, vulnerabilities) {
 /**
  * Scan for sensitive file exposure
  */
-export async function scanSensitiveFiles(parsedUrl, crawledUrls, maxDepth, vulnerabilities) {
+export async function scanSensitiveFiles(parsedUrl, crawledUrls, maxDepth, vulnerabilities, failures) {
     const sensitiveEndpoints = [
         { path: '/.git/config', name: 'Git Configuration' },
         { path: '/.env', name: 'Environment File' },
@@ -113,13 +113,13 @@ export async function scanSensitiveFiles(parsedUrl, crawledUrls, maxDepth, vulne
         if (crawledUrls >= maxDepth * 10)
             break;
         const testUrl = new URL(endpoint.path, parsedUrl.origin).toString();
-        const testResponse = await fetch(testUrl, {
+        const testResponse = await probe(testUrl, {
             method: 'GET',
             signal: AbortSignal.timeout(5000),
-        });
-        if (testResponse.ok) {
+        }, failures);
+        if (testResponse?.ok) {
             crawledUrls++;
-            const text = await testResponse.text();
+            const text = testResponse.text;
             if (text.length > 20 && !text.toLowerCase().includes('not found') && !text.toLowerCase().includes('404')) {
                 const isSensitive = endpoint.path.includes('.git') ||
                     endpoint.path.includes('.env') ||
@@ -148,15 +148,17 @@ export async function scanSensitiveFiles(parsedUrl, crawledUrls, maxDepth, vulne
 /**
  * Analyze CORS configuration
  */
-export async function analyzeCORS(targetUrl, vulnerabilities) {
-    const corsResponse = await fetch(targetUrl, {
+export async function analyzeCORS(targetUrl, vulnerabilities, failures) {
+    const corsResponse = await probe(targetUrl, {
         method: 'OPTIONS',
         headers: {
             'Origin': 'https://evil-attacker.com',
             'Access-Control-Request-Method': 'GET',
         },
         signal: AbortSignal.timeout(5000),
-    });
+    }, failures);
+    if (!corsResponse)
+        return;
     const allowOrigin = corsResponse.headers.get('access-control-allow-origin');
     if (allowOrigin === '*' || allowOrigin === 'https://evil-attacker.com') {
         vulnerabilities.push({
@@ -177,7 +179,7 @@ export async function analyzeCORS(targetUrl, vulnerabilities) {
 /**
  * Extract links from HTML and crawl discovered pages
  */
-export async function extractAndCrawlLinks(html, baseUrl, currentCrawled, maxDepth, vulnerabilities) {
+export async function extractAndCrawlLinks(html, baseUrl, currentCrawled, maxDepth, vulnerabilities, failures) {
     let crawledUrls = currentCrawled;
     const maxCrawl = maxDepth * 5;
     const linkPattern = /href=["']([^"']+)["']/gi;
@@ -200,12 +202,14 @@ export async function extractAndCrawlLinks(html, baseUrl, currentCrawled, maxDep
         if (crawledUrls >= maxCrawl)
             break;
         const crawlUrl = new URL(path, baseUrl.origin).toString();
-        const crawlResponse = await fetch(crawlUrl, {
+        const crawlResponse = await probe(crawlUrl, {
             method: 'GET',
             headers: { 'User-Agent': 'AgenticQE-DAST-Scanner/3.0' },
             signal: AbortSignal.timeout(5000),
             redirect: 'follow',
-        });
+        }, failures);
+        if (!crawlResponse)
+            continue;
         crawledUrls++;
         if (crawlResponse.ok) {
             if (path.includes('password') || path.includes('token') || path.includes('api_key')) {
@@ -220,7 +224,7 @@ export async function extractAndCrawlLinks(html, baseUrl, currentCrawled, maxDep
                     references: ['https://owasp.org/www-community/vulnerabilities/Information_exposure_through_query_strings_in_url'],
                 });
             }
-            const responseText = await crawlResponse.text();
+            const responseText = crawlResponse.text;
             if (responseText.includes('Index of /') || responseText.includes('Directory listing for')) {
                 vulnerabilities.push({
                     id: uuidv4(),
@@ -308,36 +312,6 @@ export function analyzeFormsForSecurityIssues(html, baseUrl, vulnerabilities) {
 // ============================================================================
 // Utility Functions
 // ============================================================================
-/**
- * Handle fetch errors and add appropriate vulnerabilities
- */
-export function handleFetchError(fetchError, targetUrl, vulnerabilities) {
-    const errorMsg = toErrorMessage(fetchError);
-    if (errorMsg.includes('CERT') || errorMsg.includes('SSL') || errorMsg.includes('TLS') || errorMsg.includes('certificate')) {
-        vulnerabilities.push({
-            id: uuidv4(),
-            title: 'TLS Certificate Error',
-            description: `SSL/TLS error: ${errorMsg}`,
-            severity: 'high',
-            category: 'security-misconfiguration',
-            location: { file: targetUrl },
-            remediation: { description: 'Fix TLS certificate configuration', estimatedEffort: 'moderate', automatable: false },
-            references: ['https://owasp.org/www-project-web-security-testing-guide/'],
-        });
-    }
-    else if (errorMsg.includes('timeout') || errorMsg.includes('abort')) {
-        vulnerabilities.push({
-            id: uuidv4(),
-            title: 'Connection Timeout',
-            description: `Target did not respond within timeout: ${errorMsg}`,
-            severity: 'informational',
-            category: 'security-misconfiguration',
-            location: { file: targetUrl },
-            remediation: { description: 'Verify target is accessible', estimatedEffort: 'trivial', automatable: false },
-            references: [],
-        });
-    }
-}
 /**
  * Calculate scan summary from vulnerabilities
  */
@@ -359,12 +333,13 @@ export function calculateSummary(vulnerabilities, totalFiles, scanDurationMs) {
 /**
  * Store scan results in memory
  */
-export async function storeScanResults(memory, scanId, scanType, vulnerabilities, summary) {
+export async function storeScanResults(memory, scanId, scanType, vulnerabilities, summary, completeness) {
     await memory.set(`security:scan:${scanId}`, {
         scanId,
         scanType,
         vulnerabilities,
         summary,
+        ...completeness,
         timestamp: new Date().toISOString(),
     }, { namespace: 'security-compliance', ttl: 86400 * 7 });
 }

package/dist/domains/security-compliance/services/scanners/dast-injection-testing.d.ts

@@ -2,19 +2,19 @@
  * Agentic QE v3 - DAST Injection Testing
  * XSS and SQL injection testing utilities
  */
-import type { Vulnerability } from './scanner-types.js';
+import type { Vulnerability, DASTRequestFailure } from './scanner-types.js';
 /**
  * Test for XSS vulnerabilities
  */
 export declare function testXSS(targetUrl: string, parsedUrl: URL, paramName: string, payloads: Array<{
     payload: string;
     name: string;
-}>, vulnerabilities: Vulnerability[]): Promise<void>;
+}>, vulnerabilities: Vulnerability[], failures?: DASTRequestFailure[]): Promise<void>;
 /**
  * Test for SQL injection vulnerabilities
  */
 export declare function testSQLi(targetUrl: string, parsedUrl: URL, paramName: string, payloads: Array<{
     payload: string;
     name: string;
-}>, vulnerabilities: Vulnerability[]): Promise<void>;
+}>, vulnerabilities: Vulnerability[], failures?: DASTRequestFailure[]): Promise<void>;
 //# sourceMappingURL=dast-injection-testing.d.ts.map