agentic-qe 3.15.12 → 3.15.13

package/dist/coordination/handlers/security-handlers.js

@@ -263,8 +263,12 @@ export function registerSecurityHandlers(ctx) {
                     });
                     if (result.success) {
                         dastResult = result.value;
-                        // Legacy DAST results contain findings, but no execution coverage receipt.
-                        engines.push({ ...unverifiedEngine('dast', 'url'), target: payload.targetUrl });
+                        // #1135: probes the target did not answer make DAST partial; the
+                        // findings it did collect are kept. A complete run still has no
+                        // execution coverage receipt, so it stays unverified.
+                        engines.push(dastResult.status === 'incomplete'
+                            ? { ...partialDastEngine(dastResult.failedRequests), target: payload.targetUrl }
+                            : { ...unverifiedEngine('dast', 'url'), target: payload.targetUrl });
                     }
                     else {
                         engines.push({ ...failedEngine('dast', 'url', result.error), target: payload.targetUrl });
@@ -399,6 +403,12 @@ function safeErrorCode(error) {
     const code = error?.code;
     return typeof code === 'string' && /^[A-Z0-9_]{1,32}$/.test(code) ? code : 'UNKNOWN';
 }
+function partialDastEngine(failedRequests) {
+    const codes = [...new Set(failedRequests.map(failure => failure.code))].join(', ');
+    return { id: 'dast', requested: true, required: true, status: 'partial', scope: 'url',
+        ruleCoverage: 'unknown', errors: [`dast incomplete: ${failedRequests.length} request(s) not answered (${codes}).`],
+        limitations: failedRequests.slice(0, 20).map(failure => `dast not answered: ${failure.url} (${failure.code}: ${failure.reason})`) };
+}
 function unverifiedEngine(id, scope) {
     return { id, requested: true, required: true, status: 'unverified', scope,
         ruleCoverage: 'unknown', errors: [], limitations: [`${id} returned no execution receipt; coverage is unverified.`] };

package/dist/coordination/protocols/security-audit.js

@@ -164,11 +164,16 @@ export class SecurityAuditProtocol {
                 const dastResult = await this.runDASTScan(this.config.targetUrl);
                 if (dastResult.success) {
                     this.currentAudit = { ...this.currentAudit, dastResult: dastResult.value };
+                    if (dastResult.value.status !== 'complete') {
+                        this.recordIncompleteCheck(`DAST scan is incomplete: ${dastResult.value.error ?? 'some requests were not answered'}`);
+                    }
                     this.recordIncompleteCheck('DAST coverage is unverified: the scanner returned no execution receipt');
                     await this.publishVulnerabilities(dastResult.value.vulnerabilities);
                 }
                 else {
-                    this.recordIncompleteCheck('DAST scan did not complete');
+                    // #1135: keep the scanner's reason (DAST_AUTHENTICATION_FAILED, DAST_TARGET_UNAVAILABLE, ...).
+                    const code = dastResult.error.code;
+                    this.recordIncompleteCheck(`DAST scan did not complete${typeof code === 'string' ? ` (${code})` : ''}: ${dastResult.error.message}`);
                 }
             }
             else if (auditOptions.includeDAST) {
@@ -284,7 +289,10 @@ export class SecurityAuditProtocol {
                         // Convert scanner result to protocol result format
                         return ok({
                             vulnerabilities: scanResult.value.vulnerabilities,
+                            // #1221: this scanner does not look up latest versions; empty is not "up to date".
                             outdatedPackages: [],
+                            outdatedStatus: 'not-run',
+                            outdatedUnchecked: [],
                             summary: scanResult.value.summary,
                             status: scanResult.value.status,
                             measured: scanResult.value.measured,
@@ -360,6 +368,8 @@ export class SecurityAuditProtocol {
                 if (scanResult.success) {
                     return ok(scanResult.value);
                 }
+                // #1135: the scanner's own failure, with its code, not a generic "unavailable".
+                return err(scanResult.error);
             }
             catch (scannerError) {
                 // Scanner unavailable - log error

package/dist/coordination/task-executor.js

@@ -15,6 +15,7 @@
 import { v4 as uuidv4 } from 'uuid';
 import { isCallerInputError, toErrorMessage } from '../shared/error-utils.js';
 import { InsufficientQualityEvidenceError } from '../domains/quality-assessment/quality-evidence.js';
+import { isLearnableResult } from '../learning/learnable-result.js';
 import { createResultSaver } from './result-saver.js';
 import { getProjectStorePath } from '../kernel/project-root.js';
 import { createLogger } from '../logging/logger-factory.js';
@@ -487,8 +488,12 @@ export class DomainTaskExecutor {
                 };
             }
             await this.publishTaskCompleted(task.id, result.value, domain);
-            // ADR-051: Record successful outcome
-            this.recordOutcome(task, routingTier, true, Date.now() - startTime).catch((e) => { logger.warn('recordOutcome failed', { error: e instanceof Error ? e.message : String(e), taskId: task.id }); });
+            // ADR-051: Record successful outcome. #1020: a run without evidence (a
+            // coverage estimate, an insufficient-evidence quality run) completed as a
+            // task but is not a success to learn routing from.
+            if (isLearnableResult(domain, result.value)) {
+                this.recordOutcome(task, routingTier, true, Date.now() - startTime).catch((e) => { logger.warn('recordOutcome failed', { error: e instanceof Error ? e.message : String(e), taskId: task.id }); });
+            }
             // Save results to files if enabled. A task can opt out per call with
             // payload.saveResults === false (#925); the executor-wide config still
             // acts as the global switch.

package/dist/domains/code-intelligence/coordinator-gnn.d.ts

@@ -2,10 +2,10 @@
  * Code Intelligence - GNN Integration
  * Extracted from coordinator.ts for CQ-004 (file size reduction)
  *
- * Contains: GNN embedding indexing, code embedding generation, GNN search
+ * Contains: GNN embedding indexing, code embedding generation
  */
 import { QEGNNEmbeddingIndex } from '../../integrations/ruvector/wrappers';
-import type { ImpactRequest, SearchResult } from './interfaces';
+import type { ImpactRequest } from './interfaces';
 import { FileReader } from '../../shared/io';
 export declare function initializeGNNIndex(domainKey: string): QEGNNEmbeddingIndex;
 /**
@@ -23,24 +23,10 @@ export declare function generateGraphMAEEmbeddings(fileReader: FileReader, paths
  * Generate code embedding using semantic features
  */
 export declare function generateCodeEmbedding(path: string, content: string): Promise<number[]>;
-/**
- * Search code with GNN for enhanced similarity
- */
-export declare function searchCodeWithGNN(gnnIndex: QEGNNEmbeddingIndex, query: string): Promise<Array<{
-    file: string;
-    similarity: number;
-}>>;
 /**
  * Enhance impact analysis with GNN semantic similarity
  */
 export declare function enhanceImpactAnalysisWithGNN(gnnIndex: QEGNNEmbeddingIndex, fileReader: FileReader, request: ImpactRequest): Promise<void>;
-/**
- * Merge search results from semantic search and GNN
- */
-export declare function mergeSearchResults(semanticResults: SearchResult[], gnnResults: Array<{
-    file: string;
-    similarity: number;
-}>): SearchResult[];
 /**
  * R6: Train GNN embeddings with memory-bounded cold-tier training.
  * Uses LRU hotset caching when the graph exceeds hotsetSize, falling

package/dist/domains/code-intelligence/coordinator-gnn.js

@@ -2,7 +2,7 @@
  * Code Intelligence - GNN Integration
  * Extracted from coordinator.ts for CQ-004 (file size reduction)
  *
- * Contains: GNN embedding indexing, code embedding generation, GNN search
+ * Contains: GNN embedding indexing, code embedding generation
  */
 import { LoggerFactory } from '../../logging/index.js';
 import { QEGNNIndexFactory, initGNN, } from '../../integrations/ruvector/wrappers.js';
@@ -148,34 +148,6 @@ export async function generateCodeEmbedding(path, content) {
     }
     return features.slice(0, 384);
 }
-/**
- * Search code with GNN for enhanced similarity
- */
-export async function searchCodeWithGNN(gnnIndex, query) {
-    try {
-        const queryEmbedding = await generateCodeEmbedding('query', query);
-        const queryIEmbedding = {
-            vector: queryEmbedding,
-            dimension: 384,
-            namespace: 'code',
-            text: query,
-            timestamp: Date.now(),
-            quantization: 'none',
-        };
-        const results = gnnIndex.search(queryIEmbedding, {
-            limit: 10,
-            namespace: 'code',
-        });
-        return results.map((r) => ({
-            file: r.metadata?.path ?? `file-${r.id}`,
-            similarity: 1 - r.distance,
-        }));
-    }
-    catch (error) {
-        logger.error('Failed to search with GNN:', error instanceof Error ? error : undefined);
-        return [];
-    }
-}
 /**
  * Enhance impact analysis with GNN semantic similarity
  */
@@ -206,39 +178,6 @@ export async function enhanceImpactAnalysisWithGNN(gnnIndex, fileReader, request
         logger.error('Failed to enhance impact analysis:', error instanceof Error ? error : undefined);
     }
 }
-/**
- * Merge search results from semantic search and GNN
- */
-export function mergeSearchResults(semanticResults, gnnResults) {
-    const scoreMap = new Map();
-    const resultMap = new Map();
-    for (const result of semanticResults) {
-        scoreMap.set(result.file, result.score);
-        resultMap.set(result.file, result);
-    }
-    for (const gnnResult of gnnResults) {
-        const existingScore = scoreMap.get(gnnResult.file);
-        if (existingScore !== undefined) {
-            scoreMap.set(gnnResult.file, (existingScore + gnnResult.similarity) / 2);
-        }
-        else {
-            scoreMap.set(gnnResult.file, gnnResult.similarity * 0.8);
-            resultMap.set(gnnResult.file, {
-                file: gnnResult.file,
-                snippet: '',
-                score: gnnResult.similarity * 0.8,
-                highlights: [],
-            });
-        }
-    }
-    return Array.from(resultMap.values())
-        .map(result => ({
-        ...result,
-        score: scoreMap.get(result.file) ?? result.score,
-    }))
-        .sort((a, b) => b.score - a.score)
-        .slice(0, 20);
-}
 // R6: ColdTier trainer singleton (lazy-initialized)
 let coldTierTrainer = null;
 /**

package/dist/domains/code-intelligence/coordinator.d.ts

@@ -43,6 +43,12 @@ export interface ICodeIntelligenceCoordinator extends CodeIntelligenceAPI {
      * @param projectPath - Path to the project root
      */
     collectProjectMetrics(projectPath: string): Promise<Result<ProjectMetrics, Error>>;
+    /**
+     * #1224: make indexed files searchable by `search()`. Indexing paths that
+     * only fill the knowledge graph (MCP code_index) call this so a later search
+     * reads the same project.
+     */
+    indexForSearch(paths: string[]): Promise<SearchIndexSummary>;
     /**
      * V3: Find untested functions using hypergraph analysis (GOAP Action 7)
      * Returns functions that have no test coverage based on the code knowledge graph.
@@ -126,6 +132,11 @@ export interface CoordinatorConfig extends BaseDomainCoordinatorConfig {
  * Orchestrates code intelligence workflows and coordinates with agents
  */
 type CodeIntelligenceWorkflowType = 'index' | 'search' | 'impact' | 'dependency' | 'query';
+/** #1224: what an index run made searchable. */
+export interface SearchIndexSummary {
+    searchable: number;
+    warnings: string[];
+}
 export declare class CodeIntelligenceCoordinator extends BaseDomainCoordinator<CoordinatorConfig, CodeIntelligenceWorkflowType> implements ICodeIntelligenceCoordinator {
     private readonly memory;
     private readonly agentCoordinator;
@@ -187,7 +198,6 @@ export declare class CodeIntelligenceCoordinator extends BaseDomainCoordinator<C
      * Index code embeddings in GNN for fast similarity search
      */
     private indexCodeEmbeddings;
-    private searchCodeWithGNN;
     private enhanceImpactAnalysisWithGNN;
     /**
      * Adapt search pattern using SONA
@@ -197,10 +207,6 @@ export declare class CodeIntelligenceCoordinator extends BaseDomainCoordinator<C
      * Store impact analysis pattern in SONA
      */
     private storeImpactPattern;
-    /**
-     * Merge search results from semantic search and GNN
-     */
-    private mergeSearchResults;
     private hashCode;
     private spawnIndexerAgent;
     private spawnSearchAgent;
@@ -211,7 +217,7 @@ export declare class CodeIntelligenceCoordinator extends BaseDomainCoordinator<C
     protected subscribeToEvents(): void;
     private handleTestRunCompleted;
     private handleFilesChanged;
-    private indexForSemanticSearch;
+    indexForSearch(paths: string[]): Promise<SearchIndexSummary>;
     private loadWorkflowState;
     private saveWorkflowState;
     /**

package/dist/domains/code-intelligence/coordinator.js

@@ -59,6 +59,8 @@ const DEFAULT_CONFIG = {
  * CQ-002: Extends BaseDomainCoordinator
  */
 const logger = LoggerFactory.create('code-intelligence');
+/** Files made searchable per index run (content, plus vectors with an embedding model). */
+const SEARCH_INDEX_FILE_LIMIT = 100;
 export class CodeIntelligenceCoordinator extends BaseDomainCoordinator {
     memory;
     agentCoordinator;
@@ -336,9 +338,12 @@ export class CodeIntelligenceCoordinator extends BaseDomainCoordinator {
                     }
                 }
                 this.updateWorkflowProgress(workflowId, 70);
-                // Index content for semantic search
+                // Index content for search
                 if (indexedPaths.length > 0) {
-                    await this.indexForSemanticSearch(indexedPaths);
+                    const searchIndex = await this.indexForSearch(indexedPaths);
+                    if (searchIndex.warnings.length > 0) {
+                        result.value.warnings = [...(result.value.warnings ?? []), ...searchIndex.warnings];
+                    }
                 }
                 this.updateWorkflowProgress(workflowId, 85);
                 // V3: Rebuild hypergraph from indexed files (keeps hypergraph in sync with KG)
@@ -414,18 +419,10 @@ export class CodeIntelligenceCoordinator extends BaseDomainCoordinator {
                     logger.info(`Adapted search pattern with ${pattern.similarity.toFixed(3)} similarity`);
                 }
             }
-            // V3: Use GNN for enhanced code similarity search
-            let gnnResults = [];
-            if (this.config.enableGNN && this.gnnIndex) {
-                gnnResults = await this.searchCodeWithGNN(request);
-            }
-            // Perform search
+            // Perform search. #1224: GNN feature-hash neighbours are not merged in;
+            // they do not depend on the query and carried no file name or snippet.
             const result = await this.semanticAnalyzer.search(request);
             if (result.success) {
-                // Merge GNN results with semantic search results
-                if (gnnResults.length > 0) {
-                    result.value.results = this.mergeSearchResults(result.value.results, gnnResults);
-                }
                 this.completeWorkflow(workflowId);
                 // Publish events
                 if (this.config.publishEvents) {
@@ -566,11 +563,6 @@ export class CodeIntelligenceCoordinator extends BaseDomainCoordinator {
             return;
         await GNNHelpers.indexCodeEmbeddings(this.gnnIndex, this.fileReader, paths);
     }
-    async searchCodeWithGNN(request) {
-        if (!this.gnnIndex || !this.rlInitialized)
-            return [];
-        return GNNHelpers.searchCodeWithGNN(this.gnnIndex, request.query);
-    }
     async enhanceImpactAnalysisWithGNN(request) {
         if (!this.gnnIndex || !this.rlInitialized)
             return;
@@ -655,12 +647,6 @@ export class CodeIntelligenceCoordinator extends BaseDomainCoordinator {
     // ============================================================================
     // Helper Methods
     // ============================================================================
-    /**
-     * Merge search results from semantic search and GNN
-     */
-    mergeSearchResults(semanticResults, gnnResults) {
-        return GNNHelpers.mergeSearchResults(semanticResults, gnnResults);
-    }
     hashCode(str) {
         return GNNHelpers.hashCode(str);
     }
@@ -775,22 +761,33 @@ export class CodeIntelligenceCoordinator extends BaseDomainCoordinator {
     // ============================================================================
     // Helper Methods
     // ============================================================================
-    async indexForSemanticSearch(paths) {
-        // Index a subset of files for semantic search
+    async indexForSearch(paths) {
+        // Index a subset of files for search
         // Limit to 100 files for performance in a single batch
-        const filesToIndex = paths.slice(0, 100);
+        const filesToIndex = paths.slice(0, SEARCH_INDEX_FILE_LIMIT);
+        let searchable = 0;
         for (const path of filesToIndex) {
             try {
                 // Read actual file content
                 const result = await this.fileReader.readFile(path);
                 if (result.success && result.value) {
-                    await this.semanticAnalyzer.indexCode(path, result.value);
+                    const indexed = await this.semanticAnalyzer.indexCode(path, result.value);
+                    if (indexed.success)
+                        searchable++;
                 }
             }
             catch {
                 // Continue on error - file may not exist or be unreadable
             }
         }
+        // #1224: say when search will not see every indexed file.
+        const warnings = [];
+        if (searchable < paths.length) {
+            warnings.push(`Search covers ${searchable} of ${paths.length} indexed files` +
+                (paths.length > SEARCH_INDEX_FILE_LIMIT ? ` (at most ${SEARCH_INDEX_FILE_LIMIT} per index run)` : '') +
+                '; code in the other files is not found by search.');
+        }
+        return { searchable, warnings };
     }
     // ============================================================================
     // State Persistence

package/dist/domains/code-intelligence/interfaces.d.ts

@@ -71,6 +71,13 @@ export interface SearchResults {
     results: SearchResult[];
     total: number;
     searchTime: number;
+    /**
+     * #1224, semantic searches only: 'vector' when an embedding model ranked the
+     * results, 'lexical-only' when none was available and query words were
+     * matched against the indexed text instead (`reason` says why).
+     */
+    mode?: 'vector' | 'lexical-only';
+    reason?: string;
 }
 export interface SearchResult {
     file: string;
@@ -79,6 +86,8 @@ export interface SearchResult {
     score: number;
     highlights: string[];
     metadata?: Record<string, unknown>;
+    /** #1224: how a semantic hit was found; its score is a text-match score when 'lexical'. */
+    matchType?: 'vector' | 'lexical';
 }
 export interface ImpactRequest {
     changedFiles: string[];

package/dist/domains/code-intelligence/services/semantic-analyzer.d.ts

@@ -6,6 +6,11 @@ import { Result } from '../../../shared/types';
 import { MemoryBackend } from '../../../kernel/interfaces';
 import { NomicEmbedderConfig, IEmbeddingProvider } from '../../../shared/embeddings';
 import { SearchRequest, SearchResults, SearchResult } from '../interfaces';
+/**
+ * #1224: the message for a search over an empty index. "No results" is only
+ * reported after searching an index that holds code.
+ */
+export declare const NOTHING_INDEXED_FOR_SEARCH: string;
 /**
  * Interface for the semantic analyzer service
  */
@@ -18,7 +23,10 @@ export interface ISemanticAnalyzerService {
     findSimilar(code: string, limit?: number): Promise<Result<SearchResult[], Error>>;
     /** Analyze code semantics */
     analyze(code: string): Promise<Result<SemanticAnalysis, Error>>;
-    /** Get code embeddings */
+    /**
+     * Get code embeddings. Throws when no embedding model is available: no
+     * pseudo-embedding is substituted (ADR-097).
+     */
     getEmbedding(code: string): Promise<number[]>;
 }
 /**
@@ -56,8 +64,15 @@ export interface HalsteadMetrics {
 export interface SemanticAnalyzerConfig {
     /** Embedding vector dimension (384 for all-MiniLM-L6-v2) */
     embeddingDimension: number;
-    /** Minimum similarity score threshold */
+    /** Minimum word-overlap score for fuzzy and text-only matches */
     minScore: number;
+    /**
+     * #1224: minimum cosine similarity for vector hits. Sentence-embedding
+     * models score a relevant file well below 0.5 (all-MiniLM-L6-v2 gave 0.37
+     * for "login" against a login function), so the text threshold would hide
+     * every vector hit.
+     */
+    minVectorScore: number;
     /** Maximum search results */
     maxResults: number;
     /** Storage namespace */
@@ -84,6 +99,8 @@ export declare class SemanticAnalyzerService implements ISemanticAnalyzerService
     private readonly analysisCache;
     private embedder;
     private embedderInitialized;
+    /** #1224: why no embedder is in use, once initialization has run. */
+    private embedderUnavailableReason;
     constructor(memory: MemoryBackend, config?: Partial<SemanticAnalyzerConfig>);
     /**
      * Initialize the Nomic embedder lazily
@@ -106,15 +123,31 @@ export declare class SemanticAnalyzerService implements ISemanticAnalyzerService
      */
     analyze(code: string): Promise<Result<SemanticAnalysis, Error>>;
     /**
-     * Get embedding vector for code
-     * Uses Nomic embeddings via Ollama when available, falls back to pseudo-embeddings
+     * Get embedding vector for code.
+     * Uses Nomic embeddings via Ollama (or the injected provider). Throws when
+     * neither is available: no pseudo-embedding is substituted (#1224, ADR-097).
      */
     getEmbedding(code: string): Promise<number[]>;
     /**
      * Check if using real Nomic embeddings
      */
     isUsingNomicEmbeddings(): boolean;
+    /** #1224: embed `text`, or say why no real embedding is available. */
+    private tryEmbed;
+    /** Identifies the model behind stored vectors, so vectors from another model are not compared. */
+    private embeddingModelId;
+    private isCurrentModelVector;
+    private vectorKeyPrefix;
+    private contentKeyPattern;
+    /**
+     * #1224: vector search when an embedding model is available. Otherwise (or
+     * when no indexed file has a vector from that model) it matches query words
+     * against the indexed text and says so through `lexicalOnlyReason`; no
+     * similarity is invented for those hits.
+     */
     private semanticSearch;
+    /** Word-overlap matching for a semantic query when no vectors can be used. */
+    private lexicalSearch;
     private exactSearch;
     private fuzzySearch;
     private extractConcepts;
@@ -122,11 +155,16 @@ export declare class SemanticAnalyzerService implements ISemanticAnalyzerService
     private calculateComplexity;
     private extractDependencies;
     private generateSuggestions;
-    private generateCodeEmbedding;
     private extractCodeMetadata;
     private detectLanguage;
     private tokenize;
     private calculateFuzzyScore;
+    /**
+     * A content token matches a query token it contains, or that contains it.
+     * #1224: the second direction needs a content token of 3+ characters, so a
+     * one-letter variable such as `i` does not match the query "login".
+     */
+    private tokensMatch;
     private matchesFilters;
     private extractSnippet;
     private extractSnippetAround;