agentic-qe 3.15.12 → 3.15.14

package/dist/domains/quality-assessment/coordinator.d.ts

@@ -19,6 +19,7 @@ import { EventBus, MemoryBackend, AgentCoordinator } from '../../kernel/interfac
 import type { HybridRouter } from '../../shared/llm/router/hybrid-router.js';
 import { QualityAssessmentAPI, GateEvaluationRequest, GateResult, QualityAnalysisRequest, QualityReport, DeploymentRequest, DeploymentAdvice, ComplexityRequest, ComplexityReport, QualityMetrics } from './interfaces';
 import { ClaimVerifierService } from '../../agents/claim-verifier/index.js';
+import * as ReportHelpers from './coordinator-reports.js';
 import type { QueenMinCutBridge } from '../../coordination/mincut/queen-integration';
 import type { ConsensusStats } from '../../coordination/consensus';
 import { BaseDomainCoordinator, type BaseDomainCoordinatorConfig } from '../base-domain-coordinator.js';
@@ -154,19 +155,13 @@ export declare class QualityAssessmentCoordinator extends BaseDomainCoordinator<
     generateReport(options: {
         format: 'json' | 'html' | 'markdown';
         includeRecommendations?: boolean;
-    }): Promise<Result<{
-        content: string;
-        format: string;
-    }, Error>>;
+    }): ReturnType<typeof ReportHelpers.generateReport>;
     /**
-     * Get quality dashboard overview
+     * Get quality dashboard overview. #1020: built from measured evidence only;
+     * unmeasured metrics are -1 and listed in `unmeasured`.
      * @returns Result containing dashboard data
      */
-    getQualityDashboard(): Promise<Result<{
-        overallScore: number;
-        metrics: QualityMetrics;
-        trends: Record<string, number>;
-    }, Error>>;
+    getQualityDashboard(): ReturnType<typeof ReportHelpers.getQualityDashboard>;
     /**
      * Analyze project risks
      * @param options - Risk analysis options
@@ -175,17 +170,10 @@ export declare class QualityAssessmentCoordinator extends BaseDomainCoordinator<
     analyzeRisks(options: {
         scope: 'project' | 'module' | 'file';
         includeSecurityRisks?: boolean;
-    }): Promise<Result<{
-        risks: Array<{
-            id: string;
-            severity: string;
-            description: string;
-            category: string;
-        }>;
-        overallRiskLevel: 'low' | 'medium' | 'high' | 'critical';
-    }, Error>>;
+    }): ReturnType<typeof ReportHelpers.analyzeRisks>;
     /**
-     * Evaluate a quality gate (simplified API)
+     * Evaluate a quality gate (simplified API). #1020: a metric the caller does
+     * not supply is unmeasured, so the gate cannot pass on it.
      * @param options - Quality gate evaluation options
      * @returns Result containing gate evaluation
      */
@@ -194,26 +182,21 @@ export declare class QualityAssessmentCoordinator extends BaseDomainCoordinator<
         metrics: Partial<QualityMetrics>;
     }): Promise<Result<{
         passed: boolean;
+        /** 0-100; -1 when a configured check is unmeasured. */
         score: number;
         violations: string[];
+        evidenceStatus?: GateResult['evidenceStatus'];
+        unmeasured?: string[];
     }, Error>>;
     /**
-     * Assess deployment readiness
+     * Assess deployment readiness. #1020: never ready while an input is unmeasured.
      * @param options - Deployment readiness options
      * @returns Result containing readiness assessment
      */
     assessDeploymentReadiness(options: {
         environment: 'development' | 'staging' | 'production';
         changeSet: string[];
-    }): Promise<Result<{
-        ready: boolean;
-        risks: Array<{
-            id: string;
-            severity: string;
-            description: string;
-        }>;
-        score: number;
-    }, Error>>;
+    }): ReturnType<typeof ReportHelpers.assessDeploymentReadiness>;
     /**
      * Analyze technical debt
      * @param options - Technical debt analysis options
@@ -222,16 +205,7 @@ export declare class QualityAssessmentCoordinator extends BaseDomainCoordinator<
     analyzeTechnicalDebt(options: {
         projectPath: string;
         includeCodeSmells?: boolean;
-    }): Promise<Result<{
-        totalDebt: number;
-        items: Array<{
-            file: string;
-            type: string;
-            effort: number;
-            description: string;
-        }>;
-        debtRatio: number;
-    }, Error>>;
+    }): ReturnType<typeof ReportHelpers.analyzeTechnicalDebt>;
     private spawnQualityGateAgent;
     private spawnQualityAnalyzerAgent;
     private spawnDeploymentAdvisorAgent;

package/dist/domains/quality-assessment/coordinator.js

@@ -236,7 +236,9 @@ export class QualityAssessmentCoordinator extends BaseDomainCoordinator {
             // V3 Integration: Use consensus for borderline cases (CONSENSUS-MIXIN-001)
             // Borderline cases are pass/fail decisions where metrics are close to thresholds
             let finalResult = result.value;
-            if (this.config.enableConsensus && this.isBorderlineGateResult(request.metrics, request.thresholds, result.value)) {
+            // #1020: a verdict on missing evidence is not borderline; it is not a verdict.
+            if (this.config.enableConsensus && result.value.evidenceStatus !== 'insufficient-evidence'
+                && this.isBorderlineGateResult(request.metrics, request.thresholds, result.value)) {
                 const consensusResult = await this.verifyGateVerdictWithConsensus(effectiveRequest, result.value);
                 if (consensusResult) {
                     finalResult = consensusResult;
@@ -544,7 +546,8 @@ export class QualityAssessmentCoordinator extends BaseDomainCoordinator {
         return ReportHelpers.generateReport(this.memory, options);
     }
     /**
-     * Get quality dashboard overview
+     * Get quality dashboard overview. #1020: built from measured evidence only;
+     * unmeasured metrics are -1 and listed in `unmeasured`.
      * @returns Result containing dashboard data
      */
     async getQualityDashboard() {
@@ -559,7 +562,8 @@ export class QualityAssessmentCoordinator extends BaseDomainCoordinator {
         return ReportHelpers.analyzeRisks(this.memory, options);
     }
     /**
-     * Evaluate a quality gate (simplified API)
+     * Evaluate a quality gate (simplified API). #1020: a metric the caller does
+     * not supply is unmeasured, so the gate cannot pass on it.
      * @param options - Quality gate evaluation options
      * @returns Result containing gate evaluation
      */
@@ -573,10 +577,12 @@ export class QualityAssessmentCoordinator extends BaseDomainCoordinator {
             passed: result.value.passed,
             score: result.value.overallScore,
             violations: result.value.failedChecks,
+            ...(result.value.evidenceStatus ? { evidenceStatus: result.value.evidenceStatus } : {}),
+            ...(result.value.unmeasured ? { unmeasured: result.value.unmeasured } : {}),
         });
     }
     /**
-     * Assess deployment readiness
+     * Assess deployment readiness. #1020: never ready while an input is unmeasured.
      * @param options - Deployment readiness options
      * @returns Result containing readiness assessment
      */

package/dist/domains/quality-assessment/coverage-report-event.d.ts

@@ -34,6 +34,14 @@ export interface MeasuredFileCoverage {
     function: number | null;
     statement: number | null;
     measured: true;
+    /**
+     * #1219: the line counts behind `line`, so a reader can weight several
+     * files by size. Absent on records written before 3.15.13.
+     */
+    lines?: {
+        covered: number;
+        total: number;
+    };
 }
 /**
  * Return the measured summary to store, or `null` when the payload is not

package/dist/domains/quality-assessment/coverage-report-event.js

@@ -53,6 +53,27 @@ export function measuredFileCoverage(record) {
     if (r.measured !== true || !isPercent(r.line))
         return null;
     const opt = (v) => (isPercent(v) ? v : null);
-    return { line: r.line, branch: opt(r.branch), function: opt(r.function), statement: opt(r.statement), measured: true };
+    const lines = lineCounts(r.lines, r.line);
+    return {
+        line: r.line, branch: opt(r.branch), function: opt(r.function), statement: opt(r.statement), measured: true,
+        ...(lines ? { lines } : {}),
+    };
+}
+/**
+ * #1219: whole, consistent line counts (`covered / total` within rounding of
+ * the stored percentage), or `undefined` when the record has none or they do
+ * not describe its own percentage.
+ */
+function lineCounts(value, line) {
+    if (!value || typeof value !== 'object')
+        return undefined;
+    const { covered, total } = value;
+    if (!Number.isSafeInteger(covered) || !Number.isSafeInteger(total))
+        return undefined;
+    const c = covered;
+    const t = total;
+    if (t <= 0 || c < 0 || c > t || Math.abs((c / t) * 100 - line) > 0.01)
+        return undefined;
+    return { covered: c, total: t };
 }
 //# sourceMappingURL=coverage-report-event.js.map

package/dist/domains/quality-assessment/interfaces.d.ts

@@ -54,7 +54,9 @@ export interface GateResult {
     gateName: string;
     passed: boolean;
     checks: GateCheck[];
+    /** 0-100; -1 when any configured check is unmeasured (#1020). */
     overallScore: number;
+    /** Measured checks that failed their threshold; unmeasured checks are not listed (#1020). */
     failedChecks: string[];
     /** Gate service evidence state; absent for other gate implementations. */
     evidenceStatus?: 'measured' | 'insufficient-evidence';
@@ -101,6 +103,12 @@ export interface QualityReport {
      * value covers `analysedFiles` of `totalFiles`; `failed` lists the gaps.
      */
     partial?: PartialQualityMetric[];
+    /**
+     * The weighted score over the measured metrics only, present when a
+     * requested metric is unmeasured. `score.overall` is then -1: a score that
+     * leaves out unmeasured metrics is not the overall score (#1223 convention).
+     */
+    subsetScore?: number;
 }
 /** #1021: a file excluded from static analysis, with the reason. */
 export interface ExcludedQualityFile {

package/dist/domains/quality-assessment/services/coherence-gate.js

@@ -11,7 +11,10 @@ import { QualityTier, DEFAULT_COHERENCE_GATE_POLICY, } from '../coherence/index.
 import { createLambdaCalculator, } from '../coherence/lambda-calculator.js';
 import { createCoherenceGateController, } from '../coherence/gate-controller.js';
 import { toError } from '../../../shared/error-utils.js';
+import { isMeasuredMetricValue } from '../evidence-sufficiency.js';
 import { createPartitionDetector, } from '../coherence/partition-detector.js';
+/** #996: the sentinel for an input with no measured value. */
+const UNMEASURED = -1;
 /**
  * Default service configuration
  */
@@ -175,13 +178,23 @@ export class CoherenceGateService extends QualityGateService {
      * Convert QualityMetrics to coherence input format
      */
     convertToCoherenceMetrics(metrics, previousLambda) {
+        // #1020: QualityMetrics carries no latency or flaky-test data, so those
+        // inputs are unmeasured (-1) instead of an invented "fast, not flaky"
+        // value. The total vulnerability count is weighted as critical, so the
+        // high/medium breakdown adds nothing when the total was measured.
+        const vulns = isMeasuredMetricValue(metrics.securityVulnerabilities) ? 0 : UNMEASURED;
         return {
             lineCoverage: metrics.coverage,
             testPassRate: metrics.testsPassing,
             criticalVulns: metrics.securityVulnerabilities,
-            p95Latency: 100, // Default if not provided
+            highVulns: vulns,
+            mediumVulns: vulns,
+            p95Latency: UNMEASURED,
             targetLatency: 200, // Default target
-            maintainabilityIndex: 100 - metrics.technicalDebt * 10, // Convert debt hours to index
+            maintainabilityIndex: isMeasuredMetricValue(metrics.technicalDebt)
+                ? 100 - metrics.technicalDebt * 10 // Convert debt hours to index
+                : UNMEASURED,
+            flakyTestRatio: UNMEASURED,
             duplicationPercent: metrics.duplications,
             previousLambda,
         };

package/dist/domains/quality-assessment/services/quality-analyzer.d.ts

@@ -126,6 +126,10 @@ export declare class QualityAnalyzerService implements IQualityAnalyzerService {
      * Never a fixed fallback value.
      */
     private collectFileMetrics;
+    /**
+     * The file's own measured coverage record, or `null`. #1219: never the
+     * project-wide `coverage:latest` summary — that is not this file's coverage.
+     */
     private getStoredCoverage;
     private aggregateMetrics;
     private calculateQualityScore;

package/dist/domains/quality-assessment/services/quality-analyzer.js

@@ -9,7 +9,7 @@ import { getCodeMetricsAnalyzer } from '../../../shared/metrics/index.js';
 import { toError } from '../../../shared/error-utils.js';
 import { safeJsonParse } from '../../../shared/safe-json.js';
 import { getClaudeModelForTier } from '../../../shared/llm/model-registry.js';
-import { measuredCoverageSummary, measuredFileCoverage } from '../coverage-report-event.js';
+import { measuredFileCoverage } from '../coverage-report-event.js';
 import { fileCoverageLookupKeys } from '../../coverage-analysis/collected-metrics.js';
 /** Metrics the static analyzer produces when the caller asks for all of them. */
 const ANALYZER_METRICS = ['coverage', 'complexity', 'maintainability', 'duplication', 'testability'];
@@ -25,6 +25,22 @@ const PARSED_METRICS = new Set(['complexity', 'maintainability', 'testability'])
 export const MIN_ANALYSED_SHARE = 0.95;
 /** #1011: the sentinel for "not measured" in score and complexity fields. */
 const UNMEASURED = -1;
+/**
+ * #1219: covered lines over total lines across the files, or `null` when a
+ * record has no line counts (a mean of percentages would weight a 10-line
+ * file like a 1000-line one).
+ */
+function lineWeightedCoverage(records) {
+    let covered = 0;
+    let total = 0;
+    for (const record of records) {
+        if (!record.lines)
+            return null;
+        covered += record.lines.covered;
+        total += record.lines.total;
+    }
+    return total > 0 ? (covered / total) * 100 : null;
+}
 /** First reasons of a failure list, for a one-line explanation. */
 function summariseFailures(failures) {
     return failures.slice(0, 3).map((f) => f.reason).join('; ')
@@ -262,11 +278,16 @@ Focus on:
                 return err(new Error('No source files provided for analysis'));
             }
             // Analyze metrics for each file; failures become unmeasured (#1011)
-            const { fileMetrics, unmeasured, excluded, partial } = await this.collectFileMetrics(sourceFiles, includeMetrics, request.explicitFiles ?? []);
+            const { fileMetrics, scopeValues, unmeasured, excluded, partial } = await this.collectFileMetrics(sourceFiles, includeMetrics, request.explicitFiles ?? []);
             // Calculate aggregated metrics
-            const metricDetails = this.aggregateMetrics(fileMetrics);
-            // Calculate overall quality score
-            const score = this.calculateQualityScore(metricDetails);
+            const metricDetails = this.aggregateMetrics(fileMetrics, scopeValues);
+            // Calculate overall quality score. With a requested metric unmeasured
+            // there is no overall score (-1, as the gate's overallScore since
+            // #1223); the score over the measured metrics is kept as subsetScore.
+            const computed = this.calculateQualityScore(metricDetails);
+            const insufficient = unmeasured.length > 0;
+            const score = insufficient ? { ...computed, overall: UNMEASURED } : computed;
+            const subsetScore = insufficient && computed.overall >= 0 ? computed.overall : undefined;
             // Generate trends if enabled
             const trends = this.config.enableTrendAnalysis
                 ? await this.generateTrends(metricDetails, compareBaseline)
@@ -290,6 +311,7 @@ Focus on:
                 unmeasured,
                 excluded,
                 partial,
+                ...(subsetScore !== undefined ? { subsetScore } : {}),
             };
             // Store the report
             await this.storeReport(report, sourceFiles);
@@ -395,6 +417,8 @@ Focus on:
         const unreadable = [];
         const readable = [];
         const missingCoverage = [];
+        const coverageRecords = [];
+        const scopeValues = {};
         const explicit = new Set(explicitFiles);
         const needsAnalysis = requested.some((m) => PARSED_METRICS.has(m) || m === 'duplication');
         for (const file of files) {
@@ -430,7 +454,8 @@ Focus on:
                 // Coverage requires external data (from test runners) — never fabricate a number
                 const storedCoverage = await this.getStoredCoverage(file);
                 if (storedCoverage !== null) {
-                    metrics.coverage = storedCoverage;
+                    metrics.coverage = storedCoverage.line;
+                    coverageRecords.push(storedCoverage);
                 }
                 else {
                     missingCoverage.push(file);
@@ -442,11 +467,33 @@ Focus on:
         if (missingCoverage.length > 0) {
             for (const metrics of fileMetrics.values())
                 delete metrics.coverage;
+            // #1219: the project-wide summary is not a measurement of these files.
             unmeasured.push({
                 metric: 'coverage',
-                reason: `no measured coverage recorded for ${missingCoverage.length} of ${total} file(s)`,
+                reason: `no measured coverage recorded for ${missingCoverage.length} of ${total} file(s) `
+                    + `(${missingCoverage.slice(0, 3).join(', ')}${missingCoverage.length > 3 ? ', …' : ''}); `
+                    + 'a project-wide coverage figure is not a measurement of these files',
+                files: missingCoverage,
             });
         }
+        else if (coverageRecords.length > 1) {
+            const weighted = lineWeightedCoverage(coverageRecords);
+            if (weighted === null) {
+                for (const metrics of fileMetrics.values())
+                    delete metrics.coverage;
+                const legacy = coverageRecords.filter((r) => !r.lines).length;
+                // #1219: a plain mean of per-file percentages is not the scope's coverage.
+                unmeasured.push({
+                    metric: 'coverage',
+                    reason: `${legacy} of ${coverageRecords.length} per-file coverage record(s) carry no line counts `
+                        + '(written before 3.15.13), so the files cannot be weighted by size and a mean of their '
+                        + 'percentages is not the coverage of the scope; re-run coverage to record line counts',
+                });
+            }
+            else {
+                scopeValues.coverage = weighted;
+            }
+        }
         /** Decide whether a metric with these failures is measured, partial or unmeasured. */
         const judge = (metric, failures) => {
             const analysed = total - failures.length;
@@ -502,8 +549,12 @@ Focus on:
                 unmeasured.push({ metric: 'duplication', reason: `duplication detection failed: ${toError(error).message}` });
             }
         }
-        return { fileMetrics, unmeasured, excluded, partial };
+        return { fileMetrics, scopeValues, unmeasured, excluded, partial };
     }
+    /**
+     * The file's own measured coverage record, or `null`. #1219: never the
+     * project-wide `coverage:latest` summary — that is not this file's coverage.
+     */
     async getStoredCoverage(file) {
         try {
             // 1. Try per-file coverage stored by test executor
@@ -512,21 +563,16 @@ Focus on:
             for (const key of fileCoverageLookupKeys(file)) {
                 const fileCoverage = measuredFileCoverage(await this.memory.get(key));
                 if (fileCoverage)
-                    return fileCoverage.line;
-            }
-            // 2. Fall back to project-wide summary from coverage-analyzer
-            const summary = measuredCoverageSummary(await this.memory.get('coverage:latest'));
-            if (summary) {
-                return summary.line;
+                    return fileCoverage;
             }
-            // No coverage data available — return null (never fabricate)
+            // No coverage data for this file — return null (never fabricate)
             return null;
         }
         catch {
             return null;
         }
     }
-    aggregateMetrics(fileMetrics) {
+    aggregateMetrics(fileMetrics, scopeValues = {}) {
         const aggregated = new Map();
         // Collect all values per metric
         for (const metrics of fileMetrics.values()) {
@@ -539,7 +585,7 @@ Focus on:
         // Calculate averages and generate details
         const details = [];
         for (const [name, values] of aggregated.entries()) {
-            const average = values.reduce((a, b) => a + b, 0) / values.length;
+            const average = scopeValues[name] ?? values.reduce((a, b) => a + b, 0) / values.length;
             const rating = this.getMetricRating(average, name);
             const trend = this.estimateTrend(values);
             details.push({

package/dist/domains/quality-assessment/services/quality-gate.js

@@ -87,14 +87,16 @@ export class QualityGateService {
             const unmeasured = checks
                 .filter((check) => !isMeasuredMetricValue(check.value))
                 .map((check) => check.name);
-            // Collect failed checks
+            // Collect failed checks. #1020: an unmeasured check did not fail a
+            // threshold; it is listed in `unmeasured` only.
             for (const check of checks) {
-                if (!check.passed) {
+                if (!check.passed && isMeasuredMetricValue(check.value)) {
                     failedChecks.push(check.name);
                 }
             }
-            // Calculate overall score (0-100)
-            const overallScore = this.calculateOverallScore(checks);
+            // Calculate overall score (0-100). #1020: -1 = no measured score, the
+            // same sentinel quality_assess uses; never a score over partial data.
+            const overallScore = unmeasured.length === 0 ? this.calculateOverallScore(checks) : -1;
             // Determine pass/fail based on critical checks
             const passed = unmeasured.length === 0 && this.determineGateStatus(checks);
             const result = {

package/dist/domains/security-compliance/index.d.ts

@@ -9,5 +9,5 @@ export { SecurityComplianceCoordinator, type IExtendedSecurityComplianceCoordina
 export { SecurityScannerService, type ISecurityScannerService, type SecurityScannerConfig, type FullScanResult, } from './services/security-scanner.js';
 export { SecurityAuditorService, type ISecurityAuditorService, type SecurityAuditorConfig, type SecurityPostureSummary, type TriagedVulnerabilities, } from './services/security-auditor.js';
 export { ComplianceValidatorService, type IExtendedComplianceValidationService, type ComplianceValidatorConfig, type MultiStandardReport, type DataType, type DataHandlingReport, type DataLocation, type ComplianceEvidence, type ControlEvidence, } from './services/compliance-validator.js';
-export type { Vulnerability, VulnerabilitySeverity, VulnerabilityCategory, VulnerabilityLocation, DependencyInfo, RemediationAdvice, ComplianceStandard, ComplianceRule, ComplianceViolation, ComplianceContext, ComplianceReport, GapAnalysis, ComplianceGap, RemediationAction, SASTResult, DASTResult, DASTOptions, DependencyScanResult, SecretScanResult, DetectedSecret, ScanSummary, ScanStatus, RuleSet, FalsePositiveCheck, SecurityCoverage, AuthCredentials, PackageSecurityInfo, OutdatedPackage, UpgradeRecommendation, SecurityAuditOptions, SecurityAuditReport, SecurityPosture, ISASTService, IDASTService, IDependencySecurityService, IComplianceValidationService, ISecurityComplianceCoordinator, IVulnerabilityRepository, IComplianceReportRepository, SecurityScanCompletedEvent, VulnerabilityDetectedEvent, ComplianceCheckCompletedEvent, } from './interfaces.js';
+export type { Vulnerability, VulnerabilitySeverity, VulnerabilityCategory, VulnerabilityLocation, DependencyInfo, RemediationAdvice, ComplianceStandard, ComplianceRule, ComplianceViolation, ComplianceContext, ComplianceReport, GapAnalysis, ComplianceGap, RemediationAction, SASTResult, DASTResult, DASTScanStatus, DASTRequestFailure, DASTOptions, DependencyScanResult, SecretScanResult, DetectedSecret, ScanSummary, ScanStatus, RuleSet, FalsePositiveCheck, SecurityCoverage, AuthCredentials, PackageSecurityInfo, OutdatedPackage, UpgradeRecommendation, SecurityAuditOptions, SecurityAuditReport, SecurityPosture, ISASTService, IDASTService, IDependencySecurityService, IComplianceValidationService, ISecurityComplianceCoordinator, IVulnerabilityRepository, IComplianceReportRepository, SecurityScanCompletedEvent, VulnerabilityDetectedEvent, ComplianceCheckCompletedEvent, } from './interfaces.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/domains/security-compliance/interfaces.d.ts

@@ -179,12 +179,32 @@ export interface DASTOptions {
     readonly activeScanning?: boolean;
     readonly timeout?: number;
 }
+/**
+ * Completeness of a DAST scan (#1135), on the model of DependencyScanStatus (#1049).
+ * - complete: every planned request was answered; the findings (or none) are a measurement.
+ * - incomplete: the target answered, some probes did not; the findings are real, the rest is unmeasured.
+ * - failed: the target could not be scanned. Never read as "no findings".
+ */
+export type DASTScanStatus = 'complete' | 'incomplete' | 'failed';
+/** A DAST request the target did not answer (#1135). */
+export interface DASTRequestFailure {
+    /** Origin and path of the request; query strings and credentials are not kept. */
+    readonly url: string;
+    /** DAST_REQUEST_FAILED, DAST_REQUEST_TIMEOUT, DAST_TLS_FAILED, DAST_RATE_LIMITED, ... */
+    readonly code: string;
+    readonly reason: string;
+}
 export interface DASTResult {
     readonly scanId: string;
     readonly targetUrl: string;
     readonly vulnerabilities: Vulnerability[];
     readonly summary: ScanSummary;
     readonly crawledUrls: number;
+    readonly status: DASTScanStatus;
+    /** Requests the target did not answer; non-empty means the scan is not complete. */
+    readonly failedRequests: DASTRequestFailure[];
+    /** Why the scan is incomplete/failed; absent when complete. */
+    readonly error?: string;
 }
 export interface AuthCredentials {
     readonly type: 'basic' | 'bearer' | 'cookie' | 'oauth';
@@ -213,6 +233,16 @@ export interface IDependencySecurityService {
 export interface DependencyScanResult {
     readonly vulnerabilities: Vulnerability[];
     readonly outdatedPackages: OutdatedPackage[];
+    /**
+     * #1221: whether the latest version of every dependency was looked up. Only
+     * 'complete' means `outdatedPackages` is the full list; 'incomplete' and
+     * 'failed' list the packages not checked in `outdatedUnchecked`, and
+     * 'not-run' means this scan does not look up latest versions. An empty
+     * `outdatedPackages` is "up to date" only when this is 'complete'.
+     */
+    readonly outdatedStatus: 'complete' | 'incomplete' | 'failed' | 'not-run';
+    /** #1221: dependencies whose latest version could not be looked up, and why. */
+    readonly outdatedUnchecked: UncheckedDependency[];
     readonly summary: ScanSummary;
     /**
      * #1049: whether the advisory lookup covered every dependency. Only
@@ -227,7 +257,7 @@ export interface DependencyScanResult {
     /** Why the scan is incomplete/failed; absent when complete. */
     readonly error?: string;
 }
-/** A dependency whose advisories could not be checked, and why (#1049). */
+/** A dependency whose advisories (#1049) or latest version (#1221) could not be checked, and why. */
 export interface UncheckedDependency {
     readonly name: string;
     /** The spec as declared in the manifest. */
@@ -249,8 +279,13 @@ export interface PackageSecurityInfo {
     readonly name: string;
     readonly version: string;
     readonly vulnerabilities: Vulnerability[];
-    readonly latestVersion: string;
-    readonly isDeprecated: boolean;
+    /** null when the registry lookup failed (#1052). */
+    readonly latestVersion: string | null;
+    /** null when deprecation could not be checked, never `false` (#1052). */
+    readonly isDeprecated: boolean | null;
+    /** incomplete when a registry lookup failed; `unchecked` says which and why. */
+    readonly status: 'complete' | 'incomplete';
+    readonly unchecked?: string[];
 }
 export interface OutdatedPackage {
     readonly name: string;
@@ -261,9 +296,13 @@ export interface OutdatedPackage {
 export interface UpgradeRecommendation {
     readonly package: string;
     readonly fromVersion: string;
-    readonly toVersion: string;
+    /** null when the registry lookup failed; see `unchecked` (#1052). */
+    readonly toVersion: string | null;
     readonly fixesVulnerabilities: string[];
-    readonly breakingChanges: boolean;
+    /** null when the target version is unknown. */
+    readonly breakingChanges: boolean | null;
+    /** Why no target version could be looked up; absent when it was. */
+    readonly unchecked?: string;
 }
 /**
  * Compliance Validation Service
@@ -358,6 +397,8 @@ export interface SecurityAuditReport {
     readonly secretScanResults?: SecretScanResult;
     readonly overallRiskScore: RiskScore;
     readonly recommendations: string[];
+    /** Checks that ran but could not complete (#1052); absent when every included check completed. */
+    readonly incompleteChecks?: string[];
 }
 export interface SecretScanResult {
     readonly secretsFound: DetectedSecret[];

package/dist/domains/security-compliance/services/scanners/dast-auth-testing.d.ts

@@ -2,15 +2,15 @@
  * Agentic QE v3 - DAST Authorization Testing
  * Authorization bypass and IDOR testing utilities
  */
-import type { Vulnerability, AuthCredentials } from './scanner-types.js';
+import type { Vulnerability, AuthCredentials, DASTRequestFailure } from './scanner-types.js';
 /**
  * Test for authorization bypass on protected endpoints
  */
-export declare function testAuthorizationBypass(parsedUrl: URL, authHeaders: Record<string, string>, crawledUrls: number, maxDepth: number, vulnerabilities: Vulnerability[]): Promise<number>;
+export declare function testAuthorizationBypass(parsedUrl: URL, authHeaders: Record<string, string>, crawledUrls: number, maxDepth: number, vulnerabilities: Vulnerability[], failures?: DASTRequestFailure[]): Promise<number>;
 /**
  * Test for Insecure Direct Object References (IDOR)
  */
-export declare function testIDOR(parsedUrl: URL, authHeaders: Record<string, string>, crawledUrls: number, maxDepth: number, vulnerabilities: Vulnerability[]): Promise<number>;
+export declare function testIDOR(parsedUrl: URL, authHeaders: Record<string, string>, crawledUrls: number, maxDepth: number, vulnerabilities: Vulnerability[], failures?: DASTRequestFailure[]): Promise<number>;
 /**
  * Validate authentication credentials
  */

package/dist/domains/security-compliance/services/scanners/dast-auth-testing.js

@@ -3,13 +3,14 @@
  * Authorization bypass and IDOR testing utilities
  */
 import { v4 as uuidv4 } from 'uuid';
+import { probe } from './dast-requests.js';
 // ============================================================================
 // Authorization Testing
 // ============================================================================
 /**
  * Test for authorization bypass on protected endpoints
  */
-export async function testAuthorizationBypass(parsedUrl, authHeaders, crawledUrls, maxDepth, vulnerabilities) {
+export async function testAuthorizationBypass(parsedUrl, authHeaders, crawledUrls, maxDepth, vulnerabilities, failures) {
     const protectedEndpoints = [
         '/admin',
         '/dashboard',
@@ -23,21 +24,21 @@ export async function testAuthorizationBypass(parsedUrl, authHeaders, crawledUrl
             break;
         const testUrl = new URL(endpoint, parsedUrl.origin).toString();
         // Try with authentication
-        const authResponse = await fetch(testUrl, {
+        const authResponse = await probe(testUrl, {
             method: 'GET',
             headers: { ...authHeaders },
             signal: AbortSignal.timeout(5000),
-        });
-        if (authResponse.ok) {
+        }, failures);
+        if (authResponse?.ok) {
             crawledUrls++;
             // Try without authentication
-            const unauthResponse = await fetch(testUrl, {
+            const unauthResponse = await probe(testUrl, {
                 method: 'GET',
                 signal: AbortSignal.timeout(5000),
-            });
-            if (unauthResponse.ok && unauthResponse.status === 200) {
-                const authText = await authResponse.text();
-                const unauthText = await unauthResponse.text();
+            }, failures);
+            if (unauthResponse?.ok && unauthResponse.status === 200) {
+                const authText = authResponse.text;
+                const unauthText = unauthResponse.text;
                 if (authText.length > 100 && unauthText.length > 100 &&
                     Math.abs(authText.length - unauthText.length) < authText.length * 0.1) {
                     vulnerabilities.push({
@@ -59,7 +60,7 @@ export async function testAuthorizationBypass(parsedUrl, authHeaders, crawledUrl
 /**
  * Test for Insecure Direct Object References (IDOR)
  */
-export async function testIDOR(parsedUrl, authHeaders, crawledUrls, maxDepth, vulnerabilities) {
+export async function testIDOR(parsedUrl, authHeaders, crawledUrls, maxDepth, vulnerabilities, failures) {
     const idorEndpoints = [
         '/api/users/1',
         '/api/users/2',
@@ -70,14 +71,14 @@ export async function testIDOR(parsedUrl, authHeaders, crawledUrls, maxDepth, vu
         if (crawledUrls >= maxDepth * 15)
             break;
         const testUrl = new URL(endpoint, parsedUrl.origin).toString();
-        const response = await fetch(testUrl, {
+        const response = await probe(testUrl, {
             method: 'GET',
             headers: { ...authHeaders },
             signal: AbortSignal.timeout(5000),
-        });
-        if (response.ok) {
+        }, failures);
+        if (response?.ok) {
             crawledUrls++;
-            const text = await response.text();
+            const text = response.text;
             if (text.includes('email') || text.includes('password') || text.includes('phone')) {
                 vulnerabilities.push({
                     id: uuidv4(),