agentic-qe 3.15.4 → 3.15.6

package/dist/domains/quality-assessment/services/quality-analyzer.js

@@ -9,6 +9,26 @@ import { getCodeMetricsAnalyzer } from '../../../shared/metrics/index.js';
 import { toError } from '../../../shared/error-utils.js';
 import { safeJsonParse } from '../../../shared/safe-json.js';
 import { getClaudeModelForTier } from '../../../shared/llm/model-registry.js';
+import { measuredCoverageSummary, measuredFileCoverage } from '../coverage-report-event.js';
+/** Metrics the static analyzer produces when the caller asks for all of them. */
+const ANALYZER_METRICS = ['coverage', 'complexity', 'maintainability', 'duplication', 'testability'];
+/** Metrics computed from parsing each source file. */
+const PARSED_METRICS = new Set(['complexity', 'maintainability', 'testability']);
+/**
+ * #1021: a parsed metric with read/parse failures is still evidence when at
+ * least this share of the analysable files (in-scope minus excluded) was
+ * analysed. Below it, the unseen files are too large a blind spot for an
+ * average to describe the target, so the metric is unmeasured. 95% keeps one
+ * failure in a 20-file scope acceptable but not one in 10.
+ */
+export const MIN_ANALYSED_SHARE = 0.95;
+/** #1011: the sentinel for "not measured" in score and complexity fields. */
+const UNMEASURED = -1;
+/** First reasons of a failure list, for a one-line explanation. */
+function summariseFailures(failures) {
+    return failures.slice(0, 3).map((f) => f.reason).join('; ')
+        + (failures.length > 3 ? `; and ${failures.length - 3} more` : '');
+}
 const DEFAULT_CONFIG = {
     enableTrendAnalysis: true,
     trendDataPointsMin: 3,
@@ -52,14 +72,15 @@ export class QualityAnalyzerService {
      */
     constructor(memoryOrDependencies, config = {}) {
         this.config = { ...DEFAULT_CONFIG, ...config };
-        this.metricsAnalyzer = getCodeMetricsAnalyzer();
         // Support both old and new constructor signatures
         if ('memory' in memoryOrDependencies) {
             // New signature: dependencies object
             this.memory = memoryOrDependencies.memory;
             this.llmRouter = memoryOrDependencies.llmRouter;
+            this.metricsAnalyzer = memoryOrDependencies.metricsAnalyzer ?? getCodeMetricsAnalyzer();
         }
         else {
+            this.metricsAnalyzer = getCodeMetricsAnalyzer();
             // Old signature: direct MemoryBackend
             this.memory = memoryOrDependencies;
             this.llmRouter = undefined;
@@ -84,11 +105,11 @@ export class QualityAnalyzerService {
      * Generate quality insights using LLM
      * Provides AI-powered explanation and prioritized recommendations
      */
-    async generateQualityInsightsWithLLM(metrics, score, codeContext) {
+    async generateQualityInsightsWithLLM(metrics, score, codeContext, unmeasured = []) {
         if (!this.llmRouter)
             return null;
         try {
-            const prompt = this.buildQualityInsightsPrompt(metrics, score, codeContext);
+            const prompt = this.buildQualityInsightsPrompt(metrics, score, codeContext, unmeasured);
             const modelId = this.getModelForTier(this.config.llmModelTier ?? 2);
             const response = await this.llmRouter.chat({
                 messages: [
@@ -144,19 +165,26 @@ Focus on:
     /**
      * Build prompt for quality insights generation
      */
-    buildQualityInsightsPrompt(metrics, score, codeContext) {
+    buildQualityInsightsPrompt(metrics, score, codeContext, unmeasured = []) {
         let prompt = `## Quality Analysis Results\n\n`;
-        prompt += `### Overall Score: ${score.overall}/100\n\n`;
+        prompt += score.overall >= 0
+            ? `### Overall Score: ${score.overall}/100\n\n`
+            : `### Overall Score: not measured\n\n`;
         prompt += `### Detailed Metrics:\n`;
         for (const metric of metrics) {
             prompt += `- **${metric.name}**: ${metric.value} (Rating: ${metric.rating}, Trend: ${metric.trend})\n`;
         }
+        for (const missing of unmeasured) {
+            prompt += `- **${missing.metric}**: not measured (${missing.reason})\n`;
+        }
         prompt += `\n`;
+        // #996: -1 means "not measured"; never present it to the model as a value.
+        const show = (value, unit = '') => (value >= 0 ? `${value}${unit}` : 'not measured');
         prompt += `### Score Breakdown:\n`;
-        prompt += `- Coverage: ${score.coverage}%\n`;
-        prompt += `- Complexity: ${score.complexity}\n`;
-        prompt += `- Maintainability: ${score.maintainability}\n`;
-        prompt += `- Security: ${score.security}\n\n`;
+        prompt += `- Coverage: ${show(score.coverage, '%')}\n`;
+        prompt += `- Complexity: ${show(score.complexity)}\n`;
+        prompt += `- Maintainability: ${show(score.maintainability)}\n`;
+        prompt += `- Security: ${show(score.security)}\n\n`;
         if (codeContext) {
             prompt += `### Code Context:\n\`\`\`\n${codeContext.slice(0, 2000)}\n\`\`\`\n\n`;
         }
@@ -232,8 +260,8 @@ Focus on:
             if (sourceFiles.length === 0) {
                 return err(new Error('No source files provided for analysis'));
             }
-            // Analyze metrics for each file
-            const fileMetrics = await this.collectFileMetrics(sourceFiles, includeMetrics);
+            // Analyze metrics for each file; failures become unmeasured (#1011)
+            const { fileMetrics, unmeasured, excluded, partial } = await this.collectFileMetrics(sourceFiles, includeMetrics, request.explicitFiles ?? []);
             // Calculate aggregated metrics
             const metricDetails = this.aggregateMetrics(fileMetrics);
             // Calculate overall quality score
@@ -247,7 +275,7 @@ Focus on:
             // ADR-051: Generate LLM insights if enabled
             let llmInsights;
             if (this.isLLMInsightsAvailable()) {
-                const insights = await this.generateQualityInsightsWithLLM(metricDetails, score);
+                const insights = await this.generateQualityInsightsWithLLM(metricDetails, score, undefined, unmeasured);
                 if (insights) {
                     llmInsights = insights;
                 }
@@ -258,6 +286,9 @@ Focus on:
                 trends,
                 recommendations,
                 llmInsights,
+                unmeasured,
+                excluded,
+                partial,
             };
             // Store the report
             await this.storeReport(report, sourceFiles);
@@ -342,88 +373,148 @@ Focus on:
     // ============================================================================
     // Private Helper Methods
     // ============================================================================
-    async collectFileMetrics(files, includeMetrics) {
+    /**
+     * Collect per-file metric values. #1011 / #1021:
+     * - excluded files (binary, generated, minified, declarations, refused by
+     *   reader policy) leave the scope with a reason;
+     * - failed files (unreadable, unparseable) make a parsed metric partial, or
+     *   unmeasured below MIN_ANALYSED_SHARE or when a failed file was named
+     *   explicitly;
+     * - failed duplication detection and missing coverage are unmeasured.
+     * Never a fixed fallback value.
+     */
+    async collectFileMetrics(files, includeMetrics, explicitFiles) {
+        const requested = includeMetrics.length === 0 ? [...ANALYZER_METRICS] : includeMetrics;
+        const wants = (metric) => requested.includes(metric);
         const fileMetrics = new Map();
-        const includeAll = includeMetrics.length === 0;
-        // Collect duplication across all files if requested
-        let duplicationPercentage = 0;
-        if (includeAll || includeMetrics.includes('duplication')) {
-            try {
-                const duplicationResult = await this.metricsAnalyzer.detectDuplication(files);
-                duplicationPercentage = duplicationResult.percentage;
-            }
-            catch {
-                duplicationPercentage = 0;
-            }
-        }
+        const unmeasured = [];
+        const excluded = [];
+        const partial = [];
+        const parseFailed = [];
+        const unreadable = [];
+        const readable = [];
+        const missingCoverage = [];
+        const explicit = new Set(explicitFiles);
+        const needsAnalysis = requested.some((m) => PARSED_METRICS.has(m) || m === 'duplication');
         for (const file of files) {
             const metrics = {};
-            // Analyze the file using CodeMetricsAnalyzer
-            const fileAnalysis = await this.metricsAnalyzer.analyzeFile(file);
-            if (fileAnalysis) {
-                // Real metrics from analysis
-                if (includeAll || includeMetrics.includes('complexity')) {
-                    metrics.complexity = fileAnalysis.cyclomaticComplexity;
-                }
-                if (includeAll || includeMetrics.includes('maintainability')) {
-                    metrics.maintainability = fileAnalysis.maintainabilityIndex;
+            if (needsAnalysis) {
+                const outcome = await this.metricsAnalyzer.analyzeFileDetailed(file);
+                const reason = outcome.reason ?? `${file} could not be analysed`;
+                if (outcome.status === 'excluded') {
+                    excluded.push({ file, reason });
+                    continue;
                 }
-                if (includeAll || includeMetrics.includes('duplication')) {
-                    metrics.duplication = duplicationPercentage;
+                if (outcome.metrics)
+                    readable.push(file);
+                if (outcome.status === 'failed') {
+                    (outcome.metrics ? parseFailed : unreadable).push({ file, reason });
                 }
-                if (includeAll || includeMetrics.includes('testability')) {
-                    // Testability is derived from complexity and maintainability
-                    // Lower complexity and higher maintainability = higher testability
-                    const complexityFactor = Math.max(0, 100 - fileAnalysis.cyclomaticComplexity * 3);
-                    const maintainabilityFactor = fileAnalysis.maintainabilityIndex;
-                    metrics.testability = Math.round((complexityFactor * 0.4 + maintainabilityFactor * 0.6) * 100) / 100;
-                }
-                if (includeAll || includeMetrics.includes('coverage')) {
-                    // Coverage requires external data (from test runners)
-                    // Only use real stored coverage — never fabricate a number
-                    const storedCoverage = await this.getStoredCoverage(file);
-                    if (storedCoverage !== null) {
-                        metrics.coverage = storedCoverage;
+                else if (outcome.metrics) {
+                    const analysis = outcome.metrics;
+                    if (wants('complexity'))
+                        metrics.complexity = analysis.cyclomaticComplexity;
+                    if (wants('maintainability'))
+                        metrics.maintainability = analysis.maintainabilityIndex;
+                    if (wants('testability')) {
+                        // Testability is derived from complexity and maintainability
+                        // Lower complexity and higher maintainability = higher testability
+                        const complexityFactor = Math.max(0, 100 - analysis.cyclomaticComplexity * 3);
+                        const maintainabilityFactor = analysis.maintainabilityIndex;
+                        metrics.testability = Math.round((complexityFactor * 0.4 + maintainabilityFactor * 0.6) * 100) / 100;
                     }
-                    // If no coverage data exists, omit the metric rather than guessing
                 }
             }
-            else {
-                // Fallback for files that couldn't be analyzed
-                if (includeAll || includeMetrics.includes('coverage')) {
-                    // Only use real stored coverage — never fabricate a number
-                    const storedCoverage = await this.getStoredCoverage(file);
-                    if (storedCoverage !== null) {
-                        metrics.coverage = storedCoverage;
-                    }
-                }
-                if (includeAll || includeMetrics.includes('complexity')) {
-                    metrics.complexity = 10;
-                }
-                if (includeAll || includeMetrics.includes('maintainability')) {
-                    metrics.maintainability = 70;
-                }
-                if (includeAll || includeMetrics.includes('duplication')) {
-                    metrics.duplication = duplicationPercentage;
+            if (wants('coverage')) {
+                // Coverage requires external data (from test runners) — never fabricate a number
+                const storedCoverage = await this.getStoredCoverage(file);
+                if (storedCoverage !== null) {
+                    metrics.coverage = storedCoverage;
                 }
-                if (includeAll || includeMetrics.includes('testability')) {
-                    metrics.testability = 70;
+                else {
+                    missingCoverage.push(file);
                 }
             }
             fileMetrics.set(file, metrics);
         }
-        return fileMetrics;
+        const total = fileMetrics.size;
+        if (missingCoverage.length > 0) {
+            for (const metrics of fileMetrics.values())
+                delete metrics.coverage;
+            unmeasured.push({
+                metric: 'coverage',
+                reason: `no measured coverage recorded for ${missingCoverage.length} of ${total} file(s)`,
+            });
+        }
+        /** Decide whether a metric with these failures is measured, partial or unmeasured. */
+        const judge = (metric, failures) => {
+            const analysed = total - failures.length;
+            if (analysed === 0) {
+                unmeasured.push({
+                    metric,
+                    reason: total === 0
+                        ? `no analysable files: ${excluded.length} file(s) excluded (${summariseFailures(excluded)})`
+                        : `none of ${total} file(s) could be analysed: ${summariseFailures(failures)}`,
+                    ...(failures.length > 0 ? { files: failures.map((f) => f.file) } : {}),
+                });
+                return false;
+            }
+            if (failures.length === 0)
+                return true;
+            const share = analysed / total;
+            // Round DOWN so a partial scope never reads as 1 / 100% (#1021).
+            const permille = Math.floor((analysed * 1000) / total);
+            const coverageOfScope = permille / 1000;
+            const explicitFailure = failures.find((f) => explicit.has(f.file));
+            if (explicitFailure || share < MIN_ANALYSED_SHARE) {
+                const why = explicitFailure
+                    ? `explicit target ${explicitFailure.file} could not be analysed`
+                    : `${analysed} of ${total} file(s) analysed (${permille / 10}%, below ${MIN_ANALYSED_SHARE * 100}%)`;
+                unmeasured.push({
+                    metric,
+                    reason: `${why}: ${summariseFailures(failures)}`,
+                    files: failures.map((f) => f.file),
+                });
+                return false;
+            }
+            partial.push({ metric, analysedFiles: analysed, totalFiles: total, coverageOfScope, failed: failures });
+            return true;
+        };
+        const failedToParse = [...unreadable, ...parseFailed];
+        for (const metric of requested.filter((m) => PARSED_METRICS.has(m))) {
+            if (!judge(metric, failedToParse)) {
+                for (const metrics of fileMetrics.values())
+                    delete metrics[metric];
+            }
+        }
+        // Duplication needs readable text, not a parse (#1021 N2).
+        if (wants('duplication') && judge('duplication', unreadable)) {
+            try {
+                const { percentage } = await this.metricsAnalyzer.detectDuplication(readable);
+                for (const metrics of fileMetrics.values())
+                    metrics.duplication = percentage;
+            }
+            catch (error) {
+                const index = partial.findIndex((p) => p.metric === 'duplication');
+                if (index >= 0)
+                    partial.splice(index, 1);
+                unmeasured.push({ metric: 'duplication', reason: `duplication detection failed: ${toError(error).message}` });
+            }
+        }
+        return { fileMetrics, unmeasured, excluded, partial };
     }
     async getStoredCoverage(file) {
         try {
             // 1. Try per-file coverage stored by test executor
-            const fileCoverage = await this.memory.get(`coverage:file:${file}`);
-            if (fileCoverage && typeof fileCoverage.line === 'number') {
+            // #1014: only measured records count. Legacy unstamped estimate
+            // records (written by <= 3.15.4, never expiring) are ignored.
+            const fileCoverage = measuredFileCoverage(await this.memory.get(`coverage:file:${file}`));
+            if (fileCoverage) {
                 return fileCoverage.line;
             }
             // 2. Fall back to project-wide summary from coverage-analyzer
-            const summary = await this.memory.get('coverage:latest');
-            if (summary && typeof summary.line === 'number') {
+            const summary = measuredCoverageSummary(await this.memory.get('coverage:latest'));
+            if (summary) {
                 return summary.line;
             }
             // No coverage data available — return null (never fabricate)
@@ -478,15 +569,18 @@ Focus on:
             weightedSum += normalizedValue * weight;
             totalWeight += weight;
         }
-        const overall = totalWeight > 0 ? Math.round(weightedSum / totalWeight) : 0;
+        // #1011: no measured metric means no score — -1, never 0.
+        const overall = totalWeight > 0 ? Math.round(weightedSum / totalWeight) : UNMEASURED;
         // Use -1 to signal "no data available" rather than 0 which implies "0% coverage"
-        const coverageMetric = metrics.find((m) => m.name === 'coverage');
+        // (#996: the same holds for every score field — never fabricate a value).
+        const valueOf = (name) => metrics.find((m) => m.name === name)?.value ?? UNMEASURED;
         return {
             overall,
-            coverage: coverageMetric ? coverageMetric.value : -1,
-            complexity: metrics.find((m) => m.name === 'complexity')?.value || 0,
-            maintainability: metrics.find((m) => m.name === 'maintainability')?.value || 0,
-            security: 85, // Placeholder - would come from security analysis
+            coverage: valueOf('coverage'),
+            complexity: valueOf('complexity'),
+            maintainability: valueOf('maintainability'),
+            // No security analysis runs here; -1 = not measured (was a fixed 85 placeholder).
+            security: UNMEASURED,
         };
     }
     async generateTrends(currentMetrics, _compareBaseline) {
@@ -555,7 +649,7 @@ Focus on:
             });
         }
         // Overall score recommendation
-        if (score.overall < 70) {
+        if (score.overall >= 0 && score.overall < 70) {
             recommendations.push({
                 type: 'critical',
                 title: 'Overall Quality Improvement Needed',
@@ -571,50 +665,43 @@ Focus on:
     }
     async analyzeFileComplexity(file, requestedMetrics) {
         const includesAll = requestedMetrics.length === 0;
+        const wants = (metric) => includesAll || requestedMetrics.includes(metric);
         // Use real CodeMetricsAnalyzer for file analysis
-        const fileAnalysis = await this.metricsAnalyzer.analyzeFile(file);
-        if (fileAnalysis) {
+        const { status, metrics: analysis, reason } = await this.metricsAnalyzer.analyzeFileDetailed(file);
+        if (status !== 'measured' || !analysis) {
+            // #1011: never invent values for a file that could not be analysed
             return {
                 path: file,
-                cyclomatic: includesAll || requestedMetrics.includes('cyclomatic')
-                    ? fileAnalysis.cyclomaticComplexity
-                    : 0,
-                cognitive: includesAll || requestedMetrics.includes('cognitive')
-                    ? fileAnalysis.cognitiveComplexity
-                    : 0,
-                maintainability: includesAll || requestedMetrics.includes('maintainability')
-                    ? fileAnalysis.maintainabilityIndex
-                    : 0,
-                linesOfCode: fileAnalysis.linesOfCode,
+                cyclomatic: UNMEASURED,
+                cognitive: UNMEASURED,
+                maintainability: UNMEASURED,
+                linesOfCode: UNMEASURED,
+                unmeasuredReason: reason ?? `${file} could not be analysed`,
             };
         }
-        // Fallback for files that couldn't be analyzed
+        // A metric that was not requested is not measured (-1), not 0 — a 0
+        // maintainability would otherwise be reported as a critical hotspot.
         return {
             path: file,
-            cyclomatic: includesAll || requestedMetrics.includes('cyclomatic') ? 5 : 0,
-            cognitive: includesAll || requestedMetrics.includes('cognitive') ? 8 : 0,
-            maintainability: includesAll || requestedMetrics.includes('maintainability') ? 70 : 0,
-            linesOfCode: 100,
+            cyclomatic: wants('cyclomatic') ? analysis.cyclomaticComplexity : UNMEASURED,
+            cognitive: wants('cognitive') ? analysis.cognitiveComplexity : UNMEASURED,
+            maintainability: wants('maintainability') ? analysis.maintainabilityIndex : UNMEASURED,
+            linesOfCode: analysis.linesOfCode,
         };
     }
     calculateComplexitySummary(files) {
-        if (files.length === 0) {
-            return {
-                averageCyclomatic: 0,
-                averageCognitive: 0,
-                averageMaintainability: 0,
-                totalLinesOfCode: 0,
-            };
-        }
-        const sumCyclomatic = files.reduce((sum, f) => sum + f.cyclomatic, 0);
-        const sumCognitive = files.reduce((sum, f) => sum + f.cognitive, 0);
-        const sumMaintainability = files.reduce((sum, f) => sum + f.maintainability, 0);
-        const totalLOC = files.reduce((sum, f) => sum + f.linesOfCode, 0);
+        // #1011: average measured values only; -1 when nothing was measured.
+        const average = (values) => {
+            const measured = values.filter((v) => v >= 0);
+            if (measured.length === 0)
+                return UNMEASURED;
+            return Math.round((measured.reduce((sum, v) => sum + v, 0) / measured.length) * 100) / 100;
+        };
         return {
-            averageCyclomatic: Math.round((sumCyclomatic / files.length) * 100) / 100,
-            averageCognitive: Math.round((sumCognitive / files.length) * 100) / 100,
-            averageMaintainability: Math.round((sumMaintainability / files.length) * 100) / 100,
-            totalLinesOfCode: totalLOC,
+            averageCyclomatic: average(files.map((f) => f.cyclomatic)),
+            averageCognitive: average(files.map((f) => f.cognitive)),
+            averageMaintainability: average(files.map((f) => f.maintainability)),
+            totalLinesOfCode: files.reduce((sum, f) => sum + Math.max(0, f.linesOfCode), 0),
         };
     }
     identifyHotspots(files) {
@@ -643,8 +730,8 @@ Focus on:
                         : 'Simplify control flow and reduce nesting depth.',
                 });
             }
-            // Check maintainability (lower is worse)
-            if (file.maintainability <= thresholds.maintainability.warning) {
+            // Check maintainability (lower is worse); -1 = not measured, never a hotspot
+            if (file.maintainability >= 0 && file.maintainability <= thresholds.maintainability.warning) {
                 hotspots.push({
                     file: file.path,
                     function: 'unknown',

package/dist/domains/security-compliance/services/scanners/dast-scanner.js

@@ -6,6 +6,7 @@ import { LoggerFactory } from '../../../../logging/index.js';
 import { v4 as uuidv4 } from 'uuid';
 import { ok, err } from '../../../../shared/types/index.js';
 import { toError } from '../../../../shared/error-utils.js';
+import { fetchWithResponseDeadline } from '../../../../shared/llm/providers/response-deadline.js';
 import { analyzeSecurityHeaders, analyzeCookieSecurity, analyzeServerHeaders, scanSensitiveFiles, analyzeCORS, extractAndCrawlLinks, testXSS, testSQLi, analyzeFormsForSecurityIssues, testAuthorizationBypass, testIDOR, validateCredentials, buildAuthHeaders, handleFetchError, calculateSummary, storeScanResults, } from './dast-helpers.js';
 // ============================================================================
 // DAST Scanner Service
@@ -144,20 +145,19 @@ export class DASTScanner {
             }
             const timeout = options.timeout ?? this.config.timeout;
             const maxDepth = options.maxDepth ?? this.config.dastMaxDepth;
-            // Perform main page scan
-            const controller = new AbortController();
-            const timeoutId = setTimeout(() => controller.abort(), Math.min(timeout, 30000));
+            // Perform main page scan. #980: the deadline must cover the body too —
+            // the target is untrusted and may send headers and then stall the body,
+            // so it stays armed until `response.clone().text()` below has finished.
+            const deadlineMs = Math.min(timeout, 30000);
             try {
-                const response = await fetch(targetUrl, {
+                const response = await fetchWithResponseDeadline(targetUrl, {
                     method: 'GET',
                     headers: {
                         'User-Agent': 'AgenticQE-DAST-Scanner/3.0',
                         'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
                     },
-                    signal: controller.signal,
                     redirect: 'follow',
-                });
-                clearTimeout(timeoutId);
+                }, deadlineMs, () => new Error(`DAST request timeout after ${deadlineMs}ms: ${targetUrl}`));
                 crawledUrls++;
                 // Security header analysis
                 analyzeSecurityHeaders(response.headers, targetUrl, vulnerabilities);
@@ -171,19 +171,25 @@ export class DASTScanner {
                 analyzeServerHeaders(response.headers, targetUrl, vulnerabilities);
                 // Active scanning features
                 if (options.activeScanning ?? this.config.dastActiveScanning) {
+                    // Read the page body first, inside the request deadline (#980), so the
+                    // slower probes below cannot use up the deadline of a healthy target.
+                    const responseText = await response.text();
                     crawledUrls = await scanSensitiveFiles(parsedUrl, crawledUrls, maxDepth, vulnerabilities);
                     await analyzeCORS(targetUrl, vulnerabilities);
                     // Enhanced DAST: Link crawling, injection testing, form analysis
-                    const responseText = await response.clone().text();
                     crawledUrls = await extractAndCrawlLinks(responseText, parsedUrl, crawledUrls, maxDepth, vulnerabilities);
                     if (parsedUrl.search) {
                         await this.testInjectionVulnerabilities(targetUrl, parsedUrl, vulnerabilities);
                     }
                     analyzeFormsForSecurityIssues(responseText, targetUrl, vulnerabilities);
                 }
+                else {
+                    // Passive scan: headers only. Release the connection instead of
+                    // leaving an unread body to the deadline timer.
+                    await response.body?.cancel().catch(() => undefined);
+                }
             }
             catch (fetchError) {
-                clearTimeout(timeoutId);
                 handleFetchError(fetchError, targetUrl, vulnerabilities);
             }
         }
@@ -210,20 +216,21 @@ export class DASTScanner {
             }
             const timeout = options.timeout ?? this.config.timeout;
             const maxDepth = options.maxDepth ?? this.config.dastMaxDepth;
-            const controller = new AbortController();
-            const timeoutId = setTimeout(() => controller.abort(), Math.min(timeout, 30000));
+            // #980 review N8: same deadline treatment as the unauthenticated scan.
+            // This path reads headers only; the unread body is cancelled below so
+            // a target that stalls it cannot hold the connection open.
+            const deadlineMs = Math.min(timeout, 30000);
             try {
-                const response = await fetch(targetUrl, {
+                const response = await fetchWithResponseDeadline(targetUrl, {
                     method: 'GET',
                     headers: {
                         'User-Agent': 'AgenticQE-DAST-Scanner/3.0',
                         'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
                         ...authHeaders,
                     },
-                    signal: controller.signal,
                     redirect: 'follow',
-                });
-                clearTimeout(timeoutId);
+                }, deadlineMs, () => new Error(`DAST request timeout after ${deadlineMs}ms: ${targetUrl}`));
+                await response.body?.cancel().catch(() => undefined);
                 crawledUrls++;
                 // Check if authentication was successful
                 if (response.status === 401 || response.status === 403) {
@@ -244,7 +251,6 @@ export class DASTScanner {
                 analyzeCookieSecurity(response.headers, targetUrl, vulnerabilities, true);
             }
             catch (fetchError) {
-                clearTimeout(timeoutId);
                 handleFetchError(fetchError, targetUrl, vulnerabilities);
             }
         }

package/dist/domains/test-execution/interfaces.d.ts

@@ -76,9 +76,11 @@ export interface ITestRunResult {
 export interface IFileCoverageData {
     path: string;
     line: number;
-    branch: number;
-    function: number;
-    statement: number;
+    /** `null` = no branches in the file (istanbul 0/0): not collected, not 100% (#1015). */
+    branch: number | null;
+    /** `null` = no functions in the file (istanbul 0/0): not collected, not 100% (#1015). */
+    function: number | null;
+    statement: number | null;
 }
 export interface IFailedTest {
     testId: string;
@@ -90,9 +92,11 @@ export interface IFailedTest {
 }
 export interface ICoverageData {
     line: number;
-    branch: number;
-    function: number;
-    statement: number;
+    /** `null` = not collected (no branches anywhere), never a fake 0 or 100 (#1015). */
+    branch: number | null;
+    /** `null` = not collected (no functions anywhere), never a fake 0 or 100 (#1015). */
+    function: number | null;
+    statement: number | null;
 }
 export interface IFlakyDetectionRequest {
     testFiles: string[];

package/dist/domains/test-execution/plugin.js

@@ -6,6 +6,7 @@ import { err } from '../../shared/types/index.js';
 import { BaseDomainPlugin } from '../domain-interface.js';
 import { createTestExecutionCoordinator } from './coordinator.js';
 import { getGlobalInfraHealing } from '../../strange-loop/infra-healing/global-instance.js';
+import { isMeasuredGapPayload } from '../../shared/events/domain-events.js';
 // ============================================================================
 // Plugin Implementation
 // ============================================================================
@@ -200,6 +201,9 @@ export class TestExecutionPlugin extends BaseDomainPlugin {
         });
     }
     async handleCoverageGapDetected(event) {
+        // #1014: only a gap found in MEASURED coverage is acted on / learned from.
+        if (!isMeasuredGapPayload(event.payload))
+            return;
         const payload = event.payload;
         // Could trigger targeted test execution for high-risk gaps
         if (payload.riskScore > 0.7) {