agentic-qe 3.15.5 → 3.15.7

package/dist/domains/security-compliance/services/scanners/scanner-types.d.ts

@@ -3,7 +3,7 @@
  * Common types, interfaces, and patterns used across all scanner modules
  */
 import type { MemoryBackend } from '@kernel/interfaces.js';
-import type { Vulnerability, VulnerabilitySeverity, VulnerabilityCategory, VulnerabilityLocation, RemediationAdvice, ScanSummary, SecurityCoverage, ScanStatus, SASTResult, DASTResult, DASTOptions, AuthCredentials, RuleSet, FalsePositiveCheck } from '../../interfaces.js';
+import type { Vulnerability, VulnerabilitySeverity, VulnerabilityCategory, VulnerabilityLocation, RemediationAdvice, ScanSummary, SecurityCoverage, ScanStatus, SASTResult, DASTResult, DASTOptions, AuthCredentials, RuleSet, FalsePositiveCheck, UncheckedDependency, LocalDependency } from '../../interfaces.js';
 import type { HybridRouter, ChatResponse } from '@shared/llm/index.js';
 /**
  * Combined security scanner configuration
@@ -31,16 +31,44 @@ export interface SecurityScannerDependencies {
     llmRouter?: HybridRouter;
 }
 export declare const DEFAULT_CONFIG: SecurityScannerConfig;
+/**
+ * Completeness of a dependency advisory scan (#1049).
+ * - complete: every dependency was checked; the findings (or none) are a measurement.
+ * - incomplete: some dependencies were checked (their findings are real), others not.
+ * - failed: no dependency could be checked. Never read as "0 vulnerabilities".
+ */
+export type DependencyScanStatus = 'complete' | 'incomplete' | 'failed';
 /**
  * Dependency scan result
  */
 export interface DependencyScanResult {
     readonly scanId: string;
     readonly vulnerabilities: Vulnerability[];
+    /** Dependencies submitted to the scan (checked or not). */
     readonly packagesScanned: number;
     readonly vulnerablePackages: number;
     readonly summary: ScanSummary;
     readonly scanDurationMs: number;
+    readonly status: DependencyScanStatus;
+    /** True only when status is 'complete'. */
+    readonly measured: boolean;
+    /** Dependencies whose advisories were actually checked. */
+    readonly packagesChecked: number;
+    readonly uncheckedPackages: UncheckedDependency[];
+    /** Lockfile the checked versions were resolved from (path relative to package.json), or null when none was used. */
+    readonly lockfile?: string | null;
+    /** Local workspace / linked packages: not OSV subjects, never make the scan incomplete. */
+    readonly localPackages?: LocalDependency[];
+    /**
+     * Why the scan cannot be complete beyond individual packages: a malformed
+     * lockfile, or a workspace root whose members are not scanned (#1057).
+     * Non-empty means the scan is not complete.
+     */
+    readonly resolutionErrors?: string[];
+    /** Only the direct dependencies of the scanned package.json are checked. */
+    readonly scope?: 'direct';
+    /** Why the scan is incomplete/failed; absent when complete. */
+    readonly error?: string;
 }
 /**
  * Full scan result combining SAST and DAST
@@ -89,5 +117,5 @@ export interface MutableScanSummary {
     totalFiles: number;
     scanDurationMs: number;
 }
-export type { Vulnerability, VulnerabilitySeverity, VulnerabilityCategory, VulnerabilityLocation, RemediationAdvice, ScanSummary, SecurityCoverage, ScanStatus, SASTResult, DASTResult, DASTOptions, AuthCredentials, RuleSet, FalsePositiveCheck, MemoryBackend, HybridRouter, ChatResponse, };
+export type { Vulnerability, VulnerabilitySeverity, VulnerabilityCategory, VulnerabilityLocation, RemediationAdvice, ScanSummary, SecurityCoverage, ScanStatus, SASTResult, DASTResult, DASTOptions, AuthCredentials, RuleSet, FalsePositiveCheck, UncheckedDependency, LocalDependency, MemoryBackend, HybridRouter, ChatResponse, };
 //# sourceMappingURL=scanner-types.d.ts.map

package/dist/domains/security-compliance/services/security-auditor.d.ts

@@ -12,6 +12,7 @@
 import { Result } from '../../../shared/types/index.js';
 import type { MemoryBackend } from '../../../kernel/interfaces.js';
 import type { FilePath } from '../../../shared/value-objects/index.js';
+import { OSVClient } from '../../../shared/security/osv-client.js';
 import type { DependencyScanResult, PackageSecurityInfo, UpgradeRecommendation, Vulnerability, DependencyInfo, SecretScanResult, SecurityAuditOptions, SecurityAuditReport } from '../interfaces.js';
 export type { ISecurityAuditorService, SecurityPostureSummary, TriagedVulnerabilities, SecurityAuditorConfig, PackageJson, OSVQueryRequest, OSVVulnerability, OSVQueryResponse, HttpResponse, } from './security-auditor-types.js';
 export { DEFAULT_CONFIG, httpPost, httpGet } from './security-auditor-types.js';
@@ -19,7 +20,8 @@ import type { ISecurityAuditorService, SecurityPostureSummary, TriagedVulnerabil
 export declare class SecurityAuditorService implements ISecurityAuditorService {
     private readonly memory;
     private readonly config;
-    constructor(memory: MemoryBackend, config?: Partial<SecurityAuditorConfig>);
+    private readonly osvClient;
+    constructor(memory: MemoryBackend, config?: Partial<SecurityAuditorConfig>, osvClient?: OSVClient);
     scanDependencies(manifestPath: FilePath): Promise<Result<DependencyScanResult>>;
     checkPackage(name: string, version: string, ecosystem: DependencyInfo['ecosystem']): Promise<Result<PackageSecurityInfo>>;
     getUpgradeRecommendations(vulnerabilities: Vulnerability[]): Promise<Result<UpgradeRecommendation[]>>;
@@ -29,12 +31,23 @@ export declare class SecurityAuditorService implements ISecurityAuditorService {
     triageVulnerabilities(vulnerabilities: Vulnerability[]): Promise<Result<TriagedVulnerabilities>>;
     private detectEcosystem;
     private parseDependencies;
-    private cleanVersionSpec;
-    private checkDependencyVulnerabilities;
+    /**
+     * Dependencies to check for a scan. npm uses the shared resolver (#1049):
+     * lockfile-resolved versions when in sync with package.json, exact specs
+     * otherwise, local packages excluded; anything that cannot be matched without
+     * guessing is returned as pre-unchecked. Planning errors (a malformed lockfile,
+     * a workspace root whose members are not scanned, #1057) are pre-unchecked too,
+     * so the audit is never complete when they occur.
+     */
+    private parseDependenciesForScan;
+    /**
+     * Check dependencies against OSV advisories. A failed or partial lookup is
+     * reported with the unchecked dependencies, never as "no vulnerabilities" (#1049).
+     */
+    private checkDependencyAdvisories;
+    private toDependencyScanResult;
     private mapToOSVEcosystem;
-    private mapOSVVulnerability;
-    private mapOSVSeverity;
-    private extractFixedVersion;
+    private mapParsedVulnerability;
     private categorizeVulnerability;
     private checkOutdated;
     private queryVulnerabilityDatabase;

package/dist/domains/security-compliance/services/security-auditor.js

@@ -16,8 +16,11 @@ import * as path from 'path';
 import { ok, err } from '../../../shared/types/index.js';
 import { toError } from '../../../shared/error-utils.js';
 import { safeJsonParse } from '../../../shared/safe-json.js';
+import { OSVClient } from '../../../shared/security/osv-client.js';
+import { lookupKey } from '../../../shared/security/osv-lookup.js';
+import { resolveDependencies } from './scanners/dependency-resolver.js';
 export { DEFAULT_CONFIG, httpPost, httpGet } from './security-auditor-types.js';
-import { DEFAULT_CONFIG, httpPost, httpGet } from './security-auditor-types.js';
+import { DEFAULT_CONFIG, httpGet } from './security-auditor-types.js';
 // Import extracted modules
 import { performSASTScan } from './security-auditor-sast.js';
 import { performDASTScan } from './security-auditor-dast.js';
@@ -27,12 +30,16 @@ import { calculateOverallRisk, generateRecommendations, countBySeverity, countOp
 // Security Auditor Service Implementation
 // ============================================================================
 const logger = LoggerFactory.create('security-compliance/security-auditor');
+/** Name of an unchecked entry that stands for a planning error (malformed lockfile, workspace root #1057). */
+const PLANNING_ENTRY = '(dependency plan)';
 export class SecurityAuditorService {
     memory;
     config;
-    constructor(memory, config = {}) {
+    osvClient;
+    constructor(memory, config = {}, osvClient) {
         this.memory = memory;
         this.config = { ...DEFAULT_CONFIG, ...config };
+        this.osvClient = osvClient ?? new OSVClient();
     }
     // ==========================================================================
     // IDependencySecurityService Implementation
@@ -44,20 +51,19 @@ export class SecurityAuditorService {
             if (!ecosystem) {
                 return err(new Error(`Unknown manifest format: ${manifest}`));
             }
-            const vulnerabilities = [];
             const outdatedPackages = [];
-            const dependencies = await this.parseDependencies(manifest, ecosystem);
+            const { dependencies, preUnchecked } = await this.parseDependenciesForScan(manifest, ecosystem);
+            const advisories = await this.checkDependencyAdvisories(dependencies, preUnchecked);
             for (const dep of dependencies) {
-                const vulns = await this.checkDependencyVulnerabilities(dep, ecosystem);
-                vulnerabilities.push(...vulns);
                 const outdated = await this.checkOutdated(dep);
                 if (outdated) {
                     outdatedPackages.push(outdated);
                 }
             }
-            const summary = this.createDependencySummary(vulnerabilities, dependencies.length);
-            await this.memory.set(`security:deps:${manifestPath.filename}`, { vulnerabilities, outdatedPackages, summary }, { namespace: 'security-compliance', ttl: 86400 });
-            return ok({ vulnerabilities, outdatedPackages, summary });
+            const summary = this.createDependencySummary(advisories.vulnerabilities, dependencies.length);
+            const result = this.toDependencyScanResult(advisories, outdatedPackages, summary);
+            await this.memory.set(`security:deps:${manifestPath.filename}`, result, { namespace: 'security-compliance', ttl: 86400 });
+            return ok(result);
         }
         catch (error) {
             return err(toError(error));
@@ -134,6 +140,10 @@ export class SecurityAuditorService {
             }
             const overallRiskScore = calculateOverallRisk(sastResults, dastResults, dependencyResults, secretScanResults);
             const recommendations = generateRecommendations(sastResults, dastResults, dependencyResults, secretScanResults);
+            // #1049: an incomplete advisory lookup leaves dependency risk unmeasured.
+            if (dependencyResults && dependencyResults.status !== 'complete') {
+                recommendations.unshift(`${dependencyResults.error ?? 'Dependency advisories could not be checked'}. Dependency risk is unmeasured; re-run the scan when the OSV API is reachable.`);
+            }
             const report = {
                 auditId,
                 timestamp,
@@ -247,9 +257,9 @@ export class SecurityAuditorService {
                     ...packageJson.peerDependencies,
                     ...packageJson.optionalDependencies,
                 };
+                // Declared specs only; scans resolve versions via parseDependenciesForScan (#1049).
                 for (const [name, versionSpec] of Object.entries(allDeps)) {
-                    const version = this.cleanVersionSpec(versionSpec);
-                    dependencies.push({ name, version, ecosystem: 'npm' });
+                    dependencies.push({ name, version: versionSpec, ecosystem: 'npm' });
                 }
             }
             else if (ecosystem === 'pip') {
@@ -259,11 +269,14 @@ export class SecurityAuditorService {
                     const trimmed = line.trim();
                     if (!trimmed || trimmed.startsWith('#'))
                         continue;
-                    const match = trimmed.match(/^([a-zA-Z0-9_-]+)(?:[=<>~!]+(.+))?$/);
+                    // Only an `==` pin is a concrete version; any other specifier is kept
+                    // verbatim so the lookup reports it unchecked (#1049).
+                    const match = trimmed.match(/^([a-zA-Z0-9_.-]+)\s*(===?|>=|<=|~=|!=|>|<)?\s*([^\s;#]+)?/);
                     if (match) {
+                        const [, name, op, value] = match;
                         dependencies.push({
-                            name: match[1],
-                            version: match[2] || 'latest',
+                            name,
+                            version: value && (op === '==' || op === '===') ? value : op && value ? `${op}${value}` : '*',
                             ecosystem: 'pip',
                         });
                     }
@@ -272,32 +285,90 @@ export class SecurityAuditorService {
         }
         catch (error) {
             logger.error(`Failed to parse dependencies from ${manifest}:`, error instanceof Error ? error : undefined);
+            // #1049: an unreadable manifest is a failed scan, not a project with no dependencies.
+            throw error;
         }
         return dependencies;
     }
-    cleanVersionSpec(versionSpec) {
-        return versionSpec.replace(/^[\^~>=<]+/, '').trim();
-    }
-    async checkDependencyVulnerabilities(dep, ecosystem) {
-        const vulnerabilities = [];
+    /**
+     * Dependencies to check for a scan. npm uses the shared resolver (#1049):
+     * lockfile-resolved versions when in sync with package.json, exact specs
+     * otherwise, local packages excluded; anything that cannot be matched without
+     * guessing is returned as pre-unchecked. Planning errors (a malformed lockfile,
+     * a workspace root whose members are not scanned, #1057) are pre-unchecked too,
+     * so the audit is never complete when they occur.
+     */
+    async parseDependenciesForScan(manifest, ecosystem) {
+        if (ecosystem !== 'npm')
+            return { dependencies: await this.parseDependencies(manifest, ecosystem), preUnchecked: [] };
+        let resolution;
         try {
-            const osvEcosystem = this.mapToOSVEcosystem(ecosystem);
-            const osvQuery = {
-                package: { name: dep.name, ecosystem: osvEcosystem },
-                version: dep.version,
-            };
-            const response = await httpPost('https://api.osv.dev/v1/query', osvQuery);
-            if (response.ok && response.data.vulns && response.data.vulns.length > 0) {
-                for (const osvVuln of response.data.vulns) {
-                    const vulnerability = this.mapOSVVulnerability(osvVuln, dep);
-                    vulnerabilities.push(vulnerability);
-                }
-            }
+            resolution = await resolveDependencies(manifest);
         }
         catch (error) {
-            logger.error(`Failed to check vulnerabilities for ${dep.name}@${dep.version}:`, error instanceof Error ? error : undefined);
+            logger.error(`Failed to parse dependencies from ${manifest}:`, error instanceof Error ? error : undefined);
+            // #1049: an unreadable manifest is a failed scan, not a project with no dependencies.
+            throw error;
         }
-        return vulnerabilities;
+        const dependencies = [];
+        const preUnchecked = [];
+        for (const dep of resolution.dependencies) {
+            if (dep.kind === 'check')
+                dependencies.push({ name: dep.packageName, version: dep.version, ecosystem: 'npm' });
+            else if (dep.kind === 'unchecked') {
+                preUnchecked.push({ name: dep.name, version: dep.spec, reason: dep.reason ?? 'not checked',
+                    ...(dep.member ? { member: dep.member } : {}), ...(dep.lockedVersion ? { lockedVersion: dep.lockedVersion } : {}) });
+            }
+        }
+        for (const reason of [...(resolution.error ? [resolution.error] : []), ...resolution.memberErrors]) {
+            preUnchecked.push({ name: PLANNING_ENTRY, version: '*', reason });
+        }
+        return { dependencies, preUnchecked };
+    }
+    /**
+     * Check dependencies against OSV advisories. A failed or partial lookup is
+     * reported with the unchecked dependencies, never as "no vulnerabilities" (#1049).
+     */
+    async checkDependencyAdvisories(dependencies, preUnchecked = []) {
+        const lookup = await this.osvClient.lookupBatch(dependencies.map((dep) => ({
+            name: dep.name, ecosystem: this.mapToOSVEcosystem(dep.ecosystem), version: dep.version,
+        })));
+        const vulnerabilities = [];
+        for (const dep of dependencies) {
+            const found = lookup.results.get(lookupKey({ ecosystem: this.mapToOSVEcosystem(dep.ecosystem), name: dep.name, version: dep.version })) ?? [];
+            vulnerabilities.push(...found.map((parsed) => this.mapParsedVulnerability(parsed, dep)));
+        }
+        const uncheckedPackages = [...preUnchecked, ...lookup.unchecked.map((pkg) => ({
+                name: pkg.name, version: pkg.version ?? 'unknown', reason: pkg.reason,
+            }))];
+        const reasons = lookup.errors.length > 0 ? lookup.errors : [...new Set(uncheckedPackages.map((p) => p.reason))];
+        const requested = lookup.packagesChecked + uncheckedPackages.length;
+        // `failed` only when a real package was to be checked and none was; a planning
+        // error alone (e.g. an empty workspace root) is incomplete, as in the scanner.
+        const realRequested = requested - uncheckedPackages.filter((p) => p.name === PLANNING_ENTRY).length;
+        const status = lookup.packagesChecked === requested ? 'complete'
+            : lookup.packagesChecked === 0 && realRequested > 0 ? 'failed' : 'incomplete';
+        return {
+            vulnerabilities,
+            status,
+            packagesChecked: lookup.packagesChecked,
+            uncheckedPackages,
+            ...(status === 'complete' ? {} : {
+                error: `Dependency advisories could not be checked for ${uncheckedPackages.length} package(s): ${reasons.slice(0, 3).join('; ')}`,
+            }),
+        };
+    }
+    toDependencyScanResult(advisories, outdatedPackages, summary) {
+        return {
+            vulnerabilities: advisories.vulnerabilities,
+            outdatedPackages,
+            summary,
+            status: advisories.status,
+            measured: advisories.status === 'complete',
+            packagesChecked: advisories.packagesChecked,
+            uncheckedPackages: advisories.uncheckedPackages,
+            ...(advisories.error ? { error: advisories.error } : {}),
+        };
     }
     mapToOSVEcosystem(ecosystem) {
         const ecosystemMap = {
@@ -309,13 +380,10 @@ export class SecurityAuditorService {
         };
         return ecosystemMap[ecosystem];
     }
-    mapOSVVulnerability(osvVuln, dep) {
-        const cveId = osvVuln.aliases?.find((alias) => alias.startsWith('CVE-'));
-        const severity = this.mapOSVSeverity(osvVuln.severity);
-        const fixedVersion = this.extractFixedVersion(osvVuln);
-        const references = osvVuln.references?.map((ref) => ref.url) || [];
+    mapParsedVulnerability(parsed, dep) {
+        const fixedVersion = parsed.fixedVersions[0];
         const location = {
-            file: 'package.json',
+            file: dep.ecosystem === 'pip' ? 'requirements.txt' : 'package.json',
             dependency: dep,
         };
         const remediation = {
@@ -328,51 +396,17 @@ export class SecurityAuditorService {
         };
         return {
             id: uuidv4(),
-            cveId,
-            title: osvVuln.summary || `Vulnerability in ${dep.name}`,
-            description: osvVuln.details || osvVuln.summary || 'No description available',
-            severity,
-            category: this.categorizeVulnerability(osvVuln),
+            cveId: parsed.cveIds[0],
+            title: parsed.summary || `Vulnerability in ${dep.name}`,
+            description: parsed.details || parsed.summary || 'No description available',
+            // An advisory without a severity rating stays reported, at medium (as before).
+            severity: parsed.severity === 'unknown' ? 'medium' : parsed.severity,
+            category: this.categorizeVulnerability({ summary: parsed.summary, details: parsed.details }),
             location,
             remediation,
-            references,
+            references: parsed.references,
         };
     }
-    mapOSVSeverity(severityScores) {
-        if (!severityScores || severityScores.length === 0) {
-            return 'medium';
-        }
-        const cvssScore = severityScores.find((s) => s.type === 'CVSS_V3' || s.type === 'CVSS_V2');
-        if (cvssScore) {
-            const score = parseFloat(cvssScore.score);
-            if (score >= 9.0)
-                return 'critical';
-            if (score >= 7.0)
-                return 'high';
-            if (score >= 4.0)
-                return 'medium';
-            if (score > 0)
-                return 'low';
-        }
-        return 'medium';
-    }
-    extractFixedVersion(osvVuln) {
-        if (!osvVuln.affected)
-            return undefined;
-        for (const affected of osvVuln.affected) {
-            if (affected.ranges) {
-                for (const range of affected.ranges) {
-                    if (range.events) {
-                        const fixedEvent = range.events.find((event) => event.fixed);
-                        if (fixedEvent?.fixed) {
-                            return fixedEvent.fixed;
-                        }
-                    }
-                }
-            }
-        }
-        return undefined;
-    }
     categorizeVulnerability(osvVuln) {
         const summary = (osvVuln.summary || '').toLowerCase();
         const details = (osvVuln.details || '').toLowerCase();
@@ -397,7 +431,8 @@ export class SecurityAuditorService {
     }
     async checkOutdated(dep) {
         const latestVersion = await this.getLatestVersion(dep.name, dep.ecosystem);
-        if (latestVersion !== dep.version) {
+        // A failed registry lookup ('unknown') is not evidence the package is outdated.
+        if (latestVersion !== 'unknown' && latestVersion !== dep.version) {
             return {
                 name: dep.name,
                 currentVersion: dep.version,
@@ -408,8 +443,11 @@ export class SecurityAuditorService {
         return null;
     }
     async queryVulnerabilityDatabase(name, version, ecosystem) {
-        const dep = { name, version, ecosystem };
-        return this.checkDependencyVulnerabilities(dep, ecosystem);
+        const outcome = await this.checkDependencyAdvisories([{ name, version, ecosystem }]);
+        if (outcome.status !== 'complete') {
+            throw new Error(outcome.error ?? `Dependency advisories could not be checked for ${name}@${version}`);
+        }
+        return outcome.vulnerabilities;
     }
     async getLatestVersion(name, ecosystem) {
         try {
@@ -495,25 +533,23 @@ export class SecurityAuditorService {
     }
     async performDependencyScan() {
         const startTime = Date.now();
-        const vulnerabilities = [];
         const outdatedPackages = [];
+        const manifestPath = path.join(process.cwd(), 'package.json');
         try {
-            const manifestPath = path.join(process.cwd(), 'package.json');
-            const dependencies = await this.parseDependencies(manifestPath, 'npm');
+            const { dependencies, preUnchecked } = await this.parseDependenciesForScan(manifestPath, 'npm');
+            const advisories = await this.checkDependencyAdvisories(dependencies, preUnchecked);
             for (const dep of dependencies) {
-                const vulns = await this.checkDependencyVulnerabilities(dep, dep.ecosystem);
-                vulnerabilities.push(...vulns);
                 const outdated = await this.checkOutdated(dep);
                 if (outdated) {
                     outdatedPackages.push(outdated);
                 }
             }
-            const scanDurationMs = Date.now() - startTime;
-            const baseSummary = this.createDependencySummary(vulnerabilities, dependencies.length);
-            return { vulnerabilities, outdatedPackages, summary: { ...baseSummary, scanDurationMs } };
+            const baseSummary = this.createDependencySummary(advisories.vulnerabilities, dependencies.length);
+            return this.toDependencyScanResult(advisories, outdatedPackages, { ...baseSummary, scanDurationMs: Date.now() - startTime });
         }
         catch (error) {
             logger.error('Dependency scan failed:', error instanceof Error ? error : undefined);
+            // #1049: a scan that could not run is failed, never an empty clean result.
             return {
                 vulnerabilities: [],
                 outdatedPackages: [],
@@ -521,6 +557,11 @@ export class SecurityAuditorService {
                     critical: 0, high: 0, medium: 0, low: 0, informational: 0,
                     totalFiles: 0, scanDurationMs: Date.now() - startTime,
                 },
+                status: 'failed',
+                measured: false,
+                packagesChecked: 0,
+                uncheckedPackages: [],
+                error: `Dependency scan of ${manifestPath} failed: ${toError(error).message}`,
             };
         }
     }
@@ -564,7 +605,7 @@ export class SecurityAuditorService {
                 }
             }
         }
-        catch (error) {
+        catch {
             logger.debug('Directory read error:');
         }
         return files;

package/dist/domains/test-execution/interfaces.d.ts

@@ -76,9 +76,11 @@ export interface ITestRunResult {
 export interface IFileCoverageData {
     path: string;
     line: number;
-    branch: number;
-    function: number;
-    statement: number;
+    /** `null` = no branches in the file (istanbul 0/0): not collected, not 100% (#1015). */
+    branch: number | null;
+    /** `null` = no functions in the file (istanbul 0/0): not collected, not 100% (#1015). */
+    function: number | null;
+    statement: number | null;
 }
 export interface IFailedTest {
     testId: string;
@@ -90,9 +92,11 @@ export interface IFailedTest {
 }
 export interface ICoverageData {
     line: number;
-    branch: number;
-    function: number;
-    statement: number;
+    /** `null` = not collected (no branches anywhere), never a fake 0 or 100 (#1015). */
+    branch: number | null;
+    /** `null` = not collected (no functions anywhere), never a fake 0 or 100 (#1015). */
+    function: number | null;
+    statement: number | null;
 }
 export interface IFlakyDetectionRequest {
     testFiles: string[];

package/dist/domains/test-execution/plugin.js

@@ -6,6 +6,7 @@ import { err } from '../../shared/types/index.js';
 import { BaseDomainPlugin } from '../domain-interface.js';
 import { createTestExecutionCoordinator } from './coordinator.js';
 import { getGlobalInfraHealing } from '../../strange-loop/infra-healing/global-instance.js';
+import { isMeasuredGapPayload } from '../../shared/events/domain-events.js';
 // ============================================================================
 // Plugin Implementation
 // ============================================================================
@@ -200,6 +201,9 @@ export class TestExecutionPlugin extends BaseDomainPlugin {
         });
     }
     async handleCoverageGapDetected(event) {
+        // #1014: only a gap found in MEASURED coverage is acted on / learned from.
+        if (!isMeasuredGapPayload(event.payload))
+            return;
         const payload = event.payload;
         // Could trigger targeted test execution for high-risk gaps
         if (payload.riskScore > 0.7) {

package/dist/domains/test-execution/services/retry-handler.js

@@ -7,6 +7,7 @@ import { spawn } from 'node:child_process';
 import { createVitestJsonReport } from '../../../shared/vitest-json-report.js';
 import { jestExactPathPattern, nameFilterArg, runnerFilePath } from '../../../shared/test-runner-args.js';
 import { existsSync, readFileSync } from 'node:fs';
+import { resolve as resolvePath } from 'node:path';
 import { ok, err } from '../../../shared/types/index.js';
 import { TEST_EXECUTION_CONSTANTS, RETRY_CONSTANTS } from '../../constants.js';
 import { toError } from '../../../shared/error-utils.js';
@@ -267,7 +268,7 @@ export class RetryHandlerService {
         // Build command based on runner
         const { command, args, report } = this.buildTestCommand(runner, testFile, testName, cwd);
         // Execute the test
-        return this.spawnTestProcess(command, args, cwd, report);
+        return this.spawnTestProcess(command, args, cwd, report, runner === 'vitest' ? testFile : undefined);
     }
     /**
      * Detect which test runner is available in the project
@@ -380,7 +381,7 @@ export class RetryHandlerService {
     /**
      * Spawn a test process and parse the result
      */
-    spawnTestProcess(command, args, cwd, report) {
+    spawnTestProcess(command, args, cwd, report, targetFile) {
         return new Promise((resolve, reject) => {
             const timeout = this.config.testTimeout;
             let stdout = '';
@@ -431,7 +432,7 @@ export class RetryHandlerService {
                     if (reportText === undefined) {
                         throw new Error('The current Vitest JSON report is missing for the retry run.');
                     }
-                    settle(resolve, this.parseTestResult(code, reportText, stderr));
+                    settle(resolve, this.parseTestResult(code, reportText, stderr, targetFile));
                 }
                 catch (error) {
                     settle(reject, toError(error));
@@ -450,7 +451,7 @@ export class RetryHandlerService {
     /**
      * Parse test runner output to determine pass/fail status
      */
-    parseTestResult(exitCode, stdout, stderr) {
+    parseTestResult(exitCode, stdout, stderr, targetFile) {
         // A retry can clear a prior failure only when the report proves a test
         // actually passed. Empty/fully skipped selections can also exit zero.
         try {
@@ -458,16 +459,26 @@ export class RetryHandlerService {
             const vitestMatch = stdout.match(/\{[\s\S]*"testResults"[\s\S]*\}/);
             if (vitestMatch) {
                 const result = safeJsonParse(vitestMatch[0]);
+                // Vitest's positional file filter uses prefix matching. A passing
+                // sibling must not clear a failure in the requested file (#972).
+                const targetPassed = !targetFile || result.testResults?.some((file) => typeof file.name === 'string'
+                    && resolvePath(file.name) === resolvePath(targetFile)
+                    && file.assertionResults?.some(assertion => assertion.status === 'passed'));
                 if (exitCode === 0 && result.success !== false
                     && result.numFailedTests === 0 && result.numFailedTestSuites === 0
-                    && Number.isFinite(result.numPassedTests) && result.numPassedTests > 0) {
+                    && Number.isFinite(result.numPassedTests) && result.numPassedTests > 0
+                    && targetPassed) {
                     return { passed: true };
                 }
                 const failedTest = result.testResults?.[0]?.assertionResults?.find((r) => r.status === 'failed');
                 return {
                     passed: false,
                     error: failedTest?.failureMessages?.join('\n') || stderr
-                        || (exitCode === 0 ? 'Retry runner did not report any passing tests.' : `Test failed with exit code ${exitCode}`),
+                        || (exitCode === 0
+                            ? targetFile && !targetPassed
+                                ? `Retry runner did not report a passing test in ${targetFile}.`
+                                : 'Retry runner did not report any passing tests.'
+                            : `Test failed with exit code ${exitCode}`),
                 };
             }
             // Jest JSON output

package/dist/domains/test-execution/services/test-executor.d.ts

@@ -104,6 +104,7 @@ export declare class TestExecutorService implements ITestExecutionService {
     private validateRequest;
     private validateParallelRequest;
     private runTests;
+    private mergeSequentialCoverage;
     private executeTestFile;
     private executeTestFiles;
     /**