agentic-qe 3.15.5 → 3.15.7

package/dist/shared/security/osv-lookup.d.ts

@@ -0,0 +1,124 @@
+/**
+ * Agentic QE v3 - OSV lookup outcome types and response validation (#1049)
+ *
+ * A failed or partial advisory lookup is never "no vulnerabilities". Every
+ * package the lookup could not check is listed with the reason, and the
+ * overall status says whether the result can be read as a measurement.
+ */
+import type { ParsedVulnerability } from './osv-types';
+/** A package handed to an OSV lookup. */
+export interface OSVPackageQuery {
+    name: string;
+    ecosystem: string;
+    version?: string;
+}
+/** A package whose advisories could not be checked, and why. */
+export interface OSVUncheckedPackage {
+    name: string;
+    ecosystem: string;
+    version?: string;
+    reason: string;
+}
+/**
+ * Outcome of an OSV batch lookup.
+ * - complete: every package was checked; `results` is a measurement.
+ * - incomplete: some packages were checked (their findings are real), others not.
+ * - failed: no package could be checked.
+ */
+export interface OSVBatchLookup {
+    status: 'complete' | 'incomplete' | 'failed';
+    /** Keyed `${ecosystem}:${name}`; only packages that were actually checked. */
+    results: Map<string, ParsedVulnerability[]>;
+    packagesRequested: number;
+    packagesChecked: number;
+    unchecked: OSVUncheckedPackage[];
+    /** Bounded, request-level error descriptions (no response bodies). */
+    errors: string[];
+}
+/** Thrown by the legacy list-returning methods when a lookup did not complete. */
+export declare class OSVLookupError extends Error {
+    readonly lookup?: OSVBatchLookup;
+    constructor(message: string, lookup?: OSVBatchLookup);
+    static fromLookup(lookup: OSVBatchLookup): OSVLookupError;
+}
+/**
+ * Result key for one queried package: `${ecosystem}:${name}@${version}`.
+ * Keyed by version so two versions of one package never overwrite each other.
+ */
+export declare const lookupKey: (pkg: {
+    ecosystem: string;
+    name: string;
+    version?: string;
+}) => string;
+/** At most `max` ids, then "and N more" — keeps reasons bounded. */
+export declare function boundedList(items: readonly string[], max?: number): string;
+/**
+ * The exact npm version a spec pins ("4.17.15", "=4.17.15", "v4.17.15"), or
+ * null for anything else: ranges (^ ~ < > <= >= || hyphen), wildcards, tags,
+ * and non-registry specs. A range is never reduced to a guessed version (#1049).
+ */
+export declare function exactNpmVersion(spec: string): string | null;
+/**
+ * What an npm dependency spec points at (#1049):
+ * - `local`: a workspace / linked / local-directory package. Not an OSV subject
+ *   (its own dependencies are what can carry advisories).
+ * - `remote`: git, GitHub shorthand, URL or tarball (incl. `file:*.tgz`): third-party
+ *   code with no registry version, so advisories cannot be matched.
+ * - `alias`: `npm:<real>@<range>` — the registry package `<real>`.
+ * - `registry`: an ordinary registry spec (exact version, range or tag).
+ */
+export type NpmSpecKind = {
+    kind: 'local';
+} | {
+    kind: 'remote';
+} | {
+    kind: 'alias';
+    name: string;
+    spec: string;
+} | {
+    kind: 'registry';
+    spec: string;
+};
+export declare function classifyNpmSpec(spec: string): NpmSpecKind;
+/** A spec whose source is not the npm registry (local or remote); aliases are registry packages. */
+export declare function isNonRegistrySpec(spec: string): boolean;
+/**
+ * True for a concrete version OSV can match ("4.17.15", "1.0rc1", "2.0.0-beta.1").
+ * Ranges, tags, wildcards, URLs and aliases are not: querying OSV without a
+ * concrete version returns every advisory the package ever had.
+ */
+export declare function isConcreteVersion(version: string): boolean;
+/** Longest version string considered; versions come from repo-controlled files. */
+export declare const MAX_VERSION_LENGTH = 256;
+/** One querybatch entry: the advisory ids reported for a package, or why it is unusable. */
+export type BatchEntry = {
+    ids: string[];
+} | {
+    reason: string;
+};
+/**
+ * Validate a querybatch body against the queries sent. `null` means the body as
+ * a whole is unusable (every package in the chunk is unchecked).
+ */
+export declare function parseBatchBody(body: unknown, expected: number): BatchEntry[] | null;
+/** A full OSV advisory record has a string id and an `affected` array. */
+export declare function isAdvisoryRecord(body: unknown): body is {
+    id: string;
+    affected: unknown[];
+};
+/**
+ * Whether an advisory affects `pkg@version` according to its own `affected`
+ * entries. Used to confirm querybatch matches: OSV's batch endpoint can return
+ * advisories whose ranges for the package exclude the version. An advisory is
+ * dropped only when every matching entry is positively evaluated as not
+ * affected; anything that cannot be evaluated (no matching entry, ECOSYSTEM/GIT
+ * ranges, unparseable versions) is kept.
+ */
+export declare function advisoryAffectsVersion(advisory: unknown, pkg: {
+    name: string;
+    ecosystem: string;
+    version: string;
+}): boolean;
+/** Lookup status from the counts. */
+export declare function lookupStatus(requested: number, checked: number): OSVBatchLookup['status'];
+//# sourceMappingURL=osv-lookup.d.ts.map

package/dist/shared/security/osv-lookup.js

@@ -0,0 +1,246 @@
+/**
+ * Agentic QE v3 - OSV lookup outcome types and response validation (#1049)
+ *
+ * A failed or partial advisory lookup is never "no vulnerabilities". Every
+ * package the lookup could not check is listed with the reason, and the
+ * overall status says whether the result can be read as a measurement.
+ */
+/** Thrown by the legacy list-returning methods when a lookup did not complete. */
+export class OSVLookupError extends Error {
+    lookup;
+    constructor(message, lookup) {
+        super(message);
+        this.name = 'OSVLookupError';
+        this.lookup = lookup;
+    }
+    static fromLookup(lookup) {
+        const reasons = [...new Set(lookup.unchecked.map((p) => p.reason))].slice(0, 3).join('; ');
+        return new OSVLookupError(`OSV advisories could not be checked for ${lookup.unchecked.length} of ${lookup.packagesRequested} package(s): ${reasons}`, lookup);
+    }
+}
+/**
+ * Result key for one queried package: `${ecosystem}:${name}@${version}`.
+ * Keyed by version so two versions of one package never overwrite each other.
+ */
+export const lookupKey = (pkg) => `${pkg.ecosystem}:${pkg.name}@${pkg.version ?? ''}`;
+/** At most `max` ids, then "and N more" — keeps reasons bounded. */
+export function boundedList(items, max = 5) {
+    return items.length <= max ? items.join(', ') : `${items.slice(0, max).join(', ')} and ${items.length - max} more`;
+}
+/**
+ * The exact npm version a spec pins ("4.17.15", "=4.17.15", "v4.17.15"), or
+ * null for anything else: ranges (^ ~ < > <= >= || hyphen), wildcards, tags,
+ * and non-registry specs. A range is never reduced to a guessed version (#1049).
+ */
+export function exactNpmVersion(spec) {
+    const m = /^=?v?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)$/.exec(spec.trim());
+    return m ? m[1] : null;
+}
+export function classifyNpmSpec(spec) {
+    const s = spec.trim();
+    const alias = /^npm:((?:@[^/@\s]+\/)?[^@\s]+)(?:@(.*))?$/.exec(s);
+    if (alias)
+        return { kind: 'alias', name: alias[1], spec: alias[2] ?? '' };
+    if (/^(workspace:|link:|portal:)/.test(s))
+        return { kind: 'local' };
+    if (/^file:/.test(s))
+        return /\.(tgz|tar\.gz|tar)$/i.test(s) ? { kind: 'remote' } : { kind: 'local' };
+    if (/^(\.{0,2}\/|~\/)/.test(s))
+        return /\.(tgz|tar\.gz|tar)$/i.test(s) ? { kind: 'remote' } : { kind: 'local' };
+    if (/^(patch:|exec:|git\+|git:|github:|gitlab:|bitbucket:|https?:)/.test(s))
+        return { kind: 'remote' };
+    if (/^[^\s@/:]+\/[^\s@/:]+(#.*)?$/.test(s))
+        return { kind: 'remote' }; // GitHub "user/repo" shorthand
+    return { kind: 'registry', spec: s };
+}
+/** A spec whose source is not the npm registry (local or remote); aliases are registry packages. */
+export function isNonRegistrySpec(spec) {
+    const k = classifyNpmSpec(spec).kind;
+    return k === 'local' || k === 'remote';
+}
+/**
+ * True for a concrete version OSV can match ("4.17.15", "1.0rc1", "2.0.0-beta.1").
+ * Ranges, tags, wildcards, URLs and aliases are not: querying OSV without a
+ * concrete version returns every advisory the package ever had.
+ */
+export function isConcreteVersion(version) {
+    if (version.length === 0 || version.length > MAX_VERSION_LENGTH)
+        return false;
+    if (!matchesVersionShape(version))
+        return false;
+    return !/(^|\.)[xX*](\.|$)/.test(version);
+}
+/** Longest version string considered; versions come from repo-controlled files. */
+export const MAX_VERSION_LENGTH = 256;
+const VERSION_CORE = /^\d+(?:\.\d+)*$/;
+const VERSION_TAIL = /^[0-9A-Za-z][0-9A-Za-z.+-]*$/;
+/**
+ * Linear equivalent of `^\d+(\.\d+)*([-+._]?[0-9A-Za-z][0-9A-Za-z.+-]*)?$`
+ * (whose overlapping quantifiers backtrack polynomially, CodeQL js/polynomial-redos).
+ * `_` is not in the tail class, so it can only be the separator right after the
+ * numeric core. Without `_`, any accepted split can be re-split after the first
+ * digit run (the remaining `.digits` segments fit the tail class).
+ */
+function matchesVersionShape(version) {
+    const underscore = version.indexOf('_');
+    if (underscore >= 0) {
+        return VERSION_CORE.test(version.slice(0, underscore)) && VERSION_TAIL.test(version.slice(underscore + 1));
+    }
+    let i = 0;
+    while (i < version.length && version.charCodeAt(i) >= 48 && version.charCodeAt(i) <= 57)
+        i++;
+    if (i === 0)
+        return false;
+    const rest = version.slice(i);
+    if (rest === '')
+        return true;
+    // Splitting inside a 2+ digit run makes the tail start with a digit: the rest
+    // then only has to fit the tail class ("11." = core "1" + tail "1.").
+    if (i >= 2 && VERSION_TAIL_REST.test(rest))
+        return true;
+    const sep = rest[0] === '-' || rest[0] === '+' || rest[0] === '.';
+    return VERSION_TAIL.test(sep ? rest.slice(1) : rest);
+}
+const VERSION_TAIL_REST = /^[0-9A-Za-z.+-]*$/;
+const isObject = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+/**
+ * Validate a querybatch body against the queries sent. `null` means the body as
+ * a whole is unusable (every package in the chunk is unchecked).
+ */
+export function parseBatchBody(body, expected) {
+    if (!isObject(body) || !Array.isArray(body.results) || body.results.length !== expected)
+        return null;
+    return body.results.map((entry) => {
+        if (!isObject(entry))
+            return { reason: 'malformed OSV result entry' };
+        if (typeof entry.next_page_token === 'string' && entry.next_page_token) {
+            return { reason: 'OSV advisory list was truncated (paginated) and not fully retrieved' };
+        }
+        if (entry.vulns === undefined)
+            return { ids: [] };
+        if (!Array.isArray(entry.vulns))
+            return { reason: 'malformed OSV result entry' };
+        const ids = [];
+        for (const v of entry.vulns) {
+            if (!isObject(v) || typeof v.id !== 'string' || !v.id)
+                return { reason: 'malformed OSV advisory reference' };
+            ids.push(v.id);
+        }
+        return { ids };
+    });
+}
+/** A full OSV advisory record has a string id and an `affected` array. */
+export function isAdvisoryRecord(body) {
+    return isObject(body) && typeof body.id === 'string' && Array.isArray(body.affected);
+}
+function parseSemver(version) {
+    const m = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(version.trim());
+    if (!m)
+        return null;
+    return { nums: [Number(m[1]), Number(m[2]), Number(m[3])], pre: m[4] ? m[4].split('.') : [] };
+}
+function compareSemver(a, b) {
+    for (let i = 0; i < 3; i++)
+        if (a.nums[i] !== b.nums[i])
+            return a.nums[i] < b.nums[i] ? -1 : 1;
+    if (a.pre.length === 0 || b.pre.length === 0)
+        return a.pre.length === b.pre.length ? 0 : a.pre.length === 0 ? 1 : -1;
+    for (let i = 0; i < Math.max(a.pre.length, b.pre.length); i++) {
+        const x = a.pre[i];
+        const y = b.pre[i];
+        if (x === undefined || y === undefined)
+            return x === undefined ? -1 : 1;
+        if (x === y)
+            continue;
+        const nx = /^\d+$/.test(x);
+        const ny = /^\d+$/.test(y);
+        if (nx && ny)
+            return Number(x) < Number(y) ? -1 : 1;
+        if (nx !== ny)
+            return nx ? -1 : 1;
+        return x < y ? -1 : 1;
+    }
+    return 0;
+}
+/** OSV SEMVER range evaluation; null when an event version cannot be parsed. */
+function semverRangeAffects(version, events) {
+    // `at: null` is `introduced: "0"`: before every version, prereleases included.
+    const keyed = [];
+    for (const e of events) {
+        const kind = e.introduced !== undefined ? 'introduced' : e.fixed !== undefined ? 'fixed' : e.last_affected !== undefined ? 'last_affected' : null;
+        if (!kind)
+            continue; // `limit` does not change membership for a single version
+        const raw = e[kind];
+        if (kind === 'introduced' && raw === '0') {
+            keyed.push({ at: null, kind });
+            continue;
+        }
+        const at = parseSemver(raw);
+        if (!at)
+            return null;
+        keyed.push({ at, kind });
+    }
+    // Sort by version; on a tie a fixed/last_affected closes the earlier window
+    // before an introduced at the same version opens the next one.
+    const tieRank = (kind) => (kind === 'introduced' ? 1 : 0);
+    keyed.sort((a, b) => {
+        if (!a.at || !b.at)
+            return a.at === b.at ? 0 : a.at ? 1 : -1;
+        return compareSemver(a.at, b.at) || tieRank(a.kind) - tieRank(b.kind);
+    });
+    let affected = false;
+    for (const { at, kind } of keyed) {
+        if (!at) {
+            affected = true;
+            continue;
+        }
+        const cmp = compareSemver(version, at);
+        if (kind === 'introduced' && cmp >= 0)
+            affected = true;
+        else if (kind === 'fixed' && cmp >= 0)
+            affected = false;
+        else if (kind === 'last_affected' && cmp > 0)
+            affected = false;
+    }
+    return affected;
+}
+/**
+ * Whether an advisory affects `pkg@version` according to its own `affected`
+ * entries. Used to confirm querybatch matches: OSV's batch endpoint can return
+ * advisories whose ranges for the package exclude the version. An advisory is
+ * dropped only when every matching entry is positively evaluated as not
+ * affected; anything that cannot be evaluated (no matching entry, ECOSYSTEM/GIT
+ * ranges, unparseable versions) is kept.
+ */
+export function advisoryAffectsVersion(advisory, pkg) {
+    const affected = advisory.affected;
+    if (!Array.isArray(affected))
+        return true;
+    const entries = affected.filter((a) => isObject(a) && isObject(a.package)
+        && a.package.name === pkg.name && a.package.ecosystem === pkg.ecosystem);
+    if (entries.length === 0)
+        return true;
+    const version = parseSemver(pkg.version);
+    for (const entry of entries) {
+        if (Array.isArray(entry.versions) && entry.versions.includes(pkg.version))
+            return true;
+        const ranges = Array.isArray(entry.ranges) ? entry.ranges.filter(isObject) : [];
+        if (ranges.length === 0 && !Array.isArray(entry.versions))
+            return true;
+        for (const range of ranges) {
+            if (range.type !== 'SEMVER' || !version || !Array.isArray(range.events))
+                return true;
+            const verdict = semverRangeAffects(version, range.events);
+            if (verdict !== false)
+                return true;
+        }
+    }
+    return false;
+}
+/** Lookup status from the counts. */
+export function lookupStatus(requested, checked) {
+    if (checked === requested)
+        return 'complete';
+    return checked === 0 ? 'failed' : 'incomplete';
+}
+//# sourceMappingURL=osv-lookup.js.map

package/dist/shared/security/osv-types.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Agentic QE v3 - OSV API record types
+ * API Documentation: https://google.github.io/osv.dev/api/
+ */
+/**
+ * OSV query request
+ */
+export interface OSVQueryRequest {
+    /** Package name */
+    package?: {
+        name: string;
+        ecosystem: OSVEcosystem;
+    };
+    /** Git commit hash */
+    commit?: string;
+    /**
+     * Package version to match. OSV reads it here, at the top level of the query;
+     * a `version` inside `package` is ignored (it returns every advisory ever).
+     */
+    version?: string;
+}
+/**
+ * Supported ecosystems
+ */
+export type OSVEcosystem = 'npm' | 'PyPI' | 'Go' | 'Maven' | 'crates.io' | 'NuGet' | 'Packagist' | 'RubyGems' | 'Hex' | 'Pub';
+/**
+ * OSV vulnerability record
+ */
+export interface OSVVulnerability {
+    id: string;
+    summary: string;
+    details?: string;
+    aliases?: string[];
+    modified: string;
+    published?: string;
+    withdrawn?: string;
+    severity?: OSVSeverity[];
+    affected: OSVAffected[];
+    references?: OSVReference[];
+    database_specific?: Record<string, unknown>;
+}
+/**
+ * OSV severity rating
+ */
+export interface OSVSeverity {
+    type: 'CVSS_V2' | 'CVSS_V3';
+    score: string;
+}
+/**
+ * OSV affected package information
+ */
+export interface OSVAffected {
+    package: {
+        name: string;
+        ecosystem: string;
+        purl?: string;
+    };
+    ranges?: OSVRange[];
+    versions?: string[];
+    ecosystem_specific?: Record<string, unknown>;
+    database_specific?: Record<string, unknown>;
+}
+/**
+ * OSV version range
+ */
+export interface OSVRange {
+    type: 'SEMVER' | 'ECOSYSTEM' | 'GIT';
+    repo?: string;
+    events: Array<{
+        introduced?: string;
+        fixed?: string;
+        last_affected?: string;
+        limit?: string;
+    }>;
+}
+/**
+ * OSV reference link
+ */
+export interface OSVReference {
+    type: 'ADVISORY' | 'ARTICLE' | 'DETECTION' | 'DISCUSSION' | 'REPORT' | 'FIX' | 'GIT' | 'PACKAGE' | 'EVIDENCE' | 'WEB';
+    url: string;
+}
+/**
+ * OSV query response
+ */
+export interface OSVQueryResponse {
+    vulns: OSVVulnerability[];
+}
+/**
+ * OSV batch query request
+ */
+export interface OSVBatchQueryRequest {
+    queries: OSVQueryRequest[];
+}
+/**
+ * OSV batch query response
+ */
+export interface OSVBatchQueryResponse {
+    results: Array<{
+        vulns?: OSVVulnerability[];
+    }>;
+}
+/**
+ * Parsed vulnerability for easier consumption
+ */
+export interface ParsedVulnerability {
+    id: string;
+    cveIds: string[];
+    summary: string;
+    details: string;
+    severity: 'critical' | 'high' | 'medium' | 'low' | 'unknown';
+    cvssScore: number | null;
+    affectedPackage: string;
+    affectedVersions: string[];
+    fixedVersions: string[];
+    publishedDate: Date | null;
+    references: string[];
+}
+//# sourceMappingURL=osv-types.d.ts.map

package/dist/shared/security/osv-types.js

@@ -0,0 +1,6 @@
+/**
+ * Agentic QE v3 - OSV API record types
+ * API Documentation: https://google.github.io/osv.dev/api/
+ */
+export {};
+//# sourceMappingURL=osv-types.js.map

package/dist/workers/interfaces.d.ts

@@ -152,10 +152,23 @@ export interface WorkerEvent {
     readonly timestamp: Date;
     readonly payload: unknown;
 }
+/** Read options; `namespace` reads another domain's records (e.g. quality evidence). */
+export interface WorkerMemoryReadOptions {
+    namespace?: string;
+}
 export interface WorkerMemory {
-    get<T>(key: string): Promise<T | undefined>;
+    /**
+     * Read a key. Without `namespace` the worker's own namespace is used; a
+     * backend without namespaces ignores it.
+     */
+    get<T>(key: string, options?: WorkerMemoryReadOptions): Promise<T | undefined>;
     set<T>(key: string, value: T): Promise<void>;
-    search(pattern: string): Promise<string[]>;
+    /**
+     * Keys matching a glob pattern. Like `get`, `options.namespace` searches
+     * another domain's records (e.g. recorded security scans, #1043); a backend
+     * without namespaces returns nothing for one.
+     */
+    search(pattern: string, limit?: number, options?: WorkerMemoryReadOptions): Promise<string[]>;
 }
 export interface WorkerLogger {
     debug(message: string, meta?: Record<string, unknown>): void;

package/dist/workers/namespaced-keys.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Agentic QE v3 - namespaced search keys (#1049)
+ *
+ * Kernel memory backends disagree on what a namespaced `search` returns: the
+ * hybrid (sqlite) backend returns bare keys, the in-memory backend returns
+ * `<namespace>:<key>`. A worker that passes a search result straight back to
+ * `get(key, { namespace })` then double-prefixes the key and reads nothing.
+ */
+/**
+ * The bare key for a key returned by `search(pattern, limit, { namespace })`.
+ * A result that already matches `pattern` is bare (keys may legitimately start
+ * with the namespace name, e.g. `defect-intelligence:predictor:…`); otherwise a
+ * leading `<namespace>:` is the backend's prefix and is removed.
+ */
+export declare function bareSearchKey(found: string, namespace: string, pattern: string): string;
+//# sourceMappingURL=namespaced-keys.d.ts.map

package/dist/workers/namespaced-keys.js

@@ -0,0 +1,24 @@
+/**
+ * Agentic QE v3 - namespaced search keys (#1049)
+ *
+ * Kernel memory backends disagree on what a namespaced `search` returns: the
+ * hybrid (sqlite) backend returns bare keys, the in-memory backend returns
+ * `<namespace>:<key>`. A worker that passes a search result straight back to
+ * `get(key, { namespace })` then double-prefixes the key and reads nothing.
+ */
+function globToRegExp(pattern) {
+    const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+    return new RegExp(`^${escaped.replace(/\*/g, '.*').replace(/\?/g, '.')}$`, 's');
+}
+/**
+ * The bare key for a key returned by `search(pattern, limit, { namespace })`.
+ * A result that already matches `pattern` is bare (keys may legitimately start
+ * with the namespace name, e.g. `defect-intelligence:predictor:…`); otherwise a
+ * leading `<namespace>:` is the backend's prefix and is removed.
+ */
+export function bareSearchKey(found, namespace, pattern) {
+    if (globToRegExp(pattern).test(found))
+        return found;
+    return found.startsWith(`${namespace}:`) ? found.slice(namespace.length + 1) : found;
+}
+//# sourceMappingURL=namespaced-keys.js.map

package/dist/workers/quality-daemon/coverage-delta.d.ts

@@ -17,9 +17,10 @@ export interface CoverageSnapshot {
 }
 export interface CoverageMetrics {
     readonly line: number;
-    readonly branch: number;
-    readonly function: number;
-    readonly statement: number;
+    /** `null` = not collected in that snapshot (#1027 B2) — never a fake 0. */
+    readonly branch: number | null;
+    readonly function: number | null;
+    readonly statement: number | null;
 }
 export interface FileCoverage {
     readonly line: number;

package/dist/workers/quality-daemon/coverage-delta.js

@@ -8,6 +8,11 @@
  *
  * Enqueues test suggestion tasks when gaps exceed threshold.
  */
+import { measuredCoverageSummary } from '../../domains/quality-assessment/coverage-report-event.js';
+/** Delta of a metric; 0 when either side did not collect it (#1027 B2). */
+function metricDelta(now, before) {
+    return now === null || before === null ? 0 : now - before;
+}
 const DEFAULTS = {
     regressionThreshold: 2,
     gapThreshold: 60,
@@ -39,12 +44,12 @@ export class CoverageDeltaAnalyzer {
         const previous = previousRaw;
         const overallDelta = {
             line: current.overall.line - previous.overall.line,
-            branch: current.overall.branch - previous.overall.branch,
-            function: current.overall.function - previous.overall.function,
-            statement: current.overall.statement - previous.overall.statement,
+            branch: metricDelta(current.overall.branch, previous.overall.branch ?? null),
+            function: metricDelta(current.overall.function, previous.overall.function ?? null),
+            statement: metricDelta(current.overall.statement, previous.overall.statement ?? null),
         };
         const regressionDetected = overallDelta.line < -this.options.regressionThreshold ||
-            overallDelta.branch < -this.options.regressionThreshold;
+            (overallDelta.branch ?? 0) < -this.options.regressionThreshold;
         // Compute per-file deltas
         const filesToCheck = changedFiles ?? Object.keys(current.files);
         const affectedFiles = [];
@@ -90,7 +95,9 @@ export class CoverageDeltaAnalyzer {
      * Build a CoverageSnapshot from raw lcov/istanbul data stored in memory.
      */
     async buildSnapshot(memory) {
-        const latest = await memory.get('coverage:latest');
+        const raw = await memory.get('coverage:latest');
+        // #1014: only a measured record is a snapshot; legacy/estimated records are not.
+        const latest = measuredCoverageSummary(raw);
         if (!latest)
             return undefined;
         return {
@@ -101,7 +108,7 @@ export class CoverageDeltaAnalyzer {
                 function: latest.function,
                 statement: latest.statement,
             },
-            files: latest.files ?? {},
+            files: raw && typeof raw.files === 'object' ? raw.files : {},
         };
     }
     // ============================================================================

package/dist/workers/quality-daemon/index.js

@@ -306,11 +306,12 @@ export class QualityDaemon {
             try {
                 const snapshot = await this.coverageDelta.buildSnapshot(memory);
                 if (snapshot) {
-                    this._coverageHealth = Math.round((snapshot.overall.line +
-                        snapshot.overall.branch +
-                        snapshot.overall.function +
-                        snapshot.overall.statement) /
-                        4);
+                    // #1027 B2: average the metrics that were collected; an uncollected
+                    // one (null) is left out rather than dragging health down as 0.
+                    const collected = [snapshot.overall.line, snapshot.overall.branch,
+                        snapshot.overall.function, snapshot.overall.statement]
+                        .filter((v) => typeof v === 'number');
+                    this._coverageHealth = Math.round(collected.reduce((a, v) => a + v, 0) / collected.length);
                     this._lastCoverageCheck = now;
                 }
             }

package/dist/workers/quality-daemon/notification-service.js

@@ -8,9 +8,9 @@
  * Notification types: gate_failure, coverage_drop, flaky_detected, suggestion_available
  */
 import { writeFileSync, mkdirSync, readdirSync, readFileSync, unlinkSync } from 'fs';
-import { join, resolve } from 'path';
+import { join } from 'path';
+import { getProjectStorePath } from '../../kernel/project-root.js';
 const DEFAULTS = {
-    notificationsDir: resolve(process.cwd(), '.agentic-qe', 'notifications'),
     maxNotifications: 200,
 };
 export class NotificationService {
@@ -20,7 +20,7 @@ export class NotificationService {
     urlValidator;
     _sentCount = 0;
     constructor(options) {
-        this.notificationsDir = options?.notificationsDir ?? DEFAULTS.notificationsDir;
+        this.notificationsDir = options?.notificationsDir ?? getProjectStorePath('notifications');
         this.maxNotifications = options?.maxNotifications ?? DEFAULTS.maxNotifications;
         this.webhookUrl = options?.webhookUrl;
         this.urlValidator = options?.urlValidator;