agentic-qe 3.15.5 → 3.15.7

package/dist/workers/workers/security-scan-records.js

@@ -0,0 +1,128 @@
+/**
+ * Agentic QE v3 - security-scan worker: recorded scan parsing (#1043, #1049)
+ *
+ * Parses the `security:scan:<id>` records the security-compliance domain writes
+ * (OSV dependency scans and SAST scans) into what the security-scan worker
+ * reports. Nothing is filled in: a field a record does not carry stays absent.
+ */
+export const SCHEMA_VERSION = 1;
+/** The dependency scanner keeps its records for 7 days; nothing older is current. */
+export const MAX_SCAN_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+export const SEVERITIES = ['critical', 'high', 'medium', 'low', 'informational'];
+export const CVE_ID = /^CVE-\d{4}-\d{4,}$/;
+export const isCount = (v) => typeof v === 'number' && Number.isInteger(v) && v >= 0;
+export const isRecord = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+export function parseCounts(raw) {
+    if (!isRecord(raw))
+        return null;
+    const counts = {};
+    for (const s of SEVERITIES) {
+        if (!isCount(raw[s]))
+            return null;
+        counts[s] = raw[s];
+    }
+    return counts;
+}
+/** `scannedAt` when the record's timestamp is valid, not in the future and within the scanner's retention. */
+export function parseScannedAt(raw, now) {
+    if (typeof raw !== 'string')
+        return null;
+    const t = Date.parse(raw);
+    if (!Number.isFinite(t) || t > now + 60_000 || now - t > MAX_SCAN_AGE_MS)
+        return null;
+    return raw;
+}
+export function parseVulnerability(raw, kind) {
+    if (!isRecord(raw))
+        return null;
+    const severity = raw.severity;
+    if (!SEVERITIES.includes(severity) || typeof raw.title !== 'string')
+        return null;
+    const location = isRecord(raw.location) ? raw.location : {};
+    const remediation = isRecord(raw.remediation) ? raw.remediation : {};
+    const vuln = {
+        severity,
+        title: raw.title,
+        description: typeof raw.description === 'string' ? raw.description : '',
+        category: typeof raw.category === 'string' ? raw.category : 'other',
+        references: Array.isArray(raw.references) ? raw.references.filter((r) => typeof r === 'string') : [],
+    };
+    if (typeof raw.cveId === 'string' && CVE_ID.test(raw.cveId))
+        vuln.cve = raw.cveId;
+    if (kind === 'dependency') {
+        const dep = isRecord(location.dependency) && typeof location.dependency.name === 'string'
+            ? location.dependency.name
+            : typeof location.snippet === 'string' ? /^"([^"]+)":/.exec(location.snippet)?.[1] : undefined;
+        if (dep)
+            vuln.package = dep;
+        const fixed = typeof remediation.fixExample === 'string' ? /@([^@\s]+)$/.exec(remediation.fixExample)?.[1] : undefined;
+        if (fixed)
+            vuln.fixedIn = fixed;
+    }
+    else if (typeof location.file === 'string') {
+        vuln.location = typeof location.line === 'number' ? `${location.file}:${location.line}` : location.file;
+    }
+    return vuln;
+}
+export function parseUnchecked(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    return raw.filter(isRecord).map((p) => ({
+        name: typeof p.name === 'string' ? p.name : '?',
+        version: typeof p.version === 'string' ? p.version : '?',
+        reason: typeof p.reason === 'string' ? p.reason : 'unknown',
+    }));
+}
+/**
+ * #1049: a dependency scan is a measurement only when its OSV lookup checked
+ * every requested package (`measured: true` and `status: 'complete'`).
+ */
+export function dependencyCompleteness(raw) {
+    if (raw.measured === true && raw.status === 'complete')
+        return { complete: true };
+    return {
+        complete: false,
+        status: raw.status === 'incomplete' || raw.status === 'failed' ? raw.status : 'unknown',
+        ...(typeof raw.error === 'string' && raw.error ? { error: raw.error } : {}),
+        uncheckedPackages: parseUnchecked(raw.uncheckedPackages),
+        ...(isCount(raw.packagesChecked) ? { packagesChecked: raw.packagesChecked } : {}),
+    };
+}
+export const SEVERITY_LABEL = {
+    critical: 'Critical', high: 'High Severity', medium: 'Medium Severity', low: 'Low Severity', informational: 'Informational',
+};
+/** Health penalty for the real critical/high advisories of a partial dependency scan (#1049). */
+export function partialDependencyPenalty(incomplete) {
+    return incomplete ? incomplete.scan.summary.critical * 20 + incomplete.scan.summary.high * 10 : 0;
+}
+/** What a partial dependency scan did check; the dependency totals stay 'unmeasured' (#1049). */
+export function partialDependencyMetrics(incomplete) {
+    return incomplete
+        ? { dependencyVulnerabilitiesInCheckedPackages: incomplete.scan.total, dependencyPackagesUnchecked: incomplete.uncheckedPackages.length }
+        : {};
+}
+/** A recorded dependency (OSV) or SAST scan, or `null` when the record is not one. */
+export function parseRecordedScan(raw, now) {
+    if (!isRecord(raw))
+        return null;
+    const kind = raw.scanType;
+    if (kind !== 'dependency' && kind !== 'sast')
+        return null;
+    const scannedAt = parseScannedAt(raw.timestamp, now);
+    const summary = parseCounts(raw.summary);
+    if (typeof raw.scanId !== 'string' || !scannedAt || !summary)
+        return null;
+    const listed = kind === 'dependency' ? raw.vulnerabilities : raw.criticalVulnerabilities;
+    if (!Array.isArray(listed))
+        return null;
+    const vulnerabilities = listed.map((v) => parseVulnerability(v, kind));
+    if (vulnerabilities.some((v) => v === null))
+        return null;
+    const counted = SEVERITIES.reduce((sum, s) => sum + summary[s], 0);
+    const total = kind === 'sast' && isCount(raw.vulnerabilityCount) ? raw.vulnerabilityCount : counted;
+    const scan = {
+        scanId: raw.scanId, scannedAt, summary, vulnerabilities: vulnerabilities, total,
+    };
+    return kind === 'sast' ? { kind, scan } : { kind, scan, completeness: dependencyCompleteness(raw) };
+}
+//# sourceMappingURL=security-scan-records.js.map

package/dist/workers/workers/security-scan.d.ts

@@ -2,21 +2,39 @@
  * Agentic QE v3 - Security Scan Worker
  * ADR-014: Background Workers for QE Monitoring
  *
- * Performs security vulnerability scanning including:
- * - Dependency vulnerability checks
- * - Code pattern analysis for security issues
- * - Secret detection
- * - Security configuration validation
+ * Reports the security state from scans the security-compliance domain
+ * actually ran:
+ * - Dependency vulnerabilities from the OSV dependency scan
+ * - Code security issues from the SAST scan
+ *
+ * #1043: every finding comes from a recorded scan (`security:scan:<id>` in the
+ * `security-compliance` namespace, written by DependencyScanner and
+ * SASTScanner). The worker runs no scan itself — a background tick must not
+ * send the project's dependency list to an external advisory API unasked — and
+ * never emits a vulnerability or CVE id a scan did not report. Nothing
+ * recorded → nothing stored, an "unmeasured" info finding.
+ *
+ * #1049: a dependency scan counts only when its OSV lookup was complete
+ * (`measured: true`, `status: 'complete'`). The latest scan being incomplete,
+ * failed or pre-#1049 (no `status`) leaves the dependency side unmeasured —
+ * never "0 vulnerabilities" — with a finding naming the unchecked packages.
  */
 import { BaseWorker } from '../base-worker';
 import { WorkerContext, WorkerResult } from '../interfaces';
 export declare class SecurityScanWorker extends BaseWorker {
     constructor();
     protected doExecute(context: WorkerContext): Promise<WorkerResult>;
-    private runSecurityScans;
+    /** The most recent recorded dependency and SAST scans, or `null` when neither exists (#1043). */
+    private readRecordedScans;
+    /**
+     * #1049: a dependency scan whose lookup was not complete is unmeasured —
+     * never "0 vulnerabilities". Advisories OSV did return for checked packages
+     * are real and still reported, marked as coming from a partial scan.
+     */
+    private reportIncompleteDependencyScan;
     private analyzeDependencyVulnerabilities;
     private analyzeCodeSecurityIssues;
-    private reportSecretsDetected;
+    /** Score from the recorded scans' own severity counts. */
     private calculateHealthScore;
 }
 //# sourceMappingURL=security-scan.d.ts.map

package/dist/workers/workers/security-scan.js

@@ -2,13 +2,26 @@
  * Agentic QE v3 - Security Scan Worker
  * ADR-014: Background Workers for QE Monitoring
  *
- * Performs security vulnerability scanning including:
- * - Dependency vulnerability checks
- * - Code pattern analysis for security issues
- * - Secret detection
- * - Security configuration validation
+ * Reports the security state from scans the security-compliance domain
+ * actually ran:
+ * - Dependency vulnerabilities from the OSV dependency scan
+ * - Code security issues from the SAST scan
+ *
+ * #1043: every finding comes from a recorded scan (`security:scan:<id>` in the
+ * `security-compliance` namespace, written by DependencyScanner and
+ * SASTScanner). The worker runs no scan itself — a background tick must not
+ * send the project's dependency list to an external advisory API unasked — and
+ * never emits a vulnerability or CVE id a scan did not report. Nothing
+ * recorded → nothing stored, an "unmeasured" info finding.
+ *
+ * #1049: a dependency scan counts only when its OSV lookup was complete
+ * (`measured: true`, `status: 'complete'`). The latest scan being incomplete,
+ * failed or pre-#1049 (no `status`) leaves the dependency side unmeasured —
+ * never "0 vulnerabilities" — with a finding naming the unchecked packages.
  */
+import { bareSearchKey } from '../namespaced-keys.js';
 import { BaseWorker } from '../base-worker.js';
+import { SCHEMA_VERSION, SEVERITIES, SEVERITY_LABEL, parseRecordedScan, partialDependencyMetrics, partialDependencyPenalty, } from './security-scan-records.js';
 const CONFIG = {
     id: 'security-scan',
     name: 'Security Vulnerability Scanner',
@@ -21,6 +34,10 @@ const CONFIG = {
     retryCount: 3,
     retryDelayMs: 30000,
 };
+const SECURITY_NAMESPACE = 'security-compliance';
+const SCAN_KEY_PATTERN = 'security:scan:*';
+const LAST_SCAN_KEY = 'security:lastScan';
+const MAX_SCAN_RECORDS = 1000;
 export class SecurityScanWorker extends BaseWorker {
     constructor() {
         super(CONFIG);
@@ -30,124 +47,161 @@ export class SecurityScanWorker extends BaseWorker {
         context.logger.info('Starting security vulnerability scan');
         const findings = [];
         const recommendations = [];
-        // Run security scans
-        const scanResult = await this.runSecurityScans(context);
-        // Analyze dependency vulnerabilities
-        this.analyzeDependencyVulnerabilities(scanResult.dependencyVulnerabilities, findings, recommendations);
-        // Analyze code security issues
-        this.analyzeCodeSecurityIssues(scanResult.codeSecurityIssues, findings, recommendations);
-        // Check for secrets
-        if (scanResult.secretsDetected > 0) {
-            this.reportSecretsDetected(scanResult.secretsDetected, findings, recommendations);
+        const { scan, incompleteDependency } = await this.readRecordedScans(context);
+        if (incompleteDependency) {
+            this.reportIncompleteDependencyScan(incompleteDependency, findings, recommendations);
+        }
+        if (!scan) {
+            if (!incompleteDependency)
+                findings.push({
+                    type: 'security-unmeasured',
+                    severity: 'info',
+                    domain: 'security-compliance',
+                    title: 'Security Scan Unmeasured',
+                    description: 'No dependency or SAST scan has been recorded in the last 7 days, so no vulnerabilities are ' +
+                        'reported and nothing was stored. Run security_scan_comprehensive (or `aqe security`) to scan the project.',
+                });
+            context.logger.info('Security scan complete', { measured: false });
+            return this.createResult(Date.now() - startTime, {
+                itemsAnalyzed: incompleteDependency?.scan.total ?? 0,
+                issuesFound: findings.filter((f) => f.severity !== 'info').length,
+                healthScore: Math.max(0, 100 - partialDependencyPenalty(incompleteDependency)),
+                trend: 'stable',
+                domainMetrics: {
+                    dependencyScan: 'unmeasured',
+                    codeScan: 'unmeasured',
+                    dependencyVulnerabilities: 'unmeasured',
+                    codeSecurityIssues: 'unmeasured',
+                    ...partialDependencyMetrics(incompleteDependency),
+                },
+            }, findings, recommendations);
         }
-        // Store results
-        await context.memory.set('security:lastScan', scanResult);
-        await context.memory.set('security:lastScanTime', new Date().toISOString());
-        const healthScore = this.calculateHealthScore(scanResult);
-        const totalIssues = scanResult.dependencyVulnerabilities.length +
-            scanResult.codeSecurityIssues.length +
-            scanResult.secretsDetected +
-            scanResult.configurationIssues;
+        if (scan.dependency)
+            this.analyzeDependencyVulnerabilities(scan.dependency, findings, recommendations);
+        if (scan.code)
+            this.analyzeCodeSecurityIssues(scan.code, findings, recommendations);
+        await context.memory.set(LAST_SCAN_KEY, scan);
+        await context.memory.set('security:lastScanTime', scan.evaluatedAt);
+        const healthScore = Math.max(0, this.calculateHealthScore(scan) - partialDependencyPenalty(incompleteDependency));
         context.logger.info('Security scan complete', {
+            measured: true,
             healthScore,
-            totalIssues,
-            criticalIssues: scanResult.dependencyVulnerabilities.filter(v => v.severity === 'critical').length +
-                scanResult.codeSecurityIssues.filter(i => i.severity === 'critical').length,
+            dependencyScanId: scan.dependency?.scanId ?? null,
+            codeScanId: scan.code?.scanId ?? null,
         });
         return this.createResult(Date.now() - startTime, {
-            itemsAnalyzed: totalIssues,
+            itemsAnalyzed: (scan.dependency?.total ?? 0) + (scan.code?.total ?? 0),
             issuesFound: findings.length,
             healthScore,
             trend: 'stable',
             domainMetrics: {
-                dependencyVulnerabilities: scanResult.dependencyVulnerabilities.length,
-                codeSecurityIssues: scanResult.codeSecurityIssues.length,
-                secretsDetected: scanResult.secretsDetected,
-                configurationIssues: scanResult.configurationIssues,
-                scanDuration: `${scanResult.scanDurationMs}ms`,
+                dependencyScan: scan.dependency ? scan.dependency.scannedAt : 'unmeasured',
+                codeScan: scan.code ? scan.code.scannedAt : 'unmeasured',
+                dependencyVulnerabilities: scan.dependency ? scan.dependency.total : 'unmeasured',
+                codeSecurityIssues: scan.code ? scan.code.total : 'unmeasured',
+                ...partialDependencyMetrics(incompleteDependency),
             },
         }, findings, recommendations);
     }
-    async runSecurityScans(_context) {
-        // In a real implementation, this would:
-        // 1. Run npm audit or similar for dependencies
-        // 2. Run static analysis for code issues
-        // 3. Scan for secrets with tools like gitleaks
-        // 4. Check security configurations
-        return {
-            dependencyVulnerabilities: [
-                {
-                    package: 'lodash',
-                    version: '4.17.15',
-                    severity: 'high',
-                    cve: 'CVE-2021-23337',
-                    title: 'Command Injection',
-                    description: 'Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.',
-                    fixedIn: '4.17.21',
-                },
-                {
-                    package: 'minimist',
-                    version: '1.2.5',
-                    severity: 'critical',
-                    cve: 'CVE-2021-44906',
-                    title: 'Prototype Pollution',
-                    description: 'Prototype pollution vulnerability allows attackers to manipulate JavaScript object prototypes.',
-                    fixedIn: '1.2.6',
-                },
-            ],
-            codeSecurityIssues: [
-                {
-                    file: 'src/shared/http/http-client.ts',
-                    line: 45,
-                    rule: 'no-eval',
-                    severity: 'high',
-                    message: 'Avoid using eval() as it can execute arbitrary code',
-                    category: 'injection',
-                },
-                {
-                    file: 'src/kernel/memory-backend.ts',
-                    line: 122,
-                    rule: 'sql-injection',
-                    severity: 'medium',
-                    message: 'Potential SQL injection - use parameterized queries',
-                    category: 'injection',
-                },
-            ],
-            secretsDetected: 0,
-            configurationIssues: 1,
-            scanDurationMs: 2500,
-        };
-    }
-    analyzeDependencyVulnerabilities(vulnerabilities, findings, recommendations) {
-        const critical = vulnerabilities.filter(v => v.severity === 'critical');
-        const high = vulnerabilities.filter(v => v.severity === 'high');
-        for (const vuln of critical) {
-            findings.push({
-                type: 'critical-vulnerability',
-                severity: 'critical',
-                domain: 'security-compliance',
-                title: `Critical Vulnerability in ${vuln.package}`,
-                description: `${vuln.title}: ${vuln.description}`,
-                resource: vuln.package,
-                context: {
-                    cve: vuln.cve,
-                    currentVersion: vuln.version,
-                    fixedIn: vuln.fixedIn,
-                },
-            });
+    /** The most recent recorded dependency and SAST scans, or `null` when neither exists (#1043). */
+    async readRecordedScans(context) {
+        const keys = await context.memory.search(SCAN_KEY_PATTERN, MAX_SCAN_RECORDS, { namespace: SECURITY_NAMESPACE });
+        const now = Date.now();
+        let latestDependency = null;
+        let code = null;
+        const newer = (a, b) => !b || Date.parse(a.scannedAt) > Date.parse(b.scannedAt);
+        for (const found of keys) {
+            // The in-memory kernel backend returns namespaced searches as
+            // `<namespace>:<key>`; the hybrid backend returns the bare key (#1049).
+            const key = bareSearchKey(found, SECURITY_NAMESPACE, SCAN_KEY_PATTERN);
+            const parsed = parseRecordedScan(await context.memory.get(key, { namespace: SECURITY_NAMESPACE }), now);
+            if (!parsed)
+                continue;
+            if (parsed.kind === 'dependency' && newer(parsed.scan, latestDependency?.scan ?? null))
+                latestDependency = parsed;
+            if (parsed.kind === 'sast' && newer(parsed.scan, code))
+                code = parsed.scan;
         }
-        for (const vuln of high) {
+        // #1049: only the latest dependency scan counts, and only when its lookup
+        // was complete — an older complete scan must not mask a newer failure.
+        const completeness = latestDependency?.completeness;
+        const dependency = latestDependency && completeness?.complete ? latestDependency.scan : null;
+        const incompleteDependency = latestDependency && completeness && !completeness.complete
+            ? {
+                scan: latestDependency.scan,
+                status: completeness.status,
+                ...(completeness.error ? { error: completeness.error } : {}),
+                uncheckedPackages: completeness.uncheckedPackages,
+                ...(completeness.packagesChecked !== undefined ? { packagesChecked: completeness.packagesChecked } : {}),
+            }
+            : null;
+        if (!dependency && !code)
+            return { scan: null, incompleteDependency };
+        return { incompleteDependency, scan: {
+                measured: true,
+                schemaVersion: SCHEMA_VERSION,
+                evaluatedAt: new Date().toISOString(),
+                dependency: dependency ? { ...dependency, source: 'osv' } : null,
+                code: code ? { ...code, source: 'sast' } : null,
+            } };
+    }
+    /**
+     * #1049: a dependency scan whose lookup was not complete is unmeasured —
+     * never "0 vulnerabilities". Advisories OSV did return for checked packages
+     * are real and still reported, marked as coming from a partial scan.
+     */
+    reportIncompleteDependencyScan(incomplete, findings, recommendations) {
+        const { scan, status, error, uncheckedPackages, packagesChecked } = incomplete;
+        const unchecked = uncheckedPackages.map((p) => `${p.name}@${p.version} (${p.reason})`);
+        const counts = scan.summary;
+        const inChecked = scan.total > 0
+            ? ` OSV reported ${scan.total} advisory finding(s) in the ${packagesChecked ?? ''}${packagesChecked === undefined ? '' : ' '}checked package(s)` +
+                ` (${counts.critical} critical, ${counts.high} high, ${counts.medium} medium, ${counts.low} low); they are listed as separate findings.`
+            : '';
+        const why = status === 'unknown'
+            ? 'was recorded before scans stated whether every package was checked, so a failed lookup cannot be told apart from a clean one'
+            : `is ${status}${error ? ` (${error})` : ''}`;
+        findings.push({
+            type: 'dependency-scan-incomplete',
+            severity: 'info',
+            domain: 'security-compliance',
+            title: 'Dependency Scan Unmeasured',
+            description: `The latest dependency scan (${scan.scannedAt}) ${why}; its result is not a vulnerability count.` +
+                (unchecked.length > 0 ? ` Unchecked packages: ${unchecked.join(', ')}.` : '') + inChecked +
+                ' Re-run the dependency scan.',
+            context: {
+                scanId: scan.scanId, status, ...(error ? { error } : {}), uncheckedPackages,
+                ...(packagesChecked !== undefined ? { packagesChecked } : {}),
+                advisoriesInCheckedPackages: scan.total,
+            },
+        });
+        this.analyzeDependencyVulnerabilities(scan, findings, recommendations, true);
+    }
+    analyzeDependencyVulnerabilities(scan, findings, recommendations, partialScan = false) {
+        const critical = scan.vulnerabilities.filter(v => v.severity === 'critical');
+        const high = scan.vulnerabilities.filter(v => v.severity === 'high');
+        // #1049: a complete scan carries medium/low in its counts; a partial scan has
+        // no measured count, so every advisory OSV returned for a checked package is relayed.
+        const relayed = partialScan
+            ? SEVERITIES.flatMap((s) => scan.vulnerabilities.filter(v => v.severity === s))
+            : [...critical, ...high];
+        for (const vuln of relayed) {
+            const pkg = vuln.package ?? vuln.title;
             findings.push({
-                type: 'high-vulnerability',
-                severity: 'high',
+                type: `${vuln.severity}-vulnerability`,
+                severity: vuln.severity === 'informational' ? 'info' : vuln.severity,
                 domain: 'security-compliance',
-                title: `High Severity Vulnerability in ${vuln.package}`,
-                description: `${vuln.title}: ${vuln.description}`,
-                resource: vuln.package,
+                title: `${SEVERITY_LABEL[vuln.severity]} Vulnerability in ${pkg}`,
+                description: vuln.description ? `${vuln.title}: ${vuln.description}` : vuln.title,
+                resource: pkg,
                 context: {
-                    cve: vuln.cve,
-                    currentVersion: vuln.version,
-                    fixedIn: vuln.fixedIn,
+                    advisorySource: 'osv',
+                    scanId: scan.scanId,
+                    scannedAt: scan.scannedAt,
+                    ...(vuln.cve ? { cve: vuln.cve } : {}),
+                    ...(vuln.fixedIn ? { fixedIn: vuln.fixedIn } : {}),
+                    references: vuln.references,
+                    ...(partialScan ? { partialScan: true } : {}),
                 },
             });
         }
@@ -156,7 +210,7 @@ export class SecurityScanWorker extends BaseWorker {
                 priority: 'p0',
                 domain: 'security-compliance',
                 action: 'Update Critical Vulnerabilities Immediately',
-                description: `${critical.length} packages have critical vulnerabilities. Update immediately to patched versions.`,
+                description: `The dependency scan of ${scan.scannedAt} reported ${critical.length} critical vulnerabilities. Update to patched versions.`,
                 estimatedImpact: 'high',
                 effort: 'low',
                 autoFixable: true,
@@ -167,97 +221,66 @@ export class SecurityScanWorker extends BaseWorker {
                 priority: 'p1',
                 domain: 'security-compliance',
                 action: 'Address High Severity Vulnerabilities',
-                description: `${high.length} packages have high severity vulnerabilities. Plan updates within current sprint.`,
+                description: `The dependency scan of ${scan.scannedAt} reported ${high.length} high severity vulnerabilities. Plan updates within current sprint.`,
                 estimatedImpact: 'high',
                 effort: 'low',
                 autoFixable: true,
             });
         }
     }
-    analyzeCodeSecurityIssues(issues, findings, recommendations) {
-        const byCategory = new Map();
-        for (const issue of issues) {
-            const existing = byCategory.get(issue.category) || [];
-            existing.push(issue);
-            byCategory.set(issue.category, existing);
-        }
-        for (const issue of issues) {
+    analyzeCodeSecurityIssues(scan, findings, recommendations) {
+        for (const issue of scan.vulnerabilities) {
             findings.push({
                 type: `code-security-${issue.category}`,
-                severity: issue.severity,
+                severity: issue.severity === 'informational' ? 'info' : issue.severity,
                 domain: 'security-compliance',
-                title: `Security Issue: ${issue.rule}`,
-                description: issue.message,
-                resource: `${issue.file}:${issue.line}`,
+                title: `Security Issue: ${issue.title}`,
+                description: issue.description || issue.title,
+                ...(issue.location ? { resource: issue.location } : {}),
                 context: {
-                    rule: issue.rule,
                     category: issue.category,
+                    scanId: scan.scanId,
+                    scannedAt: scan.scannedAt,
+                    ...(issue.cve ? { cve: issue.cve } : {}),
                 },
             });
         }
-        // Category-specific recommendations
-        const injectionIssues = byCategory.get('injection') || [];
+        const injectionIssues = scan.vulnerabilities.filter(v => v.category === 'injection');
         if (injectionIssues.length > 0) {
             recommendations.push({
                 priority: 'p0',
                 domain: 'security-compliance',
                 action: 'Fix Injection Vulnerabilities',
-                description: `${injectionIssues.length} potential injection vulnerabilities found. Use parameterized queries and avoid eval().`,
+                description: `The SAST scan of ${scan.scannedAt} reported ${injectionIssues.length} potential injection vulnerabilities. Use parameterized queries and avoid eval().`,
                 estimatedImpact: 'high',
                 effort: 'medium',
                 autoFixable: false,
             });
         }
-        const cryptoIssues = byCategory.get('crypto') || [];
+        const cryptoIssues = scan.vulnerabilities.filter(v => v.category === 'sensitive-data');
         if (cryptoIssues.length > 0) {
             recommendations.push({
                 priority: 'p1',
                 domain: 'security-compliance',
-                action: 'Review Cryptographic Implementations',
-                description: `${cryptoIssues.length} cryptographic issues found. Ensure using secure algorithms and proper key management.`,
+                action: 'Review Sensitive Data Handling',
+                description: `The SAST scan of ${scan.scannedAt} reported ${cryptoIssues.length} sensitive-data issues. Ensure secure algorithms and key management.`,
                 estimatedImpact: 'high',
                 effort: 'high',
                 autoFixable: false,
             });
         }
     }
-    reportSecretsDetected(count, findings, recommendations) {
-        findings.push({
-            type: 'secrets-detected',
-            severity: 'critical',
-            domain: 'security-compliance',
-            title: 'Secrets Detected in Codebase',
-            description: `${count} potential secrets/credentials found in source code`,
-            context: { count },
-        });
-        recommendations.push({
-            priority: 'p0',
-            domain: 'security-compliance',
-            action: 'Remove Secrets from Codebase',
-            description: 'Immediately rotate any exposed credentials and move them to secure secret management.',
-            estimatedImpact: 'high',
-            effort: 'medium',
-            autoFixable: false,
-        });
-    }
-    calculateHealthScore(result) {
+    /** Score from the recorded scans' own severity counts. */
+    calculateHealthScore(scan) {
         let score = 100;
-        // Critical vulnerabilities: -20 each
-        const criticalVulns = result.dependencyVulnerabilities.filter(v => v.severity === 'critical').length;
-        score -= criticalVulns * 20;
-        // High vulnerabilities: -10 each
-        const highVulns = result.dependencyVulnerabilities.filter(v => v.severity === 'high').length;
-        score -= highVulns * 10;
-        // Critical code issues: -15 each
-        const criticalCode = result.codeSecurityIssues.filter(i => i.severity === 'critical').length;
-        score -= criticalCode * 15;
-        // High code issues: -8 each
-        const highCode = result.codeSecurityIssues.filter(i => i.severity === 'high').length;
-        score -= highCode * 8;
-        // Secrets: -30 each
-        score -= result.secretsDetected * 30;
-        // Config issues: -5 each
-        score -= result.configurationIssues * 5;
+        if (scan.dependency) {
+            score -= scan.dependency.summary.critical * 20;
+            score -= scan.dependency.summary.high * 10;
+        }
+        if (scan.code) {
+            score -= scan.code.summary.critical * 15;
+            score -= scan.code.summary.high * 8;
+        }
         return Math.max(0, Math.round(score));
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-qe",
-  "version": "3.15.5",
+  "version": "3.15.7",
   "description": "Agentic Quality Engineering V3 - Domain-Driven Design Architecture with 13 Bounded Contexts, O(log n) coverage analysis, ReasoningBank learning, 60 specialized QE agents, mathematical Coherence verification, deep Claude Flow integration",
   "type": "module",
   "main": "./dist/index.js",
@@ -199,7 +199,7 @@
     "typescript": "^5.9.3",
     "uuid": "^14.0.0",
     "web-tree-sitter": "~0.26.8",
-    "yaml": "^2.8.2"
+    "yaml": "^2.9.1"
   },
   "peerDependencies": {
     "@claude-flow/browser": "3.0.0-alpha.1",

package/dist/cli/chunks/adapter-EGIPTX5H.js

@@ -1,2 +0,0 @@
-import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.5");process.exit(0)}
-import{a,b,c}from"./chunk-VML4SG3X.js";import"./chunk-KJ3KBP24.js";import"./chunk-GRIPCYW5.js";import"./chunk-RUSLEOMC.js";import"./chunk-NLDFNAOS.js";import"./chunk-HLFDC4SF.js";export{a as AgentBoosterAdapter,b as createAgentBoosterAdapter,c as createAgentBoosterAdapterSync};

package/dist/cli/chunks/aqe-learning-engine-WP4GCBDT.js

@@ -1,2 +0,0 @@
-import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.5");process.exit(0)}
-import{a,b,c,d,e,f}from"./chunk-DL5JENWD.js";import"./chunk-Y2WMPEUP.js";import"./chunk-ZTC5FBL6.js";import"./chunk-4UXPDV7E.js";import"./chunk-4PT5KNXL.js";import"./chunk-4AZP7ZCW.js";import"./chunk-FNAYDITO.js";import"./chunk-A5J4XJS6.js";import"./chunk-V7GNUVYI.js";import"./chunk-OW42F2TX.js";import"./chunk-PDPEMBFV.js";import"./chunk-NMJVG22Z.js";import"./chunk-FHUJCVT3.js";import"./chunk-GGDKOJVF.js";import"./chunk-L6SVCNXK.js";import"./chunk-663ZFPUL.js";import"./chunk-EOR3RECZ.js";import"./chunk-RUJLVJDE.js";import"./chunk-RUSLEOMC.js";import"./chunk-KHCALIFP.js";import"./chunk-2XYTS2WY.js";import"./chunk-3YASZPLO.js";import"./chunk-MQGEZA2A.js";import"./chunk-OU4ZAWCC.js";import"./chunk-OQDC7GCM.js";import"./chunk-RMJ7PJOS.js";import"./chunk-EAYQCBXL.js";import"./chunk-Y2E3IJ53.js";import"./chunk-AQN5EDBM.js";import"./chunk-3AYYGR6W.js";import"./chunk-OGYWWZU7.js";import"./chunk-L336HFFE.js";import"./chunk-E4VIVMDL.js";import"./chunk-WLIYWBQR.js";import"./chunk-NLDFNAOS.js";import"./chunk-VRJPH3LG.js";import"./chunk-3QD7U3FY.js";import"./chunk-KZVJW2SD.js";import"./chunk-UE22ODHN.js";import"./chunk-N2TJNIHA.js";import"./chunk-IHFUEPZH.js";import"./chunk-U6OVPMQX.js";import"./chunk-HLFDC4SF.js";export{b as AQELearningEngine,a as DEFAULT_ENGINE_CONFIG,c as DEFAULT_META_LEARNING_CONFIG,d as MetaLearningEngine,e as createAQELearningEngine,f as createDefaultLearningEngine};