agentic-qe 3.15.6 → 3.15.7

package/dist/cli/index.js

@@ -417,6 +417,17 @@ async function main() {
     const commandArgs = process.argv.slice(2).filter(arg => arg !== '--');
     const learningSnapshot = commandArgs[0] === 'learning'
         && (commandArgs[1] === 'backup' || commandArgs[1] === 'restore');
+    // `aqe init` must not create a mistyped AQE_PROJECT_ROOT: the token bootstrap
+    // below does `mkdir -p <root>/.agentic-qe`, so the check has to run first.
+    if (commandArgs[0] === 'init') {
+        const { explicitRootError } = await import('./handlers/init-guard.js');
+        const rootError = explicitRootError();
+        if (rootError) {
+            console.error(chalk.red(`\n  ${rootError}\n`));
+            await cleanupAndExit(1);
+            return;
+        }
+    }
     if (!learningSnapshot) {
         const { bootstrapTokenTracking } = await import('../init/token-bootstrap.js');
         await bootstrapTokenTracking({

package/dist/cli/utils/ci-output.d.ts

@@ -7,6 +7,7 @@
 import type { SecurityCoverage } from '../../domains/security-compliance/interfaces.js';
 import type { SecurityScanEvidence } from '../../domains/security-compliance/scan-evidence.js';
 import type { discoverSecurityFiles } from '../../domains/security-compliance/scan-discovery.js';
+import type { DependencyScanReport } from '../../domains/security-compliance/dependency-advisory-engine.js';
 export type OutputFormat = 'text' | 'json' | 'sarif' | 'junit' | 'markdown';
 export interface CIOutputOptions {
     format: OutputFormat;
@@ -20,6 +21,8 @@ export interface SecurityVulnerability {
     message: string;
     ruleId?: string;
     cweId?: string;
+    /** CVE id of a dependency advisory, when the advisory has one (#1049). */
+    cveId?: string;
 }
 export interface SecurityScanResult {
     vulnerabilities: SecurityVulnerability[];
@@ -38,6 +41,8 @@ export interface SecurityScanResult {
     coverage?: SecurityCoverage;
     evidence?: SecurityScanEvidence;
     discovery?: Awaited<ReturnType<typeof discoverSecurityFiles>>['discovery'];
+    /** #1049: OSV dependency advisory scan; any status but 'complete' is not a clean result. */
+    dependencyScan?: DependencyScanReport;
 }
 export type SecurityExecutionStatus = 'complete' | 'partial' | 'none' | 'failed' | 'not-run' | 'unverified';
 export interface SecurityCheckResult {

package/dist/cli/utils/ci-output.js

@@ -297,6 +297,14 @@ export function securityToMarkdown(result) {
     if (result.evidence || result.discovery) {
         md += `## Execution receipts\n\n\`\`\`json\n${toJSON({ evidence: result.evidence, discovery: result.discovery })}\n\`\`\`\n\n`;
     }
+    if (result.dependencyScan) {
+        md += `## Dependency advisories (OSV)\n\n**Status:** ${result.dependencyScan.status}\n\n${result.dependencyScan.message}\n\n`;
+        for (const pkg of result.dependencyScan.uncheckedPackages) {
+            md += `- not checked: ${pkg.name}@${pkg.version} (${pkg.reason})\n`;
+        }
+        if (result.dependencyScan.uncheckedPackages.length > 0)
+            md += '\n';
+    }
     if (result.vulnerabilities.length > 0) {
         md += `## Vulnerabilities\n\n`;
         md += `| Severity | Type | File | Line | Message |\n`;

package/dist/coordination/handlers/security-handlers.js

@@ -12,6 +12,7 @@ import { toError } from '../../shared/error-utils.js';
 import { FilePath } from '../../shared/value-objects/index.js';
 import { generateSecurityRecommendations } from './handler-utils.js';
 import { discoverSecurityFiles, isSecuritySourceFile } from '../../domains/security-compliance/scan-discovery.js';
+import { runDependencyAdvisoryScan } from '../../domains/security-compliance/dependency-advisory-engine.js';
 export function registerSecurityHandlers(ctx) {
     // Register security scan handler - REAL IMPLEMENTATION
     ctx.registerHandler('scan-security', async (task) => {
@@ -257,6 +258,13 @@ export function registerSecurityHandlers(ctx) {
                     status: payload.dast ? 'not-run' : 'disabled', scope: 'url', ruleCoverage: 'unknown',
                     errors: payload.dast ? ['DAST was requested without targetUrl.'] : [], limitations: [] });
             }
+            // #1049: OSV dependency advisories. A failed or partial lookup is a
+            // failed/partial required engine, never a completed scan with no findings.
+            let dependencyScan = null;
+            if (payload.dependencies === true) {
+                dependencyScan = await runDependencyAdvisoryScan(ctx.getSecurityScanner(), targetPath);
+                engines.push(dependencyScan.engine);
+            }
             if (payload.compliance?.length) {
                 engines.push({ id: 'compliance', requested: true, required: true, status: 'not-run',
                     scope: 'requested-files', ruleCoverage: 'unknown', errors: [],
@@ -265,7 +273,7 @@ export function registerSecurityHandlers(ctx) {
             const requestedPaths = new Set(filesToScan);
             const analyzedPaths = new Set(fileEvidence.filter(file => file.status === 'analyzed' && requestedPaths.has(file.path)).map(file => file.path));
             const requiredEngines = engines.filter(engine => engine.requested && engine.required);
-            const hasExecuted = analyzedPaths.size > 0;
+            const hasExecuted = analyzedPaths.size > 0 || (dependencyScan?.report.packagesChecked ?? 0) > 0;
             const complete = hasExecuted && requiredEngines.every(engine => engine.status === 'completed') &&
                 (!discoveryResult || discoveryResult.discovery.status === 'complete');
             const evidence = {
@@ -286,18 +294,21 @@ export function registerSecurityHandlers(ctx) {
                 low: crossLangVulns.filter(v => v.severity === 'low').length,
                 informational: crossLangVulns.filter(v => v.severity === 'informational').length,
             };
+            const depVulns = dependencyScan?.vulnerabilities ?? [];
+            const depCount = (severity) => depVulns.filter(v => v.severity === severity).length;
             const summary = {
-                critical: (sastResult?.summary?.critical || 0) + (dastResult?.summary?.critical || 0) + crossLangSeverityCounts.critical,
-                high: (sastResult?.summary?.high || 0) + (dastResult?.summary?.high || 0) + crossLangSeverityCounts.high,
-                medium: (sastResult?.summary?.medium || 0) + (dastResult?.summary?.medium || 0) + crossLangSeverityCounts.medium,
-                low: (sastResult?.summary?.low || 0) + (dastResult?.summary?.low || 0) + crossLangSeverityCounts.low,
-                informational: (sastResult?.summary?.informational || 0) + (dastResult?.summary?.informational || 0) + crossLangSeverityCounts.informational,
+                critical: (sastResult?.summary?.critical || 0) + (dastResult?.summary?.critical || 0) + crossLangSeverityCounts.critical + depCount('critical'),
+                high: (sastResult?.summary?.high || 0) + (dastResult?.summary?.high || 0) + crossLangSeverityCounts.high + depCount('high'),
+                medium: (sastResult?.summary?.medium || 0) + (dastResult?.summary?.medium || 0) + crossLangSeverityCounts.medium + depCount('medium'),
+                low: (sastResult?.summary?.low || 0) + (dastResult?.summary?.low || 0) + crossLangSeverityCounts.low + depCount('low'),
+                informational: (sastResult?.summary?.informational || 0) + (dastResult?.summary?.informational || 0) + crossLangSeverityCounts.informational + depCount('informational'),
             };
             // Extract top vulnerabilities from all sources
             const allVulns = [
                 ...(sastResult?.vulnerabilities || []),
                 ...(dastResult?.vulnerabilities || []),
                 ...crossLangVulns,
+                ...depVulns,
             ];
             const topVulnerabilities = allVulns
                 .sort((a, b) => {
@@ -316,6 +327,9 @@ export function registerSecurityHandlers(ctx) {
             const recommendations = allVulns.length === 0 && evidence.completeness !== 'complete'
                 ? ['No findings reported; requested analysis is incomplete or unverified. Inspect execution receipts.']
                 : generateSecurityRecommendations(allVulns);
+            if (dependencyScan && dependencyScan.report.status !== 'complete') {
+                recommendations.unshift(dependencyScan.report.message);
+            }
             return ok({
                 vulnerabilities: allVulns.length,
                 critical: summary.critical,
@@ -329,7 +343,9 @@ export function registerSecurityHandlers(ctx) {
                 scanTypes: {
                     sast: payload.sast !== false,
                     dast: payload.dast || false,
+                    dependencies: payload.dependencies === true,
                 },
+                ...(dependencyScan ? { dependencyScan: dependencyScan.report } : {}),
                 status: evidence.completeness === 'complete' ? 'completed' : evidence.completeness === 'partial' ? 'partial' : 'unavailable',
                 evidence,
                 limitations: evidence.limitations,

package/dist/coordination/protocols/defect-investigation.js

@@ -13,6 +13,7 @@ import { toError } from '../../shared/error-utils.js';
 import { LoggerFactory } from '../../logging/index.js';
 import { addToCount } from '../../shared/utils/safe-record.js';
 import { measuredFileCoverage } from '../../domains/quality-assessment/coverage-report-event.js';
+import { fileCoverageLookupKeys } from '../../domains/coverage-analysis/collected-metrics.js';
 const logger = LoggerFactory.create('defect-investigation');
 export const DefectInvestigationEvents = {
     DefectInvestigationStarted: 'coordination.DefectInvestigationStarted',
@@ -607,7 +608,12 @@ export class DefectInvestigationProtocol {
         try {
             // Try per-file coverage (written by coverage-analyzer and test-executor)
             // #1014: only measured records; legacy unstamped estimates are ignored.
-            const coverage = measuredFileCoverage(await this.memory.get(`coverage:file:${file}`));
+            let coverage = null;
+            for (const key of fileCoverageLookupKeys(file)) {
+                coverage = measuredFileCoverage(await this.memory.get(key));
+                if (coverage)
+                    break;
+            }
             if (!coverage) {
                 return null;
             }

package/dist/coordination/protocols/security-audit.js

@@ -137,6 +137,12 @@ export class SecurityAuditProtocol {
             if (depResult.success) {
                 this.currentAudit = { ...this.currentAudit, dependencyResult: depResult.value };
                 await this.publishDependencyVulnerabilities(depResult.value.vulnerabilities);
+                // #1049: a failed or partial advisory lookup (or a result without a
+                // status, which cannot show it was complete) is not a clean dependency scan.
+                if (depResult.value.status !== 'complete') {
+                    this.recordIncompleteCheck(depResult.value.error
+                        ?? `Dependency advisories could not be checked for ${depResult.value.uncheckedPackages?.length ?? 'unknown number of'} package(s)`);
+                }
             }
             else {
                 this.recordIncompleteCheck('Dependency scan did not complete');
@@ -280,6 +286,11 @@ export class SecurityAuditProtocol {
                             vulnerabilities: scanResult.value.vulnerabilities,
                             outdatedPackages: [],
                             summary: scanResult.value.summary,
+                            status: scanResult.value.status,
+                            measured: scanResult.value.measured,
+                            packagesChecked: scanResult.value.packagesChecked,
+                            uncheckedPackages: scanResult.value.uncheckedPackages,
+                            ...(scanResult.value.error ? { error: scanResult.value.error } : {}),
                         });
                     }
                 }

package/dist/coordination/result-saver.d.ts

@@ -88,6 +88,15 @@ export declare class ResultSaver {
      * `name-1.ext`, `name-2.ext`, … instead of replacing the earlier file (#1007).
      */
     private writeNewFile;
+    /**
+     * File name for a generated test source: the sanitized name capped at
+     * MAX_GENERATED_STEM_LENGTH characters (a long source file name would
+     * otherwise exceed the filesystem's 255-byte limit once the temp-file suffix
+     * is added) plus a short hash of the source path and full name. The hash keeps
+     * `src/one/math.ts` and `src/two/math.ts` (or a truncated long name) from
+     * overwriting each other, while the same test still maps to the same file.
+     */
+    private generatedTestFilename;
     private sanitizeFilename;
     private getTestExtension;
     private createFileEntry;

package/dist/coordination/result-saver.js

@@ -7,6 +7,8 @@ import * as path from 'path';
 import { createHash, randomBytes } from 'crypto';
 import { safeJsonParse } from '../shared/safe-json.js';
 import { getProjectStorePath } from '../kernel/project-root.js';
+/** Cap on the sanitized stem of a generated test file name (see generatedTestFilename). */
+const MAX_GENERATED_STEM_LENGTH = 100;
 function securityReportExecution(data) {
     return data.evidence?.completeness === 'complete' ? 'completed'
         : data.evidence?.completeness === 'partial' ? 'partial'
@@ -174,14 +176,26 @@ export class ResultSaver {
         // Save individual test files if code is provided
         if (data.tests) {
             for (const test of data.tests) {
-                if (test.code) {
+                // The test-generation domain returns `testCode`; retain `code` for
+                // older callers of ResultSaver that already use that field.
+                const code = test.testCode ?? test.code;
+                if (code) {
                     const ext = this.getTestExtension(options.language || 'typescript', options.framework || 'vitest');
-                    const testFilename = this.sanitizeFilename(test.name) + ext;
+                    const testFilename = this.generatedTestFilename(test, ext);
                     const testPath = path.join(testDir, testFilename);
                     // Review of #1026 N7: a generated test keeps one file per test name
                     // (replaced atomically), unlike reports, so numbered copies never
                     // pile up for a test runner to collect.
-                    files.push(await this.replaceFile(testPath, test.code, 'source'));
+                    //
+                    // One unwritable source file (e.g. a name the filesystem rejects)
+                    // must not discard the manifest and report, so a per-file failure is
+                    // skipped; `files` then lists only what is actually on disk.
+                    try {
+                        files.push(await this.replaceFile(testPath, code, 'source'));
+                    }
+                    catch (error) {
+                        console.warn(`ResultSaver: could not write generated test ${testFilename}: ${error.message}`);
+                    }
                 }
             }
         }
@@ -504,7 +518,7 @@ ${data.recommendations.length === 0 ? noRecommendations : data.recommendations.m
     // ==========================================================================
     // Utilities
     // ==========================================================================
-    async ensureDirectories(taskType) {
+    async ensureDirectories(_taskType) {
         const dirs = [
             this.resultsDir,
             path.join(this.resultsDir, 'security'),
@@ -563,6 +577,22 @@ ${data.recommendations.length === 0 ? noRecommendations : data.recommendations.m
         }
         throw new Error(`ResultSaver: no free file name for ${filePath}`);
     }
+    /**
+     * File name for a generated test source: the sanitized name capped at
+     * MAX_GENERATED_STEM_LENGTH characters (a long source file name would
+     * otherwise exceed the filesystem's 255-byte limit once the temp-file suffix
+     * is added) plus a short hash of the source path and full name. The hash keeps
+     * `src/one/math.ts` and `src/two/math.ts` (or a truncated long name) from
+     * overwriting each other, while the same test still maps to the same file.
+     */
+    generatedTestFilename(test, ext) {
+        const stem = this.sanitizeFilename(test.name).slice(0, MAX_GENERATED_STEM_LENGTH) || 'test';
+        const hash = createHash('sha256')
+            .update(`${test.file ?? ''}\0${test.name}`)
+            .digest('hex')
+            .slice(0, 8);
+        return `${stem}-${hash}${ext}`;
+    }
     sanitizeFilename(name) {
         return name.replace(/[^a-zA-Z0-9_-]/g, '_').toLowerCase();
     }

package/dist/domains/coverage-analysis/collected-metrics.d.ts

@@ -14,6 +14,8 @@ import type { CoverageSummary, FileCoverage } from './interfaces';
  * (or the cwd when none is known), so one file never has two records.
  */
 export declare function fileCoverageKey(filePath: string, projectRoot?: string): string;
+/** Read the canonical key first, then a measured legacy relative key if present. */
+export declare function fileCoverageLookupKeys(filePath: string, projectRoot?: string): string[];
 export interface CollectedMetrics {
     branch: boolean;
     function: boolean;

package/dist/domains/coverage-analysis/collected-metrics.js

@@ -16,6 +16,12 @@ import * as path from 'path';
 export function fileCoverageKey(filePath, projectRoot) {
     return path.isAbsolute(filePath) ? path.normalize(filePath) : path.resolve(projectRoot ?? process.cwd(), filePath);
 }
+/** Read the canonical key first, then a measured legacy relative key if present. */
+export function fileCoverageLookupKeys(filePath, projectRoot) {
+    const canonical = `coverage:file:${fileCoverageKey(filePath, projectRoot)}`;
+    const legacy = `coverage:file:${filePath}`;
+    return canonical === legacy ? [canonical] : [canonical, legacy];
+}
 /** Which optional metrics the files carry. Line coverage is always collected. */
 export function collectedMetrics(files) {
     return {

package/dist/domains/defect-intelligence/services/defect-predictor.js

@@ -15,6 +15,7 @@ import { toError } from '../../../shared/error-utils.js';
 import { safeJsonParse } from '../../../shared/safe-json.js';
 import { getClaudeModelForTier } from '../../../shared/llm/model-registry.js';
 import { measuredCoverageSummary, measuredFileCoverage } from '../../quality-assessment/coverage-report-event.js';
+import { fileCoverageLookupKeys } from '../../coverage-analysis/collected-metrics.js';
 // LLMDefectAnalysis is imported from ../interfaces
 const DEFAULT_CONFIG = {
     defaultThreshold: 0.5,
@@ -161,7 +162,7 @@ Be specific and actionable. Focus on concrete issues, not generic advice.`,
             }
             return null;
         }
-        catch (error) {
+        catch {
             logger.warn('LLM analysis failed, using heuristics only');
             return null;
         }
@@ -498,7 +499,7 @@ Be specific and actionable. Focus on concrete issues, not generic advice.`,
                     // Count complexity indicators in code
                     const content = fileResult.value;
                     const ifCount = (content.match(/\bif\s*\(/g) || []).length;
-                    const loopCount = (content.match(/\b(for|while|do)\s*[\(\{]/g) || []).length;
+                    const loopCount = (content.match(/\b(for|while|do)\s*[{(]/g) || []).length;
                     const switchCount = (content.match(/\bswitch\s*\(/g) || []).length;
                     const catchCount = (content.match(/\bcatch\s*\(/g) || []).length;
                     const ternaryCount = (content.match(/\?[^?:]+:/g) || []).length;
@@ -592,10 +593,12 @@ Be specific and actionable. Focus on concrete issues, not generic advice.`,
         try {
             // Try per-file coverage (written by coverage-analyzer and test-executor)
             // #1014: only measured records; legacy unstamped estimates are ignored.
-            const fileCoverage = measuredFileCoverage(await this.memory.get(`coverage:file:${file}`));
-            if (fileCoverage) {
-                // Invert: low coverage = high defect risk
-                return 1 - fileCoverage.line / 100;
+            for (const key of fileCoverageLookupKeys(file)) {
+                const fileCoverage = measuredFileCoverage(await this.memory.get(key));
+                if (fileCoverage) {
+                    // Invert: low coverage = high defect risk
+                    return 1 - fileCoverage.line / 100;
+                }
             }
             // Fall back to project-wide coverage
             const summary = measuredCoverageSummary(await this.memory.get('coverage:latest'));

package/dist/domains/quality-assessment/interfaces.d.ts

@@ -56,6 +56,10 @@ export interface GateResult {
     checks: GateCheck[];
     overallScore: number;
     failedChecks: string[];
+    /** Gate service evidence state; absent for other gate implementations. */
+    evidenceStatus?: 'measured' | 'insufficient-evidence';
+    /** Configured checks whose input was missing, negative, or non-finite. */
+    unmeasured?: string[];
 }
 export interface GateCheck {
     name: string;

package/dist/domains/quality-assessment/quality-evidence.d.ts

@@ -98,7 +98,7 @@ export declare class InsufficientQualityEvidenceError extends Error {
  * Inspect every canonical metric with the same validation, collecting each
  * absent, stale, future-dated or malformed record instead of stopping at the first.
  */
-export declare function inspectQualityEvidence(memory: MemoryBackend, options?: {
+export declare function inspectQualityEvidence(memory: Pick<MemoryBackend, 'get'>, options?: {
     now?: number;
     maxAgeMs?: number;
 }): Promise<{

package/dist/domains/quality-assessment/services/quality-analyzer.js

@@ -10,6 +10,7 @@ import { toError } from '../../../shared/error-utils.js';
 import { safeJsonParse } from '../../../shared/safe-json.js';
 import { getClaudeModelForTier } from '../../../shared/llm/model-registry.js';
 import { measuredCoverageSummary, measuredFileCoverage } from '../coverage-report-event.js';
+import { fileCoverageLookupKeys } from '../../coverage-analysis/collected-metrics.js';
 /** Metrics the static analyzer produces when the caller asks for all of them. */
 const ANALYZER_METRICS = ['coverage', 'complexity', 'maintainability', 'duplication', 'testability'];
 /** Metrics computed from parsing each source file. */
@@ -157,7 +158,7 @@ Focus on:
             }
             return null;
         }
-        catch (error) {
+        catch {
             logger.warn('LLM insights generation failed:');
             return null;
         }
@@ -226,7 +227,7 @@ Focus on:
             }
             return null;
         }
-        catch (error) {
+        catch {
             logger.warn('Failed to parse LLM insights response:');
             return null;
         }
@@ -508,9 +509,10 @@ Focus on:
             // 1. Try per-file coverage stored by test executor
             // #1014: only measured records count. Legacy unstamped estimate
             // records (written by <= 3.15.4, never expiring) are ignored.
-            const fileCoverage = measuredFileCoverage(await this.memory.get(`coverage:file:${file}`));
-            if (fileCoverage) {
-                return fileCoverage.line;
+            for (const key of fileCoverageLookupKeys(file)) {
+                const fileCoverage = measuredFileCoverage(await this.memory.get(key));
+                if (fileCoverage)
+                    return fileCoverage.line;
             }
             // 2. Fall back to project-wide summary from coverage-analyzer
             const summary = measuredCoverageSummary(await this.memory.get('coverage:latest'));

package/dist/domains/quality-assessment/services/quality-gate.js

@@ -5,6 +5,7 @@
 import { v4 as uuidv4 } from 'uuid';
 import { ok, err } from '../../../shared/types/index.js';
 import { toError } from '../../../shared/error-utils.js';
+import { isMeasuredMetricValue } from '../evidence-sufficiency.js';
 const DEFAULT_CONFIG = {
     strictMode: false,
     enableWarnings: true,
@@ -80,6 +81,12 @@ export class QualityGateService {
             // Evaluate each threshold
             checks.push(...this.evaluateMinThresholds(metrics, thresholds));
             checks.push(...this.evaluateMaxThresholds(metrics, thresholds));
+            if (checks.length === 0) {
+                return err(new Error('No thresholds configured for gate evaluation'));
+            }
+            const unmeasured = checks
+                .filter((check) => !isMeasuredMetricValue(check.value))
+                .map((check) => check.name);
             // Collect failed checks
             for (const check of checks) {
                 if (!check.passed) {
@@ -89,13 +96,15 @@ export class QualityGateService {
             // Calculate overall score (0-100)
             const overallScore = this.calculateOverallScore(checks);
             // Determine pass/fail based on critical checks
-            const passed = this.determineGateStatus(checks);
+            const passed = unmeasured.length === 0 && this.determineGateStatus(checks);
             const result = {
                 gateName,
                 passed,
                 checks,
                 overallScore,
                 failedChecks,
+                evidenceStatus: unmeasured.length === 0 ? 'measured' : 'insufficient-evidence',
+                unmeasured,
             };
             // Store evaluation result in memory
             await this.storeEvaluationResult(result);
@@ -188,9 +197,9 @@ export class QualityGateService {
         return checks;
     }
     createCheck(name, value, threshold, type, severity) {
-        const passed = type === 'min'
+        const passed = isMeasuredMetricValue(value) && (type === 'min'
             ? value >= threshold
-            : value <= threshold;
+            : value <= threshold);
         return {
             name,
             passed,

package/dist/domains/security-compliance/dependency-advisory-engine.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Dependency advisory (OSV) engine for the scan-security task (#1049).
+ *
+ * Runs the security-compliance DependencyScanner on the project's package.json
+ * and turns its outcome into an execution receipt. A failed or partial OSV
+ * lookup is a failed/partial engine with the unchecked packages listed, never
+ * a completed engine with zero findings.
+ */
+import type { SecurityEngineEvidence } from './scan-evidence.js';
+import type { Vulnerability, UncheckedDependency, LocalDependency } from './interfaces.js';
+import type { DependencyScanResult } from './services/scanners/scanner-types.js';
+import type { Result } from '../../shared/types/index.js';
+export declare const DEPENDENCY_ADVISORY_ENGINE_ID = "osv-dependency-advisories";
+/** The dependency scan as reported to MCP and CLI consumers. */
+export interface DependencyScanReport {
+    status: 'complete' | 'incomplete' | 'failed' | 'not-run';
+    measured: boolean;
+    manifest?: string;
+    /** Lockfile the checked versions were resolved from, or null (exact specs only). */
+    lockfile?: string | null;
+    packagesRequested: number;
+    packagesChecked: number;
+    uncheckedPackages: UncheckedDependency[];
+    /** Local workspace / linked packages: not OSV subjects, excluded from the counts. */
+    localPackages: LocalDependency[];
+    /** Why the scan is not complete beyond individual packages (malformed lockfile, workspace root #1057). */
+    resolutionErrors: string[];
+    /** Only direct dependencies are checked; transitive dependencies are not. */
+    scope: 'direct';
+    vulnerabilities: number;
+    scanId?: string;
+    error?: string;
+    /** One plain sentence for humans; says when advisories could not be checked. */
+    message: string;
+}
+export interface DependencyAdvisoryOutcome {
+    engine: SecurityEngineEvidence;
+    vulnerabilities: Vulnerability[];
+    report: DependencyScanReport;
+}
+interface PackageJsonScanner {
+    scanPackageJson(packageJsonPath: string): Promise<Result<DependencyScanResult>>;
+}
+/** The package.json for a scan target: the target directory's, else the project root's. */
+export declare function findPackageJson(targetPath: string, env?: NodeJS.ProcessEnv): Promise<string | null>;
+/** Human message for a dependency scan outcome. */
+export declare const DEPENDENCY_SCOPE_NOTE = "direct dependencies of this package.json only; workspace members and transitive dependencies are not checked";
+export declare function dependencyScanMessage(report: Omit<DependencyScanReport, 'message'>): string;
+/** Run the OSV dependency scan for a target and describe it as an engine receipt. */
+export declare function runDependencyAdvisoryScan(scanner: PackageJsonScanner, targetPath: string): Promise<DependencyAdvisoryOutcome>;
+export {};
+//# sourceMappingURL=dependency-advisory-engine.d.ts.map

package/dist/domains/security-compliance/dependency-advisory-engine.js

@@ -0,0 +1,113 @@
+/**
+ * Dependency advisory (OSV) engine for the scan-security task (#1049).
+ *
+ * Runs the security-compliance DependencyScanner on the project's package.json
+ * and turns its outcome into an execution receipt. A failed or partial OSV
+ * lookup is a failed/partial engine with the unchecked packages listed, never
+ * a completed engine with zero findings.
+ */
+import * as fs from 'fs/promises';
+import * as path from 'path';
+export const DEPENDENCY_ADVISORY_ENGINE_ID = 'osv-dependency-advisories';
+/** The package.json for a scan target: the target directory's, else the project root's. */
+export async function findPackageJson(targetPath, env = process.env) {
+    let dir = targetPath;
+    try {
+        if (!(await fs.stat(targetPath)).isDirectory())
+            dir = path.dirname(targetPath);
+    }
+    catch {
+        dir = path.dirname(targetPath);
+    }
+    const candidates = [dir, env.AQE_PROJECT_ROOT ? path.resolve(env.AQE_PROJECT_ROOT) : null];
+    for (const candidate of candidates) {
+        if (!candidate)
+            continue;
+        const manifest = path.join(candidate, 'package.json');
+        try {
+            if ((await fs.stat(manifest)).isFile())
+                return manifest;
+        }
+        catch { /* try next */ }
+    }
+    return null;
+}
+/** Human message for a dependency scan outcome. */
+export const DEPENDENCY_SCOPE_NOTE = 'direct dependencies of this package.json only; workspace members and transitive dependencies are not checked';
+export function dependencyScanMessage(report) {
+    return `${statusMessage(report)} Scope: ${DEPENDENCY_SCOPE_NOTE}.`;
+}
+function statusMessage(report) {
+    switch (report.status) {
+        case 'complete':
+            return report.packagesRequested === 0
+                ? `No registry dependencies to check${report.localPackages.length ? ` (${report.localPackages.length} local package(s) excluded)` : ' in package.json'}; nothing to check (complete).`
+                : `Dependency advisories checked for all ${report.packagesChecked} package(s): ${report.vulnerabilities} advisory finding(s).`;
+        case 'incomplete':
+            return (report.uncheckedPackages.length > 0
+                ? `Dependency advisories could not be checked for ${report.uncheckedPackages.length} of ${report.packagesRequested} package(s); ` : '') +
+                (report.resolutionErrors.length > 0 ? `${report.resolutionErrors.slice(0, 3).join('; ')}; ` : '') +
+                `${report.vulnerabilities} finding(s) from the ${report.packagesChecked} checked package(s). Dependency scan is INCOMPLETE, not clean.`;
+        case 'failed':
+            return `${report.error ?? `Dependency advisories could not be checked for ${report.uncheckedPackages.length} package(s)`}. ` +
+                'Dependency vulnerabilities are UNMEASURED, not zero.';
+        default:
+            return report.error ?? 'Dependency advisory scan did not run.';
+    }
+}
+function notRun(reason, manifest) {
+    const base = { status: 'not-run', measured: false, ...(manifest ? { manifest } : {}),
+        packagesRequested: 0, packagesChecked: 0, uncheckedPackages: [], localPackages: [],
+        resolutionErrors: [], scope: 'direct',
+        vulnerabilities: 0, error: reason };
+    return {
+        engine: { id: DEPENDENCY_ADVISORY_ENGINE_ID, requested: true, required: true, status: 'failed', scope: 'parent-directory',
+            ...(manifest ? { target: manifest } : {}), analyzedFiles: 0, ruleCoverage: 'unknown', errors: [reason], limitations: [] },
+        vulnerabilities: [],
+        report: { ...base, message: dependencyScanMessage(base) },
+    };
+}
+/** Run the OSV dependency scan for a target and describe it as an engine receipt. */
+export async function runDependencyAdvisoryScan(scanner, targetPath) {
+    const manifest = await findPackageJson(targetPath);
+    if (!manifest)
+        return notRun('No package.json found for the dependency advisory scan.');
+    let scan;
+    try {
+        scan = await scanner.scanPackageJson(manifest);
+    }
+    catch (error) {
+        return notRun(`Dependency advisory scan failed: ${error instanceof Error ? error.message : String(error)}`, manifest);
+    }
+    if (!scan.success)
+        return notRun(`Dependency advisory scan did not run: ${scan.error.message}`, manifest);
+    const value = scan.value;
+    const unchecked = value.uncheckedPackages.map((p) => `${p.name}@${p.version}: ${p.reason}`);
+    const base = {
+        status: value.status, measured: value.measured, manifest, lockfile: value.lockfile ?? null,
+        packagesRequested: value.packagesScanned, packagesChecked: value.packagesChecked,
+        uncheckedPackages: value.uncheckedPackages, localPackages: value.localPackages ?? [],
+        resolutionErrors: value.resolutionErrors ?? [], scope: 'direct',
+        vulnerabilities: value.vulnerabilities.length,
+        scanId: value.scanId, ...(value.error ? { error: value.error } : {}),
+    };
+    return {
+        engine: {
+            id: DEPENDENCY_ADVISORY_ENGINE_ID, requested: true, required: true,
+            status: value.status === 'complete' ? 'completed' : value.status === 'incomplete' ? 'partial' : 'failed',
+            scope: 'parent-directory', target: manifest, ruleCoverage: 'unknown',
+            errors: [...(value.error ? [value.error] : []), ...(value.resolutionErrors ?? []), ...unchecked.slice(0, 20),
+                ...(unchecked.length > 20 ? [`... and ${unchecked.length - 20} more unchecked package(s)`] : [])],
+            limitations: [
+                value.lockfile
+                    ? `Direct dependencies are checked at the versions ${value.lockfile} resolves (when in sync with package.json); transitive dependencies are not checked.`
+                    : 'No lockfile: only exact versions in package.json are checked; ranges are reported unchecked. Transitive dependencies are not checked.',
+                ...((value.localPackages ?? []).length > 0
+                    ? [`${value.localPackages.length} local workspace/linked package(s) are not OSV subjects and were excluded.`] : []),
+            ],
+        },
+        vulnerabilities: value.vulnerabilities,
+        report: { ...base, message: dependencyScanMessage(base) },
+    };
+}
+//# sourceMappingURL=dependency-advisory-engine.js.map