agentic-qe 3.15.6 → 3.15.7

package/dist/domains/security-compliance/services/scanners/dependency-scanner.js

@@ -5,8 +5,9 @@
 import { v4 as uuidv4 } from 'uuid';
 import { ok, err } from '../../../../shared/types/index.js';
 import { OSVClient } from '../../../../shared/security/index.js';
+import { lookupKey } from '../../../../shared/security/osv-lookup.js';
 import { toError } from '../../../../shared/error-utils.js';
-import { safeJsonParse } from '../../../../shared/safe-json.js';
+import { resolveDependencies, resolveFromRecord } from './dependency-resolver.js';
 // ============================================================================
 // Dependency Scanner Service
 // ============================================================================
@@ -19,71 +20,48 @@ export class DependencyScanner {
     memory;
     osvClient;
     activeScans;
-    constructor(config, memory, activeScans) {
+    constructor(config, memory, activeScans, osvClient) {
         this.config = config;
         this.memory = memory;
-        this.osvClient = new OSVClient({ enableCache: true });
+        this.osvClient = osvClient ?? new OSVClient({ enableCache: true });
         this.activeScans = activeScans || new Map();
     }
     // ==========================================================================
     // Public Methods
     // ==========================================================================
     /**
-     * Scan npm dependencies for known vulnerabilities using OSV API
+     * Scan npm dependencies (`name -> spec`) for known vulnerabilities using OSV.
+     *
+     * #1049: a failed or partial advisory lookup is recorded and returned as
+     * `status: 'failed' | 'incomplete'`, `measured: false`, with the unchecked
+     * dependencies and the error, never as a clean scan. Findings for the
+     * dependencies that were checked are kept.
+     *
+     * Each dependency is checked at `lockedVersions[name]` when given and
+     * consistent with the spec, else only when its spec is an exact version; a
+     * range with no resolution is reported unchecked, never guessed.
      */
-    async scanDependencies(dependencies) {
-        const scanId = uuidv4();
-        const startTime = Date.now();
-        try {
-            if (Object.keys(dependencies).length === 0) {
-                return err(new Error('No dependencies provided for scanning'));
-            }
-            this.activeScans.set(scanId, 'running');
-            // Query OSV for vulnerabilities
-            const osvVulns = await this.osvClient.scanNpmDependencies(dependencies);
-            // Convert OSV vulnerabilities to our format
-            const vulnerabilities = this.convertOSVVulnerabilities(osvVulns);
-            const scanDurationMs = Date.now() - startTime;
-            // Calculate unique vulnerable packages
-            const vulnerablePackageNames = new Set(osvVulns.map((v) => v.affectedPackage));
-            // Calculate summary
-            const summary = this.calculateSummary(vulnerabilities, Object.keys(dependencies).length, scanDurationMs);
-            // Store scan results
-            await this.storeScanResults(scanId, 'dependency', vulnerabilities, summary);
-            this.activeScans.set(scanId, 'completed');
-            return ok({
-                scanId,
-                vulnerabilities,
-                packagesScanned: Object.keys(dependencies).length,
-                vulnerablePackages: vulnerablePackageNames.size,
-                summary,
-                scanDurationMs,
-            });
-        }
-        catch (error) {
-            this.activeScans.set(scanId, 'failed');
-            return err(toError(error));
+    async scanDependencies(dependencies, lockedVersions = {}) {
+        if (Object.keys(dependencies).length === 0) {
+            return err(new Error('No dependencies provided for scanning'));
         }
+        return this.runScan({
+            dependencies: resolveFromRecord(dependencies, lockedVersions), lockfile: null, errors: [],
+        });
     }
     /**
-     * Scan a package.json file for dependency vulnerabilities
+     * Scan a package.json: its direct dependencies, at the versions the lockfile
+     * resolves. A manifest with no dependencies is a complete scan of nothing; a
+     * workspace root is never complete, since its members are not scanned (#1057).
      */
     async scanPackageJson(packageJsonPath) {
         try {
-            const fs = await import('fs/promises');
-            const content = await fs.readFile(packageJsonPath, 'utf-8');
-            const packageJson = safeJsonParse(content);
-            // Combine all dependency types
-            const allDependencies = {
-                ...(packageJson.dependencies || {}),
-                ...(packageJson.devDependencies || {}),
-                ...(packageJson.peerDependencies || {}),
-                ...(packageJson.optionalDependencies || {}),
-            };
-            if (Object.keys(allDependencies).length === 0) {
-                return err(new Error('No dependencies found in package.json'));
-            }
-            return this.scanDependencies(allDependencies);
+            const resolution = await resolveDependencies(packageJsonPath);
+            return this.runScan({
+                dependencies: resolution.dependencies,
+                lockfile: resolution.lockfile,
+                errors: [...(resolution.error ? [resolution.error] : []), ...resolution.memberErrors],
+            });
         }
         catch (error) {
             if (error instanceof SyntaxError) {
@@ -101,23 +79,104 @@ export class DependencyScanner {
     // ==========================================================================
     // Private Methods
     // ==========================================================================
+    async runScan(plan) {
+        const scanId = uuidv4();
+        const startTime = Date.now();
+        try {
+            this.activeScans.set(scanId, 'running');
+            const toCheck = plan.dependencies.filter((d) => d.kind === 'check');
+            const queries = [...new Map(toCheck.map((d) => {
+                    const q = { name: d.packageName, ecosystem: 'npm', version: d.version };
+                    return [lookupKey(q), q];
+                })).values()];
+            const lookup = await this.osvClient.lookupBatch(queries);
+            const failedQueries = new Map(lookup.unchecked.map((u) => [lookupKey(u), u.reason]));
+            const vulnerabilities = [];
+            const uncheckedPackages = [];
+            const localPackages = [];
+            const vulnerablePackages = new Set();
+            let packagesChecked = 0;
+            const memberField = (d) => (d.member ? { member: d.member } : {});
+            for (const dep of plan.dependencies) {
+                if (dep.kind === 'local') {
+                    localPackages.push({ name: dep.name, spec: dep.spec, reason: dep.reason ?? 'local package', ...memberField(dep) });
+                    continue;
+                }
+                if (dep.kind === 'unchecked') {
+                    uncheckedPackages.push({ name: dep.name, version: dep.spec, reason: dep.reason ?? 'not checked', ...memberField(dep),
+                        ...(dep.lockedVersion ? { lockedVersion: dep.lockedVersion } : {}) });
+                    continue;
+                }
+                const key = lookupKey({ name: dep.packageName, ecosystem: 'npm', version: dep.version });
+                const found = lookup.results.get(key);
+                if (!found) {
+                    uncheckedPackages.push({ name: dep.name, version: dep.spec, reason: failedQueries.get(key) ?? 'advisory lookup did not return a result',
+                        ...memberField(dep), ...(dep.lockedVersion ? { lockedVersion: dep.lockedVersion } : {}) });
+                    continue;
+                }
+                packagesChecked++;
+                if (found.length > 0)
+                    vulnerablePackages.add(dep.packageName);
+                vulnerabilities.push(...this.convertOSVVulnerabilities(found, dep));
+            }
+            const requested = packagesChecked + uncheckedPackages.length;
+            // #1049 round 4: a planning error (malformed lockfile, a workspace root whose
+            // members are not scanned #1057) means something was not checked.
+            const allChecked = packagesChecked === requested && plan.errors.length === 0;
+            // `failed` = something was to be checked and nothing could be; nothing to check
+            // with a planning error (e.g. a workspace root with no own dependencies) is incomplete.
+            const status = allChecked ? 'complete'
+                : packagesChecked === 0 && requested > 0 ? 'failed' : 'incomplete';
+            const scanDurationMs = Date.now() - startTime;
+            const summary = this.calculateSummary(vulnerabilities, requested, scanDurationMs);
+            const error = status === 'complete' ? undefined
+                : describeLookupFailure([...plan.errors, ...lookup.errors], uncheckedPackages);
+            const result = {
+                scanId,
+                vulnerabilities,
+                packagesScanned: requested,
+                vulnerablePackages: vulnerablePackages.size,
+                summary,
+                scanDurationMs,
+                status,
+                measured: status === 'complete',
+                packagesChecked,
+                uncheckedPackages,
+                lockfile: plan.lockfile,
+                localPackages,
+                resolutionErrors: plan.errors,
+                scope: 'direct',
+                ...(error ? { error } : {}),
+            };
+            await this.storeScanResults(result);
+            this.activeScans.set(scanId, status === 'complete' ? 'completed' : 'failed');
+            return ok(result);
+        }
+        catch (error) {
+            this.activeScans.set(scanId, 'failed');
+            return err(toError(error));
+        }
+    }
     /**
-     * Convert OSV vulnerabilities to our internal format
+     * Convert OSV vulnerabilities of one checked dependency to our internal format
      */
-    convertOSVVulnerabilities(osvVulns) {
+    convertOSVVulnerabilities(osvVulns, dep) {
+        const pkg = dep.packageName;
+        const label = pkg === dep.name ? pkg : `${dep.name} (${pkg})`;
         return osvVulns.map((osv) => {
             const location = {
-                file: 'package.json',
+                file: dep.member ? `${dep.member}/package.json` : 'package.json',
                 line: 1,
                 column: 1,
-                snippet: `"${osv.affectedPackage}": "..."`,
+                snippet: `"${dep.name}": "${dep.spec}"`,
+                dependency: { name: pkg, version: dep.version, ecosystem: 'npm' },
             };
             const remediation = {
                 description: osv.fixedVersions.length > 0
                     ? `Update to version ${osv.fixedVersions[0]} or later`
                     : 'No fixed version available; consider alternative packages',
                 fixExample: osv.fixedVersions.length > 0
-                    ? `npm install ${osv.affectedPackage}@${osv.fixedVersions[0]}`
+                    ? `npm install ${pkg}@${osv.fixedVersions[0]}`
                     : undefined,
                 estimatedEffort: 'minor',
                 automatable: true,
@@ -125,7 +184,7 @@ export class DependencyScanner {
             return {
                 id: uuidv4(),
                 cveId: osv.cveIds[0],
-                title: `${osv.affectedPackage}: ${osv.summary.substring(0, 80)}`,
+                title: `${label}: ${osv.summary.substring(0, 80)}`,
                 description: osv.details || osv.summary,
                 severity: this.mapOSVSeverity(osv.severity),
                 category: 'vulnerable-components',
@@ -167,16 +226,35 @@ export class DependencyScanner {
         return summary;
     }
     /**
-     * Store scan results
+     * Store the scan record read by the security-scan worker (#1043/#1049).
+     * Consumers must treat it as a measurement only when
+     * `measured === true && status === 'complete'`.
      */
-    async storeScanResults(scanId, scanType, vulnerabilities, summary) {
-        await this.memory.set(`security:scan:${scanId}`, {
-            scanId,
-            scanType,
-            vulnerabilities,
-            summary,
+    async storeScanResults(result) {
+        await this.memory.set(`security:scan:${result.scanId}`, {
+            scanId: result.scanId,
+            scanType: 'dependency',
+            advisorySource: 'osv',
+            status: result.status,
+            measured: result.measured,
+            scope: result.scope ?? 'direct',
+            packagesRequested: result.packagesScanned,
+            packagesChecked: result.packagesChecked,
+            uncheckedPackages: result.uncheckedPackages,
+            localPackages: result.localPackages ?? [],
+            resolutionErrors: result.resolutionErrors ?? [],
+            lockfile: result.lockfile ?? null,
+            ...(result.error ? { error: result.error } : {}),
+            vulnerabilities: result.vulnerabilities,
+            summary: result.summary,
             timestamp: new Date().toISOString(),
         }, { namespace: 'security-compliance', ttl: 86400 * 7 });
     }
 }
+/** One bounded sentence naming why the advisory lookup is incomplete. */
+function describeLookupFailure(errors, unchecked) {
+    const reasons = errors.length > 0 ? errors : [...new Set(unchecked.map((p) => p.reason))];
+    const what = unchecked.length > 0 ? `${unchecked.length} package(s)` : 'some dependencies';
+    return `Dependency advisories could not be checked for ${what}: ${reasons.slice(0, 3).join('; ')}`;
+}
 //# sourceMappingURL=dependency-scanner.js.map

package/dist/domains/security-compliance/services/scanners/lockfile-versions.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Agentic QE v3 - Lockfile index (#1049)
+ *
+ * A package.json spec is usually a range; advisories can only be matched
+ * against the version actually installed, which the lockfile records. These
+ * readers turn a lockfile into a per-importer view (the root is importer '',
+ * workspace members are their relative path, e.g. 'packages/a'):
+ *
+ * - recordedSpec: the spec the lockfile was generated for (npm v2/v3 and pnpm
+ *   record it; used to detect a lockfile out of sync with package.json);
+ * - resolve: the installed version, whether it is a local/linked package, and
+ *   the real package name behind an `npm:` alias.
+ *
+ * Supported: npm-shrinkwrap.json, package-lock.json (v1-v3), pnpm-lock.yaml
+ * (v5-v9, importers or single-project), yarn.lock (classic and berry).
+ */
+export declare const LOCKFILES: readonly ["npm-shrinkwrap.json", "package-lock.json", "pnpm-lock.yaml", "yarn.lock"];
+export type LockfileName = typeof LOCKFILES[number];
+/** What the lockfile installed for one dependency of one importer. */
+export interface LockedEntry {
+    /** Installed version (absent for a local/linked package). */
+    version?: string;
+    /** A workspace / linked / local-directory package. */
+    local?: boolean;
+    /** The registry package behind an alias (`npm:<real>@…`), when it differs from the dependency name. */
+    realName?: string;
+}
+export interface LockIndex {
+    readonly file: LockfileName;
+    /** Workspace member importers the lockfile knows (relative paths, '' excluded). */
+    members(): string[];
+    /**
+     * The spec the lockfile records for `name` in `importer`: a string, `undefined`
+     * when the importer does not list it, or `null` when this format records no specs.
+     */
+    recordedSpec(importer: string, name: string): string | undefined | null;
+    resolve(importer: string, name: string, spec: string): LockedEntry | undefined;
+    /** Whether the lockfile knows this importer (the root '' always). */
+    hasImporter(importer: string): boolean;
+}
+/** Parse a lockfile's text; throws on malformed content. */
+export declare function parseLockfile(file: LockfileName, raw: string): LockIndex;
+//# sourceMappingURL=lockfile-versions.d.ts.map

package/dist/domains/security-compliance/services/scanners/lockfile-versions.js

@@ -0,0 +1,248 @@
+/**
+ * Agentic QE v3 - Lockfile index (#1049)
+ *
+ * A package.json spec is usually a range; advisories can only be matched
+ * against the version actually installed, which the lockfile records. These
+ * readers turn a lockfile into a per-importer view (the root is importer '',
+ * workspace members are their relative path, e.g. 'packages/a'):
+ *
+ * - recordedSpec: the spec the lockfile was generated for (npm v2/v3 and pnpm
+ *   record it; used to detect a lockfile out of sync with package.json);
+ * - resolve: the installed version, whether it is a local/linked package, and
+ *   the real package name behind an `npm:` alias.
+ *
+ * Supported: npm-shrinkwrap.json, package-lock.json (v1-v3), pnpm-lock.yaml
+ * (v5-v9, importers or single-project), yarn.lock (classic and berry).
+ */
+import { safeJsonParse } from '../../../../shared/safe-json.js';
+export const LOCKFILES = ['npm-shrinkwrap.json', 'package-lock.json', 'pnpm-lock.yaml', 'yarn.lock'];
+const DEP_FIELDS = ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies'];
+/** Parse a lockfile's text; throws on malformed content. */
+export function parseLockfile(file, raw) {
+    const text = raw.replace(/^\uFEFF/, ''); // a leading BOM is not "malformed"
+    // #1049 round 4: content that is not a lockfile of this format is an error,
+    // never an empty lockfile (which would read as "nothing locked").
+    if (file === 'pnpm-lock.yaml') {
+        if (!/^lockfileVersion:/m.test(text))
+            throw new Error('not a pnpm lockfile (no lockfileVersion)');
+        return pnpmIndex(text);
+    }
+    if (file === 'yarn.lock') {
+        if (!/^# yarn lockfile v1\b|^__metadata:/m.test(text))
+            throw new Error('not a yarn lockfile (no "# yarn lockfile v1" or __metadata header)');
+        return yarnIndex(text);
+    }
+    return npmIndex(file, text);
+}
+function npmIndex(file, text) {
+    const lock = safeJsonParse(text);
+    if (!lock || typeof lock !== 'object' || Array.isArray(lock))
+        throw new Error('not a JSON object');
+    if (typeof lock.lockfileVersion !== 'number') {
+        throw new Error('not an npm lockfile (no numeric lockfileVersion)');
+    }
+    const packages = lock.packages;
+    const prefix = (importer) => (importer ? `${importer}/` : '');
+    return {
+        file,
+        members: () => packages ? Object.keys(packages).filter((k) => k !== '' && !k.includes('node_modules/')) : [],
+        hasImporter: (importer) => importer === '' || !!packages?.[importer],
+        recordedSpec(importer, name) {
+            if (!packages)
+                return null; // v1 records no specs
+            const pkg = packages[importer];
+            if (!pkg)
+                return undefined;
+            for (const field of DEP_FIELDS) {
+                const v = pkg[field]?.[name];
+                if (typeof v === 'string')
+                    return v;
+            }
+            return undefined;
+        },
+        resolve(importer, name) {
+            if (!packages) {
+                const v = lock.dependencies?.[name]?.version;
+                if (typeof v !== 'string')
+                    return undefined;
+                const alias = /^npm:((?:@[^/@]+\/)?[^@]+)@(.+)$/.exec(v);
+                return alias ? { version: alias[2], realName: alias[1] } : { version: v };
+            }
+            const entry = packages[`${prefix(importer)}node_modules/${name}`] ?? packages[`node_modules/${name}`];
+            if (!entry)
+                return undefined;
+            if (entry.link === true)
+                return { local: true };
+            const realName = typeof entry.name === 'string' && entry.name !== name ? entry.name : undefined;
+            return typeof entry.version === 'string' ? { version: entry.version, ...(realName ? { realName } : {}) } : undefined;
+        },
+    };
+}
+// ============================================================================
+// pnpm (pnpm-lock.yaml)
+// ============================================================================
+const unquote = (s) => s.trim().replace(/^['"]|['"]$/g, '');
+const indentOf = (line) => line.length - line.trimStart().length;
+/** Read the dependency sections of one importer block (lines [start, end), sections at `base`). */
+function pnpmDeps(lines, start, end, base) {
+    const deps = new Map();
+    const specifiers = new Map();
+    let section = null;
+    for (let i = start; i < end; i++) {
+        const line = lines[i];
+        if (!line.trim() || line.trimStart().startsWith('#'))
+            continue;
+        const ind = indentOf(line);
+        if (ind === base) {
+            const head = line.trim();
+            section = /^(dependencies|devDependencies|optionalDependencies):\s*$/.test(head) ? 'deps'
+                : /^specifiers:\s*$/.test(head) ? 'specifiers' : null;
+            continue;
+        }
+        if (!section || ind !== base + 2)
+            continue;
+        const m = splitKeyValue(line.trim());
+        if (!m)
+            continue;
+        const name = unquote(m[1]);
+        if (section === 'specifiers') {
+            specifiers.set(name, unquote(m[2]));
+            continue;
+        }
+        const dep = {};
+        if (m[2]) {
+            dep.version = unquote(m[2]);
+        }
+        else {
+            for (let j = i + 1; j < end && (lines[j].trim() === '' || indentOf(lines[j]) > ind); j++) {
+                const kv = splitKeyValue(lines[j].trim());
+                if (kv && (kv[1] === 'specifier' || kv[1] === 'version') && kv[2])
+                    dep[kv[1]] = unquote(kv[2]);
+            }
+        }
+        deps.set(name, dep);
+    }
+    for (const [name, spec] of specifiers) {
+        const dep = deps.get(name);
+        if (dep && dep.specifier === undefined)
+            dep.specifier = spec;
+    }
+    return deps;
+}
+/**
+ * `key: value` split at the first colon (non-empty key), the value without its
+ * leading whitespace. Linear string code instead of /^(.+?):\s*(.*)$/, whose
+ * adjacent quantifiers backtrack polynomially (CodeQL js/polynomial-redos).
+ * Index 0 is the whole line, as in a RegExp match.
+ */
+function splitKeyValue(line) {
+    const colon = line.indexOf(':');
+    if (colon <= 0)
+        return null;
+    let start = colon + 1;
+    while (start < line.length && /\s/.test(line[start]))
+        start++;
+    return [line, line.slice(0, colon), line.slice(start)];
+}
+/** `s` up to (not including) the first `ch`; linear, unlike /ch.*$/. */
+function cutAt(s, ch) {
+    const i = s.indexOf(ch);
+    return i < 0 ? s : s.slice(0, i);
+}
+/** A pnpm alias target: a valid npm package name (optionally scoped), then "@" or "/" and a version. */
+const PNPM_ALIAS = /^(?:npm:|\/)?((?:@[a-zA-Z0-9~-][a-zA-Z0-9._~-]*\/)?[a-zA-Z0-9~-][a-zA-Z0-9._~-]*)[@/](\d\S*)$/;
+function pnpmIndex(text) {
+    const lines = text.split(/\r?\n/);
+    const importers = new Map();
+    const importersAt = lines.findIndex((l) => /^importers:\s*$/.test(l));
+    if (importersAt >= 0) {
+        let end = lines.findIndex((l, i) => i > importersAt && l.trim() !== '' && indentOf(l) === 0);
+        if (end < 0)
+            end = lines.length;
+        for (let i = importersAt + 1; i < end; i++) {
+            const line = lines[i];
+            if (indentOf(line) !== 2 || !line.trimEnd().endsWith(':'))
+                continue;
+            const key = unquote(line.trim().slice(0, -1));
+            // Scan forward from this importer (a findIndex from line 0 per importer was quadratic).
+            let next = i + 1;
+            while (next < end && (lines[next].trim() === '' || indentOf(lines[next]) > 2))
+                next++;
+            importers.set(key === '.' ? '' : key, pnpmDeps(lines, i + 1, next, 4));
+        }
+    }
+    else {
+        importers.set('', pnpmDeps(lines, 0, lines.length, 0));
+    }
+    const parseVersion = (raw) => {
+        const v = cutAt(raw, '(').trim();
+        if (v.startsWith('link:') || v.startsWith('file:') || v.startsWith('workspace:'))
+            return { local: true };
+        // A plain version, with a peer suffix: v5 "16.0.0_react@16.0.0" / "18.2.0_@types+react@18.0.0",
+        // v6+ "16.0.0(react@16.0.0)" (already cut at "("). Never an alias (#1049 scope-cut re-check).
+        if (/^\d/.test(v))
+            return { version: cutAt(v, '_') };
+        // An alias: v5 "/name/1.2.3", v6 "/name@1.2.3", v9 "name@1.2.3", or "npm:name@1.2.3".
+        const alias = PNPM_ALIAS.exec(v);
+        if (alias)
+            return { version: cutAt(alias[2], '_'), realName: alias[1] };
+        return { version: cutAt(v, '_') };
+    };
+    return {
+        file: 'pnpm-lock.yaml',
+        members: () => [...importers.keys()].filter((k) => k !== ''),
+        hasImporter: (importer) => importer === '' || importers.has(importer),
+        recordedSpec(importer, name) {
+            const deps = importers.get(importer);
+            if (!deps)
+                return undefined;
+            const dep = deps.get(name);
+            if (!dep)
+                return undefined;
+            return dep.specifier ?? null;
+        },
+        resolve(importer, name) {
+            const dep = importers.get(importer)?.get(name);
+            return dep?.version ? parseVersion(dep.version) : undefined;
+        },
+    };
+}
+// ============================================================================
+// yarn (yarn.lock, classic and berry)
+// ============================================================================
+function yarnIndex(text) {
+    const entries = new Map();
+    const lines = text.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i++) {
+        const header = lines[i];
+        if (!header || /^\s|^#/.test(header) || !header.trimEnd().endsWith(':'))
+            continue;
+        let version = '';
+        let resolution = '';
+        for (let j = i + 1; j < lines.length && /^\s/.test(lines[j]); j++) {
+            const v = /^\s+version:?\s+"?([^"\s]+)"?\s*$/.exec(lines[j]);
+            if (v && !version)
+                version = v[1];
+            const r = /^\s+resolution:\s+"?([^"\s]+)"?\s*$/.exec(lines[j]);
+            if (r)
+                resolution = r[1];
+        }
+        if (!version)
+            continue;
+        const local = version === '0.0.0-use.local' || /@(workspace|link|portal|file):/.test(resolution);
+        const realName = /^((?:@[^/@]+\/)?[^@]+)@npm:/.exec(resolution)?.[1];
+        for (const raw of header.trimEnd().slice(0, -1).split(',')) {
+            const key = unquote(raw);
+            entries.set(key, local ? { local: true } : { version, ...(realName && !key.startsWith(`${realName}@`) ? { realName } : {}) });
+        }
+    }
+    return {
+        file: 'yarn.lock',
+        members: () => [],
+        hasImporter: () => true,
+        // yarn.lock is matched by `name@spec`, so a changed spec simply finds no entry.
+        recordedSpec: () => null,
+        resolve: (_importer, name, spec) => entries.get(`${name}@${spec}`) ?? entries.get(`${name}@npm:${spec}`),
+    };
+}
+//# sourceMappingURL=lockfile-versions.js.map

package/dist/domains/security-compliance/services/scanners/scanner-types.d.ts

@@ -3,7 +3,7 @@
  * Common types, interfaces, and patterns used across all scanner modules
  */
 import type { MemoryBackend } from '@kernel/interfaces.js';
-import type { Vulnerability, VulnerabilitySeverity, VulnerabilityCategory, VulnerabilityLocation, RemediationAdvice, ScanSummary, SecurityCoverage, ScanStatus, SASTResult, DASTResult, DASTOptions, AuthCredentials, RuleSet, FalsePositiveCheck } from '../../interfaces.js';
+import type { Vulnerability, VulnerabilitySeverity, VulnerabilityCategory, VulnerabilityLocation, RemediationAdvice, ScanSummary, SecurityCoverage, ScanStatus, SASTResult, DASTResult, DASTOptions, AuthCredentials, RuleSet, FalsePositiveCheck, UncheckedDependency, LocalDependency } from '../../interfaces.js';
 import type { HybridRouter, ChatResponse } from '@shared/llm/index.js';
 /**
  * Combined security scanner configuration
@@ -31,16 +31,44 @@ export interface SecurityScannerDependencies {
     llmRouter?: HybridRouter;
 }
 export declare const DEFAULT_CONFIG: SecurityScannerConfig;
+/**
+ * Completeness of a dependency advisory scan (#1049).
+ * - complete: every dependency was checked; the findings (or none) are a measurement.
+ * - incomplete: some dependencies were checked (their findings are real), others not.
+ * - failed: no dependency could be checked. Never read as "0 vulnerabilities".
+ */
+export type DependencyScanStatus = 'complete' | 'incomplete' | 'failed';
 /**
  * Dependency scan result
  */
 export interface DependencyScanResult {
     readonly scanId: string;
     readonly vulnerabilities: Vulnerability[];
+    /** Dependencies submitted to the scan (checked or not). */
     readonly packagesScanned: number;
     readonly vulnerablePackages: number;
     readonly summary: ScanSummary;
     readonly scanDurationMs: number;
+    readonly status: DependencyScanStatus;
+    /** True only when status is 'complete'. */
+    readonly measured: boolean;
+    /** Dependencies whose advisories were actually checked. */
+    readonly packagesChecked: number;
+    readonly uncheckedPackages: UncheckedDependency[];
+    /** Lockfile the checked versions were resolved from (path relative to package.json), or null when none was used. */
+    readonly lockfile?: string | null;
+    /** Local workspace / linked packages: not OSV subjects, never make the scan incomplete. */
+    readonly localPackages?: LocalDependency[];
+    /**
+     * Why the scan cannot be complete beyond individual packages: a malformed
+     * lockfile, or a workspace root whose members are not scanned (#1057).
+     * Non-empty means the scan is not complete.
+     */
+    readonly resolutionErrors?: string[];
+    /** Only the direct dependencies of the scanned package.json are checked. */
+    readonly scope?: 'direct';
+    /** Why the scan is incomplete/failed; absent when complete. */
+    readonly error?: string;
 }
 /**
  * Full scan result combining SAST and DAST
@@ -89,5 +117,5 @@ export interface MutableScanSummary {
     totalFiles: number;
     scanDurationMs: number;
 }
-export type { Vulnerability, VulnerabilitySeverity, VulnerabilityCategory, VulnerabilityLocation, RemediationAdvice, ScanSummary, SecurityCoverage, ScanStatus, SASTResult, DASTResult, DASTOptions, AuthCredentials, RuleSet, FalsePositiveCheck, MemoryBackend, HybridRouter, ChatResponse, };
+export type { Vulnerability, VulnerabilitySeverity, VulnerabilityCategory, VulnerabilityLocation, RemediationAdvice, ScanSummary, SecurityCoverage, ScanStatus, SASTResult, DASTResult, DASTOptions, AuthCredentials, RuleSet, FalsePositiveCheck, UncheckedDependency, LocalDependency, MemoryBackend, HybridRouter, ChatResponse, };
 //# sourceMappingURL=scanner-types.d.ts.map