agentic-qe 3.15.6 → 3.15.7

package/dist/shared/security/osv-lookup.d.ts

@@ -0,0 +1,124 @@
+/**
+ * Agentic QE v3 - OSV lookup outcome types and response validation (#1049)
+ *
+ * A failed or partial advisory lookup is never "no vulnerabilities". Every
+ * package the lookup could not check is listed with the reason, and the
+ * overall status says whether the result can be read as a measurement.
+ */
+import type { ParsedVulnerability } from './osv-types';
+/** A package handed to an OSV lookup. */
+export interface OSVPackageQuery {
+    name: string;
+    ecosystem: string;
+    version?: string;
+}
+/** A package whose advisories could not be checked, and why. */
+export interface OSVUncheckedPackage {
+    name: string;
+    ecosystem: string;
+    version?: string;
+    reason: string;
+}
+/**
+ * Outcome of an OSV batch lookup.
+ * - complete: every package was checked; `results` is a measurement.
+ * - incomplete: some packages were checked (their findings are real), others not.
+ * - failed: no package could be checked.
+ */
+export interface OSVBatchLookup {
+    status: 'complete' | 'incomplete' | 'failed';
+    /** Keyed `${ecosystem}:${name}`; only packages that were actually checked. */
+    results: Map<string, ParsedVulnerability[]>;
+    packagesRequested: number;
+    packagesChecked: number;
+    unchecked: OSVUncheckedPackage[];
+    /** Bounded, request-level error descriptions (no response bodies). */
+    errors: string[];
+}
+/** Thrown by the legacy list-returning methods when a lookup did not complete. */
+export declare class OSVLookupError extends Error {
+    readonly lookup?: OSVBatchLookup;
+    constructor(message: string, lookup?: OSVBatchLookup);
+    static fromLookup(lookup: OSVBatchLookup): OSVLookupError;
+}
+/**
+ * Result key for one queried package: `${ecosystem}:${name}@${version}`.
+ * Keyed by version so two versions of one package never overwrite each other.
+ */
+export declare const lookupKey: (pkg: {
+    ecosystem: string;
+    name: string;
+    version?: string;
+}) => string;
+/** At most `max` ids, then "and N more" — keeps reasons bounded. */
+export declare function boundedList(items: readonly string[], max?: number): string;
+/**
+ * The exact npm version a spec pins ("4.17.15", "=4.17.15", "v4.17.15"), or
+ * null for anything else: ranges (^ ~ < > <= >= || hyphen), wildcards, tags,
+ * and non-registry specs. A range is never reduced to a guessed version (#1049).
+ */
+export declare function exactNpmVersion(spec: string): string | null;
+/**
+ * What an npm dependency spec points at (#1049):
+ * - `local`: a workspace / linked / local-directory package. Not an OSV subject
+ *   (its own dependencies are what can carry advisories).
+ * - `remote`: git, GitHub shorthand, URL or tarball (incl. `file:*.tgz`): third-party
+ *   code with no registry version, so advisories cannot be matched.
+ * - `alias`: `npm:<real>@<range>` — the registry package `<real>`.
+ * - `registry`: an ordinary registry spec (exact version, range or tag).
+ */
+export type NpmSpecKind = {
+    kind: 'local';
+} | {
+    kind: 'remote';
+} | {
+    kind: 'alias';
+    name: string;
+    spec: string;
+} | {
+    kind: 'registry';
+    spec: string;
+};
+export declare function classifyNpmSpec(spec: string): NpmSpecKind;
+/** A spec whose source is not the npm registry (local or remote); aliases are registry packages. */
+export declare function isNonRegistrySpec(spec: string): boolean;
+/**
+ * True for a concrete version OSV can match ("4.17.15", "1.0rc1", "2.0.0-beta.1").
+ * Ranges, tags, wildcards, URLs and aliases are not: querying OSV without a
+ * concrete version returns every advisory the package ever had.
+ */
+export declare function isConcreteVersion(version: string): boolean;
+/** Longest version string considered; versions come from repo-controlled files. */
+export declare const MAX_VERSION_LENGTH = 256;
+/** One querybatch entry: the advisory ids reported for a package, or why it is unusable. */
+export type BatchEntry = {
+    ids: string[];
+} | {
+    reason: string;
+};
+/**
+ * Validate a querybatch body against the queries sent. `null` means the body as
+ * a whole is unusable (every package in the chunk is unchecked).
+ */
+export declare function parseBatchBody(body: unknown, expected: number): BatchEntry[] | null;
+/** A full OSV advisory record has a string id and an `affected` array. */
+export declare function isAdvisoryRecord(body: unknown): body is {
+    id: string;
+    affected: unknown[];
+};
+/**
+ * Whether an advisory affects `pkg@version` according to its own `affected`
+ * entries. Used to confirm querybatch matches: OSV's batch endpoint can return
+ * advisories whose ranges for the package exclude the version. An advisory is
+ * dropped only when every matching entry is positively evaluated as not
+ * affected; anything that cannot be evaluated (no matching entry, ECOSYSTEM/GIT
+ * ranges, unparseable versions) is kept.
+ */
+export declare function advisoryAffectsVersion(advisory: unknown, pkg: {
+    name: string;
+    ecosystem: string;
+    version: string;
+}): boolean;
+/** Lookup status from the counts. */
+export declare function lookupStatus(requested: number, checked: number): OSVBatchLookup['status'];
+//# sourceMappingURL=osv-lookup.d.ts.map

package/dist/shared/security/osv-lookup.js

@@ -0,0 +1,246 @@
+/**
+ * Agentic QE v3 - OSV lookup outcome types and response validation (#1049)
+ *
+ * A failed or partial advisory lookup is never "no vulnerabilities". Every
+ * package the lookup could not check is listed with the reason, and the
+ * overall status says whether the result can be read as a measurement.
+ */
+/** Thrown by the legacy list-returning methods when a lookup did not complete. */
+export class OSVLookupError extends Error {
+    lookup;
+    constructor(message, lookup) {
+        super(message);
+        this.name = 'OSVLookupError';
+        this.lookup = lookup;
+    }
+    static fromLookup(lookup) {
+        const reasons = [...new Set(lookup.unchecked.map((p) => p.reason))].slice(0, 3).join('; ');
+        return new OSVLookupError(`OSV advisories could not be checked for ${lookup.unchecked.length} of ${lookup.packagesRequested} package(s): ${reasons}`, lookup);
+    }
+}
+/**
+ * Result key for one queried package: `${ecosystem}:${name}@${version}`.
+ * Keyed by version so two versions of one package never overwrite each other.
+ */
+export const lookupKey = (pkg) => `${pkg.ecosystem}:${pkg.name}@${pkg.version ?? ''}`;
+/** At most `max` ids, then "and N more" — keeps reasons bounded. */
+export function boundedList(items, max = 5) {
+    return items.length <= max ? items.join(', ') : `${items.slice(0, max).join(', ')} and ${items.length - max} more`;
+}
+/**
+ * The exact npm version a spec pins ("4.17.15", "=4.17.15", "v4.17.15"), or
+ * null for anything else: ranges (^ ~ < > <= >= || hyphen), wildcards, tags,
+ * and non-registry specs. A range is never reduced to a guessed version (#1049).
+ */
+export function exactNpmVersion(spec) {
+    const m = /^=?v?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)$/.exec(spec.trim());
+    return m ? m[1] : null;
+}
+export function classifyNpmSpec(spec) {
+    const s = spec.trim();
+    const alias = /^npm:((?:@[^/@\s]+\/)?[^@\s]+)(?:@(.*))?$/.exec(s);
+    if (alias)
+        return { kind: 'alias', name: alias[1], spec: alias[2] ?? '' };
+    if (/^(workspace:|link:|portal:)/.test(s))
+        return { kind: 'local' };
+    if (/^file:/.test(s))
+        return /\.(tgz|tar\.gz|tar)$/i.test(s) ? { kind: 'remote' } : { kind: 'local' };
+    if (/^(\.{0,2}\/|~\/)/.test(s))
+        return /\.(tgz|tar\.gz|tar)$/i.test(s) ? { kind: 'remote' } : { kind: 'local' };
+    if (/^(patch:|exec:|git\+|git:|github:|gitlab:|bitbucket:|https?:)/.test(s))
+        return { kind: 'remote' };
+    if (/^[^\s@/:]+\/[^\s@/:]+(#.*)?$/.test(s))
+        return { kind: 'remote' }; // GitHub "user/repo" shorthand
+    return { kind: 'registry', spec: s };
+}
+/** A spec whose source is not the npm registry (local or remote); aliases are registry packages. */
+export function isNonRegistrySpec(spec) {
+    const k = classifyNpmSpec(spec).kind;
+    return k === 'local' || k === 'remote';
+}
+/**
+ * True for a concrete version OSV can match ("4.17.15", "1.0rc1", "2.0.0-beta.1").
+ * Ranges, tags, wildcards, URLs and aliases are not: querying OSV without a
+ * concrete version returns every advisory the package ever had.
+ */
+export function isConcreteVersion(version) {
+    if (version.length === 0 || version.length > MAX_VERSION_LENGTH)
+        return false;
+    if (!matchesVersionShape(version))
+        return false;
+    return !/(^|\.)[xX*](\.|$)/.test(version);
+}
+/** Longest version string considered; versions come from repo-controlled files. */
+export const MAX_VERSION_LENGTH = 256;
+const VERSION_CORE = /^\d+(?:\.\d+)*$/;
+const VERSION_TAIL = /^[0-9A-Za-z][0-9A-Za-z.+-]*$/;
+/**
+ * Linear equivalent of `^\d+(\.\d+)*([-+._]?[0-9A-Za-z][0-9A-Za-z.+-]*)?$`
+ * (whose overlapping quantifiers backtrack polynomially, CodeQL js/polynomial-redos).
+ * `_` is not in the tail class, so it can only be the separator right after the
+ * numeric core. Without `_`, any accepted split can be re-split after the first
+ * digit run (the remaining `.digits` segments fit the tail class).
+ */
+function matchesVersionShape(version) {
+    const underscore = version.indexOf('_');
+    if (underscore >= 0) {
+        return VERSION_CORE.test(version.slice(0, underscore)) && VERSION_TAIL.test(version.slice(underscore + 1));
+    }
+    let i = 0;
+    while (i < version.length && version.charCodeAt(i) >= 48 && version.charCodeAt(i) <= 57)
+        i++;
+    if (i === 0)
+        return false;
+    const rest = version.slice(i);
+    if (rest === '')
+        return true;
+    // Splitting inside a 2+ digit run makes the tail start with a digit: the rest
+    // then only has to fit the tail class ("11." = core "1" + tail "1.").
+    if (i >= 2 && VERSION_TAIL_REST.test(rest))
+        return true;
+    const sep = rest[0] === '-' || rest[0] === '+' || rest[0] === '.';
+    return VERSION_TAIL.test(sep ? rest.slice(1) : rest);
+}
+const VERSION_TAIL_REST = /^[0-9A-Za-z.+-]*$/;
+const isObject = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+/**
+ * Validate a querybatch body against the queries sent. `null` means the body as
+ * a whole is unusable (every package in the chunk is unchecked).
+ */
+export function parseBatchBody(body, expected) {
+    if (!isObject(body) || !Array.isArray(body.results) || body.results.length !== expected)
+        return null;
+    return body.results.map((entry) => {
+        if (!isObject(entry))
+            return { reason: 'malformed OSV result entry' };
+        if (typeof entry.next_page_token === 'string' && entry.next_page_token) {
+            return { reason: 'OSV advisory list was truncated (paginated) and not fully retrieved' };
+        }
+        if (entry.vulns === undefined)
+            return { ids: [] };
+        if (!Array.isArray(entry.vulns))
+            return { reason: 'malformed OSV result entry' };
+        const ids = [];
+        for (const v of entry.vulns) {
+            if (!isObject(v) || typeof v.id !== 'string' || !v.id)
+                return { reason: 'malformed OSV advisory reference' };
+            ids.push(v.id);
+        }
+        return { ids };
+    });
+}
+/** A full OSV advisory record has a string id and an `affected` array. */
+export function isAdvisoryRecord(body) {
+    return isObject(body) && typeof body.id === 'string' && Array.isArray(body.affected);
+}
+function parseSemver(version) {
+    const m = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(version.trim());
+    if (!m)
+        return null;
+    return { nums: [Number(m[1]), Number(m[2]), Number(m[3])], pre: m[4] ? m[4].split('.') : [] };
+}
+function compareSemver(a, b) {
+    for (let i = 0; i < 3; i++)
+        if (a.nums[i] !== b.nums[i])
+            return a.nums[i] < b.nums[i] ? -1 : 1;
+    if (a.pre.length === 0 || b.pre.length === 0)
+        return a.pre.length === b.pre.length ? 0 : a.pre.length === 0 ? 1 : -1;
+    for (let i = 0; i < Math.max(a.pre.length, b.pre.length); i++) {
+        const x = a.pre[i];
+        const y = b.pre[i];
+        if (x === undefined || y === undefined)
+            return x === undefined ? -1 : 1;
+        if (x === y)
+            continue;
+        const nx = /^\d+$/.test(x);
+        const ny = /^\d+$/.test(y);
+        if (nx && ny)
+            return Number(x) < Number(y) ? -1 : 1;
+        if (nx !== ny)
+            return nx ? -1 : 1;
+        return x < y ? -1 : 1;
+    }
+    return 0;
+}
+/** OSV SEMVER range evaluation; null when an event version cannot be parsed. */
+function semverRangeAffects(version, events) {
+    // `at: null` is `introduced: "0"`: before every version, prereleases included.
+    const keyed = [];
+    for (const e of events) {
+        const kind = e.introduced !== undefined ? 'introduced' : e.fixed !== undefined ? 'fixed' : e.last_affected !== undefined ? 'last_affected' : null;
+        if (!kind)
+            continue; // `limit` does not change membership for a single version
+        const raw = e[kind];
+        if (kind === 'introduced' && raw === '0') {
+            keyed.push({ at: null, kind });
+            continue;
+        }
+        const at = parseSemver(raw);
+        if (!at)
+            return null;
+        keyed.push({ at, kind });
+    }
+    // Sort by version; on a tie a fixed/last_affected closes the earlier window
+    // before an introduced at the same version opens the next one.
+    const tieRank = (kind) => (kind === 'introduced' ? 1 : 0);
+    keyed.sort((a, b) => {
+        if (!a.at || !b.at)
+            return a.at === b.at ? 0 : a.at ? 1 : -1;
+        return compareSemver(a.at, b.at) || tieRank(a.kind) - tieRank(b.kind);
+    });
+    let affected = false;
+    for (const { at, kind } of keyed) {
+        if (!at) {
+            affected = true;
+            continue;
+        }
+        const cmp = compareSemver(version, at);
+        if (kind === 'introduced' && cmp >= 0)
+            affected = true;
+        else if (kind === 'fixed' && cmp >= 0)
+            affected = false;
+        else if (kind === 'last_affected' && cmp > 0)
+            affected = false;
+    }
+    return affected;
+}
+/**
+ * Whether an advisory affects `pkg@version` according to its own `affected`
+ * entries. Used to confirm querybatch matches: OSV's batch endpoint can return
+ * advisories whose ranges for the package exclude the version. An advisory is
+ * dropped only when every matching entry is positively evaluated as not
+ * affected; anything that cannot be evaluated (no matching entry, ECOSYSTEM/GIT
+ * ranges, unparseable versions) is kept.
+ */
+export function advisoryAffectsVersion(advisory, pkg) {
+    const affected = advisory.affected;
+    if (!Array.isArray(affected))
+        return true;
+    const entries = affected.filter((a) => isObject(a) && isObject(a.package)
+        && a.package.name === pkg.name && a.package.ecosystem === pkg.ecosystem);
+    if (entries.length === 0)
+        return true;
+    const version = parseSemver(pkg.version);
+    for (const entry of entries) {
+        if (Array.isArray(entry.versions) && entry.versions.includes(pkg.version))
+            return true;
+        const ranges = Array.isArray(entry.ranges) ? entry.ranges.filter(isObject) : [];
+        if (ranges.length === 0 && !Array.isArray(entry.versions))
+            return true;
+        for (const range of ranges) {
+            if (range.type !== 'SEMVER' || !version || !Array.isArray(range.events))
+                return true;
+            const verdict = semverRangeAffects(version, range.events);
+            if (verdict !== false)
+                return true;
+        }
+    }
+    return false;
+}
+/** Lookup status from the counts. */
+export function lookupStatus(requested, checked) {
+    if (checked === requested)
+        return 'complete';
+    return checked === 0 ? 'failed' : 'incomplete';
+}
+//# sourceMappingURL=osv-lookup.js.map

package/dist/shared/security/osv-types.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Agentic QE v3 - OSV API record types
+ * API Documentation: https://google.github.io/osv.dev/api/
+ */
+/**
+ * OSV query request
+ */
+export interface OSVQueryRequest {
+    /** Package name */
+    package?: {
+        name: string;
+        ecosystem: OSVEcosystem;
+    };
+    /** Git commit hash */
+    commit?: string;
+    /**
+     * Package version to match. OSV reads it here, at the top level of the query;
+     * a `version` inside `package` is ignored (it returns every advisory ever).
+     */
+    version?: string;
+}
+/**
+ * Supported ecosystems
+ */
+export type OSVEcosystem = 'npm' | 'PyPI' | 'Go' | 'Maven' | 'crates.io' | 'NuGet' | 'Packagist' | 'RubyGems' | 'Hex' | 'Pub';
+/**
+ * OSV vulnerability record
+ */
+export interface OSVVulnerability {
+    id: string;
+    summary: string;
+    details?: string;
+    aliases?: string[];
+    modified: string;
+    published?: string;
+    withdrawn?: string;
+    severity?: OSVSeverity[];
+    affected: OSVAffected[];
+    references?: OSVReference[];
+    database_specific?: Record<string, unknown>;
+}
+/**
+ * OSV severity rating
+ */
+export interface OSVSeverity {
+    type: 'CVSS_V2' | 'CVSS_V3';
+    score: string;
+}
+/**
+ * OSV affected package information
+ */
+export interface OSVAffected {
+    package: {
+        name: string;
+        ecosystem: string;
+        purl?: string;
+    };
+    ranges?: OSVRange[];
+    versions?: string[];
+    ecosystem_specific?: Record<string, unknown>;
+    database_specific?: Record<string, unknown>;
+}
+/**
+ * OSV version range
+ */
+export interface OSVRange {
+    type: 'SEMVER' | 'ECOSYSTEM' | 'GIT';
+    repo?: string;
+    events: Array<{
+        introduced?: string;
+        fixed?: string;
+        last_affected?: string;
+        limit?: string;
+    }>;
+}
+/**
+ * OSV reference link
+ */
+export interface OSVReference {
+    type: 'ADVISORY' | 'ARTICLE' | 'DETECTION' | 'DISCUSSION' | 'REPORT' | 'FIX' | 'GIT' | 'PACKAGE' | 'EVIDENCE' | 'WEB';
+    url: string;
+}
+/**
+ * OSV query response
+ */
+export interface OSVQueryResponse {
+    vulns: OSVVulnerability[];
+}
+/**
+ * OSV batch query request
+ */
+export interface OSVBatchQueryRequest {
+    queries: OSVQueryRequest[];
+}
+/**
+ * OSV batch query response
+ */
+export interface OSVBatchQueryResponse {
+    results: Array<{
+        vulns?: OSVVulnerability[];
+    }>;
+}
+/**
+ * Parsed vulnerability for easier consumption
+ */
+export interface ParsedVulnerability {
+    id: string;
+    cveIds: string[];
+    summary: string;
+    details: string;
+    severity: 'critical' | 'high' | 'medium' | 'low' | 'unknown';
+    cvssScore: number | null;
+    affectedPackage: string;
+    affectedVersions: string[];
+    fixedVersions: string[];
+    publishedDate: Date | null;
+    references: string[];
+}
+//# sourceMappingURL=osv-types.d.ts.map

package/dist/shared/security/osv-types.js

@@ -0,0 +1,6 @@
+/**
+ * Agentic QE v3 - OSV API record types
+ * API Documentation: https://google.github.io/osv.dev/api/
+ */
+export {};
+//# sourceMappingURL=osv-types.js.map

package/dist/workers/interfaces.d.ts

@@ -163,7 +163,12 @@ export interface WorkerMemory {
      */
     get<T>(key: string, options?: WorkerMemoryReadOptions): Promise<T | undefined>;
     set<T>(key: string, value: T): Promise<void>;
-    search(pattern: string): Promise<string[]>;
+    /**
+     * Keys matching a glob pattern. Like `get`, `options.namespace` searches
+     * another domain's records (e.g. recorded security scans, #1043); a backend
+     * without namespaces returns nothing for one.
+     */
+    search(pattern: string, limit?: number, options?: WorkerMemoryReadOptions): Promise<string[]>;
 }
 export interface WorkerLogger {
     debug(message: string, meta?: Record<string, unknown>): void;

package/dist/workers/namespaced-keys.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Agentic QE v3 - namespaced search keys (#1049)
+ *
+ * Kernel memory backends disagree on what a namespaced `search` returns: the
+ * hybrid (sqlite) backend returns bare keys, the in-memory backend returns
+ * `<namespace>:<key>`. A worker that passes a search result straight back to
+ * `get(key, { namespace })` then double-prefixes the key and reads nothing.
+ */
+/**
+ * The bare key for a key returned by `search(pattern, limit, { namespace })`.
+ * A result that already matches `pattern` is bare (keys may legitimately start
+ * with the namespace name, e.g. `defect-intelligence:predictor:…`); otherwise a
+ * leading `<namespace>:` is the backend's prefix and is removed.
+ */
+export declare function bareSearchKey(found: string, namespace: string, pattern: string): string;
+//# sourceMappingURL=namespaced-keys.d.ts.map

package/dist/workers/namespaced-keys.js

@@ -0,0 +1,24 @@
+/**
+ * Agentic QE v3 - namespaced search keys (#1049)
+ *
+ * Kernel memory backends disagree on what a namespaced `search` returns: the
+ * hybrid (sqlite) backend returns bare keys, the in-memory backend returns
+ * `<namespace>:<key>`. A worker that passes a search result straight back to
+ * `get(key, { namespace })` then double-prefixes the key and reads nothing.
+ */
+function globToRegExp(pattern) {
+    const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+    return new RegExp(`^${escaped.replace(/\*/g, '.*').replace(/\?/g, '.')}$`, 's');
+}
+/**
+ * The bare key for a key returned by `search(pattern, limit, { namespace })`.
+ * A result that already matches `pattern` is bare (keys may legitimately start
+ * with the namespace name, e.g. `defect-intelligence:predictor:…`); otherwise a
+ * leading `<namespace>:` is the backend's prefix and is removed.
+ */
+export function bareSearchKey(found, namespace, pattern) {
+    if (globToRegExp(pattern).test(found))
+        return found;
+    return found.startsWith(`${namespace}:`) ? found.slice(namespace.length + 1) : found;
+}
+//# sourceMappingURL=namespaced-keys.js.map

package/dist/workers/quality-daemon/persistent-memory.d.ts

@@ -26,6 +26,6 @@ export declare class PersistentWorkerMemory implements WorkerMemory {
     constructor(backend: KVBackend);
     get<T>(key: string, options?: WorkerMemoryReadOptions): Promise<T | undefined>;
     set<T>(key: string, value: T): Promise<void>;
-    search(pattern: string): Promise<string[]>;
+    search(pattern: string, limit?: number, options?: WorkerMemoryReadOptions): Promise<string[]>;
 }
 //# sourceMappingURL=persistent-memory.d.ts.map

package/dist/workers/quality-daemon/persistent-memory.js

@@ -23,8 +23,8 @@ export class PersistentWorkerMemory {
     async set(key, value) {
         await this.backend.kvSet(key, value, NAMESPACE);
     }
-    async search(pattern) {
-        return this.backend.kvSearch(pattern, NAMESPACE);
+    async search(pattern, limit, options) {
+        return this.backend.kvSearch(pattern, options?.namespace ?? NAMESPACE, limit);
     }
 }
 //# sourceMappingURL=persistent-memory.js.map

package/dist/workers/worker-manager.js

@@ -58,10 +58,13 @@ class InMemoryWorkerMemory {
     async set(key, value) {
         this.store.set(key, value);
     }
-    async search(pattern) {
+    async search(pattern, limit, options) {
+        if (options?.namespace)
+            return [];
         const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, '\\$&');
         const regex = new RegExp(escaped.replace(/\*/g, '.*'));
-        return Array.from(this.store.keys()).filter((key) => regex.test(key));
+        const keys = Array.from(this.store.keys()).filter((key) => regex.test(key));
+        return limit === undefined ? keys : keys.slice(0, limit);
     }
     /**
      * Clear all stored data

package/dist/workers/workers/defect-predictor.d.ts

@@ -2,21 +2,38 @@
  * Agentic QE v3 - Defect Predictor Worker
  * ADR-014: Background Workers for QE Monitoring
  *
- * ML-based defect prediction including:
- * - Code change risk analysis
- * - Historical defect pattern matching
- * - Hotspot identification
- * - Predictive maintenance suggestions
+ * Surfaces the defect-intelligence domain's latest predictions:
+ * - High-risk files and their contributing factors
+ * - Targeted review / refactoring / coverage recommendations
+ *
+ * #1043: every prediction comes from a run of the defect-intelligence
+ * predictor (`defect-intelligence:predictor:prediction:<id>` in the
+ * `defect-intelligence` namespace, written by DefectPredictorService), and
+ * only files that exist in the project are kept. Code hotspots have no
+ * measured source and are reported unmeasured. Nothing predicted → nothing
+ * stored, an "unmeasured" info finding. A `defect:predictions` record without
+ * the measured stamp (the invented one written by <= 3.15.6) is ignored and
+ * replaced by the next measured run.
  */
 import { BaseWorker } from '../base-worker';
 import { WorkerContext, WorkerResult } from '../interfaces';
 export declare class DefectPredictorWorker extends BaseWorker {
     constructor();
     protected doExecute(context: WorkerContext): Promise<WorkerResult>;
-    private analyzeCodeForDefects;
-    private identifyHotspots;
+    /**
+     * #1043 round 2b: the newest prediction names no usable file, so a stored
+     * measured record from an older prediction is no longer current — stamp it
+     * stale (once) instead of leaving it looking like the latest analysis.
+     */
+    private markPreviousStale;
+    /**
+     * #1043: the most recent prediction run the defect-intelligence predictor
+     * recorded, restricted to regular files whose real path is inside the
+     * project root. `measured` is `null` when there is no such prediction;
+     * `unusable` describes a newest prediction none of whose files qualify.
+     */
+    private readLatestPrediction;
     private analyzeHighRiskPredictions;
-    private analyzeHotspots;
     private calculateHealthScore;
 }
 //# sourceMappingURL=defect-predictor.d.ts.map