agentic-qe 3.15.6 → 3.15.8

package/dist/cli/commands/security.js

@@ -8,17 +8,57 @@ import chalk from 'chalk';
 import { discoverSecurityFiles } from '../../domains/security-compliance/scan-discovery.js';
 import { FilePath } from '../../shared/value-objects/index.js';
 import { writeOutput, toJSON, toSARIF, securityToMarkdown } from '../utils/ci-output.js';
+import { runDependencyAdvisoryScan } from '../../domains/security-compliance/dependency-advisory-engine.js';
+import { resolve as resolvePath } from 'node:path';
+/** Name of the CLI check for the OSV dependency advisory scan (#1049). */
+export const DEPENDENCY_CHECK = 'Dependency advisories';
+/** #1049: dependency advisories could not be checked; the dependency result is UNMEASURED (same code as coverage/quality). */
+export const EXIT_DEPENDENCIES_UNMEASURED = 3;
+/**
+ * `aqe security` exit contract:
+ * 0 = every requested check completed, no medium+ findings
+ * 1 = high/critical findings, non-compliance, or a non-dependency check incomplete/failed
+ * 2 = medium findings only, every requested check complete
+ * 3 = dependency advisories could not be checked (failed or partial OSV lookup) and
+ *     there are no high/critical findings, non-compliance or other incomplete checks:
+ *     UNMEASURED, never a clean exit (#1049). Medium findings plus an incomplete
+ *     dependency scan also exit 3: the result is unmeasured, not a medium-only verdict.
+ */
+export function securityExitCode(result) {
+    const checks = result.checks ?? [];
+    const highOrCritical = result.vulnerabilities.some(v => v.severity === 'high' || v.severity === 'critical');
+    const nonCompliant = result.compliance?.compliant === false;
+    if (result.status !== 'complete' || nonCompliant) {
+        const dependencyUnmeasured = checks.some(check => check.name === DEPENDENCY_CHECK && check.status !== 'complete');
+        const otherIncomplete = checks.some(check => check.name !== DEPENDENCY_CHECK && check.status !== 'complete');
+        if (dependencyUnmeasured && !otherIncomplete && !nonCompliant && !highOrCritical)
+            return EXIT_DEPENDENCIES_UNMEASURED;
+        return 1;
+    }
+    if (highOrCritical)
+        return 1;
+    if (result.vulnerabilities.some(v => v.severity === 'medium'))
+        return 2;
+    return 0;
+}
 export function createSecurityCommand(context, cleanupAndExit, ensureInitialized) {
     const securityCmd = new Command('security')
         .description('Security scanning and URL validation')
         .option('--sast', 'Run SAST scan')
         .option('--dast', 'Run DAST scan')
+        .option('--dependencies', 'Check package.json dependencies against OSV advisories (sends package names and versions to the OSV API)')
         .option('--compliance <frameworks>', 'Check compliance (gdpr,hipaa,soc2)', '')
         .option('--url-validate <url>', 'Validate a URL for security threats and PII exposure')
         .option('--no-pii', 'Disable PII scanning when using --url-validate')
         .option('-t, --target <path>', 'Target directory to scan', '.')
         .option('-F, --format <format>', 'Output format (text|json|sarif|markdown)', 'text')
         .option('-o, --output <path>', 'Write output to file')
+        .addHelpText('after', `
+Exit codes:
+  0  every requested check completed; no medium or higher findings
+  1  high/critical findings, non-compliance, or a check failed / is incomplete
+  2  medium findings only
+  ${EXIT_DEPENDENCIES_UNMEASURED}  UNMEASURED: dependency advisories could not be checked (OSV unreachable, rate limited, or partial)`)
         .action(async (options) => {
         if (!await ensureInitialized())
             return;
@@ -86,13 +126,13 @@ export function createSecurityCommand(context, cleanupAndExit, ensureInitialized
             return; // Don't fall through to SAST/DAST path
         }
         const format = options.format;
-        const runSAST = options.sast || (!options.dast && !options.compliance);
+        const runSAST = options.sast || (!options.dast && !options.compliance && !options.dependencies);
         const frameworks = options.compliance
             ? options.compliance.split(',').map((value) => value.trim()).filter(Boolean)
             : [];
         const scanResult = {
             vulnerabilities: [], target: options.target,
-            scanType: [runSAST && 'SAST', options.dast && 'DAST', frameworks.length > 0 && 'Compliance'].filter(Boolean).join('+'),
+            scanType: [runSAST && 'SAST', options.dast && 'DAST', options.dependencies && 'Dependencies', frameworks.length > 0 && 'Compliance'].filter(Boolean).join('+'),
             checks: [], status: 'not-run',
         };
         const checks = scanResult.checks;
@@ -133,6 +173,18 @@ export function createSecurityCommand(context, cleanupAndExit, ensureInitialized
                         checks.push({ name: 'Source discovery', status: discovery.status, reason: 'Requested source discovery did not complete; inspect discovery issues.' });
                     }
                 }
+                if (options.dependencies) {
+                    // #1049: a failed or partial OSV lookup is reported, never a clean dependency scan.
+                    const outcome = await runDependencyAdvisoryScan({ scanPackageJson: (manifest) => securityAPI.runDependencyScan(manifest) }, resolvePath(options.target));
+                    scanResult.dependencyScan = outcome.report;
+                    scanResult.vulnerabilities.push(...outcome.vulnerabilities.map(formatVulnerability));
+                    const status = outcome.report.status;
+                    checks.push({
+                        name: DEPENDENCY_CHECK,
+                        status: status === 'complete' ? 'complete' : status === 'incomplete' ? 'partial' : status === 'failed' ? 'failed' : 'not-run',
+                        ...(status !== 'complete' ? { reason: outcome.report.message } : {}),
+                    });
+                }
                 if (frameworks.length > 0) {
                     const issues = [];
                     let compliant = true;
@@ -189,13 +241,7 @@ export function createSecurityCommand(context, cleanupAndExit, ensureInitialized
             return cleanupAndExit(1);
         }
         // Incomplete execution never has a clean exit, even if it found no vulnerabilities.
-        if (scanResult.status !== 'complete' || scanResult.compliance?.compliant === false)
-            return cleanupAndExit(1);
-        if (scanResult.vulnerabilities.some(v => v.severity === 'high' || v.severity === 'critical'))
-            return cleanupAndExit(1);
-        if (scanResult.vulnerabilities.some(v => v.severity === 'medium'))
-            return cleanupAndExit(2);
-        return cleanupAndExit(0);
+        return cleanupAndExit(securityExitCode(scanResult));
     });
     return securityCmd;
 }
@@ -227,6 +273,7 @@ function formatVulnerability(value) {
             severity: value.severity, type: value.title || value.category,
             file: value.location.file, line: value.location.line ?? 1,
             message: value.description,
+            ...(value.cveId ? { cveId: value.cveId } : {}),
         };
     }
     return value;
@@ -265,6 +312,26 @@ function printSecurityResult(result) {
         ...(result.evidence?.files.filter(file => file.status !== 'analyzed' && file.status !== 'excluded').map(file => `${file.path}: ${file.status}${file.reason ? ` (${file.reason})` : ''}`) ?? []),
         ...(result.discovery?.issues.map(issue => `${issue.path}: ${issue.reason}`) ?? []),
     ];
+    if (result.dependencyScan && result.dependencyScan.status !== 'complete') {
+        const unchecked = result.dependencyScan.uncheckedPackages;
+        console.log(chalk.yellow(`  ${result.dependencyScan.message}`));
+        for (const pkg of unchecked.slice(0, 10)) {
+            const where = `${pkg.member ? `${pkg.member}: ` : ''}${pkg.name}@${pkg.version}${pkg.lockedVersion ? ` (lockfile ${pkg.lockedVersion})` : ''}`;
+            console.log(chalk.yellow(`    not checked: ${where} (${pkg.reason})`));
+        }
+        if (unchecked.length > 10)
+            console.log(chalk.yellow(`    ... and ${unchecked.length - 10} more unchecked package(s)`));
+    }
+    else if (result.dependencyScan) {
+        console.log(`  ${result.dependencyScan.message}`);
+    }
+    if (result.dependencyScan?.localPackages.length) {
+        const local = result.dependencyScan.localPackages;
+        console.log(`  Local packages (not OSV subjects, excluded): ${local.slice(0, 10).map(p => `${p.member ? `${p.member}: ` : ''}${p.name}`).join(', ')}${local.length > 10 ? ` ... and ${local.length - 10} more` : ''}`);
+    }
+    for (const problem of result.dependencyScan?.resolutionErrors ?? []) {
+        console.log(chalk.yellow(`    incomplete: ${problem}`));
+    }
     for (const limitation of limitations.slice(0, 10))
         console.log(chalk.yellow(`  ${limitation}`));
     if (limitations.length > 10)

package/dist/cli/handlers/init-guard.d.ts

@@ -8,6 +8,26 @@
  *
  * @module cli/handlers/init-guard
  */
-/** Error message when `cwd` must not be initialized, otherwise null. */
+/** The explicit root is also the destination for all init-generated files. */
+export declare function initProjectRoot(cwd?: string, env?: NodeJS.ProcessEnv): string;
+/**
+ * Error message when `projectRoot` must not be initialized, otherwise null.
+ *
+ * An explicit root (`AQE_PROJECT_ROOT`) is refused only when it is a hard-stop
+ * directory (OS temp dir, `/`, `/home`, ...), or a sticky world-writable
+ * directory WITHOUT `.git`. This mirrors `findProjectRoot`, which keeps a
+ * sticky (mode 1777) directory that is itself a repo root as its own root, so
+ * the explicit root stays the escape hatch for such a repository. A derived
+ * root (the cwd) keeps the stricter rule: any shared directory is refused.
+ */
+export declare function sharedRootInitError(projectRoot: string, explicit: boolean): string | null;
+/** Error message when the selected root must not be initialized, otherwise null. */
 export declare function sharedDirInitError(cwd: string, env?: NodeJS.ProcessEnv): string | null;
+/**
+ * Error message when an explicit `AQE_PROJECT_ROOT` is not an existing
+ * directory, otherwise null. A typo must not silently create and initialize a
+ * new project somewhere else. Must run before anything creates the root (the
+ * CLI's token bootstrap does `mkdir -p <root>/.agentic-qe` at startup).
+ */
+export declare function explicitRootError(cwd?: string, env?: NodeJS.ProcessEnv): string | null;
 //# sourceMappingURL=init-guard.d.ts.map

package/dist/cli/handlers/init-guard.js

@@ -8,16 +8,59 @@
  *
  * @module cli/handlers/init-guard
  */
-import { isSharedSystemDir } from '../../kernel/shared-dirs.js';
-/** Error message when `cwd` must not be initialized, otherwise null. */
-export function sharedDirInitError(cwd, env = process.env) {
-    if (env.AQE_PROJECT_ROOT)
-        return null;
-    if (!isSharedSystemDir(cwd))
+import { isHardStopDir, isSharedSystemDir, isStickyWorldWritable } from '../../kernel/shared-dirs.js';
+import { existsSync, statSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+/** The explicit root is also the destination for all init-generated files. */
+export function initProjectRoot(cwd = process.cwd(), env = process.env) {
+    return resolve(cwd, env.AQE_PROJECT_ROOT || '.');
+}
+/**
+ * Error message when `projectRoot` must not be initialized, otherwise null.
+ *
+ * An explicit root (`AQE_PROJECT_ROOT`) is refused only when it is a hard-stop
+ * directory (OS temp dir, `/`, `/home`, ...), or a sticky world-writable
+ * directory WITHOUT `.git`. This mirrors `findProjectRoot`, which keeps a
+ * sticky (mode 1777) directory that is itself a repo root as its own root, so
+ * the explicit root stays the escape hatch for such a repository. A derived
+ * root (the cwd) keeps the stricter rule: any shared directory is refused.
+ */
+export function sharedRootInitError(projectRoot, explicit) {
+    const shared = explicit
+        ? isHardStopDir(projectRoot)
+            || (isStickyWorldWritable(projectRoot) && !existsSync(join(projectRoot, '.git')))
+        : isSharedSystemDir(projectRoot);
+    if (!shared)
         return null;
-    return (`Refusing to initialize in "${cwd}": it is a shared temp/system directory, ` +
+    return (`Refusing to initialize in "${projectRoot}": it is a shared temp/system directory, ` +
         'so a store here would be shared by every unrelated project below it and ' +
         'later commands would not use it. Create a project directory first ' +
-        '(mkdir my-project && cd my-project) or set AQE_PROJECT_ROOT to choose a root.');
+        '(mkdir my-project && cd my-project) or set AQE_PROJECT_ROOT to a project directory.');
+}
+/** Error message when the selected root must not be initialized, otherwise null. */
+export function sharedDirInitError(cwd, env = process.env) {
+    return sharedRootInitError(initProjectRoot(cwd, env), Boolean(env.AQE_PROJECT_ROOT));
+}
+/**
+ * Error message when an explicit `AQE_PROJECT_ROOT` is not an existing
+ * directory, otherwise null. A typo must not silently create and initialize a
+ * new project somewhere else. Must run before anything creates the root (the
+ * CLI's token bootstrap does `mkdir -p <root>/.agentic-qe` at startup).
+ */
+export function explicitRootError(cwd = process.cwd(), env = process.env) {
+    if (!env.AQE_PROJECT_ROOT)
+        return null;
+    const root = initProjectRoot(cwd, env);
+    let isDir = false;
+    try {
+        isDir = statSync(root).isDirectory();
+    }
+    catch {
+        isDir = false;
+    }
+    if (isDir)
+        return null;
+    return (`AQE_PROJECT_ROOT "${root}" is not an existing directory. ` +
+        'Create it first (mkdir -p) or correct the path; aqe init does not create the project root.');
 }
 //# sourceMappingURL=init-guard.js.map

package/dist/cli/handlers/init-handler.js

@@ -9,7 +9,7 @@ import { createRequire } from 'node:module';
 import { ALL_DOMAINS } from '../../shared/types/index.js';
 import { toErrorMessage } from '../../shared/error-utils.js';
 import { resolveInitFlags } from './init-flags.js';
-import { sharedDirInitError } from './init-guard.js';
+import { initProjectRoot, sharedRootInitError } from './init-guard.js';
 // ============================================================================
 // Init Handler
 // ============================================================================
@@ -89,9 +89,10 @@ export class InitHandler {
             });
         }
         try {
+            const projectRoot = initProjectRoot();
             // #1006 (review of #1026 N3): never initialize a store in a shared
             // temp/system dir; later commands would resolve elsewhere and ignore it.
-            const sharedDirError = sharedDirInitError(process.cwd());
+            const sharedDirError = sharedRootInitError(projectRoot, Boolean(process.env.AQE_PROJECT_ROOT));
             if (sharedDirError) {
                 console.error(chalk.red(`\n  ${sharedDirError}\n`));
                 await this.cleanupAndExit(1);
@@ -117,11 +118,11 @@ export class InitHandler {
                 console.log(chalk.blue('\n  Agentic QE v3 Initialization\n'));
                 // Use modular orchestrator for --auto or --modular
                 if (options.auto || options.modular || options.browserEngine) {
-                    await this.runModularInit(options, context);
+                    await this.runModularInit(options, context, projectRoot);
                     return;
                 }
                 // Legacy wizard mode using InitOrchestrator
-                await this.runLegacyWizard(options, context);
+                await this.runLegacyWizard(options, context, projectRoot);
                 return;
             }
             // Platform provisioning (--with-opencode, --with-n8n, --with-<editor>, ...)
@@ -144,7 +145,7 @@ export class InitHandler {
             const noStatusLineRequested = flags.noStatusLine;
             if (options.browserEngine || options.modular || platformRequested || databaseFree || noClaudeRequested || noStatusLineRequested) {
                 console.log(chalk.blue('\n  Agentic QE v3 Initialization\n'));
-                await this.runModularInit(options, context);
+                await this.runModularInit(options, context, projectRoot);
                 return;
             }
             // Standard init without wizard
@@ -155,7 +156,7 @@ export class InitHandler {
             await this.cleanupAndExit(1);
         }
     }
-    async runModularInit(options, _context) {
+    async runModularInit(options, _context, projectRoot) {
         const isJsonMode = options.json === true;
         // #931/#935: commander maps --no-<name> to options.<name> === false.
         const flags = resolveInitFlags(options);
@@ -185,7 +186,7 @@ export class InitHandler {
         }
         const { createModularInitOrchestrator } = await import('../../init/orchestrator.js');
         const orchestrator = createModularInitOrchestrator({
-            projectRoot: process.cwd(),
+            projectRoot,
             autoMode: options.auto,
             upgrade: options.upgrade,
             minimal: options.minimal,
@@ -256,7 +257,7 @@ export class InitHandler {
             try {
                 const { setupClaudeFlowIntegration } = await import('../commands/claude-flow-setup.js');
                 cfResult = await setupClaudeFlowIntegration({
-                    projectRoot: process.cwd(),
+                    projectRoot,
                     force: options.withClaudeFlow,
                 });
                 if (cfResult.available) {
@@ -313,11 +314,11 @@ export class InitHandler {
         }
         await this.cleanupAndExit(0);
     }
-    async runLegacyWizard(options, _context) {
+    async runLegacyWizard(options, _context, projectRoot) {
         const flags = resolveInitFlags(options);
         const { InitOrchestrator } = await import('../../init/init-wizard.js');
         const orchestratorOptions = {
-            projectRoot: process.cwd(),
+            projectRoot,
             autoMode: options.auto,
             minimal: options.minimal,
             browserEngine: options.browserEngine,
@@ -455,62 +456,62 @@ export class InitHandler {
         }
     }
     getHelp() {
-        return `
-Initialize the AQE v3 system with various configuration options.
-
-Usage:
-  aqe init [options]
-
-Options:
-  -d, --domains <domains>    Comma-separated list of domains to enable (default: all)
-  -m, --max-agents <number>  Maximum concurrent agents (default: 15)
-  --memory <backend>         Memory backend: sqlite, agentdb, or hybrid (default: hybrid)
-  --lazy                     Enable lazy loading of domains
-  --wizard                   Run interactive setup wizard
-  --auto                     Auto-configure based on project analysis
-  -u, --upgrade              Upgrade existing installation (overwrite skills, agents, validation)
-  --minimal                  Minimal configuration (skip optional features)
-  --skip-patterns            Skip loading pre-trained patterns
+        return `
+Initialize the AQE v3 system with various configuration options.
+
+Usage:
+  aqe init [options]
+
+Options:
+  -d, --domains <domains>    Comma-separated list of domains to enable (default: all)
+  -m, --max-agents <number>  Maximum concurrent agents (default: 15)
+  --memory <backend>         Memory backend: sqlite, agentdb, or hybrid (default: hybrid)
+  --lazy                     Enable lazy loading of domains
+  --wizard                   Run interactive setup wizard
+  --auto                     Auto-configure based on project analysis
+  -u, --upgrade              Upgrade existing installation (overwrite skills, agents, validation)
+  --minimal                  Minimal configuration (skip optional features)
+  --skip-patterns            Skip loading pre-trained patterns
   --browser-engine          Install optional Vibium and browser payload
   --no-browser-engine       Skip browser setup (default)
-  --with-n8n                 Install n8n workflow testing agents and skills
+  --with-n8n                 Install n8n workflow testing agents and skills
   --with-opencode            Include OpenCode agent/skill provisioning
   --with-codex               Include OpenAI Codex hooks, instructions, skills, and MCP
   --codex-guidance <mode>    Codex AGENTS.md guidance: full, compact, or none
   --with-ruflo               Opt into Ruflo guidance and lifecycle hooks for Codex
-  --auto-migrate             Automatically migrate from v2 if detected
-  --with-claude-flow         Force Claude Flow integration setup
-  --skip-claude-flow         Skip Claude Flow integration
-  --no-mcp                   Skip MCP server config (MCP is enabled by default)
-  --with-mcp                 Add the .mcp.json entry even if the agentic-qe-fleet plugin is enabled
-                             (--no-mcp and --with-mcp cannot be combined)
-  --no-governance            Skip governance configuration (ADR-058)
-  --modular                  Use new modular init system
-
-MCP Server:
-  MCP server configuration is ENABLED BY DEFAULT. It writes .mcp.json
-  at the project root so Claude Code auto-discovers the AQE MCP server.
-  Use --no-mcp to skip if you only want CLI commands.
-  If the agentic-qe-fleet Claude Code plugin is enabled (user, project or
-  local settings), init skips the entry because the plugin already provides
-  the AQE MCP server. Use --with-mcp to add the project entry anyway.
-
-Governance:
-  Governance is ENABLED BY DEFAULT. It installs .claude/guidance/ with:
-  - constitution.md: 7 unbreakable QE invariants
-  - shards/*.shard.md: 12 domain-specific governance rules
-
-  Use --no-governance to skip, or set GOVERNANCE_*=false env vars for
-  fine-grained control over individual gates (ContinueGate, MemoryWriteGate, etc.)
-
+  --auto-migrate             Automatically migrate from v2 if detected
+  --with-claude-flow         Force Claude Flow integration setup
+  --skip-claude-flow         Skip Claude Flow integration
+  --no-mcp                   Skip MCP server config (MCP is enabled by default)
+  --with-mcp                 Add the .mcp.json entry even if the agentic-qe-fleet plugin is enabled
+                             (--no-mcp and --with-mcp cannot be combined)
+  --no-governance            Skip governance configuration (ADR-058)
+  --modular                  Use new modular init system
+
+MCP Server:
+  MCP server configuration is ENABLED BY DEFAULT. It writes .mcp.json
+  at the project root so Claude Code auto-discovers the AQE MCP server.
+  Use --no-mcp to skip if you only want CLI commands.
+  If the agentic-qe-fleet Claude Code plugin is enabled (user, project or
+  local settings), init skips the entry because the plugin already provides
+  the AQE MCP server. Use --with-mcp to add the project entry anyway.
+
+Governance:
+  Governance is ENABLED BY DEFAULT. It installs .claude/guidance/ with:
+  - constitution.md: 7 unbreakable QE invariants
+  - shards/*.shard.md: 12 domain-specific governance rules
+
+  Use --no-governance to skip, or set GOVERNANCE_*=false env vars for
+  fine-grained control over individual gates (ContinueGate, MemoryWriteGate, etc.)
+
 Examples:
   aqe init --auto            # Auto-configure based on project (keeps existing skills)
   aqe init --auto --with-codex --with-ruflo
                              # Codex plus optional Ruflo coordination
-  aqe init --auto --upgrade  # Auto-configure AND update all skills/agents
-  aqe init --upgrade         # Upgrade existing installation
-  aqe init --wizard          # Run interactive wizard
-  aqe init --domains test-generation,coverage-analysis
+  aqe init --auto --upgrade  # Auto-configure AND update all skills/agents
+  aqe init --upgrade         # Upgrade existing installation
+  aqe init --wizard          # Run interactive wizard
+  aqe init --domains test-generation,coverage-analysis
 `;
     }
 }

package/dist/cli/index.js

@@ -417,6 +417,17 @@ async function main() {
     const commandArgs = process.argv.slice(2).filter(arg => arg !== '--');
     const learningSnapshot = commandArgs[0] === 'learning'
         && (commandArgs[1] === 'backup' || commandArgs[1] === 'restore');
+    // `aqe init` must not create a mistyped AQE_PROJECT_ROOT: the token bootstrap
+    // below does `mkdir -p <root>/.agentic-qe`, so the check has to run first.
+    if (commandArgs[0] === 'init') {
+        const { explicitRootError } = await import('./handlers/init-guard.js');
+        const rootError = explicitRootError();
+        if (rootError) {
+            console.error(chalk.red(`\n  ${rootError}\n`));
+            await cleanupAndExit(1);
+            return;
+        }
+    }
     if (!learningSnapshot) {
         const { bootstrapTokenTracking } = await import('../init/token-bootstrap.js');
         await bootstrapTokenTracking({

package/dist/cli/utils/ci-output.d.ts

@@ -7,6 +7,7 @@
 import type { SecurityCoverage } from '../../domains/security-compliance/interfaces.js';
 import type { SecurityScanEvidence } from '../../domains/security-compliance/scan-evidence.js';
 import type { discoverSecurityFiles } from '../../domains/security-compliance/scan-discovery.js';
+import type { DependencyScanReport } from '../../domains/security-compliance/dependency-advisory-engine.js';
 export type OutputFormat = 'text' | 'json' | 'sarif' | 'junit' | 'markdown';
 export interface CIOutputOptions {
     format: OutputFormat;
@@ -20,6 +21,8 @@ export interface SecurityVulnerability {
     message: string;
     ruleId?: string;
     cweId?: string;
+    /** CVE id of a dependency advisory, when the advisory has one (#1049). */
+    cveId?: string;
 }
 export interface SecurityScanResult {
     vulnerabilities: SecurityVulnerability[];
@@ -38,6 +41,8 @@ export interface SecurityScanResult {
     coverage?: SecurityCoverage;
     evidence?: SecurityScanEvidence;
     discovery?: Awaited<ReturnType<typeof discoverSecurityFiles>>['discovery'];
+    /** #1049: OSV dependency advisory scan; any status but 'complete' is not a clean result. */
+    dependencyScan?: DependencyScanReport;
 }
 export type SecurityExecutionStatus = 'complete' | 'partial' | 'none' | 'failed' | 'not-run' | 'unverified';
 export interface SecurityCheckResult {

package/dist/cli/utils/ci-output.js

@@ -297,6 +297,14 @@ export function securityToMarkdown(result) {
     if (result.evidence || result.discovery) {
         md += `## Execution receipts\n\n\`\`\`json\n${toJSON({ evidence: result.evidence, discovery: result.discovery })}\n\`\`\`\n\n`;
     }
+    if (result.dependencyScan) {
+        md += `## Dependency advisories (OSV)\n\n**Status:** ${result.dependencyScan.status}\n\n${result.dependencyScan.message}\n\n`;
+        for (const pkg of result.dependencyScan.uncheckedPackages) {
+            md += `- not checked: ${pkg.name}@${pkg.version} (${pkg.reason})\n`;
+        }
+        if (result.dependencyScan.uncheckedPackages.length > 0)
+            md += '\n';
+    }
     if (result.vulnerabilities.length > 0) {
         md += `## Vulnerabilities\n\n`;
         md += `| Severity | Type | File | Line | Message |\n`;

package/dist/coordination/handlers/security-handlers.js

@@ -12,6 +12,7 @@ import { toError } from '../../shared/error-utils.js';
 import { FilePath } from '../../shared/value-objects/index.js';
 import { generateSecurityRecommendations } from './handler-utils.js';
 import { discoverSecurityFiles, isSecuritySourceFile } from '../../domains/security-compliance/scan-discovery.js';
+import { runDependencyAdvisoryScan } from '../../domains/security-compliance/dependency-advisory-engine.js';
 export function registerSecurityHandlers(ctx) {
     // Register security scan handler - REAL IMPLEMENTATION
     ctx.registerHandler('scan-security', async (task) => {
@@ -257,6 +258,13 @@ export function registerSecurityHandlers(ctx) {
                     status: payload.dast ? 'not-run' : 'disabled', scope: 'url', ruleCoverage: 'unknown',
                     errors: payload.dast ? ['DAST was requested without targetUrl.'] : [], limitations: [] });
             }
+            // #1049: OSV dependency advisories. A failed or partial lookup is a
+            // failed/partial required engine, never a completed scan with no findings.
+            let dependencyScan = null;
+            if (payload.dependencies === true) {
+                dependencyScan = await runDependencyAdvisoryScan(ctx.getSecurityScanner(), targetPath);
+                engines.push(dependencyScan.engine);
+            }
             if (payload.compliance?.length) {
                 engines.push({ id: 'compliance', requested: true, required: true, status: 'not-run',
                     scope: 'requested-files', ruleCoverage: 'unknown', errors: [],
@@ -265,7 +273,7 @@ export function registerSecurityHandlers(ctx) {
             const requestedPaths = new Set(filesToScan);
             const analyzedPaths = new Set(fileEvidence.filter(file => file.status === 'analyzed' && requestedPaths.has(file.path)).map(file => file.path));
             const requiredEngines = engines.filter(engine => engine.requested && engine.required);
-            const hasExecuted = analyzedPaths.size > 0;
+            const hasExecuted = analyzedPaths.size > 0 || (dependencyScan?.report.packagesChecked ?? 0) > 0;
             const complete = hasExecuted && requiredEngines.every(engine => engine.status === 'completed') &&
                 (!discoveryResult || discoveryResult.discovery.status === 'complete');
             const evidence = {
@@ -286,18 +294,21 @@ export function registerSecurityHandlers(ctx) {
                 low: crossLangVulns.filter(v => v.severity === 'low').length,
                 informational: crossLangVulns.filter(v => v.severity === 'informational').length,
             };
+            const depVulns = dependencyScan?.vulnerabilities ?? [];
+            const depCount = (severity) => depVulns.filter(v => v.severity === severity).length;
             const summary = {
-                critical: (sastResult?.summary?.critical || 0) + (dastResult?.summary?.critical || 0) + crossLangSeverityCounts.critical,
-                high: (sastResult?.summary?.high || 0) + (dastResult?.summary?.high || 0) + crossLangSeverityCounts.high,
-                medium: (sastResult?.summary?.medium || 0) + (dastResult?.summary?.medium || 0) + crossLangSeverityCounts.medium,
-                low: (sastResult?.summary?.low || 0) + (dastResult?.summary?.low || 0) + crossLangSeverityCounts.low,
-                informational: (sastResult?.summary?.informational || 0) + (dastResult?.summary?.informational || 0) + crossLangSeverityCounts.informational,
+                critical: (sastResult?.summary?.critical || 0) + (dastResult?.summary?.critical || 0) + crossLangSeverityCounts.critical + depCount('critical'),
+                high: (sastResult?.summary?.high || 0) + (dastResult?.summary?.high || 0) + crossLangSeverityCounts.high + depCount('high'),
+                medium: (sastResult?.summary?.medium || 0) + (dastResult?.summary?.medium || 0) + crossLangSeverityCounts.medium + depCount('medium'),
+                low: (sastResult?.summary?.low || 0) + (dastResult?.summary?.low || 0) + crossLangSeverityCounts.low + depCount('low'),
+                informational: (sastResult?.summary?.informational || 0) + (dastResult?.summary?.informational || 0) + crossLangSeverityCounts.informational + depCount('informational'),
             };
             // Extract top vulnerabilities from all sources
             const allVulns = [
                 ...(sastResult?.vulnerabilities || []),
                 ...(dastResult?.vulnerabilities || []),
                 ...crossLangVulns,
+                ...depVulns,
             ];
             const topVulnerabilities = allVulns
                 .sort((a, b) => {
@@ -316,6 +327,9 @@ export function registerSecurityHandlers(ctx) {
             const recommendations = allVulns.length === 0 && evidence.completeness !== 'complete'
                 ? ['No findings reported; requested analysis is incomplete or unverified. Inspect execution receipts.']
                 : generateSecurityRecommendations(allVulns);
+            if (dependencyScan && dependencyScan.report.status !== 'complete') {
+                recommendations.unshift(dependencyScan.report.message);
+            }
             return ok({
                 vulnerabilities: allVulns.length,
                 critical: summary.critical,
@@ -329,7 +343,9 @@ export function registerSecurityHandlers(ctx) {
                 scanTypes: {
                     sast: payload.sast !== false,
                     dast: payload.dast || false,
+                    dependencies: payload.dependencies === true,
                 },
+                ...(dependencyScan ? { dependencyScan: dependencyScan.report } : {}),
                 status: evidence.completeness === 'complete' ? 'completed' : evidence.completeness === 'partial' ? 'partial' : 'unavailable',
                 evidence,
                 limitations: evidence.limitations,

package/dist/coordination/protocols/defect-investigation.js

@@ -13,6 +13,7 @@ import { toError } from '../../shared/error-utils.js';
 import { LoggerFactory } from '../../logging/index.js';
 import { addToCount } from '../../shared/utils/safe-record.js';
 import { measuredFileCoverage } from '../../domains/quality-assessment/coverage-report-event.js';
+import { fileCoverageLookupKeys } from '../../domains/coverage-analysis/collected-metrics.js';
 const logger = LoggerFactory.create('defect-investigation');
 export const DefectInvestigationEvents = {
     DefectInvestigationStarted: 'coordination.DefectInvestigationStarted',
@@ -607,7 +608,12 @@ export class DefectInvestigationProtocol {
         try {
             // Try per-file coverage (written by coverage-analyzer and test-executor)
             // #1014: only measured records; legacy unstamped estimates are ignored.
-            const coverage = measuredFileCoverage(await this.memory.get(`coverage:file:${file}`));
+            let coverage = null;
+            for (const key of fileCoverageLookupKeys(file)) {
+                coverage = measuredFileCoverage(await this.memory.get(key));
+                if (coverage)
+                    break;
+            }
             if (!coverage) {
                 return null;
             }

package/dist/coordination/protocols/learning-consolidation.js

@@ -9,6 +9,7 @@ import { v4 as uuidv4 } from 'uuid';
 import { ok, err, ALL_DOMAINS, } from '../../shared/types/index.js';
 import { TimeRange } from '../../shared/value-objects/index.js';
 import { toError } from '../../shared/error-utils.js';
+import { readActivePatterns } from '../../domains/learning-optimization/active-patterns.js';
 const DEFAULT_CONFIG = {
     minPatternsForConsolidation: 5,
     similarityThreshold: 0.85,
@@ -139,18 +140,11 @@ export class LearningConsolidationProtocol {
      * Get patterns for a specific domain
      */
     async getPatternsForDomain(domain, timeRange) {
-        const keys = await this.memory.search(`learning:pattern:*`, 500);
-        const patterns = [];
-        for (const key of keys) {
-            const pattern = await this.memory.get(key);
-            if (pattern &&
-                pattern.domain === domain &&
-                !key.includes(':archived:') &&
-                (timeRange.contains(pattern.createdAt) || timeRange.contains(pattern.lastUsedAt))) {
-                patterns.push(pattern);
-            }
-        }
-        return patterns;
+        // #1055: active patterns only — excludes `:creation:` provenance as well
+        // as `:archived:` records, before get() and before the scan cap applies.
+        const patterns = await readActivePatterns(this.memory);
+        return patterns.filter((pattern) => pattern.domain === domain &&
+            (timeRange.contains(pattern.createdAt) || timeRange.contains(pattern.lastUsedAt)));
     }
     /**
      * Calculate statistics for a domain's patterns