agentic-qe 3.15.6 → 3.15.8

package/dist/mcp/entry.js

@@ -25,6 +25,7 @@ import { initFeatureFlagsFromEnv } from '../integrations/ruvector/feature-flags.
 import { resetSharedRvfAdapter } from '../integrations/ruvector/shared-rvf-adapter.js';
 import { resetSharedRvfDualWriter } from '../integrations/ruvector/shared-rvf-dual-writer.js';
 import { claimProcessLifecycle, closeRegisteredStores } from '../kernel/process-lifecycle.js';
+import { startBackgroundWorkers } from './background-workers.js';
 import { readFileSync } from 'node:fs';
 import { resolve, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -330,55 +331,9 @@ async function main() {
                 originalStderrWrite(`[MCP] WARNING: ReasoningBank prewarm failed: ${rbErr instanceof Error ? rbErr.message : 'unknown'}\n`);
             }
         })();
-        // IMP-10: Start background workers (heartbeat scheduler, etc.). In
-        // database-free mode they run against the in-memory unified store, so they
-        // persist nothing to disk while keeping QualityDaemon/health functional.
-        try {
-            const { getDaemon } = await import('../workers/daemon.js');
-            // ADR-001 Bug A fix: use the canonical getDaemon() default. Passing
-            // `{ autoStart: false }` here would neuter workerManager.startAll() —
-            // the only call path that schedules per-worker setInterval timers, so
-            // workers would register but never tick. DEFAULT_CONFIG.autoStart=true
-            // (workers/daemon.ts) is the contracted default; matches the
-            // shutdownDaemon() call site above.
-            const daemon = getDaemon();
-            await daemon.start();
-            const status = daemon.getStatus();
-            originalStderrWrite(`[MCP] Background workers started (${status.workerManager.totalWorkers} workers)\n`);
-            // IMP-10: Start QualityDaemon with persistent memory (Finding 1 & 2 resolution)
-            try {
-                const { UnifiedMemoryManager } = await import('../kernel/unified-memory.js');
-                const { PersistentWorkerMemory } = await import('../workers/quality-daemon/persistent-memory.js');
-                const { isPrivateIp } = await import('../hooks/security/ssrf-guard.js');
-                const unifiedMemory = await UnifiedMemoryManager.getInstanceAsync();
-                const persistentMemory = new PersistentWorkerMemory(unifiedMemory);
-                const qualityDaemon = daemon.getQualityDaemon({
-                    notifications: {
-                        // IMP-07 SSRF guard: block private IPs in webhook URLs (Finding 5)
-                        urlValidator: (url) => {
-                            try {
-                                const parsed = new URL(url);
-                                const hostname = parsed.hostname.replace(/^\[|\]$/g, '');
-                                return !isPrivateIp(hostname);
-                            }
-                            catch {
-                                return false;
-                            }
-                        },
-                    },
-                });
-                await qualityDaemon.start(persistentMemory);
-                originalStderrWrite(`[MCP] Quality daemon started\n`);
-            }
-            catch (qdError) {
-                originalStderrWrite(`[MCP] WARNING: Quality daemon failed to start: ${qdError}\n`);
-                // Non-fatal — MCP continues without quality daemon
-            }
-        }
-        catch (daemonError) {
-            originalStderrWrite(`[MCP] WARNING: Background workers failed to start: ${daemonError}\n`);
-            // Non-fatal — MCP server continues without background workers
-        }
+        // IMP-10: Start background workers (heartbeat scheduler, etc.) and the
+        // QualityDaemon. #1061: AQE_WORKERS_ENABLED=false skips both.
+        await startBackgroundWorkers(originalStderrWrite);
         // Start HTTP server for AG-UI/A2A/A2UI if port is specified
         const httpPort = parseInt(process.env.AQE_HTTP_PORT || '0', 10);
         if (httpPort > 0) {

package/dist/mcp/handlers/domain-handler-configs.d.ts

@@ -10,6 +10,7 @@ import { DomainHandlerConfig } from './handler-factory';
 import { TestGenerateParams, TestGenerateResult, TestExecuteParams, CoverageAnalyzeParams, CoverageAnalyzeResult, QualityAssessParams, SecurityScanParams, ContractValidateParams, AccessibilityTestParams, ChaosTestParams } from '../types';
 import type { SecurityScanEvidence } from '../../domains/security-compliance/scan-evidence.js';
 import type { SecurityCoverage } from '../../domains/security-compliance/interfaces.js';
+import type { DependencyScanReport } from '../../domains/security-compliance/dependency-advisory-engine.js';
 import type { ExcludedQualityFile, PartialQualityMetric } from '../../domains/quality-assessment/interfaces.js';
 import { type RiskDecision } from '../../contracts/verdicts.js';
 import { type EvaluatedQualityCheck } from '../../domains/quality-assessment/quality-evidence.js';
@@ -114,7 +115,10 @@ export interface SecurityScanResult {
     scanTypes?: {
         sast: boolean;
         dast: boolean;
+        dependencies?: boolean;
     };
+    /** #1049: OSV dependency advisory scan; status other than 'complete' is not a clean result. */
+    dependencyScan?: DependencyScanReport;
     note?: string;
 }
 export interface ContractValidateResult {

package/dist/mcp/handlers/domain-handler-configs.js

@@ -537,10 +537,12 @@ export const securityScanConfig = {
             scanTypes.push('SAST');
         if (params.dast)
             scanTypes.push('DAST');
+        if (params.dependencies)
+            scanTypes.push('dependency advisories');
         return `Security scan (${scanTypes.join(', ')}) for ${params.target || 'project'}`;
     },
     mapToPayload: (params, routingResult) => {
-        for (const name of ['sast', 'dast']) {
+        for (const name of ['sast', 'dast', 'dependencies']) {
             if (params[name] !== undefined && typeof params[name] !== 'boolean') {
                 throw new Error(`${name} must be a boolean`);
             }
@@ -548,6 +550,7 @@ export const securityScanConfig = {
         return {
             sast: params.sast !== false,
             dast: params.dast || false,
+            dependencies: params.dependencies === true,
             compliance: params.compliance || [],
             target: params.target || '.',
             targetUrl: params.targetUrl,
@@ -582,6 +585,7 @@ export const securityScanConfig = {
         deepAnalysisPerformed: Boolean(data.evidence && data.deepAnalysisPerformed === true),
         analysisDepth: data.analysisDepth,
         scanTypes: data.scanTypes,
+        ...(data.dependencyScan ? { dependencyScan: data.dependencyScan } : {}),
         note: data.note,
         duration,
         savedFiles,

package/dist/mcp/protocol-server.js

@@ -856,7 +856,7 @@ export class MCPProtocolServer {
         this.registerTool({
             definition: {
                 name: 'test_generate_enhanced',
-                description: 'Generate unit/integration/e2e tests with AI pattern recognition and anti-pattern detection. By default saves a manifest and report under .agentic-qe/results/tests/ (paths returned in savedFiles); pass saveResults: false to generate without writing any result files. Example: test_generate_enhanced({ sourceCode: "function add(a,b){return a+b}", testType: "unit", framework: "jest" })',
+                description: 'Generate unit/integration/e2e tests with AI pattern recognition and anti-pattern detection. By default saves a manifest and report under .agentic-qe/results/tests/, plus each generated test source under .agentic-qe/results/tests/generated/ (paths returned in savedFiles); pass saveResults: false to generate without writing any result files. Example: test_generate_enhanced({ sourceCode: "function add(a,b){return a+b}", testType: "unit", framework: "jest" })',
                 category: 'domain',
                 parameters: [
                     { name: 'sourceCode', type: 'string', description: 'Source code to generate tests for' },
@@ -938,6 +938,7 @@ export class MCPProtocolServer {
                     { name: 'dast', type: 'boolean', description: 'Run DAST scan', default: false },
                     { name: 'target', type: 'string', description: 'Source file or directory for SAST' },
                     { name: 'targetUrl', type: 'string', description: 'URL for a requested DAST scan' },
+                    { name: 'dependencies', type: 'boolean', description: 'Check package.json dependencies against OSV advisories (sends package names and versions to the OSV API). If the lookup fails or is partial, dependencyScan.status is incomplete/failed: advisories could not be checked, which is not zero vulnerabilities.', default: false },
                     saveResultsParameter('security_scan_comprehensive'),
                 ],
             },

package/dist/mcp/types.d.ts

@@ -238,6 +238,12 @@ export interface SecurityScanParams {
     target?: string;
     /** URL for explicitly requested dynamic scanning. */
     targetUrl?: string;
+    /**
+     * #1049: check package.json dependencies against OSV advisories (opt-in; sends
+     * package names and versions to the OSV API). A failed or partial lookup is
+     * reported as incomplete, never as zero vulnerabilities.
+     */
+    dependencies?: boolean;
     /** #933: write result files under .agentic-qe/results/ (default true). false skips them. */
     saveResults?: boolean;
 }

package/dist/shared/security/index.d.ts

@@ -1,8 +1,8 @@
 /**
  * Agentic QE v3 - Security Utilities
  */
-export { OSVClient } from './osv-client';
-export type { OSVClientConfig, OSVQueryRequest, OSVEcosystem, OSVVulnerability, OSVSeverity, OSVAffected, OSVRange, OSVReference, OSVQueryResponse, OSVBatchQueryRequest, OSVBatchQueryResponse, ParsedVulnerability, } from './osv-client';
+export { OSVClient, OSVLookupError, resolveOSVBaseUrl } from './osv-client';
+export type { OSVBatchLookup, OSVPackageQuery, OSVUncheckedPackage, OSVClientConfig, OSVQueryRequest, OSVEcosystem, OSVVulnerability, OSVSeverity, OSVAffected, OSVRange, OSVReference, OSVQueryResponse, OSVBatchQueryRequest, OSVBatchQueryResponse, ParsedVulnerability, } from './osv-client';
 export { CompliancePatternAnalyzer, getCompliancePatternAnalyzer } from './compliance-patterns';
 export type { PatternMatch, CompliancePatternResult, EncryptionAnalysis, AccessControlAnalysis, LoggingAnalysis, DataProtectionAnalysis, SecurityControlsAnalysis, } from './compliance-patterns';
 export type { RiskLevel, ValidationResult, PathValidationResult, RegexSafetyResult, CommandValidationResult, SanitizationOptions, PathValidationOptions, RegexValidationOptions, CommandValidationOptions, IValidationStrategy, IPathValidationStrategy, IRegexValidationStrategy, ICommandValidationStrategy, IInputSanitizationStrategy, ICryptoValidationStrategy, IValidationOrchestrator, } from './validators-interfaces';

package/dist/shared/security/index.js

@@ -1,7 +1,7 @@
 /**
  * Agentic QE v3 - Security Utilities
  */
-export { OSVClient } from './osv-client.js';
+export { OSVClient, OSVLookupError, resolveOSVBaseUrl } from './osv-client.js';
 export { CompliancePatternAnalyzer, getCompliancePatternAnalyzer } from './compliance-patterns.js';
 // ============================================================================
 // Validators (moved from mcp/security/validators/)

package/dist/shared/security/osv-client.d.ts

@@ -5,146 +5,85 @@
  * OSV provides vulnerability information for npm, PyPI, Go, Maven, and more.
  * API Documentation: https://google.github.io/osv.dev/api/
  */
-/**
- * OSV query request
- */
-export interface OSVQueryRequest {
-    /** Package name */
-    package?: {
-        name: string;
-        ecosystem: OSVEcosystem;
-        version?: string;
-    };
-    /** Git commit hash */
-    commit?: string;
-    /** Package lock file version (for version ranges) */
-    version?: string;
-}
-/**
- * Supported ecosystems
- */
-export type OSVEcosystem = 'npm' | 'PyPI' | 'Go' | 'Maven' | 'crates.io' | 'NuGet' | 'Packagist' | 'RubyGems' | 'Hex' | 'Pub';
-/**
- * OSV vulnerability record
- */
-export interface OSVVulnerability {
-    id: string;
-    summary: string;
-    details?: string;
-    aliases?: string[];
-    modified: string;
-    published?: string;
-    withdrawn?: string;
-    severity?: OSVSeverity[];
-    affected: OSVAffected[];
-    references?: OSVReference[];
-    database_specific?: Record<string, unknown>;
-}
-/**
- * OSV severity rating
- */
-export interface OSVSeverity {
-    type: 'CVSS_V2' | 'CVSS_V3';
-    score: string;
-}
-/**
- * OSV affected package information
- */
-export interface OSVAffected {
-    package: {
-        name: string;
-        ecosystem: string;
-        purl?: string;
-    };
-    ranges?: OSVRange[];
-    versions?: string[];
-    ecosystem_specific?: Record<string, unknown>;
-    database_specific?: Record<string, unknown>;
-}
-/**
- * OSV version range
- */
-export interface OSVRange {
-    type: 'SEMVER' | 'ECOSYSTEM' | 'GIT';
-    repo?: string;
-    events: Array<{
-        introduced?: string;
-        fixed?: string;
-        last_affected?: string;
-        limit?: string;
-    }>;
-}
-/**
- * OSV reference link
- */
-export interface OSVReference {
-    type: 'ADVISORY' | 'ARTICLE' | 'DETECTION' | 'DISCUSSION' | 'REPORT' | 'FIX' | 'GIT' | 'PACKAGE' | 'EVIDENCE' | 'WEB';
-    url: string;
-}
-/**
- * OSV query response
- */
-export interface OSVQueryResponse {
-    vulns: OSVVulnerability[];
-}
-/**
- * OSV batch query request
- */
-export interface OSVBatchQueryRequest {
-    queries: OSVQueryRequest[];
-}
-/**
- * OSV batch query response
- */
-export interface OSVBatchQueryResponse {
-    results: Array<{
-        vulns?: OSVVulnerability[];
-    }>;
-}
-/**
- * Parsed vulnerability for easier consumption
- */
-export interface ParsedVulnerability {
-    id: string;
-    cveIds: string[];
-    summary: string;
-    details: string;
-    severity: 'critical' | 'high' | 'medium' | 'low' | 'unknown';
-    cvssScore: number | null;
-    affectedPackage: string;
-    affectedVersions: string[];
-    fixedVersions: string[];
-    publishedDate: Date | null;
-    references: string[];
-}
+import { type OSVBatchLookup, type OSVPackageQuery } from './osv-lookup';
+export { OSVLookupError } from './osv-lookup';
+export type { OSVBatchLookup, OSVPackageQuery, OSVUncheckedPackage } from './osv-lookup';
+import type { OSVEcosystem, ParsedVulnerability } from './osv-types';
+export type { OSVQueryRequest, OSVEcosystem, OSVVulnerability, OSVSeverity, OSVAffected, OSVRange, OSVReference, OSVQueryResponse, OSVBatchQueryRequest, OSVBatchQueryResponse, ParsedVulnerability, } from './osv-types';
 /**
  * OSV API Client Configuration
  */
 export interface OSVClientConfig {
-    /** API base URL (default: https://api.osv.dev) */
+    /**
+     * API base URL (default: $AQE_OSV_API_URL, else https://api.osv.dev). Must be
+     * https, or http on a loopback host. Validated lazily at the first lookup, so
+     * an invalid value fails dependency scans only, never construction (#1049).
+     */
     baseUrl?: string;
-    /** Request timeout in ms (default: 30000) */
+    /** Idle request timeout in ms (default: 30000) */
     timeout?: number;
-    /** Enable response caching (default: true) */
+    /** Retries per request after the first attempt (default: 2) */
+    retries?: number;
+    /** Packages per querybatch request (default: 500; OSV accepts up to 1000) */
+    batchSize?: number;
+    /** Concurrent advisory-detail requests (default: 8) */
+    detailConcurrency?: number;
+    /** Enable advisory-detail caching (default: true) */
     enableCache?: boolean;
     /** Cache TTL in ms (default: 1 hour) */
     cacheTtl?: number;
 }
+/**
+ * The OSV endpoint: `AQE_OSV_API_URL` or the public API. https is required,
+ * except plain http on a loopback host (local mirrors and test stubs).
+ * @throws Error naming AQE_OSV_API_URL when the value is not acceptable.
+ */
+export declare function resolveOSVBaseUrl(env?: NodeJS.ProcessEnv): string;
+/** Longest accepted AQE_OSV_API_URL; a longer value is invalid. */
+export declare const MAX_OSV_URL_LENGTH = 2048;
 /**
  * OSV API Client
- * Queries the Open Source Vulnerabilities database for dependency vulnerabilities
+ * Queries the Open Source Vulnerabilities database for dependency vulnerabilities.
+ *
+ * #1049: a failed or partial lookup is never reported as "no vulnerabilities".
+ * `lookupBatch` returns the packages it could not check; the list-returning
+ * methods throw `OSVLookupError` instead of returning `[]`.
  */
 export declare class OSVClient {
     private readonly config;
+    private readonly configuredBaseUrl;
+    private endpoint;
     private readonly http;
-    private readonly cache;
+    private readonly detailCache;
     constructor(config?: OSVClientConfig);
+    /** The endpoint this client queries, or null when the configured URL is invalid. */
+    get baseUrl(): string | null;
+    /** Resolve (once) the endpoint; an invalid value is a reason, never a throw. */
+    private resolveEndpoint;
+    private get base();
+    /**
+     * Look up advisories for packages, reporting every package that could not be
+     * checked. Only `status: 'complete'` may be read as a clean/measured result.
+     */
+    lookupBatch(packages: OSVPackageQuery[]): Promise<OSVBatchLookup>;
+    /**
+     * Look up npm `package.json` dependencies (`name -> version spec`).
+     *
+     * A dependency is checked at its lockfile-resolved version when one is given,
+     * else only when the spec is an exact version ("1.2.3", "=1.2.3", "v1.2.3").
+     * Ranges, tags and non-registry specs are reported unchecked, never guessed:
+     * checking a range's bound (e.g. "<4.17.12" as 4.17.12) can miss advisories
+     * that affect the versions the range allows (#1049).
+     */
+    lookupNpmDependencies(dependencies: Record<string, string>, lockedVersions?: Record<string, string>): Promise<OSVBatchLookup>;
     /**
-     * Query OSV for vulnerabilities affecting a package
+     * Query OSV for vulnerabilities affecting a package.
+     * @throws OSVLookupError when the advisory lookup did not complete.
      */
     queryPackage(packageName: string, ecosystem: OSVEcosystem, version?: string): Promise<ParsedVulnerability[]>;
     /**
-     * Batch query multiple packages
+     * Batch query multiple packages.
+     * @throws OSVLookupError when any package could not be checked.
      */
     queryBatch(packages: Array<{
         name: string;
@@ -152,40 +91,48 @@ export declare class OSVClient {
         version?: string;
     }>): Promise<Map<string, ParsedVulnerability[]>>;
     /**
-     * Query vulnerabilities by CVE ID
+     * Query vulnerabilities by advisory/CVE id. An id OSV does not know (404) is [].
+     * @throws OSVLookupError on any other failure.
      */
     queryByCVE(cveId: string): Promise<ParsedVulnerability[]>;
     /**
-     * Parse npm package.json dependencies for vulnerabilities
+     * Scan npm dependencies for vulnerabilities.
+     * @throws OSVLookupError when any dependency could not be checked; use
+     *   `lookupNpmDependencies` to get partial results with the unchecked list.
      */
     scanNpmDependencies(dependencies: Record<string, string>): Promise<ParsedVulnerability[]>;
     /**
-     * Scan a Python requirements.txt file content
+     * Scan a Python requirements.txt file content. Only `==` pins are concrete
+     * versions; other requirements are reported as unchecked.
+     * @throws OSVLookupError when any requirement could not be checked.
      */
     scanPythonRequirements(requirements: string): Promise<ParsedVulnerability[]>;
+    /** Clear the advisory-detail cache. */
+    clearCache(): void;
+    private requestOptions;
+    /** Read a JSON body; any transport failure, non-2xx status or parse failure is a reason. */
+    private readJson;
+    private postBatch;
+    /** Fetch full advisory records (querybatch returns only ids) with bounded concurrency. */
+    private fetchDetails;
+    private fetchDetail;
     /**
      * Parse vulnerabilities into a more usable format
      */
     private parseVulnerabilities;
     /**
-     * Extract CVSS score from severity array
+     * Extract a numeric CVSS score. OSV usually carries a CVSS vector string
+     * ("CVSS:3.1/AV:N/..."), which holds no base score: that yields null.
      */
     private extractCVSSScore;
     /**
-     * Convert CVSS score to severity level
+     * Severity from a numeric CVSS score, else the advisory's own severity label
+     * (GitHub advisories carry `database_specific.severity`), else unknown.
      */
     private scoreSeverity;
     /**
      * Extract fixed versions from affected ranges
      */
     private extractFixedVersions;
-    /**
-     * Clean version string (remove ^ ~ etc.)
-     */
-    private cleanVersion;
-    /**
-     * Clear the cache
-     */
-    clearCache(): void;
 }
 //# sourceMappingURL=osv-client.d.ts.map