agentic-qe 3.15.8 → 3.15.10

package/dist/domains/learning-optimization/services/metrics-optimizer.js

@@ -5,8 +5,8 @@
 import { v4 as uuidv4 } from 'uuid';
 import { ok, err } from '../../../shared/types/index.js';
 import { toError } from '../../../shared/error-utils.js';
-import { secureRandom } from '../../../shared/utils/crypto-random.js';
 import { rehydrateDates } from '../../../shared/utils/kv-date-rehydrate.js';
+import { partitionByRewardSource } from '../reward-source.js';
 const DEFAULT_CONFIG = {
     defaultConfidenceLevel: 0.95,
     minSamplesForOptimization: 20,
@@ -14,6 +14,12 @@ const DEFAULT_CONFIG = {
     improvementThreshold: 0.05,
     explorationRate: 0.1,
 };
+/** Namespace every optimizer record is written under. */
+const LEARNING_NS = { namespace: 'learning-optimization' };
+/** Share of the most recent experiences held out from fitting (#1099). */
+const HELD_OUT_FRACTION = 0.2;
+/** Relative tolerance within which an observed outcome matches the prediction. */
+const VALIDATION_TOLERANCE = 0.2;
 /**
  * SEC-003: Dangerous keys that could lead to prototype pollution
  */
@@ -41,29 +47,54 @@ export class MetricsOptimizerService {
     /**
      * Optimize a strategy for a given objective
      */
-    async optimizeStrategy(currentStrategy, objective, experiences) {
+    async optimizeStrategy(currentStrategy, objective, input) {
         try {
+            // #1109: fit and validate on measured outcomes only.
+            const { measured: experiences, assignedExcluded } = partitionByRewardSource(input);
             if (experiences.length < this.config.minSamplesForOptimization) {
-                return err(new Error(`Need at least ${this.config.minSamplesForOptimization} experiences for optimization`));
+                const excluded = assignedExcluded > 0
+                    ? ` (${assignedExcluded} with an assigned reward excluded)`
+                    : '';
+                return err(new Error(`Need at least ${this.config.minSamplesForOptimization} measured experiences for optimization${excluded}`));
             }
-            // Calculate current performance
-            const currentPerformance = this.evaluateStrategyPerformance(currentStrategy, experiences, objective);
+            // #1099: fit on the older experiences and validate on the most recent
+            // ones, which the fit never saw, so confidence is a held-out measurement
+            // rather than a score on the data the optimizer was fitted to.
+            const ordered = [...experiences].sort((a, b) => timeOf(a) - timeOf(b));
+            const heldOutSize = Math.max(1, Math.floor(ordered.length * HELD_OUT_FRACTION));
+            const training = ordered.slice(0, -heldOutSize);
+            const heldOut = ordered.slice(-heldOutSize);
             // Generate optimized parameters
-            const optimizedParameters = await this.optimizeParameters(currentStrategy.parameters, experiences, objective);
+            const optimizedParameters = await this.optimizeParameters(currentStrategy.parameters, training, objective);
             // Create optimized strategy
             const optimizedStrategy = {
                 name: `${currentStrategy.name}-optimized`,
                 parameters: optimizedParameters,
-                expectedOutcome: this.predictOutcome(optimizedParameters, experiences),
+                expectedOutcome: this.predictOutcome(optimizedParameters, training),
+            };
+            // Validate the fitted expectation against the held-out experiences
+            const validationResults = await this.validateOptimization(currentStrategy, optimizedStrategy, heldOut);
+            // The optimized strategy has never run, so its improvement cannot be
+            // observed. It is modelled as the change in parameter score between the
+            // two strategies on the held-out experiences, and labelled an estimate.
+            const improvement = this.calculateImprovement(this.scoreParameters(currentStrategy.parameters, heldOut, objective), this.scoreParameters(optimizedParameters, heldOut, objective), objective);
+            // Confidence is the share of held-out experiences whose observed
+            // outcome matched the fitted expectation.
+            const confidence = validationResults.length > 0
+                ? validationResults.filter((r) => r.passed).length / validationResults.length
+                : 0;
+            const unmeasured = [];
+            if (improvement === undefined)
+                unmeasured.push('improvement');
+            if (validationResults.length === 0)
+                unmeasured.push('confidence');
+            const evaluation = {
+                method: 'held-out',
+                trainingSamples: training.length,
+                heldOutSamples: heldOut.length,
+                estimated: improvement === undefined ? [] : ['improvement'],
+                ...(unmeasured.length > 0 ? { unmeasured } : {}),
             };
-            // Validate optimization
-            const validationResults = await this.validateOptimization(currentStrategy, optimizedStrategy, experiences.slice(-10) // Use recent experiences for validation
-            );
-            // Calculate improvement
-            const optimizedPerformance = this.evaluateStrategyPerformance(optimizedStrategy, experiences, objective);
-            const improvement = this.calculateImprovement(currentPerformance, optimizedPerformance, objective);
-            // Calculate confidence
-            const confidence = this.calculateOptimizationConfidence(experiences.length, improvement, validationResults);
             const domain = this.inferDomainFromExperiences(experiences);
             const result = {
                 id: uuidv4(),
@@ -71,9 +102,10 @@ export class MetricsOptimizerService {
                 objective,
                 currentStrategy,
                 optimizedStrategy,
-                improvement,
+                improvement: improvement ?? 0,
                 confidence,
                 validationResults,
+                evaluation,
             };
             // Store optimization result
             await this.storeOptimizationResult(result);
@@ -88,9 +120,24 @@ export class MetricsOptimizerService {
      */
     async runABTest(strategyA, strategyB, testConfig) {
         try {
-            // Simulate or retrieve test results
-            const metricsA = await this.collectStrategyMetrics(strategyA, testConfig.metric, testConfig.minSamples);
-            const metricsB = await this.collectStrategyMetrics(strategyB, testConfig.metric, testConfig.minSamples);
+            // Recorded observations only (#1099): never pad with simulated samples.
+            const metricsA = await this.collectStrategyMetrics(strategyA, testConfig.metric);
+            const metricsB = await this.collectStrategyMetrics(strategyB, testConfig.metric);
+            // An arm with no recorded sample is never evidence, whatever minSamples says.
+            const minSamples = Math.max(1, testConfig.minSamples);
+            if (metricsA.length < minSamples || metricsB.length < minSamples) {
+                const insufficient = {
+                    winner: 'inconclusive',
+                    evidenceStatus: 'insufficient-evidence',
+                    unmeasured: [testConfig.metric, 'stdDev', 'pValue'],
+                    strategyAMetrics: { samples: metricsA.length },
+                    strategyBMetrics: { samples: metricsB.length },
+                    sampleSizeA: metricsA.length,
+                    sampleSizeB: metricsB.length,
+                };
+                await this.storeABTestResult(strategyA, strategyB, insufficient);
+                return ok(insufficient);
+            }
             // Calculate statistics
             const meanA = this.calculateMean(metricsA);
             const meanB = this.calculateMean(metricsB);
@@ -100,7 +147,7 @@ export class MetricsOptimizerService {
             const pValue = this.calculatePValue(metricsA, metricsB);
             // Determine winner
             let winner;
-            if (pValue < 1 - testConfig.confidenceLevel) {
+            if (pValue !== undefined && pValue < 1 - testConfig.confidenceLevel) {
                 winner = meanA > meanB ? 'A' : 'B';
             }
             else {
@@ -118,7 +165,10 @@ export class MetricsOptimizerService {
                     stdDev: stdB,
                     samples: metricsB.length,
                 },
-                pValue,
+                // Neither arm varied, so the t statistic is undefined (#1099).
+                ...(pValue === undefined
+                    ? { unmeasured: ['pValue'], pValueUnavailableReason: 'zero-variance' }
+                    : { pValue }),
                 sampleSizeA: metricsA.length,
                 sampleSizeB: metricsB.length,
             };
@@ -154,7 +204,8 @@ export class MetricsOptimizerService {
                 return ok({
                     name: 'default-strategy',
                     parameters: this.getDefaultParameters(context),
-                    expectedOutcome: { success_rate: 0.7 },
+                    // #1099: nothing was measured for the default, so expect nothing.
+                    expectedOutcome: {},
                 });
             }
             // Sort by score and return best
@@ -168,8 +219,21 @@ export class MetricsOptimizerService {
     /**
      * Evaluate strategy performance
      */
-    async evaluateStrategy(strategy, experiences) {
+    async evaluateStrategy(strategy, input) {
         try {
+            // #1109: an assigned reward says nothing about how the strategy performed.
+            const { measured: experiences, assignedExcluded } = partitionByRewardSource(input);
+            if (experiences.length === 0) {
+                return ok({
+                    strategy,
+                    metrics: {},
+                    strengths: [],
+                    weaknesses: [],
+                    improvementAreas: [],
+                    evidenceStatus: 'insufficient-evidence',
+                    ...(assignedExcluded > 0 ? { assignedRewardsExcluded: assignedExcluded } : {}),
+                });
+            }
             // Calculate metrics
             const metrics = {};
             const successRate = this.calculateSuccessRate(experiences);
@@ -250,12 +314,12 @@ export class MetricsOptimizerService {
      */
     async getMetricsHistory(strategyId, limit = 100) {
         try {
-            const keys = await this.memory.search(`learning:metrics:history:${strategyId}:*`, limit);
+            const keys = await this.searchLearningKeys(`learning:metrics:history:${strategyId}:*`, limit);
             const snapshots = [];
             for (const key of keys) {
                 // #493: rehydrate `timestamp` at the kv-read seam — without this,
                 // the sort below throws once any snapshot exists in the kv.
-                const snapshot = rehydrateDates(await this.memory.get(key), ['timestamp']);
+                const snapshot = rehydrateDates(await this.memory.get(key, LEARNING_NS), ['timestamp']);
                 if (snapshot) {
                     snapshots.push(snapshot);
                 }
@@ -295,15 +359,14 @@ export class MetricsOptimizerService {
     // ============================================================================
     // Private Helper Methods
     // ============================================================================
-    evaluateStrategyPerformance(_strategy, experiences, objective) {
-        let totalScore = 0;
-        let count = 0;
-        for (const exp of experiences) {
-            const metricValue = exp.result.outcome[objective.metric] ?? 0;
-            totalScore += metricValue;
-            count++;
-        }
-        return count > 0 ? totalScore / count : 0;
+    /**
+     * Keys matching `pattern` under LEARNING_NS, ready for a namespaced get().
+     * In-memory search includes its namespace; SQLite returns a bare key.
+     */
+    async searchLearningKeys(pattern, limit) {
+        const prefix = `${LEARNING_NS.namespace}:`;
+        const found = await this.memory.search(pattern, limit, LEARNING_NS);
+        return found.map((key) => (key.startsWith(prefix) ? key.slice(prefix.length) : key));
     }
     async optimizeParameters(currentParams, experiences, objective) {
         const optimized = { ...currentParams };
@@ -391,11 +454,18 @@ export class MetricsOptimizerService {
     }
     async validateOptimization(_current, optimized, validationExperiences) {
         const results = [];
+        // Nothing was predicted, so there is nothing to validate.
+        const expected = Object.entries(optimized.expectedOutcome);
+        if (expected.length === 0)
+            return results;
         for (const exp of validationExperiences) {
-            const expected = optimized.expectedOutcome;
-            const passed = Object.entries(expected).every(([key, value]) => {
-                const actual = exp.result.outcome[key] ?? 0;
-                return Math.abs(actual - value) / Math.max(value, 1) < 0.2;
+            // A metric the experience did not record is not evidence either way.
+            const comparable = expected.filter(([key]) => typeof exp.result.outcome[key] === 'number');
+            if (comparable.length === 0)
+                continue;
+            const passed = comparable.every(([key, value]) => {
+                const actual = exp.result.outcome[key];
+                return Math.abs(actual - value) / Math.max(value, 1) < VALIDATION_TOLERANCE;
             });
             results.push({
                 testId: exp.id,
@@ -405,23 +475,14 @@ export class MetricsOptimizerService {
         }
         return results;
     }
+    /** Relative change; undefined when there is no baseline to compare with. */
     calculateImprovement(currentPerf, optimizedPerf, objective) {
         if (currentPerf === 0)
-            return optimizedPerf > 0 ? 1 : 0;
+            return undefined;
         const diff = optimizedPerf - currentPerf;
         const improvement = objective.direction === 'maximize' ? diff / currentPerf : -diff / currentPerf;
         return Math.max(-1, Math.min(1, improvement));
     }
-    calculateOptimizationConfidence(sampleSize, improvement, validationResults) {
-        // Base confidence from sample size
-        const sampleConfidence = Math.min(1, sampleSize / (this.config.minSamplesForOptimization * 2));
-        // Validation pass rate
-        const passRate = validationResults.filter((r) => r.passed).length /
-            Math.max(validationResults.length, 1);
-        // Improvement significance
-        const improvementConfidence = Math.abs(improvement) > this.config.improvementThreshold ? 1 : 0.5;
-        return sampleConfidence * 0.3 + passRate * 0.5 + improvementConfidence * 0.2;
-    }
     inferDomainFromExperiences(experiences) {
         const domainCounts = new Map();
         for (const exp of experiences) {
@@ -437,22 +498,21 @@ export class MetricsOptimizerService {
         }
         return maxDomain;
     }
-    async collectStrategyMetrics(strategy, metric, minSamples) {
-        const keys = await this.memory.search(`learning:metrics:history:*:*`, minSamples * 2);
+    /**
+     * Values of `metric` recorded for this strategy through trackMetrics(),
+     * whose strategy id is the strategy name. Only recorded observations are
+     * returned; the caller decides whether there are enough (#1099).
+     */
+    async collectStrategyMetrics(strategy, metric) {
+        const keys = await this.searchLearningKeys(`learning:metrics:history:${strategy.name}:*`, 1000);
         const metrics = [];
         for (const key of keys) {
-            const snapshot = await this.memory.get(key);
-            if (snapshot &&
-                snapshot.metrics[metric] !== undefined) {
-                metrics.push(snapshot.metrics[metric]);
+            const snapshot = await this.memory.get(key, LEARNING_NS);
+            const value = snapshot?.metrics[metric];
+            if (typeof value === 'number' && Number.isFinite(value)) {
+                metrics.push(value);
             }
         }
-        // If not enough real data, generate simulated data
-        while (metrics.length < minSamples) {
-            const expected = strategy.expectedOutcome[metric] || 0.5;
-            const variation = (secureRandom() - 0.5) * 0.2;
-            metrics.push(expected + variation);
-        }
         return metrics;
     }
     calculateMean(values) {
@@ -467,6 +527,7 @@ export class MetricsOptimizerService {
         const squaredDiffs = values.map((v) => Math.pow(v - mean, 2));
         return Math.sqrt(squaredDiffs.reduce((a, b) => a + b, 0) / values.length);
     }
+    /** Undefined when neither group varies: the test statistic is undefined. */
     calculatePValue(groupA, groupB) {
         // Simplified p-value calculation using Welch's t-test approximation
         const meanA = this.calculateMean(groupA);
@@ -477,7 +538,7 @@ export class MetricsOptimizerService {
         const nB = groupB.length;
         const se = Math.sqrt(varA / nA + varB / nB);
         if (se === 0)
-            return 0.5;
+            return undefined;
         const t = Math.abs(meanA - meanB) / se;
         // Approximate p-value using normal distribution
         const pValue = 2 * (1 - this.normalCDF(t));
@@ -590,7 +651,7 @@ export class MetricsOptimizerService {
     }
     async updateAggregatedMetrics(strategyId, metrics) {
         const key = `learning:metrics:aggregated:${strategyId}`;
-        const existing = await this.memory.get(key);
+        const existing = await this.memory.get(key, LEARNING_NS);
         const aggregated = existing?.metrics || {};
         for (const [metricName, value] of Object.entries(metrics)) {
             // SEC-003: Guard against prototype pollution
@@ -627,4 +688,9 @@ export class MetricsOptimizerService {
         }, { namespace: 'learning-optimization', ttl: 86400 * 7 });
     }
 }
+/** Epoch milliseconds of an experience; kv reads may hand back an ISO string. */
+function timeOf(experience) {
+    const ms = new Date(experience.timestamp).getTime();
+    return Number.isNaN(ms) ? 0 : ms;
+}
 //# sourceMappingURL=metrics-optimizer.js.map

package/dist/domains/learning-optimization/services/transfer-specialist.js

@@ -6,6 +6,8 @@ import { v4 as uuidv4 } from 'uuid';
 import { ok, err, ALL_DOMAINS } from '../../../shared/types/index.js';
 import { toError } from '../../../shared/error-utils.js';
 import { rehydrateDates } from '../../../shared/utils/kv-date-rehydrate.js';
+import { searchAllKeys } from '../../../shared/utils/namespaced-search.js';
+import { LEARNING_NS } from '../active-patterns.js';
 const DEFAULT_CONFIG = {
     maxKnowledgeItems: 1000,
     relevanceThreshold: 0.5,
@@ -56,32 +58,35 @@ export class TransferSpecialistService {
     async queryKnowledge(query) {
         try {
             const results = [];
-            // Search by domain if specified
-            let keys;
-            if (query.domain) {
-                keys = await this.memory.search(`learning:knowledge:*:${query.domain}:*`, query.limit || 100);
-            }
-            else {
-                keys = await this.memory.search('learning:knowledge:shared:*', query.limit || 100);
-            }
+            // Secondary domain/type indexes store IDs, not Knowledge objects, and
+            // shareKnowledge() need not create them. Read canonical shared records
+            // from the same namespace as both writers, then filter and rank before
+            // applying the caller's result limit. #1071: every key is read (the
+            // config value only sizes the first scan request), so the domain filter
+            // sees every item instead of an arbitrary first page.
+            const keys = await searchAllKeys(this.memory, 'learning:knowledge:shared:*', {
+                retrieve: LEARNING_NS,
+                pageSize: this.config.maxKnowledgeItems,
+            });
             for (const key of keys) {
                 // #493: rehydrate Date fields at the kv-read seam. `createdAt` is
                 // consumed by validateRelevance().getTime() and `expiresAt` is
                 // compared via `new Date() > knowledge.expiresAt` — both broken
                 // when the field is a string after JSON round-trip.
-                const knowledge = rehydrateDates(await this.memory.get(key), ['createdAt', 'expiresAt']);
+                const knowledge = rehydrateDates(await this.memory.get(key, { namespace: 'learning-optimization' }), ['createdAt', 'expiresAt']);
                 if (knowledge && this.matchesQuery(knowledge, query)) {
                     results.push(knowledge);
                 }
             }
-            // Sort by relevance score
-            results.sort((a, b) => b.relevanceScore - a.relevanceScore);
+            // Sort by relevance score; equal scores fall back to id order so the
+            // caller's limit always keeps the same items (#1071).
+            results.sort((a, b) => b.relevanceScore - a.relevanceScore || (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
             // Apply semantic search if embedding provided
             if (query.embedding && query.embedding.length > 0) {
                 const vectorResults = await this.memory.vectorSearch(query.embedding, query.limit || 10);
                 for (const vr of vectorResults) {
                     // #493: rehydrate Date fields at the kv-read seam.
-                    const knowledge = rehydrateDates(await this.memory.get(vr.key), ['createdAt', 'expiresAt']);
+                    const knowledge = rehydrateDates(await this.memory.get(vr.key, { namespace: 'learning-optimization' }), ['createdAt', 'expiresAt']);
                     if (knowledge &&
                         !results.some((r) => r.id === knowledge.id) &&
                         this.matchesQuery(knowledge, query)) {
@@ -253,7 +258,7 @@ export class TransferSpecialistService {
      */
     async getKnowledgeById(id) {
         // #493: rehydrate Date fields at the kv-read seam.
-        const knowledge = rehydrateDates(await this.memory.get(`learning:knowledge:shared:${id}`), ['createdAt', 'expiresAt']);
+        const knowledge = rehydrateDates(await this.memory.get(`learning:knowledge:shared:${id}`, { namespace: 'learning-optimization' }), ['createdAt', 'expiresAt']);
         return knowledge || null;
     }
     /**
@@ -261,11 +266,16 @@ export class TransferSpecialistService {
      */
     async bulkTransfer(sourceProject, targetProject, filter) {
         try {
-            const keys = await this.memory.search(`learning:knowledge:project:${sourceProject}:*`, 500);
+            // #1071: read project knowledge from the namespace it is written to
+            // below, every key, in key order. The scan is a glob (and
+            // case-insensitive on SQLite), so keep only this project's own
+            // `<prefix><id>` keys: `ALPHA` or `alpha:sub` must not leak into `alpha`.
+            const prefix = `learning:knowledge:project:${sourceProject}:`;
+            const keys = (await searchAllKeys(this.memory, `${prefix}*`, { retrieve: LEARNING_NS })).filter((key) => key.startsWith(prefix) && !key.slice(prefix.length).includes(':'));
             const results = [];
             for (const key of keys) {
                 // #493: rehydrate Date fields at the kv-read seam.
-                const knowledge = rehydrateDates(await this.memory.get(key), ['createdAt', 'expiresAt']);
+                const knowledge = rehydrateDates(await this.memory.get(key, LEARNING_NS), ['createdAt', 'expiresAt']);
                 if (!knowledge)
                     continue;
                 // Apply filter

package/dist/domains/security-compliance/plugin.js

@@ -4,6 +4,8 @@
  */
 import { err } from '../../shared/types/index.js';
 import { BaseDomainPlugin } from '../domain-interface.js';
+import { FilePath } from '../../shared/value-objects/index.js';
+import { confineSastFiles, MAX_SAST_FILE_BYTES } from './sast-path-guard.js';
 import { SecurityComplianceCoordinator, } from './coordinator.js';
 import { SecurityScannerService, } from './services/security-scanner.js';
 import { SecurityAuditorService, } from './services/security-auditor.js';
@@ -97,11 +99,23 @@ export class SecurityCompliancePlugin extends BaseDomainPlugin {
                     if (!this.securityScanner) {
                         return err(new Error('Security scanner not initialized'));
                     }
-                    const files = payload.files;
-                    if (!files || files.length === 0) {
+                    const requested = payload.files;
+                    if (!requested || requested.length === 0) {
                         return err(new Error('Invalid sast-scan payload: missing files'));
                     }
-                    return this.securityScanner.scanFiles(files);
+                    // #1125: a payload that crossed a JSON boundary (task_submit,
+                    // task_orchestrate, fleet run) carries plain path strings.
+                    if (requested.some(f => typeof f === 'string' ? f.trim() === '' : !(f instanceof FilePath))) {
+                        return err(new Error('Invalid sast-scan payload: files must be non-empty file paths'));
+                    }
+                    // Every file must be a regular file inside the project, within the
+                    // size limit; otherwise nothing is read.
+                    const { accepted, skipped } = await confineSastFiles(requested.map(f => typeof f === 'string' ? f : f.value));
+                    if (skipped.length > 0) {
+                        return err(new Error(`Invalid sast-scan payload: these files cannot be scanned: ${skipped.map(s => `${s.path} (${s.reason})`).join(', ')}. ` +
+                            `Pass regular files inside the project, at most ${MAX_SAST_FILE_BYTES / (1024 * 1024)} MB each.`));
+                    }
+                    return this.securityScanner.scanFiles(accepted.map(f => FilePath.create(f)));
                 }],
             ['dast-scan', async (payload) => {
                     if (!this.securityScanner) {

package/dist/domains/security-compliance/sast-path-guard.d.ts

@@ -0,0 +1,9 @@
+import { type SkippedPayloadPath } from '../../shared/io/payload-path-guard.js';
+/** Largest file the pattern scanner reads whole into memory. */
+export declare const MAX_SAST_FILE_BYTES: number;
+export interface ConfinedSastFiles {
+    accepted: string[];
+    skipped: SkippedPayloadPath[];
+}
+export declare function confineSastFiles(paths: readonly string[], projectRoot?: string): Promise<ConfinedSastFiles>;
+//# sourceMappingURL=sast-path-guard.d.ts.map

package/dist/domains/security-compliance/sast-path-guard.js

@@ -0,0 +1,17 @@
+/**
+ * #1125 review: decide which requested files the sast-scan task may read.
+ *
+ * The task reads every file it is given. Its payload can come from MCP
+ * task_submit, so the same rule as code indexing (#1096) applies: a file is
+ * scanned only when its realpath is a regular file inside the project root's
+ * realpath. A symlink out of the project, a device such as /dev/zero or a
+ * directory is refused by name, and so is a file over the size limit.
+ */
+import { findProjectRoot } from '../../kernel/project-root.js';
+import { confinePayloadPaths, MAX_PAYLOAD_FILE_BYTES, } from '../../shared/io/payload-path-guard.js';
+/** Largest file the pattern scanner reads whole into memory. */
+export const MAX_SAST_FILE_BYTES = MAX_PAYLOAD_FILE_BYTES;
+export async function confineSastFiles(paths, projectRoot = findProjectRoot()) {
+    return confinePayloadPaths(paths, { projectRoot, maxBytes: MAX_SAST_FILE_BYTES });
+}
+//# sourceMappingURL=sast-path-guard.js.map

package/dist/domains/security-compliance/services/scanners/dast-auth-testing.js

@@ -21,43 +21,38 @@ export async function testAuthorizationBypass(parsedUrl, authHeaders, crawledUrl
     for (const endpoint of protectedEndpoints) {
         if (crawledUrls >= maxDepth * 15)
             break;
-        try {
-            const testUrl = new URL(endpoint, parsedUrl.origin).toString();
-            // Try with authentication
-            const authResponse = await fetch(testUrl, {
+        const testUrl = new URL(endpoint, parsedUrl.origin).toString();
+        // Try with authentication
+        const authResponse = await fetch(testUrl, {
+            method: 'GET',
+            headers: { ...authHeaders },
+            signal: AbortSignal.timeout(5000),
+        });
+        if (authResponse.ok) {
+            crawledUrls++;
+            // Try without authentication
+            const unauthResponse = await fetch(testUrl, {
                 method: 'GET',
-                headers: { ...authHeaders },
                 signal: AbortSignal.timeout(5000),
             });
-            if (authResponse.ok) {
-                crawledUrls++;
-                // Try without authentication
-                const unauthResponse = await fetch(testUrl, {
-                    method: 'GET',
-                    signal: AbortSignal.timeout(5000),
-                });
-                if (unauthResponse.ok && unauthResponse.status === 200) {
-                    const authText = await authResponse.text();
-                    const unauthText = await unauthResponse.text();
-                    if (authText.length > 100 && unauthText.length > 100 &&
-                        Math.abs(authText.length - unauthText.length) < authText.length * 0.1) {
-                        vulnerabilities.push({
-                            id: uuidv4(),
-                            title: 'Missing Authentication on Protected Endpoint',
-                            description: `Endpoint ${endpoint} is accessible without authentication`,
-                            severity: 'high',
-                            category: 'broken-auth',
-                            location: { file: testUrl },
-                            remediation: { description: 'Implement proper authentication checks', estimatedEffort: 'moderate', automatable: false },
-                            references: ['https://owasp.org/www-project-web-security-testing-guide/'],
-                        });
-                    }
+            if (unauthResponse.ok && unauthResponse.status === 200) {
+                const authText = await authResponse.text();
+                const unauthText = await unauthResponse.text();
+                if (authText.length > 100 && unauthText.length > 100 &&
+                    Math.abs(authText.length - unauthText.length) < authText.length * 0.1) {
+                    vulnerabilities.push({
+                        id: uuidv4(),
+                        title: 'Missing Authentication on Protected Endpoint',
+                        description: `Endpoint ${endpoint} is accessible without authentication`,
+                        severity: 'high',
+                        category: 'broken-auth',
+                        location: { file: testUrl },
+                        remediation: { description: 'Implement proper authentication checks', estimatedEffort: 'moderate', automatable: false },
+                        references: ['https://owasp.org/www-project-web-security-testing-guide/'],
+                    });
                 }
             }
         }
-        catch {
-            // Endpoint not accessible - expected
-        }
     }
     return crawledUrls;
 }
@@ -74,33 +69,28 @@ export async function testIDOR(parsedUrl, authHeaders, crawledUrls, maxDepth, vu
     for (const endpoint of idorEndpoints.slice(0, 2)) {
         if (crawledUrls >= maxDepth * 15)
             break;
-        try {
-            const testUrl = new URL(endpoint, parsedUrl.origin).toString();
-            const response = await fetch(testUrl, {
-                method: 'GET',
-                headers: { ...authHeaders },
-                signal: AbortSignal.timeout(5000),
-            });
-            if (response.ok) {
-                crawledUrls++;
-                const text = await response.text();
-                if (text.includes('email') || text.includes('password') || text.includes('phone')) {
-                    vulnerabilities.push({
-                        id: uuidv4(),
-                        title: 'Potential Insecure Direct Object Reference (IDOR)',
-                        description: `Endpoint ${endpoint} may expose other users' data`,
-                        severity: 'high',
-                        category: 'access-control',
-                        location: { file: testUrl },
-                        remediation: { description: 'Implement proper authorization checks for resource access', estimatedEffort: 'moderate', automatable: false },
-                        references: ['https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/05-Authorization_Testing/04-Testing_for_Insecure_Direct_Object_References'],
-                    });
-                }
+        const testUrl = new URL(endpoint, parsedUrl.origin).toString();
+        const response = await fetch(testUrl, {
+            method: 'GET',
+            headers: { ...authHeaders },
+            signal: AbortSignal.timeout(5000),
+        });
+        if (response.ok) {
+            crawledUrls++;
+            const text = await response.text();
+            if (text.includes('email') || text.includes('password') || text.includes('phone')) {
+                vulnerabilities.push({
+                    id: uuidv4(),
+                    title: 'Potential Insecure Direct Object Reference (IDOR)',
+                    description: `Endpoint ${endpoint} may expose other users' data`,
+                    severity: 'high',
+                    category: 'access-control',
+                    location: { file: testUrl },
+                    remediation: { description: 'Implement proper authorization checks for resource access', estimatedEffort: 'moderate', automatable: false },
+                    references: ['https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/05-Authorization_Testing/04-Testing_for_Insecure_Direct_Object_References'],
+                });
             }
         }
-        catch {
-            // Endpoint not accessible
-        }
     }
     return crawledUrls;
 }