agentic-qe 3.15.9 → 3.15.11

package/dist/domains/learning-optimization/services/metrics-optimizer.js

@@ -186,11 +186,21 @@ export class MetricsOptimizerService {
     async recommendStrategy(context) {
         try {
             // Search for strategies that worked well in similar contexts
-            const keys = await this.memory.search('learning:strategy:optimized:*', 100);
+            const keys = await this.memory.search('learning:strategy:optimized:*', 100, { namespace: 'learning-optimization' });
             const candidates = [];
-            for (const key of keys) {
-                const optimized = await this.memory.get(key);
-                if (optimized && optimized.confidence > 0.6) {
+            for (const found of keys) {
+                // SQLite returns bare keys; in-memory search includes the namespace.
+                // get() applies that namespace separately, as storeOptimizationResult does.
+                const prefix = 'learning-optimization:';
+                const key = found.startsWith(prefix) ? found.slice(prefix.length) : found;
+                const optimized = await this.memory.get(key, { namespace: 'learning-optimization' });
+                if (optimized
+                    && context.tags.includes(optimized.domain)
+                    && context.tags.includes(optimized.objective.metric)
+                    && (!context.objective || (context.tags.includes(context.objective.metric)
+                        && optimized.objective.metric === context.objective.metric
+                        && optimized.objective.direction === context.objective.direction))
+                    && optimized.confidence > 0.6) {
                     const contextScore = this.scoreContextMatch(optimized, context);
                     const performanceScore = optimized.improvement * optimized.confidence;
                     candidates.push({

package/dist/domains/learning-optimization/services/production-intel.js

@@ -7,6 +7,7 @@ import { ok, err } from '../../../shared/types/index.js';
 import { TimeRange } from '../../../shared/value-objects/index.js';
 import { toError } from '../../../shared/error-utils.js';
 import { rehydrateDates } from '../../../shared/utils/kv-date-rehydrate.js';
+import { createSafeRecord } from '../../../shared/utils/safe-record.js';
 const DEFAULT_CONFIG = {
     metricsRetentionDays: 90,
     anomalyThreshold: 2.5,
@@ -268,7 +269,8 @@ export class ProductionIntelService {
     async getDomainHealth(domain) {
         const timeRange = TimeRange.lastNDays(1);
         const metricsResult = await this.getMetricsHistory('*', timeRange, domain);
-        const metrics = {};
+        // #1157: metric names come from stored production metrics.
+        const metrics = createSafeRecord();
         if (metricsResult.success) {
             for (const metric of metricsResult.value) {
                 if (!metrics[metric.name]) {

package/dist/domains/security-compliance/generic-finding-dedup.d.ts

@@ -0,0 +1,40 @@
+/**
+ * #1170: drop the generic eval/exec finding that language-specific SAST
+ * already reported as code injection on the same line.
+ *
+ * The scan-security task runs text patterns over every file and SAST over
+ * JS/TS files, so one `eval()` was counted twice: once by SAST (critical,
+ * CWE-95) and once by the generic eval/exec pattern (high). Only that pair is
+ * the same finding. Other generic rules (secrets, CORS, debug mode) can flag
+ * a different value or a higher severity on a line SAST also matched, so
+ * they are always kept.
+ */
+/** Title of the generic-pattern eval/exec finding in the scan-security handler. */
+export declare const GENERIC_EVAL_EXEC_TITLE = "Dangerous eval/exec usage";
+interface LocatedFinding {
+    title: string;
+    severity?: string;
+    location: {
+        file: string;
+        line?: number;
+    };
+}
+interface SastFinding {
+    severity?: string;
+    description?: string;
+    references?: readonly string[];
+    location: {
+        file: string;
+        line?: number;
+    };
+}
+/**
+ * Generic findings without the eval/exec matches SAST already reported as
+ * CWE-95 on the same real file and line, at the same or a higher severity, so
+ * dropping one never lowers what the scan reports. `isEvalOnly` says whether a generic
+ * eval/exec match is eval alone; a line that also calls exec() is kept,
+ * since SAST's eval rule does not report the exec call.
+ */
+export declare function dropGenericEvalCoveredBySast<T extends LocatedFinding>(generic: readonly T[], sast: readonly SastFinding[], isEvalOnly: (finding: T) => boolean): Promise<T[]>;
+export {};
+//# sourceMappingURL=generic-finding-dedup.d.ts.map

package/dist/domains/security-compliance/generic-finding-dedup.js

@@ -0,0 +1,63 @@
+/**
+ * #1170: drop the generic eval/exec finding that language-specific SAST
+ * already reported as code injection on the same line.
+ *
+ * The scan-security task runs text patterns over every file and SAST over
+ * JS/TS files, so one `eval()` was counted twice: once by SAST (critical,
+ * CWE-95) and once by the generic eval/exec pattern (high). Only that pair is
+ * the same finding. Other generic rules (secrets, CORS, debug mode) can flag
+ * a different value or a higher severity on a line SAST also matched, so
+ * they are always kept.
+ */
+import { realpath } from 'node:fs/promises';
+import * as path from 'node:path';
+/** Title of the generic-pattern eval/exec finding in the scan-security handler. */
+export const GENERIC_EVAL_EXEC_TITLE = 'Dangerous eval/exec usage';
+/** CWE-95 (eval injection): SAST's eval() and Function-constructor rules. */
+function isEvalInjection(finding) {
+    return /\[CWE-95\]/.test(finding.description ?? '') ||
+        (finding.references ?? []).some(ref => /\/definitions\/95\.html$/.test(ref));
+}
+const SEVERITY_RANK = {
+    informational: 0, low: 1, medium: 2, high: 3, critical: 4,
+};
+const rank = (severity) => SEVERITY_RANK[severity ?? ''] ?? -1;
+async function realPathOf(file, cache) {
+    const resolved = path.resolve(file);
+    let real = cache.get(resolved);
+    if (real === undefined) {
+        real = await realpath(resolved).catch(() => resolved);
+        cache.set(resolved, real);
+    }
+    return real;
+}
+/**
+ * Generic findings without the eval/exec matches SAST already reported as
+ * CWE-95 on the same real file and line, at the same or a higher severity, so
+ * dropping one never lowers what the scan reports. `isEvalOnly` says whether a generic
+ * eval/exec match is eval alone; a line that also calls exec() is kept,
+ * since SAST's eval rule does not report the exec call.
+ */
+export async function dropGenericEvalCoveredBySast(generic, sast, isEvalOnly) {
+    const evalSast = sast.filter(isEvalInjection);
+    if (evalSast.length === 0)
+        return [...generic];
+    const cache = new Map();
+    // Highest SAST CWE-95 severity per real file and line.
+    const covered = new Map();
+    for (const finding of evalSast) {
+        const key = `${await realPathOf(finding.location.file, cache)}:${finding.location.line ?? 0}`;
+        covered.set(key, Math.max(covered.get(key) ?? -1, rank(finding.severity)));
+    }
+    const kept = [];
+    for (const finding of generic) {
+        const key = `${await realPathOf(finding.location.file, cache)}:${finding.location.line ?? 0}`;
+        const sastRank = covered.get(key);
+        const duplicate = finding.title === GENERIC_EVAL_EXEC_TITLE && isEvalOnly(finding) &&
+            sastRank !== undefined && sastRank >= rank(finding.severity);
+        if (!duplicate)
+            kept.push(finding);
+    }
+    return kept;
+}
+//# sourceMappingURL=generic-finding-dedup.js.map

package/dist/domains/security-compliance/plugin.js

@@ -4,6 +4,8 @@
  */
 import { err } from '../../shared/types/index.js';
 import { BaseDomainPlugin } from '../domain-interface.js';
+import { FilePath } from '../../shared/value-objects/index.js';
+import { confineSastFiles, MAX_SAST_FILE_BYTES } from './sast-path-guard.js';
 import { SecurityComplianceCoordinator, } from './coordinator.js';
 import { SecurityScannerService, } from './services/security-scanner.js';
 import { SecurityAuditorService, } from './services/security-auditor.js';
@@ -97,11 +99,23 @@ export class SecurityCompliancePlugin extends BaseDomainPlugin {
                     if (!this.securityScanner) {
                         return err(new Error('Security scanner not initialized'));
                     }
-                    const files = payload.files;
-                    if (!files || files.length === 0) {
+                    const requested = payload.files;
+                    if (!requested || requested.length === 0) {
                         return err(new Error('Invalid sast-scan payload: missing files'));
                     }
-                    return this.securityScanner.scanFiles(files);
+                    // #1125: a payload that crossed a JSON boundary (task_submit,
+                    // task_orchestrate, fleet run) carries plain path strings.
+                    if (requested.some(f => typeof f === 'string' ? f.trim() === '' : !(f instanceof FilePath))) {
+                        return err(new Error('Invalid sast-scan payload: files must be non-empty file paths'));
+                    }
+                    // Every file must be a regular file inside the project, within the
+                    // size limit; otherwise nothing is read.
+                    const { accepted, skipped } = await confineSastFiles(requested.map(f => typeof f === 'string' ? f : f.value));
+                    if (skipped.length > 0) {
+                        return err(new Error(`Invalid sast-scan payload: these files cannot be scanned: ${skipped.map(s => `${s.path} (${s.reason})`).join(', ')}. ` +
+                            `Pass regular files inside the project, at most ${MAX_SAST_FILE_BYTES / (1024 * 1024)} MB each.`));
+                    }
+                    return this.securityScanner.scanFiles(accepted.map(f => FilePath.create(f)));
                 }],
             ['dast-scan', async (payload) => {
                     if (!this.securityScanner) {

package/dist/domains/security-compliance/sast-path-guard.d.ts

@@ -0,0 +1,9 @@
+import { type SkippedPayloadPath } from '../../shared/io/payload-path-guard.js';
+/** Largest file the pattern scanner reads whole into memory. */
+export declare const MAX_SAST_FILE_BYTES: number;
+export interface ConfinedSastFiles {
+    accepted: string[];
+    skipped: SkippedPayloadPath[];
+}
+export declare function confineSastFiles(paths: readonly string[], projectRoot?: string): Promise<ConfinedSastFiles>;
+//# sourceMappingURL=sast-path-guard.d.ts.map

package/dist/domains/security-compliance/sast-path-guard.js

@@ -0,0 +1,17 @@
+/**
+ * #1125 review: decide which requested files the sast-scan task may read.
+ *
+ * The task reads every file it is given. Its payload can come from MCP
+ * task_submit, so the same rule as code indexing (#1096) applies: a file is
+ * scanned only when its realpath is a regular file inside the project root's
+ * realpath. A symlink out of the project, a device such as /dev/zero or a
+ * directory is refused by name, and so is a file over the size limit.
+ */
+import { findProjectRoot } from '../../kernel/project-root.js';
+import { confinePayloadPaths, MAX_PAYLOAD_FILE_BYTES, } from '../../shared/io/payload-path-guard.js';
+/** Largest file the pattern scanner reads whole into memory. */
+export const MAX_SAST_FILE_BYTES = MAX_PAYLOAD_FILE_BYTES;
+export async function confineSastFiles(paths, projectRoot = findProjectRoot()) {
+    return confinePayloadPaths(paths, { projectRoot, maxBytes: MAX_SAST_FILE_BYTES });
+}
+//# sourceMappingURL=sast-path-guard.js.map

package/dist/domains/security-compliance/services/scanners/dast-auth-testing.js

@@ -21,43 +21,38 @@ export async function testAuthorizationBypass(parsedUrl, authHeaders, crawledUrl
     for (const endpoint of protectedEndpoints) {
         if (crawledUrls >= maxDepth * 15)
             break;
-        try {
-            const testUrl = new URL(endpoint, parsedUrl.origin).toString();
-            // Try with authentication
-            const authResponse = await fetch(testUrl, {
+        const testUrl = new URL(endpoint, parsedUrl.origin).toString();
+        // Try with authentication
+        const authResponse = await fetch(testUrl, {
+            method: 'GET',
+            headers: { ...authHeaders },
+            signal: AbortSignal.timeout(5000),
+        });
+        if (authResponse.ok) {
+            crawledUrls++;
+            // Try without authentication
+            const unauthResponse = await fetch(testUrl, {
                 method: 'GET',
-                headers: { ...authHeaders },
                 signal: AbortSignal.timeout(5000),
             });
-            if (authResponse.ok) {
-                crawledUrls++;
-                // Try without authentication
-                const unauthResponse = await fetch(testUrl, {
-                    method: 'GET',
-                    signal: AbortSignal.timeout(5000),
-                });
-                if (unauthResponse.ok && unauthResponse.status === 200) {
-                    const authText = await authResponse.text();
-                    const unauthText = await unauthResponse.text();
-                    if (authText.length > 100 && unauthText.length > 100 &&
-                        Math.abs(authText.length - unauthText.length) < authText.length * 0.1) {
-                        vulnerabilities.push({
-                            id: uuidv4(),
-                            title: 'Missing Authentication on Protected Endpoint',
-                            description: `Endpoint ${endpoint} is accessible without authentication`,
-                            severity: 'high',
-                            category: 'broken-auth',
-                            location: { file: testUrl },
-                            remediation: { description: 'Implement proper authentication checks', estimatedEffort: 'moderate', automatable: false },
-                            references: ['https://owasp.org/www-project-web-security-testing-guide/'],
-                        });
-                    }
+            if (unauthResponse.ok && unauthResponse.status === 200) {
+                const authText = await authResponse.text();
+                const unauthText = await unauthResponse.text();
+                if (authText.length > 100 && unauthText.length > 100 &&
+                    Math.abs(authText.length - unauthText.length) < authText.length * 0.1) {
+                    vulnerabilities.push({
+                        id: uuidv4(),
+                        title: 'Missing Authentication on Protected Endpoint',
+                        description: `Endpoint ${endpoint} is accessible without authentication`,
+                        severity: 'high',
+                        category: 'broken-auth',
+                        location: { file: testUrl },
+                        remediation: { description: 'Implement proper authentication checks', estimatedEffort: 'moderate', automatable: false },
+                        references: ['https://owasp.org/www-project-web-security-testing-guide/'],
+                    });
                 }
             }
         }
-        catch {
-            // Endpoint not accessible - expected
-        }
     }
     return crawledUrls;
 }
@@ -74,33 +69,28 @@ export async function testIDOR(parsedUrl, authHeaders, crawledUrls, maxDepth, vu
     for (const endpoint of idorEndpoints.slice(0, 2)) {
         if (crawledUrls >= maxDepth * 15)
             break;
-        try {
-            const testUrl = new URL(endpoint, parsedUrl.origin).toString();
-            const response = await fetch(testUrl, {
-                method: 'GET',
-                headers: { ...authHeaders },
-                signal: AbortSignal.timeout(5000),
-            });
-            if (response.ok) {
-                crawledUrls++;
-                const text = await response.text();
-                if (text.includes('email') || text.includes('password') || text.includes('phone')) {
-                    vulnerabilities.push({
-                        id: uuidv4(),
-                        title: 'Potential Insecure Direct Object Reference (IDOR)',
-                        description: `Endpoint ${endpoint} may expose other users' data`,
-                        severity: 'high',
-                        category: 'access-control',
-                        location: { file: testUrl },
-                        remediation: { description: 'Implement proper authorization checks for resource access', estimatedEffort: 'moderate', automatable: false },
-                        references: ['https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/05-Authorization_Testing/04-Testing_for_Insecure_Direct_Object_References'],
-                    });
-                }
+        const testUrl = new URL(endpoint, parsedUrl.origin).toString();
+        const response = await fetch(testUrl, {
+            method: 'GET',
+            headers: { ...authHeaders },
+            signal: AbortSignal.timeout(5000),
+        });
+        if (response.ok) {
+            crawledUrls++;
+            const text = await response.text();
+            if (text.includes('email') || text.includes('password') || text.includes('phone')) {
+                vulnerabilities.push({
+                    id: uuidv4(),
+                    title: 'Potential Insecure Direct Object Reference (IDOR)',
+                    description: `Endpoint ${endpoint} may expose other users' data`,
+                    severity: 'high',
+                    category: 'access-control',
+                    location: { file: testUrl },
+                    remediation: { description: 'Implement proper authorization checks for resource access', estimatedEffort: 'moderate', automatable: false },
+                    references: ['https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/05-Authorization_Testing/04-Testing_for_Insecure_Direct_Object_References'],
+                });
             }
         }
-        catch {
-            // Endpoint not accessible
-        }
     }
     return crawledUrls;
 }

package/dist/domains/security-compliance/services/scanners/dast-helpers.js

@@ -112,38 +112,33 @@ export async function scanSensitiveFiles(parsedUrl, crawledUrls, maxDepth, vulne
     for (const endpoint of sensitiveEndpoints) {
         if (crawledUrls >= maxDepth * 10)
             break;
-        try {
-            const testUrl = new URL(endpoint.path, parsedUrl.origin).toString();
-            const testResponse = await fetch(testUrl, {
-                method: 'GET',
-                signal: AbortSignal.timeout(5000),
-            });
-            if (testResponse.ok) {
-                crawledUrls++;
-                const text = await testResponse.text();
-                if (text.length > 20 && !text.toLowerCase().includes('not found') && !text.toLowerCase().includes('404')) {
-                    const isSensitive = endpoint.path.includes('.git') ||
-                        endpoint.path.includes('.env') ||
-                        endpoint.path.includes('.htaccess') ||
-                        endpoint.path.includes('web.config');
-                    if (isSensitive) {
-                        vulnerabilities.push({
-                            id: uuidv4(),
-                            title: `Sensitive File Exposed: ${endpoint.name}`,
-                            description: `${endpoint.name} is publicly accessible`,
-                            severity: endpoint.path.includes('.git') || endpoint.path.includes('.env') ? 'high' : 'medium',
-                            category: 'sensitive-data',
-                            location: { file: testUrl },
-                            remediation: { description: `Restrict access to ${endpoint.path}`, estimatedEffort: 'trivial', automatable: true },
-                            references: ['https://owasp.org/www-project-web-security-testing-guide/'],
-                        });
-                    }
+        const testUrl = new URL(endpoint.path, parsedUrl.origin).toString();
+        const testResponse = await fetch(testUrl, {
+            method: 'GET',
+            signal: AbortSignal.timeout(5000),
+        });
+        if (testResponse.ok) {
+            crawledUrls++;
+            const text = await testResponse.text();
+            if (text.length > 20 && !text.toLowerCase().includes('not found') && !text.toLowerCase().includes('404')) {
+                const isSensitive = endpoint.path.includes('.git') ||
+                    endpoint.path.includes('.env') ||
+                    endpoint.path.includes('.htaccess') ||
+                    endpoint.path.includes('web.config');
+                if (isSensitive) {
+                    vulnerabilities.push({
+                        id: uuidv4(),
+                        title: `Sensitive File Exposed: ${endpoint.name}`,
+                        description: `${endpoint.name} is publicly accessible`,
+                        severity: endpoint.path.includes('.git') || endpoint.path.includes('.env') ? 'high' : 'medium',
+                        category: 'sensitive-data',
+                        location: { file: testUrl },
+                        remediation: { description: `Restrict access to ${endpoint.path}`, estimatedEffort: 'trivial', automatable: true },
+                        references: ['https://owasp.org/www-project-web-security-testing-guide/'],
+                    });
                 }
             }
         }
-        catch {
-            // File not accessible - expected
-        }
     }
     return crawledUrls;
 }
@@ -154,31 +149,26 @@ export async function scanSensitiveFiles(parsedUrl, crawledUrls, maxDepth, vulne
  * Analyze CORS configuration
  */
 export async function analyzeCORS(targetUrl, vulnerabilities) {
-    try {
-        const corsResponse = await fetch(targetUrl, {
-            method: 'OPTIONS',
-            headers: {
-                'Origin': 'https://evil-attacker.com',
-                'Access-Control-Request-Method': 'GET',
-            },
-            signal: AbortSignal.timeout(5000),
+    const corsResponse = await fetch(targetUrl, {
+        method: 'OPTIONS',
+        headers: {
+            'Origin': 'https://evil-attacker.com',
+            'Access-Control-Request-Method': 'GET',
+        },
+        signal: AbortSignal.timeout(5000),
+    });
+    const allowOrigin = corsResponse.headers.get('access-control-allow-origin');
+    if (allowOrigin === '*' || allowOrigin === 'https://evil-attacker.com') {
+        vulnerabilities.push({
+            id: uuidv4(),
+            title: 'Overly Permissive CORS Policy',
+            description: allowOrigin === '*' ? 'CORS allows all origins' : 'CORS reflects arbitrary origin',
+            severity: 'medium',
+            category: 'access-control',
+            location: { file: targetUrl, snippet: `Access-Control-Allow-Origin: ${allowOrigin}` },
+            remediation: { description: 'Restrict CORS to specific trusted origins', estimatedEffort: 'minor', automatable: false },
+            references: ['https://owasp.org/www-community/attacks/CORS_OriginHeaderScrutiny'],
         });
-        const allowOrigin = corsResponse.headers.get('access-control-allow-origin');
-        if (allowOrigin === '*' || allowOrigin === 'https://evil-attacker.com') {
-            vulnerabilities.push({
-                id: uuidv4(),
-                title: 'Overly Permissive CORS Policy',
-                description: allowOrigin === '*' ? 'CORS allows all origins' : 'CORS reflects arbitrary origin',
-                severity: 'medium',
-                category: 'access-control',
-                location: { file: targetUrl, snippet: `Access-Control-Allow-Origin: ${allowOrigin}` },
-                remediation: { description: 'Restrict CORS to specific trusted origins', estimatedEffort: 'minor', automatable: false },
-                references: ['https://owasp.org/www-community/attacks/CORS_OriginHeaderScrutiny'],
-            });
-        }
-    }
-    catch {
-        // OPTIONS request failed - CORS might be properly restricted
     }
 }
 // ============================================================================
@@ -209,45 +199,40 @@ export async function extractAndCrawlLinks(html, baseUrl, currentCrawled, maxDep
     for (const path of linksToCrawl) {
         if (crawledUrls >= maxCrawl)
             break;
-        try {
-            const crawlUrl = new URL(path, baseUrl.origin).toString();
-            const crawlResponse = await fetch(crawlUrl, {
-                method: 'GET',
-                headers: { 'User-Agent': 'AgenticQE-DAST-Scanner/3.0' },
-                signal: AbortSignal.timeout(5000),
-                redirect: 'follow',
-            });
-            crawledUrls++;
-            if (crawlResponse.ok) {
-                if (path.includes('password') || path.includes('token') || path.includes('api_key')) {
-                    vulnerabilities.push({
-                        id: uuidv4(),
-                        title: 'Sensitive Data in URL Path',
-                        description: `URL path may contain sensitive parameter names: ${path}`,
-                        severity: 'medium',
-                        category: 'sensitive-data',
-                        location: { file: crawlUrl },
-                        remediation: { description: 'Avoid sensitive data in URL paths', estimatedEffort: 'minor', automatable: false },
-                        references: ['https://owasp.org/www-community/vulnerabilities/Information_exposure_through_query_strings_in_url'],
-                    });
-                }
-                const responseText = await crawlResponse.text();
-                if (responseText.includes('Index of /') || responseText.includes('Directory listing for')) {
-                    vulnerabilities.push({
-                        id: uuidv4(),
-                        title: 'Directory Listing Enabled',
-                        description: `Directory listing is enabled at: ${crawlUrl}`,
-                        severity: 'medium',
-                        category: 'security-misconfiguration',
-                        location: { file: crawlUrl },
-                        remediation: { description: 'Disable directory listing in server configuration', estimatedEffort: 'trivial', automatable: true },
-                        references: ['https://owasp.org/www-project-web-security-testing-guide/'],
-                    });
-                }
+        const crawlUrl = new URL(path, baseUrl.origin).toString();
+        const crawlResponse = await fetch(crawlUrl, {
+            method: 'GET',
+            headers: { 'User-Agent': 'AgenticQE-DAST-Scanner/3.0' },
+            signal: AbortSignal.timeout(5000),
+            redirect: 'follow',
+        });
+        crawledUrls++;
+        if (crawlResponse.ok) {
+            if (path.includes('password') || path.includes('token') || path.includes('api_key')) {
+                vulnerabilities.push({
+                    id: uuidv4(),
+                    title: 'Sensitive Data in URL Path',
+                    description: `URL path may contain sensitive parameter names: ${path}`,
+                    severity: 'medium',
+                    category: 'sensitive-data',
+                    location: { file: crawlUrl },
+                    remediation: { description: 'Avoid sensitive data in URL paths', estimatedEffort: 'minor', automatable: false },
+                    references: ['https://owasp.org/www-community/vulnerabilities/Information_exposure_through_query_strings_in_url'],
+                });
+            }
+            const responseText = await crawlResponse.text();
+            if (responseText.includes('Index of /') || responseText.includes('Directory listing for')) {
+                vulnerabilities.push({
+                    id: uuidv4(),
+                    title: 'Directory Listing Enabled',
+                    description: `Directory listing is enabled at: ${crawlUrl}`,
+                    severity: 'medium',
+                    category: 'security-misconfiguration',
+                    location: { file: crawlUrl },
+                    remediation: { description: 'Disable directory listing in server configuration', estimatedEffort: 'trivial', automatable: true },
+                    references: ['https://owasp.org/www-project-web-security-testing-guide/'],
+                });
             }
-        }
-        catch {
-            // Page not accessible
         }
     }
     return crawledUrls;