fix: resolve e2e integration issues found during Hermes Agent testing

[htafolla]

Summary

Found and fixed 5 issues during full integration testing of PRs #2 and #3. All 2311 tests now pass (was 2310 pass / 1 fail).

Issues Fixed

1. HIGH — Orchestrator status handler crash (status-handler.ts)

get_orchestration_status crashed with Cannot read properties of undefined (reading 'length') when looking up completed sessions.

• Root cause: formatStatusResponse accessed result.completedTasks, result.failedTasks, orchStatus.agentUtilization, and orchStatus.recentSessions without null-safe guards.
• Fix: Added ?? 0 defaults for numeric fields and || {} / || [] defaults for objects/arrays. Also added statusAny.status === 'completed' detection alongside the completed boolean.

2. MODERATE — Security scan hardcodes npm (security-scan.server.ts)

handleSecurityScan always passed "npm" to scanDependencies, ignoring yarn/pnpm projects.

• Root cause: Incomplete fix from PR fix: critical MCP server bugs for Hermes Agent compatibility #2 — handleDependencyAudit correctly uses detectPackageManager("auto") but handleSecurityScan did not.
• Fix: Added const detectedPm = this.detectPackageManager("auto") before the dependency scan call.

3. MODERATE — Failing integration test (integration.test.ts + enforcer.yml)

resolveAgent('enforcer') test failed because config.system was undefined.

• Root cause: Two bugs — (a) vi.mock path was "../mcps/agent-resolver.js" but the test imports from "../../mcps/agent-resolver.js", so the mock never intercepted; (b) enforcer.yml has no system field.
• Fix: Corrected the mock path to "../../mcps/agent-resolver.js" and added a system prompt to enforcer.yml.

4. MODERATE — analyze_complexity produces NaN scores (execution-planner.ts)

Tasks with dependencies > 0 got NaN complexity scores.

• Root cause: The analyze-complexity tool schema defines dependencies: number but OrchestrationTask typed it as string[]. When calculateTaskComplexity called task.dependencies.length on a number, it returned undefined, producing NaN.
• Fix: Updated OrchestrationTask.dependencies to string[] | number. Added Array.isArray guards in all 4 locations that access .length on dependencies (calculateTaskComplexity, createOptimizedPlan, sortByDependencies, calculateParallelPotential). Also added divide-by-zero guard in calculateParallelPotential.

5. LOW — Type safety for dependencies field (types.ts)

• Fix: OrchestrationTask.dependencies type changed from string[] to string[] | number to match both the orchestrate-task schema (string[] task IDs) and the analyze-complexity schema (number count).

Test Results

Before: 2310 pass / 1 fail / 48 skip (2359 total)
After:  2311 pass / 0 fail / 48 skip (2359 total)

TypeScript

Zero new TS errors introduced. Pre-existing downlevelIteration errors on Map<string, ...> iteration remain unchanged — these are caused by the tsconfig target not including es2015+ for iterator support and affect agent-capabilities.ts and execution-planner.ts Map iteration patterns. They do not affect runtime behavior (the code compiles and runs correctly under the actual build config).