@kylecheng3146/agent-ops 0.3.3 → 0.3.5

package/dist/runtime/src/review/execute.js

@@ -1,17 +1,17 @@
 import { randomUUID } from "node:crypto";
-import { chmod, copyFile, lstat, mkdir, mkdtemp, realpath, rm, stat } from "node:fs/promises";
+import { chmod, copyFile, lstat, mkdir, mkdtemp, realpath, rm, stat, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { runVerificationCommand } from "../verify/spawn.js";
 import { redactSecrets } from "../security/redact.js";
-import { extractReviewObject } from "./extract.js";
+import { answeredNothing, conversationIdOf, deniedToolsOf, extractFinalMessage, extractJsonObject, extractReviewObject } from "./extract.js";
 import { buildTargetInvocation } from "./invocation.js";
 import { reviewReportResults, reviewReportStatus, validateReviewReport } from "./report.js";
 import { detectHostTarget, planReviewTargets } from "./roles.js";
 import { detectHostRestriction } from "./host-sandbox.js";
 import { buildAdversarialPrompt, buildReviewPrompt } from "./runner.js";
 import { MAX_ADVERSARIAL_PROMPT_BYTES } from "./runner.js";
-import { extractUsage } from "./usage.js";
+import { extractUsage, sumUsage } from "./usage.js";
 /**
  * Full repository reviews need far more headroom than the lightweight auth
  * probe. Five minutes was not enough: reviewing a real working tree, codex and
@@ -298,6 +298,43 @@ async function snapshotRepository(request, destination, options) {
     }
     return undefined;
 }
+/**
+ * What a lost turn is asked once, in its own conversation. The turn ended
+ * because a tool call was refused, and the reviewer already holds everything
+ * it inspected, so the cheapest recovery is to ask for the answer.
+ */
+/** A resumed turn only has to state an answer it already holds. */
+const NUDGE_TIMEOUT_MS = 300_000;
+const NUDGE_PROMPT = "Your previous turn ended without an answer because a tool call was refused. " +
+    "Do not call any tool. Using only what you have already inspected, reply now " +
+    "with the JSON object the schema requires and nothing else.";
+/**
+ * Keeps what a lost turn left behind. The attempt directory is removed on the
+ * way out and its log is the only record of what the turn spent its tokens on,
+ * so without this a lost turn cannot be diagnosed. Best effort: it returns the
+ * repository-relative directory, or undefined, and never changes the outcome.
+ */
+async function keepLostTurn(repositoryRoot, sessionId, log, stdout, nudge) {
+    // Named in the diagnostic, so it keeps `/` on every platform; `join` below
+    // turns it into the native path.
+    const relative = `.agent-ops/reviews/lost-turns/${sessionId}`;
+    try {
+        const directory = join(repositoryRoot, relative);
+        await mkdir(directory, { recursive: true });
+        await writeFile(join(directory, "stdout.json"), stdout);
+        if (log !== undefined) {
+            await copyFile(log, join(directory, "agy.log"));
+        }
+        if (nudge !== undefined) {
+            await writeFile(join(directory, "nudge-stdout.json"), nudge.stdout);
+            await copyFile(nudge.log, join(directory, "agy-nudge.log")).catch(() => { });
+        }
+        return relative;
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * One target's attempt at one prompt, in a throwaway home directory. Returns a
  * validated report or the reason this target produced no usable verdict; the
@@ -521,10 +558,88 @@ async function attemptTarget(request, options) {
                 payload !== undefined
                 ? ` (fields: ${Object.keys(payload).sort().join(", ")})`
                 : "";
-            return skip(reason, errors.length > 0
-                ? `${errors}${fields}`
-                : firstComplaint(spawned.stdout, spawned.stderr) ??
-                    "the answer carried no review report");
+            const lostTurn = payload === undefined && answeredNothing(target, spawned.stdout);
+            const denied = lostTurn ? deniedToolsOf(target, spawned.stdout) : [];
+            const conversationId = lostTurn ? conversationIdOf(target, spawned.stdout) : undefined;
+            let nudged;
+            let recovered;
+            if (conversationId !== undefined && request.resumeLostTurn !== false &&
+                !budgetSpent(options)) {
+                const nudgeLog = join(attemptDirectory, "agy-nudge.log");
+                const nudge = buildTargetInvocation({
+                    ...invocationRequest,
+                    prompt: NUDGE_PROMPT,
+                    conversationId,
+                    logFile: nudgeLog,
+                    repositoryRoot: snapshotRoot
+                });
+                if (nudge !== undefined) {
+                    options.onProgress?.(`${target}: turn ended without answering${denied.length > 0 ? ` (denied ${denied.join(", ")})` : ""} → resuming the conversation once`);
+                    const nudgeWatch = watchForStall(nudgeLog, options.signal, stallIdleMs);
+                    let second;
+                    try {
+                        second = await runVerificationCommand({
+                            id: `review-${request.label}-nudge`,
+                            command: nudge.command,
+                            args: [...nudge.args],
+                            cwd: executionDirectory,
+                            required: true,
+                            evidence: { kind: "exit-code" },
+                            timeoutMs: stageTimeout(options, NUDGE_TIMEOUT_MS)
+                        }, {
+                            cwd: executionDirectory,
+                            ...(options.runner === undefined ? {} : { runner: options.runner }),
+                            ...(options.outputLimitBytes === undefined
+                                ? {}
+                                : { outputLimitBytes: options.outputLimitBytes }),
+                            stdin: nudge.stdin,
+                            env: environment,
+                            replaceEnv: true,
+                            signal: nudgeWatch.signal,
+                            onActivity: nudgeWatch.beat
+                        });
+                    }
+                    finally {
+                        nudgeWatch.stop();
+                    }
+                    usage = sumUsage(usage, extractUsage(target, second.stdout, second.stderr));
+                    throwIfInterrupted(target, options, second.failureClass);
+                    nudged = { log: nudgeLog, stdout: second.stdout };
+                    if (!nudgeWatch.stalled() && second.failureClass === "none" &&
+                        !second.stdoutTruncated) {
+                        // A resumed agy turn states its answer in `response` and carries no
+                        // `structured_output`; validateReviewReport stays the authority.
+                        const finalMessage = extractFinalMessage(target, second.stdout);
+                        const answer = extractReviewObject(target, second.stdout) ??
+                            (finalMessage === undefined ? undefined : extractJsonObject(finalMessage));
+                        const checked = answer === undefined
+                            ? undefined
+                            : validateReviewReport(answer, request.expectedCriterionIds, request.changedFiles);
+                        if (checked?.ok) {
+                            recovered = checked.value;
+                        }
+                    }
+                }
+            }
+            const kept = lostTurn
+                ? await keepLostTurn(request.repositoryRoot, sessionId, agyLog, spawned.stdout, nudged)
+                : undefined;
+            if (recovered !== undefined) {
+                options.onProgress?.(`${target}: the resumed conversation answered${kept === undefined ? "" : `; lost turn kept at ${kept}`}`);
+                return { kind: "verdict", report: recovered, sessionId, metrics: metrics() };
+            }
+            return {
+                ...skip(reason, lostTurn
+                    ? "the reviewer ended its turn without answering (empty response, no structured output" +
+                        (denied.length > 0 ? `; denied ${denied.join(", ")}` : "") +
+                        ")" +
+                        (kept === undefined ? "" : `; kept ${kept}`)
+                    : errors.length > 0
+                        ? `${errors}${fields}`
+                        : firstComplaint(spawned.stdout, spawned.stderr) ??
+                            "the answer carried no review report"),
+                ...(lostTurn ? { transient: true } : {})
+            };
         }
         return {
             kind: "verdict",
@@ -539,7 +654,8 @@ async function attemptTarget(request, options) {
 }
 /**
  * `attemptTarget`, retried once in a fresh session when the service dropped
- * the call. Only once: a service that is down stays down.
+ * the call or agy ended its turn without answering. Only once: a service that
+ * is down stays down.
  */
 async function attemptTargetWithRetry(request, options) {
     const first = await attemptTarget(request, options);
@@ -547,7 +663,7 @@ async function attemptTargetWithRetry(request, options) {
         return first;
     }
     options.onProgress?.(`${request.target}: ${first.diagnostic} → retrying once`);
-    return attemptTarget(request, options);
+    return attemptTarget({ ...request, resumeLostTurn: false }, options);
 }
 /** Builds the `execute` callback with one necessary and one adversarial review. */
 export function createReviewExecutor(options) {

package/dist/runtime/src/review/extract.js

@@ -50,6 +50,46 @@ export function extractFinalMessage(target, stdout) {
 export function extractJsonObject(text) {
     return parseObject(text.trim());
 }
+/**
+ * agy's plan mode can end its one `--print` turn without answering: a valid
+ * envelope with no `structured_output` and an empty `response`. That is a lost
+ * turn, not a verdict, so a fresh session is worth one retry. Anything the
+ * target did say, or any other target, is a real protocol failure instead.
+ */
+export function answeredNothing(target, stdout) {
+    if (target !== "agy") {
+        return false;
+    }
+    const envelope = parseObject(stdout);
+    if (envelope === undefined || envelope.structured_output !== undefined) {
+        return false;
+    }
+    const response = envelope.response;
+    return response === undefined ||
+        (typeof response === "string" && response.trim().length === 0);
+}
+/** The conversation a lost agy turn can be resumed in; agy alone reports one. */
+export function conversationIdOf(target, stdout) {
+    const id = target === "agy" ? parseObject(stdout)?.conversation_id : undefined;
+    return typeof id === "string" && id.length > 0 ? id : undefined;
+}
+/**
+ * The tools agy's print mode refused because nobody could confirm them. A turn
+ * that calls one ends there, which is what a lost turn is.
+ */
+export function deniedToolsOf(target, stdout) {
+    const denied = target === "agy" ? parseObject(stdout)?.denied_actions : undefined;
+    if (!Array.isArray(denied)) {
+        return [];
+    }
+    return denied.flatMap((action) => {
+        if (!isRecord(action)) {
+            return [];
+        }
+        const name = action.display_name ?? action.action;
+        return typeof name === "string" && name.length > 0 ? [name] : [];
+    });
+}
 /**
  * Review results use a strict native structured-output transport. Unlike the
  * legacy probe parser above, this path neither recovers fenced JSON nor accepts

package/dist/runtime/src/review/invocation.js

@@ -149,6 +149,9 @@ export function buildTargetInvocation(request) {
                 ? []
                 : ["--add-dir", request.repositoryRoot]),
             ...logArgs(request.target, request.logFile),
+            ...(request.target === "agy" && request.conversationId !== undefined
+                ? ["--conversation", request.conversationId]
+                : []),
             ...isolationArgs(request.target),
             ...shared
         ],

package/dist/runtime/src/review/usage.js

@@ -69,3 +69,22 @@ export function extractUsage(target, stdout, stderr) {
         ...defined("costUsd", count(envelope?.total_cost_usd))
     });
 }
+/** Two rounds of one attempt add up; a field only one round reported stays. */
+export function sumUsage(first, second) {
+    if (first === undefined || second === undefined) {
+        return first ?? second;
+    }
+    const add = (key) => {
+        const a = first[key];
+        const b = second[key];
+        return a === undefined && b === undefined ? {} : { [key]: (a ?? 0) + (b ?? 0) };
+    };
+    return {
+        ...add("inputTokens"),
+        ...add("outputTokens"),
+        ...add("cacheReadTokens"),
+        ...add("cacheWriteTokens"),
+        ...add("totalTokens"),
+        ...add("costUsd")
+    };
+}

package/dist/runtime/src/schema/validate.js

@@ -593,7 +593,7 @@ export function validateEvidence(value) {
         "taskId",
         "testCount",
         "toolVersions"
-    ], EVIDENCE_SCHEMA_VERSION);
+    ], isRecord(value) && value.schemaVersion === 2 ? 2 : EVIDENCE_SCHEMA_VERSION);
     if (isFailure(root)) {
         return root;
     }

package/dist/runtime/src/task/completion.js

@@ -25,6 +25,8 @@ export async function checkTaskCompletionEvidence(stored, options) {
                 if (!validation.ok)
                     continue;
                 const evidence = validation.value;
+                if (command.evidence.kind === "test-count" && evidence.schemaVersion === 2)
+                    continue;
                 if (evidence.taskId === stored.task.id && evidence.criterionId === criterion.id &&
                     evidence.commandId === command.id && evidence.configHash === configHash &&
                     evidence.sourceFingerprint === sourceFingerprint &&

package/dist/runtime/src/task/service.js

@@ -4,7 +4,7 @@ import { AgentOpsError } from "../fs/paths.js";
 import { validateEvidence, validateTask } from "../schema/validate.js";
 import { renderTaskMarkdown } from "./render.js";
 import { checkTaskCompletionEvidence, findIncompleteSubtask } from "./completion.js";
-import { calculateConfigHash, FileEvidenceStore } from "../verify/evidence.js";
+import { calculateConfigHash, FileEvidenceStore, isPassingVerificationEvidence } from "../verify/evidence.js";
 import { resolveReviewScope } from "../review/scope.js";
 import { calculateSourceFingerprint } from "../verify/source-fingerprint.js";
 import { advanceFailureFingerprint } from "../verify/fingerprint.js";
@@ -353,6 +353,82 @@ export class TaskService {
             return cloneRecord(updated);
         });
     }
+    /** Append a fresh verification to a completed task without reopening it. */
+    async recordVerificationEvidence(snapshot, evidenceInput, sourceFingerprint) {
+        if (snapshot.status === "active") {
+            const result = await this.recordEvidence(snapshot.task.id, evidenceInput);
+            await this.clearFailure(snapshot.task.id);
+            return result;
+        }
+        const completion = this.#completion;
+        if (snapshot.status !== "complete" || completion === undefined) {
+            throw taskError("TASK_NOT_ACTIVE", "Completed reverification requires repository context; archived tasks are immutable.");
+        }
+        const config = await completion.loadConfig();
+        const configHash = calculateConfigHash(config);
+        if (snapshot.policyConfigHash !== configHash) {
+            throw taskError("TASK_REVERIFICATION_CHANGED", "Completed task config changed; create a new task for the new scope.");
+        }
+        const store = new FileEvidenceStore(completion.root, completion.root);
+        const matches = (value, criterionId, commandId) => {
+            const validation = validateEvidence(value);
+            return validation.ok && validation.value.taskId === snapshot.task.id &&
+                validation.value.criterionId === criterionId && validation.value.commandId === commandId &&
+                validation.value.configHash === configHash && validation.value.sourceFingerprint === sourceFingerprint
+                ? validation.value : null;
+        };
+        for (const criterion of snapshot.task.criteria) {
+            const commands = config.verification.commands.filter(({ id, required }) => required && criterion.verifierIds.includes(id));
+            if (commands.length === 0)
+                throw taskError("TASK_REVERIFICATION_CHANGED", "Completed task criteria lack required coverage.");
+            for (const command of commands) {
+                let original = false;
+                let fresh = false;
+                for (const reference of snapshot.evidence[criterion.id] ?? []) {
+                    if (reference.startsWith("review:"))
+                        continue;
+                    const evidence = matches(await store.load(reference), criterion.id, command.id);
+                    // Legacy counts identify the original scope only; they do not prove fresh PASS.
+                    if (evidence !== null && isPassingVerificationEvidence({ ...command, evidence: { kind: "exit-code" } }, evidence))
+                        original = true;
+                }
+                for (const reference of evidenceInput[criterion.id] ?? []) {
+                    const evidence = matches(await store.load(reference), criterion.id, command.id);
+                    if (evidence !== null && evidence.schemaVersion === 3 &&
+                        !snapshot.evidence[criterion.id]?.includes(reference) && isPassingVerificationEvidence(command, evidence))
+                        fresh = true;
+                }
+                if (!original || !fresh)
+                    throw taskError("TASK_REVERIFICATION_CHANGED", "Completed task source or evidence changed; fresh PASS must cover the original scope and every required verifier.");
+            }
+        }
+        const appended = normalizeEvidence(snapshot.task, evidenceInput);
+        for (const [criterionId, references] of Object.entries(appended)) {
+            for (const reference of references) {
+                const validation = validateEvidence(await store.load(reference));
+                if (!validation.ok || !snapshot.task.criteria.find(({ id }) => id === criterionId)?.verifierIds.includes(validation.value.commandId) || matches(validation.value, criterionId, validation.value.commandId) === null) {
+                    throw taskError("TASK_EVIDENCE_INVALID", "Fresh verification references must belong to this task, criterion, source and config.");
+                }
+            }
+        }
+        const scope = await resolveReviewScope({ root: completion.root, runner: completion.gitRunner,
+            ...(completion.base === undefined ? {} : { base: completion.base }) });
+        if (sourceFingerprint !== await calculateSourceFingerprint(completion.root, scope, completion.gitRunner) ||
+            configHash !== calculateConfigHash(await completion.loadConfig())) {
+            throw taskError("TASK_REVERIFICATION_CHANGED", "Source or config changed during reverification.");
+        }
+        const now = assertTimestamp(this.#now());
+        return await this.#store.mutate((state) => {
+            if (JSON.stringify(findTask(state, snapshot.task.id)) !== JSON.stringify(snapshot)) {
+                throw taskError("TASK_REVERIFICATION_STATE_CHANGED", "Task changed during reverification; retry without discarding the concurrent state.");
+            }
+            const updated = { ...snapshot, updatedAt: now, failureFingerprint: null,
+                evidence: Object.fromEntries(snapshot.task.criteria.map(({ id }) => [id,
+                    [...new Set([...(snapshot.evidence[id] ?? []), ...appended[id]])]])) };
+            replaceTask(state, updated);
+            return cloneRecord(updated);
+        });
+    }
     async archive(taskId) {
         const now = assertTimestamp(this.#now());
         return await this.#store.mutate((state) => {

package/dist/runtime/src/verify/command-executor.js

@@ -1,5 +1,5 @@
 import { runVerificationCommand } from "./spawn.js";
-import { evaluateTestCount, parseTestCount } from "./test-count.js";
+import { evaluateTestCount, parseTestSummary } from "./test-count.js";
 function classifyTestCountCode(code) {
     const classes = {
         TEST_COUNT_BELOW_MINIMUM: "test-count-below-minimum",
@@ -43,7 +43,8 @@ function classifyCommand(command, spawned) {
             testCount: null
         };
     }
-    const testCount = parseTestCount(`${spawned.stdout}\n${spawned.stderr}`);
+    const summary = parseTestSummary(`${spawned.stdout}\n${spawned.stderr}`);
+    const testCount = summary.passed;
     if (spawned.status !== "PASS") {
         return {
             status: spawned.status,
@@ -51,6 +52,9 @@ function classifyCommand(command, spawned) {
             testCount
         };
     }
+    if (summary.failed > 0) {
+        return { status: "FAIL", failureClass: "test-failures", testCount };
+    }
     const evaluation = evaluateTestCount(testCount, command.evidence.minimum);
     return {
         status: evaluation.status,

package/dist/runtime/src/verify/evidence.js

@@ -54,7 +54,8 @@ export function isPassingVerificationEvidence(command, evidence) {
         return false;
     }
     return command.evidence.kind !== "test-count" ||
-        evaluateTestCount(evidence.testCount, command.evidence.minimum).status === "PASS";
+        (evidence.schemaVersion === EVIDENCE_SCHEMA_VERSION &&
+            evaluateTestCount(evidence.testCount, command.evidence.minimum).status === "PASS");
 }
 export class FileEvidenceStore {
     #root;

package/dist/runtime/src/verify/service.js

@@ -113,6 +113,10 @@ export class VerificationService {
             throw verificationError("VERIFICATION_INPUT_INVALID", validation.errors[0]?.message ??
                 "Task and verification configuration are incompatible.");
         }
+        const missingCriteria = validation.value.criteria.filter((criterion) => !this.#options.config.verification.commands.some(({ id, required }) => required && criterion.verifierIds.includes(id)));
+        if (missingCriteria.length > 0) {
+            throw verificationError("VERIFICATION_UNKNOWN", `Criteria without required coverage: ${missingCriteria.map(({ id }) => id).join(", ")}. Configure at least one required verifier for each criterion and recreate the task; no verifier commands were run.`);
+        }
         const reviewScope = await resolveReviewScope({
             root: this.#options.root,
             runner: this.#options.gitRunner,
@@ -167,9 +171,8 @@ export class VerificationService {
                 }
             }
             if (Object.keys(taskEvidence).length > 0) {
-                await this.#options.taskService.recordEvidence(taskId, taskEvidence);
+                await this.#options.taskService.recordVerificationEvidence(stored, taskEvidence, sourceFingerprint);
             }
-            await this.#options.taskService.clearFailure(taskId);
         }
         else {
             const required = results.filter((result) => result.required);

package/dist/runtime/src/verify/test-count.js

@@ -1,108 +1,108 @@
 const MAX_SUMMARY_BYTES = 1024 * 1024;
-const NUMBER_SOURCE = String.raw `\d{1,16}`;
+const NUMBER_SOURCE = String.raw `\d+`;
 function safeCount(value) {
     const parsed = Number(value);
     return Number.isSafeInteger(parsed) && parsed >= 0
         ? parsed
         : null;
 }
-function addCandidate(candidates, source) {
-    const parsed = safeCount(source);
-    if (parsed !== null) {
-        candidates.push(parsed);
+/** Counts outcomes, never discovery totals. Conflicting summaries fail closed. */
+export function parseTestSummary(output) {
+    if (output.includes("\0") || Buffer.byteLength(output, "utf8") > MAX_SUMMARY_BYTES) {
+        return { passed: null, failed: 0 };
     }
-}
-function parsePytestSummary(line) {
-    if (!/\bin \d+(?:\.\d+)?s(?:\s|$)/u.test(line)) {
-        return null;
-    }
-    const statusPattern = new RegExp(`(${NUMBER_SOURCE}) (passed|failed|skipped|error|errors|xfailed|xpassed|deselected)`, "gu");
-    let total = 0;
-    let matched = false;
-    for (const match of line.matchAll(statusPattern)) {
-        const source = match[1];
-        const status = match[2];
-        if (source === undefined || status === undefined) {
-            return null;
+    const summaries = [];
+    let nodePassed = null;
+    let nodeFailed = 0;
+    let nodeSeen = false;
+    let invalid = false;
+    const nodeCounts = new Map();
+    for (const raw of output.replace(/\u001b\[[0-9;]*m/gu, "").split(/\r?\n/u)) {
+        const line = raw.trim();
+        const node = new RegExp(`^(?:#|ℹ) (tests|pass|fail|cancelled|skipped|todo) (${NUMBER_SOURCE})$`, "u").exec(line);
+        if (node !== null) {
+            nodeSeen = true;
+            const count = safeCount(node[2]);
+            if (count === null || (nodeCounts.has(node[1]) && nodeCounts.get(node[1]) !== count))
+                invalid = true;
+            else
+                nodeCounts.set(node[1], count);
+            continue;
         }
-        const count = safeCount(source);
-        if (count === null ||
-            (status !== "deselected" &&
-                total > Number.MAX_SAFE_INTEGER - count)) {
-            return null;
+        if (/^(?:#|ℹ) (?:tests|pass|fail|cancelled|skipped|todo)\b/u.test(line)) {
+            invalid = true;
+            continue;
         }
-        if (status !== "deselected") {
-            total += count;
+        const rust = new RegExp(`^test result: (ok|FAILED)\\. (${NUMBER_SOURCE}) passed; (${NUMBER_SOURCE}) failed;`, "u").exec(line);
+        if (rust !== null) {
+            const passed = safeCount(rust[2]);
+            const failed = safeCount(rust[3]);
+            if (passed === null || failed === null)
+                invalid = true;
+            summaries.push({ passed, failed: Math.max(failed ?? 0, rust[1] === "FAILED" ? 1 : 0) });
+            continue;
         }
-        matched = true;
-    }
-    return matched ? total : null;
-}
-function parseRustSummary(line) {
-    const match = new RegExp(`^test result: (?:ok|FAILED)\\. (${NUMBER_SOURCE}) passed; (${NUMBER_SOURCE}) failed; ${NUMBER_SOURCE} ignored; ${NUMBER_SOURCE} measured; ${NUMBER_SOURCE} filtered out$`, "u").exec(line);
-    if (match === null) {
-        return null;
+        const isJest = /^Tests:/u.test(line);
+        const isVitest = /^Tests\s+/u.test(line) && /\(\d+\)\s*$/u.test(line);
+        const isPytest = /\bin \d+(?:\.\d+)?s(?:\s|=|$)/u.test(line);
+        if (isJest || isVitest || isPytest) {
+            let passed = 0;
+            let failed = 0;
+            let matched = false;
+            let total = 0;
+            const seen = new Set();
+            for (const match of line.matchAll(new RegExp(`(${NUMBER_SOURCE}) (passed|failed|skipped|todo|error|errors|cancelled|xfailed|xpassed|deselected)\\b`, "gu"))) {
+                matched = true;
+                const count = safeCount(match[1]);
+                const status = match[2];
+                if (count === null || seen.has(status)) {
+                    invalid = true;
+                    continue;
+                }
+                seen.add(status);
+                if (status !== "deselected")
+                    total += count;
+                if (!Number.isSafeInteger(total))
+                    invalid = true;
+                if (status === "passed")
+                    passed = count;
+                if (["failed", "error", "errors", "cancelled"].includes(status)) {
+                    failed += count;
+                    if (!Number.isSafeInteger(failed))
+                        invalid = true;
+                }
+            }
+            const totalMatch = isJest ? /\b(\d+) total(?:\s|$)/u.exec(line) : isVitest ? /\((\d+)\)\s*$/u.exec(line) : null;
+            if (matched && totalMatch !== null && safeCount(totalMatch[1]) !== total)
+                invalid = true;
+            // Missing passed in a recognized outcome summary means zero passes;
+            // a discovery/total-only line gives no outcome evidence.
+            summaries.push({ passed: matched ? passed : null, failed });
+            continue;
+        }
+        if (/^collected 0 items?$/u.test(line))
+            summaries.push({ passed: 0, failed: 0 });
     }
-    const passedSource = match[1];
-    const failedSource = match[2];
-    if (passedSource === undefined || failedSource === undefined) {
-        return null;
+    if (nodeSeen) {
+        nodePassed = nodeCounts.get("pass") ?? (nodeCounts.get("tests") === 0 ? 0 : null);
+        nodeFailed = (nodeCounts.get("fail") ?? 0) + (nodeCounts.get("cancelled") ?? 0);
+        if (!Number.isSafeInteger(nodeFailed))
+            invalid = true;
+        const total = nodeCounts.get("tests");
+        const outcomes = (nodePassed ?? 0) + nodeFailed + (nodeCounts.get("skipped") ?? 0) + (nodeCounts.get("todo") ?? 0);
+        if (!Number.isSafeInteger(outcomes) || (total !== undefined && outcomes > total))
+            invalid = true;
+        summaries.push({ passed: nodePassed, failed: nodeFailed });
     }
-    const passed = safeCount(passedSource);
-    const failed = safeCount(failedSource);
-    if (passed === null ||
-        failed === null ||
-        passed > Number.MAX_SAFE_INTEGER - failed) {
-        return null;
+    const first = summaries[0];
+    const failed = summaries.some((summary) => summary.failed > 0) ? 1 : 0;
+    if (invalid || first === undefined || summaries.some((summary) => summary.passed !== first.passed || summary.failed !== first.failed)) {
+        return { passed: null, failed };
     }
-    return passed + failed;
+    return { passed: first.passed, failed: first.failed };
 }
 export function parseTestCount(output) {
-    if (output.includes("\0") ||
-        Buffer.byteLength(output, "utf8") > MAX_SUMMARY_BYTES) {
-        return null;
-    }
-    const candidates = [];
-    const nodePattern = new RegExp(`^# tests (${NUMBER_SOURCE})$`, "u");
-    const collectedPattern = new RegExp(`^collected (${NUMBER_SOURCE}) items?$`, "u");
-    const jestPattern = new RegExp(`^Tests:\\s+.*\\b(${NUMBER_SOURCE}) total(?:\\s|$)`, "u");
-    const vitestPattern = new RegExp(`^Tests\\s+.*\\((${NUMBER_SOURCE})\\)\\s*$`, "u");
-    for (const rawLine of output.split(/\r?\n/u)) {
-        const line = rawLine.trim();
-        if (line.length === 0) {
-            continue;
-        }
-        const node = nodePattern.exec(line);
-        if (node?.[1] !== undefined) {
-            addCandidate(candidates, node[1]);
-        }
-        const collected = collectedPattern.exec(line);
-        if (collected?.[1] !== undefined) {
-            addCandidate(candidates, collected[1]);
-        }
-        const jest = jestPattern.exec(line);
-        if (jest?.[1] !== undefined) {
-            addCandidate(candidates, jest[1]);
-        }
-        const vitest = vitestPattern.exec(line);
-        if (vitest?.[1] !== undefined) {
-            addCandidate(candidates, vitest[1]);
-        }
-        const pytest = parsePytestSummary(line);
-        if (pytest !== null) {
-            candidates.push(pytest);
-        }
-        const rust = parseRustSummary(line);
-        if (rust !== null) {
-            candidates.push(rust);
-        }
-    }
-    const first = candidates[0];
-    if (first === undefined ||
-        candidates.some((candidate) => candidate !== first)) {
-        return null;
-    }
-    return first;
+    return parseTestSummary(output).passed;
 }
 export function evaluateTestCount(testCount, minimum = 1) {
     if (!Number.isSafeInteger(minimum) || minimum < 0) {