agentic-qe 3.11.3 → 3.11.5

package/dist/routing/free-tier/executor.js

@@ -34,8 +34,11 @@ export class FreeTierEscalatingExecutor {
     onOutcome;
     /** Resolved cross-model generator pool (A12); undefined ⇒ single-model best-of-k. */
     candidateProviders;
+    /** #6: optional pattern cache; undefined ⇒ caching disabled. */
+    patternCache;
     constructor(opts) {
         this.ladder = opts.ladder;
+        this.patternCache = opts.patternCache;
         this.claudeRunner = opts.claudeRunner;
         this.env = opts.env ?? process.env;
         this.onOutcome = opts.onOutcome;
@@ -124,6 +127,20 @@ export class FreeTierEscalatingExecutor {
         let passedAtStart = false;
         const t0 = Date.now();
         let result = { ok: false, content: '', tierUsed: startTier, escalated: false, repaired: false, bestOf: false, goodhartGuarded: false, attempts };
+        // #6: pattern-cache skip. A hit is only a CANDIDATE — re-verify with the same
+        // objective oracle before returning, so a stale/wrong hit falls through to
+        // real generation. Cache hits are NOT fed to the tracker/onOutcome (they are
+        // not a tier-capability signal).
+        if (this.patternCache && req.cacheText) {
+            const cached = await this.patternCache.lookup(req.cacheText);
+            if (cached !== undefined) {
+                const verdict = normalizeVerdict(await Promise.resolve(req.verify(cached)));
+                attempts.push({ tier: 'cache', provider: 'free-tier', repairRound: 0, ok: true, passed: verdict.passed, latencyMs: 0, feedback: verdict.feedback });
+                if (verdict.passed) {
+                    return { ok: true, content: cached, tierUsed: 'cache', escalated: false, repaired: false, bestOf: false, goodhartGuarded: !objectiveOracle, attempts };
+                }
+            }
+        }
         outer: for (let idx = startIdx; idx <= topIdx; idx++) {
             const tier = order[idx];
             const resolved = resolveTier(this.ladder, tier, this.env);
@@ -151,6 +168,10 @@ export class FreeTierEscalatingExecutor {
                         passedAtStart = true;
                     if (verdict.passed) {
                         result = { ok: true, content: run.content, tierUsed: tier, escalated: idx > startIdx, repaired: round > 0, bestOf: round === 0 && k > 0, goodhartGuarded: false, attempts };
+                        // #6: cache the VERIFIED output so an identical/near-identical code
+                        // under test can skip generation next time.
+                        if (this.patternCache && req.cacheText)
+                            await this.patternCache.put(req.cacheText, run.content);
                         break outer;
                     }
                     result = { ok: false, content: run.content || result.content, tierUsed: tier, escalated: idx > startIdx, repaired: round > 0, bestOf: false, goodhartGuarded: false, attempts };

package/dist/routing/free-tier/index.d.ts

@@ -10,6 +10,7 @@ export type { FreeTierKind, FreeTierProviderConfig, ResolvedFreeTierProvider, Ti
 export { FREE_TIER_PRESETS, resolveFreeTierProvider, freeTierChat, freeTierHealth, type ChatMessage, type FreeTierChatResult, } from './provider.js';
 export { defaultFreeTierLadder, validateLadder, createFreeTierEscalation, resolveTier, type ResolvedTier, } from './ladder.js';
 export { FreeTierEscalatingExecutor, type ClaudeTierRunner, type QeVerifier, type QeVerdict, type QeTaskRequest, type QeExecutionResult, type TierAttempt, type FreeTierExecutorOptions, } from './executor.js';
+export { TestGenPatternCache, normalizeCode, cosineSimilarity, type CodeEmbedder, type PatternCacheOptions, } from './pattern-cache.js';
 export { createRoutingFeedbackSink, type RoutingFeedbackLike, type FreeTierOutcomeEvent, type RoutingFeedbackSinkOptions, } from './feedback-sink.js';
 export { buildFreeTierExecutor, runFreeTierTextTask, DEFAULT_FREE_TIER_MODEL, type FreeTierCoordinatorConfig, type FreeTierLlmRouter, type BuildFreeTierExecutorOptions, } from './coordinator-support.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/routing/free-tier/index.js

@@ -1,6 +1,7 @@
 export { FREE_TIER_PRESETS, resolveFreeTierProvider, freeTierChat, freeTierHealth, } from './provider.js';
 export { defaultFreeTierLadder, validateLadder, createFreeTierEscalation, resolveTier, } from './ladder.js';
 export { FreeTierEscalatingExecutor, } from './executor.js';
+export { TestGenPatternCache, normalizeCode, cosineSimilarity, } from './pattern-cache.js';
 export { createRoutingFeedbackSink, } from './feedback-sink.js';
 export { buildFreeTierExecutor, runFreeTierTextTask, DEFAULT_FREE_TIER_MODEL, } from './coordinator-support.js';
 //# sourceMappingURL=index.js.map

package/dist/routing/free-tier/pattern-cache.d.ts

@@ -0,0 +1,57 @@
+/**
+ * ruvLLM-style test-gen pattern cache (#6).
+ *
+ * The local test-gen model is the slow part of the free tier (a thinking MoE
+ * spends ~100s/gen). This cache lets the executor SKIP generation when it has
+ * already produced a durable test for the same — or near-identical — code under
+ * test. Two tiers:
+ *   1. exact: normalized-source key match (whitespace/comments stripped).
+ *   2. similarity: cosine over an injected code embedding, ≥ threshold.
+ *
+ * SAFETY: a cache hit is only a CANDIDATE. The executor re-runs the same
+ * objective oracle on it before use, so a stale or wrong-but-similar hit simply
+ * fails verification and falls through to real generation — the cache can never
+ * bypass the oracle. Only outputs that PASSED verification are stored.
+ *
+ * Persistence: in-memory + per-process by design — it opens no database, so it
+ * does not touch the unified memory.db (ADR). A durable variant would go through
+ * the unified memory layer; out of scope here.
+ */
+/** Minimal embedder contract (subset of IEmbeddingProvider), injected & optional. */
+export interface CodeEmbedder {
+    embed(text: string): Promise<number[]>;
+}
+export interface PatternCacheOptions {
+    /** Optional embedder; without it only the exact-match tier is active. */
+    embedder?: CodeEmbedder;
+    /** Cosine threshold for a similarity hit (default 0.97 — deliberately strict). */
+    similarityThreshold?: number;
+    /** Max entries retained (LRU by insertion/last-hit); default 200. */
+    maxEntries?: number;
+}
+/** Strip line/block comments and collapse whitespace → stable exact-match key. */
+export declare function normalizeCode(code: string): string;
+/** Cosine similarity of two equal-length vectors; 0 for empty/mismatched/zero. */
+export declare function cosineSimilarity(a: number[], b: number[]): number;
+export declare class TestGenPatternCache {
+    private readonly embedder?;
+    private readonly threshold;
+    private readonly maxEntries;
+    /** key = normalized code; Map preserves insertion order for cheap LRU eviction. */
+    private readonly store;
+    private hits;
+    private misses;
+    constructor(opts?: PatternCacheOptions);
+    get stats(): {
+        size: number;
+        hits: number;
+        misses: number;
+    };
+    /** Return a cached test for `code` (exact, then similarity), or undefined. */
+    lookup(code: string): Promise<string | undefined>;
+    /** Cache a VERIFIED test for `code`. Computes an embedding when an embedder is set. */
+    put(code: string, test: string): Promise<void>;
+    private touch;
+    private evictIfNeeded;
+}
+//# sourceMappingURL=pattern-cache.d.ts.map

package/dist/routing/free-tier/pattern-cache.js

@@ -0,0 +1,148 @@
+/**
+ * ruvLLM-style test-gen pattern cache (#6).
+ *
+ * The local test-gen model is the slow part of the free tier (a thinking MoE
+ * spends ~100s/gen). This cache lets the executor SKIP generation when it has
+ * already produced a durable test for the same — or near-identical — code under
+ * test. Two tiers:
+ *   1. exact: normalized-source key match (whitespace/comments stripped).
+ *   2. similarity: cosine over an injected code embedding, ≥ threshold.
+ *
+ * SAFETY: a cache hit is only a CANDIDATE. The executor re-runs the same
+ * objective oracle on it before use, so a stale or wrong-but-similar hit simply
+ * fails verification and falls through to real generation — the cache can never
+ * bypass the oracle. Only outputs that PASSED verification are stored.
+ *
+ * Persistence: in-memory + per-process by design — it opens no database, so it
+ * does not touch the unified memory.db (ADR). A durable variant would go through
+ * the unified memory layer; out of scope here.
+ */
+/** Strip line/block comments and collapse whitespace → stable exact-match key. */
+export function normalizeCode(code) {
+    return stripBlockComments(code)
+        .replace(/\/\/[^\n]*/g, ' ') // line comments (linear, single quantifier)
+        .replace(/\s+/g, ' ')
+        .trim();
+}
+/**
+ * Remove `/* ... *\/` block comments in a single linear pass. A regex here
+ * (`/\/\*[\s\S]*?\*\//g`) backtracks polynomially on unterminated `/*` input —
+ * a ReDoS CodeQL flags — so we scan with native `indexOf` instead. An
+ * unterminated block comment is left in place, matching the old regex behavior.
+ */
+function stripBlockComments(code) {
+    let out = '';
+    let i = 0;
+    const n = code.length;
+    while (i < n) {
+        if (code.charCodeAt(i) === 47 /* / */ && code.charCodeAt(i + 1) === 42 /* * */) {
+            const end = code.indexOf('*/', i + 2);
+            if (end === -1) {
+                out += code.slice(i);
+                break;
+            } // unterminated → leave as-is
+            out += ' ';
+            i = end + 2;
+        }
+        else {
+            out += code[i];
+            i += 1;
+        }
+    }
+    return out;
+}
+/** Cosine similarity of two equal-length vectors; 0 for empty/mismatched/zero. */
+export function cosineSimilarity(a, b) {
+    if (a.length === 0 || a.length !== b.length)
+        return 0;
+    let dot = 0, na = 0, nb = 0;
+    for (let i = 0; i < a.length; i++) {
+        dot += a[i] * b[i];
+        na += a[i] * a[i];
+        nb += b[i] * b[i];
+    }
+    if (na === 0 || nb === 0)
+        return 0;
+    return dot / (Math.sqrt(na) * Math.sqrt(nb));
+}
+export class TestGenPatternCache {
+    embedder;
+    threshold;
+    maxEntries;
+    /** key = normalized code; Map preserves insertion order for cheap LRU eviction. */
+    store = new Map();
+    hits = 0;
+    misses = 0;
+    constructor(opts = {}) {
+        this.embedder = opts.embedder;
+        this.threshold = opts.similarityThreshold ?? 0.97;
+        this.maxEntries = Math.max(1, opts.maxEntries ?? 200);
+    }
+    get stats() {
+        return { size: this.store.size, hits: this.hits, misses: this.misses };
+    }
+    /** Return a cached test for `code` (exact, then similarity), or undefined. */
+    async lookup(code) {
+        const key = normalizeCode(code);
+        const exact = this.store.get(key);
+        if (exact) {
+            this.touch(key, exact);
+            this.hits++;
+            return exact.test;
+        }
+        if (this.embedder) {
+            let query;
+            try {
+                query = await this.embedder.embed(key);
+            }
+            catch {
+                this.misses++;
+                return undefined; // embedder unavailable → no similarity tier this call
+            }
+            let best;
+            for (const [k, entry] of this.store) {
+                if (!entry.embedding)
+                    continue;
+                const sim = cosineSimilarity(query, entry.embedding);
+                if (sim >= this.threshold && (!best || sim > best.sim))
+                    best = { key: k, entry, sim };
+            }
+            if (best) {
+                this.touch(best.key, best.entry);
+                this.hits++;
+                return best.entry.test;
+            }
+        }
+        this.misses++;
+        return undefined;
+    }
+    /** Cache a VERIFIED test for `code`. Computes an embedding when an embedder is set. */
+    async put(code, test) {
+        const key = normalizeCode(code);
+        let embedding;
+        if (this.embedder) {
+            try {
+                embedding = await this.embedder.embed(key);
+            }
+            catch {
+                embedding = undefined; // still cache for the exact-match tier
+            }
+        }
+        this.store.delete(key); // re-insert so it becomes most-recent
+        this.store.set(key, { test, embedding });
+        this.evictIfNeeded();
+    }
+    touch(key, entry) {
+        this.store.delete(key);
+        this.store.set(key, entry);
+    }
+    evictIfNeeded() {
+        while (this.store.size > this.maxEntries) {
+            const oldest = this.store.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.store.delete(oldest);
+        }
+    }
+}
+//# sourceMappingURL=pattern-cache.js.map

package/dist/routing/free-tier/provider.js

@@ -6,6 +6,7 @@
  * universal `/v1/chat/completions` shape (verified live against the M5 host
  * Ollama on 2026-06-19) and is reasoning-model aware.
  */
+import { resolveOllamaBaseUrl } from '../../shared/llm/ollama-url.js';
 /**
  * Endpoint presets. `local-ollama` defaults to the Docker-Desktop host gateway
  * (the M5 host) — override baseUrl to 'http://localhost:11434/v1' for a same-box
@@ -28,7 +29,14 @@ export function resolveFreeTierProvider(cfg, env = process.env) {
     const preset = FREE_TIER_PRESETS[cfg.kind];
     if (!preset)
         throw new Error(`free-tier: unknown provider kind "${cfg.kind}"`);
-    const baseUrl = (cfg.baseUrl ?? preset.baseUrl).replace(/\/$/, '');
+    // For the local Ollama preset, honour AQE_OLLAMA_URL / OLLAMA_URL (keeping the
+    // host.docker.internal default + the /v1 OpenAI-compat suffix) so the free
+    // tier follows the same single knob as every other local client. An explicit
+    // cfg.baseUrl still wins.
+    const presetBaseUrl = cfg.kind === 'local-ollama' && !cfg.baseUrl
+        ? `${resolveOllamaBaseUrl('http://host.docker.internal:11434', env)}/v1`
+        : preset.baseUrl;
+    const baseUrl = (cfg.baseUrl ?? presetBaseUrl).replace(/\/$/, '');
     if (!baseUrl) {
         throw new Error(`free-tier: kind "${cfg.kind}" requires an explicit baseUrl`);
     }

package/dist/routing/value-score.js

@@ -48,6 +48,9 @@ export function paretoFrontier(models) {
 export const MEASURED_QE_TEST_GEN = [
     { model: 'qwen3:8b', quality: 0.0, costPerInstance: 0 }, // D3: below the generation floor (0/3 valid)
     { model: 'qwen3:30b-a3b', quality: 0.62, costPerInstance: 0 }, // D3: clears the floor (best-of-k ~0.673 on judged)
+    { model: 'qwen3-coder:30b', quality: 0.62, costPerInstance: 0 }, // 2026-06-29 oracle bench: ties 30b-a3b (both 6/8, 75% mut) but ~14× faster wall-clock; default local test-gen model
+    { model: 'qwen2.5-coder:7b', quality: 0.50, costPerInstance: 0 }, // 2026-06-29: stock 7B coder = 4/8 (50%) — beats general qwen3:8b (38%), 16× faster; ~25pp below 30B (PEFT-tune target)
+    { model: 'qwen2.5-coder:1.5b', quality: 0.08, costPerInstance: 0 }, // 2026-06-29: stock 1.5B coder = 1/8 (8%); below floor, size dominates coder-tuning at tiny scale
     { model: 'z-ai/glm-5.2', quality: 0.71, costPerInstance: 0.0065 }, // A12: diverse, higher per-model best
     { model: 'claude-sonnet-4-6', quality: 0.83, costPerInstance: 0.045 }, // D3: frontier ceiling
 ];

package/dist/shared/embeddings/ollama-client.js

@@ -4,6 +4,7 @@
  */
 import { toError } from '../error-utils.js';
 import { EMBEDDING_CONFIG, } from './types';
+import { resolveOllamaBaseUrl } from '../llm/ollama-url.js';
 /**
  * Client for Ollama API
  */
@@ -12,7 +13,7 @@ export class OllamaClient {
     maxRetries;
     retryDelayMs;
     timeoutMs;
-    constructor(baseUrl = EMBEDDING_CONFIG.DEFAULT_OLLAMA_URL, maxRetries = EMBEDDING_CONFIG.MAX_RETRIES, retryDelayMs = EMBEDDING_CONFIG.RETRY_DELAY_MS, timeoutMs = EMBEDDING_CONFIG.TIMEOUT_MS) {
+    constructor(baseUrl = resolveOllamaBaseUrl(EMBEDDING_CONFIG.DEFAULT_OLLAMA_URL), maxRetries = EMBEDDING_CONFIG.MAX_RETRIES, retryDelayMs = EMBEDDING_CONFIG.RETRY_DELAY_MS, timeoutMs = EMBEDDING_CONFIG.TIMEOUT_MS) {
         this.baseUrl = baseUrl.replace(/\/$/, ''); // Remove trailing slash
         this.maxRetries = maxRetries;
         this.retryDelayMs = retryDelayMs;

package/dist/shared/events/domain-events.d.ts

@@ -10,6 +10,8 @@ export interface TestGeneratedPayload {
     framework: string;
     sourceFile: string;
     testType: 'unit' | 'integration' | 'e2e' | 'property';
+    /** ReasoningBank pattern IDs applied across the generation request (ADR-110). */
+    patternsUsed?: string[];
 }
 export interface TestSuiteCreatedPayload {
     suiteId: string;

package/dist/shared/llm/model-mapping.js

@@ -282,6 +282,32 @@ export const MODEL_MAPPINGS = {
             openrouter: 'qwen/qwen-2-7b-instruct',
         },
     },
+    // Qwen3 local models (Ollama). Canonical id == Ollama tag so normalizeModelId
+    // resolves the tags AQE's local clients actually use.
+    'qwen3:8b': {
+        canonical: 'Qwen3 8B',
+        family: 'qwen',
+        tier: 'economy',
+        providers: {
+            ollama: 'qwen3:8b',
+        },
+    },
+    'qwen3:30b-a3b': {
+        canonical: 'Qwen3 30B-A3B',
+        family: 'qwen',
+        tier: 'economy',
+        providers: {
+            ollama: 'qwen3:30b-a3b',
+        },
+    },
+    'qwen3-coder:30b': {
+        canonical: 'Qwen3 Coder 30B-A3B',
+        family: 'qwen',
+        tier: 'economy',
+        providers: {
+            ollama: 'qwen3-coder:30b',
+        },
+    },
 };
 // ============================================================================
 // Reverse Lookup Table (Provider-specific ID -> Canonical ID)

package/dist/shared/llm/model-registry.d.ts

@@ -128,6 +128,16 @@ export declare const MODEL_REGISTRY: Record<string, Omit<ModelInfo, 'id' | 'prov
  * ```
  */
 export declare function getModelCapabilities(modelId: string): ModelCapabilities;
+/**
+ * Whether a model is KNOWN to support tool / function calling.
+ *
+ * Fail-open: an unknown model id (not in the registry) returns `true` so a
+ * capability guard never strands a request on an unrecognized id — the guard
+ * only acts on models the registry explicitly marks tool-less.
+ *
+ * @param modelId - Any model ID (canonical or provider-specific)
+ */
+export declare function modelSupportsTools(modelId: string): boolean;
 /**
  * Get cost information for a model
  *

package/dist/shared/llm/model-registry.js

@@ -686,6 +686,81 @@ export const MODEL_REGISTRY = {
             outputCostPerMillion: 0,
         },
     },
+    'qwen3:8b': {
+        name: 'Qwen3 8B',
+        family: 'qwen',
+        tier: 'economy',
+        description: 'Alibaba Qwen3 8B — tools + thinking; below the QE test-gen floor (use for judge/triage)',
+        releaseDate: '2025-04-29',
+        recommended: false,
+        capabilities: {
+            contextLength: 40960,
+            maxOutputTokens: 8192,
+            supportsTools: true,
+            supportsStreaming: true,
+            supportsVision: false,
+            supportsJsonMode: true,
+            supportsSystemPrompt: true,
+            supportsExtendedThinking: true,
+            supportsMCP: false,
+            supportsEmbeddings: false,
+            supportsCodeExecution: false,
+        },
+        cost: {
+            inputCostPerMillion: 0,
+            outputCostPerMillion: 0,
+        },
+    },
+    'qwen3:30b-a3b': {
+        name: 'Qwen3 30B-A3B',
+        family: 'qwen',
+        tier: 'economy',
+        description: 'Alibaba Qwen3 30B MoE (3B active) — fast general local model; clears the QE test-gen floor',
+        releaseDate: '2025-04-29',
+        recommended: true,
+        capabilities: {
+            contextLength: 262144,
+            maxOutputTokens: 8192,
+            supportsTools: true,
+            supportsStreaming: true,
+            supportsVision: false,
+            supportsJsonMode: true,
+            supportsSystemPrompt: true,
+            supportsExtendedThinking: true,
+            supportsMCP: false,
+            supportsEmbeddings: false,
+            supportsCodeExecution: false,
+        },
+        cost: {
+            inputCostPerMillion: 0,
+            outputCostPerMillion: 0,
+        },
+    },
+    'qwen3-coder:30b': {
+        name: 'Qwen3 Coder 30B-A3B',
+        family: 'qwen',
+        tier: 'economy',
+        description: 'Alibaba Qwen3-Coder 30B MoE (3B active) — code-tuned, non-thinking; preferred local QE test-gen model',
+        releaseDate: '2025-07-31',
+        recommended: true,
+        capabilities: {
+            contextLength: 262144,
+            maxOutputTokens: 8192,
+            supportsTools: true,
+            supportsStreaming: true,
+            supportsVision: false,
+            supportsJsonMode: true,
+            supportsSystemPrompt: true,
+            supportsExtendedThinking: false,
+            supportsMCP: false,
+            supportsEmbeddings: false,
+            supportsCodeExecution: false,
+        },
+        cost: {
+            inputCostPerMillion: 0,
+            outputCostPerMillion: 0,
+        },
+    },
 };
 // ============================================================================
 // Core Functions
@@ -716,6 +791,23 @@ export function getModelCapabilities(modelId) {
     }
     return { ...entry.capabilities };
 }
+/**
+ * Whether a model is KNOWN to support tool / function calling.
+ *
+ * Fail-open: an unknown model id (not in the registry) returns `true` so a
+ * capability guard never strands a request on an unrecognized id — the guard
+ * only acts on models the registry explicitly marks tool-less.
+ *
+ * @param modelId - Any model ID (canonical or provider-specific)
+ */
+export function modelSupportsTools(modelId) {
+    try {
+        return getModelCapabilities(modelId).supportsTools;
+    }
+    catch {
+        return true;
+    }
+}
 /**
  * Get cost information for a model
  *

package/dist/shared/llm/ollama-url.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Single source of truth for resolving the local Ollama base URL.
+ *
+ * Precedence: AQE_OLLAMA_URL (project-namespaced) → OLLAMA_URL (generic) → the
+ * call-site's own default. Trailing slashes are stripped. This lets a user
+ * point every AQE local-model client (chat provider, consensus provider, local
+ * judge, embeddings, free-tier) at a non-localhost Ollama — a Docker host
+ * gateway (host.docker.internal), a remote GPU box — with ONE env var, while
+ * changing nothing when the vars are unset (each call-site keeps its own
+ * default via the `fallback` argument).
+ *
+ * The `env` parameter is injectable so resolution stays unit-testable without
+ * mutating process.env.
+ */
+export declare const DEFAULT_OLLAMA_BASE_URL = "http://localhost:11434";
+export declare function resolveOllamaBaseUrl(fallback?: string, env?: NodeJS.ProcessEnv): string;
+//# sourceMappingURL=ollama-url.d.ts.map

package/dist/shared/llm/ollama-url.js

@@ -0,0 +1,25 @@
+/**
+ * Single source of truth for resolving the local Ollama base URL.
+ *
+ * Precedence: AQE_OLLAMA_URL (project-namespaced) → OLLAMA_URL (generic) → the
+ * call-site's own default. Trailing slashes are stripped. This lets a user
+ * point every AQE local-model client (chat provider, consensus provider, local
+ * judge, embeddings, free-tier) at a non-localhost Ollama — a Docker host
+ * gateway (host.docker.internal), a remote GPU box — with ONE env var, while
+ * changing nothing when the vars are unset (each call-site keeps its own
+ * default via the `fallback` argument).
+ *
+ * The `env` parameter is injectable so resolution stays unit-testable without
+ * mutating process.env.
+ */
+export const DEFAULT_OLLAMA_BASE_URL = 'http://localhost:11434';
+export function resolveOllamaBaseUrl(fallback = DEFAULT_OLLAMA_BASE_URL, env = process.env) {
+    const raw = env['AQE_OLLAMA_URL'] ?? env['OLLAMA_URL'] ?? fallback;
+    // Strip trailing slashes via a linear char-scan — a `/\/+$/` regex backtracks
+    // polynomially on adversarial input (many '/'), a ReDoS flagged by CodeQL.
+    let end = raw.length;
+    while (end > 0 && raw.charCodeAt(end - 1) === 47 /* '/' */)
+        end -= 1;
+    return raw.slice(0, end);
+}
+//# sourceMappingURL=ollama-url.js.map

package/dist/shared/llm/providers/ollama-timeout.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Adaptive request-timeout sizing for local Ollama generations (#3).
+ *
+ * Local models vary ~6× in speed (a dense 27B ≈ 15 tok/s vs a 30B MoE ≈ 90
+ * tok/s on the same Mac) and thinking models can spend thousands of tokens
+ * before answering, so one fixed timeout either strands fast models or times
+ * out slow ones mid-generation. We size the timeout from the output cap
+ * (num_predict) and the model's observed throughput, with generous headroom.
+ *
+ * Pure + dependency-free so it is unit-testable in isolation.
+ */
+export declare const OLLAMA_TIMEOUT: {
+    /** Conservative throughput assumed before a model has been observed (dense floor). */
+    readonly DEFAULT_TOK_PER_SEC: 15;
+    /** Multiplier over ideal generation time to absorb variance. */
+    readonly SAFETY_FACTOR: 2.5;
+    /** Fixed overhead for cold model load / prompt eval (~6–9s measured). */
+    readonly LOAD_OVERHEAD_MS: 15000;
+    /** Never time out faster than this. */
+    readonly FLOOR_MS: 30000;
+    /** Never wait longer than this. */
+    readonly CEIL_MS: 600000;
+};
+/** Size a timeout (ms) from the output token cap and observed tok/s. */
+export declare function computeAdaptiveTimeoutMs(numPredict: number, tokPerSec?: number): number;
+//# sourceMappingURL=ollama-timeout.d.ts.map

package/dist/shared/llm/providers/ollama-timeout.js

@@ -0,0 +1,31 @@
+/**
+ * Adaptive request-timeout sizing for local Ollama generations (#3).
+ *
+ * Local models vary ~6× in speed (a dense 27B ≈ 15 tok/s vs a 30B MoE ≈ 90
+ * tok/s on the same Mac) and thinking models can spend thousands of tokens
+ * before answering, so one fixed timeout either strands fast models or times
+ * out slow ones mid-generation. We size the timeout from the output cap
+ * (num_predict) and the model's observed throughput, with generous headroom.
+ *
+ * Pure + dependency-free so it is unit-testable in isolation.
+ */
+export const OLLAMA_TIMEOUT = {
+    /** Conservative throughput assumed before a model has been observed (dense floor). */
+    DEFAULT_TOK_PER_SEC: 15,
+    /** Multiplier over ideal generation time to absorb variance. */
+    SAFETY_FACTOR: 2.5,
+    /** Fixed overhead for cold model load / prompt eval (~6–9s measured). */
+    LOAD_OVERHEAD_MS: 15_000,
+    /** Never time out faster than this. */
+    FLOOR_MS: 30_000,
+    /** Never wait longer than this. */
+    CEIL_MS: 600_000,
+};
+/** Size a timeout (ms) from the output token cap and observed tok/s. */
+export function computeAdaptiveTimeoutMs(numPredict, tokPerSec = OLLAMA_TIMEOUT.DEFAULT_TOK_PER_SEC) {
+    const tps = tokPerSec > 0 ? tokPerSec : OLLAMA_TIMEOUT.DEFAULT_TOK_PER_SEC;
+    const genMs = (Math.max(0, numPredict) / tps) * 1000;
+    const computed = genMs * OLLAMA_TIMEOUT.SAFETY_FACTOR + OLLAMA_TIMEOUT.LOAD_OVERHEAD_MS;
+    return Math.min(OLLAMA_TIMEOUT.CEIL_MS, Math.max(OLLAMA_TIMEOUT.FLOOR_MS, Math.round(computed)));
+}
+//# sourceMappingURL=ollama-timeout.js.map

package/dist/shared/llm/providers/ollama.d.ts

@@ -19,7 +19,17 @@ export declare class OllamaProvider implements LLMProvider {
     private config;
     private requestId;
     private availableModels;
+    /** EMA of observed generation throughput (tok/s) per model, for adaptive timeouts (#3). */
+    private observedTokPerSec;
     constructor(config?: Partial<OllamaConfig>);
+    /**
+     * Adaptive per-request timeout (#3). An explicitly customized config.timeoutMs
+     * (≠ the built-in default) is honored as the caller's intent; otherwise the
+     * timeout is sized from num_predict and the model's observed throughput.
+     */
+    private timeoutFor;
+    /** Fold a completed generation's throughput into the per-model EMA. */
+    private recordThroughput;
     /**
      * Check if Ollama is available and running
      */