agentic-qe 3.14.2 → 3.14.3

package/dist/domains/security-compliance/services/scanners/sast-scanner.js

@@ -2,6 +2,9 @@
  * Agentic QE v3 - SAST (Static Application Security Testing) Scanner
  * Performs static code analysis to detect security vulnerabilities
  */
+import { createHash } from 'node:crypto';
+import * as path from 'node:path';
+import { FilePath } from '../../../../shared/value-objects/index.js';
 import { LoggerFactory } from '../../../../logging/index.js';
 import { v4 as uuidv4 } from 'uuid';
 import { ok, err } from '../../../../shared/types/index.js';
@@ -48,30 +51,61 @@ export class SASTScanner {
             if (files.length === 0) {
                 return err(new Error('No files provided for scanning'));
             }
-            this.activeScans.set(scanId, 'running');
             const startTime = Date.now();
             // Get applicable rule sets
             const ruleSets = BUILT_IN_RULE_SETS.filter((rs) => ruleSetIds.includes(rs.id));
             if (ruleSets.length === 0) {
                 return err(new Error(`No valid rule sets found: ${ruleSetIds.join(', ')}`));
             }
-            // Run pattern-based scanning and semgrep in parallel
-            const [patternResult, semgrepVulns] = await Promise.all([
-                this.runPatternScanning(files, ruleSets),
-                this.runSemgrepScanning(files, ruleSetIds),
+            const unknownRuleSets = ruleSetIds.filter(id => !BUILT_IN_RULE_SETS.some(ruleSet => ruleSet.id === id));
+            if (unknownRuleSets.length > 0) {
+                return err(new Error('Unknown rule sets requested; no scan executed.'));
+            }
+            this.activeScans.set(scanId, 'running');
+            // Deduplicate lexical absolute paths; do not follow symlinks to invent identity.
+            const requestedPaths = [...new Set(files.map(file => path.resolve(file.value)))];
+            const uniqueFiles = requestedPaths.map(value => FilePath.create(value));
+            // Run independent engines while retaining each engine's execution outcome.
+            const [patternResult, semgrepResult] = await Promise.all([
+                this.runPatternScanning(uniqueFiles, ruleSets),
+                this.runSemgrepScanning(uniqueFiles, ruleSetIds),
             ]);
             // Merge pattern-based and semgrep findings, deduplicating by file+line
-            const vulnerabilities = this.mergeVulnerabilities(patternResult.vulnerabilities, semgrepVulns);
-            const linesScanned = patternResult.linesScanned;
+            const vulnerabilities = this.mergeVulnerabilities(patternResult.vulnerabilities, semgrepResult.vulnerabilities);
+            const analyzedFiles = patternResult.files.filter(file => file.status === 'analyzed');
+            const linesScanned = analyzedFiles.reduce((total, file) => total + file.analyzedLines, 0);
             const scanDurationMs = Date.now() - startTime;
             // Calculate summary
-            const summary = this.calculateSummary(vulnerabilities, files.length, scanDurationMs);
-            // Calculate coverage — include semgrep rules when they ran
-            const patternRules = ruleSets.reduce((acc, rs) => acc + rs.ruleCount, 0);
+            const summary = this.calculateSummary(vulnerabilities, analyzedFiles.length, scanDurationMs);
+            const patterns = this.getApplicablePatterns(ruleSets);
+            const ruleIds = analyzedFiles.length > 0 ? [...new Set(patterns.map(pattern => pattern.id))] : [];
             const coverage = {
-                filesScanned: files.length,
+                filesScanned: analyzedFiles.length,
                 linesScanned,
-                rulesApplied: patternRules + (semgrepVulns.length > 0 ? semgrepVulns.length : 0),
+                rulesApplied: ruleIds.length,
+                rulesAppliedScope: 'built-in-patterns',
+            };
+            const patternEngine = {
+                id: 'patterns', requested: true, required: true, scope: 'requested-files',
+                status: analyzedFiles.length === uniqueFiles.length ? 'completed' : analyzedFiles.length > 0 ? 'partial' : 'failed',
+                analyzedFiles: analyzedFiles.length,
+                ruleIds,
+                rulesetDigest: createHash('sha256').update(JSON.stringify(patterns.map(pattern => ({
+                    id: pattern.id, category: pattern.category, expression: pattern.pattern.source, flags: pattern.pattern.flags,
+                })))).digest('hex'),
+                ruleCoverage: 'known',
+                errors: patternResult.files.filter(file => file.status === 'unreadable').map(file => file.reason || 'File unreadable'),
+                limitations: ['Built-in pattern matching covers supported JavaScript and TypeScript inputs only.'],
+            };
+            const evidence = {
+                schemaVersion: 1,
+                completeness: analyzedFiles.length === uniqueFiles.length ? 'complete' : analyzedFiles.length > 0 ? 'partial' : 'none',
+                requestedFiles: uniqueFiles.length,
+                requestedPaths,
+                duplicateInputs: files.length - uniqueFiles.length,
+                files: patternResult.files,
+                engines: [patternEngine, semgrepResult.evidence],
+                limitations: [...patternEngine.limitations, ...semgrepResult.evidence.limitations],
             };
             // Store scan results in memory
             await this.storeScanResults(scanId, 'sast', vulnerabilities, summary);
@@ -81,6 +115,7 @@ export class SASTScanner {
                 vulnerabilities,
                 summary,
                 coverage,
+                evidence,
             });
         }
         catch (error) {
@@ -93,36 +128,48 @@ export class SASTScanner {
      */
     async runPatternScanning(files, ruleSets) {
         const vulnerabilities = [];
-        let linesScanned = 0;
+        const receipts = [];
         for (const file of files) {
-            const fileVulns = await this.analyzeFile(file, ruleSets);
-            vulnerabilities.push(...fileVulns.vulnerabilities);
-            linesScanned += fileVulns.linesScanned;
+            const result = await this.analyzeFile(file, ruleSets);
+            vulnerabilities.push(...result.vulnerabilities);
+            receipts.push(result.evidence);
         }
-        return { vulnerabilities, linesScanned };
+        return { vulnerabilities, files: receipts };
     }
     /**
      * Run semgrep scanning when enabled and available.
-     * Returns converted vulnerabilities or empty array on failure/unavailability.
+     * Optional engine failure preserves completed pattern analysis and its findings.
      */
     async runSemgrepScanning(files, ruleSetIds) {
+        const targetDir = this.resolveTargetDirectory(files);
+        const base = {
+            id: 'semgrep', requested: !!this.config.enableSemgrep, required: false,
+            status: 'disabled', scope: 'parent-directory', target: targetDir,
+            ruleCoverage: 'unknown', errors: [], limitations: [],
+        };
         if (!this.config.enableSemgrep) {
-            return [];
+            return { vulnerabilities: [], evidence: base };
         }
+        const limitations = [
+            'Optional Semgrep scans a parent directory; requested-file membership and executed-rule coverage are unverified.',
+        ];
         try {
-            const available = await isSemgrepAvailable();
-            if (!available) {
-                return [];
+            if (!await isSemgrepAvailable()) {
+                return { vulnerabilities: [], evidence: { ...base, status: 'unavailable', limitations,
+                        errors: ['Semgrep is unavailable.'] } };
             }
-            // Determine target directory from files (use common parent)
-            const targetDir = this.resolveTargetDirectory(files);
             const semgrepResult = await runSemgrepWithRules(targetDir, ruleSetIds);
-            if (!semgrepResult.success || semgrepResult.findings.length === 0) {
-                return [];
-            }
+            const evidence = {
+                ...base,
+                status: semgrepResult.status || 'unverified',
+                version: semgrepResult.version,
+                errors: semgrepResult.errors.length > 0 ? [`Semgrep reported ${semgrepResult.errors.length} execution error(s).`] : [],
+                limitations: [...limitations, ...(semgrepResult.diagnostics ?? []),
+                    ...(!semgrepResult.status ? ['Legacy Semgrep adapter returned no execution disposition.'] : [])],
+            };
             // Convert semgrep findings to our Vulnerability format
             const converted = convertSemgrepFindings(semgrepResult.findings);
-            return converted.map(f => ({
+            const vulnerabilities = converted.map(f => ({
                 id: uuidv4(),
                 cveId: undefined,
                 title: f.title,
@@ -142,10 +189,11 @@ export class SASTScanner {
                 },
                 references: f.references,
             }));
+            return { vulnerabilities, evidence };
         }
         catch {
-            // Semgrep failure is non-fatal — pattern scanning still covers us
-            return [];
+            return { vulnerabilities: [], evidence: { ...base, status: 'failed', limitations,
+                    errors: ['Semgrep execution failed.'] } };
         }
     }
     /**
@@ -153,25 +201,18 @@ export class SASTScanner {
      */
     resolveTargetDirectory(files) {
         if (files.length === 0)
-            return '.';
-        if (files.length === 1)
-            return files[0].directory || '.';
-        // Find common prefix of all directories
-        const dirs = files.map(f => f.directory || '.');
-        const first = dirs[0];
-        let commonLen = first.length;
-        for (let i = 1; i < dirs.length; i++) {
-            const dir = dirs[i];
-            const maxLen = Math.min(commonLen, dir.length);
-            let j = 0;
-            while (j < maxLen && first[j] === dir[j])
-                j++;
-            commonLen = j;
+            return process.cwd();
+        let common = path.dirname(path.resolve(files[0].value));
+        for (const file of files.slice(1)) {
+            const directory = path.dirname(path.resolve(file.value));
+            while (directory !== common && !directory.startsWith(common.endsWith(path.sep) ? common : common + path.sep)) {
+                const parent = path.dirname(common);
+                if (parent === common)
+                    break;
+                common = parent;
+            }
         }
-        const common = first.substring(0, commonLen);
-        // Trim to last path separator
-        const lastSep = common.lastIndexOf('/');
-        return lastSep > 0 ? common.substring(0, lastSep) : common || '.';
+        return common;
     }
     /**
      * Map semgrep OWASP category string to VulnerabilityCategory
@@ -250,32 +291,35 @@ export class SASTScanner {
     /**
      * Analyze a file for security vulnerabilities using pattern-based detection
      */
+    getApplicablePatterns(ruleSets) {
+        const categories = new Set(ruleSets.flatMap(ruleSet => ruleSet.categories));
+        return ALL_SECURITY_PATTERNS.filter(pattern => categories.has(pattern.category));
+    }
     async analyzeFile(file, ruleSets) {
         const vulnerabilities = [];
         const filePath = file.value;
-        const extension = file.extension;
-        // Read file content
+        const receipt = { path: filePath, engineId: 'patterns', readLines: 0, analyzedLines: 0 };
         let content;
-        let lines;
+        let sourceDigest;
         try {
             const fs = await import('fs/promises');
-            content = await fs.readFile(filePath, 'utf-8');
-            lines = content.split('\n');
+            const bytes = await fs.readFile(filePath);
+            sourceDigest = createHash('sha256').update(bytes).digest('hex');
+            content = bytes.toString('utf8');
         }
-        catch {
-            // File not accessible - return empty results
-            return { vulnerabilities: [], linesScanned: 0 };
+        catch (error) {
+            const code = error.code;
+            return { vulnerabilities: [], evidence: { ...receipt, status: 'unreadable',
+                    reason: typeof code === 'string' && /^[A-Z0-9_]{1,32}$/.test(code) ? code : 'File unreadable' } };
         }
-        const linesScanned = lines.length;
-        // Only scan supported file types
+        const lines = content.split('\n');
+        const readReceipt = { ...receipt, sourceDigest, readLines: lines.length };
         const supportedExtensions = ['ts', 'tsx', 'js', 'jsx', 'mjs', 'cjs'];
-        if (!supportedExtensions.includes(extension)) {
-            return { vulnerabilities: [], linesScanned };
+        if (!supportedExtensions.includes(file.extension)) {
+            return { vulnerabilities: [], evidence: { ...readReceipt, status: 'unsupported',
+                    reason: 'Unsupported language for built-in SAST patterns' } };
         }
-        // Get applicable categories from rule sets
-        const applicableCategories = new Set(ruleSets.flatMap((rs) => rs.categories));
-        // Filter patterns to only those matching applicable categories
-        const applicablePatterns = ALL_SECURITY_PATTERNS.filter((pattern) => applicableCategories.has(pattern.category));
+        const applicablePatterns = this.getApplicablePatterns(ruleSets);
         // Scan content for each pattern
         for (const securityPattern of applicablePatterns) {
             const matches = this.findPatternMatches(content, lines, securityPattern);
@@ -291,7 +335,7 @@ export class SASTScanner {
                 vulnerabilities.push(this.createVulnerabilityFromPattern(securityPattern, filePath, match));
             }
         }
-        return { vulnerabilities, linesScanned };
+        return { vulnerabilities, evidence: { ...readReceipt, status: 'analyzed', analyzedLines: lines.length } };
     }
     /**
      * Find all matches of a security pattern in the file content

package/dist/domains/security-compliance/services/semgrep-integration.d.ts

@@ -9,6 +9,8 @@
  *
  * @module security-compliance/semgrep-integration
  */
+declare const SEMGREP_SEVERITIES: readonly ["ERROR", "WARNING", "INFO", "CRITICAL", "HIGH", "MEDIUM", "LOW", "EXPERIMENT", "INVENTORY"];
+export type SemgrepSeverity = typeof SEMGREP_SEVERITIES[number];
 export interface SemgrepFinding {
     check_id: string;
     path: string;
@@ -22,7 +24,7 @@ export interface SemgrepFinding {
     };
     extra: {
         message: string;
-        severity: 'ERROR' | 'WARNING' | 'INFO';
+        severity: SemgrepSeverity;
         lines: string;
         metadata?: {
             cwe?: string[];
@@ -37,8 +39,12 @@ export interface SemgrepFinding {
 }
 export interface SemgrepResult {
     success: boolean;
+    /** Optional only for compatibility with legacy adapters. */
+    status?: 'completed' | 'partial' | 'failed' | 'unavailable';
     findings: SemgrepFinding[];
     errors: string[];
+    /** Sanitized non-fatal diagnostics, separate from analysis failures. */
+    diagnostics?: string[];
     version?: string;
 }
 export interface SemgrepConfig {
@@ -74,7 +80,7 @@ export declare function runSemgrepWithRules(target: string, rules: string[], opt
 /**
  * Map semgrep severity to standard severity
  */
-export declare function mapSemgrepSeverity(severity: 'ERROR' | 'WARNING' | 'INFO'): 'critical' | 'high' | 'medium' | 'low';
+export declare function mapSemgrepSeverity(severity: SemgrepSeverity): 'critical' | 'high' | 'medium' | 'low';
 /**
  * Convert semgrep findings to a generic format
  */
@@ -92,4 +98,5 @@ export declare function convertSemgrepFindings(findings: SemgrepFinding[]): Arra
     remediation: string;
     references: string[];
 }>;
+export {};
 //# sourceMappingURL=semgrep-integration.d.ts.map

package/dist/domains/security-compliance/services/semgrep-integration.js

@@ -12,10 +12,15 @@
 import { execFile } from 'child_process';
 import { promisify } from 'util';
 import * as path from 'path';
-import { toErrorMessage } from '../../../shared/error-utils.js';
 import { safeJsonParse } from '../../../shared/safe-json.js';
 const execFileAsync = promisify(execFile);
 // ============================================================================
+// Types
+// ============================================================================
+// Semgrep's match_severity schema retains legacy/deprecated values as well as
+// CRITICAL/HIGH/MEDIUM/LOW introduced in 1.72.0.
+const SEMGREP_SEVERITIES = ['ERROR', 'WARNING', 'INFO', 'CRITICAL', 'HIGH', 'MEDIUM', 'LOW', 'EXPERIMENT', 'INVENTORY'];
+// ============================================================================
 // Semgrep Integration
 // ============================================================================
 /**
@@ -59,8 +64,9 @@ export async function runSemgrep(config) {
     if (!available) {
         return {
             success: false,
+            status: 'unavailable',
             findings: [],
-            errors: ['Semgrep is not installed. Install with: pip install semgrep'],
+            errors: ['Semgrep is unavailable.'],
         };
     }
     try {
@@ -87,28 +93,26 @@ export async function runSemgrep(config) {
         });
         const result = parseSemgrepOutput(stdout);
         if (stderr && fullConfig.verbose) {
-            result.errors.push(stderr);
+            result.diagnostics = ['Semgrep emitted diagnostic output.'];
         }
         result.version = await getSemgrepVersion() || undefined;
         return result;
     }
     catch (error) {
-        // Semgrep exits with non-zero if findings exist
         const execError = error;
-        if (execError.stdout) {
-            try {
-                const result = parseSemgrepOutput(execError.stdout);
-                result.version = await getSemgrepVersion() || undefined;
+        if (typeof execError.stdout === 'string' && execError.stdout.length > 0) {
+            const result = parseSemgrepOutput(execError.stdout);
+            // Exit 1 can represent findings with --error. Other process failures cannot
+            // be converted into success just because stdout contains valid JSON.
+            if (execError.code === 1 && !execError.killed && !execError.signal && result.success && result.findings.length > 0) {
                 return result;
             }
-            catch {
-                // Parse failed, return error
-            }
+            return { ...result, success: false, status: 'failed',
+                errors: [...result.errors, 'Semgrep process did not complete successfully.'] };
         }
         return {
-            success: false,
-            findings: [],
-            errors: [execError.message ?? String(error)],
+            success: false, status: 'failed', findings: [],
+            errors: ['Semgrep execution failed.'],
         };
     }
 }
@@ -118,11 +122,47 @@ export async function runSemgrep(config) {
 function parseSemgrepOutput(stdout) {
     try {
         const parsed = safeJsonParse(stdout);
-        // Handle different output formats
-        const results = parsed.results || parsed.findings || [];
-        const errors = parsed.errors?.map(e => e.message || String(e)) || [];
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            throw new Error('Expected a JSON object');
+        }
+        const rawResults = parsed.results ?? parsed.findings;
+        if (!Array.isArray(rawResults) || (parsed.errors !== undefined && !Array.isArray(parsed.errors))) {
+            throw new Error('Missing or invalid result collection');
+        }
+        const isRecord = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
+        const optionalText = (value) => value === undefined || typeof value === 'string';
+        const validSeverity = (value) => value === undefined
+            || (typeof value === 'string' && SEMGREP_SEVERITIES.includes(value));
+        const validPosition = (value) => value === undefined || (isRecord(value)
+            && ['line', 'col'].every(key => value[key] === undefined
+                || (typeof value[key] === 'number' && Number.isSafeInteger(value[key]) && value[key] > 0)));
+        const validMetadata = (value) => value === undefined || (isRecord(value)
+            && ['cwe', 'owasp', 'references'].every(key => value[key] === undefined
+                || (Array.isArray(value[key]) && value[key].every(item => typeof item === 'string')))
+            && ['category', 'description', 'fix', 'confidence'].every(key => optionalText(value[key])));
+        const validFinding = (value) => {
+            if (!isRecord(value))
+                return false;
+            const id = value.check_id ?? value.rule_id;
+            if (typeof value.path !== 'string' || value.path.length === 0 || typeof id !== 'string' || id.length === 0
+                || !validPosition(value.start) || !validPosition(value.end)
+                || !optionalText(value.message) || !validSeverity(value.severity) || !validMetadata(value.metadata))
+                return false;
+            const extra = value.extra;
+            return extra === undefined || (isRecord(extra)
+                && ['message', 'lines', 'fix'].every(key => optionalText(extra[key]))
+                && validSeverity(extra.severity) && validMetadata(extra.metadata));
+        };
+        const results = rawResults.filter(validFinding);
+        const malformed = rawResults.length - results.length;
+        const errors = [];
+        if (parsed.errors?.length)
+            errors.push(`Semgrep reported ${parsed.errors.length} analysis error(s).`);
+        if (malformed)
+            errors.push(`Semgrep returned ${malformed} malformed finding(s).`);
         return {
-            success: true,
+            success: errors.length === 0,
+            status: errors.length === 0 ? 'completed' : 'partial',
             findings: results.map(r => ({
                 check_id: r.check_id || r.rule_id || 'unknown',
                 path: r.path,
@@ -146,11 +186,12 @@ function parseSemgrepOutput(stdout) {
             errors,
         };
     }
-    catch (error) {
+    catch {
         return {
             success: false,
+            status: 'failed',
             findings: [],
-            errors: [`Failed to parse semgrep output: ${toErrorMessage(error)}`],
+            errors: ['Invalid Semgrep output.'],
         };
     }
 }
@@ -191,6 +232,13 @@ export function mapSemgrepSeverity(severity) {
         ERROR: 'high',
         WARNING: 'medium',
         INFO: 'low',
+        CRITICAL: 'critical',
+        HIGH: 'high',
+        MEDIUM: 'medium',
+        LOW: 'low',
+        // Retain the existing non-risky INFO mapping for deprecated categories.
+        EXPERIMENT: 'low',
+        INVENTORY: 'low',
     };
     return mapping[severity] || 'medium';
 }

package/dist/domains/test-execution/services/flaky-detector.js

@@ -11,6 +11,7 @@ import { ok, err } from '../../../shared/types/index.js';
 import { TEST_EXECUTION_CONSTANTS, RETRY_CONSTANTS } from '../../constants.js';
 import { toError } from '../../../shared/error-utils.js';
 import { safeJsonParse } from '../../../shared/safe-json.js';
+import { createVitestJsonReport, needsVitestJsonReportFile } from '../../../shared/vitest-json-report.js';
 import { secureRandom } from '../../../shared/utils/crypto-random.js';
 const DEFAULT_FLAKY_CONFIG = {
     simulateForTesting: false,
@@ -254,7 +255,13 @@ export class FlakyDetectorService {
         const runId = uuidv4();
         const startTime = Date.now();
         return new Promise((resolve, reject) => {
-            const args = [...this.config.testRunnerArgs, file];
+            const baseArgs = [...this.config.testRunnerArgs, file];
+            // Vitest 5 writes --reporter=json output to a file, not stdout. Detect
+            // Vitest from the runner command too (testRunner: 'vitest', args: ['run', ...]).
+            const report = needsVitestJsonReportFile([this.config.testRunner, ...baseArgs])
+                ? createVitestJsonReport()
+                : undefined;
+            const args = report ? [...baseArgs, ...report.args] : baseArgs;
             const cwd = this.config.cwd ?? process.cwd();
             const child = spawn(this.config.testRunner, args, {
                 cwd,
@@ -272,19 +279,23 @@ export class FlakyDetectorService {
             // Set timeout
             const timeout = setTimeout(() => {
                 child.kill('SIGTERM');
+                report?.cleanup();
                 reject(new Error(`Test execution timed out after ${this.config.runTimeout}ms for ${file}`));
             }, this.config.runTimeout);
             child.on('error', (error) => {
                 clearTimeout(timeout);
+                report?.cleanup();
                 reject(new Error(`Failed to execute test runner: ${error.message}. ` +
                     `Ensure ${this.config.testRunner} is installed and accessible.`));
             });
             child.on('close', (code) => {
                 clearTimeout(timeout);
                 const duration = Date.now() - startTime;
+                const reportText = report ? report.read(stdout) : stdout;
+                report?.cleanup();
                 try {
-                    // Parse the test results from stdout
-                    const parsedResults = this.parseTestOutput(stdout, stderr, code ?? 0, file, runId, runIndex, duration);
+                    // Parse the test results from the JSON report (or stdout for other runners)
+                    const parsedResults = this.parseTestOutput(reportText, stderr, code ?? 0, file, runId, runIndex, duration);
                     // If parsing fails but we have an exit code, create a single result for the file
                     if (parsedResults.size === 0) {
                         const testId = this.generateTestId(file, 'main');

package/dist/domains/test-execution/services/retry-handler.js

@@ -4,6 +4,7 @@
  */
 import { LoggerFactory } from '../../../logging/index.js';
 import { spawn } from 'node:child_process';
+import { createVitestJsonReport } from '../../../shared/vitest-json-report.js';
 import { existsSync, readFileSync } from 'node:fs';
 import { ok, err } from '../../../shared/types/index.js';
 import { TEST_EXECUTION_CONSTANTS, RETRY_CONSTANTS } from '../../constants.js';
@@ -262,9 +263,9 @@ export class RetryHandlerService {
                 `or configure testRunner in RetryHandlerConfig. Cannot execute retry for: ${testFile}`);
         }
         // Build command based on runner
-        const { command, args } = this.buildTestCommand(runner, testFile, testName);
+        const { command, args, report } = this.buildTestCommand(runner, testFile, testName);
         // Execute the test
-        return this.spawnTestProcess(command, args, cwd);
+        return this.spawnTestProcess(command, args, cwd, report);
     }
     /**
      * Detect which test runner is available in the project
@@ -337,12 +338,15 @@ export class RetryHandlerService {
         switch (runner) {
             case 'vitest':
                 // vitest run --reporter=json testFile -t "testName"
+                // --outputFile: Vitest 5 no longer prints the JSON report to stdout.
                 {
+                    const report = createVitestJsonReport();
                     const vitestArgs = ['vitest', 'run', '--reporter=json', testFile];
                     if (testName && testName !== testFile) {
                         vitestArgs.push('-t', testName);
                     }
-                    return { command: npx, args: vitestArgs };
+                    vitestArgs.push(...report.args);
+                    return { command: npx, args: vitestArgs, report };
                 }
             case 'jest':
                 // jest --json testFile -t "testName"
@@ -369,12 +373,16 @@ export class RetryHandlerService {
     /**
      * Spawn a test process and parse the result
      */
-    spawnTestProcess(command, args, cwd) {
+    spawnTestProcess(command, args, cwd, report) {
         return new Promise((resolve, reject) => {
             const timeout = this.config.testTimeout;
             let stdout = '';
             let stderr = '';
             let timedOut = false;
+            const settle = (fn, value) => {
+                report?.cleanup();
+                fn(value);
+            };
             // Note: shell: false (default) to prevent command injection (CWE-78)
             // Arguments are passed as array to avoid shell interpretation
             const proc = spawn(command, args, {
@@ -396,15 +404,17 @@ export class RetryHandlerService {
             proc.on('close', (code) => {
                 clearTimeout(timeoutHandle);
                 if (timedOut) {
-                    reject(new Error(`Test execution timed out after ${timeout}ms for command: ${command} ${args.join(' ')}`));
+                    settle(reject, new Error(`Test execution timed out after ${timeout}ms for command: ${command} ${args.join(' ')}`));
                     return;
                 }
-                // Parse result based on exit code and output
-                const result = this.parseTestResult(code, stdout, stderr);
-                resolve(result);
+                // Parse result based on exit code and output (Vitest writes the JSON
+                // report to the --outputFile; read it back rather than trusting stdout).
+                const result = this.parseTestResult(code, report ? report.read(stdout) : stdout, stderr);
+                settle(resolve, result);
             });
             proc.on('error', (err) => {
                 clearTimeout(timeoutHandle);
+                report?.cleanup();
                 reject(new Error(`Failed to spawn test process: ${err.message}. ` +
                     `Command: ${command} ${args.join(' ')}. ` +
                     `Ensure the test runner is installed and accessible.`));