agentic-qe 3.14.5 → 3.14.7

package/dist/learning/real-qe-reasoning-bank.d.ts

@@ -30,6 +30,14 @@ export interface RealQEReasoningBankConfig {
     coherenceThreshold?: number;
 }
 export declare const DEFAULT_REAL_CONFIG: RealQEReasoningBankConfig;
+/** Ranking evidence keeps lexical relevance separate from vector reuse safety. */
+export interface RealQEPatternSearchResult {
+    pattern: QEPattern;
+    score: number;
+    similarity: number;
+    matchType: 'vector' | 'lexical';
+    canReuse: boolean;
+}
 export interface RealQERoutingRequest {
     task: string;
     taskType?: 'test-generation' | 'analysis' | 'debugging' | 'optimization';
@@ -144,10 +152,7 @@ export declare class RealQEReasoningBank {
         limit?: number;
         domain?: QEDomain;
         minSimilarity?: number;
-    }): Promise<Result<Array<{
-        pattern: QEPattern;
-        similarity: number;
-    }>>>;
+    }): Promise<Result<RealQEPatternSearchResult[]>>;
     /**
      * Route a task to optimal agent
      */

package/dist/learning/real-qe-reasoning-bank.js

@@ -19,6 +19,7 @@ import { v4 as uuidv4 } from 'uuid';
 import { LoggerFactory } from '../logging/index.js';
 import { toError, toErrorMessage } from '../shared/error-utils.js';
 import { maybeEnhanceRoutingWithPatterns } from './pattern-routing-guidance.js';
+import { blendFtsScore, DEFAULT_PATTERN_STORE_CONFIG } from './pattern-store.js';
 import { EMBEDDING_SPACE_CANARY } from './embedding-space.js';
 const logger = LoggerFactory.create('RealQEReasoningBank');
 import { computeRealEmbedding, isTransformerAvailable, getEmbeddingDimension, clearEmbeddingCache, getActiveEmbeddingSpaceIdentity, } from './real-embeddings.js';
@@ -418,11 +419,11 @@ export class RealQEReasoningBank {
             const limit = options.limit || 10;
             const results = this.hnswIndex.searchKnn(queryEmbedding, limit * 2); // Get extra for filtering
             const patterns = [];
-            for (let i = 0; i < results.neighbors.length && patterns.length < limit; i++) {
+            for (let i = 0; i < results.neighbors.length; i++) {
                 const hnswIndex = results.neighbors[i];
                 const distance = results.distances[i];
                 const similarity = 1 - distance; // Convert distance to similarity
-                if (options.minSimilarity && similarity < options.minSimilarity) {
+                if (options.minSimilarity !== undefined && similarity < options.minSimilarity) {
                     continue;
                 }
                 const patternId = this.patternIdMap.get(hnswIndex);
@@ -435,13 +436,36 @@ export class RealQEReasoningBank {
                 if (options.domain && pattern.qeDomain !== options.domain) {
                     continue;
                 }
-                patterns.push({ pattern, similarity });
+                const reuse = DEFAULT_PATTERN_STORE_CONFIG.reuseOptimization;
+                const ageDays = (Date.now() - new Date(pattern.lastUsedAt).getTime()) / 86_400_000;
+                patterns.push({ pattern, similarity, score: similarity, matchType: 'vector',
+                    canReuse: Boolean(pattern.reusable && similarity >= reuse.minSimilarityForReuse
+                        && pattern.successRate >= reuse.minSuccessRateForReuse && ageDays <= reuse.maxAgeForReuse),
+                });
+            }
+            const existing = new Map(patterns.map(hit => [hit.pattern.id, hit]));
+            for (const lexical of this.sqliteStore.searchFTS(query, limit * 2)) {
+                const vector = existing.get(lexical.id);
+                if (vector) {
+                    vector.score = blendFtsScore(vector.score, lexical.ftsScore * lexical.coverage);
+                    continue;
+                }
+                // A vector threshold requires measured vector evidence. A rejected
+                // vector must never re-enter through the lexical-only branch.
+                if (options.minSimilarity !== undefined)
+                    continue;
+                const pattern = this.sqliteStore.getPattern(lexical.id);
+                if (!pattern || (options.domain && pattern.qeDomain !== options.domain))
+                    continue;
+                patterns.push({ pattern, score: 0.5 * lexical.ftsScore * lexical.coverage,
+                    similarity: 0, matchType: 'lexical', canReuse: false });
             }
+            patterns.sort((a, b) => b.score - a.score);
             const searchTime = performance.now() - startTime;
             if (searchTime > 10) {
                 logger.warn('Slow search', { searchTimeMs: Number(searchTime.toFixed(1)) });
             }
-            return ok(patterns);
+            return ok(patterns.slice(0, limit));
         }
         catch (error) {
             return err(toError(error));

package/dist/learning/rvf-pattern-store.js

@@ -15,7 +15,7 @@ import { v4 as uuidv4 } from 'uuid';
 import { ok, err } from '../shared/types/index.js';
 import { toErrorMessage } from '../shared/error-utils.js';
 import { calculateQualityScore, validateQEPattern, mapQEDomainToAQE, PROMOTION_THRESHOLD, } from './qe-patterns.js';
-import { DEFAULT_PATTERN_STORE_CONFIG } from './pattern-store.js';
+import { DEFAULT_PATTERN_STORE_CONFIG, blendFtsScore } from './pattern-store.js';
 import { ensureEndpointEmbeddingSpaceIdentity, getActiveEmbeddingSpaceIdentity } from './real-embeddings.js';
 import { verifyOrCreateEmbeddingSpaceManifest } from './embedding-space.js';
 import { PatternMutationError } from './pattern-mutation-error.js';
@@ -322,16 +322,18 @@ export class RvfPatternStore {
         // Uses getPattern(id) which joins the embedding from qe_pattern_embeddings.
         if (Array.isArray(query) && !this.adapter && this.sqliteStore && results.length === 0) {
             try {
-                const allPatterns = this.sqliteStore.getPatterns({ limit: limit * 4 });
+                const activeSpaceId = getActiveEmbeddingSpaceIdentity()?.spaceId ?? this.embeddingSpaceId;
+                const embeddings = this.sqliteStore.getAllEmbeddings();
                 const qArr = query;
                 const qMag = Math.sqrt(qArr.reduce((s, v) => s + v * v, 0));
                 if (qMag > 0) {
-                    for (const pat of allPatterns) {
-                        if (!this.matchesFilters(pat, options))
+                    for (const row of embeddings) {
+                        if (!activeSpaceId || row.spaceId !== activeSpaceId)
                             continue;
-                        // getPattern() joins the embedding; getPatterns() does not
-                        const full = this.sqliteStore.getPattern(pat.id);
-                        const emb = full?.embedding;
+                        const full = this.sqliteStore.getPattern(row.patternId);
+                        if (!full || !this.matchesFilters(full, options))
+                            continue;
+                        const emb = row.embedding;
                         if (!emb || emb.length !== qArr.length)
                             continue;
                         let dot = 0, eMag = 0;
@@ -368,39 +370,50 @@ export class RvfPatternStore {
                         continue;
                     if (!this.matchesFilters(pattern, options))
                         continue;
-                    const reuseInfo = this.calculateReuseInfo(pattern, pattern.confidence);
                     results.push({
                         pattern,
                         score: pattern.confidence,
-                        matchType: 'exact',
-                        similarity: pattern.confidence,
-                        canReuse: reuseInfo.canReuse,
-                        estimatedTokenSavings: reuseInfo.estimatedTokenSavings,
-                        reuseConfidence: reuseInfo.reuseConfidence,
+                        matchType: 'context',
+                        similarity: 0,
+                        canReuse: false,
+                        estimatedTokenSavings: 0,
+                        reuseConfidence: 0,
                     });
                 }
             }
             catch { /* SQLite unavailable */ }
         }
-        // FTS5 text search fallback via SQLite
-        if (typeof query === 'string' && query.trim() && this.sqliteStore) {
+        // FTS5 hybrid search via SQLite
+        const ftsText = typeof query === 'string' ? query : options.textQuery;
+        if (ftsText?.trim() && this.sqliteStore) {
             try {
-                const ftsResults = this.sqliteStore.searchFTS(query, limit * 2);
+                const ftsResults = this.sqliteStore.searchFTS(ftsText, limit * 2);
                 const existingIds = new Set(results.map(r => r.pattern.id));
+                // #653: same vector/FTS5 blend as PatternStore for hits found by
+                // both, so lexical relevance can reorder vector results.
+                const ftsScoreMap = new Map(ftsResults.map(r => [r.id, r.ftsScore * r.coverage]));
+                for (const result of results) {
+                    const ftsScore = ftsScoreMap.get(result.pattern.id);
+                    if (ftsScore !== undefined) {
+                        result.score = blendFtsScore(result.score, ftsScore);
+                    }
+                }
                 for (const ftsResult of ftsResults) {
                     if (existingIds.has(ftsResult.id))
                         continue;
                     const pattern = await this.get(ftsResult.id);
                     if (pattern && this.matchesFilters(pattern, options)) {
-                        const reuseInfo = this.calculateReuseInfo(pattern, ftsResult.ftsScore);
+                        // Same keyword-only similarity rule as PatternStore (#653)
+                        const keywordScore = 0.5 * ftsResult.ftsScore * ftsResult.coverage;
+                        const similarity = 0; // Lexical relevance is not vector similarity or safe reuse.
                         results.push({
                             pattern,
-                            score: 0.5 * ftsResult.ftsScore,
-                            matchType: 'exact',
-                            similarity: ftsResult.ftsScore,
-                            canReuse: reuseInfo.canReuse,
-                            estimatedTokenSavings: reuseInfo.estimatedTokenSavings,
-                            reuseConfidence: reuseInfo.reuseConfidence,
+                            score: keywordScore,
+                            matchType: 'lexical',
+                            similarity,
+                            canReuse: false,
+                            estimatedTokenSavings: 0,
+                            reuseConfidence: 0,
                         });
                     }
                 }

package/dist/learning/sqlite-persistence.d.ts

@@ -91,12 +91,19 @@ export declare class SQLitePatternStore {
     }): QEPattern[];
     /**
      * FTS5 full-text search for patterns.
-     * Returns pattern IDs with BM25 relevance scores.
+     * Returns pattern IDs with BM25 relevance scores. `phrase` marks hits that
+     * also contain the whole query as a phrase (near-duplicate evidence).
+     * `coverage` is the fraction of distinct query terms the hit contains: an
+     * absolute measure, unlike `ftsScore`, which is relative to the best hit.
      */
     searchFTS(query: string, limit?: number): Array<{
         id: string;
         ftsScore: number;
+        phrase: boolean;
+        coverage: number;
     }>;
+    /** IDs whose FTS5 text contains the whole query as one phrase. */
+    private searchFTSPhraseIds;
     /** Last FTS5 search latency in ms, for instrumentation */
     private _lastFtsLatencyMs;
     get lastFtsLatencyMs(): number;

package/dist/learning/sqlite-persistence.js

@@ -16,6 +16,8 @@ import { v4 as uuidv4 } from 'uuid';
 import { safeJsonParse } from '../shared/safe-json.js';
 import { toErrorMessage } from '../shared/error-utils.js';
 import { getUnifiedMemory } from '../kernel/unified-memory.js';
+import { QE_PATTERNS_FTS_SCHEMA } from '../kernel/unified-memory-schemas.js';
+import { ensurePatternFtsInSync } from '../kernel/pattern-fts-self-heal.js';
 import { computeBatchEmbeddings, getEmbeddingDimension, isUsingEndpoint, getActiveEmbeddingSpaceIdentity, } from './real-embeddings.js';
 import { EMBEDDING_SPACE_CANARY, inspectEmbeddingSpaceRows, } from './embedding-space.js';
 import { recordPatternUsage } from './pattern-usage-recorder.js';
@@ -54,6 +56,13 @@ export function hashEmbedding(text, dimension = 384) {
     }
     return embedding;
 }
+/**
+ * Lowercased letter/digit tokens with diacritics removed, approximating the
+ * FTS5 unicode61 tokenizer so query terms and stored text compare alike.
+ */
+function ftsTokens(text) {
+    return text.normalize('NFKD').replace(/\p{M}+/gu, '').toLowerCase().match(/[\p{L}\p{N}]+/gu) ?? [];
+}
 /**
  * SQLite-based pattern persistence
  */
@@ -101,6 +110,11 @@ export class SQLitePatternStore {
                 if (this.config.foreignKeys) {
                     this.db.pragma('foreign_keys = ON');
                 }
+                // Unified mode heals on UnifiedMemoryManager open; legacy DBs get the
+                // same repair. Runs BEFORE createSchema so a missing trigger is still
+                // observable (createSchema would silently recreate it without
+                // rebuilding the drifted index). No-op on a fresh DB.
+                ensurePatternFtsInSync(this.db, { logPrefix: '[SQLitePatternStore]' });
                 // Create schema (only for legacy mode)
                 this.createSchema();
                 console.log(`[SQLitePatternStore] Initialized (legacy): ${this.config.dbPath}`);
@@ -212,30 +226,8 @@ export class SQLitePatternStore {
       CREATE UNIQUE INDEX IF NOT EXISTS idx_patterns_unique_name_domain_type
         ON qe_patterns(name, qe_domain, pattern_type);
 
-      -- FTS5 full-text search index for hybrid vector/text search
-      CREATE VIRTUAL TABLE IF NOT EXISTS qe_patterns_fts USING fts5(
-        name, description, pattern_type, qe_domain,
-        content='qe_patterns',
-        content_rowid='rowid'
-      );
-
-      -- FTS5 triggers to keep index in sync
-      CREATE TRIGGER IF NOT EXISTS qe_patterns_fts_insert AFTER INSERT ON qe_patterns BEGIN
-        INSERT INTO qe_patterns_fts(rowid, name, description, pattern_type, qe_domain)
-        VALUES (new.rowid, new.name, new.description, new.pattern_type, new.qe_domain);
-      END;
-
-      CREATE TRIGGER IF NOT EXISTS qe_patterns_fts_delete AFTER DELETE ON qe_patterns BEGIN
-        INSERT INTO qe_patterns_fts(qe_patterns_fts, rowid, name, description, pattern_type, qe_domain)
-        VALUES ('delete', old.rowid, old.name, old.description, old.pattern_type, old.qe_domain);
-      END;
-
-      CREATE TRIGGER IF NOT EXISTS qe_patterns_fts_update AFTER UPDATE ON qe_patterns BEGIN
-        INSERT INTO qe_patterns_fts(qe_patterns_fts, rowid, name, description, pattern_type, qe_domain)
-        VALUES ('delete', old.rowid, old.name, old.description, old.pattern_type, old.qe_domain);
-        INSERT INTO qe_patterns_fts(rowid, name, description, pattern_type, qe_domain)
-        VALUES (new.rowid, new.name, new.description, new.pattern_type, new.qe_domain);
-      END;
+      -- FTS5 full-text search index + sync triggers (shared DDL)
+      ${QE_PATTERNS_FTS_SCHEMA}
 
       -- Indexes for performance
       CREATE INDEX IF NOT EXISTS idx_patterns_domain ON qe_patterns(qe_domain);
@@ -465,20 +457,29 @@ export class SQLitePatternStore {
     }
     /**
      * FTS5 full-text search for patterns.
-     * Returns pattern IDs with BM25 relevance scores.
+     * Returns pattern IDs with BM25 relevance scores. `phrase` marks hits that
+     * also contain the whole query as a phrase (near-duplicate evidence).
+     * `coverage` is the fraction of distinct query terms the hit contains: an
+     * absolute measure, unlike `ftsScore`, which is relative to the best hit.
      */
     searchFTS(query, limit = 20) {
         if (!this.db)
             throw new Error('Database not initialized');
         if (!query.trim())
             return [];
-        // Sanitize: wrap in double quotes to force literal phrase match,
-        // escaping any internal double quotes to prevent FTS5 syntax injection
-        const sanitized = '"' + query.replace(/"/g, '""') + '"';
+        // #653: match any query term (BM25 ranks docs matching more/rarer terms
+        // higher). A whole-query phrase almost never matched sentence-style task
+        // queries. Terms are letters/digits only, quoted, so FTS5 syntax can't leak in.
+        const terms = [...new Set(ftsTokens(query))]
+            .filter(term => term.length >= 2)
+            .slice(0, 32);
+        if (terms.length === 0)
+            return [];
+        const sanitized = terms.map(term => `"${term}"`).join(' OR ');
         const start = performance.now();
         try {
             const rows = this.db.prepare(`
-        SELECT p.id, rank AS fts_score
+        SELECT p.id, rank AS fts_score, p.name, p.description, p.pattern_type, p.qe_domain
         FROM qe_patterns_fts fts
         JOIN qe_patterns p ON p.rowid = fts.rowid
         WHERE qe_patterns_fts MATCH ?
@@ -494,16 +495,40 @@ export class SQLitePatternStore {
             // Use Math.max(maxScore, 1.0) to prevent single-result inflation:
             // without this, a single FTS5 result always normalizes to 1.0
             const maxAbsScore = Math.max(...rows.map(r => Math.abs(r.fts_score)), 1.0);
-            return rows.map(r => ({
-                id: r.id,
-                ftsScore: Math.abs(r.fts_score) / maxAbsScore,
-            }));
+            const phraseIds = rows.length > 0 ? this.searchFTSPhraseIds(query, limit) : new Set();
+            return rows.map(r => {
+                const docTerms = new Set(ftsTokens([r.name, r.description, r.pattern_type, r.qe_domain].filter(Boolean).join(' ')));
+                const matched = terms.filter(term => docTerms.has(term)).length;
+                return {
+                    id: r.id,
+                    ftsScore: Math.abs(r.fts_score) / maxAbsScore,
+                    phrase: phraseIds.has(r.id),
+                    coverage: matched / terms.length,
+                };
+            });
         }
         catch {
             // FTS5 table may not exist yet (unified DB migrated before schema update)
             return [];
         }
     }
+    /** IDs whose FTS5 text contains the whole query as one phrase. */
+    searchFTSPhraseIds(query, limit) {
+        // Whole query quoted as one phrase, internal quotes escaped (FTS5 syntax-safe)
+        const phrase = '"' + query.replace(/"/g, '""') + '"';
+        try {
+            const rows = this.db.prepare(`
+        SELECT p.id FROM qe_patterns_fts fts
+        JOIN qe_patterns p ON p.rowid = fts.rowid
+        WHERE qe_patterns_fts MATCH ?
+        LIMIT ?
+      `).all(phrase, limit);
+            return new Set(rows.map(r => r.id));
+        }
+        catch {
+            return new Set();
+        }
+    }
     /** Last FTS5 search latency in ms, for instrumentation */
     _lastFtsLatencyMs = 0;
     get lastFtsLatencyMs() { return this._lastFtsLatencyMs; }

package/dist/logging/console-logger.d.ts

@@ -69,13 +69,10 @@ export declare class ConsoleLogger implements Logger {
      */
     private mergeContext;
     /**
-     * Format context object for display
+     * Format context object for display. The context is first reduced to a
+     * redacted, bounded, cycle-free copy (#740), so it serializes safely.
      */
     private formatContext;
-    /**
-     * Create a JSON replacer that handles circular references and depth limiting
-     */
-    private createReplacer;
 }
 /**
  * No-op Logger implementation for use when logging is disabled

package/dist/logging/console-logger.js

@@ -10,6 +10,7 @@
  * - Error stack trace handling
  */
 import { LogLevel, LOG_LEVEL_NAMES, } from './logger.js';
+import { redactLogText, redactLogValue } from './redaction.js';
 /**
  * Default configuration for ConsoleLogger
  */
@@ -61,11 +62,11 @@ export class ConsoleLogger {
                 if (error.stack) {
                     errorContext.stack = error.stack;
                 }
-                // Capture any additional properties on the error
+                // Keep the cause structured; format() redacts it with everything else
                 // Use type assertion for ES2022 Error.cause compatibility
                 const errorWithCause = error;
                 if (errorWithCause.cause !== undefined) {
-                    errorContext.cause = String(errorWithCause.cause);
+                    errorContext.cause = errorWithCause.cause;
                 }
             }
             this.output(LogLevel.ERROR, message, errorContext);
@@ -115,8 +116,8 @@ export class ConsoleLogger {
         }
         // Add domain
         parts.push(`[${this.domain}]`);
-        // Add message
-        parts.push(message);
+        // Add message (#740: redaction is a sink invariant, at every level)
+        parts.push(redactLogText(message));
         // Add context if provided
         const mergedContext = this.mergeContext(context);
         if (mergedContext && Object.keys(mergedContext).length > 0) {
@@ -159,58 +160,21 @@ export class ConsoleLogger {
         };
     }
     /**
-     * Format context object for display
+     * Format context object for display. The context is first reduced to a
+     * redacted, bounded, cycle-free copy (#740), so it serializes safely.
      */
     formatContext(context) {
         try {
+            const safe = redactLogValue(context, { maxDepth: this.config.maxContextDepth + 1 });
             if (this.config.prettyPrint) {
-                return '\n' + JSON.stringify(context, this.createReplacer(), 2);
+                return '\n' + JSON.stringify(safe, null, 2);
             }
-            return JSON.stringify(context, this.createReplacer());
+            return JSON.stringify(safe);
         }
         catch {
             return '[unserializable context]';
         }
     }
-    /**
-     * Create a JSON replacer that handles circular references and depth limiting
-     */
-    createReplacer() {
-        const seen = new WeakSet();
-        let depth = 0;
-        return (_key, value) => {
-            // Handle depth limiting
-            if (typeof value === 'object' && value !== null) {
-                if (depth >= this.config.maxContextDepth) {
-                    return '[object]';
-                }
-                // Handle circular references
-                if (seen.has(value)) {
-                    return '[circular]';
-                }
-                seen.add(value);
-                depth++;
-            }
-            // Handle special types
-            if (value instanceof Error) {
-                return {
-                    name: value.name,
-                    message: value.message,
-                    stack: value.stack,
-                };
-            }
-            if (typeof value === 'bigint') {
-                return value.toString();
-            }
-            if (typeof value === 'function') {
-                return '[function]';
-            }
-            if (typeof value === 'symbol') {
-                return value.toString();
-            }
-            return value;
-        };
-    }
 }
 /**
  * No-op Logger implementation for use when logging is disabled

package/dist/logging/index.d.ts

@@ -39,4 +39,6 @@ export type { ConsoleLoggerConfig } from './console-logger.js';
 export { ConsoleLogger, NullLogger, DEFAULT_CONSOLE_LOGGER_CONFIG } from './console-logger.js';
 export type { LoggerFactoryConfig, LoggerProvider } from './logger-factory.js';
 export { LoggerFactory, createLogger, getLogger } from './logger-factory.js';
+export type { LogRedactionOptions } from './redaction.js';
+export { redactLogValue, redactLogText, formatErrorForLog, isSensitiveLogKey } from './redaction.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/logging/index.js

@@ -36,4 +36,5 @@
 export { LogLevel, LOG_LEVEL_NAMES, parseLogLevel, isLogger } from './logger.js';
 export { ConsoleLogger, NullLogger, DEFAULT_CONSOLE_LOGGER_CONFIG } from './console-logger.js';
 export { LoggerFactory, createLogger, getLogger } from './logger-factory.js';
+export { redactLogValue, redactLogText, formatErrorForLog, isSensitiveLogKey } from './redaction.js';
 //# sourceMappingURL=index.js.map

package/dist/logging/redaction.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Agentic QE v3 - Log redaction (issue #740)
+ *
+ * Sink-side sanitizer applied before any log text is written. Redacts values
+ * under sensitive keys and credential-shaped strings anywhere in a value.
+ * Non-mutating, cycle-safe, bounded, never invokes getters or toJSON, and
+ * fails closed: a value that cannot be inspected is replaced, not printed.
+ *
+ * Heuristic redaction is defense in depth: it does not replace keeping
+ * payloads, headers and configuration out of log events in the first place.
+ */
+export interface LogRedactionOptions {
+    /** Nesting depth beyond which objects become '[object]' */
+    maxDepth?: number;
+    /** Array items / object keys kept per level */
+    maxEntries?: number;
+    /** Characters kept per string after redaction */
+    maxStringLength?: number;
+}
+export declare function isSensitiveLogKey(key: string): boolean;
+/** Redact credential-shaped substrings from free text. */
+export declare function redactLogText(text: string, maxLength?: number): string;
+/** Return a sanitized, JSON-safe copy of `value`. The input is never modified. */
+export declare function redactLogValue(value: unknown, options?: LogRedactionOptions): unknown;
+/** Render a thrown value (Error or not) as redacted text for direct console output. */
+export declare function formatErrorForLog(error: unknown): string;
+//# sourceMappingURL=redaction.d.ts.map