agentic-qe 3.14.7 → 3.14.8

package/dist/cli/utils/ci-config.js

@@ -6,7 +6,7 @@
  */
 import * as fs from 'fs';
 import * as path from 'path';
-import { parseYAMLContent } from './workflow-parser.js';
+import { isCollection, isScalar, parseDocument, visit } from 'yaml';
 // ============================================================================
 // Default Config
 // ============================================================================
@@ -100,89 +100,223 @@ export function parseCIConfigFile(filePath) {
     }
     return parseCIConfigContent(content, filePath);
 }
-/**
- * Parse CI config YAML content.
- */
+const YAML_MAX_LINES = 10000;
+const YAML_MAX_LINE_LENGTH = 10000;
+const YAML_MAX_DEPTH = 20;
+const UNSAFE_YAML_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) &&
+        (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
+}
+/** Keep the previous parser's input bounds; reject unsafe expanded aliases too. */
+function parseCIYAML(content) {
+    const lines = content.split('\n');
+    if (lines.length > YAML_MAX_LINES)
+        throw new Error(`YAML exceeds maximum allowed lines (${YAML_MAX_LINES})`);
+    if (lines.some(line => line.length > YAML_MAX_LINE_LENGTH)) {
+        throw new Error(`YAML exceeds maximum line length (${YAML_MAX_LINE_LENGTH})`);
+    }
+    const document = parseDocument(content, { prettyErrors: false, merge: true });
+    if (document.errors.length)
+        throw new Error(document.errors.map(error => error.message).join('; '));
+    visit(document, {
+        Collection: (_key, _node, ancestry) => {
+            if (ancestry.filter(isCollection).length >= YAML_MAX_DEPTH) {
+                throw new Error(`YAML exceeds maximum depth (${YAML_MAX_DEPTH})`);
+            }
+        },
+        Pair: (_key, pair) => {
+            if (isScalar(pair.key) && UNSAFE_YAML_KEYS.has(String(pair.key.value))) {
+                throw new Error(`Unsafe YAML key: ${pair.key.value}`);
+            }
+        },
+    });
+    const parsed = document.contents === null ? {} : document.toJS({ maxAliasCount: 100 });
+    // Alias references may add nesting or cycles that the syntax tree does not show.
+    function checkExpanded(value, depth, ancestors) {
+        if (value === null || typeof value !== 'object')
+            return;
+        if (depth > YAML_MAX_DEPTH)
+            throw new Error(`YAML exceeds maximum depth (${YAML_MAX_DEPTH})`);
+        if (ancestors.has(value))
+            throw new Error('Cyclic YAML aliases are not supported');
+        ancestors.add(value);
+        for (const child of Object.values(value))
+            checkExpanded(child, depth + 1, ancestors);
+        ancestors.delete(value);
+    }
+    checkExpanded(parsed, 0, new Set());
+    if (!isRecord(parsed))
+        throw new Error('CI config must be a YAML mapping');
+    return parsed;
+}
+/** Parse CI YAML faithfully, validating typed fields before any phase executes. */
 export function parseCIConfigContent(content, sourcePath) {
-    const errors = [];
     let parsed;
     try {
-        parsed = parseYAMLContent(content);
+        parsed = parseCIYAML(content);
     }
     catch (err) {
         return { success: false, errors: [`Invalid YAML: ${err}`] };
     }
-    // Build config with defaults
-    const config = {
-        version: parsed.version || DEFAULT_CI_CONFIG.version,
-        name: parsed.name || DEFAULT_CI_CONFIG.name,
-        phases: [],
-        output: { ...DEFAULT_CI_CONFIG.output },
-        qualityGate: { ...DEFAULT_CI_CONFIG.qualityGate, thresholds: { ...DEFAULT_CI_CONFIG.qualityGate.thresholds } },
-    };
-    // Parse output section
-    if (parsed.output && typeof parsed.output === 'object') {
-        const out = parsed.output;
-        if (out.format)
-            config.output.format = out.format;
-        if (out.directory)
-            config.output.directory = out.directory;
-        if (out.combined_report !== undefined)
-            config.output.combinedReport = out.combined_report;
-    }
-    // Parse quality_gate section
-    if (parsed.quality_gate && typeof parsed.quality_gate === 'object') {
-        const qg = parsed.quality_gate;
-        if (qg.enforced !== undefined)
-            config.qualityGate.enforced = qg.enforced;
-        if (qg.thresholds && typeof qg.thresholds === 'object') {
-            const th = qg.thresholds;
-            if (th.coverage !== undefined)
-                config.qualityGate.thresholds.coverage = th.coverage;
-            if (th.security !== undefined)
-                config.qualityGate.thresholds.security = th.security;
-            if (th.quality !== undefined)
-                config.qualityGate.thresholds.quality = th.quality;
+    const errors = [];
+    const config = getDefaultCIConfig();
+    function readString(record, key, fallback, label) {
+        const value = record[key];
+        if (value === undefined)
+            return fallback;
+        if (typeof value !== 'string' || !value.trim()) {
+            errors.push(`${label} must be a non-empty string`);
+            return fallback;
         }
+        return value;
     }
-    // Parse phases
-    if (parsed.phases && Array.isArray(parsed.phases)) {
-        for (let i = 0; i < parsed.phases.length; i++) {
-            const p = parsed.phases[i];
-            if (!p.name) {
-                errors.push(`Phase ${i + 1} must have a "name" field`);
-                continue;
-            }
-            if (!p.type) {
-                errors.push(`Phase "${p.name}" must have a "type" field`);
-                continue;
-            }
-            const validTypes = ['test', 'coverage', 'security', 'quality-gate', 'code-intelligence', 'custom'];
-            if (!validTypes.includes(p.type)) {
-                errors.push(`Phase "${p.name}" has invalid type "${p.type}". Valid: ${validTypes.join(', ')}`);
-                continue;
+    function readBoolean(record, key, fallback, label) {
+        const value = record[key];
+        if (value === undefined)
+            return fallback;
+        if (typeof value !== 'boolean') {
+            errors.push(`${label} must be a boolean`);
+            return fallback;
+        }
+        return value;
+    }
+    if (parsed.version !== undefined) {
+        if (typeof parsed.version === 'number' && Number.isFinite(parsed.version))
+            config.version = String(parsed.version);
+        else
+            config.version = readString(parsed, 'version', config.version, 'version');
+    }
+    config.name = readString(parsed, 'name', config.name, 'name');
+    if (parsed.output !== undefined) {
+        if (!isRecord(parsed.output))
+            errors.push('output must be a mapping');
+        else {
+            config.output.format = readString(parsed.output, 'format', config.output.format, 'output.format');
+            config.output.directory = readString(parsed.output, 'directory', config.output.directory, 'output.directory');
+            config.output.combinedReport = readBoolean(parsed.output, 'combined_report', config.output.combinedReport, 'output.combined_report');
+        }
+    }
+    if (parsed.quality_gate !== undefined) {
+        if (!isRecord(parsed.quality_gate))
+            errors.push('quality_gate must be a mapping');
+        else {
+            const gate = parsed.quality_gate;
+            config.qualityGate.enforced = readBoolean(gate, 'enforced', config.qualityGate.enforced, 'quality_gate.enforced');
+            if (gate.thresholds !== undefined) {
+                if (!isRecord(gate.thresholds))
+                    errors.push('quality_gate.thresholds must be a mapping');
+                else {
+                    for (const key of ['coverage', 'quality']) {
+                        const value = gate.thresholds[key];
+                        if (value === undefined)
+                            continue;
+                        if (typeof value !== 'number' || !Number.isFinite(value) || value < 0 || value > 100) {
+                            errors.push(`quality_gate.thresholds.${key} must be a finite number between 0 and 100`);
+                        }
+                        else
+                            config.qualityGate.thresholds[key] = value;
+                    }
+                    if (gate.thresholds.security !== undefined) {
+                        const value = gate.thresholds.security;
+                        if (typeof value !== 'string' || !['none', 'low', 'medium', 'high'].includes(value)) {
+                            errors.push('quality_gate.thresholds.security must be none, low, medium or high');
+                        }
+                        else
+                            config.qualityGate.thresholds.security = value;
+                    }
+                }
             }
-            const phase = {
-                name: p.name,
-                type: p.type,
-                enabled: p.enabled !== false,
-                config: p.config || {},
-                continueOnFailure: p.continue_on_failure || false,
-                timeout: p.timeout || 300,
-            };
-            config.phases.push(phase);
         }
     }
-    else {
-        // Use defaults if no phases specified
-        config.phases = [...DEFAULT_CI_CONFIG.phases];
+    if (parsed.phases !== undefined) {
+        config.phases = [];
+        if (!Array.isArray(parsed.phases))
+            errors.push('phases must be a sequence');
+        else
+            for (const [index, value] of parsed.phases.entries()) {
+                if (!isRecord(value)) {
+                    errors.push(`Phase ${index + 1} must be a mapping`);
+                    continue;
+                }
+                if (value.name === undefined)
+                    errors.push(`Phase ${index + 1} must have a name`);
+                const name = readString(value, 'name', '', `Phase ${index + 1} name`);
+                const validTypes = ['test', 'coverage', 'security', 'quality-gate', 'code-intelligence', 'custom'];
+                if (!validTypes.includes(value.type)) {
+                    errors.push(`Phase "${name}" has invalid type "${value.type}". Valid: ${validTypes.join(', ')}`);
+                    continue;
+                }
+                let timeout = 300;
+                if (value.timeout !== undefined) {
+                    if (typeof value.timeout !== 'number' || !Number.isFinite(value.timeout) || value.timeout <= 0) {
+                        errors.push(`Phase "${name}" timeout must be a positive finite number`);
+                    }
+                    else
+                        timeout = value.timeout;
+                }
+                if (value.config !== undefined && !isRecord(value.config))
+                    errors.push(`Phase "${name}" config must be a mapping`);
+                config.phases.push({
+                    name, type: value.type, timeout,
+                    enabled: readBoolean(value, 'enabled', true, `Phase "${name}" enabled`),
+                    continueOnFailure: readBoolean(value, 'continue_on_failure', false, `Phase "${name}" continue_on_failure`),
+                    config: isRecord(value.config) ? { ...value.config } : {},
+                });
+            }
     }
-    if (config.phases.length === 0) {
+    if (config.phases.length === 0)
         errors.push('Config must have at least one phase');
+    // Paths in a file are relative to that file's project, not the caller's cwd.
+    // Resolve existing ancestors too so a symlink cannot bypass containment.
+    const root = path.resolve(sourcePath ? path.dirname(sourcePath) : process.cwd());
+    function canonicalAncestor(candidate) {
+        let ancestor = candidate;
+        const suffix = [];
+        while (!fs.existsSync(ancestor)) {
+            const parent = path.dirname(ancestor);
+            if (parent === ancestor)
+                break;
+            suffix.unshift(path.basename(ancestor));
+            ancestor = parent;
+        }
+        return path.resolve(fs.realpathSync(ancestor), ...suffix);
     }
-    if (errors.length > 0) {
-        return { success: false, config, errors };
+    function containedPath(value, label) {
+        if (typeof value !== 'string' || !value.trim() || value.includes('\0')) {
+            errors.push(`${label} must be a non-empty relative path`);
+            return undefined;
+        }
+        const resolved = path.resolve(root, value);
+        const relative = path.relative(root, resolved);
+        if (path.isAbsolute(value) || path.win32.isAbsolute(value) ||
+            relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+            errors.push(`${label} must stay inside the project and use a relative path`);
+            return undefined;
+        }
+        try {
+            const realRelative = path.relative(canonicalAncestor(root), canonicalAncestor(resolved));
+            if (realRelative === '..' || realRelative.startsWith(`..${path.sep}`) || path.isAbsolute(realRelative)) {
+                errors.push(`${label} must stay inside the project (symlink escapes are not allowed)`);
+                return undefined;
+            }
+        }
+        catch (error) {
+            errors.push(`${label} cannot be resolved safely: ${error}`);
+            return undefined;
+        }
+        return sourcePath ? resolved : value;
+    }
+    config.output.directory = containedPath(config.output.directory, 'output.directory') ?? config.output.directory;
+    for (const phase of config.phases) {
+        if (phase.config.target !== undefined) {
+            const target = containedPath(phase.config.target, `Phase "${phase.name}" config.target`);
+            if (target !== undefined)
+                phase.config.target = target;
+        }
     }
+    if (errors.length > 0)
+        return { success: false, config, errors };
     return { success: true, config, errors: [], configPath: sourcePath };
 }
 /**

package/dist/domains/quality-assessment/quality-evidence.d.ts

@@ -33,7 +33,9 @@ export declare function loadQualityEvidence(memory: MemoryBackend, options?: {
     now?: number;
     maxAgeMs?: number;
 }): Promise<QualityEvidenceValues>;
-export declare function evaluateQualityEvidence(values: QualityEvidenceValues): {
+export declare function evaluateQualityEvidence(values: QualityEvidenceValues, thresholds?: {
+    coverage?: number;
+}): {
     passed: boolean;
     checks: EvaluatedQualityCheck[];
     recommendations: string[];

package/dist/domains/quality-assessment/quality-evidence.js

@@ -91,9 +91,14 @@ export async function loadQualityEvidence(memory, options = {}) {
     }
     return values;
 }
-export function evaluateQualityEvidence(values) {
+export function evaluateQualityEvidence(values, thresholds = {}) {
+    if (thresholds.coverage !== undefined && (!Number.isFinite(thresholds.coverage) || thresholds.coverage < 0 || thresholds.coverage > 100)) {
+        throw new Error('Coverage quality threshold must be a finite number between 0 and 100.');
+    }
     const checks = QUALITY_METRICS.map((name) => {
-        const threshold = DEFAULT_QUALITY_THRESHOLDS[name];
+        const threshold = name === 'coverage' && thresholds.coverage !== undefined
+            ? { ...DEFAULT_QUALITY_THRESHOLDS[name], value: thresholds.coverage }
+            : DEFAULT_QUALITY_THRESHOLDS[name];
         const value = values[name];
         return {
             name,

package/dist/domains/test-execution/services/retry-handler.js

@@ -11,6 +11,7 @@ import { TEST_EXECUTION_CONSTANTS, RETRY_CONSTANTS } from '../../constants.js';
 import { toError } from '../../../shared/error-utils.js';
 import { safeJsonParse } from '../../../shared/safe-json.js';
 import { secureRandom } from '../../../shared/utils/crypto-random.js';
+import { terminateTestRunner, trackTestRunnerExit } from '../../../shared/test-runner-process.js';
 const DEFAULT_RETRY_CONFIG = {
     simulateForTesting: false,
     simulatedRetrySuccessRate: RETRY_CONSTANTS.DEFAULT_FLAKY_PASS_RATE,
@@ -379,6 +380,8 @@ export class RetryHandlerService {
             let stdout = '';
             let stderr = '';
             let timedOut = false;
+            let termination;
+            const timeoutError = new Error(`Test execution timed out after ${timeout}ms for command: ${command} ${args.join(' ')}`);
             const settle = (fn, value) => {
                 report?.cleanup();
                 fn(value);
@@ -387,13 +390,20 @@ export class RetryHandlerService {
             // Arguments are passed as array to avoid shell interpretation
             const proc = spawn(command, args, {
                 cwd,
+                detached: process.platform !== 'win32',
                 env: { ...process.env, FORCE_COLOR: '0', CI: 'true' },
             });
+            const untrackExit = trackTestRunnerExit(proc);
             const timeoutHandle = setTimeout(() => {
                 timedOut = true;
-                proc.kill('SIGTERM');
-                // Give it a moment to terminate gracefully, then force kill
-                setTimeout(() => proc.kill('SIGKILL'), 1000);
+                termination = terminateTestRunner(proc);
+                termination.catch(error => {
+                    logger.warn(`Retry runner cleanup failed: ${toError(error).message}`);
+                    // A denied cleanup can leave the root alive: preserve the timeout
+                    // outcome immediately, keeping artifacts because settlement is unknown.
+                    reject(timeoutError);
+                });
+                termination.then(untrackExit, () => undefined);
             }, timeout);
             proc.stdout?.on('data', (data) => {
                 stdout += data.toString();
@@ -404,9 +414,10 @@ export class RetryHandlerService {
             proc.on('close', (code) => {
                 clearTimeout(timeoutHandle);
                 if (timedOut) {
-                    settle(reject, new Error(`Test execution timed out after ${timeout}ms for command: ${command} ${args.join(' ')}`));
+                    termination?.then(() => settle(reject, timeoutError), () => reject(timeoutError));
                     return;
                 }
+                untrackExit();
                 // Parse result based on exit code and output (Vitest writes the JSON
                 // report to the --outputFile; read it back rather than trusting stdout).
                 try {
@@ -422,6 +433,7 @@ export class RetryHandlerService {
             });
             proc.on('error', (err) => {
                 clearTimeout(timeoutHandle);
+                untrackExit();
                 report?.cleanup();
                 reject(new Error(`Failed to spawn test process: ${err.message}. ` +
                     `Command: ${command} ${args.join(' ')}. ` +
@@ -433,20 +445,23 @@ export class RetryHandlerService {
      * Parse test runner output to determine pass/fail status
      */
     parseTestResult(exitCode, stdout, stderr) {
-        // A passing process and a passing report must agree when JSON is available.
+        // A retry can clear a prior failure only when the report proves a test
+        // actually passed. Empty/fully skipped selections can also exit zero.
         try {
             // Vitest JSON output
             const vitestMatch = stdout.match(/\{[\s\S]*"testResults"[\s\S]*\}/);
             if (vitestMatch) {
                 const result = safeJsonParse(vitestMatch[0]);
                 if (exitCode === 0 && result.success !== false
-                    && result.numFailedTests === 0 && result.numFailedTestSuites === 0) {
+                    && result.numFailedTests === 0 && result.numFailedTestSuites === 0
+                    && Number.isFinite(result.numPassedTests) && result.numPassedTests > 0) {
                     return { passed: true };
                 }
                 const failedTest = result.testResults?.[0]?.assertionResults?.find((r) => r.status === 'failed');
                 return {
                     passed: false,
-                    error: failedTest?.failureMessages?.join('\n') || stderr || `Test failed with exit code ${exitCode}`,
+                    error: failedTest?.failureMessages?.join('\n') || stderr
+                        || (exitCode === 0 ? 'Retry runner did not report any passing tests.' : `Test failed with exit code ${exitCode}`),
                 };
             }
             // Jest JSON output
@@ -454,34 +469,38 @@ export class RetryHandlerService {
             if (jestMatch) {
                 const result = safeJsonParse(jestMatch[0]);
                 if (exitCode === 0 && result.success !== false
-                    && result.numFailedTests === 0 && result.numFailedTestSuites === 0) {
+                    && result.numFailedTests === 0 && result.numFailedTestSuites === 0
+                    && Number.isFinite(result.numPassedTests) && result.numPassedTests > 0) {
                     return { passed: true };
                 }
                 const failedTest = result.testResults?.[0]?.assertionResults?.find((r) => r.status === 'failed');
                 return {
                     passed: false,
-                    error: failedTest?.failureMessages?.join('\n') || stderr || `Test failed with exit code ${exitCode}`,
+                    error: failedTest?.failureMessages?.join('\n') || stderr
+                        || (exitCode === 0 ? 'Retry runner did not report any passing tests.' : `Test failed with exit code ${exitCode}`),
                 };
             }
             // Mocha JSON output
             const mochaMatch = stdout.match(/\{[\s\S]*"stats"[\s\S]*"failures"[\s\S]*\}/);
             if (mochaMatch) {
                 const result = safeJsonParse(mochaMatch[0]);
-                if (exitCode === 0 && result.stats?.failures === 0) {
+                if (exitCode === 0 && result.stats?.failures === 0
+                    && Number.isFinite(result.stats?.passes) && result.stats.passes > 0) {
                     return { passed: true };
                 }
                 const failure = result.failures?.[0];
                 return {
                     passed: false,
-                    error: failure?.err?.message || stderr || `Test failed with exit code ${exitCode}`,
+                    error: failure?.err?.message || stderr
+                        || (exitCode === 0 ? 'Retry runner did not report any passing tests.' : `Test failed with exit code ${exitCode}`),
                 };
             }
         }
         catch {
-            // JSON parsing failed, fall back to simple exit code check
+            // Unreadable output cannot prove that the retry executed a passing test.
         }
         if (exitCode === 0)
-            return { passed: true };
+            return { passed: false, error: 'Retry runner did not report any passing tests.' };
         // Non-zero exit code means failure
         const errorOutput = stderr || stdout || `Test failed with exit code ${exitCode}`;
         return {

package/dist/domains/test-execution/services/test-executor.d.ts

@@ -170,9 +170,9 @@ export declare class TestExecutorService implements ITestExecutionService {
      */
     private extractCoverageFromJson;
     /**
-     * Read coverage from disk files written by vitest/jest.
-     * Both runners write coverage-summary.json to a coverage/ directory when
-     * --coverage is passed, rather than embedding it in stdout JSON.
+     * Read coverage from the private output directory of a completed runner.
+     * Setting the directory does not enable coverage; project configuration
+     * still decides whether coverage is collected.
      */
     private readCoverageFromDisk;
     private storeResults;