agentic-qe 3.15.1 → 3.15.3

package/dist/cli/chunks/{workflow-JPA5Y7L6.js → workflow-XUQXIRNE.js}

@@ -1,5 +1,5 @@
-import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.1");process.exit(0)}
-import"./chunk-JYF3QF4C.js";import{b as $}from"./chunk-C3BW3Q27.js";import{a as k,b as W,c as v,g as C}from"./chunk-27S47AYK.js";import{c as b}from"./chunk-5C4UYXQL.js";import"./chunk-PZDI7WQ3.js";import"./chunk-ARWSPV2C.js";import"./chunk-PNK5KHSI.js";import{Command as D}from"commander";import o from"chalk";function O(w,i){let h=w.indexOf("=");return h>0&&(i[w.substring(0,h)]=w.substring(h+1)),i}function V(w,i,h){let m=new D("workflow").description("Manage QE workflows and pipelines (ADR-041)");return m.command("run <file>").description("Execute a QE pipeline from YAML file").option("-w, --watch","Watch execution progress").option("-v, --verbose","Show detailed output").option("--params <json>","Additional parameters as JSON","{}").action(async(n,t)=>{if(!await h())return;let u=(await import("path")).resolve(n);try{console.log(o.blue(`
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.3");process.exit(0)}
+import"./chunk-M3ACHBC7.js";import{b as $}from"./chunk-A6PII4R4.js";import{a as k,b as W,c as v,g as C}from"./chunk-QDQLL2QB.js";import{c as b}from"./chunk-UGNTLSBL.js";import"./chunk-Z7UGEQ4G.js";import"./chunk-2GJJGO5D.js";import"./chunk-WSUYEVSY.js";import{Command as D}from"commander";import o from"chalk";function O(w,i){let h=w.indexOf("=");return h>0&&(i[w.substring(0,h)]=w.substring(h+1)),i}function V(w,i,h){let m=new D("workflow").description("Manage QE workflows and pipelines (ADR-041)");return m.command("run <file>").description("Execute a QE pipeline from YAML file").option("-w, --watch","Watch execution progress").option("-v, --verbose","Show detailed output").option("--params <json>","Additional parameters as JSON","{}").action(async(n,t)=>{if(!await h())return;let u=(await import("path")).resolve(n);try{console.log(o.blue(`
  Running workflow from: ${n}
 `));let l=k(u);if(!l.success||!l.workflow){console.log(o.red("Failed to parse pipeline:"));for(let g of l.errors)console.log(o.red(`   ${g}`));await i(1)}let f={...b(t.params,"params")};if(l.pipeline){for(let g of l.pipeline.stages)if(g.params)for(let[y,p]of Object.entries(g.params))f[y]=p}if(!w.workflowOrchestrator.getWorkflow(l.workflow.id)){let g=w.workflowOrchestrator.registerWorkflow(l.workflow);g.success||(console.log(o.red(`Failed to register workflow: ${g.error.message}`)),await i(1))}let c=await w.workflowOrchestrator.executeWorkflow(l.workflow.id,f);if(!c.success){console.log(o.red(`Failed to start workflow: ${c.error.message}`)),await i(1);return}let a=c.value;if(console.log(o.cyan(`  Execution ID: ${a}`)),console.log(o.gray(`  Workflow: ${l.workflow.name}`)),console.log(o.gray(`  Stages: ${l.workflow.steps.length}`)),console.log(""),t.watch){console.log(o.blue(`Workflow Progress:
 `));let g,y=Date.now();for(;;){let d=w.workflowOrchestrator.getWorkflowStatus(a);if(!d)break;if(!g||g.progress!==d.progress||g.status!==d.status||JSON.stringify(g.currentSteps)!==JSON.stringify(d.currentSteps)){process.stdout.write("\r\x1B[K");let S="\u2588".repeat(Math.floor(d.progress/5))+"\u2591".repeat(20-Math.floor(d.progress/5)),R=d.status==="completed"?o.green:d.status==="failed"?o.red:d.status==="running"?o.yellow:o.gray;console.log(`  [${S}] ${d.progress}% - ${R(d.status)}`),d.currentSteps.length>0&&t.verbose&&console.log(o.gray(`    Running: ${d.currentSteps.join(", ")}`)),g=d}if(d.status==="completed"||d.status==="failed"||d.status==="cancelled")break;await new Promise(S=>setTimeout(S,500))}let p=w.workflowOrchestrator.getWorkflowStatus(a);if(p){console.log("");let d=p.duration||Date.now()-y;p.status==="completed"?(console.log(o.green("Workflow completed successfully")),console.log(o.gray(`   Duration: ${$(d)}`)),console.log(o.gray(`   Completed: ${p.completedSteps.length} stages`)),p.skippedSteps.length>0&&console.log(o.yellow(`   Skipped: ${p.skippedSteps.length} stages`))):p.status==="failed"?(console.log(o.red("Workflow failed")),console.log(o.red(`   Error: ${p.error}`)),console.log(o.gray(`   Failed stages: ${p.failedSteps.join(", ")}`))):console.log(o.yellow(`Workflow ${p.status}`))}console.log(""),await i(p?.status==="completed"?0:1);return}else console.log(o.green("Workflow execution started")),console.log(o.gray(`   Use 'aqe workflow status ${a}' to check progress`));console.log(""),await i(0)}catch(l){console.error(o.red(`
@@ -35,10 +35,10 @@ Workflow cancelled: ${n}
 `)):console.log(o.red(`
 Failed to cancel workflow: ${t.error.message}
 `)),await i(t.success?0:1)}catch(t){console.error(o.red(`
-Failed to cancel workflow:`),t),await i(1)}}),m.command("browser-list").description("List available browser workflow templates").action(async()=>{try{let{BrowserWorkflowTool:n}=await import("./browser-workflow-WN7XNTCJ.js"),e=await new n().invoke({});if(e.success&&e.data){console.log(o.blue(`
+Failed to cancel workflow:`),t),await i(1)}}),m.command("browser-list").description("List available browser workflow templates").action(async()=>{try{let{BrowserWorkflowTool:n}=await import("./browser-workflow-AEMIS6PA.js"),e=await new n().invoke({});if(e.success&&e.data){console.log(o.blue(`
  Browser Workflow Templates:
 `));for(let u of e.data.availableTemplates)console.log(`  ${o.cyan(u)}`);console.log("")}else console.log(o.red(`Failed: ${e.error||"Unknown error"}`));await i(0)}catch(n){console.error(o.red(`
-Failed:`),n),await i(1)}}),m.command("browser-load [template]").description("Load and validate a browser workflow template or inline YAML").option("--yaml <yaml>","Inline YAML workflow definition").option("-v, --var <key=value>","Variable override (repeatable)",O,{}).option("-F, --format <format>","Output format (text|json)","text").option("-o, --output <path>","Write output to file").action(async(n,t)=>{try{let{BrowserWorkflowTool:e}=await import("./browser-workflow-WN7XNTCJ.js"),{writeOutput:u,toJSON:l}=await import("./ci-output-EBSUG6HP.js"),s=new e,f={variables:t.var||{}};if(t.yaml)f.workflowYaml=t.yaml;else if(n)if(n.endsWith(".yaml")||n.endsWith(".yml")){let c=await import("fs"),g=(await import("path")).resolve(n);c.existsSync(g)||(console.log(o.red(`
+Failed:`),n),await i(1)}}),m.command("browser-load [template]").description("Load and validate a browser workflow template or inline YAML").option("--yaml <yaml>","Inline YAML workflow definition").option("-v, --var <key=value>","Variable override (repeatable)",O,{}).option("-F, --format <format>","Output format (text|json)","text").option("-o, --output <path>","Write output to file").action(async(n,t)=>{try{let{BrowserWorkflowTool:e}=await import("./browser-workflow-AEMIS6PA.js"),{writeOutput:u,toJSON:l}=await import("./ci-output-DPHTFIGX.js"),s=new e,f={variables:t.var||{}};if(t.yaml)f.workflowYaml=t.yaml;else if(n)if(n.endsWith(".yaml")||n.endsWith(".yml")){let c=await import("fs"),g=(await import("path")).resolve(n);c.existsSync(g)||(console.log(o.red(`
 File not found: ${g}
 `)),await i(1)),f.workflowYaml=c.readFileSync(g,"utf-8")}else f.templateName=n;else console.log(o.red(`
 Provide a template name or --yaml. Use "workflow browser-list" to see templates.

package/dist/cli/chunks/workflow-orchestrator-ZVFSNRYZ.js

@@ -0,0 +1,2 @@
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.3");process.exit(0)}
+import{a,b,c,d}from"./chunk-AEL4XJGJ.js";import"./chunk-DH5NWHH2.js";import"./chunk-7SWHW5AC.js";import"./chunk-OGARNKLS.js";import"./chunk-UGNTLSBL.js";import"./chunk-ASUXS4N4.js";import"./chunk-UTALYUMW.js";import"./chunk-NT6FYFJA.js";import"./chunk-7TW5UGDP.js";import"./chunk-D6PUDLJ4.js";import"./chunk-M3ONCPSU.js";import"./chunk-HVIFA73X.js";import"./chunk-CNQUU6CF.js";import"./chunk-POTVF6BY.js";import"./chunk-Z7UGEQ4G.js";import"./chunk-WSND64RL.js";import"./chunk-INVDDFJC.js";import"./chunk-FPFGN2Z5.js";import"./chunk-WLOHTLHO.js";import"./chunk-2GJJGO5D.js";import"./chunk-6TYTBQPV.js";import"./chunk-YTRGMILO.js";import"./chunk-Z7JPWXW2.js";import"./chunk-34Y4CIHD.js";import"./chunk-WSUYEVSY.js";export{b as DEFAULT_WORKFLOW_CONFIG,a as WorkflowEvents,c as WorkflowOrchestrator,d as createWorkflowOrchestrator};

package/dist/cli/chunks/wrappers-YVF5SQUN.js

@@ -0,0 +1,2 @@
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.3");process.exit(0)}
+import{a,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v as L,w as M,x as N}from"./chunk-YQ3ZW47V.js";import{a as v,b as w,c as x,d as y,e as z,f as A,g as B,h as C,i as D,j as E,k as F,l as G,m as H,n as I,o as J,p as K}from"./chunk-WTMLRMKW.js";import"./chunk-7SWHW5AC.js";import"./chunk-OGARNKLS.js";import"./chunk-UGNTLSBL.js";import"./chunk-ASUXS4N4.js";import"./chunk-UTALYUMW.js";import"./chunk-NT6FYFJA.js";import"./chunk-7TW5UGDP.js";import"./chunk-D6PUDLJ4.js";import"./chunk-M3ONCPSU.js";import"./chunk-HVIFA73X.js";import"./chunk-CNQUU6CF.js";import"./chunk-WSND64RL.js";import"./chunk-INVDDFJC.js";import"./chunk-FPFGN2Z5.js";import"./chunk-WLOHTLHO.js";import"./chunk-2GJJGO5D.js";import"./chunk-6TYTBQPV.js";import"./chunk-YTRGMILO.js";import"./chunk-Z7JPWXW2.js";import"./chunk-34Y4CIHD.js";import"./chunk-WSUYEVSY.js";export{z as GNNLayerFactory,i as QEFlashAttention,x as QEGNNEmbeddingIndex,y as QEGNNIndexFactory,a as QESONA,e as QE_FLASH_ATTENTION_CONFIG,g as QE_PERFORMANCE_TARGETS,f as QE_SONA_CONFIG,A as TensorCompressionFactory,u as batchComputeAttention,K as batchDifferentiableSearch,M as checkRuvectorPackagesAvailable,c as createDomainQESONA,j as createQEFlashAttention,b as createQESONA,D as getDifferentiableSearch,F as getGetCompressionLevel,E as getHierarchicalForward,G as getInit,h as getOptimalBlockConfig,k as getQEFlashAttentionConfig,n as getRuvectorDotProductAttention,m as getRuvectorFlashAttention,p as getRuvectorHyperbolicAttention,B as getRuvectorLayer,q as getRuvectorLinearAttention,r as getRuvectorMoEAttention,o as getRuvectorMultiHeadAttention,L as getRuvectorPackageVersions,C as getTensorCompress,l as getWorkloadTypes,N as initAllRuvectorPackages,w as initGNN,d as isAttentionAvailable,v as isGNNAvailable,s as toFloat32Array,H as toFloat32ArrayGNN,J as toIEmbedding,t as toNumberArrayAttn,I as toNumberArrayGNN};

package/dist/cli/commands/test.js

@@ -9,6 +9,8 @@ import { filterTestFilesForFramework, walkSourceFiles } from '../utils/file-disc
 import { writeOutput, toJSON, toJUnit, testRunToMarkdown } from '../utils/ci-output.js';
 import { writeQualityEvidence } from '../../domains/quality-assessment/quality-evidence.js';
 import { validateBehaviorExamples } from '../../domains/test-generation/services/behavior-example-validation.js';
+import { findProjectRoot } from '../../kernel/project-root.js';
+import { writeGeneratedTestFile } from '../utils/generated-test-writer.js';
 export function createTestCommand(context, cleanupAndExit, ensureInitialized) {
     const testCmd = new Command('test')
         .description('Test generation, execution, scheduling, and load testing')
@@ -19,6 +21,8 @@ export function createTestCommand(context, cleanupAndExit, ensureInitialized) {
         .option('-t, --type <type>', 'Test type (unit|integration|e2e)', 'unit')
         .option('-F, --format <format>', 'Output format (text|json|junit|markdown)', 'text')
         .option('-o, --output <path>', 'Write output to file')
+        .option('--no-save', 'generate action: print the generated test code instead of writing test files beside the source (#925)')
+        .option('--force', 'generate action: overwrite existing test files instead of skipping them')
         .option('--git-ref <ref>', 'Git ref for schedule action (e.g., main, HEAD~3)')
         .option('--no-git-aware', 'Disable git-aware test selection (schedule action)')
         .option('--no-flaky', 'Disable flaky test tracking (schedule action)')
@@ -95,27 +99,56 @@ export function createTestCommand(context, cleanupAndExit, ensureInitialized) {
                         // Default text output
                         console.log(chalk.green(`Generated ${generated.tests.length} tests\n`));
                         console.log(chalk.cyan('  Tests:'));
-                        for (const test of generated.tests.slice(0, 10)) {
+                        // #925/#936: every generated test is handled, with or without
+                        // --no-save. A cap here used to drop tests past the 10th
+                        // without writing or printing them.
+                        const noSave = options.save === false;
+                        // Files may only be written inside the project that owns the target.
+                        const fs = await import('fs');
+                        const projectRoot = findProjectRoot(fs.statSync(targetPath).isDirectory() ? targetPath : path.dirname(targetPath));
+                        let written = 0;
+                        let skipped = 0;
+                        for (const test of generated.tests) {
                             console.log(`    ${chalk.white(test.name)}`);
                             console.log(chalk.gray(`      Source: ${path.basename(test.sourceFile)}`));
                             console.log(chalk.gray(`      Assertions: ${test.assertions}`));
                             if (test.testCode) {
+                                if (noSave) {
+                                    console.log(chalk.gray(`      Would be written to: ${test.testFile} (not written, --no-save)`));
+                                    console.log(`      ----- ${path.basename(test.testFile)} -----`);
+                                    console.log(test.testCode);
+                                    console.log(`      ----- end ${path.basename(test.testFile)} -----`);
+                                    continue;
+                                }
                                 console.log(chalk.gray(`      Test File: ${test.testFile}`));
-                                // Bug #295 fix: Write generated test code to disk
-                                const fs = await import('fs');
-                                const testDir = path.dirname(test.testFile);
-                                fs.mkdirSync(testDir, { recursive: true });
-                                fs.writeFileSync(test.testFile, test.testCode, 'utf-8');
-                                console.log(chalk.green(`      Written to: ${test.testFile}`));
+                                // Bug #295 fix: Write generated test code to disk, but never
+                                // outside the project or over an existing file without --force.
+                                const outcome = writeGeneratedTestFile(test.testFile, test.testCode, { projectRoot, force: options.force === true });
+                                if (outcome.status === 'written') {
+                                    console.log(chalk.green(`      Written to: ${outcome.path}`));
+                                    written++;
+                                }
+                                else if (outcome.status === 'exists') {
+                                    console.log(chalk.yellow(`      ${outcome.path} exists, skipped (use --force to overwrite)`));
+                                    skipped++;
+                                }
+                                else {
+                                    console.log(chalk.red(`      ${outcome.path} is outside the project root ${projectRoot}, skipped (not written)`));
+                                    skipped++;
+                                }
                             }
                         }
-                        if (generated.tests.length > 10) {
-                            console.log(chalk.gray(`    ... and ${generated.tests.length - 10} more`));
+                        if (!noSave) {
+                            const skippedNote = skipped > 0 ? ` (${skipped} skipped)` : '';
+                            console.log(chalk.gray(`\n  Wrote ${written} of ${generated.tests.length} generated test files${skippedNote}.`));
                         }
                         console.log(`\n  Coverage Estimate: ${chalk.yellow(generated.coverageEstimate == null ? 'Unmeasured' : generated.coverageEstimate + '%')}`);
                         if (generated.patternsUsed.length > 0) {
                             console.log(`  Patterns Used: ${chalk.cyan(generated.patternsUsed.join(', '))}`);
                         }
+                        if (options.save === false) {
+                            console.log(chalk.gray('  --no-save: no generated test files were written.'));
+                        }
                     }
                 }
                 else {

package/dist/cli/handlers/init-flags.d.ts

@@ -0,0 +1,45 @@
+/**
+ * `aqe init` negatable flag resolution (#922, #931, #935)
+ *
+ * Commander maps a negatable `--no-<name>` flag to `options.<name> === false`;
+ * it never sets `options.no<Name>`. Reading `noMcp` / `noGovernance` made
+ * `--no-mcp` (#931) and `--no-governance` (#935) silent no-ops. Every
+ * negatable init flag is resolved here, the same way, so the handler never
+ * reads a Commander option name by hand.
+ *
+ * The `no<Name>: true` spelling is still honoured for programmatic callers.
+ *
+ * `--no-mcp` and `--with-mcp` contradict each other. The CLI rejects the
+ * combination at parse time (Commander `.conflicts()`); this resolver
+ * rejects it for programmatic callers too, so neither path guesses.
+ */
+export interface InitFlagInput {
+    /** `--no-mcp` sets this to false. */
+    mcp?: boolean;
+    /** `--no-governance` sets this to false. */
+    governance?: boolean;
+    /** `--no-claude` sets this to false (#532). */
+    claude?: boolean;
+    /** `--no-statusline` sets this to false (#591). */
+    statusline?: boolean;
+    /** `--no-database` sets this to false. */
+    database?: boolean;
+    /** Programmatic aliases. */
+    noMcp?: boolean;
+    noGovernance?: boolean;
+    noClaude?: boolean;
+    noStatusLine?: boolean;
+    /** `--with-mcp`: write the entry even when the agentic-qe-fleet plugin is enabled. */
+    withMcp?: boolean;
+}
+export interface ResolvedInitFlags {
+    noMcp: boolean;
+    withMcp: boolean;
+    noGovernance: boolean;
+    noClaude: boolean;
+    noStatusLine: boolean;
+    noDatabase: boolean;
+}
+export declare const INIT_MCP_FLAG_CONFLICT_MESSAGE = "--no-mcp and --with-mcp cannot be combined: --no-mcp skips the .mcp.json entry, --with-mcp forces it";
+export declare function resolveInitFlags(options: InitFlagInput): ResolvedInitFlags;
+//# sourceMappingURL=init-flags.d.ts.map

package/dist/cli/handlers/init-flags.js

@@ -0,0 +1,35 @@
+/**
+ * `aqe init` negatable flag resolution (#922, #931, #935)
+ *
+ * Commander maps a negatable `--no-<name>` flag to `options.<name> === false`;
+ * it never sets `options.no<Name>`. Reading `noMcp` / `noGovernance` made
+ * `--no-mcp` (#931) and `--no-governance` (#935) silent no-ops. Every
+ * negatable init flag is resolved here, the same way, so the handler never
+ * reads a Commander option name by hand.
+ *
+ * The `no<Name>: true` spelling is still honoured for programmatic callers.
+ *
+ * `--no-mcp` and `--with-mcp` contradict each other. The CLI rejects the
+ * combination at parse time (Commander `.conflicts()`); this resolver
+ * rejects it for programmatic callers too, so neither path guesses.
+ */
+export const INIT_MCP_FLAG_CONFLICT_MESSAGE = '--no-mcp and --with-mcp cannot be combined: --no-mcp skips the .mcp.json entry, --with-mcp forces it';
+/** True when the negatable flag was turned off, or the programmatic alias was set. */
+function isOff(value, alias) {
+    return value === false || alias === true;
+}
+export function resolveInitFlags(options) {
+    const resolved = {
+        noMcp: isOff(options.mcp, options.noMcp),
+        withMcp: options.withMcp === true,
+        noGovernance: isOff(options.governance, options.noGovernance),
+        noClaude: isOff(options.claude, options.noClaude),
+        noStatusLine: isOff(options.statusline, options.noStatusLine),
+        noDatabase: options.database === false,
+    };
+    if (resolved.noMcp && resolved.withMcp) {
+        throw new Error(INIT_MCP_FLAG_CONFLICT_MESSAGE);
+    }
+    return resolved;
+}
+//# sourceMappingURL=init-flags.js.map

package/dist/cli/handlers/init-handler.d.ts

@@ -114,10 +114,16 @@ interface InitOptions {
     withWindsurf?: boolean;
     withContinuedev?: boolean;
     withAllPlatforms?: boolean;
+    /** commander negatable flag: `--no-mcp` sets this to false (#931). */
+    mcp?: boolean;
+    /** Programmatic alias for `--no-mcp`. */
     noMcp?: boolean;
     withMcp?: boolean;
     withClaudeFlow?: boolean;
     skipClaudeFlow?: boolean;
+    /** commander negatable flag: `--no-governance` sets this to false (#935). */
+    governance?: boolean;
+    /** Programmatic alias for `--no-governance`. */
     noGovernance?: boolean;
     /** commander negatable flag: `--no-claude` sets this to false (#532). */
     claude?: boolean;

package/dist/cli/handlers/init-handler.js

@@ -8,6 +8,7 @@ import chalk from 'chalk';
 import { createRequire } from 'node:module';
 import { ALL_DOMAINS } from '../../shared/types/index.js';
 import { toErrorMessage } from '../../shared/error-utils.js';
+import { resolveInitFlags } from './init-flags.js';
 // ============================================================================
 // Init Handler
 // ============================================================================
@@ -58,8 +59,9 @@ export class InitHandler {
             .option('--with-ruflo', 'Add optional Ruflo guidance and lifecycle hooks to the Codex setup')
             .option('--with-windsurf', 'Include Windsurf MCP config and rules')
             .option('--with-continuedev', 'Include Continue.dev MCP config and rules')
-            .option('--no-mcp', 'Skip MCP server config (MCP is enabled by default)')
-            .option('--with-mcp', 'Enable MCP server config (default — kept for backward compatibility)')
+            .option('--no-mcp', 'Skip MCP server config (MCP is enabled by default). Cannot be combined with --with-mcp')
+            .addOption(new Option('--with-mcp', 'Write the project .mcp.json agentic-qe entry even when the agentic-qe-fleet Claude Code plugin already provides the AQE MCP server (#922). Cannot be combined with --no-mcp')
+            .conflicts('mcp'))
             .option('--with-all-platforms', 'Include all coding agent platform configurations')
             .option('--auto-migrate', 'Automatically migrate from v2 if detected')
             .option('--with-claude-flow', 'Force Claude Flow integration setup')
@@ -123,13 +125,14 @@ export class InitHandler {
                 options.withCopilot || options.withCursor || options.withCline ||
                 options.withKilocode || options.withRoocode || options.withCodex ||
                 options.withWindsurf || options.withContinuedev || options.withAllPlatforms);
-            const databaseFree = options.database === false || options.memory === 'memory';
+            const flags = resolveInitFlags(options);
+            const databaseFree = flags.noDatabase || options.memory === 'memory';
             // #532: `--no-claude` (commander negatable → options.claude === false) is
             // only honored by the modular orchestrator. Route there too, or the flag
             // silently falls through to runStandardInit and installs the full Claude
             // surface it was meant to suppress.
-            const noClaudeRequested = options.claude === false;
-            const noStatusLineRequested = options.statusline === false;
+            const noClaudeRequested = flags.noClaude;
+            const noStatusLineRequested = flags.noStatusLine;
             if (options.browserEngine || options.modular || platformRequested || databaseFree || noClaudeRequested || noStatusLineRequested) {
                 console.log(chalk.blue('\n  Agentic QE v3 Initialization\n'));
                 await this.runModularInit(options, context);
@@ -145,10 +148,12 @@ export class InitHandler {
     }
     async runModularInit(options, _context) {
         const isJsonMode = options.json === true;
+        // #931/#935: commander maps --no-<name> to options.<name> === false.
+        const flags = resolveInitFlags(options);
         // Database-free mode: `--no-database` or `--memory memory`. Skips the SQLite
         // database phase and configures any MCP server to run in-memory. Export the
         // backend env up-front so every subsystem spawned during init honors it.
-        const memoryOnly = options.database === false || options.memory === 'memory';
+        const memoryOnly = flags.noDatabase || options.memory === 'memory';
         if (memoryOnly) {
             process.env.AQE_MEMORY_BACKEND = 'memory';
             if (!isJsonMode) {
@@ -159,7 +164,7 @@ export class InitHandler {
         // `--with-<platform>` flags become the only targets. Commander maps the
         // negatable flag to `options.claude === false`. Warn if it would produce an
         // empty install (no platform selected) so the user isn't surprised.
-        const noClaude = options.claude === false;
+        const noClaude = flags.noClaude;
         if (noClaude) {
             const anyPlatform = Boolean(options.withOpencode || options.withN8n || options.withKiro ||
                 options.withCopilot || options.withCursor || options.withCline ||
@@ -191,10 +196,11 @@ export class InitHandler {
             codexGuidance: options.codexGuidance,
             withWindsurf: options.withWindsurf,
             withContinueDev: options.withContinuedev,
-            noMcp: options.noMcp && !options.withMcp,
-            noGovernance: options.noGovernance,
+            noMcp: flags.noMcp,
+            withMcp: flags.withMcp,
+            noGovernance: flags.noGovernance,
             noClaude,
-            noStatusLine: options.statusline === false,
+            noStatusLine: flags.noStatusLine,
             memoryBackend: memoryOnly ? 'memory' : undefined,
         });
         console.log(chalk.white('  Analyzing project...\n'));
@@ -299,6 +305,7 @@ export class InitHandler {
         await this.cleanupAndExit(0);
     }
     async runLegacyWizard(options, _context) {
+        const flags = resolveInitFlags(options);
         const { InitOrchestrator } = await import('../../init/init-wizard.js');
         const orchestratorOptions = {
             projectRoot: process.cwd(),
@@ -307,6 +314,8 @@ export class InitHandler {
             browserEngine: options.browserEngine,
             skipPatterns: options.skipPatterns,
             withN8n: options.withN8n,
+            noMcp: flags.noMcp,
+            withMcp: flags.withMcp,
         };
         const orchestrator = new InitOrchestrator(orchestratorOptions);
         if (options.wizard) {
@@ -464,6 +473,8 @@ Options:
   --with-claude-flow         Force Claude Flow integration setup
   --skip-claude-flow         Skip Claude Flow integration
   --no-mcp                   Skip MCP server config (MCP is enabled by default)
+  --with-mcp                 Add the .mcp.json entry even if the agentic-qe-fleet plugin is enabled
+                             (--no-mcp and --with-mcp cannot be combined)
   --no-governance            Skip governance configuration (ADR-058)
   --modular                  Use new modular init system
 
@@ -471,6 +482,9 @@ MCP Server:
   MCP server configuration is ENABLED BY DEFAULT. It writes .mcp.json
   at the project root so Claude Code auto-discovers the AQE MCP server.
   Use --no-mcp to skip if you only want CLI commands.
+  If the agentic-qe-fleet Claude Code plugin is enabled (user, project or
+  local settings), init skips the entry because the plugin already provides
+  the AQE MCP server. Use --with-mcp to add the project entry anyway.
 
 Governance:
   Governance is ENABLED BY DEFAULT. It installs .claude/guidance/ with:

package/dist/cli/utils/generated-test-writer.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Agentic QE v3 - Generated test file writer (#936 follow-up)
+ *
+ * `aqe test generate` writes each generated test beside its source. This
+ * module decides whether a single write is safe:
+ * - the resolved path must stay inside the project root, so a bad path
+ *   (for example from a directory named `my.ts-app`) can never create files
+ *   outside the project;
+ * - an existing file is never replaced unless the caller passed --force,
+ *   because generated files carry no marker that tells them apart from
+ *   hand-written tests.
+ *
+ * @module cli/utils/generated-test-writer
+ */
+export type GeneratedTestWriteStatus = 'written' | 'exists' | 'outside-project';
+export interface GeneratedTestWriteResult {
+    status: GeneratedTestWriteStatus;
+    /** Absolute path that was (or would have been) written. */
+    path: string;
+}
+export interface GeneratedTestWriteOptions {
+    /** Directory every written file must stay inside. */
+    projectRoot: string;
+    /** Overwrite an existing file instead of skipping it. */
+    force?: boolean;
+}
+/** True when `file` is inside `root` (never equal to it). */
+export declare function isInsideRoot(file: string, root: string): boolean;
+/**
+ * Write one generated test file if it is safe to do so.
+ *
+ * @returns what happened; nothing is written unless status is 'written'.
+ */
+export declare function writeGeneratedTestFile(testFile: string, testCode: string, options: GeneratedTestWriteOptions): GeneratedTestWriteResult;
+//# sourceMappingURL=generated-test-writer.d.ts.map

package/dist/cli/utils/generated-test-writer.js

@@ -0,0 +1,44 @@
+/**
+ * Agentic QE v3 - Generated test file writer (#936 follow-up)
+ *
+ * `aqe test generate` writes each generated test beside its source. This
+ * module decides whether a single write is safe:
+ * - the resolved path must stay inside the project root, so a bad path
+ *   (for example from a directory named `my.ts-app`) can never create files
+ *   outside the project;
+ * - an existing file is never replaced unless the caller passed --force,
+ *   because generated files carry no marker that tells them apart from
+ *   hand-written tests.
+ *
+ * @module cli/utils/generated-test-writer
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+/** True when `file` is inside `root` (never equal to it). */
+export function isInsideRoot(file, root) {
+    const rel = path.relative(path.resolve(root), path.resolve(file));
+    return rel !== '' && !rel.startsWith('..') && !path.isAbsolute(rel);
+}
+/**
+ * Write one generated test file if it is safe to do so.
+ *
+ * @returns what happened; nothing is written unless status is 'written'.
+ */
+export function writeGeneratedTestFile(testFile, testCode, options) {
+    const target = path.resolve(testFile);
+    if (!isInsideRoot(target, options.projectRoot)) {
+        return { status: 'outside-project', path: target };
+    }
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    try {
+        // 'wx' fails if the file exists, so the check and the write are atomic.
+        fs.writeFileSync(target, testCode, { encoding: 'utf-8', flag: options.force ? 'w' : 'wx' });
+    }
+    catch (error) {
+        if (error.code === 'EEXIST')
+            return { status: 'exists', path: target };
+        throw error;
+    }
+    return { status: 'written', path: target };
+}
+//# sourceMappingURL=generated-test-writer.js.map

package/dist/context/compiler.js

@@ -116,7 +116,10 @@ export class ContextCompiler {
         return { size: this.cache.size, ttlMs: this.cacheTtl };
     }
     buildCacheKey(request) {
-        return `${request.agentType}:${request.targetFiles.sort().join(',')}:${request.taskDescription.slice(0, 100)}`;
+        // JSON tuple: a ',' or ':' in a file name or agent type cannot shift fields (#914).
+        // Sort a copy so the caller's targetFiles array is not reordered.
+        const files = [...request.targetFiles].sort();
+        return JSON.stringify([request.agentType, files, request.taskDescription.slice(0, 100)]);
     }
     generateSummary(request, fragments, sources) {
         return [

package/dist/coordination/consensus/providers/ollama-provider.js

@@ -12,6 +12,7 @@ import { BaseModelProvider } from '../model-provider.js';
 import { CONSENSUS_CONSTANTS, OLLAMA_CONSTANTS } from '../../constants.js';
 import { toErrorMessage, toError } from '../../../shared/error-utils.js';
 import { resolveOllamaBaseUrl } from '../../../shared/llm/ollama-url.js';
+import { fetchWithResponseDeadline } from '../../../shared/llm/providers/response-deadline.js';
 // ============================================================================
 // Model Information
 // ============================================================================
@@ -102,13 +103,9 @@ export class OllamaModelProvider extends BaseModelProvider {
      */
     async listModels() {
         try {
-            const controller = new AbortController();
-            const timeoutId = setTimeout(() => controller.abort(), CONSENSUS_CONSTANTS.OLLAMA_CONNECTION_TEST_TIMEOUT_MS);
-            const response = await fetch(`${this.config.baseUrl}/api/tags`, {
-                method: 'GET',
-                signal: controller.signal,
-            });
-            clearTimeout(timeoutId);
+            // The deadline stays armed until the body is read (issue #961).
+            const timeoutMs = CONSENSUS_CONSTANTS.OLLAMA_CONNECTION_TEST_TIMEOUT_MS;
+            const response = await fetchWithResponseDeadline(`${this.config.baseUrl}/api/tags`, { method: 'GET' }, timeoutMs, () => new Error(`Ollama list models timed out after ${timeoutMs}ms`));
             if (!response.ok) {
                 throw new Error(`Failed to list models: ${response.status}`);
             }
@@ -233,27 +230,19 @@ export class OllamaModelProvider extends BaseModelProvider {
      * Make a request to Ollama API
      */
     async makeRequest(request, timeout) {
-        const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), timeout);
-        try {
-            const response = await fetch(`${this.config.baseUrl}/api/chat`, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                },
-                body: JSON.stringify(request),
-                signal: controller.signal,
-            });
-            clearTimeout(timeoutId);
-            if (!response.ok) {
-                const errorBody = await response.text();
-                throw new Error(`Ollama API error: ${response.status} - ${errorBody}`);
-            }
-            return (await response.json());
-        }
-        finally {
-            clearTimeout(timeoutId);
+        // One deadline covers headers and the whole body, error bodies included (issue #961).
+        const response = await fetchWithResponseDeadline(`${this.config.baseUrl}/api/chat`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify(request),
+        }, timeout, () => new Error(`Ollama request timed out after ${timeout}ms`));
+        if (!response.ok) {
+            const errorBody = await response.text();
+            throw new Error(`Ollama API error: ${response.status} - ${errorBody}`);
         }
+        return (await response.json());
     }
     /**
      * Check if an error is non-retryable

package/dist/coordination/consensus/providers/openrouter-provider.js

@@ -11,6 +11,7 @@
 import { BaseModelProvider } from '../model-provider.js';
 import { toErrorMessage, toError } from '../../../shared/error-utils.js';
 import { resolveModelPricing } from '../../../shared/llm/cost-tracker.js';
+import { fetchWithResponseDeadline } from '../../../shared/llm/providers/response-deadline.js';
 // ============================================================================
 // Model Cost and Tier Information
 // ============================================================================
@@ -286,31 +287,19 @@ export class OpenRouterModelProvider extends BaseModelProvider {
      * Make a request to OpenRouter API
      */
     async makeRequest(request, timeout) {
-        const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), timeout);
-        try {
-            const headers = {
-                Authorization: `Bearer ${this.config.apiKey}`,
-                'Content-Type': 'application/json',
-                'HTTP-Referer': this.config.siteUrl || 'https://github.com/agentic-qe',
-                'X-Title': this.config.appName || 'Agentic QE',
-            };
-            const response = await fetch('https://openrouter.ai/api/v1/chat/completions', {
-                method: 'POST',
-                headers,
-                body: JSON.stringify(request),
-                signal: controller.signal,
-            });
-            clearTimeout(timeoutId);
-            if (!response.ok) {
-                const errorBody = await response.text();
-                throw new Error(`OpenRouter API error: ${response.status} - ${errorBody}`);
-            }
-            return (await response.json());
-        }
-        finally {
-            clearTimeout(timeoutId);
+        const headers = {
+            Authorization: `Bearer ${this.config.apiKey}`,
+            'Content-Type': 'application/json',
+            'HTTP-Referer': this.config.siteUrl || 'https://github.com/agentic-qe',
+            'X-Title': this.config.appName || 'Agentic QE',
+        };
+        // One deadline covers headers and the whole body, error bodies included (issue #961).
+        const response = await fetchWithResponseDeadline('https://openrouter.ai/api/v1/chat/completions', { method: 'POST', headers, body: JSON.stringify(request) }, timeout, () => new Error(`OpenRouter request timed out after ${timeout}ms`));
+        if (!response.ok) {
+            const errorBody = await response.text();
+            throw new Error(`OpenRouter API error: ${response.status} - ${errorBody}`);
         }
+        return (await response.json());
     }
     /**
      * Check if an error is non-retryable

package/dist/coordination/handlers/test-execution-handlers.js

@@ -10,6 +10,7 @@ import { ok, err } from '../../shared/types/index.js';
 import { toError } from '../../shared/error-utils.js';
 import { getTestRunnerExecutionError, TestRunnerExecutionError } from '../../shared/test-runner-verdict.js';
 import { createVitestJsonReport } from '../../shared/vitest-json-report.js';
+import { jestExactPathPattern, runnerFilePath } from '../../shared/test-runner-args.js';
 function escapeRegExp(s) {
     return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
@@ -190,7 +191,8 @@ export function registerTestExecutionHandlers(ctx) {
             let execution;
             let output;
             try {
-                execution = spawnSync('npx', ['vitest', 'run', ...testFiles, '--reporter=json', ...report.args], options);
+                // #909: absolute paths cannot be read as flags (e.g. a "--watch" entry).
+                execution = spawnSync('npx', ['vitest', 'run', ...testFiles.map(file => runnerFilePath(file, options.cwd)), '--reporter=json', ...report.args], options);
                 output = execution.error || execution.signal
                     ? ''
                     : report.read(execution.stdout || '') ?? '';
@@ -201,7 +203,7 @@ export function registerTestExecutionHandlers(ctx) {
             // Preserve the existing Jest fallback when Vitest cannot produce a report.
             if (!output.includes('{') && execution.status !== 0 && !execution.error && !execution.signal) {
                 runner = 'jest';
-                execution = spawnSync('npx', ['jest', ...testFiles, '--json'], options);
+                execution = spawnSync('npx', ['jest', ...testFiles.map(file => jestExactPathPattern(file, options.cwd)), '--json'], options);
                 output = execution.stdout || '';
             }
             const diagnostics = [execution.error?.message, execution.signal && `Terminated by ${execution.signal}`, execution.stderr, output].filter(Boolean).join('\n');

package/dist/coordination/protocols/defect-investigation.js

@@ -11,6 +11,7 @@ import { ok, err, } from '../../shared/types/index.js';
 import { createEvent } from '../../shared/events/domain-events.js';
 import { toError } from '../../shared/error-utils.js';
 import { LoggerFactory } from '../../logging/index.js';
+import { addToCount } from '../../shared/utils/safe-record.js';
 const logger = LoggerFactory.create('defect-investigation');
 export const DefectInvestigationEvents = {
     DefectInvestigationStarted: 'coordination.DefectInvestigationStarted',
@@ -351,7 +352,9 @@ export class DefectInvestigationProtocol {
                     totalInvestigations: 0,
                 };
                 const pattern = result.rootCause.rootCause;
-                stats.patterns[pattern] = (stats.patterns[pattern] ?? 0) + 1;
+                // Root causes are free text and stats come back from storage as plain
+                // objects, so read and write own properties only (#914).
+                addToCount(stats.patterns, pattern);
                 stats.totalInvestigations += 1;
                 await this.memory.set(patternKey, stats, {
                     namespace: this.config.namespace,

package/dist/coordination/task-executor.js

@@ -450,9 +450,11 @@ export class DomainTaskExecutor {
             await this.publishTaskCompleted(task.id, result.value, domain);
             // ADR-051: Record successful outcome
             this.recordOutcome(task, routingTier, true, Date.now() - startTime).catch((e) => { logger.warn('recordOutcome failed', { error: e instanceof Error ? e.message : String(e), taskId: task.id }); });
-            // Save results to files if enabled
+            // Save results to files if enabled. A task can opt out per call with
+            // payload.saveResults === false (#925); the executor-wide config still
+            // acts as the global switch.
             let savedFiles;
-            if (this._config.saveResults) {
+            if (this._config.saveResults && payload?.saveResults !== false) {
                 try {
                     const saveOptions = {
                         language: payload?.language || this._config.defaultLanguage,