agentic-qe 3.15.1 → 3.15.3

package/dist/shared/llm/cost-tracker.js

@@ -7,6 +7,7 @@
  */
 import { randomUUID } from 'crypto';
 import { getModelCost } from './model-registry.js';
+import { addToCount, createSafeRecord } from '../utils/safe-record.js';
 /**
  * Token pricing per model (cost per 1M tokens in USD).
  * Current-generation prices verified 2026-09-27 (Anthropic docs, OpenRouter
@@ -133,7 +134,8 @@ export const MODEL_PRICING = {
  * as a free/local model.
  */
 export function resolveModelPricing(model) {
-    const pricing = MODEL_PRICING[model];
+    // Own keys only: a model named `toString` must not resolve to the inherited method (#914).
+    const pricing = Object.hasOwn(MODEL_PRICING, model) ? MODEL_PRICING[model] : undefined;
     if (pricing) {
         return { input: pricing.input, output: pricing.output };
     }
@@ -238,15 +240,15 @@ export class CostTracker {
             gemini: 0,
             cognitum: 0,
         };
-        const byModel = {};
+        // Model and provider names are data, so buckets must not inherit from Object.prototype (#914).
+        const byModel = createSafeRecord();
         let totalCost = 0;
         let totalTokens = 0;
         for (const record of relevantRecords) {
             totalCost += record.cost.totalCost;
             totalTokens += record.usage.totalTokens;
-            const providerCost = Object.hasOwn(byProvider, record.provider) ? byProvider[record.provider] : 0;
-            byProvider[record.provider] = providerCost + record.cost.totalCost;
-            byModel[record.model] = (byModel[record.model] || 0) + record.cost.totalCost;
+            addToCount(byProvider, record.provider, record.cost.totalCost);
+            addToCount(byModel, record.model, record.cost.totalCost);
         }
         return {
             period,
@@ -277,7 +279,7 @@ export class CostTracker {
     getUsageByProvider(provider, period = 'all') {
         const periodStart = this.getPeriodStart(new Date(), period);
         const providerRecords = this.records.filter((r) => r.provider === provider && r.timestamp >= periodStart);
-        const models = {};
+        const models = createSafeRecord();
         let totalCost = 0;
         let totalTokens = 0;
         for (const record of providerRecords) {

package/dist/shared/llm/providers/azure-openai.js

@@ -33,6 +33,7 @@ import { applyOpenAIParams } from '../openai-params.js';
 import { TokenMetricsCollector } from '../../../learning/token-tracker.js';
 import { toError } from '../../error-utils.js';
 import { backoffDelay } from '../retry.js';
+import { fetchWithResponseDeadline } from './response-deadline.js';
 /**
  * Default Azure OpenAI configuration
  */
@@ -492,27 +493,10 @@ export class AzureOpenAIProvider {
      * Fetch with timeout
      */
     async fetchWithTimeout(url, options, timeoutMs) {
-        const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
-        try {
-            const response = await fetch(url, {
-                ...options,
-                signal: controller.signal,
-            });
-            return response;
-        }
-        catch (error) {
-            if (error instanceof Error && error.name === 'AbortError') {
-                throw createLLMError('Request timed out', 'TIMEOUT', {
-                    provider: 'azure-openai',
-                    retryable: true,
-                });
-            }
-            throw error;
-        }
-        finally {
-            clearTimeout(timeoutId);
-        }
+        return fetchWithResponseDeadline(url, options, timeoutMs, () => createLLMError('Request timed out', 'TIMEOUT', {
+            provider: 'azure-openai',
+            retryable: true,
+        }));
     }
     /**
      * Fetch with retry logic

package/dist/shared/llm/providers/bedrock.js

@@ -16,6 +16,7 @@ import { CostTracker } from '../cost-tracker.js';
 import { TokenMetricsCollector } from '../../../learning/token-tracker.js';
 import { toError } from '../../error-utils.js';
 import { backoffDelay } from '../retry.js';
+import { fetchWithResponseDeadline } from './response-deadline.js';
 import { applyAnthropicParams } from '../anthropic-params.js';
 /**
  * Default Bedrock configuration
@@ -545,27 +546,10 @@ export class BedrockProvider {
      * Fetch with timeout
      */
     async fetchWithTimeout(url, options, timeoutMs) {
-        const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
-        try {
-            const response = await fetch(url, {
-                ...options,
-                signal: controller.signal,
-            });
-            return response;
-        }
-        catch (error) {
-            if (error instanceof Error && error.name === 'AbortError') {
-                throw createLLMError('Request timed out', 'TIMEOUT', {
-                    provider: 'bedrock',
-                    retryable: true,
-                });
-            }
-            throw error;
-        }
-        finally {
-            clearTimeout(timeoutId);
-        }
+        return fetchWithResponseDeadline(url, options, timeoutMs, () => createLLMError('Request timed out', 'TIMEOUT', {
+            provider: 'bedrock',
+            retryable: true,
+        }));
     }
     /**
      * Sleep utility

package/dist/shared/llm/providers/claude.js

@@ -10,6 +10,7 @@ import { CostTracker } from '../cost-tracker.js';
 import { TokenMetricsCollector } from '../../../learning/token-tracker.js';
 import { toError } from '../../error-utils.js';
 import { backoffDelay } from '../retry.js';
+import { fetchWithResponseDeadline } from './response-deadline.js';
 import { applyAnthropicParams } from '../anthropic-params.js';
 import { DEFAULT_SONNET_MODEL } from '../model-registry.js';
 /**
@@ -357,27 +358,10 @@ export class ClaudeProvider {
      * Fetch with timeout
      */
     async fetchWithTimeout(url, options, timeoutMs) {
-        const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
-        try {
-            const response = await fetch(url, {
-                ...options,
-                signal: controller.signal,
-            });
-            return response;
-        }
-        catch (error) {
-            if (error instanceof Error && error.name === 'AbortError') {
-                throw createLLMError('Request timed out', 'TIMEOUT', {
-                    provider: 'claude',
-                    retryable: true,
-                });
-            }
-            throw error;
-        }
-        finally {
-            clearTimeout(timeoutId);
-        }
+        return fetchWithResponseDeadline(url, options, timeoutMs, () => createLLMError('Request timed out', 'TIMEOUT', {
+            provider: 'claude',
+            retryable: true,
+        }));
     }
     /**
      * Fetch with retry logic

package/dist/shared/llm/providers/cognitum.js

@@ -16,6 +16,7 @@ import { createLLMError, } from '../interfaces.js';
 import { TokenMetricsCollector } from '../../../learning/token-tracker.js';
 import { toError } from '../../error-utils.js';
 import { backoffDelay } from '../retry.js';
+import { fetchWithResponseDeadline } from './response-deadline.js';
 export const DEFAULT_COGNITUM_CONFIG = {
     model: 'cognitum-auto',
     maxTokens: 4096,
@@ -320,23 +321,10 @@ export class CognitumProvider {
         }
     }
     async fetchWithTimeout(url, options, timeoutMs) {
-        const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
-        try {
-            return await fetch(url, { ...options, signal: controller.signal });
-        }
-        catch (error) {
-            if (error instanceof Error && error.name === 'AbortError') {
-                throw createLLMError('Request timed out', 'TIMEOUT', {
-                    provider: 'cognitum',
-                    retryable: true,
-                });
-            }
-            throw error;
-        }
-        finally {
-            clearTimeout(timeoutId);
-        }
+        return fetchWithResponseDeadline(url, options, timeoutMs, () => createLLMError('Request timed out', 'TIMEOUT', {
+            provider: 'cognitum',
+            retryable: true,
+        }));
     }
     async fetchWithRetry(url, options, timeoutMs, maxRetries) {
         let lastError;

package/dist/shared/llm/providers/gemini.js

@@ -12,6 +12,7 @@ import { createLLMError, } from '../interfaces.js';
 import { TokenMetricsCollector } from '../../../learning/token-tracker.js';
 import { toError } from '../../error-utils.js';
 import { backoffDelay } from '../retry.js';
+import { fetchWithResponseDeadline } from './response-deadline.js';
 import { safeJsonParse } from '../../safe-json.js';
 /**
  * Default Gemini configuration
@@ -246,7 +247,7 @@ export class GeminiProvider {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify(body),
-        }, options?.timeoutMs ?? this.config.timeoutMs ?? 60000);
+        }, options?.timeoutMs ?? this.config.timeoutMs ?? 60000, 'idle');
         if (!response.ok) {
             const errorData = await response.json().catch(() => ({
                 error: { message: 'Unknown error', code: 0, status: 'UNKNOWN' },
@@ -304,6 +305,8 @@ export class GeminiProvider {
             }
         }
         finally {
+            // Returning early from the generator must also release its request deadline.
+            await reader.cancel().catch(() => { });
             reader.releaseLock();
         }
         const latencyMs = Date.now() - start;
@@ -574,28 +577,11 @@ export class GeminiProvider {
     /**
      * Fetch with timeout
      */
-    async fetchWithTimeout(url, options, timeoutMs) {
-        const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
-        try {
-            const response = await fetch(url, {
-                ...options,
-                signal: controller.signal,
-            });
-            return response;
-        }
-        catch (error) {
-            if (error instanceof Error && error.name === 'AbortError') {
-                throw createLLMError('Request timed out', 'TIMEOUT', {
-                    provider: 'gemini',
-                    retryable: true,
-                });
-            }
-            throw error;
-        }
-        finally {
-            clearTimeout(timeoutId);
-        }
+    async fetchWithTimeout(url, options, timeoutMs, bodyDeadline = 'absolute') {
+        return fetchWithResponseDeadline(url, options, timeoutMs, () => createLLMError('Request timed out', 'TIMEOUT', {
+            provider: 'gemini',
+            retryable: true,
+        }), bodyDeadline);
     }
     /**
      * Fetch with retry logic

package/dist/shared/llm/providers/ollama.js

@@ -5,6 +5,7 @@
  * Local LLM provider using Ollama for fast iteration and zero-cost development.
  * Supports Llama, Mistral, CodeLlama, and other local models.
  */
+import { fetchWithResponseDeadline } from './response-deadline.js';
 import { createLLMError, } from '../interfaces.js';
 import { CostTracker } from '../cost-tracker.js';
 import { TokenMetricsCollector } from '../../../learning/token-tracker.js';
@@ -410,27 +411,10 @@ export class OllamaProvider {
      * Fetch with timeout
      */
     async fetchWithTimeout(url, options, timeoutMs) {
-        const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
-        try {
-            const response = await fetch(url, {
-                ...options,
-                signal: controller.signal,
-            });
-            return response;
-        }
-        catch (error) {
-            if (error instanceof Error && error.name === 'AbortError') {
-                throw createLLMError('Request timed out', 'TIMEOUT', {
-                    provider: 'ollama',
-                    retryable: true,
-                });
-            }
-            throw error;
-        }
-        finally {
-            clearTimeout(timeoutId);
-        }
+        return fetchWithResponseDeadline(url, options, timeoutMs, () => createLLMError('Request timed out', 'TIMEOUT', {
+            provider: 'ollama',
+            retryable: true,
+        }));
     }
 }
 //# sourceMappingURL=ollama.js.map

package/dist/shared/llm/providers/openai.js

@@ -11,6 +11,7 @@ import { applyOpenAIParams } from '../openai-params.js';
 import { TokenMetricsCollector } from '../../../learning/token-tracker.js';
 import { toError } from '../../error-utils.js';
 import { backoffDelay } from '../retry.js';
+import { fetchWithResponseDeadline } from './response-deadline.js';
 /**
  * Default OpenAI configuration
  */
@@ -378,27 +379,10 @@ export class OpenAIProvider {
      * Fetch with timeout
      */
     async fetchWithTimeout(url, options, timeoutMs) {
-        const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
-        try {
-            const response = await fetch(url, {
-                ...options,
-                signal: controller.signal,
-            });
-            return response;
-        }
-        catch (error) {
-            if (error instanceof Error && error.name === 'AbortError') {
-                throw createLLMError('Request timed out', 'TIMEOUT', {
-                    provider: 'openai',
-                    retryable: true,
-                });
-            }
-            throw error;
-        }
-        finally {
-            clearTimeout(timeoutId);
-        }
+        return fetchWithResponseDeadline(url, options, timeoutMs, () => createLLMError('Request timed out', 'TIMEOUT', {
+            provider: 'openai',
+            retryable: true,
+        }));
     }
     /**
      * Fetch with retry logic

package/dist/shared/llm/providers/openrouter.js

@@ -13,6 +13,7 @@ import { createLLMError, } from '../interfaces.js';
 import { TokenMetricsCollector } from '../../../learning/token-tracker.js';
 import { toError } from '../../error-utils.js';
 import { backoffDelay } from '../retry.js';
+import { fetchWithResponseDeadline } from './response-deadline.js';
 import { safeJsonParse } from '../../safe-json.js';
 import { resolveModelPricing } from '../cost-tracker.js';
 /**
@@ -273,7 +274,7 @@ export class OpenRouterProvider {
             method: 'POST',
             headers: this.getHeaders(),
             body: JSON.stringify(body),
-        }, options?.timeoutMs ?? this.config.timeoutMs ?? 60000);
+        }, options?.timeoutMs ?? this.config.timeoutMs ?? 60000, 'idle');
         if (!response.ok) {
             const errorData = await response.json().catch(() => ({
                 error: { message: 'Unknown error', type: 'unknown', code: null },
@@ -327,6 +328,8 @@ export class OpenRouterProvider {
             }
         }
         finally {
+            // Returning early from the generator must also release its request deadline.
+            await reader.cancel().catch(() => { });
             reader.releaseLock();
         }
         const latencyMs = Date.now() - start;
@@ -620,28 +623,11 @@ export class OpenRouterProvider {
     /**
      * Fetch with timeout
      */
-    async fetchWithTimeout(url, options, timeoutMs) {
-        const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
-        try {
-            const response = await fetch(url, {
-                ...options,
-                signal: controller.signal,
-            });
-            return response;
-        }
-        catch (error) {
-            if (error instanceof Error && error.name === 'AbortError') {
-                throw createLLMError('Request timed out', 'TIMEOUT', {
-                    provider: 'openrouter',
-                    retryable: true,
-                });
-            }
-            throw error;
-        }
-        finally {
-            clearTimeout(timeoutId);
-        }
+    async fetchWithTimeout(url, options, timeoutMs, bodyDeadline = 'absolute') {
+        return fetchWithResponseDeadline(url, options, timeoutMs, () => createLLMError('Request timed out', 'TIMEOUT', {
+            provider: 'openrouter',
+            retryable: true,
+        }), bodyDeadline);
     }
     /**
      * Fetch with retry logic

package/dist/shared/llm/providers/response-deadline.d.ts

@@ -0,0 +1,3 @@
+/** Bound headers and bodies; streaming callers may use an idle body deadline. */
+export declare function fetchWithResponseDeadline(url: string, options: RequestInit, timeoutMs: number, timeoutError: () => Error, bodyDeadline?: 'absolute' | 'idle'): Promise<Response>;
+//# sourceMappingURL=response-deadline.d.ts.map

package/dist/shared/llm/providers/response-deadline.js

@@ -0,0 +1,100 @@
+/** Bound headers and bodies; streaming callers may use an idle body deadline. */
+export async function fetchWithResponseDeadline(url, options, timeoutMs, timeoutError, bodyDeadline = 'absolute') {
+    const abort = new AbortController();
+    let expired = false;
+    let expireBody;
+    const expire = () => {
+        expired = true;
+        const error = timeoutError();
+        expireBody?.(error);
+        abort.abort(error);
+    };
+    let timer = setTimeout(expire, timeoutMs);
+    const resetIdleDeadline = () => {
+        if (bodyDeadline !== 'idle')
+            return;
+        clearTimeout(timer);
+        timer = setTimeout(expire, timeoutMs);
+        timer.unref?.();
+    };
+    // A status-only caller must not keep a process alive until its deadline.
+    timer.unref?.();
+    try {
+        const response = await fetch(url, { ...options, signal: abort.signal });
+        if (!response.body) {
+            clearTimeout(timer);
+            return response;
+        }
+        resetIdleDeadline();
+        const reader = response.body.getReader();
+        let finished = false;
+        const finish = () => {
+            finished = true;
+            clearTimeout(timer);
+        };
+        const body = new ReadableStream({
+            start(controller) {
+                expireBody = error => {
+                    if (finished)
+                        return;
+                    finish();
+                    controller.error(error);
+                    // Cancel also settles any pending read before releasing its lock.
+                    void reader.cancel(error).catch(() => { }).finally(() => reader.releaseLock());
+                };
+            },
+            async pull(controller) {
+                try {
+                    const result = await reader.read();
+                    if (finished)
+                        return;
+                    if (result.done) {
+                        finish();
+                        reader.releaseLock();
+                        controller.close();
+                    }
+                    else {
+                        resetIdleDeadline();
+                        controller.enqueue(result.value);
+                    }
+                }
+                catch (error) {
+                    if (finished)
+                        return;
+                    finish();
+                    reader.releaseLock();
+                    controller.error(error);
+                }
+            },
+            async cancel(reason) {
+                if (finished)
+                    return;
+                finish();
+                try {
+                    await reader.cancel(reason);
+                }
+                finally {
+                    reader.releaseLock();
+                }
+            },
+        }, { highWaterMark: 0 });
+        const bounded = new Response(body, {
+            status: response.status,
+            statusText: response.statusText,
+            headers: response.headers,
+        });
+        // Keep fetch metadata while using the bounded stream for body consumers.
+        for (const key of ['url', 'redirected', 'type']) {
+            Object.defineProperty(bounded, key, { value: response[key] });
+        }
+        return bounded;
+    }
+    catch (error) {
+        clearTimeout(timer);
+        if (expired || (error instanceof Error && error.name === 'AbortError')) {
+            throw timeoutError();
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=response-deadline.js.map

package/dist/shared/llm/spend-ledger.js

@@ -17,6 +17,7 @@
  * connections (one per process) to a WAL-mode DB is exactly the supported
  * cross-process pattern.
  */
+import { createSafeRecord } from '../utils/safe-record.js';
 /** Bucket used for charges recorded without an agent context. */
 export const UNATTRIBUTED_AGENT = '(unattributed)';
 const CREATE_TABLE_SQL = `
@@ -127,7 +128,7 @@ export class SqliteSpendLedger {
                 .prepare(`SELECT COALESCE(agent_type, ?) AS agent, COALESCE(SUM(cost_usd), 0) AS total
              FROM llm_spend WHERE ts >= ? GROUP BY COALESCE(agent_type, ?)`)
                 .all(UNATTRIBUTED_AGENT, nowMs - windowMs, UNATTRIBUTED_AGENT);
-            const out = {};
+            const out = createSafeRecord();
             for (const r of rows)
                 out[r.agent] = r.total;
             return out;
@@ -157,7 +158,7 @@ export class InMemorySpendLedger {
     }
     spentByAgentSince(windowMs, nowMs = Date.now()) {
         const cutoff = nowMs - windowMs;
-        const out = {};
+        const out = createSafeRecord();
         for (const e of this.entries) {
             if (e.ts >= cutoff)
                 out[e.agent] = (out[e.agent] ?? 0) + e.costUsd;

package/dist/shared/metrics/code-metrics.d.ts

@@ -63,6 +63,7 @@ export declare class CodeMetricsAnalyzer {
     detectDuplication(files: string[], minLines?: number): Promise<DuplicationResult>;
     private countLines;
     private calculateCyclomaticComplexity;
+    /** SonarSource cognitive complexity heuristic; see ./cognitive-complexity.ts (#907). */
     private calculateCognitiveComplexity;
     private estimateCyclomaticComplexity;
     private estimateCognitiveComplexity;

package/dist/shared/metrics/code-metrics.js

@@ -6,6 +6,7 @@ import { TypeScriptParser } from '../parsers/index.js';
 import { FileReader } from '../io/index.js';
 import { treeSitterRegistry } from '../parsers/multi-language-parser.js';
 import { getLanguageFromExtension } from '../types/test-frameworks.js';
+import { calculateCognitiveComplexity } from './cognitive-complexity.js';
 // ============================================================================
 // Code Metrics Analyzer
 // ============================================================================
@@ -247,51 +248,9 @@ export class CodeMetricsAnalyzer {
         }
         return complexity;
     }
+    /** SonarSource cognitive complexity heuristic; see ./cognitive-complexity.ts (#907). */
     calculateCognitiveComplexity(code) {
-        let complexity = 0;
-        let nestingLevel = 0;
-        const lines = code.split('\n');
-        for (const line of lines) {
-            const trimmed = line.trim();
-            // Increase nesting
-            if (/\bif\s*\(/.test(trimmed)) {
-                complexity += 1 + nestingLevel;
-                nestingLevel++;
-            }
-            if (/\belse\s+if\s*\(/.test(trimmed)) {
-                complexity += 1 + nestingLevel;
-            }
-            if (/\belse\s*{/.test(trimmed)) {
-                complexity += 1;
-            }
-            if (/\bfor\s*\(/.test(trimmed)) {
-                complexity += 1 + nestingLevel;
-                nestingLevel++;
-            }
-            if (/\bwhile\s*\(/.test(trimmed)) {
-                complexity += 1 + nestingLevel;
-                nestingLevel++;
-            }
-            if (/\bswitch\s*\(/.test(trimmed)) {
-                complexity += 1 + nestingLevel;
-                nestingLevel++;
-            }
-            if (/\bcatch\s*\(/.test(trimmed)) {
-                complexity += 1 + nestingLevel;
-                nestingLevel++;
-            }
-            if (/\?\s*[^:]/.test(trimmed)) {
-                complexity += 1 + nestingLevel; // Ternary
-            }
-            if (/&&|\|\|/.test(trimmed)) {
-                complexity += 1; // Boolean operators
-            }
-            // Track nesting via braces (simplified)
-            const openBraces = (trimmed.match(/{/g) || []).length;
-            const closeBraces = (trimmed.match(/}/g) || []).length;
-            nestingLevel = Math.max(0, nestingLevel + openBraces - closeBraces);
-        }
-        return complexity;
+        return calculateCognitiveComplexity(code);
     }
     estimateCyclomaticComplexity(code) {
         // Fallback heuristic for non-parseable code

package/dist/shared/metrics/cognitive-complexity.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Line-based cognitive complexity heuristic (SonarSource rules, issues #907).
+ * Known gaps (lambdas, labelled jumps, boolean sequences, ...) are tracked in #967.
+ */
+/**
+ * Blank out comments and the contents of string, template and regex literals,
+ * keeping newlines and delimiters, so keywords and braces inside them are not counted.
+ */
+export declare function maskCommentsAndLiterals(code: string): string;
+/**
+ * `if`, loops, `switch`, `catch` and ternaries score +1 plus the nesting level;
+ * `else if` and `else` score a flat +1 (an `else if` is not also an `if`).
+ * Nesting rises only inside the braces of those structures, so a function
+ * body, try block or object literal adds no nesting bonus.
+ */
+export declare function calculateCognitiveComplexity(code: string): number;
+//# sourceMappingURL=cognitive-complexity.d.ts.map