agentic-qe 3.15.10 → 3.15.11

package/dist/cli/chunks/{witness-chain-repair-RUXIOE7F.js → witness-chain-repair-K7YX2AO6.js}

@@ -1,2 +1,2 @@
-import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.10");process.exit(0)}
-import{a as E}from"./chunk-TBLI254A.js";import"./chunk-XEB3NLJR.js";import{b as R,c as b,e as A,h as y,k as C}from"./chunk-2T7RRL6G.js";import"./chunk-C522H7XR.js";import"./chunk-3Y7SPD72.js";import"./chunk-ACWFKES2.js";import"./chunk-AI4VYSFS.js";import"./chunk-VJQYDYAJ.js";import"./chunk-OBAREPDC.js";import"./chunk-6GP6W46M.js";import"./chunk-PGYMKGOE.js";import"./chunk-GZLZCZ42.js";import"./chunk-GJMLK5UT.js";import"./chunk-6PX4OXQO.js";import"./chunk-AH3ZD3NJ.js";import"./chunk-HOZUDE4C.js";import"./chunk-ATHWDAXB.js";import"./chunk-N6PIIK6G.js";import"./chunk-WSF24I3D.js";import"./chunk-GHBNRMSJ.js";import"./chunk-XLZYRTNO.js";import"./chunk-EWFECZ2U.js";import"./chunk-VWNFAW2M.js";import{a as g,b as _}from"./chunk-XBVUVFJK.js";import"./chunk-EN2QSKFF.js";import"./chunk-OY2AHLSF.js";_();import{existsSync as v}from"node:fs";import{basename as I}from"node:path";var w={includeArchive:!0};function l(e){let r=n=>C(e,n)?e.prepare(`SELECT COUNT(*) AS n FROM ${n}`).get().n:0;return{live:r("witness_chain"),archive:r("witness_chain_archive")}}function O(e){return{status:e.status,entriesChecked:e.entriesChecked,forks:e.forks.length,unacknowledgedForks:e.forks.length-e.acknowledgedForks.length,...e.tamperedAt!==void 0?{tamperedAt:e.tamperedAt}:{},...e.tamperReason?{tamperReason:e.tamperReason}:{}}}function $(e){return e.forkDetails.filter(r=>!r.acknowledged).map(({id:r,parentId:n,prevHash:s,actionHash:c})=>({id:r,parentId:n,prevHash:s,actionHash:c}))}function x(e,r){let n=new Set,s=e.prepare("SELECT prev_hash FROM witness_chain UNION ALL SELECT prev_hash FROM witness_chain_archive").pluck().iterate();for(let t of s)n.add(t);let c=[],a=new Set;for(let t of["witness_chain","witness_chain_archive"]){let f=e.prepare(`SELECT * FROM ${t} ORDER BY id ASC`).iterate();for(let o of f){if(o.id===r||a.has(o.id))continue;a.add(o.id);let i=A(o);!n.has(b(i))&&!n.has(R(i))&&c.push({id:o.id,hash:y(o)})}}return c.sort((t,f)=>t.id-f.id)}function S(e){return`Refusing to repair: tampering detected at id=${e.tamperedAt} (${e.tamperReason}). Only accidental forks can be re-anchored; restore from a backup and investigate.`}function M(e){let r=`${e}.bak-${Math.floor(Date.now()/1e3)}`;if(!v(r))return r;let n=1;for(;v(`${r}-${n}`);)n++;return`${r}-${n}`}function W(e,r){let n=M(e),s=g(e,{readonly:!0,fileMustExist:!0});try{s.prepare("VACUUM INTO ?").run(n)}finally{s.close()}let c=g(n,{readonly:!0,fileMustExist:!0});try{let a=c.pragma("integrity_check",{simple:!0});if(a!=="ok")throw new Error(`backup integrity_check failed: ${String(a)}`);let t=l(c);if(t.live!==r.live||t.archive!==r.archive)throw new Error(`backup holds ${JSON.stringify(t)} witness rows, expected ${JSON.stringify(r)}`)}finally{c.close()}return n}async function L(e,r){let n=r.dryRun===!0,s=new E(e,r.keyManager??void 0);await s.initialize();let c=l(e),a=s.verify(w),t={dryRun:n,before:O(a),rowsBefore:c,rowsAfter:c};if(a.tampered)return{...t,action:"refused",message:S(a),forksAcknowledged:[]};let f=$(a);if(f.length===0){let d=a.forks.length>0?`Nothing to repair: all ${a.forks.length} fork(s) are already re-anchored.`:"Nothing to repair: the audit chain has no forks.";return{...t,action:"none",message:d,forksAcknowledged:[]}}if(n)return{...t,action:"would-reanchor",forksAcknowledged:f.map(d=>d.id),message:`Dry run: would back up the database and append a CHAIN_REANCHOR entry acknowledging ${f.length} fork(s). Nothing was written.`};let o,i=e.transaction(()=>{let d=l(e),p=s.verify(w);if(p.tampered)return{kind:"refused",check:p};let h=$(p);if(h.length===0)return{kind:"noop"};o=W(r.dbPath,d);let m=e.prepare("SELECT * FROM witness_chain ORDER BY id DESC LIMIT 1").get(),T=s.append("CHAIN_REANCHOR",{reason:"fork-repair",issue:"https://github.com/proffesor-for-testing/agentic-qe/issues/753",note:"Acknowledges accidental forks from pre-3.14.5 concurrent appends; no rows were changed.",forkCount:h.length,forks:h,pins:x(e,m.id),verifiedTipId:m.id,verifiedTipHash:y(m),entriesChecked:p.entriesChecked,rows:d,backup:I(o)},r.actor??"aqe-audit-repair"),k=l(e);if(k.live!==d.live+1||k.archive!==d.archive)throw new Error(`row-count check failed: before ${JSON.stringify(d)}, after ${JSON.stringify(k)}`);return{kind:"reanchored",entry:T,forks:h,txAfter:k}}).immediate();if(i.kind==="refused")return{...t,action:"refused",message:S(i.check),forksAcknowledged:[]};if(i.kind==="noop")return{...t,action:"none",message:"Nothing to repair (another process re-anchored first).",forksAcknowledged:[]};let u=s.verify(w),N=u.valid&&!u.tampered;return{...t,action:"reanchored",after:O(u),rowsAfter:i.txAfter,forksAcknowledged:i.forks.map(d=>d.id),reanchorId:i.entry.id,backupPath:o,message:N?`Re-anchored ${i.forks.length} fork(s) with CHAIN_REANCHOR id=${i.entry.id}; chain now ${u.status}. Backup: ${o}`:`Appended CHAIN_REANCHOR id=${i.entry.id}, but the chain still verifies as ${u.status}. Backup: ${o}`}}export{L as repairWitnessChainForks};
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.11");process.exit(0)}
+import{a as E}from"./chunk-CO3DX2AX.js";import"./chunk-KDI5JOYZ.js";import{b as R,c as b,e as A,h as y,k as C}from"./chunk-NT7JRHMH.js";import"./chunk-LD5CFK53.js";import"./chunk-XGPTZUKQ.js";import"./chunk-JFLU7L3W.js";import"./chunk-WM3SRRA6.js";import"./chunk-XGBU3KEM.js";import"./chunk-G2IJFNZS.js";import"./chunk-M5XYIQYZ.js";import"./chunk-NQZNMCZU.js";import"./chunk-5N25I53C.js";import"./chunk-OYJC3YON.js";import"./chunk-EJPK7OTR.js";import"./chunk-QDESWOZP.js";import"./chunk-IO5537OM.js";import"./chunk-FZHSG75I.js";import"./chunk-VO3DRK4P.js";import"./chunk-HJ3XNTTJ.js";import"./chunk-76SNL7GU.js";import"./chunk-EH2S6AOR.js";import"./chunk-XNLIWQYE.js";import{d as g,e as _}from"./chunk-4MUBW4RT.js";import"./chunk-DDEOZPWJ.js";import"./chunk-XJKZ7FTR.js";import"./chunk-CFWGGRE7.js";_();import{existsSync as v}from"node:fs";import{basename as I}from"node:path";var w={includeArchive:!0};function l(e){let r=n=>C(e,n)?e.prepare(`SELECT COUNT(*) AS n FROM ${n}`).get().n:0;return{live:r("witness_chain"),archive:r("witness_chain_archive")}}function O(e){return{status:e.status,entriesChecked:e.entriesChecked,forks:e.forks.length,unacknowledgedForks:e.forks.length-e.acknowledgedForks.length,...e.tamperedAt!==void 0?{tamperedAt:e.tamperedAt}:{},...e.tamperReason?{tamperReason:e.tamperReason}:{}}}function $(e){return e.forkDetails.filter(r=>!r.acknowledged).map(({id:r,parentId:n,prevHash:s,actionHash:c})=>({id:r,parentId:n,prevHash:s,actionHash:c}))}function x(e,r){let n=new Set,s=e.prepare("SELECT prev_hash FROM witness_chain UNION ALL SELECT prev_hash FROM witness_chain_archive").pluck().iterate();for(let t of s)n.add(t);let c=[],a=new Set;for(let t of["witness_chain","witness_chain_archive"]){let f=e.prepare(`SELECT * FROM ${t} ORDER BY id ASC`).iterate();for(let o of f){if(o.id===r||a.has(o.id))continue;a.add(o.id);let i=A(o);!n.has(b(i))&&!n.has(R(i))&&c.push({id:o.id,hash:y(o)})}}return c.sort((t,f)=>t.id-f.id)}function S(e){return`Refusing to repair: tampering detected at id=${e.tamperedAt} (${e.tamperReason}). Only accidental forks can be re-anchored; restore from a backup and investigate.`}function M(e){let r=`${e}.bak-${Math.floor(Date.now()/1e3)}`;if(!v(r))return r;let n=1;for(;v(`${r}-${n}`);)n++;return`${r}-${n}`}function W(e,r){let n=M(e),s=g(e,{readonly:!0,fileMustExist:!0});try{s.prepare("VACUUM INTO ?").run(n)}finally{s.close()}let c=g(n,{readonly:!0,fileMustExist:!0});try{let a=c.pragma("integrity_check",{simple:!0});if(a!=="ok")throw new Error(`backup integrity_check failed: ${String(a)}`);let t=l(c);if(t.live!==r.live||t.archive!==r.archive)throw new Error(`backup holds ${JSON.stringify(t)} witness rows, expected ${JSON.stringify(r)}`)}finally{c.close()}return n}async function L(e,r){let n=r.dryRun===!0,s=new E(e,r.keyManager??void 0);await s.initialize();let c=l(e),a=s.verify(w),t={dryRun:n,before:O(a),rowsBefore:c,rowsAfter:c};if(a.tampered)return{...t,action:"refused",message:S(a),forksAcknowledged:[]};let f=$(a);if(f.length===0){let d=a.forks.length>0?`Nothing to repair: all ${a.forks.length} fork(s) are already re-anchored.`:"Nothing to repair: the audit chain has no forks.";return{...t,action:"none",message:d,forksAcknowledged:[]}}if(n)return{...t,action:"would-reanchor",forksAcknowledged:f.map(d=>d.id),message:`Dry run: would back up the database and append a CHAIN_REANCHOR entry acknowledging ${f.length} fork(s). Nothing was written.`};let o,i=e.transaction(()=>{let d=l(e),p=s.verify(w);if(p.tampered)return{kind:"refused",check:p};let h=$(p);if(h.length===0)return{kind:"noop"};o=W(r.dbPath,d);let m=e.prepare("SELECT * FROM witness_chain ORDER BY id DESC LIMIT 1").get(),T=s.append("CHAIN_REANCHOR",{reason:"fork-repair",issue:"https://github.com/proffesor-for-testing/agentic-qe/issues/753",note:"Acknowledges accidental forks from pre-3.14.5 concurrent appends; no rows were changed.",forkCount:h.length,forks:h,pins:x(e,m.id),verifiedTipId:m.id,verifiedTipHash:y(m),entriesChecked:p.entriesChecked,rows:d,backup:I(o)},r.actor??"aqe-audit-repair"),k=l(e);if(k.live!==d.live+1||k.archive!==d.archive)throw new Error(`row-count check failed: before ${JSON.stringify(d)}, after ${JSON.stringify(k)}`);return{kind:"reanchored",entry:T,forks:h,txAfter:k}}).immediate();if(i.kind==="refused")return{...t,action:"refused",message:S(i.check),forksAcknowledged:[]};if(i.kind==="noop")return{...t,action:"none",message:"Nothing to repair (another process re-anchored first).",forksAcknowledged:[]};let u=s.verify(w),N=u.valid&&!u.tampered;return{...t,action:"reanchored",after:O(u),rowsAfter:i.txAfter,forksAcknowledged:i.forks.map(d=>d.id),reanchorId:i.entry.id,backupPath:o,message:N?`Re-anchored ${i.forks.length} fork(s) with CHAIN_REANCHOR id=${i.entry.id}; chain now ${u.status}. Backup: ${o}`:`Appended CHAIN_REANCHOR id=${i.entry.id}, but the chain still verifies as ${u.status}. Backup: ${o}`}}export{L as repairWitnessChainForks};

package/dist/cli/chunks/{witness-chain-verifier-YXENHB42.js → witness-chain-verifier-GUTC3W7N.js}

@@ -1,2 +1,2 @@
-import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.10");process.exit(0)}
-import{g as a,h as b,i as c,j as d,k as e}from"./chunk-2T7RRL6G.js";import"./chunk-OY2AHLSF.js";export{a as CHAIN_REANCHOR_ACTION,c as WitnessChainVerifier,b as ownHash,e as tableExists,d as verifyWitnessChain};
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.11");process.exit(0)}
+import{g as a,h as b,i as c,j as d,k as e}from"./chunk-NT7JRHMH.js";import"./chunk-CFWGGRE7.js";export{a as CHAIN_REANCHOR_ACTION,c as WitnessChainVerifier,b as ownHash,e as tableExists,d as verifyWitnessChain};

package/dist/cli/chunks/{witness-key-manager-HL26AGFO.js → witness-key-manager-YBNKMOP6.js}

@@ -1,2 +1,2 @@
-import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.10");process.exit(0)}
-import{a,b,c}from"./chunk-XEB3NLJR.js";import"./chunk-EWFECZ2U.js";import"./chunk-VWNFAW2M.js";import"./chunk-OY2AHLSF.js";export{a as WitnessKeyManager,c as _resetDefaultWitnessKeyManagerForTests,b as getDefaultWitnessKeyManager};
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.11");process.exit(0)}
+import{a,b,c}from"./chunk-KDI5JOYZ.js";import"./chunk-EH2S6AOR.js";import"./chunk-XNLIWQYE.js";import"./chunk-CFWGGRE7.js";export{a as WitnessKeyManager,c as _resetDefaultWitnessKeyManagerForTests,b as getDefaultWitnessKeyManager};

package/dist/cli/chunks/{workflow-EOVVCN2E.js → workflow-UAJUILFQ.js}

@@ -1,5 +1,5 @@
-import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.10");process.exit(0)}
-import{b as $}from"./chunk-ZXPY654C.js";import"./chunk-M2QV7PT7.js";import{a as k,b as W,c as b,g as C}from"./chunk-4G63WT4F.js";import"./chunk-FZOWULMH.js";import{c as v}from"./chunk-ACWFKES2.js";import"./chunk-NSHU347M.js";import"./chunk-GHBNRMSJ.js";import"./chunk-OY2AHLSF.js";import{Command as D}from"commander";import o from"chalk";function O(f,i){let h=f.indexOf("=");return h>0&&(i[f.substring(0,h)]=f.substring(h+1)),i}function V(f,i,h){let m=new D("workflow").description("Manage QE workflows and pipelines (ADR-041)");return m.command("run <file>").description("Execute a QE pipeline from YAML file").option("-w, --watch","Watch execution progress").option("-v, --verbose","Show detailed output").option("--params <json>","Additional parameters as JSON","{}").action(async(n,t)=>{if(!await h())return;let c=(await import("path")).resolve(n);try{console.log(o.blue(`
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.11");process.exit(0)}
+import{b as $}from"./chunk-VWUZSNVC.js";import"./chunk-WCVCOT4E.js";import{a as k,b as W,c as b,g as C}from"./chunk-BZPE3LDO.js";import"./chunk-TCYSBC7Y.js";import{c as v}from"./chunk-JFLU7L3W.js";import"./chunk-IW6WDGHM.js";import"./chunk-DDEOZPWJ.js";import"./chunk-CFWGGRE7.js";import{Command as D}from"commander";import o from"chalk";function O(f,i){let h=f.indexOf("=");return h>0&&(i[f.substring(0,h)]=f.substring(h+1)),i}function V(f,i,h){let m=new D("workflow").description("Manage QE workflows and pipelines (ADR-041)");return m.command("run <file>").description("Execute a QE pipeline from YAML file").option("-w, --watch","Watch execution progress").option("-v, --verbose","Show detailed output").option("--params <json>","Additional parameters as JSON","{}").action(async(n,t)=>{if(!await h())return;let c=(await import("path")).resolve(n);try{console.log(o.blue(`
  Running workflow from: ${n}
 `));let l=k(c);if(!l.success||!l.workflow){console.log(o.red("Failed to parse pipeline:"));for(let d of l.errors)console.log(o.red(`   ${d}`));await i(1)}let u={...v(t.params,"params")};if(l.pipeline){for(let d of l.pipeline.stages)if(d.params)for(let[y,p]of Object.entries(d.params))u[y]=p}if(!f.workflowOrchestrator.getWorkflow(l.workflow.id)){let d=f.workflowOrchestrator.registerWorkflow(l.workflow);d.success||(console.log(o.red(`Failed to register workflow: ${d.error.message}`)),await i(1))}let g=await f.workflowOrchestrator.executeWorkflow(l.workflow.id,u);if(!g.success){console.log(o.red(`Failed to start workflow: ${g.error.message}`)),await i(1);return}let a=g.value;if(console.log(o.cyan(`  Execution ID: ${a}`)),console.log(o.gray(`  Workflow: ${l.workflow.name}`)),console.log(o.gray(`  Stages: ${l.workflow.steps.length}`)),console.log(""),t.watch){console.log(o.blue(`Workflow Progress:
 `));let d,y=Date.now();for(;;){let w=f.workflowOrchestrator.getWorkflowStatus(a);if(!w)break;if(!d||d.progress!==w.progress||d.status!==w.status||JSON.stringify(d.currentSteps)!==JSON.stringify(w.currentSteps)){process.stdout.write("\r\x1B[K");let S="\u2588".repeat(Math.floor(w.progress/5))+"\u2591".repeat(20-Math.floor(w.progress/5)),R=w.status==="completed"?o.green:w.status==="failed"?o.red:w.status==="running"?o.yellow:o.gray;console.log(`  [${S}] ${w.progress}% - ${R(w.status)}`),w.currentSteps.length>0&&t.verbose&&console.log(o.gray(`    Running: ${w.currentSteps.join(", ")}`)),d=w}if(w.status==="completed"||w.status==="failed"||w.status==="cancelled")break;await new Promise(S=>setTimeout(S,500))}let p=f.workflowOrchestrator.getWorkflowStatus(a);if(p){console.log("");let w=p.duration||Date.now()-y;p.status==="completed"?(console.log(o.green("Workflow completed successfully")),console.log(o.gray(`   Duration: ${$(w)}`)),console.log(o.gray(`   Completed: ${p.completedSteps.length} stages`)),p.skippedSteps.length>0&&console.log(o.yellow(`   Skipped: ${p.skippedSteps.length} stages`))):p.status==="failed"?(console.log(o.red("Workflow failed")),console.log(o.red(`   Error: ${p.error}`)),console.log(o.gray(`   Failed stages: ${p.failedSteps.join(", ")}`))):console.log(o.yellow(`Workflow ${p.status}`))}console.log(""),await i(p?.status==="completed"?0:1);return}else console.log(o.green("Workflow execution started")),console.log(o.gray(`   Use 'aqe workflow status ${a}' to check progress`));console.log(""),await i(0)}catch(l){console.error(o.red(`
@@ -35,10 +35,10 @@ Workflow cancelled: ${n}
 `)):console.log(o.red(`
 Failed to cancel workflow: ${t.error.message}
 `)),await i(t.success?0:1)}catch(t){console.error(o.red(`
-Failed to cancel workflow:`),t),await i(1)}}),m.command("browser-list").description("List available browser workflow templates").action(async()=>{try{let{BrowserWorkflowTool:n}=await import("./browser-workflow-MSBOLYUY.js"),e=await new n().invoke({});if(e.success&&e.data){console.log(o.blue(`
+Failed to cancel workflow:`),t),await i(1)}}),m.command("browser-list").description("List available browser workflow templates").action(async()=>{try{let{BrowserWorkflowTool:n}=await import("./browser-workflow-VTDFBW7T.js"),e=await new n().invoke({});if(e.success&&e.data){console.log(o.blue(`
  Browser Workflow Templates:
 `));for(let c of e.data.availableTemplates)console.log(`  ${o.cyan(c)}`);console.log("")}else console.log(o.red(`Failed: ${e.error||"Unknown error"}`));await i(0)}catch(n){console.error(o.red(`
-Failed:`),n),await i(1)}}),m.command("browser-load [template]").description("Load and validate a browser workflow template or inline YAML").option("--yaml <yaml>","Inline YAML workflow definition").option("-v, --var <key=value>","Variable override (repeatable)",O,{}).option("-F, --format <format>","Output format (text|json)","text").option("-o, --output <path>","Write output to file").action(async(n,t)=>{try{let{BrowserWorkflowTool:e}=await import("./browser-workflow-MSBOLYUY.js"),{writeOutput:c,toJSON:l}=await import("./ci-output-FXZ7ZZW3.js"),s=new e,u={variables:t.var||{}};if(t.yaml)u.workflowYaml=t.yaml;else if(n)if(n.endsWith(".yaml")||n.endsWith(".yml")){let g=await import("fs"),d=(await import("path")).resolve(n);g.existsSync(d)||(console.log(o.red(`
+Failed:`),n),await i(1)}}),m.command("browser-load [template]").description("Load and validate a browser workflow template or inline YAML").option("--yaml <yaml>","Inline YAML workflow definition").option("-v, --var <key=value>","Variable override (repeatable)",O,{}).option("-F, --format <format>","Output format (text|json)","text").option("-o, --output <path>","Write output to file").action(async(n,t)=>{try{let{BrowserWorkflowTool:e}=await import("./browser-workflow-VTDFBW7T.js"),{writeOutput:c,toJSON:l}=await import("./ci-output-PEQQQWVD.js"),s=new e,u={variables:t.var||{}};if(t.yaml)u.workflowYaml=t.yaml;else if(n)if(n.endsWith(".yaml")||n.endsWith(".yml")){let g=await import("fs"),d=(await import("path")).resolve(n);g.existsSync(d)||(console.log(o.red(`
 File not found: ${d}
 `)),await i(1)),u.workflowYaml=g.readFileSync(d,"utf-8")}else u.templateName=n;else console.log(o.red(`
 Provide a template name or --yaml. Use "workflow browser-list" to see templates.

package/dist/cli/chunks/workflow-orchestrator-3ZN7MVCE.js

@@ -0,0 +1,2 @@
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.11");process.exit(0)}
+import{a,b,d as c,e as d}from"./chunk-T5KHJ3J7.js";import"./chunk-BTVWA35P.js";import"./chunk-LD5CFK53.js";import"./chunk-XGPTZUKQ.js";import"./chunk-JFLU7L3W.js";import"./chunk-WM3SRRA6.js";import"./chunk-XGBU3KEM.js";import"./chunk-G2IJFNZS.js";import"./chunk-M5XYIQYZ.js";import"./chunk-NQZNMCZU.js";import"./chunk-5N25I53C.js";import"./chunk-OYJC3YON.js";import"./chunk-EJPK7OTR.js";import"./chunk-7R5HC56U.js";import"./chunk-IW6WDGHM.js";import"./chunk-QDESWOZP.js";import"./chunk-IO5537OM.js";import"./chunk-FZHSG75I.js";import"./chunk-VO3DRK4P.js";import"./chunk-HJ3XNTTJ.js";import"./chunk-76SNL7GU.js";import"./chunk-EH2S6AOR.js";import"./chunk-XNLIWQYE.js";import"./chunk-4MUBW4RT.js";import"./chunk-DDEOZPWJ.js";import"./chunk-XJKZ7FTR.js";import"./chunk-CFWGGRE7.js";export{b as DEFAULT_WORKFLOW_CONFIG,a as WorkflowEvents,c as WorkflowOrchestrator,d as createWorkflowOrchestrator};

package/dist/cli/chunks/{wrappers-AGODHBOO.js → wrappers-AVZ3GPAL.js}

@@ -1,2 +1,2 @@
-import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.10");process.exit(0)}
-import{a,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v as L,w as M,x as N}from"./chunk-ODJNUMV3.js";import{a as v,b as w,c as x,d as y,e as z,f as A,g as B,h as C,i as D,j as E,k as F,l as G,m as H,n as I,o as J,p as K}from"./chunk-ESUO3GTJ.js";import"./chunk-C522H7XR.js";import"./chunk-3Y7SPD72.js";import"./chunk-ACWFKES2.js";import"./chunk-AI4VYSFS.js";import"./chunk-VJQYDYAJ.js";import"./chunk-OBAREPDC.js";import"./chunk-6GP6W46M.js";import"./chunk-PGYMKGOE.js";import"./chunk-GZLZCZ42.js";import"./chunk-GJMLK5UT.js";import"./chunk-6PX4OXQO.js";import"./chunk-AH3ZD3NJ.js";import"./chunk-HOZUDE4C.js";import"./chunk-ATHWDAXB.js";import"./chunk-N6PIIK6G.js";import"./chunk-WSF24I3D.js";import"./chunk-GHBNRMSJ.js";import"./chunk-XLZYRTNO.js";import"./chunk-EWFECZ2U.js";import"./chunk-VWNFAW2M.js";import"./chunk-XBVUVFJK.js";import"./chunk-EN2QSKFF.js";import"./chunk-OY2AHLSF.js";export{z as GNNLayerFactory,i as QEFlashAttention,x as QEGNNEmbeddingIndex,y as QEGNNIndexFactory,a as QESONA,e as QE_FLASH_ATTENTION_CONFIG,g as QE_PERFORMANCE_TARGETS,f as QE_SONA_CONFIG,A as TensorCompressionFactory,u as batchComputeAttention,K as batchDifferentiableSearch,M as checkRuvectorPackagesAvailable,c as createDomainQESONA,j as createQEFlashAttention,b as createQESONA,D as getDifferentiableSearch,F as getGetCompressionLevel,E as getHierarchicalForward,G as getInit,h as getOptimalBlockConfig,k as getQEFlashAttentionConfig,n as getRuvectorDotProductAttention,m as getRuvectorFlashAttention,p as getRuvectorHyperbolicAttention,B as getRuvectorLayer,q as getRuvectorLinearAttention,r as getRuvectorMoEAttention,o as getRuvectorMultiHeadAttention,L as getRuvectorPackageVersions,C as getTensorCompress,l as getWorkloadTypes,N as initAllRuvectorPackages,w as initGNN,d as isAttentionAvailable,v as isGNNAvailable,s as toFloat32Array,H as toFloat32ArrayGNN,J as toIEmbedding,t as toNumberArrayAttn,I as toNumberArrayGNN};
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.11");process.exit(0)}
+import{a,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v as L,w as M,x as N}from"./chunk-VEEYL2CZ.js";import{a as v,b as w,c as x,d as y,e as z,f as A,g as B,h as C,i as D,j as E,k as F,l as G,m as H,n as I,o as J,p as K}from"./chunk-JUMICXM6.js";import"./chunk-LD5CFK53.js";import"./chunk-XGPTZUKQ.js";import"./chunk-JFLU7L3W.js";import"./chunk-WM3SRRA6.js";import"./chunk-XGBU3KEM.js";import"./chunk-G2IJFNZS.js";import"./chunk-M5XYIQYZ.js";import"./chunk-NQZNMCZU.js";import"./chunk-5N25I53C.js";import"./chunk-OYJC3YON.js";import"./chunk-EJPK7OTR.js";import"./chunk-QDESWOZP.js";import"./chunk-IO5537OM.js";import"./chunk-FZHSG75I.js";import"./chunk-VO3DRK4P.js";import"./chunk-HJ3XNTTJ.js";import"./chunk-76SNL7GU.js";import"./chunk-EH2S6AOR.js";import"./chunk-XNLIWQYE.js";import"./chunk-4MUBW4RT.js";import"./chunk-DDEOZPWJ.js";import"./chunk-XJKZ7FTR.js";import"./chunk-CFWGGRE7.js";export{z as GNNLayerFactory,i as QEFlashAttention,x as QEGNNEmbeddingIndex,y as QEGNNIndexFactory,a as QESONA,e as QE_FLASH_ATTENTION_CONFIG,g as QE_PERFORMANCE_TARGETS,f as QE_SONA_CONFIG,A as TensorCompressionFactory,u as batchComputeAttention,K as batchDifferentiableSearch,M as checkRuvectorPackagesAvailable,c as createDomainQESONA,j as createQEFlashAttention,b as createQESONA,D as getDifferentiableSearch,F as getGetCompressionLevel,E as getHierarchicalForward,G as getInit,h as getOptimalBlockConfig,k as getQEFlashAttentionConfig,n as getRuvectorDotProductAttention,m as getRuvectorFlashAttention,p as getRuvectorHyperbolicAttention,B as getRuvectorLayer,q as getRuvectorLinearAttention,r as getRuvectorMoEAttention,o as getRuvectorMultiHeadAttention,L as getRuvectorPackageVersions,C as getTensorCompress,l as getWorkloadTypes,N as initAllRuvectorPackages,w as initGNN,d as isAttentionAvailable,v as isGNNAvailable,s as toFloat32Array,H as toFloat32ArrayGNN,J as toIEmbedding,t as toNumberArrayAttn,I as toNumberArrayGNN};

package/dist/cli/commands/fleet.js

@@ -307,7 +307,10 @@ export function createFleetCommand(context, cleanupAndExit, ensureInitialized, r
                     return { id: op.id, success: false, result: undefined };
                 }
             }));
-            progress.stop();
+            // #1168: a completed agent is not a passed check, so the completion
+            // line only says "successfully" when the verdict passes.
+            const verdictPassed = reportFleetVerdict(operation, results, () => { });
+            progress.stop({ verdictFailed: !verdictPassed });
             const successful = results.filter(r => r.success).length;
             const failed = results.filter(r => !r.success).length;
             console.log(chalk.blue('\n Operation Summary:'));

package/dist/cli/commands/hooks-handlers/tool-loop-guardrail.js

@@ -17,6 +17,7 @@
  */
 import * as fs from 'fs';
 import * as path from 'path';
+import { createSafeRecord, getOwn, setOwn } from '../../../shared/utils/safe-record.js';
 export class ToolLoopGuardrail {
     statePath;
     warnThreshold;
@@ -46,7 +47,7 @@ export class ToolLoopGuardrail {
         if (!sig) {
             return { verdict: 'allow', consecutiveFailures: 0, halfOpen: false };
         }
-        const entry = this.readState()[sig];
+        const entry = getOwn(this.readState(), sig);
         if (!entry || entry.consecutiveFailures < this.warnThreshold) {
             return { verdict: 'allow', consecutiveFailures: entry?.consecutiveFailures ?? 0, halfOpen: false };
         }
@@ -89,16 +90,16 @@ export class ToolLoopGuardrail {
         try {
             const state = this.readState();
             if (success) {
-                if (state[sig]) {
+                if (getOwn(state, sig)) {
                     delete state[sig];
                     this.writeState(state, now);
                 }
                 return;
             }
-            const entry = state[sig] ?? { consecutiveFailures: 0, lastFailureAt: now };
+            const entry = getOwn(state, sig) ?? { consecutiveFailures: 0, lastFailureAt: now };
             entry.consecutiveFailures += 1;
             entry.lastFailureAt = now;
-            state[sig] = entry;
+            setOwn(state, sig, entry);
             this.writeState(state, now);
         }
         catch {
@@ -113,10 +114,14 @@ export class ToolLoopGuardrail {
         try {
             const raw = fs.readFileSync(this.statePath, 'utf8');
             const parsed = JSON.parse(raw);
-            return typeof parsed === 'object' && parsed !== null ? parsed : {};
+            // #1157: keys are command signatures (`__proto__` is a valid command
+            // string), so the state never inherits from Object.prototype.
+            return typeof parsed === 'object' && parsed !== null
+                ? Object.assign(createSafeRecord(), parsed)
+                : createSafeRecord();
         }
         catch {
-            return {}; // missing or corrupt sidecar → clean slate
+            return createSafeRecord(); // missing or corrupt sidecar → clean slate
         }
     }
     writeState(state, now) {

package/dist/cli/commands/test.js

@@ -11,6 +11,7 @@ import { writeTestRunEvidence } from '../../domains/quality-assessment/quality-e
 import { validateBehaviorExamples } from '../../domains/test-generation/services/behavior-example-validation.js';
 import { findProjectRoot } from '../../kernel/project-root.js';
 import { writeGeneratedTestFile } from '../utils/generated-test-writer.js';
+import { DEFAULT_TEST_RETRY_COUNT } from '../../domains/test-execution/services/retry-outcome.js';
 export function createTestCommand(context, cleanupAndExit, ensureInitialized) {
     const testCmd = new Command('test')
         .description('Test generation, execution, scheduling, and load testing')
@@ -179,7 +180,8 @@ export function createTestCommand(context, cleanupAndExit, ensureInitialized) {
                     testFiles,
                     framework: options.framework,
                     parallel: true,
-                    retryCount: 2,
+                    // #1170: the same default as MCP test_execute_parallel.
+                    retryCount: DEFAULT_TEST_RETRY_COUNT,
                 });
                 if (result.success && result.value) {
                     const run = result.value;
@@ -211,7 +213,8 @@ export function createTestCommand(context, cleanupAndExit, ensureInitialized) {
                         console.log(chalk.green(`Test run complete`));
                         console.log(`\n  Results:`);
                         console.log(`    Total: ${chalk.white(total)}`);
-                        console.log(`    Passed: ${chalk.green(run.passed)}`);
+                        console.log(`    Passed: ${chalk.green(run.passed)}` +
+                            (run.flaky ? ` (${chalk.yellow(run.flaky)} flaky: passed on a retry)` : ''));
                         console.log(`    Failed: ${chalk.red(run.failed)}`);
                         console.log(`    Skipped: ${chalk.yellow(run.skipped)}`);
                         console.log(`    Duration: ${chalk.cyan(run.duration + 'ms')}`);

package/dist/cli/handlers/init-handler.d.ts

@@ -134,6 +134,18 @@ interface InitOptions {
     statusline?: boolean;
     modular?: boolean;
 }
+interface DisplayedInitStep {
+    step: string;
+    status: string;
+    message?: string;
+    durationMs: number;
+}
+/**
+ * Render init step results. A failed step's message is printed under it —
+ * previously only the step name was shown and the CLI then said "Check errors
+ * above" with no error anywhere on screen (#1173).
+ */
+export declare function formatInitStepLines(steps: readonly DisplayedInitStep[]): string[];
 export declare function createInitHandler(cleanupAndExit: (code: number) => Promise<never>): InitHandler;
 export {};
 //# sourceMappingURL=init-handler.d.ts.map

package/dist/cli/handlers/init-handler.js

@@ -245,12 +245,7 @@ export class InitHandler {
             return;
         }
         // Display step results
-        for (const step of result.steps) {
-            const statusIcon = step.status === 'success' ? '*' : step.status === 'error' ? 'x' : '!';
-            const statusColor = step.status === 'success' ? chalk.green : step.status === 'error' ? chalk.red : chalk.yellow;
-            console.log(statusColor(`  ${statusIcon} ${step.step} (${step.durationMs}ms)`));
-        }
-        console.log('');
+        printInitSteps(result.steps);
         // Claude Flow integration (after base init)
         let cfResult;
         if (!options.skipClaudeFlow && (options.withClaudeFlow || result.success)) {
@@ -340,12 +335,7 @@ export class InitHandler {
         console.log(chalk.white('  Analyzing project...\n'));
         const result = await orchestrator.initialize();
         // Display step results
-        for (const step of result.steps) {
-            const statusIcon = step.status === 'success' ? '*' : step.status === 'error' ? 'x' : '!';
-            const statusColor = step.status === 'success' ? chalk.green : step.status === 'error' ? chalk.red : chalk.yellow;
-            console.log(statusColor(`  ${statusIcon} ${step.step} (${step.durationMs}ms)`));
-        }
-        console.log('');
+        printInitSteps(result.steps);
         if (result.success) {
             console.log(chalk.green('  AQE v3 initialized successfully!\n'));
             // Show summary
@@ -548,6 +538,31 @@ function isPeerInstalled(pkg) {
         return code === 'ERR_PACKAGE_PATH_NOT_EXPORTED';
     }
 }
+/**
+ * Render init step results. A failed step's message is printed under it —
+ * previously only the step name was shown and the CLI then said "Check errors
+ * above" with no error anywhere on screen (#1173).
+ */
+export function formatInitStepLines(steps) {
+    const lines = [];
+    for (const step of steps) {
+        const statusIcon = step.status === 'success' ? '*' : step.status === 'error' ? 'x' : '!';
+        const statusColor = step.status === 'success' ? chalk.green : step.status === 'error' ? chalk.red : chalk.yellow;
+        lines.push(statusColor(`  ${statusIcon} ${step.step} (${step.durationMs}ms)`));
+        if (step.status === 'error' && step.message) {
+            for (const line of step.message.split('\n')) {
+                lines.push(chalk.red(`      ${line}`));
+            }
+        }
+    }
+    return lines;
+}
+function printInitSteps(steps) {
+    for (const line of formatInitStepLines(steps)) {
+        console.log(line);
+    }
+    console.log('');
+}
 function printOptionalPeerHints() {
     const missing = OPTIONAL_PEERS.filter(({ pkg }) => !isPeerInstalled(pkg));
     if (missing.length === 0)

package/dist/cli/utils/ci-output.d.ts

@@ -76,6 +76,8 @@ export interface TestRunSummary {
             unmatched?: boolean;
         }>;
     };
+    /** #1170: tests that failed and then passed on a retry; counted in `passed`. */
+    flaky?: number;
 }
 export interface CoverageResult {
     /** `null` = the report never collected that metric (#995); not 0%. */

package/dist/cli/utils/ci-output.js

@@ -333,6 +333,8 @@ export function testRunToMarkdown(summary) {
     md += `|--------|-------|\n`;
     md += `| Total | ${total} |\n`;
     md += `| Passed | ${summary.passed} |\n`;
+    if (summary.flaky)
+        md += `| Flaky (passed on a retry) | ${summary.flaky} |\n`;
     md += `| Failed | ${summary.failed} |\n`;
     md += `| Skipped | ${summary.skipped} |\n`;
     md += `\n**Result:** ${summary.failed === 0 ? '\u2705 All tests passed' : '\u274C Some tests failed'}\n`;

package/dist/cli/utils/progress.d.ts

@@ -21,6 +21,14 @@ export interface FleetProgressOptions {
     showPercentage?: boolean;
     format?: string;
 }
+/** Options for {@link FleetProgressManager.stop}. */
+export interface FleetProgressStopOptions {
+    /**
+     * The operation's verdict failed (#1168). The agents still completed, but
+     * the summary line must not call that a success.
+     */
+    verdictFailed?: boolean;
+}
 export interface SpinnerOptions {
     text: string;
     color?: 'cyan' | 'green' | 'yellow' | 'red' | 'blue' | 'magenta' | 'white';
@@ -43,7 +51,7 @@ export declare class FleetProgressManager {
     /**
      * Start the fleet progress display
      */
-    start(totalAgents: number): void;
+    start(_totalAgents: number): void;
     /**
      * Add an agent to track
      */
@@ -63,11 +71,17 @@ export declare class FleetProgressManager {
     /**
      * Stop the progress display
      */
-    stop(): void;
+    stop(options?: FleetProgressStopOptions): void;
     /**
      * Update the fleet-level progress bar
      */
     private updateFleetProgress;
+    /**
+     * Create a bar and apply its payload. Without a TTY, cli-progress's
+     * MultiBar.create() returns before starting the bar, dropping the payload,
+     * so the final render printed a literal `{name}` (#1168).
+     */
+    private createBar;
     private getAgentNameDisplay;
     private getStatusIcon;
     private truncateName;

package/dist/cli/utils/progress.js

@@ -13,6 +13,7 @@ import { getCLIConfig, shouldUseColors } from '../config/cli-config.js';
 // ============================================================================
 // Fleet Progress Manager - Multi-bar progress for parallel agents
 // ============================================================================
+const FLEET_BAR_NAME = chalk.white('Fleet Progress'.padEnd(30));
 export class FleetProgressManager {
     multiBar;
     agentBars = new Map();
@@ -31,10 +32,12 @@ export class FleetProgressManager {
             showPercentage: true,
             ...options,
         };
-        // Custom format for multi-bar display (respects color config)
+        // Custom format for multi-bar display (respects color config).
+        // `{eta}` is a cli-progress built-in that overrides the payload, so the
+        // formatted ETA travels as `{etaText}` (#1168).
         const barColor = useColors ? chalk.cyan('{bar}') : '{bar}';
         const format = this.options.format ||
-            `{name} ${barColor} {percentage}% | {status} {eta}`;
+            `{name} ${barColor} {percentage}% | {status} {etaText}`;
         this.multiBar = new MultiBar({
             clearOnComplete: false,
             hideCursor: true,
@@ -48,15 +51,15 @@ export class FleetProgressManager {
     /**
      * Start the fleet progress display
      */
-    start(totalAgents) {
+    start(_totalAgents) {
         this.isActive = true;
         this.startTime = Date.now();
         // Create fleet-level progress bar
         console.log(chalk.blue(`\n${this.options.title}\n`));
-        this.fleetBar = this.multiBar.create(100, 0, {
-            name: chalk.white('Fleet Progress'.padEnd(30)),
+        this.fleetBar = this.createBar(0, {
+            name: FLEET_BAR_NAME,
             status: '',
-            eta: '',
+            etaText: '',
         });
     }
     /**
@@ -66,10 +69,10 @@ export class FleetProgressManager {
         if (!this.isActive)
             return;
         this.agentStates.set(agent.id, agent);
-        const bar = this.multiBar.create(100, agent.progress, {
+        const bar = this.createBar(agent.progress, {
             name: chalk.gray(this.truncateName(agent.name, 30).padEnd(30)),
             status: this.getStatusIcon(agent.status),
-            eta: agent.eta ? this.formatEta(agent.eta) : '',
+            etaText: agent.eta ? this.formatEta(agent.eta) : '',
         });
         this.agentBars.set(agent.id, bar);
         this.updateFleetProgress();
@@ -96,7 +99,7 @@ export class FleetProgressManager {
         bar.update(state.progress, {
             name: this.getAgentNameDisplay(state),
             status: this.getStatusIcon(state.status),
-            eta: state.eta ? this.formatEta(state.eta) : '',
+            etaText: state.eta ? this.formatEta(state.eta) : '',
         });
         this.updateFleetProgress();
     }
@@ -115,14 +118,14 @@ export class FleetProgressManager {
         bar.update(state.progress, {
             name: this.getAgentNameDisplay(state),
             status: this.getStatusIcon(state.status),
-            eta: '',
+            etaText: '',
         });
         this.updateFleetProgress();
     }
     /**
      * Stop the progress display
      */
-    stop() {
+    stop(options = {}) {
         if (!this.isActive)
             return;
         this.isActive = false;
@@ -135,7 +138,10 @@ export class FleetProgressManager {
         const total = this.agentStates.size;
         const duration = Date.now() - this.startTime;
         console.log('');
-        if (failed === 0) {
+        if (failed === 0 && options.verdictFailed) {
+            console.log(chalk.yellow(`All ${completed}/${total} agents completed (${this.formatDuration(duration)})`));
+        }
+        else if (failed === 0) {
             console.log(chalk.green(`All ${completed}/${total} agents completed successfully (${this.formatDuration(duration)})`));
         }
         else {
@@ -155,10 +161,21 @@ export class FleetProgressManager {
         const completed = agents.filter(a => a.status === 'completed').length;
         const running = agents.filter(a => a.status === 'running').length;
         this.fleetBar.update(avgProgress, {
+            name: FLEET_BAR_NAME,
             status: chalk.gray(`${completed}/${agents.length} complete, ${running} running`),
-            eta: this.options.showEta ? this.estimateFleetEta(agents) : '',
+            etaText: this.options.showEta ? this.estimateFleetEta(agents) : '',
         });
     }
+    /**
+     * Create a bar and apply its payload. Without a TTY, cli-progress's
+     * MultiBar.create() returns before starting the bar, dropping the payload,
+     * so the final render printed a literal `{name}` (#1168).
+     */
+    createBar(value, payload) {
+        const bar = this.multiBar.create(100, value, payload);
+        bar.update(value, payload);
+        return bar;
+    }
     getAgentNameDisplay(agent) {
         const name = this.truncateName(agent.name, 26);
         switch (agent.status) {
@@ -448,7 +465,7 @@ export class EtaEstimator {
  * Create a simple spinner for async operations
  */
 export function withSpinner(text, operation) {
-    const { spinner, succeed, fail } = createTimedSpinner(text);
+    const { succeed, fail } = createTimedSpinner(text);
     return operation()
         .then((result) => {
         succeed();

package/dist/coordination/consensus/consensus-engine.js

@@ -12,6 +12,7 @@ import { DEFAULT_CONSENSUS_CONFIG, } from './interfaces.js';
 import { buildVerificationPrompt, parseVerificationResponse, buildModelVote, } from './model-provider.js';
 import { ok, err } from '../../shared/types/index.js';
 import { toErrorMessage, toError } from '../../shared/error-utils.js';
+import { createSafeRecord } from '../../shared/utils/safe-record.js';
 import { createStrategy, } from './strategies/index.js';
 import { createSycophancyScorer } from './sycophancy-scorer.js';
 // ============================================================================
@@ -268,7 +269,8 @@ export class ConsensusEngineImpl {
             averageExecutionTime: 0,
             totalCost: 0,
             humanReviewCount: 0,
-            modelStats: {},
+            // #1157: keyed by provider model ids.
+            modelStats: createSafeRecord(),
         };
     }
     /**

package/dist/coordination/handlers/code-intelligence-handlers.js

@@ -4,7 +4,6 @@
  * Extracted from task-executor.ts registerHandlers().
  * Covers: index-code, predict-defects
  */
-import * as fs from 'fs/promises';
 import { randomUUID } from 'node:crypto';
 import { prunePredictionHistory } from '../../domains/defect-intelligence/prediction-history.js';
 import * as path from 'path';
@@ -15,6 +14,7 @@ import { resolveProjectRootFromPaths } from '../../domains/code-intelligence/pro
 import { nothingIndexedError } from '../../domains/code-intelligence/index-path-guard.js';
 import { createLogger } from '../../logging/logger-factory.js';
 import { requirePayloadPath } from '../../shared/io/payload-path-guard.js';
+import { readConfinedText } from '../../shared/io/confined-read.js';
 const logger = createLogger('CodeIntelligenceHandlers');
 async function collectProjectMetricsForTarget(ctx, targetPath, indexedFiles) {
     if (!ctx.getCodeIntelligenceCoordinator)
@@ -177,7 +177,8 @@ export function registerCodeIntelligenceHandlers(ctx) {
             let filesSkipped = 0;
             for (const filePath of sourceFiles) {
                 try {
-                    const content = await fs.readFile(filePath, 'utf-8');
+                    // #1161: validate the opened descriptor, not the name listed earlier.
+                    const content = await readConfinedText(filePath, { outsideRoot: 'allow' });
                     const lines = content.split('\n');
                     const lineCount = lines.length;
                     // Calculate complexity indicators from real code

package/dist/coordination/handlers/coverage-collection.js

@@ -19,6 +19,7 @@
  * caller.
  */
 import * as fs from 'fs';
+import { readConfinedTextSync } from '../../shared/io/confined-read.js';
 import * as os from 'os';
 import * as path from 'path';
 import { parseLcovInfo } from './handler-utils.js';
@@ -558,8 +559,9 @@ export function buildEstimatedCoverage(targetPath) {
         return null;
     const files = sourceFiles.map(filePath => {
         let content = '';
+        // #1161: a source file linked out of the project is treated as unreadable.
         try {
-            content = fs.readFileSync(filePath, 'utf-8');
+            content = readConfinedTextSync(filePath, { outsideRoot: 'allow' });
         }
         catch { /* unreadable — treat as empty */ }
         const ext = path.extname(filePath);

package/dist/coordination/handlers/coverage-runner.d.ts

@@ -25,6 +25,8 @@
  *      fate. Hosts should shut down via a handled signal.
  */
 import type { CoverageData } from '../../domains/coverage-analysis/interfaces';
+import { summarizeStderr } from './coverage-stderr';
+export { summarizeStderr };
 export type JsRunnerName = 'vitest' | 'jest' | 'nyc';
 export interface JsCoverageInvocation {
     runner: JsRunnerName;
@@ -64,7 +66,7 @@ export interface JsCoverageRun {
     numFailedTests?: number | null;
     numPendingTests?: number | null;
     numFailedTestSuites?: number | null;
-    /** The runner's first error line plus the last ~2 KB of its stderr, for diagnosing a crash. */
+    /** The runner's first error line plus the last ~2 KB of its stderr, redacted (#1150), for diagnosing a crash. */
     stderrTail: string;
 }
 /**
@@ -74,13 +76,6 @@ export interface JsCoverageRun {
  * every test passing). Without counts (nyc), the exit code decides.
  */
 export declare function testRunStatus(run: JsCoverageRun): 'passed' | 'failed';
-/**
- * Summarise a runner's stderr for a caller: the FIRST error-looking line (or
- * the first ~512 bytes) plus the last ~2 KB (#995 review NB-C). A tail alone
- * loses the cause when a long stack follows it — a vitest config syntax error
- * prints `[PARSE_ERROR] …` first and then kilobytes of frames.
- */
-export declare function summarizeStderr(head: string, tail: string, totalBytes: number): string;
 /**
  * Find an installed package's bin script, walking up `node_modules` from the
  * project root (hoisted monorepo installs live above the package).

package/dist/coordination/handlers/coverage-runner.js

@@ -30,6 +30,8 @@ import * as os from 'os';
 import * as path from 'path';
 import { safeJsonParse } from '../../shared/safe-json.js';
 import { loadCoverageReportFile } from './coverage-target.js';
+import { STDERR_WINDOW_BYTES, summarizeStderr } from './coverage-stderr.js';
+export { summarizeStderr };
 /**
  * Outcome of a coverage run's tests (#1027 NB2): 'failed' when the runner's
  * own result reports a failed test or test suite, 'passed' when it reports
@@ -43,25 +45,6 @@ export function testRunStatus(run) {
     return run.exitedCleanly ? 'passed' : 'failed';
 }
 const RESULTS_FILE = 'test-results.json';
-const STDERR_TAIL_BYTES = 2048;
-const STDERR_HEAD_BYTES = 4096;
-const STDERR_PREFIX_BYTES = 512;
-const ERROR_LINE_RE = /^.*(?:error|\[[A-Z][A-Z_]{2,}\]|ERR_[A-Z_]+).*$/im;
-/**
- * Summarise a runner's stderr for a caller: the FIRST error-looking line (or
- * the first ~512 bytes) plus the last ~2 KB (#995 review NB-C). A tail alone
- * loses the cause when a long stack follows it — a vitest config syntax error
- * prints `[PARSE_ERROR] …` first and then kilobytes of frames.
- */
-export function summarizeStderr(head, tail, totalBytes) {
-    if (totalBytes <= STDERR_TAIL_BYTES)
-        return tail.trim();
-    const errorLine = ERROR_LINE_RE.exec(head)?.[0]?.trim();
-    const prefix = (errorLine ?? head.slice(0, STDERR_PREFIX_BYTES)).trim();
-    if (prefix && tail.includes(prefix))
-        return tail.trim();
-    return `${prefix}\n…\n${tail.trim()}`;
-}
 // ============================================================================
 // Locating the runner
 // ============================================================================
@@ -348,9 +331,10 @@ export async function runProcessTree(command, args, options) {
         child.stderr?.on('data', (chunk) => {
             const text = chunk.toString('utf-8');
             stderrBytes += chunk.length;
-            if (stderrHead.length < STDERR_HEAD_BYTES)
-                stderrHead = (stderrHead + text).slice(0, STDERR_HEAD_BYTES);
-            stderrTail = (stderrTail + text).slice(-STDERR_TAIL_BYTES);
+            // #1150: raw windows only; summarizeStderr redacts them before slicing.
+            if (stderrHead.length < STDERR_WINDOW_BYTES)
+                stderrHead = (stderrHead + text).slice(0, STDERR_WINDOW_BYTES);
+            stderrTail = (stderrTail + text).slice(-STDERR_WINDOW_BYTES);
         });
         // A grandchild holding the pipe open must not keep the host alive.
         child.stderr?.on('error', () => { });