agentic-qe 3.15.10 → 3.15.11

package/dist/mcp/handlers/domain-handler-configs.d.ts

@@ -21,6 +21,8 @@ export interface TestExecuteResult {
     total: number;
     passed: number;
     failed: number;
+    /** #1170: tests that failed and then passed on a retry; counted in `passed`. */
+    flaky?: number;
     duration: number;
     /** Measured line coverage of the run, or null when none was collected (#1027 N5). */
     coverage?: number | null;

package/dist/mcp/handlers/domain-handler-configs.js

@@ -15,6 +15,7 @@ import { buildRiskDecisionFromQualityGate, validateRiskDecision, } from '../../c
 import { INSUFFICIENT_EVIDENCE, } from '../../domains/quality-assessment/quality-evidence.js';
 import { validateRequestedMetrics, } from '../../domains/quality-assessment/evidence-sufficiency.js';
 import { validateBehaviorExamples } from '../../domains/test-generation/services/behavior-example-validation.js';
+import { DEFAULT_TEST_RETRY_COUNT } from '../../domains/test-execution/services/retry-outcome.js';
 const SUPPORTED_LANGUAGES = Object.keys(DEFAULT_FRAMEWORKS);
 /**
  * Normalize a language string from MCP input. Returns the canonical
@@ -67,7 +68,7 @@ export const testGenerateConfig = {
         let framework;
         if (params.framework) {
             framework = params.framework;
-            const fwLang = FRAMEWORK_TO_LANGUAGE[framework];
+            const fwLang = Object.hasOwn(FRAMEWORK_TO_LANGUAGE, framework) ? FRAMEWORK_TO_LANGUAGE[framework] : undefined; // #1157
             if (fwLang && fwLang !== language) {
                 // typescript<->javascript is a soft compatibility — JS frameworks
                 // can target both. Treat as same family.
@@ -190,7 +191,8 @@ export const testExecuteConfig = {
         testSuites: params.testSuites || [],
         parallel: params.parallel !== false,
         parallelism: params.parallelism || 4,
-        retryCount: params.retryCount ?? 3,
+        // #1170: the same default as `aqe test execute`.
+        retryCount: params.retryCount ?? DEFAULT_TEST_RETRY_COUNT,
         timeout: params.timeout || 60000,
         collectCoverage: params.collectCoverage || false,
         reportFormat: params.reportFormat || 'json',
@@ -203,6 +205,8 @@ export const testExecuteConfig = {
         const total = data.total || 0;
         const passed = data.passed || 0;
         const failed = data.failed || 0;
+        // #1170: tests that passed on a retry; already counted in `passed`.
+        const flaky = typeof data.flaky === 'number' && data.flaky > 0 ? data.flaky : undefined;
         // #1027 N5: no measured coverage → null, never a hardcoded 0.
         const coverage = typeof data.coverage === 'number' && Number.isFinite(data.coverage) ? data.coverage : null;
         // #1110: report only what was measured. A figure with no measurement is
@@ -275,6 +279,7 @@ export const testExecuteConfig = {
             summary: {
                 totalTests: total,
                 passRate: total > 0 ? (passed / total) * 100 : 0,
+                ...(flaky !== undefined ? { flaky } : {}),
                 ...(avgTestDuration !== undefined ? { avgDuration: avgTestDuration } : {}),
                 ...(efficiency !== null ? { parallelEfficiency: efficiency } : {}),
             },
@@ -285,6 +290,7 @@ export const testExecuteConfig = {
             total,
             passed,
             failed,
+            ...(flaky !== undefined ? { flaky } : {}),
             duration,
             coverage,
             savedFiles,

package/dist/mcp/handlers/task-handlers.d.ts

@@ -35,6 +35,17 @@ export interface TaskOrchestrateParams {
         requirements?: string[];
     };
 }
+/**
+ * #1022: how learned patterns informed task_orchestrate.
+ * - 'vector': embedding similarity plus text matching
+ * - 'lexical-only': no embedding runtime; text matching only, no similarity
+ *   scores, and experience guidance unavailable
+ * - 'unavailable': the ReasoningBank could not start; no learned guidance
+ */
+export interface OrchestrateLearningStatus {
+    patternSearch: 'vector' | 'lexical-only' | 'unavailable';
+    reason?: string;
+}
 export interface TaskOrchestrateResult {
     taskId: string;
     /** The task type submitted to the domain. */
@@ -57,6 +68,8 @@ export interface TaskOrchestrateResult {
         rationale: string;
         decisionTimeMs: number;
     };
+    /** #1022: how learned patterns informed this orchestration */
+    learning: OrchestrateLearningStatus;
 }
 export declare function handleTaskOrchestrate(params: TaskOrchestrateParams): Promise<ToolResult<TaskOrchestrateResult>>;
 export interface ModelRouteParams {

package/dist/mcp/handlers/task-handlers.js

@@ -232,6 +232,39 @@ export async function handleTaskCancel(params) {
         };
     }
 }
+/**
+ * #1022: gather experience guidance and pattern hints for task_orchestrate.
+ * Learned guidance is optional: a missing embedder, or a ReasoningBank that
+ * cannot start, must not fail the orchestration. The returned status says
+ * which kind of matching produced the hints.
+ */
+async function getOrchestrateLearningContext(task, guidanceDomain, patternDomain) {
+    let service;
+    try {
+        service = await getReasoningBankService();
+    }
+    catch (error) {
+        return {
+            experienceGuidance: null,
+            patternHintMatches: [],
+            learning: { patternSearch: 'unavailable', reason: toErrorMessage(error) },
+        };
+    }
+    const experienceGuidance = await service.getExperienceGuidance(task, guidanceDomain);
+    // Bring HNSW A (qe_patterns) into the routing decision alongside HNSW C
+    // (experienceGuidance). Without this, only past trajectories influenced
+    // routing — the catalog of consolidated long-term patterns was never
+    // consulted for new tasks. Fail-soft: empty array on error.
+    const patternHintMatches = await service
+        .searchPatternMatches(task, { limit: 5, domain: patternDomain })
+        .catch(() => []);
+    const status = service.getPatternSearchStatus();
+    return {
+        experienceGuidance,
+        patternHintMatches,
+        learning: { patternSearch: status.mode, ...(status.reason ? { reason: status.reason } : {}) },
+    };
+}
 export async function handleTaskOrchestrate(params) {
     if (!isFleetInitialized()) {
         return {
@@ -270,18 +303,7 @@ export async function handleTaskOrchestrate(params) {
             },
         });
         // INTEGRATION FIX: Get ReasoningBank guidance for the task
-        const reasoningBankService = await getReasoningBankService();
-        const experienceGuidance = await reasoningBankService.getExperienceGuidance(params.task, params.context?.project);
-        // Bring HNSW A (qe_patterns) into the routing decision alongside HNSW C
-        // (experienceGuidance). Without this, only past trajectories influenced
-        // routing — the catalog of consolidated long-term patterns was never
-        // consulted for new tasks. Fail-soft: empty array on error.
-        const patternHintMatches = await reasoningBankService
-            .searchPatternMatches(params.task, {
-            limit: 5,
-            domain: params.context?.project ?? inferredDomain,
-        })
-            .catch(() => []);
+        const { experienceGuidance, patternHintMatches, learning } = await getOrchestrateLearningContext(params.task, params.context?.project, params.context?.project ?? inferredDomain);
         // Parse task description to determine task type
         const taskType = inferTaskType(params.task);
         const priority = mapPriority(params.priority || 'medium');
@@ -355,6 +377,7 @@ export async function handleTaskOrchestrate(params) {
                         rationale: routingResult.decision.rationale,
                         decisionTimeMs: routingResult.decision.metadata.decisionTimeMs,
                     },
+                    learning,
                 },
             };
         }
@@ -446,10 +469,12 @@ export async function handleTaskOrchestrate(params) {
         }
         // INTEGRATION FIX: Start trajectory tracking for learning
         const taskId = result.value;
-        await startTaskTrajectory(taskId, params.task, {
-            agent: 'queen-coordinator',
-            domain: params.context?.project,
-        });
+        if (learning.patternSearch !== 'unavailable') {
+            await startTaskTrajectory(taskId, params.task, {
+                agent: 'queen-coordinator',
+                domain: params.context?.project,
+            });
+        }
         // Issue N1: Trajectory auto-close is handled by subscribeTrajectoryEvents(),
         // which listens for TaskCompleted/TaskFailed on the event router.
         // No per-task polling needed.
@@ -485,6 +510,7 @@ export async function handleTaskOrchestrate(params) {
                     rationale: routingResult.decision.rationale,
                     decisionTimeMs: routingResult.decision.metadata.decisionTimeMs,
                 },
+                learning,
             },
         };
     }

package/dist/mcp/handlers/validation-pipeline-handler.js

@@ -4,11 +4,11 @@
  * Exposes the structured 13-step requirements validation pipeline
  * as an MCP tool that users can invoke directly.
  */
-import { readFileSync, existsSync } from 'fs';
 import { runPipeline, formatPipelineReport } from '../../validation/pipeline.js';
 import { createRequirementsPipeline, REQUIREMENTS_VALIDATION_STEPS } from '../../validation/steps/requirements.js';
 import { toErrorMessage } from '../../shared/error-utils.js';
 import { MAX_PAYLOAD_FILE_BYTES, requirePayloadPath } from '../../shared/io/payload-path-guard.js';
+import { ConfinedReadError, readConfinedText } from '../../shared/io/confined-read.js';
 /**
  * Run the structured validation pipeline on a document.
  */
@@ -23,17 +23,17 @@ export async function handleValidationPipeline(params) {
         const confined = await requirePayloadPath('validation_pipeline', 'filePath', params.filePath, { allowMissing: true, maxBytes: MAX_PAYLOAD_FILE_BYTES });
         if (!confined.success)
             return { success: false, error: confined.error.message };
-        const absPath = confined.value;
-        if (!existsSync(absPath)) {
-            return {
-                success: false,
-                error: `File not found: ${params.filePath}`,
-            };
-        }
+        // #1161: read from the validated descriptor, not the name checked above.
         try {
-            content = readFileSync(absPath, 'utf-8');
+            content = await readConfinedText(confined.value, { maxBytes: MAX_PAYLOAD_FILE_BYTES });
         }
         catch (readErr) {
+            if (readErr instanceof ConfinedReadError && readErr.reason === 'not-found') {
+                return {
+                    success: false,
+                    error: `File not found: ${params.filePath}`,
+                };
+            }
             return {
                 success: false,
                 error: `Failed to read file: ${toErrorMessage(readErr)}`,

package/dist/mcp/protocol-server.js

@@ -627,7 +627,7 @@ export class MCPProtocolServer {
                 parameters: [
                     { name: 'topology', type: 'string', description: 'Swarm topology type', enum: ['hierarchical', 'mesh', 'ring', 'adaptive'] },
                     { name: 'maxAgents', type: 'number', description: 'Maximum number of agents', default: 15 },
-                    { name: 'enabledDomains', type: 'array', description: 'Domains to enable' },
+                    { name: 'enabledDomains', type: 'array', description: 'Domains to enable', items: { type: 'string' } },
                     { name: 'lazyLoading', type: 'boolean', description: 'Enable lazy loading', default: true },
                 ],
             },
@@ -669,7 +669,7 @@ export class MCPProtocolServer {
                 parameters: [
                     { name: 'type', type: 'string', description: 'Task type', required: true },
                     { name: 'priority', type: 'string', description: 'Task priority', enum: ['p0', 'p1', 'p2', 'p3'], default: 'p1' },
-                    { name: 'targetDomains', type: 'array', description: 'Target domains (e.g. ["coverage-analysis"]); unknown domains are rejected' },
+                    { name: 'targetDomains', type: 'array', description: 'Target domains (e.g. ["coverage-analysis"]); unknown domains are rejected', items: { type: 'string' } },
                     { name: 'payload', type: 'object', description: 'Task payload data' },
                 ],
             },
@@ -882,7 +882,7 @@ export class MCPProtocolServer {
                 description: `Execute test files in parallel with automatic retry on flaky failures. ${SAVE_RESULTS_HINT} Example: test_execute_parallel({ testFiles: ["tests/auth.test.ts"], parallel: true })`,
                 category: 'domain',
                 parameters: [
-                    { name: 'testFiles', type: 'array', description: 'Nonempty list of concrete test file paths (relative to the project working directory or absolute). Expand glob patterns before calling; glob patterns are rejected.' },
+                    { name: 'testFiles', type: 'array', description: 'Nonempty list of concrete test file paths (relative to the project working directory or absolute). Expand glob patterns before calling; glob patterns are rejected.', items: { type: 'string' } },
                     { name: 'parallel', type: 'boolean', description: 'Enable parallel execution', default: true },
                     saveResultsParameter('test_execute_parallel'),
                 ],
@@ -1110,7 +1110,7 @@ export class MCPProtocolServer {
                 category: 'memory',
                 parameters: [
                     { name: 'sourceAgentId', type: 'string', description: 'Source agent ID', required: true },
-                    { name: 'targetAgentIds', type: 'array', description: 'Target agent IDs', required: true },
+                    { name: 'targetAgentIds', type: 'array', description: 'Target agent IDs', required: true, items: { type: 'string' } },
                     { name: 'knowledgeDomain', type: 'string', description: 'Knowledge domain', required: true },
                 ],
             },
@@ -1127,7 +1127,7 @@ export class MCPProtocolServer {
                 parameters: [
                     { name: 'task', type: 'string', description: 'Task description to analyze', required: true },
                     { name: 'codeContext', type: 'string', description: 'Optional code context for complexity analysis' },
-                    { name: 'filePaths', type: 'array', description: 'Optional file paths involved' },
+                    { name: 'filePaths', type: 'array', description: 'Optional file paths involved', items: { type: 'string' } },
                     { name: 'manualTier', type: 'number', description: 'Manual tier override (0-4)' },
                     { name: 'isCritical', type: 'boolean', description: 'Mark as critical task (allows budget overrides)' },
                     { name: 'agentType', type: 'string', description: 'Agent type making the request' },
@@ -1194,7 +1194,7 @@ export class MCPProtocolServer {
                 description: 'Trigger infrastructure recovery for detected failures and optionally re-run affected tests. Example: infra_healing_recover({ services: ["postgres"], rerunTests: true })',
                 category: 'infra-healing',
                 parameters: [
-                    { name: 'services', type: 'array', description: 'Specific services to recover (empty = all failing)' },
+                    { name: 'services', type: 'array', description: 'Specific services to recover (empty = all failing)', items: { type: 'string' } },
                     { name: 'rerunTests', type: 'boolean', description: 'Re-run affected tests after recovery', default: true },
                 ],
             },
@@ -1283,7 +1283,7 @@ export class MCPProtocolServer {
                 category: 'cross-phase',
                 isConcurrencySafe: true,
                 parameters: [
-                    { name: 'signals', type: 'array', description: 'Signals to format', required: true },
+                    { name: 'signals', type: 'array', description: 'Signals to format', required: true, items: { type: 'object' } },
                 ],
             },
             handler: (params) => handleFormatSignals(params),
@@ -1309,7 +1309,7 @@ export class MCPProtocolServer {
                     { name: 'filePath', type: 'string', description: 'Path to the document to validate' },
                     { name: 'content', type: 'string', description: 'Inline content to validate (alternative to filePath)' },
                     { name: 'pipeline', type: 'string', description: 'Pipeline type (default: requirements)', default: 'requirements' },
-                    { name: 'steps', type: 'array', description: 'Specific step IDs to run (default: all 13)' },
+                    { name: 'steps', type: 'array', description: 'Specific step IDs to run (default: all 13)', items: { type: 'string' } },
                     { name: 'continueOnFailure', type: 'boolean', description: 'Continue past blocking failures', default: false },
                     { name: 'format', type: 'string', description: 'Output format: markdown or json', default: 'json' },
                 ],

package/dist/mcp/qe-tool-bridge.js

@@ -46,6 +46,9 @@ function schemaToParameters(tool) {
             required: requiredSet.has(name) || undefined,
             default: prop.default,
             enum: prop.enum,
+            // #1185: keep the element schema; clients such as VS Code Copilot
+            // reject a tool whose array parameter has no items.
+            items: prop.items,
         });
     }
     return params;

package/dist/mcp/services/reasoning-bank-service.d.ts

@@ -12,7 +12,7 @@
  * - Synchronous learning (no fire-and-forget)
  */
 import { type Trajectory, type TrajectoryStep as TrackerTrajectoryStep, type TrajectoryOptions, type ExperienceGuidance, type EnhancedReasoningBankAdapterStats } from '../../integrations/agentic-flow/reasoning-bank/index.js';
-import { type RealQERoutingRequest, type RealQERoutingResult, type RealQEReasoningBankStats, type RealQEPatternSearchResult } from '../../learning/real-qe-reasoning-bank.js';
+import { type RealQERoutingRequest, type RealQERoutingResult, type RealQEReasoningBankStats, type PatternSearchStatus, type RealQEPatternSearchResult } from '../../learning/real-qe-reasoning-bank.js';
 import type { QEPattern, QEDomain } from '../../learning/qe-patterns.js';
 /**
  * Task outcome record for learning
@@ -208,6 +208,8 @@ export declare class ReasoningBankService {
         limit?: number;
         domain?: QEDomain;
     }): Promise<RealQEPatternSearchResult[]>;
+    /** #1022: whether pattern search uses vectors or text matching only. */
+    getPatternSearchStatus(): PatternSearchStatus;
     /**
      * Get service statistics
      */

package/dist/mcp/services/reasoning-bank-service.js

@@ -515,6 +515,10 @@ export class ReasoningBankService {
             return [];
         }
     }
+    /** #1022: whether pattern search uses vectors or text matching only. */
+    getPatternSearchStatus() {
+        return this.enhancedAdapter.getPatternSearchStatus();
+    }
     /**
      * Get service statistics
      */

package/dist/mcp/tool-annotations.js

@@ -58,7 +58,10 @@ function conservativeDisposition() {
 export const BUILT_IN_TOOL_SAFETY_INVENTORY = Object.freeze(Object.fromEntries(BUILT_IN_TOOL_NAMES.map((name) => [name, conservativeDisposition()])));
 /** Resolve explicit metadata over inventory metadata over conservative defaults. */
 export function resolveToolAnnotations(name, annotations) {
-    const reviewedDisposition = BUILT_IN_TOOL_SAFETY_INVENTORY[name];
+    // #1157: own entries only; a tool named `constructor` is not in the inventory.
+    const reviewedDisposition = Object.hasOwn(BUILT_IN_TOOL_SAFETY_INVENTORY, name)
+        ? BUILT_IN_TOOL_SAFETY_INVENTORY[name]
+        : undefined;
     return Object.freeze({
         ...(reviewedDisposition?.annotations ?? CONSERVATIVE_TOOL_ANNOTATIONS),
         // Dynamic and plugin-supplied names cannot self-assert optimistic hints.

package/dist/mcp/tools/coherence/check.js

@@ -19,6 +19,7 @@ const COHERENCE_CHECK_SCHEMA = {
         nodes: {
             type: 'array',
             description: 'Array of nodes to check for coherence. Each node must have an id and embedding vector.',
+            items: { type: 'object', description: 'Node with id, embedding vector, optional weight and metadata' },
         },
         energyThreshold: {
             type: 'number',

package/dist/mcp/tools/coherence/consensus.js

@@ -54,11 +54,13 @@ const COHERENCE_CONSENSUS_SCHEMA = {
                     agentId: { type: 'string', description: 'Agent identifier', minLength: 1 },
                     agentType: { type: 'string', description: 'Agent type (default: worker)' },
                     // `verdict` may be a string, number, or boolean, which this schema
-                    // type cannot express; it is required below and checked in execute().
+                    // type cannot express. It is required, but checked in execute():
+                    // listing it in `required` without a property is invalid in strict
+                    // JSON Schema (#1185).
                     confidence: { type: 'number', description: 'Confidence in the verdict', minimum: 0, maximum: 1 },
                     reasoning: { type: 'string', description: 'Optional reasoning text' },
                 },
-                required: ['agentId', 'verdict', 'confidence'],
+                required: ['agentId', 'confidence'],
             },
         },
         confidenceThreshold: {

package/dist/mcp/tools/learning-optimization/optimize.js

@@ -318,6 +318,7 @@ export class LearningOptimizeTool extends MCPToolBase {
             // Not enough data - recommend default strategy
             const contextForRecommendation = {
                 tags: [targetDomain, objective.metric],
+                objective: { metric: objective.metric, direction: objective.direction },
             };
             const recommendResult = await metricsOptimizer.recommendStrategy(contextForRecommendation);
             if (!recommendResult.success)
@@ -362,7 +363,6 @@ export class LearningOptimizeTool extends MCPToolBase {
         let sourcePatterns = 0;
         let transferredPatterns = 0;
         let adaptedPatterns = 0;
-        let totalRelevance = 0;
         if (queryResult.success) {
             sourcePatterns = queryResult.value.length;
             // Transfer each piece of knowledge to target domain
@@ -370,7 +370,6 @@ export class LearningOptimizeTool extends MCPToolBase {
                 const transferResult = await transferSpecialist.transferKnowledge(knowledge, targetDomain);
                 if (transferResult.success) {
                     transferredPatterns++;
-                    totalRelevance += transferResult.value.relevanceScore;
                     // Count as adapted if relevance changed significantly
                     if (Math.abs(transferResult.value.relevanceScore - knowledge.relevanceScore) > 0.1) {
                         adaptedPatterns++;

package/dist/mcp/tools/mincut/index.js

@@ -39,10 +39,12 @@ export class MinCutHealthTool extends MCPToolBase {
                 agents: {
                     type: 'array',
                     description: 'Agent vertices to add to the graph before analysis',
+                    items: { type: 'object', description: 'Agent vertex { id, domain, weight? }' },
                 },
                 edges: {
                     type: 'array',
                     description: 'Edges to add between agents',
+                    items: { type: 'object', description: 'Edge { source, target, weight? }' },
                 },
                 includeWeakVertices: {
                     type: 'boolean',
@@ -210,6 +212,7 @@ export class MinCutStrengthenTool extends MCPToolBase {
                 targetVertices: {
                     type: 'array',
                     description: 'Specific vertices to strengthen',
+                    items: { type: 'string', description: 'Vertex ID' },
                 },
                 apply: {
                     type: 'boolean',

package/dist/mcp/tools/quality-assessment/gate.js

@@ -13,6 +13,8 @@ import { MCPToolBase } from '../base.js';
 import { toErrorMessage } from '../../../shared/error-utils.js';
 import { MAX_PAYLOAD_FILE_BYTES, requirePayloadPath } from '../../../shared/io/payload-path-guard.js';
 import { findProjectRoot } from '../../../kernel/project-root.js';
+import { readConfinedText } from '../../../shared/io/confined-read.js';
+import { parseAnchorSet } from '../../../validation/anchor-set.js';
 import { getLLMRouter } from '../base.js';
 import { runQualityGate, } from '../../../validation/quality-gate-runner.js';
 import { createRouterFrontierJudge, createUnavailableJudge, } from '../../../validation/frontier-judge.js';
@@ -37,11 +39,15 @@ export class QualityGateTool extends MCPToolBase {
             // #1126: a caller-named anchor must be a regular file inside the project
             // (relative paths resolve against the project root, as the runner does).
             let anchorPath;
+            let anchor;
             if (params.anchorPath !== undefined) {
                 const confined = await requirePayloadPath('qe/quality/gate', 'anchorPath', params.anchorPath, { basePath: findProjectRoot(), maxBytes: MAX_PAYLOAD_FILE_BYTES });
                 if (!confined.success)
                     return { success: false, error: confined.error.message };
                 anchorPath = confined.value;
+                // #1161: the runner gets the anchor read from the validated descriptor,
+                // so a file swapped after the check is never read by name.
+                anchor = parseAnchorSet(await readConfinedText(anchorPath, { maxBytes: MAX_PAYLOAD_FILE_BYTES }), params.anchorPath);
             }
             const router = await getLLMRouter(context);
             const judge = router
@@ -59,6 +65,7 @@ export class QualityGateTool extends MCPToolBase {
                 checklistId: params.checklistId,
                 judge,
                 anchorPath,
+                anchor,
                 verificationManifest: params.verificationManifest,
             });
             return { success: true, data: result };

package/dist/mcp/tools/qx-analysis/analyze.js

@@ -37,6 +37,7 @@ const QX_ANALYZE_SCHEMA = {
         heuristics: {
             type: 'array',
             description: 'Specific heuristics to apply (default: all)',
+            items: { type: 'string', description: 'Heuristic name' },
         },
         minOracleSeverity: {
             type: 'string',

package/dist/mcp/tools/requirements-validation/quality-criteria.js

@@ -13,9 +13,9 @@
  */
 import { MCPToolBase } from '../base.js';
 import { createQualityCriteriaService, HTSM_CATEGORIES, NEVER_OMIT_CATEGORIES, } from '../../../domains/requirements-validation/index.js';
-import { existsSync, readFileSync } from 'fs';
 import { toErrorMessage } from '../../../shared/error-utils.js';
 import { MAX_PAYLOAD_FILE_BYTES, requirePayloadPath } from '../../../shared/io/payload-path-guard.js';
+import { ConfinedReadError, readConfinedText } from '../../../shared/io/confined-read.js';
 // ============================================================================
 // Tool Implementation
 // ============================================================================
@@ -128,8 +128,15 @@ export class QualityCriteriaTool extends MCPToolBase {
                 const confined = await requirePayloadPath('quality-criteria', 'epicPath', epicPath, { allowMissing: true, maxBytes: MAX_PAYLOAD_FILE_BYTES });
                 if (!confined.success)
                     return { success: false, error: confined.error.message };
-                if (existsSync(confined.value))
-                    content = readFileSync(confined.value, 'utf-8');
+                // #1161: read from the validated descriptor; a missing file stays empty.
+                try {
+                    content = await readConfinedText(confined.value, { maxBytes: MAX_PAYLOAD_FILE_BYTES });
+                }
+                catch (readErr) {
+                    if (!(readErr instanceof ConfinedReadError) || readErr.reason !== 'not-found') {
+                        return { success: false, error: toErrorMessage(readErr) };
+                    }
+                }
             }
             if (!content && !epicPath) {
                 return {

package/dist/mcp/tools/security-compliance/scan.js

@@ -10,6 +10,7 @@
 import { MCPToolBase, getMemoryBackend } from '../base.js';
 import { toErrorMessage } from '../../../shared/error-utils.js';
 import { safeJsonParse } from '../../../shared/safe-json.js';
+import { getOwn } from '../../../shared/utils/safe-record.js';
 import { ALL_SECURITY_PATTERNS, SECRET_PATTERNS, } from '../../../domains/security-compliance/services/scanners/security-patterns.js';
 import { writeQualityEvidence } from '../../../domains/quality-assessment/quality-evidence.js';
 // ============================================================================
@@ -460,7 +461,8 @@ const KNOWN_VULNERABLE_NPM = {
 function checkKnownVulnerableDeps(deps, manifest) {
     const vulns = [];
     for (const [name, version] of Object.entries(deps)) {
-        const known = KNOWN_VULNERABLE_NPM[name];
+        // #1157: a dependency named `constructor` is a package, not a table entry.
+        const known = getOwn(KNOWN_VULNERABLE_NPM, name);
         if (known) {
             const cleanVersion = version.replace(/^[\^~>=<]+/, '');
             if (compareVersions(cleanVersion, known.maxSafe) < 0) {
@@ -512,7 +514,7 @@ function extractRequirementsTxtDeps(content) {
 function checkKnownVulnerablePythonDeps(deps, manifest) {
     const vulns = [];
     for (const dep of deps) {
-        const known = KNOWN_VULNERABLE_PYTHON[dep];
+        const known = getOwn(KNOWN_VULNERABLE_PYTHON, dep);
         if (known) {
             vulns.push({
                 id: `DEP-py-${dep}-${known.cve}`,

package/dist/mcp/tools/test-execution/e2e-execute.js

@@ -130,7 +130,7 @@ const E2E_EXECUTE_SCHEMA = {
                 name: { type: 'string', description: 'Test case name' },
                 description: { type: 'string', description: 'Test case description' },
                 baseUrl: { type: 'string', description: 'Base URL for the test' },
-                steps: { type: 'array', description: 'Test steps to execute' },
+                steps: { type: 'array', description: 'Test steps to execute', items: { type: 'object', description: 'Test step' } },
                 viewport: {
                     type: 'object',
                     description: 'Browser viewport configuration',
@@ -149,7 +149,7 @@ const E2E_EXECUTE_SCHEMA = {
                 id: { type: 'string', description: 'Test suite ID' },
                 name: { type: 'string', description: 'Test suite name' },
                 description: { type: 'string', description: 'Test suite description' },
-                testCases: { type: 'array', description: 'Test cases in the suite' },
+                testCases: { type: 'array', description: 'Test cases in the suite', items: { type: 'object', description: 'Test case' } },
                 parallel: { type: 'boolean', description: 'Run tests in parallel' },
                 maxWorkers: { type: 'number', description: 'Maximum parallel workers' },
             },

package/dist/mcp/tools/test-execution/execute.js

@@ -9,6 +9,7 @@
 import { MCPToolBase } from '../base.js';
 import { toErrorMessage } from '../../../shared/error-utils.js';
 import { secureRandom, secureRandomFloat } from '../../../shared/utils/crypto-random.js';
+import { DEFAULT_TEST_RETRY_COUNT } from '../../../domains/test-execution/services/retry-outcome.js';
 // ============================================================================
 // Tool Implementation
 // ============================================================================
@@ -22,7 +23,7 @@ export class TestExecuteTool extends MCPToolBase {
         timeout: 300000,
     };
     async execute(params, context) {
-        const { testFiles = [], testSuites = [], pattern, parallel = true, parallelism = 4, retryCount = 3, timeout = 60000, collectCoverage = false, reportFormat = 'json', failFast = false, } = params;
+        const { testFiles = [], testSuites = [], pattern, parallel = true, parallelism = 4, retryCount = DEFAULT_TEST_RETRY_COUNT, collectCoverage = false, failFast = false, } = params;
         const startTime = Date.now();
         try {
             // Determine files to test
@@ -164,7 +165,7 @@ const TEST_EXECUTE_SCHEMA = {
             description: 'Number of retries for failed tests',
             minimum: 0,
             maximum: 5,
-            default: 3,
+            default: DEFAULT_TEST_RETRY_COUNT,
         },
         timeout: {
             type: 'number',

package/dist/memory/crdt/crdt-store.js

@@ -309,6 +309,9 @@ export function createCRDTStore(config) {
         applyState(incoming) {
             // Apply registers
             for (const [key, state] of Object.entries(incoming.registers)) {
+                // One malformed peer entry must not block unrelated state from converging.
+                if (typeof state?.timestamp !== 'number' || !Number.isFinite(state.timestamp))
+                    continue;
                 if (!registers.has(key)) {
                     registers.set(key, createLWWRegisterFromState(nodeId, state));
                 }
@@ -431,6 +434,8 @@ export function createCRDTStore(config) {
             // Apply delta similar to full state, but only for included keys
             if (delta.registers) {
                 for (const [key, state] of Object.entries(delta.registers)) {
+                    if (typeof state?.timestamp !== 'number' || !Number.isFinite(state.timestamp))
+                        continue;
                     if (!registers.has(key)) {
                         registers.set(key, createLWWRegisterFromState(nodeId, state));
                     }

package/dist/memory/crdt/lww-register.js

@@ -7,6 +7,11 @@
  *
  * @module memory/crdt/lww-register
  */
+function assertFiniteTimestamp(timestamp) {
+    if (!Number.isFinite(timestamp)) {
+        throw new RangeError('LWW register timestamp must be a finite number');
+    }
+}
 // =============================================================================
 // LWW Register Implementation
 // =============================================================================
@@ -26,10 +31,12 @@
  * ```
  */
 export function createLWWRegister(nodeId, initialValue, initialTimestamp) {
+    const timestamp = initialTimestamp ?? (initialValue !== undefined ? Date.now() : 0);
+    assertFiniteTimestamp(timestamp);
     // Internal state
     let state = {
         value: initialValue,
-        timestamp: initialTimestamp ?? (initialValue !== undefined ? Date.now() : 0),
+        timestamp,
         nodeId: initialValue !== undefined ? nodeId : '',
         version: initialValue !== undefined ? 1 : 0,
         lastUpdated: Date.now(),
@@ -51,6 +58,7 @@ export function createLWWRegister(nodeId, initialValue, initialTimestamp) {
         },
         set(value, timestamp) {
             let ts = timestamp ?? Date.now();
+            assertFiniteTimestamp(ts);
             // Without an explicit timestamp the write means "now": a second write by
             // this node within one clock tick (or after a backwards clock step) must
             // still supersede its own earlier write, not tie with it and be dropped.
@@ -88,6 +96,8 @@ export function createLWWRegister(nodeId, initialValue, initialTimestamp) {
             // (0) would otherwise beat a real write at a negative timestamp.
             if (incoming.version === 0)
                 return;
+            // NaN breaks total ordering; infinity would permanently outrank finite writes.
+            assertFiniteTimestamp(incoming.timestamp);
             // Only update if incoming timestamp wins
             if (state.version === 0 ||
                 compareTimestamps(incoming.timestamp, incoming.nodeId, state.timestamp, state.nodeId) > 0) {
@@ -134,7 +144,7 @@ export function isLWWRegisterState(value) {
         return false;
     }
     const state = value;
-    return (typeof state.timestamp === 'number' &&
+    return (typeof state.timestamp === 'number' && Number.isFinite(state.timestamp) &&
         typeof state.nodeId === 'string' &&
         typeof state.version === 'number' &&
         typeof state.lastUpdated === 'number' &&