agentic-qe 3.15.10 → 3.15.12

package/dist/cli/utils/coverage-verdict.js

@@ -8,7 +8,10 @@
  *
  *   - measured   — an instrumented report covers the target: judged on the
  *                  metrics the report collected (an uncollected metric is null,
- *                  never 0%, and is left out of the threshold);
+ *                  never 0%, and is left out of the threshold). When target
+ *                  files are missing from the report, or the report is older
+ *                  than the sources, the evidence is insufficient (#1154): the
+ *                  threshold is not met and the exit code is 3;
  *   - unmeasured — the report has no entry for the target, the runner ran 0
  *                  tests, or only test files were reported: no figure, exit 3;
  *   - estimate   — no report exists, so the CLI shows a labelled STATIC
@@ -20,6 +23,7 @@ import chalk from 'chalk';
 import { walkSourceFiles } from './file-discovery.js';
 import { buildCoverageData, summarizeCoverage } from './coverage-data.js';
 import { describeNoData, reconcileRecommendations, resolveExistingCoverage, thresholdVerdict, } from '../../coordination/handlers/coverage-target.js';
+import { describeEvidence } from '../../coordination/handlers/coverage-evidence.js';
 /** `aqe coverage` exit code when no coverage measurement exists for the target (#995). */
 export const EXIT_UNMEASURED = 3;
 /** Provenance labels, the same vocabulary as MCP `coverage_analyze_sublinear`. */
@@ -46,8 +50,12 @@ export async function resolveCliCoverageData(targetPath, log = message => consol
     if (existing.status === 'evaluated') {
         const { evaluation, projectRoot } = existing;
         if (evaluation.status === 'measured') {
-            const files = evaluation.files;
-            return { kind: 'data', data: { files, summary: summarizeCoverage(files), instrumented: true }, projectRoot };
+            const { files, evidence } = evaluation;
+            const data = {
+                files, summary: summarizeCoverage(files), instrumented: true,
+                ...(evidence.unmeasuredFiles.length > 0 ? { unmeasuredFiles: evidence.unmeasuredFiles } : {}),
+            };
+            return { kind: 'data', data, projectRoot, evidence };
         }
         return { kind: 'no-data', reason: evaluation.reason, message: describeNoData(evaluation.reason, targetPath, projectRoot) };
     }
@@ -104,12 +112,17 @@ export async function evaluateCliCoverage(api, targetPath, threshold, log) {
     // #995 review NB5: a metric the report never collected is null — not 0 —
     // and is left out of the threshold verdict (same rule as MCP).
     const collected = metricsCollected(data);
-    const verdict = thresholdVerdict(report.summary, threshold, collected);
+    const figures = thresholdVerdict(report.summary, threshold, collected);
+    // #1154: figures over part of the target, or from a stale report, never meet the threshold.
+    const insufficientEvidence = describeEvidence(resolved.evidence, resolved.projectRoot ?? targetPath);
+    const verdict = { ...figures, meetsThreshold: figures.meetsThreshold && insufficientEvidence.length === 0 };
     return {
         kind: 'measured',
         data,
         collected,
         verdict,
+        insufficientEvidence,
+        ...(resolved.evidence ? { evidence: resolved.evidence } : {}),
         summary: {
             ...report.summary,
             branch: collected.branch ? report.summary.branch : null,
@@ -117,16 +130,19 @@ export async function evaluateCliCoverage(api, targetPath, threshold, log) {
             statement: collected.statement ? report.summary.statement : null,
         },
         // NB-A: the shortfall advice comes from the same verdict (shared with MCP).
-        recommendations: reconcileRecommendations(report.recommendations ?? [], verdict, threshold, collected),
+        recommendations: reconcileRecommendations(report.recommendations ?? [], figures, threshold, collected),
     };
 }
 /**
  * Exit code: 0 meets (by more than 5%), 1 below / error, 2 within 5% above,
- * 3 UNMEASURED (not in the report, 0 tests, test-only report, or estimate only).
+ * 3 UNMEASURED (not in the report, 0 tests, test-only report, or estimate only)
+ * or insufficient evidence (target files missing from the report, stale report).
  */
 export function coverageExitCode(outcome, threshold) {
     switch (outcome.kind) {
         case 'measured': {
+            if (outcome.insufficientEvidence.length > 0)
+                return EXIT_UNMEASURED;
             const { overall, meetsThreshold } = outcome.verdict;
             if (!meetsThreshold)
                 return 1;
@@ -158,6 +174,10 @@ export function coverageJson(outcome, threshold, target) {
                 functionDataCollected: outcome.collected.function,
                 statementDataCollected: outcome.collected.statement,
                 ...(outcome.data.unmeasuredFiles?.length ? { unmeasuredFiles: outcome.data.unmeasuredFiles } : {}),
+                ...(outcome.evidence ? { evidenceStatus: outcome.evidence.status } : {}),
+                ...(outcome.evidence?.stale ? { staleReport: outcome.evidence.stale } : {}),
+                ...(outcome.insufficientEvidence.length > 0
+                    ? { warning: `INSUFFICIENT EVIDENCE: ${outcome.insufficientEvidence.join('; ')}` } : {}),
             };
         case 'estimate':
             return {

package/dist/cli/utils/fleet-operation.d.ts

@@ -17,6 +17,11 @@ export interface FleetOperationTask {
     domain: DomainName;
     type: string;
     payload: Record<string, unknown>;
+    /**
+     * #1154: why the input cannot support a passing verdict (target files missing
+     * from the coverage report, a stale report). The verdict fails while non-empty.
+     */
+    insufficientEvidence?: string[];
 }
 export type FleetOperationPlan = {
     success: true;

package/dist/cli/utils/fleet-operation.js

@@ -15,6 +15,7 @@ import { extname, resolve } from 'node:path';
 import { walkSourceFiles } from './file-discovery.js';
 import { summarizeCoverage } from './coverage-data.js';
 import { describeNoData, resolveExistingCoverage } from '../../coordination/handlers/coverage-target.js';
+import { describeEvidence } from '../../coordination/handlers/coverage-evidence.js';
 import { MAX_SAST_FILE_BYTES } from '../../domains/security-compliance/sast-path-guard.js';
 export const FLEET_OPERATIONS = ['test', 'analyze', 'scan'];
 /** Coverage threshold `analyze` judges against, as `aqe coverage` does by default. */
@@ -61,9 +62,14 @@ export async function planFleetOperation(operation, target) {
             if (evaluation.status !== 'measured')
                 return refuse(describeNoData(evaluation.reason, target, projectRoot));
             const coverageData = { files: evaluation.files, summary: summarizeCoverage(evaluation.files) };
+            const insufficientEvidence = describeEvidence(evaluation.evidence, projectRoot);
             return {
                 success: true,
-                task: { domain: 'coverage-analysis', type: 'analyze-coverage', payload: { coverageData, threshold: FLEET_COVERAGE_THRESHOLD } },
+                task: {
+                    domain: 'coverage-analysis', type: 'analyze-coverage',
+                    payload: { coverageData, threshold: FLEET_COVERAGE_THRESHOLD },
+                    ...(insufficientEvidence.length > 0 ? { insufficientEvidence } : {}),
+                },
             };
         }
     }

package/dist/cli/utils/fleet-result.d.ts

@@ -8,7 +8,8 @@
  *   - test    fails when no test was generated or a generated test failed
  *             the test quality gate;
  *   - analyze fails when coverage over the collected metrics is below the
- *             threshold (an uncollected metric is not counted as 0%).
+ *             threshold (an uncollected metric is not counted as 0%), or when
+ *             the report leaves target files unmeasured or is stale (#1154).
  * A result without the expected shape fails rather than passing unread.
  */
 import { type FleetOperation } from './fleet-operation.js';
@@ -22,10 +23,11 @@ export interface FleetResultSummary {
 export declare function summarizeFleetResult(operation: FleetOperation, result: unknown): FleetResultSummary;
 /**
  * Print each distinct worker result once and the verdict over all workers.
- * Returns whether the operation passed.
+ * `insufficientEvidence` (from the operation's plan) fails the verdict whatever
+ * the workers returned. Returns whether the operation passed.
  */
 export declare function reportFleetVerdict(operation: FleetOperation, workers: ReadonlyArray<{
     success: boolean;
     result: unknown;
-}>, log?: (line: string) => void): boolean;
+}>, log?: (line: string) => void, insufficientEvidence?: readonly string[]): boolean;
 //# sourceMappingURL=fleet-result.d.ts.map

package/dist/cli/utils/fleet-result.js

@@ -8,7 +8,8 @@
  *   - test    fails when no test was generated or a generated test failed
  *             the test quality gate;
  *   - analyze fails when coverage over the collected metrics is below the
- *             threshold (an uncollected metric is not counted as 0%).
+ *             threshold (an uncollected metric is not counted as 0%), or when
+ *             the report leaves target files unmeasured or is stale (#1154).
  * A result without the expected shape fails rather than passing unread.
  */
 import chalk from 'chalk';
@@ -97,9 +98,10 @@ export function summarizeFleetResult(operation, result) {
 }
 /**
  * Print each distinct worker result once and the verdict over all workers.
- * Returns whether the operation passed.
+ * `insufficientEvidence` (from the operation's plan) fails the verdict whatever
+ * the workers returned. Returns whether the operation passed.
  */
-export function reportFleetVerdict(operation, workers, log = line => console.log(line)) {
+export function reportFleetVerdict(operation, workers, log = line => console.log(line), insufficientEvidence = []) {
     const summaries = workers.filter(w => w.success).map(w => summarizeFleetResult(operation, w.result));
     const shown = new Set();
     for (const summary of summaries) {
@@ -111,8 +113,12 @@ export function reportFleetVerdict(operation, workers, log = line => console.log
         for (const line of summary.lines)
             log(`   ${line}`);
     }
+    for (const reason of insufficientEvidence)
+        log(chalk.yellow(`   Evidence: ${reason}`));
     const incomplete = workers.filter(w => !w.success).length;
     const reasons = [...new Set(summaries.flatMap(s => s.reasons))];
+    if (insufficientEvidence.length > 0)
+        reasons.push('insufficient evidence: the coverage report is incomplete or stale for the target');
     if (incomplete > 0)
         reasons.unshift(`${incomplete} of ${workers.length} workers did not complete`);
     log('');

package/dist/cli/utils/progress.d.ts

@@ -21,6 +21,14 @@ export interface FleetProgressOptions {
     showPercentage?: boolean;
     format?: string;
 }
+/** Options for {@link FleetProgressManager.stop}. */
+export interface FleetProgressStopOptions {
+    /**
+     * The operation's verdict failed (#1168). The agents still completed, but
+     * the summary line must not call that a success.
+     */
+    verdictFailed?: boolean;
+}
 export interface SpinnerOptions {
     text: string;
     color?: 'cyan' | 'green' | 'yellow' | 'red' | 'blue' | 'magenta' | 'white';
@@ -43,7 +51,7 @@ export declare class FleetProgressManager {
     /**
      * Start the fleet progress display
      */
-    start(totalAgents: number): void;
+    start(_totalAgents: number): void;
     /**
      * Add an agent to track
      */
@@ -63,11 +71,17 @@ export declare class FleetProgressManager {
     /**
      * Stop the progress display
      */
-    stop(): void;
+    stop(options?: FleetProgressStopOptions): void;
     /**
      * Update the fleet-level progress bar
      */
     private updateFleetProgress;
+    /**
+     * Create a bar and apply its payload. Without a TTY, cli-progress's
+     * MultiBar.create() returns before starting the bar, dropping the payload,
+     * so the final render printed a literal `{name}` (#1168).
+     */
+    private createBar;
     private getAgentNameDisplay;
     private getStatusIcon;
     private truncateName;

package/dist/cli/utils/progress.js

@@ -13,6 +13,7 @@ import { getCLIConfig, shouldUseColors } from '../config/cli-config.js';
 // ============================================================================
 // Fleet Progress Manager - Multi-bar progress for parallel agents
 // ============================================================================
+const FLEET_BAR_NAME = chalk.white('Fleet Progress'.padEnd(30));
 export class FleetProgressManager {
     multiBar;
     agentBars = new Map();
@@ -31,10 +32,12 @@ export class FleetProgressManager {
             showPercentage: true,
             ...options,
         };
-        // Custom format for multi-bar display (respects color config)
+        // Custom format for multi-bar display (respects color config).
+        // `{eta}` is a cli-progress built-in that overrides the payload, so the
+        // formatted ETA travels as `{etaText}` (#1168).
         const barColor = useColors ? chalk.cyan('{bar}') : '{bar}';
         const format = this.options.format ||
-            `{name} ${barColor} {percentage}% | {status} {eta}`;
+            `{name} ${barColor} {percentage}% | {status} {etaText}`;
         this.multiBar = new MultiBar({
             clearOnComplete: false,
             hideCursor: true,
@@ -48,15 +51,15 @@ export class FleetProgressManager {
     /**
      * Start the fleet progress display
      */
-    start(totalAgents) {
+    start(_totalAgents) {
         this.isActive = true;
         this.startTime = Date.now();
         // Create fleet-level progress bar
         console.log(chalk.blue(`\n${this.options.title}\n`));
-        this.fleetBar = this.multiBar.create(100, 0, {
-            name: chalk.white('Fleet Progress'.padEnd(30)),
+        this.fleetBar = this.createBar(0, {
+            name: FLEET_BAR_NAME,
             status: '',
-            eta: '',
+            etaText: '',
         });
     }
     /**
@@ -66,10 +69,10 @@ export class FleetProgressManager {
         if (!this.isActive)
             return;
         this.agentStates.set(agent.id, agent);
-        const bar = this.multiBar.create(100, agent.progress, {
+        const bar = this.createBar(agent.progress, {
             name: chalk.gray(this.truncateName(agent.name, 30).padEnd(30)),
             status: this.getStatusIcon(agent.status),
-            eta: agent.eta ? this.formatEta(agent.eta) : '',
+            etaText: agent.eta ? this.formatEta(agent.eta) : '',
         });
         this.agentBars.set(agent.id, bar);
         this.updateFleetProgress();
@@ -96,7 +99,7 @@ export class FleetProgressManager {
         bar.update(state.progress, {
             name: this.getAgentNameDisplay(state),
             status: this.getStatusIcon(state.status),
-            eta: state.eta ? this.formatEta(state.eta) : '',
+            etaText: state.eta ? this.formatEta(state.eta) : '',
         });
         this.updateFleetProgress();
     }
@@ -115,14 +118,14 @@ export class FleetProgressManager {
         bar.update(state.progress, {
             name: this.getAgentNameDisplay(state),
             status: this.getStatusIcon(state.status),
-            eta: '',
+            etaText: '',
         });
         this.updateFleetProgress();
     }
     /**
      * Stop the progress display
      */
-    stop() {
+    stop(options = {}) {
         if (!this.isActive)
             return;
         this.isActive = false;
@@ -135,7 +138,10 @@ export class FleetProgressManager {
         const total = this.agentStates.size;
         const duration = Date.now() - this.startTime;
         console.log('');
-        if (failed === 0) {
+        if (failed === 0 && options.verdictFailed) {
+            console.log(chalk.yellow(`All ${completed}/${total} agents completed (${this.formatDuration(duration)})`));
+        }
+        else if (failed === 0) {
             console.log(chalk.green(`All ${completed}/${total} agents completed successfully (${this.formatDuration(duration)})`));
         }
         else {
@@ -155,10 +161,21 @@ export class FleetProgressManager {
         const completed = agents.filter(a => a.status === 'completed').length;
         const running = agents.filter(a => a.status === 'running').length;
         this.fleetBar.update(avgProgress, {
+            name: FLEET_BAR_NAME,
             status: chalk.gray(`${completed}/${agents.length} complete, ${running} running`),
-            eta: this.options.showEta ? this.estimateFleetEta(agents) : '',
+            etaText: this.options.showEta ? this.estimateFleetEta(agents) : '',
         });
     }
+    /**
+     * Create a bar and apply its payload. Without a TTY, cli-progress's
+     * MultiBar.create() returns before starting the bar, dropping the payload,
+     * so the final render printed a literal `{name}` (#1168).
+     */
+    createBar(value, payload) {
+        const bar = this.multiBar.create(100, value, payload);
+        bar.update(value, payload);
+        return bar;
+    }
     getAgentNameDisplay(agent) {
         const name = this.truncateName(agent.name, 26);
         switch (agent.status) {
@@ -448,7 +465,7 @@ export class EtaEstimator {
  * Create a simple spinner for async operations
  */
 export function withSpinner(text, operation) {
-    const { spinner, succeed, fail } = createTimedSpinner(text);
+    const { succeed, fail } = createTimedSpinner(text);
     return operation()
         .then((result) => {
         succeed();

package/dist/coordination/consensus/consensus-engine.js

@@ -12,6 +12,7 @@ import { DEFAULT_CONSENSUS_CONFIG, } from './interfaces.js';
 import { buildVerificationPrompt, parseVerificationResponse, buildModelVote, } from './model-provider.js';
 import { ok, err } from '../../shared/types/index.js';
 import { toErrorMessage, toError } from '../../shared/error-utils.js';
+import { createSafeRecord } from '../../shared/utils/safe-record.js';
 import { createStrategy, } from './strategies/index.js';
 import { createSycophancyScorer } from './sycophancy-scorer.js';
 // ============================================================================
@@ -268,7 +269,8 @@ export class ConsensusEngineImpl {
             averageExecutionTime: 0,
             totalCost: 0,
             humanReviewCount: 0,
-            modelStats: {},
+            // #1157: keyed by provider model ids.
+            modelStats: createSafeRecord(),
         };
     }
     /**

package/dist/coordination/handlers/code-intelligence-handlers.js

@@ -4,7 +4,6 @@
  * Extracted from task-executor.ts registerHandlers().
  * Covers: index-code, predict-defects
  */
-import * as fs from 'fs/promises';
 import { randomUUID } from 'node:crypto';
 import { prunePredictionHistory } from '../../domains/defect-intelligence/prediction-history.js';
 import * as path from 'path';
@@ -15,6 +14,7 @@ import { resolveProjectRootFromPaths } from '../../domains/code-intelligence/pro
 import { nothingIndexedError } from '../../domains/code-intelligence/index-path-guard.js';
 import { createLogger } from '../../logging/logger-factory.js';
 import { requirePayloadPath } from '../../shared/io/payload-path-guard.js';
+import { readConfinedText } from '../../shared/io/confined-read.js';
 const logger = createLogger('CodeIntelligenceHandlers');
 async function collectProjectMetricsForTarget(ctx, targetPath, indexedFiles) {
     if (!ctx.getCodeIntelligenceCoordinator)
@@ -177,7 +177,8 @@ export function registerCodeIntelligenceHandlers(ctx) {
             let filesSkipped = 0;
             for (const filePath of sourceFiles) {
                 try {
-                    const content = await fs.readFile(filePath, 'utf-8');
+                    // #1161: validate the opened descriptor, not the name listed earlier.
+                    const content = await readConfinedText(filePath, { outsideRoot: 'allow' });
                     const lines = content.split('\n');
                     const lineCount = lines.length;
                     // Calculate complexity indicators from real code

package/dist/coordination/handlers/coverage-collection.d.ts

@@ -141,6 +141,8 @@ export declare function isRustProject(targetPath: string): boolean;
 export declare function collectRustCoverage(targetPath: string, options?: {
     timeoutMs?: number;
 }): Promise<CollectedCoverage | null>;
+/** Production source files under a directory (test, build and vendored directories skipped). */
+export declare function walkSourceFiles(targetPath: string): string[];
 /**
  * Static coverage estimate from source shape, for when no instrumentation could
  * be run.

package/dist/coordination/handlers/coverage-collection.js

@@ -19,6 +19,7 @@
  * caller.
  */
 import * as fs from 'fs';
+import { readConfinedTextSync } from '../../shared/io/confined-read.js';
 import * as os from 'os';
 import * as path from 'path';
 import { parseLcovInfo } from './handler-utils.js';
@@ -501,7 +502,8 @@ function withRecomputedSummary(files) {
         },
     };
 }
-function walkSourceFiles(targetPath) {
+/** Production source files under a directory (test, build and vendored directories skipped). */
+export function walkSourceFiles(targetPath) {
     const found = [];
     // Classification is relative to the analysis root (see isTestPath).
     const rootDir = targetPath;
@@ -558,8 +560,9 @@ export function buildEstimatedCoverage(targetPath) {
         return null;
     const files = sourceFiles.map(filePath => {
         let content = '';
+        // #1161: a source file linked out of the project is treated as unreadable.
         try {
-            content = fs.readFileSync(filePath, 'utf-8');
+            content = readConfinedTextSync(filePath, { outsideRoot: 'allow' });
         }
         catch { /* unreadable — treat as empty */ }
         const ext = path.extname(filePath);

package/dist/coordination/handlers/coverage-evidence.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Coverage evidence: is a report complete and current for its target? (#1154)
+ *
+ * A report judged over only the files it happens to contain says nothing
+ * about the target's other files. `aqe fleet run analyze --target src` printed
+ * "100% over 1 files" and "Verdict: PASSED" from a report that listed
+ * `src/math.js` while `src/unsafe.js` had no measurement at all, and a report
+ * written before the sources last changed was judged as if it were current.
+ *
+ * This module answers two questions for every caller of the shared resolver
+ * (MCP `coverage_analyze_sublinear` / `task_orchestrate`, `aqe coverage`,
+ * `aqe ci`, `aqe fleet run analyze`):
+ *   1. Which production source files under the target are not in the report?
+ *      They are UNMEASURED: not 0%, and not left out silently.
+ *   2. Is the report older than source files it is judged against? (stale)
+ * Either one makes the evidence insufficient: no verdict may pass on it.
+ */
+import type { FileCoverage } from '../../domains/coverage-analysis/interfaces';
+/** The report is older than these source files. */
+export interface StaleReport {
+    reportPath: string;
+    reportModified: string;
+    newerFiles: string[];
+}
+export interface CoverageEvidence {
+    /** `insufficient-evidence` when any target file is unmeasured or the report is stale. */
+    status: 'complete' | 'insufficient-evidence';
+    /** Production source files under the target with no entry in the report (absolute paths). */
+    unmeasuredFiles: string[];
+    /** Production source files under the target, measured or not. */
+    targetFiles: number;
+    stale?: StaleReport;
+    /** The coverage config whose include/exclude scoped `unmeasuredFiles`, if any. */
+    coverageScope?: {
+        source: string;
+        readable: boolean;
+    };
+}
+/**
+ * Production source files under a directory `target` that the report has no
+ * entry for. Only files in a language the report covers count: a JS report
+ * does not make a Python helper script unmeasured. Files the project's coverage
+ * config leaves out (include/exclude) were never meant to be measured and do
+ * not count either.
+ */
+export declare function findUnmeasuredSourceFiles(reportFiles: FileCoverage[], projectRoot: string, target: string): {
+    targetFiles: string[];
+    unmeasured: string[];
+    coverageScope?: {
+        source: string;
+        readable: boolean;
+    };
+};
+/** Source files modified after the report was written; `undefined` when the report is current. */
+export declare function findStaleness(reportPath: string, sourceFiles: string[]): StaleReport | undefined;
+/**
+ * The evidence a report gives for `target`.
+ *
+ * `measuredFiles` are the report entries already scoped to the target.
+ * Completeness is checked only when `checkCompleteness` is set (a directory
+ * target, not a report file given as the target), staleness only when the
+ * report's path is known (not for a report the run just wrote).
+ */
+export declare function assessCoverageEvidence(report: {
+    files: FileCoverage[];
+}, measuredFiles: FileCoverage[], projectRoot: string, target: string, options?: {
+    reportPath?: string;
+    checkCompleteness?: boolean;
+}): CoverageEvidence;
+/**
+ * Why the evidence is insufficient, one sentence per problem; empty when it is
+ * complete. Shared by MCP and CLI so the wording cannot drift.
+ */
+export declare function describeEvidence(evidence: CoverageEvidence | undefined, projectRoot: string): string[];
+//# sourceMappingURL=coverage-evidence.d.ts.map