agentic-qe 3.15.10 → 3.15.12

package/dist/domains/code-intelligence/services/semantic-analyzer.d.ts

@@ -134,6 +134,14 @@ export declare class SemanticAnalyzerService implements ISemanticAnalyzerService
     private findHighlights;
     private findSemanticHighlights;
     private fileToKey;
+    /**
+     * Content identity for the analysis and embedding caches.
+     *
+     * This keys cache entries, so it has to separate any two distinct inputs.
+     * A 31-multiplier 32-bit hash does not: for any shared prefix and suffix,
+     * "Aa" and "BB" collide, so two different functions would share one entry
+     * and the second caller would receive the first one's result.
+     */
     private hashCode;
     private cacheEmbedding;
     private cacheAnalysis;

package/dist/domains/code-intelligence/services/semantic-analyzer.js

@@ -2,6 +2,7 @@
  * Agentic QE v3 - Semantic Analyzer Service
  * Semantic code analysis using vector embeddings and HNSW search
  */
+import { createHash } from 'node:crypto';
 import { ok, err } from '../../../shared/types/index.js';
 import { NomicEmbedder, EMBEDDING_CONFIG, } from '../../../shared/embeddings/index.js';
 import { toError } from '../../../shared/error-utils.js';
@@ -635,14 +636,16 @@ export class SemanticAnalyzerService {
     fileToKey(file) {
         return file.replace(/[/\\]/g, ':').replace(/\./g, '_');
     }
+    /**
+     * Content identity for the analysis and embedding caches.
+     *
+     * This keys cache entries, so it has to separate any two distinct inputs.
+     * A 31-multiplier 32-bit hash does not: for any shared prefix and suffix,
+     * "Aa" and "BB" collide, so two different functions would share one entry
+     * and the second caller would receive the first one's result.
+     */
     hashCode(str) {
-        let hash = 0;
-        for (let i = 0; i < str.length; i++) {
-            const char = str.charCodeAt(i);
-            hash = (hash << 5) - hash + char;
-            hash = hash & hash;
-        }
-        return hash.toString(16);
+        return createHash('sha256').update(str, 'utf8').digest('hex');
     }
     cacheEmbedding(key, embedding) {
         if (this.embeddingCache.size >= this.config.cacheSize) {

package/dist/domains/coverage-analysis/services/coverage-parser.js

@@ -19,6 +19,15 @@
 import * as fs from 'fs/promises';
 import * as path from 'path';
 import { safeJsonParse } from '../../../shared/safe-json.js';
+import { readConfinedText } from '../../../shared/io/confined-read.js';
+/**
+ * #1161: coverage reports are found under caller-named directories, so read
+ * them from a validated descriptor: a report linked out of the project, or to
+ * a device such as /dev/zero, is refused instead of read.
+ */
+function readCoverageFile(file) {
+    return readConfinedText(file, { outsideRoot: 'allow' });
+}
 // ============================================================================
 // LCOV Parser
 // ============================================================================
@@ -28,7 +37,7 @@ import { safeJsonParse } from '../../../shared/safe-json.js';
  * LCOV format is the most common output from Istanbul, nyc, c8, etc.
  */
 export async function parseLCOV(lcovPath, projectRoot) {
-    const content = await fs.readFile(lcovPath, 'utf-8');
+    const content = await readCoverageFile(lcovPath);
     return parseLCOVContent(content, projectRoot || path.dirname(lcovPath));
 }
 /**
@@ -221,7 +230,7 @@ export function parseLCOVContent(content, projectRoot) {
  * Parse JSON coverage data (Istanbul/Vitest format)
  */
 export async function parseJSONCoverage(jsonPath, projectRoot) {
-    const content = await fs.readFile(jsonPath, 'utf-8');
+    const content = await readCoverageFile(jsonPath);
     const data = safeJsonParse(content);
     const root = projectRoot || path.dirname(jsonPath);
     const files = new Map();
@@ -334,7 +343,7 @@ export async function parseJSONCoverage(jsonPath, projectRoot) {
  *   <report><package><class><method><counter type="LINE" missed="X" covered="Y"/></method></class></package></report>
  */
 export async function parseJaCoCo(xmlPath, projectRoot) {
-    const content = await fs.readFile(xmlPath, 'utf-8');
+    const content = await readCoverageFile(xmlPath);
     return parseJaCoCoContent(content, projectRoot || path.dirname(xmlPath));
 }
 export function parseJaCoCoContent(content, projectRoot) {
@@ -437,7 +446,7 @@ function parseJaCoCoCounters(xml) {
  *   <Root CoveredStatements="X" TotalStatements="Y"><Assembly><Namespace><Type><Member Statement="..."/></Type></Namespace></Assembly></Root>
  */
 export async function parseDotcover(xmlPath, projectRoot) {
-    const content = await fs.readFile(xmlPath, 'utf-8');
+    const content = await readCoverageFile(xmlPath);
     return parseDotcoverContent(content, projectRoot || path.dirname(xmlPath));
 }
 export function parseDotcoverContent(content, projectRoot) {
@@ -531,7 +540,7 @@ export function parseDotcoverContent(content, projectRoot) {
  * Also handles tarpaulin LCOV output by delegating to parseLCOVContent.
  */
 export async function parseTarpaulin(filePath, projectRoot) {
-    const content = await fs.readFile(filePath, 'utf-8');
+    const content = await readCoverageFile(filePath);
     const root = projectRoot || path.dirname(filePath);
     // If it looks like LCOV, delegate
     if (content.includes('SF:') && content.includes('end_of_record')) {
@@ -603,7 +612,7 @@ export function parseTarpaulinContent(content, projectRoot) {
  *   pkg/file.go:startLine.startCol,endLine.endCol numStatements count
  */
 export async function parseGoCover(coverPath, projectRoot) {
-    const content = await fs.readFile(coverPath, 'utf-8');
+    const content = await readCoverageFile(coverPath);
     return parseGoCoverContent(content, projectRoot || path.dirname(coverPath));
 }
 export function parseGoCoverContent(content, projectRoot) {
@@ -681,7 +690,7 @@ export function parseGoCoverContent(content, projectRoot) {
  * but sets the format and language appropriately.
  */
 export async function parseKover(xmlPath, projectRoot) {
-    const content = await fs.readFile(xmlPath, 'utf-8');
+    const content = await readCoverageFile(xmlPath);
     const report = parseJaCoCoContent(content, projectRoot || path.dirname(xmlPath));
     report.format = 'kover';
     report.language = 'kotlin';
@@ -698,7 +707,7 @@ export async function parseKover(xmlPath, projectRoot) {
  *   { "targets": [ { "files": [ { "path": "...", "lineCoverage": 0.85, "coveredLines": N, "executableLines": N, "functions": [...] } ] } ] }
  */
 export async function parseXcresult(jsonPath, projectRoot) {
-    const content = await fs.readFile(jsonPath, 'utf-8');
+    const content = await readCoverageFile(jsonPath);
     return parseXcresultContent(content, projectRoot || path.dirname(jsonPath));
 }
 export function parseXcresultContent(content, projectRoot) {
@@ -830,7 +839,7 @@ export async function parseCoverage(coveragePath, projectRoot, format, language)
         return parseXcresult(coveragePath, projectRoot);
     }
     // Content-based detection
-    const content = await fs.readFile(coveragePath, 'utf-8');
+    const content = await readCoverageFile(coveragePath);
     const trimmed = content.trim();
     if (trimmed.startsWith('{')) {
         // Check for tarpaulin JSON structure
@@ -869,7 +878,7 @@ export async function parseCoverage(coveragePath, projectRoot, format, language)
     // Language-based fallback: try the first format associated with the language
     if (language) {
         const langLower = language.toLowerCase();
-        const hints = LANGUAGE_FORMAT_HINTS[langLower];
+        const hints = Object.hasOwn(LANGUAGE_FORMAT_HINTS, langLower) ? LANGUAGE_FORMAT_HINTS[langLower] : undefined; // #1157
         if (hints && hints.length > 0) {
             try {
                 return await parseCoverage(coveragePath, projectRoot, hints[0]);

package/dist/domains/learning-optimization/interfaces.d.ts

@@ -36,6 +36,8 @@ export interface PatternContext {
     readonly testType?: string;
     readonly codeContext?: string;
     readonly tags: string[];
+    /** Explicit strategy objective; absent means no requested direction. */
+    readonly objective?: Pick<OptimizationObjective, 'metric' | 'direction'>;
 }
 export interface PatternTemplate {
     readonly type: 'code' | 'prompt' | 'workflow' | 'config';

package/dist/domains/learning-optimization/services/learning-coordinator.js

@@ -290,7 +290,8 @@ Provide:
             let output = pattern.template.content;
             // Replace template variables
             for (const variable of pattern.template.variables) {
-                const value = variables[variable.name] ?? variable.defaultValue;
+                // #1157: the variable name comes from a stored pattern; read own values only.
+                const value = (Object.hasOwn(variables, variable.name) ? variables[variable.name] : undefined) ?? variable.defaultValue;
                 if (variable.required && value === undefined) {
                     return err(new Error(`Required variable ${variable.name} not provided`));
                 }

package/dist/domains/learning-optimization/services/metrics-optimizer.js

@@ -186,11 +186,21 @@ export class MetricsOptimizerService {
     async recommendStrategy(context) {
         try {
             // Search for strategies that worked well in similar contexts
-            const keys = await this.memory.search('learning:strategy:optimized:*', 100);
+            const keys = await this.memory.search('learning:strategy:optimized:*', 100, { namespace: 'learning-optimization' });
             const candidates = [];
-            for (const key of keys) {
-                const optimized = await this.memory.get(key);
-                if (optimized && optimized.confidence > 0.6) {
+            for (const found of keys) {
+                // SQLite returns bare keys; in-memory search includes the namespace.
+                // get() applies that namespace separately, as storeOptimizationResult does.
+                const prefix = 'learning-optimization:';
+                const key = found.startsWith(prefix) ? found.slice(prefix.length) : found;
+                const optimized = await this.memory.get(key, { namespace: 'learning-optimization' });
+                if (optimized
+                    && context.tags.includes(optimized.domain)
+                    && context.tags.includes(optimized.objective.metric)
+                    && (!context.objective || (context.tags.includes(context.objective.metric)
+                        && optimized.objective.metric === context.objective.metric
+                        && optimized.objective.direction === context.objective.direction))
+                    && optimized.confidence > 0.6) {
                     const contextScore = this.scoreContextMatch(optimized, context);
                     const performanceScore = optimized.improvement * optimized.confidence;
                     candidates.push({

package/dist/domains/learning-optimization/services/production-intel.js

@@ -7,6 +7,7 @@ import { ok, err } from '../../../shared/types/index.js';
 import { TimeRange } from '../../../shared/value-objects/index.js';
 import { toError } from '../../../shared/error-utils.js';
 import { rehydrateDates } from '../../../shared/utils/kv-date-rehydrate.js';
+import { createSafeRecord } from '../../../shared/utils/safe-record.js';
 const DEFAULT_CONFIG = {
     metricsRetentionDays: 90,
     anomalyThreshold: 2.5,
@@ -268,7 +269,8 @@ export class ProductionIntelService {
     async getDomainHealth(domain) {
         const timeRange = TimeRange.lastNDays(1);
         const metricsResult = await this.getMetricsHistory('*', timeRange, domain);
-        const metrics = {};
+        // #1157: metric names come from stored production metrics.
+        const metrics = createSafeRecord();
         if (metricsResult.success) {
             for (const metric of metricsResult.value) {
                 if (!metrics[metric.name]) {

package/dist/domains/security-compliance/generic-finding-dedup.d.ts

@@ -0,0 +1,40 @@
+/**
+ * #1170: drop the generic eval/exec finding that language-specific SAST
+ * already reported as code injection on the same line.
+ *
+ * The scan-security task runs text patterns over every file and SAST over
+ * JS/TS files, so one `eval()` was counted twice: once by SAST (critical,
+ * CWE-95) and once by the generic eval/exec pattern (high). Only that pair is
+ * the same finding. Other generic rules (secrets, CORS, debug mode) can flag
+ * a different value or a higher severity on a line SAST also matched, so
+ * they are always kept.
+ */
+/** Title of the generic-pattern eval/exec finding in the scan-security handler. */
+export declare const GENERIC_EVAL_EXEC_TITLE = "Dangerous eval/exec usage";
+interface LocatedFinding {
+    title: string;
+    severity?: string;
+    location: {
+        file: string;
+        line?: number;
+    };
+}
+interface SastFinding {
+    severity?: string;
+    description?: string;
+    references?: readonly string[];
+    location: {
+        file: string;
+        line?: number;
+    };
+}
+/**
+ * Generic findings without the eval/exec matches SAST already reported as
+ * CWE-95 on the same real file and line, at the same or a higher severity, so
+ * dropping one never lowers what the scan reports. `isEvalOnly` says whether a generic
+ * eval/exec match is eval alone; a line that also calls exec() is kept,
+ * since SAST's eval rule does not report the exec call.
+ */
+export declare function dropGenericEvalCoveredBySast<T extends LocatedFinding>(generic: readonly T[], sast: readonly SastFinding[], isEvalOnly: (finding: T) => boolean): Promise<T[]>;
+export {};
+//# sourceMappingURL=generic-finding-dedup.d.ts.map

package/dist/domains/security-compliance/generic-finding-dedup.js

@@ -0,0 +1,63 @@
+/**
+ * #1170: drop the generic eval/exec finding that language-specific SAST
+ * already reported as code injection on the same line.
+ *
+ * The scan-security task runs text patterns over every file and SAST over
+ * JS/TS files, so one `eval()` was counted twice: once by SAST (critical,
+ * CWE-95) and once by the generic eval/exec pattern (high). Only that pair is
+ * the same finding. Other generic rules (secrets, CORS, debug mode) can flag
+ * a different value or a higher severity on a line SAST also matched, so
+ * they are always kept.
+ */
+import { realpath } from 'node:fs/promises';
+import * as path from 'node:path';
+/** Title of the generic-pattern eval/exec finding in the scan-security handler. */
+export const GENERIC_EVAL_EXEC_TITLE = 'Dangerous eval/exec usage';
+/** CWE-95 (eval injection): SAST's eval() and Function-constructor rules. */
+function isEvalInjection(finding) {
+    return /\[CWE-95\]/.test(finding.description ?? '') ||
+        (finding.references ?? []).some(ref => /\/definitions\/95\.html$/.test(ref));
+}
+const SEVERITY_RANK = {
+    informational: 0, low: 1, medium: 2, high: 3, critical: 4,
+};
+const rank = (severity) => SEVERITY_RANK[severity ?? ''] ?? -1;
+async function realPathOf(file, cache) {
+    const resolved = path.resolve(file);
+    let real = cache.get(resolved);
+    if (real === undefined) {
+        real = await realpath(resolved).catch(() => resolved);
+        cache.set(resolved, real);
+    }
+    return real;
+}
+/**
+ * Generic findings without the eval/exec matches SAST already reported as
+ * CWE-95 on the same real file and line, at the same or a higher severity, so
+ * dropping one never lowers what the scan reports. `isEvalOnly` says whether a generic
+ * eval/exec match is eval alone; a line that also calls exec() is kept,
+ * since SAST's eval rule does not report the exec call.
+ */
+export async function dropGenericEvalCoveredBySast(generic, sast, isEvalOnly) {
+    const evalSast = sast.filter(isEvalInjection);
+    if (evalSast.length === 0)
+        return [...generic];
+    const cache = new Map();
+    // Highest SAST CWE-95 severity per real file and line.
+    const covered = new Map();
+    for (const finding of evalSast) {
+        const key = `${await realPathOf(finding.location.file, cache)}:${finding.location.line ?? 0}`;
+        covered.set(key, Math.max(covered.get(key) ?? -1, rank(finding.severity)));
+    }
+    const kept = [];
+    for (const finding of generic) {
+        const key = `${await realPathOf(finding.location.file, cache)}:${finding.location.line ?? 0}`;
+        const sastRank = covered.get(key);
+        const duplicate = finding.title === GENERIC_EVAL_EXEC_TITLE && isEvalOnly(finding) &&
+            sastRank !== undefined && sastRank >= rank(finding.severity);
+        if (!duplicate)
+            kept.push(finding);
+    }
+    return kept;
+}
+//# sourceMappingURL=generic-finding-dedup.js.map

package/dist/domains/security-compliance/services/scanners/dependency-resolver.js

@@ -22,28 +22,33 @@
  * complete, with a reason; each member can be scanned directly.
  */
 import * as fs from 'fs/promises';
+// #1161: manifests and lockfiles are read from a validated descriptor; one
+// linked out of the project, or to a device, is refused instead of read.
+import { readConfinedText } from '../../../../shared/io/confined-read.js';
 import * as path from 'path';
 import semver from 'semver';
 import { parse as parseYaml } from 'yaml';
 import { safeJsonParse } from '../../../../shared/safe-json.js';
 import { classifyNpmSpec, exactNpmVersion } from '../../../../shared/security/osv-lookup.js';
+import { createSafeRecord, getOwn, setOwn } from '../../../../shared/utils/safe-record.js';
 import { LOCKFILES, parseLockfile } from './lockfile-versions.js';
 /** The reason a workspace root's scan is not complete (#1057). */
 export const WORKSPACE_NOT_SCANNED = 'workspace member dependencies are not scanned yet (#1057); scan each member directory separately';
 const OUT_OF_SYNC = 'lockfile out of sync with package.json';
 /** All declared dependencies of a manifest (later fields win, as npm resolves them). */
 export function declaredDependencies(manifest) {
-    const out = {};
+    // #1157: a dependency named `__proto__` is kept as an own entry, not dropped.
+    const out = createSafeRecord();
     for (const field of ['peerDependencies', 'optionalDependencies', 'devDependencies', 'dependencies']) {
         for (const [name, spec] of Object.entries(manifest[field] ?? {})) {
             if (typeof spec === 'string')
-                out[name] = spec;
+                setOwn(out, name, spec);
         }
     }
     return out;
 }
 async function readManifest(file) {
-    return safeJsonParse(await fs.readFile(file, 'utf-8'));
+    return safeJsonParse(await readConfinedText(file, { outsideRoot: 'allow' }));
 }
 async function exists(file) {
     try {
@@ -123,7 +128,7 @@ async function pnpmDeclaresPackages(file) {
         const st = await fs.stat(file); // follows a link; a dangling one throws
         if (!st.isFile() || st.size > MAX_PNPM_WORKSPACE_BYTES)
             return true;
-        const text = await fs.readFile(file, 'utf-8');
+        const text = await readConfinedText(file, { outsideRoot: 'allow', maxBytes: MAX_PNPM_WORKSPACE_BYTES });
         doc = parseYaml(text, { uniqueKeys: false, merge: true, maxAliasCount: 100 });
     }
     catch {
@@ -182,7 +187,10 @@ export function resolveFromRecord(dependencies, lockedVersions = {}) {
         members: () => [],
         hasImporter: () => true,
         recordedSpec: () => null,
-        resolve: (_importer, name) => (lockedVersions[name] !== undefined ? { version: lockedVersions[name] } : undefined),
+        resolve: (_importer, name) => {
+            const version = getOwn(lockedVersions, name);
+            return version !== undefined ? { version } : undefined;
+        },
     };
     return Object.entries(dependencies).map(([name, spec]) => resolveOne(name, spec, '', index, new Set()));
 }
@@ -202,7 +210,7 @@ export async function resolveDependencies(manifestPath) {
     if (found) {
         const member = path.relative(found.dir, realManifestDir).split(path.sep).join('/');
         try {
-            const parsed = parseLockfile(found.file, await fs.readFile(path.join(found.dir, found.file), 'utf-8'));
+            const parsed = parseLockfile(found.file, await readConfinedText(path.join(found.dir, found.file), { outsideRoot: 'allow' }));
             const rootManifest = member ? await readManifest(path.join(found.dir, 'package.json')).catch(() => ({})) : manifest;
             // A member scanned directly: the root lockfile covers it if it lists the
             // importer (npm/pnpm) or, for yarn, if the root declares workspaces.

package/dist/domains/security-compliance/services/scanners/sast-scanner.js

@@ -11,6 +11,7 @@ import { ok, err } from '../../../../shared/types/index.js';
 import { ALL_SECURITY_PATTERNS, BUILT_IN_RULE_SETS } from './security-patterns.js';
 import { toError } from '../../../../shared/error-utils.js';
 import { safeJsonParse } from '../../../../shared/safe-json.js';
+import { readConfinedFile } from '../../../../shared/io/confined-read.js';
 import { CLAUDE_TIER_MODELS, DEFAULT_OPUS_MODEL } from '../../../../shared/llm/model-registry.js';
 import { isSemgrepAvailable, runSemgrepWithRules, convertSemgrepFindings, } from '../semgrep-integration.js';
 // ============================================================================
@@ -303,8 +304,9 @@ export class SASTScanner {
         let content;
         let sourceDigest;
         try {
-            const fs = await import('fs/promises');
-            const bytes = await fs.readFile(filePath);
+            // #1161: open once and validate the opened descriptor, so a file swapped
+            // after the sast-scan path check cannot redirect the read.
+            const bytes = await readConfinedFile(filePath, { outsideRoot: 'allow' });
             sourceDigest = createHash('sha256').update(bytes).digest('hex');
             content = bytes.toString('utf8');
         }

package/dist/domains/security-compliance/services/security-auditor-sast.js

@@ -4,7 +4,7 @@
  */
 import { LoggerFactory } from '../../../logging/index.js';
 import { v4 as uuidv4 } from 'uuid';
-import * as fs from 'fs/promises';
+import { readConfinedText } from '../../../shared/io/confined-read.js';
 import * as path from 'path';
 /**
  * Get the default SAST vulnerability patterns for JS/TS analysis
@@ -173,7 +173,7 @@ export async function performSASTScan(findSourceFiles, shouldExclude) {
                 continue;
             }
             try {
-                const content = await fs.readFile(filePath, 'utf-8');
+                const content = await readConfinedText(filePath, { outsideRoot: 'allow' }); // #1161
                 const lines = content.split('\n');
                 filesScanned++;
                 linesScanned += lines.length;

package/dist/domains/security-compliance/services/security-auditor-secrets.js

@@ -3,7 +3,7 @@
  * Extracted from security-auditor.ts - Secret/credential detection
  */
 import { LoggerFactory } from '../../../logging/index.js';
-import * as fs from 'fs/promises';
+import { readConfinedText } from '../../../shared/io/confined-read.js';
 /**
  * Get the comprehensive set of secret detection patterns
  */
@@ -198,7 +198,7 @@ export function validateSecret(type, value) {
 export async function scanFileForSecrets(file) {
     const secrets = [];
     try {
-        const content = await fs.readFile(file.value, 'utf-8');
+        const content = await readConfinedText(file.value, { outsideRoot: 'allow' }); // #1161
         const lines = content.split('\n');
         const secretPatterns = getSecretPatterns();
         for (let lineIndex = 0; lineIndex < lines.length; lineIndex++) {

package/dist/domains/security-compliance/services/security-auditor.js

@@ -12,6 +12,7 @@
 import { LoggerFactory } from '../../../logging/index.js';
 import { v4 as uuidv4 } from 'uuid';
 import * as fs from 'fs/promises';
+import { readConfinedText } from '../../../shared/io/confined-read.js';
 import * as path from 'path';
 import { ok, err } from '../../../shared/types/index.js';
 import { toError } from '../../../shared/error-utils.js';
@@ -249,7 +250,7 @@ export class SecurityAuditorService {
         const dependencies = [];
         try {
             if (ecosystem === 'npm') {
-                const content = await fs.readFile(manifest, 'utf-8');
+                const content = await readConfinedText(manifest, { outsideRoot: 'allow' }); // #1161
                 const packageJson = safeJsonParse(content);
                 const allDeps = {
                     ...packageJson.dependencies,
@@ -263,7 +264,7 @@ export class SecurityAuditorService {
                 }
             }
             else if (ecosystem === 'pip') {
-                const content = await fs.readFile(manifest, 'utf-8');
+                const content = await readConfinedText(manifest, { outsideRoot: 'allow' }); // #1161
                 const lines = content.split('\n');
                 for (const line of lines) {
                     const trimmed = line.trim();

package/dist/domains/test-execution/coordinator.d.ts

@@ -125,7 +125,8 @@ export declare class TestExecutionCoordinator extends BaseDomainCoordinator<Test
     runTests(request: SimpleTestRequest): Promise<Result<TestRunResult, Error>>;
     /**
      * Retry a run's failed tests when retries were requested, and attach what
-     * the retries did to the run (#1130). The run's own counts are unchanged.
+     * the retries did to the run (#1130). A test that passed on a retry counts
+     * as passed and flaky in the run's own counts (#1170).
      */
     private retryFailures;
     /**

package/dist/domains/test-execution/coordinator.js

@@ -9,6 +9,7 @@ import { TestExecutionEvents, createEvent, } from '../../shared/events/index.js'
 import { TestExecutorService } from './services/test-executor.js';
 import { FlakyDetectorService } from './services/flaky-detector.js';
 import { RetryHandlerService } from './services/retry-handler.js';
+import { applyRetryOutcome } from './services/retry-outcome.js';
 import { TestPrioritizerService } from './services/test-prioritizer.js';
 import { createE2ETestRunnerService, } from './services/e2e-runner.js';
 import { createDomainFinding, } from '../../coordination/consensus/domain-findings.js';
@@ -162,7 +163,8 @@ export class TestExecutionCoordinator extends BaseDomainCoordinator {
     }
     /**
      * Retry a run's failed tests when retries were requested, and attach what
-     * the retries did to the run (#1130). The run's own counts are unchanged.
+     * the retries did to the run (#1130). A test that passed on a retry counts
+     * as passed and flaky in the run's own counts (#1170).
      */
     async retryFailures(run, retryCount) {
         if (!retryCount || retryCount <= 0)
@@ -179,17 +181,7 @@ export class TestExecutionCoordinator extends BaseDomainCoordinator {
         });
         if (!retried.success)
             return;
-        const byId = new Map(run.failedTests.map(t => [t.testId, t]));
-        run.retries = {
-            totalRetries: retried.value.retried,
-            nowPassing: retried.value.nowPassing,
-            stillFailing: retried.value.stillFailing,
-            tests: (retried.value.tests ?? []).map(({ testId, ...outcome }) => ({
-                name: byId.get(testId)?.testName ?? testId,
-                file: byId.get(testId)?.file ?? '',
-                ...outcome,
-            })),
-        };
+        applyRetryOutcome(run, retried.value);
     }
     /**
      * Detect test framework from file patterns and project configuration
@@ -686,11 +678,10 @@ export class TestExecutionCoordinator extends BaseDomainCoordinator {
     /**
      * Record execution results for DT learning
      */
-    async recordExecutionResults(runId, testFiles, result, prioritizationInfo) {
+    async recordExecutionResults(runId, testFiles, result, _prioritizationInfo) {
         // Record each test execution for learning
         for (let i = 0; i < testFiles.length; i++) {
             const testId = this.generateTestId(testFiles[i]);
-            const info = prioritizationInfo;
             // Find if this test failed (check if it's in failed tests)
             const failedTest = result.failedTests.find(t => t.file === testFiles[i]);
             const passed = !failedTest;

package/dist/domains/test-execution/interfaces.d.ts

@@ -80,6 +80,11 @@ export interface ITestRunResult {
     fileCoverages?: IFileCoverageData[];
     /** #1130: what the requested retries of failed tests did. Absent when none were requested. */
     retries?: IRunRetrySummary;
+    /**
+     * #1170: tests that failed and then passed on a retry. They are counted in
+     * `passed`, not `failed`. Absent when no test passed on a retry.
+     */
+    flaky?: number;
 }
 /** #1130: the measured outcome of a run's retries, per failed test. */
 export interface IRunRetrySummary {
@@ -102,8 +107,13 @@ export interface ITestCaseResult {
     status: 'passed' | 'failed' | 'skipped';
     /** Runner-reported duration in ms; omitted when the runner reported none. */
     duration?: number;
-    /** The runner's failure message for a failed test, when it reported one. */
+    /**
+     * The runner's failure message for a failed test, or for the failed first
+     * attempt of a flaky test, when it reported one.
+     */
     failureMessage?: string;
+    /** #1170: the test failed and then passed on a retry, so it is `passed`. */
+    flaky?: true;
 }
 export interface IFileCoverageData {
     path: string;

package/dist/domains/test-execution/services/retry-outcome.d.ts

@@ -0,0 +1,18 @@
+/**
+ * #1170: a run's final outcome after its failed tests were retried.
+ *
+ * A test that failed and then passed on a retry is passed, and flaky: it
+ * leaves `failed`/`failedTests`, its runner test case reads `passed` with
+ * `flaky: true`, and the run counts it in `flaky`. A test whose retries all
+ * failed, or whose retry matched no test, stays failed.
+ */
+import type { IRetryResult, ITestRunResult } from '../interfaces';
+/**
+ * Default retries of a failed test, shared by `aqe test execute` and MCP
+ * `test_execute_parallel` so both surfaces rerun a failure the same number of
+ * times (#1170).
+ */
+export declare const DEFAULT_TEST_RETRY_COUNT = 2;
+/** Attach the retry outcome to `run` and move tests that passed on retry from failed to passed. */
+export declare function applyRetryOutcome(run: ITestRunResult, retried: IRetryResult): void;
+//# sourceMappingURL=retry-outcome.d.ts.map

package/dist/domains/test-execution/services/retry-outcome.js

@@ -0,0 +1,53 @@
+/**
+ * #1170: a run's final outcome after its failed tests were retried.
+ *
+ * A test that failed and then passed on a retry is passed, and flaky: it
+ * leaves `failed`/`failedTests`, its runner test case reads `passed` with
+ * `flaky: true`, and the run counts it in `flaky`. A test whose retries all
+ * failed, or whose retry matched no test, stays failed.
+ */
+/**
+ * Default retries of a failed test, shared by `aqe test execute` and MCP
+ * `test_execute_parallel` so both surfaces rerun a failure the same number of
+ * times (#1170).
+ */
+export const DEFAULT_TEST_RETRY_COUNT = 2;
+/** Attach the retry outcome to `run` and move tests that passed on retry from failed to passed. */
+export function applyRetryOutcome(run, retried) {
+    const byId = new Map(run.failedTests.map(t => [t.testId, t]));
+    const outcomes = retried.tests ?? [];
+    const summary = {
+        totalRetries: retried.retried,
+        nowPassing: retried.nowPassing,
+        stillFailing: retried.stillFailing,
+        tests: outcomes.map(({ testId, ...outcome }) => ({
+            name: byId.get(testId)?.testName ?? testId,
+            file: byId.get(testId)?.file ?? '',
+            ...outcome,
+        })),
+    };
+    run.retries = summary;
+    const passedOnRetry = new Set(outcomes.filter(o => o.passed && !o.unmatched).map(o => o.testId));
+    const recovered = run.failedTests.filter(t => passedOnRetry.has(t.testId));
+    if (recovered.length === 0)
+        return;
+    run.failedTests = run.failedTests.filter(t => !passedOnRetry.has(t.testId));
+    run.failed = Math.max(0, run.failed - recovered.length);
+    run.passed += recovered.length;
+    run.flaky = (run.flaky ?? 0) + recovered.length;
+    if (run.failed === 0 && run.status === 'failed')
+        run.status = 'passed';
+    if (run.testCases) {
+        const pending = [...recovered];
+        run.testCases = run.testCases.map(testCase => {
+            if (testCase.status !== 'failed')
+                return testCase;
+            const index = pending.findIndex(t => t.testName === testCase.name && t.file === testCase.file);
+            if (index < 0)
+                return testCase;
+            pending.splice(index, 1);
+            return { ...testCase, status: 'passed', flaky: true };
+        });
+    }
+}
+//# sourceMappingURL=retry-outcome.js.map