agentic-qe 3.15.17 → 3.15.18

package/dist/mcp/handlers/domain-handler-configs.d.ts

@@ -195,6 +195,9 @@ export interface DefectPredictResult {
     scanStatus?: 'partial' | 'complete';
     predictionMethod?: 'static-code-indicators';
     estimated?: boolean;
+    /** #1137: the run was stored, but pruning older runs failed. */
+    retention?: 'failed';
+    retentionError?: string;
     taskId: string;
     status: string;
     predictedDefects: Array<{

package/dist/mcp/handlers/domain-handler-configs.js

@@ -770,6 +770,7 @@ export const defectPredictConfig = {
             filesAnalyzed: data.filesAnalyzed, filesSkipped: data.filesSkipped,
             scanStatus: data.scanStatus,
         } : {}),
+        ...(data.retention === 'failed' ? { retention: 'failed', retentionError: String(data.retentionError ?? '') } : {}),
         predictedDefects: data.predictedDefects || [],
         riskScore: data.riskScore || 0,
         recommendations: data.recommendations || [],

package/dist/mcp/handlers/heartbeat-handlers.d.ts

@@ -20,7 +20,8 @@ export interface HeartbeatStatusResult {
     lastResult: {
         success: boolean;
         durationMs: number;
-        healthScore: number;
+        /** `null` when the run measured nothing (#1137). */
+        healthScore: number | null;
         trend: string;
         domainMetrics: Record<string, number | string>;
     } | null;
@@ -32,7 +33,8 @@ export interface HeartbeatTriggerParams {
 export interface HeartbeatTriggerResult {
     success: boolean;
     durationMs: number;
-    healthScore: number;
+    /** `null` when the run measured nothing (#1137). */
+    healthScore: number | null;
     trend: string;
     promoted: number;
     deprecated: number;

package/dist/mcp/tools/learning-optimization/optimize.d.ts

@@ -48,6 +48,8 @@ export interface LearnResult {
     experienceIdsNotFound?: number;
     evidenceStatus?: 'insufficient-evidence';
     patternsLearned: number;
+    /** #1147: why nothing was learned from the requested experiences. */
+    noPatternReason?: string;
     newPatterns: LearnedPattern[];
     /** No baseline is recorded to compare against, so improvement is not measured (#1109). */
     improvement: number | null;
@@ -128,7 +130,10 @@ export interface DashboardResult {
     assignedPatternsExcluded?: number;
     /** #1121: untagged patterns mined before #1120 (rate selected over successes), excluded likewise. */
     legacyPatternsExcluded?: number;
-    /** Ranked by measured success rate; empty when no domain has a measured outcome. */
+    /**
+     * Ranked by measured success rate (#1147): domains with no measured outcome,
+     * or with 0% measured success, are left out.
+     */
     topPerformingDomains: DomainName[];
     evidenceStatus?: 'insufficient-evidence';
     unmeasured?: string[];

package/dist/mcp/tools/learning-optimization/optimize.js

@@ -15,6 +15,7 @@ import { MetricsOptimizerService } from '../../../domains/learning-optimization/
 import { TransferSpecialistService } from '../../../domains/learning-optimization/services/transfer-specialist.js';
 import { toErrorMessage } from '../../../shared/error-utils.js';
 import { partitionByRewardSource } from '../../../domains/learning-optimization/reward-source.js';
+import { rankTopPerformingDomains } from '../../../domains/learning-optimization/domain-ranking.js';
 // ============================================================================
 // Tool Implementation
 // ============================================================================
@@ -174,8 +175,21 @@ export class LearningOptimizeTool extends MCPToolBase {
         if (!readResult.success)
             throw readResult.error;
         const read = readResult.value;
+        const requested = new Set(experienceIds).size;
         const { measured, assignedExcluded } = partitionByRewardSource(read);
         const learned = measured.length > 0 ? await learningCoordinator.learnPattern(read) : null;
+        // #1147: say why nothing was learned instead of returning a bare 0.
+        let noPatternReason;
+        if (read.length === 0) {
+            noPatternReason = `None of the ${requested} requested experience ID(s) were found.`;
+        }
+        else if (measured.length === 0) {
+            noPatternReason = `None of the ${read.length} experience(s) read has a measured outcome` +
+                (assignedExcluded > 0 ? ` (${assignedExcluded} with an assigned reward excluded).` : '.');
+        }
+        else if (learned && !learned.success) {
+            noPatternReason = learned.error.message;
+        }
         const newPatterns = learned?.success
             ? [{
                     id: learned.value.id,
@@ -190,11 +204,12 @@ export class LearningOptimizeTool extends MCPToolBase {
         this.markAsRealData();
         return {
             experiencesProcessed: read.length,
-            experienceIdsNotFound: new Set(experienceIds).size - read.length,
+            experienceIdsNotFound: requested - read.length,
             measuredExperiences: measured.length,
             assignedRewardsExcluded: assignedExcluded,
             ...(measured.length === 0 ? { evidenceStatus: 'insufficient-evidence' } : {}),
             patternsLearned: newPatterns.length,
+            ...(noPatternReason ? { noPatternReason } : {}),
             newPatterns,
             improvement: null,
             unmeasured: ['improvement'],
@@ -464,17 +479,11 @@ export class LearningOptimizeTool extends MCPToolBase {
                 experiencesLast24h += mineResult.value.experienceCount;
                 assignedRewardsExcluded += mineResult.value.assignedRewardsExcluded ?? 0;
                 // #1109: only a measured success rate can rank a domain.
-                const { successRate } = mineResult.value;
-                if (successRate !== null) {
-                    domainPerformance.push({ domain, successRate });
-                }
+                domainPerformance.push({ domain, successRate: mineResult.value.successRate });
             }
         }
-        // Calculate top performing domains
-        domainPerformance.sort((a, b) => b.successRate - a.successRate);
-        const topPerformingDomains = domainPerformance
-            .slice(0, 3)
-            .map(d => d.domain);
+        // #1147: rank by measured success; a domain at 0% is not top-performing.
+        const { topPerformingDomains, measuredDomains } = rankTopPerformingDomains(domainPerformance);
         // Calculate overall learning rate from pattern stats
         // getPatternStats already leaves out patterns learned from assigned rewards.
         const totalPatterns = statsResult.success ? statsResult.value.totalPatterns : 0;
@@ -528,7 +537,7 @@ export class LearningOptimizeTool extends MCPToolBase {
         const unmeasured = [];
         if (overallLearningRate === null)
             unmeasured.push('overallLearningRate');
-        if (topPerformingDomains.length === 0)
+        if (measuredDomains === 0)
             unmeasured.push('topPerformingDomains');
         return {
             overallLearningRate,

package/dist/planning/goap-planner.js

@@ -656,6 +656,10 @@ export class GOAPPlanner {
             }
             // #1157: goal and condition keys can come from callers; an inherited
             // member such as `constructor` is not part of the world state.
+            // #1186: deliberately, a key resolves only through own properties of
+            // objects. An array's own `length` resolves (`items.length`), but a
+            // primitive has no world-state members, so `name.length` on a string
+            // is undefined and a condition on it is unmet.
             if (typeof current !== 'object' || !Object.hasOwn(current, part)) {
                 return undefined;
             }

package/dist/planning/plan-executor.js

@@ -123,8 +123,8 @@ export class PlanExecutor {
         // This allows async unified storage initialization
         if (!this.config.useUnified) {
             // Legacy mode: create separate database immediately
-            this.db = openDatabase(dbPath ?? ':memory:', { walMode: false });
-            this.db.pragma('journal_mode = WAL');
+            // #1164: openDatabase() set the journal mode (retrying contention, honouring AQE_DISABLE_WAL).
+            this.db = openDatabase(dbPath ?? ':memory:');
         }
     }
     // ==========================================================================
@@ -911,6 +911,10 @@ export class PlanExecutor {
             }
             // #1157: goal and condition keys can come from callers; an inherited
             // member such as `constructor` is not part of the world state.
+            // #1186: deliberately, a key resolves only through own properties of
+            // objects. An array's own `length` resolves (`items.length`), but a
+            // primitive has no world-state members, so `name.length` on a string
+            // is undefined and a condition on it is unmet.
             if (typeof current !== 'object' || !Object.hasOwn(current, part)) {
                 return undefined;
             }

package/dist/shared/git/git-analyzer.d.ts

@@ -71,23 +71,28 @@ export declare class GitAnalyzer {
     private isGitRepo;
     /** After a rev-parse timeout, when to ask git again (until then: "timeout"). */
     private repoRetryAt;
+    /** Files whose git data came back incomplete outside any withFileDeadline() call. */
     private readonly timedOutFiles;
-    /** Files inside withFileDeadline() and when their git time runs out. */
-    private readonly fileDeadlines;
+    /** The withFileDeadline() call each async context runs in, so concurrent calls on one file stay apart (#1165). */
+    private readonly fileScopes;
     constructor(config?: GitAnalyzerConfig);
     /**
      * Check if current directory is a git repository
      */
     isGitRepository(): Promise<boolean>;
     /**
-     * True when git timed out while analysing `filePath` since the last call, so
-     * the analysis returned its "git unavailable" default rather than a result.
+     * True when git timed out, or its output overflowed, while analysing
+     * `filePath` since the last call, so the analysis returned its "git
+     * unavailable" default rather than a result. Inside withFileDeadline() it
+     * reports only that call's analyses, not another caller's on the same file (#1165).
      */
     consumeTimeout(filePath: string): boolean;
     /**
      * Run `work`, during which every analysis of `filePath` also stops at one
      * shared `fileTimeoutMs` deadline. One file's analyses then wait for git at
-     * most that long together, rather than `gitTimeoutMs` each (#1115).
+     * most that long together, rather than `gitTimeoutMs` each (#1115). Each
+     * call has its own deadline and timeout flag, even when calls on the same
+     * file overlap (#1165); call consumeTimeout() inside `work` to read the flag.
      */
     withFileDeadline<T>(filePath: string, work: () => Promise<T>): Promise<T>;
     /**
@@ -112,13 +117,16 @@ export declare class GitAnalyzer {
     getBugHistory(filePath: string): Promise<number>;
     /**
      * Get comprehensive file history analysis
+     * @throws GitTimeoutError when git does not answer within `gitTimeoutMs`, and
+     *   an ENOBUFS error when its output overflows; zero history would be a false answer (#1165)
      */
     getFileHistory(filePath: string): Promise<FileHistory>;
     /**
      * Get files changed since a specific date
      * @param since - Date to check changes from (default: 24 hours ago)
      * @returns Array of changed file paths relative to repo root
-     * @throws GitTimeoutError when git does not answer within `gitTimeoutMs`
+     * @throws GitTimeoutError when git does not answer within `gitTimeoutMs`, and
+     *   an Error when git fails; neither means "no changes" (#1165)
      */
     getChangedFiles(since?: Date): Promise<string[]>;
     /**
@@ -128,13 +136,15 @@ export declare class GitAnalyzer {
      * @throws Error when `commitHash` is option-shaped (starts with "-") or otherwise
      *   not a safe revision argument; git would otherwise parse it as an option
      *   (e.g. `--output=<path>` writes an arbitrary file). See issue #960.
-     * @throws GitTimeoutError when git does not answer within `gitTimeoutMs`
+     * @throws GitTimeoutError when git does not answer within `gitTimeoutMs`, and
+     *   an Error when git fails, e.g. on an unknown revision (#1165)
      */
     getCommitFiles(commitHash?: string): Promise<string[]>;
     /**
      * Get files with uncommitted changes (staged + unstaged)
      * @returns Array of modified file paths relative to repo root
-     * @throws GitTimeoutError when git does not answer within `gitTimeoutMs`
+     * @throws GitTimeoutError when git does not answer within `gitTimeoutMs`, and
+     *   an Error when git fails (#1165)
      */
     getUncommittedFiles(): Promise<string[]>;
     /**
@@ -143,13 +153,22 @@ export declare class GitAnalyzer {
      * never reach a shell.
      */
     private countBugFixCommits;
+    /**
+     * `query`'s paths, or none when the repository has no commit yet, which
+     * `git log` and `git diff HEAD` report as an error.
+     */
+    private unlessUnborn;
     /**
      * Run one file's analysis with every git call sharing one `gitTimeoutMs`
-     * deadline (#1115). When git is unavailable or times out, the analysis
-     * returns its default, which callers treat as "no git data", and a timeout
-     * is recorded for consumeTimeout(). A timeout never yields a measured 0.
+     * deadline (#1115). When git is unavailable or fails, the analysis returns
+     * its default, which callers treat as "no git data", never a measured 0
+     * (#1165). A timeout or an output overflow is recorded for consumeTimeout(),
+     * or, with `strict`, rejects.
      */
     private analyze;
+    /** The withFileDeadline() call on `filePath` that the current async context runs in. */
+    private scopeFor;
+    private markIncomplete;
     /**
      * Whether the repo root is a git work tree. A timeout is not an answer: it
      * is remembered for `cacheTtl` so a hung git is not waited on for every

package/dist/shared/git/git-analyzer.js

@@ -9,6 +9,7 @@
  * - Bug history from commit messages
  */
 import * as path from 'path';
+import { AsyncLocalStorage } from 'async_hooks';
 import { assertSafeGitRef } from './ref-validation.js';
 import { GitTimeoutError, runGit } from './git-process.js';
 /**
@@ -35,6 +36,10 @@ const DEFAULT_CONFIG = {
 };
 /** Room for `git blame --line-porcelain` on large files (execFileSync allowed 1 MiB). */
 const GIT_MAX_BUFFER = 64 * 1024 * 1024;
+/** Git had an answer that was not read: it timed out or overflowed the output limit. */
+function isIncompleteRead(error) {
+    return error instanceof GitTimeoutError || error?.code === 'ENOBUFS';
+}
 /**
  * Git Analyzer for defect prediction metrics
  */
@@ -44,9 +49,10 @@ export class GitAnalyzer {
     isGitRepo = null;
     /** After a rev-parse timeout, when to ask git again (until then: "timeout"). */
     repoRetryAt = 0;
+    /** Files whose git data came back incomplete outside any withFileDeadline() call. */
     timedOutFiles = new Set();
-    /** Files inside withFileDeadline() and when their git time runs out. */
-    fileDeadlines = new Map();
+    /** The withFileDeadline() call each async context runs in, so concurrent calls on one file stay apart (#1165). */
+    fileScopes = new AsyncLocalStorage();
     constructor(config = {}) {
         this.config = { ...DEFAULT_CONFIG, ...config };
     }
@@ -57,27 +63,31 @@ export class GitAnalyzer {
         return (await this.repoState()) === true;
     }
     /**
-     * True when git timed out while analysing `filePath` since the last call, so
-     * the analysis returned its "git unavailable" default rather than a result.
+     * True when git timed out, or its output overflowed, while analysing
+     * `filePath` since the last call, so the analysis returned its "git
+     * unavailable" default rather than a result. Inside withFileDeadline() it
+     * reports only that call's analyses, not another caller's on the same file (#1165).
      */
     consumeTimeout(filePath) {
-        return this.timedOutFiles.delete(filePath);
+        const scope = this.scopeFor(filePath);
+        if (!scope)
+            return this.timedOutFiles.delete(filePath);
+        const incomplete = scope.incomplete;
+        scope.incomplete = false;
+        return incomplete;
     }
     /**
      * Run `work`, during which every analysis of `filePath` also stops at one
      * shared `fileTimeoutMs` deadline. One file's analyses then wait for git at
-     * most that long together, rather than `gitTimeoutMs` each (#1115).
+     * most that long together, rather than `gitTimeoutMs` each (#1115). Each
+     * call has its own deadline and timeout flag, even when calls on the same
+     * file overlap (#1165); call consumeTimeout() inside `work` to read the flag.
      */
     async withFileDeadline(filePath, work) {
-        if (this.fileDeadlines.has(filePath))
+        if (this.scopeFor(filePath))
             return work();
-        this.fileDeadlines.set(filePath, Date.now() + this.config.fileTimeoutMs);
-        try {
-            return await work();
-        }
-        finally {
-            this.fileDeadlines.delete(filePath);
-        }
+        const scope = { filePath, deadline: Date.now() + this.config.fileTimeoutMs, incomplete: false };
+        return this.fileScopes.run(scope, work);
     }
     /**
      * Get file change frequency (commits in last 90 days / 3)
@@ -88,7 +98,7 @@ export class GitAnalyzer {
         const cached = this.getFromCache(cacheKey);
         if (cached !== undefined)
             return cached;
-        return this.analyze(filePath, 0.4, async (git, relativePath) => {
+        return this.analyze(filePath, 0.4, {}, async (git, relativePath) => {
             // Literal pathspecs preserve route filenames such as app/[id].tsx.
             // Arguments go to git directly, without shell interpretation.
             const output = (await git.text(['--literal-pathspecs', 'log', '--oneline', '--since=90 days ago', '--', relativePath])).trim();
@@ -107,7 +117,7 @@ export class GitAnalyzer {
         const cached = this.getFromCache(cacheKey);
         if (cached !== undefined)
             return cached;
-        return this.analyze(filePath, 0.5, async (git, relativePath) => {
+        return this.analyze(filePath, 0.5, {}, async (git, relativePath) => {
             const blameOutput = await git.text(['--literal-pathspecs', 'blame', '--line-porcelain', '--', relativePath]);
             // Parse blame output - count authors manually instead of piping through shell
             const authorCounts = new Map();
@@ -135,7 +145,7 @@ export class GitAnalyzer {
         const cached = this.getFromCache(cacheKey);
         if (cached !== undefined)
             return cached;
-        return this.analyze(filePath, 0.4, async (git, relativePath) => {
+        return this.analyze(filePath, 0.4, {}, async (git, relativePath) => {
             // First commit: the last line (oldest) of the commits that added the file
             const added = await git.lines(['--literal-pathspecs', 'log', '--format=%at', '--follow', '--diff-filter=A', '--', relativePath]);
             const firstCommitTimestamp = parseInt(added[added.length - 1] ?? '', 10);
@@ -172,7 +182,7 @@ export class GitAnalyzer {
         const cached = this.getFromCache(cacheKey);
         if (cached !== undefined)
             return cached;
-        return this.analyze(filePath, 0.2, async (git, relativePath) => {
+        return this.analyze(filePath, 0.2, {}, async (git, relativePath) => {
             const bugCommits = await this.countBugFixCommits(git, relativePath);
             const riskScore = Math.min(1, bugCommits / 10); // Normalize: 10+ bug fixes = 1.0
             this.setCache(cacheKey, riskScore);
@@ -181,14 +191,16 @@ export class GitAnalyzer {
     }
     /**
      * Get comprehensive file history analysis
+     * @throws GitTimeoutError when git does not answer within `gitTimeoutMs`, and
+     *   an ENOBUFS error when its output overflows; zero history would be a false answer (#1165)
      */
     async getFileHistory(filePath) {
         const cacheKey = `history:${filePath}`;
         const cached = this.getFromCache(cacheKey);
         if (cached)
             return cached;
-        return this.analyze(filePath, this.getDefaultFileHistory(filePath), async (git, relativePath) => {
-            // Each query yields no lines when the file is not in git
+        return this.analyze(filePath, this.getDefaultFileHistory(filePath), { strict: true }, async (git, relativePath) => {
+            // `git log` yields no lines when the file is not in git
             const totalCommits = (await git.lines(['--literal-pathspecs', 'log', '--oneline', '--', relativePath])).length;
             // Parse authors here instead of piping through sort/wc
             const uniqueAuthors = new Set(await git.lines(['--literal-pathspecs', 'log', '--format=%ae', '--', relativePath])).size;
@@ -224,14 +236,16 @@ export class GitAnalyzer {
      * Get files changed since a specific date
      * @param since - Date to check changes from (default: 24 hours ago)
      * @returns Array of changed file paths relative to repo root
-     * @throws GitTimeoutError when git does not answer within `gitTimeoutMs`
+     * @throws GitTimeoutError when git does not answer within `gitTimeoutMs`, and
+     *   an Error when git fails; neither means "no changes" (#1165)
      */
     async getChangedFiles(since) {
         if (!(await this.isGitRepository())) {
             return [];
         }
         const sinceDate = since || new Date(Date.now() - 24 * 60 * 60 * 1000);
-        const files = await this.query().paths(['log', `--since=${sinceDate.toISOString()}`, '--name-only', '-z', '--format=']);
+        const git = this.query();
+        const files = await this.unlessUnborn(git, git.paths(['log', `--since=${sinceDate.toISOString()}`, '--name-only', '-z', '--format=']));
         return Array.from(new Set(files));
     }
     /**
@@ -241,7 +255,8 @@ export class GitAnalyzer {
      * @throws Error when `commitHash` is option-shaped (starts with "-") or otherwise
      *   not a safe revision argument; git would otherwise parse it as an option
      *   (e.g. `--output=<path>` writes an arbitrary file). See issue #960.
-     * @throws GitTimeoutError when git does not answer within `gitTimeoutMs`
+     * @throws GitTimeoutError when git does not answer within `gitTimeoutMs`, and
+     *   an Error when git fails, e.g. on an unknown revision (#1165)
      */
     async getCommitFiles(commitHash = 'HEAD') {
         // Validate before touching git: there is no shell, so stripping
@@ -255,7 +270,8 @@ export class GitAnalyzer {
     /**
      * Get files with uncommitted changes (staged + unstaged)
      * @returns Array of modified file paths relative to repo root
-     * @throws GitTimeoutError when git does not answer within `gitTimeoutMs`
+     * @throws GitTimeoutError when git does not answer within `gitTimeoutMs`, and
+     *   an Error when git fails (#1165)
      */
     async getUncommittedFiles() {
         if (!(await this.isGitRepository())) {
@@ -263,7 +279,7 @@ export class GitAnalyzer {
         }
         // `diff HEAD` fails before the first commit; `--cached` still lists staged files.
         const git = this.query();
-        const unstaged = await git.paths(['diff', '--name-only', '-z', 'HEAD']);
+        const unstaged = await this.unlessUnborn(git, git.paths(['diff', '--name-only', '-z', 'HEAD']));
         const staged = await git.paths(['diff', '--name-only', '-z', '--cached']);
         return Array.from(new Set([...unstaged, ...staged]));
     }
@@ -279,28 +295,69 @@ export class GitAnalyzer {
         const lines = await git.lines(['--literal-pathspecs', 'log', '--oneline', '-i', ...greps, '--', relativePath]);
         return new Set(lines.map((line) => line.split(' ')[0]).filter(Boolean)).size;
     }
+    /**
+     * `query`'s paths, or none when the repository has no commit yet, which
+     * `git log` and `git diff HEAD` report as an error.
+     */
+    async unlessUnborn(git, query) {
+        try {
+            return await query;
+        }
+        catch (error) {
+            if (error instanceof GitTimeoutError)
+                throw error;
+            try {
+                await git.text(['rev-parse', '--verify', '-q', 'HEAD']);
+            }
+            catch (headError) {
+                if (headError instanceof GitTimeoutError)
+                    throw headError;
+                return [];
+            }
+            throw error;
+        }
+    }
     /**
      * Run one file's analysis with every git call sharing one `gitTimeoutMs`
-     * deadline (#1115). When git is unavailable or times out, the analysis
-     * returns its default, which callers treat as "no git data", and a timeout
-     * is recorded for consumeTimeout(). A timeout never yields a measured 0.
+     * deadline (#1115). When git is unavailable or fails, the analysis returns
+     * its default, which callers treat as "no git data", never a measured 0
+     * (#1165). A timeout or an output overflow is recorded for consumeTimeout(),
+     * or, with `strict`, rejects.
      */
-    async analyze(filePath, fallback, work) {
+    async analyze(filePath, fallback, options, work) {
+        const scope = this.scopeFor(filePath);
         const repo = await this.repoState();
-        if (repo !== true) {
-            if (repo === 'timeout')
-                this.timedOutFiles.add(filePath);
-            return fallback;
+        if (repo === 'timeout') {
+            if (options.strict)
+                throw new GitTimeoutError(['rev-parse', '--is-inside-work-tree'], this.config.gitTimeoutMs);
+            this.markIncomplete(filePath, scope);
         }
+        if (repo !== true)
+            return fallback;
         try {
-            return await work(this.query(this.fileDeadlines.get(filePath)), this.getRelativePath(filePath));
+            return await work(this.query(scope?.deadline), this.getRelativePath(filePath));
         }
         catch (error) {
-            if (error instanceof GitTimeoutError)
-                this.timedOutFiles.add(filePath);
+            // Any other failure is git's answer for this file, e.g. `blame` of an untracked file.
+            if (!isIncompleteRead(error))
+                return fallback;
+            if (options.strict)
+                throw error;
+            this.markIncomplete(filePath, scope);
             return fallback;
         }
     }
+    /** The withFileDeadline() call on `filePath` that the current async context runs in. */
+    scopeFor(filePath) {
+        const scope = this.fileScopes.getStore();
+        return scope?.filePath === filePath ? scope : undefined;
+    }
+    markIncomplete(filePath, scope) {
+        if (scope)
+            scope.incomplete = true;
+        else
+            this.timedOutFiles.add(filePath);
+    }
     /**
      * Whether the repo root is a git work tree. A timeout is not an answer: it
      * is remembered for `cacheTtl` so a hung git is not waited on for every
@@ -335,20 +392,10 @@ export class GitAnalyzer {
         const text = (args) => runGit(args, {
             cwd: this.config.repoRoot, timeout: deadline - Date.now(), maxBuffer: GIT_MAX_BUFFER,
         });
-        const orNothing = async (args, separator) => {
-            try {
-                return (await text(args)).split(separator);
-            }
-            catch (error) {
-                if (error instanceof GitTimeoutError)
-                    throw error;
-                return [];
-            }
-        };
         return {
             text,
-            lines: async (args) => (await orNothing(args, '\n')).map((line) => line.trim()).filter(Boolean),
-            paths: async (args) => (await orNothing(args, '\0')).filter(Boolean),
+            lines: async (args) => (await text(args)).split('\n').map((line) => line.trim()).filter(Boolean),
+            paths: async (args) => (await text(args)).split('\0').filter(Boolean),
         };
     }
     /**

package/dist/shared/io/confined-read.d.ts

@@ -5,24 +5,41 @@
  * it again later, so a file or symlink swapped in between could be read
  * unchecked. These readers OPEN first and validate what was opened:
  *
- * - the path's realpath is opened with O_NOFOLLOW (a symlink swapped onto the
- *   final name fails the open) and O_NONBLOCK (a FIFO cannot hang the open);
+ * - the path is resolved the kernel's way (a symlink is followed before a
+ *   later `..` is applied, as the payload guard does), and that realpath is
+ *   opened with O_NOFOLLOW (a symlink swapped onto the final name fails the
+ *   open) and O_NONBLOCK (a FIFO cannot hang the open);
  * - the descriptor must be a regular file within the size limit (fstat);
  * - the descriptor's real location (/proc/self/fd/N on Linux; elsewhere the
  *   re-resolved realpath, which must be the same inode) must lie inside the
  *   project root, so a directory component swapped for a symlink is caught;
+ *   a file that was replaced or unlinked after the open is refused as
+ *   'changed-during-read';
  * - the content is read from that same descriptor, and never past the limit,
  *   even if the file grows after the fstat.
  *
  * A path spelled outside the root is refused before any filesystem call,
  * unless the caller opts into `outsideRoot: 'allow'` for paths it accepts
  * from a trusted source (the other checks still apply).
+ *
+ * Hardlinks (#1186): no path check can see a hardlink, because every name of
+ * a hardlinked file is equally real and the kernel offers no way to list the
+ * other names. `hardlinks: 'refuse'` refuses any file with more than one link
+ * (st_nlink > 1), which also refuses a hardlink whose other name is inside
+ * the project (pnpm stores, `cp -al` snapshots). A file whose outside name
+ * was removed has one link and is read. The policy trusts the link count the
+ * filesystem reports: one that reports 1 for every file (FAT, some network
+ * shares) hides a hardlink from it. Verified on Linux only.
  */
 import { type Stats } from 'node:fs';
 import { CallerInputError } from '../error-utils.js';
 /** Default upper bound for a confined read when the caller names none. */
 export declare const DEFAULT_MAX_CONFINED_READ_BYTES: number;
-export type ConfinedReadReason = 'not-found' | 'not-a-file' | 'outside-project-root' | 'unreadable' | 'too-large';
+export type ConfinedReadReason = 'not-found' | 'not-a-file' | 'outside-project-root' | 'unreadable' | 'too-large'
+/** The opened file is no longer at the checked path (replaced or unlinked). */
+ | 'changed-during-read'
+/** `hardlinks: 'refuse'` and the file has more than one link. */
+ | 'hardlinked';
 export interface ConfinedReadOptions {
     /** Project root; defaults to findProjectRoot(). */
     projectRoot?: string;
@@ -34,6 +51,11 @@ export interface ConfinedReadOptions {
      * trusts it. Paths spelled inside the root are always held to the root.
      */
     outsideRoot?: 'refuse' | 'allow';
+    /**
+     * 'refuse' refuses a file with more than one hardlink, which a path check
+     * cannot confine (see the module comment). Default 'allow'.
+     */
+    hardlinks?: 'allow' | 'refuse';
 }
 /**
  * A confined read that was refused; `reason` matches the payload guard's.
@@ -52,10 +74,13 @@ export declare const CONFINED_OPEN_FLAGS: number;
 /** True when `candidate` is `root` or lies beneath it (both absolute). */
 export declare function isWithinRoot(root: string, candidate: string): boolean;
 /**
- * Where an OPEN descriptor really points. On Linux, /proc/self/fd/N resolves
- * to the opened file itself. Elsewhere, re-resolve the path and accept it only
- * if it is the same inode as the descriptor, so a swap after the open is
- * detected. Returns null when it cannot be proven.
+ * Where an OPEN descriptor really points. On Linux, /proc/self/fd/N names the
+ * opened file itself; when /proc answers, its answer is final (#1186): a file
+ * unlinked or replaced since the open reads as "<path> (deleted)" or names
+ * another inode, and is not re-resolved by name. Without /proc (macOS,
+ * Windows, /proc not mounted), re-resolve the path and accept it only if it
+ * is the same inode as the descriptor, so a swap after the open is detected.
+ * Returns null when the opened file is no longer where it was checked.
  */
 export declare function openedLocation(fd: number, lexical: string, opened: Stats): Promise<string | null>;
 /** Synchronous openedLocation, for callers that read synchronously. */