agentic-qe 3.15.17 → 3.15.18

package/dist/shared/io/confined-read.js

@@ -5,18 +5,31 @@
  * it again later, so a file or symlink swapped in between could be read
  * unchecked. These readers OPEN first and validate what was opened:
  *
- * - the path's realpath is opened with O_NOFOLLOW (a symlink swapped onto the
- *   final name fails the open) and O_NONBLOCK (a FIFO cannot hang the open);
+ * - the path is resolved the kernel's way (a symlink is followed before a
+ *   later `..` is applied, as the payload guard does), and that realpath is
+ *   opened with O_NOFOLLOW (a symlink swapped onto the final name fails the
+ *   open) and O_NONBLOCK (a FIFO cannot hang the open);
  * - the descriptor must be a regular file within the size limit (fstat);
  * - the descriptor's real location (/proc/self/fd/N on Linux; elsewhere the
  *   re-resolved realpath, which must be the same inode) must lie inside the
  *   project root, so a directory component swapped for a symlink is caught;
+ *   a file that was replaced or unlinked after the open is refused as
+ *   'changed-during-read';
  * - the content is read from that same descriptor, and never past the limit,
  *   even if the file grows after the fstat.
  *
  * A path spelled outside the root is refused before any filesystem call,
  * unless the caller opts into `outsideRoot: 'allow'` for paths it accepts
  * from a trusted source (the other checks still apply).
+ *
+ * Hardlinks (#1186): no path check can see a hardlink, because every name of
+ * a hardlinked file is equally real and the kernel offers no way to list the
+ * other names. `hardlinks: 'refuse'` refuses any file with more than one link
+ * (st_nlink > 1), which also refuses a hardlink whose other name is inside
+ * the project (pnpm stores, `cp -al` snapshots). A file whose outside name
+ * was removed has one link and is read. The policy trusts the link count the
+ * filesystem reports: one that reports 1 for every file (FAT, some network
+ * shares) hides a hardlink from it. Verified on Linux only.
  */
 import { constants as fsConstants } from 'node:fs';
 import * as fsSync from 'node:fs';
@@ -52,19 +65,22 @@ export function isWithinRoot(root, candidate) {
     return relative === '' || (relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
 }
 /**
- * Where an OPEN descriptor really points. On Linux, /proc/self/fd/N resolves
- * to the opened file itself. Elsewhere, re-resolve the path and accept it only
- * if it is the same inode as the descriptor, so a swap after the open is
- * detected. Returns null when it cannot be proven.
+ * Where an OPEN descriptor really points. On Linux, /proc/self/fd/N names the
+ * opened file itself; when /proc answers, its answer is final (#1186): a file
+ * unlinked or replaced since the open reads as "<path> (deleted)" or names
+ * another inode, and is not re-resolved by name. Without /proc (macOS,
+ * Windows, /proc not mounted), re-resolve the path and accept it only if it
+ * is the same inode as the descriptor, so a swap after the open is detected.
+ * Returns null when the opened file is no longer where it was checked.
  */
 export async function openedLocation(fd, lexical, opened) {
     const sameFile = async (candidate) => {
         const st = await fs.stat(candidate).catch(() => null);
         return st !== null && st.dev === opened.dev && st.ino === opened.ino;
     };
-    const viaProc = await fs.realpath(`/proc/self/fd/${fd}`).catch(() => null);
-    if (viaProc && path.isAbsolute(viaProc) && await sameFile(viaProc))
-        return viaProc;
+    const viaProc = await fs.readlink(`/proc/self/fd/${fd}`).catch(() => null);
+    if (viaProc !== null)
+        return path.isAbsolute(viaProc) && await sameFile(viaProc) ? viaProc : null;
     const real = await fs.realpath(lexical).catch(() => null);
     if (real && await sameFile(real))
         return real;
@@ -81,18 +97,21 @@ export function openedLocationSync(fd, lexical, opened) {
             return false;
         }
     };
-    const realOrNull = (p) => {
+    const viaProc = (() => {
         try {
-            return fsSync.realpathSync(p);
+            return fsSync.readlinkSync(`/proc/self/fd/${fd}`);
         }
         catch {
             return null;
         }
-    };
-    const viaProc = realOrNull(`/proc/self/fd/${fd}`);
-    if (viaProc && path.isAbsolute(viaProc) && sameFile(viaProc))
-        return viaProc;
-    const real = realOrNull(lexical);
+    })();
+    if (viaProc !== null)
+        return path.isAbsolute(viaProc) && sameFile(viaProc) ? viaProc : null;
+    let real = null;
+    try {
+        real = fsSync.realpathSync.native(lexical);
+    }
+    catch { /* not resolvable */ }
     if (real && sameFile(real))
         return real;
     return null;
@@ -120,14 +139,21 @@ function plan(filePath, rootReal, options) {
     // reason cannot reveal whether an outside path exists.
     if (!inRoot && options.outsideRoot !== 'allow')
         throw fail(filePath, 'outside-project-root');
-    return { lexical, rootReal, inRoot, limit: options.maxBytes ?? DEFAULT_MAX_CONFINED_READ_BYTES };
+    const raw = path.isAbsolute(filePath) ? filePath : `${process.cwd()}${path.sep}${filePath}`;
+    return {
+        lexical, raw, rootReal, inRoot,
+        limit: options.maxBytes ?? DEFAULT_MAX_CONFINED_READ_BYTES,
+        hardlinks: options.hardlinks ?? 'allow',
+    };
 }
 /** Check the opened descriptor's stat before anything is read. */
-function checkOpened(filePath, st, limit) {
+function checkOpened(filePath, st, p) {
     if (!st.isFile())
         throw fail(filePath, 'not-a-file');
-    if (st.size > limit)
+    if (st.size > p.limit)
         throw fail(filePath, 'too-large');
+    if (p.hardlinks === 'refuse' && st.nlink > 1)
+        throw fail(filePath, 'hardlinked');
 }
 /**
  * Read a file by path, confined to the project root and validated on the
@@ -139,7 +165,9 @@ export async function readConfinedFile(filePath, options = {}) {
     const p = plan(filePath, rootReal, options);
     let real;
     try {
-        real = await fs.realpath(p.lexical);
+        // fs.promises.realpath is the native realpath(3): it resolves `..` after
+        // following the symlink before it.
+        real = await fs.realpath(p.raw);
     }
     catch (error) {
         throw fail(filePath, reasonFor(error), error);
@@ -155,10 +183,12 @@ export async function readConfinedFile(filePath, options = {}) {
     }
     try {
         const st = await handle.stat();
-        checkOpened(filePath, st, p.limit);
+        checkOpened(filePath, st, p);
         if (p.inRoot) {
             const location = await openedLocation(handle.fd, real, st);
-            if (!location || !isWithinRoot(p.rootReal, location))
+            if (!location)
+                throw fail(filePath, 'changed-during-read');
+            if (!isWithinRoot(p.rootReal, location))
                 throw fail(filePath, 'outside-project-root');
         }
         // Read at most limit + 1 bytes from this descriptor: a file that grew
@@ -201,7 +231,8 @@ export function readConfinedFileSync(filePath, options = {}) {
     const p = plan(filePath, rootReal, options);
     let real;
     try {
-        real = fsSync.realpathSync(p.lexical);
+        // .native: the JS realpathSync collapses `..` as text before resolving.
+        real = fsSync.realpathSync.native(p.raw);
     }
     catch (error) {
         throw fail(filePath, reasonFor(error), error);
@@ -217,10 +248,12 @@ export function readConfinedFileSync(filePath, options = {}) {
     }
     try {
         const st = fsSync.fstatSync(fd);
-        checkOpened(filePath, st, p.limit);
+        checkOpened(filePath, st, p);
         if (p.inRoot) {
             const location = openedLocationSync(fd, real, st);
-            if (!location || !isWithinRoot(p.rootReal, location))
+            if (!location)
+                throw fail(filePath, 'changed-during-read');
+            if (!isWithinRoot(p.rootReal, location))
                 throw fail(filePath, 'outside-project-root');
         }
         const chunks = [];

package/dist/shared/io/file-reader.js

@@ -335,7 +335,10 @@ export class FileReader {
         try {
             // The lexical root, so a path spelled under a symlinked root still
             // counts as inside; the primitive resolves the root's realpath itself.
-            return ok(await readConfinedText(lexical, { projectRoot: this.projectRoot ?? rootReal }));
+            // #1186: the caller's spelling, not `lexical`, so `link/../x` resolves
+            // through the link the way the kernel and the payload guard resolve it.
+            const raw = path.isAbsolute(filePath) ? filePath : `${path.resolve(this.basePath)}${path.sep}${filePath}`;
+            return ok(await readConfinedText(raw, { projectRoot: this.projectRoot ?? rootReal }));
         }
         catch (error) {
             if (!(error instanceof ConfinedReadError))

package/dist/shared/safe-db.d.ts

@@ -16,7 +16,7 @@ export interface SafeDbOptions {
     fileMustExist?: boolean;
     /** Busy timeout in ms (default: 5000) */
     busyTimeout?: number;
-    /** Enable WAL mode (default: true for writable, false for readonly) */
+    /** Enable WAL mode (default: true for writable; always ignored for readonly) */
     walMode?: boolean;
     /**
      * M3.2: on a malformed/corrupt existing DB, auto-restore the newest verified

package/dist/shared/safe-db.js

@@ -12,6 +12,7 @@ import Database from 'better-sqlite3';
 import { basename } from 'node:path';
 import { attemptAutoRestore } from './db-recovery.js';
 import { withNativeModuleRemedy } from './native-module-errors.js';
+import { setJournalModeWithRetry } from './sqlite-journal-mode.js';
 /**
  * Open a SQLite database with safe defaults that prevent corruption.
  *
@@ -95,8 +96,11 @@ export function openDatabase(dbPath, opts) {
                 // 2026-07-07), so continuing to write in WAL would trade a loud outage for
                 // silent corruption. Availability is not worth that; the message below
                 // carries the exact command that finds the real holder.
+                //
+                // Concurrent openers racing the same one-time switch (#1164) are retried
+                // within busyTimeout first; only contention that outlasts it fails closed.
                 try {
-                    db.pragma(`journal_mode = ${desired}`);
+                    setJournalModeWithRetry(db, desired, busyTimeout);
                 }
                 catch (err) {
                     const code = err?.code;
@@ -135,11 +139,22 @@ export function openDatabase(dbPath, opts) {
             }
         }
     }
-    else if (walMode) {
+    else if (walMode && !readonly) {
         // WAL mode for writable connections prevents corruption from concurrent
-        // writers. Readonly connections inherit WAL from the DB file but we set it
-        // explicitly to be safe in case the DB was created without WAL.
-        db.pragma('journal_mode = WAL');
+        // writers. Readonly connections inherit the file's journal mode and must
+        // not switch it: that is a write and fails with SQLITE_READONLY on a
+        // rollback-journal file (#1320), so `walMode` is ignored for readonly opens.
+        //
+        // #1164: switching a rollback-journal file to WAL upgrades a read lock to a
+        // write lock, and SQLite returns SQLITE_BUSY for that at once instead of
+        // waiting on busy_timeout. Concurrent first opens retry within busyTimeout.
+        try {
+            setJournalModeWithRetry(db, 'WAL', busyTimeout);
+        }
+        catch (err) {
+            db.close();
+            throw err;
+        }
     }
     return db;
 }

package/dist/shared/sqlite-journal-mode.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Switch a SQLite connection's journal mode, retrying lock contention (#1164).
+ *
+ * `PRAGMA journal_mode = WAL` on a rollback-journal database reads page 1
+ * under a SHARED lock and then upgrades to a write lock to rewrite the header.
+ * SQLite does not run the busy handler for that upgrade (an upgrade from a
+ * held read lock could deadlock), so when several processes open the same
+ * non-WAL database at once, all but one can get SQLITE_BUSY in well under a
+ * millisecond even with busy_timeout set. Leaving WAL needs an EXCLUSIVE lock
+ * and fails the same way.
+ *
+ * This retries the switch with a short, growing sleep until `budgetMs` has
+ * passed, then throws the last error. Once another process has switched the
+ * file, the retry finds the mode already set, which needs no write lock.
+ *
+ * Dependency-free (no better-sqlite3 import) so optional-dependency callers can
+ * use it with a connection they loaded themselves.
+ */
+/** The part of a better-sqlite3 connection this needs. */
+export interface JournalModeConnection {
+    pragma(source: string, options?: {
+        simple?: boolean;
+    }): unknown;
+}
+export interface JournalModeRetryOptions {
+    /** Synchronous sleep, injectable for tests. */
+    sleep?: (ms: number) => void;
+    /** Clock in ms, injectable for tests. */
+    now?: () => number;
+}
+/** True for SQLITE_BUSY / SQLITE_LOCKED, including extended codes such as SQLITE_BUSY_RECOVERY. */
+export declare function isJournalLockContention(err: unknown): boolean;
+/**
+ * Set `journal_mode` to `mode`, retrying SQLITE_BUSY / SQLITE_LOCKED for up to
+ * `budgetMs`. Returns the mode SQLite reports afterwards, lower-cased. Any
+ * other error is thrown at once.
+ */
+export declare function setJournalModeWithRetry(db: JournalModeConnection, mode: string, budgetMs: number, options?: JournalModeRetryOptions): string;
+//# sourceMappingURL=sqlite-journal-mode.d.ts.map

package/dist/shared/sqlite-journal-mode.js

@@ -0,0 +1,53 @@
+/**
+ * Switch a SQLite connection's journal mode, retrying lock contention (#1164).
+ *
+ * `PRAGMA journal_mode = WAL` on a rollback-journal database reads page 1
+ * under a SHARED lock and then upgrades to a write lock to rewrite the header.
+ * SQLite does not run the busy handler for that upgrade (an upgrade from a
+ * held read lock could deadlock), so when several processes open the same
+ * non-WAL database at once, all but one can get SQLITE_BUSY in well under a
+ * millisecond even with busy_timeout set. Leaving WAL needs an EXCLUSIVE lock
+ * and fails the same way.
+ *
+ * This retries the switch with a short, growing sleep until `budgetMs` has
+ * passed, then throws the last error. Once another process has switched the
+ * file, the retry finds the mode already set, which needs no write lock.
+ *
+ * Dependency-free (no better-sqlite3 import) so optional-dependency callers can
+ * use it with a connection they loaded themselves.
+ */
+const FIRST_BACKOFF_MS = 2;
+const MAX_BACKOFF_MS = 50;
+/** True for SQLITE_BUSY / SQLITE_LOCKED, including extended codes such as SQLITE_BUSY_RECOVERY. */
+export function isJournalLockContention(err) {
+    const code = err?.code;
+    return typeof code === 'string' && (code.startsWith('SQLITE_BUSY') || code.startsWith('SQLITE_LOCKED'));
+}
+function sleepSync(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+/**
+ * Set `journal_mode` to `mode`, retrying SQLITE_BUSY / SQLITE_LOCKED for up to
+ * `budgetMs`. Returns the mode SQLite reports afterwards, lower-cased. Any
+ * other error is thrown at once.
+ */
+export function setJournalModeWithRetry(db, mode, budgetMs, options = {}) {
+    const sleep = options.sleep ?? sleepSync;
+    const now = options.now ?? Date.now;
+    const deadline = now() + Math.max(0, budgetMs);
+    let backoff = FIRST_BACKOFF_MS;
+    for (;;) {
+        try {
+            return String(db.pragma(`journal_mode = ${mode}`, { simple: true }) ?? '').toLowerCase();
+        }
+        catch (err) {
+            const remaining = deadline - now();
+            if (!isJournalLockContention(err) || remaining <= 0)
+                throw err;
+            // Jitter so processes that collided do not retry in lockstep.
+            sleep(Math.min(remaining, backoff / 2 + Math.random() * backoff / 2));
+            backoff = Math.min(backoff * 2, MAX_BACKOFF_MS);
+        }
+    }
+}
+//# sourceMappingURL=sqlite-journal-mode.js.map

package/dist/sync/claude-flow-bridge.js

@@ -152,8 +152,8 @@ export async function syncClaudeFlowToAQE(options = {}) {
         // Import safe database opener
         const { openDatabase } = await import('../shared/safe-db.js');
         const db = openDatabase(aqeDbPath);
+        // #1164: openDatabase() set the journal mode (retrying contention, honouring AQE_DISABLE_WAL).
         try {
-            db.pragma('journal_mode = WAL');
             // Prepare insert statements
             const insertKv = db.prepare(`
         INSERT OR REPLACE INTO kv_store (key, namespace, value, expires_at, created_at)

package/dist/sync/readers/sqlite-reader.js

@@ -37,11 +37,10 @@ export class SQLiteReader {
             throw new Error(`SQLite database not found: ${this.dbPath}`);
         }
         try {
-            // Open read-only
+            // Open read-only. Never set journal_mode/synchronous here: switching the
+            // journal mode is a write, so it fails with SQLITE_READONLY on a
+            // rollback-journal source (#1320). A reader must leave the source as-is.
             this.db = openDatabase(this.dbPath, { readonly: true });
-            // Enable performance settings for reads
-            this.db.pragma('journal_mode = WAL');
-            this.db.pragma('synchronous = NORMAL');
             console.log(`[SQLiteReader:${this.name}] Initialized: ${this.dbPath}`);
         }
         catch (error) {

package/dist/sync/writers/sqlite-writer.js

@@ -31,8 +31,8 @@ export class SQLiteWriter {
             throw new Error(`SQLite database not found: ${this.dbPath}. Run 'aqe init' to create it.`);
         }
         try {
+            // #1164: openDatabase() set the journal mode (retrying contention, honouring AQE_DISABLE_WAL).
             this.db = openDatabase(this.dbPath);
-            this.db.pragma('journal_mode = WAL');
             this.db.pragma('synchronous = NORMAL');
             logger.debug(`Opened SQLite database: ${this.dbPath}`);
         }

package/dist/workers/interfaces.d.ts

@@ -55,8 +55,8 @@ export interface WorkerMetrics {
     readonly itemsAnalyzed: number;
     /** Number of issues found */
     readonly issuesFound: number;
-    /** Health score (0-100) */
-    readonly healthScore: number;
+    /** Health score (0-100); `null` when nothing was measured (#1137) */
+    readonly healthScore: number | null;
     /** Trend direction */
     readonly trend: 'improving' | 'stable' | 'degrading';
     /** Domain-specific metrics */

package/dist/workers/quality-daemon/git-watcher.d.ts

@@ -28,6 +28,8 @@ export declare class GitWatcher {
     private debounceTimer;
     private _running;
     private _polling;
+    /** Ref changes to read again after git timed out on them (fs.watch mode). */
+    private readonly retryTimers;
     constructor(queue: PriorityQueue, options?: GitWatcherOptions);
     get running(): boolean;
     /**
@@ -45,6 +47,12 @@ export declare class GitWatcher {
     poll(): Promise<string[]>;
     private handleRefChange;
     private processRefChange;
+    /**
+     * Enqueue the files changed from `lastHash` (the last head seen) to
+     * `commitHash`, or in `commitHash` alone. Returns false when git timed out,
+     * so the caller keeps `lastHash` and tries again (#1165). When git fails,
+     * the changed files are left unknown rather than reported as none.
+     */
     private enqueueCommitAnalysis;
     private snapshotHeads;
 }

package/dist/workers/quality-daemon/git-watcher.js

@@ -9,7 +9,7 @@ import { watch } from 'fs';
 import { resolve, join } from 'path';
 import { existsSync, readFileSync } from 'fs';
 import { getGitRefError } from '../../shared/git/ref-validation.js';
-import { runGit } from '../../shared/git/git-process.js';
+import { GitTimeoutError, runGit } from '../../shared/git/git-process.js';
 /** A hung git must not stall the watcher; its process group is stopped (#1115). */
 const GIT_TIMEOUT_MS = 10_000;
 const DEFAULTS = {
@@ -30,6 +30,8 @@ export class GitWatcher {
     debounceTimer;
     _running = false;
     _polling = false;
+    /** Ref changes to read again after git timed out on them (fs.watch mode). */
+    retryTimers = new Set();
     constructor(queue, options) {
         this.queue = queue;
         this.options = { ...DEFAULTS, ...options };
@@ -87,6 +89,9 @@ export class GitWatcher {
             this.watcher.close();
             this.watcher = undefined;
         }
+        for (const timer of this.retryTimers)
+            clearTimeout(timer);
+        this.retryTimers.clear();
         this._running = false;
     }
     /**
@@ -111,8 +116,11 @@ export class GitWatcher {
                 const [branch, hash] = line.split(' ');
                 const lastHash = this.lastKnownHeads.get(branch);
                 if (lastHash && lastHash !== hash) {
+                    // #1165: on a git timeout keep the old head, so the next poll
+                    // covers this commit too.
+                    if (!(await this.enqueueCommitAnalysis(branch, hash, lastHash)))
+                        continue;
                     changedBranches.push(branch);
-                    await this.enqueueCommitAnalysis(branch, hash);
                 }
                 this.lastKnownHeads.set(branch, hash);
             }
@@ -152,37 +160,70 @@ export class GitWatcher {
         const lastHash = this.lastKnownHeads.get(branch);
         if (lastHash === newHash)
             return; // no change
+        if (!(await this.enqueueCommitAnalysis(branch, newHash, lastHash))) {
+            // #1165: git timed out; keep the old head and read the ref again later.
+            const timer = setTimeout(() => {
+                this.retryTimers.delete(timer);
+                this.processRefChange(filename).catch((err) => {
+                    console.debug('[GitWatcher] Error processing ref change:', err);
+                });
+            }, this.options.pollIntervalMs);
+            timer.unref?.();
+            this.retryTimers.add(timer);
+            return;
+        }
         this.lastKnownHeads.set(branch, newHash);
-        await this.enqueueCommitAnalysis(branch, newHash);
     }
-    async enqueueCommitAnalysis(branch, commitHash) {
+    /**
+     * Enqueue the files changed from `lastHash` (the last head seen) to
+     * `commitHash`, or in `commitHash` alone. Returns false when git timed out,
+     * so the caller keeps `lastHash` and tries again (#1165). When git fails,
+     * the changed files are left unknown rather than reported as none.
+     */
+    async enqueueCommitAnalysis(branch, commitHash, lastHash) {
         // The hash is read from a ref file; never let an option-shaped value
         // (e.g. `--output=<path>`) reach `git diff-tree` (issue #960).
         if (getGitRefError(commitHash, 'commit hash'))
-            return;
-        let changedFiles = [];
-        try {
+            return true;
+        const since = lastHash && !getGitRefError(lastHash, 'commit hash') ? lastHash : undefined;
+        const diffTree = async (revisions) => {
             const stdout = await runGit([
                 'diff-tree',
                 '--no-commit-id',
                 '--name-only',
                 '-r',
-                commitHash,
+                ...revisions,
             ], { cwd: this.options.repoRoot, timeout: GIT_TIMEOUT_MS });
-            changedFiles = stdout
+            return stdout
                 .trim()
                 .split('\n')
                 .filter(Boolean)
                 .slice(0, this.options.maxChangedFiles);
+        };
+        let changedFiles;
+        try {
+            // From the last head seen, so commits between two polls are not skipped.
+            changedFiles = await diffTree(since ? [since, commitHash] : ['--root', commitHash]);
         }
-        catch {
-            // fallback: empty changed files list
+        catch (error) {
+            if (error instanceof GitTimeoutError)
+                return false;
+            // The last head can be gone after a force-push and gc; fall back to this commit.
+            if (since) {
+                try {
+                    changedFiles = await diffTree(['--root', commitHash]);
+                }
+                catch (fallbackError) {
+                    if (fallbackError instanceof GitTimeoutError)
+                        return false;
+                }
+            }
         }
         const payload = {
             type: 'git_commit',
             branch,
             commitHash,
-            changedFiles,
+            ...(changedFiles ? { changedFiles } : {}),
         };
         const item = {
             id: `git-${commitHash}-${Date.now()}`,
@@ -193,6 +234,7 @@ export class GitWatcher {
             ttlMs: 5 * 60 * 1000, // 5 min TTL
         };
         this.queue.enqueue(item);
+        return true;
     }
     async snapshotHeads() {
         try {

package/dist/workers/quality-daemon/index.js

@@ -203,7 +203,7 @@ export class QualityDaemon {
                             });
                         }
                         if (delta.newGaps.length > 0) {
-                            const suggestions = await this.testSuggester.suggest(delta.newGaps, payload.changedFiles, memory);
+                            const suggestions = await this.testSuggester.suggest(delta.newGaps, payload.changedFiles ?? [], memory);
                             this._suggestionsGenerated += suggestions.length;
                             if (suggestions.length > 0) {
                                 await this.notificationService.send({

package/dist/workers/quality-daemon/priority-queue.d.ts

@@ -23,7 +23,8 @@ export interface GitCommitPayload {
     readonly type: 'git_commit';
     readonly branch: string;
     readonly commitHash: string;
-    readonly changedFiles: string[];
+    /** Files changed since the last commit seen; absent when git could not list them (#1165). */
+    readonly changedFiles?: string[];
 }
 export interface CoverageDeltaPayload {
     readonly type: 'coverage_delta';

package/dist/workers/workers/defect-predictor.d.ts

@@ -18,6 +18,10 @@
  * A `defect:predictions` record without
  * the measured stamp (the invented one written by <= 3.15.6) is ignored and
  * replaced by the next measured run.
+ *
+ * #1137: the latest run of every target is reported, so predicting `src/b`
+ * after `src/a` keeps `src/a`'s files; a file named by several targets takes
+ * its prediction from the newest run that names it.
  */
 import { BaseWorker } from '../base-worker';
 import { WorkerContext, WorkerResult } from '../interfaces';
@@ -31,11 +35,12 @@ export declare class DefectPredictorWorker extends BaseWorker {
      */
     private markPreviousStale;
     /**
-     * #1043: the most recent prediction run the defect-intelligence predictor
+     * #1043: the most recent prediction runs the defect-intelligence predictor
      * recorded, restricted to regular files whose real path is inside the
-     * project root. `measured` is `null` when there is no such prediction;
-     * `unusable` describes an ambiguous newest timestamp or a newest prediction
-     * none of whose files qualify.
+     * project root. #1137: the latest run of each target contributes, and a
+     * file takes its prediction from the newest run naming it. `measured` is
+     * `null` when no file qualifies; `unusable` then describes the newest run
+     * (or its ambiguous timestamp).
      */
     private readLatestPrediction;
     private analyzeHighRiskPredictions;