agentic-qe 3.15.2 → 3.15.3

package/dist/cli/chunks/{workflow-PYI6HCAG.js → workflow-XUQXIRNE.js}

@@ -1,5 +1,5 @@
-import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.2");process.exit(0)}
-import"./chunk-A6L2OCMO.js";import{b as $}from"./chunk-ATGIGJSL.js";import{a as k,b as W,c as v,g as C}from"./chunk-RLQ4MYB6.js";import{c as b}from"./chunk-URWT3EQT.js";import"./chunk-2AWU2E6R.js";import"./chunk-3KTAMNKI.js";import"./chunk-D75HDHX3.js";import{Command as D}from"commander";import o from"chalk";function O(w,i){let h=w.indexOf("=");return h>0&&(i[w.substring(0,h)]=w.substring(h+1)),i}function V(w,i,h){let m=new D("workflow").description("Manage QE workflows and pipelines (ADR-041)");return m.command("run <file>").description("Execute a QE pipeline from YAML file").option("-w, --watch","Watch execution progress").option("-v, --verbose","Show detailed output").option("--params <json>","Additional parameters as JSON","{}").action(async(n,t)=>{if(!await h())return;let u=(await import("path")).resolve(n);try{console.log(o.blue(`
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.3");process.exit(0)}
+import"./chunk-M3ACHBC7.js";import{b as $}from"./chunk-A6PII4R4.js";import{a as k,b as W,c as v,g as C}from"./chunk-QDQLL2QB.js";import{c as b}from"./chunk-UGNTLSBL.js";import"./chunk-Z7UGEQ4G.js";import"./chunk-2GJJGO5D.js";import"./chunk-WSUYEVSY.js";import{Command as D}from"commander";import o from"chalk";function O(w,i){let h=w.indexOf("=");return h>0&&(i[w.substring(0,h)]=w.substring(h+1)),i}function V(w,i,h){let m=new D("workflow").description("Manage QE workflows and pipelines (ADR-041)");return m.command("run <file>").description("Execute a QE pipeline from YAML file").option("-w, --watch","Watch execution progress").option("-v, --verbose","Show detailed output").option("--params <json>","Additional parameters as JSON","{}").action(async(n,t)=>{if(!await h())return;let u=(await import("path")).resolve(n);try{console.log(o.blue(`
  Running workflow from: ${n}
 `));let l=k(u);if(!l.success||!l.workflow){console.log(o.red("Failed to parse pipeline:"));for(let g of l.errors)console.log(o.red(`   ${g}`));await i(1)}let f={...b(t.params,"params")};if(l.pipeline){for(let g of l.pipeline.stages)if(g.params)for(let[y,p]of Object.entries(g.params))f[y]=p}if(!w.workflowOrchestrator.getWorkflow(l.workflow.id)){let g=w.workflowOrchestrator.registerWorkflow(l.workflow);g.success||(console.log(o.red(`Failed to register workflow: ${g.error.message}`)),await i(1))}let c=await w.workflowOrchestrator.executeWorkflow(l.workflow.id,f);if(!c.success){console.log(o.red(`Failed to start workflow: ${c.error.message}`)),await i(1);return}let a=c.value;if(console.log(o.cyan(`  Execution ID: ${a}`)),console.log(o.gray(`  Workflow: ${l.workflow.name}`)),console.log(o.gray(`  Stages: ${l.workflow.steps.length}`)),console.log(""),t.watch){console.log(o.blue(`Workflow Progress:
 `));let g,y=Date.now();for(;;){let d=w.workflowOrchestrator.getWorkflowStatus(a);if(!d)break;if(!g||g.progress!==d.progress||g.status!==d.status||JSON.stringify(g.currentSteps)!==JSON.stringify(d.currentSteps)){process.stdout.write("\r\x1B[K");let S="\u2588".repeat(Math.floor(d.progress/5))+"\u2591".repeat(20-Math.floor(d.progress/5)),R=d.status==="completed"?o.green:d.status==="failed"?o.red:d.status==="running"?o.yellow:o.gray;console.log(`  [${S}] ${d.progress}% - ${R(d.status)}`),d.currentSteps.length>0&&t.verbose&&console.log(o.gray(`    Running: ${d.currentSteps.join(", ")}`)),g=d}if(d.status==="completed"||d.status==="failed"||d.status==="cancelled")break;await new Promise(S=>setTimeout(S,500))}let p=w.workflowOrchestrator.getWorkflowStatus(a);if(p){console.log("");let d=p.duration||Date.now()-y;p.status==="completed"?(console.log(o.green("Workflow completed successfully")),console.log(o.gray(`   Duration: ${$(d)}`)),console.log(o.gray(`   Completed: ${p.completedSteps.length} stages`)),p.skippedSteps.length>0&&console.log(o.yellow(`   Skipped: ${p.skippedSteps.length} stages`))):p.status==="failed"?(console.log(o.red("Workflow failed")),console.log(o.red(`   Error: ${p.error}`)),console.log(o.gray(`   Failed stages: ${p.failedSteps.join(", ")}`))):console.log(o.yellow(`Workflow ${p.status}`))}console.log(""),await i(p?.status==="completed"?0:1);return}else console.log(o.green("Workflow execution started")),console.log(o.gray(`   Use 'aqe workflow status ${a}' to check progress`));console.log(""),await i(0)}catch(l){console.error(o.red(`
@@ -35,10 +35,10 @@ Workflow cancelled: ${n}
 `)):console.log(o.red(`
 Failed to cancel workflow: ${t.error.message}
 `)),await i(t.success?0:1)}catch(t){console.error(o.red(`
-Failed to cancel workflow:`),t),await i(1)}}),m.command("browser-list").description("List available browser workflow templates").action(async()=>{try{let{BrowserWorkflowTool:n}=await import("./browser-workflow-AWCQLQZK.js"),e=await new n().invoke({});if(e.success&&e.data){console.log(o.blue(`
+Failed to cancel workflow:`),t),await i(1)}}),m.command("browser-list").description("List available browser workflow templates").action(async()=>{try{let{BrowserWorkflowTool:n}=await import("./browser-workflow-AEMIS6PA.js"),e=await new n().invoke({});if(e.success&&e.data){console.log(o.blue(`
  Browser Workflow Templates:
 `));for(let u of e.data.availableTemplates)console.log(`  ${o.cyan(u)}`);console.log("")}else console.log(o.red(`Failed: ${e.error||"Unknown error"}`));await i(0)}catch(n){console.error(o.red(`
-Failed:`),n),await i(1)}}),m.command("browser-load [template]").description("Load and validate a browser workflow template or inline YAML").option("--yaml <yaml>","Inline YAML workflow definition").option("-v, --var <key=value>","Variable override (repeatable)",O,{}).option("-F, --format <format>","Output format (text|json)","text").option("-o, --output <path>","Write output to file").action(async(n,t)=>{try{let{BrowserWorkflowTool:e}=await import("./browser-workflow-AWCQLQZK.js"),{writeOutput:u,toJSON:l}=await import("./ci-output-FYNKONEQ.js"),s=new e,f={variables:t.var||{}};if(t.yaml)f.workflowYaml=t.yaml;else if(n)if(n.endsWith(".yaml")||n.endsWith(".yml")){let c=await import("fs"),g=(await import("path")).resolve(n);c.existsSync(g)||(console.log(o.red(`
+Failed:`),n),await i(1)}}),m.command("browser-load [template]").description("Load and validate a browser workflow template or inline YAML").option("--yaml <yaml>","Inline YAML workflow definition").option("-v, --var <key=value>","Variable override (repeatable)",O,{}).option("-F, --format <format>","Output format (text|json)","text").option("-o, --output <path>","Write output to file").action(async(n,t)=>{try{let{BrowserWorkflowTool:e}=await import("./browser-workflow-AEMIS6PA.js"),{writeOutput:u,toJSON:l}=await import("./ci-output-DPHTFIGX.js"),s=new e,f={variables:t.var||{}};if(t.yaml)f.workflowYaml=t.yaml;else if(n)if(n.endsWith(".yaml")||n.endsWith(".yml")){let c=await import("fs"),g=(await import("path")).resolve(n);c.existsSync(g)||(console.log(o.red(`
 File not found: ${g}
 `)),await i(1)),f.workflowYaml=c.readFileSync(g,"utf-8")}else f.templateName=n;else console.log(o.red(`
 Provide a template name or --yaml. Use "workflow browser-list" to see templates.

package/dist/cli/chunks/workflow-orchestrator-ZVFSNRYZ.js

@@ -0,0 +1,2 @@
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.3");process.exit(0)}
+import{a,b,c,d}from"./chunk-AEL4XJGJ.js";import"./chunk-DH5NWHH2.js";import"./chunk-7SWHW5AC.js";import"./chunk-OGARNKLS.js";import"./chunk-UGNTLSBL.js";import"./chunk-ASUXS4N4.js";import"./chunk-UTALYUMW.js";import"./chunk-NT6FYFJA.js";import"./chunk-7TW5UGDP.js";import"./chunk-D6PUDLJ4.js";import"./chunk-M3ONCPSU.js";import"./chunk-HVIFA73X.js";import"./chunk-CNQUU6CF.js";import"./chunk-POTVF6BY.js";import"./chunk-Z7UGEQ4G.js";import"./chunk-WSND64RL.js";import"./chunk-INVDDFJC.js";import"./chunk-FPFGN2Z5.js";import"./chunk-WLOHTLHO.js";import"./chunk-2GJJGO5D.js";import"./chunk-6TYTBQPV.js";import"./chunk-YTRGMILO.js";import"./chunk-Z7JPWXW2.js";import"./chunk-34Y4CIHD.js";import"./chunk-WSUYEVSY.js";export{b as DEFAULT_WORKFLOW_CONFIG,a as WorkflowEvents,c as WorkflowOrchestrator,d as createWorkflowOrchestrator};

package/dist/cli/chunks/wrappers-YVF5SQUN.js

@@ -0,0 +1,2 @@
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.3");process.exit(0)}
+import{a,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v as L,w as M,x as N}from"./chunk-YQ3ZW47V.js";import{a as v,b as w,c as x,d as y,e as z,f as A,g as B,h as C,i as D,j as E,k as F,l as G,m as H,n as I,o as J,p as K}from"./chunk-WTMLRMKW.js";import"./chunk-7SWHW5AC.js";import"./chunk-OGARNKLS.js";import"./chunk-UGNTLSBL.js";import"./chunk-ASUXS4N4.js";import"./chunk-UTALYUMW.js";import"./chunk-NT6FYFJA.js";import"./chunk-7TW5UGDP.js";import"./chunk-D6PUDLJ4.js";import"./chunk-M3ONCPSU.js";import"./chunk-HVIFA73X.js";import"./chunk-CNQUU6CF.js";import"./chunk-WSND64RL.js";import"./chunk-INVDDFJC.js";import"./chunk-FPFGN2Z5.js";import"./chunk-WLOHTLHO.js";import"./chunk-2GJJGO5D.js";import"./chunk-6TYTBQPV.js";import"./chunk-YTRGMILO.js";import"./chunk-Z7JPWXW2.js";import"./chunk-34Y4CIHD.js";import"./chunk-WSUYEVSY.js";export{z as GNNLayerFactory,i as QEFlashAttention,x as QEGNNEmbeddingIndex,y as QEGNNIndexFactory,a as QESONA,e as QE_FLASH_ATTENTION_CONFIG,g as QE_PERFORMANCE_TARGETS,f as QE_SONA_CONFIG,A as TensorCompressionFactory,u as batchComputeAttention,K as batchDifferentiableSearch,M as checkRuvectorPackagesAvailable,c as createDomainQESONA,j as createQEFlashAttention,b as createQESONA,D as getDifferentiableSearch,F as getGetCompressionLevel,E as getHierarchicalForward,G as getInit,h as getOptimalBlockConfig,k as getQEFlashAttentionConfig,n as getRuvectorDotProductAttention,m as getRuvectorFlashAttention,p as getRuvectorHyperbolicAttention,B as getRuvectorLayer,q as getRuvectorLinearAttention,r as getRuvectorMoEAttention,o as getRuvectorMultiHeadAttention,L as getRuvectorPackageVersions,C as getTensorCompress,l as getWorkloadTypes,N as initAllRuvectorPackages,w as initGNN,d as isAttentionAvailable,v as isGNNAvailable,s as toFloat32Array,H as toFloat32ArrayGNN,J as toIEmbedding,t as toNumberArrayAttn,I as toNumberArrayGNN};

package/dist/cli/commands/test.js

@@ -9,6 +9,8 @@ import { filterTestFilesForFramework, walkSourceFiles } from '../utils/file-disc
 import { writeOutput, toJSON, toJUnit, testRunToMarkdown } from '../utils/ci-output.js';
 import { writeQualityEvidence } from '../../domains/quality-assessment/quality-evidence.js';
 import { validateBehaviorExamples } from '../../domains/test-generation/services/behavior-example-validation.js';
+import { findProjectRoot } from '../../kernel/project-root.js';
+import { writeGeneratedTestFile } from '../utils/generated-test-writer.js';
 export function createTestCommand(context, cleanupAndExit, ensureInitialized) {
     const testCmd = new Command('test')
         .description('Test generation, execution, scheduling, and load testing')
@@ -20,6 +22,7 @@ export function createTestCommand(context, cleanupAndExit, ensureInitialized) {
         .option('-F, --format <format>', 'Output format (text|json|junit|markdown)', 'text')
         .option('-o, --output <path>', 'Write output to file')
         .option('--no-save', 'generate action: print the generated test code instead of writing test files beside the source (#925)')
+        .option('--force', 'generate action: overwrite existing test files instead of skipping them')
         .option('--git-ref <ref>', 'Git ref for schedule action (e.g., main, HEAD~3)')
         .option('--no-git-aware', 'Disable git-aware test selection (schedule action)')
         .option('--no-flaky', 'Disable flaky test tracking (schedule action)')
@@ -96,11 +99,16 @@ export function createTestCommand(context, cleanupAndExit, ensureInitialized) {
                         // Default text output
                         console.log(chalk.green(`Generated ${generated.tests.length} tests\n`));
                         console.log(chalk.cyan('  Tests:'));
-                        // #925: with --no-save the printed code is the only output, so
-                        // show every test instead of the first 10.
+                        // #925/#936: every generated test is handled, with or without
+                        // --no-save. A cap here used to drop tests past the 10th
+                        // without writing or printing them.
                         const noSave = options.save === false;
-                        const shown = noSave ? generated.tests : generated.tests.slice(0, 10);
-                        for (const test of shown) {
+                        // Files may only be written inside the project that owns the target.
+                        const fs = await import('fs');
+                        const projectRoot = findProjectRoot(fs.statSync(targetPath).isDirectory() ? targetPath : path.dirname(targetPath));
+                        let written = 0;
+                        let skipped = 0;
+                        for (const test of generated.tests) {
                             console.log(`    ${chalk.white(test.name)}`);
                             console.log(chalk.gray(`      Source: ${path.basename(test.sourceFile)}`));
                             console.log(chalk.gray(`      Assertions: ${test.assertions}`));
@@ -113,16 +121,26 @@ export function createTestCommand(context, cleanupAndExit, ensureInitialized) {
                                     continue;
                                 }
                                 console.log(chalk.gray(`      Test File: ${test.testFile}`));
-                                // Bug #295 fix: Write generated test code to disk
-                                const fs = await import('fs');
-                                const testDir = path.dirname(test.testFile);
-                                fs.mkdirSync(testDir, { recursive: true });
-                                fs.writeFileSync(test.testFile, test.testCode, 'utf-8');
-                                console.log(chalk.green(`      Written to: ${test.testFile}`));
+                                // Bug #295 fix: Write generated test code to disk, but never
+                                // outside the project or over an existing file without --force.
+                                const outcome = writeGeneratedTestFile(test.testFile, test.testCode, { projectRoot, force: options.force === true });
+                                if (outcome.status === 'written') {
+                                    console.log(chalk.green(`      Written to: ${outcome.path}`));
+                                    written++;
+                                }
+                                else if (outcome.status === 'exists') {
+                                    console.log(chalk.yellow(`      ${outcome.path} exists, skipped (use --force to overwrite)`));
+                                    skipped++;
+                                }
+                                else {
+                                    console.log(chalk.red(`      ${outcome.path} is outside the project root ${projectRoot}, skipped (not written)`));
+                                    skipped++;
+                                }
                             }
                         }
-                        if (!noSave && generated.tests.length > 10) {
-                            console.log(chalk.gray(`    ... and ${generated.tests.length - 10} more`));
+                        if (!noSave) {
+                            const skippedNote = skipped > 0 ? ` (${skipped} skipped)` : '';
+                            console.log(chalk.gray(`\n  Wrote ${written} of ${generated.tests.length} generated test files${skippedNote}.`));
                         }
                         console.log(`\n  Coverage Estimate: ${chalk.yellow(generated.coverageEstimate == null ? 'Unmeasured' : generated.coverageEstimate + '%')}`);
                         if (generated.patternsUsed.length > 0) {

package/dist/cli/utils/generated-test-writer.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Agentic QE v3 - Generated test file writer (#936 follow-up)
+ *
+ * `aqe test generate` writes each generated test beside its source. This
+ * module decides whether a single write is safe:
+ * - the resolved path must stay inside the project root, so a bad path
+ *   (for example from a directory named `my.ts-app`) can never create files
+ *   outside the project;
+ * - an existing file is never replaced unless the caller passed --force,
+ *   because generated files carry no marker that tells them apart from
+ *   hand-written tests.
+ *
+ * @module cli/utils/generated-test-writer
+ */
+export type GeneratedTestWriteStatus = 'written' | 'exists' | 'outside-project';
+export interface GeneratedTestWriteResult {
+    status: GeneratedTestWriteStatus;
+    /** Absolute path that was (or would have been) written. */
+    path: string;
+}
+export interface GeneratedTestWriteOptions {
+    /** Directory every written file must stay inside. */
+    projectRoot: string;
+    /** Overwrite an existing file instead of skipping it. */
+    force?: boolean;
+}
+/** True when `file` is inside `root` (never equal to it). */
+export declare function isInsideRoot(file: string, root: string): boolean;
+/**
+ * Write one generated test file if it is safe to do so.
+ *
+ * @returns what happened; nothing is written unless status is 'written'.
+ */
+export declare function writeGeneratedTestFile(testFile: string, testCode: string, options: GeneratedTestWriteOptions): GeneratedTestWriteResult;
+//# sourceMappingURL=generated-test-writer.d.ts.map

package/dist/cli/utils/generated-test-writer.js

@@ -0,0 +1,44 @@
+/**
+ * Agentic QE v3 - Generated test file writer (#936 follow-up)
+ *
+ * `aqe test generate` writes each generated test beside its source. This
+ * module decides whether a single write is safe:
+ * - the resolved path must stay inside the project root, so a bad path
+ *   (for example from a directory named `my.ts-app`) can never create files
+ *   outside the project;
+ * - an existing file is never replaced unless the caller passed --force,
+ *   because generated files carry no marker that tells them apart from
+ *   hand-written tests.
+ *
+ * @module cli/utils/generated-test-writer
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+/** True when `file` is inside `root` (never equal to it). */
+export function isInsideRoot(file, root) {
+    const rel = path.relative(path.resolve(root), path.resolve(file));
+    return rel !== '' && !rel.startsWith('..') && !path.isAbsolute(rel);
+}
+/**
+ * Write one generated test file if it is safe to do so.
+ *
+ * @returns what happened; nothing is written unless status is 'written'.
+ */
+export function writeGeneratedTestFile(testFile, testCode, options) {
+    const target = path.resolve(testFile);
+    if (!isInsideRoot(target, options.projectRoot)) {
+        return { status: 'outside-project', path: target };
+    }
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    try {
+        // 'wx' fails if the file exists, so the check and the write are atomic.
+        fs.writeFileSync(target, testCode, { encoding: 'utf-8', flag: options.force ? 'w' : 'wx' });
+    }
+    catch (error) {
+        if (error.code === 'EEXIST')
+            return { status: 'exists', path: target };
+        throw error;
+    }
+    return { status: 'written', path: target };
+}
+//# sourceMappingURL=generated-test-writer.js.map

package/dist/context/compiler.js

@@ -116,7 +116,10 @@ export class ContextCompiler {
         return { size: this.cache.size, ttlMs: this.cacheTtl };
     }
     buildCacheKey(request) {
-        return `${request.agentType}:${request.targetFiles.sort().join(',')}:${request.taskDescription.slice(0, 100)}`;
+        // JSON tuple: a ',' or ':' in a file name or agent type cannot shift fields (#914).
+        // Sort a copy so the caller's targetFiles array is not reordered.
+        const files = [...request.targetFiles].sort();
+        return JSON.stringify([request.agentType, files, request.taskDescription.slice(0, 100)]);
     }
     generateSummary(request, fragments, sources) {
         return [

package/dist/coordination/consensus/providers/ollama-provider.js

@@ -12,6 +12,7 @@ import { BaseModelProvider } from '../model-provider.js';
 import { CONSENSUS_CONSTANTS, OLLAMA_CONSTANTS } from '../../constants.js';
 import { toErrorMessage, toError } from '../../../shared/error-utils.js';
 import { resolveOllamaBaseUrl } from '../../../shared/llm/ollama-url.js';
+import { fetchWithResponseDeadline } from '../../../shared/llm/providers/response-deadline.js';
 // ============================================================================
 // Model Information
 // ============================================================================
@@ -102,13 +103,9 @@ export class OllamaModelProvider extends BaseModelProvider {
      */
     async listModels() {
         try {
-            const controller = new AbortController();
-            const timeoutId = setTimeout(() => controller.abort(), CONSENSUS_CONSTANTS.OLLAMA_CONNECTION_TEST_TIMEOUT_MS);
-            const response = await fetch(`${this.config.baseUrl}/api/tags`, {
-                method: 'GET',
-                signal: controller.signal,
-            });
-            clearTimeout(timeoutId);
+            // The deadline stays armed until the body is read (issue #961).
+            const timeoutMs = CONSENSUS_CONSTANTS.OLLAMA_CONNECTION_TEST_TIMEOUT_MS;
+            const response = await fetchWithResponseDeadline(`${this.config.baseUrl}/api/tags`, { method: 'GET' }, timeoutMs, () => new Error(`Ollama list models timed out after ${timeoutMs}ms`));
             if (!response.ok) {
                 throw new Error(`Failed to list models: ${response.status}`);
             }
@@ -233,27 +230,19 @@ export class OllamaModelProvider extends BaseModelProvider {
      * Make a request to Ollama API
      */
     async makeRequest(request, timeout) {
-        const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), timeout);
-        try {
-            const response = await fetch(`${this.config.baseUrl}/api/chat`, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                },
-                body: JSON.stringify(request),
-                signal: controller.signal,
-            });
-            clearTimeout(timeoutId);
-            if (!response.ok) {
-                const errorBody = await response.text();
-                throw new Error(`Ollama API error: ${response.status} - ${errorBody}`);
-            }
-            return (await response.json());
-        }
-        finally {
-            clearTimeout(timeoutId);
+        // One deadline covers headers and the whole body, error bodies included (issue #961).
+        const response = await fetchWithResponseDeadline(`${this.config.baseUrl}/api/chat`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify(request),
+        }, timeout, () => new Error(`Ollama request timed out after ${timeout}ms`));
+        if (!response.ok) {
+            const errorBody = await response.text();
+            throw new Error(`Ollama API error: ${response.status} - ${errorBody}`);
         }
+        return (await response.json());
     }
     /**
      * Check if an error is non-retryable

package/dist/coordination/consensus/providers/openrouter-provider.js

@@ -11,6 +11,7 @@
 import { BaseModelProvider } from '../model-provider.js';
 import { toErrorMessage, toError } from '../../../shared/error-utils.js';
 import { resolveModelPricing } from '../../../shared/llm/cost-tracker.js';
+import { fetchWithResponseDeadline } from '../../../shared/llm/providers/response-deadline.js';
 // ============================================================================
 // Model Cost and Tier Information
 // ============================================================================
@@ -286,31 +287,19 @@ export class OpenRouterModelProvider extends BaseModelProvider {
      * Make a request to OpenRouter API
      */
     async makeRequest(request, timeout) {
-        const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), timeout);
-        try {
-            const headers = {
-                Authorization: `Bearer ${this.config.apiKey}`,
-                'Content-Type': 'application/json',
-                'HTTP-Referer': this.config.siteUrl || 'https://github.com/agentic-qe',
-                'X-Title': this.config.appName || 'Agentic QE',
-            };
-            const response = await fetch('https://openrouter.ai/api/v1/chat/completions', {
-                method: 'POST',
-                headers,
-                body: JSON.stringify(request),
-                signal: controller.signal,
-            });
-            clearTimeout(timeoutId);
-            if (!response.ok) {
-                const errorBody = await response.text();
-                throw new Error(`OpenRouter API error: ${response.status} - ${errorBody}`);
-            }
-            return (await response.json());
-        }
-        finally {
-            clearTimeout(timeoutId);
+        const headers = {
+            Authorization: `Bearer ${this.config.apiKey}`,
+            'Content-Type': 'application/json',
+            'HTTP-Referer': this.config.siteUrl || 'https://github.com/agentic-qe',
+            'X-Title': this.config.appName || 'Agentic QE',
+        };
+        // One deadline covers headers and the whole body, error bodies included (issue #961).
+        const response = await fetchWithResponseDeadline('https://openrouter.ai/api/v1/chat/completions', { method: 'POST', headers, body: JSON.stringify(request) }, timeout, () => new Error(`OpenRouter request timed out after ${timeout}ms`));
+        if (!response.ok) {
+            const errorBody = await response.text();
+            throw new Error(`OpenRouter API error: ${response.status} - ${errorBody}`);
         }
+        return (await response.json());
     }
     /**
      * Check if an error is non-retryable

package/dist/coordination/handlers/test-execution-handlers.js

@@ -10,6 +10,7 @@ import { ok, err } from '../../shared/types/index.js';
 import { toError } from '../../shared/error-utils.js';
 import { getTestRunnerExecutionError, TestRunnerExecutionError } from '../../shared/test-runner-verdict.js';
 import { createVitestJsonReport } from '../../shared/vitest-json-report.js';
+import { jestExactPathPattern, runnerFilePath } from '../../shared/test-runner-args.js';
 function escapeRegExp(s) {
     return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
@@ -190,7 +191,8 @@ export function registerTestExecutionHandlers(ctx) {
             let execution;
             let output;
             try {
-                execution = spawnSync('npx', ['vitest', 'run', ...testFiles, '--reporter=json', ...report.args], options);
+                // #909: absolute paths cannot be read as flags (e.g. a "--watch" entry).
+                execution = spawnSync('npx', ['vitest', 'run', ...testFiles.map(file => runnerFilePath(file, options.cwd)), '--reporter=json', ...report.args], options);
                 output = execution.error || execution.signal
                     ? ''
                     : report.read(execution.stdout || '') ?? '';
@@ -201,7 +203,7 @@ export function registerTestExecutionHandlers(ctx) {
             // Preserve the existing Jest fallback when Vitest cannot produce a report.
             if (!output.includes('{') && execution.status !== 0 && !execution.error && !execution.signal) {
                 runner = 'jest';
-                execution = spawnSync('npx', ['jest', ...testFiles, '--json'], options);
+                execution = spawnSync('npx', ['jest', ...testFiles.map(file => jestExactPathPattern(file, options.cwd)), '--json'], options);
                 output = execution.stdout || '';
             }
             const diagnostics = [execution.error?.message, execution.signal && `Terminated by ${execution.signal}`, execution.stderr, output].filter(Boolean).join('\n');

package/dist/coordination/protocols/defect-investigation.js

@@ -11,6 +11,7 @@ import { ok, err, } from '../../shared/types/index.js';
 import { createEvent } from '../../shared/events/domain-events.js';
 import { toError } from '../../shared/error-utils.js';
 import { LoggerFactory } from '../../logging/index.js';
+import { addToCount } from '../../shared/utils/safe-record.js';
 const logger = LoggerFactory.create('defect-investigation');
 export const DefectInvestigationEvents = {
     DefectInvestigationStarted: 'coordination.DefectInvestigationStarted',
@@ -351,7 +352,9 @@ export class DefectInvestigationProtocol {
                     totalInvestigations: 0,
                 };
                 const pattern = result.rootCause.rootCause;
-                stats.patterns[pattern] = (stats.patterns[pattern] ?? 0) + 1;
+                // Root causes are free text and stats come back from storage as plain
+                // objects, so read and write own properties only (#914).
+                addToCount(stats.patterns, pattern);
                 stats.totalInvestigations += 1;
                 await this.memory.set(patternKey, stats, {
                     namespace: this.config.namespace,

package/dist/domains/code-intelligence/services/metric-collector/test-counter.js

@@ -274,10 +274,10 @@ function countCargoTests(projectPath, config) {
         // Count lines ending with ": test"
         const testLines = output.split('\n').filter(line => line.endsWith(': test'));
         const total = testLines.length;
-        // Classify by test path patterns
-        const unit = testLines.filter(t => !t.includes('integration') && !t.includes('e2e')).length;
-        const integration = testLines.filter(t => t.includes('integration')).length;
+        // Disjoint categories, e2e before integration: `tests::integration::e2e_x` counts once.
         const e2e = testLines.filter(t => t.includes('e2e')).length;
+        const integration = testLines.filter(t => !t.includes('e2e') && t.includes('integration')).length;
+        const unit = total - integration - e2e;
         return {
             total,
             unit,

package/dist/domains/coverage-analysis/services/gap-detector.js

@@ -9,6 +9,7 @@ import { ok, err } from '../../../shared/types/index.js';
 import { toError } from '../../../shared/error-utils.js';
 import { safeJsonParse } from '../../../shared/safe-json.js';
 import { getClaudeModelForTier } from '../../../shared/llm/model-registry.js';
+import { createSafeRecord } from '../../../shared/utils/safe-record.js';
 const DEFAULT_CONFIG = {
     minCoverage: 80,
     enableLLMAnalysis: true, // On by default - opt-out
@@ -212,7 +213,8 @@ Return JSON in this exact format:
      * Calculate effort breakdown by file
      */
     calculateEffortBreakdown(gaps) {
-        const breakdown = {};
+        // File paths are data, so the buckets must not inherit from Object.prototype (#914).
+        const breakdown = createSafeRecord();
         for (const gap of gaps) {
             const effort = Math.ceil(gap.lines.length / 15);
             breakdown[gap.file] = (breakdown[gap.file] || 0) + effort;

package/dist/domains/learning-optimization/services/learning-coordinator.js

@@ -9,6 +9,7 @@ import { rehydrateDates } from '../../../shared/utils/kv-date-rehydrate.js';
 import { toError } from '../../../shared/error-utils.js';
 import { createQEFlashAttention, } from '../../../integrations/ruvector/wrappers.js';
 import { getClaudeModelForTier } from '../../../shared/llm/model-registry.js';
+import { createSafeRecord } from '../../../shared/utils/safe-record.js';
 const DEFAULT_CONFIG = {
     minExperiencesForPattern: 5,
     patternConfidenceThreshold: 0.7,
@@ -943,8 +944,9 @@ Provide:
         return false;
     }
     calculateCentroid(experiences) {
-        const avgMetrics = {};
-        const metricCounts = {};
+        // Metric names come from stored experiences (#914).
+        const avgMetrics = createSafeRecord();
+        const metricCounts = createSafeRecord();
         for (const exp of experiences) {
             for (const [key, value] of Object.entries(exp.state.metrics)) {
                 avgMetrics[key] = (avgMetrics[key] || 0) + value;

package/dist/domains/test-execution/services/flaky-detector.js

@@ -13,6 +13,7 @@ import { toError } from '../../../shared/error-utils.js';
 import { safeJsonParse } from '../../../shared/safe-json.js';
 import { getTestRunnerExecutionError } from '../../../shared/test-runner-verdict.js';
 import { createVitestJsonReport, needsVitestJsonReportFile } from '../../../shared/vitest-json-report.js';
+import { isJestCommand, jestExactPathPattern, runnerFilePath } from '../../../shared/test-runner-args.js';
 import { secureRandom } from '../../../shared/utils/crypto-random.js';
 const DEFAULT_FLAKY_CONFIG = {
     simulateForTesting: false,
@@ -256,14 +257,19 @@ export class FlakyDetectorService {
         const runId = uuidv4();
         const startTime = Date.now();
         return new Promise((resolve, reject) => {
-            const baseArgs = [...this.config.testRunnerArgs, file];
+            const cwd = this.config.cwd ?? process.cwd();
+            // #909: pass an absolute path (never read as a flag); Jest reads it as a
+            // regex, so escape and anchor it to select exactly this file.
+            const fileArg = isJestCommand([this.config.testRunner, ...this.config.testRunnerArgs])
+                ? jestExactPathPattern(file, cwd)
+                : runnerFilePath(file, cwd);
+            const baseArgs = [...this.config.testRunnerArgs, fileArg];
             // Vitest 5 writes --reporter=json output to a file, not stdout. Detect
             // Vitest from the runner command too (testRunner: 'vitest', args: ['run', ...]).
             const report = needsVitestJsonReportFile([this.config.testRunner, ...baseArgs])
                 ? createVitestJsonReport()
                 : undefined;
             const args = report ? [...baseArgs, ...report.args] : baseArgs;
-            const cwd = this.config.cwd ?? process.cwd();
             const child = spawn(this.config.testRunner, args, {
                 cwd,
                 env: { ...process.env, ...this.config.env },

package/dist/domains/test-execution/services/retry-handler.js

@@ -5,6 +5,7 @@
 import { LoggerFactory } from '../../../logging/index.js';
 import { spawn } from 'node:child_process';
 import { createVitestJsonReport } from '../../../shared/vitest-json-report.js';
+import { jestExactPathPattern, nameFilterArg, runnerFilePath } from '../../../shared/test-runner-args.js';
 import { existsSync, readFileSync } from 'node:fs';
 import { ok, err } from '../../../shared/types/index.js';
 import { TEST_EXECUTION_CONSTANTS, RETRY_CONSTANTS } from '../../constants.js';
@@ -264,7 +265,7 @@ export class RetryHandlerService {
                 `or configure testRunner in RetryHandlerConfig. Cannot execute retry for: ${testFile}`);
         }
         // Build command based on runner
-        const { command, args, report } = this.buildTestCommand(runner, testFile, testName);
+        const { command, args, report } = this.buildTestCommand(runner, testFile, testName, cwd);
         // Execute the test
         return this.spawnTestProcess(command, args, cwd, report);
     }
@@ -334,40 +335,42 @@ export class RetryHandlerService {
     /**
      * Build the command and arguments for the test runner
      */
-    buildTestCommand(runner, testFile, testName) {
+    buildTestCommand(runner, testFile, testName, cwd = this.config.cwd ?? process.cwd()) {
         const npx = this.config.npxPath;
-        // These runners interpret name filters as regular expressions, but a
-        // FailedTest contains the literal assertion name from the previous run.
-        const namePattern = testName?.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') ?? '';
+        // A FailedTest holds the literal assertion name and path from the previous
+        // run. Name filters are regex-escaped and passed as --flag=value; file
+        // filters are absolute (Jest: escaped and anchored), so neither can be
+        // misread as a regex or as a flag when it starts with '-' (#886, #909).
+        const filterByName = Boolean(testName) && testName !== testFile;
         switch (runner) {
             case 'vitest':
-                // vitest run --reporter=json testFile -t "testName"
+                // vitest run --reporter=json <abs file> --testNamePattern=<name>
                 // --outputFile: Vitest 5 no longer prints the JSON report to stdout.
                 {
                     const report = createVitestJsonReport();
-                    const vitestArgs = ['vitest', 'run', '--reporter=json', testFile];
-                    if (testName && testName !== testFile) {
-                        vitestArgs.push('-t', namePattern);
-                    }
+                    const vitestArgs = ['vitest', 'run', '--reporter=json', runnerFilePath(testFile, cwd)];
+                    if (filterByName)
+                        vitestArgs.push(nameFilterArg('vitest', testName));
                     vitestArgs.push(...report.args);
                     return { command: npx, args: vitestArgs, report };
                 }
             case 'jest':
-                // jest --json testFile -t "testName"
+                // jest --json --testNamePattern=<name> ^<escaped abs file>$
+                // Positional TestPathPatterns work on Jest 29 and 30 (Jest 30 rejects
+                // the old --testPathPattern flag).
                 {
-                    const jestArgs = ['jest', '--json', '--testPathPattern', testFile];
-                    if (testName && testName !== testFile) {
-                        jestArgs.push('-t', namePattern);
-                    }
+                    const jestArgs = ['jest', '--json'];
+                    if (filterByName)
+                        jestArgs.push(nameFilterArg('jest', testName));
+                    jestArgs.push(jestExactPathPattern(testFile, cwd));
                     return { command: npx, args: jestArgs };
                 }
             case 'mocha':
-                // mocha --reporter json testFile --grep "testName"
+                // mocha --reporter json <abs file> --grep=<name>
                 {
-                    const mochaArgs = ['mocha', '--reporter', 'json', testFile];
-                    if (testName && testName !== testFile) {
-                        mochaArgs.push('--grep', namePattern);
-                    }
+                    const mochaArgs = ['mocha', '--reporter', 'json', runnerFilePath(testFile, cwd)];
+                    if (filterByName)
+                        mochaArgs.push(nameFilterArg('mocha', testName));
                     return { command: npx, args: mochaArgs };
                 }
             default:

package/dist/domains/test-execution/services/test-executor.js

@@ -16,6 +16,7 @@ import { secureRandom, secureRandomInt } from '../../../shared/utils/crypto-rand
 import { writeQualityEvidence } from '../../quality-assessment/quality-evidence.js';
 import { getTestRunnerExecutionError, TestRunnerExecutionError } from '../../../shared/test-runner-verdict.js';
 import { createVitestJsonReport } from '../../../shared/vitest-json-report.js';
+import { jestExactPathPattern, runnerFilePath } from '../../../shared/test-runner-args.js';
 import { getClaudeModelForTier } from '../../../shared/llm/model-registry.js';
 import { terminateTestRunner, trackTestRunnerExit } from '../../../shared/test-runner-process.js';
 const DEFAULT_CONFIG = {
@@ -481,7 +482,9 @@ Provide:
      * Build test command based on framework
      */
     buildTestCommand(fileOrFiles, framework) {
-        const files = Array.isArray(fileOrFiles) ? fileOrFiles : [fileOrFiles];
+        // #909: absolute paths never start with '-', so a file cannot be read as a
+        // flag; Jest's positional patterns are regexes, so escape and anchor them.
+        const files = (Array.isArray(fileOrFiles) ? fileOrFiles : [fileOrFiles]).map(file => runnerFilePath(file));
         const createCoverageDirectory = () => mkdtempSync(join(tmpdir(), 'aqe-test-coverage-'));
         switch (framework.toLowerCase()) {
             case 'vitest': {
@@ -507,7 +510,7 @@ Provide:
                 const coverageDirectory = createCoverageDirectory();
                 return {
                     command: 'npx',
-                    args: ['jest', ...files, '--json', '--no-colors', '--testLocationInResults', `--coverageDirectory=${coverageDirectory}`],
+                    args: ['jest', ...files.map(file => jestExactPathPattern(file)), '--json', '--no-colors', '--testLocationInResults', `--coverageDirectory=${coverageDirectory}`],
                     coverageDirectory,
                 };
             }

package/dist/domains/test-generation/services/test-generator.js

@@ -993,8 +993,11 @@ Return a JSON array of test suggestions, each with: { "name": "test name", "desc
         if (lang && lang !== 'typescript' && lang !== 'javascript') {
             return resolveTestFilePath(sourceFile, lang);
         }
-        const ext = sourceFile.split('.').pop() || 'ts';
-        const base = sourceFile.replace(`.${ext}`, '');
+        // #936 follow-up: strip only the trailing extension. A first-match
+        // replace turned /home/u/my.ts-app/src/a.ts into /home/u/my-app/src/a.ts,
+        // pointing the test file at a sibling directory outside the project.
+        const ext = fileExt ? fileExt.slice(1) : 'ts';
+        const base = fileExt ? sourceFile.slice(0, -fileExt.length) : sourceFile;
         if (framework === 'pytest') {
             return `test_${base.split('/').pop()}.py`;
         }