agentic-qe 3.15.2 → 3.15.4

package/dist/cli/chunks/{workflow-PYI6HCAG.js → workflow-M7TUYYXY.js}

@@ -1,5 +1,5 @@
-import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.2");process.exit(0)}
-import"./chunk-A6L2OCMO.js";import{b as $}from"./chunk-ATGIGJSL.js";import{a as k,b as W,c as v,g as C}from"./chunk-RLQ4MYB6.js";import{c as b}from"./chunk-URWT3EQT.js";import"./chunk-2AWU2E6R.js";import"./chunk-3KTAMNKI.js";import"./chunk-D75HDHX3.js";import{Command as D}from"commander";import o from"chalk";function O(w,i){let h=w.indexOf("=");return h>0&&(i[w.substring(0,h)]=w.substring(h+1)),i}function V(w,i,h){let m=new D("workflow").description("Manage QE workflows and pipelines (ADR-041)");return m.command("run <file>").description("Execute a QE pipeline from YAML file").option("-w, --watch","Watch execution progress").option("-v, --verbose","Show detailed output").option("--params <json>","Additional parameters as JSON","{}").action(async(n,t)=>{if(!await h())return;let u=(await import("path")).resolve(n);try{console.log(o.blue(`
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.4");process.exit(0)}
+import"./chunk-RA3MI5WK.js";import{b as $}from"./chunk-RJMBHZYL.js";import{a as k,b as W,c as v,g as C}from"./chunk-QIAX3JJB.js";import{c as b}from"./chunk-S5D3HCGN.js";import"./chunk-54XTJBHV.js";import"./chunk-JL3TI43V.js";import"./chunk-5H7MR6HP.js";import{Command as D}from"commander";import o from"chalk";function O(w,i){let h=w.indexOf("=");return h>0&&(i[w.substring(0,h)]=w.substring(h+1)),i}function V(w,i,h){let m=new D("workflow").description("Manage QE workflows and pipelines (ADR-041)");return m.command("run <file>").description("Execute a QE pipeline from YAML file").option("-w, --watch","Watch execution progress").option("-v, --verbose","Show detailed output").option("--params <json>","Additional parameters as JSON","{}").action(async(n,t)=>{if(!await h())return;let u=(await import("path")).resolve(n);try{console.log(o.blue(`
  Running workflow from: ${n}
 `));let l=k(u);if(!l.success||!l.workflow){console.log(o.red("Failed to parse pipeline:"));for(let g of l.errors)console.log(o.red(`   ${g}`));await i(1)}let f={...b(t.params,"params")};if(l.pipeline){for(let g of l.pipeline.stages)if(g.params)for(let[y,p]of Object.entries(g.params))f[y]=p}if(!w.workflowOrchestrator.getWorkflow(l.workflow.id)){let g=w.workflowOrchestrator.registerWorkflow(l.workflow);g.success||(console.log(o.red(`Failed to register workflow: ${g.error.message}`)),await i(1))}let c=await w.workflowOrchestrator.executeWorkflow(l.workflow.id,f);if(!c.success){console.log(o.red(`Failed to start workflow: ${c.error.message}`)),await i(1);return}let a=c.value;if(console.log(o.cyan(`  Execution ID: ${a}`)),console.log(o.gray(`  Workflow: ${l.workflow.name}`)),console.log(o.gray(`  Stages: ${l.workflow.steps.length}`)),console.log(""),t.watch){console.log(o.blue(`Workflow Progress:
 `));let g,y=Date.now();for(;;){let d=w.workflowOrchestrator.getWorkflowStatus(a);if(!d)break;if(!g||g.progress!==d.progress||g.status!==d.status||JSON.stringify(g.currentSteps)!==JSON.stringify(d.currentSteps)){process.stdout.write("\r\x1B[K");let S="\u2588".repeat(Math.floor(d.progress/5))+"\u2591".repeat(20-Math.floor(d.progress/5)),R=d.status==="completed"?o.green:d.status==="failed"?o.red:d.status==="running"?o.yellow:o.gray;console.log(`  [${S}] ${d.progress}% - ${R(d.status)}`),d.currentSteps.length>0&&t.verbose&&console.log(o.gray(`    Running: ${d.currentSteps.join(", ")}`)),g=d}if(d.status==="completed"||d.status==="failed"||d.status==="cancelled")break;await new Promise(S=>setTimeout(S,500))}let p=w.workflowOrchestrator.getWorkflowStatus(a);if(p){console.log("");let d=p.duration||Date.now()-y;p.status==="completed"?(console.log(o.green("Workflow completed successfully")),console.log(o.gray(`   Duration: ${$(d)}`)),console.log(o.gray(`   Completed: ${p.completedSteps.length} stages`)),p.skippedSteps.length>0&&console.log(o.yellow(`   Skipped: ${p.skippedSteps.length} stages`))):p.status==="failed"?(console.log(o.red("Workflow failed")),console.log(o.red(`   Error: ${p.error}`)),console.log(o.gray(`   Failed stages: ${p.failedSteps.join(", ")}`))):console.log(o.yellow(`Workflow ${p.status}`))}console.log(""),await i(p?.status==="completed"?0:1);return}else console.log(o.green("Workflow execution started")),console.log(o.gray(`   Use 'aqe workflow status ${a}' to check progress`));console.log(""),await i(0)}catch(l){console.error(o.red(`
@@ -10,7 +10,7 @@ Note: Scheduled workflows require daemon mode to run automatically`)),console.lo
 Failed to schedule workflow:`),l),await i(1)}}),m.command("list").description("List workflows").option("-s, --scheduled","Show only scheduled workflows").option("-a, --active","Show only active executions").option("--all","Show all workflows (registered + scheduled + active)").action(async n=>{if(await h())try{if(console.log(o.blue(`
 Workflows
 `)),n.scheduled||n.all){console.log(o.cyan("Scheduled Workflows:"));let t=await w.persistentScheduler.getSchedules();if(t.length===0)console.log(o.gray(`  No scheduled workflows
-`));else for(let e of t){let u=e.enabled?o.green("*"):o.gray("o");console.log(`  ${u} ${o.white(e.workflowId)}`),console.log(o.gray(`     ID: ${e.id}`)),console.log(o.gray(`     Schedule: ${e.schedule} (${e.scheduleDescription})`)),console.log(o.gray(`     File: ${e.pipelinePath}`)),console.log(o.gray(`     Next run: ${e.nextRun}`)),e.lastRun&&console.log(o.gray(`     Last run: ${e.lastRun}`)),console.log(o.gray(`     Status: ${e.enabled?o.green("enabled"):o.yellow("disabled")}`)),console.log("")}}if(n.active||n.all){console.log(o.cyan("Active Executions:"));let t=w.workflowOrchestrator.getActiveExecutions();if(t.length===0)console.log(o.gray(`  No active executions
+`));else for(let e of t){let u=e.enabled?o.green("*"):o.gray("o");console.log(`  ${u} ${o.white(e.workflowId)}`),console.log(o.gray(`     ID: ${e.id}`)),console.log(o.gray(`     Schedule: ${e.schedule} (${e.scheduleDescription})`)),console.log(o.gray(`     File: ${e.pipelinePath}`)),console.log(o.gray(`     Next run: ${e.nextRun}`)),e.lastRun&&console.log(o.gray(`     Last run: ${e.lastRun}`)),console.log(o.gray(`     Status: ${e.enabled?o.green("enabled"):o.yellow("disabled")}`)),e.disabledReason&&console.log(o.yellow(`     Reason: ${e.disabledReason}`)),console.log("")}}if(n.active||n.all){console.log(o.cyan("Active Executions:"));let t=w.workflowOrchestrator.getActiveExecutions();if(t.length===0)console.log(o.gray(`  No active executions
 `));else for(let e of t){let u=e.status==="running"?o.yellow:o.gray;console.log(`  ${u("*")} ${o.white(e.workflowName)}`),console.log(o.gray(`     Execution: ${e.executionId}`)),console.log(o.gray(`     Status: ${e.status}`)),console.log(o.gray(`     Progress: ${e.progress}%`)),e.currentSteps.length>0&&console.log(o.gray(`     Current: ${e.currentSteps.join(", ")}`)),console.log("")}}if(!n.scheduled&&!n.active||n.all){console.log(o.cyan("Registered Workflows:"));let t=w.workflowOrchestrator.listWorkflows();if(t.length===0)console.log(o.gray(`  No registered workflows
 `));else for(let e of t)console.log(`  ${o.white(e.name)} (${o.cyan(e.id)})`),console.log(o.gray(`     Version: ${e.version}`)),console.log(o.gray(`     Steps: ${e.stepCount}`)),e.description&&console.log(o.gray(`     ${e.description}`)),e.tags&&e.tags.length>0&&console.log(o.gray(`     Tags: ${e.tags.join(", ")}`)),e.triggers&&e.triggers.length>0&&console.log(o.gray(`     Triggers: ${e.triggers.join(", ")}`)),console.log("")}await i(0)}catch(t){console.error(o.red(`
 Failed to list workflows:`),t),await i(1)}}),m.command("validate <file>").description("Validate a pipeline YAML file").option("-v, --verbose","Show detailed validation results").action(async(n,t)=>{let e=await import("fs"),l=(await import("path")).resolve(n);try{console.log(o.blue(`
@@ -35,10 +35,10 @@ Workflow cancelled: ${n}
 `)):console.log(o.red(`
 Failed to cancel workflow: ${t.error.message}
 `)),await i(t.success?0:1)}catch(t){console.error(o.red(`
-Failed to cancel workflow:`),t),await i(1)}}),m.command("browser-list").description("List available browser workflow templates").action(async()=>{try{let{BrowserWorkflowTool:n}=await import("./browser-workflow-AWCQLQZK.js"),e=await new n().invoke({});if(e.success&&e.data){console.log(o.blue(`
+Failed to cancel workflow:`),t),await i(1)}}),m.command("browser-list").description("List available browser workflow templates").action(async()=>{try{let{BrowserWorkflowTool:n}=await import("./browser-workflow-6M6VLWRF.js"),e=await new n().invoke({});if(e.success&&e.data){console.log(o.blue(`
  Browser Workflow Templates:
 `));for(let u of e.data.availableTemplates)console.log(`  ${o.cyan(u)}`);console.log("")}else console.log(o.red(`Failed: ${e.error||"Unknown error"}`));await i(0)}catch(n){console.error(o.red(`
-Failed:`),n),await i(1)}}),m.command("browser-load [template]").description("Load and validate a browser workflow template or inline YAML").option("--yaml <yaml>","Inline YAML workflow definition").option("-v, --var <key=value>","Variable override (repeatable)",O,{}).option("-F, --format <format>","Output format (text|json)","text").option("-o, --output <path>","Write output to file").action(async(n,t)=>{try{let{BrowserWorkflowTool:e}=await import("./browser-workflow-AWCQLQZK.js"),{writeOutput:u,toJSON:l}=await import("./ci-output-FYNKONEQ.js"),s=new e,f={variables:t.var||{}};if(t.yaml)f.workflowYaml=t.yaml;else if(n)if(n.endsWith(".yaml")||n.endsWith(".yml")){let c=await import("fs"),g=(await import("path")).resolve(n);c.existsSync(g)||(console.log(o.red(`
+Failed:`),n),await i(1)}}),m.command("browser-load [template]").description("Load and validate a browser workflow template or inline YAML").option("--yaml <yaml>","Inline YAML workflow definition").option("-v, --var <key=value>","Variable override (repeatable)",O,{}).option("-F, --format <format>","Output format (text|json)","text").option("-o, --output <path>","Write output to file").action(async(n,t)=>{try{let{BrowserWorkflowTool:e}=await import("./browser-workflow-6M6VLWRF.js"),{writeOutput:u,toJSON:l}=await import("./ci-output-BMJABAEX.js"),s=new e,f={variables:t.var||{}};if(t.yaml)f.workflowYaml=t.yaml;else if(n)if(n.endsWith(".yaml")||n.endsWith(".yml")){let c=await import("fs"),g=(await import("path")).resolve(n);c.existsSync(g)||(console.log(o.red(`
 File not found: ${g}
 `)),await i(1)),f.workflowYaml=c.readFileSync(g,"utf-8")}else f.templateName=n;else console.log(o.red(`
 Provide a template name or --yaml. Use "workflow browser-list" to see templates.

package/dist/cli/chunks/workflow-orchestrator-OFTAR2NA.js

@@ -0,0 +1,2 @@
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.4");process.exit(0)}
+import{a,b,c,d}from"./chunk-CQ3WSTJ2.js";import"./chunk-V3NZ23X6.js";import"./chunk-BY5PLEPZ.js";import"./chunk-FRBCX46J.js";import"./chunk-S5D3HCGN.js";import"./chunk-6HTO4BLV.js";import"./chunk-HCDTLV5J.js";import"./chunk-RJ5CZ7B6.js";import"./chunk-W6TJXK5Y.js";import"./chunk-NIJMLEAX.js";import"./chunk-OG4KHX7S.js";import"./chunk-RB2SL5GD.js";import"./chunk-33IUCP34.js";import"./chunk-PEA4DVXW.js";import"./chunk-54XTJBHV.js";import"./chunk-WW6WUMS7.js";import"./chunk-5XXLWJU7.js";import"./chunk-LXYTC62V.js";import"./chunk-Z56QTRRB.js";import"./chunk-JL3TI43V.js";import"./chunk-K2VUYRMG.js";import"./chunk-O7TMY4GS.js";import"./chunk-WO4NSPLX.js";import"./chunk-X5S5UEM6.js";import"./chunk-5H7MR6HP.js";export{b as DEFAULT_WORKFLOW_CONFIG,a as WorkflowEvents,c as WorkflowOrchestrator,d as createWorkflowOrchestrator};

package/dist/cli/chunks/wrappers-COU73OQ6.js

@@ -0,0 +1,2 @@
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.4");process.exit(0)}
+import{a,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v as L,w as M,x as N}from"./chunk-SZWXUG36.js";import{a as v,b as w,c as x,d as y,e as z,f as A,g as B,h as C,i as D,j as E,k as F,l as G,m as H,n as I,o as J,p as K}from"./chunk-LGA6J4I4.js";import"./chunk-BY5PLEPZ.js";import"./chunk-FRBCX46J.js";import"./chunk-S5D3HCGN.js";import"./chunk-6HTO4BLV.js";import"./chunk-HCDTLV5J.js";import"./chunk-RJ5CZ7B6.js";import"./chunk-W6TJXK5Y.js";import"./chunk-NIJMLEAX.js";import"./chunk-OG4KHX7S.js";import"./chunk-RB2SL5GD.js";import"./chunk-33IUCP34.js";import"./chunk-WW6WUMS7.js";import"./chunk-5XXLWJU7.js";import"./chunk-LXYTC62V.js";import"./chunk-Z56QTRRB.js";import"./chunk-JL3TI43V.js";import"./chunk-K2VUYRMG.js";import"./chunk-O7TMY4GS.js";import"./chunk-WO4NSPLX.js";import"./chunk-X5S5UEM6.js";import"./chunk-5H7MR6HP.js";export{z as GNNLayerFactory,i as QEFlashAttention,x as QEGNNEmbeddingIndex,y as QEGNNIndexFactory,a as QESONA,e as QE_FLASH_ATTENTION_CONFIG,g as QE_PERFORMANCE_TARGETS,f as QE_SONA_CONFIG,A as TensorCompressionFactory,u as batchComputeAttention,K as batchDifferentiableSearch,M as checkRuvectorPackagesAvailable,c as createDomainQESONA,j as createQEFlashAttention,b as createQESONA,D as getDifferentiableSearch,F as getGetCompressionLevel,E as getHierarchicalForward,G as getInit,h as getOptimalBlockConfig,k as getQEFlashAttentionConfig,n as getRuvectorDotProductAttention,m as getRuvectorFlashAttention,p as getRuvectorHyperbolicAttention,B as getRuvectorLayer,q as getRuvectorLinearAttention,r as getRuvectorMoEAttention,o as getRuvectorMultiHeadAttention,L as getRuvectorPackageVersions,C as getTensorCompress,l as getWorkloadTypes,N as initAllRuvectorPackages,w as initGNN,d as isAttentionAvailable,v as isGNNAvailable,s as toFloat32Array,H as toFloat32ArrayGNN,J as toIEmbedding,t as toNumberArrayAttn,I as toNumberArrayGNN};

package/dist/cli/commands/test.js

@@ -9,6 +9,8 @@ import { filterTestFilesForFramework, walkSourceFiles } from '../utils/file-disc
 import { writeOutput, toJSON, toJUnit, testRunToMarkdown } from '../utils/ci-output.js';
 import { writeQualityEvidence } from '../../domains/quality-assessment/quality-evidence.js';
 import { validateBehaviorExamples } from '../../domains/test-generation/services/behavior-example-validation.js';
+import { findProjectRoot } from '../../kernel/project-root.js';
+import { writeGeneratedTestFile } from '../utils/generated-test-writer.js';
 export function createTestCommand(context, cleanupAndExit, ensureInitialized) {
     const testCmd = new Command('test')
         .description('Test generation, execution, scheduling, and load testing')
@@ -20,6 +22,7 @@ export function createTestCommand(context, cleanupAndExit, ensureInitialized) {
         .option('-F, --format <format>', 'Output format (text|json|junit|markdown)', 'text')
         .option('-o, --output <path>', 'Write output to file')
         .option('--no-save', 'generate action: print the generated test code instead of writing test files beside the source (#925)')
+        .option('--force', 'generate action: overwrite existing test files instead of skipping them')
         .option('--git-ref <ref>', 'Git ref for schedule action (e.g., main, HEAD~3)')
         .option('--no-git-aware', 'Disable git-aware test selection (schedule action)')
         .option('--no-flaky', 'Disable flaky test tracking (schedule action)')
@@ -96,11 +99,16 @@ export function createTestCommand(context, cleanupAndExit, ensureInitialized) {
                         // Default text output
                         console.log(chalk.green(`Generated ${generated.tests.length} tests\n`));
                         console.log(chalk.cyan('  Tests:'));
-                        // #925: with --no-save the printed code is the only output, so
-                        // show every test instead of the first 10.
+                        // #925/#936: every generated test is handled, with or without
+                        // --no-save. A cap here used to drop tests past the 10th
+                        // without writing or printing them.
                         const noSave = options.save === false;
-                        const shown = noSave ? generated.tests : generated.tests.slice(0, 10);
-                        for (const test of shown) {
+                        // Files may only be written inside the project that owns the target.
+                        const fs = await import('fs');
+                        const projectRoot = findProjectRoot(fs.statSync(targetPath).isDirectory() ? targetPath : path.dirname(targetPath));
+                        let written = 0;
+                        let skipped = 0;
+                        for (const test of generated.tests) {
                             console.log(`    ${chalk.white(test.name)}`);
                             console.log(chalk.gray(`      Source: ${path.basename(test.sourceFile)}`));
                             console.log(chalk.gray(`      Assertions: ${test.assertions}`));
@@ -113,16 +121,26 @@ export function createTestCommand(context, cleanupAndExit, ensureInitialized) {
                                     continue;
                                 }
                                 console.log(chalk.gray(`      Test File: ${test.testFile}`));
-                                // Bug #295 fix: Write generated test code to disk
-                                const fs = await import('fs');
-                                const testDir = path.dirname(test.testFile);
-                                fs.mkdirSync(testDir, { recursive: true });
-                                fs.writeFileSync(test.testFile, test.testCode, 'utf-8');
-                                console.log(chalk.green(`      Written to: ${test.testFile}`));
+                                // Bug #295 fix: Write generated test code to disk, but never
+                                // outside the project or over an existing file without --force.
+                                const outcome = writeGeneratedTestFile(test.testFile, test.testCode, { projectRoot, force: options.force === true });
+                                if (outcome.status === 'written') {
+                                    console.log(chalk.green(`      Written to: ${outcome.path}`));
+                                    written++;
+                                }
+                                else if (outcome.status === 'exists') {
+                                    console.log(chalk.yellow(`      ${outcome.path} exists, skipped (use --force to overwrite)`));
+                                    skipped++;
+                                }
+                                else {
+                                    console.log(chalk.red(`      ${outcome.path} is outside the project root ${projectRoot}, skipped (not written)`));
+                                    skipped++;
+                                }
                             }
                         }
-                        if (!noSave && generated.tests.length > 10) {
-                            console.log(chalk.gray(`    ... and ${generated.tests.length - 10} more`));
+                        if (!noSave) {
+                            const skippedNote = skipped > 0 ? ` (${skipped} skipped)` : '';
+                            console.log(chalk.gray(`\n  Wrote ${written} of ${generated.tests.length} generated test files${skippedNote}.`));
                         }
                         console.log(`\n  Coverage Estimate: ${chalk.yellow(generated.coverageEstimate == null ? 'Unmeasured' : generated.coverageEstimate + '%')}`);
                         if (generated.patternsUsed.length > 0) {

package/dist/cli/commands/workflow.js

@@ -238,6 +238,9 @@ export function createWorkflowCommand(context, cleanupAndExit, ensureInitialized
                             console.log(chalk.gray(`     Last run: ${sched.lastRun}`));
                         }
                         console.log(chalk.gray(`     Status: ${sched.enabled ? chalk.green('enabled') : chalk.yellow('disabled')}`));
+                        if (sched.disabledReason) {
+                            console.log(chalk.yellow(`     Reason: ${sched.disabledReason}`));
+                        }
                         console.log('');
                     }
                 }

package/dist/cli/scheduler/persistent-scheduler.d.ts

@@ -32,6 +32,8 @@ export interface PersistedSchedule {
     lastRun?: string;
     /** Whether the schedule is active */
     enabled: boolean;
+    /** Derived load diagnostic for a disabled legacy cron expression. */
+    disabledReason?: string;
     /** ISO date string when schedule was created */
     createdAt: string;
 }

package/dist/cli/scheduler/persistent-scheduler.js

@@ -16,7 +16,7 @@ import { randomUUID } from 'crypto';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
-import { calculateNextRun } from '../utils/workflow-parser.js';
+import { calculateNextRun, isValidCronExpression } from '../utils/workflow-parser.js';
 import { safeJsonParse } from '../../shared/safe-json.js';
 import { toErrorMessage } from '../../shared/error-utils.js';
 // ============================================================================
@@ -294,9 +294,19 @@ export class PersistentScheduler {
         }
         // Validate each schedule has required fields
         for (const schedule of data.schedules) {
-            if (!schedule.id || !schedule.workflowId || !schedule.schedule) {
+            if (!schedule.id || !schedule.workflowId || !Object.prototype.hasOwnProperty.call(schedule, 'schedule')) {
                 throw new Error(`Invalid schedule entry: missing required fields`);
             }
+            if (typeof schedule.schedule !== 'string' || !isValidCronExpression(schedule.schedule)) {
+                schedule.disabledReason = `Invalid cron expression: ${schedule.schedule}`;
+                if (schedule.enabled) {
+                    console.warn(`[PersistentScheduler] Disabled schedule ${schedule.id}: ${schedule.disabledReason}`);
+                }
+                schedule.enabled = false;
+            }
+            else {
+                delete schedule.disabledReason;
+            }
         }
         return data;
     }

package/dist/cli/utils/generated-test-writer.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Agentic QE v3 - Generated test file writer (#936 follow-up)
+ *
+ * `aqe test generate` writes each generated test beside its source. This
+ * module decides whether a single write is safe:
+ * - the resolved path must stay inside the project root, so a bad path
+ *   (for example from a directory named `my.ts-app`) can never create files
+ *   outside the project;
+ * - an existing file is never replaced unless the caller passed --force,
+ *   because generated files carry no marker that tells them apart from
+ *   hand-written tests.
+ *
+ * @module cli/utils/generated-test-writer
+ */
+export type GeneratedTestWriteStatus = 'written' | 'exists' | 'outside-project';
+export interface GeneratedTestWriteResult {
+    status: GeneratedTestWriteStatus;
+    /** Absolute path that was (or would have been) written. */
+    path: string;
+}
+export interface GeneratedTestWriteOptions {
+    /** Directory every written file must stay inside. */
+    projectRoot: string;
+    /** Overwrite an existing file instead of skipping it. */
+    force?: boolean;
+}
+/** True when `file` is inside `root` (never equal to it). */
+export declare function isInsideRoot(file: string, root: string): boolean;
+/**
+ * Write one generated test file if it is safe to do so.
+ *
+ * @returns what happened; nothing is written unless status is 'written'.
+ */
+export declare function writeGeneratedTestFile(testFile: string, testCode: string, options: GeneratedTestWriteOptions): GeneratedTestWriteResult;
+//# sourceMappingURL=generated-test-writer.d.ts.map

package/dist/cli/utils/generated-test-writer.js

@@ -0,0 +1,44 @@
+/**
+ * Agentic QE v3 - Generated test file writer (#936 follow-up)
+ *
+ * `aqe test generate` writes each generated test beside its source. This
+ * module decides whether a single write is safe:
+ * - the resolved path must stay inside the project root, so a bad path
+ *   (for example from a directory named `my.ts-app`) can never create files
+ *   outside the project;
+ * - an existing file is never replaced unless the caller passed --force,
+ *   because generated files carry no marker that tells them apart from
+ *   hand-written tests.
+ *
+ * @module cli/utils/generated-test-writer
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+/** True when `file` is inside `root` (never equal to it). */
+export function isInsideRoot(file, root) {
+    const rel = path.relative(path.resolve(root), path.resolve(file));
+    return rel !== '' && !rel.startsWith('..') && !path.isAbsolute(rel);
+}
+/**
+ * Write one generated test file if it is safe to do so.
+ *
+ * @returns what happened; nothing is written unless status is 'written'.
+ */
+export function writeGeneratedTestFile(testFile, testCode, options) {
+    const target = path.resolve(testFile);
+    if (!isInsideRoot(target, options.projectRoot)) {
+        return { status: 'outside-project', path: target };
+    }
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    try {
+        // 'wx' fails if the file exists, so the check and the write are atomic.
+        fs.writeFileSync(target, testCode, { encoding: 'utf-8', flag: options.force ? 'w' : 'wx' });
+    }
+    catch (error) {
+        if (error.code === 'EEXIST')
+            return { status: 'exists', path: target };
+        throw error;
+    }
+    return { status: 'written', path: target };
+}
+//# sourceMappingURL=generated-test-writer.js.map

package/dist/context/compiler.js

@@ -116,7 +116,10 @@ export class ContextCompiler {
         return { size: this.cache.size, ttlMs: this.cacheTtl };
     }
     buildCacheKey(request) {
-        return `${request.agentType}:${request.targetFiles.sort().join(',')}:${request.taskDescription.slice(0, 100)}`;
+        // JSON tuple: a ',' or ':' in a file name or agent type cannot shift fields (#914).
+        // Sort a copy so the caller's targetFiles array is not reordered.
+        const files = [...request.targetFiles].sort();
+        return JSON.stringify([request.agentType, files, request.taskDescription.slice(0, 100)]);
     }
     generateSummary(request, fragments, sources) {
         return [

package/dist/coordination/consensus/providers/ollama-provider.js

@@ -12,6 +12,7 @@ import { BaseModelProvider } from '../model-provider.js';
 import { CONSENSUS_CONSTANTS, OLLAMA_CONSTANTS } from '../../constants.js';
 import { toErrorMessage, toError } from '../../../shared/error-utils.js';
 import { resolveOllamaBaseUrl } from '../../../shared/llm/ollama-url.js';
+import { fetchWithResponseDeadline } from '../../../shared/llm/providers/response-deadline.js';
 // ============================================================================
 // Model Information
 // ============================================================================
@@ -102,13 +103,9 @@ export class OllamaModelProvider extends BaseModelProvider {
      */
     async listModels() {
         try {
-            const controller = new AbortController();
-            const timeoutId = setTimeout(() => controller.abort(), CONSENSUS_CONSTANTS.OLLAMA_CONNECTION_TEST_TIMEOUT_MS);
-            const response = await fetch(`${this.config.baseUrl}/api/tags`, {
-                method: 'GET',
-                signal: controller.signal,
-            });
-            clearTimeout(timeoutId);
+            // The deadline stays armed until the body is read (issue #961).
+            const timeoutMs = CONSENSUS_CONSTANTS.OLLAMA_CONNECTION_TEST_TIMEOUT_MS;
+            const response = await fetchWithResponseDeadline(`${this.config.baseUrl}/api/tags`, { method: 'GET' }, timeoutMs, () => new Error(`Ollama list models timed out after ${timeoutMs}ms`));
             if (!response.ok) {
                 throw new Error(`Failed to list models: ${response.status}`);
             }
@@ -233,27 +230,19 @@ export class OllamaModelProvider extends BaseModelProvider {
      * Make a request to Ollama API
      */
     async makeRequest(request, timeout) {
-        const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), timeout);
-        try {
-            const response = await fetch(`${this.config.baseUrl}/api/chat`, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                },
-                body: JSON.stringify(request),
-                signal: controller.signal,
-            });
-            clearTimeout(timeoutId);
-            if (!response.ok) {
-                const errorBody = await response.text();
-                throw new Error(`Ollama API error: ${response.status} - ${errorBody}`);
-            }
-            return (await response.json());
-        }
-        finally {
-            clearTimeout(timeoutId);
+        // One deadline covers headers and the whole body, error bodies included (issue #961).
+        const response = await fetchWithResponseDeadline(`${this.config.baseUrl}/api/chat`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify(request),
+        }, timeout, () => new Error(`Ollama request timed out after ${timeout}ms`));
+        if (!response.ok) {
+            const errorBody = await response.text();
+            throw new Error(`Ollama API error: ${response.status} - ${errorBody}`);
         }
+        return (await response.json());
     }
     /**
      * Check if an error is non-retryable

package/dist/coordination/consensus/providers/openrouter-provider.js

@@ -11,6 +11,7 @@
 import { BaseModelProvider } from '../model-provider.js';
 import { toErrorMessage, toError } from '../../../shared/error-utils.js';
 import { resolveModelPricing } from '../../../shared/llm/cost-tracker.js';
+import { fetchWithResponseDeadline } from '../../../shared/llm/providers/response-deadline.js';
 // ============================================================================
 // Model Cost and Tier Information
 // ============================================================================
@@ -286,31 +287,19 @@ export class OpenRouterModelProvider extends BaseModelProvider {
      * Make a request to OpenRouter API
      */
     async makeRequest(request, timeout) {
-        const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), timeout);
-        try {
-            const headers = {
-                Authorization: `Bearer ${this.config.apiKey}`,
-                'Content-Type': 'application/json',
-                'HTTP-Referer': this.config.siteUrl || 'https://github.com/agentic-qe',
-                'X-Title': this.config.appName || 'Agentic QE',
-            };
-            const response = await fetch('https://openrouter.ai/api/v1/chat/completions', {
-                method: 'POST',
-                headers,
-                body: JSON.stringify(request),
-                signal: controller.signal,
-            });
-            clearTimeout(timeoutId);
-            if (!response.ok) {
-                const errorBody = await response.text();
-                throw new Error(`OpenRouter API error: ${response.status} - ${errorBody}`);
-            }
-            return (await response.json());
-        }
-        finally {
-            clearTimeout(timeoutId);
+        const headers = {
+            Authorization: `Bearer ${this.config.apiKey}`,
+            'Content-Type': 'application/json',
+            'HTTP-Referer': this.config.siteUrl || 'https://github.com/agentic-qe',
+            'X-Title': this.config.appName || 'Agentic QE',
+        };
+        // One deadline covers headers and the whole body, error bodies included (issue #961).
+        const response = await fetchWithResponseDeadline('https://openrouter.ai/api/v1/chat/completions', { method: 'POST', headers, body: JSON.stringify(request) }, timeout, () => new Error(`OpenRouter request timed out after ${timeout}ms`));
+        if (!response.ok) {
+            const errorBody = await response.text();
+            throw new Error(`OpenRouter API error: ${response.status} - ${errorBody}`);
         }
+        return (await response.json());
     }
     /**
      * Check if an error is non-retryable

package/dist/coordination/handlers/test-execution-handlers.js

@@ -10,6 +10,7 @@ import { ok, err } from '../../shared/types/index.js';
 import { toError } from '../../shared/error-utils.js';
 import { getTestRunnerExecutionError, TestRunnerExecutionError } from '../../shared/test-runner-verdict.js';
 import { createVitestJsonReport } from '../../shared/vitest-json-report.js';
+import { jestExactPathPattern, runnerFilePath } from '../../shared/test-runner-args.js';
 function escapeRegExp(s) {
     return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
@@ -190,7 +191,8 @@ export function registerTestExecutionHandlers(ctx) {
             let execution;
             let output;
             try {
-                execution = spawnSync('npx', ['vitest', 'run', ...testFiles, '--reporter=json', ...report.args], options);
+                // #909: absolute paths cannot be read as flags (e.g. a "--watch" entry).
+                execution = spawnSync('npx', ['vitest', 'run', ...testFiles.map(file => runnerFilePath(file, options.cwd)), '--reporter=json', ...report.args], options);
                 output = execution.error || execution.signal
                     ? ''
                     : report.read(execution.stdout || '') ?? '';
@@ -201,7 +203,7 @@ export function registerTestExecutionHandlers(ctx) {
             // Preserve the existing Jest fallback when Vitest cannot produce a report.
             if (!output.includes('{') && execution.status !== 0 && !execution.error && !execution.signal) {
                 runner = 'jest';
-                execution = spawnSync('npx', ['jest', ...testFiles, '--json'], options);
+                execution = spawnSync('npx', ['jest', ...testFiles.map(file => jestExactPathPattern(file, options.cwd)), '--json'], options);
                 output = execution.stdout || '';
             }
             const diagnostics = [execution.error?.message, execution.signal && `Terminated by ${execution.signal}`, execution.stderr, output].filter(Boolean).join('\n');

package/dist/coordination/protocols/defect-investigation.js

@@ -11,6 +11,7 @@ import { ok, err, } from '../../shared/types/index.js';
 import { createEvent } from '../../shared/events/domain-events.js';
 import { toError } from '../../shared/error-utils.js';
 import { LoggerFactory } from '../../logging/index.js';
+import { addToCount } from '../../shared/utils/safe-record.js';
 const logger = LoggerFactory.create('defect-investigation');
 export const DefectInvestigationEvents = {
     DefectInvestigationStarted: 'coordination.DefectInvestigationStarted',
@@ -351,7 +352,9 @@ export class DefectInvestigationProtocol {
                     totalInvestigations: 0,
                 };
                 const pattern = result.rootCause.rootCause;
-                stats.patterns[pattern] = (stats.patterns[pattern] ?? 0) + 1;
+                // Root causes are free text and stats come back from storage as plain
+                // objects, so read and write own properties only (#914).
+                addToCount(stats.patterns, pattern);
                 stats.totalInvestigations += 1;
                 await this.memory.set(patternKey, stats, {
                     namespace: this.config.namespace,

package/dist/domains/code-intelligence/services/metric-collector/listing-process-owner.d.ts

@@ -0,0 +1,3 @@
+/** Register a process-tree owner, returning an idempotent release callback. */
+export declare function ownListingProcess(directory: string, stopTree: () => void): () => void;
+//# sourceMappingURL=listing-process-owner.d.ts.map

package/dist/domains/code-intelligence/services/metric-collector/listing-process-owner.js

@@ -0,0 +1,57 @@
+/**
+ * Own detached listing subprocesses until completion or caller termination.
+ * Normal attempt completion removes the handlers; interrupted callers must
+ * synchronously kill every owned group before deleting listing artifacts.
+ */
+import { rmSync } from 'node:fs';
+const owners = new Set();
+const signals = ['SIGINT', 'SIGTERM', 'SIGHUP'];
+function removeHandlers() {
+    process.removeListener('exit', cleanup);
+    for (const signal of signals)
+        process.removeListener(signal, signalHandlers[signal]);
+}
+function cleanup() {
+    const pending = [...owners];
+    owners.clear();
+    for (const owner of pending) {
+        try {
+            owner.stopTree();
+        }
+        catch { /* Continue terminating other owned trees. */ }
+    }
+    for (const directory of new Set(pending.map(owner => owner.directory))) {
+        try {
+            rmSync(directory, { recursive: true, force: true });
+        }
+        catch { /* Best effort during exit. */ }
+    }
+}
+function interrupted(signal) {
+    cleanup();
+    removeHandlers();
+    // Restore signal termination (including its exit status) instead of swallowing
+    // Ctrl-C or converting a requested shutdown into a successful metrics result.
+    process.kill(process.pid, signal);
+}
+const signalHandlers = {
+    SIGINT: () => interrupted('SIGINT'),
+    SIGTERM: () => interrupted('SIGTERM'),
+    SIGHUP: () => interrupted('SIGHUP'),
+};
+/** Register a process-tree owner, returning an idempotent release callback. */
+export function ownListingProcess(directory, stopTree) {
+    if (owners.size === 0) {
+        process.once('exit', cleanup);
+        for (const signal of signals)
+            process.on(signal, signalHandlers[signal]);
+    }
+    const owner = { directory, stopTree };
+    owners.add(owner);
+    return () => {
+        owners.delete(owner);
+        if (owners.size === 0)
+            removeHandlers();
+    };
+}
+//# sourceMappingURL=listing-process-owner.js.map