agentic-qe 3.15.2 → 3.15.4

package/dist/domains/code-intelligence/services/metric-collector/test-counter.js

@@ -12,11 +12,14 @@
  *
  * @see docs/plans/AQE_V3_IMPROVEMENTS_PLAN.md - Phase 5, RM-003
  */
-import { execSync, spawnSync } from 'child_process';
-import { existsSync, readFileSync, readdirSync } from 'fs';
-import { join, extname } from 'path';
+import { execSync, spawn, spawnSync } from 'child_process';
+import { createRequire } from 'module';
+import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync } from 'fs';
+import { tmpdir } from 'os';
+import { join, extname, resolve } from 'path';
 import { DEFAULT_METRIC_CONFIG, } from './interfaces.js';
 import { safeJsonParse } from '../../../../shared/safe-json.js';
+import { ownListingProcess } from './listing-process-owner.js';
 // ============================================================================
 // Main Test Counting Function
 // ============================================================================
@@ -177,53 +180,138 @@ export function checkTestRunners(projectPath) {
 // ============================================================================
 /**
  * Count tests using Vitest
- * Uses `vitest list` for accurate test discovery WITHOUT execution.
+ * Uses `vitest list` for accurate test discovery without executing test callbacks.
  *
  * IMPORTANT: We use `vitest list` (not `vitest --run`) because:
  * - `vitest --run` EXECUTES tests, causing OOM in test-of-tests scenarios
- * - `vitest list` only enumerates tests without running them
+ * - Collection imports test modules but does not run test callbacks
  */
-function countVitestTests(projectPath, config) {
+async function countVitestTests(projectPath, config) {
+    let listingDirectory;
     try {
-        // Use vitest list for safe enumeration (NO execution). --json emits one
-        // entry per discovered test in Vitest 4 and 5; --reporter=json does not.
-        const output = execSync('npx vitest list --json', {
-            cwd: projectPath,
-            encoding: 'utf-8',
-            timeout: Math.min(config.timeout, 30000), // Cap at 30s for listing
-            maxBuffer: 10 * 1024 * 1024, // 10MB buffer (reduced from 50MB)
-        });
+        let supportsStaticParse = false;
         try {
-            const data = safeJsonParse(output);
-            // Vitest list --json returns a flat array of { name, file, location? }.
-            if (Array.isArray(data) && data.every(test => test && typeof test.name === 'string' && typeof test.file === 'string')) {
-                return classifyTests(data.length, 'vitest', projectPath);
-            }
-            // Preserve compatibility with older structured runner output.
-            if (data && typeof data.numTotalTests === 'number') {
-                return classifyTests(data.numTotalTests, 'vitest', projectPath);
-            }
+            const projectRequire = createRequire(resolve(projectPath, 'package.json'));
+            const pkg = safeJsonParse(readFileSync(projectRequire.resolve('vitest/package.json'), 'utf-8'));
+            const [major, minor] = String(pkg.version).split('.').map(Number);
+            supportsStaticParse = major > 4 || (major === 4 && minor >= 1);
         }
         catch {
-            // JSON parse failed, try line counting
+            // Retain native listing without new flags for unresolved/older runners.
+        }
+        listingDirectory = mkdtempSync(join(tmpdir(), 'aqe-vitest-list-'));
+        const readListing = (file) => {
+            try {
+                if (statSync(file).size > 10 * 1024 * 1024)
+                    return undefined;
+                const data = safeJsonParse(readFileSync(file, 'utf-8'));
+                if (Array.isArray(data) && data.every(test => test && typeof test.name === 'string' && typeof test.file === 'string'))
+                    return data.length;
+                if (data && typeof data.numTotalTests === 'number')
+                    return data.numTotalTests;
+            }
+            catch { /* Missing/invalid artifacts are not authoritative counts. */ }
+            return undefined;
+        };
+        const listTests = async (mode) => {
+            // Separate artifacts prevent a failed attempt from contaminating recovery.
+            const file = join(listingDirectory, `${mode}.json`);
+            const args = ['vitest', 'list', `--json=${file}`];
+            if (mode !== 'legacy')
+                args.push(mode === 'static' ? '--static-parse' : '--no-static-parse');
+            const succeeded = await new Promise((resolveAttempt) => {
+                const windows = process.platform === 'win32';
+                // Keep Windows artifact paths in a quoted environment expansion;
+                // interpolating a caller-controlled temporary path into cmd is unsafe.
+                const flag = mode === 'legacy' ? ''
+                    : mode === 'static' ? ' --static-parse' : ' --no-static-parse';
+                const command = windows ? `npx vitest list --json="%AQE_VITEST_LIST_JSON%"${flag}` : 'npx';
+                const child = spawn(command, windows ? [] : args, {
+                    cwd: projectPath, detached: !windows, shell: windows,
+                    env: { ...process.env, AQE_VITEST_LIST_JSON: file },
+                    stdio: ['ignore', 'pipe', 'pipe'],
+                });
+                let stopped = false;
+                let bytes = 0;
+                const stopTree = () => {
+                    if (!child.pid)
+                        return;
+                    try {
+                        if (windows) {
+                            // Windows has no POSIX process groups; terminate this owned tree.
+                            spawnSync('taskkill', ['/PID', String(child.pid), '/T', '/F'], {
+                                stdio: 'ignore', timeout: 5000,
+                            });
+                        }
+                        else {
+                            process.kill(-child.pid, 'SIGKILL');
+                        }
+                    }
+                    catch { /* The process group may already have exited. */ }
+                };
+                const releaseOwnership = ownListingProcess(listingDirectory, stopTree);
+                const timer = setTimeout(() => { stopped = true; stopTree(); }, Math.min(config.timeout, 30000));
+                const consume = (chunk) => {
+                    bytes += chunk.length;
+                    if (bytes > 10 * 1024 * 1024) {
+                        stopped = true;
+                        stopTree();
+                    }
+                };
+                child.stdout?.on('data', consume);
+                child.stderr?.on('data', consume);
+                child.once('error', () => { clearTimeout(timer); stopTree(); releaseOwnership(); resolveAttempt(false); });
+                child.once('close', (code) => {
+                    clearTimeout(timer);
+                    // A wrapper may exit while its descendants are still importing modules.
+                    stopTree();
+                    releaseOwnership();
+                    resolveAttempt(!stopped && code === 0);
+                });
+            });
+            return succeeded ? readListing(file) : undefined;
+        };
+        if (!supportsStaticParse) {
+            const total = await listTests('legacy');
+            return total === undefined ? countTestsByFilePattern(projectPath, config)
+                : classifyTests(total, 'vitest', projectPath);
         }
-        // Fallback: count test entries from text output
-        // vitest list outputs lines like "✓ test name" or "○ test name"
-        const lines = output.split('\n');
-        const testLines = lines.filter(line => line.trim().startsWith('✓') ||
-            line.trim().startsWith('○') ||
-            line.includes(' > ') // nested test format: "describe > test name"
-        );
-        if (testLines.length > 0) {
-            return classifyTests(testLines.length, 'vitest', projectPath);
+        // Inspect cheap static discovery before importing project test modules.
+        // Above 1,000 static declarations or 100 files, retain the native static
+        // count instead of paying the collection timeout for every metrics call.
+        const staticTotal = await listTests('static');
+        const staticFile = join(listingDirectory, 'static.json');
+        let staticFiles = 0;
+        if (staticTotal !== undefined) {
+            try {
+                const data = safeJsonParse(readFileSync(staticFile, 'utf-8'));
+                if (Array.isArray(data))
+                    staticFiles = new Set(data.map(test => test.file)).size;
+            }
+            catch { /* The validated count remains usable. */ }
+            if (staticTotal > 1000 || staticFiles > 100) {
+                return classifyTests(staticTotal, 'vitest', projectPath);
+            }
         }
-        // If vitest list produced no usable output, fall back to file pattern
-        return countTestsByFilePattern(projectPath, config);
+        // Collection expands parameterized/computed declarations but imports every
+        // test module (with setup/describe side effects). One throwing import loses
+        // expansion for the whole suite; preserve its static count when available.
+        const collectedTotal = await listTests('collection');
+        const total = collectedTotal ?? staticTotal;
+        return total === undefined ? countTestsByFilePattern(projectPath, config)
+            : classifyTests(total, 'vitest', projectPath);
     }
     catch {
-        // vitest list failed (not installed, timeout, etc.) - fall back to file pattern
         return countTestsByFilePattern(projectPath, config);
     }
+    finally {
+        if (listingDirectory) {
+            try {
+                rmSync(listingDirectory, { recursive: true, force: true });
+            }
+            catch { /* Cleanup failure must not change an otherwise valid count. */ }
+        }
+    }
 }
 /**
  * Count tests using Jest
@@ -274,10 +362,10 @@ function countCargoTests(projectPath, config) {
         // Count lines ending with ": test"
         const testLines = output.split('\n').filter(line => line.endsWith(': test'));
         const total = testLines.length;
-        // Classify by test path patterns
-        const unit = testLines.filter(t => !t.includes('integration') && !t.includes('e2e')).length;
-        const integration = testLines.filter(t => t.includes('integration')).length;
+        // Disjoint categories, e2e before integration: `tests::integration::e2e_x` counts once.
         const e2e = testLines.filter(t => t.includes('e2e')).length;
+        const integration = testLines.filter(t => !t.includes('e2e') && t.includes('integration')).length;
+        const unit = total - integration - e2e;
         return {
             total,
             unit,

package/dist/domains/coverage-analysis/services/gap-detector.js

@@ -9,6 +9,7 @@ import { ok, err } from '../../../shared/types/index.js';
 import { toError } from '../../../shared/error-utils.js';
 import { safeJsonParse } from '../../../shared/safe-json.js';
 import { getClaudeModelForTier } from '../../../shared/llm/model-registry.js';
+import { createSafeRecord } from '../../../shared/utils/safe-record.js';
 const DEFAULT_CONFIG = {
     minCoverage: 80,
     enableLLMAnalysis: true, // On by default - opt-out
@@ -212,7 +213,8 @@ Return JSON in this exact format:
      * Calculate effort breakdown by file
      */
     calculateEffortBreakdown(gaps) {
-        const breakdown = {};
+        // File paths are data, so the buckets must not inherit from Object.prototype (#914).
+        const breakdown = createSafeRecord();
         for (const gap of gaps) {
             const effort = Math.ceil(gap.lines.length / 15);
             breakdown[gap.file] = (breakdown[gap.file] || 0) + effort;

package/dist/domains/learning-optimization/services/learning-coordinator.js

@@ -9,6 +9,7 @@ import { rehydrateDates } from '../../../shared/utils/kv-date-rehydrate.js';
 import { toError } from '../../../shared/error-utils.js';
 import { createQEFlashAttention, } from '../../../integrations/ruvector/wrappers.js';
 import { getClaudeModelForTier } from '../../../shared/llm/model-registry.js';
+import { createSafeRecord } from '../../../shared/utils/safe-record.js';
 const DEFAULT_CONFIG = {
     minExperiencesForPattern: 5,
     patternConfidenceThreshold: 0.7,
@@ -943,8 +944,9 @@ Provide:
         return false;
     }
     calculateCentroid(experiences) {
-        const avgMetrics = {};
-        const metricCounts = {};
+        // Metric names come from stored experiences (#914).
+        const avgMetrics = createSafeRecord();
+        const metricCounts = createSafeRecord();
         for (const exp of experiences) {
             for (const [key, value] of Object.entries(exp.state.metrics)) {
                 avgMetrics[key] = (avgMetrics[key] || 0) + value;

package/dist/domains/test-execution/services/flaky-detector.js

@@ -13,6 +13,7 @@ import { toError } from '../../../shared/error-utils.js';
 import { safeJsonParse } from '../../../shared/safe-json.js';
 import { getTestRunnerExecutionError } from '../../../shared/test-runner-verdict.js';
 import { createVitestJsonReport, needsVitestJsonReportFile } from '../../../shared/vitest-json-report.js';
+import { isJestCommand, jestExactPathPattern, runnerFilePath } from '../../../shared/test-runner-args.js';
 import { secureRandom } from '../../../shared/utils/crypto-random.js';
 const DEFAULT_FLAKY_CONFIG = {
     simulateForTesting: false,
@@ -256,14 +257,19 @@ export class FlakyDetectorService {
         const runId = uuidv4();
         const startTime = Date.now();
         return new Promise((resolve, reject) => {
-            const baseArgs = [...this.config.testRunnerArgs, file];
+            const cwd = this.config.cwd ?? process.cwd();
+            // #909: pass an absolute path (never read as a flag); Jest reads it as a
+            // regex, so escape and anchor it to select exactly this file.
+            const fileArg = isJestCommand([this.config.testRunner, ...this.config.testRunnerArgs])
+                ? jestExactPathPattern(file, cwd)
+                : runnerFilePath(file, cwd);
+            const baseArgs = [...this.config.testRunnerArgs, fileArg];
             // Vitest 5 writes --reporter=json output to a file, not stdout. Detect
             // Vitest from the runner command too (testRunner: 'vitest', args: ['run', ...]).
             const report = needsVitestJsonReportFile([this.config.testRunner, ...baseArgs])
                 ? createVitestJsonReport()
                 : undefined;
             const args = report ? [...baseArgs, ...report.args] : baseArgs;
-            const cwd = this.config.cwd ?? process.cwd();
             const child = spawn(this.config.testRunner, args, {
                 cwd,
                 env: { ...process.env, ...this.config.env },

package/dist/domains/test-execution/services/retry-handler.js

@@ -5,6 +5,7 @@
 import { LoggerFactory } from '../../../logging/index.js';
 import { spawn } from 'node:child_process';
 import { createVitestJsonReport } from '../../../shared/vitest-json-report.js';
+import { jestExactPathPattern, nameFilterArg, runnerFilePath } from '../../../shared/test-runner-args.js';
 import { existsSync, readFileSync } from 'node:fs';
 import { ok, err } from '../../../shared/types/index.js';
 import { TEST_EXECUTION_CONSTANTS, RETRY_CONSTANTS } from '../../constants.js';
@@ -264,7 +265,7 @@ export class RetryHandlerService {
                 `or configure testRunner in RetryHandlerConfig. Cannot execute retry for: ${testFile}`);
         }
         // Build command based on runner
-        const { command, args, report } = this.buildTestCommand(runner, testFile, testName);
+        const { command, args, report } = this.buildTestCommand(runner, testFile, testName, cwd);
         // Execute the test
         return this.spawnTestProcess(command, args, cwd, report);
     }
@@ -334,40 +335,42 @@ export class RetryHandlerService {
     /**
      * Build the command and arguments for the test runner
      */
-    buildTestCommand(runner, testFile, testName) {
+    buildTestCommand(runner, testFile, testName, cwd = this.config.cwd ?? process.cwd()) {
         const npx = this.config.npxPath;
-        // These runners interpret name filters as regular expressions, but a
-        // FailedTest contains the literal assertion name from the previous run.
-        const namePattern = testName?.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') ?? '';
+        // A FailedTest holds the literal assertion name and path from the previous
+        // run. Name filters are regex-escaped and passed as --flag=value; file
+        // filters are absolute (Jest: escaped and anchored), so neither can be
+        // misread as a regex or as a flag when it starts with '-' (#886, #909).
+        const filterByName = Boolean(testName) && testName !== testFile;
         switch (runner) {
             case 'vitest':
-                // vitest run --reporter=json testFile -t "testName"
+                // vitest run --reporter=json <abs file> --testNamePattern=<name>
                 // --outputFile: Vitest 5 no longer prints the JSON report to stdout.
                 {
                     const report = createVitestJsonReport();
-                    const vitestArgs = ['vitest', 'run', '--reporter=json', testFile];
-                    if (testName && testName !== testFile) {
-                        vitestArgs.push('-t', namePattern);
-                    }
+                    const vitestArgs = ['vitest', 'run', '--reporter=json', runnerFilePath(testFile, cwd)];
+                    if (filterByName)
+                        vitestArgs.push(nameFilterArg('vitest', testName));
                     vitestArgs.push(...report.args);
                     return { command: npx, args: vitestArgs, report };
                 }
             case 'jest':
-                // jest --json testFile -t "testName"
+                // jest --json --testNamePattern=<name> ^<escaped abs file>$
+                // Positional TestPathPatterns work on Jest 29 and 30 (Jest 30 rejects
+                // the old --testPathPattern flag).
                 {
-                    const jestArgs = ['jest', '--json', '--testPathPattern', testFile];
-                    if (testName && testName !== testFile) {
-                        jestArgs.push('-t', namePattern);
-                    }
+                    const jestArgs = ['jest', '--json'];
+                    if (filterByName)
+                        jestArgs.push(nameFilterArg('jest', testName));
+                    jestArgs.push(jestExactPathPattern(testFile, cwd));
                     return { command: npx, args: jestArgs };
                 }
             case 'mocha':
-                // mocha --reporter json testFile --grep "testName"
+                // mocha --reporter json <abs file> --grep=<name>
                 {
-                    const mochaArgs = ['mocha', '--reporter', 'json', testFile];
-                    if (testName && testName !== testFile) {
-                        mochaArgs.push('--grep', namePattern);
-                    }
+                    const mochaArgs = ['mocha', '--reporter', 'json', runnerFilePath(testFile, cwd)];
+                    if (filterByName)
+                        mochaArgs.push(nameFilterArg('mocha', testName));
                     return { command: npx, args: mochaArgs };
                 }
             default:

package/dist/domains/test-execution/services/test-executor.js

@@ -16,6 +16,7 @@ import { secureRandom, secureRandomInt } from '../../../shared/utils/crypto-rand
 import { writeQualityEvidence } from '../../quality-assessment/quality-evidence.js';
 import { getTestRunnerExecutionError, TestRunnerExecutionError } from '../../../shared/test-runner-verdict.js';
 import { createVitestJsonReport } from '../../../shared/vitest-json-report.js';
+import { jestExactPathPattern, runnerFilePath } from '../../../shared/test-runner-args.js';
 import { getClaudeModelForTier } from '../../../shared/llm/model-registry.js';
 import { terminateTestRunner, trackTestRunnerExit } from '../../../shared/test-runner-process.js';
 const DEFAULT_CONFIG = {
@@ -481,7 +482,9 @@ Provide:
      * Build test command based on framework
      */
     buildTestCommand(fileOrFiles, framework) {
-        const files = Array.isArray(fileOrFiles) ? fileOrFiles : [fileOrFiles];
+        // #909: absolute paths never start with '-', so a file cannot be read as a
+        // flag; Jest's positional patterns are regexes, so escape and anchor them.
+        const files = (Array.isArray(fileOrFiles) ? fileOrFiles : [fileOrFiles]).map(file => runnerFilePath(file));
         const createCoverageDirectory = () => mkdtempSync(join(tmpdir(), 'aqe-test-coverage-'));
         switch (framework.toLowerCase()) {
             case 'vitest': {
@@ -507,7 +510,7 @@ Provide:
                 const coverageDirectory = createCoverageDirectory();
                 return {
                     command: 'npx',
-                    args: ['jest', ...files, '--json', '--no-colors', '--testLocationInResults', `--coverageDirectory=${coverageDirectory}`],
+                    args: ['jest', ...files.map(file => jestExactPathPattern(file)), '--json', '--no-colors', '--testLocationInResults', `--coverageDirectory=${coverageDirectory}`],
                     coverageDirectory,
                 };
             }

package/dist/domains/test-generation/services/test-generator.js

@@ -993,8 +993,11 @@ Return a JSON array of test suggestions, each with: { "name": "test name", "desc
         if (lang && lang !== 'typescript' && lang !== 'javascript') {
             return resolveTestFilePath(sourceFile, lang);
         }
-        const ext = sourceFile.split('.').pop() || 'ts';
-        const base = sourceFile.replace(`.${ext}`, '');
+        // #936 follow-up: strip only the trailing extension. A first-match
+        // replace turned /home/u/my.ts-app/src/a.ts into /home/u/my-app/src/a.ts,
+        // pointing the test file at a sibling directory outside the project.
+        const ext = fileExt ? fileExt.slice(1) : 'ts';
+        const base = fileExt ? sourceFile.slice(0, -fileExt.length) : sourceFile;
         if (framework === 'pytest') {
             return `test_${base.split('/').pop()}.py`;
         }

package/dist/governance/compliance-reporter.js

@@ -19,6 +19,7 @@ import { governanceFlags, } from './feature-flags.js';
 import { proofEnvelopeIntegration, } from './proof-envelope-integration.js';
 import { getUnifiedMemory } from '../kernel/unified-memory.js';
 import { toErrorMessage } from '../shared/error-utils.js';
+import { createSafeRecord } from '../shared/utils/safe-record.js';
 // ============================================================================
 // Default Configuration
 // ============================================================================
@@ -274,14 +275,14 @@ export class ComplianceReporter {
         });
         // Calculate overall score
         const overall = this.calculateOverallScore(violations);
-        // Calculate score by gate
-        const byGate = {};
+        // Calculate score by gate. Gate and agent names are data (#914).
+        const byGate = createSafeRecord();
         const gateViolations = this.groupBy(violations, 'gate');
         for (const [gate, gateViols] of Object.entries(gateViolations)) {
             byGate[gate] = this.calculateOverallScore(gateViols);
         }
         // Calculate score by agent
-        const byAgent = {};
+        const byAgent = createSafeRecord();
         const agentViolations = this.groupBy(violations, 'agentId');
         for (const [agentId, agentViols] of Object.entries(agentViolations)) {
             if (agentId !== 'undefined') {
@@ -572,13 +573,13 @@ export class ComplianceReporter {
         for (const v of allViolations) {
             bySeverity[v.severity]++;
         }
-        // Count by gate
-        const byGate = {};
+        // Count by gate. Gate and agent names are data (#914).
+        const byGate = createSafeRecord();
         for (const v of allViolations) {
             byGate[v.gate] = (byGate[v.gate] || 0) + 1;
         }
         // Count by agent
-        const byAgent = {};
+        const byAgent = createSafeRecord();
         for (const v of allViolations) {
             if (v.agentId) {
                 byAgent[v.agentId] = (byAgent[v.agentId] || 0) + 1;
@@ -984,7 +985,7 @@ export class ComplianceReporter {
      * Group violations by a field
      */
     groupBy(violations, field) {
-        const groups = {};
+        const groups = createSafeRecord();
         for (const v of violations) {
             const key = String(v[field]);
             if (!groups[key]) {

package/dist/governance/proof-envelope-integration.js

@@ -19,6 +19,7 @@ import { safeJsonParse } from '../shared/safe-json.js';
  */
 import { wasmKernelIntegration, } from './wasm-kernel-integration.js';
 import { governanceFlags, } from './feature-flags.js';
+import { createSafeRecord } from '../shared/utils/safe-record.js';
 /**
  * Genesis envelope hash constant
  */
@@ -514,7 +515,8 @@ export class ProofEnvelopeIntegration {
      * Get chain statistics
      */
     getProofStats() {
-        const actionCounts = {};
+        // Action names are data, so the buckets must not inherit from Object.prototype (#914).
+        const actionCounts = createSafeRecord();
         const agents = new Set();
         for (const envelope of this.chain) {
             agents.add(envelope.agentId);

package/dist/init/phases/07-hooks.js

@@ -259,10 +259,13 @@ export class HooksPhase extends BasePhase {
             mkdirSync(helpersDir, { recursive: true });
         }
         const destPath = join(helpersDir, 'brain-checkpoint.cjs');
-        // Try to copy from our own installation first
+        // Try to copy from our own installation first. The last candidate is this
+        // package's own copy (relative to the compiled init module), so a GLOBAL
+        // install also refreshes an existing project's helper on re-init (#872).
         const sourcePaths = [
             join(projectRoot, '.claude', 'helpers', 'brain-checkpoint.cjs'),
             join(projectRoot, 'node_modules', 'agentic-qe', '.claude', 'helpers', 'brain-checkpoint.cjs'),
+            join(__dirname, '..', '..', '..', '.claude', 'helpers', 'brain-checkpoint.cjs'),
         ];
         for (const src of sourcePaths) {
             if (existsSync(src) && src !== destPath) {
@@ -399,16 +402,39 @@ const AQE_DIR = path.join(PROJECT_ROOT, '.agentic-qe');
 const RVF_PATH = path.join(AQE_DIR, 'aqe.rvf');
 const DB_PATH = path.join(AQE_DIR, 'memory.db');
 const MAX_AGE_HOURS = 24;
-const AQE_BIN = process.env.AQE_HOOK_BIN || (process.platform === 'win32' ? 'aqe.cmd' : 'aqe');
+// Windows (#872): never execFile aqe.cmd (EINVAL without a shell); reuse the
+// hook shim's resolver, which runs the AQE bundle via node instead.
+function aqeInvocation() {
+  if (process.platform !== 'win32') return { cmd: process.env.AQE_HOOK_BIN || 'aqe', args: [] };
+  const shimPath = path.join(__dirname, '..', 'hooks', 'aqe-hook.cjs');
+  let src = '';
+  try { src = fs.readFileSync(shimPath, 'utf8'); } catch { /* missing */ }
+  // An older shim runs its hook main (spawn + exit) when required.
+  if (!src.includes('resolveAqeInvocation') || !src.includes('require.main === module')) {
+    return { cmd: null, args: [], reason: '.claude/hooks/aqe-hook.cjs is missing or predates #872; re-run aqe init' };
+  }
+  try {
+    return require(shimPath).resolveAqeInvocation({ project: PROJECT_ROOT });
+  } catch (e) {
+    return { cmd: null, args: [], reason: 'aqe-hook.cjs failed to load: ' + e.message };
+  }
+}
 
 function log(msg) { process.stderr.write('[brain-checkpoint] ' + msg + '\\n'); }
 
 function exportBrain() {
   if (!fs.existsSync(DB_PATH)) { log('No memory.db, skipping'); return { exported: false }; }
+  const aqe = aqeInvocation();
+  if (!aqe.cmd) { log('Export skipped: ' + aqe.reason); return { exported: false, reason: aqe.reason }; }
+  // Never write through a committed symlink: .agentic-qe must be a real dir, and
+  // unlink (not existsSync) drops a planted aqe.rvf link, even a dangling one.
+  let st; try { st = fs.lstatSync(AQE_DIR); } catch { /* missing */ }
+  if (!st || !st.isDirectory()) { log('Export skipped: .agentic-qe is a symlink'); return { exported: false }; }
+  for (const f of [RVF_PATH, RVF_PATH + '.idmap.json']) { try { fs.unlinkSync(f); } catch { /* absent */ } }
   try {
     const result = execFileSync(
-      AQE_BIN, ['brain', 'export', '-o', RVF_PATH, '--format', 'rvf'],
-      { timeout: 60000, encoding: 'utf-8' }
+      aqe.cmd, [...aqe.args, 'brain', 'export', '-o', RVF_PATH, '--format', 'rvf'],
+      { timeout: 60000, encoding: 'utf-8', windowsHide: true }
     );
     const m = result.match(/Patterns:\\s+(\\d+)/);
     const p = m ? m[1] : '0';

package/dist/init/phases/10-workers.js

@@ -109,8 +109,9 @@ export class WorkersPhase extends BasePhase {
 // Generated by aqe init
 // Starts the MCP server with background workers enabled
 
-const { existsSync, readFileSync, writeFileSync, appendFileSync } = require('fs');
-const { join } = require('path');
+const fs = require('fs');
+const { existsSync, readFileSync } = fs;
+const { join, dirname } = require('path');
 const { spawn } = require('child_process');
 
 const projectRoot = join(__dirname, '..', '..');
@@ -118,8 +119,33 @@ const workersDir = join(projectRoot, '.agentic-qe', 'workers');
 const pidFile = join(workersDir, 'daemon.pid');
 const logFile = join(workersDir, 'daemon.log');
 
-// Check if already running
-if (existsSync(pidFile)) {
+// A repository can commit .agentic-qe, workers/ or a file in it as a symlink.
+// Never write through one (#970): real directories only, appends only to a
+// regular file (lstat + O_NOFOLLOW where the platform has it), and the pid file
+// is replaced by rename instead of being written in place.
+function isRealDir(d) { try { const s = fs.lstatSync(d); return s.isDirectory() && !s.isSymbolicLink(); } catch { return false; } }
+function isRegularOrAbsent(f) { try { return fs.lstatSync(f).isFile(); } catch (e) { return !!e && e.code === 'ENOENT'; } }
+if (!isRealDir(join(projectRoot, '.agentic-qe')) || !isRealDir(workersDir)) {
+  console.error('AQE v3 Worker Daemon not started: .agentic-qe/workers must be a real directory, not a symlink');
+  process.exit(1);
+}
+function appendFileSync(file, data) {
+  if (!isRegularOrAbsent(file)) return;
+  const c = fs.constants;
+  let fd;
+  try {
+    fd = fs.openSync(file, c.O_APPEND | c.O_CREAT | c.O_WRONLY | (c.O_NOFOLLOW || 0), 0o644);
+    fs.writeSync(fd, data);
+  } catch {} finally { if (fd !== undefined) { try { fs.closeSync(fd); } catch {} } }
+}
+function writeFileSync(file, data) {
+  const tmp = file + '.' + process.pid + '.' + Date.now() + '.tmp';
+  try { fs.writeFileSync(tmp, data, { flag: 'wx' }); fs.renameSync(tmp, file); }
+  catch { try { fs.unlinkSync(tmp); } catch {} }
+}
+
+// Check if already running (only trust a regular pid file, never a link target)
+if (existsSync(pidFile) && isRegularOrAbsent(pidFile)) {
   const pid = parseInt(readFileSync(pidFile, 'utf-8').trim(), 10);
   try { process.kill(pid, 0); console.log('Daemon already running (PID: ' + pid + ')'); process.exit(0); } catch {}
 }
@@ -161,8 +187,18 @@ if (binCandidate && binCandidate.endsWith('bundle.js')) {
   mcpCmd = binCandidate;
   mcpArgs = [];
 } else {
-  mcpCmd = process.platform === 'win32' ? 'npx.cmd' : 'npx';
-  mcpArgs = ['--yes', 'agentic-qe', 'mcp'];
+  // Windows (#872): npx is npx.cmd, which spawn() refuses to start without a
+  // shell (EINVAL since CVE-2024-27980). Run npm's bundled npx CLI via node.
+  const npxCli = join(dirname(process.execPath), 'node_modules', 'npm', 'bin', 'npx-cli.js');
+  if (process.platform === 'win32' && !existsSync(npxCli)) {
+    appendFileSync(logFile, '[' + ts + '] ERROR: no AQE MCP bundle found and npx-cli.js is missing next to node.exe; install agentic-qe locally (npm install -D agentic-qe).\\n');
+    console.error('AQE v3 Worker Daemon not started: agentic-qe MCP bundle not found (see ' + logFile + ')');
+    process.exit(1);
+  }
+  mcpCmd = process.platform === 'win32' ? process.execPath : 'npx';
+  mcpArgs = process.platform === 'win32'
+    ? [npxCli, '--yes', 'agentic-qe', 'mcp']
+    : ['--yes', 'agentic-qe', 'mcp'];
   appendFileSync(logFile, '[' + ts + '] WARNING: using npx fallback — daemon.pid will point at the npx wrapper, not the MCP server. \`aqe daemon status\` may misreport liveness after the wrapper exits.\\n');
 }
 

package/dist/integrations/agentic-flow/onnx-embeddings/embedding-generator.d.ts

@@ -43,7 +43,10 @@ export declare class EmbeddingGenerator {
      */
     updateConfig(config: Partial<EmbeddingConfig>): void;
     /**
-     * Generate cache key from text and config
+     * Generate cache key from text and every config field that changes the vector.
+     * A JSON tuple keeps field boundaries intact when the model or text contains
+     * ':' (#914, as #863 did for the shared embedding cache). The cache is
+     * in-memory only, so no persisted keys need migrating.
      */
     private getCacheKey;
     /**

package/dist/integrations/agentic-flow/onnx-embeddings/embedding-generator.js

@@ -240,10 +240,14 @@ export class EmbeddingGenerator {
         }
     }
     /**
-     * Generate cache key from text and config
+     * Generate cache key from text and every config field that changes the vector.
+     * A JSON tuple keeps field boundaries intact when the model or text contains
+     * ':' (#914, as #863 did for the shared embedding cache). The cache is
+     * in-memory only, so no persisted keys need migrating.
      */
     getCacheKey(text) {
-        return `${this.config.model}:${this.config.hyperbolic}:${text}`;
+        const { model, hyperbolic, normalize, curvature } = this.config;
+        return JSON.stringify([model, hyperbolic, normalize, curvature, text]);
     }
     /**
      * Convert Euclidean embedding to Poincaré ball