agentic-qe 3.15.2 → 3.15.4

package/dist/memory/crdt/or-set.js

@@ -83,6 +83,22 @@ export function createORSet(nodeId) {
     let version = 0;
     let lastUpdated = Date.now();
     let tagCounter = 0;
+    /** Continue this owner's allocation sequence after importing a checkpoint. */
+    function observeOwnedTag(tag) {
+        const prefix = `${nodeId}:`;
+        if (!tag.startsWith(prefix))
+            return;
+        const suffix = tag.slice(prefix.length);
+        const match = /^(-?\d+):(\d+)$/.exec(suffix);
+        if (!match)
+            return;
+        const timestamp = Number(match[1]);
+        const counter = Number(match[2]);
+        if (Number.isSafeInteger(timestamp) && Number.isSafeInteger(counter) &&
+            counter < Number.MAX_SAFE_INTEGER) {
+            tagCounter = Math.max(tagCounter, counter + 1);
+        }
+    }
     /**
      * Check if an element has any active (non-tombstoned) tags
      */
@@ -202,6 +218,7 @@ export function createORSet(nodeId) {
                 }
                 const localTags = elements.get(serialized);
                 for (const tag of incomingTags) {
+                    observeOwnedTag(tag);
                     if (!localTags.has(tag)) {
                         localTags.add(tag);
                         changed = true;
@@ -215,6 +232,7 @@ export function createORSet(nodeId) {
                 }
                 const localTombstones = tombstones.get(serialized);
                 for (const tag of incomingTombstones) {
+                    observeOwnedTag(tag);
                     if (!localTombstones.has(tag)) {
                         localTombstones.add(tag);
                         changed = true;

package/dist/planning/goap-planner.js

@@ -16,6 +16,8 @@ import { safeJsonParse } from '../shared/safe-json.js';
 import { getUnifiedPersistence } from '../kernel/unified-persistence.js';
 import { DEFAULT_MAX_PLAN_STEPS, validateMaxSteps } from './types.js';
 import { getAllQEActions, QE_GOALS } from './actions/qe-action-library.js';
+/** Conservative budget fallback for actions without a declared estimate. */
+const DEFAULT_ACTION_DURATION_MS = 1000;
 // ============================================================================
 // MinHeap for A* Open Set (O(log n) insert/extract vs O(n log n) sort+shift)
 // ============================================================================
@@ -215,18 +217,24 @@ export class GOAPPlanner {
     }
     /** Restore missing estimates only for unchanged legacy library definitions. */
     backfillActionDurationEstimates() {
-        const update = this.ensureDb().prepare(`
+        const db = this.ensureDb();
+        const missing = db.prepare('SELECT 1 FROM goap_actions WHERE estimated_duration_ms IS NULL LIMIT 1').get();
+        if (!missing)
+            return;
+        const update = db.prepare(`
       UPDATE goap_actions SET estimated_duration_ms = ?
       WHERE estimated_duration_ms IS NULL AND name = ?
         AND agent_type IS ? AND category = ? AND qe_domain IS ?
         AND preconditions = ? AND effects = ?
         AND method IS ? AND params IS ? AND implemented = ?
     `);
-        for (const action of getAllQEActions()) {
-            if (action.estimatedDurationMs === undefined)
-                continue;
-            update.run(action.estimatedDurationMs, action.name, action.agentType ?? null, action.category, action.qeDomain ?? null, JSON.stringify(action.preconditions), JSON.stringify(action.effects), action.method ?? null, action.params ? JSON.stringify(action.params) : null, action.implemented ? 1 : 0);
-        }
+        db.transaction(() => {
+            for (const action of getAllQEActions()) {
+                if (action.estimatedDurationMs === undefined)
+                    continue;
+                update.run(action.estimatedDurationMs, action.name, action.agentType ?? null, action.category, action.qeDomain ?? null, JSON.stringify(action.preconditions), JSON.stringify(action.effects), action.method ?? null, action.params ? JSON.stringify(action.params) : null, action.implemented ? 1 : 0);
+            }
+        })();
     }
     // ==========================================================================
     // Core Planning - A* Search
@@ -258,7 +266,7 @@ export class GOAPPlanner {
                 this.recordPlanReuse(reusedPlan.id, true);
                 const clonedPlan = {
                     ...reusedPlan,
-                    estimatedDurationMs: reusedPlan.actions.reduce((sum, action) => sum + (action.estimatedDurationMs ?? 0), 0),
+                    estimatedDurationMs: reusedPlan.actions.reduce((sum, action) => sum + (action.estimatedDurationMs ?? DEFAULT_ACTION_DURATION_MS), 0),
                     id: `plan-${Date.now()}-${randomUUID().slice(0, 8)}`,
                     initialState: this.cloneState(currentState),
                     reusedFrom: reusedPlan.id,
@@ -285,7 +293,7 @@ export class GOAPPlanner {
             goalState: goal,
             actions: actionSequence,
             totalCost: actionSequence.reduce((sum, a) => sum + a.cost, 0),
-            estimatedDurationMs: actionSequence.reduce((sum, a) => sum + (a.estimatedDurationMs ?? 0), 0),
+            estimatedDurationMs: actionSequence.reduce((sum, a) => sum + (a.estimatedDurationMs ?? DEFAULT_ACTION_DURATION_MS), 0),
             status: 'pending',
         };
         // A14: persist the plan itself (not just its reuse signature) so
@@ -404,7 +412,7 @@ export class GOAPPlanner {
                     continue;
                 }
                 // Check duration constraints
-                const estimatedDuration = current.estimatedDurationMs + (action.estimatedDurationMs ?? 0);
+                const estimatedDuration = current.estimatedDurationMs + (action.estimatedDurationMs ?? DEFAULT_ACTION_DURATION_MS);
                 if (estimatedDuration > maxDuration) {
                     continue;
                 }
@@ -1040,7 +1048,7 @@ export class GOAPPlanner {
         if (plan.actions.length > maxSteps)
             return false;
         if (constraints?.maxDurationMs !== undefined &&
-            plan.actions.reduce((sum, action) => sum + (action.estimatedDurationMs ?? 0), 0)
+            plan.actions.reduce((sum, action) => sum + (action.estimatedDurationMs ?? DEFAULT_ACTION_DURATION_MS), 0)
                 > constraints.maxDurationMs) {
             return false;
         }

package/dist/shared/embeddings/embedding-cache.d.ts

@@ -19,15 +19,15 @@ export declare class EmbeddingCache {
     /**
      * Get cached embedding if available
      */
-    get(content: string, model: string): number[] | null;
+    get(content: string, model: string, namespace?: string): number[] | null;
     /**
      * Store embedding in cache
      */
-    set(content: string, model: string, embedding: number[]): void;
+    set(content: string, model: string, embedding: number[], namespace?: string): void;
     /**
      * Check if embedding exists in cache
      */
-    has(content: string, model: string): boolean;
+    has(content: string, model: string, namespace?: string): boolean;
     /**
      * Get cache statistics
      */

package/dist/shared/embeddings/embedding-cache.js

@@ -20,16 +20,16 @@ export class EmbeddingCache {
     /**
      * Generate SHA-256 hash of content for cache key
      */
-    hashContent(content, model) {
+    hashContent(content, model, namespace) {
         return createHash('sha256')
-            .update(JSON.stringify([model, content]))
+            .update(JSON.stringify(namespace === undefined ? [model, content] : [model, namespace, content]))
             .digest('hex');
     }
     /**
      * Get cached embedding if available
      */
-    get(content, model) {
-        const key = this.hashContent(content, model);
+    get(content, model, namespace) {
+        const key = this.hashContent(content, model, namespace);
         const entry = this.cache.get(key);
         if (entry) {
             this.hits++;
@@ -44,8 +44,8 @@ export class EmbeddingCache {
     /**
      * Store embedding in cache
      */
-    set(content, model, embedding) {
-        const key = this.hashContent(content, model);
+    set(content, model, embedding, namespace) {
+        const key = this.hashContent(content, model, namespace);
         // Evict oldest entry if cache is full (LRU)
         if (this.cache.size >= this.maxSize && !this.cache.has(key)) {
             const firstKey = this.cache.keys().next().value;
@@ -63,8 +63,8 @@ export class EmbeddingCache {
     /**
      * Check if embedding exists in cache
      */
-    has(content, model) {
-        const key = this.hashContent(content, model);
+    has(content, model, namespace) {
+        const key = this.hashContent(content, model, namespace);
         return this.cache.has(key);
     }
     /**

package/dist/shared/embeddings/nomic-embedder.js

@@ -15,6 +15,9 @@ import { EmbeddingCache } from './embedding-cache.js';
 import { toErrorMessage } from '../error-utils.js';
 import { EMBEDDING_CONFIG, } from './types.js';
 const PSEUDO_EMBEDDING_MODEL = 'pseudo-embedding';
+// Unversioned real-model entries may predate fallback provenance separation.
+const VERIFIED_MODEL_CACHE_NAMESPACE = 'verified-backend-v1';
+const cacheNamespace = (model) => model === EMBEDDING_CONFIG.MODEL ? VERIFIED_MODEL_CACHE_NAMESPACE : undefined;
 /**
  * Nomic Embedder for generating code embeddings via Ollama
  */
@@ -53,10 +56,10 @@ export class NomicEmbedder {
     async embed(text) {
         // Prefer genuine cached vectors, then select the active backend before a
         // single counted lookup so alternate namespaces do not inflate misses.
-        let model = this.cache.has(text, EMBEDDING_CONFIG.MODEL) ||
+        let model = this.cache.has(text, EMBEDDING_CONFIG.MODEL, VERIFIED_MODEL_CACHE_NAMESPACE) ||
             await this.isOllamaAvailable() || !this.enableFallback
             ? EMBEDDING_CONFIG.MODEL : PSEUDO_EMBEDDING_MODEL;
-        const cached = this.cache.get(text, model);
+        const cached = this.cache.get(text, model, cacheNamespace(model));
         if (cached) {
             return cached;
         }
@@ -75,7 +78,7 @@ export class NomicEmbedder {
                 `Please run: ollama pull ${EMBEDDING_CONFIG.MODEL}`);
         }
         // Cache result
-        this.cache.set(text, model, embedding);
+        this.cache.set(text, model, embedding, cacheNamespace(model));
         return embedding;
     }
     /**
@@ -188,9 +191,9 @@ export class NomicEmbedder {
             const formattedText = this.formatForEmbedding(chunk);
             const chunkStartTime = Date.now();
             // Check cache
-            const cachedModel = useOllama || this.cache.has(formattedText, EMBEDDING_CONFIG.MODEL)
+            const cachedModel = useOllama || this.cache.has(formattedText, EMBEDDING_CONFIG.MODEL, VERIFIED_MODEL_CACHE_NAMESPACE)
                 ? EMBEDDING_CONFIG.MODEL : PSEUDO_EMBEDDING_MODEL;
-            const cachedEmbedding = this.cache.get(formattedText, cachedModel);
+            const cachedEmbedding = this.cache.get(formattedText, cachedModel, cacheNamespace(cachedModel));
             if (cachedEmbedding) {
                 return {
                     chunkId: chunk.id,
@@ -211,7 +214,7 @@ export class NomicEmbedder {
                 }
                 // Cache the result
                 const model = useOllama ? EMBEDDING_CONFIG.MODEL : PSEUDO_EMBEDDING_MODEL;
-                this.cache.set(formattedText, model, embedding);
+                this.cache.set(formattedText, model, embedding, cacheNamespace(model));
                 return {
                     chunkId: chunk.id,
                     embedding,

package/dist/shared/embeddings/ollama-client.d.ts

@@ -21,7 +21,7 @@ export declare class OllamaClient {
      */
     generateEmbedding(prompt: string): Promise<number[]>;
     /**
-     * Fetch with timeout support
+     * Keep the request timeout active through required body consumption.
      */
     private fetchWithTimeout;
     /**

package/dist/shared/embeddings/ollama-client.js

@@ -24,24 +24,24 @@ export class OllamaClient {
      */
     async healthCheck() {
         try {
-            const response = await this.fetchWithTimeout(`${this.baseUrl}/api/tags`, {
+            return await this.fetchWithTimeout(`${this.baseUrl}/api/tags`, {
                 method: 'GET',
                 headers: { 'Content-Type': 'application/json' },
-            }, 5000 // Shorter timeout for health check
-            );
-            if (!response.ok) {
+            }, 5000, // Shorter timeout for health check
+            async (response) => {
+                if (!response.ok)
+                    return false;
+                const data = await response.json();
+                // Check if configured embedding model is available
+                // Match the configured model exactly, allowing its existing tag suffix.
+                if (data.models) {
+                    return data.models.some((model) => model.name === EMBEDDING_CONFIG.MODEL ||
+                        model.name?.startsWith(`${EMBEDDING_CONFIG.MODEL}:`) ||
+                        model.model === EMBEDDING_CONFIG.MODEL ||
+                        model.model?.startsWith(`${EMBEDDING_CONFIG.MODEL}:`));
+                }
                 return false;
-            }
-            const data = await response.json();
-            // Check if configured embedding model is available
-            // Match the configured model exactly, allowing its existing tag suffix.
-            if (data.models) {
-                return data.models.some((model) => model.name === EMBEDDING_CONFIG.MODEL ||
-                    model.name?.startsWith(`${EMBEDDING_CONFIG.MODEL}:`) ||
-                    model.model === EMBEDDING_CONFIG.MODEL ||
-                    model.model?.startsWith(`${EMBEDDING_CONFIG.MODEL}:`));
-            }
-            return false;
+            });
         }
         catch {
             return false;
@@ -58,16 +58,17 @@ export class OllamaClient {
         let lastError = null;
         for (let attempt = 0; attempt < this.maxRetries; attempt++) {
             try {
-                const response = await this.fetchWithTimeout(`${this.baseUrl}/api/embeddings`, {
+                const data = await this.fetchWithTimeout(`${this.baseUrl}/api/embeddings`, {
                     method: 'POST',
                     headers: { 'Content-Type': 'application/json' },
                     body: JSON.stringify(request),
-                }, this.timeoutMs);
-                if (!response.ok) {
-                    const errorText = await response.text();
-                    throw new Error(`Ollama API error (${response.status}): ${errorText}`);
-                }
-                const data = await response.json();
+                }, this.timeoutMs, async (response) => {
+                    if (!response.ok) {
+                        const errorText = await response.text();
+                        throw new Error(`Ollama API error (${response.status}): ${errorText}`);
+                    }
+                    return await response.json();
+                });
                 // Validate embedding dimensions
                 if (data.embedding.length !== EMBEDDING_CONFIG.DIMENSIONS) {
                     throw new Error(`Invalid embedding dimensions: expected ${EMBEDDING_CONFIG.DIMENSIONS}, got ${data.embedding.length}`);
@@ -90,9 +91,9 @@ export class OllamaClient {
         throw new Error(`Failed to generate embedding after ${this.maxRetries} attempts: ${lastError?.message}`);
     }
     /**
-     * Fetch with timeout support
+     * Keep the request timeout active through required body consumption.
      */
-    async fetchWithTimeout(url, options, timeoutMs) {
+    async fetchWithTimeout(url, options, timeoutMs, consume) {
         const controller = new AbortController();
         const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
         try {
@@ -100,7 +101,7 @@ export class OllamaClient {
                 ...options,
                 signal: controller.signal,
             });
-            return response;
+            return await consume(response);
         }
         finally {
             clearTimeout(timeoutId);
@@ -117,14 +118,12 @@ export class OllamaClient {
      */
     async getServerInfo() {
         try {
-            const response = await this.fetchWithTimeout(`${this.baseUrl}/api/tags`, {
+            return await this.fetchWithTimeout(`${this.baseUrl}/api/tags`, {
                 method: 'GET',
                 headers: { 'Content-Type': 'application/json' },
-            }, 5000);
-            if (!response.ok) {
-                return null;
-            }
-            return await response.json();
+            }, 5000, async (response) => response.ok
+                ? await response.json()
+                : null);
         }
         catch {
             return null;

package/dist/shared/git/git-analyzer.d.ts

@@ -102,8 +102,11 @@ export declare class GitAnalyzer {
     getChangedFiles(since?: Date): Promise<string[]>;
     /**
      * Get files changed in a specific commit
-     * @param commitHash - Git commit hash (default: HEAD)
+     * @param commitHash - Git revision (SHA, `HEAD~3`, `origin/main`, tag; default: HEAD)
      * @returns Array of changed file paths relative to repo root
+     * @throws Error when `commitHash` is option-shaped (starts with "-") or otherwise
+     *   not a safe revision argument; git would otherwise parse it as an option
+     *   (e.g. `--output=<path>` writes an arbitrary file). See issue #960.
      */
     getCommitFiles(commitHash?: string): Promise<string[]>;
     /**

package/dist/shared/git/git-analyzer.js

@@ -10,6 +10,7 @@
  */
 import { execFileSync } from 'child_process';
 import * as path from 'path';
+import { assertSafeGitRef } from './ref-validation.js';
 /**
  * Sanitize a string for safe use in git arguments
  * Removes shell metacharacters that could enable injection
@@ -432,18 +433,22 @@ export class GitAnalyzer {
     }
     /**
      * Get files changed in a specific commit
-     * @param commitHash - Git commit hash (default: HEAD)
+     * @param commitHash - Git revision (SHA, `HEAD~3`, `origin/main`, tag; default: HEAD)
      * @returns Array of changed file paths relative to repo root
+     * @throws Error when `commitHash` is option-shaped (starts with "-") or otherwise
+     *   not a safe revision argument; git would otherwise parse it as an option
+     *   (e.g. `--output=<path>` writes an arbitrary file). See issue #960.
      */
     async getCommitFiles(commitHash = 'HEAD') {
+        // Validate before touching git: execFileSync has no shell, so stripping
+        // metacharacters does not help, but a leading "-" is still parsed as an option.
+        assertSafeGitRef(commitHash, 'commit hash');
         if (!(await this.isGitRepository())) {
             return [];
         }
         try {
-            // Sanitize commit hash to prevent injection
-            const sanitizedHash = sanitizeGitArg(commitHash);
             const output = execFileSync('git', [
-                'diff-tree', '--no-commit-id', '--name-only', '-z', '-r', sanitizedHash
+                'diff-tree', '--root', '--no-commit-id', '--name-only', '-z', '-r', commitHash
             ], {
                 cwd: this.config.repoRoot,
                 encoding: 'utf-8',

package/dist/shared/llm/cache.js

@@ -276,7 +276,7 @@ export class LLMResponseCache {
      * Cache a generation response
      */
     setGeneration(input, response, options, ttlMs) {
-        if (!this.config.cacheGenerations) {
+        if (!this.config.cacheGenerations || response.finishReason === 'content_filter') {
             return;
         }
         const key = LLMCache.generateKey('generation', input, options);

package/dist/shared/llm/cost-tracker.js

@@ -7,6 +7,7 @@
  */
 import { randomUUID } from 'crypto';
 import { getModelCost } from './model-registry.js';
+import { addToCount, createSafeRecord } from '../utils/safe-record.js';
 /**
  * Token pricing per model (cost per 1M tokens in USD).
  * Current-generation prices verified 2026-09-27 (Anthropic docs, OpenRouter
@@ -133,7 +134,8 @@ export const MODEL_PRICING = {
  * as a free/local model.
  */
 export function resolveModelPricing(model) {
-    const pricing = MODEL_PRICING[model];
+    // Own keys only: a model named `toString` must not resolve to the inherited method (#914).
+    const pricing = Object.hasOwn(MODEL_PRICING, model) ? MODEL_PRICING[model] : undefined;
     if (pricing) {
         return { input: pricing.input, output: pricing.output };
     }
@@ -238,15 +240,15 @@ export class CostTracker {
             gemini: 0,
             cognitum: 0,
         };
-        const byModel = {};
+        // Model and provider names are data, so buckets must not inherit from Object.prototype (#914).
+        const byModel = createSafeRecord();
         let totalCost = 0;
         let totalTokens = 0;
         for (const record of relevantRecords) {
             totalCost += record.cost.totalCost;
             totalTokens += record.usage.totalTokens;
-            const providerCost = Object.hasOwn(byProvider, record.provider) ? byProvider[record.provider] : 0;
-            byProvider[record.provider] = providerCost + record.cost.totalCost;
-            byModel[record.model] = (byModel[record.model] || 0) + record.cost.totalCost;
+            addToCount(byProvider, record.provider, record.cost.totalCost);
+            addToCount(byModel, record.model, record.cost.totalCost);
         }
         return {
             period,
@@ -277,7 +279,7 @@ export class CostTracker {
     getUsageByProvider(provider, period = 'all') {
         const periodStart = this.getPeriodStart(new Date(), period);
         const providerRecords = this.records.filter((r) => r.provider === provider && r.timestamp >= periodStart);
-        const models = {};
+        const models = createSafeRecord();
         let totalCost = 0;
         let totalTokens = 0;
         for (const record of providerRecords) {

package/dist/shared/llm/providers/azure-openai.js

@@ -33,6 +33,7 @@ import { applyOpenAIParams } from '../openai-params.js';
 import { TokenMetricsCollector } from '../../../learning/token-tracker.js';
 import { toError } from '../../error-utils.js';
 import { backoffDelay } from '../retry.js';
+import { fetchWithResponseDeadline } from './response-deadline.js';
 /**
  * Default Azure OpenAI configuration
  */
@@ -492,27 +493,10 @@ export class AzureOpenAIProvider {
      * Fetch with timeout
      */
     async fetchWithTimeout(url, options, timeoutMs) {
-        const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
-        try {
-            const response = await fetch(url, {
-                ...options,
-                signal: controller.signal,
-            });
-            return response;
-        }
-        catch (error) {
-            if (error instanceof Error && error.name === 'AbortError') {
-                throw createLLMError('Request timed out', 'TIMEOUT', {
-                    provider: 'azure-openai',
-                    retryable: true,
-                });
-            }
-            throw error;
-        }
-        finally {
-            clearTimeout(timeoutId);
-        }
+        return fetchWithResponseDeadline(url, options, timeoutMs, () => createLLMError('Request timed out', 'TIMEOUT', {
+            provider: 'azure-openai',
+            retryable: true,
+        }));
     }
     /**
      * Fetch with retry logic

package/dist/shared/llm/providers/bedrock.js

@@ -16,6 +16,7 @@ import { CostTracker } from '../cost-tracker.js';
 import { TokenMetricsCollector } from '../../../learning/token-tracker.js';
 import { toError } from '../../error-utils.js';
 import { backoffDelay } from '../retry.js';
+import { fetchWithResponseDeadline } from './response-deadline.js';
 import { applyAnthropicParams } from '../anthropic-params.js';
 /**
  * Default Bedrock configuration
@@ -545,27 +546,10 @@ export class BedrockProvider {
      * Fetch with timeout
      */
     async fetchWithTimeout(url, options, timeoutMs) {
-        const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
-        try {
-            const response = await fetch(url, {
-                ...options,
-                signal: controller.signal,
-            });
-            return response;
-        }
-        catch (error) {
-            if (error instanceof Error && error.name === 'AbortError') {
-                throw createLLMError('Request timed out', 'TIMEOUT', {
-                    provider: 'bedrock',
-                    retryable: true,
-                });
-            }
-            throw error;
-        }
-        finally {
-            clearTimeout(timeoutId);
-        }
+        return fetchWithResponseDeadline(url, options, timeoutMs, () => createLLMError('Request timed out', 'TIMEOUT', {
+            provider: 'bedrock',
+            retryable: true,
+        }));
     }
     /**
      * Sleep utility

package/dist/shared/llm/providers/claude.js

@@ -10,6 +10,7 @@ import { CostTracker } from '../cost-tracker.js';
 import { TokenMetricsCollector } from '../../../learning/token-tracker.js';
 import { toError } from '../../error-utils.js';
 import { backoffDelay } from '../retry.js';
+import { fetchWithResponseDeadline } from './response-deadline.js';
 import { applyAnthropicParams } from '../anthropic-params.js';
 import { DEFAULT_SONNET_MODEL } from '../model-registry.js';
 /**
@@ -357,27 +358,10 @@ export class ClaudeProvider {
      * Fetch with timeout
      */
     async fetchWithTimeout(url, options, timeoutMs) {
-        const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
-        try {
-            const response = await fetch(url, {
-                ...options,
-                signal: controller.signal,
-            });
-            return response;
-        }
-        catch (error) {
-            if (error instanceof Error && error.name === 'AbortError') {
-                throw createLLMError('Request timed out', 'TIMEOUT', {
-                    provider: 'claude',
-                    retryable: true,
-                });
-            }
-            throw error;
-        }
-        finally {
-            clearTimeout(timeoutId);
-        }
+        return fetchWithResponseDeadline(url, options, timeoutMs, () => createLLMError('Request timed out', 'TIMEOUT', {
+            provider: 'claude',
+            retryable: true,
+        }));
     }
     /**
      * Fetch with retry logic

package/dist/shared/llm/providers/cognitum.js

@@ -16,6 +16,7 @@ import { createLLMError, } from '../interfaces.js';
 import { TokenMetricsCollector } from '../../../learning/token-tracker.js';
 import { toError } from '../../error-utils.js';
 import { backoffDelay } from '../retry.js';
+import { fetchWithResponseDeadline } from './response-deadline.js';
 export const DEFAULT_COGNITUM_CONFIG = {
     model: 'cognitum-auto',
     maxTokens: 4096,
@@ -320,23 +321,10 @@ export class CognitumProvider {
         }
     }
     async fetchWithTimeout(url, options, timeoutMs) {
-        const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
-        try {
-            return await fetch(url, { ...options, signal: controller.signal });
-        }
-        catch (error) {
-            if (error instanceof Error && error.name === 'AbortError') {
-                throw createLLMError('Request timed out', 'TIMEOUT', {
-                    provider: 'cognitum',
-                    retryable: true,
-                });
-            }
-            throw error;
-        }
-        finally {
-            clearTimeout(timeoutId);
-        }
+        return fetchWithResponseDeadline(url, options, timeoutMs, () => createLLMError('Request timed out', 'TIMEOUT', {
+            provider: 'cognitum',
+            retryable: true,
+        }));
     }
     async fetchWithRetry(url, options, timeoutMs, maxRetries) {
         let lastError;