agentic-qe 3.15.2 → 3.15.4

package/dist/shared/test-runner-args.js

@@ -0,0 +1,74 @@
+/**
+ * Safe argument builders for spawning test runners (issue #909).
+ *
+ * Runner CLIs read some values in ways that can select the wrong tests:
+ * - Jest treats positional TestPathPatterns as regular expressions, so a path
+ *   containing `(`, `[`, `+` or `.` can match other files or miss its own.
+ * - A value that starts with `-` (a test name such as `-x`, or a relative path
+ *   such as `-dash.test.ts`) is parsed as a flag by Jest, Vitest and Mocha.
+ *   Vitest ignores everything after a `--` separator, so a separator alone
+ *   cannot protect positional file filters.
+ *
+ * The rules used here:
+ * - Name filters use the `--flag=value` form, so the value is never a flag.
+ * - File filters are absolute paths, which never start with `-`.
+ * - Jest file filters are regex-escaped and anchored as `^<path>$`, so they
+ *   select exactly one file, and the leading `^` cannot be read as a flag.
+ */
+import { realpathSync, statSync } from 'node:fs';
+import { basename, dirname, extname, resolve, sep } from 'node:path';
+/** Escape every regular-expression metacharacter in a literal string. */
+export function escapeRegExpLiteral(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * Absolute path for a test file. Directory symlinks (for example `/tmp` on
+ * macOS) are resolved the same way runners resolve their root, while the file
+ * name itself is kept. The result never begins with `-`.
+ */
+export function runnerFilePath(file, cwd = process.cwd()) {
+    const absolute = resolve(cwd, file);
+    try {
+        return resolve(realpathSync(dirname(absolute)), basename(absolute));
+    }
+    catch {
+        return absolute;
+    }
+}
+/**
+ * True when `absolutePath` names a directory. A path that does not exist is
+ * treated as a directory when it has no file extension.
+ */
+function isDirectoryTarget(absolutePath) {
+    try {
+        return statSync(absolutePath).isDirectory();
+    }
+    catch {
+        return extname(absolutePath) === '';
+    }
+}
+/**
+ * Jest positional TestPathPattern for `file`. A file matches exactly; a
+ * directory matches every path beneath it but not a sibling that shares its
+ * prefix (`app` vs `app-other`). Separators are normalised to `/`, which Jest
+ * maps to the platform separator.
+ */
+export function jestExactPathPattern(file, cwd = process.cwd()) {
+    const absolute = runnerFilePath(file, cwd);
+    const normalized = absolute.split(sep).join('/');
+    const end = isDirectoryTarget(absolute) ? '(?:/|$)' : '$';
+    return `^${escapeRegExpLiteral(normalized)}${end}`;
+}
+/**
+ * Literal test-name filter in `--flag=value` form. Mocha uses `--grep`; Jest
+ * and Vitest use `--testNamePattern` (the long form of `-t`).
+ */
+export function nameFilterArg(runner, testName) {
+    const pattern = escapeRegExpLiteral(testName);
+    return runner === 'mocha' ? `--grep=${pattern}` : `--testNamePattern=${pattern}`;
+}
+/** True when a command vector (runner command plus its arguments) runs Jest. */
+export function isJestCommand(args) {
+    return args.some(arg => /(^|[\\/])jest(\.cmd|\.js|\.mjs)?$/i.test(arg));
+}
+//# sourceMappingURL=test-runner-args.js.map

package/dist/shared/utils/safe-record.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Prototype-safe keyed records (#914).
+ *
+ * Plain `{}` objects inherit from Object.prototype. When a key comes from data
+ * (a model name, an agent id, a file path), keys such as `constructor`,
+ * `toString` or `__proto__` read the inherited member instead of a missing
+ * bucket: `(counts[key] || 0) + 1` then concatenates a function source string,
+ * and an assignment to `__proto__` is silently dropped.
+ */
+/** A record with no prototype, so every key starts out absent. */
+export declare function createSafeRecord<T>(): Record<string, T>;
+/** Read only an own property; inherited members count as absent. */
+export declare function getOwn<T>(record: Record<string, T>, key: string): T | undefined;
+/** Write an own data property, including for the key `__proto__`. */
+export declare function setOwn<T>(record: Record<string, T>, key: string, value: T): void;
+/** Add `amount` to the bucket for `key` and return the new total. */
+export declare function addToCount(record: Record<string, number>, key: string, amount?: number): number;
+//# sourceMappingURL=safe-record.d.ts.map

package/dist/shared/utils/safe-record.js

@@ -0,0 +1,28 @@
+/**
+ * Prototype-safe keyed records (#914).
+ *
+ * Plain `{}` objects inherit from Object.prototype. When a key comes from data
+ * (a model name, an agent id, a file path), keys such as `constructor`,
+ * `toString` or `__proto__` read the inherited member instead of a missing
+ * bucket: `(counts[key] || 0) + 1` then concatenates a function source string,
+ * and an assignment to `__proto__` is silently dropped.
+ */
+/** A record with no prototype, so every key starts out absent. */
+export function createSafeRecord() {
+    return Object.create(null);
+}
+/** Read only an own property; inherited members count as absent. */
+export function getOwn(record, key) {
+    return Object.hasOwn(record, key) ? record[key] : undefined;
+}
+/** Write an own data property, including for the key `__proto__`. */
+export function setOwn(record, key, value) {
+    Object.defineProperty(record, key, { value, writable: true, enumerable: true, configurable: true });
+}
+/** Add `amount` to the bucket for `key` and return the new total. */
+export function addToCount(record, key, amount = 1) {
+    const next = (getOwn(record, key) ?? 0) + amount;
+    setOwn(record, key, next);
+    return next;
+}
+//# sourceMappingURL=safe-record.js.map

package/dist/test-scheduling/executors/vitest-executor.js

@@ -8,6 +8,8 @@ import { execFile, spawn } from 'child_process';
 import { safeJsonParse } from '../../shared/safe-json.js';
 import { getTestRunnerExecutionError } from '../../shared/test-runner-verdict.js';
 import { createVitestJsonReport } from '../../shared/vitest-json-report.js';
+import { runnerFilePath } from '../../shared/test-runner-args.js';
+import { npmCliInvocation } from '../../shared/npm-cli-invocation.js';
 // ============================================================================
 // Vitest Executor Implementation
 // ============================================================================
@@ -56,7 +58,9 @@ export class VitestPhaseExecutor {
         const args = ['vitest', 'run', '--reporter=json'];
         // Add test patterns or specific files
         if (testFiles && testFiles.length > 0) {
-            args.push(...testFiles);
+            // #909: absolute paths cannot be read as flags when a name starts with '-'.
+            const cwd = this.config.cwd || process.cwd();
+            args.push(...testFiles.map(file => runnerFilePath(file, cwd)));
         }
         else {
             // Use phase patterns
@@ -149,10 +153,24 @@ export class VitestPhaseExecutor {
         if (this.currentCommand) {
             return Promise.reject(new Error('Test executor already has an active process'));
         }
-        // shell: false prevents argument injection. A fresh POSIX process group
-        // lets cancellation reach npx, Vitest, and the workers it started.
-        const executable = process.platform === 'win32' && command === 'npx' ? 'npx.cmd' : command;
-        const child = spawn(executable, args, {
+        // shell: false prevents argument injection. On Windows `npx` is npx.cmd,
+        // which Node refuses to start without a shell (EINVAL, CVE-2024-27980), so
+        // run the npx CLI bundled next to node.exe instead (#872). A JS vitestPath
+        // is not executable on Windows either, so it always runs via this node.
+        const invocation = command === 'npx'
+            ? npmCliInvocation('npx')
+            : /\.[cm]?js$/i.test(command)
+                ? [process.execPath, [command]]
+                : [command, []];
+        if (!invocation) {
+            return Promise.reject(new Error('Cannot run npx on Windows without a shell: node_modules\\npm\\bin\\npx-cli.js was not '
+                + 'found next to node.exe. Set vitestPath to Vitest\'s JS entry '
+                + '(node_modules/vitest/vitest.mjs), which is run with node.'));
+        }
+        const [executable, leadingArgs] = invocation;
+        // A fresh POSIX process group lets cancellation reach npx, Vitest, and the
+        // workers it started.
+        const child = spawn(executable, [...leadingArgs, ...args], {
             cwd: this.config.cwd || process.cwd(),
             env: { ...process.env, ...this.config.env },
             shell: false,

package/dist/workers/quality-daemon/git-watcher.js

@@ -10,6 +10,7 @@ import { execFile } from 'child_process';
 import { promisify } from 'util';
 import { resolve, join } from 'path';
 import { existsSync, readFileSync } from 'fs';
+import { getGitRefError } from '../../shared/git/ref-validation.js';
 const execFileAsync = promisify(execFile);
 const DEFAULTS = {
     repoRoot: process.cwd(),
@@ -155,6 +156,10 @@ export class GitWatcher {
         await this.enqueueCommitAnalysis(branch, newHash);
     }
     async enqueueCommitAnalysis(branch, commitHash) {
+        // The hash is read from a ref file; never let an option-shaped value
+        // (e.g. `--output=<path>`) reach `git diff-tree` (issue #960).
+        if (getGitRefError(commitHash, 'commit hash'))
+            return;
         let changedFiles = [];
         try {
             const { stdout } = await execFileAsync('git', [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-qe",
-  "version": "3.15.2",
+  "version": "3.15.4",
   "description": "Agentic Quality Engineering V3 - Domain-Driven Design Architecture with 13 Bounded Contexts, O(log n) coverage analysis, ReasoningBank learning, 60 specialized QE agents, mathematical Coherence verification, deep Claude Flow integration",
   "type": "module",
   "main": "./dist/index.js",

package/dist/adapters/ag-ui/json-patch-utils.d.ts

@@ -1,136 +0,0 @@
-/**
- * JSON Patch Utilities (RFC 6902)
- *
- * Provides utilities for computing and applying JSON Patch operations
- * for AG-UI STATE_DELTA event synchronization.
- *
- * Reference: https://datatracker.ietf.org/doc/html/rfc6902
- *
- * @module adapters/ag-ui/json-patch-utils
- */
-import type { JsonPatchOperation } from './event-types.js';
-/**
- * Result of applying a patch operation
- */
-export interface PatchResult {
-    /** Whether the patch was applied successfully */
-    success: boolean;
-    /** The resulting document after patch application */
-    document: Record<string, unknown>;
-    /** Error message if patch failed */
-    error?: string;
-    /** Index of the failed operation (if any) */
-    failedOperationIndex?: number;
-}
-/**
- * Configuration for diff computation
- */
-export interface DiffConfig {
-    /** Whether to generate 'test' operations for validation */
-    generateTestOps?: boolean;
-    /** Whether to use 'move' operations when possible */
-    detectMoves?: boolean;
-    /** Maximum depth to compare objects (default: unlimited) */
-    maxDepth?: number;
-}
-/**
- * Validation result for a patch operation
- */
-export interface ValidationResult {
-    /** Whether the operation is valid */
-    valid: boolean;
-    /** Error message if invalid */
-    error?: string;
-}
-/**
- * Escape special characters in a JSON Pointer token (RFC 6901)
- * ~ becomes ~0
- * / becomes ~1
- */
-export declare function escapePathToken(token: string): string;
-/**
- * Unescape special characters in a JSON Pointer token (RFC 6901)
- * ~0 becomes ~
- * ~1 becomes /
- */
-export declare function unescapePathToken(token: string): string;
-/**
- * Parse a JSON Pointer path into tokens
- */
-export declare function parsePath(path: string): string[];
-/**
- * Build a JSON Pointer path from tokens
- */
-export declare function buildPath(tokens: string[]): string;
-/**
- * Get a value from an object using a JSON Pointer path
- */
-export declare function getValueAtPath(document: Record<string, unknown>, path: string): unknown;
-/**
- * Set a value at a JSON Pointer path (mutates the document)
- */
-export declare function setValueAtPath(document: Record<string, unknown>, path: string, value: unknown): void;
-/**
- * Delete a value at a JSON Pointer path (mutates the document)
- */
-export declare function deleteValueAtPath(document: Record<string, unknown>, path: string): void;
-/**
- * Check if a path exists in the document
- */
-export declare function pathExists(document: Record<string, unknown>, path: string): boolean;
-/**
- * Validate a single patch operation
- */
-export declare function validateOperation(op: JsonPatchOperation): ValidationResult;
-/**
- * Validate an array of patch operations
- */
-export declare function validatePatch(patch: JsonPatchOperation[]): ValidationResult;
-/**
- * Apply a single patch operation to a document
- * Returns a new document (immutable)
- */
-export declare function applyOperation(document: Record<string, unknown>, op: JsonPatchOperation): Record<string, unknown>;
-/**
- * Apply a JSON Patch to a document
- * Returns result with success status and either new document or error info
- */
-export declare function applyPatch(document: Record<string, unknown>, patch: JsonPatchOperation[]): PatchResult;
-/**
- * Apply a JSON Patch atomically with automatic rollback on failure
- * Returns the new document if successful, throws on error
- */
-export declare function applyPatchAtomic(document: Record<string, unknown>, patch: JsonPatchOperation[]): Record<string, unknown>;
-/**
- * Deep equality comparison for JSON values
- */
-export declare function deepEqual(a: unknown, b: unknown): boolean;
-/**
- * Compute the JSON Patch to transform oldState into newState
- */
-export declare function computeDiff(oldState: Record<string, unknown>, newState: Record<string, unknown>, config?: DiffConfig): JsonPatchOperation[];
-/**
- * Create a test operation to validate state before applying patches
- */
-export declare function createTestOperation(path: string, value: unknown): JsonPatchOperation;
-/**
- * Create an add operation
- */
-export declare function createAddOperation(path: string, value: unknown): JsonPatchOperation;
-/**
- * Create a remove operation
- */
-export declare function createRemoveOperation(path: string): JsonPatchOperation;
-/**
- * Create a replace operation
- */
-export declare function createReplaceOperation(path: string, value: unknown): JsonPatchOperation;
-/**
- * Create a move operation
- */
-export declare function createMoveOperation(from: string, path: string): JsonPatchOperation;
-/**
- * Create a copy operation
- */
-export declare function createCopyOperation(from: string, path: string): JsonPatchOperation;
-//# sourceMappingURL=json-patch-utils.d.ts.map