agentic-qe 3.15.5 → 3.15.6

package/dist/init/retired-assets.js

@@ -0,0 +1,230 @@
+/**
+ * Retired shipped assets (#1017).
+ *
+ * Earlier releases copied files into the user's project that 3.15.6 renames.
+ * Re-running `aqe init` skips skills that already exist, so an existing install
+ * would keep the stale copies, and their test-glob names make the user's own
+ * vitest / jest collect AQE's eval fixtures.
+ *
+ * Each group is retired as a unit:
+ *  - A retired file is removable only when its path matches exactly, it is a
+ *    regular file (not a symlink), its resolved parent directory is inside the
+ *    project root (no symlinked ancestor), and its sha256 equals a version AQE
+ *    actually shipped.
+ *  - If ANY present file in a group is not removable (edited, symlink, outside
+ *    the project, unreadable), the whole group is kept. Deleting a pristine
+ *    `budget.ts` next to a kept `budget.test.ts` would break the user's test run
+ *    with "Cannot find module './budget'".
+ *  - After removal, the renamed replacements are installed from the package
+ *    (never overwriting an existing file), and companion files that still name
+ *    the old files (README, eval yaml) are refreshed only when they are AQE's
+ *    unmodified shipped copies. Plain `init --auto` therefore leaves a working
+ *    skill without overwriting user edits.
+ */
+import { createHash } from 'crypto';
+import { constants as fsConstants, copyFileSync, existsSync, lstatSync, readFileSync, realpathSync, unlinkSync, } from 'fs';
+import { dirname, join, sep } from 'path';
+const QC = '.claude/skills/qe-court/evals/fixtures/seeded-mutant-delivery';
+const QC_SRC = 'qe-court/evals/fixtures/seeded-mutant-delivery';
+const TS = '.claude/skills/testability-scoring/resources/templates';
+const TS_SRC = 'testability-scoring/resources/templates';
+/**
+ * Hashes are of `git show <tag>:assets/skills/<path>` over every v3 release tag.
+ * Retired files: one distinct content each (v3.13.0–v3.15.5 for qe-court,
+ * v3.0.0–v3.15.5 for testability-scoring); the same bytes now ship under the
+ * new names, which a unit test pins. Refreshed files list every earlier shipped
+ * content (qe-court.yaml changed once, at v3.14.0).
+ */
+export const RETIRED_ASSET_GROUPS = Object.freeze([
+    {
+        id: 'qe-court-seeded-mutant',
+        retired: [
+            { relPath: `${QC}/budget.test.ts`, shippedSha256: ['add1ff4cb05978c136f8c2c5cc50059d920f06f409e5f6f304239b7dad3cf65d'] },
+            { relPath: `${QC}/budget.ts`, shippedSha256: ['11fc97cad19bb4fc0d31151a6d216ab99d0df0521b60be8fb19581d412147ef6'] },
+        ],
+        replacements: [
+            { relPath: `${QC}/budget-tests.ts.fixture`, source: `${QC_SRC}/budget-tests.ts.fixture` },
+            { relPath: `${QC}/budget.ts.fixture`, source: `${QC_SRC}/budget.ts.fixture` },
+        ],
+        refresh: [
+            {
+                relPath: `${QC}/README.md`,
+                source: `${QC_SRC}/README.md`,
+                previousSha256: ['d3988b92856d0023a7ae210dce3e0bdf76204f41d635fd29f7e243c168ff6109'],
+            },
+            {
+                relPath: '.claude/skills/qe-court/evals/qe-court.yaml',
+                source: 'qe-court/evals/qe-court.yaml',
+                previousSha256: [
+                    '412899013a51a099224bad04491d49dca19f2c567c5599adedabd0e1d58556c7',
+                    '27c8be547dc032e2dbe488156dd7a30f79b1cc921fe92efec5b9bb0a151f0e9b',
+                ],
+            },
+        ],
+        advice: '3.15.6 renamed the qe-court seeded-mutant fixture to budget.ts.fixture / budget-tests.ts.fixture ' +
+            'because budget.test.ts matches test-runner globs, so your vitest/jest collects it (#1017). ' +
+            'The pair was left as is; delete or rename both files if you do not want your test runner to collect it',
+    },
+    {
+        id: 'testability-scoring-spec-template',
+        retired: [
+            {
+                relPath: `${TS}/testability-scoring.spec.template.js`,
+                shippedSha256: ['e85a3e25bb458f3d090834e121b02e8db83cdc589149b5cf7549853e1a067edf'],
+            },
+        ],
+        replacements: [
+            { relPath: `${TS}/testability-scoring-spec.template.js`, source: `${TS_SRC}/testability-scoring-spec.template.js` },
+        ],
+        refresh: [],
+        advice: '3.15.6 renamed it to testability-scoring-spec.template.js because its name matches the `*.spec.*` ' +
+            'test glob (#1017); delete or rename it if your test runner should not collect it',
+    },
+]);
+export function sha256Hex(content) {
+    return createHash('sha256').update(content).digest('hex');
+}
+/** True when `full`'s resolved parent directory is inside the resolved project root. */
+function parentInsideRoot(rootReal, full) {
+    let parentReal;
+    try {
+        parentReal = realpathSync(dirname(full));
+    }
+    catch {
+        return false;
+    }
+    return parentReal === rootReal || parentReal.startsWith(rootReal + sep);
+}
+function probe(rootReal, full, name, shippedSha256) {
+    let stat;
+    try {
+        stat = lstatSync(full);
+    }
+    catch {
+        return { state: 'absent' };
+    }
+    if (!parentInsideRoot(rootReal, full)) {
+        return { state: 'blocked', why: `${name} resolves outside the project (symlinked directory)` };
+    }
+    if (!stat.isFile())
+        return { state: 'blocked', why: `${name} is not a regular file` };
+    try {
+        if (!shippedSha256.includes(sha256Hex(readFileSync(full)))) {
+            return { state: 'blocked', why: `${name} was modified since AQE installed it` };
+        }
+    }
+    catch (error) {
+        return { state: 'blocked', why: `${name} is unreadable (${error instanceof Error ? error.message : String(error)})` };
+    }
+    return { state: 'removable' };
+}
+/** Remove retired assets AQE shipped unmodified, install replacements; keep anything else. */
+export function retireShippedAssets(projectRoot, options = {}) {
+    const groups = options.groups ?? RETIRED_ASSET_GROUPS;
+    const result = {
+        removed: [], installed: [], refreshed: [], kept: [], missingReplacements: [], replacementWarnings: [],
+    };
+    let rootReal;
+    try {
+        rootReal = realpathSync(projectRoot);
+    }
+    catch {
+        return result;
+    }
+    const abs = (rel) => join(projectRoot, ...rel.split('/'));
+    for (const group of groups) {
+        const probes = group.retired.map((file) => ({
+            file,
+            probe: probe(rootReal, abs(file.relPath), file.relPath.split('/').pop(), file.shippedSha256),
+        }));
+        const present = probes.filter((p) => p.probe.state !== 'absent');
+        if (present.length === 0)
+            continue;
+        const blocked = present.filter((p) => p.probe.state === 'blocked');
+        if (blocked.length > 0) {
+            result.kept.push({
+                group: group.id,
+                files: present.map((p) => p.file.relPath),
+                why: blocked.map((p) => p.probe.why).join('; '),
+                advice: group.advice,
+            });
+            continue;
+        }
+        for (const { file } of present) {
+            try {
+                unlinkSync(abs(file.relPath));
+                result.removed.push(file.relPath);
+            }
+            catch (error) {
+                result.kept.push({
+                    group: group.id,
+                    files: [file.relPath],
+                    why: `could not remove (${error instanceof Error ? error.message : String(error)})`,
+                    advice: group.advice,
+                });
+            }
+        }
+        for (const replacement of group.replacements) {
+            const target = abs(replacement.relPath);
+            const source = options.sourceSkillsDir ? join(options.sourceSkillsDir, ...replacement.source.split('/')) : undefined;
+            // Never overwrite. lstat (not existsSync) so a dangling symlink counts as
+            // present: it must not be written through.
+            let present;
+            try {
+                present = lstatSync(target);
+            }
+            catch {
+                present = undefined;
+            }
+            if (present?.isFile())
+                continue;
+            if (present) {
+                result.missingReplacements.push(replacement.relPath);
+                result.replacementWarnings.push(`${replacement.relPath} exists and is not a regular file (e.g. a symlink); not replaced`);
+                continue;
+            }
+            if (!source || !existsSync(source)) {
+                result.missingReplacements.push(replacement.relPath);
+                continue;
+            }
+            try {
+                // The retired files lived in the same directories, so they exist; a
+                // missing one is not created (it could sit under a symlinked ancestor).
+                if (!existsSync(dirname(target)) || !parentInsideRoot(rootReal, target)) {
+                    result.missingReplacements.push(replacement.relPath);
+                    continue;
+                }
+                // COPYFILE_EXCL = O_CREAT|O_EXCL: refuses ANY existing path, including a
+                // dangling symlink created after the check above (no write-through).
+                copyFileSync(source, target, fsConstants.COPYFILE_EXCL);
+                result.installed.push(replacement.relPath);
+            }
+            catch (error) {
+                result.missingReplacements.push(replacement.relPath);
+                if (error?.code === 'EEXIST') {
+                    result.replacementWarnings.push(`${replacement.relPath} appeared during install; not replaced`);
+                }
+            }
+        }
+        for (const refresh of group.refresh) {
+            const target = abs(refresh.relPath);
+            const source = options.sourceSkillsDir ? join(options.sourceSkillsDir, ...refresh.source.split('/')) : undefined;
+            if (!source || !existsSync(source))
+                continue;
+            try {
+                const stat = lstatSync(target);
+                if (!stat.isFile() || !parentInsideRoot(rootReal, target))
+                    continue;
+                if (!refresh.previousSha256.includes(sha256Hex(readFileSync(target))))
+                    continue; // user-edited or current
+                copyFileSync(source, target);
+                result.refreshed.push(refresh.relPath);
+            }
+            catch {
+                // absent or unreadable: nothing to refresh
+            }
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=retired-assets.js.map

package/dist/init/skills-installer.d.ts

@@ -47,6 +47,8 @@ export declare class SkillsInstaller {
      * Prioritises assets/skills/ (canonical npm source) over .claude/skills/.
      */
     private findSourceSkillsDir;
+    /** The package skills directory skills are copied from (assets/skills). */
+    getSourceSkillsDir(): string;
     /**
      * Install skills to the project
      */

package/dist/init/skills-installer.js

@@ -162,6 +162,10 @@ export class SkillsInstaller {
         // If no skills found, return the first path (will fail gracefully)
         return possiblePaths[0];
     }
+    /** The package skills directory skills are copied from (assets/skills). */
+    getSourceSkillsDir() {
+        return this.sourceSkillsDir;
+    }
     /**
      * Install skills to the project
      */

package/dist/init/types.d.ts

@@ -237,6 +237,9 @@ export interface InitResult {
                 error?: string;
             };
         };
+        /** #1017: pre-3.15.6 test-named skill files removed / kept by init. */
+        retiredAssetsRemoved?: string[];
+        retiredAssetsKept?: string[];
     };
     totalDurationMs: number;
     timestamp: Date;

package/dist/integrations/ruvector/rvf-native-adapter.d.ts

@@ -61,6 +61,8 @@ export interface RvfNativeAdapter {
         accepted: number;
         rejected: number;
     };
+    /** True when the index holds a vector for `id` (#981 review B2: reconcile with SQLite). */
+    has?(id: string): boolean;
     search(query: Float32Array | number[], k: number): RvfSearchResult[];
     delete(ids: string[]): number;
     fork(childPath: string): RvfNativeAdapter;

package/dist/integrations/ruvector/rvf-native-adapter.js

@@ -121,6 +121,11 @@ class RvfNativeAdapterImpl {
         this.persistIdMap();
         return { accepted: result.accepted, rejected: result.rejected };
     }
+    // -- has ------------------------------------------------------------------
+    has(id) {
+        this.ensureOpen();
+        return this.strToNum.has(id);
+    }
     // -- search ---------------------------------------------------------------
     search(query, k) {
         this.ensureOpen();

package/dist/integrations/ruvector/server-client.js

@@ -59,6 +59,7 @@
 import { spawn } from 'child_process';
 import { toErrorMessage } from '../../shared/error-utils.js';
 import { LoggerFactory } from '../../logging/index.js';
+import { fetchWithResponseDeadline } from '../../shared/llm/providers/response-deadline.js';
 const logger = LoggerFactory.create('ruvector-server-client');
 /**
  * Default server configuration
@@ -644,18 +645,9 @@ export class RuVectorServerClient {
      * Fetch with timeout support
      */
     async fetchWithTimeout(url, options, timeoutMs) {
-        const controller = new AbortController();
-        const timeout = setTimeout(() => controller.abort(), timeoutMs);
-        try {
-            const response = await fetch(url, {
-                ...options,
-                signal: controller.signal,
-            });
-            return response;
-        }
-        finally {
-            clearTimeout(timeout);
-        }
+        // #980 bug class: keep the deadline armed until the body is read, so a
+        // server that sends headers and stalls cannot hang health/stats calls.
+        return fetchWithResponseDeadline(url, options, timeoutMs, () => new Error(`RuVector server request timeout after ${timeoutMs}ms: ${url}`));
     }
 }
 // ============================================================================

package/dist/kernel/project-root.d.ts

@@ -16,6 +16,13 @@
  * environment changes at runtime.
  */
 export declare function clearProjectRootCache(): void;
+export { isSharedSystemDir, scratchRootPath } from './shared-dirs.js';
+/**
+ * Path of a file or directory inside the current project's `.agentic-qe`
+ * store. Writers use this instead of a cwd-relative `.agentic-qe`, so a run
+ * from a subdirectory or a shared temp dir writes to the resolved store.
+ */
+export declare function getProjectStorePath(...segments: string[]): string;
 /**
  * Find the project root by walking up the directory tree.
  *
@@ -26,6 +33,16 @@ export declare function clearProjectRootCache(): void;
  * 4. Walk up looking for package.json WITHOUT node_modules sibling (monorepo root)
  * 5. Fallback to current working directory
  *
+ * Shared directories (#1006):
+ * - The walk stops at a hard-stop directory (the OS temp dir, a fixed system
+ *   dir such as `/tmp`, `/`, `/home`, or a Windows drive root); markers in or
+ *   above it are never adopted.
+ * - In a sticky world-writable dir (mode 1777) markers are still read, so a
+ *   repo whose root is 1777 keeps its root, but a `.agentic-qe` store there
+ *   is adopted only when the same dir has `.git`.
+ * - A shared dir is never returned as the root itself: a stable per-user
+ *   scratch root is used instead (`ensureScratchRoot`).
+ *
  * Optimized: single upward walk checks all markers in one pass,
  * and the result is cached at module level for subsequent calls.
  */

package/dist/kernel/project-root.js

@@ -14,6 +14,7 @@
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
+import { ensureScratchRoot, isHardStopDir, isSharedSystemDir, isStickyWorldWritable, } from './shared-dirs.js';
 /** Module-level cache for findProjectRoot result. */
 let _cachedProjectRoot = null;
 let _cachedStartDir = null;
@@ -25,6 +26,34 @@ export function clearProjectRootCache() {
     _cachedProjectRoot = null;
     _cachedStartDir = null;
 }
+export { isSharedSystemDir, scratchRootPath } from './shared-dirs.js';
+/** Scratch roots already announced in this process (one notice per directory). */
+const announcedScratchRoots = new Set();
+/**
+ * Stable private root used when AQE runs with no project marker from a shared
+ * temp/system directory itself. Using that directory would create
+ * `<tmp>/.agentic-qe`, which every marker-less run below it would adopt
+ * (#1006). The root lives in the per-user cache dir, keyed by the directory,
+ * so memory persists across runs and no directory is minted per process.
+ */
+function scratchRootFor(sharedDir) {
+    const scratch = ensureScratchRoot(sharedDir);
+    if (!announcedScratchRoots.has(scratch)) {
+        announcedScratchRoots.add(scratch);
+        console.error(`[AQE] No project marker found and "${sharedDir}" is a shared temp/system ` +
+            `directory; using the private scratch root "${scratch}" instead of creating ` +
+            `a shared .agentic-qe store there. Set AQE_PROJECT_ROOT to choose a root.`);
+    }
+    return scratch;
+}
+/**
+ * Path of a file or directory inside the current project's `.agentic-qe`
+ * store. Writers use this instead of a cwd-relative `.agentic-qe`, so a run
+ * from a subdirectory or a shared temp dir writes to the resolved store.
+ */
+export function getProjectStorePath(...segments) {
+    return path.join(findProjectRoot(), '.agentic-qe', ...segments);
+}
 /** True when `dir` is `parent` or inside it. */
 function isWithin(dir, parent) {
     const rel = path.relative(parent, dir);
@@ -40,6 +69,16 @@ function isWithin(dir, parent) {
  * 4. Walk up looking for package.json WITHOUT node_modules sibling (monorepo root)
  * 5. Fallback to current working directory
  *
+ * Shared directories (#1006):
+ * - The walk stops at a hard-stop directory (the OS temp dir, a fixed system
+ *   dir such as `/tmp`, `/`, `/home`, or a Windows drive root); markers in or
+ *   above it are never adopted.
+ * - In a sticky world-writable dir (mode 1777) markers are still read, so a
+ *   repo whose root is 1777 keeps its root, but a `.agentic-qe` store there
+ *   is adopted only when the same dir has `.git`.
+ * - A shared dir is never returned as the root itself: a stable per-user
+ *   scratch root is used instead (`ensureScratchRoot`).
+ *
  * Optimized: single upward walk checks all markers in one pass,
  * and the result is cached at module level for subsequent calls.
  */
@@ -69,6 +108,15 @@ export function findProjectRoot(startDir = process.cwd()) {
     let lowestGitDir = null;
     let topmostPackageJson = null;
     while (checkDir !== root) {
+        // #1006: a marker in the OS temp dir or a fixed system dir belongs to no
+        // project, and nothing above one is this project's either. Stop before
+        // adopting `/tmp/.agentic-qe`, `/tmp/.git` or a store above the temp dir.
+        if (isHardStopDir(checkDir))
+            break;
+        const hasGit = fs.existsSync(path.join(checkDir, '.git'));
+        // A sticky world-writable dir is shared scratch space unless it is itself
+        // a repo root; only then may a store in it be adopted (#1006, N4).
+        const strayStoreDir = !hasGit && isStickyWorldWritable(checkDir);
         // Issue #516: prefer the NEAREST (lowest) .agentic-qe, mirroring the
         // .git logic below. Keeping the topmost match let an ancestor store
         // (e.g. ~/.agentic-qe, created by any `aqe` run from $HOME) hijack
@@ -77,12 +125,13 @@ export function findProjectRoot(startDir = process.cwd()) {
         // has not been initialized with AQE yet.
         const isHomeStoreAboveStart = checkDir === home && checkDir !== dir
             && !isWithin(dir, path.join(checkDir, '.agentic-qe'));
-        if (lowestGitDir === null && !isHomeStoreAboveStart && fs.existsSync(path.join(checkDir, '.agentic-qe'))) {
+        if (lowestGitDir === null && !isHomeStoreAboveStart && !strayStoreDir
+            && fs.existsSync(path.join(checkDir, '.agentic-qe'))) {
             if (nearestAqeDir === null) {
                 nearestAqeDir = checkDir;
             }
         }
-        if (fs.existsSync(path.join(checkDir, '.git'))) {
+        if (hasGit) {
             if (lowestGitDir === null) {
                 lowestGitDir = checkDir;
             }
@@ -101,6 +150,9 @@ export function findProjectRoot(startDir = process.cwd()) {
     else if (topmostPackageJson) {
         _cachedProjectRoot = topmostPackageJson;
     }
+    else if (isSharedSystemDir(dir)) {
+        _cachedProjectRoot = scratchRootFor(dir);
+    }
     else {
         _cachedProjectRoot = dir;
     }

package/dist/kernel/shared-dirs.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Shared temp/system directory detection and the per-user scratch root (#1006).
+ *
+ * AQE must never adopt or create a learning store in a directory that many
+ * unrelated runs share (the OS temp dir, `/tmp`, `/`, `/home`, ...): every
+ * project without a marker below it would then read and pollute one store.
+ *
+ * Dependency-free (fs/os/path/crypto only) so `project-root` stays light.
+ *
+ * @module kernel/shared-dirs
+ */
+/**
+ * Fixed POSIX system directories that are never a project root. A `.agentic-qe`,
+ * `.git` or `package.json` found in one of these is a stray left by another run.
+ */
+export declare const POSIX_SYSTEM_DIRS: readonly string[];
+/** Platform facts, injectable so Windows/macOS rules are testable anywhere. */
+export interface PlatformContext {
+    platform: NodeJS.Platform;
+    tmpdir: string;
+    homedir: string;
+    env: NodeJS.ProcessEnv;
+    /** Resolve symlinks and (on Windows) 8.3 short names; return input on failure. */
+    realpath: (p: string) => string;
+}
+export declare function currentPlatformContext(): PlatformContext;
+/**
+ * Canonical form for comparing two directory paths on `platform`: absolute,
+ * symlinks/8.3 names resolved, no trailing separator, and case-folded on
+ * Windows (whose file system is case-insensitive).
+ */
+export declare function normalizeForCompare(p: string, ctx?: PlatformContext): string;
+/** True when `a` and `b` name the same directory on the given platform. */
+export declare function samePath(a: string, b: string, ctx?: PlatformContext): boolean;
+/**
+ * True for a directory the project-root walk must never cross or adopt: the OS
+ * temp dir, a drive root on Windows, or a fixed POSIX system directory.
+ */
+export declare function isHardStopDir(dir: string, ctx?: PlatformContext): boolean;
+/** True for a sticky world-writable directory (mode 1777, the shape of a shared temp dir). */
+export declare function isStickyWorldWritable(dir: string, ctx?: PlatformContext): boolean;
+/**
+ * True when `dir` is shared by unrelated runs: a hard-stop directory or a
+ * sticky world-writable one. A plain chmod-777 directory (no sticky bit) is
+ * not shared: container workspaces often look like that and are real projects.
+ */
+export declare function isSharedSystemDir(dir: string, ctx?: PlatformContext): boolean;
+/**
+ * Per-user cache base for scratch roots:
+ * - Windows: `%LOCALAPPDATA%` (or `~/AppData/Local`)
+ * - macOS:   `~/Library/Caches`
+ * - other:   `$XDG_CACHE_HOME` when absolute, else `~/.cache`
+ */
+export declare function userScratchBase(ctx?: PlatformContext): string;
+/** Stable scratch-root path for `dir`: `<base>/<sha256(canonical dir) first 16 hex>`. */
+export declare function scratchRootPath(dir: string, ctx?: PlatformContext): string;
+/**
+ * Create (or reuse) the private scratch root that stands in for a shared
+ * directory with no project marker. The location is stable per user and per
+ * directory, so memory persists across runs and no new directory is minted
+ * per process; it lives outside every shared dir, so no other walk adopts it.
+ * Falls back to `<tmpdir>/agentic-qe-scratch-<uid>/<key>` (0700) when the
+ * user cache dir cannot be created.
+ */
+export declare function ensureScratchRoot(dir: string, ctx?: PlatformContext): string;
+//# sourceMappingURL=shared-dirs.d.ts.map