agentic-qe 3.15.6 → 3.15.7

package/dist/domains/security-compliance/services/security-auditor.d.ts

@@ -12,6 +12,7 @@
 import { Result } from '../../../shared/types/index.js';
 import type { MemoryBackend } from '../../../kernel/interfaces.js';
 import type { FilePath } from '../../../shared/value-objects/index.js';
+import { OSVClient } from '../../../shared/security/osv-client.js';
 import type { DependencyScanResult, PackageSecurityInfo, UpgradeRecommendation, Vulnerability, DependencyInfo, SecretScanResult, SecurityAuditOptions, SecurityAuditReport } from '../interfaces.js';
 export type { ISecurityAuditorService, SecurityPostureSummary, TriagedVulnerabilities, SecurityAuditorConfig, PackageJson, OSVQueryRequest, OSVVulnerability, OSVQueryResponse, HttpResponse, } from './security-auditor-types.js';
 export { DEFAULT_CONFIG, httpPost, httpGet } from './security-auditor-types.js';
@@ -19,7 +20,8 @@ import type { ISecurityAuditorService, SecurityPostureSummary, TriagedVulnerabil
 export declare class SecurityAuditorService implements ISecurityAuditorService {
     private readonly memory;
     private readonly config;
-    constructor(memory: MemoryBackend, config?: Partial<SecurityAuditorConfig>);
+    private readonly osvClient;
+    constructor(memory: MemoryBackend, config?: Partial<SecurityAuditorConfig>, osvClient?: OSVClient);
     scanDependencies(manifestPath: FilePath): Promise<Result<DependencyScanResult>>;
     checkPackage(name: string, version: string, ecosystem: DependencyInfo['ecosystem']): Promise<Result<PackageSecurityInfo>>;
     getUpgradeRecommendations(vulnerabilities: Vulnerability[]): Promise<Result<UpgradeRecommendation[]>>;
@@ -29,12 +31,23 @@ export declare class SecurityAuditorService implements ISecurityAuditorService {
     triageVulnerabilities(vulnerabilities: Vulnerability[]): Promise<Result<TriagedVulnerabilities>>;
     private detectEcosystem;
     private parseDependencies;
-    private cleanVersionSpec;
-    private checkDependencyVulnerabilities;
+    /**
+     * Dependencies to check for a scan. npm uses the shared resolver (#1049):
+     * lockfile-resolved versions when in sync with package.json, exact specs
+     * otherwise, local packages excluded; anything that cannot be matched without
+     * guessing is returned as pre-unchecked. Planning errors (a malformed lockfile,
+     * a workspace root whose members are not scanned, #1057) are pre-unchecked too,
+     * so the audit is never complete when they occur.
+     */
+    private parseDependenciesForScan;
+    /**
+     * Check dependencies against OSV advisories. A failed or partial lookup is
+     * reported with the unchecked dependencies, never as "no vulnerabilities" (#1049).
+     */
+    private checkDependencyAdvisories;
+    private toDependencyScanResult;
     private mapToOSVEcosystem;
-    private mapOSVVulnerability;
-    private mapOSVSeverity;
-    private extractFixedVersion;
+    private mapParsedVulnerability;
     private categorizeVulnerability;
     private checkOutdated;
     private queryVulnerabilityDatabase;

package/dist/domains/security-compliance/services/security-auditor.js

@@ -16,8 +16,11 @@ import * as path from 'path';
 import { ok, err } from '../../../shared/types/index.js';
 import { toError } from '../../../shared/error-utils.js';
 import { safeJsonParse } from '../../../shared/safe-json.js';
+import { OSVClient } from '../../../shared/security/osv-client.js';
+import { lookupKey } from '../../../shared/security/osv-lookup.js';
+import { resolveDependencies } from './scanners/dependency-resolver.js';
 export { DEFAULT_CONFIG, httpPost, httpGet } from './security-auditor-types.js';
-import { DEFAULT_CONFIG, httpPost, httpGet } from './security-auditor-types.js';
+import { DEFAULT_CONFIG, httpGet } from './security-auditor-types.js';
 // Import extracted modules
 import { performSASTScan } from './security-auditor-sast.js';
 import { performDASTScan } from './security-auditor-dast.js';
@@ -27,12 +30,16 @@ import { calculateOverallRisk, generateRecommendations, countBySeverity, countOp
 // Security Auditor Service Implementation
 // ============================================================================
 const logger = LoggerFactory.create('security-compliance/security-auditor');
+/** Name of an unchecked entry that stands for a planning error (malformed lockfile, workspace root #1057). */
+const PLANNING_ENTRY = '(dependency plan)';
 export class SecurityAuditorService {
     memory;
     config;
-    constructor(memory, config = {}) {
+    osvClient;
+    constructor(memory, config = {}, osvClient) {
         this.memory = memory;
         this.config = { ...DEFAULT_CONFIG, ...config };
+        this.osvClient = osvClient ?? new OSVClient();
     }
     // ==========================================================================
     // IDependencySecurityService Implementation
@@ -44,20 +51,19 @@ export class SecurityAuditorService {
             if (!ecosystem) {
                 return err(new Error(`Unknown manifest format: ${manifest}`));
             }
-            const vulnerabilities = [];
             const outdatedPackages = [];
-            const dependencies = await this.parseDependencies(manifest, ecosystem);
+            const { dependencies, preUnchecked } = await this.parseDependenciesForScan(manifest, ecosystem);
+            const advisories = await this.checkDependencyAdvisories(dependencies, preUnchecked);
             for (const dep of dependencies) {
-                const vulns = await this.checkDependencyVulnerabilities(dep, ecosystem);
-                vulnerabilities.push(...vulns);
                 const outdated = await this.checkOutdated(dep);
                 if (outdated) {
                     outdatedPackages.push(outdated);
                 }
             }
-            const summary = this.createDependencySummary(vulnerabilities, dependencies.length);
-            await this.memory.set(`security:deps:${manifestPath.filename}`, { vulnerabilities, outdatedPackages, summary }, { namespace: 'security-compliance', ttl: 86400 });
-            return ok({ vulnerabilities, outdatedPackages, summary });
+            const summary = this.createDependencySummary(advisories.vulnerabilities, dependencies.length);
+            const result = this.toDependencyScanResult(advisories, outdatedPackages, summary);
+            await this.memory.set(`security:deps:${manifestPath.filename}`, result, { namespace: 'security-compliance', ttl: 86400 });
+            return ok(result);
         }
         catch (error) {
             return err(toError(error));
@@ -134,6 +140,10 @@ export class SecurityAuditorService {
             }
             const overallRiskScore = calculateOverallRisk(sastResults, dastResults, dependencyResults, secretScanResults);
             const recommendations = generateRecommendations(sastResults, dastResults, dependencyResults, secretScanResults);
+            // #1049: an incomplete advisory lookup leaves dependency risk unmeasured.
+            if (dependencyResults && dependencyResults.status !== 'complete') {
+                recommendations.unshift(`${dependencyResults.error ?? 'Dependency advisories could not be checked'}. Dependency risk is unmeasured; re-run the scan when the OSV API is reachable.`);
+            }
             const report = {
                 auditId,
                 timestamp,
@@ -247,9 +257,9 @@ export class SecurityAuditorService {
                     ...packageJson.peerDependencies,
                     ...packageJson.optionalDependencies,
                 };
+                // Declared specs only; scans resolve versions via parseDependenciesForScan (#1049).
                 for (const [name, versionSpec] of Object.entries(allDeps)) {
-                    const version = this.cleanVersionSpec(versionSpec);
-                    dependencies.push({ name, version, ecosystem: 'npm' });
+                    dependencies.push({ name, version: versionSpec, ecosystem: 'npm' });
                 }
             }
             else if (ecosystem === 'pip') {
@@ -259,11 +269,14 @@ export class SecurityAuditorService {
                     const trimmed = line.trim();
                     if (!trimmed || trimmed.startsWith('#'))
                         continue;
-                    const match = trimmed.match(/^([a-zA-Z0-9_-]+)(?:[=<>~!]+(.+))?$/);
+                    // Only an `==` pin is a concrete version; any other specifier is kept
+                    // verbatim so the lookup reports it unchecked (#1049).
+                    const match = trimmed.match(/^([a-zA-Z0-9_.-]+)\s*(===?|>=|<=|~=|!=|>|<)?\s*([^\s;#]+)?/);
                     if (match) {
+                        const [, name, op, value] = match;
                         dependencies.push({
-                            name: match[1],
-                            version: match[2] || 'latest',
+                            name,
+                            version: value && (op === '==' || op === '===') ? value : op && value ? `${op}${value}` : '*',
                             ecosystem: 'pip',
                         });
                     }
@@ -272,32 +285,90 @@ export class SecurityAuditorService {
         }
         catch (error) {
             logger.error(`Failed to parse dependencies from ${manifest}:`, error instanceof Error ? error : undefined);
+            // #1049: an unreadable manifest is a failed scan, not a project with no dependencies.
+            throw error;
         }
         return dependencies;
     }
-    cleanVersionSpec(versionSpec) {
-        return versionSpec.replace(/^[\^~>=<]+/, '').trim();
-    }
-    async checkDependencyVulnerabilities(dep, ecosystem) {
-        const vulnerabilities = [];
+    /**
+     * Dependencies to check for a scan. npm uses the shared resolver (#1049):
+     * lockfile-resolved versions when in sync with package.json, exact specs
+     * otherwise, local packages excluded; anything that cannot be matched without
+     * guessing is returned as pre-unchecked. Planning errors (a malformed lockfile,
+     * a workspace root whose members are not scanned, #1057) are pre-unchecked too,
+     * so the audit is never complete when they occur.
+     */
+    async parseDependenciesForScan(manifest, ecosystem) {
+        if (ecosystem !== 'npm')
+            return { dependencies: await this.parseDependencies(manifest, ecosystem), preUnchecked: [] };
+        let resolution;
         try {
-            const osvEcosystem = this.mapToOSVEcosystem(ecosystem);
-            const osvQuery = {
-                package: { name: dep.name, ecosystem: osvEcosystem },
-                version: dep.version,
-            };
-            const response = await httpPost('https://api.osv.dev/v1/query', osvQuery);
-            if (response.ok && response.data.vulns && response.data.vulns.length > 0) {
-                for (const osvVuln of response.data.vulns) {
-                    const vulnerability = this.mapOSVVulnerability(osvVuln, dep);
-                    vulnerabilities.push(vulnerability);
-                }
-            }
+            resolution = await resolveDependencies(manifest);
         }
         catch (error) {
-            logger.error(`Failed to check vulnerabilities for ${dep.name}@${dep.version}:`, error instanceof Error ? error : undefined);
+            logger.error(`Failed to parse dependencies from ${manifest}:`, error instanceof Error ? error : undefined);
+            // #1049: an unreadable manifest is a failed scan, not a project with no dependencies.
+            throw error;
         }
-        return vulnerabilities;
+        const dependencies = [];
+        const preUnchecked = [];
+        for (const dep of resolution.dependencies) {
+            if (dep.kind === 'check')
+                dependencies.push({ name: dep.packageName, version: dep.version, ecosystem: 'npm' });
+            else if (dep.kind === 'unchecked') {
+                preUnchecked.push({ name: dep.name, version: dep.spec, reason: dep.reason ?? 'not checked',
+                    ...(dep.member ? { member: dep.member } : {}), ...(dep.lockedVersion ? { lockedVersion: dep.lockedVersion } : {}) });
+            }
+        }
+        for (const reason of [...(resolution.error ? [resolution.error] : []), ...resolution.memberErrors]) {
+            preUnchecked.push({ name: PLANNING_ENTRY, version: '*', reason });
+        }
+        return { dependencies, preUnchecked };
+    }
+    /**
+     * Check dependencies against OSV advisories. A failed or partial lookup is
+     * reported with the unchecked dependencies, never as "no vulnerabilities" (#1049).
+     */
+    async checkDependencyAdvisories(dependencies, preUnchecked = []) {
+        const lookup = await this.osvClient.lookupBatch(dependencies.map((dep) => ({
+            name: dep.name, ecosystem: this.mapToOSVEcosystem(dep.ecosystem), version: dep.version,
+        })));
+        const vulnerabilities = [];
+        for (const dep of dependencies) {
+            const found = lookup.results.get(lookupKey({ ecosystem: this.mapToOSVEcosystem(dep.ecosystem), name: dep.name, version: dep.version })) ?? [];
+            vulnerabilities.push(...found.map((parsed) => this.mapParsedVulnerability(parsed, dep)));
+        }
+        const uncheckedPackages = [...preUnchecked, ...lookup.unchecked.map((pkg) => ({
+                name: pkg.name, version: pkg.version ?? 'unknown', reason: pkg.reason,
+            }))];
+        const reasons = lookup.errors.length > 0 ? lookup.errors : [...new Set(uncheckedPackages.map((p) => p.reason))];
+        const requested = lookup.packagesChecked + uncheckedPackages.length;
+        // `failed` only when a real package was to be checked and none was; a planning
+        // error alone (e.g. an empty workspace root) is incomplete, as in the scanner.
+        const realRequested = requested - uncheckedPackages.filter((p) => p.name === PLANNING_ENTRY).length;
+        const status = lookup.packagesChecked === requested ? 'complete'
+            : lookup.packagesChecked === 0 && realRequested > 0 ? 'failed' : 'incomplete';
+        return {
+            vulnerabilities,
+            status,
+            packagesChecked: lookup.packagesChecked,
+            uncheckedPackages,
+            ...(status === 'complete' ? {} : {
+                error: `Dependency advisories could not be checked for ${uncheckedPackages.length} package(s): ${reasons.slice(0, 3).join('; ')}`,
+            }),
+        };
+    }
+    toDependencyScanResult(advisories, outdatedPackages, summary) {
+        return {
+            vulnerabilities: advisories.vulnerabilities,
+            outdatedPackages,
+            summary,
+            status: advisories.status,
+            measured: advisories.status === 'complete',
+            packagesChecked: advisories.packagesChecked,
+            uncheckedPackages: advisories.uncheckedPackages,
+            ...(advisories.error ? { error: advisories.error } : {}),
+        };
     }
     mapToOSVEcosystem(ecosystem) {
         const ecosystemMap = {
@@ -309,13 +380,10 @@ export class SecurityAuditorService {
         };
         return ecosystemMap[ecosystem];
     }
-    mapOSVVulnerability(osvVuln, dep) {
-        const cveId = osvVuln.aliases?.find((alias) => alias.startsWith('CVE-'));
-        const severity = this.mapOSVSeverity(osvVuln.severity);
-        const fixedVersion = this.extractFixedVersion(osvVuln);
-        const references = osvVuln.references?.map((ref) => ref.url) || [];
+    mapParsedVulnerability(parsed, dep) {
+        const fixedVersion = parsed.fixedVersions[0];
         const location = {
-            file: 'package.json',
+            file: dep.ecosystem === 'pip' ? 'requirements.txt' : 'package.json',
             dependency: dep,
         };
         const remediation = {
@@ -328,51 +396,17 @@ export class SecurityAuditorService {
         };
         return {
             id: uuidv4(),
-            cveId,
-            title: osvVuln.summary || `Vulnerability in ${dep.name}`,
-            description: osvVuln.details || osvVuln.summary || 'No description available',
-            severity,
-            category: this.categorizeVulnerability(osvVuln),
+            cveId: parsed.cveIds[0],
+            title: parsed.summary || `Vulnerability in ${dep.name}`,
+            description: parsed.details || parsed.summary || 'No description available',
+            // An advisory without a severity rating stays reported, at medium (as before).
+            severity: parsed.severity === 'unknown' ? 'medium' : parsed.severity,
+            category: this.categorizeVulnerability({ summary: parsed.summary, details: parsed.details }),
             location,
             remediation,
-            references,
+            references: parsed.references,
         };
     }
-    mapOSVSeverity(severityScores) {
-        if (!severityScores || severityScores.length === 0) {
-            return 'medium';
-        }
-        const cvssScore = severityScores.find((s) => s.type === 'CVSS_V3' || s.type === 'CVSS_V2');
-        if (cvssScore) {
-            const score = parseFloat(cvssScore.score);
-            if (score >= 9.0)
-                return 'critical';
-            if (score >= 7.0)
-                return 'high';
-            if (score >= 4.0)
-                return 'medium';
-            if (score > 0)
-                return 'low';
-        }
-        return 'medium';
-    }
-    extractFixedVersion(osvVuln) {
-        if (!osvVuln.affected)
-            return undefined;
-        for (const affected of osvVuln.affected) {
-            if (affected.ranges) {
-                for (const range of affected.ranges) {
-                    if (range.events) {
-                        const fixedEvent = range.events.find((event) => event.fixed);
-                        if (fixedEvent?.fixed) {
-                            return fixedEvent.fixed;
-                        }
-                    }
-                }
-            }
-        }
-        return undefined;
-    }
     categorizeVulnerability(osvVuln) {
         const summary = (osvVuln.summary || '').toLowerCase();
         const details = (osvVuln.details || '').toLowerCase();
@@ -397,7 +431,8 @@ export class SecurityAuditorService {
     }
     async checkOutdated(dep) {
         const latestVersion = await this.getLatestVersion(dep.name, dep.ecosystem);
-        if (latestVersion !== dep.version) {
+        // A failed registry lookup ('unknown') is not evidence the package is outdated.
+        if (latestVersion !== 'unknown' && latestVersion !== dep.version) {
             return {
                 name: dep.name,
                 currentVersion: dep.version,
@@ -408,8 +443,11 @@ export class SecurityAuditorService {
         return null;
     }
     async queryVulnerabilityDatabase(name, version, ecosystem) {
-        const dep = { name, version, ecosystem };
-        return this.checkDependencyVulnerabilities(dep, ecosystem);
+        const outcome = await this.checkDependencyAdvisories([{ name, version, ecosystem }]);
+        if (outcome.status !== 'complete') {
+            throw new Error(outcome.error ?? `Dependency advisories could not be checked for ${name}@${version}`);
+        }
+        return outcome.vulnerabilities;
     }
     async getLatestVersion(name, ecosystem) {
         try {
@@ -495,25 +533,23 @@ export class SecurityAuditorService {
     }
     async performDependencyScan() {
         const startTime = Date.now();
-        const vulnerabilities = [];
         const outdatedPackages = [];
+        const manifestPath = path.join(process.cwd(), 'package.json');
         try {
-            const manifestPath = path.join(process.cwd(), 'package.json');
-            const dependencies = await this.parseDependencies(manifestPath, 'npm');
+            const { dependencies, preUnchecked } = await this.parseDependenciesForScan(manifestPath, 'npm');
+            const advisories = await this.checkDependencyAdvisories(dependencies, preUnchecked);
             for (const dep of dependencies) {
-                const vulns = await this.checkDependencyVulnerabilities(dep, dep.ecosystem);
-                vulnerabilities.push(...vulns);
                 const outdated = await this.checkOutdated(dep);
                 if (outdated) {
                     outdatedPackages.push(outdated);
                 }
             }
-            const scanDurationMs = Date.now() - startTime;
-            const baseSummary = this.createDependencySummary(vulnerabilities, dependencies.length);
-            return { vulnerabilities, outdatedPackages, summary: { ...baseSummary, scanDurationMs } };
+            const baseSummary = this.createDependencySummary(advisories.vulnerabilities, dependencies.length);
+            return this.toDependencyScanResult(advisories, outdatedPackages, { ...baseSummary, scanDurationMs: Date.now() - startTime });
         }
         catch (error) {
             logger.error('Dependency scan failed:', error instanceof Error ? error : undefined);
+            // #1049: a scan that could not run is failed, never an empty clean result.
             return {
                 vulnerabilities: [],
                 outdatedPackages: [],
@@ -521,6 +557,11 @@ export class SecurityAuditorService {
                     critical: 0, high: 0, medium: 0, low: 0, informational: 0,
                     totalFiles: 0, scanDurationMs: Date.now() - startTime,
                 },
+                status: 'failed',
+                measured: false,
+                packagesChecked: 0,
+                uncheckedPackages: [],
+                error: `Dependency scan of ${manifestPath} failed: ${toError(error).message}`,
             };
         }
     }
@@ -564,7 +605,7 @@ export class SecurityAuditorService {
                 }
             }
         }
-        catch (error) {
+        catch {
             logger.debug('Directory read error:');
         }
         return files;

package/dist/domains/test-execution/services/retry-handler.js

@@ -7,6 +7,7 @@ import { spawn } from 'node:child_process';
 import { createVitestJsonReport } from '../../../shared/vitest-json-report.js';
 import { jestExactPathPattern, nameFilterArg, runnerFilePath } from '../../../shared/test-runner-args.js';
 import { existsSync, readFileSync } from 'node:fs';
+import { resolve as resolvePath } from 'node:path';
 import { ok, err } from '../../../shared/types/index.js';
 import { TEST_EXECUTION_CONSTANTS, RETRY_CONSTANTS } from '../../constants.js';
 import { toError } from '../../../shared/error-utils.js';
@@ -267,7 +268,7 @@ export class RetryHandlerService {
         // Build command based on runner
         const { command, args, report } = this.buildTestCommand(runner, testFile, testName, cwd);
         // Execute the test
-        return this.spawnTestProcess(command, args, cwd, report);
+        return this.spawnTestProcess(command, args, cwd, report, runner === 'vitest' ? testFile : undefined);
     }
     /**
      * Detect which test runner is available in the project
@@ -380,7 +381,7 @@ export class RetryHandlerService {
     /**
      * Spawn a test process and parse the result
      */
-    spawnTestProcess(command, args, cwd, report) {
+    spawnTestProcess(command, args, cwd, report, targetFile) {
         return new Promise((resolve, reject) => {
             const timeout = this.config.testTimeout;
             let stdout = '';
@@ -431,7 +432,7 @@ export class RetryHandlerService {
                     if (reportText === undefined) {
                         throw new Error('The current Vitest JSON report is missing for the retry run.');
                     }
-                    settle(resolve, this.parseTestResult(code, reportText, stderr));
+                    settle(resolve, this.parseTestResult(code, reportText, stderr, targetFile));
                 }
                 catch (error) {
                     settle(reject, toError(error));
@@ -450,7 +451,7 @@ export class RetryHandlerService {
     /**
      * Parse test runner output to determine pass/fail status
      */
-    parseTestResult(exitCode, stdout, stderr) {
+    parseTestResult(exitCode, stdout, stderr, targetFile) {
         // A retry can clear a prior failure only when the report proves a test
         // actually passed. Empty/fully skipped selections can also exit zero.
         try {
@@ -458,16 +459,26 @@ export class RetryHandlerService {
             const vitestMatch = stdout.match(/\{[\s\S]*"testResults"[\s\S]*\}/);
             if (vitestMatch) {
                 const result = safeJsonParse(vitestMatch[0]);
+                // Vitest's positional file filter uses prefix matching. A passing
+                // sibling must not clear a failure in the requested file (#972).
+                const targetPassed = !targetFile || result.testResults?.some((file) => typeof file.name === 'string'
+                    && resolvePath(file.name) === resolvePath(targetFile)
+                    && file.assertionResults?.some(assertion => assertion.status === 'passed'));
                 if (exitCode === 0 && result.success !== false
                     && result.numFailedTests === 0 && result.numFailedTestSuites === 0
-                    && Number.isFinite(result.numPassedTests) && result.numPassedTests > 0) {
+                    && Number.isFinite(result.numPassedTests) && result.numPassedTests > 0
+                    && targetPassed) {
                     return { passed: true };
                 }
                 const failedTest = result.testResults?.[0]?.assertionResults?.find((r) => r.status === 'failed');
                 return {
                     passed: false,
                     error: failedTest?.failureMessages?.join('\n') || stderr
-                        || (exitCode === 0 ? 'Retry runner did not report any passing tests.' : `Test failed with exit code ${exitCode}`),
+                        || (exitCode === 0
+                            ? targetFile && !targetPassed
+                                ? `Retry runner did not report a passing test in ${targetFile}.`
+                                : 'Retry runner did not report any passing tests.'
+                            : `Test failed with exit code ${exitCode}`),
                 };
             }
             // Jest JSON output

package/dist/domains/test-execution/services/test-executor.d.ts

@@ -104,6 +104,7 @@ export declare class TestExecutorService implements ITestExecutionService {
     private validateRequest;
     private validateParallelRequest;
     private runTests;
+    private mergeSequentialCoverage;
     private executeTestFile;
     private executeTestFiles;
     /**

package/dist/domains/test-execution/services/test-executor.js

@@ -7,6 +7,7 @@ import { spawn } from 'node:child_process';
 import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
 import { v4 as uuidv4 } from 'uuid';
 import { ok, err } from '../../../shared/types/index.js';
 import { TEST_EXECUTION_CONSTANTS, LLM_ANALYSIS_CONSTANTS } from '../../constants.js';
@@ -305,11 +306,13 @@ Provide:
         const failedTests = [];
         const coverages = [];
         const allFileCoverages = [];
+        const executionResults = [];
         let passed = 0;
         let failed = 0;
         let skipped = 0;
         for (const file of testFiles) {
             const result = await this.executeTestFile(file, framework, timeout);
+            executionResults.push(result);
             passed += result.passed;
             failed += result.failed;
             skipped += result.skipped;
@@ -321,16 +324,61 @@ Provide:
                 allFileCoverages.push(...result.fileCoverages);
             }
         }
+        // Separate runner invocations each have their own coverage map. Averaging
+        // percentages double-counts source files and misses disjoint hits (#1030).
+        // If any run lacks raw counters, there is no honest combined measurement.
+        const merged = testFiles.length > 1 && !this.config.simulateForTesting
+            ? this.mergeSequentialCoverage(executionResults)
+            : undefined;
+        const separateRuns = testFiles.length > 1 && !this.config.simulateForTesting;
         return {
             total: passed + failed + skipped,
             passed,
             failed,
             skipped,
             failedTests,
-            coverage: this.aggregateCoverage(coverages),
-            fileCoverages: allFileCoverages.length > 0 ? allFileCoverages : undefined,
+            coverage: separateRuns ? merged?.summary : this.aggregateCoverage(coverages),
+            fileCoverages: separateRuns ? merged?.perFile
+                : allFileCoverages.length > 0 ? allFileCoverages : undefined,
         };
     }
+    mergeSequentialCoverage(results) {
+        if (results.some(result => !result.rawCoverageMap))
+            return undefined;
+        const merged = {};
+        for (const result of results) {
+            for (const [rawPath, entry] of Object.entries(result.rawCoverageMap)) {
+                if (!isRecord(entry) || !isRecord(entry.statementMap) || !isRecord(entry.fnMap)
+                    || !isRecord(entry.branchMap) || !isRecord(entry.s) || !isRecord(entry.f)
+                    || !isRecord(entry.b))
+                    return undefined;
+                const file = fileCoverageKey(rawPath);
+                const prior = merged[file];
+                if (prior) {
+                    if (!isDeepStrictEqual(prior.statementMap, entry.statementMap)
+                        || !isDeepStrictEqual(prior.fnMap, entry.fnMap)
+                        || !isDeepStrictEqual(prior.branchMap, entry.branchMap))
+                        return undefined;
+                    for (const counter of ['s', 'f', 'b']) {
+                        const hits = mergeHitCounts(prior[counter], entry[counter]);
+                        if (!hits)
+                            return undefined;
+                        prior[counter] = hits;
+                    }
+                }
+                else {
+                    const s = mergeHitCounts(entry.s, entry.s);
+                    const f = mergeHitCounts(entry.f, entry.f);
+                    const b = mergeHitCounts(entry.b, entry.b);
+                    if (!s || !f || !b)
+                        return undefined;
+                    merged[file] = { ...entry, path: file, s, f, b };
+                }
+            }
+        }
+        const coverage = this.extractCoverageFromJson({ coverageMap: merged });
+        return coverage.summary ? { summary: coverage.summary, perFile: coverage.perFile } : undefined;
+    }
     async executeTestFile(file, framework, timeout) {
         return this.executeTestFiles([file], framework, timeout);
     }
@@ -460,13 +508,14 @@ Provide:
                 const parseResult = this.parseTestOutput(reportText, stderr, fileLabel, framework, code);
                 // Read only this invocation's coverage artifacts. A previous or
                 // concurrent run's project coverage directory is not evidence.
-                if (parseResult.success && !parseResult.value.coverage && coverageDirectory) {
+                if (parseResult.success && coverageDirectory) {
                     const diskCoverage = this.readCoverageFromDisk(coverageDirectory);
                     if (diskCoverage) {
-                        parseResult.value.coverage = diskCoverage.summary;
-                        if (diskCoverage.perFile.length > 0) {
+                        parseResult.value.coverage ??= diskCoverage.summary;
+                        if (!parseResult.value.fileCoverages && diskCoverage.perFile.length > 0) {
                             parseResult.value.fileCoverages = diskCoverage.perFile;
                         }
+                        parseResult.value.rawCoverageMap ??= diskCoverage.rawMap;
                     }
                 }
                 finish(parseResult);
@@ -661,6 +710,7 @@ Provide:
                     failedTests,
                     coverage: covData.summary,
                     fileCoverages: covData.perFile.length > 0 ? covData.perFile : undefined,
+                    rawCoverageMap: isRecord(json.coverageMap) && !json.coverageMap.total ? json.coverageMap : undefined,
                 });
             }
             catch {
@@ -715,6 +765,7 @@ Provide:
                 failedTests,
                 coverage: covData.summary,
                 fileCoverages: covData.perFile.length > 0 ? covData.perFile : undefined,
+                rawCoverageMap: isRecord(json.coverageMap) && !json.coverageMap.total ? json.coverageMap : undefined,
             });
         }
         catch {
@@ -1067,8 +1118,8 @@ Provide:
         try {
             // Check common coverage output paths
             const candidates = [
-                join(coverageDirectory, 'coverage-summary.json'),
                 join(coverageDirectory, 'coverage-final.json'),
+                join(coverageDirectory, 'coverage-summary.json'),
             ];
             for (const filePath of candidates) {
                 if (!existsSync(filePath))
@@ -1117,7 +1168,7 @@ Provide:
                 if (typeof json === 'object' && !json.total) {
                     const result = this.extractCoverageFromJson({ coverageMap: json });
                     if (result.summary) {
-                        return { summary: result.summary, perFile: result.perFile };
+                        return { summary: result.summary, perFile: result.perFile, rawMap: json };
                     }
                 }
             }
@@ -1216,4 +1267,33 @@ function summaryPct(metric) {
         return null;
     return metric.pct;
 }
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** A test covers a counter if any invocation hit it. Reject incompatible maps. */
+function mergeHitCounts(left, right) {
+    if (!isRecord(left) || !isRecord(right))
+        return undefined;
+    const keys = Object.keys(left);
+    if (!isDeepStrictEqual(keys.sort(), Object.keys(right).sort()))
+        return undefined;
+    const merged = {};
+    for (const key of keys) {
+        const a = left[key];
+        const b = right[key];
+        if (typeof a === 'number' && Number.isFinite(a) && a >= 0
+            && typeof b === 'number' && Number.isFinite(b) && b >= 0) {
+            merged[key] = Math.max(a, b);
+        }
+        else if (Array.isArray(a) && Array.isArray(b) && a.length === b.length
+            && a.every(v => typeof v === 'number' && Number.isFinite(v) && v >= 0)
+            && b.every(v => typeof v === 'number' && Number.isFinite(v) && v >= 0)) {
+            merged[key] = a.map((v, i) => Math.max(v, b[i]));
+        }
+        else {
+            return undefined;
+        }
+    }
+    return merged;
+}
 //# sourceMappingURL=test-executor.js.map