agentic-qe 3.15.8 → 3.15.10

package/dist/context/sources/git-source.js

@@ -1,7 +1,7 @@
 /**
  * Git Source - Recent commit context for target files
  */
-import { execFileSync } from 'node:child_process';
+import { runGit } from '../../shared/git/git-process.js';
 export class GitContextSource {
     cwd;
     id = 'git';
@@ -18,7 +18,11 @@ export class GitContextSource {
                 // filePaths can originate from MCP tool arguments. Pass each path as
                 // one argv element; interpolating it into a shell command would allow
                 // command execution via quotes or shell metacharacters.
-                const log = execFileSync('git', ['log', '--oneline', '-5', '--', file], { cwd: this.cwd ?? process.cwd(), encoding: 'utf-8', timeout: 5000, stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+                // Async, in its own process group, so a slow git can neither stall
+                // the MCP server's event loop nor outlive its timeout (#1115).
+                const log = (await runGit(['log', '--oneline', '-5', '--', file], {
+                    cwd: this.cwd ?? process.cwd(), timeout: 5000,
+                })).trim();
                 if (log) {
                     const content = `Recent commits for ${file}:\n${log}`;
                     fragments.push({

package/dist/coordination/handlers/code-intelligence-handlers.js

@@ -5,12 +5,16 @@
  * Covers: index-code, predict-defects
  */
 import * as fs from 'fs/promises';
+import { randomUUID } from 'node:crypto';
+import { prunePredictionHistory } from '../../domains/defect-intelligence/prediction-history.js';
 import * as path from 'path';
 import { ok, err } from '../../shared/types/index.js';
 import { toError } from '../../shared/error-utils.js';
 import { discoverSourceFiles } from './handler-utils.js';
 import { resolveProjectRootFromPaths } from '../../domains/code-intelligence/project-root-resolver.js';
+import { nothingIndexedError } from '../../domains/code-intelligence/index-path-guard.js';
 import { createLogger } from '../../logging/logger-factory.js';
+import { requirePayloadPath } from '../../shared/io/payload-path-guard.js';
 const logger = createLogger('CodeIntelligenceHandlers');
 async function collectProjectMetricsForTarget(ctx, targetPath, indexedFiles) {
     if (!ctx.getCodeIntelligenceCoordinator)
@@ -42,13 +46,24 @@ async function collectProjectMetricsForTarget(ctx, targetPath, indexedFiles) {
         return undefined;
     }
 }
+/** #1126: a caller-named target must be a file or directory inside the project. */
+async function confineTarget(taskType, target) {
+    if (!target || target === '.')
+        return ok(undefined);
+    return requirePayloadPath(taskType, 'target', target, { allowDirectory: true, allowMissing: true });
+}
 export function registerCodeIntelligenceHandlers(ctx) {
     // Register code indexing handler - REAL IMPLEMENTATION
     ctx.registerHandler('index-code', async (task) => {
         const payload = task.payload;
         try {
+            // #1126: refuse an outside target before listing it, so the error
+            // cannot name the files in an outside directory.
+            const confined = await confineTarget('index-code', payload.target);
+            if (!confined.success)
+                return confined;
             const kg = ctx.getKnowledgeGraph();
-            const targetPath = payload.target || process.cwd();
+            const targetPath = confined.value ?? (payload.target || process.cwd());
             const startTime = Date.now();
             // Discover files to index
             const filesToIndex = await discoverSourceFiles(targetPath, {
@@ -78,11 +93,21 @@ export function registerCodeIntelligenceHandlers(ctx) {
                 return result;
             }
             const indexResult = result.value;
+            // #1096: files were found but none was indexed (e.g. the target is a
+            // symlink out of the project) - fail like the coordinator does.
+            if (indexResult.filesIndexed === 0) {
+                return err(nothingIndexedError(filesToIndex.length, indexResult.skipped ?? [], indexResult.errors));
+            }
+            const notIndexed = new Set([
+                ...(indexResult.skipped ?? []).map((s) => s.path),
+                ...indexResult.errors.map((e) => e.file),
+            ]);
+            const indexedFiles = filesToIndex.filter((file) => !notIndexed.has(file));
             // #999 MCP-CLI parity: `aqe code index` runs the coordinator's project
             // metric step (LOC, tests, tools); run the same step here, rooted at the
             // caller's target the way #997 resolves it. Best-effort: indexing has
             // already succeeded, so a metric failure only omits projectMetrics.
-            const projectMetrics = await collectProjectMetricsForTarget(ctx, targetPath, filesToIndex);
+            const projectMetrics = await collectProjectMetricsForTarget(ctx, targetPath, indexedFiles);
             // Detect languages from files
             const detectedLanguages = new Set();
             const extToLang = {
@@ -95,7 +120,7 @@ export function registerCodeIntelligenceHandlers(ctx) {
                 c: 'c', h: 'c', cpp: 'cpp', hpp: 'cpp', cc: 'cpp',
                 scala: 'scala',
             };
-            for (const file of filesToIndex) {
+            for (const file of indexedFiles) {
                 const ext = path.extname(file).slice(1);
                 const lang = extToLang[ext];
                 if (lang)
@@ -116,6 +141,7 @@ export function registerCodeIntelligenceHandlers(ctx) {
                 duration: indexResult.duration,
                 errors: indexResult.errors,
                 warnings: indexResult.warnings,
+                skipped: indexResult.skipped ?? [],
                 ...(projectMetrics ? { projectMetrics } : {}),
             });
         }
@@ -127,7 +153,10 @@ export function registerCodeIntelligenceHandlers(ctx) {
     ctx.registerHandler('predict-defects', async (task) => {
         const payload = task.payload;
         try {
-            const targetPath = payload.target || process.cwd();
+            const confined = await confineTarget('predict-defects', payload.target);
+            if (!confined.success)
+                return confined;
+            const targetPath = confined.value ?? path.resolve(payload.target || process.cwd());
             const minConfidence = payload.minConfidence || 0.5;
             // Discover actual source files in the target directory
             const sourceFiles = await discoverSourceFiles(targetPath, { includeTests: false });
@@ -144,6 +173,8 @@ export function registerCodeIntelligenceHandlers(ctx) {
             }
             // Analyze each file for defect indicators based on real metrics
             const predictedDefects = [];
+            const predictions = [];
+            let filesSkipped = 0;
             for (const filePath of sourceFiles) {
                 try {
                     const content = await fs.readFile(filePath, 'utf-8');
@@ -194,6 +225,18 @@ export function registerCodeIntelligenceHandlers(ctx) {
                         reasons.push('Potentially long functions');
                     }
                     probability = Math.min(probability, 0.95);
+                    // Keep every analyzed file, including a clean reanalysis below the
+                    // display threshold. Absolute paths retain the project-relative
+                    // identity when the caller targeted a nested directory (#1050).
+                    const roundedProbability = Math.round(probability * 100) / 100;
+                    predictions.push({
+                        file: path.resolve(filePath),
+                        probability: roundedProbability,
+                        riskLevel: probability >= 0.8 ? 'critical' : probability >= 0.6 ? 'high'
+                            : probability >= 0.4 ? 'medium' : probability >= 0.2 ? 'low' : 'info',
+                        factors: [{ name: 'staticCodeIndicators', contribution: roundedProbability }],
+                        recommendations: reasons,
+                    });
                     if (probability >= minConfidence) {
                         // Use relative path for readability
                         const relativePath = filePath.startsWith(targetPath)
@@ -207,9 +250,27 @@ export function registerCodeIntelligenceHandlers(ctx) {
                     }
                 }
                 catch {
+                    filesSkipped++;
                     // Skip files that can't be read
                 }
             }
+            if (predictions.length === 0) {
+                return err(new Error(`Defect prediction could not read any of ${sourceFiles.length} source files`));
+            }
+            // Record the run in the schema consumed by the background worker.
+            // These are static risk estimates from files actually read, not an
+            // empirically calibrated likelihood of future production defects.
+            const id = randomUUID();
+            await ctx.memory.set(`defect-intelligence:predictor:prediction:${id}`, {
+                id,
+                timestamp: new Date().toISOString(),
+                predictions,
+                predictionMethod: 'static-code-indicators',
+                estimated: true,
+                filesSkipped,
+                scanStatus: filesSkipped > 0 ? 'partial' : 'complete',
+            }, { namespace: 'defect-intelligence', ttl: 86400 * 7 });
+            await prunePredictionHistory(ctx.memory);
             // Sort by probability descending
             predictedDefects.sort((a, b) => b.probability - a.probability);
             // Calculate overall risk score
@@ -220,7 +281,7 @@ export function registerCodeIntelligenceHandlers(ctx) {
             // Generate recommendations from actual findings
             const recommendations = [];
             if (predictedDefects.length > 0) {
-                recommendations.push(`${predictedDefects.length} files flagged for potential defects out of ${sourceFiles.length} analyzed`);
+                recommendations.push(`${predictedDefects.length} files flagged for potential defects out of ${predictions.length} analyzed`);
                 const topFile = predictedDefects[0];
                 recommendations.push(`Highest risk: ${topFile.file} (${Math.round(topFile.probability * 100)}%) — ${topFile.reason}`);
             }
@@ -231,13 +292,19 @@ export function registerCodeIntelligenceHandlers(ctx) {
                 recommendations.push('Address TODO/FIXME comments to reduce technical debt');
             }
             if (predictedDefects.length === 0) {
-                recommendations.push('No files exceeded the defect probability threshold — code looks healthy');
+                recommendations.push(filesSkipped > 0
+                    ? `No analyzed files exceeded the threshold; ${filesSkipped} unreadable source files remain unassessed`
+                    : 'No files exceeded the defect probability threshold — code looks healthy');
             }
             return ok({
                 predictedDefects: predictedDefects.slice(0, 20), // Top 20
                 riskScore,
                 recommendations,
-                filesAnalyzed: sourceFiles.length,
+                filesAnalyzed: predictions.length,
+                filesSkipped,
+                scanStatus: filesSkipped > 0 ? 'partial' : 'complete',
+                predictionMethod: 'static-code-indicators',
+                estimated: true,
             });
         }
         catch (error) {

package/dist/coordination/handlers/coverage-collection.js

@@ -22,6 +22,7 @@ import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
 import { parseLcovInfo } from './handler-utils.js';
+import { runTestRunnerProcess } from '../../shared/test-runner-process.js';
 /**
  * Is the "never execute build tooling" kill-switch set?
  *
@@ -402,26 +403,24 @@ export async function collectRustCoverage(targetPath, options = {}) {
     // Honor the opt-out before doing any of that.
     if (isCoverageExecDisabled())
         return null;
-    const { execSync } = await import('child_process');
     const timeout = options.timeoutMs ?? 300000;
     // cargo must run from the crate root, not from whatever subdirectory the
     // caller happened to point at.
     const crateRoot = findCargoRoot(targetPath);
     if (!crateRoot)
         return null;
-    try {
-        execSync('cargo llvm-cov --version', {
-            cwd: crateRoot, timeout: 30000, stdio: ['pipe', 'pipe', 'pipe'],
-        });
-    }
-    catch {
+    // #1074: run cargo asynchronously. The coverage run executes the crate's
+    // whole test suite, and a synchronous call would stop the MCP server
+    // answering any other request for up to `timeout`.
+    const version = await runTestRunnerProcess('cargo', ['llvm-cov', '--version'], { cwd: crateRoot, timeout: 30000 });
+    if (version.error || version.status !== 0) {
         return null; // cargo-llvm-cov not installed — not an error, just unavailable.
     }
     const outPath = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'aqe-rust-cov-')), 'lcov.info');
     try {
-        execSync(`cargo llvm-cov --lcov --output-path ${JSON.stringify(outPath)}`, {
-            cwd: crateRoot, timeout, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'],
-        });
+        const run = await runTestRunnerProcess('cargo', ['llvm-cov', '--lcov', '--output-path', outPath], { cwd: crateRoot, timeout });
+        if (run.error || run.status !== 0)
+            return null;
         if (!fs.existsSync(outPath))
             return null;
         const parsed = parseLcovInfo(fs.readFileSync(outPath, 'utf-8'));

package/dist/coordination/handlers/coverage-handlers.js

@@ -6,9 +6,11 @@
  */
 import { ok, err } from '../../shared/types/index.js';
 import { toError } from '../../shared/error-utils.js';
+import { requirePayloadPath } from '../../shared/io/payload-path-guard.js';
 import { buildEstimatedCoverage, collectRustCoverage, findCargoRoot, isCoverageExecDisabled, isRustProject, } from './coverage-collection.js';
-import { describeNoData, evaluateCoverageForTarget, isUnmeasured, resolveExistingCoverage, scopeCoverageToTarget, reconcileRecommendations, thresholdVerdict, } from './coverage-target.js';
+import { describeNoData, evaluateCoverageForTarget, isUnmeasured, packageFilterForTarget, resolveExistingCoverage, scopeCoverageToTarget, reconcileRecommendations, thresholdVerdict, } from './coverage-target.js';
 import { randomUUID } from 'crypto';
+import * as path from 'path';
 import { describeRunFailure, runJsCoverage, testRunStatus } from './coverage-runner.js';
 import { collectedMetrics } from '../../domains/coverage-analysis/collected-metrics.js';
 /**
@@ -80,7 +82,8 @@ async function collectCoverage(targetPath) {
     if (existing.status === 'evaluated') {
         return fromEvaluation(existing.evaluation, false, existing.projectRoot);
     }
-    const { target, projectRoot } = existing;
+    const { target } = existing;
+    let projectRoot = existing.projectRoot;
     // #569 work item 1: delegate to real instrumentation where available.
     if (isRustProject(target)) {
         const rust = await collectRustCoverage(target);
@@ -109,7 +112,23 @@ async function collectCoverage(targetPath) {
     if (isCoverageExecDisabled()) {
         return { collected: buildEstimatedCoverage(target), ranTests: false, projectRoot };
     }
-    const run = await runJsCoverage(projectRoot, { timeoutMs: coverageTimeoutMs() });
+    const pathFilter = packageFilterForTarget(target, projectRoot);
+    let run = await runJsCoverage(projectRoot, {
+        timeoutMs: coverageTimeoutMs(),
+        pathFilter,
+    });
+    // A workspace config may deliberately include only root-level tests. If it
+    // found no tests for this package, restore the nearest-package behavior. The
+    // same fallback permits isolated package installs with no runner at the root.
+    // Do not retry timeouts, crashes or nonempty failing suites: their failures
+    // must remain visible. Only the fallback run's actual report can be measured.
+    const rootRunnerMissing = run.missing && run.numTotalTests === null;
+    const rootHadNoTests = !run.missing && run.numTotalTests === 0
+        && testRunStatus(run) === 'passed' && (run.exitCode === 0 || run.exitCode === 1);
+    if (pathFilter && !run.timedOut && (rootRunnerMissing || rootHadNoTests)) {
+        projectRoot = path.resolve(projectRoot, pathFilter);
+        run = await runJsCoverage(projectRoot, { timeoutMs: coverageTimeoutMs() });
+    }
     // An EMPTY report (`{}`) from a run that reported its tests means "the run
     // instrumented nothing under the target" → unmeasured, never an estimate
     // (#995 review BL2). An empty report from a run that crashed before
@@ -182,8 +201,16 @@ export function registerCoverageHandlers(ctx) {
     ctx.registerHandler('analyze-coverage', async (task) => {
         const payload = task.payload;
         try {
+            // #1126: collect coverage (which may run the tests) only inside the
+            // project. A missing target keeps its own message below.
+            let targetPath = payload.target || process.cwd();
+            if (payload.target && payload.target !== '.') {
+                const confined = await requirePayloadPath('analyze-coverage', 'target', payload.target, { allowDirectory: true, allowMissing: true });
+                if (!confined.success)
+                    return confined;
+                targetPath = confined.value;
+            }
             const analyzer = ctx.getCoverageAnalyzer();
-            const targetPath = payload.target || process.cwd();
             const threshold = payload.threshold || 80;
             const { collected, ranTests, noData, projectRoot, notes, runStatus, testRun } = await collectCoverage(targetPath);
             // #995 review N5: say so plainly instead of "no coverage data found".

package/dist/coordination/handlers/coverage-runner.d.ts

@@ -96,7 +96,7 @@ export declare function runnerBinDirs(projectRoot: string): string[];
  * Pick the runner and its argv. No shell is involved: `command` is the Node
  * binary and `args[0]` the runner's JS entry, so paths are passed verbatim.
  */
-export declare function buildJsCoverageInvocation(projectRoot: string, reportDir: string): JsCoverageInvocation;
+export declare function buildJsCoverageInvocation(projectRoot: string, reportDir: string, pathFilter?: string | null): JsCoverageInvocation;
 /**
  * Synchronously kill every live coverage run and remove its temp dir. Runs from
  * `process.on('exit')`, where only synchronous work is possible.
@@ -134,6 +134,7 @@ export declare function runProcessTree(command: string, args: string[], options:
  */
 export declare function runJsCoverage(projectRoot: string, options?: {
     timeoutMs?: number;
+    pathFilter?: string | null;
 }): Promise<JsCoverageRun>;
 /**
  * One-line, caller-facing explanation of why a run produced no usable report.

package/dist/coordination/handlers/coverage-runner.js

@@ -174,7 +174,7 @@ function usesPlugNPlay(projectRoot) {
  * Pick the runner and its argv. No shell is involved: `command` is the Node
  * binary and `args[0]` the runner's JS entry, so paths are passed verbatim.
  */
-export function buildJsCoverageInvocation(projectRoot, reportDir) {
+export function buildJsCoverageInvocation(projectRoot, reportDir, pathFilter) {
     const resultsFile = path.join(reportDir, RESULTS_FILE);
     const deps = readRunnerDeps(projectRoot);
     let runner = 'vitest';
@@ -200,6 +200,13 @@ export function buildJsCoverageInvocation(projectRoot, reportDir) {
         runnerArgs = ['run', '--coverage', `--coverage.reportsDirectory=${reportDir}`,
             '--coverage.reporter=json', '--coverage.reportOnFailure=true', '--reporter=json', `--outputFile=${resultsFile}`];
     }
+    // A package target run from the workspace root: restrict the run to that
+    // package's tests (vitest/jest positional filter) so a slow sibling cannot
+    // time the run out. nyc/mocha take no such filter.
+    // jest reads the positional as a regex, so escape the directory's metacharacters.
+    if (pathFilter && runner !== 'nyc') {
+        runnerArgs.push(runner === 'jest' ? pathFilter.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') : pathFilter);
+    }
     const bin = findPackageBin(projectRoot, runner === 'jest' ? 'jest' : runner);
     return {
         runner,
@@ -392,7 +399,7 @@ export async function runJsCoverage(projectRoot, options = {}) {
     const timeoutMs = options.timeoutMs ?? 120000;
     const reportDir = fs.mkdtempSync(path.join(os.tmpdir(), 'aqe-js-cov-'));
     try {
-        const inv = buildJsCoverageInvocation(projectRoot, reportDir);
+        const inv = buildJsCoverageInvocation(projectRoot, reportDir, options.pathFilter);
         if (!inv.command) {
             return {
                 runner: inv.runner, missing: true, exitCode: null, exitedCleanly: false, timedOut: false,

package/dist/coordination/handlers/coverage-target.d.ts

@@ -22,9 +22,11 @@ import type { CoverageData, FileCoverage } from '../../domains/coverage-analysis
 /**
  * Walk up from a target to the nearest directory that holds a project marker.
  *
- * NEAREST rather than topmost: in a monorepo, `packages/core/src` belongs to
- * `packages/core` (its own package.json and test config), not the workspace
- * root. This intentionally differs from `kernel/findProjectRoot`, which locates
+ * Normally NEAREST rather than topmost: in a monorepo, `packages/core/src`
+ * belongs to `packages/core` when it has its own runner config. When only the
+ * enclosing workspace has a runner config, use that workspace so test execution
+ * and existing coverage reports use the same configured root (#1005). This
+ * intentionally differs from `kernel/findProjectRoot`, which locates
  * the AQE data root (honouring AQE_PROJECT_ROOT and `.agentic-qe`).
  *
  * Returns `null` when the target does not exist (a typo must not silently
@@ -32,6 +34,14 @@ import type { CoverageData, FileCoverage } from '../../domains/coverage-analysis
  * found below the home directory / filesystem root within `maxDepth` levels.
  */
 export declare function findCoverageProjectRoot(target: string, maxDepth?: number): string | null;
+/**
+ * When `projectRoot` was adopted as a workspace root for a target inside a
+ * nested package, the directory (relative to the root, with a trailing `/`) of
+ * that package, for use as a test-runner path filter so sibling packages' tests
+ * are not run too. `null` when the target is the root itself or no nested
+ * package manifest sits between the target and the root.
+ */
+export declare function packageFilterForTarget(target: string, projectRoot: string): string | null;
 /** Is this path (by name) a coverage report rather than source code? */
 export declare function isCoverageReportFile(filePath: string): boolean;
 /**

package/dist/coordination/handlers/coverage-target.js

@@ -23,6 +23,7 @@ import * as os from 'os';
 import * as path from 'path';
 import { loadCoverageData, parseCoberturaXml, parseCoverageJson, parseCoverageSummaryJson, parseLcovInfo, } from './handler-utils.js';
 import { isTestPath } from './coverage-collection.js';
+import { findProjectRoot } from '../../kernel/project-root.js';
 // ============================================================================
 // Project root
 // ============================================================================
@@ -38,12 +39,180 @@ const PROJECT_ROOT_MARKERS = [
     'pom.xml', 'build.gradle', 'build.gradle.kts',
     '.git',
 ];
+const JS_RUNNER_CONFIGS = [
+    'vitest.config.ts', 'vitest.config.js', 'vitest.config.mts', 'vitest.config.mjs',
+    'vitest.config.cts', 'vitest.config.cjs',
+    'vitest.workspace.ts', 'vitest.workspace.js', 'vitest.workspace.mts',
+    'vitest.workspace.mjs', 'vitest.workspace.json',
+    'vite.config.ts', 'vite.config.js', 'vite.config.mts', 'vite.config.mjs',
+    'jest.config.ts', 'jest.config.js', 'jest.config.mts', 'jest.config.mjs',
+    'jest.config.cts', 'jest.config.cjs', 'jest.config.json',
+];
+function hasJsRunnerConfig(dir) {
+    if (JS_RUNNER_CONFIGS.some(name => fs.existsSync(path.join(dir, name))))
+        return true;
+    // Jest also accepts inline configuration: `"jest": { ... }` in package.json.
+    return readPackageJson(dir)?.jest !== undefined;
+}
+/**
+ * The runner a package.json declares through its dependencies, mirroring the
+ * precedence of the coverage runner (jest, then mocha/nyc, then vitest).
+ * `null` when it declares none. Jest and vitest run with no config file at all,
+ * so a dependency is as good a declaration as a config.
+ */
+function declaredRunner(dir) {
+    const pkg = readPackageJson(dir);
+    if (!pkg)
+        return null;
+    const deps = {
+        ...pkg.devDependencies,
+        ...pkg.dependencies,
+    };
+    if (deps['jest'] || deps['@jest/core'])
+        return 'jest';
+    if (deps['mocha'] || deps['nyc'])
+        return 'nyc';
+    if (deps['vitest'])
+        return 'vitest';
+    return null;
+}
+/** mocha/nyc are configured by dotfiles rather than a runner config module. */
+function hasMochaOrNycConfig(dir) {
+    try {
+        return fs.readdirSync(dir).some(name => /^\.(mocharc|nycrc)(\.|$)/.test(name));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * May a package inherit the runner config of workspace `rootDir`? Only when it
+ * does not bring its own runner: a package that declares a different runner
+ * (e.g. jest under a vitest root) must keep running that one, from its own
+ * directory. With no runner declared at the root the runner defaults to vitest.
+ */
+function packageCanUseRootRunner(pkgDir, rootDir) {
+    if (hasMochaOrNycConfig(pkgDir))
+        return (declaredRunner(rootDir) ?? 'vitest') === 'nyc';
+    const own = declaredRunner(pkgDir);
+    return own === null || own === (declaredRunner(rootDir) ?? 'vitest');
+}
+function readPackageJson(dir) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf-8'));
+        return typeof parsed === 'object' && parsed !== null ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The workspace patterns a root declares: npm/yarn `workspaces` (array or
+ * `{ packages: [...] }`) or pnpm's `packages:` list. `null` = not a workspace
+ * root. Patterns are returned as written (negations keep their `!`).
+ */
+function readWorkspacePatterns(dir) {
+    const patterns = [];
+    let isRoot = false;
+    const pkg = readPackageJson(dir);
+    const ws = pkg?.workspaces;
+    const fromPkg = Array.isArray(ws)
+        ? ws
+        : (typeof ws === 'object' && ws !== null && Array.isArray(ws.packages)
+            ? ws.packages
+            : null);
+    if (ws !== undefined && ws !== null && typeof ws === 'object')
+        isRoot = true;
+    if (fromPkg)
+        patterns.push(...fromPkg.filter((p) => typeof p === 'string'));
+    // Only the block-list `packages:` form is read; the flow form gives no
+    // patterns, so the root is not adopted (fails safe).
+    try {
+        const yaml = fs.readFileSync(path.join(dir, 'pnpm-workspace.yaml'), 'utf-8');
+        isRoot = true;
+        let inPackages = false;
+        for (const raw of yaml.split(/\r?\n/)) {
+            const line = raw.replace(/\s+#.*$/, '').trimEnd();
+            if (/^packages\s*:/.test(line)) {
+                inPackages = true;
+                continue;
+            }
+            if (inPackages) {
+                const m = /^\s+-\s+(.+)$/.exec(line);
+                if (m)
+                    patterns.push(m[1].trim().replace(/^['"]|['"]$/g, ''));
+                else if (/^\S/.test(line))
+                    inPackages = false;
+            }
+        }
+    }
+    catch { /* no pnpm-workspace.yaml */ }
+    return isRoot ? patterns : null;
+}
+function workspaceGlobToRegExp(pattern) {
+    const DEEP_DIR = '\u0000';
+    const DEEP_ANY = '\u0001';
+    const body = pattern.replace(/^\.\//, '').replace(/\/+$/, '')
+        .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+        .replace(/\*\*\//g, DEEP_DIR)
+        .replace(/\*\*/g, DEEP_ANY)
+        .replace(/\*/g, '[^/]*')
+        .replace(/\?/g, '[^/]')
+        .split(DEEP_DIR).join('(?:.*/)?')
+        .split(DEEP_ANY).join('.*');
+    return new RegExp(`^${body}$`);
+}
+/**
+ * Is `pkgDir` a member of the workspace declared at `rootDir`? Patterns are
+ * resolved relative to the root; a pattern containing a `..` segment or an
+ * absolute path is ignored (it could point outside the root), and `!`
+ * patterns exclude.
+ */
+function isWorkspaceMember(rootDir, pkgDir) {
+    const patterns = readWorkspacePatterns(rootDir);
+    if (!patterns)
+        return false;
+    const rel = path.relative(rootDir, pkgDir).split(path.sep).join('/');
+    if (rel === '' || rel.startsWith('..') || path.isAbsolute(rel))
+        return false;
+    let member = false;
+    for (const raw of patterns) {
+        const negated = raw.startsWith('!');
+        const pattern = negated ? raw.slice(1) : raw;
+        if (path.isAbsolute(pattern) || /^[A-Za-z]:/.test(pattern) || pattern.split(/[\\/]/).includes('..'))
+            continue;
+        if (workspaceGlobToRegExp(pattern).test(rel))
+            member = !negated;
+    }
+    return member;
+}
+/** True when `child` is `parent` or inside it (path-segment aware). */
+function within(child, parent) {
+    const rel = path.relative(parent, child);
+    return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
+}
+/**
+ * The AQE project root, as the ceiling for workspace-root adoption. Runner
+ * configuration is code that gets executed, so it must never be picked up from
+ * above the project (`AQE_PROJECT_ROOT` or the discovered root). `null` when it
+ * cannot be resolved, which disables adoption.
+ */
+function aqeProjectCeiling(start) {
+    try {
+        return fs.realpathSync(path.resolve(findProjectRoot(start)));
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Walk up from a target to the nearest directory that holds a project marker.
  *
- * NEAREST rather than topmost: in a monorepo, `packages/core/src` belongs to
- * `packages/core` (its own package.json and test config), not the workspace
- * root. This intentionally differs from `kernel/findProjectRoot`, which locates
+ * Normally NEAREST rather than topmost: in a monorepo, `packages/core/src`
+ * belongs to `packages/core` when it has its own runner config. When only the
+ * enclosing workspace has a runner config, use that workspace so test execution
+ * and existing coverage reports use the same configured root (#1005). This
+ * intentionally differs from `kernel/findProjectRoot`, which locates
  * the AQE data root (honouring AQE_PROJECT_ROOT and `.agentic-qe`).
  *
  * Returns `null` when the target does not exist (a typo must not silently
@@ -70,18 +239,66 @@ export function findCoverageProjectRoot(target, maxDepth = 12) {
         home = null;
     }
     const start = dir;
+    let nearestRoot = null;
+    let ceiling = null;
     for (let depth = 0; depth <= maxDepth; depth++) {
         // A stray manifest in $HOME must not claim every directory beneath it.
         // $HOME is still a valid root when it is the target itself.
         if (home !== null && dir === home && dir !== start)
-            return null;
-        if (PROJECT_ROOT_MARKERS.some(m => fs.existsSync(path.join(dir, m))))
-            return dir;
+            return nearestRoot;
+        if (!nearestRoot && PROJECT_ROOT_MARKERS.some(m => fs.existsSync(path.join(dir, m)))) {
+            nearestRoot = dir;
+            if (hasJsRunnerConfig(dir))
+                return dir;
+            // Only a nested JS package can inherit the workspace's runner config.
+            // Other project types keep the nearest-marker semantics.
+            if (!fs.existsSync(path.join(dir, 'package.json')))
+                return dir;
+        }
+        else if (nearestRoot && readWorkspacePatterns(dir) !== null) {
+            // Adopt this workspace root (and run its config) only when it is inside
+            // the AQE project and actually lists the nearest package as a member.
+            ceiling ??= aqeProjectCeiling(start) ?? '';
+            if (ceiling && within(dir, ceiling) && within(nearestRoot, ceiling)
+                && isWorkspaceMember(dir, nearestRoot) && hasJsRunnerConfig(dir)
+                && packageCanUseRootRunner(nearestRoot, dir)) {
+                return dir;
+            }
+            return nearestRoot;
+        }
+        // Do not adopt configuration from a different repository.
+        if (nearestRoot && fs.existsSync(path.join(dir, '.git')))
+            return nearestRoot;
         const parent = path.dirname(dir);
         if (parent === dir)
-            return null;
+            return nearestRoot;
         dir = parent;
     }
+    return nearestRoot;
+}
+/**
+ * When `projectRoot` was adopted as a workspace root for a target inside a
+ * nested package, the directory (relative to the root, with a trailing `/`) of
+ * that package, for use as a test-runner path filter so sibling packages' tests
+ * are not run too. `null` when the target is the root itself or no nested
+ * package manifest sits between the target and the root.
+ */
+export function packageFilterForTarget(target, projectRoot) {
+    try {
+        const root = fs.realpathSync(projectRoot);
+        const real = fs.realpathSync(path.resolve(target));
+        let dir = fs.statSync(real).isDirectory() ? real : path.dirname(real);
+        while (dir !== root && within(dir, root)) {
+            if (fs.existsSync(path.join(dir, 'package.json'))) {
+                return `${path.relative(root, dir).split(path.sep).join('/')}/`;
+            }
+            const parent = path.dirname(dir);
+            if (parent === dir)
+                break;
+            dir = parent;
+        }
+    }
+    catch { /* fall through */ }
     return null;
 }
 // ============================================================================