agentic-qe 3.15.8 → 3.15.10

package/dist/domains/code-intelligence/services/knowledge-graph.js

@@ -7,6 +7,8 @@ import { ok, err } from '../../../shared/types/index.js';
 import { TypeScriptParser } from '../../../shared/parsers/index.js';
 import { FileReader } from '../../../shared/io/index.js';
 import { NomicEmbedder } from '../../../shared/embeddings/index.js';
+import { findProjectRoot } from '../../../kernel/project-root.js';
+import { confineIndexPaths } from '../index-path-guard.js';
 import { toErrorMessage, toError } from '../../../shared/error-utils.js';
 import { safeJsonParse } from '../../../shared/safe-json.js';
 import { existsSync, statSync } from 'fs';
@@ -51,6 +53,7 @@ export class KnowledgeGraphService {
     allEdgesCache;
     tsParser;
     fileReader;
+    projectRoot;
     embedder;
     /** ADR-051: Optional LLM router for AI-enhanced extraction */
     llmRouter;
@@ -73,7 +76,13 @@ export class KnowledgeGraphService {
             this.llmRouter = undefined;
         }
         this.tsParser = new TypeScriptParser();
-        this.fileReader = new FileReader(this.config.basePath ? { basePath: this.config.basePath } : undefined);
+        // #1096: confine reads to the project root by realpath, so a symlink
+        // inside the project cannot pull an outside file into the graph.
+        this.projectRoot = this.config.projectRoot ?? this.config.basePath ?? findProjectRoot();
+        this.fileReader = new FileReader({
+            ...(this.config.basePath ? { basePath: this.config.basePath } : {}),
+            projectRoot: this.projectRoot,
+        });
         this.embedder = new NomicEmbedder({
             enableFallback: true,
         });
@@ -110,21 +119,35 @@ export class KnowledgeGraphService {
         const unsupportedByExt = new Map();
         try {
             const { paths, incremental = false, includeTests = true, languages } = request;
+            // #1096: index only regular files whose realpath is inside the project
+            // root; everything else is reported in `skipped`, never counted.
+            const { accepted, skipped } = await confineIndexPaths(paths, this.projectRoot, this.config.basePath ?? process.cwd());
+            let filesIndexed = 0;
             // Clear existing graph if not incremental
             if (!incremental) {
                 await this.clear();
             }
-            for (const path of paths) {
+            else {
+                // #511: a file deleted since the last index must not leave its old
+                // nodes/edges behind, even though it is no longer indexed.
+                for (const entry of skipped) {
+                    if (entry.reason === 'not-found')
+                        await this.removeFileFromGraph(entry.path);
+                }
+            }
+            for (const path of accepted) {
                 try {
                     // Filter by language if specified
                     if (languages && languages.length > 0) {
                         const ext = this.getFileExtension(path);
                         if (!this.matchesLanguage(ext, languages)) {
+                            skipped.push({ path, reason: 'excluded-by-language' });
                             continue;
                         }
                     }
                     // Skip test files if not included
                     if (!includeTests && this.isTestFile(path)) {
+                        skipped.push({ path, reason: 'excluded-test-file' });
                         continue;
                     }
                     const ext = this.getFileExtension(path);
@@ -135,6 +158,7 @@ export class KnowledgeGraphService {
                     const result = await this.indexFile(path, incremental);
                     nodesCreated += result.nodes;
                     edgesCreated += result.edges;
+                    filesIndexed++;
                 }
                 catch (fileError) {
                     errors.push({
@@ -159,19 +183,20 @@ export class KnowledgeGraphService {
             }
             // Store indexing metadata
             await this.storeIndexMetadata({
-                filesIndexed: paths.length - errors.length,
+                filesIndexed,
                 nodesCreated,
                 edgesCreated,
                 duration,
                 indexedAt: new Date().toISOString(),
             });
             return ok({
-                filesIndexed: paths.length - errors.length,
+                filesIndexed,
                 nodesCreated,
                 edgesCreated,
                 duration,
                 errors,
                 warnings,
+                skipped,
             });
         }
         catch (error) {
@@ -521,7 +546,19 @@ Return JSON: { "rankedIds": ["id1", "id2", ...], "insights": ["insight1", "insig
         // STALE pre-edit text. Eviction guarantees fresh reads; the two reads within
         // this method (entities + imports) still share one cache fill, so they stay
         // mutually consistent.
-        this.fileReader.invalidateCache(filePath);
+        try {
+            this.fileReader.invalidateCache(filePath);
+        }
+        catch {
+            // #1096: a path the reader's legacy validator rejects (e.g. a project
+            // root outside cwd) is never cached; the read below decides.
+        }
+        // #1096: a file that cannot be read (removed since it was confined, or
+        // blocked by the reader) is an error, not an indexed file node.
+        const readable = await this.fileReader.readFile(filePath);
+        if (!readable.success) {
+            throw readable.error;
+        }
         // #511: on an incremental re-index, drop this file's prior nodes/edges
         // first so renamed/removed entities and stale outgoing imports don't
         // linger as phantom dependencies. (A full index already cleared everything.)

package/dist/domains/code-intelligence/services/metric-collector/index.d.ts

@@ -20,7 +20,7 @@ export { DEFAULT_METRIC_CONFIG } from './interfaces.js';
  */
 export interface IMetricCollectorService extends MetricCollector {
     /** Check available tools on the system */
-    checkTools(): ToolAvailability[];
+    checkTools(): Promise<ToolAvailability[]>;
     /** Clear the metrics cache */
     clearCache(): void;
     /** Get cache statistics */
@@ -66,7 +66,7 @@ export declare class MetricCollectorService implements IMetricCollectorService {
     /**
      * Check available tools on the system
      */
-    checkTools(): ToolAvailability[];
+    checkTools(): Promise<ToolAvailability[]>;
     /**
      * Clear the metrics cache
      */

package/dist/domains/code-intelligence/services/metric-collector/index.js

@@ -138,9 +138,8 @@ export class MetricCollectorService {
     /**
      * Check available tools on the system
      */
-    checkTools() {
-        const locTools = checkLOCTools();
-        const testTools = checkTestRunners(process.cwd());
+    async checkTools() {
+        const [locTools, testTools] = await Promise.all([checkLOCTools(), checkTestRunners(process.cwd())]);
         return [...locTools, ...testTools];
     }
     /**

package/dist/domains/code-intelligence/services/metric-collector/loc-counter.d.ts

@@ -24,7 +24,7 @@ export declare function countLOC(projectPath: string, config?: Partial<MetricCol
 /**
  * Check which LOC counting tools are available
  */
-export declare function checkLOCTools(): ToolAvailability[];
+export declare function checkLOCTools(): Promise<ToolAvailability[]>;
 /**
  * cloc `--not-match-f` regex matching any of `names` exactly (basename), or
  * null when there is nothing to exclude.

package/dist/domains/code-intelligence/services/metric-collector/loc-counter.js

@@ -11,12 +11,12 @@
  *
  * @see docs/plans/AQE_V3_IMPROVEMENTS_PLAN.md - Phase 5, RM-002
  */
-import { spawnSync } from 'child_process';
 import { existsSync, readdirSync, readFileSync, statSync } from 'fs';
 import { join, extname } from 'path';
 import { AQE_CLAUDE_DIR, AQE_STATE_DIR, findAqeClaudeDirs } from '../../../../shared/aqe-managed-dirs.js';
 import { DEFAULT_METRIC_CONFIG, } from './interfaces.js';
 import { safeJsonParse } from '../../../../shared/safe-json.js';
+import { runTestRunnerProcess } from '../../../../shared/test-runner-process.js';
 // ============================================================================
 // Main LOC Counting Function
 // ============================================================================
@@ -46,37 +46,13 @@ export async function countLOC(projectPath, config = {}) {
 /**
  * Check which LOC counting tools are available
  */
-export function checkLOCTools() {
-    const tools = [];
-    // Check cloc
-    try {
-        const result = spawnSync('cloc', ['--version'], { encoding: 'utf-8', timeout: 5000 });
-        if (result.status === 0) {
-            const version = result.stdout.trim().split('\n')[0];
-            tools.push({ name: 'cloc', available: true, version });
-        }
-        else {
-            tools.push({ name: 'cloc', available: false });
-        }
-    }
-    catch {
-        tools.push({ name: 'cloc', available: false });
-    }
-    // Check tokei
-    try {
-        const result = spawnSync('tokei', ['--version'], { encoding: 'utf-8', timeout: 5000 });
-        if (result.status === 0) {
-            const version = result.stdout.trim();
-            tools.push({ name: 'tokei', available: true, version });
-        }
-        else {
-            tools.push({ name: 'tokei', available: false });
-        }
-    }
-    catch {
-        tools.push({ name: 'tokei', available: false });
-    }
-    return tools;
+export async function checkLOCTools() {
+    return Promise.all(['cloc', 'tokei'].map(async (name) => {
+        const result = await runTestRunnerProcess(name, ['--version'], { cwd: process.cwd(), timeout: 5000 });
+        if (result.error || result.status !== 0)
+            return { name, available: false };
+        return { name, available: true, version: result.stdout.trim().split('\n')[0] };
+    }));
 }
 /**
  * cloc `--not-match-f` regex matching any of `names` exactly (basename), or
@@ -134,8 +110,8 @@ async function tryClocCount(projectPath, config) {
         if (notMatch)
             args.push(`--not-match-f=${notMatch}`);
         args.push(projectPath);
-        const result = spawnSync('cloc', args, {
-            encoding: 'utf-8',
+        const result = await runTestRunnerProcess('cloc', args, {
+            cwd: process.cwd(),
             timeout: config.timeout,
             maxBuffer: 10 * 1024 * 1024, // 10MB buffer (reduced for memory safety)
         });
@@ -193,9 +169,8 @@ async function tryTokeiCount(projectPath, config) {
             args.push('-e', `/${rel}`);
         }
         args.push('.');
-        const result = spawnSync('tokei', args, {
+        const result = await runTestRunnerProcess('tokei', args, {
             cwd: projectPath,
-            encoding: 'utf-8',
             timeout: config.timeout,
             maxBuffer: 10 * 1024 * 1024, // 10MB buffer (reduced for memory safety)
         });

package/dist/domains/code-intelligence/services/metric-collector/test-counter.d.ts

@@ -29,5 +29,5 @@ export declare function detectTestRunner(projectPath: string): TestSource;
 /**
  * Check which test runners are available on the system
  */
-export declare function checkTestRunners(projectPath: string): ToolAvailability[];
+export declare function checkTestRunners(projectPath: string): Promise<ToolAvailability[]>;
 //# sourceMappingURL=test-counter.d.ts.map

package/dist/domains/code-intelligence/services/metric-collector/test-counter.js

@@ -12,7 +12,7 @@
  *
  * @see docs/plans/AQE_V3_IMPROVEMENTS_PLAN.md - Phase 5, RM-003
  */
-import { execSync, spawn, spawnSync } from 'child_process';
+import { spawn, spawnSync } from 'child_process';
 import { createRequire } from 'module';
 import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync } from 'fs';
 import { tmpdir } from 'os';
@@ -21,6 +21,8 @@ import { AQE_STATE_DIR } from '../../../../shared/aqe-managed-dirs.js';
 import { DEFAULT_METRIC_CONFIG, } from './interfaces.js';
 import { safeJsonParse } from '../../../../shared/safe-json.js';
 import { ownListingProcess } from './listing-process-owner.js';
+import { runTestRunnerProcess } from '../../../../shared/test-runner-process.js';
+import { npmCliInvocation } from '../../../../shared/npm-cli-invocation.js';
 // ============================================================================
 // Main Test Counting Function
 // ============================================================================
@@ -99,82 +101,31 @@ export function detectTestRunner(projectPath) {
 /**
  * Check which test runners are available on the system
  */
-export function checkTestRunners(projectPath) {
-    const tools = [];
-    // Check npx vitest
-    try {
-        const result = spawnSync('npx', ['vitest', '--version'], {
-            cwd: projectPath,
-            encoding: 'utf-8',
-            timeout: 10000,
-        });
-        if (result.status === 0) {
-            tools.push({ name: 'vitest', available: true, version: result.stdout.trim() });
-        }
-        else {
-            tools.push({ name: 'vitest', available: false });
-        }
-    }
-    catch {
-        tools.push({ name: 'vitest', available: false });
-    }
-    // Check npx jest
-    try {
-        const result = spawnSync('npx', ['jest', '--version'], {
-            cwd: projectPath,
-            encoding: 'utf-8',
-            timeout: 10000,
-        });
-        if (result.status === 0) {
-            tools.push({ name: 'jest', available: true, version: result.stdout.trim() });
-        }
-        else {
-            tools.push({ name: 'jest', available: false });
-        }
-    }
-    catch {
-        tools.push({ name: 'jest', available: false });
-    }
-    // Check cargo
-    try {
-        const result = spawnSync('cargo', ['--version'], { encoding: 'utf-8', timeout: 5000 });
-        if (result.status === 0) {
-            tools.push({ name: 'cargo', available: true, version: result.stdout.trim() });
-        }
-        else {
-            tools.push({ name: 'cargo', available: false });
-        }
-    }
-    catch {
-        tools.push({ name: 'cargo', available: false });
-    }
-    // Check pytest
-    try {
-        const result = spawnSync('pytest', ['--version'], { encoding: 'utf-8', timeout: 5000 });
-        if (result.status === 0) {
-            tools.push({ name: 'pytest', available: true, version: result.stdout.trim() });
-        }
-        else {
-            tools.push({ name: 'pytest', available: false });
-        }
-    }
-    catch {
-        tools.push({ name: 'pytest', available: false });
-    }
-    // Check go
-    try {
-        const result = spawnSync('go', ['version'], { encoding: 'utf-8', timeout: 5000 });
-        if (result.status === 0) {
-            tools.push({ name: 'go', available: true, version: result.stdout.trim() });
-        }
-        else {
-            tools.push({ name: 'go', available: false });
-        }
-    }
-    catch {
-        tools.push({ name: 'go', available: false });
-    }
-    return tools;
+export async function checkTestRunners(projectPath) {
+    const npx = npmCliInvocation('npx');
+    const probes = [
+        ['vitest', npx, ['vitest', '--version'], projectPath, 10000],
+        ['jest', npx, ['jest', '--version'], projectPath, 10000],
+        ['cargo', ['cargo', []], ['--version'], process.cwd(), 5000],
+        ['pytest', ['pytest', []], ['--version'], process.cwd(), 5000],
+        ['go', ['go', []], ['version'], process.cwd(), 5000],
+    ];
+    return Promise.all(probes.map(async ([name, invocation, args, cwd, timeout]) => {
+        const output = await runListing(invocation, args, cwd, timeout);
+        return output === null ? { name, available: false } : { name, available: true, version: output.trim() };
+    }));
+}
+/**
+ * Run a probe or listing command without blocking the event loop (#1115).
+ * Resolves with stdout on exit 0, or null when it cannot start, fails or
+ * times out; a timeout stops the whole process group (cargo, npx trees).
+ */
+async function runListing(invocation, args, cwd, timeout, maxBuffer) {
+    if (!invocation)
+        return null;
+    const [command, leadingArgs] = invocation;
+    const result = await runTestRunnerProcess(command, [...leadingArgs, ...args], { cwd, timeout, maxBuffer });
+    return result.error || result.status !== 0 ? null : result.stdout;
 }
 // ============================================================================
 // Runner-Specific Implementations
@@ -319,15 +270,12 @@ async function countVitestTests(projectPath, config) {
  * Uses `jest --listTests` for accurate test file discovery WITHOUT execution.
  * Then parses the test files to count individual tests.
  */
-function countJestTests(projectPath, config) {
+async function countJestTests(projectPath, config) {
     try {
-        // Use jest --listTests for safe enumeration (NO execution)
-        const output = execSync('npx jest --listTests', {
-            cwd: projectPath,
-            encoding: 'utf-8',
-            timeout: Math.min(config.timeout, 30000), // Cap at 30s for listing
-            maxBuffer: 10 * 1024 * 1024, // 10MB buffer (reduced from 50MB)
-        });
+        // Use jest --listTests for safe enumeration (NO execution), capped at 30s
+        const output = await runListing(npmCliInvocation('npx'), ['jest', '--listTests'], projectPath, Math.min(config.timeout, 30000), 10 * 1024 * 1024);
+        if (output === null)
+            return countTestsByFilePattern(projectPath, config);
         // Output is one test file path per line
         const testFiles = output
             .split('\n')
@@ -353,13 +301,11 @@ function countJestTests(projectPath, config) {
  * Count tests using Cargo (Rust)
  * Uses `cargo test -- --list` for accurate test enumeration
  */
-function countCargoTests(projectPath, config) {
+async function countCargoTests(projectPath, config) {
     try {
-        const output = execSync('cargo test -- --list', {
-            cwd: projectPath,
-            encoding: 'utf-8',
-            timeout: config.timeout,
-        });
+        const output = await runListing(['cargo', []], ['test', '--', '--list'], projectPath, config.timeout);
+        if (output === null)
+            throw new Error('listing failed');
         // Count lines ending with ": test"
         const testLines = output.split('\n').filter(line => line.endsWith(': test'));
         const total = testLines.length;
@@ -389,13 +335,11 @@ function countCargoTests(projectPath, config) {
  * Count tests using pytest (Python)
  * Uses `pytest --collect-only` for test discovery
  */
-function countPytestTests(projectPath, config) {
+async function countPytestTests(projectPath, config) {
     try {
-        const output = execSync('pytest --collect-only -q', {
-            cwd: projectPath,
-            encoding: 'utf-8',
-            timeout: config.timeout,
-        });
+        const output = await runListing(['pytest', []], ['--collect-only', '-q'], projectPath, config.timeout);
+        if (output === null)
+            throw new Error('listing failed');
         // Count test function lines (format: "tests/test_foo.py::test_bar")
         const testLines = output.split('\n').filter(line => line.includes('::test_') || line.includes('::Test'));
         const total = testLines.length;
@@ -426,13 +370,11 @@ function countPytestTests(projectPath, config) {
  * Count tests using Go test
  * Uses `go test -list` for test discovery
  */
-function countGoTests(projectPath, config) {
+async function countGoTests(projectPath, config) {
     try {
-        const output = execSync('go test -list ".*" ./...', {
-            cwd: projectPath,
-            encoding: 'utf-8',
-            timeout: config.timeout,
-        });
+        const output = await runListing(['go', []], ['test', '-list', '.*', './...'], projectPath, config.timeout);
+        if (output === null)
+            throw new Error('listing failed');
         // Benchmarks and examples are listed too, but are not included in the
         // test total. Apply that same selection to every category.
         const testLines = output.split('\n').filter(line => line.startsWith('Test'));

package/dist/domains/contract-testing/coordinator.js

@@ -11,6 +11,7 @@ import { toError, toErrorMessage } from '../../shared/error-utils.js';
 import { Version } from '../../shared/value-objects/index.js';
 import { createHttpClient } from '../../shared/http/index.js';
 import { FileReader } from '../../shared/io/index.js';
+import { findProjectRoot } from '../../kernel/project-root.js';
 import { createEvent } from '../../shared/events/domain-events.js';
 import { ContractValidatorService } from './services/contract-validator.js';
 import { ApiCompatibilityService } from './services/api-compatibility.js';
@@ -80,7 +81,8 @@ export class ContractTestingCoordinator extends BaseDomainCoordinator {
         this.contractValidator = new ContractValidatorService({ memory, llmRouter });
         this.apiCompatibility = new ApiCompatibilityService(memory);
         this.httpClient = createHttpClient();
-        this.fileReader = new FileReader();
+        // #1096: a symlink inside the project must not expose an outside file.
+        this.fileReader = new FileReader({ projectRoot: findProjectRoot() });
         // Note: schemaValidator initialized when needed for schema operations
     }
     // ==========================================================================

package/dist/domains/contract-testing/services/api-compatibility.js

@@ -259,9 +259,10 @@ export class ApiCompatibilityService {
             const newProps = newContent.properties || {};
             const oldRequired = oldContent.required || [];
             const newRequired = newContent.required || [];
-            // Check for removed properties
+            // Check for removed properties. #1136: own properties only, so a
+            // property named `constructor` or `toString` is compared like any other.
             for (const prop of Object.keys(oldProps)) {
-                if (!(prop in newProps)) {
+                if (!Object.hasOwn(newProps, prop)) {
                     breakingChanges.push({
                         type: 'removed-field',
                         location: `schema:${oldSchema.id}.${prop}`,
@@ -273,7 +274,7 @@ export class ApiCompatibilityService {
             }
             // Check for added properties
             for (const prop of Object.keys(newProps)) {
-                if (!(prop in oldProps)) {
+                if (!Object.hasOwn(oldProps, prop)) {
                     nonBreakingChanges.push({
                         type: 'added-field',
                         location: `schema:${newSchema.id}.${prop}`,
@@ -284,7 +285,7 @@ export class ApiCompatibilityService {
             // Check for new required fields (breaking if field existed as optional)
             for (const req of newRequired) {
                 if (!oldRequired.includes(req)) {
-                    if (req in oldProps) {
+                    if (Object.hasOwn(oldProps, req)) {
                         // Was optional, now required
                         if (!this.config.allowOptionalToRequired) {
                             breakingChanges.push({
@@ -296,7 +297,7 @@ export class ApiCompatibilityService {
                             });
                         }
                     }
-                    else if (req in newProps) {
+                    else if (Object.hasOwn(newProps, req)) {
                         // New required field
                         breakingChanges.push({
                             type: 'required-field-added',
@@ -310,7 +311,7 @@ export class ApiCompatibilityService {
             }
             // Check for type changes
             for (const prop of Object.keys(oldProps)) {
-                if (prop in newProps) {
+                if (Object.hasOwn(newProps, prop)) {
                     const oldPropDef = oldProps[prop];
                     const newPropDef = newProps[prop];
                     if (oldPropDef.type !== newPropDef.type) {

package/dist/domains/contract-testing/services/contract-validator.js

@@ -760,7 +760,8 @@ Provide:
         // Validate variables against operation variable definitions
         if (variables && operationInfo.variableDefinitions) {
             for (const [varName, varDef] of Object.entries(operationInfo.variableDefinitions)) {
-                if (varDef.required && !(varName in variables)) {
+                // #1136: own properties only; an inherited `constructor` is not a variable.
+                if (varDef.required && !Object.hasOwn(variables, varName)) {
                     errors.push({
                         path: `variables.${varName}`,
                         keyword: 'required',
@@ -768,7 +769,7 @@ Provide:
                         params: { variable: varName },
                     });
                 }
-                if (varName in variables) {
+                if (Object.hasOwn(variables, varName)) {
                     this.validateGraphQLVariableType(variables[varName], varDef.type, `variables.${varName}`, errors);
                 }
             }
@@ -1209,7 +1210,8 @@ Provide:
             const dataObj = data;
             // Check required properties
             for (const prop of required) {
-                if (!(prop in dataObj)) {
+                // #1136: own properties only; an inherited `constructor` is not present.
+                if (!Object.hasOwn(dataObj, prop)) {
                     errors.push({
                         path: path ? `${path}.${prop}` : prop,
                         keyword: 'required',
@@ -1220,7 +1222,7 @@ Provide:
             }
             // Validate each property
             for (const [prop, propSchema] of Object.entries(properties)) {
-                if (prop in dataObj) {
+                if (Object.hasOwn(dataObj, prop)) {
                     this.basicTypeValidation(dataObj[prop], propSchema, path ? `${path}.${prop}` : prop, errors, depth + 1);
                 }
             }

package/dist/domains/contract-testing/services/schema-validator.js

@@ -308,7 +308,8 @@ export class SchemaValidatorService {
         const additionalProperties = schema.additionalProperties;
         // Check required properties
         for (const prop of required) {
-            if (!(prop in value)) {
+            // #1136: own properties only; an inherited `constructor` is not present.
+            if (!Object.hasOwn(value, prop)) {
                 errors.push({
                     path: path ? `${path}.${prop}` : prop,
                     keyword: 'required',
@@ -320,7 +321,7 @@ export class SchemaValidatorService {
         // Validate each property
         for (const [prop, propValue] of Object.entries(value)) {
             const propPath = path ? `${path}.${prop}` : prop;
-            if (prop in properties) {
+            if (Object.hasOwn(properties, prop)) {
                 this.validateValue(propValue, properties[prop], propPath, errors, depth + 1);
             }
             else if (this.config.strictMode && additionalProperties === false) {
@@ -605,15 +606,17 @@ export class SchemaValidatorService {
         const oldRequired = new Set(oldSchema.required || []);
         const newRequired = new Set(newSchema.required || []);
         // Check for removed properties
+        // #1136: own properties only, so a property named `constructor` or
+        // `toString` is compared like any other.
         for (const prop of Object.keys(oldProps)) {
-            if (!(prop in newProps)) {
+            if (!Object.hasOwn(newProps, prop)) {
                 const propPath = path ? `${path}.${prop}` : prop;
                 removals.push(propPath);
             }
         }
         // Check for added properties
         for (const prop of Object.keys(newProps)) {
-            if (!(prop in oldProps)) {
+            if (!Object.hasOwn(oldProps, prop)) {
                 const propPath = path ? `${path}.${prop}` : prop;
                 additions.push(propPath);
                 // New required property is breaking
@@ -639,7 +642,7 @@ export class SchemaValidatorService {
         // Check for required changes
         const newRequiredArray = Array.from(newRequired);
         for (const prop of newRequiredArray) {
-            if (!oldRequired.has(prop) && prop in oldProps) {
+            if (!oldRequired.has(prop) && Object.hasOwn(oldProps, prop)) {
                 const propPath = path ? `${path}.${prop}` : prop;
                 modifications.push({
                     path: propPath,

package/dist/domains/defect-intelligence/interfaces.d.ts

@@ -55,6 +55,8 @@ export interface FilePrediction {
         contribution: number;
     }[];
     recommendations: string[];
+    /** Why this prediction is incomplete, e.g. git history timed out (#1115). */
+    warnings?: string[];
 }
 export interface RootCauseRequest {
     defectId: string;

package/dist/domains/defect-intelligence/plugin.js

@@ -4,6 +4,7 @@
  */
 import { err } from '../../shared/types/index.js';
 import { BaseDomainPlugin } from '../domain-interface.js';
+import { MAX_PAYLOAD_FILE_BYTES, requirePayloadFiles } from '../../shared/io/payload-path-guard.js';
 import { DefectIntelligenceCoordinator, } from './coordinator.js';
 import { DefectPredictorService, } from './services/defect-predictor.js';
 import { PatternLearnerService, } from './services/pattern-learner.js';
@@ -79,8 +80,12 @@ export class DefectIntelligencePlugin extends BaseDomainPlugin {
                     if (!files || files.length === 0) {
                         return err(new Error('Invalid predict-defects payload: missing files'));
                     }
+                    // #1126: refuse by name what FileReader would otherwise skip quietly.
+                    const confined = await requirePayloadFiles('predict-defects', 'files', files, { maxBytes: MAX_PAYLOAD_FILE_BYTES });
+                    if (!confined.success)
+                        return confined;
                     return this.coordinator.predictDefects({
-                        files,
+                        files: confined.value,
                         threshold: threshold ?? 0.7,
                     });
                 }],
@@ -112,8 +117,12 @@ export class DefectIntelligencePlugin extends BaseDomainPlugin {
                     if (!changedFiles || changedFiles.length === 0) {
                         return err(new Error('Invalid analyze-regression-risk payload: missing changedFiles'));
                     }
+                    // #1126: a changeset may name deleted files, but never outside ones.
+                    const confined = await requirePayloadFiles('analyze-regression-risk', 'changedFiles', changedFiles, { allowMissing: true });
+                    if (!confined.success)
+                        return confined;
                     return this.coordinator.analyzeRegressionRisk({
-                        changeset: changedFiles,
+                        changeset: confined.value,
                         baseline: payload.commitHash,
                     });
                 }],