agentic-qe 3.15.8 → 3.15.10

package/dist/domains/security-compliance/services/scanners/dast-helpers.js

@@ -112,38 +112,33 @@ export async function scanSensitiveFiles(parsedUrl, crawledUrls, maxDepth, vulne
     for (const endpoint of sensitiveEndpoints) {
         if (crawledUrls >= maxDepth * 10)
             break;
-        try {
-            const testUrl = new URL(endpoint.path, parsedUrl.origin).toString();
-            const testResponse = await fetch(testUrl, {
-                method: 'GET',
-                signal: AbortSignal.timeout(5000),
-            });
-            if (testResponse.ok) {
-                crawledUrls++;
-                const text = await testResponse.text();
-                if (text.length > 20 && !text.toLowerCase().includes('not found') && !text.toLowerCase().includes('404')) {
-                    const isSensitive = endpoint.path.includes('.git') ||
-                        endpoint.path.includes('.env') ||
-                        endpoint.path.includes('.htaccess') ||
-                        endpoint.path.includes('web.config');
-                    if (isSensitive) {
-                        vulnerabilities.push({
-                            id: uuidv4(),
-                            title: `Sensitive File Exposed: ${endpoint.name}`,
-                            description: `${endpoint.name} is publicly accessible`,
-                            severity: endpoint.path.includes('.git') || endpoint.path.includes('.env') ? 'high' : 'medium',
-                            category: 'sensitive-data',
-                            location: { file: testUrl },
-                            remediation: { description: `Restrict access to ${endpoint.path}`, estimatedEffort: 'trivial', automatable: true },
-                            references: ['https://owasp.org/www-project-web-security-testing-guide/'],
-                        });
-                    }
+        const testUrl = new URL(endpoint.path, parsedUrl.origin).toString();
+        const testResponse = await fetch(testUrl, {
+            method: 'GET',
+            signal: AbortSignal.timeout(5000),
+        });
+        if (testResponse.ok) {
+            crawledUrls++;
+            const text = await testResponse.text();
+            if (text.length > 20 && !text.toLowerCase().includes('not found') && !text.toLowerCase().includes('404')) {
+                const isSensitive = endpoint.path.includes('.git') ||
+                    endpoint.path.includes('.env') ||
+                    endpoint.path.includes('.htaccess') ||
+                    endpoint.path.includes('web.config');
+                if (isSensitive) {
+                    vulnerabilities.push({
+                        id: uuidv4(),
+                        title: `Sensitive File Exposed: ${endpoint.name}`,
+                        description: `${endpoint.name} is publicly accessible`,
+                        severity: endpoint.path.includes('.git') || endpoint.path.includes('.env') ? 'high' : 'medium',
+                        category: 'sensitive-data',
+                        location: { file: testUrl },
+                        remediation: { description: `Restrict access to ${endpoint.path}`, estimatedEffort: 'trivial', automatable: true },
+                        references: ['https://owasp.org/www-project-web-security-testing-guide/'],
+                    });
                 }
             }
         }
-        catch {
-            // File not accessible - expected
-        }
     }
     return crawledUrls;
 }
@@ -154,31 +149,26 @@ export async function scanSensitiveFiles(parsedUrl, crawledUrls, maxDepth, vulne
  * Analyze CORS configuration
  */
 export async function analyzeCORS(targetUrl, vulnerabilities) {
-    try {
-        const corsResponse = await fetch(targetUrl, {
-            method: 'OPTIONS',
-            headers: {
-                'Origin': 'https://evil-attacker.com',
-                'Access-Control-Request-Method': 'GET',
-            },
-            signal: AbortSignal.timeout(5000),
+    const corsResponse = await fetch(targetUrl, {
+        method: 'OPTIONS',
+        headers: {
+            'Origin': 'https://evil-attacker.com',
+            'Access-Control-Request-Method': 'GET',
+        },
+        signal: AbortSignal.timeout(5000),
+    });
+    const allowOrigin = corsResponse.headers.get('access-control-allow-origin');
+    if (allowOrigin === '*' || allowOrigin === 'https://evil-attacker.com') {
+        vulnerabilities.push({
+            id: uuidv4(),
+            title: 'Overly Permissive CORS Policy',
+            description: allowOrigin === '*' ? 'CORS allows all origins' : 'CORS reflects arbitrary origin',
+            severity: 'medium',
+            category: 'access-control',
+            location: { file: targetUrl, snippet: `Access-Control-Allow-Origin: ${allowOrigin}` },
+            remediation: { description: 'Restrict CORS to specific trusted origins', estimatedEffort: 'minor', automatable: false },
+            references: ['https://owasp.org/www-community/attacks/CORS_OriginHeaderScrutiny'],
         });
-        const allowOrigin = corsResponse.headers.get('access-control-allow-origin');
-        if (allowOrigin === '*' || allowOrigin === 'https://evil-attacker.com') {
-            vulnerabilities.push({
-                id: uuidv4(),
-                title: 'Overly Permissive CORS Policy',
-                description: allowOrigin === '*' ? 'CORS allows all origins' : 'CORS reflects arbitrary origin',
-                severity: 'medium',
-                category: 'access-control',
-                location: { file: targetUrl, snippet: `Access-Control-Allow-Origin: ${allowOrigin}` },
-                remediation: { description: 'Restrict CORS to specific trusted origins', estimatedEffort: 'minor', automatable: false },
-                references: ['https://owasp.org/www-community/attacks/CORS_OriginHeaderScrutiny'],
-            });
-        }
-    }
-    catch {
-        // OPTIONS request failed - CORS might be properly restricted
     }
 }
 // ============================================================================
@@ -209,45 +199,40 @@ export async function extractAndCrawlLinks(html, baseUrl, currentCrawled, maxDep
     for (const path of linksToCrawl) {
         if (crawledUrls >= maxCrawl)
             break;
-        try {
-            const crawlUrl = new URL(path, baseUrl.origin).toString();
-            const crawlResponse = await fetch(crawlUrl, {
-                method: 'GET',
-                headers: { 'User-Agent': 'AgenticQE-DAST-Scanner/3.0' },
-                signal: AbortSignal.timeout(5000),
-                redirect: 'follow',
-            });
-            crawledUrls++;
-            if (crawlResponse.ok) {
-                if (path.includes('password') || path.includes('token') || path.includes('api_key')) {
-                    vulnerabilities.push({
-                        id: uuidv4(),
-                        title: 'Sensitive Data in URL Path',
-                        description: `URL path may contain sensitive parameter names: ${path}`,
-                        severity: 'medium',
-                        category: 'sensitive-data',
-                        location: { file: crawlUrl },
-                        remediation: { description: 'Avoid sensitive data in URL paths', estimatedEffort: 'minor', automatable: false },
-                        references: ['https://owasp.org/www-community/vulnerabilities/Information_exposure_through_query_strings_in_url'],
-                    });
-                }
-                const responseText = await crawlResponse.text();
-                if (responseText.includes('Index of /') || responseText.includes('Directory listing for')) {
-                    vulnerabilities.push({
-                        id: uuidv4(),
-                        title: 'Directory Listing Enabled',
-                        description: `Directory listing is enabled at: ${crawlUrl}`,
-                        severity: 'medium',
-                        category: 'security-misconfiguration',
-                        location: { file: crawlUrl },
-                        remediation: { description: 'Disable directory listing in server configuration', estimatedEffort: 'trivial', automatable: true },
-                        references: ['https://owasp.org/www-project-web-security-testing-guide/'],
-                    });
-                }
+        const crawlUrl = new URL(path, baseUrl.origin).toString();
+        const crawlResponse = await fetch(crawlUrl, {
+            method: 'GET',
+            headers: { 'User-Agent': 'AgenticQE-DAST-Scanner/3.0' },
+            signal: AbortSignal.timeout(5000),
+            redirect: 'follow',
+        });
+        crawledUrls++;
+        if (crawlResponse.ok) {
+            if (path.includes('password') || path.includes('token') || path.includes('api_key')) {
+                vulnerabilities.push({
+                    id: uuidv4(),
+                    title: 'Sensitive Data in URL Path',
+                    description: `URL path may contain sensitive parameter names: ${path}`,
+                    severity: 'medium',
+                    category: 'sensitive-data',
+                    location: { file: crawlUrl },
+                    remediation: { description: 'Avoid sensitive data in URL paths', estimatedEffort: 'minor', automatable: false },
+                    references: ['https://owasp.org/www-community/vulnerabilities/Information_exposure_through_query_strings_in_url'],
+                });
+            }
+            const responseText = await crawlResponse.text();
+            if (responseText.includes('Index of /') || responseText.includes('Directory listing for')) {
+                vulnerabilities.push({
+                    id: uuidv4(),
+                    title: 'Directory Listing Enabled',
+                    description: `Directory listing is enabled at: ${crawlUrl}`,
+                    severity: 'medium',
+                    category: 'security-misconfiguration',
+                    location: { file: crawlUrl },
+                    remediation: { description: 'Disable directory listing in server configuration', estimatedEffort: 'trivial', automatable: true },
+                    references: ['https://owasp.org/www-project-web-security-testing-guide/'],
+                });
             }
-        }
-        catch {
-            // Page not accessible
         }
     }
     return crawledUrls;

package/dist/domains/security-compliance/services/scanners/dast-injection-testing.js

@@ -11,43 +11,38 @@ import { v4 as uuidv4 } from 'uuid';
  */
 export async function testXSS(targetUrl, parsedUrl, paramName, payloads, vulnerabilities) {
     for (const xss of payloads) {
-        try {
-            const testParams = new URLSearchParams(parsedUrl.search);
-            testParams.set(paramName, xss.payload);
-            const testUrl = `${parsedUrl.origin}${parsedUrl.pathname}?${testParams.toString()}`;
-            const response = await fetch(testUrl, {
-                method: 'GET',
-                headers: { 'User-Agent': 'AgenticQE-DAST-Scanner/3.0' },
-                signal: AbortSignal.timeout(5000),
-            });
-            if (response.ok) {
-                const text = await response.text();
-                const escapedPayload = xss.payload
-                    .replace(/&/g, '&')
-                    .replace(/</g, '&lt;')
-                    .replace(/>/g, '&gt;')
-                    .replace(/"/g, '&quot;')
-                    .replace(/'/g, '&#x27;');
-                const hasUnescapedPayload = text.includes(xss.payload);
-                const hasEscapedPayload = text.includes(escapedPayload);
-                if (hasUnescapedPayload && !hasEscapedPayload) {
-                    vulnerabilities.push({
-                        id: uuidv4(),
-                        title: `Reflected XSS: ${xss.name}`,
-                        description: `Parameter '${paramName}' reflects unsanitized input`,
-                        severity: 'critical',
-                        category: 'xss',
-                        location: { file: targetUrl, snippet: `Parameter: ${paramName}, Payload: ${xss.payload.substring(0, 30)}...` },
-                        remediation: { description: 'HTML-encode all user input before rendering', estimatedEffort: 'moderate', automatable: false },
-                        references: ['https://owasp.org/www-community/attacks/xss/'],
-                    });
-                    break;
-                }
+        const testParams = new URLSearchParams(parsedUrl.search);
+        testParams.set(paramName, xss.payload);
+        const testUrl = `${parsedUrl.origin}${parsedUrl.pathname}?${testParams.toString()}`;
+        const response = await fetch(testUrl, {
+            method: 'GET',
+            headers: { 'User-Agent': 'AgenticQE-DAST-Scanner/3.0' },
+            signal: AbortSignal.timeout(5000),
+        });
+        if (response.ok) {
+            const text = await response.text();
+            const escapedPayload = xss.payload
+                .replace(/&/g, '&amp;')
+                .replace(/</g, '&lt;')
+                .replace(/>/g, '&gt;')
+                .replace(/"/g, '&quot;')
+                .replace(/'/g, '&#x27;');
+            const hasUnescapedPayload = text.includes(xss.payload);
+            const hasEscapedPayload = text.includes(escapedPayload);
+            if (hasUnescapedPayload && !hasEscapedPayload) {
+                vulnerabilities.push({
+                    id: uuidv4(),
+                    title: `Reflected XSS: ${xss.name}`,
+                    description: `Parameter '${paramName}' reflects unsanitized input`,
+                    severity: 'critical',
+                    category: 'xss',
+                    location: { file: targetUrl, snippet: `Parameter: ${paramName}, Payload: ${xss.payload.substring(0, 30)}...` },
+                    remediation: { description: 'HTML-encode all user input before rendering', estimatedEffort: 'moderate', automatable: false },
+                    references: ['https://owasp.org/www-community/attacks/xss/'],
+                });
+                break;
             }
         }
-        catch {
-            // Request failed
-        }
     }
 }
 /**
@@ -65,35 +60,30 @@ export async function testSQLi(targetUrl, parsedUrl, paramName, payloads, vulner
         /quoted string not properly terminated/i,
     ];
     for (const sqli of payloads) {
-        try {
-            const testParams = new URLSearchParams(parsedUrl.search);
-            testParams.set(paramName, sqli.payload);
-            const testUrl = `${parsedUrl.origin}${parsedUrl.pathname}?${testParams.toString()}`;
-            const response = await fetch(testUrl, {
-                method: 'GET',
-                headers: { 'User-Agent': 'AgenticQE-DAST-Scanner/3.0' },
-                signal: AbortSignal.timeout(5000),
-            });
-            const text = await response.text();
-            for (const pattern of sqlErrorPatterns) {
-                if (pattern.test(text)) {
-                    vulnerabilities.push({
-                        id: uuidv4(),
-                        title: `SQL Injection: ${sqli.name}`,
-                        description: `Parameter '${paramName}' appears vulnerable to SQL injection`,
-                        severity: 'critical',
-                        category: 'injection',
-                        location: { file: targetUrl, snippet: `Parameter: ${paramName}` },
-                        remediation: { description: 'Use parameterized queries or prepared statements', estimatedEffort: 'moderate', automatable: false },
-                        references: ['https://owasp.org/www-community/attacks/SQL_Injection'],
-                    });
-                    break;
-                }
+        const testParams = new URLSearchParams(parsedUrl.search);
+        testParams.set(paramName, sqli.payload);
+        const testUrl = `${parsedUrl.origin}${parsedUrl.pathname}?${testParams.toString()}`;
+        const response = await fetch(testUrl, {
+            method: 'GET',
+            headers: { 'User-Agent': 'AgenticQE-DAST-Scanner/3.0' },
+            signal: AbortSignal.timeout(5000),
+        });
+        const text = await response.text();
+        for (const pattern of sqlErrorPatterns) {
+            if (pattern.test(text)) {
+                vulnerabilities.push({
+                    id: uuidv4(),
+                    title: `SQL Injection: ${sqli.name}`,
+                    description: `Parameter '${paramName}' appears vulnerable to SQL injection`,
+                    severity: 'critical',
+                    category: 'injection',
+                    location: { file: targetUrl, snippet: `Parameter: ${paramName}` },
+                    remediation: { description: 'Use parameterized queries or prepared statements', estimatedEffort: 'moderate', automatable: false },
+                    references: ['https://owasp.org/www-community/attacks/SQL_Injection'],
+                });
+                break;
             }
         }
-        catch {
-            // Request failed
-        }
     }
 }
 //# sourceMappingURL=dast-injection-testing.js.map

package/dist/domains/security-compliance/services/scanners/dast-scanner.d.ts

@@ -4,6 +4,27 @@
  */
 import { Result } from '@shared/types/index.js';
 import type { SecurityScannerConfig, DASTResult, DASTOptions, AuthCredentials, MemoryBackend, ScanStatus } from './scanner-types.js';
+/**
+ * DAST Scanner - Dynamic Application Security Testing
+ * Scans running applications for security vulnerabilities
+ *
+ * **Capabilities:**
+ * - Security header analysis (HSTS, CSP, X-Frame-Options, etc.)
+ * - Cookie security (Secure, HttpOnly, SameSite flags)
+ * - CORS misconfiguration detection
+ * - Sensitive file exposure (/.git, /.env, etc.)
+ * - Link crawling with same-origin scope
+ * - XSS reflection testing (GET parameters)
+ * - SQL injection error-based detection (GET parameters)
+ * - Form security analysis (CSRF tokens, autocomplete, action URLs)
+ *
+ * **Limitations:**
+ * - Injection testing: GET parameters only (POST form submission not implemented)
+ * - Crawling: Same-origin only, max 10 links per page, single depth
+ * - Auth flows: Header-based only, no login form automation
+ * - No JavaScript execution (static response analysis only)
+ * - No session management testing beyond cookie attributes
+ */
 export declare class DASTScanner {
     private readonly config;
     private readonly memory;
@@ -31,7 +52,6 @@ export declare class DASTScanner {
     private performAuthenticatedScan;
     private createInvalidUrlVuln;
     private createInsecureProtocolVuln;
-    private createAuthFailedVuln;
     private createTokenInUrlVuln;
     /**
      * Test URL parameters for injection vulnerabilities

package/dist/domains/security-compliance/services/scanners/dast-scanner.js

@@ -2,15 +2,25 @@
  * Agentic QE v3 - DAST (Dynamic Application Security Testing) Scanner
  * Performs dynamic analysis of running applications to detect security vulnerabilities
  */
-import { LoggerFactory } from '../../../../logging/index.js';
 import { v4 as uuidv4 } from 'uuid';
 import { ok, err } from '../../../../shared/types/index.js';
 import { toError } from '../../../../shared/error-utils.js';
 import { fetchWithResponseDeadline } from '../../../../shared/llm/providers/response-deadline.js';
-import { analyzeSecurityHeaders, analyzeCookieSecurity, analyzeServerHeaders, scanSensitiveFiles, analyzeCORS, extractAndCrawlLinks, testXSS, testSQLi, analyzeFormsForSecurityIssues, testAuthorizationBypass, testIDOR, validateCredentials, buildAuthHeaders, handleFetchError, calculateSummary, storeScanResults, } from './dast-helpers.js';
+import { analyzeSecurityHeaders, analyzeCookieSecurity, analyzeServerHeaders, scanSensitiveFiles, analyzeCORS, extractAndCrawlLinks, testXSS, testSQLi, analyzeFormsForSecurityIssues, testAuthorizationBypass, testIDOR, validateCredentials, buildAuthHeaders, calculateSummary, storeScanResults, } from './dast-helpers.js';
 // ============================================================================
 // DAST Scanner Service
 // ============================================================================
+/** Transport failures are execution errors, not absence of vulnerabilities. */
+function dastRequestFailure(error) {
+    if (error instanceof Error && 'code' in error && ['DAST_AUTHENTICATION_FAILED', 'DAST_TARGET_UNAVAILABLE'].includes(String(error.code)))
+        return error;
+    const timeout = error instanceof Error && /timeout|abort/i.test(error.message);
+    return Object.assign(new Error(timeout
+        ? 'DAST target request timeout; dynamic analysis is incomplete'
+        : 'DAST target request failed; dynamic analysis is incomplete'), {
+        code: timeout ? 'DAST_REQUEST_TIMEOUT' : 'DAST_REQUEST_FAILED',
+    });
+}
 /**
  * DAST Scanner - Dynamic Application Security Testing
  * Scans running applications for security vulnerabilities
@@ -32,7 +42,6 @@ import { analyzeSecurityHeaders, analyzeCookieSecurity, analyzeServerHeaders, sc
  * - No JavaScript execution (static response analysis only)
  * - No session management testing beyond cookie attributes
  */
-const logger = LoggerFactory.create('security-compliance/dast-scanner');
 export class DASTScanner {
     config;
     memory;
@@ -90,7 +99,7 @@ export class DASTScanner {
             // Validate credentials
             const credValidation = validateCredentials(credentials);
             if (!credValidation.valid) {
-                return err(new Error(credValidation.reason));
+                throw new Error(credValidation.reason);
             }
             const mergedOptions = {
                 maxDepth: options?.maxDepth ?? this.config.dastMaxDepth,
@@ -158,6 +167,12 @@ export class DASTScanner {
                     },
                     redirect: 'follow',
                 }, deadlineMs, () => new Error(`DAST request timeout after ${deadlineMs}ms: ${targetUrl}`));
+                if (response.status === 401 || response.status === 403 || response.status >= 500) {
+                    await response.body?.cancel().catch(() => undefined);
+                    throw Object.assign(new Error(`DAST ${response.status < 500 ? 'authentication rejected' : 'target unavailable'} (HTTP ${response.status}); dynamic analysis is incomplete`), {
+                        code: response.status < 500 ? 'DAST_AUTHENTICATION_FAILED' : 'DAST_TARGET_UNAVAILABLE',
+                    });
+                }
                 crawledUrls++;
                 // Security header analysis
                 analyzeSecurityHeaders(response.headers, targetUrl, vulnerabilities);
@@ -190,11 +205,11 @@ export class DASTScanner {
                 }
             }
             catch (fetchError) {
-                handleFetchError(fetchError, targetUrl, vulnerabilities);
+                throw dastRequestFailure(fetchError);
             }
         }
         catch (error) {
-            logger.error('DAST scan error:', error instanceof Error ? error : undefined);
+            throw toError(error);
         }
         return { vulnerabilities, crawledUrls };
     }
@@ -231,11 +246,13 @@ export class DASTScanner {
                     redirect: 'follow',
                 }, deadlineMs, () => new Error(`DAST request timeout after ${deadlineMs}ms: ${targetUrl}`));
                 await response.body?.cancel().catch(() => undefined);
-                crawledUrls++;
-                // Check if authentication was successful
-                if (response.status === 401 || response.status === 403) {
-                    vulnerabilities.push(this.createAuthFailedVuln(targetUrl, response.status));
+                if (response.status === 401 || response.status === 403 || response.status >= 500) {
+                    await response.body?.cancel().catch(() => undefined);
+                    throw Object.assign(new Error(`DAST ${response.status < 500 ? 'authentication rejected' : 'target unavailable'} (HTTP ${response.status}); dynamic analysis is incomplete`), {
+                        code: response.status < 500 ? 'DAST_AUTHENTICATION_FAILED' : 'DAST_TARGET_UNAVAILABLE',
+                    });
                 }
+                crawledUrls++;
                 // Standard security header checks
                 analyzeSecurityHeaders(response.headers, targetUrl, vulnerabilities, true);
                 // Check for session token in URL
@@ -251,11 +268,11 @@ export class DASTScanner {
                 analyzeCookieSecurity(response.headers, targetUrl, vulnerabilities, true);
             }
             catch (fetchError) {
-                handleFetchError(fetchError, targetUrl, vulnerabilities);
+                throw dastRequestFailure(fetchError);
             }
         }
         catch (error) {
-            logger.error('Authenticated DAST scan error:', error instanceof Error ? error : undefined);
+            throw toError(error);
         }
         return { vulnerabilities, crawledUrls };
     }
@@ -286,18 +303,6 @@ export class DASTScanner {
             references: ['https://owasp.org/www-project-web-security-testing-guide/'],
         };
     }
-    createAuthFailedVuln(targetUrl, status) {
-        return {
-            id: uuidv4(),
-            title: 'Authentication Failed',
-            description: `Authentication returned ${status} status`,
-            severity: 'informational',
-            category: 'broken-auth',
-            location: { file: targetUrl },
-            remediation: { description: 'Verify credentials are correct', estimatedEffort: 'trivial', automatable: false },
-            references: [],
-        };
-    }
     createTokenInUrlVuln(targetUrl, search) {
         return {
             id: uuidv4(),

package/dist/domains/security-compliance/services/scanners/scanner-orchestrator.js

@@ -122,7 +122,10 @@ export class SecurityScannerService {
                 if (dastScan.success) {
                     dastResult = dastScan.value;
                 }
-                // Don't fail the full scan if DAST fails
+                else {
+                    // A requested phase that did not execute cannot become a full scan.
+                    return err(dastScan.error);
+                }
             }
             // Combine summaries
             const combinedSummary = this.combineSummaries(sastResult.value.summary, dastResult?.summary);

package/dist/domains/test-execution/coordinator.d.ts

@@ -123,6 +123,11 @@ export declare class TestExecutionCoordinator extends BaseDomainCoordinator<Test
      * Auto-detects framework and uses sensible defaults
      */
     runTests(request: SimpleTestRequest): Promise<Result<TestRunResult, Error>>;
+    /**
+     * Retry a run's failed tests when retries were requested, and attach what
+     * the retries did to the run (#1130). The run's own counts are unchanged.
+     */
+    private retryFailures;
     /**
      * Detect test framework from file patterns and project configuration
      */

package/dist/domains/test-execution/coordinator.js

@@ -146,16 +146,8 @@ export class TestExecutionCoordinator extends BaseDomainCoordinator {
                 workers,
                 timeout,
             });
-            // Handle retries if requested and there were failures
-            if (request.retryCount && request.retryCount > 0 && result.success && result.value.failed > 0) {
-                const failedTestIds = result.value.failedTests.map(t => t.testId);
-                await this.retry({
-                    runId: result.value.runId,
-                    failedTests: failedTestIds,
-                    maxRetries: request.retryCount,
-                    backoff: 'exponential',
-                });
-            }
+            if (result.success)
+                await this.retryFailures(result.value, request.retryCount);
             return result;
         }
         // Sequential execution
@@ -164,18 +156,41 @@ export class TestExecutionCoordinator extends BaseDomainCoordinator {
             framework,
             timeout,
         });
-        // Handle retries if requested and there were failures
-        if (request.retryCount && request.retryCount > 0 && result.success && result.value.failed > 0) {
-            const failedTestIds = result.value.failedTests.map(t => t.testId);
-            await this.retry({
-                runId: result.value.runId,
-                failedTests: failedTestIds,
-                maxRetries: request.retryCount,
-                backoff: 'exponential',
-            });
-        }
+        if (result.success)
+            await this.retryFailures(result.value, request.retryCount);
         return result;
     }
+    /**
+     * Retry a run's failed tests when retries were requested, and attach what
+     * the retries did to the run (#1130). The run's own counts are unchanged.
+     */
+    async retryFailures(run, retryCount) {
+        if (!retryCount || retryCount <= 0)
+            return;
+        if (run.failed === 0) {
+            run.retries = { totalRetries: 0, nowPassing: 0, stillFailing: 0, tests: [] };
+            return;
+        }
+        const retried = await this.retry({
+            runId: run.runId,
+            failedTests: run.failedTests.map(t => t.testId),
+            maxRetries: retryCount,
+            backoff: 'exponential',
+        });
+        if (!retried.success)
+            return;
+        const byId = new Map(run.failedTests.map(t => [t.testId, t]));
+        run.retries = {
+            totalRetries: retried.value.retried,
+            nowPassing: retried.value.nowPassing,
+            stillFailing: retried.value.stillFailing,
+            tests: (retried.value.tests ?? []).map(({ testId, ...outcome }) => ({
+                name: byId.get(testId)?.testName ?? testId,
+                file: byId.get(testId)?.file ?? '',
+                ...outcome,
+            })),
+        };
+    }
     /**
      * Detect test framework from file patterns and project configuration
      */