agentic-qe 3.15.8 → 3.15.10

package/dist/mcp/metrics/metrics-collector.d.ts

@@ -109,13 +109,20 @@ declare class MetricsCollectorImpl {
         successRate: number;
     };
     /**
-     * Get worker efficiency based on actual throughput
+     * Number of completed tasks in the sliding window. Zero means the retry and
+     * worker figures below describe nothing that was measured (#1110).
      */
-    getWorkerEfficiency(): number;
+    getRecordedTaskCount(): number;
     /**
-     * Get load balance score based on actual distribution
+     * Get worker efficiency based on actual throughput.
+     * Returns null when no task has been recorded: there is nothing to measure (#1110).
      */
-    getLoadBalanceScore(): number;
+    getWorkerEfficiency(): number | null;
+    /**
+     * Get load balance score based on actual distribution.
+     * Returns null when no worker has been recorded (#1110).
+     */
+    getLoadBalanceScore(): number | null;
     /**
      * Get retry statistics
      */
@@ -132,11 +139,6 @@ declare class MetricsCollectorImpl {
      * Get number of workers used (with active or completed tasks)
      */
     getWorkersUsed(): number;
-    /**
-     * Generate individual test result durations based on actual execution
-     * Uses the sliding window of real task durations
-     */
-    getTestDurations(count: number): number[];
     /**
      * Record a successful retry for tracking
      */

package/dist/mcp/metrics/metrics-collector.js

@@ -165,11 +165,19 @@ class MetricsCollectorImpl {
         };
     }
     /**
-     * Get worker efficiency based on actual throughput
+     * Number of completed tasks in the sliding window. Zero means the retry and
+     * worker figures below describe nothing that was measured (#1110).
+     */
+    getRecordedTaskCount() {
+        return this.taskMetrics.length;
+    }
+    /**
+     * Get worker efficiency based on actual throughput.
+     * Returns null when no task has been recorded: there is nothing to measure (#1110).
      */
     getWorkerEfficiency() {
         if (this.taskMetrics.length === 0) {
-            return 0.85; // Default baseline
+            return null;
         }
         // Calculate efficiency based on:
         // - Success rate
@@ -185,11 +193,12 @@ class MetricsCollectorImpl {
         return Math.min(1.0, Math.max(0, efficiency));
     }
     /**
-     * Get load balance score based on actual distribution
+     * Get load balance score based on actual distribution.
+     * Returns null when no worker has been recorded (#1110).
      */
     getLoadBalanceScore() {
         if (this.workerLoads.size === 0) {
-            return 0.9; // Default baseline
+            return null;
         }
         const loads = Array.from(this.workerLoads.values()).map((w) => w.completedTaskCount);
         if (loads.length <= 1) {
@@ -243,28 +252,6 @@ class MetricsCollectorImpl {
     getWorkersUsed() {
         return this.workerLoads.size;
     }
-    /**
-     * Generate individual test result durations based on actual execution
-     * Uses the sliding window of real task durations
-     */
-    getTestDurations(count) {
-        const durations = [];
-        if (this.taskMetrics.length === 0) {
-            // No real data - return reasonable estimates based on typical test times
-            for (let i = 0; i < count; i++) {
-                durations.push(100 + i * 10); // Start at 100ms, increment by 10ms
-            }
-            return durations;
-        }
-        // Use real durations from the sliding window
-        const realDurations = this.taskMetrics.map((t) => t.durationMs || 200).sort((a, b) => a - b);
-        for (let i = 0; i < count; i++) {
-            // Sample from real durations with wrapping
-            const index = i % realDurations.length;
-            durations.push(Math.round(realDurations[index]));
-        }
-        return durations;
-    }
     /**
      * Record a successful retry for tracking
      */

package/dist/mcp/protocol-server.js

@@ -655,6 +655,7 @@ export class MCPProtocolServer {
                 isCacheable: false,
                 parameters: [
                     { name: 'domain', type: 'string', description: 'Specific domain to check' },
+                    { name: 'detailed', type: 'boolean', description: 'Include per-domain health, issues and the MinCut reading (raw minCut status/value, and the fleet reading without task-scoped agents that decides status)', default: false },
                 ],
             },
             handler: (params) => handleFleetHealth(params),
@@ -720,6 +721,7 @@ export class MCPProtocolServer {
                 parameters: [
                     { name: 'task', type: 'string', description: 'Task description', required: true },
                     { name: 'strategy', type: 'string', description: 'Execution strategy', enum: ['parallel', 'sequential', 'adaptive'] },
+                    { name: 'filePaths', type: 'array', description: 'Project files the task works on. A security scan or quality assessment runs on these files and is refused without them.', items: { type: 'string' } },
                 ],
             },
             handler: (params) => handleTaskOrchestrate(params),
@@ -1491,7 +1493,11 @@ export class MCPProtocolServer {
                 ],
             },
             handler: async (params) => {
-                const { execFileSync } = await import('child_process');
+                // #1074: run the advisor CLI asynchronously; a synchronous call would
+                // stop the server answering every other request for up to 60s.
+                const { execFile } = await import('child_process');
+                const { promisify } = await import('util');
+                const execFileAsync = promisify(execFile);
                 const { writeFileSync, unlinkSync, mkdirSync } = await import('fs');
                 const { join } = await import('path');
                 const { tmpdir } = await import('os');
@@ -1531,15 +1537,16 @@ export class MCPProtocolServer {
                     // Resolve aqe binary with fallback to npx (MCP server may not have aqe on PATH)
                     let aqeBin = 'aqe';
                     try {
-                        execFileSync('which', ['aqe'], { encoding: 'utf-8' });
+                        await execFileAsync('which', ['aqe'], { encoding: 'utf-8' });
                     }
                     catch {
                         aqeBin = 'npx';
                         cliArgs.unshift('aqe');
                     }
-                    const result = execFileSync(aqeBin, cliArgs, {
+                    const { stdout: result } = await execFileAsync(aqeBin, cliArgs, {
                         encoding: 'utf-8',
                         timeout: 60000,
+                        maxBuffer: 1024 * 1024,
                         env: process.env,
                     });
                     try {

package/dist/mcp/security/schema-validator.js

@@ -451,7 +451,8 @@ export class SchemaValidator {
         // Check required properties
         if (schema.required) {
             for (const required of schema.required) {
-                if (!(required in data)) {
+                // #1136: own properties only; an inherited `constructor` is not present.
+                if (!Object.hasOwn(data, required)) {
                     errors.push({
                         path: path ? `${path}.${required}` : required,
                         message: `Required property '${required}' is missing`,
@@ -464,7 +465,7 @@ export class SchemaValidator {
         // Validate properties
         if (schema.properties) {
             for (const [key, propSchema] of Object.entries(schema.properties)) {
-                if (key in data) {
+                if (Object.hasOwn(data, key)) {
                     this.validateValue(data[key], propSchema, path ? `${path}.${key}` : key, `${schemaPath}/properties/${key}`, errors);
                 }
             }

package/dist/mcp/tools/code-intelligence/c4.js

@@ -15,6 +15,7 @@ import { KnowledgeGraphService } from '../../../domains/code-intelligence/servic
 import { createKnowledgeGraphRelationshipResolver } from '../../../domains/code-intelligence/services/c4-model/kg-relationships.js';
 import { InMemoryEventBus } from '../../../kernel/event-bus.js';
 import { toErrorMessage } from '../../../shared/error-utils.js';
+import { requirePayloadPath } from '../../../shared/io/payload-path-guard.js';
 const want = (level, l) => level === 'all' || level === l;
 // ============================================================================
 // Tool Implementation
@@ -53,7 +54,16 @@ export class CodeC4Tool extends MCPToolBase {
         return this.searchService;
     }
     async execute(params, context) {
-        const { action, projectPath = '.', level = 'all', query, limit = 10 } = params;
+        const { action, projectPath: requestedPath = '.', level = 'all', query, limit = 10 } = params;
+        // #1126: analyse (and report package names from) only a directory inside
+        // the project.
+        let projectPath = requestedPath;
+        if (requestedPath !== '.') {
+            const confined = await requirePayloadPath('qe/code/c4', 'projectPath', requestedPath, { allowDirectory: true });
+            if (!confined.success)
+                return { success: false, error: confined.error.message };
+            projectPath = confined.value;
+        }
         try {
             if (this.isAborted(context)) {
                 return { success: false, error: 'Operation aborted' };

package/dist/mcp/tools/coverage-analysis/index.js

@@ -12,6 +12,27 @@ import { CoverageAnalyzerService } from '../../../domains/coverage-analysis/serv
 import { GapDetectorService } from '../../../domains/coverage-analysis/services/gap-detector.js';
 import { findAndParseCoverage, parseCoverage, } from '../../../domains/coverage-analysis/services/coverage-parser.js';
 import { toErrorMessage } from '../../../shared/error-utils.js';
+import { requirePayloadPath } from '../../../shared/io/payload-path-guard.js';
+/**
+ * #1126: a caller-named coverage report must be a regular file inside the
+ * project (never /dev/zero or /proc/self/environ), and a target a directory
+ * inside it. Returns the real paths to read, or an error naming the refusal.
+ */
+async function confineCoverageInputs(tool, target, coverageFile) {
+    let confinedTarget = target;
+    if (target !== '.') {
+        const t = await requirePayloadPath(tool, 'target', target, { allowDirectory: true, allowMissing: true });
+        if (!t.success)
+            return { error: t.error.message };
+        confinedTarget = t.value;
+    }
+    if (coverageFile === undefined)
+        return { target: confinedTarget };
+    const f = await requirePayloadPath(tool, 'coverageFile', coverageFile);
+    if (!f.success)
+        return { error: f.error.message };
+    return { target: confinedTarget, coverageFile: f.value };
+}
 // ============================================================================
 // Helper: Calculate Coverage Summary from Files
 // ============================================================================
@@ -93,8 +114,12 @@ export class CoverageAnalyzeTool extends MCPToolBase {
         return this.analyzerService;
     }
     async execute(params, context) {
-        const { target = '.', coverageFile, thresholds = { lines: 80, branches: 70, functions: 80, statements: 80 }, includeRisk = false, includeRiskScoring = false, dryRun = false, coverageFormat, language, } = params;
+        const { target: requestedTarget = '.', coverageFile: requestedCoverageFile, thresholds = { lines: 80, branches: 70, functions: 80, statements: 80 }, includeRisk = false, includeRiskScoring = false, dryRun = false, coverageFormat, language, } = params;
         const shouldIncludeRisk = includeRisk || includeRiskScoring;
+        const confined = await confineCoverageInputs('qe/coverage/analyze', requestedTarget, requestedCoverageFile);
+        if ('error' in confined)
+            return { success: false, error: confined.error };
+        const { target, coverageFile } = confined;
         try {
             this.emitStream(context, {
                 status: 'analyzing',
@@ -309,7 +334,11 @@ export class CoverageGapsTool extends MCPToolBase {
         return this.gapService;
     }
     async execute(params, context) {
-        const { target = '.', coverageFile, minRisk = 0.3, limit = 20, prioritization = 'complexity', coverageFormat, language, } = params;
+        const { target: requestedTarget = '.', coverageFile: requestedCoverageFile, minRisk = 0.3, limit = 20, prioritization = 'complexity', coverageFormat, language, } = params;
+        const confined = await confineCoverageInputs('qe/coverage/gaps', requestedTarget, requestedCoverageFile);
+        if ('error' in confined)
+            return { success: false, error: confined.error };
+        const { target, coverageFile } = confined;
         try {
             this.emitStream(context, {
                 status: 'detecting',

package/dist/mcp/tools/learning-optimization/dream.d.ts

@@ -52,6 +52,8 @@ export interface DreamResultSummary {
         nodesActivated: number;
     };
     patternsCreated: number;
+    /** #1060: how long the dream's single commit transaction held the write lock, in ms */
+    commitDurationMs?: number;
 }
 export interface InsightSummary {
     id: string;
@@ -91,19 +93,17 @@ export interface DreamStatusResult {
 export declare class DreamCycleTool extends MCPToolBase<DreamCycleParams, DreamCycleToolResult> {
     readonly config: MCPToolConfig;
     private engine;
-    private engineConfig;
+    /** #1060: the one in-flight engine creation, so concurrent calls share it. */
+    private enginePending;
     /**
      * Get or create the DreamEngine instance.
      *
-     * If config differs from the cached engine's config, the engine is
-     * recreated to respect the new configuration. This prevents the bug
-     * where subsequent calls with different durationMs/minPatterns were ignored.
+     * #1060: one engine for the tool's lifetime. Duration and the minimum
+     * concept count are passed per call to dream(), so a call with different
+     * values no longer closes and recreates the engine (which interrupted a
+     * dream still running on it).
      */
     private getEngine;
-    /**
-     * Compare two configs for equality (shallow comparison of relevant fields)
-     */
-    private configsEqual;
     /**
      * Load patterns from ReasoningBank into the DreamEngine
      *

package/dist/mcp/tools/learning-optimization/dream.js

@@ -13,6 +13,7 @@
  */
 import { MCPToolBase, getSharedMemoryBackend } from '../base.js';
 import { createDreamEngine, } from '../../../learning/dream/index.js';
+import { DreamAlreadyRunningError } from '../../../learning/dream/dream-engine.js';
 import { createQEReasoningBank } from '../../../learning/qe-reasoning-bank.js';
 import { toErrorMessage } from '../../../shared/error-utils.js';
 // ============================================================================
@@ -66,39 +67,37 @@ export class DreamCycleTool extends MCPToolBase {
         timeout: 120000, // 2 minutes max (dream cycle + overhead)
     };
     engine = null;
-    engineConfig = null;
+    /** #1060: the one in-flight engine creation, so concurrent calls share it. */
+    enginePending = null;
     /**
      * Get or create the DreamEngine instance.
      *
-     * If config differs from the cached engine's config, the engine is
-     * recreated to respect the new configuration. This prevents the bug
-     * where subsequent calls with different durationMs/minPatterns were ignored.
+     * #1060: one engine for the tool's lifetime. Duration and the minimum
+     * concept count are passed per call to dream(), so a call with different
+     * values no longer closes and recreates the engine (which interrupted a
+     * dream still running on it).
      */
-    async getEngine(config) {
-        // Check if we need to recreate due to config change
-        const configChanged = this.engine && config && !this.configsEqual(this.engineConfig, config);
-        if (configChanged && this.engine) {
-            await this.engine.close().catch(() => { });
-            this.engine = null;
-            this.engineConfig = null;
-        }
-        if (!this.engine) {
-            this.engine = createDreamEngine(config);
-            this.engineConfig = config || null;
-            await this.engine.initialize();
+    async getEngine() {
+        if (this.engine)
+            return this.engine;
+        if (!this.enginePending) {
+            const create = async () => {
+                const engine = createDreamEngine();
+                await engine.initialize();
+                // A reset while initializing dropped this engine; don't resurrect it.
+                if (this.enginePending === pending)
+                    this.engine = engine;
+                else
+                    engine.close().catch(() => { });
+                return engine;
+            };
+            const pending = create();
+            this.enginePending = pending;
+            const settle = () => { if (this.enginePending === pending)
+                this.enginePending = null; };
+            pending.then(settle, settle);
         }
-        return this.engine;
-    }
-    /**
-     * Compare two configs for equality (shallow comparison of relevant fields)
-     */
-    configsEqual(a, b) {
-        if (a === b)
-            return true;
-        if (!a || !b)
-            return false;
-        return (a.maxDurationMs === b.maxDurationMs &&
-            a.minConceptsRequired === b.minConceptsRequired);
+        return this.enginePending;
     }
     /**
      * Load patterns from ReasoningBank into the DreamEngine
@@ -142,7 +141,8 @@ export class DreamCycleTool extends MCPToolBase {
                 domain: result.pattern.qeDomain || 'learning-optimization',
                 patternType: result.pattern.patternType,
                 confidence: result.pattern.confidence,
-                successRate: result.pattern.successRate || 0.5,
+                // A real 0% stays 0%; a pattern never used has no rate (#1142 review).
+                successRate: result.pattern.usageCount > 0 ? result.pattern.successRate : undefined,
             }));
             const loaded = await engine.loadPatternsAsConcepts(importPatterns);
             this.logger.info(`Loaded ${loaded} patterns as concepts from ReasoningBank`);
@@ -195,17 +195,19 @@ export class DreamCycleTool extends MCPToolBase {
         const minPatterns = params.minPatterns || 10;
         const loadFromRB = params.loadFromReasoningBank !== false;
         this.logger.info(`Starting dream cycle (${durationMs}ms, min: ${minPatterns} patterns)`);
-        const engine = await this.getEngine({
-            maxDurationMs: durationMs,
-            minConceptsRequired: minPatterns,
-        });
+        const engine = await this.getEngine();
+        // #1060: a concurrent dream is refused with a clear error, not queued.
+        const running = engine.getCurrentCycle();
+        if (running) {
+            throw new DreamAlreadyRunningError(running.id);
+        }
         // Load patterns from ReasoningBank if requested
         if (loadFromRB) {
             const loaded = await this.loadPatternsFromReasoningBank(engine);
             this.logger.info(`Loaded ${loaded} patterns from ReasoningBank`);
         }
         // Run the dream cycle
-        const result = await engine.dream(durationMs);
+        const result = await engine.dream(durationMs, { minConceptsRequired: minPatterns });
         const dreamResult = {
             cycleId: result.cycle.id,
             status: result.cycle.status,
@@ -215,6 +217,7 @@ export class DreamCycleTool extends MCPToolBase {
             insightsGenerated: result.cycle.insightsGenerated,
             activationStats: result.activationStats,
             patternsCreated: result.patternsCreated,
+            commitDurationMs: result.commitDurationMs,
         };
         const insights = result.insights.map((i) => ({
             id: i.id,
@@ -392,6 +395,7 @@ export class DreamCycleTool extends MCPToolBase {
      * Reset instance cache (for fleet dispose)
      */
     resetInstanceCache() {
+        this.enginePending = null;
         if (this.engine) {
             this.engine.close().catch(console.error);
             this.engine = null;

package/dist/mcp/tools/learning-optimization/optimize.d.ts

@@ -31,6 +31,7 @@ export interface OptimizationObjective {
 }
 export interface LearningOptimizeResult {
     action: string;
+    evidenceStatus?: 'insufficient-evidence';
     learnResult?: LearnResult;
     optimizeResult?: OptimizeResult;
     transferResult?: TransferResult;
@@ -39,9 +40,18 @@ export interface LearningOptimizeResult {
 }
 export interface LearnResult {
     experiencesProcessed: number;
+    /** #1109: experiences with a measured outcome; patterns are learned from these only. */
+    measuredExperiences?: number;
+    /** #1109: experiences recorded with an assigned reward, excluded from every rate. */
+    assignedRewardsExcluded?: number;
+    /** #1121: requested experience IDs with no stored experience; not processed. */
+    experienceIdsNotFound?: number;
+    evidenceStatus?: 'insufficient-evidence';
     patternsLearned: number;
     newPatterns: LearnedPattern[];
-    improvement: number;
+    /** No baseline is recorded to compare against, so improvement is not measured (#1109). */
+    improvement: number | null;
+    unmeasured?: string[];
 }
 export interface LearnedPattern {
     id: string;
@@ -53,6 +63,20 @@ export interface LearnedPattern {
     successRate: number;
 }
 export interface OptimizeResult {
+    inputSource: 'recorded-experiences';
+    experiencesUsed: number;
+    /** #1109: recorded experiences left out because their reward was assigned. */
+    assignedRewardsExcluded?: number;
+    evidenceStatus?: 'insufficient-evidence';
+    unmeasured?: string[];
+    /** Figures that were modelled, not observed (#1099). */
+    estimated?: string[];
+    /** How improvement and confidence were derived, when optimization ran. */
+    evaluation?: {
+        method: 'held-out';
+        trainingSamples: number;
+        heldOutSamples: number;
+    };
     strategiesEvaluated: number;
     bestStrategy: Strategy;
     improvement: number;
@@ -81,17 +105,33 @@ export interface PatternResult {
     byType: Record<string, number>;
     byDomain: Record<string, number>;
     topPatterns: LearnedPattern[];
-    avgConfidence: number;
-    avgSuccessRate: number;
+    /** Null when no pattern has a measured rate (#1121); not a 0 that reads as measured. */
+    avgConfidence: number | null;
+    avgSuccessRate: number | null;
+    /** #1109: patterns learned from assigned rewards, left out of every figure. */
+    assignedPatternsExcluded?: number;
+    /** #1121: untagged patterns mined before #1120, left out of every figure. */
+    legacyPatternsExcluded?: number;
+    evidenceStatus?: 'insufficient-evidence';
     /** Read-only persisted SONA visibility when an initialized fleet is available. */
     sona?: SONASnapshot;
 }
 export interface DashboardResult {
-    overallLearningRate: number;
+    /** Average success rate of patterns with measured rates; null when there are none. */
+    overallLearningRate: number | null;
     totalPatterns: number;
     totalKnowledge: number;
     experiencesLast24h: number;
+    /** #1109: last-24h experiences excluded from rankings because their reward was assigned. */
+    assignedRewardsExcluded?: number;
+    /** #1109: stored patterns excluded because they were learned from assigned rewards. */
+    assignedPatternsExcluded?: number;
+    /** #1121: untagged patterns mined before #1120 (rate selected over successes), excluded likewise. */
+    legacyPatternsExcluded?: number;
+    /** Ranked by measured success rate; empty when no domain has a measured outcome. */
     topPerformingDomains: DomainName[];
+    evidenceStatus?: 'insufficient-evidence';
+    unmeasured?: string[];
     learningTrend: TrendPoint[];
     recentMilestones: Milestone[];
     /** Read-only persisted SONA visibility when an initialized fleet is available. */
@@ -108,7 +148,8 @@ export interface TrendPoint {
 }
 export interface Milestone {
     name: string;
-    achievedAt: string;
+    /** When the milestone was first reached; null because that moment is not recorded (#1109). */
+    achievedAt: string | null;
     domain: DomainName;
 }
 export declare class LearningOptimizeTool extends MCPToolBase<LearningOptimizeParams, LearningOptimizeResult> {
@@ -119,6 +160,12 @@ export declare class LearningOptimizeTool extends MCPToolBase<LearningOptimizePa
     private getServices;
     execute(params: LearningOptimizeParams, context: MCPToolContext): Promise<ToolResult<LearningOptimizeResult>>;
     private executeLearn;
+    /**
+     * #1121: learn from explicitly requested experiences. experiencesProcessed
+     * is the number actually read; IDs with no stored experience are counted in
+     * experienceIdsNotFound instead of being reported as processed.
+     */
+    private learnFromExperienceIds;
     /**
      * Return demo learn results when no real data available.
      * Only used when demoMode is explicitly requested or as fallback with warning.