agentic-qe 3.15.8 → 3.15.10

package/dist/shared/git/git-process.js

@@ -0,0 +1,37 @@
+/**
+ * Run git without blocking the event loop (#1115).
+ *
+ * Git runs in its own process group, so a timeout stops it together with any
+ * wrapper, credential helper or fsmonitor child it started.
+ */
+import { runProcessText } from '../test-runner-process.js';
+/** Git did not finish before its deadline; its result is unknown, not empty. */
+export class GitTimeoutError extends Error {
+    constructor(args, timeoutMs) {
+        super(`git ${args.join(' ')} timed out after ${Math.max(0, timeoutMs)}ms`);
+        this.name = 'GitTimeoutError';
+    }
+}
+/**
+ * Resolve with git's stdout. Rejects with GitTimeoutError when the deadline
+ * passes, and with a plain Error when git cannot start or exits non-zero.
+ */
+export async function runGit(args, options) {
+    if (options.timeout <= 0)
+        throw new GitTimeoutError(args, options.timeout);
+    try {
+        return await runProcessText('git', args, {
+            cwd: options.cwd,
+            timeout: options.timeout,
+            maxBuffer: options.maxBuffer,
+            // Never wait for a credential prompt that no one can answer.
+            env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
+        });
+    }
+    catch (error) {
+        if (error.code === 'ETIMEDOUT')
+            throw new GitTimeoutError(args, options.timeout);
+        throw error;
+    }
+}
+//# sourceMappingURL=git-process.js.map

package/dist/shared/git/index.d.ts

@@ -4,4 +4,5 @@
 export { GitAnalyzer } from './git-analyzer';
 export type { GitAnalyzerConfig, GitCommit, GitBlameInfo, FileHistory, } from './git-analyzer';
 export { assertSafeGitRef, getGitRefError } from './ref-validation';
+export { GitTimeoutError } from './git-process';
 //# sourceMappingURL=index.d.ts.map

package/dist/shared/git/index.js

@@ -3,4 +3,5 @@
  */
 export { GitAnalyzer } from './git-analyzer.js';
 export { assertSafeGitRef, getGitRefError } from './ref-validation.js';
+export { GitTimeoutError } from './git-process.js';
 //# sourceMappingURL=index.js.map

package/dist/shared/io/payload-path-guard.d.ts

@@ -0,0 +1,75 @@
+/**
+ * #1126: decide which caller-named paths a task handler may read.
+ *
+ * A task payload can come from MCP task_submit, task_orchestrate, a domain
+ * MCP tool or `aqe task submit`, so every handler that reads a path from its
+ * payload applies the same rule as code indexing (#1096) and sast-scan
+ * (#1144): a path is read only when its realpath is a regular file (or, for a
+ * target to walk, a directory) inside the project root's realpath. A path
+ * spelled outside the root is refused before any filesystem call, so the
+ * reason does not reveal whether it exists, and an outside directory is never
+ * listed. A symlink pointing out, a device such as /dev/zero or a directory
+ * is refused by name, and so is a file over the size limit when the handler
+ * reads files whole.
+ *
+ * The check runs inside each handler rather than at one MCP entry point, so
+ * no route into the handler can skip it. A refusal is a CallerInputError: it
+ * is not retried and does not count toward the domain circuit breaker.
+ */
+import { Result } from '../types';
+/** Largest file a handler reads whole into memory (the #1144 sast limit). */
+export declare const MAX_PAYLOAD_FILE_BYTES: number;
+export type PayloadPathSkipReason = 'not-found' | 'not-a-file' | 'outside-project-root' | 'unreadable' | 'too-large';
+export interface SkippedPayloadPath {
+    path: string;
+    reason: PayloadPathSkipReason;
+}
+export interface ConfinedPayloadPaths {
+    /** Requested paths (as given) that are regular files inside the project root. */
+    accepted: string[];
+    /** The real path checked for each accepted entry, in the same order. */
+    resolved: string[];
+    skipped: SkippedPayloadPath[];
+}
+export interface PayloadPathOptions {
+    /** Project root; defaults to findProjectRoot(). */
+    projectRoot?: string;
+    /** Base for relative paths; defaults to process.cwd(), as FileReader does. */
+    basePath?: string;
+    /** Refuse files larger than this. Omit when the handler does not read files whole. */
+    maxBytes?: number;
+    /**
+     * Accept a path inside the root that does not exist, for handlers that
+     * report a missing file themselves (a test runner, a deleted file in a
+     * changeset). A missing path outside the root is still refused.
+     */
+    allowMissing?: boolean;
+}
+/** Options for a single caller-named target that may be a directory. */
+export interface PayloadTargetOptions extends PayloadPathOptions {
+    /** Accept a directory inside the root as well as a regular file. */
+    allowDirectory?: boolean;
+}
+/**
+ * Split `paths` into those a handler may read and those it must refuse.
+ * `resolved[i]` is the symlink-free path checked for `accepted[i]` (relative
+ * to basePath when the request was relative); a handler opens that path,
+ * never the caller's string.
+ */
+export declare function confinePayloadPaths(paths: readonly string[], options?: PayloadTargetOptions): Promise<ConfinedPayloadPaths>;
+/**
+ * Handler-side check for a payload path list: `value` must be an array of
+ * non-empty path strings, and every entry must pass confinePayloadPaths.
+ * Otherwise the whole request is refused and nothing is read. Returns the real
+ * paths that were checked; the handler reads those, not the payload strings.
+ * `taskType` and `field` name the payload in the error.
+ */
+export declare function requirePayloadFiles(taskType: string, field: string, value: unknown, options?: PayloadTargetOptions): Promise<Result<string[], Error>>;
+/**
+ * Handler-side check for one caller-named path (a file, or with
+ * allowDirectory a directory to walk). Returns the real path that was
+ * checked, which the handler reads instead of the payload string, or an error
+ * naming the reason without reading anything.
+ */
+export declare function requirePayloadPath(taskType: string, field: string, value: unknown, options?: PayloadTargetOptions): Promise<Result<string, Error>>;
+//# sourceMappingURL=payload-path-guard.d.ts.map

package/dist/shared/io/payload-path-guard.js

@@ -0,0 +1,190 @@
+/**
+ * #1126: decide which caller-named paths a task handler may read.
+ *
+ * A task payload can come from MCP task_submit, task_orchestrate, a domain
+ * MCP tool or `aqe task submit`, so every handler that reads a path from its
+ * payload applies the same rule as code indexing (#1096) and sast-scan
+ * (#1144): a path is read only when its realpath is a regular file (or, for a
+ * target to walk, a directory) inside the project root's realpath. A path
+ * spelled outside the root is refused before any filesystem call, so the
+ * reason does not reveal whether it exists, and an outside directory is never
+ * listed. A symlink pointing out, a device such as /dev/zero or a directory
+ * is refused by name, and so is a file over the size limit when the handler
+ * reads files whole.
+ *
+ * The check runs inside each handler rather than at one MCP entry point, so
+ * no route into the handler can skip it. A refusal is a CallerInputError: it
+ * is not retried and does not count toward the domain circuit breaker.
+ */
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import { findProjectRoot } from '../../kernel/project-root.js';
+import { ok, err } from '../types/index.js';
+import { CallerInputError } from '../error-utils.js';
+/** Largest file a handler reads whole into memory (the #1144 sast limit). */
+export const MAX_PAYLOAD_FILE_BYTES = 2 * 1024 * 1024;
+/** True when `candidate` is `root` or lies beneath it (both absolute). */
+function isWithin(root, candidate) {
+    const relative = path.relative(root, candidate);
+    return relative === '' || (relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
+}
+/**
+ * The path the kernel will open for `requested`. path.resolve() collapses
+ * `..` as text, but the kernel follows a symlink before applying `..`, so
+ * `src/link/../x` opens a file beside the link's target (review of #1162).
+ * Keep the caller's spelling and let realpath resolve it the kernel's way.
+ */
+function kernelPath(basePath, requested) {
+    return path.isAbsolute(requested) ? requested : `${basePath}${path.sep}${requested}`;
+}
+/**
+ * For a path that does not exist: resolve its deepest existing ancestor the
+ * kernel's way and append the missing names. Returns null when the ancestor
+ * resolves outside the root or a missing name is `..`.
+ */
+async function resolveMissing(raw, rootReal) {
+    const missing = [];
+    let dir = raw;
+    for (;;) {
+        missing.unshift(path.basename(dir));
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+        const real = await fs.realpath(dir).catch(() => null);
+        if (!real)
+            continue;
+        if (!isWithin(rootReal, real) || missing.some(name => name === '..'))
+            return null;
+        return path.join(real, ...missing.filter(name => name !== '.' && name !== ''));
+    }
+}
+/**
+ * Split `paths` into those a handler may read and those it must refuse.
+ * `resolved[i]` is the symlink-free path checked for `accepted[i]` (relative
+ * to basePath when the request was relative); a handler opens that path,
+ * never the caller's string.
+ */
+export async function confinePayloadPaths(paths, options = {}) {
+    const projectRoot = options.projectRoot ?? findProjectRoot();
+    const basePath = options.basePath ?? process.cwd();
+    const accepted = [];
+    const resolved = [];
+    const skipped = [];
+    const rootLexical = path.resolve(projectRoot);
+    const rootReal = await fs.realpath(projectRoot).catch(() => rootLexical);
+    const baseReal = await fs.realpath(basePath).catch(() => null);
+    // A relative request stays relative, to the base's realpath: the kernel
+    // resolves it through the same real directories, and records keep the
+    // caller's spelling for ordinary paths ('tests/a.test.ts').
+    const accept = (requested, real) => {
+        accepted.push(requested);
+        resolved.push(!path.isAbsolute(requested) && baseReal ? (path.relative(baseReal, real) || '.') : real);
+    };
+    for (const requested of paths) {
+        const lexical = path.resolve(basePath, requested);
+        // Spelled outside the root: refused before any filesystem call, so the
+        // reason cannot reveal whether an outside path exists.
+        if (!isWithin(rootLexical, lexical) && !isWithin(rootReal, lexical)) {
+            skipped.push({ path: requested, reason: 'outside-project-root' });
+            continue;
+        }
+        const raw = kernelPath(basePath, requested);
+        let real;
+        try {
+            real = await fs.realpath(raw);
+        }
+        catch (error) {
+            const code = error.code;
+            const missing = code === 'ENOENT' || code === 'ENOTDIR';
+            // A dangling symlink exists by name: it is not a missing file to accept.
+            const dangling = await fs.lstat(raw).then(() => true, () => false);
+            const target = missing && !dangling && options.allowMissing ? await resolveMissing(raw, rootReal) : null;
+            if (target)
+                accept(requested, target);
+            else
+                skipped.push({ path: requested, reason: missing ? 'not-found' : 'unreadable' });
+            continue;
+        }
+        if (!isWithin(rootReal, real)) {
+            skipped.push({ path: requested, reason: 'outside-project-root' });
+            continue;
+        }
+        // stat, never open: a FIFO, device or directory is refused unread.
+        const stat = await fs.stat(real).catch(() => null);
+        if (!stat) {
+            skipped.push({ path: requested, reason: 'unreadable' });
+        }
+        else if (!(stat.isFile() || (options.allowDirectory && stat.isDirectory()))) {
+            skipped.push({ path: requested, reason: 'not-a-file' });
+        }
+        else if (options.maxBytes !== undefined && stat.size > options.maxBytes) {
+            skipped.push({ path: requested, reason: 'too-large' });
+        }
+        else {
+            accept(requested, real);
+        }
+    }
+    return { accepted, resolved, skipped };
+}
+function describe(value) {
+    if (value === null)
+        return 'null';
+    if (Array.isArray(value))
+        return 'array';
+    return typeof value;
+}
+/**
+ * Handler-side check for a payload path list: `value` must be an array of
+ * non-empty path strings, and every entry must pass confinePayloadPaths.
+ * Otherwise the whole request is refused and nothing is read. Returns the real
+ * paths that were checked; the handler reads those, not the payload strings.
+ * `taskType` and `field` name the payload in the error.
+ */
+export async function requirePayloadFiles(taskType, field, value, options = {}) {
+    const context = `Invalid ${taskType} payload`;
+    if (!Array.isArray(value)) {
+        return err(new CallerInputError(`${context}: '${field}' must be an array of file paths, got ${describe(value)}`));
+    }
+    for (let i = 0; i < value.length; i++) {
+        const entry = value[i];
+        if (typeof entry !== 'string' || entry.trim() === '') {
+            return err(new CallerInputError(`${context}: '${field}[${i}]' must be a non-empty string, got ${describe(entry)}`));
+        }
+        if (entry.includes('\0')) {
+            return err(new CallerInputError(`${context}: '${field}[${i}]' contains a null byte`));
+        }
+    }
+    const { resolved, skipped } = await confinePayloadPaths(value, options);
+    if (skipped.length > 0)
+        return err(refusal(context, field, skipped, options));
+    return ok(resolved);
+}
+function refusal(context, field, skipped, options) {
+    const limit = options.maxBytes !== undefined
+        ? `, at most ${Math.round(options.maxBytes / (1024 * 1024))} MB each`
+        : '';
+    const kinds = options.allowDirectory ? 'regular files or directories' : 'regular files';
+    return new CallerInputError(`${context}: ${field} cannot be read: ${skipped.map(s => `${s.path} (${s.reason})`).join(', ')}. ` +
+        `Pass ${kinds} inside the project${limit}.`);
+}
+/**
+ * Handler-side check for one caller-named path (a file, or with
+ * allowDirectory a directory to walk). Returns the real path that was
+ * checked, which the handler reads instead of the payload string, or an error
+ * naming the reason without reading anything.
+ */
+export async function requirePayloadPath(taskType, field, value, options = {}) {
+    const context = `Invalid ${taskType} payload`;
+    if (typeof value !== 'string' || value.trim() === '') {
+        return err(new CallerInputError(`${context}: '${field}' must be a non-empty path string, got ${describe(value)}`));
+    }
+    if (value.includes('\0')) {
+        return err(new CallerInputError(`${context}: '${field}' contains a null byte`));
+    }
+    const { resolved, skipped } = await confinePayloadPaths([value], options);
+    if (skipped.length > 0)
+        return err(refusal(context, field, skipped, options));
+    return ok(resolved[0]);
+}
+//# sourceMappingURL=payload-path-guard.js.map

package/dist/shared/llm/cache.js

@@ -316,7 +316,10 @@ export class LLMResponseCache {
      * Cache a completion response
      */
     setCompletion(prompt, response, options, ttlMs) {
-        if (!this.config.cacheCompletions) {
+        // CompletionResponse does not carry finishReason. In particular, Gemini
+        // returns an empty completion for a safety refusal (#912). Return that
+        // result to its caller, but never pin it as a reusable completion.
+        if (!this.config.cacheCompletions || response.completion.length === 0) {
             return;
         }
         const key = LLMCache.generateKey('completion', prompt, options);

package/dist/shared/llm/router/agent-router-config.js

@@ -278,7 +278,8 @@ export const DEFAULT_CATEGORY_CAPABILITIES = {
  */
 export function getAgentRoutingCategory(agentType) {
     // Direct lookup first
-    if (agentType in AGENT_CATEGORY_MAP) {
+    // #1136: own entries only; `constructor` is not an agent type.
+    if (Object.hasOwn(AGENT_CATEGORY_MAP, agentType)) {
         return AGENT_CATEGORY_MAP[agentType];
     }
     // Pattern-based detection

package/dist/shared/llm/translation/tool-translator.js

@@ -246,7 +246,8 @@ export function validateToolDefinition(tool) {
         const params = tool.parameters;
         const props = params.properties || {};
         for (const req of tool.required) {
-            if (!(req in props)) {
+            // #1136: own properties only.
+            if (!Object.hasOwn(props, req)) {
                 errors.push(`Required parameter '${req}' not found in properties`);
             }
         }

package/dist/shared/security/compliance-patterns.js

@@ -3,6 +3,7 @@
  * Detects security and compliance patterns in source code
  */
 import { FileReader } from '../io/index.js';
+import { findProjectRoot } from '../../kernel/project-root.js';
 // ============================================================================
 // Pattern Definitions
 // ============================================================================
@@ -156,7 +157,8 @@ const SECURITY_CONTROLS_PATTERNS = {
 export class CompliancePatternAnalyzer {
     fileReader;
     constructor() {
-        this.fileReader = new FileReader();
+        // #1096: a symlink inside the project must not expose an outside file.
+        this.fileReader = new FileReader({ projectRoot: findProjectRoot() });
     }
     /**
      * Analyze encryption patterns in files

package/dist/shared/test-runner-args.d.ts

@@ -35,6 +35,11 @@ export declare function jestExactPathPattern(file: string, cwd?: string): string
 /**
  * Literal test-name filter in `--flag=value` form. Mocha uses `--grep`; Jest
  * and Vitest use `--testNamePattern` (the long form of `-t`).
+ *
+ * `testName` is the full name the runner reported (describe titles, then the
+ * test title). Runners match the filter against that name joined with ' '
+ * (Jest, Mocha, Vitest 3) or ' > ' (Vitest 4+), so each space matches either
+ * separator, and the name is anchored so a retry targets that one test (#1141).
  */
 export declare function nameFilterArg(runner: NameFilterRunner, testName: string): string;
 /** True when a command vector (runner command plus its arguments) runs Jest. */

package/dist/shared/test-runner-args.js

@@ -62,9 +62,14 @@ export function jestExactPathPattern(file, cwd = process.cwd()) {
 /**
  * Literal test-name filter in `--flag=value` form. Mocha uses `--grep`; Jest
  * and Vitest use `--testNamePattern` (the long form of `-t`).
+ *
+ * `testName` is the full name the runner reported (describe titles, then the
+ * test title). Runners match the filter against that name joined with ' '
+ * (Jest, Mocha, Vitest 3) or ' > ' (Vitest 4+), so each space matches either
+ * separator, and the name is anchored so a retry targets that one test (#1141).
  */
 export function nameFilterArg(runner, testName) {
-    const pattern = escapeRegExpLiteral(testName);
+    const pattern = `^${testName.split(' ').map(escapeRegExpLiteral).join('(?: > | )')}$`;
     return runner === 'mocha' ? `--grep=${pattern}` : `--testNamePattern=${pattern}`;
 }
 /** True when a command vector (runner command plus its arguments) runs Jest. */

package/dist/shared/test-runner-process.d.ts

@@ -7,4 +7,36 @@ export declare function trackTestRunnerExit(proc: ChildProcess): () => void;
  * Windows uses taskkill's tree operation while the root PID still exists.
  */
 export declare function terminateTestRunner(proc: ChildProcess): Promise<void>;
+/** The `spawnSync` result fields a test-runner caller reads. */
+export interface TestRunnerProcessResult {
+    status: number | null;
+    signal: NodeJS.Signals | null;
+    stdout: string;
+    stderr: string;
+    error?: NodeJS.ErrnoException;
+}
+export interface TestRunnerProcessOptions {
+    cwd: string;
+    /** Kill the runner and report ETIMEDOUT after this many milliseconds. */
+    timeout: number;
+    env?: NodeJS.ProcessEnv;
+    /** Per-stream output limit; exceeding it kills the runner (ENOBUFS). */
+    maxBuffer?: number;
+}
+/**
+ * #1074: run a test runner without blocking the event loop. Resolves with the
+ * same fields and failure semantics `spawnSync` reports: exit status or
+ * terminating signal, captured UTF-8 stdout/stderr, an ETIMEDOUT error after
+ * `timeout`, an ENOBUFS error once a stream exceeds `maxBuffer`, and the
+ * spawn error itself when the command cannot start. The runner gets its own
+ * process group, so a timeout or overflow stops the whole `npx` tree before
+ * the promise settles and before any report file is removed.
+ */
+export declare function runTestRunnerProcess(command: string, args: readonly string[], options: TestRunnerProcessOptions): Promise<TestRunnerProcessResult>;
+/**
+ * Stdout of a command that must exit 0, run like runTestRunnerProcess (no
+ * blocking, process-group stop on timeout). Rejects with the ETIMEDOUT,
+ * ENOBUFS or spawn error, or with an error carrying `status` and `stderr`.
+ */
+export declare function runProcessText(command: string, args: readonly string[], options: TestRunnerProcessOptions): Promise<string>;
 //# sourceMappingURL=test-runner-process.d.ts.map

package/dist/shared/test-runner-process.js

@@ -207,4 +207,109 @@ export function terminateTestRunner(proc) {
         }
     });
 }
+/** `spawnSync`'s default per-stream output limit. */
+const DEFAULT_MAX_BUFFER = 1024 * 1024;
+/** Longest wait for the runner's pipes to close after it has been stopped. */
+const PIPE_RELEASE_GRACE_MS = 3000;
+/**
+ * #1074: run a test runner without blocking the event loop. Resolves with the
+ * same fields and failure semantics `spawnSync` reports: exit status or
+ * terminating signal, captured UTF-8 stdout/stderr, an ETIMEDOUT error after
+ * `timeout`, an ENOBUFS error once a stream exceeds `maxBuffer`, and the
+ * spawn error itself when the command cannot start. The runner gets its own
+ * process group, so a timeout or overflow stops the whole `npx` tree before
+ * the promise settles and before any report file is removed.
+ */
+export function runTestRunnerProcess(command, args, options) {
+    const maxBuffer = options.maxBuffer ?? DEFAULT_MAX_BUFFER;
+    return new Promise(resolve => {
+        let stdout = '';
+        let stderr = '';
+        let error;
+        let stopping;
+        let releaseTimer;
+        let settled = false;
+        let proc;
+        try {
+            proc = spawn(command, [...args], {
+                cwd: options.cwd,
+                env: options.env ?? process.env,
+                detached: process.platform !== 'win32',
+                stdio: ['ignore', 'pipe', 'pipe'],
+            });
+        }
+        catch (spawnError) {
+            resolve({ status: null, signal: null, stdout, stderr, error: spawnError });
+            return;
+        }
+        const untrackExit = trackTestRunnerExit(proc);
+        const settle = (status, signal) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            clearTimeout(releaseTimer);
+            // Report the signal the runner was stopped with, as spawnSync does.
+            const stoppedWith = stopping && !signal ? 'SIGTERM' : signal;
+            const result = { status: stopping ? null : status, signal: stoppedWith, stdout, stderr, error };
+            const done = () => { untrackExit(); resolve(result); };
+            if (stopping)
+                stopping.then(done, done);
+            else
+                done();
+        };
+        const stop = (code, message) => {
+            if (stopping)
+                return;
+            error = Object.assign(new Error(message), { code, syscall: `spawnSync ${command}` });
+            stopping = terminateTestRunner(proc);
+            // spawnSync closes the runner's pipes when it kills it. Do the same once
+            // the runner is stopped, or after a grace period, so a descendant that
+            // left the process group (e.g. a detached server holding the inherited
+            // stdout) cannot keep 'close', and so the result, pending forever.
+            const release = () => {
+                proc.stdout?.destroy();
+                proc.stderr?.destroy();
+            };
+            stopping.then(release, release);
+            releaseTimer = setTimeout(release, PIPE_RELEASE_GRACE_MS);
+        };
+        const timer = setTimeout(() => stop('ETIMEDOUT', `spawnSync ${command} ETIMEDOUT`), options.timeout);
+        const collect = (stream) => (chunk) => {
+            if (stopping)
+                return;
+            const next = (stream === 'stdout' ? stdout : stderr) + chunk;
+            const kept = next.length > maxBuffer ? next.slice(0, maxBuffer) : next;
+            if (stream === 'stdout')
+                stdout = kept;
+            else
+                stderr = kept;
+            if (next.length > maxBuffer)
+                stop('ENOBUFS', `spawnSync ${command} ENOBUFS`);
+        };
+        proc.stdout?.setEncoding('utf8').on('data', collect('stdout'));
+        proc.stderr?.setEncoding('utf8').on('data', collect('stderr'));
+        proc.once('error', (spawnError) => {
+            error ??= spawnError;
+            // A runner that never started emits no 'close' with a status to wait for.
+            if (proc.pid === undefined)
+                settle(null, null);
+        });
+        proc.once('close', (status, signal) => settle(status, signal));
+    });
+}
+/**
+ * Stdout of a command that must exit 0, run like runTestRunnerProcess (no
+ * blocking, process-group stop on timeout). Rejects with the ETIMEDOUT,
+ * ENOBUFS or spawn error, or with an error carrying `status` and `stderr`.
+ */
+export async function runProcessText(command, args, options) {
+    const result = await runTestRunnerProcess(command, args, options);
+    if (result.error)
+        throw result.error;
+    if (result.status !== 0) {
+        throw Object.assign(new Error(`${command} exited with ${result.status ?? result.signal}: ${result.stderr.trim()}`), { status: result.status, stderr: result.stderr });
+    }
+    return result.stdout;
+}
 //# sourceMappingURL=test-runner-process.js.map

package/dist/shared/test-runner-verdict.d.ts

@@ -1,4 +1,7 @@
-/** A runner or suite error is not an assertion result. */
+/**
+ * A runner or suite error is not an assertion result. Its message carries
+ * runner output and is returned over MCP, so it is redacted (#1122).
+ */
 export declare class TestRunnerExecutionError extends Error {
     constructor(message: string);
 }
@@ -19,6 +22,11 @@ interface RunnerReport {
         }>;
     }>;
 }
+/**
+ * Runner output quoted in an error, redacted before it is cut so a secret
+ * that straddles the cut cannot survive half-matched (#1122).
+ */
+export declare function capDiagnostics(text: string, maxLength?: number): string;
 /**
  * Preserve ordinary assertion failures, but reject incomplete/failed execution
  * that assertion counts cannot represent. Process status is authoritative even

package/dist/shared/test-runner-verdict.js

@@ -1,10 +1,21 @@
-/** A runner or suite error is not an assertion result. */
+import { redactLogText } from '../logging/redaction.js';
+/**
+ * A runner or suite error is not an assertion result. Its message carries
+ * runner output and is returned over MCP, so it is redacted (#1122).
+ */
 export class TestRunnerExecutionError extends Error {
     constructor(message) {
-        super(message);
+        super(redactLogText(message, Number.POSITIVE_INFINITY));
         this.name = 'TestRunnerExecutionError';
     }
 }
+/**
+ * Runner output quoted in an error, redacted before it is cut so a secret
+ * that straddles the cut cannot survive half-matched (#1122).
+ */
+export function capDiagnostics(text, maxLength = 4000) {
+    return redactLogText(text, Number.POSITIVE_INFINITY).slice(0, maxLength);
+}
 /**
  * Preserve ordinary assertion failures, but reject incomplete/failed execution
  * that assertion counts cannot represent. Process status is authoritative even
@@ -36,8 +47,8 @@ export function getTestRunnerExecutionError(runner, files, exitCode, counts, out
     const diagnostics = [
         ...suiteErrors.map(suite => suite.message).filter(Boolean),
         output.trim(),
-    ].filter(Boolean).join('\n').slice(0, 4000);
+    ].filter(Boolean).join('\n');
     return new TestRunnerExecutionError(`${runner} ${reason} for ${files} (exit code ${exitCode ?? 'unknown'}).` +
-        (diagnostics ? `\n${diagnostics}` : ''));
+        (diagnostics ? `\n${capDiagnostics(diagnostics)}` : ''));
 }
 //# sourceMappingURL=test-runner-verdict.js.map

package/dist/shared/types/index.d.ts

@@ -69,6 +69,15 @@ export interface QualityScore {
 }
 export type Severity = 'critical' | 'high' | 'medium' | 'low' | 'info';
 export type Priority = 'p0' | 'p1' | 'p2' | 'p3';
+export declare const ALL_PRIORITIES: readonly Priority[];
+/**
+ * Type guard for a user-supplied task priority (CLI flags, MCP arguments).
+ * Validate at the boundary so an unknown priority is rejected instead of being
+ * silently accepted (#1108).
+ */
+export declare function isPriority(value: unknown): value is Priority;
+/** Shared rejection message so `task_submit` and `aqe task submit` stay in parity (#1108). */
+export declare function invalidPriorityMessage(value: unknown): string;
 export interface DomainConfig {
     enabled: boolean;
     maxAgents: number;

package/dist/shared/types/index.js

@@ -32,4 +32,17 @@ export function ok(value) {
 export function err(error) {
     return { success: false, error };
 }
+export const ALL_PRIORITIES = ['p0', 'p1', 'p2', 'p3'];
+/**
+ * Type guard for a user-supplied task priority (CLI flags, MCP arguments).
+ * Validate at the boundary so an unknown priority is rejected instead of being
+ * silently accepted (#1108).
+ */
+export function isPriority(value) {
+    return typeof value === 'string' && ALL_PRIORITIES.includes(value);
+}
+/** Shared rejection message so `task_submit` and `aqe task submit` stay in parity (#1108). */
+export function invalidPriorityMessage(value) {
+    return `Invalid priority: ${String(value)}. Valid priorities: ${ALL_PRIORITIES.join(', ')}`;
+}
 //# sourceMappingURL=index.js.map