agentic-qe 3.15.9 → 3.15.10

package/dist/coordination/queen-task-queue.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Agentic QE v3 - Queen Task Queue
+ * Extracted from queen-task-management.ts - priority queue operations, the
+ * queue drain, and handing a released slot back to the queue.
+ */
+import type { DomainName, Priority } from '../shared/types';
+import type { QueenTask } from './queen-types.js';
+import { type QueenTaskContext } from './queen-task-management.js';
+/**
+ * PERF-001 FIX: Comparator for tasks - sorted by createdAt ascending (oldest first / FIFO within priority)
+ */
+export declare const taskComparator: import("../shared/utils/binary-insert").Comparator<QueenTask>;
+/**
+ * PERF-001 FIX: Use binary insertion O(log n) instead of sort O(n log n)
+ */
+export declare function enqueueTask(taskQueue: Map<Priority, QueenTask[]>, domainQueues: Map<DomainName, QueenTask[]>, task: QueenTask): void;
+/**
+ * Remove a task from all queues.
+ * PERF-008: Only iterate the task's targetDomains instead of ALL_DOMAINS.
+ */
+export declare function removeFromQueues(taskQueue: Map<Priority, QueenTask[]>, domainQueues: Map<DomainName, QueenTask[]>, task: QueenTask): void;
+/**
+ * Get the position of a task within the priority queues.
+ */
+export declare function getQueuePosition(taskQueue: Map<Priority, QueenTask[]>, task: QueenTask): number;
+/**
+ * Process the queue: dequeue highest-priority tasks and assign them.
+ * CC-002 FIX: Uses atomic counter for capacity check.
+ */
+export declare function processQueue(ctx: QueenTaskContext): Promise<void>;
+/**
+ * Give back the slot a task held and hand it to the queue: a running drain
+ * picks it up on its next scan, otherwise a new drain starts.
+ */
+export declare function releaseSlot(ctx: QueenTaskContext): Promise<void>;
+/**
+ * Mark a task that never started as failed, publish QueenTaskFailed (#1124)
+ * and hand the slot it held to the queue.
+ */
+export declare function settleFailedBeforeRun(ctx: QueenTaskContext, task: QueenTask, domain: DomainName | undefined, reason: string): Promise<void>;
+//# sourceMappingURL=queen-task-queue.d.ts.map

package/dist/coordination/queen-task-queue.js

@@ -0,0 +1,194 @@
+/**
+ * Agentic QE v3 - Queen Task Queue
+ * Extracted from queen-task-management.ts - priority queue operations, the
+ * queue drain, and handing a released slot back to the queue.
+ */
+import { binaryInsert, createdAtComparator } from '../shared/utils/index.js';
+import { toErrorMessage } from '../shared/error-utils.js';
+import { assignTask } from './queen-task-management.js';
+// ============================================================================
+// Task comparator for priority queue binary insertion
+// ============================================================================
+/**
+ * PERF-001 FIX: Comparator for tasks - sorted by createdAt ascending (oldest first / FIFO within priority)
+ */
+export const taskComparator = createdAtComparator();
+// ============================================================================
+// Queue operations
+// ============================================================================
+/**
+ * PERF-001 FIX: Use binary insertion O(log n) instead of sort O(n log n)
+ */
+export function enqueueTask(taskQueue, domainQueues, task) {
+    const priorityQueue = taskQueue.get(task.priority);
+    if (priorityQueue) {
+        binaryInsert(priorityQueue, task, taskComparator);
+    }
+    // Also add to domain-specific queues (unsorted - just for load tracking)
+    for (const domain of task.targetDomains) {
+        const domainQueue = domainQueues.get(domain);
+        if (domainQueue) {
+            domainQueue.push(task);
+        }
+    }
+}
+/**
+ * Remove a task from all queues.
+ * PERF-008: Only iterate the task's targetDomains instead of ALL_DOMAINS.
+ */
+export function removeFromQueues(taskQueue, domainQueues, task) {
+    const priorityQueue = taskQueue.get(task.priority);
+    if (priorityQueue) {
+        const idx = priorityQueue.findIndex(t => t.id === task.id);
+        if (idx !== -1) {
+            priorityQueue.splice(idx, 1);
+        }
+    }
+    for (const domain of task.targetDomains) {
+        const domainQueue = domainQueues.get(domain);
+        if (domainQueue) {
+            const idx = domainQueue.findIndex(t => t.id === task.id);
+            if (idx !== -1) {
+                domainQueue.splice(idx, 1);
+            }
+        }
+    }
+}
+/**
+ * Get the position of a task within the priority queues.
+ */
+export function getQueuePosition(taskQueue, task) {
+    let position = 0;
+    for (const p of ['p0', 'p1', 'p2', 'p3']) {
+        const queue = taskQueue.get(p);
+        if (queue) {
+            if (p === task.priority) {
+                position += queue.findIndex(t => t.id === task.id);
+                break;
+            }
+            position += queue.length;
+        }
+    }
+    return position;
+}
+/**
+ * Process the queue: dequeue highest-priority tasks and assign them.
+ * CC-002 FIX: Uses atomic counter for capacity check.
+ */
+export async function processQueue(ctx) {
+    if (ctx.runningTaskCounter >= ctx.config.maxConcurrentTasks) {
+        return;
+    }
+    // #1081: while this drain runs, a task failed at dispatch frees its slot
+    // here instead of starting a nested drain (one stack frame per failed task).
+    drainDepth.set(ctx.tasks, (drainDepth.get(ctx.tasks) ?? 0) + 1);
+    try {
+        // #1127: a slot released elsewhere while this drain awaits marks it dirty,
+        // so it scans again from p0 rather than leaving the slot unused.
+        do {
+            drainDirty.delete(ctx.tasks);
+            for (const priority of ['p0', 'p1', 'p2', 'p3']) {
+                const queue = ctx.taskQueue.get(priority);
+                if (!queue || queue.length === 0)
+                    continue;
+                let task = shiftDispatchableTask(ctx, queue);
+                while (task) {
+                    removeFromQueues(ctx.taskQueue, ctx.domainQueues, task);
+                    // CC-002 FIX: Increment counter before assigning queued task
+                    ctx.runningTaskCounter++;
+                    let assigned;
+                    try {
+                        assigned = await assignTask(ctx, task);
+                    }
+                    catch (error) {
+                        ctx.runningTaskCounter = Math.max(0, ctx.runningTaskCounter - 1);
+                        throw error;
+                    }
+                    // #1081: a queued task that cannot be assigned (no healthy domain, open
+                    // breaker) has no caller waiting on the result. Fail it with the reason
+                    // rather than leave it queued forever on a held slot.
+                    if (!assigned.success && (ctx.tasks.get(task.id)?.status ?? 'queued') === 'queued') {
+                        await settleFailedBeforeRun(ctx, task, undefined, assigned.error.message);
+                    }
+                    if (ctx.runningTaskCounter >= ctx.config.maxConcurrentTasks) {
+                        return;
+                    }
+                    // #1127: fill every free slot, whether this task started, failed
+                    // before running or was cancelled while it was being assigned.
+                    task = shiftDispatchableTask(ctx, queue);
+                }
+            }
+        } while (drainDirty.has(ctx.tasks) && ctx.runningTaskCounter < ctx.config.maxConcurrentTasks);
+    }
+    finally {
+        const depth = (drainDepth.get(ctx.tasks) ?? 1) - 1;
+        if (depth > 0)
+            drainDepth.set(ctx.tasks, depth);
+        else {
+            drainDepth.delete(ctx.tasks);
+            drainDirty.delete(ctx.tasks);
+        }
+    }
+}
+/**
+ * Drains in progress per Queen, keyed by its task map (the task context
+ * object is rebuilt for every call).
+ */
+const drainDepth = new WeakMap();
+/** #1127: Queens with a slot released while a drain was running. */
+const drainDirty = new WeakSet();
+/**
+ * Give back the slot a task held and hand it to the queue: a running drain
+ * picks it up on its next scan, otherwise a new drain starts.
+ */
+export async function releaseSlot(ctx) {
+    ctx.runningTaskCounter = Math.max(0, ctx.runningTaskCounter - 1);
+    if (drainDepth.has(ctx.tasks)) {
+        drainDirty.add(ctx.tasks);
+        return;
+    }
+    // The drain dispatches other tasks. The caller whose task released this
+    // slot does not wait for it (#1140), and its failure belongs to none of
+    // them, so it must not reach that caller.
+    void processQueue(ctx).catch(error => {
+        console.warn('[Queen] Queue drain after a released slot failed:', toErrorMessage(error));
+    });
+}
+/**
+ * Take the next task that is still waiting to run. A queued task can reach a
+ * terminal state without being dequeued, e.g. when its caller executes it
+ * directly (#1070). Dispatching it again would flip it back to running and
+ * leak a capacity slot, so such entries are dropped from the queues instead.
+ */
+function shiftDispatchableTask(ctx, queue) {
+    let task = queue.shift();
+    while (task) {
+        const status = ctx.tasks.get(task.id)?.status;
+        if (status === undefined || status === 'queued')
+            return task;
+        removeFromQueues(ctx.taskQueue, ctx.domainQueues, task);
+        task = queue.shift();
+    }
+    return undefined;
+}
+/**
+ * Mark a task that never started as failed, publish QueenTaskFailed (#1124)
+ * and hand the slot it held to the queue.
+ */
+export async function settleFailedBeforeRun(ctx, task, domain, reason) {
+    ctx.tasks.set(task.id, {
+        taskId: task.id,
+        task,
+        status: 'failed',
+        assignedDomain: domain,
+        assignedAgents: [],
+        retryCount: ctx.tasks.get(task.id)?.retryCount ?? 0,
+        error: reason,
+        completedAt: new Date(),
+    });
+    ctx.tasksFailed++;
+    ctx.auditLogger.logFail(task.id, undefined, reason);
+    await ctx.publishEvent('TaskFailed', { taskId: task.id, domain, error: reason });
+    await releaseSlot(ctx);
+}
+//# sourceMappingURL=queen-task-queue.js.map

package/dist/coordination/queen-types.d.ts

@@ -151,7 +151,7 @@ export interface IQueenCoordinator {
     triggerWorkStealing(): Promise<number>;
     listAllAgents(): AgentInfo[];
     getAgentsByDomain(domain: DomainName): AgentInfo[];
-    requestAgentSpawn(domain: DomainName, type: string, capabilities: string[]): Promise<Result<string, Error>>;
+    requestAgentSpawn(domain: DomainName, type: string, capabilities: string[], taskId?: string): Promise<Result<string, Error>>;
     getHealth(): QueenHealth;
     getMetrics(): QueenMetrics;
     executeProtocol(protocolId: string, params?: Record<string, unknown>): Promise<Result<string, Error>>;

package/dist/coordination/queen-work-stealing.d.ts

@@ -14,8 +14,13 @@ export interface QueenWorkStealingContext {
     getIdleDomains(): DomainName[];
     getBusyDomains(): DomainName[];
     getDomainLoad(domain: DomainName): number;
+    /** #1140: free Queen slots; a steal starts a task, so it needs one */
+    availableSlots(): number;
+    /** #1124: the domain is configured for the task and its plugin can execute it */
+    canExecuteInDomain(domain: DomainName, task: QueenTask): boolean;
     removeFromQueues(task: QueenTask): void;
-    assignTaskToDomain(task: QueenTask, domain: DomainName): Promise<void>;
+    /** Dispatch a stolen task; resolves whether it now runs in `domain`. */
+    assignTaskToDomain(task: QueenTask, domain: DomainName): Promise<boolean>;
     publishEvent(type: string, payload: Record<string, unknown>): Promise<void>;
 }
 /**

package/dist/coordination/queen-work-stealing.js

@@ -4,7 +4,6 @@
  * exponential backoff and automatic disable on repeated failures.
  */
 import { toErrorMessage } from '../shared/error-utils.js';
-import { canDomainHandleTask } from './queen-task-management.js';
 // ============================================================================
 // Work stealing algorithm
 // ============================================================================
@@ -26,14 +25,18 @@ export async function triggerWorkStealing(ctx) {
             break;
         const queue = ctx.domainQueues.get(busyDomain) || [];
         const stealCount = Math.min(queue.length, ctx.config.workStealing.stealBatchSize);
-        for (let i = 0; i < stealCount && idleDomains.length > 0; i++) {
-            const task = queue.find(t => canDomainHandleTask(idleDomains[0], t));
+        // #1140: each steal takes a slot, so stop when none is free.
+        for (let i = 0; i < stealCount && idleDomains.length > 0 && ctx.availableSlots() > 0; i++) {
+            const task = queue.find(t => ctx.canExecuteInDomain(idleDomains[0], t));
             if (task) {
                 const stealerDomain = idleDomains.shift();
                 ctx.removeFromQueues(task);
+                // #1124: a task that is not running afterwards (already terminal, or
+                // failed at assignment) was not stolen.
+                if (!await ctx.assignTaskToDomain(task, stealerDomain))
+                    continue;
                 // SEC-003 Simplified: Log work stealing for observability
                 ctx.auditLogger.logSteal(task.id, busyDomain, stealerDomain);
-                await ctx.assignTaskToDomain(task, stealerDomain);
                 stolenCount++;
                 ctx.tasksStolen++;
                 await ctx.publishEvent('TaskStolen', {

package/dist/coordination/result-saver-adapters.d.ts

@@ -0,0 +1,15 @@
+/**
+ * #1125 review: task_orchestrate and `aqe fleet run` now submit the domains'
+ * concrete handler types (sast-scan, analyze-quality) for the abstract types
+ * scan-security and assess-quality. These adapters map those handler results
+ * onto the report shapes ResultSaver already writes, so they are saved by the
+ * security and quality savers rather than as generic JSON. Nothing missing
+ * from a result is filled in: absent values stay absent.
+ */
+import type { TaskType } from './queen-types.js';
+/** The saver type and report for a task result; other types pass through. */
+export declare function resultForSaver(taskType: string, result: unknown): {
+    saveType: TaskType;
+    report: unknown;
+};
+//# sourceMappingURL=result-saver-adapters.d.ts.map

package/dist/coordination/result-saver-adapters.js

@@ -0,0 +1,57 @@
+const asRecord = (value) => value !== null && typeof value === 'object' ? value : {};
+/** sast-scan's SASTResult -> the scan-security report shape. */
+function securityReport(result) {
+    const data = asRecord(result);
+    const summary = asRecord(data.summary);
+    const findings = Array.isArray(data.vulnerabilities) ? data.vulnerabilities : [];
+    const count = (severity) => typeof summary[severity] === 'number' ? summary[severity] : 0;
+    return {
+        vulnerabilities: findings.length,
+        critical: count('critical'),
+        high: count('high'),
+        medium: count('medium'),
+        low: count('low'),
+        topVulnerabilities: findings.slice(0, 10).map(f => ({
+            type: f.title ?? f.category ?? 'finding',
+            severity: f.severity ?? 'unknown',
+            file: f.location?.file ?? '',
+            line: f.location?.line ?? 0,
+        })),
+        findings: findings.map(f => ({
+            title: f.title, type: f.category, severity: f.severity ?? 'unknown', location: f.location?.file
+                ? { file: f.location.file, line: f.location.line } : undefined, description: f.description,
+        })),
+        recommendations: [],
+        evidence: data.evidence,
+        coverage: data.coverage,
+        analysisDepth: 'sast-patterns',
+    };
+}
+/** analyze-quality's analysis -> the assess-quality report shape. No gate runs. */
+function qualityReport(result) {
+    const data = asRecord(result);
+    const score = asRecord(data.score);
+    const metrics = Array.isArray(data.metrics) ? data.metrics : [];
+    const unmeasured = Array.isArray(data.unmeasured)
+        ? data.unmeasured.map(u => u.metric).filter((m) => !!m)
+        : [];
+    return {
+        ...(typeof score.overall === 'number' ? { qualityScore: score.overall } : {}),
+        passed: false,
+        gateEvaluated: false,
+        metrics: Object.fromEntries(metrics.filter(m => m.name && typeof m.value === 'number').map(m => [m.name, m.value])),
+        recommendations: Array.isArray(data.recommendations) ? data.recommendations : [],
+        unmeasured,
+        evidenceStatus: unmeasured.length > 0 ? 'insufficient-evidence' : 'measured',
+        scoreBasis: metrics.map(m => m.name).filter((m) => !!m),
+    };
+}
+/** The saver type and report for a task result; other types pass through. */
+export function resultForSaver(taskType, result) {
+    switch (taskType) {
+        case 'sast-scan': return { saveType: 'scan-security', report: securityReport(result) };
+        case 'analyze-quality': return { saveType: 'assess-quality', report: qualityReport(result) };
+        default: return { saveType: taskType, report: result };
+    }
+}
+//# sourceMappingURL=result-saver-adapters.js.map

package/dist/coordination/result-saver.d.ts

@@ -58,7 +58,7 @@ export declare class ResultSaver {
     /**
      * Save task result in appropriate format(s)
      */
-    save(taskId: string, taskType: TaskType, result: unknown, options?: SaveOptions): Promise<SavedResult>;
+    save(taskId: string, taskType: TaskType, taskResult: unknown, options?: SaveOptions): Promise<SavedResult>;
     private saveTestGeneration;
     private saveCoverage;
     private saveSecurityScan;

package/dist/coordination/result-saver.js

@@ -7,6 +7,7 @@ import * as path from 'path';
 import { createHash, randomBytes } from 'crypto';
 import { safeJsonParse } from '../shared/safe-json.js';
 import { getProjectStorePath } from '../kernel/project-root.js';
+import { resultForSaver } from './result-saver-adapters.js';
 /** Cap on the sanitized stem of a generated test file name (see generatedTestFilename). */
 const MAX_GENERATED_STEM_LENGTH = 100;
 function securityReportExecution(data) {
@@ -92,12 +93,14 @@ export class ResultSaver {
     /**
      * Save task result in appropriate format(s)
      */
-    async save(taskId, taskType, result, options = {}) {
+    async save(taskId, taskType, taskResult, options = {}) {
+        // #1125: concrete handler types are saved by their abstract type's saver.
+        const { saveType, report: result } = resultForSaver(taskType, taskResult);
         const timestamp = new Date();
         const files = [];
         // Database-free mode (#534): do not write .agentic-qe/results/* to disk.
         if (process.env.AQE_MEMORY_BACKEND === 'memory') {
-            return { taskId, taskType, timestamp, files, summary: this.extractSummary(taskType, result) };
+            return { taskId, taskType, timestamp, files, summary: this.extractSummary(saveType, result) };
         }
         // Ensure directories exist
         await this.ensureDirectories(taskType);
@@ -110,7 +113,7 @@ export class ResultSaver {
         const tsStr = this.formatTimestamp(timestamp);
         const prefix = options.filenamePrefix || `${tsStr}_${this.uniqueSuffix(taskId)}`;
         // Save based on task type
-        switch (taskType) {
+        switch (saveType) {
             case 'generate-tests':
                 files.push(...await this.saveTestGeneration(result, prefix, options));
                 break;
@@ -140,10 +143,10 @@ export class ResultSaver {
                 break;
             default:
                 // Generic JSON save for unknown types
-                files.push(...await this.saveGeneric(taskType, result, prefix));
+                files.push(...await this.saveGeneric(saveType, result, prefix));
         }
         // Update index
-        const summary = this.extractSummary(taskType, result);
+        const summary = this.extractSummary(saveType, result);
         await this.updateIndex(taskId, taskType, timestamp, files, summary);
         return {
             taskId,

package/dist/coordination/yaml-pipeline-loader.js

@@ -8,6 +8,7 @@
 import * as fs from 'node:fs/promises';
 import { parse as parseYaml } from 'yaml';
 import { ok, err, ALL_DOMAINS } from '../shared/types/index.js';
+import { getOwn } from '../shared/utils/safe-record.js';
 const VALID_OPERATORS = [
     'eq', 'neq', 'gt', 'gte', 'lt', 'lte', 'contains', 'exists',
 ];
@@ -380,8 +381,10 @@ export class YamlPipelineLoader {
     }
     /** Resolve a dot-path variable (e.g. "foo.bar") from a variables map. */
     resolveVarPath(vars, path) {
+        // #1136: own properties only, so ${constructor} or ${x.toString} does
+        // not expand to an inherited Object.prototype member.
         // Try direct key first (covers flat keys like "coverageGoal")
-        if (path in vars)
+        if (Object.hasOwn(vars, path))
             return vars[path];
         // Try dot-path traversal
         const parts = path.split('.');
@@ -390,7 +393,7 @@ export class YamlPipelineLoader {
             if (current === null || current === undefined || typeof current !== 'object') {
                 return undefined;
             }
-            current = current[part];
+            current = getOwn(current, part);
         }
         return current;
     }

package/dist/domains/code-intelligence/index-path-guard.d.ts

@@ -28,13 +28,16 @@ export declare const MAX_INDEX_PATHS = 10000;
 export declare function validateIndexPaths(value: unknown, field?: string, context?: string, maxPaths?: number): Result<string[], Error>;
 /**
  * Boundary check shared by `task_submit` and `aqe task submit`: an `index` or
- * `index-code` task that carries `paths` must carry a well-formed list.
- * Returns undefined when the task is acceptable.
+ * `index-code` task must carry a non-empty, well-formed `paths` list. The task
+ * handler indexes exactly those files; it does not expand a directory
+ * `target` (#1134), so a request without `paths` is refused here instead of
+ * failing after it was accepted. Returns undefined when the task is acceptable.
  */
 export declare function validateIndexTaskPayload(type: string, payload: unknown): Error | undefined;
 /**
  * Split `paths` into those that may be indexed and those that must be skipped.
  * Relative paths resolve against `basePath` (default: cwd), as FileReader does.
+ * The rule is the shared payload-path guard (#1126) without a size limit.
  */
 export declare function confineIndexPaths(paths: readonly string[], projectRoot: string, basePath?: string): Promise<ConfinedIndexPaths>;
 /**

package/dist/domains/code-intelligence/index-path-guard.js

@@ -8,14 +8,8 @@
  * of the project is skipped and reported instead of followed. Callers get the
  * skipped paths back with a reason; nothing skipped counts as indexed.
  */
-import * as fs from 'node:fs/promises';
-import * as path from 'node:path';
 import { ok, err } from '../../shared/types/index.js';
-/** True when `candidate` is `root` or lies beneath it (both absolute). */
-function isWithin(root, candidate) {
-    const relative = path.relative(root, candidate);
-    return relative === '' || (relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
-}
+import { confinePayloadPaths } from '../../shared/io/payload-path-guard.js';
 function describe(value) {
     if (value === null)
         return 'null';
@@ -53,60 +47,36 @@ export function validateIndexPaths(value, field = 'paths', context = 'Invalid in
 }
 /**
  * Boundary check shared by `task_submit` and `aqe task submit`: an `index` or
- * `index-code` task that carries `paths` must carry a well-formed list.
- * Returns undefined when the task is acceptable.
+ * `index-code` task must carry a non-empty, well-formed `paths` list. The task
+ * handler indexes exactly those files; it does not expand a directory
+ * `target` (#1134), so a request without `paths` is refused here instead of
+ * failing after it was accepted. Returns undefined when the task is acceptable.
  */
 export function validateIndexTaskPayload(type, payload) {
     if (type !== 'index' && type !== 'index-code')
         return undefined;
-    if (payload === null || typeof payload !== 'object' || !('paths' in payload))
-        return undefined;
+    if (payload === null || typeof payload !== 'object' || !Object.hasOwn(payload, 'paths')) {
+        return new Error(`Invalid index payload: '${type}' needs 'paths', the list of files to index. ` +
+            "It does not expand a directory 'target'; use code_index (or `aqe code index`) with a target, " +
+            'or list the files in paths.');
+    }
     const result = validateIndexPaths(payload.paths);
-    return result.success ? undefined : result.error;
+    if (!result.success)
+        return result.error;
+    if (result.value.length === 0) {
+        return new Error("Invalid index payload: 'paths' is empty; list at least one file to index");
+    }
+    return undefined;
 }
 /**
  * Split `paths` into those that may be indexed and those that must be skipped.
  * Relative paths resolve against `basePath` (default: cwd), as FileReader does.
+ * The rule is the shared payload-path guard (#1126) without a size limit.
  */
 export async function confineIndexPaths(paths, projectRoot, basePath = process.cwd()) {
-    const accepted = [];
-    const skipped = [];
-    const rootLexical = path.resolve(projectRoot);
-    const rootReal = await fs.realpath(projectRoot).catch(() => rootLexical);
-    for (const requested of paths) {
-        const lexical = path.resolve(basePath, requested);
-        // A path that is not even spelled inside the root is refused before any
-        // filesystem call, so the reason cannot reveal whether an outside path
-        // exists or is readable.
-        if (!isWithin(rootLexical, lexical) && !isWithin(rootReal, lexical)) {
-            skipped.push({ path: requested, reason: 'outside-project-root' });
-            continue;
-        }
-        let real;
-        try {
-            real = await fs.realpath(lexical);
-        }
-        catch (error) {
-            const code = error.code;
-            skipped.push({ path: requested, reason: code === 'ENOENT' || code === 'ENOTDIR' ? 'not-found' : 'unreadable' });
-            continue;
-        }
-        if (!isWithin(rootReal, real)) {
-            skipped.push({ path: requested, reason: 'outside-project-root' });
-            continue;
-        }
-        const stat = await fs.stat(real).catch(() => null);
-        if (!stat) {
-            skipped.push({ path: requested, reason: 'unreadable' });
-        }
-        else if (!stat.isFile()) {
-            skipped.push({ path: requested, reason: 'not-a-file' });
-        }
-        else {
-            accepted.push(requested);
-        }
-    }
-    return { accepted, skipped };
+    const { accepted, skipped } = await confinePayloadPaths(paths, { projectRoot, basePath });
+    // Without maxBytes the guard never reports 'too-large'.
+    return { accepted, skipped: skipped };
 }
 /**
  * The error an index entry point returns when paths were requested but none

package/dist/domains/code-intelligence/plugin.js

@@ -66,7 +66,7 @@ export class CodeIntelligencePlugin extends BaseDomainPlugin {
     // Task Handlers (Queen-Domain Integration)
     // ============================================================================
     getTaskHandlers() {
-        return new Map([
+        const handlers = new Map([
             ['index', async (payload) => {
                     if (!this.coordinator) {
                         return err(new Error('Coordinator not initialized'));
@@ -127,6 +127,10 @@ export class CodeIntelligencePlugin extends BaseDomainPlugin {
                     });
                 }],
         ]);
+        // `index-code` is the public Queen TaskType inferred by task_orchestrate.
+        // Both names share one execution handler and the same result lifecycle.
+        handlers.set('index-code', handlers.get('index'));
+        return handlers;
     }
     // ============================================================================
     // Lifecycle Methods

package/dist/domains/code-intelligence/services/metric-collector/index.d.ts

@@ -20,7 +20,7 @@ export { DEFAULT_METRIC_CONFIG } from './interfaces.js';
  */
 export interface IMetricCollectorService extends MetricCollector {
     /** Check available tools on the system */
-    checkTools(): ToolAvailability[];
+    checkTools(): Promise<ToolAvailability[]>;
     /** Clear the metrics cache */
     clearCache(): void;
     /** Get cache statistics */
@@ -66,7 +66,7 @@ export declare class MetricCollectorService implements IMetricCollectorService {
     /**
      * Check available tools on the system
      */
-    checkTools(): ToolAvailability[];
+    checkTools(): Promise<ToolAvailability[]>;
     /**
      * Clear the metrics cache
      */

package/dist/domains/code-intelligence/services/metric-collector/index.js

@@ -138,9 +138,8 @@ export class MetricCollectorService {
     /**
      * Check available tools on the system
      */
-    checkTools() {
-        const locTools = checkLOCTools();
-        const testTools = checkTestRunners(process.cwd());
+    async checkTools() {
+        const [locTools, testTools] = await Promise.all([checkLOCTools(), checkTestRunners(process.cwd())]);
         return [...locTools, ...testTools];
     }
     /**

package/dist/domains/code-intelligence/services/metric-collector/loc-counter.d.ts

@@ -24,7 +24,7 @@ export declare function countLOC(projectPath: string, config?: Partial<MetricCol
 /**
  * Check which LOC counting tools are available
  */
-export declare function checkLOCTools(): ToolAvailability[];
+export declare function checkLOCTools(): Promise<ToolAvailability[]>;
 /**
  * cloc `--not-match-f` regex matching any of `names` exactly (basename), or
  * null when there is nothing to exclude.