agentic-qe 3.15.9 → 3.15.10

package/dist/domains/security-compliance/services/scanners/dast-scanner.js

@@ -2,15 +2,25 @@
  * Agentic QE v3 - DAST (Dynamic Application Security Testing) Scanner
  * Performs dynamic analysis of running applications to detect security vulnerabilities
  */
-import { LoggerFactory } from '../../../../logging/index.js';
 import { v4 as uuidv4 } from 'uuid';
 import { ok, err } from '../../../../shared/types/index.js';
 import { toError } from '../../../../shared/error-utils.js';
 import { fetchWithResponseDeadline } from '../../../../shared/llm/providers/response-deadline.js';
-import { analyzeSecurityHeaders, analyzeCookieSecurity, analyzeServerHeaders, scanSensitiveFiles, analyzeCORS, extractAndCrawlLinks, testXSS, testSQLi, analyzeFormsForSecurityIssues, testAuthorizationBypass, testIDOR, validateCredentials, buildAuthHeaders, handleFetchError, calculateSummary, storeScanResults, } from './dast-helpers.js';
+import { analyzeSecurityHeaders, analyzeCookieSecurity, analyzeServerHeaders, scanSensitiveFiles, analyzeCORS, extractAndCrawlLinks, testXSS, testSQLi, analyzeFormsForSecurityIssues, testAuthorizationBypass, testIDOR, validateCredentials, buildAuthHeaders, calculateSummary, storeScanResults, } from './dast-helpers.js';
 // ============================================================================
 // DAST Scanner Service
 // ============================================================================
+/** Transport failures are execution errors, not absence of vulnerabilities. */
+function dastRequestFailure(error) {
+    if (error instanceof Error && 'code' in error && ['DAST_AUTHENTICATION_FAILED', 'DAST_TARGET_UNAVAILABLE'].includes(String(error.code)))
+        return error;
+    const timeout = error instanceof Error && /timeout|abort/i.test(error.message);
+    return Object.assign(new Error(timeout
+        ? 'DAST target request timeout; dynamic analysis is incomplete'
+        : 'DAST target request failed; dynamic analysis is incomplete'), {
+        code: timeout ? 'DAST_REQUEST_TIMEOUT' : 'DAST_REQUEST_FAILED',
+    });
+}
 /**
  * DAST Scanner - Dynamic Application Security Testing
  * Scans running applications for security vulnerabilities
@@ -32,7 +42,6 @@ import { analyzeSecurityHeaders, analyzeCookieSecurity, analyzeServerHeaders, sc
  * - No JavaScript execution (static response analysis only)
  * - No session management testing beyond cookie attributes
  */
-const logger = LoggerFactory.create('security-compliance/dast-scanner');
 export class DASTScanner {
     config;
     memory;
@@ -90,7 +99,7 @@ export class DASTScanner {
             // Validate credentials
             const credValidation = validateCredentials(credentials);
             if (!credValidation.valid) {
-                return err(new Error(credValidation.reason));
+                throw new Error(credValidation.reason);
             }
             const mergedOptions = {
                 maxDepth: options?.maxDepth ?? this.config.dastMaxDepth,
@@ -158,6 +167,12 @@ export class DASTScanner {
                     },
                     redirect: 'follow',
                 }, deadlineMs, () => new Error(`DAST request timeout after ${deadlineMs}ms: ${targetUrl}`));
+                if (response.status === 401 || response.status === 403 || response.status >= 500) {
+                    await response.body?.cancel().catch(() => undefined);
+                    throw Object.assign(new Error(`DAST ${response.status < 500 ? 'authentication rejected' : 'target unavailable'} (HTTP ${response.status}); dynamic analysis is incomplete`), {
+                        code: response.status < 500 ? 'DAST_AUTHENTICATION_FAILED' : 'DAST_TARGET_UNAVAILABLE',
+                    });
+                }
                 crawledUrls++;
                 // Security header analysis
                 analyzeSecurityHeaders(response.headers, targetUrl, vulnerabilities);
@@ -190,11 +205,11 @@ export class DASTScanner {
                 }
             }
             catch (fetchError) {
-                handleFetchError(fetchError, targetUrl, vulnerabilities);
+                throw dastRequestFailure(fetchError);
             }
         }
         catch (error) {
-            logger.error('DAST scan error:', error instanceof Error ? error : undefined);
+            throw toError(error);
         }
         return { vulnerabilities, crawledUrls };
     }
@@ -231,11 +246,13 @@ export class DASTScanner {
                     redirect: 'follow',
                 }, deadlineMs, () => new Error(`DAST request timeout after ${deadlineMs}ms: ${targetUrl}`));
                 await response.body?.cancel().catch(() => undefined);
-                crawledUrls++;
-                // Check if authentication was successful
-                if (response.status === 401 || response.status === 403) {
-                    vulnerabilities.push(this.createAuthFailedVuln(targetUrl, response.status));
+                if (response.status === 401 || response.status === 403 || response.status >= 500) {
+                    await response.body?.cancel().catch(() => undefined);
+                    throw Object.assign(new Error(`DAST ${response.status < 500 ? 'authentication rejected' : 'target unavailable'} (HTTP ${response.status}); dynamic analysis is incomplete`), {
+                        code: response.status < 500 ? 'DAST_AUTHENTICATION_FAILED' : 'DAST_TARGET_UNAVAILABLE',
+                    });
                 }
+                crawledUrls++;
                 // Standard security header checks
                 analyzeSecurityHeaders(response.headers, targetUrl, vulnerabilities, true);
                 // Check for session token in URL
@@ -251,11 +268,11 @@ export class DASTScanner {
                 analyzeCookieSecurity(response.headers, targetUrl, vulnerabilities, true);
             }
             catch (fetchError) {
-                handleFetchError(fetchError, targetUrl, vulnerabilities);
+                throw dastRequestFailure(fetchError);
             }
         }
         catch (error) {
-            logger.error('Authenticated DAST scan error:', error instanceof Error ? error : undefined);
+            throw toError(error);
         }
         return { vulnerabilities, crawledUrls };
     }
@@ -286,18 +303,6 @@ export class DASTScanner {
             references: ['https://owasp.org/www-project-web-security-testing-guide/'],
         };
     }
-    createAuthFailedVuln(targetUrl, status) {
-        return {
-            id: uuidv4(),
-            title: 'Authentication Failed',
-            description: `Authentication returned ${status} status`,
-            severity: 'informational',
-            category: 'broken-auth',
-            location: { file: targetUrl },
-            remediation: { description: 'Verify credentials are correct', estimatedEffort: 'trivial', automatable: false },
-            references: [],
-        };
-    }
     createTokenInUrlVuln(targetUrl, search) {
         return {
             id: uuidv4(),

package/dist/domains/security-compliance/services/scanners/scanner-orchestrator.js

@@ -122,7 +122,10 @@ export class SecurityScannerService {
                 if (dastScan.success) {
                     dastResult = dastScan.value;
                 }
-                // Don't fail the full scan if DAST fails
+                else {
+                    // A requested phase that did not execute cannot become a full scan.
+                    return err(dastScan.error);
+                }
             }
             // Combine summaries
             const combinedSummary = this.combineSummaries(sastResult.value.summary, dastResult?.summary);

package/dist/domains/test-execution/coordinator.d.ts

@@ -123,6 +123,11 @@ export declare class TestExecutionCoordinator extends BaseDomainCoordinator<Test
      * Auto-detects framework and uses sensible defaults
      */
     runTests(request: SimpleTestRequest): Promise<Result<TestRunResult, Error>>;
+    /**
+     * Retry a run's failed tests when retries were requested, and attach what
+     * the retries did to the run (#1130). The run's own counts are unchanged.
+     */
+    private retryFailures;
     /**
      * Detect test framework from file patterns and project configuration
      */

package/dist/domains/test-execution/coordinator.js

@@ -146,16 +146,8 @@ export class TestExecutionCoordinator extends BaseDomainCoordinator {
                 workers,
                 timeout,
             });
-            // Handle retries if requested and there were failures
-            if (request.retryCount && request.retryCount > 0 && result.success && result.value.failed > 0) {
-                const failedTestIds = result.value.failedTests.map(t => t.testId);
-                await this.retry({
-                    runId: result.value.runId,
-                    failedTests: failedTestIds,
-                    maxRetries: request.retryCount,
-                    backoff: 'exponential',
-                });
-            }
+            if (result.success)
+                await this.retryFailures(result.value, request.retryCount);
             return result;
         }
         // Sequential execution
@@ -164,18 +156,41 @@ export class TestExecutionCoordinator extends BaseDomainCoordinator {
             framework,
             timeout,
         });
-        // Handle retries if requested and there were failures
-        if (request.retryCount && request.retryCount > 0 && result.success && result.value.failed > 0) {
-            const failedTestIds = result.value.failedTests.map(t => t.testId);
-            await this.retry({
-                runId: result.value.runId,
-                failedTests: failedTestIds,
-                maxRetries: request.retryCount,
-                backoff: 'exponential',
-            });
-        }
+        if (result.success)
+            await this.retryFailures(result.value, request.retryCount);
         return result;
     }
+    /**
+     * Retry a run's failed tests when retries were requested, and attach what
+     * the retries did to the run (#1130). The run's own counts are unchanged.
+     */
+    async retryFailures(run, retryCount) {
+        if (!retryCount || retryCount <= 0)
+            return;
+        if (run.failed === 0) {
+            run.retries = { totalRetries: 0, nowPassing: 0, stillFailing: 0, tests: [] };
+            return;
+        }
+        const retried = await this.retry({
+            runId: run.runId,
+            failedTests: run.failedTests.map(t => t.testId),
+            maxRetries: retryCount,
+            backoff: 'exponential',
+        });
+        if (!retried.success)
+            return;
+        const byId = new Map(run.failedTests.map(t => [t.testId, t]));
+        run.retries = {
+            totalRetries: retried.value.retried,
+            nowPassing: retried.value.nowPassing,
+            stillFailing: retried.value.stillFailing,
+            tests: (retried.value.tests ?? []).map(({ testId, ...outcome }) => ({
+                name: byId.get(testId)?.testName ?? testId,
+                file: byId.get(testId)?.file ?? '',
+                ...outcome,
+            })),
+        };
+    }
     /**
      * Detect test framework from file patterns and project configuration
      */

package/dist/domains/test-execution/interfaces.d.ts

@@ -78,6 +78,22 @@ export interface ITestRunResult {
     coverage?: ICoverageData;
     /** Per-file coverage data for granular quality assessment */
     fileCoverages?: IFileCoverageData[];
+    /** #1130: what the requested retries of failed tests did. Absent when none were requested. */
+    retries?: IRunRetrySummary;
+}
+/** #1130: the measured outcome of a run's retries, per failed test. */
+export interface IRunRetrySummary {
+    /** Reruns that executed a test (an unmatched retry runs nothing and is not counted). */
+    totalRetries: number;
+    nowPassing: number;
+    stillFailing: number;
+    tests: Array<{
+        name: string;
+        file: string;
+        attempts: number;
+        passed: boolean;
+        unmatched?: boolean;
+    }>;
 }
 /** One test case taken verbatim from a runner report (#1110). */
 export interface ITestCaseResult {
@@ -144,6 +160,15 @@ export interface IRetryResult {
     nowPassing: number;
     stillFailing: number;
     flakyDetected: string[];
+    /** Failed tests whose retry filter selected no test, so none was rerun (#1141). */
+    unmatched?: string[];
+    /** #1130: the outcome per retried test. */
+    tests?: Array<{
+        testId: string;
+        attempts: number;
+        passed: boolean;
+        unmatched?: boolean;
+    }>;
 }
 export interface IExecutionStats {
     runId: string;

package/dist/domains/test-execution/plugin.js

@@ -4,6 +4,7 @@
  */
 import { err } from '../../shared/types/index.js';
 import { BaseDomainPlugin } from '../domain-interface.js';
+import { requirePayloadFiles } from '../../shared/io/payload-path-guard.js';
 import { createTestExecutionCoordinator } from './coordinator.js';
 import { getGlobalInfraHealing } from '../../strange-loop/infra-healing/global-instance.js';
 import { isMeasuredGapPayload } from '../../shared/events/domain-events.js';
@@ -60,11 +61,22 @@ export class TestExecutionPlugin extends BaseDomainPlugin {
                     if (!this.coordinator) {
                         return err(new Error('Coordinator not initialized'));
                     }
+                    // #1126: a runner executes the files it is given, so only files and
+                    // directories (#909 Jest targets) inside the project, passed on as the
+                    // real paths that were checked. A missing one is still reported by the
+                    // runner.
+                    let testFiles;
+                    if (payload.testFiles !== undefined) {
+                        const confined = await requirePayloadFiles('execute-tests', 'testFiles', payload.testFiles, { allowMissing: true, allowDirectory: true });
+                        if (!confined.success)
+                            return confined;
+                        testFiles = confined.value;
+                    }
                     // Support both simple and full request formats
-                    if (payload.testFiles && Array.isArray(payload.testFiles)) {
+                    if (testFiles) {
                         // Simple request format
                         const request = {
-                            testFiles: payload.testFiles,
+                            testFiles,
                             parallel: payload.parallel,
                             retryCount: payload.retryCount,
                             timeout: payload.timeout,
@@ -75,7 +87,7 @@ export class TestExecutionPlugin extends BaseDomainPlugin {
                     else if (payload.framework) {
                         // Full request format
                         const request = {
-                            testFiles: payload.testFiles || [],
+                            testFiles: [],
                             framework: payload.framework,
                             timeout: payload.timeout,
                             env: payload.env,
@@ -96,8 +108,11 @@ export class TestExecutionPlugin extends BaseDomainPlugin {
                     if (!testFiles) {
                         return err(new Error('Invalid detect-flaky payload: missing testFiles'));
                     }
+                    const confined = await requirePayloadFiles('detect-flaky', 'testFiles', testFiles, { allowMissing: true, allowDirectory: true });
+                    if (!confined.success)
+                        return confined;
                     return this.coordinator.detectFlaky({
-                        testFiles,
+                        testFiles: confined.value,
                         runs: runs ?? 5,
                         threshold: threshold ?? 0.1,
                     });

package/dist/domains/test-execution/services/flaky-detector.js

@@ -15,6 +15,7 @@ import { getTestRunnerExecutionError } from '../../../shared/test-runner-verdict
 import { createVitestJsonReport, needsVitestJsonReportFile } from '../../../shared/vitest-json-report.js';
 import { isJestCommand, jestExactPathPattern, runnerFilePath } from '../../../shared/test-runner-args.js';
 import { secureRandom } from '../../../shared/utils/crypto-random.js';
+import { redactFailureText } from './runner-test-cases.js';
 const DEFAULT_FLAKY_CONFIG = {
     simulateForTesting: false,
     simulatedFlakinessRate: RETRY_CONSTANTS.DEFAULT_FLAKY_RATE,
@@ -132,7 +133,8 @@ export class FlakyDetectorService {
     async recordExecution(testId, result) {
         // Add to in-memory history
         const history = this.testHistory.get(testId) ?? [];
-        history.push(result);
+        // #1122: test-history is persisted, so failure text is stored redacted.
+        history.push(result.error ? { ...result, error: redactFailureText(result.error) } : result);
         // Keep only last 100 executions
         if (history.length > 100) {
             history.shift();
@@ -336,7 +338,7 @@ export class FlakyDetectorService {
                                 runId,
                                 passed: code === 0,
                                 duration,
-                                error: code !== 0 ? stderr || `Exit code: ${code}` : undefined,
+                                error: code !== 0 ? redactFailureText(stderr || `Exit code: ${code}`) : undefined,
                                 timestamp: new Date(),
                                 context: {
                                     parallelRuns: 1,
@@ -365,7 +367,7 @@ export class FlakyDetectorService {
                             passed: code === 0,
                             duration,
                             error: code !== 0
-                                ? stderr || `Exit code: ${code}, Parse error: ${parseError}`
+                                ? redactFailureText(stderr || `Exit code: ${code}, Parse error: ${parseError}`)
                                 : undefined,
                             timestamp: new Date(),
                             context: {
@@ -479,8 +481,8 @@ export class FlakyDetectorService {
                     runId,
                     passed: test.status === 'passed',
                     duration: test.duration || 0,
-                    error: test.status === 'failed'
-                        ? test.failureMessages?.join('\n')
+                    error: test.status === 'failed' && test.failureMessages
+                        ? redactFailureText(test.failureMessages.join('\n'))
                         : undefined,
                     timestamp: new Date(),
                     context: {
@@ -505,8 +507,8 @@ export class FlakyDetectorService {
                     runId,
                     passed: assertion.status === 'passed',
                     duration: assertion.duration || 0,
-                    error: assertion.status === 'failed'
-                        ? assertion.failureMessages?.join('\n')
+                    error: assertion.status === 'failed' && assertion.failureMessages
+                        ? redactFailureText(assertion.failureMessages.join('\n'))
                         : undefined,
                     timestamp: new Date(),
                     context: {

package/dist/domains/test-execution/services/retry-handler.js

@@ -14,6 +14,7 @@ import { toError } from '../../../shared/error-utils.js';
 import { safeJsonParse } from '../../../shared/safe-json.js';
 import { secureRandom } from '../../../shared/utils/crypto-random.js';
 import { terminateTestRunner, trackTestRunnerExit } from '../../../shared/test-runner-process.js';
+import { redactFailureText } from './runner-test-cases.js';
 /**
  * Whether a runner-reported test file and the requested target are the same
  * file. Runners report real paths, so a target given through a symlink must be
@@ -104,6 +105,8 @@ export class RetryHandlerService {
             const nowPassing = [];
             const stillFailing = [];
             const flakyDetected = [];
+            const unmatched = [];
+            const tests = [];
             for (const test of failedTests) {
                 const result = await this.retryTest(test, maxRetries, backoff, baseDelay, maxDelay, onRetry);
                 stats.totalRetries += result.attempts;
@@ -118,11 +121,18 @@ export class RetryHandlerService {
                 else {
                     stillFailing.push(test.testId);
                     stats.failed++;
+                    if (result.unmatched)
+                        unmatched.push(test.testId);
                 }
+                tests.push({
+                    testId: test.testId, attempts: result.attempts, passed: result.passed,
+                    ...(result.unmatched ? { unmatched: true } : {}),
+                });
                 // Record retry history
                 await this.recordRetry(test.testId, result);
             }
             stats.flakyDetected = flakyDetected;
+            stats.unmatched = unmatched;
             stats.endTime = Date.now();
             this.runStats.set(runId, stats);
             // Persist stats
@@ -136,6 +146,8 @@ export class RetryHandlerService {
                 nowPassing: nowPassing.length,
                 stillFailing: stillFailing.length,
                 flakyDetected,
+                unmatched,
+                tests,
             };
             return ok(retryResult);
         }
@@ -218,7 +230,8 @@ export class RetryHandlerService {
     }
     async retryTest(test, maxRetries, backoff, baseDelay, maxDelay, onRetry) {
         let attempts = 0;
-        let lastError = test.error;
+        // #1122: the final error is persisted in retry-history, so keep it redacted.
+        let lastError = redactFailureText(test.error);
         while (attempts < maxRetries) {
             // Check if should retry
             const shouldRetry = await this.shouldRetry(test.testId, attempts, lastError);
@@ -232,9 +245,16 @@ export class RetryHandlerService {
             if (onRetry) {
                 onRetry(test.testId, attempts + 1);
             }
-            attempts++;
             // Execute test (simulated - in real implementation, would run actual test)
             const result = await this.executeTest(test);
+            // #1141: a filter that selected no test reran nothing. Report that
+            // instead of counting it as a retry, and stop: another attempt would
+            // select nothing again.
+            if (result.unmatched) {
+                logger.warn(`Retry of "${test.testName}" matched no test in ${test.file}; nothing was rerun.`);
+                return { testId: test.testId, passed: false, attempts, finalError: lastError, unmatched: true };
+            }
+            attempts++;
             if (result.passed) {
                 return {
                     testId: test.testId,
@@ -243,7 +263,7 @@ export class RetryHandlerService {
                     finalError: undefined,
                 };
             }
-            lastError = result.error ?? lastError;
+            lastError = result.error !== undefined ? redactFailureText(result.error) : lastError;
         }
         return {
             testId: test.testId,
@@ -477,9 +497,16 @@ export class RetryHandlerService {
                 const result = safeJsonParse(vitestMatch[0]);
                 // Vitest's positional file filter uses prefix matching. A passing
                 // sibling must not clear a failure in the requested file (#972).
-                const targetPassed = !targetFile || result.testResults?.some((file) => typeof file.name === 'string'
-                    && sameTestFile(file.name, targetFile, this.config.cwd ?? process.cwd())
-                    && file.assertionResults?.some(assertion => assertion.status === 'passed'));
+                const targetHas = (status) => result.testResults?.some((file) => typeof file.name === 'string'
+                    && (!targetFile || sameTestFile(file.name, targetFile, this.config.cwd ?? process.cwd()))
+                    && file.assertionResults?.some(assertion => assertion.status === status)) === true;
+                const targetPassed = !targetFile || targetHas('passed');
+                const nothingRan = targetFile
+                    ? Array.isArray(result.testResults) && !targetPassed && !targetHas('failed')
+                    : result.numPassedTests === 0;
+                if (nothingRan && result.numFailedTests === 0 && result.numFailedTestSuites === 0) {
+                    return UNMATCHED;
+                }
                 if (exitCode === 0 && result.success !== false
                     && result.numFailedTests === 0 && result.numFailedTestSuites === 0
                     && Number.isFinite(result.numPassedTests) && result.numPassedTests > 0
@@ -501,6 +528,10 @@ export class RetryHandlerService {
             const jestMatch = stdout.match(/\{[\s\S]*"numFailedTests"[\s\S]*\}/);
             if (jestMatch) {
                 const result = safeJsonParse(jestMatch[0]);
+                if (result.numPassedTests === 0 && result.numFailedTests === 0
+                    && result.numFailedTestSuites === 0) {
+                    return UNMATCHED;
+                }
                 if (exitCode === 0 && result.success !== false
                     && result.numFailedTests === 0 && result.numFailedTestSuites === 0
                     && Number.isFinite(result.numPassedTests) && result.numPassedTests > 0) {
@@ -517,6 +548,8 @@ export class RetryHandlerService {
             const mochaMatch = stdout.match(/\{[\s\S]*"stats"[\s\S]*"failures"[\s\S]*\}/);
             if (mochaMatch) {
                 const result = safeJsonParse(mochaMatch[0]);
+                if (result.stats?.passes === 0 && result.stats?.failures === 0)
+                    return UNMATCHED;
                 if (exitCode === 0 && result.stats?.failures === 0
                     && Number.isFinite(result.stats?.passes) && result.stats.passes > 0) {
                     return { passed: true };
@@ -538,7 +571,7 @@ export class RetryHandlerService {
         const errorOutput = stderr || stdout || `Test failed with exit code ${exitCode}`;
         return {
             passed: false,
-            error: errorOutput.substring(0, 1000), // Truncate long error messages
+            error: redactFailureText(errorOutput).substring(0, 1000), // Truncate long error messages
         };
     }
     calculateDelay(attempt, backoff, baseDelay, maxDelay) {
@@ -573,6 +606,7 @@ export class RetryHandlerService {
             attempts: result.attempts,
             passed: result.passed,
             error: result.finalError,
+            ...(result.unmatched ? { unmatched: true } : {}),
             timestamp: new Date(),
         });
         // Keep last 50 entries
@@ -616,4 +650,9 @@ export class RetryHandlerService {
         };
     }
 }
+const UNMATCHED = {
+    passed: false,
+    unmatched: true,
+    error: 'The retry filter matched no test, so nothing was rerun.',
+};
 //# sourceMappingURL=retry-handler.js.map

package/dist/domains/test-execution/services/runner-test-cases.d.ts

@@ -6,6 +6,17 @@
  * derived from aggregate counts.
  */
 import type { ITestCaseResult } from '../interfaces';
+/**
+ * #1122: failure text goes back over MCP and into saved results, so
+ * credential-shaped values (e.g. a connection string) are redacted first.
+ * The text is not shortened here; callers apply their own caps.
+ */
+export declare function redactFailureText(text: string): string;
+/** Failed tests with `error` and `stack` redacted (#1122). */
+export declare function redactFailedTests<T extends {
+    error: string;
+    stack?: string;
+}>(tests: T[]): T[];
 /**
  * Test cases listed in a runner JSON report, or undefined when the report
  * has no per-test entries.

package/dist/domains/test-execution/services/runner-test-cases.js

@@ -5,19 +5,37 @@
  * test case with the runner's own name, status and duration; nothing is
  * derived from aggregate counts.
  */
+import { redactLogText } from '../../../logging/redaction.js';
 const SKIPPED_STATUSES = new Set(['skipped', 'pending', 'todo']);
 /** Upper bound on a reported failure message, so one stack cannot swamp the output. */
 const MAX_FAILURE_MESSAGE_LENGTH = 4000;
 function failureMessageOf(assertion) {
     if (!Array.isArray(assertion.failureMessages))
         return undefined;
-    const message = assertion.failureMessages.filter((m) => typeof m === 'string').join('\n').trim();
-    if (!message)
+    const joined = assertion.failureMessages.filter((m) => typeof m === 'string').join('\n').trim();
+    if (!joined)
         return undefined;
+    const message = redactFailureText(joined);
     return message.length > MAX_FAILURE_MESSAGE_LENGTH
         ? `${message.slice(0, MAX_FAILURE_MESSAGE_LENGTH)}… [truncated]`
         : message;
 }
+/**
+ * #1122: failure text goes back over MCP and into saved results, so
+ * credential-shaped values (e.g. a connection string) are redacted first.
+ * The text is not shortened here; callers apply their own caps.
+ */
+export function redactFailureText(text) {
+    return redactLogText(text, Number.POSITIVE_INFINITY);
+}
+/** Failed tests with `error` and `stack` redacted (#1122). */
+export function redactFailedTests(tests) {
+    return tests.map(test => ({
+        ...test,
+        error: redactFailureText(test.error),
+        ...(typeof test.stack === 'string' ? { stack: redactFailureText(test.stack) } : {}),
+    }));
+}
 function toStatus(status) {
     if (status === 'passed' || status === 'failed')
         return status;

package/dist/domains/test-execution/services/test-executor.js

@@ -17,8 +17,8 @@ import { secureRandom, secureRandomInt } from '../../../shared/utils/crypto-rand
 import { writeTestRunEvidence } from '../../quality-assessment/quality-evidence.js';
 import { istanbulLineHits } from '../../../coordination/handlers/handler-utils.js';
 import { fileCoverageKey } from '../../coverage-analysis/collected-metrics.js';
-import { mergeTestCases, testCasesFromRunnerReport } from './runner-test-cases.js';
-import { getTestRunnerExecutionError, TestRunnerExecutionError } from '../../../shared/test-runner-verdict.js';
+import { mergeTestCases, redactFailedTests, redactFailureText, testCasesFromRunnerReport } from './runner-test-cases.js';
+import { capDiagnostics, getTestRunnerExecutionError, TestRunnerExecutionError } from '../../../shared/test-runner-verdict.js';
 import { createVitestJsonReport } from '../../../shared/vitest-json-report.js';
 import { jestExactPathPattern, runnerFilePath } from '../../../shared/test-runner-args.js';
 import { getClaudeModelForTier } from '../../../shared/llm/model-registry.js';
@@ -76,7 +76,7 @@ export class TestExecutorService {
                 failed: results.failed,
                 skipped: results.skipped,
                 duration,
-                failedTests: results.failedTests,
+                failedTests: redactFailedTests(results.failedTests),
                 ...(results.testCases ? { testCases: results.testCases } : {}),
                 coverage: results.coverage,
                 fileCoverages: results.fileCoverages,
@@ -132,7 +132,7 @@ export class TestExecutorService {
                 failed: aggregated.failed,
                 skipped: aggregated.skipped,
                 duration,
-                failedTests: aggregated.failedTests,
+                failedTests: redactFailedTests(aggregated.failedTests),
                 ...(aggregated.testCases ? { testCases: aggregated.testCases } : {}),
                 coverage: aggregated.coverage,
                 fileCoverages: aggregated.fileCoverages,
@@ -260,7 +260,7 @@ export class TestExecutorService {
         if (!this.isLLMAnalysisAvailable() || failures.length === 0)
             return null;
         try {
-            const failureSummary = failures.slice(0, 5).map(f => `- ${f.testName}: ${f.error?.substring(0, 200) || 'Unknown error'}`).join('\n');
+            const failureSummary = failures.slice(0, 5).map(f => `- ${f.testName}: ${f.error ? redactFailureText(f.error).substring(0, 200) : 'Unknown error'}`).join('\n');
             const response = await this.llmRouter.chat({
                 model: this.getModelForTier(this.config.llmModelTier),
                 messages: [{
@@ -624,7 +624,7 @@ Provide:
         }
         catch (error) {
             return err(new Error(`Failed to parse test output for ${file}: ${toErrorMessage(error)}\n` +
-                `stdout: ${stdout.slice(0, 500)}\nstderr: ${stderr.slice(0, 500)}`));
+                `stdout: ${capDiagnostics(stdout, 500)}\nstderr: ${capDiagnostics(stderr, 500)}`));
         }
     }
     /**
@@ -880,7 +880,7 @@ Provide:
             ];
             for (const indicator of errorMessages) {
                 if (combinedOutput.includes(indicator)) {
-                    return err(new Error(`Test execution failed for ${file} (exit code ${exitCode}):\n${combinedOutput.slice(0, 1000)}`));
+                    return err(new Error(`Test execution failed for ${file} (exit code ${exitCode}):\n${capDiagnostics(combinedOutput, 1000)}`));
                 }
             }
         }
@@ -894,7 +894,7 @@ Provide:
         }
         // Could not parse output - return error with details
         return err(new Error(`Unable to parse test results for ${file}. Exit code: ${exitCode}\n` +
-            `Output: ${combinedOutput.slice(0, 500)}`));
+            `Output: ${capDiagnostics(combinedOutput, 500)}`));
     }
     /**
      * Create generic failure entries when we know tests failed but can't parse details