agentic-qe 3.15.9 → 3.15.10

package/dist/shared/git/git-process.js

@@ -0,0 +1,37 @@
+/**
+ * Run git without blocking the event loop (#1115).
+ *
+ * Git runs in its own process group, so a timeout stops it together with any
+ * wrapper, credential helper or fsmonitor child it started.
+ */
+import { runProcessText } from '../test-runner-process.js';
+/** Git did not finish before its deadline; its result is unknown, not empty. */
+export class GitTimeoutError extends Error {
+    constructor(args, timeoutMs) {
+        super(`git ${args.join(' ')} timed out after ${Math.max(0, timeoutMs)}ms`);
+        this.name = 'GitTimeoutError';
+    }
+}
+/**
+ * Resolve with git's stdout. Rejects with GitTimeoutError when the deadline
+ * passes, and with a plain Error when git cannot start or exits non-zero.
+ */
+export async function runGit(args, options) {
+    if (options.timeout <= 0)
+        throw new GitTimeoutError(args, options.timeout);
+    try {
+        return await runProcessText('git', args, {
+            cwd: options.cwd,
+            timeout: options.timeout,
+            maxBuffer: options.maxBuffer,
+            // Never wait for a credential prompt that no one can answer.
+            env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
+        });
+    }
+    catch (error) {
+        if (error.code === 'ETIMEDOUT')
+            throw new GitTimeoutError(args, options.timeout);
+        throw error;
+    }
+}
+//# sourceMappingURL=git-process.js.map

package/dist/shared/git/index.d.ts

@@ -4,4 +4,5 @@
 export { GitAnalyzer } from './git-analyzer';
 export type { GitAnalyzerConfig, GitCommit, GitBlameInfo, FileHistory, } from './git-analyzer';
 export { assertSafeGitRef, getGitRefError } from './ref-validation';
+export { GitTimeoutError } from './git-process';
 //# sourceMappingURL=index.d.ts.map

package/dist/shared/git/index.js

@@ -3,4 +3,5 @@
  */
 export { GitAnalyzer } from './git-analyzer.js';
 export { assertSafeGitRef, getGitRefError } from './ref-validation.js';
+export { GitTimeoutError } from './git-process.js';
 //# sourceMappingURL=index.js.map

package/dist/shared/io/payload-path-guard.d.ts

@@ -0,0 +1,75 @@
+/**
+ * #1126: decide which caller-named paths a task handler may read.
+ *
+ * A task payload can come from MCP task_submit, task_orchestrate, a domain
+ * MCP tool or `aqe task submit`, so every handler that reads a path from its
+ * payload applies the same rule as code indexing (#1096) and sast-scan
+ * (#1144): a path is read only when its realpath is a regular file (or, for a
+ * target to walk, a directory) inside the project root's realpath. A path
+ * spelled outside the root is refused before any filesystem call, so the
+ * reason does not reveal whether it exists, and an outside directory is never
+ * listed. A symlink pointing out, a device such as /dev/zero or a directory
+ * is refused by name, and so is a file over the size limit when the handler
+ * reads files whole.
+ *
+ * The check runs inside each handler rather than at one MCP entry point, so
+ * no route into the handler can skip it. A refusal is a CallerInputError: it
+ * is not retried and does not count toward the domain circuit breaker.
+ */
+import { Result } from '../types';
+/** Largest file a handler reads whole into memory (the #1144 sast limit). */
+export declare const MAX_PAYLOAD_FILE_BYTES: number;
+export type PayloadPathSkipReason = 'not-found' | 'not-a-file' | 'outside-project-root' | 'unreadable' | 'too-large';
+export interface SkippedPayloadPath {
+    path: string;
+    reason: PayloadPathSkipReason;
+}
+export interface ConfinedPayloadPaths {
+    /** Requested paths (as given) that are regular files inside the project root. */
+    accepted: string[];
+    /** The real path checked for each accepted entry, in the same order. */
+    resolved: string[];
+    skipped: SkippedPayloadPath[];
+}
+export interface PayloadPathOptions {
+    /** Project root; defaults to findProjectRoot(). */
+    projectRoot?: string;
+    /** Base for relative paths; defaults to process.cwd(), as FileReader does. */
+    basePath?: string;
+    /** Refuse files larger than this. Omit when the handler does not read files whole. */
+    maxBytes?: number;
+    /**
+     * Accept a path inside the root that does not exist, for handlers that
+     * report a missing file themselves (a test runner, a deleted file in a
+     * changeset). A missing path outside the root is still refused.
+     */
+    allowMissing?: boolean;
+}
+/** Options for a single caller-named target that may be a directory. */
+export interface PayloadTargetOptions extends PayloadPathOptions {
+    /** Accept a directory inside the root as well as a regular file. */
+    allowDirectory?: boolean;
+}
+/**
+ * Split `paths` into those a handler may read and those it must refuse.
+ * `resolved[i]` is the symlink-free path checked for `accepted[i]` (relative
+ * to basePath when the request was relative); a handler opens that path,
+ * never the caller's string.
+ */
+export declare function confinePayloadPaths(paths: readonly string[], options?: PayloadTargetOptions): Promise<ConfinedPayloadPaths>;
+/**
+ * Handler-side check for a payload path list: `value` must be an array of
+ * non-empty path strings, and every entry must pass confinePayloadPaths.
+ * Otherwise the whole request is refused and nothing is read. Returns the real
+ * paths that were checked; the handler reads those, not the payload strings.
+ * `taskType` and `field` name the payload in the error.
+ */
+export declare function requirePayloadFiles(taskType: string, field: string, value: unknown, options?: PayloadTargetOptions): Promise<Result<string[], Error>>;
+/**
+ * Handler-side check for one caller-named path (a file, or with
+ * allowDirectory a directory to walk). Returns the real path that was
+ * checked, which the handler reads instead of the payload string, or an error
+ * naming the reason without reading anything.
+ */
+export declare function requirePayloadPath(taskType: string, field: string, value: unknown, options?: PayloadTargetOptions): Promise<Result<string, Error>>;
+//# sourceMappingURL=payload-path-guard.d.ts.map

package/dist/shared/io/payload-path-guard.js

@@ -0,0 +1,190 @@
+/**
+ * #1126: decide which caller-named paths a task handler may read.
+ *
+ * A task payload can come from MCP task_submit, task_orchestrate, a domain
+ * MCP tool or `aqe task submit`, so every handler that reads a path from its
+ * payload applies the same rule as code indexing (#1096) and sast-scan
+ * (#1144): a path is read only when its realpath is a regular file (or, for a
+ * target to walk, a directory) inside the project root's realpath. A path
+ * spelled outside the root is refused before any filesystem call, so the
+ * reason does not reveal whether it exists, and an outside directory is never
+ * listed. A symlink pointing out, a device such as /dev/zero or a directory
+ * is refused by name, and so is a file over the size limit when the handler
+ * reads files whole.
+ *
+ * The check runs inside each handler rather than at one MCP entry point, so
+ * no route into the handler can skip it. A refusal is a CallerInputError: it
+ * is not retried and does not count toward the domain circuit breaker.
+ */
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import { findProjectRoot } from '../../kernel/project-root.js';
+import { ok, err } from '../types/index.js';
+import { CallerInputError } from '../error-utils.js';
+/** Largest file a handler reads whole into memory (the #1144 sast limit). */
+export const MAX_PAYLOAD_FILE_BYTES = 2 * 1024 * 1024;
+/** True when `candidate` is `root` or lies beneath it (both absolute). */
+function isWithin(root, candidate) {
+    const relative = path.relative(root, candidate);
+    return relative === '' || (relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
+}
+/**
+ * The path the kernel will open for `requested`. path.resolve() collapses
+ * `..` as text, but the kernel follows a symlink before applying `..`, so
+ * `src/link/../x` opens a file beside the link's target (review of #1162).
+ * Keep the caller's spelling and let realpath resolve it the kernel's way.
+ */
+function kernelPath(basePath, requested) {
+    return path.isAbsolute(requested) ? requested : `${basePath}${path.sep}${requested}`;
+}
+/**
+ * For a path that does not exist: resolve its deepest existing ancestor the
+ * kernel's way and append the missing names. Returns null when the ancestor
+ * resolves outside the root or a missing name is `..`.
+ */
+async function resolveMissing(raw, rootReal) {
+    const missing = [];
+    let dir = raw;
+    for (;;) {
+        missing.unshift(path.basename(dir));
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+        const real = await fs.realpath(dir).catch(() => null);
+        if (!real)
+            continue;
+        if (!isWithin(rootReal, real) || missing.some(name => name === '..'))
+            return null;
+        return path.join(real, ...missing.filter(name => name !== '.' && name !== ''));
+    }
+}
+/**
+ * Split `paths` into those a handler may read and those it must refuse.
+ * `resolved[i]` is the symlink-free path checked for `accepted[i]` (relative
+ * to basePath when the request was relative); a handler opens that path,
+ * never the caller's string.
+ */
+export async function confinePayloadPaths(paths, options = {}) {
+    const projectRoot = options.projectRoot ?? findProjectRoot();
+    const basePath = options.basePath ?? process.cwd();
+    const accepted = [];
+    const resolved = [];
+    const skipped = [];
+    const rootLexical = path.resolve(projectRoot);
+    const rootReal = await fs.realpath(projectRoot).catch(() => rootLexical);
+    const baseReal = await fs.realpath(basePath).catch(() => null);
+    // A relative request stays relative, to the base's realpath: the kernel
+    // resolves it through the same real directories, and records keep the
+    // caller's spelling for ordinary paths ('tests/a.test.ts').
+    const accept = (requested, real) => {
+        accepted.push(requested);
+        resolved.push(!path.isAbsolute(requested) && baseReal ? (path.relative(baseReal, real) || '.') : real);
+    };
+    for (const requested of paths) {
+        const lexical = path.resolve(basePath, requested);
+        // Spelled outside the root: refused before any filesystem call, so the
+        // reason cannot reveal whether an outside path exists.
+        if (!isWithin(rootLexical, lexical) && !isWithin(rootReal, lexical)) {
+            skipped.push({ path: requested, reason: 'outside-project-root' });
+            continue;
+        }
+        const raw = kernelPath(basePath, requested);
+        let real;
+        try {
+            real = await fs.realpath(raw);
+        }
+        catch (error) {
+            const code = error.code;
+            const missing = code === 'ENOENT' || code === 'ENOTDIR';
+            // A dangling symlink exists by name: it is not a missing file to accept.
+            const dangling = await fs.lstat(raw).then(() => true, () => false);
+            const target = missing && !dangling && options.allowMissing ? await resolveMissing(raw, rootReal) : null;
+            if (target)
+                accept(requested, target);
+            else
+                skipped.push({ path: requested, reason: missing ? 'not-found' : 'unreadable' });
+            continue;
+        }
+        if (!isWithin(rootReal, real)) {
+            skipped.push({ path: requested, reason: 'outside-project-root' });
+            continue;
+        }
+        // stat, never open: a FIFO, device or directory is refused unread.
+        const stat = await fs.stat(real).catch(() => null);
+        if (!stat) {
+            skipped.push({ path: requested, reason: 'unreadable' });
+        }
+        else if (!(stat.isFile() || (options.allowDirectory && stat.isDirectory()))) {
+            skipped.push({ path: requested, reason: 'not-a-file' });
+        }
+        else if (options.maxBytes !== undefined && stat.size > options.maxBytes) {
+            skipped.push({ path: requested, reason: 'too-large' });
+        }
+        else {
+            accept(requested, real);
+        }
+    }
+    return { accepted, resolved, skipped };
+}
+function describe(value) {
+    if (value === null)
+        return 'null';
+    if (Array.isArray(value))
+        return 'array';
+    return typeof value;
+}
+/**
+ * Handler-side check for a payload path list: `value` must be an array of
+ * non-empty path strings, and every entry must pass confinePayloadPaths.
+ * Otherwise the whole request is refused and nothing is read. Returns the real
+ * paths that were checked; the handler reads those, not the payload strings.
+ * `taskType` and `field` name the payload in the error.
+ */
+export async function requirePayloadFiles(taskType, field, value, options = {}) {
+    const context = `Invalid ${taskType} payload`;
+    if (!Array.isArray(value)) {
+        return err(new CallerInputError(`${context}: '${field}' must be an array of file paths, got ${describe(value)}`));
+    }
+    for (let i = 0; i < value.length; i++) {
+        const entry = value[i];
+        if (typeof entry !== 'string' || entry.trim() === '') {
+            return err(new CallerInputError(`${context}: '${field}[${i}]' must be a non-empty string, got ${describe(entry)}`));
+        }
+        if (entry.includes('\0')) {
+            return err(new CallerInputError(`${context}: '${field}[${i}]' contains a null byte`));
+        }
+    }
+    const { resolved, skipped } = await confinePayloadPaths(value, options);
+    if (skipped.length > 0)
+        return err(refusal(context, field, skipped, options));
+    return ok(resolved);
+}
+function refusal(context, field, skipped, options) {
+    const limit = options.maxBytes !== undefined
+        ? `, at most ${Math.round(options.maxBytes / (1024 * 1024))} MB each`
+        : '';
+    const kinds = options.allowDirectory ? 'regular files or directories' : 'regular files';
+    return new CallerInputError(`${context}: ${field} cannot be read: ${skipped.map(s => `${s.path} (${s.reason})`).join(', ')}. ` +
+        `Pass ${kinds} inside the project${limit}.`);
+}
+/**
+ * Handler-side check for one caller-named path (a file, or with
+ * allowDirectory a directory to walk). Returns the real path that was
+ * checked, which the handler reads instead of the payload string, or an error
+ * naming the reason without reading anything.
+ */
+export async function requirePayloadPath(taskType, field, value, options = {}) {
+    const context = `Invalid ${taskType} payload`;
+    if (typeof value !== 'string' || value.trim() === '') {
+        return err(new CallerInputError(`${context}: '${field}' must be a non-empty path string, got ${describe(value)}`));
+    }
+    if (value.includes('\0')) {
+        return err(new CallerInputError(`${context}: '${field}' contains a null byte`));
+    }
+    const { resolved, skipped } = await confinePayloadPaths([value], options);
+    if (skipped.length > 0)
+        return err(refusal(context, field, skipped, options));
+    return ok(resolved[0]);
+}
+//# sourceMappingURL=payload-path-guard.js.map

package/dist/shared/llm/router/agent-router-config.js

@@ -278,7 +278,8 @@ export const DEFAULT_CATEGORY_CAPABILITIES = {
  */
 export function getAgentRoutingCategory(agentType) {
     // Direct lookup first
-    if (agentType in AGENT_CATEGORY_MAP) {
+    // #1136: own entries only; `constructor` is not an agent type.
+    if (Object.hasOwn(AGENT_CATEGORY_MAP, agentType)) {
         return AGENT_CATEGORY_MAP[agentType];
     }
     // Pattern-based detection

package/dist/shared/llm/translation/tool-translator.js

@@ -246,7 +246,8 @@ export function validateToolDefinition(tool) {
         const params = tool.parameters;
         const props = params.properties || {};
         for (const req of tool.required) {
-            if (!(req in props)) {
+            // #1136: own properties only.
+            if (!Object.hasOwn(props, req)) {
                 errors.push(`Required parameter '${req}' not found in properties`);
             }
         }

package/dist/shared/test-runner-args.d.ts

@@ -35,6 +35,11 @@ export declare function jestExactPathPattern(file: string, cwd?: string): string
 /**
  * Literal test-name filter in `--flag=value` form. Mocha uses `--grep`; Jest
  * and Vitest use `--testNamePattern` (the long form of `-t`).
+ *
+ * `testName` is the full name the runner reported (describe titles, then the
+ * test title). Runners match the filter against that name joined with ' '
+ * (Jest, Mocha, Vitest 3) or ' > ' (Vitest 4+), so each space matches either
+ * separator, and the name is anchored so a retry targets that one test (#1141).
  */
 export declare function nameFilterArg(runner: NameFilterRunner, testName: string): string;
 /** True when a command vector (runner command plus its arguments) runs Jest. */

package/dist/shared/test-runner-args.js

@@ -62,9 +62,14 @@ export function jestExactPathPattern(file, cwd = process.cwd()) {
 /**
  * Literal test-name filter in `--flag=value` form. Mocha uses `--grep`; Jest
  * and Vitest use `--testNamePattern` (the long form of `-t`).
+ *
+ * `testName` is the full name the runner reported (describe titles, then the
+ * test title). Runners match the filter against that name joined with ' '
+ * (Jest, Mocha, Vitest 3) or ' > ' (Vitest 4+), so each space matches either
+ * separator, and the name is anchored so a retry targets that one test (#1141).
  */
 export function nameFilterArg(runner, testName) {
-    const pattern = escapeRegExpLiteral(testName);
+    const pattern = `^${testName.split(' ').map(escapeRegExpLiteral).join('(?: > | )')}$`;
     return runner === 'mocha' ? `--grep=${pattern}` : `--testNamePattern=${pattern}`;
 }
 /** True when a command vector (runner command plus its arguments) runs Jest. */

package/dist/shared/test-runner-process.d.ts

@@ -33,4 +33,10 @@ export interface TestRunnerProcessOptions {
  * the promise settles and before any report file is removed.
  */
 export declare function runTestRunnerProcess(command: string, args: readonly string[], options: TestRunnerProcessOptions): Promise<TestRunnerProcessResult>;
+/**
+ * Stdout of a command that must exit 0, run like runTestRunnerProcess (no
+ * blocking, process-group stop on timeout). Rejects with the ETIMEDOUT,
+ * ENOBUFS or spawn error, or with an error carrying `status` and `stderr`.
+ */
+export declare function runProcessText(command: string, args: readonly string[], options: TestRunnerProcessOptions): Promise<string>;
 //# sourceMappingURL=test-runner-process.d.ts.map

package/dist/shared/test-runner-process.js

@@ -298,4 +298,18 @@ export function runTestRunnerProcess(command, args, options) {
         proc.once('close', (status, signal) => settle(status, signal));
     });
 }
+/**
+ * Stdout of a command that must exit 0, run like runTestRunnerProcess (no
+ * blocking, process-group stop on timeout). Rejects with the ETIMEDOUT,
+ * ENOBUFS or spawn error, or with an error carrying `status` and `stderr`.
+ */
+export async function runProcessText(command, args, options) {
+    const result = await runTestRunnerProcess(command, args, options);
+    if (result.error)
+        throw result.error;
+    if (result.status !== 0) {
+        throw Object.assign(new Error(`${command} exited with ${result.status ?? result.signal}: ${result.stderr.trim()}`), { status: result.status, stderr: result.stderr });
+    }
+    return result.stdout;
+}
 //# sourceMappingURL=test-runner-process.js.map

package/dist/shared/test-runner-verdict.d.ts

@@ -1,4 +1,7 @@
-/** A runner or suite error is not an assertion result. */
+/**
+ * A runner or suite error is not an assertion result. Its message carries
+ * runner output and is returned over MCP, so it is redacted (#1122).
+ */
 export declare class TestRunnerExecutionError extends Error {
     constructor(message: string);
 }
@@ -19,6 +22,11 @@ interface RunnerReport {
         }>;
     }>;
 }
+/**
+ * Runner output quoted in an error, redacted before it is cut so a secret
+ * that straddles the cut cannot survive half-matched (#1122).
+ */
+export declare function capDiagnostics(text: string, maxLength?: number): string;
 /**
  * Preserve ordinary assertion failures, but reject incomplete/failed execution
  * that assertion counts cannot represent. Process status is authoritative even

package/dist/shared/test-runner-verdict.js

@@ -1,10 +1,21 @@
-/** A runner or suite error is not an assertion result. */
+import { redactLogText } from '../logging/redaction.js';
+/**
+ * A runner or suite error is not an assertion result. Its message carries
+ * runner output and is returned over MCP, so it is redacted (#1122).
+ */
 export class TestRunnerExecutionError extends Error {
     constructor(message) {
-        super(message);
+        super(redactLogText(message, Number.POSITIVE_INFINITY));
         this.name = 'TestRunnerExecutionError';
     }
 }
+/**
+ * Runner output quoted in an error, redacted before it is cut so a secret
+ * that straddles the cut cannot survive half-matched (#1122).
+ */
+export function capDiagnostics(text, maxLength = 4000) {
+    return redactLogText(text, Number.POSITIVE_INFINITY).slice(0, maxLength);
+}
 /**
  * Preserve ordinary assertion failures, but reject incomplete/failed execution
  * that assertion counts cannot represent. Process status is authoritative even
@@ -36,8 +47,8 @@ export function getTestRunnerExecutionError(runner, files, exitCode, counts, out
     const diagnostics = [
         ...suiteErrors.map(suite => suite.message).filter(Boolean),
         output.trim(),
-    ].filter(Boolean).join('\n').slice(0, 4000);
+    ].filter(Boolean).join('\n');
     return new TestRunnerExecutionError(`${runner} ${reason} for ${files} (exit code ${exitCode ?? 'unknown'}).` +
-        (diagnostics ? `\n${diagnostics}` : ''));
+        (diagnostics ? `\n${capDiagnostics(diagnostics)}` : ''));
 }
 //# sourceMappingURL=test-runner-verdict.js.map

package/dist/shared/utils/namespaced-search.d.ts

@@ -30,6 +30,13 @@ export interface SearchAllKeysOptions {
     /** First request size (tests). Defaults to `DEFAULT_KEY_SCAN_PAGE_SIZE`. */
     pageSize?: number;
 }
+/**
+ * Most `search()` requests one scan may make (#1106). The limit doubles each
+ * time, so this covers more keys than any store holds (2^31 x the first page)
+ * while still guaranteeing the loop ends for a backend that never returns a
+ * short page.
+ */
+export declare const MAX_KEY_SCAN_REQUESTS = 32;
 /**
  * Every key matching `pattern`, bare (usable with `get(key, retrieve)`),
  * de-duplicated and sorted.
@@ -37,6 +44,13 @@ export interface SearchAllKeysOptions {
  * `search()` has no offset, so this widens the request until the backend
  * returns fewer keys than were asked for. That is the only point at which the
  * result is known to be complete; no cap ever truncates it.
+ *
+ * #1106: a backend that always returns at least `limit` keys (for example
+ * one that pads or repeats results) never gives a short page. After
+ * MAX_KEY_SCAN_REQUESTS this throws instead of looping forever or returning a
+ * list that may be incomplete, because callers select patterns to archive
+ * from it. A backend that ignores `limit` and returns every key still ends:
+ * the limit doubles past the key count.
  */
 export declare function searchAllKeys(memory: MemoryBackend, pattern: string, options?: SearchAllKeysOptions): Promise<string[]>;
 //# sourceMappingURL=namespaced-search.d.ts.map

package/dist/shared/utils/namespaced-search.js

@@ -31,6 +31,13 @@ export function bareSearchKey(found, namespace, pattern) {
 }
 /** First request size for `searchAllKeys`. Each further request doubles it. */
 export const DEFAULT_KEY_SCAN_PAGE_SIZE = 10_000;
+/**
+ * Most `search()` requests one scan may make (#1106). The limit doubles each
+ * time, so this covers more keys than any store holds (2^31 x the first page)
+ * while still guaranteeing the loop ends for a backend that never returns a
+ * short page.
+ */
+export const MAX_KEY_SCAN_REQUESTS = 32;
 /**
  * Every key matching `pattern`, bare (usable with `get(key, retrieve)`),
  * de-duplicated and sorted.
@@ -38,11 +45,22 @@ export const DEFAULT_KEY_SCAN_PAGE_SIZE = 10_000;
  * `search()` has no offset, so this widens the request until the backend
  * returns fewer keys than were asked for. That is the only point at which the
  * result is known to be complete; no cap ever truncates it.
+ *
+ * #1106: a backend that always returns at least `limit` keys (for example
+ * one that pads or repeats results) never gives a short page. After
+ * MAX_KEY_SCAN_REQUESTS this throws instead of looping forever or returning a
+ * list that may be incomplete, because callers select patterns to archive
+ * from it. A backend that ignores `limit` and returns every key still ends:
+ * the limit doubles past the key count.
  */
 export async function searchAllKeys(memory, pattern, options = {}) {
     let limit = Math.max(1, Math.floor(options.pageSize ?? DEFAULT_KEY_SCAN_PAGE_SIZE));
     let found = await memory.search(pattern, limit, options.retrieve);
-    while (found.length >= limit) {
+    for (let requests = 1; found.length >= limit; requests++) {
+        if (requests >= MAX_KEY_SCAN_REQUESTS) {
+            throw new Error(`searchAllKeys('${pattern}'): the backend never returned a short page after ${requests} requests ` +
+                `(last limit ${limit}); refusing to return a possibly incomplete key list`);
+        }
         limit *= 2;
         found = await memory.search(pattern, limit, options.retrieve);
     }

package/dist/shared/utils/safe-expression-evaluator.js

@@ -243,8 +243,9 @@ class Parser {
     parseIdentifier() {
         let value = this.context;
         const name = this.advance().value;
-        // Get initial value from context
-        if (typeof value === 'object' && value !== null && name in value) {
+        // Get initial value from context. #1136: own properties only, so an
+        // identifier such as `constructor` does not read an inherited member.
+        if (typeof value === 'object' && value !== null && Object.hasOwn(value, name)) {
             value = value[name];
         }
         else {
@@ -254,7 +255,7 @@ class Parser {
         while (this.current().type === 'DOT') {
             this.advance(); // consume dot
             const prop = this.expect('IDENTIFIER').value;
-            if (value !== null && value !== undefined && typeof value === 'object') {
+            if (value !== null && value !== undefined && typeof value === 'object' && Object.hasOwn(value, prop)) {
                 value = value[prop];
             }
             else {

package/dist/strange-loop/infra-healing/recovery-playbook.js

@@ -59,7 +59,11 @@ export class RecoveryPlaybook {
     getRecoveryPlan(serviceName) {
         if (!this.config)
             return undefined;
-        return this.config.services[serviceName];
+        // Own-property lookup only: a name like `constructor` or `toString` must
+        // not resolve to an Object.prototype member (#1118).
+        return Object.hasOwn(this.config.services, serviceName)
+            ? this.config.services[serviceName]
+            : undefined;
     }
     /**
      * List all service names defined in the playbook.
@@ -89,7 +93,9 @@ export class RecoveryPlaybook {
         const defaultTimeoutMs = defaults.timeoutMs ?? 10_000;
         const defaultMaxRetries = defaults.maxRetries ?? 3;
         const defaultBackoffMs = defaults.backoffMs ?? [2000, 5000, 10_000];
-        const services = {};
+        // Null-prototype map so a service named `__proto__` is stored as an own
+        // key instead of silently replacing the prototype (#1118).
+        const services = Object.create(null);
         if (raw.services) {
             for (const [name, rawService] of Object.entries(raw.services)) {
                 services[name] = this.parseService(name, rawService, defaultTimeoutMs, defaultMaxRetries, defaultBackoffMs);
@@ -137,7 +143,11 @@ export class RecoveryPlaybook {
      */
     interpolate(template) {
         return template.replace(/\$\{([^}]+)\}/g, (_match, varName) => {
-            return this.variables[varName] ?? _match;
+            // Own properties only: `${constructor}` must stay unresolved rather
+            // than expand to Object's function source (#1118).
+            return Object.hasOwn(this.variables, varName)
+                ? (this.variables[varName] ?? _match)
+                : _match;
         });
     }
 }

package/dist/validation/gate-reexecute.js

@@ -26,6 +26,7 @@ import { createHash } from 'node:crypto';
 import { meetsNoRegression } from './anchor-set.js';
 import { tierAllowsPromotion } from '../learning/provenance-tier.js';
 import { bootstrapDeltaCILow, pairedDeltas } from './paired-bootstrap.js';
+import { getOwn } from '../shared/utils/safe-record.js';
 /** Tag domain-separating the rule fingerprint hash. */
 const RULE_TAG = 'aqe:accept-rule:v1+sig';
 /**
@@ -137,14 +138,16 @@ export function sealedHash(sealed) {
  * unknown version so a missing rule can never silently pass verification.
  */
 export function gateFingerprint(ruleVersion) {
-    if (!(ruleVersion in ACCEPTANCE_RULES)) {
+    // #1136: own entries only; `constructor` is not a registered rule.
+    if (!Object.hasOwn(ACCEPTANCE_RULES, ruleVersion)) {
         throw new Error(`Unknown acceptance rule version '${ruleVersion}' — cannot fingerprint an unregistered rule.`);
     }
     return createHash('sha256').update(RULE_TAG).update('\0').update(ruleVersion).digest('hex');
 }
 /** Re-execute a frozen rule on sealed inputs. Throws for an unknown version. */
 export function reExecuteGate(ruleVersion, sealed) {
-    const rule = ACCEPTANCE_RULES[ruleVersion];
+    // #1136: an inherited member (`constructor` is Object) is not a rule.
+    const rule = getOwn(ACCEPTANCE_RULES, ruleVersion);
     if (!rule) {
         throw new Error(`Unknown acceptance rule version '${ruleVersion}' — refusing to re-execute an unregistered rule.`);
     }
@@ -260,14 +263,14 @@ export function pathSealedHash(sealed) {
 }
 /** Fingerprint of a path-rule VERSION. Throws for an unregistered rule. */
 export function pathGateFingerprint(ruleVersion) {
-    if (!(ruleVersion in PROMOTION_PATH_RULES)) {
+    if (!Object.hasOwn(PROMOTION_PATH_RULES, ruleVersion)) {
         throw new Error(`Unknown promotion-path rule version '${ruleVersion}' — cannot fingerprint an unregistered rule.`);
     }
     return createHash('sha256').update(PATH_RULE_TAG).update('\0').update(ruleVersion).digest('hex');
 }
 /** Re-execute a frozen path rule on sealed inputs. Throws for an unknown version. */
 export function reExecutePathGate(ruleVersion, sealed) {
-    const rule = PROMOTION_PATH_RULES[ruleVersion];
+    const rule = getOwn(PROMOTION_PATH_RULES, ruleVersion);
     if (!rule) {
         throw new Error(`Unknown promotion-path rule version '${ruleVersion}' — refusing to re-execute an unregistered rule.`);
     }

package/dist/workers/daemon.js

@@ -74,7 +74,19 @@ export class QEDaemon {
         this._healthCheckTimer.unref?.();
         // Auto-start workers if configured
         if (this.config.autoStart) {
-            await this.workerManager.startAll();
+            try {
+                await this.workerManager.startAll();
+            }
+            catch (error) {
+                // #1116: a failed start must not leave the daemon reporting running.
+                this._running = false;
+                this._startedAt = undefined;
+                if (this._healthCheckTimer)
+                    clearInterval(this._healthCheckTimer);
+                this._healthCheckTimer = undefined;
+                await this.workerManager.stopAll().catch(() => undefined);
+                throw error;
+            }
             console.info('[Daemon] All workers started');
         }
         // Log registered workers