agentic-qe 3.15.9 → 3.15.11

package/dist/cli/utils/fleet-result.js

@@ -0,0 +1,124 @@
+/**
+ * Agentic QE v3 - `aqe fleet run` result summary (#1125 review)
+ *
+ * A completed task is not a passed check. The summary shows what each
+ * operation's handler returned and turns it into a verdict:
+ *   - scan    fails on a critical or high finding, or when the scan evidence
+ *             says not every requested file was analyzed;
+ *   - test    fails when no test was generated or a generated test failed
+ *             the test quality gate;
+ *   - analyze fails when coverage over the collected metrics is below the
+ *             threshold (an uncollected metric is not counted as 0%).
+ * A result without the expected shape fails rather than passing unread.
+ */
+import chalk from 'chalk';
+import { FLEET_COVERAGE_THRESHOLD } from './fleet-operation.js';
+import { thresholdVerdict } from '../../coordination/handlers/coverage-target.js';
+const SEVERITIES = ['critical', 'high', 'medium', 'low', 'informational'];
+const MAX_LISTED_FINDINGS = 10;
+const asRecord = (value) => value !== null && typeof value === 'object' ? value : undefined;
+const pct = (value) => typeof value === 'number' ? `${value}%` : 'n/a';
+function summarizeScan(result) {
+    const summary = asRecord(result.summary);
+    const findings = Array.isArray(result.vulnerabilities) ? result.vulnerabilities : undefined;
+    if (!summary || !findings)
+        return unreadable('scan');
+    const count = (severity) => Number(summary[severity] ?? 0);
+    const coverage = asRecord(result.coverage);
+    const evidence = asRecord(result.evidence);
+    const completeness = typeof evidence?.completeness === 'string' ? evidence.completeness : 'unknown';
+    const lines = [
+        `Findings: ${SEVERITIES.map(s => `${s} ${count(s)}`).join(', ')}`,
+        `Files scanned: ${coverage?.filesScanned ?? 'n/a'} (evidence: ${completeness})`,
+        ...findings.slice(0, MAX_LISTED_FINDINGS).map(f => `  [${f.severity ?? '?'}] ${f.title ?? 'untitled'} @ ${f.location?.file ?? '?'}:${f.location?.line ?? '?'}`),
+    ];
+    if (findings.length > MAX_LISTED_FINDINGS)
+        lines.push(`  … ${findings.length - MAX_LISTED_FINDINGS} more`);
+    const reasons = [];
+    if (count('critical') + count('high') > 0)
+        reasons.push(`${count('critical')} critical and ${count('high')} high findings`);
+    if (completeness !== 'complete')
+        reasons.push(`scan evidence is ${completeness}: not every requested file was analyzed`);
+    return { lines, passed: reasons.length === 0, reasons };
+}
+function summarizeTests(result) {
+    if (!Array.isArray(result.tests))
+        return unreadable('test');
+    const tests = result.tests;
+    const assertions = tests.reduce((sum, t) => sum + (typeof t.assertions === 'number' ? t.assertions : 0), 0);
+    const modes = [...new Set(tests.map(t => t.generationMode).filter((m) => typeof m === 'string'))];
+    const gateFailed = tests.filter(t => asRecord(t.qualityGateResult)?.passed === false);
+    const lines = [
+        `Tests generated: ${tests.length}, assertions: ${assertions}` +
+            (modes.length > 0 ? `, generation mode: ${modes.join(', ')}` : ''),
+        `Quality gate: ${gateFailed.length === 0 ? 'passed' : `failed for ${gateFailed.length} of ${tests.length} tests`}`,
+        ...gateFailed.slice(0, MAX_LISTED_FINDINGS).map(t => `  ${t.testFile ?? t.name ?? t.id}`),
+    ];
+    const reasons = [];
+    if (tests.length === 0)
+        reasons.push('no tests were generated');
+    if (gateFailed.length > 0)
+        reasons.push(`${gateFailed.length} generated tests failed the test quality gate`);
+    return { lines, passed: reasons.length === 0, reasons };
+}
+function summarizeCoverage(result) {
+    const summary = asRecord(result.summary);
+    if (!summary || typeof summary.line !== 'number')
+        return unreadable('analyze');
+    const collected = asRecord(result.collected);
+    const isCollected = (name) => collected?.[name] !== false;
+    // An uncollected metric is 0 by construction (#1027 B2): show it as n/a and
+    // leave it out of the verdict, as `aqe coverage` does (#995).
+    const metric = (name) => isCollected(name) ? pct(summary[name]) : 'n/a (not collected)';
+    const num = (name) => typeof summary[name] === 'number' ? summary[name] : 0;
+    const verdict = thresholdVerdict({ line: num('line'), branch: num('branch'), function: num('function'), statement: num('statement') }, FLEET_COVERAGE_THRESHOLD, { branch: isCollected('branch'), function: isCollected('function'), statement: isCollected('statement') });
+    const lines = [
+        `Coverage: line ${pct(summary.line)}, branch ${metric('branch')}, function ${metric('function')}, ` +
+            `statement ${metric('statement')} over ${summary.files ?? 'n/a'} files`,
+        `Overall over collected metrics: ${verdict.overall.toFixed(1)}% (threshold ${FLEET_COVERAGE_THRESHOLD}%)`,
+    ];
+    const reasons = verdict.meetsThreshold ? [] : [`coverage is below the ${FLEET_COVERAGE_THRESHOLD}% threshold`];
+    return { lines, passed: reasons.length === 0, reasons };
+}
+function unreadable(operation) {
+    const reason = `the ${operation} result has no readable summary`;
+    return { lines: [`Result: ${reason}`], passed: false, reasons: [reason] };
+}
+/** Summarize one completed task's result for its fleet operation. */
+export function summarizeFleetResult(operation, result) {
+    const record = asRecord(result);
+    if (!record)
+        return unreadable(operation);
+    switch (operation) {
+        case 'scan': return summarizeScan(record);
+        case 'test': return summarizeTests(record);
+        case 'analyze': return summarizeCoverage(record);
+    }
+}
+/**
+ * Print each distinct worker result once and the verdict over all workers.
+ * Returns whether the operation passed.
+ */
+export function reportFleetVerdict(operation, workers, log = line => console.log(line)) {
+    const summaries = workers.filter(w => w.success).map(w => summarizeFleetResult(operation, w.result));
+    const shown = new Set();
+    for (const summary of summaries) {
+        const text = summary.lines.join('\n');
+        if (shown.has(text))
+            continue;
+        shown.add(text);
+        log('');
+        for (const line of summary.lines)
+            log(`   ${line}`);
+    }
+    const incomplete = workers.filter(w => !w.success).length;
+    const reasons = [...new Set(summaries.flatMap(s => s.reasons))];
+    if (incomplete > 0)
+        reasons.unshift(`${incomplete} of ${workers.length} workers did not complete`);
+    log('');
+    log(reasons.length === 0
+        ? chalk.green('   Verdict: PASSED')
+        : chalk.red(`   Verdict: FAILED (${reasons.join('; ')})`));
+    return reasons.length === 0;
+}
+//# sourceMappingURL=fleet-result.js.map

package/dist/cli/utils/progress.d.ts

@@ -21,6 +21,14 @@ export interface FleetProgressOptions {
     showPercentage?: boolean;
     format?: string;
 }
+/** Options for {@link FleetProgressManager.stop}. */
+export interface FleetProgressStopOptions {
+    /**
+     * The operation's verdict failed (#1168). The agents still completed, but
+     * the summary line must not call that a success.
+     */
+    verdictFailed?: boolean;
+}
 export interface SpinnerOptions {
     text: string;
     color?: 'cyan' | 'green' | 'yellow' | 'red' | 'blue' | 'magenta' | 'white';
@@ -43,7 +51,7 @@ export declare class FleetProgressManager {
     /**
      * Start the fleet progress display
      */
-    start(totalAgents: number): void;
+    start(_totalAgents: number): void;
     /**
      * Add an agent to track
      */
@@ -63,11 +71,17 @@ export declare class FleetProgressManager {
     /**
      * Stop the progress display
      */
-    stop(): void;
+    stop(options?: FleetProgressStopOptions): void;
     /**
      * Update the fleet-level progress bar
      */
     private updateFleetProgress;
+    /**
+     * Create a bar and apply its payload. Without a TTY, cli-progress's
+     * MultiBar.create() returns before starting the bar, dropping the payload,
+     * so the final render printed a literal `{name}` (#1168).
+     */
+    private createBar;
     private getAgentNameDisplay;
     private getStatusIcon;
     private truncateName;

package/dist/cli/utils/progress.js

@@ -13,6 +13,7 @@ import { getCLIConfig, shouldUseColors } from '../config/cli-config.js';
 // ============================================================================
 // Fleet Progress Manager - Multi-bar progress for parallel agents
 // ============================================================================
+const FLEET_BAR_NAME = chalk.white('Fleet Progress'.padEnd(30));
 export class FleetProgressManager {
     multiBar;
     agentBars = new Map();
@@ -31,10 +32,12 @@ export class FleetProgressManager {
             showPercentage: true,
             ...options,
         };
-        // Custom format for multi-bar display (respects color config)
+        // Custom format for multi-bar display (respects color config).
+        // `{eta}` is a cli-progress built-in that overrides the payload, so the
+        // formatted ETA travels as `{etaText}` (#1168).
         const barColor = useColors ? chalk.cyan('{bar}') : '{bar}';
         const format = this.options.format ||
-            `{name} ${barColor} {percentage}% | {status} {eta}`;
+            `{name} ${barColor} {percentage}% | {status} {etaText}`;
         this.multiBar = new MultiBar({
             clearOnComplete: false,
             hideCursor: true,
@@ -48,15 +51,15 @@ export class FleetProgressManager {
     /**
      * Start the fleet progress display
      */
-    start(totalAgents) {
+    start(_totalAgents) {
         this.isActive = true;
         this.startTime = Date.now();
         // Create fleet-level progress bar
         console.log(chalk.blue(`\n${this.options.title}\n`));
-        this.fleetBar = this.multiBar.create(100, 0, {
-            name: chalk.white('Fleet Progress'.padEnd(30)),
+        this.fleetBar = this.createBar(0, {
+            name: FLEET_BAR_NAME,
             status: '',
-            eta: '',
+            etaText: '',
         });
     }
     /**
@@ -66,10 +69,10 @@ export class FleetProgressManager {
         if (!this.isActive)
             return;
         this.agentStates.set(agent.id, agent);
-        const bar = this.multiBar.create(100, agent.progress, {
+        const bar = this.createBar(agent.progress, {
             name: chalk.gray(this.truncateName(agent.name, 30).padEnd(30)),
             status: this.getStatusIcon(agent.status),
-            eta: agent.eta ? this.formatEta(agent.eta) : '',
+            etaText: agent.eta ? this.formatEta(agent.eta) : '',
         });
         this.agentBars.set(agent.id, bar);
         this.updateFleetProgress();
@@ -96,7 +99,7 @@ export class FleetProgressManager {
         bar.update(state.progress, {
             name: this.getAgentNameDisplay(state),
             status: this.getStatusIcon(state.status),
-            eta: state.eta ? this.formatEta(state.eta) : '',
+            etaText: state.eta ? this.formatEta(state.eta) : '',
         });
         this.updateFleetProgress();
     }
@@ -115,14 +118,14 @@ export class FleetProgressManager {
         bar.update(state.progress, {
             name: this.getAgentNameDisplay(state),
             status: this.getStatusIcon(state.status),
-            eta: '',
+            etaText: '',
         });
         this.updateFleetProgress();
     }
     /**
      * Stop the progress display
      */
-    stop() {
+    stop(options = {}) {
         if (!this.isActive)
             return;
         this.isActive = false;
@@ -135,7 +138,10 @@ export class FleetProgressManager {
         const total = this.agentStates.size;
         const duration = Date.now() - this.startTime;
         console.log('');
-        if (failed === 0) {
+        if (failed === 0 && options.verdictFailed) {
+            console.log(chalk.yellow(`All ${completed}/${total} agents completed (${this.formatDuration(duration)})`));
+        }
+        else if (failed === 0) {
             console.log(chalk.green(`All ${completed}/${total} agents completed successfully (${this.formatDuration(duration)})`));
         }
         else {
@@ -155,10 +161,21 @@ export class FleetProgressManager {
         const completed = agents.filter(a => a.status === 'completed').length;
         const running = agents.filter(a => a.status === 'running').length;
         this.fleetBar.update(avgProgress, {
+            name: FLEET_BAR_NAME,
             status: chalk.gray(`${completed}/${agents.length} complete, ${running} running`),
-            eta: this.options.showEta ? this.estimateFleetEta(agents) : '',
+            etaText: this.options.showEta ? this.estimateFleetEta(agents) : '',
         });
     }
+    /**
+     * Create a bar and apply its payload. Without a TTY, cli-progress's
+     * MultiBar.create() returns before starting the bar, dropping the payload,
+     * so the final render printed a literal `{name}` (#1168).
+     */
+    createBar(value, payload) {
+        const bar = this.multiBar.create(100, value, payload);
+        bar.update(value, payload);
+        return bar;
+    }
     getAgentNameDisplay(agent) {
         const name = this.truncateName(agent.name, 26);
         switch (agent.status) {
@@ -448,7 +465,7 @@ export class EtaEstimator {
  * Create a simple spinner for async operations
  */
 export function withSpinner(text, operation) {
-    const { spinner, succeed, fail } = createTimedSpinner(text);
+    const { succeed, fail } = createTimedSpinner(text);
     return operation()
         .then((result) => {
         succeed();

package/dist/context/sources/git-source.js

@@ -1,7 +1,7 @@
 /**
  * Git Source - Recent commit context for target files
  */
-import { execFileSync } from 'node:child_process';
+import { runGit } from '../../shared/git/git-process.js';
 export class GitContextSource {
     cwd;
     id = 'git';
@@ -18,7 +18,11 @@ export class GitContextSource {
                 // filePaths can originate from MCP tool arguments. Pass each path as
                 // one argv element; interpolating it into a shell command would allow
                 // command execution via quotes or shell metacharacters.
-                const log = execFileSync('git', ['log', '--oneline', '-5', '--', file], { cwd: this.cwd ?? process.cwd(), encoding: 'utf-8', timeout: 5000, stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+                // Async, in its own process group, so a slow git can neither stall
+                // the MCP server's event loop nor outlive its timeout (#1115).
+                const log = (await runGit(['log', '--oneline', '-5', '--', file], {
+                    cwd: this.cwd ?? process.cwd(), timeout: 5000,
+                })).trim();
                 if (log) {
                     const content = `Recent commits for ${file}:\n${log}`;
                     fragments.push({

package/dist/coordination/consensus/consensus-engine.js

@@ -12,6 +12,7 @@ import { DEFAULT_CONSENSUS_CONFIG, } from './interfaces.js';
 import { buildVerificationPrompt, parseVerificationResponse, buildModelVote, } from './model-provider.js';
 import { ok, err } from '../../shared/types/index.js';
 import { toErrorMessage, toError } from '../../shared/error-utils.js';
+import { createSafeRecord } from '../../shared/utils/safe-record.js';
 import { createStrategy, } from './strategies/index.js';
 import { createSycophancyScorer } from './sycophancy-scorer.js';
 // ============================================================================
@@ -268,7 +269,8 @@ export class ConsensusEngineImpl {
             averageExecutionTime: 0,
             totalCost: 0,
             humanReviewCount: 0,
-            modelStats: {},
+            // #1157: keyed by provider model ids.
+            modelStats: createSafeRecord(),
         };
     }
     /**

package/dist/coordination/handlers/code-intelligence-handlers.js

@@ -4,7 +4,8 @@
  * Extracted from task-executor.ts registerHandlers().
  * Covers: index-code, predict-defects
  */
-import * as fs from 'fs/promises';
+import { randomUUID } from 'node:crypto';
+import { prunePredictionHistory } from '../../domains/defect-intelligence/prediction-history.js';
 import * as path from 'path';
 import { ok, err } from '../../shared/types/index.js';
 import { toError } from '../../shared/error-utils.js';
@@ -12,6 +13,8 @@ import { discoverSourceFiles } from './handler-utils.js';
 import { resolveProjectRootFromPaths } from '../../domains/code-intelligence/project-root-resolver.js';
 import { nothingIndexedError } from '../../domains/code-intelligence/index-path-guard.js';
 import { createLogger } from '../../logging/logger-factory.js';
+import { requirePayloadPath } from '../../shared/io/payload-path-guard.js';
+import { readConfinedText } from '../../shared/io/confined-read.js';
 const logger = createLogger('CodeIntelligenceHandlers');
 async function collectProjectMetricsForTarget(ctx, targetPath, indexedFiles) {
     if (!ctx.getCodeIntelligenceCoordinator)
@@ -43,13 +46,24 @@ async function collectProjectMetricsForTarget(ctx, targetPath, indexedFiles) {
         return undefined;
     }
 }
+/** #1126: a caller-named target must be a file or directory inside the project. */
+async function confineTarget(taskType, target) {
+    if (!target || target === '.')
+        return ok(undefined);
+    return requirePayloadPath(taskType, 'target', target, { allowDirectory: true, allowMissing: true });
+}
 export function registerCodeIntelligenceHandlers(ctx) {
     // Register code indexing handler - REAL IMPLEMENTATION
     ctx.registerHandler('index-code', async (task) => {
         const payload = task.payload;
         try {
+            // #1126: refuse an outside target before listing it, so the error
+            // cannot name the files in an outside directory.
+            const confined = await confineTarget('index-code', payload.target);
+            if (!confined.success)
+                return confined;
             const kg = ctx.getKnowledgeGraph();
-            const targetPath = payload.target || process.cwd();
+            const targetPath = confined.value ?? (payload.target || process.cwd());
             const startTime = Date.now();
             // Discover files to index
             const filesToIndex = await discoverSourceFiles(targetPath, {
@@ -139,7 +153,10 @@ export function registerCodeIntelligenceHandlers(ctx) {
     ctx.registerHandler('predict-defects', async (task) => {
         const payload = task.payload;
         try {
-            const targetPath = payload.target || process.cwd();
+            const confined = await confineTarget('predict-defects', payload.target);
+            if (!confined.success)
+                return confined;
+            const targetPath = confined.value ?? path.resolve(payload.target || process.cwd());
             const minConfidence = payload.minConfidence || 0.5;
             // Discover actual source files in the target directory
             const sourceFiles = await discoverSourceFiles(targetPath, { includeTests: false });
@@ -156,9 +173,12 @@ export function registerCodeIntelligenceHandlers(ctx) {
             }
             // Analyze each file for defect indicators based on real metrics
             const predictedDefects = [];
+            const predictions = [];
+            let filesSkipped = 0;
             for (const filePath of sourceFiles) {
                 try {
-                    const content = await fs.readFile(filePath, 'utf-8');
+                    // #1161: validate the opened descriptor, not the name listed earlier.
+                    const content = await readConfinedText(filePath, { outsideRoot: 'allow' });
                     const lines = content.split('\n');
                     const lineCount = lines.length;
                     // Calculate complexity indicators from real code
@@ -206,6 +226,18 @@ export function registerCodeIntelligenceHandlers(ctx) {
                         reasons.push('Potentially long functions');
                     }
                     probability = Math.min(probability, 0.95);
+                    // Keep every analyzed file, including a clean reanalysis below the
+                    // display threshold. Absolute paths retain the project-relative
+                    // identity when the caller targeted a nested directory (#1050).
+                    const roundedProbability = Math.round(probability * 100) / 100;
+                    predictions.push({
+                        file: path.resolve(filePath),
+                        probability: roundedProbability,
+                        riskLevel: probability >= 0.8 ? 'critical' : probability >= 0.6 ? 'high'
+                            : probability >= 0.4 ? 'medium' : probability >= 0.2 ? 'low' : 'info',
+                        factors: [{ name: 'staticCodeIndicators', contribution: roundedProbability }],
+                        recommendations: reasons,
+                    });
                     if (probability >= minConfidence) {
                         // Use relative path for readability
                         const relativePath = filePath.startsWith(targetPath)
@@ -219,9 +251,27 @@ export function registerCodeIntelligenceHandlers(ctx) {
                     }
                 }
                 catch {
+                    filesSkipped++;
                     // Skip files that can't be read
                 }
             }
+            if (predictions.length === 0) {
+                return err(new Error(`Defect prediction could not read any of ${sourceFiles.length} source files`));
+            }
+            // Record the run in the schema consumed by the background worker.
+            // These are static risk estimates from files actually read, not an
+            // empirically calibrated likelihood of future production defects.
+            const id = randomUUID();
+            await ctx.memory.set(`defect-intelligence:predictor:prediction:${id}`, {
+                id,
+                timestamp: new Date().toISOString(),
+                predictions,
+                predictionMethod: 'static-code-indicators',
+                estimated: true,
+                filesSkipped,
+                scanStatus: filesSkipped > 0 ? 'partial' : 'complete',
+            }, { namespace: 'defect-intelligence', ttl: 86400 * 7 });
+            await prunePredictionHistory(ctx.memory);
             // Sort by probability descending
             predictedDefects.sort((a, b) => b.probability - a.probability);
             // Calculate overall risk score
@@ -232,7 +282,7 @@ export function registerCodeIntelligenceHandlers(ctx) {
             // Generate recommendations from actual findings
             const recommendations = [];
             if (predictedDefects.length > 0) {
-                recommendations.push(`${predictedDefects.length} files flagged for potential defects out of ${sourceFiles.length} analyzed`);
+                recommendations.push(`${predictedDefects.length} files flagged for potential defects out of ${predictions.length} analyzed`);
                 const topFile = predictedDefects[0];
                 recommendations.push(`Highest risk: ${topFile.file} (${Math.round(topFile.probability * 100)}%) — ${topFile.reason}`);
             }
@@ -243,13 +293,19 @@ export function registerCodeIntelligenceHandlers(ctx) {
                 recommendations.push('Address TODO/FIXME comments to reduce technical debt');
             }
             if (predictedDefects.length === 0) {
-                recommendations.push('No files exceeded the defect probability threshold — code looks healthy');
+                recommendations.push(filesSkipped > 0
+                    ? `No analyzed files exceeded the threshold; ${filesSkipped} unreadable source files remain unassessed`
+                    : 'No files exceeded the defect probability threshold — code looks healthy');
             }
             return ok({
                 predictedDefects: predictedDefects.slice(0, 20), // Top 20
                 riskScore,
                 recommendations,
-                filesAnalyzed: sourceFiles.length,
+                filesAnalyzed: predictions.length,
+                filesSkipped,
+                scanStatus: filesSkipped > 0 ? 'partial' : 'complete',
+                predictionMethod: 'static-code-indicators',
+                estimated: true,
             });
         }
         catch (error) {

package/dist/coordination/handlers/coverage-collection.js

@@ -19,6 +19,7 @@
  * caller.
  */
 import * as fs from 'fs';
+import { readConfinedTextSync } from '../../shared/io/confined-read.js';
 import * as os from 'os';
 import * as path from 'path';
 import { parseLcovInfo } from './handler-utils.js';
@@ -558,8 +559,9 @@ export function buildEstimatedCoverage(targetPath) {
         return null;
     const files = sourceFiles.map(filePath => {
         let content = '';
+        // #1161: a source file linked out of the project is treated as unreadable.
         try {
-            content = fs.readFileSync(filePath, 'utf-8');
+            content = readConfinedTextSync(filePath, { outsideRoot: 'allow' });
         }
         catch { /* unreadable — treat as empty */ }
         const ext = path.extname(filePath);

package/dist/coordination/handlers/coverage-handlers.js

@@ -6,6 +6,7 @@
  */
 import { ok, err } from '../../shared/types/index.js';
 import { toError } from '../../shared/error-utils.js';
+import { requirePayloadPath } from '../../shared/io/payload-path-guard.js';
 import { buildEstimatedCoverage, collectRustCoverage, findCargoRoot, isCoverageExecDisabled, isRustProject, } from './coverage-collection.js';
 import { describeNoData, evaluateCoverageForTarget, isUnmeasured, packageFilterForTarget, resolveExistingCoverage, scopeCoverageToTarget, reconcileRecommendations, thresholdVerdict, } from './coverage-target.js';
 import { randomUUID } from 'crypto';
@@ -200,8 +201,16 @@ export function registerCoverageHandlers(ctx) {
     ctx.registerHandler('analyze-coverage', async (task) => {
         const payload = task.payload;
         try {
+            // #1126: collect coverage (which may run the tests) only inside the
+            // project. A missing target keeps its own message below.
+            let targetPath = payload.target || process.cwd();
+            if (payload.target && payload.target !== '.') {
+                const confined = await requirePayloadPath('analyze-coverage', 'target', payload.target, { allowDirectory: true, allowMissing: true });
+                if (!confined.success)
+                    return confined;
+                targetPath = confined.value;
+            }
             const analyzer = ctx.getCoverageAnalyzer();
-            const targetPath = payload.target || process.cwd();
             const threshold = payload.threshold || 80;
             const { collected, ranTests, noData, projectRoot, notes, runStatus, testRun } = await collectCoverage(targetPath);
             // #995 review N5: say so plainly instead of "no coverage data found".

package/dist/coordination/handlers/coverage-runner.d.ts

@@ -25,6 +25,8 @@
  *      fate. Hosts should shut down via a handled signal.
  */
 import type { CoverageData } from '../../domains/coverage-analysis/interfaces';
+import { summarizeStderr } from './coverage-stderr';
+export { summarizeStderr };
 export type JsRunnerName = 'vitest' | 'jest' | 'nyc';
 export interface JsCoverageInvocation {
     runner: JsRunnerName;
@@ -64,7 +66,7 @@ export interface JsCoverageRun {
     numFailedTests?: number | null;
     numPendingTests?: number | null;
     numFailedTestSuites?: number | null;
-    /** The runner's first error line plus the last ~2 KB of its stderr, for diagnosing a crash. */
+    /** The runner's first error line plus the last ~2 KB of its stderr, redacted (#1150), for diagnosing a crash. */
     stderrTail: string;
 }
 /**
@@ -74,13 +76,6 @@ export interface JsCoverageRun {
  * every test passing). Without counts (nyc), the exit code decides.
  */
 export declare function testRunStatus(run: JsCoverageRun): 'passed' | 'failed';
-/**
- * Summarise a runner's stderr for a caller: the FIRST error-looking line (or
- * the first ~512 bytes) plus the last ~2 KB (#995 review NB-C). A tail alone
- * loses the cause when a long stack follows it — a vitest config syntax error
- * prints `[PARSE_ERROR] …` first and then kilobytes of frames.
- */
-export declare function summarizeStderr(head: string, tail: string, totalBytes: number): string;
 /**
  * Find an installed package's bin script, walking up `node_modules` from the
  * project root (hoisted monorepo installs live above the package).

package/dist/coordination/handlers/coverage-runner.js

@@ -30,6 +30,8 @@ import * as os from 'os';
 import * as path from 'path';
 import { safeJsonParse } from '../../shared/safe-json.js';
 import { loadCoverageReportFile } from './coverage-target.js';
+import { STDERR_WINDOW_BYTES, summarizeStderr } from './coverage-stderr.js';
+export { summarizeStderr };
 /**
  * Outcome of a coverage run's tests (#1027 NB2): 'failed' when the runner's
  * own result reports a failed test or test suite, 'passed' when it reports
@@ -43,25 +45,6 @@ export function testRunStatus(run) {
     return run.exitedCleanly ? 'passed' : 'failed';
 }
 const RESULTS_FILE = 'test-results.json';
-const STDERR_TAIL_BYTES = 2048;
-const STDERR_HEAD_BYTES = 4096;
-const STDERR_PREFIX_BYTES = 512;
-const ERROR_LINE_RE = /^.*(?:error|\[[A-Z][A-Z_]{2,}\]|ERR_[A-Z_]+).*$/im;
-/**
- * Summarise a runner's stderr for a caller: the FIRST error-looking line (or
- * the first ~512 bytes) plus the last ~2 KB (#995 review NB-C). A tail alone
- * loses the cause when a long stack follows it — a vitest config syntax error
- * prints `[PARSE_ERROR] …` first and then kilobytes of frames.
- */
-export function summarizeStderr(head, tail, totalBytes) {
-    if (totalBytes <= STDERR_TAIL_BYTES)
-        return tail.trim();
-    const errorLine = ERROR_LINE_RE.exec(head)?.[0]?.trim();
-    const prefix = (errorLine ?? head.slice(0, STDERR_PREFIX_BYTES)).trim();
-    if (prefix && tail.includes(prefix))
-        return tail.trim();
-    return `${prefix}\n…\n${tail.trim()}`;
-}
 // ============================================================================
 // Locating the runner
 // ============================================================================
@@ -348,9 +331,10 @@ export async function runProcessTree(command, args, options) {
         child.stderr?.on('data', (chunk) => {
             const text = chunk.toString('utf-8');
             stderrBytes += chunk.length;
-            if (stderrHead.length < STDERR_HEAD_BYTES)
-                stderrHead = (stderrHead + text).slice(0, STDERR_HEAD_BYTES);
-            stderrTail = (stderrTail + text).slice(-STDERR_TAIL_BYTES);
+            // #1150: raw windows only; summarizeStderr redacts them before slicing.
+            if (stderrHead.length < STDERR_WINDOW_BYTES)
+                stderrHead = (stderrHead + text).slice(0, STDERR_WINDOW_BYTES);
+            stderrTail = (stderrTail + text).slice(-STDERR_WINDOW_BYTES);
         });
         // A grandchild holding the pipe open must not keep the host alive.
         child.stderr?.on('error', () => { });

package/dist/coordination/handlers/coverage-stderr.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Caller-facing summary of a coverage runner's stderr.
+ *
+ * #1150: the summary reaches `provenance.notes` of a SUCCESS result, where the
+ * #1139 error backstop never sees it, so it is redacted here. Redaction runs
+ * BEFORE slicing: a slice boundary that cut a token or connection string in
+ * half would leave a fragment the redaction patterns no longer recognise.
+ * The collector therefore keeps a wide raw window at each end of the stream;
+ * each window is redacted whole, and only then are the short head and tail
+ * taken from it. A secret cut by a window edge lies far outside the part
+ * that is kept.
+ */
+/** Raw stderr kept at each end of the stream, before redaction. */
+export declare const STDERR_WINDOW_BYTES: number;
+/**
+ * Summarise a runner's stderr for a caller: the FIRST error-looking line (or
+ * the first ~512 bytes) plus the last ~2 KB (#995 review NB-C). A tail alone
+ * loses the cause when a long stack follows it — a vitest config syntax error
+ * prints `[PARSE_ERROR] …` first and then kilobytes of frames. `head` and
+ * `tail` are the raw windows at each end; both are redacted before slicing.
+ */
+export declare function summarizeStderr(head: string, tail: string, totalBytes: number): string;
+//# sourceMappingURL=coverage-stderr.d.ts.map