agentic-qe 3.15.9 → 3.15.11

package/dist/coordination/result-saver.js

@@ -7,6 +7,7 @@ import * as path from 'path';
 import { createHash, randomBytes } from 'crypto';
 import { safeJsonParse } from '../shared/safe-json.js';
 import { getProjectStorePath } from '../kernel/project-root.js';
+import { resultForSaver } from './result-saver-adapters.js';
 /** Cap on the sanitized stem of a generated test file name (see generatedTestFilename). */
 const MAX_GENERATED_STEM_LENGTH = 100;
 function securityReportExecution(data) {
@@ -92,12 +93,14 @@ export class ResultSaver {
     /**
      * Save task result in appropriate format(s)
      */
-    async save(taskId, taskType, result, options = {}) {
+    async save(taskId, taskType, taskResult, options = {}) {
+        // #1125: concrete handler types are saved by their abstract type's saver.
+        const { saveType, report: result } = resultForSaver(taskType, taskResult);
         const timestamp = new Date();
         const files = [];
         // Database-free mode (#534): do not write .agentic-qe/results/* to disk.
         if (process.env.AQE_MEMORY_BACKEND === 'memory') {
-            return { taskId, taskType, timestamp, files, summary: this.extractSummary(taskType, result) };
+            return { taskId, taskType, timestamp, files, summary: this.extractSummary(saveType, result) };
         }
         // Ensure directories exist
         await this.ensureDirectories(taskType);
@@ -110,7 +113,7 @@ export class ResultSaver {
         const tsStr = this.formatTimestamp(timestamp);
         const prefix = options.filenamePrefix || `${tsStr}_${this.uniqueSuffix(taskId)}`;
         // Save based on task type
-        switch (taskType) {
+        switch (saveType) {
             case 'generate-tests':
                 files.push(...await this.saveTestGeneration(result, prefix, options));
                 break;
@@ -140,10 +143,10 @@ export class ResultSaver {
                 break;
             default:
                 // Generic JSON save for unknown types
-                files.push(...await this.saveGeneric(taskType, result, prefix));
+                files.push(...await this.saveGeneric(saveType, result, prefix));
         }
         // Update index
-        const summary = this.extractSummary(taskType, result);
+        const summary = this.extractSummary(saveType, result);
         await this.updateIndex(taskId, taskType, timestamp, files, summary);
         return {
             taskId,

package/dist/coordination/task-executability.d.ts

@@ -14,5 +14,17 @@ import type { DomainPlugin } from '../kernel/interfaces';
  * every domain can run the task.
  */
 export declare function findDomainsWithoutHandler(domainPlugins: ReadonlyMap<DomainName, DomainPlugin>, type: string, domains: readonly DomainName[]): string[];
+/**
+ * #1170: the loaded domains whose plugin executes `type`. A plugin task type
+ * such as `sast-scan` has no entry in TASK_DOMAIN_MAP, so a caller that names
+ * no target domain is routed to the domains that handle it.
+ */
+export declare function findDomainsWithHandler(domainPlugins: ReadonlyMap<DomainName, DomainPlugin>, type: string): DomainName[];
+/**
+ * The domains a task may run in: the caller's target domains, else the
+ * domains configured for its type, else (#1170) the loaded domains whose
+ * plugin handles the type.
+ */
+export declare function resolveTaskDomains(type: string, targetDomains: readonly DomainName[], domainPlugins?: ReadonlyMap<DomainName, DomainPlugin>): readonly DomainName[];
 export declare function describeMissingHandler(type: string, gaps: readonly string[]): string;
 //# sourceMappingURL=task-executability.d.ts.map

package/dist/coordination/task-executability.js

@@ -6,6 +6,7 @@
  * the `TaskAssigned` event fallback, which nothing answers, so the task stayed
  * `running` and held a concurrency slot for good.
  */
+import { getTaskDomains } from './queen-types.js';
 /**
  * List the domains among `domains` that cannot execute `type`, each with the
  * reason and, where known, the types it does support. An empty list means
@@ -25,6 +26,32 @@ export function findDomainsWithoutHandler(domainPlugins, type, domains) {
     }
     return gaps;
 }
+/**
+ * #1170: the loaded domains whose plugin executes `type`. A plugin task type
+ * such as `sast-scan` has no entry in TASK_DOMAIN_MAP, so a caller that names
+ * no target domain is routed to the domains that handle it.
+ */
+export function findDomainsWithHandler(domainPlugins, type) {
+    const domains = [];
+    for (const [domain, plugin] of domainPlugins) {
+        if (plugin.executeTask && plugin.canHandleTask?.(type))
+            domains.push(domain);
+    }
+    return domains;
+}
+/**
+ * The domains a task may run in: the caller's target domains, else the
+ * domains configured for its type, else (#1170) the loaded domains whose
+ * plugin handles the type.
+ */
+export function resolveTaskDomains(type, targetDomains, domainPlugins) {
+    if (targetDomains.length > 0)
+        return targetDomains;
+    const configured = getTaskDomains(type);
+    if (configured.length > 0 || !domainPlugins)
+        return configured;
+    return findDomainsWithHandler(domainPlugins, type);
+}
 export function describeMissingHandler(type, gaps) {
     return `No handler for task type '${type}' in domain ${gaps.join('; ')}`;
 }

package/dist/coordination/workflow-orchestrator.d.ts

@@ -49,6 +49,12 @@ export declare class WorkflowOrchestrator implements IWorkflowOrchestrator {
      */
     rejectStep(executionId: string, stepId: string, reason?: string): boolean;
     isActionRegistered(domain: DomainName, action: string): boolean;
+    /**
+     * #1157: a registered action by domain and action name. Both names come from
+     * pipeline YAML, so only own registry entries count: `toString` or
+     * `constructor` is an unregistered action, not an Object.prototype member.
+     */
+    private lookupAction;
     getRegisteredActions(domain: DomainName): string[];
     getDomainsWithActions(): DomainName[];
     spawnWorkflowAgent(workflowId: string, stepId: string, domain: DomainName): Promise<Result<string, Error>>;

package/dist/coordination/workflow-orchestrator.js

@@ -209,7 +209,18 @@ export class WorkflowOrchestrator {
     // Public Utility Methods
     // ============================================================================
     isActionRegistered(domain, action) {
-        return !!this.actionRegistry[domain]?.[action];
+        return this.lookupAction(domain, action) !== undefined;
+    }
+    /**
+     * #1157: a registered action by domain and action name. Both names come from
+     * pipeline YAML, so only own registry entries count: `toString` or
+     * `constructor` is an unregistered action, not an Object.prototype member.
+     */
+    lookupAction(domain, action) {
+        const actions = Object.hasOwn(this.actionRegistry, domain)
+            ? this.actionRegistry[domain]
+            : undefined;
+        return actions && Object.hasOwn(actions, action) ? actions[action] : undefined;
     }
     getRegisteredActions(domain) {
         return Object.keys(this.actionRegistry[domain] || {});
@@ -612,9 +623,9 @@ export class WorkflowOrchestrator {
             return actionResult.value;
         }
         // Fall back to registered domain actions
-        const domainActions = this.actionRegistry[step.domain];
-        if (domainActions?.[step.action]) {
-            const actionResult = await Promise.race([domainActions[step.action](input, context), timeoutPromise]);
+        const domainAction = this.lookupAction(step.domain, step.action);
+        if (domainAction) {
+            const actionResult = await Promise.race([domainAction(input, context), timeoutPromise]);
             if (!actionResult.success)
                 throw actionResult.error;
             return actionResult.value;
@@ -624,12 +635,12 @@ export class WorkflowOrchestrator {
     }
     async executeRollback(rollback, context) {
         try {
-            const domainActions = this.actionRegistry[rollback.domain];
-            if (!domainActions?.[rollback.action]) {
+            const domainAction = this.lookupAction(rollback.domain, rollback.action);
+            if (!domainAction) {
                 console.warn(`Rollback action '${rollback.action}' not registered for domain '${rollback.domain}'. Skipping rollback.`);
                 return;
             }
-            const result = await domainActions[rollback.action](rollback.input || {}, context);
+            const result = await domainAction(rollback.input || {}, context);
             if (!result.success)
                 console.error(`Rollback failed for ${rollback.domain}.${rollback.action}:`, result.error);
         }
@@ -669,8 +680,11 @@ export class WorkflowOrchestrator {
         for (const part of parts) {
             if (current === null || current === undefined)
                 return undefined;
-            if (typeof current === 'object')
+            // #1157: paths come from pipeline YAML (conditions, input/output
+            // mappings); an inherited member such as `constructor` is absent.
+            if (typeof current === 'object' && Object.hasOwn(current, part)) {
                 current = current[part];
+            }
             else
                 return undefined;
         }

package/dist/coordination/yaml-pipeline-loader.js

@@ -8,6 +8,7 @@
 import * as fs from 'node:fs/promises';
 import { parse as parseYaml } from 'yaml';
 import { ok, err, ALL_DOMAINS } from '../shared/types/index.js';
+import { getOwn } from '../shared/utils/safe-record.js';
 const VALID_OPERATORS = [
     'eq', 'neq', 'gt', 'gte', 'lt', 'lte', 'contains', 'exists',
 ];
@@ -380,8 +381,10 @@ export class YamlPipelineLoader {
     }
     /** Resolve a dot-path variable (e.g. "foo.bar") from a variables map. */
     resolveVarPath(vars, path) {
+        // #1136: own properties only, so ${constructor} or ${x.toString} does
+        // not expand to an inherited Object.prototype member.
         // Try direct key first (covers flat keys like "coverageGoal")
-        if (path in vars)
+        if (Object.hasOwn(vars, path))
             return vars[path];
         // Try dot-path traversal
         const parts = path.split('.');
@@ -390,7 +393,7 @@ export class YamlPipelineLoader {
             if (current === null || current === undefined || typeof current !== 'object') {
                 return undefined;
             }
-            current = current[part];
+            current = getOwn(current, part);
         }
         return current;
     }

package/dist/domains/code-intelligence/index-path-guard.d.ts

@@ -28,13 +28,16 @@ export declare const MAX_INDEX_PATHS = 10000;
 export declare function validateIndexPaths(value: unknown, field?: string, context?: string, maxPaths?: number): Result<string[], Error>;
 /**
  * Boundary check shared by `task_submit` and `aqe task submit`: an `index` or
- * `index-code` task that carries `paths` must carry a well-formed list.
- * Returns undefined when the task is acceptable.
+ * `index-code` task must carry a non-empty, well-formed `paths` list. The task
+ * handler indexes exactly those files; it does not expand a directory
+ * `target` (#1134), so a request without `paths` is refused here instead of
+ * failing after it was accepted. Returns undefined when the task is acceptable.
  */
 export declare function validateIndexTaskPayload(type: string, payload: unknown): Error | undefined;
 /**
  * Split `paths` into those that may be indexed and those that must be skipped.
  * Relative paths resolve against `basePath` (default: cwd), as FileReader does.
+ * The rule is the shared payload-path guard (#1126) without a size limit.
  */
 export declare function confineIndexPaths(paths: readonly string[], projectRoot: string, basePath?: string): Promise<ConfinedIndexPaths>;
 /**

package/dist/domains/code-intelligence/index-path-guard.js

@@ -8,14 +8,8 @@
  * of the project is skipped and reported instead of followed. Callers get the
  * skipped paths back with a reason; nothing skipped counts as indexed.
  */
-import * as fs from 'node:fs/promises';
-import * as path from 'node:path';
 import { ok, err } from '../../shared/types/index.js';
-/** True when `candidate` is `root` or lies beneath it (both absolute). */
-function isWithin(root, candidate) {
-    const relative = path.relative(root, candidate);
-    return relative === '' || (relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
-}
+import { confinePayloadPaths } from '../../shared/io/payload-path-guard.js';
 function describe(value) {
     if (value === null)
         return 'null';
@@ -53,60 +47,36 @@ export function validateIndexPaths(value, field = 'paths', context = 'Invalid in
 }
 /**
  * Boundary check shared by `task_submit` and `aqe task submit`: an `index` or
- * `index-code` task that carries `paths` must carry a well-formed list.
- * Returns undefined when the task is acceptable.
+ * `index-code` task must carry a non-empty, well-formed `paths` list. The task
+ * handler indexes exactly those files; it does not expand a directory
+ * `target` (#1134), so a request without `paths` is refused here instead of
+ * failing after it was accepted. Returns undefined when the task is acceptable.
  */
 export function validateIndexTaskPayload(type, payload) {
     if (type !== 'index' && type !== 'index-code')
         return undefined;
-    if (payload === null || typeof payload !== 'object' || !('paths' in payload))
-        return undefined;
+    if (payload === null || typeof payload !== 'object' || !Object.hasOwn(payload, 'paths')) {
+        return new Error(`Invalid index payload: '${type}' needs 'paths', the list of files to index. ` +
+            "It does not expand a directory 'target'; use code_index (or `aqe code index`) with a target, " +
+            'or list the files in paths.');
+    }
     const result = validateIndexPaths(payload.paths);
-    return result.success ? undefined : result.error;
+    if (!result.success)
+        return result.error;
+    if (result.value.length === 0) {
+        return new Error("Invalid index payload: 'paths' is empty; list at least one file to index");
+    }
+    return undefined;
 }
 /**
  * Split `paths` into those that may be indexed and those that must be skipped.
  * Relative paths resolve against `basePath` (default: cwd), as FileReader does.
+ * The rule is the shared payload-path guard (#1126) without a size limit.
  */
 export async function confineIndexPaths(paths, projectRoot, basePath = process.cwd()) {
-    const accepted = [];
-    const skipped = [];
-    const rootLexical = path.resolve(projectRoot);
-    const rootReal = await fs.realpath(projectRoot).catch(() => rootLexical);
-    for (const requested of paths) {
-        const lexical = path.resolve(basePath, requested);
-        // A path that is not even spelled inside the root is refused before any
-        // filesystem call, so the reason cannot reveal whether an outside path
-        // exists or is readable.
-        if (!isWithin(rootLexical, lexical) && !isWithin(rootReal, lexical)) {
-            skipped.push({ path: requested, reason: 'outside-project-root' });
-            continue;
-        }
-        let real;
-        try {
-            real = await fs.realpath(lexical);
-        }
-        catch (error) {
-            const code = error.code;
-            skipped.push({ path: requested, reason: code === 'ENOENT' || code === 'ENOTDIR' ? 'not-found' : 'unreadable' });
-            continue;
-        }
-        if (!isWithin(rootReal, real)) {
-            skipped.push({ path: requested, reason: 'outside-project-root' });
-            continue;
-        }
-        const stat = await fs.stat(real).catch(() => null);
-        if (!stat) {
-            skipped.push({ path: requested, reason: 'unreadable' });
-        }
-        else if (!stat.isFile()) {
-            skipped.push({ path: requested, reason: 'not-a-file' });
-        }
-        else {
-            accepted.push(requested);
-        }
-    }
-    return { accepted, skipped };
+    const { accepted, skipped } = await confinePayloadPaths(paths, { projectRoot, basePath });
+    // Without maxBytes the guard never reports 'too-large'.
+    return { accepted, skipped: skipped };
 }
 /**
  * The error an index entry point returns when paths were requested but none

package/dist/domains/code-intelligence/plugin.js

@@ -66,7 +66,7 @@ export class CodeIntelligencePlugin extends BaseDomainPlugin {
     // Task Handlers (Queen-Domain Integration)
     // ============================================================================
     getTaskHandlers() {
-        return new Map([
+        const handlers = new Map([
             ['index', async (payload) => {
                     if (!this.coordinator) {
                         return err(new Error('Coordinator not initialized'));
@@ -127,6 +127,10 @@ export class CodeIntelligencePlugin extends BaseDomainPlugin {
                     });
                 }],
         ]);
+        // `index-code` is the public Queen TaskType inferred by task_orchestrate.
+        // Both names share one execution handler and the same result lifecycle.
+        handlers.set('index-code', handlers.get('index'));
+        return handlers;
     }
     // ============================================================================
     // Lifecycle Methods

package/dist/domains/code-intelligence/services/metric-collector/index.d.ts

@@ -20,7 +20,7 @@ export { DEFAULT_METRIC_CONFIG } from './interfaces.js';
  */
 export interface IMetricCollectorService extends MetricCollector {
     /** Check available tools on the system */
-    checkTools(): ToolAvailability[];
+    checkTools(): Promise<ToolAvailability[]>;
     /** Clear the metrics cache */
     clearCache(): void;
     /** Get cache statistics */
@@ -66,7 +66,7 @@ export declare class MetricCollectorService implements IMetricCollectorService {
     /**
      * Check available tools on the system
      */
-    checkTools(): ToolAvailability[];
+    checkTools(): Promise<ToolAvailability[]>;
     /**
      * Clear the metrics cache
      */

package/dist/domains/code-intelligence/services/metric-collector/index.js

@@ -138,9 +138,8 @@ export class MetricCollectorService {
     /**
      * Check available tools on the system
      */
-    checkTools() {
-        const locTools = checkLOCTools();
-        const testTools = checkTestRunners(process.cwd());
+    async checkTools() {
+        const [locTools, testTools] = await Promise.all([checkLOCTools(), checkTestRunners(process.cwd())]);
         return [...locTools, ...testTools];
     }
     /**

package/dist/domains/code-intelligence/services/metric-collector/loc-counter.d.ts

@@ -24,7 +24,7 @@ export declare function countLOC(projectPath: string, config?: Partial<MetricCol
 /**
  * Check which LOC counting tools are available
  */
-export declare function checkLOCTools(): ToolAvailability[];
+export declare function checkLOCTools(): Promise<ToolAvailability[]>;
 /**
  * cloc `--not-match-f` regex matching any of `names` exactly (basename), or
  * null when there is nothing to exclude.

package/dist/domains/code-intelligence/services/metric-collector/loc-counter.js

@@ -11,12 +11,12 @@
  *
  * @see docs/plans/AQE_V3_IMPROVEMENTS_PLAN.md - Phase 5, RM-002
  */
-import { spawnSync } from 'child_process';
 import { existsSync, readdirSync, readFileSync, statSync } from 'fs';
 import { join, extname } from 'path';
 import { AQE_CLAUDE_DIR, AQE_STATE_DIR, findAqeClaudeDirs } from '../../../../shared/aqe-managed-dirs.js';
 import { DEFAULT_METRIC_CONFIG, } from './interfaces.js';
 import { safeJsonParse } from '../../../../shared/safe-json.js';
+import { runTestRunnerProcess } from '../../../../shared/test-runner-process.js';
 // ============================================================================
 // Main LOC Counting Function
 // ============================================================================
@@ -46,37 +46,13 @@ export async function countLOC(projectPath, config = {}) {
 /**
  * Check which LOC counting tools are available
  */
-export function checkLOCTools() {
-    const tools = [];
-    // Check cloc
-    try {
-        const result = spawnSync('cloc', ['--version'], { encoding: 'utf-8', timeout: 5000 });
-        if (result.status === 0) {
-            const version = result.stdout.trim().split('\n')[0];
-            tools.push({ name: 'cloc', available: true, version });
-        }
-        else {
-            tools.push({ name: 'cloc', available: false });
-        }
-    }
-    catch {
-        tools.push({ name: 'cloc', available: false });
-    }
-    // Check tokei
-    try {
-        const result = spawnSync('tokei', ['--version'], { encoding: 'utf-8', timeout: 5000 });
-        if (result.status === 0) {
-            const version = result.stdout.trim();
-            tools.push({ name: 'tokei', available: true, version });
-        }
-        else {
-            tools.push({ name: 'tokei', available: false });
-        }
-    }
-    catch {
-        tools.push({ name: 'tokei', available: false });
-    }
-    return tools;
+export async function checkLOCTools() {
+    return Promise.all(['cloc', 'tokei'].map(async (name) => {
+        const result = await runTestRunnerProcess(name, ['--version'], { cwd: process.cwd(), timeout: 5000 });
+        if (result.error || result.status !== 0)
+            return { name, available: false };
+        return { name, available: true, version: result.stdout.trim().split('\n')[0] };
+    }));
 }
 /**
  * cloc `--not-match-f` regex matching any of `names` exactly (basename), or
@@ -134,8 +110,8 @@ async function tryClocCount(projectPath, config) {
         if (notMatch)
             args.push(`--not-match-f=${notMatch}`);
         args.push(projectPath);
-        const result = spawnSync('cloc', args, {
-            encoding: 'utf-8',
+        const result = await runTestRunnerProcess('cloc', args, {
+            cwd: process.cwd(),
             timeout: config.timeout,
             maxBuffer: 10 * 1024 * 1024, // 10MB buffer (reduced for memory safety)
         });
@@ -193,9 +169,8 @@ async function tryTokeiCount(projectPath, config) {
             args.push('-e', `/${rel}`);
         }
         args.push('.');
-        const result = spawnSync('tokei', args, {
+        const result = await runTestRunnerProcess('tokei', args, {
             cwd: projectPath,
-            encoding: 'utf-8',
             timeout: config.timeout,
             maxBuffer: 10 * 1024 * 1024, // 10MB buffer (reduced for memory safety)
         });

package/dist/domains/code-intelligence/services/metric-collector/test-counter.d.ts

@@ -29,5 +29,5 @@ export declare function detectTestRunner(projectPath: string): TestSource;
 /**
  * Check which test runners are available on the system
  */
-export declare function checkTestRunners(projectPath: string): ToolAvailability[];
+export declare function checkTestRunners(projectPath: string): Promise<ToolAvailability[]>;
 //# sourceMappingURL=test-counter.d.ts.map