agentic-qe 3.15.9 → 3.15.11

package/dist/domains/security-compliance/services/scanners/dast-injection-testing.js

@@ -11,43 +11,38 @@ import { v4 as uuidv4 } from 'uuid';
  */
 export async function testXSS(targetUrl, parsedUrl, paramName, payloads, vulnerabilities) {
     for (const xss of payloads) {
-        try {
-            const testParams = new URLSearchParams(parsedUrl.search);
-            testParams.set(paramName, xss.payload);
-            const testUrl = `${parsedUrl.origin}${parsedUrl.pathname}?${testParams.toString()}`;
-            const response = await fetch(testUrl, {
-                method: 'GET',
-                headers: { 'User-Agent': 'AgenticQE-DAST-Scanner/3.0' },
-                signal: AbortSignal.timeout(5000),
-            });
-            if (response.ok) {
-                const text = await response.text();
-                const escapedPayload = xss.payload
-                    .replace(/&/g, '&')
-                    .replace(/</g, '&lt;')
-                    .replace(/>/g, '&gt;')
-                    .replace(/"/g, '&quot;')
-                    .replace(/'/g, '&#x27;');
-                const hasUnescapedPayload = text.includes(xss.payload);
-                const hasEscapedPayload = text.includes(escapedPayload);
-                if (hasUnescapedPayload && !hasEscapedPayload) {
-                    vulnerabilities.push({
-                        id: uuidv4(),
-                        title: `Reflected XSS: ${xss.name}`,
-                        description: `Parameter '${paramName}' reflects unsanitized input`,
-                        severity: 'critical',
-                        category: 'xss',
-                        location: { file: targetUrl, snippet: `Parameter: ${paramName}, Payload: ${xss.payload.substring(0, 30)}...` },
-                        remediation: { description: 'HTML-encode all user input before rendering', estimatedEffort: 'moderate', automatable: false },
-                        references: ['https://owasp.org/www-community/attacks/xss/'],
-                    });
-                    break;
-                }
+        const testParams = new URLSearchParams(parsedUrl.search);
+        testParams.set(paramName, xss.payload);
+        const testUrl = `${parsedUrl.origin}${parsedUrl.pathname}?${testParams.toString()}`;
+        const response = await fetch(testUrl, {
+            method: 'GET',
+            headers: { 'User-Agent': 'AgenticQE-DAST-Scanner/3.0' },
+            signal: AbortSignal.timeout(5000),
+        });
+        if (response.ok) {
+            const text = await response.text();
+            const escapedPayload = xss.payload
+                .replace(/&/g, '&amp;')
+                .replace(/</g, '&lt;')
+                .replace(/>/g, '&gt;')
+                .replace(/"/g, '&quot;')
+                .replace(/'/g, '&#x27;');
+            const hasUnescapedPayload = text.includes(xss.payload);
+            const hasEscapedPayload = text.includes(escapedPayload);
+            if (hasUnescapedPayload && !hasEscapedPayload) {
+                vulnerabilities.push({
+                    id: uuidv4(),
+                    title: `Reflected XSS: ${xss.name}`,
+                    description: `Parameter '${paramName}' reflects unsanitized input`,
+                    severity: 'critical',
+                    category: 'xss',
+                    location: { file: targetUrl, snippet: `Parameter: ${paramName}, Payload: ${xss.payload.substring(0, 30)}...` },
+                    remediation: { description: 'HTML-encode all user input before rendering', estimatedEffort: 'moderate', automatable: false },
+                    references: ['https://owasp.org/www-community/attacks/xss/'],
+                });
+                break;
             }
         }
-        catch {
-            // Request failed
-        }
     }
 }
 /**
@@ -65,35 +60,30 @@ export async function testSQLi(targetUrl, parsedUrl, paramName, payloads, vulner
         /quoted string not properly terminated/i,
     ];
     for (const sqli of payloads) {
-        try {
-            const testParams = new URLSearchParams(parsedUrl.search);
-            testParams.set(paramName, sqli.payload);
-            const testUrl = `${parsedUrl.origin}${parsedUrl.pathname}?${testParams.toString()}`;
-            const response = await fetch(testUrl, {
-                method: 'GET',
-                headers: { 'User-Agent': 'AgenticQE-DAST-Scanner/3.0' },
-                signal: AbortSignal.timeout(5000),
-            });
-            const text = await response.text();
-            for (const pattern of sqlErrorPatterns) {
-                if (pattern.test(text)) {
-                    vulnerabilities.push({
-                        id: uuidv4(),
-                        title: `SQL Injection: ${sqli.name}`,
-                        description: `Parameter '${paramName}' appears vulnerable to SQL injection`,
-                        severity: 'critical',
-                        category: 'injection',
-                        location: { file: targetUrl, snippet: `Parameter: ${paramName}` },
-                        remediation: { description: 'Use parameterized queries or prepared statements', estimatedEffort: 'moderate', automatable: false },
-                        references: ['https://owasp.org/www-community/attacks/SQL_Injection'],
-                    });
-                    break;
-                }
+        const testParams = new URLSearchParams(parsedUrl.search);
+        testParams.set(paramName, sqli.payload);
+        const testUrl = `${parsedUrl.origin}${parsedUrl.pathname}?${testParams.toString()}`;
+        const response = await fetch(testUrl, {
+            method: 'GET',
+            headers: { 'User-Agent': 'AgenticQE-DAST-Scanner/3.0' },
+            signal: AbortSignal.timeout(5000),
+        });
+        const text = await response.text();
+        for (const pattern of sqlErrorPatterns) {
+            if (pattern.test(text)) {
+                vulnerabilities.push({
+                    id: uuidv4(),
+                    title: `SQL Injection: ${sqli.name}`,
+                    description: `Parameter '${paramName}' appears vulnerable to SQL injection`,
+                    severity: 'critical',
+                    category: 'injection',
+                    location: { file: targetUrl, snippet: `Parameter: ${paramName}` },
+                    remediation: { description: 'Use parameterized queries or prepared statements', estimatedEffort: 'moderate', automatable: false },
+                    references: ['https://owasp.org/www-community/attacks/SQL_Injection'],
+                });
+                break;
             }
         }
-        catch {
-            // Request failed
-        }
     }
 }
 //# sourceMappingURL=dast-injection-testing.js.map

package/dist/domains/security-compliance/services/scanners/dast-scanner.d.ts

@@ -4,6 +4,27 @@
  */
 import { Result } from '@shared/types/index.js';
 import type { SecurityScannerConfig, DASTResult, DASTOptions, AuthCredentials, MemoryBackend, ScanStatus } from './scanner-types.js';
+/**
+ * DAST Scanner - Dynamic Application Security Testing
+ * Scans running applications for security vulnerabilities
+ *
+ * **Capabilities:**
+ * - Security header analysis (HSTS, CSP, X-Frame-Options, etc.)
+ * - Cookie security (Secure, HttpOnly, SameSite flags)
+ * - CORS misconfiguration detection
+ * - Sensitive file exposure (/.git, /.env, etc.)
+ * - Link crawling with same-origin scope
+ * - XSS reflection testing (GET parameters)
+ * - SQL injection error-based detection (GET parameters)
+ * - Form security analysis (CSRF tokens, autocomplete, action URLs)
+ *
+ * **Limitations:**
+ * - Injection testing: GET parameters only (POST form submission not implemented)
+ * - Crawling: Same-origin only, max 10 links per page, single depth
+ * - Auth flows: Header-based only, no login form automation
+ * - No JavaScript execution (static response analysis only)
+ * - No session management testing beyond cookie attributes
+ */
 export declare class DASTScanner {
     private readonly config;
     private readonly memory;
@@ -31,7 +52,6 @@ export declare class DASTScanner {
     private performAuthenticatedScan;
     private createInvalidUrlVuln;
     private createInsecureProtocolVuln;
-    private createAuthFailedVuln;
     private createTokenInUrlVuln;
     /**
      * Test URL parameters for injection vulnerabilities

package/dist/domains/security-compliance/services/scanners/dast-scanner.js

@@ -2,15 +2,25 @@
  * Agentic QE v3 - DAST (Dynamic Application Security Testing) Scanner
  * Performs dynamic analysis of running applications to detect security vulnerabilities
  */
-import { LoggerFactory } from '../../../../logging/index.js';
 import { v4 as uuidv4 } from 'uuid';
 import { ok, err } from '../../../../shared/types/index.js';
 import { toError } from '../../../../shared/error-utils.js';
 import { fetchWithResponseDeadline } from '../../../../shared/llm/providers/response-deadline.js';
-import { analyzeSecurityHeaders, analyzeCookieSecurity, analyzeServerHeaders, scanSensitiveFiles, analyzeCORS, extractAndCrawlLinks, testXSS, testSQLi, analyzeFormsForSecurityIssues, testAuthorizationBypass, testIDOR, validateCredentials, buildAuthHeaders, handleFetchError, calculateSummary, storeScanResults, } from './dast-helpers.js';
+import { analyzeSecurityHeaders, analyzeCookieSecurity, analyzeServerHeaders, scanSensitiveFiles, analyzeCORS, extractAndCrawlLinks, testXSS, testSQLi, analyzeFormsForSecurityIssues, testAuthorizationBypass, testIDOR, validateCredentials, buildAuthHeaders, calculateSummary, storeScanResults, } from './dast-helpers.js';
 // ============================================================================
 // DAST Scanner Service
 // ============================================================================
+/** Transport failures are execution errors, not absence of vulnerabilities. */
+function dastRequestFailure(error) {
+    if (error instanceof Error && 'code' in error && ['DAST_AUTHENTICATION_FAILED', 'DAST_TARGET_UNAVAILABLE'].includes(String(error.code)))
+        return error;
+    const timeout = error instanceof Error && /timeout|abort/i.test(error.message);
+    return Object.assign(new Error(timeout
+        ? 'DAST target request timeout; dynamic analysis is incomplete'
+        : 'DAST target request failed; dynamic analysis is incomplete'), {
+        code: timeout ? 'DAST_REQUEST_TIMEOUT' : 'DAST_REQUEST_FAILED',
+    });
+}
 /**
  * DAST Scanner - Dynamic Application Security Testing
  * Scans running applications for security vulnerabilities
@@ -32,7 +42,6 @@ import { analyzeSecurityHeaders, analyzeCookieSecurity, analyzeServerHeaders, sc
  * - No JavaScript execution (static response analysis only)
  * - No session management testing beyond cookie attributes
  */
-const logger = LoggerFactory.create('security-compliance/dast-scanner');
 export class DASTScanner {
     config;
     memory;
@@ -90,7 +99,7 @@ export class DASTScanner {
             // Validate credentials
             const credValidation = validateCredentials(credentials);
             if (!credValidation.valid) {
-                return err(new Error(credValidation.reason));
+                throw new Error(credValidation.reason);
             }
             const mergedOptions = {
                 maxDepth: options?.maxDepth ?? this.config.dastMaxDepth,
@@ -158,6 +167,12 @@ export class DASTScanner {
                     },
                     redirect: 'follow',
                 }, deadlineMs, () => new Error(`DAST request timeout after ${deadlineMs}ms: ${targetUrl}`));
+                if (response.status === 401 || response.status === 403 || response.status >= 500) {
+                    await response.body?.cancel().catch(() => undefined);
+                    throw Object.assign(new Error(`DAST ${response.status < 500 ? 'authentication rejected' : 'target unavailable'} (HTTP ${response.status}); dynamic analysis is incomplete`), {
+                        code: response.status < 500 ? 'DAST_AUTHENTICATION_FAILED' : 'DAST_TARGET_UNAVAILABLE',
+                    });
+                }
                 crawledUrls++;
                 // Security header analysis
                 analyzeSecurityHeaders(response.headers, targetUrl, vulnerabilities);
@@ -190,11 +205,11 @@ export class DASTScanner {
                 }
             }
             catch (fetchError) {
-                handleFetchError(fetchError, targetUrl, vulnerabilities);
+                throw dastRequestFailure(fetchError);
             }
         }
         catch (error) {
-            logger.error('DAST scan error:', error instanceof Error ? error : undefined);
+            throw toError(error);
         }
         return { vulnerabilities, crawledUrls };
     }
@@ -231,11 +246,13 @@ export class DASTScanner {
                     redirect: 'follow',
                 }, deadlineMs, () => new Error(`DAST request timeout after ${deadlineMs}ms: ${targetUrl}`));
                 await response.body?.cancel().catch(() => undefined);
-                crawledUrls++;
-                // Check if authentication was successful
-                if (response.status === 401 || response.status === 403) {
-                    vulnerabilities.push(this.createAuthFailedVuln(targetUrl, response.status));
+                if (response.status === 401 || response.status === 403 || response.status >= 500) {
+                    await response.body?.cancel().catch(() => undefined);
+                    throw Object.assign(new Error(`DAST ${response.status < 500 ? 'authentication rejected' : 'target unavailable'} (HTTP ${response.status}); dynamic analysis is incomplete`), {
+                        code: response.status < 500 ? 'DAST_AUTHENTICATION_FAILED' : 'DAST_TARGET_UNAVAILABLE',
+                    });
                 }
+                crawledUrls++;
                 // Standard security header checks
                 analyzeSecurityHeaders(response.headers, targetUrl, vulnerabilities, true);
                 // Check for session token in URL
@@ -251,11 +268,11 @@ export class DASTScanner {
                 analyzeCookieSecurity(response.headers, targetUrl, vulnerabilities, true);
             }
             catch (fetchError) {
-                handleFetchError(fetchError, targetUrl, vulnerabilities);
+                throw dastRequestFailure(fetchError);
             }
         }
         catch (error) {
-            logger.error('Authenticated DAST scan error:', error instanceof Error ? error : undefined);
+            throw toError(error);
         }
         return { vulnerabilities, crawledUrls };
     }
@@ -286,18 +303,6 @@ export class DASTScanner {
             references: ['https://owasp.org/www-project-web-security-testing-guide/'],
         };
     }
-    createAuthFailedVuln(targetUrl, status) {
-        return {
-            id: uuidv4(),
-            title: 'Authentication Failed',
-            description: `Authentication returned ${status} status`,
-            severity: 'informational',
-            category: 'broken-auth',
-            location: { file: targetUrl },
-            remediation: { description: 'Verify credentials are correct', estimatedEffort: 'trivial', automatable: false },
-            references: [],
-        };
-    }
     createTokenInUrlVuln(targetUrl, search) {
         return {
             id: uuidv4(),

package/dist/domains/security-compliance/services/scanners/dependency-resolver.js

@@ -22,28 +22,33 @@
  * complete, with a reason; each member can be scanned directly.
  */
 import * as fs from 'fs/promises';
+// #1161: manifests and lockfiles are read from a validated descriptor; one
+// linked out of the project, or to a device, is refused instead of read.
+import { readConfinedText } from '../../../../shared/io/confined-read.js';
 import * as path from 'path';
 import semver from 'semver';
 import { parse as parseYaml } from 'yaml';
 import { safeJsonParse } from '../../../../shared/safe-json.js';
 import { classifyNpmSpec, exactNpmVersion } from '../../../../shared/security/osv-lookup.js';
+import { createSafeRecord, getOwn, setOwn } from '../../../../shared/utils/safe-record.js';
 import { LOCKFILES, parseLockfile } from './lockfile-versions.js';
 /** The reason a workspace root's scan is not complete (#1057). */
 export const WORKSPACE_NOT_SCANNED = 'workspace member dependencies are not scanned yet (#1057); scan each member directory separately';
 const OUT_OF_SYNC = 'lockfile out of sync with package.json';
 /** All declared dependencies of a manifest (later fields win, as npm resolves them). */
 export function declaredDependencies(manifest) {
-    const out = {};
+    // #1157: a dependency named `__proto__` is kept as an own entry, not dropped.
+    const out = createSafeRecord();
     for (const field of ['peerDependencies', 'optionalDependencies', 'devDependencies', 'dependencies']) {
         for (const [name, spec] of Object.entries(manifest[field] ?? {})) {
             if (typeof spec === 'string')
-                out[name] = spec;
+                setOwn(out, name, spec);
         }
     }
     return out;
 }
 async function readManifest(file) {
-    return safeJsonParse(await fs.readFile(file, 'utf-8'));
+    return safeJsonParse(await readConfinedText(file, { outsideRoot: 'allow' }));
 }
 async function exists(file) {
     try {
@@ -123,7 +128,7 @@ async function pnpmDeclaresPackages(file) {
         const st = await fs.stat(file); // follows a link; a dangling one throws
         if (!st.isFile() || st.size > MAX_PNPM_WORKSPACE_BYTES)
             return true;
-        const text = await fs.readFile(file, 'utf-8');
+        const text = await readConfinedText(file, { outsideRoot: 'allow', maxBytes: MAX_PNPM_WORKSPACE_BYTES });
         doc = parseYaml(text, { uniqueKeys: false, merge: true, maxAliasCount: 100 });
     }
     catch {
@@ -182,7 +187,10 @@ export function resolveFromRecord(dependencies, lockedVersions = {}) {
         members: () => [],
         hasImporter: () => true,
         recordedSpec: () => null,
-        resolve: (_importer, name) => (lockedVersions[name] !== undefined ? { version: lockedVersions[name] } : undefined),
+        resolve: (_importer, name) => {
+            const version = getOwn(lockedVersions, name);
+            return version !== undefined ? { version } : undefined;
+        },
     };
     return Object.entries(dependencies).map(([name, spec]) => resolveOne(name, spec, '', index, new Set()));
 }
@@ -202,7 +210,7 @@ export async function resolveDependencies(manifestPath) {
     if (found) {
         const member = path.relative(found.dir, realManifestDir).split(path.sep).join('/');
         try {
-            const parsed = parseLockfile(found.file, await fs.readFile(path.join(found.dir, found.file), 'utf-8'));
+            const parsed = parseLockfile(found.file, await readConfinedText(path.join(found.dir, found.file), { outsideRoot: 'allow' }));
             const rootManifest = member ? await readManifest(path.join(found.dir, 'package.json')).catch(() => ({})) : manifest;
             // A member scanned directly: the root lockfile covers it if it lists the
             // importer (npm/pnpm) or, for yarn, if the root declares workspaces.

package/dist/domains/security-compliance/services/scanners/sast-scanner.js

@@ -11,6 +11,7 @@ import { ok, err } from '../../../../shared/types/index.js';
 import { ALL_SECURITY_PATTERNS, BUILT_IN_RULE_SETS } from './security-patterns.js';
 import { toError } from '../../../../shared/error-utils.js';
 import { safeJsonParse } from '../../../../shared/safe-json.js';
+import { readConfinedFile } from '../../../../shared/io/confined-read.js';
 import { CLAUDE_TIER_MODELS, DEFAULT_OPUS_MODEL } from '../../../../shared/llm/model-registry.js';
 import { isSemgrepAvailable, runSemgrepWithRules, convertSemgrepFindings, } from '../semgrep-integration.js';
 // ============================================================================
@@ -303,8 +304,9 @@ export class SASTScanner {
         let content;
         let sourceDigest;
         try {
-            const fs = await import('fs/promises');
-            const bytes = await fs.readFile(filePath);
+            // #1161: open once and validate the opened descriptor, so a file swapped
+            // after the sast-scan path check cannot redirect the read.
+            const bytes = await readConfinedFile(filePath, { outsideRoot: 'allow' });
             sourceDigest = createHash('sha256').update(bytes).digest('hex');
             content = bytes.toString('utf8');
         }

package/dist/domains/security-compliance/services/scanners/scanner-orchestrator.js

@@ -122,7 +122,10 @@ export class SecurityScannerService {
                 if (dastScan.success) {
                     dastResult = dastScan.value;
                 }
-                // Don't fail the full scan if DAST fails
+                else {
+                    // A requested phase that did not execute cannot become a full scan.
+                    return err(dastScan.error);
+                }
             }
             // Combine summaries
             const combinedSummary = this.combineSummaries(sastResult.value.summary, dastResult?.summary);

package/dist/domains/security-compliance/services/security-auditor-sast.js

@@ -4,7 +4,7 @@
  */
 import { LoggerFactory } from '../../../logging/index.js';
 import { v4 as uuidv4 } from 'uuid';
-import * as fs from 'fs/promises';
+import { readConfinedText } from '../../../shared/io/confined-read.js';
 import * as path from 'path';
 /**
  * Get the default SAST vulnerability patterns for JS/TS analysis
@@ -173,7 +173,7 @@ export async function performSASTScan(findSourceFiles, shouldExclude) {
                 continue;
             }
             try {
-                const content = await fs.readFile(filePath, 'utf-8');
+                const content = await readConfinedText(filePath, { outsideRoot: 'allow' }); // #1161
                 const lines = content.split('\n');
                 filesScanned++;
                 linesScanned += lines.length;

package/dist/domains/security-compliance/services/security-auditor-secrets.js

@@ -3,7 +3,7 @@
  * Extracted from security-auditor.ts - Secret/credential detection
  */
 import { LoggerFactory } from '../../../logging/index.js';
-import * as fs from 'fs/promises';
+import { readConfinedText } from '../../../shared/io/confined-read.js';
 /**
  * Get the comprehensive set of secret detection patterns
  */
@@ -198,7 +198,7 @@ export function validateSecret(type, value) {
 export async function scanFileForSecrets(file) {
     const secrets = [];
     try {
-        const content = await fs.readFile(file.value, 'utf-8');
+        const content = await readConfinedText(file.value, { outsideRoot: 'allow' }); // #1161
         const lines = content.split('\n');
         const secretPatterns = getSecretPatterns();
         for (let lineIndex = 0; lineIndex < lines.length; lineIndex++) {

package/dist/domains/security-compliance/services/security-auditor.js

@@ -12,6 +12,7 @@
 import { LoggerFactory } from '../../../logging/index.js';
 import { v4 as uuidv4 } from 'uuid';
 import * as fs from 'fs/promises';
+import { readConfinedText } from '../../../shared/io/confined-read.js';
 import * as path from 'path';
 import { ok, err } from '../../../shared/types/index.js';
 import { toError } from '../../../shared/error-utils.js';
@@ -249,7 +250,7 @@ export class SecurityAuditorService {
         const dependencies = [];
         try {
             if (ecosystem === 'npm') {
-                const content = await fs.readFile(manifest, 'utf-8');
+                const content = await readConfinedText(manifest, { outsideRoot: 'allow' }); // #1161
                 const packageJson = safeJsonParse(content);
                 const allDeps = {
                     ...packageJson.dependencies,
@@ -263,7 +264,7 @@ export class SecurityAuditorService {
                 }
             }
             else if (ecosystem === 'pip') {
-                const content = await fs.readFile(manifest, 'utf-8');
+                const content = await readConfinedText(manifest, { outsideRoot: 'allow' }); // #1161
                 const lines = content.split('\n');
                 for (const line of lines) {
                     const trimmed = line.trim();

package/dist/domains/test-execution/coordinator.d.ts

@@ -123,6 +123,12 @@ export declare class TestExecutionCoordinator extends BaseDomainCoordinator<Test
      * Auto-detects framework and uses sensible defaults
      */
     runTests(request: SimpleTestRequest): Promise<Result<TestRunResult, Error>>;
+    /**
+     * Retry a run's failed tests when retries were requested, and attach what
+     * the retries did to the run (#1130). A test that passed on a retry counts
+     * as passed and flaky in the run's own counts (#1170).
+     */
+    private retryFailures;
     /**
      * Detect test framework from file patterns and project configuration
      */

package/dist/domains/test-execution/coordinator.js

@@ -9,6 +9,7 @@ import { TestExecutionEvents, createEvent, } from '../../shared/events/index.js'
 import { TestExecutorService } from './services/test-executor.js';
 import { FlakyDetectorService } from './services/flaky-detector.js';
 import { RetryHandlerService } from './services/retry-handler.js';
+import { applyRetryOutcome } from './services/retry-outcome.js';
 import { TestPrioritizerService } from './services/test-prioritizer.js';
 import { createE2ETestRunnerService, } from './services/e2e-runner.js';
 import { createDomainFinding, } from '../../coordination/consensus/domain-findings.js';
@@ -146,16 +147,8 @@ export class TestExecutionCoordinator extends BaseDomainCoordinator {
                 workers,
                 timeout,
             });
-            // Handle retries if requested and there were failures
-            if (request.retryCount && request.retryCount > 0 && result.success && result.value.failed > 0) {
-                const failedTestIds = result.value.failedTests.map(t => t.testId);
-                await this.retry({
-                    runId: result.value.runId,
-                    failedTests: failedTestIds,
-                    maxRetries: request.retryCount,
-                    backoff: 'exponential',
-                });
-            }
+            if (result.success)
+                await this.retryFailures(result.value, request.retryCount);
             return result;
         }
         // Sequential execution
@@ -164,18 +157,32 @@ export class TestExecutionCoordinator extends BaseDomainCoordinator {
             framework,
             timeout,
         });
-        // Handle retries if requested and there were failures
-        if (request.retryCount && request.retryCount > 0 && result.success && result.value.failed > 0) {
-            const failedTestIds = result.value.failedTests.map(t => t.testId);
-            await this.retry({
-                runId: result.value.runId,
-                failedTests: failedTestIds,
-                maxRetries: request.retryCount,
-                backoff: 'exponential',
-            });
-        }
+        if (result.success)
+            await this.retryFailures(result.value, request.retryCount);
         return result;
     }
+    /**
+     * Retry a run's failed tests when retries were requested, and attach what
+     * the retries did to the run (#1130). A test that passed on a retry counts
+     * as passed and flaky in the run's own counts (#1170).
+     */
+    async retryFailures(run, retryCount) {
+        if (!retryCount || retryCount <= 0)
+            return;
+        if (run.failed === 0) {
+            run.retries = { totalRetries: 0, nowPassing: 0, stillFailing: 0, tests: [] };
+            return;
+        }
+        const retried = await this.retry({
+            runId: run.runId,
+            failedTests: run.failedTests.map(t => t.testId),
+            maxRetries: retryCount,
+            backoff: 'exponential',
+        });
+        if (!retried.success)
+            return;
+        applyRetryOutcome(run, retried.value);
+    }
     /**
      * Detect test framework from file patterns and project configuration
      */
@@ -671,11 +678,10 @@ export class TestExecutionCoordinator extends BaseDomainCoordinator {
     /**
      * Record execution results for DT learning
      */
-    async recordExecutionResults(runId, testFiles, result, prioritizationInfo) {
+    async recordExecutionResults(runId, testFiles, result, _prioritizationInfo) {
         // Record each test execution for learning
         for (let i = 0; i < testFiles.length; i++) {
             const testId = this.generateTestId(testFiles[i]);
-            const info = prioritizationInfo;
             // Find if this test failed (check if it's in failed tests)
             const failedTest = result.failedTests.find(t => t.file === testFiles[i]);
             const passed = !failedTest;

package/dist/domains/test-execution/interfaces.d.ts

@@ -78,6 +78,27 @@ export interface ITestRunResult {
     coverage?: ICoverageData;
     /** Per-file coverage data for granular quality assessment */
     fileCoverages?: IFileCoverageData[];
+    /** #1130: what the requested retries of failed tests did. Absent when none were requested. */
+    retries?: IRunRetrySummary;
+    /**
+     * #1170: tests that failed and then passed on a retry. They are counted in
+     * `passed`, not `failed`. Absent when no test passed on a retry.
+     */
+    flaky?: number;
+}
+/** #1130: the measured outcome of a run's retries, per failed test. */
+export interface IRunRetrySummary {
+    /** Reruns that executed a test (an unmatched retry runs nothing and is not counted). */
+    totalRetries: number;
+    nowPassing: number;
+    stillFailing: number;
+    tests: Array<{
+        name: string;
+        file: string;
+        attempts: number;
+        passed: boolean;
+        unmatched?: boolean;
+    }>;
 }
 /** One test case taken verbatim from a runner report (#1110). */
 export interface ITestCaseResult {
@@ -86,8 +107,13 @@ export interface ITestCaseResult {
     status: 'passed' | 'failed' | 'skipped';
     /** Runner-reported duration in ms; omitted when the runner reported none. */
     duration?: number;
-    /** The runner's failure message for a failed test, when it reported one. */
+    /**
+     * The runner's failure message for a failed test, or for the failed first
+     * attempt of a flaky test, when it reported one.
+     */
     failureMessage?: string;
+    /** #1170: the test failed and then passed on a retry, so it is `passed`. */
+    flaky?: true;
 }
 export interface IFileCoverageData {
     path: string;
@@ -144,6 +170,15 @@ export interface IRetryResult {
     nowPassing: number;
     stillFailing: number;
     flakyDetected: string[];
+    /** Failed tests whose retry filter selected no test, so none was rerun (#1141). */
+    unmatched?: string[];
+    /** #1130: the outcome per retried test. */
+    tests?: Array<{
+        testId: string;
+        attempts: number;
+        passed: boolean;
+        unmatched?: boolean;
+    }>;
 }
 export interface IExecutionStats {
     runId: string;