agentic-qe 3.15.9 → 3.15.11

package/dist/domains/test-execution/plugin.js

@@ -4,6 +4,7 @@
  */
 import { err } from '../../shared/types/index.js';
 import { BaseDomainPlugin } from '../domain-interface.js';
+import { requirePayloadFiles } from '../../shared/io/payload-path-guard.js';
 import { createTestExecutionCoordinator } from './coordinator.js';
 import { getGlobalInfraHealing } from '../../strange-loop/infra-healing/global-instance.js';
 import { isMeasuredGapPayload } from '../../shared/events/domain-events.js';
@@ -60,11 +61,22 @@ export class TestExecutionPlugin extends BaseDomainPlugin {
                     if (!this.coordinator) {
                         return err(new Error('Coordinator not initialized'));
                     }
+                    // #1126: a runner executes the files it is given, so only files and
+                    // directories (#909 Jest targets) inside the project, passed on as the
+                    // real paths that were checked. A missing one is still reported by the
+                    // runner.
+                    let testFiles;
+                    if (payload.testFiles !== undefined) {
+                        const confined = await requirePayloadFiles('execute-tests', 'testFiles', payload.testFiles, { allowMissing: true, allowDirectory: true });
+                        if (!confined.success)
+                            return confined;
+                        testFiles = confined.value;
+                    }
                     // Support both simple and full request formats
-                    if (payload.testFiles && Array.isArray(payload.testFiles)) {
+                    if (testFiles) {
                         // Simple request format
                         const request = {
-                            testFiles: payload.testFiles,
+                            testFiles,
                             parallel: payload.parallel,
                             retryCount: payload.retryCount,
                             timeout: payload.timeout,
@@ -75,7 +87,7 @@ export class TestExecutionPlugin extends BaseDomainPlugin {
                     else if (payload.framework) {
                         // Full request format
                         const request = {
-                            testFiles: payload.testFiles || [],
+                            testFiles: [],
                             framework: payload.framework,
                             timeout: payload.timeout,
                             env: payload.env,
@@ -96,8 +108,11 @@ export class TestExecutionPlugin extends BaseDomainPlugin {
                     if (!testFiles) {
                         return err(new Error('Invalid detect-flaky payload: missing testFiles'));
                     }
+                    const confined = await requirePayloadFiles('detect-flaky', 'testFiles', testFiles, { allowMissing: true, allowDirectory: true });
+                    if (!confined.success)
+                        return confined;
                     return this.coordinator.detectFlaky({
-                        testFiles,
+                        testFiles: confined.value,
                         runs: runs ?? 5,
                         threshold: threshold ?? 0.1,
                     });

package/dist/domains/test-execution/services/flaky-detector.js

@@ -15,6 +15,7 @@ import { getTestRunnerExecutionError } from '../../../shared/test-runner-verdict
 import { createVitestJsonReport, needsVitestJsonReportFile } from '../../../shared/vitest-json-report.js';
 import { isJestCommand, jestExactPathPattern, runnerFilePath } from '../../../shared/test-runner-args.js';
 import { secureRandom } from '../../../shared/utils/crypto-random.js';
+import { redactFailureText } from './runner-test-cases.js';
 const DEFAULT_FLAKY_CONFIG = {
     simulateForTesting: false,
     simulatedFlakinessRate: RETRY_CONSTANTS.DEFAULT_FLAKY_RATE,
@@ -132,7 +133,8 @@ export class FlakyDetectorService {
     async recordExecution(testId, result) {
         // Add to in-memory history
         const history = this.testHistory.get(testId) ?? [];
-        history.push(result);
+        // #1122: test-history is persisted, so failure text is stored redacted.
+        history.push(result.error ? { ...result, error: redactFailureText(result.error) } : result);
         // Keep only last 100 executions
         if (history.length > 100) {
             history.shift();
@@ -336,7 +338,7 @@ export class FlakyDetectorService {
                                 runId,
                                 passed: code === 0,
                                 duration,
-                                error: code !== 0 ? stderr || `Exit code: ${code}` : undefined,
+                                error: code !== 0 ? redactFailureText(stderr || `Exit code: ${code}`) : undefined,
                                 timestamp: new Date(),
                                 context: {
                                     parallelRuns: 1,
@@ -365,7 +367,7 @@ export class FlakyDetectorService {
                             passed: code === 0,
                             duration,
                             error: code !== 0
-                                ? stderr || `Exit code: ${code}, Parse error: ${parseError}`
+                                ? redactFailureText(stderr || `Exit code: ${code}, Parse error: ${parseError}`)
                                 : undefined,
                             timestamp: new Date(),
                             context: {
@@ -479,8 +481,8 @@ export class FlakyDetectorService {
                     runId,
                     passed: test.status === 'passed',
                     duration: test.duration || 0,
-                    error: test.status === 'failed'
-                        ? test.failureMessages?.join('\n')
+                    error: test.status === 'failed' && test.failureMessages
+                        ? redactFailureText(test.failureMessages.join('\n'))
                         : undefined,
                     timestamp: new Date(),
                     context: {
@@ -505,8 +507,8 @@ export class FlakyDetectorService {
                     runId,
                     passed: assertion.status === 'passed',
                     duration: assertion.duration || 0,
-                    error: assertion.status === 'failed'
-                        ? assertion.failureMessages?.join('\n')
+                    error: assertion.status === 'failed' && assertion.failureMessages
+                        ? redactFailureText(assertion.failureMessages.join('\n'))
                         : undefined,
                     timestamp: new Date(),
                     context: {

package/dist/domains/test-execution/services/retry-handler.js

@@ -14,6 +14,7 @@ import { toError } from '../../../shared/error-utils.js';
 import { safeJsonParse } from '../../../shared/safe-json.js';
 import { secureRandom } from '../../../shared/utils/crypto-random.js';
 import { terminateTestRunner, trackTestRunnerExit } from '../../../shared/test-runner-process.js';
+import { redactFailureText } from './runner-test-cases.js';
 /**
  * Whether a runner-reported test file and the requested target are the same
  * file. Runners report real paths, so a target given through a symlink must be
@@ -104,6 +105,8 @@ export class RetryHandlerService {
             const nowPassing = [];
             const stillFailing = [];
             const flakyDetected = [];
+            const unmatched = [];
+            const tests = [];
             for (const test of failedTests) {
                 const result = await this.retryTest(test, maxRetries, backoff, baseDelay, maxDelay, onRetry);
                 stats.totalRetries += result.attempts;
@@ -118,11 +121,18 @@ export class RetryHandlerService {
                 else {
                     stillFailing.push(test.testId);
                     stats.failed++;
+                    if (result.unmatched)
+                        unmatched.push(test.testId);
                 }
+                tests.push({
+                    testId: test.testId, attempts: result.attempts, passed: result.passed,
+                    ...(result.unmatched ? { unmatched: true } : {}),
+                });
                 // Record retry history
                 await this.recordRetry(test.testId, result);
             }
             stats.flakyDetected = flakyDetected;
+            stats.unmatched = unmatched;
             stats.endTime = Date.now();
             this.runStats.set(runId, stats);
             // Persist stats
@@ -136,6 +146,8 @@ export class RetryHandlerService {
                 nowPassing: nowPassing.length,
                 stillFailing: stillFailing.length,
                 flakyDetected,
+                unmatched,
+                tests,
             };
             return ok(retryResult);
         }
@@ -218,7 +230,8 @@ export class RetryHandlerService {
     }
     async retryTest(test, maxRetries, backoff, baseDelay, maxDelay, onRetry) {
         let attempts = 0;
-        let lastError = test.error;
+        // #1122: the final error is persisted in retry-history, so keep it redacted.
+        let lastError = redactFailureText(test.error);
         while (attempts < maxRetries) {
             // Check if should retry
             const shouldRetry = await this.shouldRetry(test.testId, attempts, lastError);
@@ -232,9 +245,16 @@ export class RetryHandlerService {
             if (onRetry) {
                 onRetry(test.testId, attempts + 1);
             }
-            attempts++;
             // Execute test (simulated - in real implementation, would run actual test)
             const result = await this.executeTest(test);
+            // #1141: a filter that selected no test reran nothing. Report that
+            // instead of counting it as a retry, and stop: another attempt would
+            // select nothing again.
+            if (result.unmatched) {
+                logger.warn(`Retry of "${test.testName}" matched no test in ${test.file}; nothing was rerun.`);
+                return { testId: test.testId, passed: false, attempts, finalError: lastError, unmatched: true };
+            }
+            attempts++;
             if (result.passed) {
                 return {
                     testId: test.testId,
@@ -243,7 +263,7 @@ export class RetryHandlerService {
                     finalError: undefined,
                 };
             }
-            lastError = result.error ?? lastError;
+            lastError = result.error !== undefined ? redactFailureText(result.error) : lastError;
         }
         return {
             testId: test.testId,
@@ -477,9 +497,16 @@ export class RetryHandlerService {
                 const result = safeJsonParse(vitestMatch[0]);
                 // Vitest's positional file filter uses prefix matching. A passing
                 // sibling must not clear a failure in the requested file (#972).
-                const targetPassed = !targetFile || result.testResults?.some((file) => typeof file.name === 'string'
-                    && sameTestFile(file.name, targetFile, this.config.cwd ?? process.cwd())
-                    && file.assertionResults?.some(assertion => assertion.status === 'passed'));
+                const targetHas = (status) => result.testResults?.some((file) => typeof file.name === 'string'
+                    && (!targetFile || sameTestFile(file.name, targetFile, this.config.cwd ?? process.cwd()))
+                    && file.assertionResults?.some(assertion => assertion.status === status)) === true;
+                const targetPassed = !targetFile || targetHas('passed');
+                const nothingRan = targetFile
+                    ? Array.isArray(result.testResults) && !targetPassed && !targetHas('failed')
+                    : result.numPassedTests === 0;
+                if (nothingRan && result.numFailedTests === 0 && result.numFailedTestSuites === 0) {
+                    return UNMATCHED;
+                }
                 if (exitCode === 0 && result.success !== false
                     && result.numFailedTests === 0 && result.numFailedTestSuites === 0
                     && Number.isFinite(result.numPassedTests) && result.numPassedTests > 0
@@ -501,6 +528,10 @@ export class RetryHandlerService {
             const jestMatch = stdout.match(/\{[\s\S]*"numFailedTests"[\s\S]*\}/);
             if (jestMatch) {
                 const result = safeJsonParse(jestMatch[0]);
+                if (result.numPassedTests === 0 && result.numFailedTests === 0
+                    && result.numFailedTestSuites === 0) {
+                    return UNMATCHED;
+                }
                 if (exitCode === 0 && result.success !== false
                     && result.numFailedTests === 0 && result.numFailedTestSuites === 0
                     && Number.isFinite(result.numPassedTests) && result.numPassedTests > 0) {
@@ -517,6 +548,8 @@ export class RetryHandlerService {
             const mochaMatch = stdout.match(/\{[\s\S]*"stats"[\s\S]*"failures"[\s\S]*\}/);
             if (mochaMatch) {
                 const result = safeJsonParse(mochaMatch[0]);
+                if (result.stats?.passes === 0 && result.stats?.failures === 0)
+                    return UNMATCHED;
                 if (exitCode === 0 && result.stats?.failures === 0
                     && Number.isFinite(result.stats?.passes) && result.stats.passes > 0) {
                     return { passed: true };
@@ -538,7 +571,7 @@ export class RetryHandlerService {
         const errorOutput = stderr || stdout || `Test failed with exit code ${exitCode}`;
         return {
             passed: false,
-            error: errorOutput.substring(0, 1000), // Truncate long error messages
+            error: redactFailureText(errorOutput).substring(0, 1000), // Truncate long error messages
         };
     }
     calculateDelay(attempt, backoff, baseDelay, maxDelay) {
@@ -573,6 +606,7 @@ export class RetryHandlerService {
             attempts: result.attempts,
             passed: result.passed,
             error: result.finalError,
+            ...(result.unmatched ? { unmatched: true } : {}),
             timestamp: new Date(),
         });
         // Keep last 50 entries
@@ -616,4 +650,9 @@ export class RetryHandlerService {
         };
     }
 }
+const UNMATCHED = {
+    passed: false,
+    unmatched: true,
+    error: 'The retry filter matched no test, so nothing was rerun.',
+};
 //# sourceMappingURL=retry-handler.js.map

package/dist/domains/test-execution/services/retry-outcome.d.ts

@@ -0,0 +1,18 @@
+/**
+ * #1170: a run's final outcome after its failed tests were retried.
+ *
+ * A test that failed and then passed on a retry is passed, and flaky: it
+ * leaves `failed`/`failedTests`, its runner test case reads `passed` with
+ * `flaky: true`, and the run counts it in `flaky`. A test whose retries all
+ * failed, or whose retry matched no test, stays failed.
+ */
+import type { IRetryResult, ITestRunResult } from '../interfaces';
+/**
+ * Default retries of a failed test, shared by `aqe test execute` and MCP
+ * `test_execute_parallel` so both surfaces rerun a failure the same number of
+ * times (#1170).
+ */
+export declare const DEFAULT_TEST_RETRY_COUNT = 2;
+/** Attach the retry outcome to `run` and move tests that passed on retry from failed to passed. */
+export declare function applyRetryOutcome(run: ITestRunResult, retried: IRetryResult): void;
+//# sourceMappingURL=retry-outcome.d.ts.map

package/dist/domains/test-execution/services/retry-outcome.js

@@ -0,0 +1,53 @@
+/**
+ * #1170: a run's final outcome after its failed tests were retried.
+ *
+ * A test that failed and then passed on a retry is passed, and flaky: it
+ * leaves `failed`/`failedTests`, its runner test case reads `passed` with
+ * `flaky: true`, and the run counts it in `flaky`. A test whose retries all
+ * failed, or whose retry matched no test, stays failed.
+ */
+/**
+ * Default retries of a failed test, shared by `aqe test execute` and MCP
+ * `test_execute_parallel` so both surfaces rerun a failure the same number of
+ * times (#1170).
+ */
+export const DEFAULT_TEST_RETRY_COUNT = 2;
+/** Attach the retry outcome to `run` and move tests that passed on retry from failed to passed. */
+export function applyRetryOutcome(run, retried) {
+    const byId = new Map(run.failedTests.map(t => [t.testId, t]));
+    const outcomes = retried.tests ?? [];
+    const summary = {
+        totalRetries: retried.retried,
+        nowPassing: retried.nowPassing,
+        stillFailing: retried.stillFailing,
+        tests: outcomes.map(({ testId, ...outcome }) => ({
+            name: byId.get(testId)?.testName ?? testId,
+            file: byId.get(testId)?.file ?? '',
+            ...outcome,
+        })),
+    };
+    run.retries = summary;
+    const passedOnRetry = new Set(outcomes.filter(o => o.passed && !o.unmatched).map(o => o.testId));
+    const recovered = run.failedTests.filter(t => passedOnRetry.has(t.testId));
+    if (recovered.length === 0)
+        return;
+    run.failedTests = run.failedTests.filter(t => !passedOnRetry.has(t.testId));
+    run.failed = Math.max(0, run.failed - recovered.length);
+    run.passed += recovered.length;
+    run.flaky = (run.flaky ?? 0) + recovered.length;
+    if (run.failed === 0 && run.status === 'failed')
+        run.status = 'passed';
+    if (run.testCases) {
+        const pending = [...recovered];
+        run.testCases = run.testCases.map(testCase => {
+            if (testCase.status !== 'failed')
+                return testCase;
+            const index = pending.findIndex(t => t.testName === testCase.name && t.file === testCase.file);
+            if (index < 0)
+                return testCase;
+            pending.splice(index, 1);
+            return { ...testCase, status: 'passed', flaky: true };
+        });
+    }
+}
+//# sourceMappingURL=retry-outcome.js.map

package/dist/domains/test-execution/services/runner-test-cases.d.ts

@@ -6,6 +6,17 @@
  * derived from aggregate counts.
  */
 import type { ITestCaseResult } from '../interfaces';
+/**
+ * #1122: failure text goes back over MCP and into saved results, so
+ * credential-shaped values (e.g. a connection string) are redacted first.
+ * The text is not shortened here; callers apply their own caps.
+ */
+export declare function redactFailureText(text: string): string;
+/** Failed tests with `error` and `stack` redacted (#1122). */
+export declare function redactFailedTests<T extends {
+    error: string;
+    stack?: string;
+}>(tests: T[]): T[];
 /**
  * Test cases listed in a runner JSON report, or undefined when the report
  * has no per-test entries.

package/dist/domains/test-execution/services/runner-test-cases.js

@@ -5,19 +5,37 @@
  * test case with the runner's own name, status and duration; nothing is
  * derived from aggregate counts.
  */
+import { redactLogText } from '../../../logging/redaction.js';
 const SKIPPED_STATUSES = new Set(['skipped', 'pending', 'todo']);
 /** Upper bound on a reported failure message, so one stack cannot swamp the output. */
 const MAX_FAILURE_MESSAGE_LENGTH = 4000;
 function failureMessageOf(assertion) {
     if (!Array.isArray(assertion.failureMessages))
         return undefined;
-    const message = assertion.failureMessages.filter((m) => typeof m === 'string').join('\n').trim();
-    if (!message)
+    const joined = assertion.failureMessages.filter((m) => typeof m === 'string').join('\n').trim();
+    if (!joined)
         return undefined;
+    const message = redactFailureText(joined);
     return message.length > MAX_FAILURE_MESSAGE_LENGTH
         ? `${message.slice(0, MAX_FAILURE_MESSAGE_LENGTH)}… [truncated]`
         : message;
 }
+/**
+ * #1122: failure text goes back over MCP and into saved results, so
+ * credential-shaped values (e.g. a connection string) are redacted first.
+ * The text is not shortened here; callers apply their own caps.
+ */
+export function redactFailureText(text) {
+    return redactLogText(text, Number.POSITIVE_INFINITY);
+}
+/** Failed tests with `error` and `stack` redacted (#1122). */
+export function redactFailedTests(tests) {
+    return tests.map(test => ({
+        ...test,
+        error: redactFailureText(test.error),
+        ...(typeof test.stack === 'string' ? { stack: redactFailureText(test.stack) } : {}),
+    }));
+}
 function toStatus(status) {
     if (status === 'passed' || status === 'failed')
         return status;

package/dist/domains/test-execution/services/test-executor.js

@@ -17,8 +17,8 @@ import { secureRandom, secureRandomInt } from '../../../shared/utils/crypto-rand
 import { writeTestRunEvidence } from '../../quality-assessment/quality-evidence.js';
 import { istanbulLineHits } from '../../../coordination/handlers/handler-utils.js';
 import { fileCoverageKey } from '../../coverage-analysis/collected-metrics.js';
-import { mergeTestCases, testCasesFromRunnerReport } from './runner-test-cases.js';
-import { getTestRunnerExecutionError, TestRunnerExecutionError } from '../../../shared/test-runner-verdict.js';
+import { mergeTestCases, redactFailedTests, redactFailureText, testCasesFromRunnerReport } from './runner-test-cases.js';
+import { capDiagnostics, getTestRunnerExecutionError, TestRunnerExecutionError } from '../../../shared/test-runner-verdict.js';
 import { createVitestJsonReport } from '../../../shared/vitest-json-report.js';
 import { jestExactPathPattern, runnerFilePath } from '../../../shared/test-runner-args.js';
 import { getClaudeModelForTier } from '../../../shared/llm/model-registry.js';
@@ -76,7 +76,7 @@ export class TestExecutorService {
                 failed: results.failed,
                 skipped: results.skipped,
                 duration,
-                failedTests: results.failedTests,
+                failedTests: redactFailedTests(results.failedTests),
                 ...(results.testCases ? { testCases: results.testCases } : {}),
                 coverage: results.coverage,
                 fileCoverages: results.fileCoverages,
@@ -132,7 +132,7 @@ export class TestExecutorService {
                 failed: aggregated.failed,
                 skipped: aggregated.skipped,
                 duration,
-                failedTests: aggregated.failedTests,
+                failedTests: redactFailedTests(aggregated.failedTests),
                 ...(aggregated.testCases ? { testCases: aggregated.testCases } : {}),
                 coverage: aggregated.coverage,
                 fileCoverages: aggregated.fileCoverages,
@@ -260,7 +260,7 @@ export class TestExecutorService {
         if (!this.isLLMAnalysisAvailable() || failures.length === 0)
             return null;
         try {
-            const failureSummary = failures.slice(0, 5).map(f => `- ${f.testName}: ${f.error?.substring(0, 200) || 'Unknown error'}`).join('\n');
+            const failureSummary = failures.slice(0, 5).map(f => `- ${f.testName}: ${f.error ? redactFailureText(f.error).substring(0, 200) : 'Unknown error'}`).join('\n');
             const response = await this.llmRouter.chat({
                 model: this.getModelForTier(this.config.llmModelTier),
                 messages: [{
@@ -624,7 +624,7 @@ Provide:
         }
         catch (error) {
             return err(new Error(`Failed to parse test output for ${file}: ${toErrorMessage(error)}\n` +
-                `stdout: ${stdout.slice(0, 500)}\nstderr: ${stderr.slice(0, 500)}`));
+                `stdout: ${capDiagnostics(stdout, 500)}\nstderr: ${capDiagnostics(stderr, 500)}`));
         }
     }
     /**
@@ -880,7 +880,7 @@ Provide:
             ];
             for (const indicator of errorMessages) {
                 if (combinedOutput.includes(indicator)) {
-                    return err(new Error(`Test execution failed for ${file} (exit code ${exitCode}):\n${combinedOutput.slice(0, 1000)}`));
+                    return err(new Error(`Test execution failed for ${file} (exit code ${exitCode}):\n${capDiagnostics(combinedOutput, 1000)}`));
                 }
             }
         }
@@ -894,7 +894,7 @@ Provide:
         }
         // Could not parse output - return error with details
         return err(new Error(`Unable to parse test results for ${file}. Exit code: ${exitCode}\n` +
-            `Output: ${combinedOutput.slice(0, 500)}`));
+            `Output: ${capDiagnostics(combinedOutput, 500)}`));
     }
     /**
      * Create generic failure entries when we know tests failed but can't parse details

package/dist/domains/test-generation/coordinator.js

@@ -9,7 +9,7 @@
  */
 import { LoggerFactory } from '../../logging/index.js';
 import { v4 as uuidv4 } from 'uuid';
-import { readFile } from 'node:fs/promises';
+import { readConfinedText } from '../../shared/io/confined-read.js';
 import { ok, err, } from '../../shared/types/index.js';
 import { toError } from '../../shared/error-utils.js';
 // Opt-in free-tier local test generation (cross-pollination plan 06, D7-wire/D8/D9).
@@ -425,7 +425,7 @@ export class TestGenerationCoordinator extends BaseDomainCoordinator {
             return null;
         let code = '';
         try {
-            code = await readFile(src, 'utf8');
+            code = await readConfinedText(src, { outsideRoot: 'allow' }); // #1161
         }
         catch {
             return null; // unreadable → fall back

package/dist/domains/test-generation/plugin.js

@@ -4,6 +4,7 @@
  */
 import { err } from '../../shared/types/index.js';
 import { BaseDomainPlugin } from '../domain-interface.js';
+import { MAX_PAYLOAD_FILE_BYTES, requirePayloadFiles } from '../../shared/io/payload-path-guard.js';
 import { TestGenerationCoordinator, } from './coordinator.js';
 // D9: live routing-feedback so free-tier outcomes lift routing confidence.
 import { RoutingFeedbackCollector } from '../../routing/routing-feedback.js';
@@ -73,12 +74,16 @@ export class TestGenerationPlugin extends BaseDomainPlugin {
                     if (!this.coordinator) {
                         return err(new Error('Coordinator not initialized'));
                     }
-                    const sourceFiles = payload.sourceFiles;
                     const testType = payload.testType;
                     const framework = payload.framework;
-                    if (!sourceFiles || sourceFiles.length === 0) {
+                    if (!Array.isArray(payload.sourceFiles) || payload.sourceFiles.length === 0) {
                         return err(new Error('Invalid generate-tests payload: missing sourceFiles'));
                     }
+                    // #1126: the generator reads each file whole, so only project files.
+                    const confined = await requirePayloadFiles('generate-tests', 'sourceFiles', payload.sourceFiles, { maxBytes: MAX_PAYLOAD_FILE_BYTES });
+                    if (!confined.success)
+                        return confined;
+                    const sourceFiles = confined.value;
                     const request = {
                         sourceFiles,
                         testType: testType ?? 'unit',

package/dist/domains/test-generation/services/pattern-matcher.js

@@ -7,7 +7,7 @@
  */
 import { v4 as uuidv4 } from 'uuid';
 import ts from 'typescript';
-import * as fs from 'fs';
+import { readConfinedTextSync } from '../../../shared/io/confined-read.js';
 import * as path from 'path';
 import { ok, err } from '../../../shared/types/index.js';
 import { NomicEmbedder, EMBEDDING_CONFIG } from '../../../shared/embeddings/index.js';
@@ -45,7 +45,7 @@ export class PatternMatcherService {
             // Read file content
             let content;
             try {
-                content = fs.readFileSync(filePath, 'utf-8');
+                content = readConfinedTextSync(filePath, { outsideRoot: 'allow' }); // #1161
             }
             catch {
                 return err(new Error(`Cannot read file: ${filePath}`));
@@ -737,7 +737,7 @@ export class PatternMatcherService {
             // Read the file content
             let content;
             try {
-                content = fs.readFileSync(file, 'utf-8');
+                content = readConfinedTextSync(file, { outsideRoot: 'allow' }); // #1161
             }
             catch {
                 // File doesn't exist or can't be read, return empty
@@ -1068,7 +1068,7 @@ class TypeScriptASTParser {
             this.sourceCode = content;
         }
         else {
-            this.sourceCode = fs.readFileSync(filePath, 'utf-8');
+            this.sourceCode = readConfinedTextSync(filePath, { outsideRoot: 'allow' }); // #1161
         }
         this.sourceFile = ts.createSourceFile(path.basename(filePath), this.sourceCode, ts.ScriptTarget.Latest, true, ts.ScriptKind.TS);
         return this.sourceFile;

package/dist/domains/test-generation/services/test-data-generator.js

@@ -230,7 +230,9 @@ export class TestDataGeneratorService {
             const parts = methodPath.split('.');
             let result = f;
             for (const part of parts) {
-                if (result && typeof result === 'object' && part in result) {
+                // #1136: a member every object inherits (`constructor`, `toString`)
+                // is not a faker method.
+                if (result && typeof result === 'object' && part in result && !(part in Object.prototype)) {
                     const next = result[part];
                     if (typeof next === 'function') {
                         result = next();

package/dist/domains/test-generation/services/test-generator.js

@@ -10,7 +10,7 @@ import { generateBehaviorExamples } from './behavior-examples.js';
 import { validateBehaviorExamples } from './behavior-example-validation.js';
 import { LoggerFactory } from '../../../logging/index.js';
 import { v4 as uuidv4 } from 'uuid';
-import * as fs from 'fs';
+import { readConfinedTextSync } from '../../../shared/io/confined-read.js';
 import * as path from 'path';
 import ts from 'typescript';
 import { ok, err } from '../../../shared/types/index.js';
@@ -445,7 +445,7 @@ Return a JSON array of test suggestions, each with: { "name": "test name", "desc
         let codeAnalysis = null;
         let sourceContent = '';
         try {
-            sourceContent = fs.readFileSync(sourceFile, 'utf-8');
+            sourceContent = readConfinedTextSync(sourceFile, { outsideRoot: 'allow' }); // #1161
             codeAnalysis = await this.analyzeSourceCode(sourceContent, sourceFile);
         }
         catch {

package/dist/domains/visual-accessibility/services/axe-core-audit.js

@@ -85,7 +85,7 @@ export class AccessibilityAuditor {
         // Check for vibium
         try {
             await loadVibium();
-            this.toolsAvailable.vibium = isVibiumReady();
+            this.toolsAvailable.vibium = await isVibiumReady();
         }
         catch {
             this.toolsAvailable.vibium = false;

package/dist/governance/evolution-pipeline-integration.js

@@ -19,6 +19,7 @@
 import { governanceFlags } from './feature-flags.js';
 import { getUnifiedMemory } from '../kernel/unified-memory.js';
 import { toErrorMessage } from '../shared/error-utils.js';
+import { createSafeRecord } from '../shared/utils/safe-record.js';
 // ============================================================================
 // Feature Flag Helpers
 // ============================================================================
@@ -799,7 +800,8 @@ export class EvolutionPipelineIntegration {
      * Group array by key function
      */
     groupBy(array, keyFn) {
-        const groups = {};
+        // #1157: keys come from recorded rule applications.
+        const groups = createSafeRecord();
         for (const item of array) {
             const key = keyFn(item);
             if (!groups[key]) {

package/dist/hooks/cross-phase-hooks.js

@@ -12,6 +12,7 @@ import { join } from 'path';
 import { parse as parseYaml } from 'yaml';
 import { getCrossPhaseMemory, } from '../memory/cross-phase-memory.js';
 import { captureHooksConfigSnapshot, validateHookUrl, classifyHookExit, } from './security/index.js';
+import { createSafeRecord } from '../shared/utils/safe-record.js';
 // =============================================================================
 // Hook Executor
 // =============================================================================
@@ -79,7 +80,8 @@ export class CrossPhaseHookExecutor {
         // IMP-07: Runtime kill-switch check
         if (process.env.AQE_HOOKS_DISABLED === 'true')
             return {};
-        const injectedSignals = {};
+        // #1157: agent names come from the hooks YAML file.
+        const injectedSignals = createSafeRecord();
         const matchingHooks = this.filterManagedHooks(Object.entries(this.config.hooks).filter(([_, hook]) => hook.trigger.event === 'phase-start' &&
             hook.trigger.phase === phaseName));
         for (const [hookName, hook] of matchingHooks) {
@@ -332,7 +334,8 @@ export class CrossPhaseHookExecutor {
     }
     getValueFromPath(obj, path) {
         return path.split('.').reduce((curr, key) => {
-            if (curr && typeof curr === 'object' && key in curr) {
+            // #1136: own properties only.
+            if (curr && typeof curr === 'object' && Object.hasOwn(curr, key)) {
                 return curr[key];
             }
             return undefined;