agentic-qe 3.13.0 → 3.13.2

package/dist/init/codex-installer.js

@@ -5,8 +5,9 @@
  *
  * Follows the OpenCode/Kiro installer pattern (ADR-025).
  */
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
+import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync, } from 'fs';
 import { join, dirname } from 'path';
+import { fileURLToPath } from 'url';
 import { toErrorMessage } from '../shared/error-utils.js';
 import { createPlatformConfigGenerator, } from './platform-config-generator.js';
 // ============================================================================
@@ -28,9 +29,13 @@ export class CodexInstaller {
             success: true,
             mcpConfigured: false,
             agentsMdInstalled: false,
+            hooksConfigured: false,
+            skillsInstalled: 0,
             errors: [],
             configPath: '',
             agentsMdPath: '',
+            hooksPath: join(this.projectRoot, '.codex', 'hooks.json'),
+            skillsPath: join(this.projectRoot, '.agents', 'skills'),
         };
         try {
             // Generate TOML MCP config
@@ -65,6 +70,8 @@ export class CodexInstaller {
                 }
                 result.agentsMdInstalled = true;
             }
+            this.installCodexHooks(result);
+            result.skillsInstalled = this.installCodexSkills();
         }
         catch (error) {
             result.success = false;
@@ -72,6 +79,120 @@ export class CodexInstaller {
         }
         return result;
     }
+    /**
+     * Install Codex-native lifecycle adapters and merge AQE/ruflo hook groups
+     * without removing user-defined hooks.
+     */
+    installCodexHooks(result) {
+        const sourceRoot = this.resolvePackageRoot();
+        if (!sourceRoot)
+            return;
+        const sourceConfig = join(sourceRoot, '.codex', 'hooks.json');
+        const sourceScripts = join(sourceRoot, '.codex', 'hooks');
+        if (!existsSync(sourceConfig) || !existsSync(sourceScripts))
+            return;
+        const targetCodexDir = join(this.projectRoot, '.codex');
+        const targetScripts = join(targetCodexDir, 'hooks');
+        mkdirSync(targetScripts, { recursive: true });
+        for (const file of readdirSync(sourceScripts)) {
+            const source = join(sourceScripts, file);
+            if (!statSync(source).isFile())
+                continue;
+            const target = join(targetScripts, file);
+            if (!existsSync(target) || this.overwrite) {
+                copyFileSync(source, target);
+            }
+        }
+        const runtimes = [
+            {
+                source: join(sourceRoot, '.claude', 'hooks', 'aqe-hook.cjs'),
+                target: join(targetScripts, 'aqe-runtime.cjs'),
+            },
+            {
+                source: join(sourceRoot, '.claude', 'helpers', 'ruflo-hook.cjs'),
+                target: join(targetScripts, 'ruflo-runtime.cjs'),
+            },
+        ];
+        for (const runtime of runtimes) {
+            if (existsSync(runtime.source) && (!existsSync(runtime.target) || this.overwrite)) {
+                copyFileSync(runtime.source, runtime.target);
+            }
+        }
+        const generated = JSON.parse(readFileSync(sourceConfig, 'utf-8'));
+        const targetConfig = join(targetCodexDir, 'hooks.json');
+        if (!existsSync(targetConfig)) {
+            writeFileSync(targetConfig, JSON.stringify(generated, null, 2) + '\n');
+            result.hooksConfigured = true;
+            return;
+        }
+        if (!this.overwrite)
+            return;
+        const existing = JSON.parse(readFileSync(targetConfig, 'utf-8'));
+        const owned = (value) => JSON.stringify(value).includes('/.codex/hooks/aqe-codex-hook.cjs')
+            || JSON.stringify(value).includes('/.codex/hooks/ruflo-codex-hook.cjs');
+        const mergedHooks = {};
+        const events = new Set([
+            ...Object.keys(existing.hooks || {}),
+            ...Object.keys(generated.hooks || {}),
+        ]);
+        for (const event of events) {
+            const userGroups = (existing.hooks?.[event] || []).filter((group) => !owned(group));
+            mergedHooks[event] = [...userGroups, ...(generated.hooks?.[event] || [])];
+        }
+        writeFileSync(targetConfig, JSON.stringify({ ...existing, description: generated.description, hooks: mergedHooks }, null, 2) + '\n');
+        result.hooksConfigured = true;
+    }
+    /** Install the curated repo-scoped AQE skills Codex discovers automatically. */
+    installCodexSkills() {
+        const sourceRoot = this.resolvePackageRoot();
+        if (!sourceRoot)
+            return 0;
+        const sourceSkills = join(sourceRoot, '.agents', 'skills');
+        if (!existsSync(sourceSkills))
+            return 0;
+        const targetSkills = join(this.projectRoot, '.agents', 'skills');
+        mkdirSync(targetSkills, { recursive: true });
+        let installed = 0;
+        for (const skill of readdirSync(sourceSkills)) {
+            if (!skill.startsWith('aqe-'))
+                continue;
+            const source = join(sourceSkills, skill);
+            if (!statSync(source).isDirectory())
+                continue;
+            const target = join(targetSkills, skill);
+            if (existsSync(target) && !this.overwrite)
+                continue;
+            this.copyDirectory(source, target);
+            installed++;
+        }
+        return installed;
+    }
+    copyDirectory(source, target) {
+        mkdirSync(target, { recursive: true });
+        for (const entry of readdirSync(source)) {
+            const from = join(source, entry);
+            const to = join(target, entry);
+            if (statSync(from).isDirectory()) {
+                this.copyDirectory(from, to);
+            }
+            else {
+                copyFileSync(from, to);
+            }
+        }
+    }
+    resolvePackageRoot() {
+        const moduleDir = dirname(fileURLToPath(import.meta.url));
+        const candidates = [
+            join(moduleDir, '..', '..'),
+            // esbuild bundles this module into dist/cli/bundle.js, so import.meta.url
+            // no longer identifies src/init/codex-installer.ts. Resolve from the
+            // running CLI entrypoint as the authoritative packaged layout.
+            join(dirname(process.argv[1] || ''), '..', '..'),
+            join(this.projectRoot, 'node_modules', 'agentic-qe'),
+        ];
+        return candidates.find((candidate) => existsSync(join(candidate, '.codex', 'hooks.json'))
+            || existsSync(join(candidate, '.agents', 'skills')));
+    }
     /**
      * Merge AQE MCP server config into existing TOML.
      * Simple approach: if [mcp_servers.agentic-qe] already exists, skip.

package/dist/init/phases/09-assets.js

@@ -303,6 +303,10 @@ export class AssetsPhase extends BasePhase {
                 context.services.log(`  Codex MCP: ${res.configPath}`);
             if (res.agentsMdInstalled)
                 context.services.log(`  Codex AGENTS.md: ${res.agentsMdPath}`);
+            if (res.hooksConfigured)
+                context.services.log(`  Codex hooks: ${res.hooksPath}`);
+            if (res.skillsInstalled > 0)
+                context.services.log(`  Codex skills: ${res.skillsInstalled} installed`);
         }
         if (options.withWindsurf || (options.autoMode && existsSync(join(projectRoot, '.windsurf')))) {
             const { createWindsurfInstaller } = await import('../windsurf-installer.js');

package/dist/init/phases/phase-interface.d.ts

@@ -119,7 +119,7 @@ export interface InitOptions {
     withKiloCode?: boolean;
     /** Install Roo Code MCP config and custom mode */
     withRooCode?: boolean;
-    /** Install OpenAI Codex CLI MCP config and AGENTS.md */
+    /** Install OpenAI Codex CLI MCP, AGENTS.md, hooks, and QE skills */
     withCodex?: boolean;
     /** Install Windsurf MCP config and rules */
     withWindsurf?: boolean;

package/dist/integrations/ruvector/rvf-store-integrity.js

@@ -84,7 +84,11 @@ export function isLockHeldByLiveProcess(rvfPath) {
     const pid = readLockOwnerPid(rvfPath);
     if (pid === null)
         return false;
-    return pid !== process.pid && isPidAlive(pid);
+    // A same-PID lock can belong to another adapter initialized through a
+    // different in-process path. PID equality does not prove that handle was
+    // closed, and breaking the lock can quarantine/replace a store that this
+    // process still has open. Treat every live owner conservatively.
+    return isPidAlive(pid);
 }
 /**
  * Move an unusable store and its sidecars aside so the next create succeeds.

package/dist/integrations/ruvector/shared-rvf-adapter.js

@@ -136,11 +136,11 @@ function openOrCreateRvf(openFn, createFn, rvfPath, dimensions) {
     // prior process is dead and the lock is stale". We unlink the .lock and
     // retry open exactly once.
     //
-    // Issue #563: the lock record turns out to carry its owner's pid (u32 LE at
-    // offset 4, after the `FLVR` magic), so "is it stale?" is now a check rather
-    // than an assumption. This previously unlinked the lock unconditionally,
-    // which breaks a genuinely-live peer — the one case the old comment admitted
-    // it could not distinguish.
+    // Issue #563: the lock record carries its owner's pid (u32 LE at offset 4,
+    // after the `FLVR` magic), so "is it stale?" is a check rather than an
+    // assumption. This includes a lock owned by the current PID: another
+    // in-process adapter may still hold the store, so PID equality is not proof
+    // that the lock can be removed safely.
     if (!opened && isLockHeld(openErr)) {
         try {
             // eslint-disable-next-line @typescript-eslint/no-require-imports

package/dist/learning/real-embeddings.js

@@ -125,7 +125,21 @@ async function initializeModel(config = {}) {
                 return;
             }
             // In-process branch — only here do we import the transformers package.
-            const transformers = await import('@huggingface/transformers');
+            // #565: `@huggingface/transformers` is NOT installed automatically (it
+            // transitively pulls onnxruntime-node -> adm-zip <0.6.0, GHSA-xcpc-8h2w-3j85,
+            // which upstream has not fixed). Users who want in-process embeddings opt in
+            // explicitly; everyone else uses an embedding endpoint. Translate the raw
+            // module-resolution failure into actionable guidance.
+            let transformers;
+            try {
+                transformers = await import('@huggingface/transformers');
+            }
+            catch {
+                throw new Error('In-process embeddings require the optional package "@huggingface/transformers", ' +
+                    'which is not installed. Either run `npm install @huggingface/transformers`, or ' +
+                    'configure an embedding endpoint (EmbeddingConfig.endpoint / AQE_EMBEDDING_ENDPOINT) ' +
+                    'so no local model is loaded.');
+            }
             pipeline = transformers.pipeline;
             console.log(`[RealEmbeddings] Loading model: ${fullConfig.modelName}`);
             const startTime = performance.now();