agentic-qe 3.14.4 → 3.14.6

package/dist/planning/plan-executor.js

@@ -24,6 +24,7 @@ const DEFAULT_CONFIG = {
     maxRetries: 2,
     stepTimeoutMs: 60000,
     replanOnFailure: true,
+    maxReplans: 3,
     parallelExecution: false,
     recordWorldState: true,
     useUnified: true, // ADR-046: Default to unified storage
@@ -44,6 +45,24 @@ function safeStringify(value, maxLength = 2000) {
         return String(value);
     }
 }
+/**
+ * Issue #535: render the `error` of a domain Result err as text — an Error's
+ * message, a string as-is, else a (truncated) JSON rendering.
+ */
+function describeDomainError(reason) {
+    if (reason === undefined || reason === null)
+        return 'unknown error';
+    if (reason instanceof Error || typeof reason === 'string')
+        return toErrorMessage(reason);
+    const message = reason.message;
+    return typeof message === 'string' ? message : safeStringify(reason, 500);
+}
+/**
+ * Issue #535: goap_execution_steps marker row recording that an execution
+ * was cancelled (see persistExecutionResult). Excluded from step lists.
+ */
+const CANCELLED_MARKER_ACTION_ID = '__execution_cancelled__';
+const CANCELLED_MARKER_STATUS = 'cancelled';
 // ============================================================================
 // Plan Executor Class
 // ============================================================================
@@ -200,9 +219,30 @@ export class PlanExecutor {
      */
     async executeWithCallbacks(plan, onStepStart, onStepComplete, initialState) {
         await this.initialize();
-        const startTime = Date.now();
         const executionId = `exec-${Date.now()}-${randomUUID().slice(0, 8)}`;
         this.currentExecution = { planId: plan.id, cancelled: false };
+        try {
+            const result = await this.runPlan(plan, onStepStart, onStepComplete, initialState, {
+                excludedActions: new Set(),
+                replanDepth: 0,
+            });
+            // Persist once per top-level execution. Issue #535: replanned
+            // sub-plans used to persist their own steps AND hand them back to the
+            // parent, which persisted them again under the same step ids
+            // ("UNIQUE constraint failed: goap_execution_steps.id").
+            await this.persistExecutionResult(executionId, result);
+            return result;
+        }
+        finally {
+            this.currentExecution = null;
+        }
+    }
+    /**
+     * Run a plan's steps (and any replacement plans after a failure) without
+     * persisting or resetting execution tracking — see executeWithCallbacks.
+     */
+    async runPlan(plan, onStepStart, onStepComplete, initialState, replan) {
+        const startTime = Date.now();
         const result = {
             planId: plan.id,
             status: 'completed',
@@ -222,106 +262,115 @@ export class PlanExecutor {
             stepOrder: index,
             status: 'pending',
         }));
-        try {
-            for (const step of steps) {
-                // Check for cancellation
-                if (this.currentExecution?.cancelled) {
-                    result.status = 'cancelled';
-                    result.error = 'Execution was cancelled';
+        for (const step of steps) {
+            // Check for cancellation
+            if (this.currentExecution?.cancelled) {
+                result.status = 'cancelled';
+                result.error = 'Execution was cancelled';
+                break;
+            }
+            // Record world state before execution
+            if (this.config.recordWorldState) {
+                step.worldStateBefore = this.cloneState(currentState);
+            }
+            // Notify step start
+            onStepStart(step);
+            // Execute with retries
+            let success = false;
+            let lastError;
+            let retries = 0;
+            let output;
+            let agentId;
+            const stepStartTime = Date.now();
+            for (let attempt = 0; attempt <= this.config.maxRetries; attempt++) {
+                const execResult = await this.executeStep(step, currentState);
+                if (execResult.success) {
+                    success = true;
+                    currentState = execResult.newState;
+                    output = execResult.output;
+                    agentId = execResult.agentId;
                     break;
                 }
-                // Record world state before execution
-                if (this.config.recordWorldState) {
-                    step.worldStateBefore = this.cloneState(currentState);
-                }
-                // Notify step start
-                onStepStart(step);
-                // Execute with retries
-                let success = false;
-                let lastError;
-                let retries = 0;
-                let output;
-                let agentId;
-                const stepStartTime = Date.now();
-                for (let attempt = 0; attempt <= this.config.maxRetries; attempt++) {
-                    const execResult = await this.executeStep(step, currentState);
-                    if (execResult.success) {
-                        success = true;
-                        currentState = execResult.newState;
-                        output = execResult.output;
-                        agentId = execResult.agentId;
-                        break;
-                    }
-                    lastError = execResult.error;
-                    retries = attempt;
-                    // Wait before retry (exponential backoff)
-                    if (attempt < this.config.maxRetries) {
-                        await this.delay(Math.min(1000 * Math.pow(2, attempt), 5000));
-                    }
+                lastError = execResult.error;
+                retries = attempt;
+                // Issue #535: deterministic failures (no implementation, domain
+                // not loaded, missing method, unmet preconditions) cannot succeed
+                // on retry — don't burn seconds of backoff on them.
+                if (execResult.retryable === false) {
+                    break;
                 }
-                // Record executed step
-                const executedStep = {
-                    ...step,
-                    status: success ? 'completed' : 'failed',
-                    retries,
-                    startedAt: new Date(stepStartTime),
-                    completedAt: new Date(),
-                    durationMs: Date.now() - stepStartTime,
-                    agentId,
-                    agentOutput: output,
-                    worldStateAfter: this.config.recordWorldState
-                        ? this.cloneState(currentState)
-                        : undefined,
-                    error: lastError,
-                };
-                result.steps.push(executedStep);
-                onStepComplete(executedStep);
-                if (success) {
-                    result.stepsCompleted++;
-                    await this.updateActionStats(step.action.id, true, executedStep.durationMs ?? 0);
+                // Wait before retry (exponential backoff)
+                if (attempt < this.config.maxRetries) {
+                    await this.delay(Math.min(1000 * Math.pow(2, attempt), 5000));
                 }
-                else {
-                    result.stepsFailed++;
-                    await this.updateActionStats(step.action.id, false, 0);
-                    // Try to replan if configured
-                    if (this.config.replanOnFailure) {
-                        const newPlan = await this.replanFromFailure(plan, step.stepOrder, currentState);
-                        if (newPlan) {
-                            // Execute new plan recursively
-                            const replanResult = await this.executeWithCallbacks(newPlan, onStepStart, onStepComplete, currentState);
-                            result.steps.push(...replanResult.steps);
-                            result.stepsCompleted += replanResult.stepsCompleted;
-                            result.stepsFailed += replanResult.stepsFailed;
-                            if (replanResult.status === 'completed' && replanResult.finalWorldState) {
-                                currentState = replanResult.finalWorldState;
-                            }
-                            else {
-                                result.status = 'partial';
-                                result.error = `Replanning partially succeeded: ${replanResult.error || 'unknown error'}`;
-                            }
+            }
+            // Record executed step
+            const executedStep = {
+                ...step,
+                status: success ? 'completed' : 'failed',
+                retries,
+                startedAt: new Date(stepStartTime),
+                completedAt: new Date(),
+                durationMs: Date.now() - stepStartTime,
+                agentId,
+                agentOutput: output,
+                worldStateAfter: this.config.recordWorldState
+                    ? this.cloneState(currentState)
+                    : undefined,
+                error: lastError,
+            };
+            result.steps.push(executedStep);
+            onStepComplete(executedStep);
+            if (success) {
+                result.stepsCompleted++;
+                await this.updateActionStats(step.action.id, true, executedStep.durationMs ?? 0);
+            }
+            else {
+                result.stepsFailed++;
+                await this.updateActionStats(step.action.id, false, 0);
+                // Try to replan if configured (bounded — issue #535)
+                const maxReplans = this.config.maxReplans ?? 3;
+                if (this.config.replanOnFailure && replan.replanDepth < maxReplans) {
+                    // Accumulate exclusions across successive replans so a chain of
+                    // failures can't bounce back to an action that already failed.
+                    replan.excludedActions.add(step.action.id);
+                    const newPlan = await this.replanFromFailure(plan, step.stepOrder, currentState, [...replan.excludedActions]);
+                    if (newPlan) {
+                        const replanResult = await this.runPlan(newPlan, onStepStart, onStepComplete, currentState, { excludedActions: replan.excludedActions, replanDepth: replan.replanDepth + 1 });
+                        result.steps.push(...replanResult.steps);
+                        result.stepsCompleted += replanResult.stepsCompleted;
+                        result.stepsFailed += replanResult.stepsFailed;
+                        if (replanResult.status === 'completed' && replanResult.finalWorldState) {
+                            currentState = replanResult.finalWorldState;
                         }
                         else {
-                            result.status = 'failed';
-                            result.error = `Step ${step.stepOrder} failed and replanning unsuccessful: ${lastError}`;
-                            break;
+                            // The goal was not reached — report it as such rather than
+                            // the old 'partial' ("Replanning partially succeeded").
+                            result.status = replanResult.status === 'cancelled' ? 'cancelled' : 'failed';
+                            result.error =
+                                `Step ${step.stepOrder} failed (${lastError}); replanning did not recover: ` +
+                                    `${replanResult.error || 'unknown error'}`;
                         }
+                        // The replacement plan supersedes the rest of this plan —
+                        // don't keep executing stale steps after it.
+                        break;
                     }
                     else {
                         result.status = 'failed';
-                        result.error = `Step ${step.stepOrder} failed: ${lastError}`;
+                        result.error = `Step ${step.stepOrder} failed and replanning unsuccessful: ${lastError}`;
                         break;
                     }
                 }
+                else {
+                    result.status = 'failed';
+                    result.error = `Step ${step.stepOrder} failed: ${lastError}`;
+                    break;
+                }
             }
-            result.finalWorldState = currentState;
-            result.totalDurationMs = Date.now() - startTime;
-            // Persist execution result
-            await this.persistExecutionResult(executionId, result);
-            return result;
-        }
-        finally {
-            this.currentExecution = null;
         }
+        result.finalWorldState = currentState;
+        result.totalDurationMs = Date.now() - startTime;
+        return result;
     }
     /**
      * Execute a single step
@@ -334,6 +383,7 @@ export class PlanExecutor {
                 success: false,
                 newState: currentState,
                 error: `Preconditions not met for action: ${action.name}`,
+                retryable: false,
             };
         }
         // A14: an action explicitly marked as having no real domain backing
@@ -347,6 +397,7 @@ export class PlanExecutor {
                 success: false,
                 newState: currentState,
                 error: `Action '${action.name}' has no real implementation yet (not simulated — see GOAPAction.implemented)`,
+                retryable: false,
             };
         }
         // A14: real dispatch — opt-in via constructor-injected getDomainAPI
@@ -359,9 +410,7 @@ export class PlanExecutor {
         const taskDescription = this.buildTaskDescription(action);
         try {
             // Execute with timeout
-            const timeoutPromise = new Promise((_, reject) => setTimeout(() => reject(new Error(`Step timeout after ${this.config.stepTimeoutMs}ms`)), this.config.stepTimeoutMs));
-            const spawnPromise = this.spawner.spawn(action.agentType, taskDescription);
-            const agentResult = await Promise.race([spawnPromise, timeoutPromise]);
+            const agentResult = await this.withStepTimeout(this.spawner.spawn(action.agentType, taskDescription));
             if (agentResult.success) {
                 // Apply action effects to world state
                 const newState = this.applyEffects(currentState, action.effects);
@@ -404,6 +453,7 @@ export class PlanExecutor {
                 success: false,
                 newState: currentState,
                 error: `Action '${action.name}' has no qeDomain to resolve a real API from`,
+                retryable: false,
             };
         }
         if (!action.method) {
@@ -411,6 +461,7 @@ export class PlanExecutor {
                 success: false,
                 newState: currentState,
                 error: `Action '${action.name}' is marked implemented but has no method binding`,
+                retryable: false,
             };
         }
         let api;
@@ -429,6 +480,7 @@ export class PlanExecutor {
                 success: false,
                 newState: currentState,
                 error: `Domain '${action.qeDomain}' is not available (kernel not initialized, or the domain isn't loaded — try fleet_init)`,
+                retryable: false,
             };
         }
         const method = api[action.method];
@@ -437,12 +489,28 @@ export class PlanExecutor {
                 success: false,
                 newState: currentState,
                 error: `Domain '${action.qeDomain}' has no method '${action.method}'`,
+                retryable: false,
             };
         }
         try {
-            const timeoutPromise = new Promise((_, reject) => setTimeout(() => reject(new Error(`Step timeout after ${this.config.stepTimeoutMs}ms`)), this.config.stepTimeoutMs));
             const invokePromise = method.call(api, action.params ?? {});
-            const result = await Promise.race([invokePromise, timeoutPromise]);
+            const result = await this.withStepTimeout(invokePromise);
+            // Issue #535: domain APIs return Result<T, Error> ({ success: false,
+            // error }) rather than throwing. Treating any resolved value as
+            // success reported e.g. detectGaps({}) -> err("missing coverageData")
+            // as a completed step and applied its effects — a fabricated success.
+            if (typeof result === 'object' &&
+                result !== null &&
+                result.success === false) {
+                const reason = result.error;
+                return {
+                    success: false,
+                    newState: currentState,
+                    agentId: `domain:${action.qeDomain}`,
+                    error: `Domain '${action.qeDomain}' method '${action.method}' returned an error: ` +
+                        describeDomainError(reason),
+                };
+            }
             const newState = this.applyEffects(currentState, action.effects);
             return {
                 success: true,
@@ -459,6 +527,25 @@ export class PlanExecutor {
             };
         }
     }
+    /**
+     * Race `work` against the per-step timeout, clearing the timer once the
+     * race settles so completed steps don't leave a pending timer behind
+     * (codex review, #535: it kept short-lived processes alive for up to
+     * stepTimeoutMs and accumulated timers across executions).
+     */
+    async withStepTimeout(work) {
+        let timer;
+        const timeout = new Promise((_, reject) => {
+            timer = setTimeout(() => reject(new Error(`Step timeout after ${this.config.stepTimeoutMs}ms`)), this.config.stepTimeoutMs);
+        });
+        try {
+            return await Promise.race([work, timeout]);
+        }
+        finally {
+            if (timer !== undefined)
+                clearTimeout(timer);
+        }
+    }
     /**
      * Build a task description for an agent
      */
@@ -494,11 +581,12 @@ export class PlanExecutor {
      * @param currentState - Current world state at failure point
      * @returns New plan or null if replanning fails
      */
-    async replanFromFailure(originalPlan, failedStepIndex, currentState) {
+    async replanFromFailure(originalPlan, failedStepIndex, currentState, additionalExcluded = []) {
         try {
-            // Exclude the failed action from replanning
+            // Exclude the failed action (and any that failed earlier in this
+            // execution) from replanning
             const failedAction = originalPlan.actions[failedStepIndex];
-            const excludedActions = [failedAction.id];
+            const excludedActions = [...new Set([failedAction.id, ...additionalExcluded])];
             // Try to find a new plan
             const newPlan = await this.planner.findPlan(currentState, originalPlan.goalState, { excludedActions });
             return newPlan;
@@ -555,7 +643,8 @@ export class PlanExecutor {
         SUM(CASE WHEN status = 'completed' THEN 1 ELSE 0 END) as steps_completed,
         SUM(CASE WHEN status = 'failed' THEN 1 ELSE 0 END) as steps_failed,
         SUM(COALESCE(duration_ms, 0)) as total_duration_ms,
-        COUNT(*) as steps_recorded,
+        SUM(CASE WHEN action_id = '${CANCELLED_MARKER_ACTION_ID}' THEN 0 ELSE 1 END) as steps_recorded,
+        SUM(CASE WHEN action_id = '${CANCELLED_MARKER_ACTION_ID}' THEN 1 ELSE 0 END) as cancelled_markers,
         MAX(CASE WHEN status = 'failed' THEN error_message END) as last_error
       FROM goap_execution_steps
     `;
@@ -571,9 +660,18 @@ export class PlanExecutor {
             const steps = await this.getExecutedSteps(row.execution_id);
             const finalWorldState = [...steps].reverse().find((s) => s.worldStateAfter)?.worldStateAfter;
             const plannedStepCount = this.getPlannedActionCount(row.plan_id);
+            // Issue #535: a failed step followed by a successful replacement plan
+            // is a recovered (completed) execution; only a run that ENDS on a
+            // failed step failed. Without failures, fewer recorded steps than
+            // planned means it was cancelled.
+            const lastStep = steps[steps.length - 1];
             let status;
-            if (row.steps_failed > 0)
+            if (row.cancelled_markers > 0)
+                status = 'cancelled';
+            else if (lastStep?.status === 'failed')
                 status = 'failed';
+            else if (row.steps_failed > 0)
+                status = 'completed';
             else if (plannedStepCount != null && row.steps_recorded < plannedStepCount)
                 status = 'cancelled';
             else
@@ -605,8 +703,8 @@ export class PlanExecutor {
      */
     async getExecutedSteps(executionId) {
         const rows = this.db
-            .prepare(`SELECT * FROM goap_execution_steps WHERE execution_id = ? ORDER BY step_order`)
-            .all(executionId);
+            .prepare(`SELECT * FROM goap_execution_steps WHERE execution_id = ? AND action_id != ? ORDER BY step_order`)
+            .all(executionId, CANCELLED_MARKER_ACTION_ID);
         return rows.map((row) => ({
             id: row.id,
             planId: row.plan_id,
@@ -662,8 +760,19 @@ export class PlanExecutor {
         agent_output, world_state_before, world_state_after, error_message
       ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
     `);
-        for (const step of result.steps) {
-            insertStep.run(step.id, step.planId, executionId, step.action.id, step.stepOrder, step.status, step.retries, step.startedAt.toISOString(), step.durationMs ?? null, step.agentId ?? null, step.agentOutput ?? null, step.worldStateBefore ? JSON.stringify(step.worldStateBefore) : null, step.worldStateAfter ? JSON.stringify(step.worldStateAfter) : null, step.error ?? null);
+        // Issue #535: steps from replacement plans (replanning) are recorded
+        // under the top-level plan id with a chronological step order, so one
+        // execution is one history record for the plan the caller executed —
+        // not split across sub-plan ids with colliding step orders.
+        result.steps.forEach((step, index) => {
+            insertStep.run(step.id, result.planId, executionId, step.action.id, index, step.status, step.retries, step.startedAt.toISOString(), step.durationMs ?? null, step.agentId ?? null, step.agentOutput ?? null, step.worldStateBefore ? JSON.stringify(step.worldStateBefore) : null, step.worldStateAfter ? JSON.stringify(step.worldStateAfter) : null, step.error ?? null);
+        });
+        // Issue #535 (codex review): an execution's cancellation cannot be
+        // inferred from its step rows once replanning is involved (the step
+        // count no longer matches the executed plan's action count), so record
+        // it explicitly with a marker row that history reads and then hides.
+        if (result.status === 'cancelled') {
+            insertStep.run(`${executionId}-${CANCELLED_MARKER_STATUS}`, result.planId, executionId, CANCELLED_MARKER_ACTION_ID, result.steps.length, CANCELLED_MARKER_STATUS, 0, new Date().toISOString(), null, null, null, null, null, result.error ?? 'Execution was cancelled');
         }
         // Reflects only the most recent execution attempt for this plan — a
         // deliberate, documented scope limit: goap_plans is one row per plan,

package/dist/planning/types.d.ts

@@ -220,6 +220,12 @@ export interface PlanConstraints {
     maxCost?: number;
     /** Maximum total duration in milliseconds */
     maxDurationMs?: number;
+    /**
+     * Maximum number of actions (steps) in the returned plan. Must be a
+     * positive integer; the planner rejects anything else. Defaults to
+     * DEFAULT_MAX_PLAN_STEPS when omitted. Issue #535.
+     */
+    maxSteps?: number;
     /** Only use actions that these agent types can execute */
     requiredAgentTypes?: string[];
     /** Exclude these specific action IDs */
@@ -227,6 +233,16 @@ export interface PlanConstraints {
     /** Prefer actions in these QE domains */
     preferredQeDomains?: QEDomain[];
 }
+/**
+ * Default A* depth limit (plan length cap) when constraints.maxSteps is unset.
+ */
+export declare const DEFAULT_MAX_PLAN_STEPS = 20;
+/**
+ * Validate a constraints.maxSteps value. Returns an error message, or null
+ * when the value is absent or a positive integer. Issue #535: shared by the
+ * planner and the goap_plan MCP tool so both boundaries reject the same input.
+ */
+export declare function validateMaxSteps(maxSteps: unknown): string | null;
 /**
  * Default world state for initialization
  */

package/dist/planning/types.js

@@ -12,6 +12,23 @@
  * @module planning/types
  * @version 3.0.0
  */
+/**
+ * Default A* depth limit (plan length cap) when constraints.maxSteps is unset.
+ */
+export const DEFAULT_MAX_PLAN_STEPS = 20;
+/**
+ * Validate a constraints.maxSteps value. Returns an error message, or null
+ * when the value is absent or a positive integer. Issue #535: shared by the
+ * planner and the goap_plan MCP tool so both boundaries reject the same input.
+ */
+export function validateMaxSteps(maxSteps) {
+    if (maxSteps === undefined)
+        return null;
+    if (typeof maxSteps !== 'number' || !Number.isInteger(maxSteps) || maxSteps < 1) {
+        return `constraints.maxSteps must be a positive integer, got ${String(maxSteps)}`;
+    }
+    return null;
+}
 // ============================================================================
 // Default World State
 // ============================================================================

package/dist/plugins/cache.d.ts

@@ -37,6 +37,8 @@ export declare class PluginCache {
     listVersions(name: string): CachedPlugin[];
     /** List all cached plugins (latest version of each). */
     listAll(): CachedPlugin[];
+    /** Every cached candidate, for constraint-aware dependency resolution. */
+    listCandidates(): CachedPlugin[];
     private versionDir;
     private pruneOldVersions;
     private copyDir;

package/dist/plugins/cache.js

@@ -7,6 +7,7 @@
  */
 import * as fs from 'fs';
 import * as path from 'path';
+import { validVersion, newestVersionFirst } from './version-policy.js';
 // ============================================================================
 // PluginCache
 // ============================================================================
@@ -79,6 +80,12 @@ export class PluginCache {
                 try {
                     const raw = fs.readFileSync(manifestPath, 'utf-8');
                     const manifest = JSON.parse(raw);
+                    if (!validVersion(manifest.version)) {
+                        // Older releases admitted versions SemVer now rejects (e.g. 01.0.0);
+                        // say why the plugin disappeared instead of dropping it silently.
+                        console.warn(`[PluginCache] Skipping cached plugin ${name}@${entry}: invalid version ${JSON.stringify(manifest.version)}`);
+                        continue;
+                    }
                     const stat = fs.statSync(fullPath);
                     results.push({
                         manifest,
@@ -102,13 +109,19 @@ export class PluginCache {
         for (const name of entries) {
             const versions = this.listVersions(name);
             if (versions.length > 0) {
-                // Return the latest version (lexicographic semver sort)
-                versions.sort((a, b) => b.manifest.version.localeCompare(a.manifest.version));
+                // Return the latest version by npm SemVer precedence.
+                versions.sort((a, b) => newestVersionFirst(a.manifest.version, b.manifest.version));
                 results.push(versions[0]);
             }
         }
         return results;
     }
+    /** Every cached candidate, for constraint-aware dependency resolution. */
+    listCandidates() {
+        if (!fs.existsSync(this.cacheDir))
+            return [];
+        return fs.readdirSync(this.cacheDir).flatMap(name => this.listVersions(name));
+    }
     // --------------------------------------------------------------------------
     // Internal
     // --------------------------------------------------------------------------

package/dist/plugins/lifecycle.js

@@ -94,6 +94,19 @@ export class PluginLifecycleManager {
                 securityViolations: security.violations,
             };
         }
+        // Admit only the requested dependency closure, using all cached candidates.
+        // Force this manifest's version so an older cached copy cannot mask failure.
+        try {
+            const candidates = this.cache.listCandidates().map(c => c.manifest)
+                .filter(c => c.name !== manifest.name);
+            const resolution = this.resolver.resolve([...candidates, manifest], [manifest.name]);
+            if (resolution.errors.length) {
+                return { success: false, manifest, errors: resolution.errors.map(e => `${e.code}: ${e.message}`), securityViolations: [] };
+            }
+        }
+        catch (error) {
+            return { success: false, manifest, errors: [error instanceof Error ? error.message : String(error)], securityViolations: [] };
+        }
         // 5. Check if already cached
         if (this.cache.has(manifest.name, manifest.version)) {
             const cached = this.cache.get(manifest.name, manifest.version);
@@ -162,8 +175,8 @@ export class PluginLifecycleManager {
      * Resolve load order for all cached plugins.
      */
     resolveLoadOrder() {
-        const all = this.cache.listAll();
-        return this.resolver.resolve(all.map(c => c.manifest));
+        const all = this.cache.listCandidates();
+        return this.resolver.resolveAvailable(all.map(c => c.manifest));
     }
     /**
      * Register a plugin source.

package/dist/plugins/manifest.js

@@ -5,13 +5,12 @@
  * plugins must provide. Includes validation logic for name, version,
  * entry point, and permissions.
  */
+import { validVersion, validRange } from './version-policy.js';
 // ============================================================================
 // Constants
 // ============================================================================
 /** Regex for valid plugin names: lowercase, alphanumeric, hyphens */
 const VALID_NAME_REGEX = /^[a-z][a-z0-9-]*$/;
-/** Regex for semver: major.minor.patch with optional pre-release */
-const SEMVER_REGEX = /^\d+\.\d+\.\d+(-[a-zA-Z0-9.]+)?$/;
 /** Reserved name prefixes that third-party plugins cannot use */
 const RESERVED_PREFIXES = ['aqe-core-', 'agentic-qe-core-'];
 /** Maximum name length */
@@ -41,7 +40,7 @@ export function validateManifest(manifest) {
     if (!m.version || typeof m.version !== 'string') {
         errors.push('version is required and must be a string');
     }
-    else if (!SEMVER_REGEX.test(m.version)) {
+    else if (!validVersion(m.version)) {
         errors.push(`version "${m.version}" is not valid semver (expected: major.minor.patch)`);
     }
     if (!m.description || typeof m.description !== 'string') {
@@ -80,6 +79,9 @@ export function validateManifest(manifest) {
                 if (typeof depVersion !== 'string') {
                     errors.push(`Dependency "${depName}" must have a string version range`);
                 }
+                else if (!validRange(depVersion)) {
+                    errors.push(`Dependency "${depName}" has an invalid semver range`);
+                }
             }
         }
     }
@@ -100,8 +102,8 @@ export function validateManifest(manifest) {
         }
     }
     if (m.minAqeVersion !== undefined) {
-        if (typeof m.minAqeVersion !== 'string' || !SEMVER_REGEX.test(m.minAqeVersion)) {
-            warnings.push('minAqeVersion should be valid semver');
+        if (typeof m.minAqeVersion !== 'string' || !validVersion(m.minAqeVersion)) {
+            errors.push('minAqeVersion must be valid semver');
         }
     }
     if (m.permissions !== undefined) {