agentic-qe 3.14.5 → 3.14.6

package/dist/cli/chunks/{workflow-TWOIA6LZ.js → workflow-KHMVVBBA.js}

@@ -1,5 +1,5 @@
-import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.14.5");process.exit(0)}
-import"./chunk-73EI4C2E.js";import{b as $}from"./chunk-R74ZKREV.js";import{d as C}from"./chunk-XUR2M2WB.js";import{b as k,c as W,d as v}from"./chunk-QRCIZFNK.js";import{c as b}from"./chunk-IJHCIXJC.js";import"./chunk-XEZIIQYJ.js";import"./chunk-J5UNP6W3.js";import"./chunk-JSZ663MU.js";import{Command as D}from"commander";import o from"chalk";function O(w,i){let h=w.indexOf("=");return h>0&&(i[w.substring(0,h)]=w.substring(h+1)),i}function V(w,i,h){let m=new D("workflow").description("Manage QE workflows and pipelines (ADR-041)");return m.command("run <file>").description("Execute a QE pipeline from YAML file").option("-w, --watch","Watch execution progress").option("-v, --verbose","Show detailed output").option("--params <json>","Additional parameters as JSON","{}").action(async(n,t)=>{if(!await h())return;let u=(await import("path")).resolve(n);try{console.log(o.blue(`
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.14.6");process.exit(0)}
+import"./chunk-L4RUBPLR.js";import{b as $}from"./chunk-D45SG6CP.js";import{d as C}from"./chunk-DK4XN4CU.js";import{b as k,c as W,d as v}from"./chunk-SPV2VKC5.js";import{c as b}from"./chunk-AIRGNL55.js";import"./chunk-KNNISEDY.js";import"./chunk-MJS53PRX.js";import"./chunk-64VGZQLB.js";import{Command as D}from"commander";import o from"chalk";function O(w,i){let h=w.indexOf("=");return h>0&&(i[w.substring(0,h)]=w.substring(h+1)),i}function V(w,i,h){let m=new D("workflow").description("Manage QE workflows and pipelines (ADR-041)");return m.command("run <file>").description("Execute a QE pipeline from YAML file").option("-w, --watch","Watch execution progress").option("-v, --verbose","Show detailed output").option("--params <json>","Additional parameters as JSON","{}").action(async(n,t)=>{if(!await h())return;let u=(await import("path")).resolve(n);try{console.log(o.blue(`
  Running workflow from: ${n}
 `));let l=k(u);if(!l.success||!l.workflow){console.log(o.red("Failed to parse pipeline:"));for(let g of l.errors)console.log(o.red(`   ${g}`));await i(1)}let f={...b(t.params,"params")};if(l.pipeline){for(let g of l.pipeline.stages)if(g.params)for(let[y,p]of Object.entries(g.params))f[y]=p}if(!w.workflowOrchestrator.getWorkflow(l.workflow.id)){let g=w.workflowOrchestrator.registerWorkflow(l.workflow);g.success||(console.log(o.red(`Failed to register workflow: ${g.error.message}`)),await i(1))}let c=await w.workflowOrchestrator.executeWorkflow(l.workflow.id,f);if(!c.success){console.log(o.red(`Failed to start workflow: ${c.error.message}`)),await i(1);return}let a=c.value;if(console.log(o.cyan(`  Execution ID: ${a}`)),console.log(o.gray(`  Workflow: ${l.workflow.name}`)),console.log(o.gray(`  Stages: ${l.workflow.steps.length}`)),console.log(""),t.watch){console.log(o.blue(`Workflow Progress:
 `));let g,y=Date.now();for(;;){let d=w.workflowOrchestrator.getWorkflowStatus(a);if(!d)break;if(!g||g.progress!==d.progress||g.status!==d.status||JSON.stringify(g.currentSteps)!==JSON.stringify(d.currentSteps)){process.stdout.write("\r\x1B[K");let S="\u2588".repeat(Math.floor(d.progress/5))+"\u2591".repeat(20-Math.floor(d.progress/5)),R=d.status==="completed"?o.green:d.status==="failed"?o.red:d.status==="running"?o.yellow:o.gray;console.log(`  [${S}] ${d.progress}% - ${R(d.status)}`),d.currentSteps.length>0&&t.verbose&&console.log(o.gray(`    Running: ${d.currentSteps.join(", ")}`)),g=d}if(d.status==="completed"||d.status==="failed"||d.status==="cancelled")break;await new Promise(S=>setTimeout(S,500))}let p=w.workflowOrchestrator.getWorkflowStatus(a);if(p){console.log("");let d=p.duration||Date.now()-y;p.status==="completed"?(console.log(o.green("Workflow completed successfully")),console.log(o.gray(`   Duration: ${$(d)}`)),console.log(o.gray(`   Completed: ${p.completedSteps.length} stages`)),p.skippedSteps.length>0&&console.log(o.yellow(`   Skipped: ${p.skippedSteps.length} stages`))):p.status==="failed"?(console.log(o.red("Workflow failed")),console.log(o.red(`   Error: ${p.error}`)),console.log(o.gray(`   Failed stages: ${p.failedSteps.join(", ")}`))):console.log(o.yellow(`Workflow ${p.status}`))}console.log(""),await i(p?.status==="completed"?0:1);return}else console.log(o.green("Workflow execution started")),console.log(o.gray(`   Use 'aqe workflow status ${a}' to check progress`));console.log(""),await i(0)}catch(l){console.error(o.red(`
@@ -35,10 +35,10 @@ Workflow cancelled: ${n}
 `)):console.log(o.red(`
 Failed to cancel workflow: ${t.error.message}
 `)),await i(t.success?0:1)}catch(t){console.error(o.red(`
-Failed to cancel workflow:`),t),await i(1)}}),m.command("browser-list").description("List available browser workflow templates").action(async()=>{try{let{BrowserWorkflowTool:n}=await import("./browser-workflow-YYHQQ25X.js"),e=await new n().invoke({});if(e.success&&e.data){console.log(o.blue(`
+Failed to cancel workflow:`),t),await i(1)}}),m.command("browser-list").description("List available browser workflow templates").action(async()=>{try{let{BrowserWorkflowTool:n}=await import("./browser-workflow-CJ7T3MXF.js"),e=await new n().invoke({});if(e.success&&e.data){console.log(o.blue(`
  Browser Workflow Templates:
 `));for(let u of e.data.availableTemplates)console.log(`  ${o.cyan(u)}`);console.log("")}else console.log(o.red(`Failed: ${e.error||"Unknown error"}`));await i(0)}catch(n){console.error(o.red(`
-Failed:`),n),await i(1)}}),m.command("browser-load [template]").description("Load and validate a browser workflow template or inline YAML").option("--yaml <yaml>","Inline YAML workflow definition").option("-v, --var <key=value>","Variable override (repeatable)",O,{}).option("-F, --format <format>","Output format (text|json)","text").option("-o, --output <path>","Write output to file").action(async(n,t)=>{try{let{BrowserWorkflowTool:e}=await import("./browser-workflow-YYHQQ25X.js"),{writeOutput:u,toJSON:l}=await import("./ci-output-EHRSZBKG.js"),s=new e,f={variables:t.var||{}};if(t.yaml)f.workflowYaml=t.yaml;else if(n)if(n.endsWith(".yaml")||n.endsWith(".yml")){let c=await import("fs"),g=(await import("path")).resolve(n);c.existsSync(g)||(console.log(o.red(`
+Failed:`),n),await i(1)}}),m.command("browser-load [template]").description("Load and validate a browser workflow template or inline YAML").option("--yaml <yaml>","Inline YAML workflow definition").option("-v, --var <key=value>","Variable override (repeatable)",O,{}).option("-F, --format <format>","Output format (text|json)","text").option("-o, --output <path>","Write output to file").action(async(n,t)=>{try{let{BrowserWorkflowTool:e}=await import("./browser-workflow-CJ7T3MXF.js"),{writeOutput:u,toJSON:l}=await import("./ci-output-LDT24TS3.js"),s=new e,f={variables:t.var||{}};if(t.yaml)f.workflowYaml=t.yaml;else if(n)if(n.endsWith(".yaml")||n.endsWith(".yml")){let c=await import("fs"),g=(await import("path")).resolve(n);c.existsSync(g)||(console.log(o.red(`
 File not found: ${g}
 `)),await i(1)),f.workflowYaml=c.readFileSync(g,"utf-8")}else f.templateName=n;else console.log(o.red(`
 Provide a template name or --yaml. Use "workflow browser-list" to see templates.

package/dist/cli/chunks/workflow-orchestrator-GI5NQH7C.js

@@ -0,0 +1,2 @@
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.14.6");process.exit(0)}
+import{a,b,c,d}from"./chunk-GSF6MB64.js";import"./chunk-DHVX5UB2.js";import"./chunk-2JVWITNK.js";import"./chunk-Q5XTSMWR.js";import"./chunk-AIRGNL55.js";import"./chunk-QW6VMTBR.js";import"./chunk-SDRHUMJB.js";import"./chunk-KNNISEDY.js";import"./chunk-TCHGOB2N.js";import"./chunk-FBMN7B46.js";import"./chunk-ENGZ4D5V.js";import"./chunk-MJS53PRX.js";import"./chunk-DPYSUDAO.js";import"./chunk-PI7TJS62.js";import"./chunk-EAY2JMZG.js";import"./chunk-C6KWXUFJ.js";import"./chunk-IB27QACC.js";import"./chunk-6SH5VZUD.js";import"./chunk-SESK3ARK.js";import"./chunk-SNOBH4AZ.js";import"./chunk-IQO7UCFR.js";import"./chunk-DUYOVM5I.js";import"./chunk-64VGZQLB.js";export{b as DEFAULT_WORKFLOW_CONFIG,a as WorkflowEvents,c as WorkflowOrchestrator,d as createWorkflowOrchestrator};

package/dist/cli/chunks/wrappers-N6XIK5PT.js

@@ -0,0 +1,2 @@
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.14.6");process.exit(0)}
+import{a,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v as L,w as M,x as N}from"./chunk-UKA2KOXE.js";import{a as v,b as w,c as x,d as y,e as z,f as A,g as B,h as C,i as D,j as E,k as F,l as G,m as H,n as I,o as J,p as K}from"./chunk-VGFFFKGK.js";import"./chunk-2JVWITNK.js";import"./chunk-Q5XTSMWR.js";import"./chunk-AIRGNL55.js";import"./chunk-QW6VMTBR.js";import"./chunk-SDRHUMJB.js";import"./chunk-TCHGOB2N.js";import"./chunk-FBMN7B46.js";import"./chunk-ENGZ4D5V.js";import"./chunk-MJS53PRX.js";import"./chunk-PI7TJS62.js";import"./chunk-EAY2JMZG.js";import"./chunk-C6KWXUFJ.js";import"./chunk-IB27QACC.js";import"./chunk-6SH5VZUD.js";import"./chunk-SESK3ARK.js";import"./chunk-SNOBH4AZ.js";import"./chunk-IQO7UCFR.js";import"./chunk-DUYOVM5I.js";import"./chunk-64VGZQLB.js";export{z as GNNLayerFactory,i as QEFlashAttention,x as QEGNNEmbeddingIndex,y as QEGNNIndexFactory,a as QESONA,e as QE_FLASH_ATTENTION_CONFIG,g as QE_PERFORMANCE_TARGETS,f as QE_SONA_CONFIG,A as TensorCompressionFactory,u as batchComputeAttention,K as batchDifferentiableSearch,M as checkRuvectorPackagesAvailable,c as createDomainQESONA,j as createQEFlashAttention,b as createQESONA,D as getDifferentiableSearch,F as getGetCompressionLevel,E as getHierarchicalForward,G as getInit,h as getOptimalBlockConfig,k as getQEFlashAttentionConfig,n as getRuvectorDotProductAttention,m as getRuvectorFlashAttention,p as getRuvectorHyperbolicAttention,B as getRuvectorLayer,q as getRuvectorLinearAttention,r as getRuvectorMoEAttention,o as getRuvectorMultiHeadAttention,L as getRuvectorPackageVersions,C as getTensorCompress,l as getWorkloadTypes,N as initAllRuvectorPackages,w as initGNN,d as isAttentionAvailable,v as isGNNAvailable,s as toFloat32Array,H as toFloat32ArrayGNN,J as toIEmbedding,t as toNumberArrayAttn,I as toNumberArrayGNN};

package/dist/cli/commands/audit.d.ts

@@ -4,7 +4,8 @@
  * Verifies the witness chain audit trail integrity.
  * Shows chain length, integrity status, and last receipt hash.
  *
- * Usage: aqe audit verify [--format json|text]
+ * Usage: aqe audit verify [--chain governance|audit] [--format json|text]
+ *        aqe audit repair --chain audit [--dry-run] [--format json|text]
  *
  * @module cli/commands/audit
  * @see ADR-083-coherence-gated-agent-actions.md
@@ -12,6 +13,8 @@
 import { Command } from 'commander';
 import { type ChainVerificationResult } from '../../governance/witness-chain.js';
 import type { CLIContext } from '../handlers/interfaces.js';
+import type { ChainStatus } from '../../audit/witness-chain-verifier.js';
+import type { RepairResult } from '../../audit/witness-chain-repair.js';
 /**
  * Verification output for JSON format.
  */
@@ -22,11 +25,17 @@ export interface AuditVerifyOutput {
     brokenAt: number;
     lastHash: string;
     message: string;
+    status?: ChainStatus;
+    tampered?: boolean;
+    tamperedAt?: number;
+    tamperReason?: string;
+    forks?: number[];
+    acknowledgedForks?: number[];
 }
 /**
  * Format verification result as human-readable text.
  */
-export declare function formatVerificationText(result: ChainVerificationResult, featureEnabled: boolean): string;
+export declare function formatVerificationText(result: ChainVerificationResult, featureEnabled: boolean, audit?: Pick<AuditVerifyOutput, 'status' | 'tamperedAt' | 'tamperReason' | 'forks' | 'acknowledgedForks'>): string;
 /**
  * Handle the audit verify command.
  *
@@ -48,6 +57,15 @@ export declare function handleAuditVerify(options: {
 export declare function handleAuditChainVerify(options: {
     format?: 'json' | 'text';
 }): Promise<AuditVerifyOutput>;
+/**
+ * `aqe audit repair --chain audit`: re-anchor a store whose only breaks are
+ * accidental pre-3.14.5 forks (#753). Refuses on tampering, backs up first,
+ * never rewrites existing rows. See src/audit/witness-chain-repair.ts.
+ */
+export declare function handleAuditChainRepair(options: {
+    format?: 'json' | 'text';
+    dryRun?: boolean;
+}): Promise<RepairResult>;
 /**
  * Create the audit command group following the project convention.
  */

package/dist/cli/commands/audit.js

@@ -4,7 +4,8 @@
  * Verifies the witness chain audit trail integrity.
  * Shows chain length, integrity status, and last receipt hash.
  *
- * Usage: aqe audit verify [--format json|text]
+ * Usage: aqe audit verify [--chain governance|audit] [--format json|text]
+ *        aqe audit repair --chain audit [--dry-run] [--format json|text]
  *
  * @module cli/commands/audit
  * @see ADR-083-coherence-gated-agent-actions.md
@@ -18,7 +19,7 @@ import path from 'node:path';
 /**
  * Format verification result as human-readable text.
  */
-export function formatVerificationText(result, featureEnabled) {
+export function formatVerificationText(result, featureEnabled, audit) {
     const lines = [];
     lines.push(chalk.bold('Witness Chain Audit Verification'));
     lines.push('');
@@ -30,20 +31,36 @@ export function formatVerificationText(result, featureEnabled) {
     // Chain length
     lines.push(`  Chain Length:  ${result.length} receipts`);
     // Integrity status
-    const integrityStatus = result.valid
-        ? chalk.green('VALID')
-        : chalk.red('BROKEN');
+    const integrityStatus = audit?.status === 'forked'
+        ? chalk.yellow('FORKED (no tampering detected)')
+        : result.valid
+            ? chalk.green(audit?.status === 'valid-with-forks' ? 'VALID (forks re-anchored)' : 'VALID')
+            : chalk.red(audit?.status === 'tampered' ? 'BROKEN (tampering detected)' : 'BROKEN');
     lines.push(`  Integrity:    ${integrityStatus}`);
     // Last hash
     if (result.length > 0) {
         lines.push(`  Last Hash:    ${result.lastHash.slice(0, 16)}...`);
     }
+    const forkCount = audit?.forks?.length ?? 0;
+    if (forkCount > 0) {
+        const reanchored = audit?.acknowledgedForks?.length ?? 0;
+        lines.push(`  Forks:        ${forkCount} accidental (pre-3.14.5 concurrent writes, #753), ${reanchored} re-anchored`);
+    }
     // Details
-    if (!result.valid && result.brokenAt >= 0) {
+    if (audit?.status === 'forked') {
+        lines.push('');
+        lines.push(chalk.yellow(`  ${result.message}`));
+    }
+    else if (!result.valid && result.brokenAt >= 0) {
         lines.push('');
-        lines.push(chalk.red(`  Break detected at index ${result.brokenAt}`));
+        const at = audit?.status === 'tampered' && audit.tamperedAt !== undefined ? audit.tamperedAt : result.brokenAt;
+        lines.push(chalk.red(`  Break detected at index ${at}${audit?.tamperReason ? ` (${audit.tamperReason})` : ''}`));
         lines.push(chalk.red(`  ${result.message}`));
     }
+    else if (result.valid && forkCount > 0) {
+        lines.push('');
+        lines.push(chalk.green(`  ${result.message}`));
+    }
     lines.push('');
     return lines.join('\n');
 }
@@ -109,8 +126,7 @@ export async function handleAuditVerify(options) {
  */
 export async function handleAuditChainVerify(options) {
     const { WitnessChain, hashWith, serializeEntry } = await import('../../audit/witness-chain.js');
-    const root = findProjectRoot();
-    const dbPath = path.join(root, '.agentic-qe', 'memory.db');
+    const { dbPath, keyDir } = auditChainPaths();
     let output;
     if (!existsSync(dbPath)) {
         output = {
@@ -126,10 +142,15 @@ export async function handleAuditChainVerify(options) {
         const { default: Database } = await import('better-sqlite3');
         const db = new Database(dbPath, { readonly: true });
         try {
-            const chain = new WitnessChain(db);
+            const chain = new WitnessChain(db, (await loadReadOnlyKeyManager(keyDir)) ?? undefined);
             await chain.initialize();
-            const result = chain.verify({ includeArchive: true, checkSignatures: true });
-            const lastEntry = db.prepare('SELECT * FROM witness_chain ORDER BY id DESC LIMIT 1').get();
+            // Fork and CHAIN_REANCHOR rows signed by a key in witness-keys/ are always
+            // signature-checked. The every-row `checkSignatures` sweep stays off, as it
+            // effectively was before this command loaded keys: it would fail rows
+            // signed by keys this project never stored (e.g. imported rows).
+            const result = chain.verify({ includeArchive: true, checkSignatures: false });
+            const { tableExists } = await import('../../audit/witness-chain-verifier.js');
+            const lastEntry = !tableExists(db, 'witness_chain') ? undefined : db.prepare('SELECT * FROM witness_chain ORDER BY id DESC LIMIT 1').get();
             const lastHash = lastEntry
                 ? hashWith(lastEntry.hash_algo || 'sha256', serializeEntry(lastEntry))
                 : '';
@@ -139,9 +160,13 @@ export async function handleAuditChainVerify(options) {
                 integrity: result.valid,
                 brokenAt: result.brokenAt ?? -1,
                 lastHash,
-                message: result.valid
-                    ? `Audit chain verified: ${result.entriesChecked} entries checked, ${result.signatureFailures ?? 0} signature failures`
-                    : `Audit chain BROKEN at id=${result.brokenAt} (${result.entriesChecked} entries checked before the break)`,
+                message: auditChainMessage(result),
+                status: result.status,
+                tampered: result.tampered,
+                ...(result.tamperedAt !== undefined ? { tamperedAt: result.tamperedAt } : {}),
+                ...(result.tamperReason ? { tamperReason: result.tamperReason } : {}),
+                forks: result.forks,
+                acknowledgedForks: result.acknowledgedForks,
             };
         }
         finally {
@@ -152,10 +177,103 @@ export async function handleAuditChainVerify(options) {
         console.log(JSON.stringify(output, null, 2));
     }
     else {
-        console.log(formatVerificationText({ valid: output.integrity, length: output.chainLength, brokenAt: output.brokenAt, lastHash: output.lastHash, message: output.message }, output.featureEnabled));
+        console.log(formatVerificationText({ valid: output.integrity, length: output.chainLength, brokenAt: output.brokenAt, lastHash: output.lastHash, message: output.message }, output.featureEnabled, output));
     }
     return output;
 }
+function auditChainPaths() {
+    const root = findProjectRoot();
+    return {
+        dbPath: path.join(root, '.agentic-qe', 'memory.db'),
+        keyDir: path.join(root, '.agentic-qe', 'witness-keys'),
+    };
+}
+/** Persisted witness keys, loaded without generating (or writing) anything. */
+async function loadReadOnlyKeyManager(keyDir) {
+    if (!existsSync(keyDir))
+        return null;
+    const { WitnessKeyManager: KeyManager } = await import('../../audit/witness-key-manager.js');
+    return new KeyManager({ keyDir, autoGenerate: false });
+}
+function auditChainMessage(result) {
+    const n = result.entriesChecked;
+    const forks = result.forks.length;
+    const pending = forks - result.acknowledgedForks.length;
+    switch (result.status) {
+        case 'valid':
+            return `Audit chain verified: ${n} entries checked, ${result.signatureFailures ?? 0} signature failures`;
+        case 'valid-with-forks':
+            return `Audit chain verified: ${n} entries checked; ${forks} accidental fork(s) from pre-3.14.5 ` +
+                'concurrent writes are re-anchored by CHAIN_REANCHOR, no tampering detected';
+        case 'forked':
+            return `${pending} accidental fork(s) (pre-3.14.5 concurrent writes, #753), no tampering detected — ` +
+                `${n} entries checked, first fork at id=${result.brokenAt}. ` +
+                'Run `aqe audit repair --chain audit` to back up the store and re-anchor.';
+        default:
+            return `Audit chain BROKEN: tampering detected at id=${result.tamperedAt} (${result.tamperReason}); ` +
+                `${n} entries checked` + (forks > 0 ? `, ${forks} accidental fork(s) found before it` : '');
+    }
+}
+function repairFailed(result) {
+    if (result.action === 'refused')
+        return true;
+    return result.action === 'reanchored' && !(result.after?.status === 'valid' || result.after?.status === 'valid-with-forks');
+}
+/**
+ * `aqe audit repair --chain audit`: re-anchor a store whose only breaks are
+ * accidental pre-3.14.5 forks (#753). Refuses on tampering, backs up first,
+ * never rewrites existing rows. See src/audit/witness-chain-repair.ts.
+ */
+export async function handleAuditChainRepair(options) {
+    const { repairWitnessChainForks } = await import('../../audit/witness-chain-repair.js');
+    const { dbPath, keyDir } = auditChainPaths();
+    const dryRun = options.dryRun === true;
+    let result;
+    if (!existsSync(dbPath)) {
+        const empty = { status: 'valid', entriesChecked: 0, forks: 0, unacknowledgedForks: 0 };
+        result = {
+            action: 'none', dryRun, message: `No database found at ${dbPath} — nothing to repair`,
+            before: empty, rowsBefore: { live: 0, archive: 0 }, rowsAfter: { live: 0, archive: 0 }, forksAcknowledged: [],
+        };
+    }
+    else {
+        const { openDatabase } = await import('../../shared/safe-db.js');
+        // A dry run opens read-only and never generates a signing key.
+        const db = openDatabase(dbPath, { readonly: dryRun, fileMustExist: true });
+        try {
+            const keyManager = dryRun
+                ? await loadReadOnlyKeyManager(keyDir)
+                : (await import('../../audit/witness-key-manager.js')).getDefaultWitnessKeyManager();
+            result = await repairWitnessChainForks(db, { dbPath, dryRun, keyManager });
+        }
+        finally {
+            db.close();
+        }
+    }
+    if (options.format === 'json') {
+        console.log(JSON.stringify(result, null, 2));
+    }
+    else {
+        console.log(formatRepairText(result));
+    }
+    return result;
+}
+function formatRepairText(result) {
+    const color = result.action === 'refused' ? chalk.red : result.action === 'reanchored' ? chalk.green : chalk.yellow;
+    const lines = [
+        chalk.bold('Witness Chain Audit Repair'),
+        '',
+        `  Action:       ${color(result.action.toUpperCase())}${result.dryRun ? ' (dry run)' : ''}`,
+        `  Before:       ${result.before.status}, ${result.before.forks} fork(s), ${result.before.unacknowledgedForks} unacknowledged`,
+        `  Rows:         live ${result.rowsBefore.live} -> ${result.rowsAfter.live}, archive ${result.rowsBefore.archive} -> ${result.rowsAfter.archive}`,
+    ];
+    if (result.after)
+        lines.push(`  After:        ${result.after.status}`);
+    if (result.backupPath)
+        lines.push(`  Backup:       ${result.backupPath}`);
+    lines.push('', `  ${color(result.message)}`, '');
+    return lines.join('\n');
+}
 /**
  * Create the audit command group following the project convention.
  */
@@ -180,6 +298,30 @@ export function createAuditCommand(_context, cleanupAndExit, _ensureInitialized)
             await cleanupAndExit(1);
         }
     });
+    audit
+        .command('repair')
+        .description('Re-anchor accidental pre-3.14.5 forks in the audit chain (#753); backs up first, refuses on tampering')
+        .option('-C, --chain <chain>', 'Chain to repair (only "audit" is supported)', 'audit')
+        .option('--dry-run', 'Report what would be done without writing anything', false)
+        .option('-F, --format <format>', 'Output format (json|text)', 'text')
+        .action(async (options) => {
+        try {
+            if (options.chain !== 'audit') {
+                console.error(`aqe audit repair supports only --chain audit (got "${options.chain}")`);
+                await cleanupAndExit(1);
+                return;
+            }
+            const result = await handleAuditChainRepair({
+                format: options.format,
+                dryRun: options.dryRun === true,
+            });
+            await cleanupAndExit(repairFailed(result) ? 1 : 0);
+        }
+        catch (error) {
+            console.error('Failed to repair witness chain:', error);
+            await cleanupAndExit(1);
+        }
+    });
     return audit;
 }
 //# sourceMappingURL=audit.js.map

package/dist/cli/commands/claude-flow-setup.js

@@ -16,7 +16,8 @@
  * - Rule-based model routing
  * - Local pattern learning
  */
-import { existsSync, writeFileSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
+import { writeFileIfChanged } from '../../init/idempotent-write.js';
 import { join } from 'node:path';
 import { safeJsonParse } from '../../shared/safe-json.js';
 import { toErrorMessage } from '../../shared/error-utils.js';
@@ -143,8 +144,8 @@ function updateMCPConfig(projectRoot) {
             env: {},
         };
     }
-    // Write updated settings
-    writeFileSync(claudeSettingsPath, JSON.stringify(settings, null, 2));
+    // Write updated settings — only when something changed (#778).
+    writeFileIfChanged(claudeSettingsPath, JSON.stringify(settings, null, 2));
 }
 // ============================================================================
 // Main Setup Function
@@ -195,7 +196,7 @@ export async function setupClaudeFlowIntegration(options) {
     const configPath = join(aqeDir, 'claude-flow-integration.json');
     try {
         const config = generateClaudeFlowConfig(projectRoot, features);
-        writeFileSync(configPath, JSON.stringify(config, null, 2));
+        writeFileIfChanged(configPath, JSON.stringify(config, null, 2));
         if (debug)
             console.log(`[ClaudeFlow] Config written to: ${configPath}`);
     }

package/dist/cli/index.js

@@ -21,6 +21,7 @@ import { ALL_DOMAINS } from '../shared/types/index.js';
 // ============================================================================
 import { applyCommandVerbosity, installCliLogGate, isCliLogLevelEnabled } from './log-gate.js';
 import { LogLevel } from '../logging/index.js';
+import { formatErrorForLog } from '../logging/redaction.js';
 installCliLogGate();
 // ============================================================================
 // CLI State
@@ -420,7 +421,7 @@ async function main() {
     await cleanupAndExit(process.exitCode ?? 0);
 }
 main().catch(async (error) => {
-    console.error(chalk.red('Fatal error:'), error);
+    console.error(chalk.red('Fatal error:'), formatErrorForLog(error));
     await cleanupAndExit(1);
 });
 //# sourceMappingURL=index.js.map

package/dist/init/agents-installer.d.ts

@@ -74,6 +74,10 @@ export declare class AgentsInstaller {
      * Install a single agent
      */
     private installAgent;
+    /**
+     * Describe an agent from its installed file (type, description, domain).
+     */
+    private describeAgent;
     /**
      * Get the type of an agent based on its name
      */

package/dist/init/agents-installer.js

@@ -11,6 +11,7 @@ import { toErrorMessage } from '../shared/error-utils.js';
 import { loadOverlays, applyOverlayToContent } from '../agents/overlay-loader.js';
 import { validateFleetMcpDeps } from '../validation/steps/agent-mcp-validator.js';
 import { findPackageRoot } from './find-package-root.js';
+import { GENERATED_ON_LINE, writeTextIfChangedIgnoring } from './idempotent-write.js';
 // ============================================================================
 // Helpers
 // ============================================================================
@@ -240,15 +241,21 @@ export class AgentsInstaller {
         result.totalCount = availableAgents.length;
         // Filter agents based on options
         const agentsToInstall = this.filterAgents(availableAgents);
+        // Every selected agent present on disk after this run — newly installed or
+        // already there — so the index describes the install, not just this run's
+        // delta (a repeat init used to rewrite it as "Total Agents: 0", #778).
+        const presentAgents = [];
         // Install each agent
         for (const agentName of agentsToInstall) {
             try {
                 const agentInfo = await this.installAgent(agentName, targetAgentsDir, targetSubagentsDir);
                 if (agentInfo) {
                     result.installed.push(agentInfo);
+                    presentAgents.push(agentInfo);
                 }
                 else {
                     result.skipped.push(agentName);
+                    presentAgents.push(this.describeAgent(agentName, targetAgentsDir, targetSubagentsDir));
                 }
             }
             catch (error) {
@@ -313,7 +320,7 @@ export class AgentsInstaller {
             }
         }
         // Create agents index file
-        await this.createAgentsIndex(targetAgentsDir, result.installed);
+        await this.createAgentsIndex(targetAgentsDir, presentAgents);
         return result;
     }
     /**
@@ -405,17 +412,22 @@ export class AgentsInstaller {
         else {
             throw new Error(`Source file not found: ${sourceFile}`);
         }
-        // Determine agent type
-        const agentType = this.getAgentType(agentName, isSubagent);
-        // Get description from agent file
-        const description = this.getAgentDescription(targetFile);
-        // Get domain from agent name
-        const domain = this.getAgentDomain(agentName);
+        return this.describeAgent(agentPath, targetDir, targetSubagentsDir);
+    }
+    /**
+     * Describe an agent from its installed file (type, description, domain).
+     */
+    describeAgent(agentPath, targetDir, targetSubagentsDir) {
+        const isSubagent = agentPath.startsWith('subagents/');
+        const agentName = isSubagent ? agentPath.split('/')[1] : agentPath;
+        const targetFile = isSubagent
+            ? join(targetSubagentsDir, `${agentName}.md`)
+            : join(targetDir, `${agentName}.md`);
         return {
             name: agentName,
-            type: agentType,
-            description,
-            domain,
+            type: this.getAgentType(agentName, isSubagent),
+            description: this.getAgentDescription(targetFile),
+            domain: this.getAgentDomain(agentName),
         };
     }
     /**
@@ -629,7 +641,8 @@ ${subagents.map(a => `- **${a.name}**${a.description ? `: ${a.description}` : ''
         if (!existsSync(docsDir)) {
             mkdirSync(docsDir, { recursive: true });
         }
-        writeFileSync(join(docsDir, 'v3-agents-index.md'), indexContent, 'utf-8');
+        // #778: ignore the generation-timestamp footer when deciding to rewrite.
+        writeTextIfChangedIgnoring(join(docsDir, 'v3-agents-index.md'), indexContent, GENERATED_ON_LINE);
     }
 }
 /**

package/dist/init/codex-installer.js

@@ -10,6 +10,7 @@ import { join, dirname } from 'path';
 import { fileURLToPath } from 'url';
 import { toErrorMessage } from '../shared/error-utils.js';
 import { findPackageRoot } from './find-package-root.js';
+import { writeFileIfChanged } from './idempotent-write.js';
 import { selectCodexSkills } from './codex-skill-manifest.js';
 import { createPlatformConfigGenerator, } from './platform-config-generator.js';
 export const CODEX_COMPACT_GUIDANCE_MAX_BYTES = 512;
@@ -236,9 +237,10 @@ export class CodexInstaller {
             const userGroups = (existing.hooks?.[event] || []).filter((group) => !owned(group));
             mergedHooks[event] = [...userGroups, ...(generated.hooks?.[event] || [])];
         }
-        writeFileSync(targetConfig, JSON.stringify({ ...existing, description: generated.description, hooks: mergedHooks }, null, 2) + '\n');
+        // #778: a converged hooks.json is left untouched (no mtime churn).
+        const changed = writeFileIfChanged(targetConfig, JSON.stringify({ ...existing, description: generated.description, hooks: mergedHooks }, null, 2) + '\n');
         result.hooksConfigured = true;
-        return 'updated';
+        return changed ? 'updated' : 'preserved';
     }
     /** Install the curated repo-scoped AQE skills Codex discovers automatically. */
     installCodexSkills() {

package/dist/init/idempotent-write.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Idempotent file writers for `aqe init` (#778).
+ *
+ * A repeat `aqe init` on an unchanged project must be a byte-stable
+ * convergence step: files whose content would not change are left alone (no
+ * rewrite, so the mtime is preserved too), and volatile fields such as
+ * generation timestamps are carried over from the existing file unless
+ * something else in that file actually changed.
+ */
+/**
+ * Write `content` to `path` only when the bytes on disk differ.
+ * @returns true when the file was written.
+ */
+export declare function writeFileIfChanged(path: string, content: string | Buffer): boolean;
+/**
+ * Copy `src` to `dest` only when `dest` is missing or its bytes differ.
+ * Uses copyFileSync for the actual copy so file-mode semantics are unchanged.
+ * @returns true when the file was copied.
+ */
+export declare function copyFileIfChanged(src: string, dest: string): boolean;
+/**
+ * Write a text file whose content embeds a volatile line (e.g. a generation
+ * timestamp). When the existing file matches `content` on every line except
+ * the lines matching `volatileLine`, the file is left untouched.
+ * @returns true when the file was written.
+ */
+export declare function writeTextIfChangedIgnoring(path: string, content: string, volatileLine: RegExp): boolean;
+/** The `*Generated by AQE v3 init on <ISO>*` footer of generated index docs. */
+export declare const GENERATED_ON_LINE: RegExp;
+/** JSON serialization with object keys sorted, for order-insensitive comparison. */
+export declare function canonicalJson(value: unknown): string;
+/** Deep structural equality of two JSON values, ignoring object key order. */
+export declare function jsonEquivalent(a: unknown, b: unknown): boolean;
+/**
+ * Carry volatile fields (timestamps) over from `previous` into `next` when
+ * `next` is otherwise identical to `previous`.
+ *
+ * - Unchanged (apart from the volatile fields): `next` is mutated to hold the
+ *   previous values and `false` is returned — the caller should not write.
+ * - Changed, or no previous document: `next` keeps its fresh values and
+ *   `true` is returned — the caller should write.
+ */
+export declare function stabilizeVolatileFields(previous: unknown, next: Record<string, unknown>, volatilePaths: ReadonlyArray<readonly string[]>): boolean;
+/** Read and parse a JSON file, or return undefined when missing/unparseable. */
+export declare function readJsonIfPresent(path: string): unknown;
+/**
+ * Write a generated JSON document (2-space indent) unless it is equivalent to
+ * the one already on disk, preserving the existing values of `volatilePaths`
+ * (e.g. `[['createdAt']]`) when nothing else changed.
+ * @returns true when the file was written.
+ */
+export declare function writeJsonIfChanged(path: string, doc: Record<string, unknown>, volatilePaths?: ReadonlyArray<readonly string[]>): boolean;
+//# sourceMappingURL=idempotent-write.d.ts.map