agentic-qe 3.14.7 → 3.15.0

package/.claude/skills/release/SKILL.md

@@ -65,9 +65,13 @@ cd /workspaces/agentic-qe && npm version <version> --no-git-tag-version
 
 Also update `fleetVersion` in `.claude/skills/skills-manifest.json`.
 
+`npm version` runs the `version` lifecycle script (`scripts/sync-plugin-versions.cjs`), which also bumps the Claude Code plugin surfaces: `.claude-plugin/plugin.json` (version + `agentic-qe@<version>` MCP pin), `plugins/agentic-qe-fleet/.claude-plugin/plugin.json` (version) and `plugins/agentic-qe-fleet/.mcp.json` (`agentic-qe@<version>` pin). Add a `## <version> — <date>` entry to `plugins/agentic-qe-fleet/CHANGELOG.md` when the plugin itself changed.
+
 Verify:
 ```bash
 grep '"version"' package.json
+node scripts/sync-plugin-versions.cjs --check   # must print "in sync"
+bash plugins/agentic-qe-fleet/scripts/smoke.sh  # plugin contract incl. MCP pin
 ```
 
 **STOP — confirm version is correct.**
@@ -254,6 +258,8 @@ cd /workspaces/agentic-qe
 # Stage version bump + changelog + release docs + any version audit fixes
 git add package.json package-lock.json CHANGELOG.md docs/releases/README.md docs/releases/v<version>.md
 git add .claude/skills/skills-manifest.json  # if fleetVersion was updated
+git add .claude-plugin/plugin.json plugins/agentic-qe-fleet/.claude-plugin/plugin.json \
+  plugins/agentic-qe-fleet/.mcp.json plugins/agentic-qe-fleet/CHANGELOG.md
 git status
 
 git commit -m "chore(release): bump version to v<version>"

package/.claude/skills/skills-manifest.json

@@ -940,7 +940,7 @@
   },
   "metadata": {
     "generatedBy": "Agentic QE Fleet",
-    "fleetVersion": "3.14.7",
+    "fleetVersion": "3.15.0",
     "manifestVersion": "1.4.0",
     "lastUpdated": "2026-04-13T00:00:00.000Z",
     "contributors": [

package/CHANGELOG.md

@@ -5,6 +5,281 @@ All notable changes to the Agentic QE project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.15.0] - 2026-10-09
+
+This release makes the `agentic-qe-fleet` Claude Code plugin ready for the
+ruflo marketplace and console. Installing the plugin now connects the AQE MCP
+server. The plugin also ships a mod that shows AQE's status in the ruflo
+console and refuses commands that would destroy your learning data. The
+release also bundles about forty reliability fixes: test counting, workflow
+schedules, LLM providers, caches, rate limiting, git analysis and planning.
+
+### Added
+
+- **aqe-mod for Claude Code 2.1.287 and later.** The fleet plugin now includes
+  a function-hook mod that:
+  - writes `.claude-flow/aqe-mod/status.json`, so AQE appears in the ruflo
+    console's Mods section;
+  - adds an `/aqe-mod` command (`status`, `check <cmd>`, `fleet`, `gate`);
+  - turns on, by default, a guard that refuses to delete, overwrite, move or
+    `DROP`/`DELETE`/`TRUNCATE` the learning databases in `.agentic-qe/`.
+    Backups, `SELECT` and `PRAGMA integrity_check` still work. The guard mode
+    is `enforce`, `notify` or `off` ([#916]).
+- **Plugin settings.** The plugin can now be configured with the LLM provider,
+  budget cap, memory backend and guard mode ([#916]).
+
+### Fixed
+
+**Plugin**
+
+- Installing `agentic-qe-fleet` from the marketplace now registers the AQE MCP
+  server. Before, the skills and agents were installed without the tools they
+  call ([#916]).
+- The plugin's MCP server is pinned to the matching `agentic-qe` release
+  instead of `@latest`, and `npm version` keeps the plugin versions in step
+  ([#916]).
+- The repository's plugin manifest now passes `claude plugin validate`
+  ([#916]).
+
+**Workflows and planning**
+
+- Workflow schedules honour all five cron fields. Steps, lists, ranges,
+  weekdays and months work, and `daily`/`weekly`/`hourly`/`minutely` resolve
+  correctly. Invalid expressions are rejected instead of becoming "every day"
+  ([#903]).
+- GOAP duration limits use the plan's total estimated time ([#895]). Malformed
+  saved plans no longer break plan listings ([#896]). Unknown status filters
+  are rejected ([#894]).
+- A/B benchmark promotion requires significant evidence over the runner-up
+  ([#901]).
+
+**Test execution and metrics**
+
+- Vitest phase runs use the supported `--maxWorkers` flag ([#898]) and read
+  current coverage from the JSON report ([#899]).
+- Cargo tests are listed correctly ([#893]). Python async tests are counted
+  once ([#892]). pytest and Go test categories no longer overlap ([#891]).
+- Retrying a test whose name contains regex characters runs exactly that test
+  ([#886]).
+- Cyclomatic complexity counts `else if` once ([#880]), and process CPU usage
+  is measured against the right baseline ([#883]).
+- The session journal keeps accepted entries when a disk write fails ([#900]).
+
+**LLM providers, embeddings and caches**
+
+- Gemini prompts blocked by its safety filter are reported as filtered
+  instead of as a network error ([#887]). SSE streams with `data:` and no
+  space are parsed ([#884]).
+- Cached LLM responses are kept separate by stop sequences, effort and
+  preferred provider ([#879]). Empty cache keys are evicted correctly
+  ([#867]). Costs are totalled for every registered provider type ([#878]).
+- Ollama readiness requires the exact configured model ([#881]). Fallback
+  vectors are never served as real embeddings ([#882]). Model and content can
+  no longer collide in embedding cache keys ([#863]).
+
+**Network, git and protocol layers**
+
+- The HTTP client classifies native fetch errors correctly ([#876]) and lets
+  only one probe through while a circuit recovers ([#877]).
+- Git analysis keeps filenames that contain brackets, spaces or Unicode
+  ([#873]), and uses the exact change-detection cutoff time ([#875]).
+- MCP rate limits:
+  - endpoint patterns with the `g`/`y` flags no longer skip limits ([#859]);
+  - invalid token costs are rejected ([#860]);
+  - resetting a client clears all of its buckets ([#861]).
+- AG-UI state deltas:
+  - nested fields are part of the cache identity ([#857]);
+  - JSON Pointers are decoded and array indices validated ([#862], [#869]);
+  - cached patches can't be changed by callers ([#864]);
+  - capacity is validated ([#868]);
+  - refreshing an entry keeps unrelated ones ([#870]).
+- A2A queued deliveries survive replacement at capacity ([#865]). Caller-input
+  errors are no longer retried ([#866]). File depth limits are measured from
+  the checkout root ([#856]).
+
+### Changed
+
+- **Breaking for `agentic-qe/governance` users:** `WinnerResult.confidence` is
+  renamed to `heuristicScore` ([#901]).
+- `aqe workflow schedule` exits with an error for an invalid cron expression
+  ([#903]).
+- A blocked Gemini prompt no longer fails over to another provider. See
+  [#912] for whether such responses should be cached.
+- Onboarding docs and the quality-evidence presentation were redesigned
+  ([#904]).
+
+[#856]: https://github.com/proffesor-for-testing/agentic-qe/pull/856
+[#857]: https://github.com/proffesor-for-testing/agentic-qe/pull/857
+[#859]: https://github.com/proffesor-for-testing/agentic-qe/pull/859
+[#860]: https://github.com/proffesor-for-testing/agentic-qe/pull/860
+[#861]: https://github.com/proffesor-for-testing/agentic-qe/pull/861
+[#862]: https://github.com/proffesor-for-testing/agentic-qe/pull/862
+[#863]: https://github.com/proffesor-for-testing/agentic-qe/pull/863
+[#864]: https://github.com/proffesor-for-testing/agentic-qe/pull/864
+[#865]: https://github.com/proffesor-for-testing/agentic-qe/pull/865
+[#866]: https://github.com/proffesor-for-testing/agentic-qe/pull/866
+[#867]: https://github.com/proffesor-for-testing/agentic-qe/pull/867
+[#868]: https://github.com/proffesor-for-testing/agentic-qe/pull/868
+[#869]: https://github.com/proffesor-for-testing/agentic-qe/pull/869
+[#870]: https://github.com/proffesor-for-testing/agentic-qe/pull/870
+[#873]: https://github.com/proffesor-for-testing/agentic-qe/pull/873
+[#875]: https://github.com/proffesor-for-testing/agentic-qe/pull/875
+[#876]: https://github.com/proffesor-for-testing/agentic-qe/pull/876
+[#877]: https://github.com/proffesor-for-testing/agentic-qe/pull/877
+[#878]: https://github.com/proffesor-for-testing/agentic-qe/pull/878
+[#879]: https://github.com/proffesor-for-testing/agentic-qe/pull/879
+[#880]: https://github.com/proffesor-for-testing/agentic-qe/pull/880
+[#881]: https://github.com/proffesor-for-testing/agentic-qe/pull/881
+[#882]: https://github.com/proffesor-for-testing/agentic-qe/pull/882
+[#883]: https://github.com/proffesor-for-testing/agentic-qe/pull/883
+[#884]: https://github.com/proffesor-for-testing/agentic-qe/pull/884
+[#886]: https://github.com/proffesor-for-testing/agentic-qe/pull/886
+[#887]: https://github.com/proffesor-for-testing/agentic-qe/pull/887
+[#891]: https://github.com/proffesor-for-testing/agentic-qe/pull/891
+[#892]: https://github.com/proffesor-for-testing/agentic-qe/pull/892
+[#893]: https://github.com/proffesor-for-testing/agentic-qe/pull/893
+[#894]: https://github.com/proffesor-for-testing/agentic-qe/pull/894
+[#895]: https://github.com/proffesor-for-testing/agentic-qe/pull/895
+[#896]: https://github.com/proffesor-for-testing/agentic-qe/pull/896
+[#898]: https://github.com/proffesor-for-testing/agentic-qe/pull/898
+[#899]: https://github.com/proffesor-for-testing/agentic-qe/pull/899
+[#900]: https://github.com/proffesor-for-testing/agentic-qe/pull/900
+[#901]: https://github.com/proffesor-for-testing/agentic-qe/pull/901
+[#903]: https://github.com/proffesor-for-testing/agentic-qe/pull/903
+[#904]: https://github.com/proffesor-for-testing/agentic-qe/pull/904
+[#912]: https://github.com/proffesor-for-testing/agentic-qe/issues/912
+[#916]: https://github.com/proffesor-for-testing/agentic-qe/pull/916
+
+## [3.14.8] - 2026-10-04
+
+This patch removes a high-severity dependency advisory from the installed
+package and fixes about thirty reliability bugs. Memory searches stay in
+their namespace and page correctly. The self-learning engine keeps its patterns
+and feedback across restarts and storage failures. Test runs and CI gates now
+report only what actually ran and passed. Caches can no longer hand back stale
+or shared results.
+
+### Security
+
+- Installing `agentic-qe` no longer pulls in `braces` (GHSA-vfj7-8cjw-p6xm, a
+  high-severity denial of service). No fixed `braces` release exists, so file
+  scanning now uses `tinyglobby` instead of `fast-glob`. The files it finds are
+  unchanged, and scans are faster ([#837]).
+- The bundled ruflo helpers are refreshed to 3.51.1, with two local hardening
+  patches. The session helper can no longer be steered by a crafted session
+  file to write outside the project. The auto-memory helper loads its modules
+  from its own install location instead of the opened project. Dangerous shell
+  commands are now actually blocked by the pre-bash hook ([#837]).
+
+### Fixed
+
+**Memory**
+
+- Semantic searches without an explicit namespace stay in the default
+  namespace instead of returning entries from every namespace ([#816]).
+- Paged memory queries report correctly whether another page exists ([#817]).
+- Two agents sharing knowledge at the same moment no longer overwrite each
+  other's share ([#822]).
+- Memory key searches honour only `*` and `?` as wildcards. Persistent
+  searches no longer treat `_` and `%` as wildcards, and in-memory searches
+  match whole keys ([#825]).
+
+**Self-learning (SONA)**
+
+- Deleting a pattern removes it from both the queued and the stored state, so
+  it doesn't come back ([#818]).
+- String actions that look like JSON keep their exact value across a restart
+  ([#819]).
+- A closed persistent engine can be initialized again ([#820]).
+- Pattern sync keeps the feedback counters you have already recorded
+  ([#823]).
+- Writes deferred after a native storage failure are kept and saved on the next
+  successful flush instead of being lost ([#829]).
+
+**Test execution and CI gates**
+
+- Timed-out test runners are stopped together with their whole process tree
+  ([#824]).
+- Coverage evidence comes only from the current run, never from an earlier
+  run's leftover files ([#827]).
+- A retried test counts as passing only when the retry actually ran and passed
+  at least one test; a retry whose filter matched nothing stays failed
+  ([#830]).
+- The quality gate's mechanical oracle accepts only real boolean evidence;
+  strings such as `"false"` no longer count as passing ([#828]).
+- `aqe ci` rejects unknown or empty phase selections ([#832]), reads your real
+  YAML configuration instead of falling back to default phases ([#834]), and
+  enforces the coverage threshold you configured ([#835]).
+
+**MCP server, caching and runtime**
+
+- Live status reads (`task_status`, fleet, agent, health and metrics) return
+  current data instead of a cached snapshot up to an hour old, so a finished
+  task no longer shows as `running`. Other cached reads are kept ([#831]).
+- The MCP connection pool never gives one connection to two callers at once,
+  and doesn't prune connections still in use ([#844]). Concurrent start-up
+  creates the pool only once, and shutdown during start-up leaves no timers
+  running ([#848]).
+- The LLM response cache keys requests on an unambiguous identity, so different
+  requests can no longer share a cached answer ([#841]). Importing a cache
+  snapshot no longer duplicates entries in the eviction order ([#842]).
+- Session-cache fingerprints follow real JSON values, so different dates or
+  arrays no longer collide ([#845]). Refreshing a cached operation no longer
+  evicts an unrelated result when the cache is full ([#850]).
+- Cached embedding vectors are copied, so a caller changing its array can't
+  corrupt the cache ([#846]).
+- A plugin whose copy into the cache fails partway is cleaned up, so a retry
+  stores it properly instead of reusing the broken copy ([#840]).
+- With retries disabled, an already-cancelled operation no longer runs once
+  anyway ([#843]).
+- An older A2A webhook send can no longer remove a newer queued replacement,
+  or report retries after it was cancelled ([#847]).
+- The quality daemon clears expired background work before rejecting a new
+  quality-gate or CI failure alert as over capacity ([#849]).
+- CLI commands release the stores they opened before exiting, so
+  `patterns.rvf.lock` is no longer left behind ([#821]).
+
+### Changed
+
+- Test suites for SONA persistence and MCP cancellation use isolated SQLite
+  fixtures and the real runner, so they no longer interfere with each other
+  ([#826], [#833]).
+- Updated `figlet` in the ruflo graph-intelligence plugin ([#839]).
+
+[#816]: https://github.com/proffesor-for-testing/agentic-qe/pull/816
+[#817]: https://github.com/proffesor-for-testing/agentic-qe/pull/817
+[#818]: https://github.com/proffesor-for-testing/agentic-qe/pull/818
+[#819]: https://github.com/proffesor-for-testing/agentic-qe/pull/819
+[#820]: https://github.com/proffesor-for-testing/agentic-qe/pull/820
+[#821]: https://github.com/proffesor-for-testing/agentic-qe/pull/821
+[#822]: https://github.com/proffesor-for-testing/agentic-qe/pull/822
+[#823]: https://github.com/proffesor-for-testing/agentic-qe/pull/823
+[#824]: https://github.com/proffesor-for-testing/agentic-qe/pull/824
+[#825]: https://github.com/proffesor-for-testing/agentic-qe/pull/825
+[#826]: https://github.com/proffesor-for-testing/agentic-qe/pull/826
+[#827]: https://github.com/proffesor-for-testing/agentic-qe/pull/827
+[#828]: https://github.com/proffesor-for-testing/agentic-qe/pull/828
+[#829]: https://github.com/proffesor-for-testing/agentic-qe/pull/829
+[#830]: https://github.com/proffesor-for-testing/agentic-qe/pull/830
+[#831]: https://github.com/proffesor-for-testing/agentic-qe/pull/831
+[#832]: https://github.com/proffesor-for-testing/agentic-qe/pull/832
+[#833]: https://github.com/proffesor-for-testing/agentic-qe/pull/833
+[#834]: https://github.com/proffesor-for-testing/agentic-qe/pull/834
+[#835]: https://github.com/proffesor-for-testing/agentic-qe/pull/835
+[#837]: https://github.com/proffesor-for-testing/agentic-qe/pull/837
+[#839]: https://github.com/proffesor-for-testing/agentic-qe/pull/839
+[#840]: https://github.com/proffesor-for-testing/agentic-qe/pull/840
+[#841]: https://github.com/proffesor-for-testing/agentic-qe/pull/841
+[#842]: https://github.com/proffesor-for-testing/agentic-qe/pull/842
+[#843]: https://github.com/proffesor-for-testing/agentic-qe/pull/843
+[#844]: https://github.com/proffesor-for-testing/agentic-qe/pull/844
+[#845]: https://github.com/proffesor-for-testing/agentic-qe/pull/845
+[#846]: https://github.com/proffesor-for-testing/agentic-qe/pull/846
+[#847]: https://github.com/proffesor-for-testing/agentic-qe/pull/847
+[#848]: https://github.com/proffesor-for-testing/agentic-qe/pull/848
+[#849]: https://github.com/proffesor-for-testing/agentic-qe/pull/849
+[#850]: https://github.com/proffesor-for-testing/agentic-qe/pull/850
+
 ## [3.14.7] - 2026-10-02
 
 This patch makes browser setup opt-in, so installing AQE no longer downloads