agentic-qe 3.15.1 → 3.15.3

package/.claude/helpers/brain-checkpoint.cjs

@@ -17,7 +17,27 @@ const AQE_DIR = path.join(PROJECT_ROOT, '.agentic-qe');
 const RVF_PATH = path.join(AQE_DIR, 'aqe.rvf');
 const DB_PATH = path.join(AQE_DIR, 'memory.db');
 const MAX_AGE_HOURS = 24;
-const AQE_BIN = process.env.AQE_HOOK_BIN || (process.platform === 'win32' ? 'aqe.cmd' : 'aqe');
+/**
+ * How to run `aqe`. POSIX: the `aqe` binary. Windows (#872): never execFile
+ * `aqe.cmd` (EINVAL without a shell since CVE-2024-27980, and a shell is unsafe);
+ * reuse the hook shim's resolver, which finds the bundle and runs it via node.
+ */
+function aqeInvocation() {
+  if (process.platform !== 'win32') return { cmd: process.env.AQE_HOOK_BIN || 'aqe', args: [] };
+  const shimPath = path.join(__dirname, '..', 'hooks', 'aqe-hook.cjs');
+  let src = '';
+  try { src = fs.readFileSync(shimPath, 'utf8'); } catch { /* missing: handled below */ }
+  // Only a #872+ shim may be required: an older one runs its hook main at load
+  // time (spawn + process.exit(0)), which would kill this export silently.
+  if (!src.includes('resolveAqeInvocation') || !src.includes('require.main === module')) {
+    return { cmd: null, args: [], reason: '.claude/hooks/aqe-hook.cjs is missing or predates #872; re-run `aqe init`' };
+  }
+  try {
+    return require(shimPath).resolveAqeInvocation({ project: PROJECT_ROOT });
+  } catch (e) {
+    return { cmd: null, args: [], reason: 'aqe-hook.cjs failed to load: ' + e.message };
+  }
+}
 
 // Mount-local kill switch. `brain export` (below) spawns a native RVF writer
 // that, on a macOS Docker virtiofs bind mount, deadlocks in a futex and IGNORES
@@ -31,15 +51,35 @@ const CHECKPOINT_DISABLED =
 
 function log(msg) { process.stderr.write('[brain-checkpoint] ' + msg + '\n'); }
 
+/** A repository can commit `.agentic-qe` as a symlink: only write into a REAL dir. */
+function isRealDir(dir) {
+  try { const st = fs.lstatSync(dir); return st.isDirectory() && !st.isSymbolicLink(); } catch { return false; }
+}
+
+/**
+ * Remove whatever sits at `p` WITHOUT following it: unlink drops a planted
+ * symlink itself (even a dangling one, which existsSync reports as absent),
+ * so the exporter below creates a fresh regular file instead of writing
+ * through the link.
+ */
+function removeEntry(p) {
+  try { fs.unlinkSync(p); } catch (e) { if (!e || e.code !== 'ENOENT') throw e; }
+}
+
 function exportBrain() {
   if (!fs.existsSync(DB_PATH)) { log('No memory.db, skipping'); return { exported: false }; }
+  if (!isRealDir(AQE_DIR)) {
+    const reason = '.agentic-qe is a symlink; refusing to write through it';
+    log('Export skipped: ' + reason); return { exported: false, reason };
+  }
+  const aqe = aqeInvocation();
+  if (!aqe.cmd) { log('Export skipped: ' + aqe.reason); return { exported: false, reason: aqe.reason }; }
   try {
-    if (fs.existsSync(RVF_PATH)) fs.unlinkSync(RVF_PATH);
-    const idmap = RVF_PATH + '.idmap.json';
-    if (fs.existsSync(idmap)) fs.unlinkSync(idmap);
+    removeEntry(RVF_PATH);
+    removeEntry(RVF_PATH + '.idmap.json');
     const result = execFileSync(
-      AQE_BIN, ['brain', 'export', '-o', RVF_PATH, '--format', 'rvf'],
-      { timeout: 60000, encoding: 'utf-8' }
+      aqe.cmd, [...aqe.args, 'brain', 'export', '-o', RVF_PATH, '--format', 'rvf'],
+      { timeout: 60000, encoding: 'utf-8', windowsHide: true }
     );
     const m = result.match(/Patterns:\s+(\d+)/);
     const p = m ? m[1] : '0';

package/.claude/hooks/aqe-hook.cjs

@@ -16,7 +16,8 @@
  * Contract:
  *   * resolve a PROJECT-LOCAL AQE bundle and run it via THIS node (no shell),
  *     or invoke an already-installed `aqe` binary without package-manager or
- *     network resolution;
+ *     network resolution (on Windows: the global install's bundle, never the
+ *     `aqe.cmd` shim — see resolveAqeInvocation, #872);
  *   * if nothing resolves, no-op (a hook must never block a turn);
  *   * keep stderr OUT of the transcript, but tee fatal native-init markers
  *     (e.g. better-sqlite3 `invalid ELF header`) to a throttled, durable
@@ -37,39 +38,240 @@
 
 'use strict';
 
-const { spawnSync } = require('node:child_process');
+const childProcess = require('node:child_process');
 const fs = require('node:fs');
 const path = require('node:path');
 
 const PROJECT = process.env.CLAUDE_PROJECT_DIR || '.';
 const args = process.argv.slice(2); // hook subcommand + its args
 
-// Resolve how to run `<runner> hooks <args>`, in priority order:
-//   1. installed dependency bundle  (a user's project: node_modules/agentic-qe)
-//   2. local source build           (this repo: ./dist)
-//   -> run either directly via process.execPath (this node): no shell, no
-//      node_modules/.bin/aqe(.cmd) wrapper, fully cross-platform.
-//   3. installed `aqe` binary        (global/managed installs without a local
-//      bundle). AQE_HOOK_BIN is a test/managed-install seam; no package manager
-//      is ever invoked from a lifecycle hook.
-const candidates = [
-  process.env.AQE_HOOK_BUNDLE,
-  path.join(PROJECT, 'node_modules', 'agentic-qe', 'dist', 'cli', 'bundle.js'),
-  path.join(PROJECT, 'dist', 'cli', 'bundle.js'),
-].filter(Boolean);
-
-let cmd;
-let cmdArgs;
-let bundle;
-for (const p of candidates) {
-  try { if (fs.existsSync(p)) { bundle = p; break; } } catch { /* ignore */ }
+const BUNDLE_IN_PACKAGE = ['node_modules', 'agentic-qe', 'dist', 'cli', 'bundle.js'];
+// Script shims that Node cannot start without a shell (.ps1 is never directly
+// executable at all). They are only ever READ to find the JS entry behind them.
+// Windows ignores trailing dots/spaces in file names, so `aqe.cmd.` IS aqe.cmd.
+const SCRIPT_SHIM = /\.(cmd|bat|ps1)[. ]*$/i;
+const PREFIX_CACHE_TTL_MS = 5 * 60 * 1000;
+const PREFIX_CACHE_MAX_BYTES = 4096;
+
+function existsSafe(p) { try { return fs.existsSync(p); } catch { return false; } }
+function readSafe(p) { try { return fs.readFileSync(p, 'utf8'); } catch { return ''; } }
+
+/** Env lookup that is case-insensitive on Windows (PATH is usually `Path`). */
+function envGet(env, name, platform) {
+  if (platform !== 'win32') return env[name];
+  const key = Object.keys(env).find((k) => k.toUpperCase() === name.toUpperCase());
+  return key === undefined ? undefined : env[key];
+}
+
+/**
+ * The target a package-manager `.cmd` shim launches, relative to its directory:
+ *   npm:     "%_prog%"  "%dp0%\node_modules\agentic-qe\dist\cli\bundle.js" %*
+ *   pnpm:    "%~dp0\global\5\node_modules\agentic-qe\dist\cli\bundle.js" %*
+ *   yarn v1: @"%~dp0\..\Data\global\node_modules\.bin\aqe.cmd"   %*  (another .cmd)
+ * Volta's `volta run %~n0 %*` names no file, so it yields null.
+ */
+function parseCmdShimTarget(shimPath, content, p) {
+  const m = /"%~?dp0%?\\([^"%]+\.(?:[cm]?js|cmd|bat))"/i.exec(content || '');
+  return m ? p.join(p.dirname(shimPath), ...m[1].split(/[\\/]+/)) : null;
+}
+
+/**
+ * The JS bundle behind a shim: its parsed JS target, else npm's layout beside
+ * it, else (yarn v1) ONE hop through the `.cmd` it delegates to. Files are only
+ * read; the result is always run via node, never as a script.
+ */
+function shimBundle(shim, p, exists, readFile, hops) {
+  if (!exists(shim)) return null;
+  const target = parseCmdShimTarget(shim, readFile(shim), p);
+  const direct = [target && /\.[cm]?js$/i.test(target) ? target : null,
+    p.join(p.dirname(shim), ...BUNDLE_IN_PACKAGE)];
+  for (const b of direct) if (b && exists(b)) return b;
+  if (hops > 0 && target && /\.(cmd|bat)$/i.test(target)) {
+    return shimBundle(target, p, exists, readFile, hops - 1);
+  }
+  return null;
+}
+
+/**
+ * `npm prefix -g` costs a node spawn (up to 1.5s) and only runs when nothing
+ * else resolved, i.e. on EVERY hook while AQE is unresolvable. Cache the answer
+ * (including "none") per node binary for a few minutes in the project's
+ * .agentic-qe/ (not a shared temp dir another user could pre-seed).
+ */
+function cachedNpmPrefix(lookup, execPath, p, exists, cacheFile, now) {
+  if (!cacheFile) return lookup(execPath, p, exists);
+  try {
+    // Never follow a symlink/junction or read something huge: regular file only.
+    const st = fs.lstatSync(cacheFile);
+    if (st.isFile() && st.size <= PREFIX_CACHE_MAX_BYTES) {
+      const c = JSON.parse(fs.readFileSync(cacheFile, 'utf8'));
+      if (c && c.execPath === execPath && now - c.at >= 0 && now - c.at < PREFIX_CACHE_TTL_MS) {
+        return typeof c.prefix === 'string' ? c.prefix : null;
+      }
+    }
+  } catch { /* no or unreadable cache: look it up */ }
+  const prefix = lookup(execPath, p, exists) || null;
+  writeFileAtomic(cacheFile, JSON.stringify({ execPath, prefix, at: now }));
+  return prefix;
+}
+
+/**
+ * A repository can commit `.agentic-qe` (or a file in it) as a symlink. Every
+ * write this hook makes therefore goes only into a REAL directory (created if
+ * missing; a symlink/junction is refused, never followed) ...
+ */
+function ensureRealDir(dir) {
+  try {
+    let st;
+    try { st = fs.lstatSync(dir); } catch (e) {
+      if (!e || e.code !== 'ENOENT') return false;
+      fs.mkdirSync(dir, { recursive: true });
+      st = fs.lstatSync(dir);
+    }
+    return st.isDirectory() && !st.isSymbolicLink();
+  } catch { return false; }
+}
+
+/**
+ * ... and appends only to a regular file: lstat refuses an existing link or
+ * non-file, and O_NOFOLLOW (POSIX; undefined on Windows, where the lstat check
+ * stands alone) closes the race. Returns false when it declined to write.
+ */
+function appendFileSafe(file, text) {
+  if (!ensureRealDir(path.dirname(file))) return false;
+  try {
+    if (!fs.lstatSync(file).isFile()) return false; // lstat: a symlink is never isFile()
+  } catch (e) { if (!e || e.code !== 'ENOENT') return false; }
+  const c = fs.constants;
+  let fd;
+  try {
+    fd = fs.openSync(file, c.O_APPEND | c.O_CREAT | c.O_WRONLY | (c.O_NOFOLLOW || 0), 0o644);
+    fs.writeSync(fd, text);
+    return true;
+  } catch { return false; } finally {
+    if (fd !== undefined) { try { fs.closeSync(fd); } catch { /* ignore */ } }
+  }
+}
+
+/**
+ * Write via a fresh temp file (O_EXCL: never opens an existing path or follows
+ * a planted link) + rename. rename REPLACES a symlink at the destination rather
+ * than writing through it, and readers never see a torn file. Best-effort.
+ */
+function writeFileAtomic(file, data) {
+  if (!ensureRealDir(path.dirname(file))) return;
+  const tmp = `${file}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
+  try {
+    fs.writeFileSync(tmp, data, { flag: 'wx' });
+    fs.renameSync(tmp, file);
+  } catch {
+    try { fs.unlinkSync(tmp); } catch { /* nothing to clean up */ }
+  }
 }
-if (bundle) {
-  cmd = process.execPath;
-  cmdArgs = [bundle, 'hooks', ...args];
-} else {
-  cmd = process.env.AQE_HOOK_BIN || (process.platform === 'win32' ? 'aqe.cmd' : 'aqe');
-  cmdArgs = ['hooks', ...args];
+
+/** `npm prefix -g` via the npm CLI bundled next to node.exe: no shell, no .cmd. */
+function npmGlobalPrefix(execPath, p, exists) {
+  const npmCli = p.join(p.dirname(execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js');
+  if (!exists(npmCli)) return null;
+  try {
+    const r = childProcess.spawnSync(execPath, [npmCli, 'prefix', '-g'], {
+      encoding: 'utf8', timeout: 1500, stdio: ['ignore', 'pipe', 'ignore'], windowsHide: true,
+    });
+    return r && r.status === 0 && r.stdout ? r.stdout.trim() || null : null;
+  } catch { return null; }
+}
+
+/**
+ * Resolve how to run `<runner> hooks <args>`, in priority order:
+ *   1. AQE_HOOK_BUNDLE, the installed dependency bundle (node_modules/agentic-qe)
+ *      or a local source build (./dist), run via process.execPath (this node):
+ *      no shell, no node_modules/.bin/aqe(.cmd) wrapper.
+ *   2. POSIX: the installed `aqe` binary (AQE_HOOK_BIN is a test/managed-install
+ *      seam). No package manager is ever invoked from a lifecycle hook.
+ *   3. Windows (#872): NEVER spawn `aqe.cmd`. Since the CVE-2024-27980 fix Node
+ *      refuses to start .cmd/.bat without `shell: true` (EINVAL), and a shell
+ *      would expose Claude Code-supplied arguments (--command, prompt text) to
+ *      cmd.exe metacharacter injection. Instead find the bundle the global shim
+ *      would have launched and run it via process.execPath: parse `aqe.cmd` on
+ *      PATH (npm, pnpm, yarn v1), then npm's global layouts, then a cached
+ *      `npm prefix -g` (bundled npm CLI). An AQE_HOOK_BIN naming a .cmd/.bat/
+ *      .ps1 is resolved the same way, never spawned.
+ *   4. Nothing resolved (e.g. Volta): { cmd: null, reason }. The caller logs it.
+ *
+ * Returns { cmd, args, source }; `args` are the runner args that precede
+ * `hooks <subcommand ...>`. Every input is injectable for tests
+ * (`prefixCacheFile: null` disables the npm-prefix cache).
+ */
+function resolveAqeInvocation(opts) {
+  const o = opts || {};
+  const platform = o.platform || process.platform;
+  const env = o.env || process.env;
+  const execPath = o.execPath || process.execPath;
+  const exists = o.exists || existsSafe;
+  const readFile = o.readFile || readSafe;
+  const npmPrefix = o.npmPrefix || npmGlobalPrefix;
+  // Host path module (=== path.win32 on real Windows); injectable for tests.
+  const p = o.path || path;
+  const project = o.project || env.CLAUDE_PROJECT_DIR || '.';
+  // Always hand node an ABSOLUTE path: a relative one such as `--require=./x.js`
+  // would be parsed by node as an option, not as the script to run.
+  const viaNode = (bundle, source) => ({ cmd: execPath, args: [p.resolve(bundle)], source });
+
+  const local = [
+    env.AQE_HOOK_BUNDLE,
+    p.join(project, ...BUNDLE_IN_PACKAGE),
+    p.join(project, 'dist', 'cli', 'bundle.js'),
+  ].filter(Boolean);
+  for (const b of local) if (exists(b)) return viaNode(b, 'project-bundle');
+
+  const bin = env.AQE_HOOK_BIN;
+  if (platform !== 'win32') return { cmd: bin || 'aqe', args: [], source: 'bin' };
+  // A real executable (aqe.exe, a test stub) can be spawned without a shell.
+  if (bin && !SCRIPT_SHIM.test(bin)) return { cmd: bin, args: [], source: 'bin' };
+
+  const shims = bin ? [bin] : [];
+  for (const dir of (envGet(env, 'PATH', platform) || '').split(';')) {
+    const d = dir.trim().replace(/^"(.*)"$/, '$1');
+    // Relative PATH entries (`.`, `--require=.`) resolve against an arbitrary
+    // cwd; Windows itself never searches them for a hook-launched process here.
+    if (d && p.isAbsolute(d)) shims.push(p.join(d, 'aqe.cmd'));
+  }
+  for (const shim of shims) {
+    const b = shimBundle(shim, p, exists, readFile, 1);
+    if (b) return viaNode(b, `global-shim:${shim}`);
+  }
+
+  const appData = envGet(env, 'APPDATA', platform);
+  const prefixes = [
+    envGet(env, 'npm_config_prefix', platform),
+    appData && p.join(appData, 'npm'), // npm's default global prefix on Windows
+    p.dirname(execPath),               // nvm-windows: prefix = node install dir
+  ].filter(Boolean);
+  for (const prefix of prefixes) {
+    const b = p.join(prefix, ...BUNDLE_IN_PACKAGE);
+    if (exists(b)) return viaNode(b, `global-prefix:${prefix}`);
+  }
+  const cacheFile = o.prefixCacheFile === undefined
+    ? p.join(project, '.agentic-qe', 'hook-npm-prefix.json') : o.prefixCacheFile;
+  const queried = cachedNpmPrefix(npmPrefix, execPath, p, exists, cacheFile, o.now || Date.now());
+  if (queried && exists(p.join(queried, ...BUNDLE_IN_PACKAGE))) {
+    return viaNode(p.join(queried, ...BUNDLE_IN_PACKAGE), `npm-prefix:${queried}`);
+  }
+
+  const binNote = bin
+    ? `AQE_HOOK_BIN=${bin} is a .cmd/.bat/.ps1 script, which is never started without `
+      + 'a shell, and no agentic-qe bundle was found behind it; ' : '';
+  return {
+    cmd: null,
+    args: [],
+    source: 'none',
+    reason: `${binNote}no agentic-qe bundle found (Windows cannot spawn aqe.cmd without a shell `
+      + 'since CVE-2024-27980, and a shell is unsafe for hook arguments). Volta and other '
+      + 'non-npm/pnpm/yarn-v1 shims cannot be followed. Fix: `npm install -D agentic-qe`, '
+      + 'or set AQE_HOOK_BUNDLE to the global bundle, e.g. '
+      + '<npm global prefix>\\node_modules\\agentic-qe\\dist\\cli\\bundle.js '
+      + '(Volta: the agentic-qe dist\\cli\\bundle.js inside your Volta tools image directory)',
+  };
 }
 
 // Fatal init markers that mean the hook ran but its persistence layer is dead
@@ -100,18 +302,36 @@ function recordHookHealth(line) {
   try {
     const logPath = path.join(PROJECT, '.agentic-qe', 'hooks-health.log');
     // Throttle: skip if we logged within the last 5 min (avoid a line/turn).
+    // lstat, so a planted symlink's TARGET mtime never decides anything.
     try {
-      const st = fs.statSync(logPath);
-      if (Date.now() - st.mtimeMs < 5 * 60 * 1000) return;
+      const st = fs.lstatSync(logPath);
+      if (st.isFile() && Date.now() - st.mtimeMs < 5 * 60 * 1000) return;
     } catch { /* no log yet — fall through and create it */ }
-    fs.mkdirSync(path.dirname(logPath), { recursive: true });
-    fs.appendFileSync(logPath, line);
+    appendFileSafe(logPath, line); // never through a symlinked log or .agentic-qe
   } catch { /* health logging must never block a turn */ }
 }
 
-let out = '';
-try {
-  const res = spawnSync(cmd, cmdArgs, {
+/** Spawn the resolved runner; returns its stdout ('' on any failure). */
+function runHook() {
+  const ts = () => new Date().toISOString();
+  const subcmd = args[0] || 'unknown';
+  const inv = resolveAqeInvocation();
+  if (!inv.cmd) {
+    recordHookHealth(`[${ts()}] SPAWN-FAILED hook could not start `
+      + `(cmd=${subcmd}): ${inv.reason}. Learning for this invocation was NOT captured.\n`);
+    return '';
+  }
+  let out = '';
+  try {
+    out = superviseSpawn(inv.cmd, [...inv.args, 'hooks', ...args], subcmd, ts);
+  } catch { /* never block a turn */ }
+  return out;
+}
+
+function superviseSpawn(cmd, cmdArgs, subcmd, ts) {
+  // shell is deliberately NOT set: arguments go to CreateProcess/execve verbatim.
+  const res = childProcess.spawnSync(cmd, cmdArgs, {
+    windowsHide: true,
     // Claude Code delivers hook event data (prompt, tool_input, etc.) as JSON
     // on stdin — `$PROMPT`/`$TOOL_INPUT_*` env-var substitution is NOT
     // reliable on every hook surface (see hooks-shared.ts:readStdinJsonEvent's
@@ -123,11 +343,9 @@ try {
     maxBuffer: 16 * 1024 * 1024,
     timeout: SPAWN_TIMEOUT_MS,
   });
-  out = (res && res.stdout) || '';
-  const subcmd = args[0] || 'unknown';
+  const out = (res && res.stdout) || '';
   const stderr = (res && res.stderr) || '';
   const hit = FATAL_MARKERS.find((m) => stderr.includes(m));
-  const ts = () => new Date().toISOString();
   if (hit) {
     // The fix depends on WHICH failure hit. A native-binary marker (invalid ELF
     // header / ERR_DLOPEN_FAILED / wrong Node version) is a real rebuild case.
@@ -183,20 +401,31 @@ try {
     recordHookHealth(`[${ts()}] EMPTY-RESULT hook exited status=${res.status} `
       + `with no JSON output (cmd=${subcmd}). stderr: ${stderr.slice(0, 300)}\n`);
   }
-} catch { /* never block a turn */ }
-
-// Emit only the top-level JSON object: the first line beginning with '{' through
-// the first line beginning with '}' (pretty-printed JSON closes at column 0;
-// nested closes are indented). Drops leading init-noise lines AND any async log
-// lines printed after the JSON.
-const lines = out.split('\n');
-const start = lines.findIndex((l) => l.startsWith('{'));
-if (start !== -1) {
-  let end = lines.length - 1;
-  for (let i = start; i < lines.length; i++) {
-    if (lines[i].startsWith('}')) { end = i; break; }
+  return out;
+}
+
+function main() {
+  const out = runHook();
+  // Emit only the top-level JSON object: the first line beginning with '{' through
+  // the first line beginning with '}' (pretty-printed JSON closes at column 0;
+  // nested closes are indented). Drops leading init-noise lines AND any async log
+  // lines printed after the JSON.
+  const lines = out.split('\n');
+  const start = lines.findIndex((l) => l.startsWith('{'));
+  if (start !== -1) {
+    let end = lines.length - 1;
+    for (let i = start; i < lines.length; i++) {
+      if (lines[i].startsWith('}')) { end = i; break; }
+    }
+    process.stdout.write(lines.slice(start, end + 1).join('\n') + '\n');
   }
-  process.stdout.write(lines.slice(start, end + 1).join('\n') + '\n');
+  process.exit(0);
 }
 
-process.exit(0);
+// Exported so brain-checkpoint.cjs and unit tests can reuse the resolver;
+// requiring this file never spawns anything.
+// brain-checkpoint.cjs checks for this export (and the require.main guard
+// below) before requiring this file; keep both.
+module.exports = { resolveAqeInvocation, parseCmdShimTarget };
+
+if (require.main === module) main();

package/.claude/skills/skills-manifest.json

@@ -940,7 +940,7 @@
   },
   "metadata": {
     "generatedBy": "Agentic QE Fleet",
-    "fleetVersion": "3.15.1",
+    "fleetVersion": "3.15.3",
     "manifestVersion": "1.4.0",
     "lastUpdated": "2026-04-13T00:00:00.000Z",
     "contributors": [

package/CHANGELOG.md

@@ -5,6 +5,135 @@ All notable changes to the Agentic QE project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.15.3] - 2026-10-11
+
+A bug-fix release. AQE hooks work on Windows again. Several hangs, data-safety
+and correctness bugs are fixed, mostly found while testing the
+`agentic-qe-fleet` plugin end to end and in the October review batch.
+
+### Fixed
+
+- **AQE hooks run on Windows again.** On Windows, hooks generated by
+  `aqe init` silently did nothing when agentic-qe was installed globally,
+  because Node refuses to start `aqe.cmd` without a shell. Hooks now run the
+  installed AQE bundle directly with Node. That works for npm, pnpm and
+  yarn v1 global installs; Volta users can set `AQE_HOOK_BUNDLE`. Re-run
+  `aqe init` to refresh existing hooks. This was verified with a simulated
+  Windows environment, not yet on a real Windows machine ([#872]).
+- **Hook and daemon files can't be redirected.** The hook, brain-checkpoint
+  and daemon scripts no longer follow symbolic links when writing into
+  `.agentic-qe/` (#872 hardening).
+- **No more hangs on stalled servers.** These now time out instead of
+  waiting forever when a server sends headers and then stalls:
+  - LLM providers (including slow but healthy streams, which keep
+    working) ([#889]);
+  - Ollama embeddings ([#885]);
+  - the Ollama and OpenRouter consensus providers ([#961]).
+- **`RateLimiter.wait()` no longer hangs** when a request can never fit the
+  bucket ([#905]).
+- **Git refs are validated.** A commit reference that looks like a git option
+  (for example `--output=…`) is rejected instead of being passed to git.
+  Refs such as `@{-1}` and `HEAD^!` now work correctly ([#960]).
+- **Test retries target exactly the right test.** Retried test names and paths
+  are escaped and anchored for Jest, Vitest and Mocha. Names that start with
+  `-` work, and Jest 30's renamed path option is used ([#909]).
+- **`aqe test generate` writes every generated test**, not just the first
+  10. Generated tests never land outside your project, and existing test
+  files are kept unless you pass `--force` ([#936]).
+- **Session journal is crash-safe.** A partial write is completed, not
+  duplicated. If the disk stays full, the oldest buffered entries are dropped,
+  and a gap marker keeps the session resumable ([#910]).
+- **Fresh projects no longer log an RVF error.** Without an embedder you get
+  one clear warning that explains how to enable vector search, and dream
+  "apply" succeeds while the vector index is pending. The provenance check
+  that protects existing indexes is unchanged ([#852]).
+- **Cognitive complexity follows the SonarSource rules.** `else if` and
+  nesting are no longer double-counted, and keywords in comments or strings
+  are ignored ([#907]).
+- Cargo test categories no longer overlap ([#906]). The git analyzer includes
+  files from a repository's initial commit ([#874]). Optional native modules
+  with a missing platform binary now degrade with a clear reason ([#858]).
+- Hardening: costs, counters and caches are safe with keys such as
+  `constructor` or `__proto__`. Embedding cache keys can't collide. Cached
+  state deltas are JSON-safe ([#914]).
+
+### Changed
+
+- **Cognitive complexity scores are much lower.** Expect a one-time drop in
+  stored reports and trends after upgrading ([#907]).
+- **`aqe test generate` no longer overwrites existing test files.** Pass
+  `--force` to overwrite them ([#936]).
+- **`saveResults` on MCP domain tools.** The 11 tools that save results under
+  `.agentic-qe/results/` accept `saveResults: false`. They also return
+  `resultsSaved`, `resultsNote` and `savedFiles`, which is now always an
+  array ([#925], [#933]). `aqe test generate --no-save` prints the tests
+  instead of writing them.
+- `goap-status` rejects unknown status filters, including the empty string
+  (#894, from the October batch).
+- Dependency updates (lockfile only, dev dependencies) ([#938]).
+
+[#852]: https://github.com/proffesor-for-testing/agentic-qe/issues/852
+[#858]: https://github.com/proffesor-for-testing/agentic-qe/pull/858
+[#872]: https://github.com/proffesor-for-testing/agentic-qe/issues/872
+[#874]: https://github.com/proffesor-for-testing/agentic-qe/pull/874
+[#885]: https://github.com/proffesor-for-testing/agentic-qe/pull/885
+[#889]: https://github.com/proffesor-for-testing/agentic-qe/pull/889
+[#905]: https://github.com/proffesor-for-testing/agentic-qe/issues/905
+[#906]: https://github.com/proffesor-for-testing/agentic-qe/issues/906
+[#907]: https://github.com/proffesor-for-testing/agentic-qe/issues/907
+[#909]: https://github.com/proffesor-for-testing/agentic-qe/issues/909
+[#910]: https://github.com/proffesor-for-testing/agentic-qe/issues/910
+[#914]: https://github.com/proffesor-for-testing/agentic-qe/issues/914
+[#925]: https://github.com/proffesor-for-testing/agentic-qe/issues/925
+[#933]: https://github.com/proffesor-for-testing/agentic-qe/issues/933
+[#936]: https://github.com/proffesor-for-testing/agentic-qe/issues/936
+[#938]: https://github.com/proffesor-for-testing/agentic-qe/pull/938
+[#960]: https://github.com/proffesor-for-testing/agentic-qe/issues/960
+[#961]: https://github.com/proffesor-for-testing/agentic-qe/issues/961
+
+## [3.15.2] - 2026-10-10
+
+This hardening patch fixes problems found by installing the
+`agentic-qe-fleet` plugin from the marketplace into a fresh project and
+using it end to end.
+
+### Fixed
+
+- **No duplicate AQE MCP server.** When the `agentic-qe-fleet` plugin is
+  enabled, `aqe init` no longer also adds its own `agentic-qe` server to the
+  project's `.mcp.json`, so AQE is registered only once. If your project
+  already has that entry, init keeps it and tells you how to remove it. Use
+  `aqe init --with-mcp` to add the project entry anyway ([#922]).
+- **`aqe init --no-mcp` and `--no-governance` now work.** Both flags were
+  ignored before: init still wrote the MCP entry and the governance files.
+  Combining `--no-mcp` with `--with-mcp` now stops with a clear error
+  ([#931], [#935]).
+- **aqe-mod reports its real version.** The status file and the ruflo
+  console now show the plugin version instead of `0.1.0` ([#923]).
+- **aqe-mod remembers past refusals.** `/aqe-mod status` now shows totals
+  across sessions and the most recent refusal, not just the current
+  session's counts. The command text is never stored ([#924]).
+- **aqe-mod status file handling is hardened.** The mod no longer follows
+  symbolic links when reading or writing its status file, and it validates
+  what it reads back ([#930]).
+- **Test generation can skip saving results.** `test_generate_enhanced` (and
+  the other MCP tools that save results) accept `saveResults: false` to skip
+  writing reports under `.agentic-qe/results/`. The tool description now says
+  results are saved by default. `aqe test generate --no-save` prints the
+  generated tests instead of writing files ([#925]).
+- **No broken `ruflo` plugin entry in this repository.** The vendored `ruflo`
+  skill is now just its `SKILL.md`, so Claude Code no longer lists a broken
+  skills-directory plugin when you work in this repo ([#926]).
+
+[#922]: https://github.com/proffesor-for-testing/agentic-qe/issues/922
+[#923]: https://github.com/proffesor-for-testing/agentic-qe/issues/923
+[#924]: https://github.com/proffesor-for-testing/agentic-qe/issues/924
+[#925]: https://github.com/proffesor-for-testing/agentic-qe/issues/925
+[#926]: https://github.com/proffesor-for-testing/agentic-qe/issues/926
+[#930]: https://github.com/proffesor-for-testing/agentic-qe/pull/930
+[#931]: https://github.com/proffesor-for-testing/agentic-qe/issues/931
+[#935]: https://github.com/proffesor-for-testing/agentic-qe/issues/935
+
 ## [3.15.1] - 2026-10-10
 
 This patch hardens the aqe-mod guard that ships with the `agentic-qe-fleet`

package/assets/skills/skills-manifest.json

@@ -940,7 +940,7 @@
   },
   "metadata": {
     "generatedBy": "Agentic QE Fleet",
-    "fleetVersion": "3.15.1",
+    "fleetVersion": "3.15.3",
     "manifestVersion": "1.4.0",
     "lastUpdated": "2026-04-13T00:00:00.000Z",
     "contributors": [

package/dist/adapters/ag-ui/state-delta-cache.js

@@ -67,6 +67,15 @@ const TOOL_STATUS_TRANSITIONS = [
 // ============================================================================
 // State Delta Cache Implementation
 // ============================================================================
+/**
+ * AG-UI state is JSON. States are hashed (#857), diffed and cloned with the
+ * same JSON round trip, so a function, Date or undefined behaves as it does
+ * over the wire, and the cached delta always matches its key (#914). Values JSON
+ * cannot represent (BigInt, cycles) throw a TypeError.
+ */
+function toJson(value) {
+    return JSON.parse(JSON.stringify(value));
+}
 /**
  * LRU Cache for pre-computed state deltas
  *
@@ -113,11 +122,11 @@ export class StateDeltaCache {
             // Move to end for LRU (delete and re-add)
             this.cache.delete(key);
             this.cache.set(key, cached);
-            return structuredClone(cached.delta);
+            return toJson(cached.delta);
         }
         // Cache miss - compute delta
         this.misses++;
-        const delta = computeDiff(fromState, toState, this.config.diffConfig);
+        const delta = computeDiff(toJson(fromState), toJson(toState), this.config.diffConfig);
         // Store in cache
         this.setDelta(key, delta);
         return delta;
@@ -135,7 +144,7 @@ export class StateDeltaCache {
      */
     precompute(fromState, toState) {
         const key = this.computeCacheKey(fromState, toState);
-        const delta = computeDiff(fromState, toState, this.config.diffConfig);
+        const delta = computeDiff(toJson(fromState), toJson(toState), this.config.diffConfig);
         this.setDelta(key, delta);
         this.preComputedKeys.add(key);
         return delta;
@@ -329,7 +338,7 @@ export class StateDeltaCache {
     hashState(state) {
         // A JSON replacer key list applies at every depth and drops nested fields.
         // Normalize JSON values first, then sort each object without filtering keys.
-        const normalized = JSON.parse(JSON.stringify(state));
+        const normalized = toJson(state);
         const encode = (value) => {
             if (value === null || typeof value !== 'object')
                 return JSON.stringify(value);
@@ -351,7 +360,7 @@ export class StateDeltaCache {
         }
         const now = Date.now();
         this.cache.set(key, {
-            delta: structuredClone(delta),
+            delta: toJson(delta),
             createdAt: now,
             lastAccessedAt: now,
             accessCount: 0,