agentic-qe 3.15.1 → 3.15.3

package/dist/init/phases/08-mcp.js

@@ -15,16 +15,22 @@ import { existsSync, readFileSync } from 'fs';
 import { writeFileIfChanged } from '../idempotent-write.js';
 import { join } from 'path';
 import { safeJsonParse } from '../../shared/safe-json.js';
+import { aqePluginMcpSkipMessage, detectAqeFleetPlugin, } from '../claude-plugin-detection.js';
 import { BasePhase, } from './phase-interface.js';
 /**
  * MCP phase - configures MCP server
  */
 export class MCPPhase extends BasePhase {
+    detectPlugin;
     name = 'mcp';
     description = 'Configure MCP server';
     order = 80;
     critical = false;
     requiresPhases = ['configuration', 'database'];
+    constructor(detectPlugin = (root) => detectAqeFleetPlugin(root)) {
+        super();
+        this.detectPlugin = detectPlugin;
+    }
     async run(context) {
         const { projectRoot } = context;
         // #532: --no-claude suppresses the Claude Code surface, including .mcp.json.
@@ -42,6 +48,22 @@ export class MCPPhase extends BasePhase {
                 serverName: '',
             };
         }
+        // #922: the agentic-qe-fleet Claude Code plugin bundles the AQE MCP
+        // server. Adding a project entry too registers AQE twice, so skip it
+        // unless --with-mcp forces it. An existing entry is left untouched (and
+        // reported as a duplicate, with how to remove it).
+        if (!context.options.withMcp) {
+            const plugin = this.detectPlugin(projectRoot);
+            if (plugin.enabled) {
+                context.services.log(aqePluginMcpSkipMessage(projectRoot));
+                return {
+                    configured: false,
+                    mcpPath: '',
+                    serverName: '',
+                    skippedForPlugin: plugin.pluginKey,
+                };
+            }
+        }
         // AQE MCP server configuration
         // AQE_PROJECT_ROOT omitted — runtime discovery via findProjectRoot() is
         // portable across machines, devcontainers, and CI (#321)

package/dist/init/phases/10-workers.js

@@ -109,8 +109,9 @@ export class WorkersPhase extends BasePhase {
 // Generated by aqe init
 // Starts the MCP server with background workers enabled
 
-const { existsSync, readFileSync, writeFileSync, appendFileSync } = require('fs');
-const { join } = require('path');
+const fs = require('fs');
+const { existsSync, readFileSync } = fs;
+const { join, dirname } = require('path');
 const { spawn } = require('child_process');
 
 const projectRoot = join(__dirname, '..', '..');
@@ -118,8 +119,33 @@ const workersDir = join(projectRoot, '.agentic-qe', 'workers');
 const pidFile = join(workersDir, 'daemon.pid');
 const logFile = join(workersDir, 'daemon.log');
 
-// Check if already running
-if (existsSync(pidFile)) {
+// A repository can commit .agentic-qe, workers/ or a file in it as a symlink.
+// Never write through one (#970): real directories only, appends only to a
+// regular file (lstat + O_NOFOLLOW where the platform has it), and the pid file
+// is replaced by rename instead of being written in place.
+function isRealDir(d) { try { const s = fs.lstatSync(d); return s.isDirectory() && !s.isSymbolicLink(); } catch { return false; } }
+function isRegularOrAbsent(f) { try { return fs.lstatSync(f).isFile(); } catch (e) { return !!e && e.code === 'ENOENT'; } }
+if (!isRealDir(join(projectRoot, '.agentic-qe')) || !isRealDir(workersDir)) {
+  console.error('AQE v3 Worker Daemon not started: .agentic-qe/workers must be a real directory, not a symlink');
+  process.exit(1);
+}
+function appendFileSync(file, data) {
+  if (!isRegularOrAbsent(file)) return;
+  const c = fs.constants;
+  let fd;
+  try {
+    fd = fs.openSync(file, c.O_APPEND | c.O_CREAT | c.O_WRONLY | (c.O_NOFOLLOW || 0), 0o644);
+    fs.writeSync(fd, data);
+  } catch {} finally { if (fd !== undefined) { try { fs.closeSync(fd); } catch {} } }
+}
+function writeFileSync(file, data) {
+  const tmp = file + '.' + process.pid + '.' + Date.now() + '.tmp';
+  try { fs.writeFileSync(tmp, data, { flag: 'wx' }); fs.renameSync(tmp, file); }
+  catch { try { fs.unlinkSync(tmp); } catch {} }
+}
+
+// Check if already running (only trust a regular pid file, never a link target)
+if (existsSync(pidFile) && isRegularOrAbsent(pidFile)) {
   const pid = parseInt(readFileSync(pidFile, 'utf-8').trim(), 10);
   try { process.kill(pid, 0); console.log('Daemon already running (PID: ' + pid + ')'); process.exit(0); } catch {}
 }
@@ -161,8 +187,18 @@ if (binCandidate && binCandidate.endsWith('bundle.js')) {
   mcpCmd = binCandidate;
   mcpArgs = [];
 } else {
-  mcpCmd = process.platform === 'win32' ? 'npx.cmd' : 'npx';
-  mcpArgs = ['--yes', 'agentic-qe', 'mcp'];
+  // Windows (#872): npx is npx.cmd, which spawn() refuses to start without a
+  // shell (EINVAL since CVE-2024-27980). Run npm's bundled npx CLI via node.
+  const npxCli = join(dirname(process.execPath), 'node_modules', 'npm', 'bin', 'npx-cli.js');
+  if (process.platform === 'win32' && !existsSync(npxCli)) {
+    appendFileSync(logFile, '[' + ts + '] ERROR: no AQE MCP bundle found and npx-cli.js is missing next to node.exe; install agentic-qe locally (npm install -D agentic-qe).\\n');
+    console.error('AQE v3 Worker Daemon not started: agentic-qe MCP bundle not found (see ' + logFile + ')');
+    process.exit(1);
+  }
+  mcpCmd = process.platform === 'win32' ? process.execPath : 'npx';
+  mcpArgs = process.platform === 'win32'
+    ? [npxCli, '--yes', 'agentic-qe', 'mcp']
+    : ['--yes', 'agentic-qe', 'mcp'];
   appendFileSync(logFile, '[' + ts + '] WARNING: using npx fallback — daemon.pid will point at the npx wrapper, not the MCP server. \`aqe daemon status\` may misreport liveness after the wrapper exits.\\n');
 }
 

package/dist/init/phases/phase-interface.d.ts

@@ -145,7 +145,11 @@ export interface InitOptions {
     noClaude?: boolean;
     /** Skip AQE's Claude Code status line and remove a previously AQE-owned one. */
     noStatusLine?: boolean;
-    /** @deprecated Use default behavior instead — MCP is now enabled by default */
+    /**
+     * Force the project `.mcp.json` `agentic-qe` entry even when the
+     * `agentic-qe-fleet` Claude Code plugin is enabled (that plugin already
+     * provides the AQE MCP server, so init skips the entry by default — #922).
+     */
     withMcp?: boolean;
     /**
      * Memory backend for this install. 'memory' => database-free: the SQLite

package/dist/integrations/agentic-flow/onnx-embeddings/embedding-generator.d.ts

@@ -43,7 +43,10 @@ export declare class EmbeddingGenerator {
      */
     updateConfig(config: Partial<EmbeddingConfig>): void;
     /**
-     * Generate cache key from text and config
+     * Generate cache key from text and every config field that changes the vector.
+     * A JSON tuple keeps field boundaries intact when the model or text contains
+     * ':' (#914, as #863 did for the shared embedding cache). The cache is
+     * in-memory only, so no persisted keys need migrating.
      */
     private getCacheKey;
     /**

package/dist/integrations/agentic-flow/onnx-embeddings/embedding-generator.js

@@ -240,10 +240,14 @@ export class EmbeddingGenerator {
         }
     }
     /**
-     * Generate cache key from text and config
+     * Generate cache key from text and every config field that changes the vector.
+     * A JSON tuple keeps field boundaries intact when the model or text contains
+     * ':' (#914, as #863 did for the shared embedding cache). The cache is
+     * in-memory only, so no persisted keys need migrating.
      */
     getCacheKey(text) {
-        return `${this.config.model}:${this.config.hyperbolic}:${text}`;
+        const { model, hyperbolic, normalize, curvature } = this.config;
+        return JSON.stringify([model, hyperbolic, normalize, curvature, text]);
     }
     /**
      * Convert Euclidean embedding to Poincaré ball

package/dist/integrations/browser/qe-dashboard/wasm-vector-store.js

@@ -232,7 +232,8 @@ export class WasmVectorStore {
      * @returns StoreStats with counts, dimensions, memory usage, etc.
      */
     getStats() {
-        const namespaceSizes = {};
+        // Namespaces are caller-supplied: no prototype, so `constructor` is just a name (#914).
+        const namespaceSizes = Object.create(null);
         let memoryBytes = 0;
         for (const [, entry] of this.vectors) {
             const ns = entry.namespace;

package/dist/integrations/ruvector/coverage-router.d.ts

@@ -125,7 +125,9 @@ export declare class RuVectorCoverageRouter implements CoverageRouter {
      */
     private generateTargetReason;
     /**
-     * Compute cache key
+     * Compute cache key. JSON tuples keep a ':' or '|' in a file path from merging
+     * entries (#914). Keys from older releases that were persisted to KV never
+     * match the new format, so they only miss and age out under the TTL.
      */
     private computeCacheKey;
 }

package/dist/integrations/ruvector/coverage-router.js

@@ -484,14 +484,15 @@ export class RuVectorCoverageRouter {
         return reasons.join(', ') || 'coverage below target';
     }
     /**
-     * Compute cache key
+     * Compute cache key. JSON tuples keep a ':' or '|' in a file path from merging
+     * entries (#914). Keys from older releases that were persisted to KV never
+     * match the new format, so they only miss and age out under the TTL.
      */
     computeCacheKey(coverageData, targetCoverage) {
-        const dataKey = coverageData
-            .map((c) => `${c.filePath}:${c.lineCoverage}:${c.branchCoverage}`)
-            .sort()
-            .join('|');
-        return `${targetCoverage}:${dataKey}`;
+        const entries = coverageData
+            .map((c) => JSON.stringify([c.filePath, c.lineCoverage, c.branchCoverage]))
+            .sort();
+        return JSON.stringify([targetCoverage, entries]);
     }
 }
 // ============================================================================

package/dist/integrations/ruvector/diff-risk-classifier.js

@@ -593,11 +593,12 @@ export class RuVectorDiffRiskClassifier {
      * Compute cache key for context
      */
     computeCacheKey(context) {
+        // JSON tuples keep delimiters in a commit hash or file path from colliding
+        // (#914). Persisted keys in the old format never match, so they age out.
         const fileKeys = context.files
-            .map((f) => `${f.filePath}:${f.status}:${f.additions}:${f.deletions}`)
-            .sort()
-            .join('|');
-        return `${context.commitHash || 'unknown'}:${fileKeys}`;
+            .map((f) => JSON.stringify([f.filePath, f.status, f.additions, f.deletions]))
+            .sort();
+        return JSON.stringify([context.commitHash || 'unknown', fileKeys]);
     }
 }
 // ============================================================================

package/dist/integrations/ruvector/rvf-dual-writer.js

@@ -11,7 +11,7 @@
  * to one or both backends depending on the configured mode.
  */
 import { ensureEndpointEmbeddingSpaceIdentity, getActiveEmbeddingSpaceIdentity } from '../../learning/real-embeddings.js';
-import { verifyOrCreateEmbeddingSpaceManifest } from '../../learning/embedding-space.js';
+import { reportEmbeddingRuntimeUnavailable, verifyOrCreateEmbeddingSpaceManifest, } from '../../learning/embedding-space.js';
 /**
  * Wraps the real RvfNativeAdapter to conform to the simpler RvfStore interface.
  */
@@ -102,6 +102,15 @@ export class RvfDualWriter {
             if (!this.activeSpaceId()) {
                 await ensureEndpointEmbeddingSpaceIdentity();
             }
+            if (!this.activeSpaceId()) {
+                // #852: no embedding runtime available (fresh project, or a missing
+                // endpoint). brain.rvf cannot be bound to a vector space, so leave it
+                // unopened (uncreated if absent; existing vectors are kept) and
+                // report the expected state once instead of a per-store failure.
+                this.rvfAvailable = false;
+                reportEmbeddingRuntimeUnavailable();
+                return;
+            }
             const { isRvfLockHeldError, removeStaleRvfLock, quarantineUnusableStore } = await import('./rvf-store-integrity.js');
             const tryOpen = () => {
                 try {

package/dist/integrations/vibium/runtime.js

@@ -3,6 +3,7 @@ import { createRequire } from 'node:module';
 import { execFileSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { dirname, join } from 'node:path';
+import { npmCliInvocation } from '../../shared/npm-cli-invocation.js';
 export const VIBIUM_SETUP = 'aqe init --browser-engine (or npm install vibium@^26.8.21)';
 const requireFromHere = createRequire(import.meta.url);
 /**
@@ -12,12 +13,7 @@ const requireFromHere = createRequire(import.meta.url);
  * Falls back to plain `npm` when that layout is absent.
  */
 export function npmInvocation(platform = process.platform, execPath = process.execPath, exists = existsSync) {
-    if (platform === 'win32') {
-        const npmCli = join(dirname(execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js');
-        if (exists(npmCli))
-            return [execPath, [npmCli]];
-    }
-    return ['npm', []];
+    return npmCliInvocation('npm', platform, execPath, exists) ?? ['npm', []];
 }
 /** Never install or download anything while probing availability. */
 function resolveRuntime() {

package/dist/learning/dream/dream-engine.d.ts

@@ -63,6 +63,11 @@ export interface DreamCycleResult {
 export interface ApplyInsightResult {
     success: boolean;
     patternId?: string;
+    /**
+     * The pattern row committed to SQLite but its vector index is pending
+     * (COMMITTED_PENDING_INDEX, e.g. the RVF index is unbound or locked).
+     */
+    indexPending?: boolean;
     error?: string;
 }
 /**

package/dist/learning/dream/dream-engine.js

@@ -16,6 +16,7 @@
  */
 import { safeJsonParse } from '../../shared/safe-json.js';
 import { toErrorMessage } from '../../shared/error-utils.js';
+import { PatternMutationError } from '../pattern-mutation-error.js';
 import { LoggerFactory } from '../../logging/index.js';
 const dreamLogger = LoggerFactory.create('dream-engine');
 import { v4 as uuidv4 } from 'uuid';
@@ -640,7 +641,16 @@ export class DreamEngine {
                     complexity: 'medium',
                 },
             });
-            if (!patternResult.success) {
+            // COMMITTED_PENDING_INDEX proves the authoritative SQLite row exists;
+            // only the derived vector index is pending (unbound or locked RVF).
+            // The pattern is real, so the insight is applied — re-applying would
+            // just hit the same row. Any other failure stays retryable.
+            const pendingIndex = !patternResult.success &&
+                patternResult.error instanceof PatternMutationError &&
+                patternResult.error.disposition === 'COMMITTED_PENDING_INDEX'
+                ? patternResult.error
+                : null;
+            if (!patternResult.success && !pendingIndex) {
                 // Do NOT mark applied — leave it retryable rather than silently
                 // swallowing a real pattern-creation failure behind a fake success.
                 return {
@@ -648,7 +658,14 @@ export class DreamEngine {
                     error: `Failed to create pattern: ${patternResult.error?.message ?? 'unknown error'}`,
                 };
             }
-            const patternId = patternResult.value.id;
+            const patternId = patternResult.success ? patternResult.value.id : pendingIndex.patternId;
+            if (pendingIndex) {
+                dreamLogger.warn('Insight applied; pattern committed with vector index pending', {
+                    insightId,
+                    patternId,
+                    cause: toErrorMessage(pendingIndex.cause),
+                });
+            }
             // Mark insight as applied — pattern_id now points at the REAL row.
             const stmt = this.db.prepare(`
         UPDATE dream_insights
@@ -656,7 +673,7 @@ export class DreamEngine {
         WHERE id = ?
       `);
             stmt.run(patternId, insightId);
-            return { success: true, patternId };
+            return pendingIndex ? { success: true, patternId, indexPending: true } : { success: true, patternId };
         }
         catch (error) {
             return {

package/dist/learning/embedding-space.d.ts

@@ -39,6 +39,24 @@ export declare function verifyEmbeddingRoundTrip(writeEmbed: (text: string) => P
 export declare function inspectEmbeddingSpaceRows(rows: ReadonlyArray<{
     spaceId: string | null;
 }>, activeSpaceId: string | null): EmbeddingSpaceDiagnostics;
+/**
+ * #852: a project with no embedding runtime (no AQE_EMBEDDER_ENDPOINT, no
+ * injected embedder) has nothing that could prove which vector space an ANN
+ * index belongs to. That is the normal state of a freshly initialised
+ * project, not a fault: index binders must stay closed (the #633 guard), but
+ * they should say so once, at warn level, instead of reporting an ERROR.
+ *
+ * The wording must not imply data loss: the same state is reached by a user
+ * whose AQE_EMBEDDER_ENDPOINT went missing (an index with vectors) or whose
+ * in-process embedder only loads lazily, after the index was opened.
+ */
+export declare const EMBEDDING_RUNTIME_UNAVAILABLE_NOTICE: string;
+/** Stored as the RVF init cause, so COMMITTED_PENDING_INDEX errors read correctly later. */
+export declare const EMBEDDING_RUNTIME_UNAVAILABLE_CAUSE: string;
+/** Log the no-embedder notice at most once per process. */
+export declare function reportEmbeddingRuntimeUnavailable(): void;
+/** @internal test-only seam */
+export declare function __resetEmbeddingRuntimeNoticeForTests(): void;
 /** Sidecar path used to bind a persistent ANN index to one embedding space. */
 export declare function embeddingSpaceManifestPath(indexPath: string): string;
 /**

package/dist/learning/embedding-space.js

@@ -87,6 +87,39 @@ export function inspectEmbeddingSpaceRows(rows, activeSpaceId) {
         unverifiedVectors,
     };
 }
+/**
+ * #852: a project with no embedding runtime (no AQE_EMBEDDER_ENDPOINT, no
+ * injected embedder) has nothing that could prove which vector space an ANN
+ * index belongs to. That is the normal state of a freshly initialised
+ * project, not a fault: index binders must stay closed (the #633 guard), but
+ * they should say so once, at warn level, instead of reporting an ERROR.
+ *
+ * The wording must not imply data loss: the same state is reached by a user
+ * whose AQE_EMBEDDER_ENDPOINT went missing (an index with vectors) or whose
+ * in-process embedder only loads lazily, after the index was opened.
+ */
+// The literal "WARN" is load-bearing: the MCP stdio entry only forwards
+// stderr lines containing it (or ERROR/[MCP]/...), so without it MCP users
+// would never see the notice the CLI prints.
+export const EMBEDDING_RUNTIME_UNAVAILABLE_NOTICE = '[VectorSearch] WARN: semantic vector search is not active: no embedding runtime was available ' +
+    'when the ANN indexes were opened (set AQE_EMBEDDER_ENDPOINT, or install @huggingface/transformers). ' +
+    'Any existing vectors in patterns.rvf and brain.rvf are kept and will be used once an embedder is available; ' +
+    'until then pattern search uses SQLite text matching.';
+/** Stored as the RVF init cause, so COMMITTED_PENDING_INDEX errors read correctly later. */
+export const EMBEDDING_RUNTIME_UNAVAILABLE_CAUSE = 'VECTOR_SPACE_UNVERIFIED: no embedding runtime was available when the RVF index was opened; ' +
+    'index left unbound (existing vectors are kept)';
+let embeddingRuntimeNoticeShown = false;
+/** Log the no-embedder notice at most once per process. */
+export function reportEmbeddingRuntimeUnavailable() {
+    if (embeddingRuntimeNoticeShown)
+        return;
+    embeddingRuntimeNoticeShown = true;
+    console.warn(EMBEDDING_RUNTIME_UNAVAILABLE_NOTICE);
+}
+/** @internal test-only seam */
+export function __resetEmbeddingRuntimeNoticeForTests() {
+    embeddingRuntimeNoticeShown = false;
+}
 /** Sidecar path used to bind a persistent ANN index to one embedding space. */
 export function embeddingSpaceManifestPath(indexPath) {
     return `${indexPath}.space.json`;

package/dist/learning/rvf-pattern-store.js

@@ -17,7 +17,7 @@ import { toErrorMessage } from '../shared/error-utils.js';
 import { calculateQualityScore, validateQEPattern, mapQEDomainToAQE, PROMOTION_THRESHOLD, } from './qe-patterns.js';
 import { DEFAULT_PATTERN_STORE_CONFIG, blendFtsScore } from './pattern-store.js';
 import { ensureEndpointEmbeddingSpaceIdentity, getActiveEmbeddingSpaceIdentity } from './real-embeddings.js';
-import { verifyOrCreateEmbeddingSpaceManifest } from './embedding-space.js';
+import { EMBEDDING_RUNTIME_UNAVAILABLE_CAUSE, reportEmbeddingRuntimeUnavailable, verifyOrCreateEmbeddingSpaceManifest, } from './embedding-space.js';
 import { PatternMutationError } from './pattern-mutation-error.js';
 // ============================================================================
 // RVF Pattern Store Implementation
@@ -81,11 +81,25 @@ export class RvfPatternStore {
             if (!this.embeddingSpaceId && !getActiveEmbeddingSpaceIdentity()) {
                 await ensureEndpointEmbeddingSpaceIdentity();
             }
-            this.adapter = this.createAdapter(this.rvfPath, this.config.embeddingDimension);
             const activeSpaceId = getActiveEmbeddingSpaceIdentity()?.spaceId ?? this.embeddingSpaceId ?? null;
-            verifyOrCreateEmbeddingSpaceManifest(this.rvfPath, activeSpaceId, this.adapter.status()?.totalVectors ?? 0);
-            this.initialized = true;
-            console.log(`[RvfPatternStore] Initialized: ${this.rvfPath} (dim=${this.config.embeddingDimension})`);
+            if (!activeSpaceId) {
+                // #852: no embedding runtime was available when the index was opened
+                // (the normal state of a fresh project). The index stays closed —
+                // nothing could prove its vector space; any vectors in it are kept —
+                // but this is not a failure, so report it once at warn level
+                // and do not open or create the .rvf file. rvfInitError keeps
+                // embedding writes fail-closed (COMMITTED_PENDING_INDEX).
+                this.rvfInitError = EMBEDDING_RUNTIME_UNAVAILABLE_CAUSE;
+                this.adapter = null;
+                this.initialized = true;
+                reportEmbeddingRuntimeUnavailable();
+            }
+            else {
+                this.adapter = this.createAdapter(this.rvfPath, this.config.embeddingDimension);
+                verifyOrCreateEmbeddingSpaceManifest(this.rvfPath, activeSpaceId, this.adapter.status()?.totalVectors ?? 0);
+                this.initialized = true;
+                console.log(`[RvfPatternStore] Initialized: ${this.rvfPath} (dim=${this.config.embeddingDimension})`);
+            }
         }
         catch (error) {
             // Do NOT silently swallow — the user chose useRVFPatternStore=true,