agentic-qe 3.15.10 → 3.15.11

package/dist/init/phases/12-verification.js

@@ -13,6 +13,8 @@ import { BasePhase, } from './phase-interface.js';
 import { openDatabase } from '../../shared/safe-db.js';
 /** The `# <ISO timestamp>` header line written by configToYAML(). */
 const CONFIG_TIMESTAMP_LINE = /^# \d{4}-\d{2}-\d{2}T[\d:.]+Z$/;
+/** #1157: config keys that would reach Object.prototype through a plain object. */
+const UNSAFE_YAML_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
 /**
  * Verification phase - verifies installation and writes markers
  */
@@ -173,8 +175,12 @@ export class VerificationPhase extends BasePhase {
                 // Top-level key (no indentation)
                 const topMatch = line.match(/^(\w+):\s*(.*)$/);
                 if (topMatch) {
-                    currentSection = topMatch[1];
+                    // #1157: keys come from config.yaml; a `__proto__` section (and
+                    // everything under it) is skipped instead of re-prototyping result.
+                    currentSection = UNSAFE_YAML_KEYS.has(topMatch[1]) ? '' : topMatch[1];
                     currentSubSection = '';
+                    if (!currentSection)
+                        continue;
                     const value = topMatch[2].trim();
                     if (value && !value.startsWith('"')) {
                         // Simple value
@@ -191,9 +197,11 @@ export class VerificationPhase extends BasePhase {
                 // Second-level key (2-space indent)
                 const subMatch = line.match(/^ {2}(\w+):\s*(.*)$/);
                 if (subMatch && currentSection) {
-                    currentSubSection = subMatch[1];
+                    currentSubSection = UNSAFE_YAML_KEYS.has(subMatch[1]) ? '' : subMatch[1];
+                    if (!currentSubSection)
+                        continue;
                     const value = subMatch[2].trim();
-                    if (!result[currentSection]) {
+                    if (!Object.hasOwn(result, currentSection) || !result[currentSection]) {
                         result[currentSection] = {};
                     }
                     if (value) {
@@ -210,8 +218,10 @@ export class VerificationPhase extends BasePhase {
                 if (thirdMatch && currentSection && currentSubSection) {
                     const key = thirdMatch[1];
                     const value = thirdMatch[2].trim();
+                    if (UNSAFE_YAML_KEYS.has(key))
+                        continue;
                     const section = result[currentSection];
-                    if (!section[currentSubSection]) {
+                    if (!Object.hasOwn(section, currentSubSection) || !section[currentSubSection]) {
                         section[currentSubSection] = {};
                     }
                     if (typeof section[currentSubSection] === 'object' && !Array.isArray(section[currentSubSection])) {

package/dist/init/settings-merge.js

@@ -8,6 +8,7 @@
  * - Generates full env vars and v3 settings sections
  */
 import { existsSync, readFileSync, writeFileSync } from 'fs';
+import { getOwn, setOwn } from '../shared/utils/safe-record.js';
 /**
  * Create a one-time `.backup` of an existing settings.json before AQE modifies
  * it — mirroring the CLAUDE.md backup convention.
@@ -75,22 +76,24 @@ export function isAqeHookEntry(entry) {
  * 3. Preserve any hook types not in the new config
  */
 export function mergeHooksSmart(existingHooks, newAqeHooks) {
+    // #1157: hook types come from the user's settings.json; read and write own
+    // entries only, so a type named `constructor` or `__proto__` is kept as-is.
     const merged = {};
     // Process hook types that have new AQE entries
     for (const [hookType, newEntries] of Object.entries(newAqeHooks)) {
-        const existing = existingHooks[hookType] || [];
+        const existing = getOwn(existingHooks, hookType) || [];
         // Keep only non-AQE entries from existing config
         const userEntries = Array.isArray(existing)
             ? existing.filter((entry) => !isAqeHookEntry(entry))
             : [];
         // New AQE hooks go after user hooks (except PreToolUse guard which should be first)
-        merged[hookType] = [...newEntries, ...userEntries];
+        setOwn(merged, hookType, [...newEntries, ...userEntries]);
     }
     // Preserve hook types that are not in our new config (user's custom hook types)
     for (const [hookType, hookArray] of Object.entries(existingHooks)) {
-        if (!merged[hookType]) {
+        if (!Object.hasOwn(merged, hookType)) {
             // This hook type isn't one we manage — keep it as-is
-            merged[hookType] = hookArray;
+            setOwn(merged, hookType, hookArray);
         }
     }
     return merged;

package/dist/integrations/agentic-flow/reasoning-bank/experience-replay.d.ts

@@ -113,6 +113,7 @@ export declare class ExperienceReplay {
     private prepared;
     private initialized;
     private initializationPromise;
+    private embedderUnavailableLogged;
     private hnswIndex;
     private idToExperienceId;
     private experienceIdToHnswId;
@@ -150,6 +151,12 @@ export declare class ExperienceReplay {
      * @returns The stored experience
      */
     storeExperience(trajectory: Trajectory, strategy: string, tags?: string[]): Promise<Experience | null>;
+    /**
+     * #1022: embed text, or return null when no embedding runtime is available.
+     * The experience is then stored without a vector (backfilled at a later
+     * start that has an embedder) and similarity search finds no matches.
+     */
+    private embedOrNull;
     /**
      * Get guidance for a new task based on similar experiences
      *

package/dist/integrations/agentic-flow/reasoning-bank/experience-replay.js

@@ -60,6 +60,7 @@ export class ExperienceReplay {
     prepared = new Map();
     initialized = false;
     initializationPromise = null;
+    embedderUnavailableLogged = false;
     // Real HNSW index for O(log n) similarity search (150x-12,500x faster than linear scan)
     hnswIndex;
     // Mapping from HNSW numeric IDs to experience string IDs
@@ -399,7 +400,7 @@ export class ExperienceReplay {
             .map(s => scrubReasoningBlocks(s.action));
         // Generate embedding for similarity search
         const embeddingText = `${task} ${strategy} ${keyActions.join(' ')}`;
-        const embedding = await computeRealEmbedding(embeddingText, this.config.embedding);
+        const embedding = (await this.embedOrNull(embeddingText)) ?? undefined;
         const id = uuidv4();
         const domain = trajectory.domain || 'test-generation';
         const experience = {
@@ -456,6 +457,24 @@ export class ExperienceReplay {
         }
         return experience;
     }
+    /**
+     * #1022: embed text, or return null when no embedding runtime is available.
+     * The experience is then stored without a vector (backfilled at a later
+     * start that has an embedder) and similarity search finds no matches.
+     */
+    async embedOrNull(text) {
+        try {
+            return await computeRealEmbedding(text, this.config.embedding);
+        }
+        catch (error) {
+            if (!this.embedderUnavailableLogged) {
+                this.embedderUnavailableLogged = true;
+                console.warn('[ExperienceReplay] No embedding runtime; experiences are stored without vectors ' +
+                    'and similar-experience guidance is unavailable:', error instanceof Error ? error.message : error);
+            }
+            return null;
+        }
+    }
     /**
      * Get guidance for a new task based on similar experiences
      *
@@ -465,6 +484,13 @@ export class ExperienceReplay {
      */
     async getGuidance(task, domain) {
         this.ensureInitialized();
+        // #1022: the reservoir blend below picks experiences without looking at
+        // the query and gives them a coherence-derived similarity. Without an
+        // embedding of the query nothing measures relevance, so return no guidance
+        // rather than query-independent picks with a made-up similarity.
+        if (!(await this.embedOrNull(scrubReasoningBlocks(task)))) {
+            return null;
+        }
         // Find similar experiences via HNSW
         const similar = await this.findSimilarExperiences(task, domain);
         // Blend in high-coherence experiences from reservoir buffer (R10, ADR-087)
@@ -546,7 +572,10 @@ export class ExperienceReplay {
         // Generate embedding for the task
         // ADR-099: scrub so query embeddings match the scrubbed stored embeddings
         task = scrubReasoningBlocks(task);
-        const taskEmbedding = await computeRealEmbedding(task, this.config.embedding);
+        const taskEmbedding = await this.embedOrNull(task);
+        if (!taskEmbedding) {
+            return [];
+        }
         // Create query embedding for HNSW search
         const queryEmbedding = {
             vector: taskEmbedding,

package/dist/integrations/agentic-flow/reasoning-bank/index.d.ts

@@ -15,7 +15,7 @@
  * - Automatic strategy recommendations
  * - Pattern quality improvement over time
  */
-import { RealQEReasoningBank, type RealQEReasoningBankConfig, type RealQEPatternSearchResult, type RealQERoutingRequest, type RealQERoutingResult, type LearningOutcome } from '../../../learning/real-qe-reasoning-bank.js';
+import { RealQEReasoningBank, type RealQEReasoningBankConfig, type RealQEPatternSearchResult, type PatternSearchStatus, type RealQERoutingRequest, type RealQERoutingResult, type LearningOutcome } from '../../../learning/real-qe-reasoning-bank.js';
 import { TrajectoryTracker, type Trajectory, type TrajectoryStep, type TrajectoryOptions, type TrajectoryTrackerConfig } from './trajectory-tracker.js';
 import { ExperienceReplay, type ExperienceGuidance, type ExperienceReplayConfig } from './experience-replay.js';
 import { PatternEvolution, type PatternVersion, type DriftDetectionResult, type MergeCandidate, type PatternEvolutionConfig } from './pattern-evolution.js';
@@ -183,6 +183,8 @@ export declare class EnhancedReasoningBankAdapter {
         domain?: QEDomain;
         minSimilarity?: number;
     }): Promise<Result<RealQEPatternSearchResult[]>>;
+    /** #1022: whether pattern search uses vectors or text matching only. */
+    getPatternSearchStatus(): PatternSearchStatus;
     /**
      * Record a pattern outcome with evolution tracking
      */

package/dist/integrations/agentic-flow/reasoning-bank/index.js

@@ -297,6 +297,11 @@ export class EnhancedReasoningBankAdapter {
         this.ensureInitialized();
         return this.reasoningBank.searchQEPatterns(query, options);
     }
+    /** #1022: whether pattern search uses vectors or text matching only. */
+    getPatternSearchStatus() {
+        this.ensureInitialized();
+        return this.reasoningBank.getPatternSearchStatus();
+    }
     /**
      * Record a pattern outcome with evolution tracking
      */

package/dist/integrations/ruvector/filter-adapter.js

@@ -69,7 +69,8 @@ function resolveField(result, fieldPath) {
         for (const part of parts) {
             if (current === null || current === undefined)
                 break;
-            if (typeof current === 'object') {
+            // #1157: an inherited member such as `toString` is not a field.
+            if (typeof current === 'object' && Object.hasOwn(current, part)) {
                 current = current[part];
             }
             else {

package/dist/learning/dream/insight-generator.js

@@ -14,6 +14,7 @@
  * @module learning/dream/insight-generator
  */
 import { randomUUID } from 'crypto';
+import { getOwn, setOwn } from '../../shared/utils/safe-record.js';
 /**
  * Default insight configuration
  */
@@ -320,10 +321,10 @@ export class InsightGenerator {
         };
         for (const node of activeNodes) {
             const typeKey = node.conceptType ?? 'pattern';
-            if (!byType[typeKey]) {
-                byType[typeKey] = [];
-            }
-            byType[typeKey].push(node);
+            // #1157: concept types come from stored nodes; own buckets only.
+            const bucket = getOwn(byType, typeKey) ?? [];
+            setOwn(byType, typeKey, bucket);
+            bucket.push(node);
         }
         // Gap: Error without resolution
         for (const errorNode of byType.error ?? []) {

package/dist/learning/memory-auditor.js

@@ -59,6 +59,7 @@
 import { randomUUID } from 'crypto';
 import { LoggerFactory } from '../logging/index.js';
 import { toErrorMessage } from '../shared/error-utils.js';
+import { createSafeRecord } from '../shared/utils/safe-record.js';
 const logger = LoggerFactory.create('MemoryAuditor');
 /**
  * Default auditor configuration
@@ -319,7 +320,8 @@ export class MemoryCoherenceAuditor {
      * Group patterns by domain
      */
     groupByDomain(patterns) {
-        const groups = {};
+        // #1157: domains come from stored pattern rows.
+        const groups = createSafeRecord();
         for (const pattern of patterns) {
             const domain = pattern.qeDomain;
             if (!groups[domain]) {

package/dist/learning/qe-patterns.js

@@ -163,7 +163,8 @@ export function validateQEPattern(pattern) {
 export function applyPatternTemplate(template, variables) {
     let content = template.content;
     for (const variable of template.variables) {
-        const value = variables[variable.name] ?? variable.defaultValue;
+        // #1157: the variable name comes from a stored pattern; read own values only.
+        const value = (Object.hasOwn(variables, variable.name) ? variables[variable.name] : undefined) ?? variable.defaultValue;
         if (variable.required && value === undefined) {
             throw new Error(`Required variable ${variable.name} not provided`);
         }

package/dist/learning/real-qe-reasoning-bank.d.ts

@@ -38,6 +38,17 @@ export interface RealQEPatternSearchResult {
     matchType: 'vector' | 'lexical';
     canReuse: boolean;
 }
+/**
+ * #1022: how pattern search works in this process. Without an embedding
+ * runtime the bank stores patterns text-only (vectors pending, filled later by
+ * `aqe learning backfill-embeddings`) and searches by SQLite FTS text matching
+ * only. No similarity score is computed in that mode.
+ */
+export interface PatternSearchStatus {
+    mode: 'vector' | 'lexical-only';
+    /** Why vector search is unavailable (only for 'lexical-only'). */
+    reason?: string;
+}
 export interface RealQERoutingRequest {
     task: string;
     taskType?: 'test-generation' | 'analysis' | 'debugging' | 'optimization';
@@ -94,6 +105,8 @@ export interface RealQEReasoningBankStats {
     transformerAvailable: boolean;
     embeddingDimension: number;
     sqliteDbPath: string;
+    /** #1022: whether pattern search uses vectors, or text matching only */
+    patternSearch: PatternSearchStatus;
     /** ADR-061: Asymmetric learning metrics */
     asymmetricLearning?: {
         failurePenaltyRatio: string;
@@ -119,6 +132,8 @@ export declare class RealQEReasoningBank {
     private hnswIndex;
     private patternIdMap;
     private initialized;
+    /** #1022: set when no embedding runtime is available; null when vectors work. */
+    private embedderUnavailableReason;
     private stats;
     private routingLatencies;
     private readonly asymmetricEngine;
@@ -128,6 +143,8 @@ export declare class RealQEReasoningBank {
      * Initialize the QE ReasoningBank
      */
     initialize(): Promise<void>;
+    /** #1022: whether pattern search uses vectors or text matching only. */
+    getPatternSearchStatus(): PatternSearchStatus;
     /**
      * Initialize HNSW index for fast similarity search
      */
@@ -153,6 +170,8 @@ export declare class RealQEReasoningBank {
         domain?: QEDomain;
         minSimilarity?: number;
     }): Promise<Result<RealQEPatternSearchResult[]>>;
+    /** Append HNSW vector matches for `query` to `patterns`. */
+    private collectVectorMatches;
     /**
      * Route a task to optimal agent
      */

package/dist/learning/real-qe-reasoning-bank.js

@@ -80,6 +80,8 @@ export class RealQEReasoningBank {
     hnswIndex = null;
     patternIdMap = new Map();
     initialized = false;
+    /** #1022: set when no embedding runtime is available; null when vectors work. */
+    embedderUnavailableReason = null;
     // Statistics tracking - using CircularBuffer for O(1) operations (ADR memory leak fix)
     stats = {
         routingRequests: 0,
@@ -167,12 +169,24 @@ export class RealQEReasoningBank {
         await this.sqliteStore.initialize();
         logger.info('SQLite persistence initialized');
         // Establish executable provenance before any persisted vectors enter ANN.
-        await computeRealEmbedding(EMBEDDING_SPACE_CANARY, this.qeConfig.embeddings);
-        // Initialize HNSW index
-        await this.initializeHNSW();
-        logger.info('HNSW index initialized');
-        // Load existing patterns into HNSW
-        await this.loadPatternsIntoHNSW();
+        // #1022: without an embedding runtime (no @huggingface/transformers and no
+        // AQE_EMBEDDER_ENDPOINT) run text-only instead of failing: no vector is
+        // computed, stored or searched (ADR-097: no hash-embedding fallback).
+        try {
+            await computeRealEmbedding(EMBEDDING_SPACE_CANARY, this.qeConfig.embeddings);
+        }
+        catch (error) {
+            this.embedderUnavailableReason = toErrorMessage(error);
+            logger.warn('No embedding runtime: patterns are stored without vectors (pending ' +
+                '`aqe learning backfill-embeddings`) and searched by text matching only', { reason: this.embedderUnavailableReason });
+        }
+        if (this.embedderUnavailableReason === null) {
+            // Initialize HNSW index
+            await this.initializeHNSW();
+            logger.info('HNSW index initialized');
+            // Load existing patterns into HNSW
+            await this.loadPatternsIntoHNSW();
+        }
         // Load foundational patterns ONLY if this is a brand-new database (no tables or genuinely empty).
         // CRITICAL: Do NOT overwrite existing data. If patterns were unexpectedly wiped,
         // loading 22 seed patterns would mask the data loss. Log a warning instead.
@@ -193,6 +207,12 @@ export class RealQEReasoningBank {
         const initTime = performance.now() - startTime;
         logger.info('Fully initialized', { durationMs: Math.round(initTime) });
     }
+    /** #1022: whether pattern search uses vectors or text matching only. */
+    getPatternSearchStatus() {
+        return this.embedderUnavailableReason === null
+            ? { mode: 'vector' }
+            : { mode: 'lexical-only', reason: this.embedderUnavailableReason };
+    }
     /**
      * Initialize HNSW index for fast similarity search
      */
@@ -311,9 +331,12 @@ export class RealQEReasoningBank {
     async storeQEPattern(options) {
         // Require explicit initialization - don't auto-initialize to avoid memory issues
         try {
-            // Generate REAL embedding using transformer model
+            // Generate REAL embedding using transformer model. #1022: without an
+            // embedding runtime the pattern is stored text-only (vector pending).
             const textToEmbed = `${options.name} ${options.description || ''} ${options.context?.tags?.join(' ') || ''}`;
-            const embedding = await computeRealEmbedding(textToEmbed, this.qeConfig.embeddings);
+            const embedding = this.embedderUnavailableReason === null
+                ? await computeRealEmbedding(textToEmbed, this.qeConfig.embeddings)
+                : undefined;
             // Detect QE domain
             const qeDomain = detectQEDomain(textToEmbed) || 'test-generation';
             // ADR-058: Check MemoryWriteGate for contradictions before storing
@@ -374,7 +397,7 @@ export class RealQEReasoningBank {
             // Store in SQLite
             this.sqliteStore.storePattern(pattern, embedding);
             // Add to HNSW index
-            if (this.hnswIndex) {
+            if (this.hnswIndex && embedding) {
                 const index = this.hnswIndex.getCurrentCount();
                 this.hnswIndex.addPoint(embedding, index);
                 this.patternIdMap.set(index, patternId);
@@ -410,38 +433,15 @@ export class RealQEReasoningBank {
         // Require explicit initialization - don't auto-initialize to avoid memory issues
         const startTime = performance.now();
         try {
-            if (!this.hnswIndex) {
-                return err(new Error('HNSW index not available'));
-            }
-            // Generate REAL embedding for query
-            const queryEmbedding = await computeRealEmbedding(query, this.qeConfig.embeddings);
-            // Search HNSW index
             const limit = options.limit || 10;
-            const results = this.hnswIndex.searchKnn(queryEmbedding, limit * 2); // Get extra for filtering
             const patterns = [];
-            for (let i = 0; i < results.neighbors.length; i++) {
-                const hnswIndex = results.neighbors[i];
-                const distance = results.distances[i];
-                const similarity = 1 - distance; // Convert distance to similarity
-                if (options.minSimilarity !== undefined && similarity < options.minSimilarity) {
-                    continue;
-                }
-                const patternId = this.patternIdMap.get(hnswIndex);
-                if (!patternId)
-                    continue;
-                const pattern = this.sqliteStore.getPattern(patternId);
-                if (!pattern)
-                    continue;
-                // Filter by domain if specified
-                if (options.domain && pattern.qeDomain !== options.domain) {
-                    continue;
+            // #1022: without an embedding runtime only the lexical (FTS) branch
+            // below runs; its hits are labelled matchType 'lexical'.
+            if (this.embedderUnavailableReason === null) {
+                if (!this.hnswIndex) {
+                    return err(new Error('HNSW index not available'));
                 }
-                const reuse = DEFAULT_PATTERN_STORE_CONFIG.reuseOptimization;
-                const ageDays = (Date.now() - new Date(pattern.lastUsedAt).getTime()) / 86_400_000;
-                patterns.push({ pattern, similarity, score: similarity, matchType: 'vector',
-                    canReuse: Boolean(pattern.reusable && similarity >= reuse.minSimilarityForReuse
-                        && pattern.successRate >= reuse.minSuccessRateForReuse && ageDays <= reuse.maxAgeForReuse),
-                });
+                await this.collectVectorMatches(query, limit, options, patterns);
             }
             const existing = new Map(patterns.map(hit => [hit.pattern.id, hit]));
             for (const lexical of this.sqliteStore.searchFTS(query, limit * 2)) {
@@ -471,6 +471,37 @@ export class RealQEReasoningBank {
             return err(toError(error));
         }
     }
+    /** Append HNSW vector matches for `query` to `patterns`. */
+    async collectVectorMatches(query, limit, options, patterns) {
+        // Generate REAL embedding for query
+        const queryEmbedding = await computeRealEmbedding(query, this.qeConfig.embeddings);
+        // Search HNSW index
+        const results = this.hnswIndex.searchKnn(queryEmbedding, limit * 2); // Get extra for filtering
+        for (let i = 0; i < results.neighbors.length; i++) {
+            const hnswIndex = results.neighbors[i];
+            const distance = results.distances[i];
+            const similarity = 1 - distance; // Convert distance to similarity
+            if (options.minSimilarity !== undefined && similarity < options.minSimilarity) {
+                continue;
+            }
+            const patternId = this.patternIdMap.get(hnswIndex);
+            if (!patternId)
+                continue;
+            const pattern = this.sqliteStore.getPattern(patternId);
+            if (!pattern)
+                continue;
+            // Filter by domain if specified
+            if (options.domain && pattern.qeDomain !== options.domain) {
+                continue;
+            }
+            const reuse = DEFAULT_PATTERN_STORE_CONFIG.reuseOptimization;
+            const ageDays = (Date.now() - new Date(pattern.lastUsedAt).getTime()) / 86_400_000;
+            patterns.push({ pattern, similarity, score: similarity, matchType: 'vector',
+                canReuse: Boolean(pattern.reusable && similarity >= reuse.minSimilarityForReuse
+                    && pattern.successRate >= reuse.minSuccessRateForReuse && ageDays <= reuse.maxAgeForReuse),
+            });
+        }
+    }
     /**
      * Route a task to optimal agent
      */
@@ -701,6 +732,7 @@ export class RealQEReasoningBank {
                 : 0,
             embeddingCacheSize: 0, // Would need to track this in real-embeddings
             transformerAvailable: isTransformerAvailable(),
+            patternSearch: this.getPatternSearchStatus(),
             embeddingDimension: getEmbeddingDimension(),
             sqliteDbPath: this.qeConfig.sqlite.dbPath || '.agentic-qe/memory.db',
             // ADR-061: Asymmetric learning stats