agentic-qe 3.15.10 → 3.15.12

package/.claude/hooks/aqe-hook.cjs

@@ -298,8 +298,43 @@ const FAST_HOOKS = new Set(['guard', 'pre-command']);
 const SPAWN_TIMEOUT_MS = Number(process.env.AQE_HOOK_TIMEOUT_MS)
   || (FAST_HOOKS.has(args[0]) ? 2500 : 4500);
 
+// Credential shapes scrubbed from health-log lines (#740). The child's stderr
+// can echo hook arguments (commands, prompts) and provider errors. This file is
+// copied standalone into user projects and cannot import the AQE logger, so it
+// carries a compact copy of src/logging/redaction.ts's detectors; the parity
+// test (tests/unit/logging/redaction-copies.test.ts) keeps them in step. Every
+// pattern is linear: bounded or single-pass quantifiers only.
+const HEALTH_REDACTIONS = [
+  [/-----BEGIN[^-\n]{0,64}PRIVATE KEY-----(?:[\s\S]*?-----END[^-\n]{0,64}PRIVATE KEY-----|[\s\S]*)/g, '<REDACTED:private_key>'],
+  [/(:\/\/)[^\s/@:"']*:[^\s/@"']+@/g, '$1<REDACTED:credentials>@'],
+  [/\b((?:authorization|x-api-key):\s*(?:(?:Bearer|Basic|Token)\s+)?)[^\s"']+/gi, '$1<REDACTED:credential>'],
+  [/\b(set-cookie|cookie):\s*[^\n]+/gi, '$1: <REDACTED:cookie>'],
+  [/\b(Bearer)\s+([A-Za-z0-9._~+/=-]{8,})/gi,
+    (match, scheme, value) => (isProseWord(value) ? match : `${scheme} <REDACTED:credential>`)],
+  [/\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g, '<REDACTED:jwt>'],
+  [/\b(?:sk-(?:ant-|proj-)?[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9_]{16,}|github_pat_[A-Za-z0-9_]{16,}|glpat-[A-Za-z0-9_-]{20,}|xox[bpsa]-[A-Za-z0-9-]{10,}|hf_[A-Za-z0-9]{30,}|npm_[A-Za-z0-9]{36,}|cog_[A-Za-z0-9-]{20,}|[spr]k_(?:live|test)_[A-Za-z0-9]{10,}|AIzaSy[A-Za-z0-9_-]{33}|A[KS]IA[0-9A-Z]{16})/g,
+    '<REDACTED:token>'],
+  // key=value, key: value, "key": "value" and --key value for sensitive key names.
+  [/((?:^|[^A-Za-z0-9])[A-Za-z0-9_-]{0,64}?(?:token|secret|password|passwd|passphrase|api[_-]?key|credentials?|private[_-]?key)["']?\s*[:=]\s*["']?)[^\s"'&,;}]+/gi,
+    '$1<REDACTED:credential>'],
+  [/(--?[A-Za-z0-9-]{0,64}?(?:token|secret|password|api-?key)\s+)[^\s-][^\s]*/gi, '$1<REDACTED:credential>'],
+];
+
+/** "use Bearer authorization" is prose; digits, mixed case, symbols or >16 letters mean a token. */
+function isProseWord(value) {
+  return /^[A-Z]?[a-z]+\.?$/.test(value) && value.replace(/\.$/, '').length <= 16;
+}
+
+/** Redact credential-shaped text before it reaches the health log. */
+function redactHealthText(text) {
+  let out = String(text);
+  for (const [regex, replacement] of HEALTH_REDACTIONS) out = out.replace(regex, replacement);
+  return out;
+}
+
 function recordHookHealth(line) {
   try {
+    line = redactHealthText(line);
     const logPath = path.join(PROJECT, '.agentic-qe', 'hooks-health.log');
     // Throttle: skip if we logged within the last 5 min (avoid a line/turn).
     // lstat, so a planted symlink's TARGET mtime never decides anything.
@@ -399,7 +434,8 @@ function superviseSpawn(cmd, cmdArgs, subcmd, ts) {
     // Child exited non-zero with no JSON payload — e.g. an empty-task throw
     // when the harness didn't populate $PROMPT/$TOOL_INPUT_*.
     recordHookHealth(`[${ts()}] EMPTY-RESULT hook exited status=${res.status} `
-      + `with no JSON output (cmd=${subcmd}). stderr: ${stderr.slice(0, 300)}\n`);
+      // Redact before truncating, so a cut can never leave a token too short to match.
+      + `with no JSON output (cmd=${subcmd}). stderr: ${redactHealthText(stderr.slice(0, 4096)).slice(0, 300)}\n`);
   }
   return out;
 }
@@ -426,6 +462,6 @@ function main() {
 // requiring this file never spawns anything.
 // brain-checkpoint.cjs checks for this export (and the require.main guard
 // below) before requiring this file; keep both.
-module.exports = { resolveAqeInvocation, parseCmdShimTarget };
+module.exports = { resolveAqeInvocation, parseCmdShimTarget, redactHealthText };
 
 if (require.main === module) main();

package/.claude/skills/skills-manifest.json

@@ -940,7 +940,7 @@
   },
   "metadata": {
     "generatedBy": "Agentic QE Fleet",
-    "fleetVersion": "3.15.10",
+    "fleetVersion": "3.15.12",
     "manifestVersion": "1.4.0",
     "lastUpdated": "2026-04-13T00:00:00.000Z",
     "contributors": [

package/CHANGELOG.md

@@ -5,6 +5,269 @@ All notable changes to the Agentic QE project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.15.12] - 2026-10-23
+
+A coverage verdict now needs evidence for the whole target. A report that
+leaves out source files, or is older than the code, gives INSUFFICIENT
+EVIDENCE instead of PASSED. Coverage tasks sent through `task_orchestrate`
+work. The worker daemon started by `start-daemon.cjs` stays running and keeps
+its log small. When the embedder fails after startup, pattern learning falls
+back to text search instead of failing, and retries the embedder without
+stalling anyone. Redaction catches more secrets and stops redacting plain
+prose. CI and the Docker image use the patched October Node releases.
+
+### Changed
+
+- **Coverage verdicts need complete, current evidence** ([#1154], [#1199]):
+  `aqe fleet run analyze`, `aqe coverage`, `aqe ci` and MCP
+  `coverage_analyze_sublinear` no longer report a pass from a coverage report
+  that covers only part of the target or is older than the sources. Source
+  files under the target that the report doesn't list are counted as
+  unmeasured and named, and a stale report is flagged. Either one gives
+  **INSUFFICIENT EVIDENCE**: `aqe coverage` and `aqe ci` exit with 3, and the
+  fleet verdict is FAILED. Only production source files inside the project's
+  own coverage scope count. That scope is read from the include/exclude
+  settings in vitest/vite, jest, nyc or c8 config, so files you exclude there
+  are not required. To fix a failing verdict, regenerate the report for the
+  whole target (for example `npm test -- --coverage`), or exclude the files
+  that are not meant to be measured. JSON output carries `evidenceStatus`,
+  `unmeasuredFiles` and `staleReport`.
+- **Invalid task priorities are rejected** ([#1117], [#1131], by
+  @rudycelekli): `task_orchestrate` used to turn any unknown priority into
+  `p1`, including `""` and `null`, and could downgrade a requested `p0`. It
+  now accepts `critical`, `high`, `medium`, `low` and `p0`–`p3` and rejects
+  anything else with a message. `aqe task list --priority` and MCP
+  `task_list` validate their filter the same way, instead of silently
+  listing nothing.
+
+### Fixed
+
+- **Coverage tasks from `task_orchestrate` work** ([#1200], [#1202]): they
+  always failed with "Invalid analyze-coverage payload: missing
+  coverageData". They now run through the same code as
+  `coverage_analyze_sublinear`, with the same figures and evidence checks.
+  The target is the single `filePaths` entry, else a path named in the task
+  text, else the project. A task that names more than one target is refused
+  and asked for one.
+- **The worker daemon stays running** ([#1158], [#1208]): `start-daemon.cjs`
+  started the MCP server with no stdin, and the server read that as a
+  disconnected client and shut down within seconds. The script now starts
+  the server in daemon mode (`AQE_MCP_DAEMON=1`). It ignores stdin EOF, logs a
+  heartbeat each minute and stops on SIGTERM, which `stop-daemon.cjs` sends.
+  Daemon mode is honoured only when nothing is attached to stdin, so a
+  normal MCP client still shuts its server down when it disconnects.
+  **Re-run `aqe init` once** so the project's `start-daemon.cjs` is
+  regenerated.
+- **`daemon.log` stays small** ([#1207], [#1214]): the daemon moves the log
+  to `daemon.log.1` when it passes 5 MB. Set `AQE_DAEMON_LOG_MAX_SIZE` to
+  change the cap (`0` or `off` disables it), and
+  `AQE_DAEMON_HEARTBEAT_SECONDS` to change the heartbeat interval.
+- **An embedder that fails after startup no longer breaks pattern learning**
+  ([#1187], [#1203], [#1204], [#1215]): when the embedding endpoint went down
+  mid-session, pattern search threw and lost its text matches, storing a
+  pattern failed, and the status still said `vector`. Now:
+  - search returns its text matches, labelled `lexical-only` with the reason;
+  - patterns are stored without a vector (`aqe learning backfill-embeddings`
+    adds it later);
+  - `aqe hooks learn` and `aqe hooks search` work in text-only mode instead
+    of exiting 1, and the hint names the configured endpoint and why it
+    failed.
+
+  The embedder is retried every 60 s (`embedderRetryIntervalMs`), in the
+  background, so the call that triggers a retry never waits for it. Recovery
+  takes about one interval, down from two. `task_orchestrate` reports
+  experience guidance the same way, in `learning.experienceGuidance`.
+- **Experience guidance reports only measured similarity** ([#1192],
+  [#1215]): reservoir samples, picked without looking at the task, were
+  blended in with a similarity derived from their coherence score. A sample
+  is now included only when its similarity to the task was actually computed
+  and meets the threshold. Some tasks get less guidance as a result.
+- **Slow stream consumers no longer time out** ([#962], [#1197]): a
+  streaming LLM call's idle deadline fired when the caller paused between
+  chunks, even after the server had sent everything. It now measures network
+  silence, reading up to 1 MiB ahead of the consumer.
+- **One interrupt reaches the host once** ([#992], [#1198]): when a test
+  count was interrupted, AQE re-raised the signal even if the program
+  embedding it had its own handler, so a host that counts Ctrl-C presses saw
+  two.
+- **Cached code analyses belong to the right code** ([#1190], by
+  @rudycelekli): the semantic analyzer keyed its analysis and embedding
+  caches with a weak 32-bit hash, so two different snippets could share an
+  entry and get each other's results or embeddings. Entries are now keyed by
+  SHA-256 of the content.
+- **Infra health with a custom agent prefix** ([#1189], by @rudycelekli): a
+  prefix containing regex characters recovered the wrong service name, so a
+  service that was down reported as healthy. The prefix is now stripped
+  literally.
+
+### Security
+
+- **More secrets are redacted** ([#740], [#1195], [#1213]): logs, MCP tool
+  errors, the CLI fatal handler and kernel errors now redact:
+  - Hugging Face (`hf_`), npm (`npm_`) and Cognitum (`cog_`) tokens;
+  - `Authorization: Token …` headers;
+  - private-key blocks that are missing their END line;
+  - whole objects and arrays stored under a sensitive key (for example
+    `"apiKey": {…}`), not only plain values.
+
+  `.agentic-qe/hooks-health.log` and the OpenCode plugin's output are
+  redacted too. Error logs show the error's `code` and `status` again.
+- **Less over-redaction** ([#740], [#1195], [#1196], [#1213]): prose such as
+  "Basic authentication" or "use Bearer authorization" is no longer replaced.
+  Real Basic credentials and Bearer tokens, and any value in an
+  `Authorization:` header, still are.
+- **Patched Node releases** ([#1206]): CI, the release workflow, the Docker
+  image and `.nvmrc` use Node 24.22.1, and the Node 22 compatibility job uses
+  22.23.4. Both include the October 2026 Node security fixes. The supported
+  minimum stays `>=22.13.0`.
+
+### Changed (development)
+
+- `vitest` and `@vitest/coverage-v8` 5.0.1 → 5.0.5 (dev dependencies), which
+  clears two `@vitest/mocker` advisories ([#1210]).
+
+[#740]: https://github.com/proffesor-for-testing/agentic-qe/issues/740
+[#962]: https://github.com/proffesor-for-testing/agentic-qe/issues/962
+[#992]: https://github.com/proffesor-for-testing/agentic-qe/issues/992
+[#1117]: https://github.com/proffesor-for-testing/agentic-qe/issues/1117
+[#1131]: https://github.com/proffesor-for-testing/agentic-qe/pull/1131
+[#1154]: https://github.com/proffesor-for-testing/agentic-qe/issues/1154
+[#1158]: https://github.com/proffesor-for-testing/agentic-qe/issues/1158
+[#1187]: https://github.com/proffesor-for-testing/agentic-qe/issues/1187
+[#1189]: https://github.com/proffesor-for-testing/agentic-qe/pull/1189
+[#1190]: https://github.com/proffesor-for-testing/agentic-qe/pull/1190
+[#1192]: https://github.com/proffesor-for-testing/agentic-qe/issues/1192
+[#1195]: https://github.com/proffesor-for-testing/agentic-qe/pull/1195
+[#1196]: https://github.com/proffesor-for-testing/agentic-qe/issues/1196
+[#1197]: https://github.com/proffesor-for-testing/agentic-qe/pull/1197
+[#1198]: https://github.com/proffesor-for-testing/agentic-qe/pull/1198
+[#1199]: https://github.com/proffesor-for-testing/agentic-qe/pull/1199
+[#1200]: https://github.com/proffesor-for-testing/agentic-qe/issues/1200
+[#1202]: https://github.com/proffesor-for-testing/agentic-qe/pull/1202
+[#1203]: https://github.com/proffesor-for-testing/agentic-qe/pull/1203
+[#1204]: https://github.com/proffesor-for-testing/agentic-qe/issues/1204
+[#1206]: https://github.com/proffesor-for-testing/agentic-qe/pull/1206
+[#1207]: https://github.com/proffesor-for-testing/agentic-qe/issues/1207
+[#1208]: https://github.com/proffesor-for-testing/agentic-qe/pull/1208
+[#1210]: https://github.com/proffesor-for-testing/agentic-qe/pull/1210
+[#1213]: https://github.com/proffesor-for-testing/agentic-qe/pull/1213
+[#1214]: https://github.com/proffesor-for-testing/agentic-qe/pull/1214
+[#1215]: https://github.com/proffesor-for-testing/agentic-qe/pull/1215
+
+## [3.15.11] - 2026-10-22
+
+AQE now works on npm 12 and on a plain install without the optional
+embedding package, and its MCP tools load in VS Code Copilot. When the
+database cannot start, `aqe init` prints the real cause and the command that
+fixes it. `aqe fleet run` progress output is readable, a test that passes on
+retry counts as passed and flaky, and an `eval()` is no longer reported twice.
+Four security fixes close the follow-ups from the 3.15.10 review: a checked
+file is read from exactly what was checked, runner stderr is redacted before
+it is cut, and names like `constructor` or `__proto__` are plain names in
+every data lookup.
+
+### Fixed
+
+- **`aqe init` explains a missing database driver** ([#1173], [#1175]): on
+  npm 12, `npm install -g agentic-qe` blocks the install script of
+  `better-sqlite3`, so its native binary is never built. `aqe init` then
+  failed at "Initialize persistence database" with no error printed. Now
+  `init` prints the real error, and every command that opens the database
+  (`init`, `health`, `status`, `memory`, MCP fleet init) names the cause and
+  prints the exact fix:
+  `npm install -g agentic-qe --allow-scripts=agentic-qe,better-sqlite3,hnswlib-node`.
+  The README and getting-started guide include the npm 12 install note.
+- **MCP tools load in VS Code Copilot** ([#1185], [#1193]): Copilot refused
+  `fleet_init` and 17 other tools with "tool parameters array type must have
+  items". Every list parameter in every tool schema now declares what its
+  elements are, including the `qe/*` domain tools, whose element types were
+  dropped when they were published.
+- **`task_orchestrate` and `aqe eval` work without an embedder** ([#1022],
+  [#1181]): on a plain install without `@huggingface/transformers`,
+  `task_orchestrate` always failed with "Transformer initialization
+  previously failed" and `aqe eval` failed to load. Both now work. Pattern
+  learning stores patterns without a vector and searches them by text; its
+  response says so in a new `learning` field (`patternSearch: "vector"`,
+  `"lexical-only"` with the reason, or `"unavailable"`). Text matches report
+  `similarity: 0` because no similarity was measured. Experience guidance is
+  not produced without an embedding of the task, instead of guidance for an
+  unrelated task with a made-up similarity.
+- **`aqe fleet run` progress output** ([#1168], [#1177]): the progress header
+  shows `Fleet Progress` instead of a literal `{name}` and a stray `0`. When
+  the verdict is FAILED, the completion line no longer says "successfully".
+- **A test that passes on retry counts as passed and flaky** ([#1170],
+  [#1177]): MCP `test_execute_parallel` and `aqe test execute` (text, JSON and
+  markdown) now count it as passed, report it as flaky, and agree with
+  `retryStats`. MCP and the CLI share one default retry count, 2 (MCP used 3).
+- **`sast-scan` runs without naming a domain** ([#1170], [#1177]):
+  `task_submit` and `aqe task submit` route it to `security-compliance`. A
+  task type no loaded domain handles is still rejected, with an error that
+  says so.
+- **One `eval()` is reported once** ([#1170], [#1177], [#1184]):
+  `security_scan_comprehensive` dropped a duplicate generic eval/exec finding
+  only when SAST reported eval injection (CWE-95) on the same file and line,
+  at the same or a higher severity, and the line has no `exec()`. Secret, CORS
+  and debug findings are always kept. The generic rule reports every matching
+  line, and its findings name the scanned path.
+- **Learning recommendations stay in their domain and objective** ([#1091],
+  thanks @rudycelekli): a strategy tuned to maximize coverage can no longer
+  be recommended for minimizing latency or for another domain.
+- **CRDT sync rejects non-finite timestamps** ([#1087], thanks
+  @rudycelekli): a remote register with a `NaN` or infinite timestamp is
+  skipped at merge instead of winning every later comparison; valid
+  registers, including cleared ones, keep converging.
+
+### Security
+
+- **A checked file is read from exactly what was checked** ([#1161],
+  [#1179]): the path guard checked a path, and the handler opened it again
+  later by name, so a file or symlink swapped in between was read
+  unchecked. Fixed-name files inside an accepted folder (coverage reports,
+  `package.json`, dependency manifests) were not checked at all, so a
+  committed symlink could pull an outside file into results or point a
+  coverage report at `/dev/zero`. One shared reader now opens the file once
+  without following a final symlink, checks the open file (regular, within the
+  size limit, inside the project) and reads from it. Code index, SAST,
+  security scans, contract and requirements validation, test generation, C4
+  and every coverage report parser use it.
+- **Test runner stderr is redacted before it is cut** ([#1150], [#1180]):
+  when coverage tests crashed without a report, `coverage_analyze_sublinear`
+  quoted the runner's raw stderr, and a secret cut at the 2 KB boundary left a
+  fragment no redaction pattern recognizes. Stderr is now redacted first, then
+  cut. Claim-verifier command evidence and the claude-code provider's parse
+  error are redacted the same way.
+- **`constructor`, `__proto__` and other built-in names are plain names**
+  ([#1157], [#1182]): names from callers, files or stored data matched
+  built-in JavaScript members. A pipeline condition on `input.constructor`
+  ran a step that should be skipped, a dependency named `constructor` crashed
+  `qe/code/c4` and hid real findings, an agent-overlay `__proto__:` section
+  wrote onto every object, and a tool named `constructor` could claim to be
+  read-only. Every such lookup now reads own entries only.
+
+### Changed
+
+- `vite` (dev dependency) 8.3.0 → 8.3.4 ([#1172]).
+
+[#1022]: https://github.com/proffesor-for-testing/agentic-qe/issues/1022
+[#1087]: https://github.com/proffesor-for-testing/agentic-qe/pull/1087
+[#1091]: https://github.com/proffesor-for-testing/agentic-qe/pull/1091
+[#1150]: https://github.com/proffesor-for-testing/agentic-qe/issues/1150
+[#1157]: https://github.com/proffesor-for-testing/agentic-qe/issues/1157
+[#1161]: https://github.com/proffesor-for-testing/agentic-qe/issues/1161
+[#1168]: https://github.com/proffesor-for-testing/agentic-qe/issues/1168
+[#1170]: https://github.com/proffesor-for-testing/agentic-qe/issues/1170
+[#1172]: https://github.com/proffesor-for-testing/agentic-qe/pull/1172
+[#1173]: https://github.com/proffesor-for-testing/agentic-qe/issues/1173
+[#1175]: https://github.com/proffesor-for-testing/agentic-qe/pull/1175
+[#1177]: https://github.com/proffesor-for-testing/agentic-qe/pull/1177
+[#1179]: https://github.com/proffesor-for-testing/agentic-qe/pull/1179
+[#1180]: https://github.com/proffesor-for-testing/agentic-qe/pull/1180
+[#1181]: https://github.com/proffesor-for-testing/agentic-qe/pull/1181
+[#1182]: https://github.com/proffesor-for-testing/agentic-qe/pull/1182
+[#1184]: https://github.com/proffesor-for-testing/agentic-qe/pull/1184
+[#1185]: https://github.com/proffesor-for-testing/agentic-qe/issues/1185
+[#1193]: https://github.com/proffesor-for-testing/agentic-qe/pull/1193
+
 ## [3.15.10] - 2026-10-19
 
 Files named in a request are now read only when they are inside your

package/README.md

@@ -34,6 +34,14 @@ aqe init --auto
 aqe health
 ```
 
+**npm 12+:** dependency install scripts are blocked unless allowed, and AQE's SQLite store (`better-sqlite3`) needs its install script to fetch its native binary. Name the packages when you install:
+
+```bash
+npm install -g agentic-qe --allow-scripts=agentic-qe,better-sqlite3,hnswlib-node
+```
+
+Include `agentic-qe` in the command — npm's warning suggests `npm install -g --allow-scripts=...` without a package name, which installs the current directory instead. If `aqe init` reports that the `better-sqlite3` native module could not be loaded on an existing install, rebuild it with `npm rebuild -g better-sqlite3 --allow-scripts=better-sqlite3` (for a project-local install: `npm install-scripts approve better-sqlite3 && npm rebuild better-sqlite3`). `hnswlib-node` is optional; AQE runs without it.
+
 `aqe init --auto` analyzes your project and configures the default Claude Code surface, including MCP. Review the generated project files. For another client, select its setup flag below and use its MCP connection flow.
 
 In your coding agent, start with a narrow request:

package/assets/skills/skills-manifest.json

@@ -940,7 +940,7 @@
   },
   "metadata": {
     "generatedBy": "Agentic QE Fleet",
-    "fleetVersion": "3.15.10",
+    "fleetVersion": "3.15.12",
     "manifestVersion": "1.4.0",
     "lastUpdated": "2026-04-13T00:00:00.000Z",
     "contributors": [

package/dist/adapters/a2a/agent-cards/generator.js

@@ -53,15 +53,18 @@ export function parseFrontmatter(markdown) {
         if (keyValueMatch) {
             const [, indent, key, value] = keyValueMatch;
             const currentIndent = indent.length;
+            // #1157: keys come from agent markdown; skip ones that would re-prototype
+            // the result (and, for a top-level key, the nested block under it).
+            const unsafe = key === '__proto__' || key === 'constructor' || key === 'prototype';
             if (currentIndent === 0) {
                 // Top-level key
                 if (currentKey && indentLevel > 0) {
                     result[currentKey] = nestedObj;
                     nestedObj = {};
                 }
-                currentKey = key;
+                currentKey = unsafe ? '' : key;
                 indentLevel = 0;
-                if (value.trim()) {
+                if (value.trim() && !unsafe) {
                     // Clean up quoted values
                     result[key] = value.replace(/^["']|["']$/g, '');
                 }
@@ -69,7 +72,7 @@ export function parseFrontmatter(markdown) {
             else if (currentIndent > 0 && currentKey) {
                 // Nested key
                 indentLevel = currentIndent;
-                if (value.trim()) {
+                if (value.trim() && !unsafe) {
                     nestedObj[key] = value.replace(/^["']|["']$/g, '');
                 }
             }

package/dist/adapters/a2a/tasks/task-router.js

@@ -401,7 +401,9 @@ export class TaskRouter extends EventEmitter {
         // Check capabilities
         if (request.requiredCapabilities) {
             for (const cap of request.requiredCapabilities) {
-                if (!agent.capabilities[cap]) {
+                // #1157: the capability name comes from the routing request; an
+                // inherited member such as `toString` is not a capability.
+                if (!Object.hasOwn(agent.capabilities, cap) || !agent.capabilities[cap]) {
                     return false;
                 }
             }

package/dist/adapters/trajectory-adapter.js

@@ -135,7 +135,7 @@ export class TrajectoryAdapter {
                 acc[type] = [];
             acc[type].push(t);
             return acc;
-        }, {});
+        }, createSafeRecord()); // #1157: workflow types are stored data
         // Extract common sequences within each workflow type
         for (const [workflowType, trajs] of Object.entries(successfulByType)) {
             const commonSequences = this.findCommonSequences(trajs);

package/dist/agents/claim-verifier/verifiers/output-verifier.d.ts

@@ -92,7 +92,9 @@ export declare class OutputBasedVerifier {
      */
     private verifyExistingEvidence;
     /**
-     * Truncate output if it exceeds max size.
+     * Redact command output, then truncate it if it exceeds max size. #1150:
+     * redaction runs first, so a cut cannot leave a fragment of a secret that
+     * the redaction patterns no longer recognise.
      */
     private truncateOutput;
 }

package/dist/agents/claim-verifier/verifiers/output-verifier.js

@@ -12,6 +12,32 @@
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { generateContentHash } from '../index.js';
+import { redactLogText } from '../../../logging/redaction.js';
+/** Output above this size is redacted in line-aligned pieces. */
+const REDACT_PIECE_CHARS = 256 * 1024;
+/**
+ * Redact command output of any size (#1150). redactLogText drops a string over
+ * its scan limit instead of scanning it, and maxBuffer lets output reach 1 MB,
+ * so long output is redacted in pieces cut at line ends, and a credential on
+ * one line is never split between pieces. A line longer than a piece stays
+ * whole; one over the scan limit is dropped by redactLogText, never cut.
+ */
+function redactOutput(raw) {
+    if (raw.length <= REDACT_PIECE_CHARS)
+        return redactLogText(raw, Number.POSITIVE_INFINITY);
+    const parts = [];
+    for (let start = 0; start < raw.length;) {
+        let end = Math.min(start + REDACT_PIECE_CHARS, raw.length);
+        if (end < raw.length) {
+            const lineEnd = raw.lastIndexOf('\n', end - 1);
+            const next = raw.indexOf('\n', end);
+            end = lineEnd >= start ? lineEnd + 1 : next === -1 ? raw.length : next + 1;
+        }
+        parts.push(redactLogText(raw.slice(start, end), Number.POSITIVE_INFINITY));
+        start = end;
+    }
+    return parts.join('');
+}
 const execFileAsync = promisify(execFile);
 const ALLOWED_COMMANDS = new Map([
     ['npm run build', { bin: 'npm', args: ['run', 'build'] }],
@@ -347,9 +373,12 @@ export class OutputBasedVerifier {
         return { evidence, verified, reasoning, confidence };
     }
     /**
-     * Truncate output if it exceeds max size.
+     * Redact command output, then truncate it if it exceeds max size. #1150:
+     * redaction runs first, so a cut cannot leave a fragment of a secret that
+     * the redaction patterns no longer recognise.
      */
-    truncateOutput(output) {
+    truncateOutput(raw) {
+        const output = redactOutput(raw);
         if (output.length <= this.config.maxOutputSize) {
             return output;
         }

package/dist/agents/overlay-loader.js

@@ -8,6 +8,11 @@ import { readFileSync, existsSync, readdirSync } from 'fs';
 import { join, basename } from 'path';
 import { validateOverlay } from './overlay-schema.js';
 const OVERRIDES_DIR = '.claude/agent-overrides';
+/**
+ * #1157: keys come from the overlay file. These would reach Object.prototype
+ * (or the Object constructor) through a plain object, so they are skipped.
+ */
+const UNSAFE_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
 /**
  * Parse YAML-like overlay files.
  * Uses a simple parser to avoid adding a yaml dependency.
@@ -15,9 +20,17 @@ const OVERRIDES_DIR = '.claude/agent-overrides';
  */
 function parseSimpleYaml(content) {
     const result = {};
+    // An own section object for `name`; an inherited member never counts.
+    const sectionOf = (name) => {
+        const existing = Object.hasOwn(result, name) ? result[name] : undefined;
+        if (existing !== null && typeof existing === 'object')
+            return existing;
+        const fresh = {};
+        result[name] = fresh;
+        return fresh;
+    };
     const lines = content.split('\n');
     let currentSection = null;
-    let currentSubSection = null;
     let currentArray = null;
     let currentArrayKey = null;
     for (const rawLine of lines) {
@@ -37,15 +50,8 @@ function parseSimpleYaml(content) {
         }
         // Flush any pending array
         if (currentArray && currentArrayKey) {
-            if (currentSubSection && currentSection) {
-                const section = result[currentSection] || {};
-                section[currentArrayKey] = currentArray;
-                result[currentSection] = section;
-            }
-            else if (currentSection) {
-                const section = result[currentSection] || {};
-                section[currentArrayKey] = currentArray;
-                result[currentSection] = section;
+            if (currentSection) {
+                sectionOf(currentSection)[currentArrayKey] = currentArray;
             }
             currentArray = null;
             currentArrayKey = null;
@@ -56,39 +62,38 @@ function parseSimpleYaml(content) {
             continue;
         const [, key, rawValue] = match;
         const value = rawValue.trim().replace(/^["']|["']$/g, '');
+        if (UNSAFE_KEYS.has(key)) {
+            // Skip the key, and a whole section under it.
+            if (indent === 0) {
+                currentSection = null;
+            }
+            continue;
+        }
         if (indent === 0) {
             // Top-level key
             if (value === '' || value === undefined) {
                 currentSection = key;
-                currentSubSection = null;
-                if (!result[key])
-                    result[key] = {};
+                sectionOf(key);
             }
             else {
                 result[key] = parseValue(value);
                 currentSection = null;
-                currentSubSection = null;
             }
         }
         else if (indent <= 4 && currentSection) {
             if (value === '' || value === undefined) {
                 // Sub-section or array start
-                currentSubSection = key;
                 currentArray = [];
                 currentArrayKey = key;
             }
             else {
-                const section = result[currentSection] || {};
-                section[key] = parseValue(value);
-                result[currentSection] = section;
+                sectionOf(currentSection)[key] = parseValue(value);
             }
         }
     }
     // Flush final array
     if (currentArray && currentArrayKey && currentSection) {
-        const section = result[currentSection] || {};
-        section[currentArrayKey] = currentArray;
-        result[currentSection] = section;
+        sectionOf(currentSection)[currentArrayKey] = currentArray;
     }
     return result;
 }