agentic-qe 3.15.13 → 3.15.15

package/dist/domains/quality-assessment/services/quality-analyzer.js

@@ -9,7 +9,7 @@ import { getCodeMetricsAnalyzer } from '../../../shared/metrics/index.js';
 import { toError } from '../../../shared/error-utils.js';
 import { safeJsonParse } from '../../../shared/safe-json.js';
 import { getClaudeModelForTier } from '../../../shared/llm/model-registry.js';
-import { measuredCoverageSummary, measuredFileCoverage } from '../coverage-report-event.js';
+import { measuredFileCoverage } from '../coverage-report-event.js';
 import { fileCoverageLookupKeys } from '../../coverage-analysis/collected-metrics.js';
 /** Metrics the static analyzer produces when the caller asks for all of them. */
 const ANALYZER_METRICS = ['coverage', 'complexity', 'maintainability', 'duplication', 'testability'];
@@ -25,6 +25,22 @@ const PARSED_METRICS = new Set(['complexity', 'maintainability', 'testability'])
 export const MIN_ANALYSED_SHARE = 0.95;
 /** #1011: the sentinel for "not measured" in score and complexity fields. */
 const UNMEASURED = -1;
+/**
+ * #1219: covered lines over total lines across the files, or `null` when a
+ * record has no line counts (a mean of percentages would weight a 10-line
+ * file like a 1000-line one).
+ */
+function lineWeightedCoverage(records) {
+    let covered = 0;
+    let total = 0;
+    for (const record of records) {
+        if (!record.lines)
+            return null;
+        covered += record.lines.covered;
+        total += record.lines.total;
+    }
+    return total > 0 ? (covered / total) * 100 : null;
+}
 /** First reasons of a failure list, for a one-line explanation. */
 function summariseFailures(failures) {
     return failures.slice(0, 3).map((f) => f.reason).join('; ')
@@ -262,11 +278,16 @@ Focus on:
                 return err(new Error('No source files provided for analysis'));
             }
             // Analyze metrics for each file; failures become unmeasured (#1011)
-            const { fileMetrics, unmeasured, excluded, partial } = await this.collectFileMetrics(sourceFiles, includeMetrics, request.explicitFiles ?? []);
+            const { fileMetrics, scopeValues, unmeasured, excluded, partial } = await this.collectFileMetrics(sourceFiles, includeMetrics, request.explicitFiles ?? []);
             // Calculate aggregated metrics
-            const metricDetails = this.aggregateMetrics(fileMetrics);
-            // Calculate overall quality score
-            const score = this.calculateQualityScore(metricDetails);
+            const metricDetails = this.aggregateMetrics(fileMetrics, scopeValues);
+            // Calculate overall quality score. With a requested metric unmeasured
+            // there is no overall score (-1, as the gate's overallScore since
+            // #1223); the score over the measured metrics is kept as subsetScore.
+            const computed = this.calculateQualityScore(metricDetails);
+            const insufficient = unmeasured.length > 0;
+            const score = insufficient ? { ...computed, overall: UNMEASURED } : computed;
+            const subsetScore = insufficient && computed.overall >= 0 ? computed.overall : undefined;
             // Generate trends if enabled
             const trends = this.config.enableTrendAnalysis
                 ? await this.generateTrends(metricDetails, compareBaseline)
@@ -290,6 +311,7 @@ Focus on:
                 unmeasured,
                 excluded,
                 partial,
+                ...(subsetScore !== undefined ? { subsetScore } : {}),
             };
             // Store the report
             await this.storeReport(report, sourceFiles);
@@ -395,6 +417,8 @@ Focus on:
         const unreadable = [];
         const readable = [];
         const missingCoverage = [];
+        const coverageRecords = [];
+        const scopeValues = {};
         const explicit = new Set(explicitFiles);
         const needsAnalysis = requested.some((m) => PARSED_METRICS.has(m) || m === 'duplication');
         for (const file of files) {
@@ -430,7 +454,8 @@ Focus on:
                 // Coverage requires external data (from test runners) — never fabricate a number
                 const storedCoverage = await this.getStoredCoverage(file);
                 if (storedCoverage !== null) {
-                    metrics.coverage = storedCoverage;
+                    metrics.coverage = storedCoverage.line;
+                    coverageRecords.push(storedCoverage);
                 }
                 else {
                     missingCoverage.push(file);
@@ -442,11 +467,33 @@ Focus on:
         if (missingCoverage.length > 0) {
             for (const metrics of fileMetrics.values())
                 delete metrics.coverage;
+            // #1219: the project-wide summary is not a measurement of these files.
             unmeasured.push({
                 metric: 'coverage',
-                reason: `no measured coverage recorded for ${missingCoverage.length} of ${total} file(s)`,
+                reason: `no measured coverage recorded for ${missingCoverage.length} of ${total} file(s) `
+                    + `(${missingCoverage.slice(0, 3).join(', ')}${missingCoverage.length > 3 ? ', …' : ''}); `
+                    + 'a project-wide coverage figure is not a measurement of these files',
+                files: missingCoverage,
             });
         }
+        else if (coverageRecords.length > 1) {
+            const weighted = lineWeightedCoverage(coverageRecords);
+            if (weighted === null) {
+                for (const metrics of fileMetrics.values())
+                    delete metrics.coverage;
+                const legacy = coverageRecords.filter((r) => !r.lines).length;
+                // #1219: a plain mean of per-file percentages is not the scope's coverage.
+                unmeasured.push({
+                    metric: 'coverage',
+                    reason: `${legacy} of ${coverageRecords.length} per-file coverage record(s) carry no line counts `
+                        + '(written before 3.15.13), so the files cannot be weighted by size and a mean of their '
+                        + 'percentages is not the coverage of the scope; re-run coverage to record line counts',
+                });
+            }
+            else {
+                scopeValues.coverage = weighted;
+            }
+        }
         /** Decide whether a metric with these failures is measured, partial or unmeasured. */
         const judge = (metric, failures) => {
             const analysed = total - failures.length;
@@ -502,8 +549,12 @@ Focus on:
                 unmeasured.push({ metric: 'duplication', reason: `duplication detection failed: ${toError(error).message}` });
             }
         }
-        return { fileMetrics, unmeasured, excluded, partial };
+        return { fileMetrics, scopeValues, unmeasured, excluded, partial };
     }
+    /**
+     * The file's own measured coverage record, or `null`. #1219: never the
+     * project-wide `coverage:latest` summary — that is not this file's coverage.
+     */
     async getStoredCoverage(file) {
         try {
             // 1. Try per-file coverage stored by test executor
@@ -512,21 +563,16 @@ Focus on:
             for (const key of fileCoverageLookupKeys(file)) {
                 const fileCoverage = measuredFileCoverage(await this.memory.get(key));
                 if (fileCoverage)
-                    return fileCoverage.line;
-            }
-            // 2. Fall back to project-wide summary from coverage-analyzer
-            const summary = measuredCoverageSummary(await this.memory.get('coverage:latest'));
-            if (summary) {
-                return summary.line;
+                    return fileCoverage;
             }
-            // No coverage data available — return null (never fabricate)
+            // No coverage data for this file — return null (never fabricate)
             return null;
         }
         catch {
             return null;
         }
     }
-    aggregateMetrics(fileMetrics) {
+    aggregateMetrics(fileMetrics, scopeValues = {}) {
         const aggregated = new Map();
         // Collect all values per metric
         for (const metrics of fileMetrics.values()) {
@@ -539,7 +585,7 @@ Focus on:
         // Calculate averages and generate details
         const details = [];
         for (const [name, values] of aggregated.entries()) {
-            const average = values.reduce((a, b) => a + b, 0) / values.length;
+            const average = scopeValues[name] ?? values.reduce((a, b) => a + b, 0) / values.length;
             const rating = this.getMetricRating(average, name);
             const trend = this.estimateTrend(values);
             details.push({

package/dist/domains/test-execution/interfaces.d.ts

@@ -128,6 +128,11 @@ export interface IFileCoverageData {
     /** `null` = no functions in the file (istanbul 0/0): not collected, not 100% (#1015). */
     function: number | null;
     statement: number | null;
+    /** #1219: the line counts behind `line`, when the report has them. */
+    lines?: {
+        covered: number;
+        total: number;
+    };
 }
 export interface IFailedTest {
     testId: string;

package/dist/domains/test-execution/services/test-executor.js

@@ -1114,6 +1114,7 @@ Provide:
                         branch: ratio(branches),
                         function: ratio(fns),
                         statement: ratio(statements),
+                        lines: { covered: lines[0], total: lines[1] },
                     });
                     for (const [key, [covered, count]] of [['line', lines], ['branch', branches], ['function', fns], ['statement', statements]]) {
                         totals[key][0] += covered;
@@ -1171,12 +1172,15 @@ Provide:
                         const line = summaryPct(entry?.lines);
                         if (line !== null) {
                             // #1015: a metric with total 0 is not collected (null), not its 100 pct.
+                            const counts = entry.lines;
                             perFile.push({
                                 path: normalizedPath,
                                 line,
                                 branch: summaryPct(entry.branches),
                                 function: summaryPct(entry.functions),
                                 statement: summaryPct(entry.statements),
+                                ...(typeof counts?.covered === 'number' && typeof counts.total === 'number'
+                                    ? { lines: { covered: counts.covered, total: counts.total } } : {}),
                             });
                         }
                     }
@@ -1268,6 +1272,8 @@ Provide:
                     function: fc.function ?? null,
                     statement: fc.statement ?? null,
                     measured: true,
+                    // #1219: the counts behind `line`, so several files can be line-weighted.
+                    ...(fc.lines ? { lines: fc.lines } : {}),
                     runStatus,
                 }, { persist: true });
             }

package/dist/init/init-wizard-hooks.d.ts

@@ -21,7 +21,7 @@ export declare function configureHooks(projectRoot: string, config: AQEInitConfi
 /**
  * Configure MCP server.
  * Creates .mcp.json (root level) with AQE v3 MCP server configuration.
- * Uses npx to run the MCP server without requiring global installation.
+ * Runs the installed `aqe-mcp` binary, matching the phase-based installer.
  *
  * #922: skipped when the agentic-qe-fleet Claude Code plugin is enabled (it
  * already provides the AQE MCP server) unless `force` is set (--with-mcp).

package/dist/init/init-wizard-hooks.js

@@ -13,6 +13,7 @@ import { existsSync, mkdirSync, writeFileSync, readFileSync, copyFileSync } from
 import { join, dirname } from 'path';
 import { safeJsonParse } from '../shared/safe-json.js';
 import { aqePluginMcpSkipMessage, detectAqeFleetPlugin } from './claude-plugin-detection.js';
+import { removeUntrustedAqeMcpServers, scrubUntrustedAqeMcpFile } from './settings-merge.js';
 import { mergeHooksSmart, generateAqeEnvVars, generateV3SettingsSections, applyV3Sections, mergeAqeEnv, backupSettingsFile, } from './settings-merge.js';
 // ============================================================================
 // Hook Configuration
@@ -240,7 +241,7 @@ async function installCrossPhaseMemoryHooks(projectRoot) {
     // If no asset found, create minimal config
     const minimalConfig = `# Cross-Phase Memory Hooks Configuration
 # Generated by aqe init
-# See: https://github.com/anthropics/agentic-qe/docs/cross-phase-memory.md
+# See: https://github.com/proffesor-for-testing/agentic-qe/blob/main/docs/architecture/CROSS-PHASE-MEMORY-IMPLEMENTATION.md
 
 version: "1.0"
 enabled: true
@@ -272,7 +273,7 @@ routing:
 /**
  * Configure MCP server.
  * Creates .mcp.json (root level) with AQE v3 MCP server configuration.
- * Uses npx to run the MCP server without requiring global installation.
+ * Runs the installed `aqe-mcp` binary, matching the phase-based installer.
  *
  * #922: skipped when the agentic-qe-fleet Claude Code plugin is enabled (it
  * already provides the AQE MCP server) unless `force` is set (--with-mcp).
@@ -280,6 +281,7 @@ routing:
 export async function configureMCP(projectRoot, options = {}) {
     if (!options.force && detectAqeFleetPlugin(projectRoot).enabled) {
         console.log(aqePluginMcpSkipMessage(projectRoot));
+        scrubUntrustedAqeMcpFile(join(projectRoot, '.mcp.json'));
         return false;
     }
     const mcpPath = join(projectRoot, '.mcp.json');
@@ -297,13 +299,10 @@ export async function configureMCP(projectRoot, options = {}) {
         mcpConfig.mcpServers = {};
     }
     const servers = mcpConfig.mcpServers;
+    removeUntrustedAqeMcpServers(servers);
     servers['agentic-qe'] = {
-        command: 'npx',
-        args: [
-            '@anthropics/agentic-qe',
-            'mcp',
-            'start'
-        ],
+        command: 'aqe-mcp',
+        args: [],
         env: {
             AQE_LEARNING_ENABLED: 'true',
             AQE_VERBOSE: 'false',

package/dist/init/phases/07-hooks.js

@@ -394,6 +394,7 @@ console.log(\`\\x1b[1m\\x1b[35m▊ Agentic QE v3\\x1b[0m\${branchStr}\${patStr}\
  *   node brain-checkpoint.cjs verify   # Verify aqe.rvf exists (session-start)
  */
 const { execFileSync } = require('child_process');
+const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
 
@@ -402,6 +403,11 @@ const AQE_DIR = path.join(PROJECT_ROOT, '.agentic-qe');
 const RVF_PATH = path.join(AQE_DIR, 'aqe.rvf');
 const DB_PATH = path.join(AQE_DIR, 'memory.db');
 const MAX_AGE_HOURS = 24;
+// #1238: after a too-large export, skip the Stop-hook export for a while
+// unless a newer aqe.rvf shows that an export has succeeded since.
+const SKIP_PATH = path.join(AQE_DIR, 'brain-checkpoint.skip.json');
+const RETRY_ENV = Number.parseFloat(process.env.AQE_BRAIN_CHECKPOINT_RETRY_HOURS || '');
+const TOO_LARGE_RETRY_HOURS = Number.isFinite(RETRY_ENV) && RETRY_ENV >= 0 ? RETRY_ENV : 6;
 // Windows (#872): never execFile aqe.cmd (EINVAL without a shell); reuse the
 // hook shim's resolver, which runs the AQE bundle via node instead.
 function aqeInvocation() {
@@ -422,32 +428,110 @@ function aqeInvocation() {
 
 function log(msg) { process.stderr.write('[brain-checkpoint] ' + msg + '\\n'); }
 
+function activeSkip() {
+  let st; try { st = fs.lstatSync(SKIP_PATH); } catch { return null; }
+  let skip = null;
+  if (st.isFile()) { try { skip = JSON.parse(fs.readFileSync(SKIP_PATH, 'utf8')); } catch { /* unreadable */ } }
+  const at = skip ? Date.parse(skip.at) : NaN;
+  let rvfMtime = 0; try { rvfMtime = fs.lstatSync(RVF_PATH).mtimeMs; } catch { /* absent */ }
+  if (!Number.isFinite(at) || Date.now() >= at + TOO_LARGE_RETRY_HOURS * 3600000 || rvfMtime > at) {
+    try { fs.unlinkSync(SKIP_PATH); } catch { /* best-effort */ }
+    return null;
+  }
+  return skip;
+}
+
+function writeSkip(reason) {
+  const at = new Date();
+  const skip = { reason, at: at.toISOString(), retryAfter: new Date(at.getTime() + TOO_LARGE_RETRY_HOURS * 3600000).toISOString() };
+  // 'wx' after unlink: never write through a planted symlink (#970).
+  try { try { fs.unlinkSync(SKIP_PATH); } catch { /* absent */ } fs.writeFileSync(SKIP_PATH, JSON.stringify(skip) + '\\n', { flag: 'wx' }); } catch { /* best-effort */ }
+  return skip;
+}
+
+// Export to a temp store next to aqe.rvf; rename it over aqe.rvf only on
+// success, so a failed, too-large or killed export keeps the last checkpoint.
+const RVF_SIDECARS = ['.idmap.json', '.manifest.json'];
+const TMP_PREFIX = path.basename(RVF_PATH) + '.tmp-';
+function removeEntry(p) { try { fs.unlinkSync(p); } catch (e) { if (!e || e.code !== 'ENOENT') throw e; } }
+function isPidAlive(pid) { try { process.kill(pid, 0); return true; } catch (e) { return !!e && e.code === 'EPERM'; } }
+function removeByPrefix(prefix, keep) {
+  let entries = []; try { entries = fs.readdirSync(AQE_DIR); } catch { return; }
+  for (const entry of entries) {
+    if (!entry.startsWith(prefix) || (keep && keep(entry))) continue;
+    try { removeEntry(path.join(AQE_DIR, entry)); } catch { /* best-effort */ }
+  }
+}
+function sweepStaleTmp() {
+  removeByPrefix(TMP_PREFIX, (entry) => {
+    const pid = Number.parseInt(entry.slice(TMP_PREFIX.length).split('-')[0], 10);
+    return !Number.isInteger(pid) || pid <= 0 || isPidAlive(pid);
+  });
+}
+function lexists(p) { try { fs.lstatSync(p); return true; } catch { return false; } }
+// rename() replaces a planted symlink without writing through it (#970). The
+// store goes first: if that fails nothing changed. If a sidecar rename fails
+// afterwards, the stale sidecar is removed, so the new store is never read
+// with the previous export's idmap.
+function promote(tmp) {
+  fs.renameSync(tmp, RVF_PATH);
+  for (const suffix of RVF_SIDECARS) {
+    try {
+      if (lexists(tmp + suffix)) fs.renameSync(tmp + suffix, RVF_PATH + suffix);
+      else removeEntry(RVF_PATH + suffix);
+    } catch { try { removeEntry(RVF_PATH + suffix); } catch { /* best-effort */ } }
+  }
+}
+
 function exportBrain() {
   if (!fs.existsSync(DB_PATH)) { log('No memory.db, skipping'); return { exported: false }; }
   const aqe = aqeInvocation();
   if (!aqe.cmd) { log('Export skipped: ' + aqe.reason); return { exported: false, reason: aqe.reason }; }
-  // Never write through a committed symlink: .agentic-qe must be a real dir, and
-  // unlink (not existsSync) drops a planted aqe.rvf link, even a dangling one.
+  // Never write through a committed symlink: .agentic-qe must be a real dir.
   let st; try { st = fs.lstatSync(AQE_DIR); } catch { /* missing */ }
   if (!st || !st.isDirectory()) { log('Export skipped: .agentic-qe is a symlink'); return { exported: false }; }
-  for (const f of [RVF_PATH, RVF_PATH + '.idmap.json']) { try { fs.unlinkSync(f); } catch { /* absent */ } }
+  const skip = activeSkip();
+  if (skip) {
+    log('Export skipped until ' + skip.retryAfter + ': ' + skip.reason);
+    return { exported: false, skipped: true, reason: skip.reason, retryAfter: skip.retryAfter };
+  }
+  sweepStaleTmp();
+  const tmp = path.join(AQE_DIR, TMP_PREFIX + process.pid + '-' + crypto.randomBytes(4).toString('hex'));
   try {
+    for (const suffix of ['', ...RVF_SIDECARS]) removeEntry(tmp + suffix);
     const result = execFileSync(
-      aqe.cmd, [...aqe.args, 'brain', 'export', '-o', RVF_PATH, '--format', 'rvf'],
-      { timeout: 60000, encoding: 'utf-8', windowsHide: true }
+      aqe.cmd, [...aqe.args, 'brain', 'export', '-o', tmp, '--format', 'rvf'],
+      { timeout: 60000, encoding: 'utf-8', windowsHide: true, stdio: ['ignore', 'pipe', 'pipe'] }
     );
+    // A zero exit without a store is a failure, not an empty checkpoint.
+    if (!lexists(tmp)) throw new Error('brain export exited 0 but wrote no store');
+    promote(tmp);
     const m = result.match(/Patterns:\\s+(\\d+)/);
     const p = m ? m[1] : '0';
     log('Exported ' + p + ' patterns to aqe.rvf');
     return { exported: true, patterns: parseInt(p) };
   } catch (e) {
-    log('Export failed: ' + e.message);
+    const tooLarge = (String(e.stderr || '') + String(e.stdout || '')).match(/RVF_KERNEL_TOO_LARGE:[^\\n]*/);
+    if (tooLarge) {
+      const skip = writeSkip(tooLarge[0].trim());
+      log('Export failed: ' + skip.reason);
+      log('Skipping the checkpoint export until ' + skip.retryAfter + ' (AQE_BRAIN_CHECKPOINT_RETRY_HOURS sets the wait).');
+      return { exported: false, tooLarge: true, reason: skip.reason, retryAfter: skip.retryAfter };
+    }
+    log('Export failed: ' + e.message + ' (previous aqe.rvf kept)');
     return { exported: false, reason: e.message };
+  } finally {
+    removeByPrefix(path.basename(tmp));
   }
 }
 
 function verifyBrain() {
   if (!fs.existsSync(RVF_PATH)) {
+    const skip = activeSkip();
+    if (skip) {
+      log('No aqe.rvf found; checkpoint export paused until ' + skip.retryAfter + ': ' + skip.reason);
+      return { valid: false, reason: 'missing', skippedUntil: skip.retryAfter };
+    }
     log('No aqe.rvf found');
     return { valid: false, reason: 'missing' };
   }

package/dist/init/phases/08-mcp.js

@@ -16,6 +16,7 @@ import { writeFileIfChanged } from '../idempotent-write.js';
 import { join } from 'path';
 import { safeJsonParse } from '../../shared/safe-json.js';
 import { aqePluginMcpSkipMessage, detectAqeFleetPlugin, } from '../claude-plugin-detection.js';
+import { removeUntrustedAqeMcpServers, scrubUntrustedAqeMcpFile } from '../settings-merge.js';
 import { BasePhase, } from './phase-interface.js';
 /**
  * MCP phase - configures MCP server
@@ -56,6 +57,7 @@ export class MCPPhase extends BasePhase {
             const plugin = this.detectPlugin(projectRoot);
             if (plugin.enabled) {
                 context.services.log(aqePluginMcpSkipMessage(projectRoot));
+                reportUntrustedMcpRemoval(context, scrubUntrustedAqeMcpFile(join(projectRoot, '.mcp.json')));
                 return {
                     configured: false,
                     mcpPath: '',
@@ -107,6 +109,7 @@ export class MCPPhase extends BasePhase {
             rootMcpConfig.mcpServers = {};
         }
         const rootServers = rootMcpConfig.mcpServers;
+        reportUntrustedMcpRemoval(context, removeUntrustedAqeMcpServers(rootServers));
         rootServers['agentic-qe'] = aqeServerConfig;
         // #778: no rewrite (mtime churn) when the merged config is unchanged.
         writeFileIfChanged(rootMcpPath, JSON.stringify(rootMcpConfig, null, 2));
@@ -128,5 +131,11 @@ export class MCPPhase extends BasePhase {
         };
     }
 }
+/** GHSA-chjc-8q37-52fg: say which stale server entries init removed. */
+function reportUntrustedMcpRemoval(context, removed) {
+    if (removed.length > 0) {
+        context.services.log(`  MCP: removed server entry launching @anthropics/agentic-qe: ${removed.join(', ')}`);
+    }
+}
 // Instance exported from index.ts
 //# sourceMappingURL=08-mcp.js.map

package/dist/init/settings-merge.d.ts

@@ -59,12 +59,25 @@ export declare function generateAqeEnvVars(config: AQEInitConfig, options?: {
  * "Agentic QE v3" banner). Anything else is treated as user-owned and preserved.
  */
 export declare function isAqeStatusLine(statusLine: unknown): boolean;
+/** Drop allow-list entries that pre-approve the untrusted package. */
+export declare function removeUntrustedAqePermissions(allow: string[]): string[];
+/**
+ * Remove MCP servers that launch the untrusted package.
+ * Mutates `servers` and returns the removed server names.
+ */
+export declare function removeUntrustedAqeMcpServers(servers: Record<string, unknown>): string[];
+/**
+ * Remove untrusted-package servers from an existing `.mcp.json`, leaving the
+ * rest of the file alone. Used where init does not write its own entry.
+ */
+export declare function scrubUntrustedAqeMcpFile(mcpPath: string): string[];
 /**
  * Apply the generated v3 settings sections onto an existing settings object
  * WITHOUT clobbering configuration the user already set:
  *
  * - `_aqePermissions`: union-merge into `permissions.allow`, preserving the
  *   user's existing allow/deny entries (#362).
+ *   Entries naming the untrusted package are dropped (GHSA-chjc-8q37-52fg).
  * - `statusLine`: generic Claude Code setting — only written when absent or when
  *   the existing one is AQE's own (so a user's custom status line is preserved).
  * - `includeCoAuthoredBy`: generic Claude Code setting — only written when the

package/dist/init/settings-merge.js

@@ -186,12 +186,60 @@ function deepMergeOwned(target, source) {
 function isPlainObject(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
+/**
+ * A package name earlier AQE versions wrote into `permissions.allow` and
+ * `.mcp.json` (GHSA-chjc-8q37-52fg). AQE does not publish or control it, so
+ * init removes any entry naming it instead of leaving a standing grant.
+ */
+const UNTRUSTED_AQE_PACKAGE = /@anthropics\/agentic-qe\b/i;
+/** Drop allow-list entries that pre-approve the untrusted package. */
+export function removeUntrustedAqePermissions(allow) {
+    return allow.filter((entry) => typeof entry !== 'string' || !UNTRUSTED_AQE_PACKAGE.test(entry));
+}
+/**
+ * Remove MCP servers that launch the untrusted package.
+ * Mutates `servers` and returns the removed server names.
+ */
+export function removeUntrustedAqeMcpServers(servers) {
+    const removed = [];
+    for (const [name, server] of Object.entries(servers)) {
+        const { command, args } = (isPlainObject(server) ? server : {});
+        const parts = [command, ...(Array.isArray(args) ? args : [])];
+        if (parts.some((part) => typeof part === 'string' && UNTRUSTED_AQE_PACKAGE.test(part))) {
+            delete servers[name];
+            removed.push(name);
+        }
+    }
+    return removed;
+}
+/**
+ * Remove untrusted-package servers from an existing `.mcp.json`, leaving the
+ * rest of the file alone. Used where init does not write its own entry.
+ */
+export function scrubUntrustedAqeMcpFile(mcpPath) {
+    if (!existsSync(mcpPath))
+        return [];
+    let config;
+    try {
+        config = JSON.parse(readFileSync(mcpPath, 'utf-8'));
+    }
+    catch {
+        return [];
+    }
+    if (!isPlainObject(config) || !isPlainObject(config.mcpServers))
+        return [];
+    const removed = removeUntrustedAqeMcpServers(config.mcpServers);
+    if (removed.length > 0)
+        writeFileSync(mcpPath, JSON.stringify(config, null, 2), 'utf-8');
+    return removed;
+}
 /**
  * Apply the generated v3 settings sections onto an existing settings object
  * WITHOUT clobbering configuration the user already set:
  *
  * - `_aqePermissions`: union-merge into `permissions.allow`, preserving the
  *   user's existing allow/deny entries (#362).
+ *   Entries naming the untrusted package are dropped (GHSA-chjc-8q37-52fg).
  * - `statusLine`: generic Claude Code setting — only written when absent or when
  *   the existing one is AQE's own (so a user's custom status line is preserved).
  * - `includeCoAuthoredBy`: generic Claude Code setting — only written when the
@@ -205,7 +253,7 @@ export function applyV3Sections(settings, sections, options = {}) {
     for (const [key, value] of Object.entries(sections)) {
         if (key === '_aqePermissions') {
             const existingPerms = settings.permissions || {};
-            const existingAllow = existingPerms.allow || [];
+            const existingAllow = removeUntrustedAqePermissions(existingPerms.allow || []);
             const merged = [...new Set([...existingAllow, ...value])];
             settings.permissions = { ...existingPerms, allow: merged };
         }
@@ -261,7 +309,6 @@ export function generateV3SettingsSections(config, projectRoot, options = {}) {
         // permissions are union-merged in 07-hooks.ts — not set here to avoid overwriting user entries (#362)
         _aqePermissions: [
             'Bash(npx agentic-qe:*)',
-            'Bash(npx @anthropics/agentic-qe:*)',
             'mcp__agentic-qe__*',
         ],
         includeCoAuthoredBy: true,