agentic-qe 3.15.6 → 3.15.7

package/dist/cli/chunks/{windsurf-installer-FQ5DBFCG.js → windsurf-installer-2LWSKMBU.js}

@@ -1,5 +1,5 @@
-import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.6");process.exit(0)}
-import{b as u}from"./chunk-7TJZDRDU.js";import{a as f,e as d}from"./chunk-KYVIOC3C.js";import"./chunk-7SAMMQVS.js";d();import{existsSync as i,mkdirSync as h,readFileSync as g,writeFileSync as a}from"fs";import{join as p,dirname as v}from"path";var c=class{projectRoot;overwrite;options;generator;constructor(e){this.projectRoot=e.projectRoot,this.overwrite=e.overwrite??!1,this.options=e,this.generator=u()}async install(){let e={success:!0,mcpConfigured:!1,rulesInstalled:!1,errors:[],configPath:"",rulesPath:""};try{let t=this.generator.generateMcpConfig("windsurf",{memoryBackend:this.options.memoryBackend}),r=p(this.projectRoot,t.path);if(e.configPath=r,!i(r)||this.overwrite){let o=v(r);if(i(o)||h(o,{recursive:!0}),i(r)&&this.overwrite){let m=this.mergeExistingConfig(r,t.content);a(r,m)}else a(r,t.content);e.mcpConfigured=!0}let s=this.generator.generateBehavioralRules("windsurf"),n=p(this.projectRoot,s.path);if(e.rulesPath=n,!i(n)||this.overwrite){if(i(n)&&this.overwrite){let o=this.mergeExistingRules(n,s.content);a(n,o)}else a(n,s.content);e.rulesInstalled=!0}}catch(t){e.success=!1,e.errors.push(`Windsurf installation failed: ${f(t)}`)}return e}mergeExistingConfig(e,t){try{let r=JSON.parse(g(e,"utf-8")),s=JSON.parse(t);return r.mcpServers||(r.mcpServers={}),Object.assign(r.mcpServers,s.mcpServers),JSON.stringify(r,null,2)+`
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.7");process.exit(0)}
+import{b as u}from"./chunk-VCA6YYII.js";import{a as f,e as d}from"./chunk-LVEX4GID.js";import"./chunk-HSDOOFV7.js";d();import{existsSync as i,mkdirSync as h,readFileSync as g,writeFileSync as a}from"fs";import{join as p,dirname as v}from"path";var c=class{projectRoot;overwrite;options;generator;constructor(e){this.projectRoot=e.projectRoot,this.overwrite=e.overwrite??!1,this.options=e,this.generator=u()}async install(){let e={success:!0,mcpConfigured:!1,rulesInstalled:!1,errors:[],configPath:"",rulesPath:""};try{let t=this.generator.generateMcpConfig("windsurf",{memoryBackend:this.options.memoryBackend}),r=p(this.projectRoot,t.path);if(e.configPath=r,!i(r)||this.overwrite){let o=v(r);if(i(o)||h(o,{recursive:!0}),i(r)&&this.overwrite){let m=this.mergeExistingConfig(r,t.content);a(r,m)}else a(r,t.content);e.mcpConfigured=!0}let s=this.generator.generateBehavioralRules("windsurf"),n=p(this.projectRoot,s.path);if(e.rulesPath=n,!i(n)||this.overwrite){if(i(n)&&this.overwrite){let o=this.mergeExistingRules(n,s.content);a(n,o)}else a(n,s.content);e.rulesInstalled=!0}}catch(t){e.success=!1,e.errors.push(`Windsurf installation failed: ${f(t)}`)}return e}mergeExistingConfig(e,t){try{let r=JSON.parse(g(e,"utf-8")),s=JSON.parse(t);return r.mcpServers||(r.mcpServers={}),Object.assign(r.mcpServers,s.mcpServers),JSON.stringify(r,null,2)+`
 `}catch{return t}}mergeExistingRules(e,t){try{let r=g(e,"utf-8");return r.includes("Agentic QE")||r.includes("fleet_init")?r:r.trimEnd()+`
 
 ---

package/dist/cli/chunks/witness-chain-52PEIEGK.js

@@ -0,0 +1,2 @@
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.7");process.exit(0)}
+import{a as h,b as i,c as j,d as k}from"./chunk-XEWXYGJI.js";import"./chunk-634D2ENF.js";import{a,b,c,d,e,f,g}from"./chunk-J43DV3ME.js";import"./chunk-ZLVQSEZK.js";import"./chunk-LMEU64TR.js";import"./chunk-4G2VNW4C.js";import"./chunk-7EX4DEQR.js";import"./chunk-QNQSM2OG.js";import"./chunk-F62EKVVC.js";import"./chunk-HTWIGQL4.js";import"./chunk-ONVALAZN.js";import"./chunk-ZTMZFF25.js";import"./chunk-Q2T5FXEA.js";import"./chunk-RNYX4CPI.js";import"./chunk-WXI2STKQ.js";import"./chunk-VJRZFWR5.js";import"./chunk-JYXOFN3E.js";import"./chunk-KPOPBUUJ.js";import"./chunk-LVEX4GID.js";import"./chunk-LGBN7TKC.js";import"./chunk-5Q22XPTH.js";import"./chunk-ZUMDDMDE.js";import"./chunk-IARSGAG7.js";import"./chunk-JVYPXW6Y.js";import"./chunk-HSDOOFV7.js";export{g as CHAIN_REANCHOR_ACTION,a as GENESIS_PREV_HASH,h as WitnessChain,k as _resetWitnessChainForTests,j as createWitnessChain,i as getWitnessChain,d as hashWith,e as serializeEntry,b as sha256,c as shake256,f as signaturePayload};

package/dist/cli/chunks/{witness-chain-I7TN4MXZ.js → witness-chain-JJMSJFZP.js}

@@ -1,2 +1,2 @@
-import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.6");process.exit(0)}
-import{a,b,c,d,e,f,g}from"./chunk-6R3FBFCJ.js";import"./chunk-45MVRQG4.js";import"./chunk-IEPWO4XP.js";import"./chunk-D5N2O5EH.js";import"./chunk-A7ANPS4E.js";import"./chunk-7SAMMQVS.js";export{c as PersistentWitnessChain,a as SPRTAccumulator,b as WitnessChain,f as createPersistentWitnessChain,e as createWitnessChain,d as createWitnessChainSQLitePersistence,g as isWitnessChainFeatureEnabled};
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.7");process.exit(0)}
+import{a,b,c,d,e,f,g}from"./chunk-6PKCQXEW.js";import"./chunk-VJRZFWR5.js";import"./chunk-JYXOFN3E.js";import"./chunk-KPOPBUUJ.js";import"./chunk-LGBN7TKC.js";import"./chunk-HSDOOFV7.js";export{c as PersistentWitnessChain,a as SPRTAccumulator,b as WitnessChain,f as createPersistentWitnessChain,e as createWitnessChain,d as createWitnessChainSQLitePersistence,g as isWitnessChainFeatureEnabled};

package/dist/cli/chunks/{witness-chain-repair-D3NE3NQK.js → witness-chain-repair-OX7VFW6T.js}

@@ -1,2 +1,2 @@
-import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.6");process.exit(0)}
-import{a as E}from"./chunk-GFB6BZWU.js";import"./chunk-B7RHBKHL.js";import{b as R,c as b,e as A,h as y,k as C}from"./chunk-AUN4FG7V.js";import"./chunk-YNG7E26C.js";import"./chunk-X2DR27AY.js";import"./chunk-22OZIJAD.js";import"./chunk-DQNUPEY5.js";import"./chunk-LZWJ5BMP.js";import"./chunk-RUTO67PT.js";import"./chunk-K55EAWZ5.js";import"./chunk-5LST62QR.js";import"./chunk-XBFQJZWX.js";import"./chunk-F7A2UBZO.js";import"./chunk-5MT7DMD7.js";import"./chunk-HEGGV2PT.js";import"./chunk-45MVRQG4.js";import"./chunk-IEPWO4XP.js";import"./chunk-D5N2O5EH.js";import"./chunk-KYVIOC3C.js";import"./chunk-A7ANPS4E.js";import"./chunk-TVLOED6O.js";import"./chunk-5VZVMO7B.js";import{a as g,b as _}from"./chunk-AJT3XDRD.js";import"./chunk-FOJRPEIP.js";import"./chunk-7SAMMQVS.js";_();import{existsSync as v}from"node:fs";import{basename as I}from"node:path";var w={includeArchive:!0};function l(e){let r=n=>C(e,n)?e.prepare(`SELECT COUNT(*) AS n FROM ${n}`).get().n:0;return{live:r("witness_chain"),archive:r("witness_chain_archive")}}function O(e){return{status:e.status,entriesChecked:e.entriesChecked,forks:e.forks.length,unacknowledgedForks:e.forks.length-e.acknowledgedForks.length,...e.tamperedAt!==void 0?{tamperedAt:e.tamperedAt}:{},...e.tamperReason?{tamperReason:e.tamperReason}:{}}}function $(e){return e.forkDetails.filter(r=>!r.acknowledged).map(({id:r,parentId:n,prevHash:s,actionHash:c})=>({id:r,parentId:n,prevHash:s,actionHash:c}))}function x(e,r){let n=new Set,s=e.prepare("SELECT prev_hash FROM witness_chain UNION ALL SELECT prev_hash FROM witness_chain_archive").pluck().iterate();for(let t of s)n.add(t);let c=[],a=new Set;for(let t of["witness_chain","witness_chain_archive"]){let f=e.prepare(`SELECT * FROM ${t} ORDER BY id ASC`).iterate();for(let o of f){if(o.id===r||a.has(o.id))continue;a.add(o.id);let i=A(o);!n.has(b(i))&&!n.has(R(i))&&c.push({id:o.id,hash:y(o)})}}return c.sort((t,f)=>t.id-f.id)}function S(e){return`Refusing to repair: tampering detected at id=${e.tamperedAt} (${e.tamperReason}). Only accidental forks can be re-anchored; restore from a backup and investigate.`}function M(e){let r=`${e}.bak-${Math.floor(Date.now()/1e3)}`;if(!v(r))return r;let n=1;for(;v(`${r}-${n}`);)n++;return`${r}-${n}`}function W(e,r){let n=M(e),s=g(e,{readonly:!0,fileMustExist:!0});try{s.prepare("VACUUM INTO ?").run(n)}finally{s.close()}let c=g(n,{readonly:!0,fileMustExist:!0});try{let a=c.pragma("integrity_check",{simple:!0});if(a!=="ok")throw new Error(`backup integrity_check failed: ${String(a)}`);let t=l(c);if(t.live!==r.live||t.archive!==r.archive)throw new Error(`backup holds ${JSON.stringify(t)} witness rows, expected ${JSON.stringify(r)}`)}finally{c.close()}return n}async function L(e,r){let n=r.dryRun===!0,s=new E(e,r.keyManager??void 0);await s.initialize();let c=l(e),a=s.verify(w),t={dryRun:n,before:O(a),rowsBefore:c,rowsAfter:c};if(a.tampered)return{...t,action:"refused",message:S(a),forksAcknowledged:[]};let f=$(a);if(f.length===0){let d=a.forks.length>0?`Nothing to repair: all ${a.forks.length} fork(s) are already re-anchored.`:"Nothing to repair: the audit chain has no forks.";return{...t,action:"none",message:d,forksAcknowledged:[]}}if(n)return{...t,action:"would-reanchor",forksAcknowledged:f.map(d=>d.id),message:`Dry run: would back up the database and append a CHAIN_REANCHOR entry acknowledging ${f.length} fork(s). Nothing was written.`};let o,i=e.transaction(()=>{let d=l(e),p=s.verify(w);if(p.tampered)return{kind:"refused",check:p};let h=$(p);if(h.length===0)return{kind:"noop"};o=W(r.dbPath,d);let m=e.prepare("SELECT * FROM witness_chain ORDER BY id DESC LIMIT 1").get(),T=s.append("CHAIN_REANCHOR",{reason:"fork-repair",issue:"https://github.com/proffesor-for-testing/agentic-qe/issues/753",note:"Acknowledges accidental forks from pre-3.14.5 concurrent appends; no rows were changed.",forkCount:h.length,forks:h,pins:x(e,m.id),verifiedTipId:m.id,verifiedTipHash:y(m),entriesChecked:p.entriesChecked,rows:d,backup:I(o)},r.actor??"aqe-audit-repair"),k=l(e);if(k.live!==d.live+1||k.archive!==d.archive)throw new Error(`row-count check failed: before ${JSON.stringify(d)}, after ${JSON.stringify(k)}`);return{kind:"reanchored",entry:T,forks:h,txAfter:k}}).immediate();if(i.kind==="refused")return{...t,action:"refused",message:S(i.check),forksAcknowledged:[]};if(i.kind==="noop")return{...t,action:"none",message:"Nothing to repair (another process re-anchored first).",forksAcknowledged:[]};let u=s.verify(w),N=u.valid&&!u.tampered;return{...t,action:"reanchored",after:O(u),rowsAfter:i.txAfter,forksAcknowledged:i.forks.map(d=>d.id),reanchorId:i.entry.id,backupPath:o,message:N?`Re-anchored ${i.forks.length} fork(s) with CHAIN_REANCHOR id=${i.entry.id}; chain now ${u.status}. Backup: ${o}`:`Appended CHAIN_REANCHOR id=${i.entry.id}, but the chain still verifies as ${u.status}. Backup: ${o}`}}export{L as repairWitnessChainForks};
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.7");process.exit(0)}
+import{a as E}from"./chunk-XEWXYGJI.js";import"./chunk-634D2ENF.js";import{b as R,c as b,e as A,h as y,k as C}from"./chunk-J43DV3ME.js";import"./chunk-ZLVQSEZK.js";import"./chunk-LMEU64TR.js";import"./chunk-4G2VNW4C.js";import"./chunk-7EX4DEQR.js";import"./chunk-QNQSM2OG.js";import"./chunk-F62EKVVC.js";import"./chunk-HTWIGQL4.js";import"./chunk-ONVALAZN.js";import"./chunk-ZTMZFF25.js";import"./chunk-Q2T5FXEA.js";import"./chunk-RNYX4CPI.js";import"./chunk-WXI2STKQ.js";import"./chunk-VJRZFWR5.js";import"./chunk-JYXOFN3E.js";import"./chunk-KPOPBUUJ.js";import"./chunk-LVEX4GID.js";import"./chunk-LGBN7TKC.js";import"./chunk-5Q22XPTH.js";import"./chunk-ZUMDDMDE.js";import{a as g,b as _}from"./chunk-IARSGAG7.js";import"./chunk-JVYPXW6Y.js";import"./chunk-HSDOOFV7.js";_();import{existsSync as v}from"node:fs";import{basename as I}from"node:path";var w={includeArchive:!0};function l(e){let r=n=>C(e,n)?e.prepare(`SELECT COUNT(*) AS n FROM ${n}`).get().n:0;return{live:r("witness_chain"),archive:r("witness_chain_archive")}}function O(e){return{status:e.status,entriesChecked:e.entriesChecked,forks:e.forks.length,unacknowledgedForks:e.forks.length-e.acknowledgedForks.length,...e.tamperedAt!==void 0?{tamperedAt:e.tamperedAt}:{},...e.tamperReason?{tamperReason:e.tamperReason}:{}}}function $(e){return e.forkDetails.filter(r=>!r.acknowledged).map(({id:r,parentId:n,prevHash:s,actionHash:c})=>({id:r,parentId:n,prevHash:s,actionHash:c}))}function x(e,r){let n=new Set,s=e.prepare("SELECT prev_hash FROM witness_chain UNION ALL SELECT prev_hash FROM witness_chain_archive").pluck().iterate();for(let t of s)n.add(t);let c=[],a=new Set;for(let t of["witness_chain","witness_chain_archive"]){let f=e.prepare(`SELECT * FROM ${t} ORDER BY id ASC`).iterate();for(let o of f){if(o.id===r||a.has(o.id))continue;a.add(o.id);let i=A(o);!n.has(b(i))&&!n.has(R(i))&&c.push({id:o.id,hash:y(o)})}}return c.sort((t,f)=>t.id-f.id)}function S(e){return`Refusing to repair: tampering detected at id=${e.tamperedAt} (${e.tamperReason}). Only accidental forks can be re-anchored; restore from a backup and investigate.`}function M(e){let r=`${e}.bak-${Math.floor(Date.now()/1e3)}`;if(!v(r))return r;let n=1;for(;v(`${r}-${n}`);)n++;return`${r}-${n}`}function W(e,r){let n=M(e),s=g(e,{readonly:!0,fileMustExist:!0});try{s.prepare("VACUUM INTO ?").run(n)}finally{s.close()}let c=g(n,{readonly:!0,fileMustExist:!0});try{let a=c.pragma("integrity_check",{simple:!0});if(a!=="ok")throw new Error(`backup integrity_check failed: ${String(a)}`);let t=l(c);if(t.live!==r.live||t.archive!==r.archive)throw new Error(`backup holds ${JSON.stringify(t)} witness rows, expected ${JSON.stringify(r)}`)}finally{c.close()}return n}async function L(e,r){let n=r.dryRun===!0,s=new E(e,r.keyManager??void 0);await s.initialize();let c=l(e),a=s.verify(w),t={dryRun:n,before:O(a),rowsBefore:c,rowsAfter:c};if(a.tampered)return{...t,action:"refused",message:S(a),forksAcknowledged:[]};let f=$(a);if(f.length===0){let d=a.forks.length>0?`Nothing to repair: all ${a.forks.length} fork(s) are already re-anchored.`:"Nothing to repair: the audit chain has no forks.";return{...t,action:"none",message:d,forksAcknowledged:[]}}if(n)return{...t,action:"would-reanchor",forksAcknowledged:f.map(d=>d.id),message:`Dry run: would back up the database and append a CHAIN_REANCHOR entry acknowledging ${f.length} fork(s). Nothing was written.`};let o,i=e.transaction(()=>{let d=l(e),p=s.verify(w);if(p.tampered)return{kind:"refused",check:p};let h=$(p);if(h.length===0)return{kind:"noop"};o=W(r.dbPath,d);let m=e.prepare("SELECT * FROM witness_chain ORDER BY id DESC LIMIT 1").get(),T=s.append("CHAIN_REANCHOR",{reason:"fork-repair",issue:"https://github.com/proffesor-for-testing/agentic-qe/issues/753",note:"Acknowledges accidental forks from pre-3.14.5 concurrent appends; no rows were changed.",forkCount:h.length,forks:h,pins:x(e,m.id),verifiedTipId:m.id,verifiedTipHash:y(m),entriesChecked:p.entriesChecked,rows:d,backup:I(o)},r.actor??"aqe-audit-repair"),k=l(e);if(k.live!==d.live+1||k.archive!==d.archive)throw new Error(`row-count check failed: before ${JSON.stringify(d)}, after ${JSON.stringify(k)}`);return{kind:"reanchored",entry:T,forks:h,txAfter:k}}).immediate();if(i.kind==="refused")return{...t,action:"refused",message:S(i.check),forksAcknowledged:[]};if(i.kind==="noop")return{...t,action:"none",message:"Nothing to repair (another process re-anchored first).",forksAcknowledged:[]};let u=s.verify(w),N=u.valid&&!u.tampered;return{...t,action:"reanchored",after:O(u),rowsAfter:i.txAfter,forksAcknowledged:i.forks.map(d=>d.id),reanchorId:i.entry.id,backupPath:o,message:N?`Re-anchored ${i.forks.length} fork(s) with CHAIN_REANCHOR id=${i.entry.id}; chain now ${u.status}. Backup: ${o}`:`Appended CHAIN_REANCHOR id=${i.entry.id}, but the chain still verifies as ${u.status}. Backup: ${o}`}}export{L as repairWitnessChainForks};

package/dist/cli/chunks/{witness-chain-verifier-RU2WOP5M.js → witness-chain-verifier-QLSMXHAZ.js}

@@ -1,2 +1,2 @@
-import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.6");process.exit(0)}
-import{g as a,h as b,i as c,j as d,k as e}from"./chunk-AUN4FG7V.js";import"./chunk-7SAMMQVS.js";export{a as CHAIN_REANCHOR_ACTION,c as WitnessChainVerifier,b as ownHash,e as tableExists,d as verifyWitnessChain};
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.7");process.exit(0)}
+import{g as a,h as b,i as c,j as d,k as e}from"./chunk-J43DV3ME.js";import"./chunk-HSDOOFV7.js";export{a as CHAIN_REANCHOR_ACTION,c as WitnessChainVerifier,b as ownHash,e as tableExists,d as verifyWitnessChain};

package/dist/cli/chunks/{witness-key-manager-IHQB2FR5.js → witness-key-manager-3DS4L7LE.js}

@@ -1,2 +1,2 @@
-import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.6");process.exit(0)}
-import{a,b,c}from"./chunk-B7RHBKHL.js";import"./chunk-TVLOED6O.js";import"./chunk-5VZVMO7B.js";import"./chunk-7SAMMQVS.js";export{a as WitnessKeyManager,c as _resetDefaultWitnessKeyManagerForTests,b as getDefaultWitnessKeyManager};
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.7");process.exit(0)}
+import{a,b,c}from"./chunk-634D2ENF.js";import"./chunk-5Q22XPTH.js";import"./chunk-ZUMDDMDE.js";import"./chunk-HSDOOFV7.js";export{a as WitnessKeyManager,c as _resetDefaultWitnessKeyManagerForTests,b as getDefaultWitnessKeyManager};

package/dist/cli/chunks/{workflow-6BWTNVV6.js → workflow-ARWAMHD3.js}

@@ -1,5 +1,5 @@
-import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.6");process.exit(0)}
-import"./chunk-ELI4GDQO.js";import{b as $}from"./chunk-RD5BYLN7.js";import{a as k,b as W,c as b,g as C}from"./chunk-KCB6P463.js";import"./chunk-RLB7K7QP.js";import{c as v}from"./chunk-22OZIJAD.js";import"./chunk-QLKUCMZC.js";import"./chunk-KYVIOC3C.js";import"./chunk-7SAMMQVS.js";import{Command as D}from"commander";import o from"chalk";function O(f,i){let h=f.indexOf("=");return h>0&&(i[f.substring(0,h)]=f.substring(h+1)),i}function V(f,i,h){let m=new D("workflow").description("Manage QE workflows and pipelines (ADR-041)");return m.command("run <file>").description("Execute a QE pipeline from YAML file").option("-w, --watch","Watch execution progress").option("-v, --verbose","Show detailed output").option("--params <json>","Additional parameters as JSON","{}").action(async(n,t)=>{if(!await h())return;let c=(await import("path")).resolve(n);try{console.log(o.blue(`
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.7");process.exit(0)}
+import{b as $}from"./chunk-BTYKGVJ5.js";import"./chunk-UY3REQOK.js";import{a as k,b as W,c as b,g as C}from"./chunk-7UCVYYWL.js";import"./chunk-AAA4SHEG.js";import{c as v}from"./chunk-4G2VNW4C.js";import"./chunk-CG5DZCOZ.js";import"./chunk-LVEX4GID.js";import"./chunk-HSDOOFV7.js";import{Command as D}from"commander";import o from"chalk";function O(f,i){let h=f.indexOf("=");return h>0&&(i[f.substring(0,h)]=f.substring(h+1)),i}function V(f,i,h){let m=new D("workflow").description("Manage QE workflows and pipelines (ADR-041)");return m.command("run <file>").description("Execute a QE pipeline from YAML file").option("-w, --watch","Watch execution progress").option("-v, --verbose","Show detailed output").option("--params <json>","Additional parameters as JSON","{}").action(async(n,t)=>{if(!await h())return;let c=(await import("path")).resolve(n);try{console.log(o.blue(`
  Running workflow from: ${n}
 `));let l=k(c);if(!l.success||!l.workflow){console.log(o.red("Failed to parse pipeline:"));for(let d of l.errors)console.log(o.red(`   ${d}`));await i(1)}let u={...v(t.params,"params")};if(l.pipeline){for(let d of l.pipeline.stages)if(d.params)for(let[y,p]of Object.entries(d.params))u[y]=p}if(!f.workflowOrchestrator.getWorkflow(l.workflow.id)){let d=f.workflowOrchestrator.registerWorkflow(l.workflow);d.success||(console.log(o.red(`Failed to register workflow: ${d.error.message}`)),await i(1))}let g=await f.workflowOrchestrator.executeWorkflow(l.workflow.id,u);if(!g.success){console.log(o.red(`Failed to start workflow: ${g.error.message}`)),await i(1);return}let a=g.value;if(console.log(o.cyan(`  Execution ID: ${a}`)),console.log(o.gray(`  Workflow: ${l.workflow.name}`)),console.log(o.gray(`  Stages: ${l.workflow.steps.length}`)),console.log(""),t.watch){console.log(o.blue(`Workflow Progress:
 `));let d,y=Date.now();for(;;){let w=f.workflowOrchestrator.getWorkflowStatus(a);if(!w)break;if(!d||d.progress!==w.progress||d.status!==w.status||JSON.stringify(d.currentSteps)!==JSON.stringify(w.currentSteps)){process.stdout.write("\r\x1B[K");let S="\u2588".repeat(Math.floor(w.progress/5))+"\u2591".repeat(20-Math.floor(w.progress/5)),R=w.status==="completed"?o.green:w.status==="failed"?o.red:w.status==="running"?o.yellow:o.gray;console.log(`  [${S}] ${w.progress}% - ${R(w.status)}`),w.currentSteps.length>0&&t.verbose&&console.log(o.gray(`    Running: ${w.currentSteps.join(", ")}`)),d=w}if(w.status==="completed"||w.status==="failed"||w.status==="cancelled")break;await new Promise(S=>setTimeout(S,500))}let p=f.workflowOrchestrator.getWorkflowStatus(a);if(p){console.log("");let w=p.duration||Date.now()-y;p.status==="completed"?(console.log(o.green("Workflow completed successfully")),console.log(o.gray(`   Duration: ${$(w)}`)),console.log(o.gray(`   Completed: ${p.completedSteps.length} stages`)),p.skippedSteps.length>0&&console.log(o.yellow(`   Skipped: ${p.skippedSteps.length} stages`))):p.status==="failed"?(console.log(o.red("Workflow failed")),console.log(o.red(`   Error: ${p.error}`)),console.log(o.gray(`   Failed stages: ${p.failedSteps.join(", ")}`))):console.log(o.yellow(`Workflow ${p.status}`))}console.log(""),await i(p?.status==="completed"?0:1);return}else console.log(o.green("Workflow execution started")),console.log(o.gray(`   Use 'aqe workflow status ${a}' to check progress`));console.log(""),await i(0)}catch(l){console.error(o.red(`
@@ -35,10 +35,10 @@ Workflow cancelled: ${n}
 `)):console.log(o.red(`
 Failed to cancel workflow: ${t.error.message}
 `)),await i(t.success?0:1)}catch(t){console.error(o.red(`
-Failed to cancel workflow:`),t),await i(1)}}),m.command("browser-list").description("List available browser workflow templates").action(async()=>{try{let{BrowserWorkflowTool:n}=await import("./browser-workflow-WXXPBSCM.js"),e=await new n().invoke({});if(e.success&&e.data){console.log(o.blue(`
+Failed to cancel workflow:`),t),await i(1)}}),m.command("browser-list").description("List available browser workflow templates").action(async()=>{try{let{BrowserWorkflowTool:n}=await import("./browser-workflow-ITPX72RX.js"),e=await new n().invoke({});if(e.success&&e.data){console.log(o.blue(`
  Browser Workflow Templates:
 `));for(let c of e.data.availableTemplates)console.log(`  ${o.cyan(c)}`);console.log("")}else console.log(o.red(`Failed: ${e.error||"Unknown error"}`));await i(0)}catch(n){console.error(o.red(`
-Failed:`),n),await i(1)}}),m.command("browser-load [template]").description("Load and validate a browser workflow template or inline YAML").option("--yaml <yaml>","Inline YAML workflow definition").option("-v, --var <key=value>","Variable override (repeatable)",O,{}).option("-F, --format <format>","Output format (text|json)","text").option("-o, --output <path>","Write output to file").action(async(n,t)=>{try{let{BrowserWorkflowTool:e}=await import("./browser-workflow-WXXPBSCM.js"),{writeOutput:c,toJSON:l}=await import("./ci-output-E45OGVPR.js"),s=new e,u={variables:t.var||{}};if(t.yaml)u.workflowYaml=t.yaml;else if(n)if(n.endsWith(".yaml")||n.endsWith(".yml")){let g=await import("fs"),d=(await import("path")).resolve(n);g.existsSync(d)||(console.log(o.red(`
+Failed:`),n),await i(1)}}),m.command("browser-load [template]").description("Load and validate a browser workflow template or inline YAML").option("--yaml <yaml>","Inline YAML workflow definition").option("-v, --var <key=value>","Variable override (repeatable)",O,{}).option("-F, --format <format>","Output format (text|json)","text").option("-o, --output <path>","Write output to file").action(async(n,t)=>{try{let{BrowserWorkflowTool:e}=await import("./browser-workflow-ITPX72RX.js"),{writeOutput:c,toJSON:l}=await import("./ci-output-BJQVXX5E.js"),s=new e,u={variables:t.var||{}};if(t.yaml)u.workflowYaml=t.yaml;else if(n)if(n.endsWith(".yaml")||n.endsWith(".yml")){let g=await import("fs"),d=(await import("path")).resolve(n);g.existsSync(d)||(console.log(o.red(`
 File not found: ${d}
 `)),await i(1)),u.workflowYaml=g.readFileSync(d,"utf-8")}else u.templateName=n;else console.log(o.red(`
 Provide a template name or --yaml. Use "workflow browser-list" to see templates.

package/dist/cli/chunks/workflow-orchestrator-DORMQMG7.js

@@ -0,0 +1,2 @@
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.7");process.exit(0)}
+import{a,b,d as c,e as d}from"./chunk-QWLTHFZW.js";import"./chunk-MHZPC4HJ.js";import"./chunk-ZLVQSEZK.js";import"./chunk-LMEU64TR.js";import"./chunk-4G2VNW4C.js";import"./chunk-7EX4DEQR.js";import"./chunk-QNQSM2OG.js";import"./chunk-F62EKVVC.js";import"./chunk-HTWIGQL4.js";import"./chunk-ONVALAZN.js";import"./chunk-ZTMZFF25.js";import"./chunk-Q2T5FXEA.js";import"./chunk-RNYX4CPI.js";import"./chunk-FTTFJ7SJ.js";import"./chunk-CG5DZCOZ.js";import"./chunk-WXI2STKQ.js";import"./chunk-VJRZFWR5.js";import"./chunk-JYXOFN3E.js";import"./chunk-KPOPBUUJ.js";import"./chunk-LVEX4GID.js";import"./chunk-LGBN7TKC.js";import"./chunk-5Q22XPTH.js";import"./chunk-ZUMDDMDE.js";import"./chunk-IARSGAG7.js";import"./chunk-JVYPXW6Y.js";import"./chunk-HSDOOFV7.js";export{b as DEFAULT_WORKFLOW_CONFIG,a as WorkflowEvents,c as WorkflowOrchestrator,d as createWorkflowOrchestrator};

package/dist/cli/chunks/{wrappers-URVP25VU.js → wrappers-J6KGTUSJ.js}

@@ -1,2 +1,2 @@
-import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.6");process.exit(0)}
-import{a,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v as L,w as M,x as N}from"./chunk-7VTKR44N.js";import{a as v,b as w,c as x,d as y,e as z,f as A,g as B,h as C,i as D,j as E,k as F,l as G,m as H,n as I,o as J,p as K}from"./chunk-ZL5LJT7D.js";import"./chunk-YNG7E26C.js";import"./chunk-X2DR27AY.js";import"./chunk-22OZIJAD.js";import"./chunk-DQNUPEY5.js";import"./chunk-LZWJ5BMP.js";import"./chunk-RUTO67PT.js";import"./chunk-K55EAWZ5.js";import"./chunk-5LST62QR.js";import"./chunk-XBFQJZWX.js";import"./chunk-F7A2UBZO.js";import"./chunk-5MT7DMD7.js";import"./chunk-HEGGV2PT.js";import"./chunk-45MVRQG4.js";import"./chunk-IEPWO4XP.js";import"./chunk-D5N2O5EH.js";import"./chunk-KYVIOC3C.js";import"./chunk-A7ANPS4E.js";import"./chunk-TVLOED6O.js";import"./chunk-5VZVMO7B.js";import"./chunk-AJT3XDRD.js";import"./chunk-FOJRPEIP.js";import"./chunk-7SAMMQVS.js";export{z as GNNLayerFactory,i as QEFlashAttention,x as QEGNNEmbeddingIndex,y as QEGNNIndexFactory,a as QESONA,e as QE_FLASH_ATTENTION_CONFIG,g as QE_PERFORMANCE_TARGETS,f as QE_SONA_CONFIG,A as TensorCompressionFactory,u as batchComputeAttention,K as batchDifferentiableSearch,M as checkRuvectorPackagesAvailable,c as createDomainQESONA,j as createQEFlashAttention,b as createQESONA,D as getDifferentiableSearch,F as getGetCompressionLevel,E as getHierarchicalForward,G as getInit,h as getOptimalBlockConfig,k as getQEFlashAttentionConfig,n as getRuvectorDotProductAttention,m as getRuvectorFlashAttention,p as getRuvectorHyperbolicAttention,B as getRuvectorLayer,q as getRuvectorLinearAttention,r as getRuvectorMoEAttention,o as getRuvectorMultiHeadAttention,L as getRuvectorPackageVersions,C as getTensorCompress,l as getWorkloadTypes,N as initAllRuvectorPackages,w as initGNN,d as isAttentionAvailable,v as isGNNAvailable,s as toFloat32Array,H as toFloat32ArrayGNN,J as toIEmbedding,t as toNumberArrayAttn,I as toNumberArrayGNN};
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.7");process.exit(0)}
+import{a,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v as L,w as M,x as N}from"./chunk-JPHDMHFG.js";import{a as v,b as w,c as x,d as y,e as z,f as A,g as B,h as C,i as D,j as E,k as F,l as G,m as H,n as I,o as J,p as K}from"./chunk-MKFQNCXI.js";import"./chunk-ZLVQSEZK.js";import"./chunk-LMEU64TR.js";import"./chunk-4G2VNW4C.js";import"./chunk-7EX4DEQR.js";import"./chunk-QNQSM2OG.js";import"./chunk-F62EKVVC.js";import"./chunk-HTWIGQL4.js";import"./chunk-ONVALAZN.js";import"./chunk-ZTMZFF25.js";import"./chunk-Q2T5FXEA.js";import"./chunk-RNYX4CPI.js";import"./chunk-WXI2STKQ.js";import"./chunk-VJRZFWR5.js";import"./chunk-JYXOFN3E.js";import"./chunk-KPOPBUUJ.js";import"./chunk-LVEX4GID.js";import"./chunk-LGBN7TKC.js";import"./chunk-5Q22XPTH.js";import"./chunk-ZUMDDMDE.js";import"./chunk-IARSGAG7.js";import"./chunk-JVYPXW6Y.js";import"./chunk-HSDOOFV7.js";export{z as GNNLayerFactory,i as QEFlashAttention,x as QEGNNEmbeddingIndex,y as QEGNNIndexFactory,a as QESONA,e as QE_FLASH_ATTENTION_CONFIG,g as QE_PERFORMANCE_TARGETS,f as QE_SONA_CONFIG,A as TensorCompressionFactory,u as batchComputeAttention,K as batchDifferentiableSearch,M as checkRuvectorPackagesAvailable,c as createDomainQESONA,j as createQEFlashAttention,b as createQESONA,D as getDifferentiableSearch,F as getGetCompressionLevel,E as getHierarchicalForward,G as getInit,h as getOptimalBlockConfig,k as getQEFlashAttentionConfig,n as getRuvectorDotProductAttention,m as getRuvectorFlashAttention,p as getRuvectorHyperbolicAttention,B as getRuvectorLayer,q as getRuvectorLinearAttention,r as getRuvectorMoEAttention,o as getRuvectorMultiHeadAttention,L as getRuvectorPackageVersions,C as getTensorCompress,l as getWorkloadTypes,N as initAllRuvectorPackages,w as initGNN,d as isAttentionAvailable,v as isGNNAvailable,s as toFloat32Array,H as toFloat32ArrayGNN,J as toIEmbedding,t as toNumberArrayAttn,I as toNumberArrayGNN};

package/dist/cli/commands/learning.js

@@ -12,6 +12,7 @@
 import { Command } from 'commander';
 import chalk from 'chalk';
 import path from 'node:path';
+import { randomUUID } from 'node:crypto';
 import { findProjectRoot } from '../../kernel/unified-memory.js';
 import { existsSync, writeFileSync, readFileSync, copyFileSync, renameSync } from 'node:fs';
 import { safeJsonParse } from '../../shared/safe-json.js';
@@ -737,8 +738,8 @@ function registerBackupCommand(learning) {
             const dbPath = getDbPath();
             if (!existsSync(dbPath))
                 throw new Error(`No learning database found at: ${dbPath}`);
-            const timestamp = new Date().toISOString().replace(/[:.]/g, '-').slice(0, 19);
-            const defaultOutput = path.join(process.cwd(), 'backups', `learning-${timestamp}.db`);
+            const timestamp = new Date().toISOString().replace(/[:.]/g, '-').slice(0, 23);
+            const defaultOutput = path.join(process.cwd(), 'backups', `learning-${timestamp}-${randomUUID()}.db`);
             const outputPath = options.output ? path.resolve(options.output) : defaultOutput;
             const snapshot = await backupLearningDatabase(dbPath, outputPath, options);
             const { backupPath: finalPath, sourceSizeKB, backupSizeKB: finalSizeKB, schemaVersion } = snapshot;

package/dist/cli/commands/security.d.ts

@@ -5,5 +5,21 @@
  */
 import { Command } from 'commander';
 import type { CLIContext } from '../handlers/interfaces.js';
+import { type SecurityScanResult } from '../utils/ci-output.js';
+/** Name of the CLI check for the OSV dependency advisory scan (#1049). */
+export declare const DEPENDENCY_CHECK = "Dependency advisories";
+/** #1049: dependency advisories could not be checked; the dependency result is UNMEASURED (same code as coverage/quality). */
+export declare const EXIT_DEPENDENCIES_UNMEASURED = 3;
+/**
+ * `aqe security` exit contract:
+ * 0 = every requested check completed, no medium+ findings
+ * 1 = high/critical findings, non-compliance, or a non-dependency check incomplete/failed
+ * 2 = medium findings only, every requested check complete
+ * 3 = dependency advisories could not be checked (failed or partial OSV lookup) and
+ *     there are no high/critical findings, non-compliance or other incomplete checks:
+ *     UNMEASURED, never a clean exit (#1049). Medium findings plus an incomplete
+ *     dependency scan also exit 3: the result is unmeasured, not a medium-only verdict.
+ */
+export declare function securityExitCode(result: SecurityScanResult): number;
 export declare function createSecurityCommand(context: CLIContext, cleanupAndExit: (code: number) => Promise<never>, ensureInitialized: () => Promise<boolean>): Command;
 //# sourceMappingURL=security.d.ts.map

package/dist/cli/commands/security.js

@@ -8,17 +8,57 @@ import chalk from 'chalk';
 import { discoverSecurityFiles } from '../../domains/security-compliance/scan-discovery.js';
 import { FilePath } from '../../shared/value-objects/index.js';
 import { writeOutput, toJSON, toSARIF, securityToMarkdown } from '../utils/ci-output.js';
+import { runDependencyAdvisoryScan } from '../../domains/security-compliance/dependency-advisory-engine.js';
+import { resolve as resolvePath } from 'node:path';
+/** Name of the CLI check for the OSV dependency advisory scan (#1049). */
+export const DEPENDENCY_CHECK = 'Dependency advisories';
+/** #1049: dependency advisories could not be checked; the dependency result is UNMEASURED (same code as coverage/quality). */
+export const EXIT_DEPENDENCIES_UNMEASURED = 3;
+/**
+ * `aqe security` exit contract:
+ * 0 = every requested check completed, no medium+ findings
+ * 1 = high/critical findings, non-compliance, or a non-dependency check incomplete/failed
+ * 2 = medium findings only, every requested check complete
+ * 3 = dependency advisories could not be checked (failed or partial OSV lookup) and
+ *     there are no high/critical findings, non-compliance or other incomplete checks:
+ *     UNMEASURED, never a clean exit (#1049). Medium findings plus an incomplete
+ *     dependency scan also exit 3: the result is unmeasured, not a medium-only verdict.
+ */
+export function securityExitCode(result) {
+    const checks = result.checks ?? [];
+    const highOrCritical = result.vulnerabilities.some(v => v.severity === 'high' || v.severity === 'critical');
+    const nonCompliant = result.compliance?.compliant === false;
+    if (result.status !== 'complete' || nonCompliant) {
+        const dependencyUnmeasured = checks.some(check => check.name === DEPENDENCY_CHECK && check.status !== 'complete');
+        const otherIncomplete = checks.some(check => check.name !== DEPENDENCY_CHECK && check.status !== 'complete');
+        if (dependencyUnmeasured && !otherIncomplete && !nonCompliant && !highOrCritical)
+            return EXIT_DEPENDENCIES_UNMEASURED;
+        return 1;
+    }
+    if (highOrCritical)
+        return 1;
+    if (result.vulnerabilities.some(v => v.severity === 'medium'))
+        return 2;
+    return 0;
+}
 export function createSecurityCommand(context, cleanupAndExit, ensureInitialized) {
     const securityCmd = new Command('security')
         .description('Security scanning and URL validation')
         .option('--sast', 'Run SAST scan')
         .option('--dast', 'Run DAST scan')
+        .option('--dependencies', 'Check package.json dependencies against OSV advisories (sends package names and versions to the OSV API)')
         .option('--compliance <frameworks>', 'Check compliance (gdpr,hipaa,soc2)', '')
         .option('--url-validate <url>', 'Validate a URL for security threats and PII exposure')
         .option('--no-pii', 'Disable PII scanning when using --url-validate')
         .option('-t, --target <path>', 'Target directory to scan', '.')
         .option('-F, --format <format>', 'Output format (text|json|sarif|markdown)', 'text')
         .option('-o, --output <path>', 'Write output to file')
+        .addHelpText('after', `
+Exit codes:
+  0  every requested check completed; no medium or higher findings
+  1  high/critical findings, non-compliance, or a check failed / is incomplete
+  2  medium findings only
+  ${EXIT_DEPENDENCIES_UNMEASURED}  UNMEASURED: dependency advisories could not be checked (OSV unreachable, rate limited, or partial)`)
         .action(async (options) => {
         if (!await ensureInitialized())
             return;
@@ -86,13 +126,13 @@ export function createSecurityCommand(context, cleanupAndExit, ensureInitialized
             return; // Don't fall through to SAST/DAST path
         }
         const format = options.format;
-        const runSAST = options.sast || (!options.dast && !options.compliance);
+        const runSAST = options.sast || (!options.dast && !options.compliance && !options.dependencies);
         const frameworks = options.compliance
             ? options.compliance.split(',').map((value) => value.trim()).filter(Boolean)
             : [];
         const scanResult = {
             vulnerabilities: [], target: options.target,
-            scanType: [runSAST && 'SAST', options.dast && 'DAST', frameworks.length > 0 && 'Compliance'].filter(Boolean).join('+'),
+            scanType: [runSAST && 'SAST', options.dast && 'DAST', options.dependencies && 'Dependencies', frameworks.length > 0 && 'Compliance'].filter(Boolean).join('+'),
             checks: [], status: 'not-run',
         };
         const checks = scanResult.checks;
@@ -133,6 +173,18 @@ export function createSecurityCommand(context, cleanupAndExit, ensureInitialized
                         checks.push({ name: 'Source discovery', status: discovery.status, reason: 'Requested source discovery did not complete; inspect discovery issues.' });
                     }
                 }
+                if (options.dependencies) {
+                    // #1049: a failed or partial OSV lookup is reported, never a clean dependency scan.
+                    const outcome = await runDependencyAdvisoryScan({ scanPackageJson: (manifest) => securityAPI.runDependencyScan(manifest) }, resolvePath(options.target));
+                    scanResult.dependencyScan = outcome.report;
+                    scanResult.vulnerabilities.push(...outcome.vulnerabilities.map(formatVulnerability));
+                    const status = outcome.report.status;
+                    checks.push({
+                        name: DEPENDENCY_CHECK,
+                        status: status === 'complete' ? 'complete' : status === 'incomplete' ? 'partial' : status === 'failed' ? 'failed' : 'not-run',
+                        ...(status !== 'complete' ? { reason: outcome.report.message } : {}),
+                    });
+                }
                 if (frameworks.length > 0) {
                     const issues = [];
                     let compliant = true;
@@ -189,13 +241,7 @@ export function createSecurityCommand(context, cleanupAndExit, ensureInitialized
             return cleanupAndExit(1);
         }
         // Incomplete execution never has a clean exit, even if it found no vulnerabilities.
-        if (scanResult.status !== 'complete' || scanResult.compliance?.compliant === false)
-            return cleanupAndExit(1);
-        if (scanResult.vulnerabilities.some(v => v.severity === 'high' || v.severity === 'critical'))
-            return cleanupAndExit(1);
-        if (scanResult.vulnerabilities.some(v => v.severity === 'medium'))
-            return cleanupAndExit(2);
-        return cleanupAndExit(0);
+        return cleanupAndExit(securityExitCode(scanResult));
     });
     return securityCmd;
 }
@@ -227,6 +273,7 @@ function formatVulnerability(value) {
             severity: value.severity, type: value.title || value.category,
             file: value.location.file, line: value.location.line ?? 1,
             message: value.description,
+            ...(value.cveId ? { cveId: value.cveId } : {}),
         };
     }
     return value;
@@ -265,6 +312,26 @@ function printSecurityResult(result) {
         ...(result.evidence?.files.filter(file => file.status !== 'analyzed' && file.status !== 'excluded').map(file => `${file.path}: ${file.status}${file.reason ? ` (${file.reason})` : ''}`) ?? []),
         ...(result.discovery?.issues.map(issue => `${issue.path}: ${issue.reason}`) ?? []),
     ];
+    if (result.dependencyScan && result.dependencyScan.status !== 'complete') {
+        const unchecked = result.dependencyScan.uncheckedPackages;
+        console.log(chalk.yellow(`  ${result.dependencyScan.message}`));
+        for (const pkg of unchecked.slice(0, 10)) {
+            const where = `${pkg.member ? `${pkg.member}: ` : ''}${pkg.name}@${pkg.version}${pkg.lockedVersion ? ` (lockfile ${pkg.lockedVersion})` : ''}`;
+            console.log(chalk.yellow(`    not checked: ${where} (${pkg.reason})`));
+        }
+        if (unchecked.length > 10)
+            console.log(chalk.yellow(`    ... and ${unchecked.length - 10} more unchecked package(s)`));
+    }
+    else if (result.dependencyScan) {
+        console.log(`  ${result.dependencyScan.message}`);
+    }
+    if (result.dependencyScan?.localPackages.length) {
+        const local = result.dependencyScan.localPackages;
+        console.log(`  Local packages (not OSV subjects, excluded): ${local.slice(0, 10).map(p => `${p.member ? `${p.member}: ` : ''}${p.name}`).join(', ')}${local.length > 10 ? ` ... and ${local.length - 10} more` : ''}`);
+    }
+    for (const problem of result.dependencyScan?.resolutionErrors ?? []) {
+        console.log(chalk.yellow(`    incomplete: ${problem}`));
+    }
     for (const limitation of limitations.slice(0, 10))
         console.log(chalk.yellow(`  ${limitation}`));
     if (limitations.length > 10)

package/dist/cli/handlers/init-guard.d.ts

@@ -8,6 +8,26 @@
  *
  * @module cli/handlers/init-guard
  */
-/** Error message when `cwd` must not be initialized, otherwise null. */
+/** The explicit root is also the destination for all init-generated files. */
+export declare function initProjectRoot(cwd?: string, env?: NodeJS.ProcessEnv): string;
+/**
+ * Error message when `projectRoot` must not be initialized, otherwise null.
+ *
+ * An explicit root (`AQE_PROJECT_ROOT`) is refused only when it is a hard-stop
+ * directory (OS temp dir, `/`, `/home`, ...), or a sticky world-writable
+ * directory WITHOUT `.git`. This mirrors `findProjectRoot`, which keeps a
+ * sticky (mode 1777) directory that is itself a repo root as its own root, so
+ * the explicit root stays the escape hatch for such a repository. A derived
+ * root (the cwd) keeps the stricter rule: any shared directory is refused.
+ */
+export declare function sharedRootInitError(projectRoot: string, explicit: boolean): string | null;
+/** Error message when the selected root must not be initialized, otherwise null. */
 export declare function sharedDirInitError(cwd: string, env?: NodeJS.ProcessEnv): string | null;
+/**
+ * Error message when an explicit `AQE_PROJECT_ROOT` is not an existing
+ * directory, otherwise null. A typo must not silently create and initialize a
+ * new project somewhere else. Must run before anything creates the root (the
+ * CLI's token bootstrap does `mkdir -p <root>/.agentic-qe` at startup).
+ */
+export declare function explicitRootError(cwd?: string, env?: NodeJS.ProcessEnv): string | null;
 //# sourceMappingURL=init-guard.d.ts.map

package/dist/cli/handlers/init-guard.js

@@ -8,16 +8,59 @@
  *
  * @module cli/handlers/init-guard
  */
-import { isSharedSystemDir } from '../../kernel/shared-dirs.js';
-/** Error message when `cwd` must not be initialized, otherwise null. */
-export function sharedDirInitError(cwd, env = process.env) {
-    if (env.AQE_PROJECT_ROOT)
-        return null;
-    if (!isSharedSystemDir(cwd))
+import { isHardStopDir, isSharedSystemDir, isStickyWorldWritable } from '../../kernel/shared-dirs.js';
+import { existsSync, statSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+/** The explicit root is also the destination for all init-generated files. */
+export function initProjectRoot(cwd = process.cwd(), env = process.env) {
+    return resolve(cwd, env.AQE_PROJECT_ROOT || '.');
+}
+/**
+ * Error message when `projectRoot` must not be initialized, otherwise null.
+ *
+ * An explicit root (`AQE_PROJECT_ROOT`) is refused only when it is a hard-stop
+ * directory (OS temp dir, `/`, `/home`, ...), or a sticky world-writable
+ * directory WITHOUT `.git`. This mirrors `findProjectRoot`, which keeps a
+ * sticky (mode 1777) directory that is itself a repo root as its own root, so
+ * the explicit root stays the escape hatch for such a repository. A derived
+ * root (the cwd) keeps the stricter rule: any shared directory is refused.
+ */
+export function sharedRootInitError(projectRoot, explicit) {
+    const shared = explicit
+        ? isHardStopDir(projectRoot)
+            || (isStickyWorldWritable(projectRoot) && !existsSync(join(projectRoot, '.git')))
+        : isSharedSystemDir(projectRoot);
+    if (!shared)
         return null;
-    return (`Refusing to initialize in "${cwd}": it is a shared temp/system directory, ` +
+    return (`Refusing to initialize in "${projectRoot}": it is a shared temp/system directory, ` +
         'so a store here would be shared by every unrelated project below it and ' +
         'later commands would not use it. Create a project directory first ' +
-        '(mkdir my-project && cd my-project) or set AQE_PROJECT_ROOT to choose a root.');
+        '(mkdir my-project && cd my-project) or set AQE_PROJECT_ROOT to a project directory.');
+}
+/** Error message when the selected root must not be initialized, otherwise null. */
+export function sharedDirInitError(cwd, env = process.env) {
+    return sharedRootInitError(initProjectRoot(cwd, env), Boolean(env.AQE_PROJECT_ROOT));
+}
+/**
+ * Error message when an explicit `AQE_PROJECT_ROOT` is not an existing
+ * directory, otherwise null. A typo must not silently create and initialize a
+ * new project somewhere else. Must run before anything creates the root (the
+ * CLI's token bootstrap does `mkdir -p <root>/.agentic-qe` at startup).
+ */
+export function explicitRootError(cwd = process.cwd(), env = process.env) {
+    if (!env.AQE_PROJECT_ROOT)
+        return null;
+    const root = initProjectRoot(cwd, env);
+    let isDir = false;
+    try {
+        isDir = statSync(root).isDirectory();
+    }
+    catch {
+        isDir = false;
+    }
+    if (isDir)
+        return null;
+    return (`AQE_PROJECT_ROOT "${root}" is not an existing directory. ` +
+        'Create it first (mkdir -p) or correct the path; aqe init does not create the project root.');
 }
 //# sourceMappingURL=init-guard.js.map

package/dist/cli/handlers/init-handler.js

@@ -9,7 +9,7 @@ import { createRequire } from 'node:module';
 import { ALL_DOMAINS } from '../../shared/types/index.js';
 import { toErrorMessage } from '../../shared/error-utils.js';
 import { resolveInitFlags } from './init-flags.js';
-import { sharedDirInitError } from './init-guard.js';
+import { initProjectRoot, sharedRootInitError } from './init-guard.js';
 // ============================================================================
 // Init Handler
 // ============================================================================
@@ -89,9 +89,10 @@ export class InitHandler {
             });
         }
         try {
+            const projectRoot = initProjectRoot();
             // #1006 (review of #1026 N3): never initialize a store in a shared
             // temp/system dir; later commands would resolve elsewhere and ignore it.
-            const sharedDirError = sharedDirInitError(process.cwd());
+            const sharedDirError = sharedRootInitError(projectRoot, Boolean(process.env.AQE_PROJECT_ROOT));
             if (sharedDirError) {
                 console.error(chalk.red(`\n  ${sharedDirError}\n`));
                 await this.cleanupAndExit(1);
@@ -117,11 +118,11 @@ export class InitHandler {
                 console.log(chalk.blue('\n  Agentic QE v3 Initialization\n'));
                 // Use modular orchestrator for --auto or --modular
                 if (options.auto || options.modular || options.browserEngine) {
-                    await this.runModularInit(options, context);
+                    await this.runModularInit(options, context, projectRoot);
                     return;
                 }
                 // Legacy wizard mode using InitOrchestrator
-                await this.runLegacyWizard(options, context);
+                await this.runLegacyWizard(options, context, projectRoot);
                 return;
             }
             // Platform provisioning (--with-opencode, --with-n8n, --with-<editor>, ...)
@@ -144,7 +145,7 @@ export class InitHandler {
             const noStatusLineRequested = flags.noStatusLine;
             if (options.browserEngine || options.modular || platformRequested || databaseFree || noClaudeRequested || noStatusLineRequested) {
                 console.log(chalk.blue('\n  Agentic QE v3 Initialization\n'));
-                await this.runModularInit(options, context);
+                await this.runModularInit(options, context, projectRoot);
                 return;
             }
             // Standard init without wizard
@@ -155,7 +156,7 @@ export class InitHandler {
             await this.cleanupAndExit(1);
         }
     }
-    async runModularInit(options, _context) {
+    async runModularInit(options, _context, projectRoot) {
         const isJsonMode = options.json === true;
         // #931/#935: commander maps --no-<name> to options.<name> === false.
         const flags = resolveInitFlags(options);
@@ -185,7 +186,7 @@ export class InitHandler {
         }
         const { createModularInitOrchestrator } = await import('../../init/orchestrator.js');
         const orchestrator = createModularInitOrchestrator({
-            projectRoot: process.cwd(),
+            projectRoot,
             autoMode: options.auto,
             upgrade: options.upgrade,
             minimal: options.minimal,
@@ -256,7 +257,7 @@ export class InitHandler {
             try {
                 const { setupClaudeFlowIntegration } = await import('../commands/claude-flow-setup.js');
                 cfResult = await setupClaudeFlowIntegration({
-                    projectRoot: process.cwd(),
+                    projectRoot,
                     force: options.withClaudeFlow,
                 });
                 if (cfResult.available) {
@@ -313,11 +314,11 @@ export class InitHandler {
         }
         await this.cleanupAndExit(0);
     }
-    async runLegacyWizard(options, _context) {
+    async runLegacyWizard(options, _context, projectRoot) {
         const flags = resolveInitFlags(options);
         const { InitOrchestrator } = await import('../../init/init-wizard.js');
         const orchestratorOptions = {
-            projectRoot: process.cwd(),
+            projectRoot,
             autoMode: options.auto,
             minimal: options.minimal,
             browserEngine: options.browserEngine,
@@ -455,62 +456,62 @@ export class InitHandler {
         }
     }
     getHelp() {
-        return `
-Initialize the AQE v3 system with various configuration options.
-
-Usage:
-  aqe init [options]
-
-Options:
-  -d, --domains <domains>    Comma-separated list of domains to enable (default: all)
-  -m, --max-agents <number>  Maximum concurrent agents (default: 15)
-  --memory <backend>         Memory backend: sqlite, agentdb, or hybrid (default: hybrid)
-  --lazy                     Enable lazy loading of domains
-  --wizard                   Run interactive setup wizard
-  --auto                     Auto-configure based on project analysis
-  -u, --upgrade              Upgrade existing installation (overwrite skills, agents, validation)
-  --minimal                  Minimal configuration (skip optional features)
-  --skip-patterns            Skip loading pre-trained patterns
+        return `
+Initialize the AQE v3 system with various configuration options.
+
+Usage:
+  aqe init [options]
+
+Options:
+  -d, --domains <domains>    Comma-separated list of domains to enable (default: all)
+  -m, --max-agents <number>  Maximum concurrent agents (default: 15)
+  --memory <backend>         Memory backend: sqlite, agentdb, or hybrid (default: hybrid)
+  --lazy                     Enable lazy loading of domains
+  --wizard                   Run interactive setup wizard
+  --auto                     Auto-configure based on project analysis
+  -u, --upgrade              Upgrade existing installation (overwrite skills, agents, validation)
+  --minimal                  Minimal configuration (skip optional features)
+  --skip-patterns            Skip loading pre-trained patterns
   --browser-engine          Install optional Vibium and browser payload
   --no-browser-engine       Skip browser setup (default)
-  --with-n8n                 Install n8n workflow testing agents and skills
+  --with-n8n                 Install n8n workflow testing agents and skills
   --with-opencode            Include OpenCode agent/skill provisioning
   --with-codex               Include OpenAI Codex hooks, instructions, skills, and MCP
   --codex-guidance <mode>    Codex AGENTS.md guidance: full, compact, or none
   --with-ruflo               Opt into Ruflo guidance and lifecycle hooks for Codex
-  --auto-migrate             Automatically migrate from v2 if detected
-  --with-claude-flow         Force Claude Flow integration setup
-  --skip-claude-flow         Skip Claude Flow integration
-  --no-mcp                   Skip MCP server config (MCP is enabled by default)
-  --with-mcp                 Add the .mcp.json entry even if the agentic-qe-fleet plugin is enabled
-                             (--no-mcp and --with-mcp cannot be combined)
-  --no-governance            Skip governance configuration (ADR-058)
-  --modular                  Use new modular init system
-
-MCP Server:
-  MCP server configuration is ENABLED BY DEFAULT. It writes .mcp.json
-  at the project root so Claude Code auto-discovers the AQE MCP server.
-  Use --no-mcp to skip if you only want CLI commands.
-  If the agentic-qe-fleet Claude Code plugin is enabled (user, project or
-  local settings), init skips the entry because the plugin already provides
-  the AQE MCP server. Use --with-mcp to add the project entry anyway.
-
-Governance:
-  Governance is ENABLED BY DEFAULT. It installs .claude/guidance/ with:
-  - constitution.md: 7 unbreakable QE invariants
-  - shards/*.shard.md: 12 domain-specific governance rules
-
-  Use --no-governance to skip, or set GOVERNANCE_*=false env vars for
-  fine-grained control over individual gates (ContinueGate, MemoryWriteGate, etc.)
-
+  --auto-migrate             Automatically migrate from v2 if detected
+  --with-claude-flow         Force Claude Flow integration setup
+  --skip-claude-flow         Skip Claude Flow integration
+  --no-mcp                   Skip MCP server config (MCP is enabled by default)
+  --with-mcp                 Add the .mcp.json entry even if the agentic-qe-fleet plugin is enabled
+                             (--no-mcp and --with-mcp cannot be combined)
+  --no-governance            Skip governance configuration (ADR-058)
+  --modular                  Use new modular init system
+
+MCP Server:
+  MCP server configuration is ENABLED BY DEFAULT. It writes .mcp.json
+  at the project root so Claude Code auto-discovers the AQE MCP server.
+  Use --no-mcp to skip if you only want CLI commands.
+  If the agentic-qe-fleet Claude Code plugin is enabled (user, project or
+  local settings), init skips the entry because the plugin already provides
+  the AQE MCP server. Use --with-mcp to add the project entry anyway.
+
+Governance:
+  Governance is ENABLED BY DEFAULT. It installs .claude/guidance/ with:
+  - constitution.md: 7 unbreakable QE invariants
+  - shards/*.shard.md: 12 domain-specific governance rules
+
+  Use --no-governance to skip, or set GOVERNANCE_*=false env vars for
+  fine-grained control over individual gates (ContinueGate, MemoryWriteGate, etc.)
+
 Examples:
   aqe init --auto            # Auto-configure based on project (keeps existing skills)
   aqe init --auto --with-codex --with-ruflo
                              # Codex plus optional Ruflo coordination
-  aqe init --auto --upgrade  # Auto-configure AND update all skills/agents
-  aqe init --upgrade         # Upgrade existing installation
-  aqe init --wizard          # Run interactive wizard
-  aqe init --domains test-generation,coverage-analysis
+  aqe init --auto --upgrade  # Auto-configure AND update all skills/agents
+  aqe init --upgrade         # Upgrade existing installation
+  aqe init --wizard          # Run interactive wizard
+  aqe init --domains test-generation,coverage-analysis
 `;
     }
 }