agentic-qe 3.15.8 → 3.15.10

package/.claude/skills/skills-manifest.json

@@ -940,7 +940,7 @@
   },
   "metadata": {
     "generatedBy": "Agentic QE Fleet",
-    "fleetVersion": "3.15.8",
+    "fleetVersion": "3.15.10",
     "manifestVersion": "1.4.0",
     "lastUpdated": "2026-04-13T00:00:00.000Z",
     "contributors": [

package/CHANGELOG.md

@@ -5,6 +5,440 @@ All notable changes to the Agentic QE project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.15.10] - 2026-10-19
+
+Files named in a request are now read only when they are inside your
+project, and secrets in test failures are redacted everywhere AQE returns
+or stores them. Advertised `aqe fleet run` and `task_orchestrate` commands
+run real handlers and judge what they returned. A dream can no longer lose
+an acknowledged memory write, git and other slow tools no longer freeze
+the MCP server, and the learning success rate counts measured outcomes
+only. Every change was reviewed adversarially before merge.
+
+### Security
+
+- **Paths in a request are read only inside the project** ([#1126],
+  [#1162], [#1125], [#1144]): before, a caller could ask AQE over MCP to
+  read any file on the machine, and one request for `/dev/zero` crashed the
+  server. Every handler that reads a file or folder named in a request
+  (`generate-tests`, `execute-tests`, `predict-defects`, `sast-scan`,
+  `security_scan_comprehensive`, `coverage_analyze_sublinear`,
+  `code_index`, `contract_validate` and others) now applies one shared
+  check, on every entry point: MCP tools, `task_submit`,
+  `task_orchestrate` and `aqe task submit`.
+  - The real location, with every symlink followed, must be inside the
+    project root. A symlink that points out, and `src/link/../x` when
+    `src/link` points out, are refused.
+  - Only regular files are read, at most 2 MB each where a file is read
+    whole. Devices, FIFOs and (except where a folder is expected)
+    directories are refused before anything is opened.
+  - A path outside the project is refused without touching the
+    filesystem, so the error does not reveal whether the file exists.
+  - The refusal is a caller error: it is not retried and does not trip the
+    domain circuit breaker.
+- **Secrets in test failures are redacted** ([#1122], [#1139]): a
+  connection string, AWS key or bearer token in a failing test's message
+  used to come back verbatim from `test_execute_parallel` and
+  `aqe test execute`, and was saved under `.agentic-qe/results/`, in
+  session logs and in `memory.db` (test runs, experiences, retry and flaky
+  history). All of these copies are now redacted, before any length cap,
+  so a secret cut in half cannot survive. The `error` of every MCP domain
+  tool is redacted as a backstop.
+- **Lookups keyed by caller data read own properties only** ([#1136],
+  [#1156], [#1118], [#1132]):
+  - `${constructor}` or `{{toString}}` in a pipeline YAML, browser
+    workflow, workflow condition or cross-phase hook no longer expands to
+    native function source. It stays literal.
+  - JSON Pointer and JSON Patch paths such as `/__proto__/x` in the A2UI
+    and AG-UI adapters can no longer write to `Object.prototype`.
+  - Required-property checks in contract, enterprise-integration and MCP
+    schema validation no longer count an inherited `constructor` as
+    present.
+  - Name tables (agent names, gate rules, routing categories,
+    `aqe ruvector flags --profile`, faker paths and recovery playbook
+    services) no longer match inherited members. Thanks to @rudycelekli
+    for the recovery playbook fix.
+- **DAST scans fail when the target cannot be reached** ([#1092]): an
+  initial 401/403 now fails with `DAST_AUTHENTICATION_FAILED` and a 5xx
+  with `DAST_TARGET_UNAVAILABLE`. Before, an unreachable target could
+  produce a completed scan. Failed follow-up probes fail the scan, and a
+  failed scan is not stored as completed. Thanks to @rudycelekli.
+
+### Fixed
+
+- **Dreams no longer put memory writes at risk** ([#1060], [#1160]): a
+  dream does its work in memory and writes its results in one short
+  transaction at the end. An acknowledged `memory_store` made during a
+  dream is kept however the dream ends: it finishes, is cancelled, the
+  engine closes, stdin closes or the process is killed. `cancelDream()`,
+  `close()` and shutdown stop a dream at once and record it `interrupted`.
+  A second dream request while one runs is refused instead of interrupting
+  it. A cycle left `running` by a dead process is marked `interrupted`
+  (never deleted) after 11 minutes. Thanks to @pacphi for the report and
+  reproduction in [#1060].
+- **Slow child processes no longer freeze the MCP server** ([#1115],
+  [#1148]): git (defect prediction, task routing, the quality daemon's
+  watcher), `cloc`/`tokei` and test-runner listings for `code_index`, and
+  `npx agent-browser` for the browser tools now run asynchronously with
+  timeouts. A timeout stops the child's whole process group, so nothing is
+  left running. With a git that took 1 s per call, `fleet_status` used to
+  wait up to 12 s; now it answers in well under a second.
+- **Learning's success rate counts measured outcomes only** ([#1129],
+  [#1121], [#1142]): `aqe learning stats` said 100% after test runs with a
+  failing test. Now only a test run is a measured outcome (it passes when
+  every test passed, and both results are recorded), and the rate counts
+  runs, not rows. Completed calls, errors, hook-reported `--success` and
+  session-consolidation aggregates count as uses, not verdicts. Existing
+  rows are classified on read; nothing is deleted or rewritten. The
+  learning dashboard no longer shows an invented `0.5` learning rate or a
+  `100%` transfer rate, and patterns stored before 3.15.9 are kept but left
+  out of stats.
+- **Learning consolidation cannot lose patterns** ([#1106], [#1143]): a
+  merge now reads back every archived source and the merged pattern before
+  removing the sources. If any step fails, nothing is merged. A failed
+  domain or merge is reported as `status: 'partial'` with an `errors` list
+  instead of success. A dry run now predicts the same trims as a real run,
+  and a key scan that never ends stops with an error.
+- **Advertised commands run real handlers** ([#1125], [#1144]):
+  `aqe fleet run scan` runs a SAST scan on the target's JS/TS files,
+  `analyze` uses the coverage report that already exists for the target,
+  and `test` generates tests for the target's sources. `task_orchestrate`
+  routes `scan-security` to `sast-scan` and `assess-quality` to
+  `analyze-quality` when you pass `filePaths`. Requests that lack the
+  input a handler needs are refused with the tool to use instead; nothing
+  is estimated. `task_submit` with `sast-scan` now accepts plain path
+  strings.
+- **Index tasks run, or are refused up front** ([#1086], [#1134],
+  [#1159]): an inferred `index-code` task now runs the code-intelligence
+  handler with the paths it was given. Thanks to @rudycelekli.
+- **Queen slots are always handed on** ([#1127], [#1138], [#1140],
+  [#1152]): a slot freed while the queue drains goes to the next queued
+  task. Work stealing moves a task only to a domain that can run it and
+  never exceeds `maxConcurrentTasks`. A failure at dispatch publishes
+  `QueenTaskFailed` once and frees its slot once; a plugin that throws no
+  longer leaves its task `running`.
+- **Retries rerun tests inside `describe` blocks** ([#1141], [#1151]): the
+  retry filter only ever matched top-level tests. It now matches the full
+  name for Vitest, Jest and Mocha. A retry that selects no test is
+  reported as `unmatched` instead of counting as an attempt.
+- **Retry results are reported** ([#1130], [#1163]):
+  `test_execute_parallel` returns `retryStats` (retries run, now passing,
+  still failing, per test) and `aqe test execute` prints a `Retries:` line.
+- **`fleet_status` stays healthy during a test run** ([#1130], [#1163]):
+  the agent spawned for one task no longer marks the fleet `degraded`
+  while it runs or after it finishes. Real topology problems and failed
+  agents still degrade the status. `fleet_health({ detailed: true })`
+  shows the raw MinCut reading.
+- **Chaos wording is not run as tests** ([#1130], [#1163]): "Run chaos
+  resilience testing with fault injection" now gets chaos guidance from
+  `task_orchestrate` instead of being submitted as `execute-tests`.
+- **Dream archive and worker status are reported truthfully** ([#1116],
+  [#1155]): a stale insight with a NULL id no longer makes every retention
+  sweep fail. The generated `start-daemon.cjs` honours
+  `AQE_WORKERS_ENABLED` (environment or Claude settings files) and says
+  "started" only when the server is still running. MCP startup reports
+  workers as `starting` until they have started.
+- **Concurrent startups no longer fail with "database is locked" during a
+  schema migration** ([#1116], [#1155]): a migration takes the write lock
+  up front and waits for it.
+- **Defect predictions reach the background worker** ([#1088]): public
+  predictions are recorded in the shape the worker reads, history is
+  bounded to the newest 32 runs, and the newest result is no longer hidden
+  behind an old scan cap. Static scores are labelled as estimates. Thanks
+  to @rudycelekli.
+
+### Changed
+
+- **`task_orchestrate` and fleet responses:** `type` is now the handler
+  type that actually ran (for example `sast-scan`). The type inferred from
+  the description moves to the new field `inferredType`. Clients that read
+  `type` as the inferred type should read `inferredType`.
+- **`aqe fleet run` shows results and a verdict.** It prints the findings,
+  coverage or generated tests, and exits 1 with `Verdict: FAILED (…)` on a
+  critical or high finding, incomplete scan evidence, a failed quality
+  gate, coverage below 80% or an unreadable result. The count line now
+  says `Completed: N` instead of `Successful: N`.
+- **Payload paths are confined to the project root.** After `aqe init` in
+  a monorepo package, a sibling package such as `../b/tests/x.test.ts` is
+  refused. Set `AQE_PROJECT_ROOT=<repo root>` to let packages reach each
+  other.
+- **Interpolation no longer resolves inherited values.** `${constructor}`,
+  `${toString}` and similar placeholders stay literal unless you define
+  them.
+- **`enableBranching` is a deprecated no-op.** The option is still
+  accepted and logs a warning. `RVCOWBranchManager` is deprecated.
+- **Index tasks without `paths` are refused at submit.** `task_submit` and
+  `aqe task submit` with `index` or `index-code` need a non-empty `paths`
+  list, and `task_orchestrate` needs `filePaths`. Use `code_index` or
+  `aqe code index` to index a directory.
+- **`task_orchestrate` refuses `optimize-learning` from free text**,
+  because it overwrites the stored learned strategies. Use `task_submit`
+  with type `optimize-strategies`. `run-chaos`, `validate-contracts`,
+  `validate-requirements` and `test-accessibility` are refused with the
+  tool to use instead.
+- **Schema v14.** The `dream_insights_archive` table moves into the
+  versioned schema with an additive, idempotent migration. 3.15.8 and
+  3.15.9 still open a migrated database.
+- **Learning success rates count measured outcomes only.** Projects that
+  only have hook-reported outcomes now show "insufficient evidence"
+  instead of 100%. `aqe learning stats --json` reports `measuredOutcomes`
+  and `unmeasuredOutcomes`, and `patternSuccessRate` can be `null`.
+- **Git timeouts are reported as unavailable, never as 0.** A prediction
+  whose git history timed out carries a `warnings` entry, and its metrics
+  are not cached.
+
+### Known issues
+
+- `task_orchestrate` still fails on an install without an embedder (the
+  optional `@huggingface/transformers` package or `AQE_EMBEDDER_ENDPOINT`),
+  so its new routing is only reachable with one configured ([#1022]).
+- Payload path checks and the read that follows are not atomic, so a path
+  swapped between them is not caught yet ([#1161]).
+- Some direct `map[userKey]` lookups on plain objects remain to be audited
+  ([#1157]).
+- `aqe fleet run analyze` and `aqe coverage` can pass from a report that
+  covers only part of the target ([#1154]).
+- The daemon spawned by `start-daemon.cjs` exits on stdin EOF, so it never
+  stays up; it now says so instead of reporting "started" ([#1158]).
+- A rare "database is locked" on concurrent first open of a non-WAL
+  database ([#1164]).
+- Git timeout follow-ups: per-path deadlines and the watcher baseline
+  ([#1165]).
+- Queen follow-ups: a late `onComplete` can settle twice, and work stealing
+  rarely runs under the slot cap ([#1153]).
+- Learning outcome follow-ups: failures can still mint patterns, and
+  routing still uses completion-based success ([#1147]).
+- Pattern consolidation follow-ups: id-only read-back and no
+  compare-and-delete ([#1149]).
+
+[#1022]: https://github.com/proffesor-for-testing/agentic-qe/issues/1022
+[#1060]: https://github.com/proffesor-for-testing/agentic-qe/issues/1060
+[#1086]: https://github.com/proffesor-for-testing/agentic-qe/pull/1086
+[#1088]: https://github.com/proffesor-for-testing/agentic-qe/pull/1088
+[#1092]: https://github.com/proffesor-for-testing/agentic-qe/pull/1092
+[#1106]: https://github.com/proffesor-for-testing/agentic-qe/issues/1106
+[#1115]: https://github.com/proffesor-for-testing/agentic-qe/issues/1115
+[#1116]: https://github.com/proffesor-for-testing/agentic-qe/issues/1116
+[#1118]: https://github.com/proffesor-for-testing/agentic-qe/issues/1118
+[#1121]: https://github.com/proffesor-for-testing/agentic-qe/issues/1121
+[#1122]: https://github.com/proffesor-for-testing/agentic-qe/issues/1122
+[#1125]: https://github.com/proffesor-for-testing/agentic-qe/issues/1125
+[#1126]: https://github.com/proffesor-for-testing/agentic-qe/issues/1126
+[#1127]: https://github.com/proffesor-for-testing/agentic-qe/issues/1127
+[#1129]: https://github.com/proffesor-for-testing/agentic-qe/issues/1129
+[#1130]: https://github.com/proffesor-for-testing/agentic-qe/issues/1130
+[#1132]: https://github.com/proffesor-for-testing/agentic-qe/pull/1132
+[#1134]: https://github.com/proffesor-for-testing/agentic-qe/issues/1134
+[#1136]: https://github.com/proffesor-for-testing/agentic-qe/issues/1136
+[#1138]: https://github.com/proffesor-for-testing/agentic-qe/pull/1138
+[#1139]: https://github.com/proffesor-for-testing/agentic-qe/pull/1139
+[#1140]: https://github.com/proffesor-for-testing/agentic-qe/issues/1140
+[#1141]: https://github.com/proffesor-for-testing/agentic-qe/issues/1141
+[#1142]: https://github.com/proffesor-for-testing/agentic-qe/pull/1142
+[#1143]: https://github.com/proffesor-for-testing/agentic-qe/pull/1143
+[#1144]: https://github.com/proffesor-for-testing/agentic-qe/pull/1144
+[#1147]: https://github.com/proffesor-for-testing/agentic-qe/issues/1147
+[#1148]: https://github.com/proffesor-for-testing/agentic-qe/pull/1148
+[#1149]: https://github.com/proffesor-for-testing/agentic-qe/issues/1149
+[#1151]: https://github.com/proffesor-for-testing/agentic-qe/pull/1151
+[#1152]: https://github.com/proffesor-for-testing/agentic-qe/pull/1152
+[#1153]: https://github.com/proffesor-for-testing/agentic-qe/issues/1153
+[#1154]: https://github.com/proffesor-for-testing/agentic-qe/issues/1154
+[#1155]: https://github.com/proffesor-for-testing/agentic-qe/pull/1155
+[#1156]: https://github.com/proffesor-for-testing/agentic-qe/pull/1156
+[#1157]: https://github.com/proffesor-for-testing/agentic-qe/issues/1157
+[#1158]: https://github.com/proffesor-for-testing/agentic-qe/issues/1158
+[#1159]: https://github.com/proffesor-for-testing/agentic-qe/pull/1159
+[#1160]: https://github.com/proffesor-for-testing/agentic-qe/pull/1160
+[#1161]: https://github.com/proffesor-for-testing/agentic-qe/issues/1161
+[#1162]: https://github.com/proffesor-for-testing/agentic-qe/pull/1162
+[#1163]: https://github.com/proffesor-for-testing/agentic-qe/pull/1163
+[#1164]: https://github.com/proffesor-for-testing/agentic-qe/issues/1164
+[#1165]: https://github.com/proffesor-for-testing/agentic-qe/issues/1165
+
+## [3.15.9] - 2026-10-17
+
+Tasks no longer get stuck in `running` and quietly use up Queen slots.
+`test_execute_parallel` and the learning tools now report only what was
+actually measured, without made-up efficiency numbers, sample data or
+success rates. Test runs no longer freeze the MCP server, and code indexing
+stays inside your project. Every change was reviewed adversarially before
+merge.
+
+### Fixed
+
+- **Tasks no longer get stuck and use up Queen slots** ([#1070], [#1075],
+  [#1077], [#1081], [#1076], [#1079], [#1082], [#1085], [#1107]): several
+  paths left a task `running` forever, each one holding a concurrency slot.
+  After 50 such tasks, every new submission was queued and never ran.
+  - `quality_assess` gives its slot back. The anti-drift middleware was
+    silently dropping its `TaskCompleted` event.
+  - `task_submit`, `aqe task submit`, `task_orchestrate` and `aqe fleet run`
+    reject a task type that no domain plugin runs. The error names the
+    domain and the types it supports.
+  - As a backstop, the Queen fails any task it owns that has no handler,
+    with the reason, and frees the slot.
+  - The anti-drift middleware never drops task lifecycle events. When it
+    drops any other event, it logs a rate-limited warning on stderr with the
+    event type and source, never the payload. If the embedding service fails
+    part-way, events are still delivered (marked unverified) instead of
+    `publish()` failing.
+- **Test runs no longer freeze the MCP server** ([#1074], [#1114]): the
+  `execute-tests` runner, `coverage_analyze_sublinear` on a Rust crate
+  (`cargo llvm-cov`, up to 300 s) and `advisor_consult` (up to 60 s) used
+  blocking child-process calls that froze every other MCP request until they
+  finished. They now run asynchronously, with the same exit codes, output,
+  timeouts and output limits as before.
+- **`test_execute_parallel` runs your suite once and reports real numbers**
+  ([#1059], [#1065], [#1110], [#1113]): one request no longer starts two
+  test runs. The 0.85 efficiency, 0.9 load balance and made-up `test_case_N`
+  durations are gone. Per-test results come from the Vitest or Jest JSON
+  report. Anything that was not measured is left out and listed in
+  `unmeasured`, with a reason in `unmeasuredReasons`. Each run is stored in
+  learning once instead of twice.
+- **Learning reports only what it measured** ([#1093], [#1099], [#1105],
+  [#1109], [#1120]):
+  - `qe/learning/optimize` optimizes the experiences that were actually
+    recorded. Before, it generated random samples.
+  - A/B tests no longer pad with random samples, the default strategy no
+    longer claims a 0.7 outcome, and optimizer confidence is scored on
+    held-out records.
+  - Experiences with a fixed reward (generated tests, defect predictions,
+    impact analyses and coverage gaps) are still recorded, now tagged
+    `rewardSource: 'assigned'`. They no longer count toward success rates,
+    pattern confidence, domain rankings, milestones or anomaly baselines.
+  - With too little measured data, the tools say `insufficient-evidence`
+    instead of reporting 100%.
+- **Learning data is read from where it is written** ([#1071], [#1084],
+  [#1089], [#1103]): export, import, consolidation, transfer and shared
+  knowledge lookups use the `learning-optimization` namespace that learning
+  writes to. Export now returns every active pattern. Before, it stopped at
+  about 5,000. An import no longer overwrites newer knowledge or a better
+  strategy with stale data. Thanks to @rudycelekli.
+- **Code indexing stays inside your project** ([#1096], [#1123]): a symlink
+  inside the project that points outside it is skipped and reported instead
+  of read. Missing files and directories are no longer counted as indexed.
+  A request that indexes nothing now fails: the MCP task is marked failed
+  and the CLI exits with code 1.
+- **Dream insights are archived, not deleted** ([#1066], [#1112]): the
+  retention sweep moves stale unapplied insights into a new
+  `dream_insights_archive` table, in one transaction that deletes only rows
+  whose copy is verified. `AQE_DREAM_INSIGHTS_RETENTION_DAYS=false`, `no`,
+  `disabled`, `none` and `never` now turn the sweep off. An unreadable value
+  also leaves it off, with a warning. Before, it fell back to deleting at
+  30 days.
+- **Worker settings** ([#1066], [#1112]): worker ids in
+  `AQE_DISABLED_WORKERS` are no longer case-sensitive. `aqe daemon start`
+  and the generated `start-daemon.cjs` respect `AQE_WORKERS_ENABLED`. The
+  QualityDaemon no longer waits about 150 s for every worker's first run
+  before it starts.
+- **Invalid task priorities are rejected** ([#1108], [#1111]):
+  `task_submit` and `aqe task submit` accept only `p0` to `p3`, with the
+  same error on both paths. Before, any string was accepted.
+- **Test-execution experiences no longer show up as fake test runs**
+  ([#1095], [#1100]).
+- **Deleting an unfinished task no longer unblocks the tasks that depend on
+  it** ([#1069], [#1098]): this affects library users of the `TaskDAG` and
+  `DAGScheduler` API. Every dependency now has a typed status. Each change
+  of status writes an audit receipt, and an unfinished prerequisite can only
+  be bypassed by an explicit, attributed waiver.
+- **Coverage for monorepo packages** ([#1036]): a package with no test
+  runner config of its own uses the workspace root's config, so coverage is
+  measured instead of estimated. Thanks to @rudycelekli.
+- **CRDT registers** ([#1062], [#1063]): a register created by a read can no
+  longer erase a negative-timestamp write on merge. A second local write in
+  the same millisecond is no longer dropped. Thanks to @rudycelekli.
+- **Names like `constructor` or `__proto__`** ([#1064], [#1083], [#1104]):
+  CI workflows, claim agents, infra services, model ids and task domains
+  with these names no longer crash or read inherited values. Thanks to
+  @rudycelekli.
+- **Empty LLM completions are no longer cached** ([#1090]), so a provider
+  refusal does not block retries of the same prompt until the cache entry
+  expires. Thanks to @rudycelekli.
+
+### Changed
+
+- **`task_orchestrate` and `aqe fleet run scan`** now return an error for
+  `scan-security`, `run-chaos` and `assess-quality`, which no domain plugin
+  runs. Before, these tasks were accepted and never finished. Routing them
+  to real handlers is tracked in [#1124].
+- **`test_execute_parallel` output**: fields with no measurement behind them,
+  such as `workerStats.efficiency`, `workerStats.loadBalance`, `retryStats`
+  and per-test `results`, are left out of the response and named in
+  `unmeasured`. Code that read those fields unconditionally needs to handle
+  their absence.
+- **Learning totals can drop.** Success rates, confidence, rankings and
+  milestones now count measured outcomes only.
+- **For library users:** `TaskDAG.removeTask` no longer marks dependents
+  ready. Use a waiver to let them run.
+
+### Known issues
+
+- Dreams still need the full rework ([#1060]).
+- The anti-drift middleware still runs model inference for every event on
+  the in-process bus ([#1078]).
+- `task_orchestrate` and fleet scans do not route security, chaos or
+  quality tasks to their domains yet ([#1124], [#1125]).
+- Some MCP-reachable paths still use blocking child-process calls
+  ([#1115]).
+- Test failure messages and runner output are not yet redacted for secrets
+  ([#1122]).
+- In a narrow case, a task that fails at dispatch while the Queen is
+  draining its queue can leave a free slot unused until the next submission
+  ([#1127]).
+- Workspace member dependencies are not scanned from a monorepo root yet
+  ([#1057]).
+
+[#1036]: https://github.com/proffesor-for-testing/agentic-qe/pull/1036
+[#1057]: https://github.com/proffesor-for-testing/agentic-qe/issues/1057
+[#1059]: https://github.com/proffesor-for-testing/agentic-qe/issues/1059
+[#1060]: https://github.com/proffesor-for-testing/agentic-qe/issues/1060
+[#1062]: https://github.com/proffesor-for-testing/agentic-qe/pull/1062
+[#1063]: https://github.com/proffesor-for-testing/agentic-qe/pull/1063
+[#1064]: https://github.com/proffesor-for-testing/agentic-qe/pull/1064
+[#1065]: https://github.com/proffesor-for-testing/agentic-qe/pull/1065
+[#1066]: https://github.com/proffesor-for-testing/agentic-qe/issues/1066
+[#1069]: https://github.com/proffesor-for-testing/agentic-qe/issues/1069
+[#1070]: https://github.com/proffesor-for-testing/agentic-qe/issues/1070
+[#1071]: https://github.com/proffesor-for-testing/agentic-qe/issues/1071
+[#1074]: https://github.com/proffesor-for-testing/agentic-qe/issues/1074
+[#1075]: https://github.com/proffesor-for-testing/agentic-qe/issues/1075
+[#1076]: https://github.com/proffesor-for-testing/agentic-qe/pull/1076
+[#1077]: https://github.com/proffesor-for-testing/agentic-qe/issues/1077
+[#1078]: https://github.com/proffesor-for-testing/agentic-qe/issues/1078
+[#1079]: https://github.com/proffesor-for-testing/agentic-qe/pull/1079
+[#1081]: https://github.com/proffesor-for-testing/agentic-qe/issues/1081
+[#1082]: https://github.com/proffesor-for-testing/agentic-qe/pull/1082
+[#1083]: https://github.com/proffesor-for-testing/agentic-qe/pull/1083
+[#1084]: https://github.com/proffesor-for-testing/agentic-qe/pull/1084
+[#1085]: https://github.com/proffesor-for-testing/agentic-qe/pull/1085
+[#1089]: https://github.com/proffesor-for-testing/agentic-qe/pull/1089
+[#1090]: https://github.com/proffesor-for-testing/agentic-qe/pull/1090
+[#1093]: https://github.com/proffesor-for-testing/agentic-qe/pull/1093
+[#1095]: https://github.com/proffesor-for-testing/agentic-qe/issues/1095
+[#1096]: https://github.com/proffesor-for-testing/agentic-qe/issues/1096
+[#1098]: https://github.com/proffesor-for-testing/agentic-qe/pull/1098
+[#1099]: https://github.com/proffesor-for-testing/agentic-qe/issues/1099
+[#1100]: https://github.com/proffesor-for-testing/agentic-qe/pull/1100
+[#1103]: https://github.com/proffesor-for-testing/agentic-qe/pull/1103
+[#1104]: https://github.com/proffesor-for-testing/agentic-qe/pull/1104
+[#1105]: https://github.com/proffesor-for-testing/agentic-qe/pull/1105
+[#1107]: https://github.com/proffesor-for-testing/agentic-qe/pull/1107
+[#1108]: https://github.com/proffesor-for-testing/agentic-qe/issues/1108
+[#1109]: https://github.com/proffesor-for-testing/agentic-qe/issues/1109
+[#1110]: https://github.com/proffesor-for-testing/agentic-qe/issues/1110
+[#1111]: https://github.com/proffesor-for-testing/agentic-qe/pull/1111
+[#1112]: https://github.com/proffesor-for-testing/agentic-qe/pull/1112
+[#1113]: https://github.com/proffesor-for-testing/agentic-qe/pull/1113
+[#1114]: https://github.com/proffesor-for-testing/agentic-qe/pull/1114
+[#1115]: https://github.com/proffesor-for-testing/agentic-qe/issues/1115
+[#1120]: https://github.com/proffesor-for-testing/agentic-qe/pull/1120
+[#1122]: https://github.com/proffesor-for-testing/agentic-qe/issues/1122
+[#1123]: https://github.com/proffesor-for-testing/agentic-qe/pull/1123
+[#1124]: https://github.com/proffesor-for-testing/agentic-qe/issues/1124
+[#1125]: https://github.com/proffesor-for-testing/agentic-qe/issues/1125
+[#1127]: https://github.com/proffesor-for-testing/agentic-qe/issues/1127
+
 ## [3.15.8] - 2026-10-16
 
 Your acknowledged memory writes are no longer lost when a dream is running,

package/assets/skills/skills-manifest.json

@@ -940,7 +940,7 @@
   },
   "metadata": {
     "generatedBy": "Agentic QE Fleet",
-    "fleetVersion": "3.15.8",
+    "fleetVersion": "3.15.10",
     "manifestVersion": "1.4.0",
     "lastUpdated": "2026-04-13T00:00:00.000Z",
     "contributors": [

package/dist/adapters/a2ui/catalog/component-schemas.js

@@ -965,7 +965,8 @@ export function validateComponent(component, componentType) {
     // Check required properties
     if (schema.required) {
         for (const prop of schema.required) {
-            if (!(prop in comp)) {
+            // #1136: own properties only; an inherited `constructor` is not present.
+            if (!Object.hasOwn(comp, prop)) {
                 errors.push({
                     path: prop,
                     message: `Missing required property: ${prop}`,

package/dist/adapters/a2ui/data/json-pointer-resolver.js

@@ -7,6 +7,7 @@
  * @see https://www.rfc-editor.org/rfc/rfc6901
  * @module adapters/a2ui/data/json-pointer-resolver
  */
+import { setOwn } from '../../../shared/utils/safe-record.js';
 // ============================================================================
 // Types
 // ============================================================================
@@ -176,7 +177,9 @@ export function resolvePointerWithInfo(data, pointer) {
         else {
             // Object access
             const obj = current;
-            if (!(segment in obj)) {
+            // #1136: own properties only; `/constructor` or `/__proto__` does not
+            // resolve to an inherited member.
+            if (!Object.hasOwn(obj, segment)) {
                 return { found: false, value: undefined };
             }
             lastKey = segment;
@@ -239,9 +242,11 @@ export function setAtPointer(data, pointer, value) {
         }
         else {
             const obj = current;
-            if (!(segment in obj)) {
+            // #1136: own properties only, and created as own data properties, so
+            // `/__proto__/x` cannot walk into and write Object.prototype.
+            if (!Object.hasOwn(obj, segment)) {
                 // Auto-create intermediate objects
-                obj[segment] = {};
+                setOwn(obj, segment, {});
             }
             current = obj[segment];
         }
@@ -269,7 +274,7 @@ export function setAtPointer(data, pointer, value) {
         }
     }
     else {
-        current[lastSegment] = value;
+        setOwn(current, lastSegment, value);
     }
 }
 /**
@@ -304,7 +309,7 @@ export function deleteAtPointer(data, pointer) {
     }
     else {
         const obj = parent;
-        if (!(lastSegment in obj)) {
+        if (!Object.hasOwn(obj, lastSegment)) {
             return false;
         }
         delete obj[lastSegment];

package/dist/adapters/a2ui/integration/agui-sync.js

@@ -8,6 +8,7 @@
  */
 import { EventEmitter } from 'events';
 import { v4 as uuidv4 } from 'uuid';
+import { getOwn, setOwn } from '../../../shared/utils/safe-record.js';
 /**
  * Default configuration
  */
@@ -473,7 +474,8 @@ export class AGUISyncService extends EventEmitter {
         const parts = extractor.split('.');
         let value = payload;
         for (const part of parts) {
-            if (value && typeof value === 'object' && part in value) {
+            // #1136: own properties only.
+            if (value && typeof value === 'object' && Object.hasOwn(value, part)) {
                 value = value[part];
             }
             else {
@@ -498,7 +500,7 @@ export class AGUISyncService extends EventEmitter {
             if (typeof current !== 'object') {
                 return undefined;
             }
-            current = current[part];
+            current = getOwn(current, part);
         }
         return current;
     }
@@ -512,14 +514,16 @@ export class AGUISyncService extends EventEmitter {
         }
         const parts = path.split('/').filter(Boolean);
         let current = obj;
+        // #1136: own properties only, created as own data properties, so
+        // `/__proto__/x` cannot walk into and write Object.prototype.
         for (let i = 0; i < parts.length - 1; i++) {
             const part = parts[i];
-            if (!(part in current) || typeof current[part] !== 'object') {
-                current[part] = {};
+            if (!Object.hasOwn(current, part) || typeof current[part] !== 'object' || current[part] === null) {
+                setOwn(current, part, {});
             }
             current = current[part];
         }
-        current[parts[parts.length - 1]] = value;
+        setOwn(current, parts[parts.length - 1], value);
     }
     /**
      * Delete value at JSON Pointer path
@@ -532,7 +536,7 @@ export class AGUISyncService extends EventEmitter {
         let current = obj;
         for (let i = 0; i < parts.length - 1; i++) {
             const part = parts[i];
-            if (!(part in current) || typeof current[part] !== 'object') {
+            if (!Object.hasOwn(current, part) || typeof current[part] !== 'object') {
                 return;
             }
             current = current[part];

package/dist/adapters/a2ui/integration/surface-state-bridge.js

@@ -8,6 +8,7 @@
  */
 import { EventEmitter } from 'events';
 import { v4 as uuidv4 } from 'uuid';
+import { getOwn, setOwn } from '../../../shared/utils/safe-record.js';
 import { createSurfaceGenerator, createComponentBuilder, } from '../renderer/index.js';
 /**
  * Default configuration
@@ -461,7 +462,8 @@ export class SurfaceStateBridge extends EventEmitter {
             if (typeof current !== 'object') {
                 return undefined;
             }
-            current = current[part];
+            // #1136: own properties only.
+            current = getOwn(current, part);
         }
         return current;
     }
@@ -475,14 +477,16 @@ export class SurfaceStateBridge extends EventEmitter {
         }
         const parts = path.split('/').filter(Boolean);
         let current = obj;
+        // #1136: own properties only, created as own data properties, so
+        // `/__proto__/x` cannot walk into and write Object.prototype.
         for (let i = 0; i < parts.length - 1; i++) {
             const part = parts[i];
-            if (!(part in current) || typeof current[part] !== 'object' || current[part] === null) {
-                current[part] = {};
+            if (!Object.hasOwn(current, part) || typeof current[part] !== 'object' || current[part] === null) {
+                setOwn(current, part, {});
             }
             current = current[part];
         }
-        current[parts[parts.length - 1]] = value;
+        setOwn(current, parts[parts.length - 1], value);
     }
     /**
      * Delete value at JSON Pointer path
@@ -495,7 +499,7 @@ export class SurfaceStateBridge extends EventEmitter {
         let current = obj;
         for (let i = 0; i < parts.length - 1; i++) {
             const part = parts[i];
-            if (!(part in current) || typeof current[part] !== 'object') {
+            if (!Object.hasOwn(current, part) || typeof current[part] !== 'object') {
                 return;
             }
             current = current[part];