agentic-qe 3.15.9 → 3.15.10

package/.claude/skills/skills-manifest.json

@@ -940,7 +940,7 @@
   },
   "metadata": {
     "generatedBy": "Agentic QE Fleet",
-    "fleetVersion": "3.15.9",
+    "fleetVersion": "3.15.10",
     "manifestVersion": "1.4.0",
     "lastUpdated": "2026-04-13T00:00:00.000Z",
     "contributors": [

package/CHANGELOG.md

@@ -5,6 +5,257 @@ All notable changes to the Agentic QE project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.15.10] - 2026-10-19
+
+Files named in a request are now read only when they are inside your
+project, and secrets in test failures are redacted everywhere AQE returns
+or stores them. Advertised `aqe fleet run` and `task_orchestrate` commands
+run real handlers and judge what they returned. A dream can no longer lose
+an acknowledged memory write, git and other slow tools no longer freeze
+the MCP server, and the learning success rate counts measured outcomes
+only. Every change was reviewed adversarially before merge.
+
+### Security
+
+- **Paths in a request are read only inside the project** ([#1126],
+  [#1162], [#1125], [#1144]): before, a caller could ask AQE over MCP to
+  read any file on the machine, and one request for `/dev/zero` crashed the
+  server. Every handler that reads a file or folder named in a request
+  (`generate-tests`, `execute-tests`, `predict-defects`, `sast-scan`,
+  `security_scan_comprehensive`, `coverage_analyze_sublinear`,
+  `code_index`, `contract_validate` and others) now applies one shared
+  check, on every entry point: MCP tools, `task_submit`,
+  `task_orchestrate` and `aqe task submit`.
+  - The real location, with every symlink followed, must be inside the
+    project root. A symlink that points out, and `src/link/../x` when
+    `src/link` points out, are refused.
+  - Only regular files are read, at most 2 MB each where a file is read
+    whole. Devices, FIFOs and (except where a folder is expected)
+    directories are refused before anything is opened.
+  - A path outside the project is refused without touching the
+    filesystem, so the error does not reveal whether the file exists.
+  - The refusal is a caller error: it is not retried and does not trip the
+    domain circuit breaker.
+- **Secrets in test failures are redacted** ([#1122], [#1139]): a
+  connection string, AWS key or bearer token in a failing test's message
+  used to come back verbatim from `test_execute_parallel` and
+  `aqe test execute`, and was saved under `.agentic-qe/results/`, in
+  session logs and in `memory.db` (test runs, experiences, retry and flaky
+  history). All of these copies are now redacted, before any length cap,
+  so a secret cut in half cannot survive. The `error` of every MCP domain
+  tool is redacted as a backstop.
+- **Lookups keyed by caller data read own properties only** ([#1136],
+  [#1156], [#1118], [#1132]):
+  - `${constructor}` or `{{toString}}` in a pipeline YAML, browser
+    workflow, workflow condition or cross-phase hook no longer expands to
+    native function source. It stays literal.
+  - JSON Pointer and JSON Patch paths such as `/__proto__/x` in the A2UI
+    and AG-UI adapters can no longer write to `Object.prototype`.
+  - Required-property checks in contract, enterprise-integration and MCP
+    schema validation no longer count an inherited `constructor` as
+    present.
+  - Name tables (agent names, gate rules, routing categories,
+    `aqe ruvector flags --profile`, faker paths and recovery playbook
+    services) no longer match inherited members. Thanks to @rudycelekli
+    for the recovery playbook fix.
+- **DAST scans fail when the target cannot be reached** ([#1092]): an
+  initial 401/403 now fails with `DAST_AUTHENTICATION_FAILED` and a 5xx
+  with `DAST_TARGET_UNAVAILABLE`. Before, an unreachable target could
+  produce a completed scan. Failed follow-up probes fail the scan, and a
+  failed scan is not stored as completed. Thanks to @rudycelekli.
+
+### Fixed
+
+- **Dreams no longer put memory writes at risk** ([#1060], [#1160]): a
+  dream does its work in memory and writes its results in one short
+  transaction at the end. An acknowledged `memory_store` made during a
+  dream is kept however the dream ends: it finishes, is cancelled, the
+  engine closes, stdin closes or the process is killed. `cancelDream()`,
+  `close()` and shutdown stop a dream at once and record it `interrupted`.
+  A second dream request while one runs is refused instead of interrupting
+  it. A cycle left `running` by a dead process is marked `interrupted`
+  (never deleted) after 11 minutes. Thanks to @pacphi for the report and
+  reproduction in [#1060].
+- **Slow child processes no longer freeze the MCP server** ([#1115],
+  [#1148]): git (defect prediction, task routing, the quality daemon's
+  watcher), `cloc`/`tokei` and test-runner listings for `code_index`, and
+  `npx agent-browser` for the browser tools now run asynchronously with
+  timeouts. A timeout stops the child's whole process group, so nothing is
+  left running. With a git that took 1 s per call, `fleet_status` used to
+  wait up to 12 s; now it answers in well under a second.
+- **Learning's success rate counts measured outcomes only** ([#1129],
+  [#1121], [#1142]): `aqe learning stats` said 100% after test runs with a
+  failing test. Now only a test run is a measured outcome (it passes when
+  every test passed, and both results are recorded), and the rate counts
+  runs, not rows. Completed calls, errors, hook-reported `--success` and
+  session-consolidation aggregates count as uses, not verdicts. Existing
+  rows are classified on read; nothing is deleted or rewritten. The
+  learning dashboard no longer shows an invented `0.5` learning rate or a
+  `100%` transfer rate, and patterns stored before 3.15.9 are kept but left
+  out of stats.
+- **Learning consolidation cannot lose patterns** ([#1106], [#1143]): a
+  merge now reads back every archived source and the merged pattern before
+  removing the sources. If any step fails, nothing is merged. A failed
+  domain or merge is reported as `status: 'partial'` with an `errors` list
+  instead of success. A dry run now predicts the same trims as a real run,
+  and a key scan that never ends stops with an error.
+- **Advertised commands run real handlers** ([#1125], [#1144]):
+  `aqe fleet run scan` runs a SAST scan on the target's JS/TS files,
+  `analyze` uses the coverage report that already exists for the target,
+  and `test` generates tests for the target's sources. `task_orchestrate`
+  routes `scan-security` to `sast-scan` and `assess-quality` to
+  `analyze-quality` when you pass `filePaths`. Requests that lack the
+  input a handler needs are refused with the tool to use instead; nothing
+  is estimated. `task_submit` with `sast-scan` now accepts plain path
+  strings.
+- **Index tasks run, or are refused up front** ([#1086], [#1134],
+  [#1159]): an inferred `index-code` task now runs the code-intelligence
+  handler with the paths it was given. Thanks to @rudycelekli.
+- **Queen slots are always handed on** ([#1127], [#1138], [#1140],
+  [#1152]): a slot freed while the queue drains goes to the next queued
+  task. Work stealing moves a task only to a domain that can run it and
+  never exceeds `maxConcurrentTasks`. A failure at dispatch publishes
+  `QueenTaskFailed` once and frees its slot once; a plugin that throws no
+  longer leaves its task `running`.
+- **Retries rerun tests inside `describe` blocks** ([#1141], [#1151]): the
+  retry filter only ever matched top-level tests. It now matches the full
+  name for Vitest, Jest and Mocha. A retry that selects no test is
+  reported as `unmatched` instead of counting as an attempt.
+- **Retry results are reported** ([#1130], [#1163]):
+  `test_execute_parallel` returns `retryStats` (retries run, now passing,
+  still failing, per test) and `aqe test execute` prints a `Retries:` line.
+- **`fleet_status` stays healthy during a test run** ([#1130], [#1163]):
+  the agent spawned for one task no longer marks the fleet `degraded`
+  while it runs or after it finishes. Real topology problems and failed
+  agents still degrade the status. `fleet_health({ detailed: true })`
+  shows the raw MinCut reading.
+- **Chaos wording is not run as tests** ([#1130], [#1163]): "Run chaos
+  resilience testing with fault injection" now gets chaos guidance from
+  `task_orchestrate` instead of being submitted as `execute-tests`.
+- **Dream archive and worker status are reported truthfully** ([#1116],
+  [#1155]): a stale insight with a NULL id no longer makes every retention
+  sweep fail. The generated `start-daemon.cjs` honours
+  `AQE_WORKERS_ENABLED` (environment or Claude settings files) and says
+  "started" only when the server is still running. MCP startup reports
+  workers as `starting` until they have started.
+- **Concurrent startups no longer fail with "database is locked" during a
+  schema migration** ([#1116], [#1155]): a migration takes the write lock
+  up front and waits for it.
+- **Defect predictions reach the background worker** ([#1088]): public
+  predictions are recorded in the shape the worker reads, history is
+  bounded to the newest 32 runs, and the newest result is no longer hidden
+  behind an old scan cap. Static scores are labelled as estimates. Thanks
+  to @rudycelekli.
+
+### Changed
+
+- **`task_orchestrate` and fleet responses:** `type` is now the handler
+  type that actually ran (for example `sast-scan`). The type inferred from
+  the description moves to the new field `inferredType`. Clients that read
+  `type` as the inferred type should read `inferredType`.
+- **`aqe fleet run` shows results and a verdict.** It prints the findings,
+  coverage or generated tests, and exits 1 with `Verdict: FAILED (…)` on a
+  critical or high finding, incomplete scan evidence, a failed quality
+  gate, coverage below 80% or an unreadable result. The count line now
+  says `Completed: N` instead of `Successful: N`.
+- **Payload paths are confined to the project root.** After `aqe init` in
+  a monorepo package, a sibling package such as `../b/tests/x.test.ts` is
+  refused. Set `AQE_PROJECT_ROOT=<repo root>` to let packages reach each
+  other.
+- **Interpolation no longer resolves inherited values.** `${constructor}`,
+  `${toString}` and similar placeholders stay literal unless you define
+  them.
+- **`enableBranching` is a deprecated no-op.** The option is still
+  accepted and logs a warning. `RVCOWBranchManager` is deprecated.
+- **Index tasks without `paths` are refused at submit.** `task_submit` and
+  `aqe task submit` with `index` or `index-code` need a non-empty `paths`
+  list, and `task_orchestrate` needs `filePaths`. Use `code_index` or
+  `aqe code index` to index a directory.
+- **`task_orchestrate` refuses `optimize-learning` from free text**,
+  because it overwrites the stored learned strategies. Use `task_submit`
+  with type `optimize-strategies`. `run-chaos`, `validate-contracts`,
+  `validate-requirements` and `test-accessibility` are refused with the
+  tool to use instead.
+- **Schema v14.** The `dream_insights_archive` table moves into the
+  versioned schema with an additive, idempotent migration. 3.15.8 and
+  3.15.9 still open a migrated database.
+- **Learning success rates count measured outcomes only.** Projects that
+  only have hook-reported outcomes now show "insufficient evidence"
+  instead of 100%. `aqe learning stats --json` reports `measuredOutcomes`
+  and `unmeasuredOutcomes`, and `patternSuccessRate` can be `null`.
+- **Git timeouts are reported as unavailable, never as 0.** A prediction
+  whose git history timed out carries a `warnings` entry, and its metrics
+  are not cached.
+
+### Known issues
+
+- `task_orchestrate` still fails on an install without an embedder (the
+  optional `@huggingface/transformers` package or `AQE_EMBEDDER_ENDPOINT`),
+  so its new routing is only reachable with one configured ([#1022]).
+- Payload path checks and the read that follows are not atomic, so a path
+  swapped between them is not caught yet ([#1161]).
+- Some direct `map[userKey]` lookups on plain objects remain to be audited
+  ([#1157]).
+- `aqe fleet run analyze` and `aqe coverage` can pass from a report that
+  covers only part of the target ([#1154]).
+- The daemon spawned by `start-daemon.cjs` exits on stdin EOF, so it never
+  stays up; it now says so instead of reporting "started" ([#1158]).
+- A rare "database is locked" on concurrent first open of a non-WAL
+  database ([#1164]).
+- Git timeout follow-ups: per-path deadlines and the watcher baseline
+  ([#1165]).
+- Queen follow-ups: a late `onComplete` can settle twice, and work stealing
+  rarely runs under the slot cap ([#1153]).
+- Learning outcome follow-ups: failures can still mint patterns, and
+  routing still uses completion-based success ([#1147]).
+- Pattern consolidation follow-ups: id-only read-back and no
+  compare-and-delete ([#1149]).
+
+[#1022]: https://github.com/proffesor-for-testing/agentic-qe/issues/1022
+[#1060]: https://github.com/proffesor-for-testing/agentic-qe/issues/1060
+[#1086]: https://github.com/proffesor-for-testing/agentic-qe/pull/1086
+[#1088]: https://github.com/proffesor-for-testing/agentic-qe/pull/1088
+[#1092]: https://github.com/proffesor-for-testing/agentic-qe/pull/1092
+[#1106]: https://github.com/proffesor-for-testing/agentic-qe/issues/1106
+[#1115]: https://github.com/proffesor-for-testing/agentic-qe/issues/1115
+[#1116]: https://github.com/proffesor-for-testing/agentic-qe/issues/1116
+[#1118]: https://github.com/proffesor-for-testing/agentic-qe/issues/1118
+[#1121]: https://github.com/proffesor-for-testing/agentic-qe/issues/1121
+[#1122]: https://github.com/proffesor-for-testing/agentic-qe/issues/1122
+[#1125]: https://github.com/proffesor-for-testing/agentic-qe/issues/1125
+[#1126]: https://github.com/proffesor-for-testing/agentic-qe/issues/1126
+[#1127]: https://github.com/proffesor-for-testing/agentic-qe/issues/1127
+[#1129]: https://github.com/proffesor-for-testing/agentic-qe/issues/1129
+[#1130]: https://github.com/proffesor-for-testing/agentic-qe/issues/1130
+[#1132]: https://github.com/proffesor-for-testing/agentic-qe/pull/1132
+[#1134]: https://github.com/proffesor-for-testing/agentic-qe/issues/1134
+[#1136]: https://github.com/proffesor-for-testing/agentic-qe/issues/1136
+[#1138]: https://github.com/proffesor-for-testing/agentic-qe/pull/1138
+[#1139]: https://github.com/proffesor-for-testing/agentic-qe/pull/1139
+[#1140]: https://github.com/proffesor-for-testing/agentic-qe/issues/1140
+[#1141]: https://github.com/proffesor-for-testing/agentic-qe/issues/1141
+[#1142]: https://github.com/proffesor-for-testing/agentic-qe/pull/1142
+[#1143]: https://github.com/proffesor-for-testing/agentic-qe/pull/1143
+[#1144]: https://github.com/proffesor-for-testing/agentic-qe/pull/1144
+[#1147]: https://github.com/proffesor-for-testing/agentic-qe/issues/1147
+[#1148]: https://github.com/proffesor-for-testing/agentic-qe/pull/1148
+[#1149]: https://github.com/proffesor-for-testing/agentic-qe/issues/1149
+[#1151]: https://github.com/proffesor-for-testing/agentic-qe/pull/1151
+[#1152]: https://github.com/proffesor-for-testing/agentic-qe/pull/1152
+[#1153]: https://github.com/proffesor-for-testing/agentic-qe/issues/1153
+[#1154]: https://github.com/proffesor-for-testing/agentic-qe/issues/1154
+[#1155]: https://github.com/proffesor-for-testing/agentic-qe/pull/1155
+[#1156]: https://github.com/proffesor-for-testing/agentic-qe/pull/1156
+[#1157]: https://github.com/proffesor-for-testing/agentic-qe/issues/1157
+[#1158]: https://github.com/proffesor-for-testing/agentic-qe/issues/1158
+[#1159]: https://github.com/proffesor-for-testing/agentic-qe/pull/1159
+[#1160]: https://github.com/proffesor-for-testing/agentic-qe/pull/1160
+[#1161]: https://github.com/proffesor-for-testing/agentic-qe/issues/1161
+[#1162]: https://github.com/proffesor-for-testing/agentic-qe/pull/1162
+[#1163]: https://github.com/proffesor-for-testing/agentic-qe/pull/1163
+[#1164]: https://github.com/proffesor-for-testing/agentic-qe/issues/1164
+[#1165]: https://github.com/proffesor-for-testing/agentic-qe/issues/1165
+
 ## [3.15.9] - 2026-10-17
 
 Tasks no longer get stuck in `running` and quietly use up Queen slots.

package/assets/skills/skills-manifest.json

@@ -940,7 +940,7 @@
   },
   "metadata": {
     "generatedBy": "Agentic QE Fleet",
-    "fleetVersion": "3.15.9",
+    "fleetVersion": "3.15.10",
     "manifestVersion": "1.4.0",
     "lastUpdated": "2026-04-13T00:00:00.000Z",
     "contributors": [

package/dist/adapters/a2ui/catalog/component-schemas.js

@@ -965,7 +965,8 @@ export function validateComponent(component, componentType) {
     // Check required properties
     if (schema.required) {
         for (const prop of schema.required) {
-            if (!(prop in comp)) {
+            // #1136: own properties only; an inherited `constructor` is not present.
+            if (!Object.hasOwn(comp, prop)) {
                 errors.push({
                     path: prop,
                     message: `Missing required property: ${prop}`,

package/dist/adapters/a2ui/data/json-pointer-resolver.js

@@ -7,6 +7,7 @@
  * @see https://www.rfc-editor.org/rfc/rfc6901
  * @module adapters/a2ui/data/json-pointer-resolver
  */
+import { setOwn } from '../../../shared/utils/safe-record.js';
 // ============================================================================
 // Types
 // ============================================================================
@@ -176,7 +177,9 @@ export function resolvePointerWithInfo(data, pointer) {
         else {
             // Object access
             const obj = current;
-            if (!(segment in obj)) {
+            // #1136: own properties only; `/constructor` or `/__proto__` does not
+            // resolve to an inherited member.
+            if (!Object.hasOwn(obj, segment)) {
                 return { found: false, value: undefined };
             }
             lastKey = segment;
@@ -239,9 +242,11 @@ export function setAtPointer(data, pointer, value) {
         }
         else {
             const obj = current;
-            if (!(segment in obj)) {
+            // #1136: own properties only, and created as own data properties, so
+            // `/__proto__/x` cannot walk into and write Object.prototype.
+            if (!Object.hasOwn(obj, segment)) {
                 // Auto-create intermediate objects
-                obj[segment] = {};
+                setOwn(obj, segment, {});
             }
             current = obj[segment];
         }
@@ -269,7 +274,7 @@ export function setAtPointer(data, pointer, value) {
         }
     }
     else {
-        current[lastSegment] = value;
+        setOwn(current, lastSegment, value);
     }
 }
 /**
@@ -304,7 +309,7 @@ export function deleteAtPointer(data, pointer) {
     }
     else {
         const obj = parent;
-        if (!(lastSegment in obj)) {
+        if (!Object.hasOwn(obj, lastSegment)) {
             return false;
         }
         delete obj[lastSegment];

package/dist/adapters/a2ui/integration/agui-sync.js

@@ -8,6 +8,7 @@
  */
 import { EventEmitter } from 'events';
 import { v4 as uuidv4 } from 'uuid';
+import { getOwn, setOwn } from '../../../shared/utils/safe-record.js';
 /**
  * Default configuration
  */
@@ -473,7 +474,8 @@ export class AGUISyncService extends EventEmitter {
         const parts = extractor.split('.');
         let value = payload;
         for (const part of parts) {
-            if (value && typeof value === 'object' && part in value) {
+            // #1136: own properties only.
+            if (value && typeof value === 'object' && Object.hasOwn(value, part)) {
                 value = value[part];
             }
             else {
@@ -498,7 +500,7 @@ export class AGUISyncService extends EventEmitter {
             if (typeof current !== 'object') {
                 return undefined;
             }
-            current = current[part];
+            current = getOwn(current, part);
         }
         return current;
     }
@@ -512,14 +514,16 @@ export class AGUISyncService extends EventEmitter {
         }
         const parts = path.split('/').filter(Boolean);
         let current = obj;
+        // #1136: own properties only, created as own data properties, so
+        // `/__proto__/x` cannot walk into and write Object.prototype.
         for (let i = 0; i < parts.length - 1; i++) {
             const part = parts[i];
-            if (!(part in current) || typeof current[part] !== 'object') {
-                current[part] = {};
+            if (!Object.hasOwn(current, part) || typeof current[part] !== 'object' || current[part] === null) {
+                setOwn(current, part, {});
             }
             current = current[part];
         }
-        current[parts[parts.length - 1]] = value;
+        setOwn(current, parts[parts.length - 1], value);
     }
     /**
      * Delete value at JSON Pointer path
@@ -532,7 +536,7 @@ export class AGUISyncService extends EventEmitter {
         let current = obj;
         for (let i = 0; i < parts.length - 1; i++) {
             const part = parts[i];
-            if (!(part in current) || typeof current[part] !== 'object') {
+            if (!Object.hasOwn(current, part) || typeof current[part] !== 'object') {
                 return;
             }
             current = current[part];

package/dist/adapters/a2ui/integration/surface-state-bridge.js

@@ -8,6 +8,7 @@
  */
 import { EventEmitter } from 'events';
 import { v4 as uuidv4 } from 'uuid';
+import { getOwn, setOwn } from '../../../shared/utils/safe-record.js';
 import { createSurfaceGenerator, createComponentBuilder, } from '../renderer/index.js';
 /**
  * Default configuration
@@ -461,7 +462,8 @@ export class SurfaceStateBridge extends EventEmitter {
             if (typeof current !== 'object') {
                 return undefined;
             }
-            current = current[part];
+            // #1136: own properties only.
+            current = getOwn(current, part);
         }
         return current;
     }
@@ -475,14 +477,16 @@ export class SurfaceStateBridge extends EventEmitter {
         }
         const parts = path.split('/').filter(Boolean);
         let current = obj;
+        // #1136: own properties only, created as own data properties, so
+        // `/__proto__/x` cannot walk into and write Object.prototype.
         for (let i = 0; i < parts.length - 1; i++) {
             const part = parts[i];
-            if (!(part in current) || typeof current[part] !== 'object' || current[part] === null) {
-                current[part] = {};
+            if (!Object.hasOwn(current, part) || typeof current[part] !== 'object' || current[part] === null) {
+                setOwn(current, part, {});
             }
             current = current[part];
         }
-        current[parts[parts.length - 1]] = value;
+        setOwn(current, parts[parts.length - 1], value);
     }
     /**
      * Delete value at JSON Pointer path
@@ -495,7 +499,7 @@ export class SurfaceStateBridge extends EventEmitter {
         let current = obj;
         for (let i = 0; i < parts.length - 1; i++) {
             const part = parts[i];
-            if (!(part in current) || typeof current[part] !== 'object') {
+            if (!Object.hasOwn(current, part) || typeof current[part] !== 'object') {
                 return;
             }
             current = current[part];

package/dist/adapters/ag-ui/json-patch.js

@@ -11,6 +11,7 @@
  */
 import * as fastJsonPatch from 'fast-json-patch';
 import { toErrorMessage } from '../../shared/error-utils.js';
+import { getOwn, setOwn } from '../../shared/utils/safe-record.js';
 // ============================================================================
 // Path Utilities (RFC 6901 JSON Pointer)
 // ============================================================================
@@ -79,7 +80,8 @@ export function getValueAtPath(document, path) {
             current = current[index];
         }
         else if (typeof current === 'object') {
-            current = current[token];
+            // #1136: own properties only; `/constructor` is not a path.
+            current = getOwn(current, token);
         }
         else {
             return undefined;
@@ -108,7 +110,7 @@ export function pathExists(document, path) {
             current = current[index];
         }
         else if (typeof current === 'object') {
-            if (!(token in current)) {
+            if (!Object.hasOwn(current, token)) {
                 return false;
             }
             current = current[token];
@@ -141,7 +143,9 @@ export function setValueAtPath(document, path, value) {
             current = current[index];
         }
         else if (typeof current === 'object') {
-            if (!(token in current)) {
+            // #1136: own properties only, so `/__proto__/x` cannot walk into and
+            // write Object.prototype.
+            if (!Object.hasOwn(current, token)) {
                 throw new JsonPatchError(`Path does not exist: ${path}`, 'PATH_NOT_FOUND', { path });
             }
             current = current[token];
@@ -158,7 +162,7 @@ export function setValueAtPath(document, path, value) {
         current[index] = value;
     }
     else if (typeof current === 'object' && current !== null) {
-        current[lastToken] = value;
+        setOwn(current, lastToken, value);
     }
     else {
         throw new JsonPatchError(`Cannot set value at path: ${path}`, 'INVALID_OPERATION', { path });
@@ -186,7 +190,7 @@ export function deleteValueAtPath(document, path) {
             current = current[index];
         }
         else if (typeof current === 'object') {
-            current = current[token];
+            current = getOwn(current, token);
         }
         else {
             throw new JsonPatchError(`Cannot traverse non-object: ${path}`, 'INVALID_PATH', { path });
@@ -200,7 +204,7 @@ export function deleteValueAtPath(document, path) {
         current.splice(index, 1);
     }
     else if (typeof current === 'object' && current !== null) {
-        if (!(lastToken in current)) {
+        if (!Object.hasOwn(current, lastToken)) {
             throw new JsonPatchError(`Path does not exist: ${path}`, 'PATH_NOT_FOUND', { path });
         }
         delete current[lastToken];

package/dist/audit/witness-chain.d.ts

@@ -11,7 +11,7 @@ import { GENESIS_PREV_HASH, sha256, shake256, hashWith, serializeEntry, signatur
 import { type VerifyOptions, type VerifyResult } from './witness-chain-verifier.js';
 export type { VerifyOptions, VerifyResult, ChainStatus, TamperReason, WitnessForkInfo, ReanchorForkRecord, } from './witness-chain-verifier.js';
 export { CHAIN_REANCHOR_ACTION } from './witness-chain-verifier.js';
-export type WitnessActionType = 'PATTERN_CREATE' | 'PATTERN_UPDATE' | 'PATTERN_PROMOTE' | 'PATTERN_QUARANTINE' | 'DREAM_MERGE' | 'DREAM_DISCARD' | 'QUALITY_GATE_PASS' | 'QUALITY_GATE_FAIL' | 'ROUTING_DECISION' | 'FINDING_DELIVERED' | 'FINDING_BLOCKED' | 'BRANCH_MERGE' | 'BRANCH_DISCARD' | 'HEBBIAN_PENALTY' | 'KEY_ROTATION' | 'BRAIN_IMPORT' | 'CHAIN_REANCHOR';
+export type WitnessActionType = 'PATTERN_CREATE' | 'PATTERN_UPDATE' | 'PATTERN_PROMOTE' | 'PATTERN_QUARANTINE' | 'DREAM_MERGE' | 'DREAM_DISCARD' | 'DREAM_COMMIT' | 'QUALITY_GATE_PASS' | 'QUALITY_GATE_FAIL' | 'ROUTING_DECISION' | 'FINDING_DELIVERED' | 'FINDING_BLOCKED' | 'BRANCH_MERGE' | 'BRANCH_DISCARD' | 'HEBBIAN_PENALTY' | 'KEY_ROTATION' | 'BRAIN_IMPORT' | 'CHAIN_REANCHOR';
 export interface WitnessEntry {
     id: number;
     prev_hash: string;

package/dist/cli/bundle.js

@@ -1,18 +1,18 @@
 #!/usr/bin/env node
-import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.9");process.exit(0)}
-import{b as x}from"./chunks/chunk-YZYDTABJ.js";import{b as v,c as E,e as A}from"./chunks/chunk-32UTLDNY.js";import{d as P}from"./chunks/chunk-REUFWGMA.js";import{a as C}from"./chunks/chunk-JNNZK7KH.js";import{b as S,c as y,d as I}from"./chunks/chunk-2BA45H64.js";import{a as W}from"./chunks/chunk-KTSLTZSG.js";import{b as k,c as F}from"./chunks/chunk-O3JLOVZX.js";import"./chunks/chunk-DGTLJNJH.js";import{a as g,e as T}from"./chunks/chunk-N3KEY4XJ.js";import{Q as w,S as H}from"./chunks/chunk-2I2UPJS7.js";import{h as L}from"./chunks/chunk-PX2B5TS2.js";import"./chunks/chunk-4V27J6YN.js";import"./chunks/chunk-H3KBIWTO.js";import"./chunks/chunk-OXZLKP6C.js";import"./chunks/chunk-SNBYYO6F.js";import"./chunks/chunk-HZ5NC6U5.js";T();H();import{createRequire as G}from"node:module";import{Command as j}from"commander";import l from"chalk";W();F();I();var b=!1;function h(){if(!b){b=!0;try{P()}catch{}try{L()}catch{}try{S()}catch{}}}function R(e,n,c,a){let m=e.command(n).description(c);if(a)for(let u of a)m.alias(u);return m.helpOption(!1),m.allowUnknownOption(!0),m.allowExcessArguments(!0),m}function D(e,n){let c=e.commands,a=c.indexOf(n);a>=0&&c.splice(a,1)}function i(e,n){let c=R(e,n.name,n.description,n.aliases);c.action(async()=>{try{let a=await n.factory();D(e,c),e.addCommand(a),await e.parseAsync(process.argv)}catch(a){console.error(`Failed to load command '${n.name}':`,a instanceof Error?a.message:a),process.exit(1)}})}function d(e,n,c,a,m,u){let f=R(e,n,c,u);f.action(async()=>{try{let p=await a();D(e,f),p.register(e,m),await e.parseAsync(process.argv)}catch(p){console.error(`Failed to load command '${n}':`,p instanceof Error?p.message:p),process.exit(1)}})}I();A();process.on("exit",h);var t={kernel:null,queen:null,router:null,workflowOrchestrator:null,scheduledWorkflows:new Map,persistentScheduler:null,initialized:!1};function q(e,n){let c=e.getDomainAPI("visual-accessibility");if(c?.registerWorkflowActions)try{c.registerWorkflowActions(n)}catch(m){console.error(l.yellow(`  Warning: Could not register visual-accessibility workflow actions: ${g(m)}`))}let a=e.getDomainAPI("requirements-validation");if(a?.registerWorkflowActions)try{a.registerWorkflowActions(n)}catch(m){console.error(l.yellow(`  Warning: Could not register requirements-validation workflow actions: ${g(m)}`))}}async function B(){let{QEKernelImpl:e}=await import("./chunks/kernel-N7PJ6FCE.js"),{CrossDomainEventRouter:n}=await import("./chunks/cross-domain-router-7UKODQWG.js"),{DefaultProtocolExecutor:c}=await import("./chunks/protocol-executor-QW6XN6QN.js"),{WorkflowOrchestrator:a}=await import("./chunks/workflow-orchestrator-4GAW7HNZ.js"),{createQueenCoordinator:m}=await import("./chunks/queen-coordinator-S4U4MKK2.js"),{createPersistentScheduler:u}=await import("./chunks/scheduler-XXMJCH24.js"),{loadCLIDomainPlugins:f}=await import("./chunks/domain-plugins-GJRWOHQP.js");t.kernel=new e({maxConcurrentAgents:15,memoryBackend:"sqlite",hnswEnabled:!0,lazyLoading:!0,enabledDomains:[...C],enableExperienceBridge:!1}),await t.kernel.initialize();let p=await f(t.kernel.plugins);t.router=new n(t.kernel.eventBus),await t.router.initialize();let O=_=>t.kernel.getDomainAPI(_),V=new c(t.kernel.eventBus,t.kernel.memory,O);t.workflowOrchestrator=new a(t.kernel.eventBus,t.kernel.memory,t.kernel.coordinator),await t.workflowOrchestrator.initialize(),q(t.kernel,t.workflowOrchestrator),t.persistentScheduler=u(),t.queen=m(t.kernel,t.router,V,void 0,p),await t.queen.initialize();let{adoptExternalFleet:M}=await import("./chunks/core-handlers-JSRXQWPE.js");M({kernel:t.kernel,queen:t.queen,router:t.router,workflowOrchestrator:t.workflowOrchestrator}),t.initialized=!0}async function Q(){if(t.initialized&&t.kernel&&t.queen)return!0;let e=await import("fs"),n=await import("path"),{findProjectRoot:c}=await import("./chunks/project-root-X72FSM2F.js"),a=n.join(c(),".agentic-qe");return e.existsSync(a)?s():(console.error(l.red(`
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.10");process.exit(0)}
+import{b as x}from"./chunks/chunk-CZ2IF6MC.js";import{b as v,c as E,e as A}from"./chunks/chunk-7PJIR4ST.js";import{d as P}from"./chunks/chunk-LMS3Y7JD.js";import{a as C}from"./chunks/chunk-NSHU347M.js";import{b as S,c as y,d as I}from"./chunks/chunk-AH3ZD3NJ.js";import{a as W}from"./chunks/chunk-HOZUDE4C.js";import"./chunks/chunk-ATHWDAXB.js";import{c as k,d as F}from"./chunks/chunk-N6PIIK6G.js";import"./chunks/chunk-WSF24I3D.js";import{a as g,e as T}from"./chunks/chunk-GHBNRMSJ.js";import{Q as w,S as H}from"./chunks/chunk-XLZYRTNO.js";import{h as L}from"./chunks/chunk-NVYIZCSR.js";import"./chunks/chunk-EWFECZ2U.js";import"./chunks/chunk-VWNFAW2M.js";import"./chunks/chunk-V2M2XCR5.js";import"./chunks/chunk-KOBVYY6H.js";import"./chunks/chunk-OY2AHLSF.js";T();H();import{createRequire as G}from"node:module";import{Command as j}from"commander";import l from"chalk";W();F();I();var b=!1;function h(){if(!b){b=!0;try{P()}catch{}try{L()}catch{}try{S()}catch{}}}function R(e,n,c,a){let m=e.command(n).description(c);if(a)for(let u of a)m.alias(u);return m.helpOption(!1),m.allowUnknownOption(!0),m.allowExcessArguments(!0),m}function D(e,n){let c=e.commands,a=c.indexOf(n);a>=0&&c.splice(a,1)}function i(e,n){let c=R(e,n.name,n.description,n.aliases);c.action(async()=>{try{let a=await n.factory();D(e,c),e.addCommand(a),await e.parseAsync(process.argv)}catch(a){console.error(`Failed to load command '${n.name}':`,a instanceof Error?a.message:a),process.exit(1)}})}function d(e,n,c,a,m,u){let f=R(e,n,c,u);f.action(async()=>{try{let p=await a();D(e,f),p.register(e,m),await e.parseAsync(process.argv)}catch(p){console.error(`Failed to load command '${n}':`,p instanceof Error?p.message:p),process.exit(1)}})}I();A();process.on("exit",h);var t={kernel:null,queen:null,router:null,workflowOrchestrator:null,scheduledWorkflows:new Map,persistentScheduler:null,initialized:!1};function q(e,n){let c=e.getDomainAPI("visual-accessibility");if(c?.registerWorkflowActions)try{c.registerWorkflowActions(n)}catch(m){console.error(l.yellow(`  Warning: Could not register visual-accessibility workflow actions: ${g(m)}`))}let a=e.getDomainAPI("requirements-validation");if(a?.registerWorkflowActions)try{a.registerWorkflowActions(n)}catch(m){console.error(l.yellow(`  Warning: Could not register requirements-validation workflow actions: ${g(m)}`))}}async function B(){let{QEKernelImpl:e}=await import("./chunks/kernel-JQK7PRAI.js"),{CrossDomainEventRouter:n}=await import("./chunks/cross-domain-router-N3AIEM3B.js"),{DefaultProtocolExecutor:c}=await import("./chunks/protocol-executor-RNZNZP3A.js"),{WorkflowOrchestrator:a}=await import("./chunks/workflow-orchestrator-UKHEJVSK.js"),{createQueenCoordinator:m}=await import("./chunks/queen-coordinator-4452SXZQ.js"),{createPersistentScheduler:u}=await import("./chunks/scheduler-XFLJSFIU.js"),{loadCLIDomainPlugins:f}=await import("./chunks/domain-plugins-7TARX2XF.js");t.kernel=new e({maxConcurrentAgents:15,memoryBackend:"sqlite",hnswEnabled:!0,lazyLoading:!0,enabledDomains:[...C],enableExperienceBridge:!1}),await t.kernel.initialize();let p=await f(t.kernel.plugins);t.router=new n(t.kernel.eventBus),await t.router.initialize();let O=_=>t.kernel.getDomainAPI(_),V=new c(t.kernel.eventBus,t.kernel.memory,O);t.workflowOrchestrator=new a(t.kernel.eventBus,t.kernel.memory,t.kernel.coordinator),await t.workflowOrchestrator.initialize(),q(t.kernel,t.workflowOrchestrator),t.persistentScheduler=u(),t.queen=m(t.kernel,t.router,V,void 0,p),await t.queen.initialize();let{adoptExternalFleet:M}=await import("./chunks/core-handlers-V243GY7X.js");M({kernel:t.kernel,queen:t.queen,router:t.router,workflowOrchestrator:t.workflowOrchestrator}),t.initialized=!0}async function Q(){if(t.initialized&&t.kernel&&t.queen)return!0;let e=await import("fs"),n=await import("path"),{findProjectRoot:c}=await import("./chunks/project-root-JCAUNL6O.js"),a=n.join(c(),".agentic-qe");return e.existsSync(a)?s():(console.error(l.red(`
 Error: AQE system not initialized in this directory.`)),console.log(l.yellow("Run `aqe init` first to set up this project.\n")),process.exitCode=1,!1)}async function s(){if(t.initialized&&t.kernel&&t.queen)return!0;let e=E(1);e&&process.stderr.write(l.gray("Auto-initializing v3 system...")+`
 `);let n=3e4,c=new Promise((a,m)=>{setTimeout(()=>m(new Error("Initialization timeout after 30 seconds")),n)});try{return await Promise.race([B(),c]),e&&process.stderr.write(l.green("System ready")+`
 
-`),!0}catch(a){return a.message.includes("timeout")?(console.error(l.red("Initialization timed out after 30 seconds.")),console.log(l.yellow("Try running `aqe init` manually."))):(console.error(l.red("Failed to auto-initialize:"),a),console.log(l.yellow("Try running `aqe init` manually."))),process.exitCode=1,!1}}async function o(e=0){try{t.workflowOrchestrator&&t.workflowOrchestrator.dispose().catch(()=>{}),t.queen&&t.queen.dispose().catch(()=>{}),t.router&&t.router.dispose().catch(()=>{}),t.kernel&&t.kernel.dispose().catch(()=>{})}catch{}h(),process.exit(e)}var r=new j,N=G(import.meta.url),de=N("../../package.json").version,z="3.15.9";r.name("aqe").description("Agentic QE - Domain-Driven Quality Engineering").version(z).addHelpText("after",`
+`),!0}catch(a){return a.message.includes("timeout")?(console.error(l.red("Initialization timed out after 30 seconds.")),console.log(l.yellow("Try running `aqe init` manually."))):(console.error(l.red("Failed to auto-initialize:"),a),console.log(l.yellow("Try running `aqe init` manually."))),process.exitCode=1,!1}}async function o(e=0){try{t.workflowOrchestrator&&t.workflowOrchestrator.dispose().catch(()=>{}),t.queen&&t.queen.dispose().catch(()=>{}),t.router&&t.router.dispose().catch(()=>{}),t.kernel&&t.kernel.dispose().catch(()=>{})}catch{}h(),process.exit(e)}var r=new j,N=G(import.meta.url),de=N("../../package.json").version,z="3.15.10";r.name("aqe").description("Agentic QE - Domain-Driven Quality Engineering").version(z).addHelpText("after",`
 Environment:
   AQE_LOG_LEVEL   Internal log level: debug | info | warn | error | silent (default: warn)
   LOG_LEVEL       Same as AQE_LOG_LEVEL; AQE_LOG_LEVEL takes precedence
   AQE_VERBOSE=1   Shorthand for info-level logging (full system-init output)
-Diagnostics are written to stderr; stdout carries command output only.`);r.hook("preAction",(e,n)=>{v(n.opts())});d(r,"init","Initialize the AQE v3 system",()=>import("./chunks/init-handler-L4KJHVWS.js").then(e=>e.createInitHandler(o)),t);d(r,"status","Show system status",()=>import("./chunks/status-handler-K72XZE4T.js").then(e=>e.createStatusHandler(o,Q)),t);d(r,"health","Check system health",()=>import("./chunks/status-handler-K72XZE4T.js").then(e=>e.createHealthHandler(o,Q)),t);d(r,"task","Manage QE tasks",()=>import("./chunks/task-handler-24S3WFVJ.js").then(e=>e.createTaskHandler(o,s)),t);d(r,"agent","Manage QE agents",()=>import("./chunks/agent-handler-RIYHTHVZ.js").then(e=>e.createAgentHandler(o,s)),t);d(r,"domain","Domain operations",()=>import("./chunks/domain-handler-55ZVYODR.js").then(e=>e.createDomainHandler(o,s)),t);d(r,"protocol","Execute coordination protocols",()=>import("./chunks/protocol-handler-BNRONTQV.js").then(e=>e.createProtocolHandler(o,s)),t);d(r,"brain","Export, import, and inspect QE brain state",()=>import("./chunks/brain-handler-452WCPZC.js").then(e=>e.createBrainHandler(o,s)),t);d(r,"hypergraph","Query the code knowledge hypergraph",()=>import("./chunks/hypergraph-handler-DUMF6SJV.js").then(e=>e.createHypergraphHandler(o,s)),t,["hg"]);d(r,"heartbeat","Manage the token-free heartbeat scheduler",()=>import("./chunks/heartbeat-handler-ZMM53NDY.js").then(e=>e.createHeartbeatHandler(o)),t);d(r,"routing","View routing performance, economics, and accuracy",()=>import("./chunks/routing-handler-WM33ZILE.js").then(e=>e.createRoutingHandler(o)),t);i(r,{name:"workflow",description:"Manage QE workflows and pipelines (ADR-041)",factory:()=>import("./chunks/workflow-QMZPAWQW.js").then(e=>e.createWorkflowCommand(t,o,s))});i(r,{name:"test",description:"Test generation, execution, scheduling, and load testing",factory:()=>import("./chunks/test-XFSGQELD.js").then(e=>e.createTestCommand(t,o,s))});i(r,{name:"coverage",description:"Coverage analysis shortcut",factory:()=>import("./chunks/coverage-VWKTWZ6D.js").then(e=>e.createCoverageCommand(t,o,s))});i(r,{name:"quality",description:"Quality assessment shortcut",factory:()=>import("./chunks/quality-NH2QA4D4.js").then(e=>e.createQualityCommand(t,o,s))});i(r,{name:"quality-gate",description:"Two-gate, three-valued quality verdict against a pinned checklist (ADR-119)",factory:()=>import("./chunks/quality-gate-JTKLF7GW.js").then(e=>e.createQualityGateCommand(t,o,s))});i(r,{name:"security",description:"Security scanning and URL validation",factory:()=>import("./chunks/security-AUDTRX3I.js").then(e=>e.createSecurityCommand(t,o,s))});i(r,{name:"arena",description:"Competitive test-strategy tournaments (ADR-104)",factory:()=>import("./chunks/arena-YAJZX6MC.js").then(e=>e.createArenaCommand(t,o,s))});i(r,{name:"code",description:"Code intelligence analysis",factory:()=>import("./chunks/code-ONKLMVQ2.js").then(e=>e.createCodeCommand(t,o,s))});i(r,{name:"completions",description:"Generate shell completions for aqe",factory:()=>import("./chunks/completions-MHX7GCC7.js").then(e=>e.createCompletionsCommand(o))});i(r,{name:"upgrade",description:"Detect optional native bindings and recommend install / flag changes",factory:()=>import("./chunks/upgrade-4ABM72T4.js").then(e=>e.createUpgradeCommand(o))});i(r,{name:"fleet",description:"Fleet operations with multi-agent progress tracking",factory:()=>import("./chunks/fleet-ADL57COA.js").then(e=>e.createFleetCommand(t,o,s,q))});i(r,{name:"validate",description:"Validation commands for skills and agents",factory:()=>import("./chunks/validate-swarm-TODOUWNN.js").then(e=>e.createValidateSwarmCommand(t,o,s))});i(r,{name:"skill",description:"Skill validation and reporting (ADR-056)",factory:()=>import("./chunks/validate-UDJCWKXI.js").then(e=>e.createValidateCommand(t,o,s))});i(r,{name:"eval",description:"Run skill evaluation suites in parallel",factory:()=>import("./chunks/eval-GO22R4OZ.js").then(e=>e.createEvalCommand())});i(r,{name:"ci",description:"CI/CD pipeline orchestration",factory:()=>import("./chunks/ci-7SGRCFPS.js").then(e=>e.createCICommand(t,o,s))});i(r,{name:"token-usage",description:"View and analyze token consumption metrics (ADR-042)",factory:()=>import("./chunks/token-usage-VLQ6WO2L.js").then(e=>e.createTokenUsageCommand())});i(r,{name:"llm",description:"LLM Router management (ADR-043)",factory:()=>import("./chunks/llm-router-ZFMORP36.js").then(e=>e.createLLMRouterCommand())});i(r,{name:"sync",description:"Sync local learning data to cloud PostgreSQL",factory:()=>import("./chunks/sync-VBD5Y3E2.js").then(e=>e.createSyncCommands())});i(r,{name:"hooks",description:"Self-learning QE hooks for pattern recognition and guidance",factory:()=>import("./chunks/hooks-X62O7TJO.js").then(e=>e.createHooksCommand())});i(r,{name:"learning",description:"AQE self-learning system management (standalone, no claude-flow required)",factory:()=>import("./chunks/learning-4IEEOHJS.js").then(e=>e.createLearningCommand())});i(r,{name:"memory",description:"Memory store, retrieve, search, and delete operations",factory:()=>Promise.all([import("./chunks/memory-W5FZGVAD.js"),import("./chunks/standalone-memory-XNOAI4G4.js")]).then(([e,n])=>e.createMemoryCommand(t,o,n.createEnsureMemoryBackend(t)))});i(r,{name:"mcp",description:"Start the MCP protocol server for Claude Code integration",factory:()=>import("./chunks/mcp-CRZKZE37.js").then(e=>e.createMcpCommand())});i(r,{name:"platform",description:"Manage coding agent platform configurations",factory:()=>import("./chunks/platform-KJDABL5C.js").then(e=>e.createPlatformCommand())});i(r,{name:"prove",description:"Generate a verifiable Proof-of-Quality attestation",factory:()=>import("./chunks/prove-ELLL6XMX.js").then(e=>e.createProveCommand(t,o,s))});i(r,{name:"ruvector",description:"RuVector integration management",factory:()=>import("./chunks/ruvector-commands-BBLXEA7A.js").then(e=>e.createRuVectorCommand())});i(r,{name:"audit",description:"Witness chain audit trail management",factory:()=>import("./chunks/audit-7ZNOXWP3.js").then(e=>e.createAuditCommand(t,o,s))});i(r,{name:"pipeline",description:"Manage YAML deterministic pipelines (Imp-9)",factory:()=>import("./chunks/pipeline-5LMLBIJ7.js").then(e=>e.createPipelineCommand(t,o,s))});i(r,{name:"plugin",description:"Manage external QE domain plugins",factory:()=>import("./chunks/plugin-V4KSBVVM.js").then(e=>e.createPluginCommand())});i(r,{name:"daemon",description:"Manage the QE Quality Daemon",factory:()=>import("./chunks/daemon-SHWJSJW5.js").then(e=>e.createDaemonCommand())});process.on("SIGINT",async()=>{y("SIGINT")||(console.log(l.yellow(`
+Diagnostics are written to stderr; stdout carries command output only.`);r.hook("preAction",(e,n)=>{v(n.opts())});d(r,"init","Initialize the AQE v3 system",()=>import("./chunks/init-handler-MPRGWMOE.js").then(e=>e.createInitHandler(o)),t);d(r,"status","Show system status",()=>import("./chunks/status-handler-Z2BP6EOG.js").then(e=>e.createStatusHandler(o,Q)),t);d(r,"health","Check system health",()=>import("./chunks/status-handler-Z2BP6EOG.js").then(e=>e.createHealthHandler(o,Q)),t);d(r,"task","Manage QE tasks",()=>import("./chunks/task-handler-43PYE75J.js").then(e=>e.createTaskHandler(o,s)),t);d(r,"agent","Manage QE agents",()=>import("./chunks/agent-handler-SVXSHEET.js").then(e=>e.createAgentHandler(o,s)),t);d(r,"domain","Domain operations",()=>import("./chunks/domain-handler-YOYLBYJE.js").then(e=>e.createDomainHandler(o,s)),t);d(r,"protocol","Execute coordination protocols",()=>import("./chunks/protocol-handler-BQRYMUTG.js").then(e=>e.createProtocolHandler(o,s)),t);d(r,"brain","Export, import, and inspect QE brain state",()=>import("./chunks/brain-handler-ADBBJPYW.js").then(e=>e.createBrainHandler(o,s)),t);d(r,"hypergraph","Query the code knowledge hypergraph",()=>import("./chunks/hypergraph-handler-VINJRAID.js").then(e=>e.createHypergraphHandler(o,s)),t,["hg"]);d(r,"heartbeat","Manage the token-free heartbeat scheduler",()=>import("./chunks/heartbeat-handler-EM2URCYZ.js").then(e=>e.createHeartbeatHandler(o)),t);d(r,"routing","View routing performance, economics, and accuracy",()=>import("./chunks/routing-handler-DST7BVCU.js").then(e=>e.createRoutingHandler(o)),t);i(r,{name:"workflow",description:"Manage QE workflows and pipelines (ADR-041)",factory:()=>import("./chunks/workflow-EOVVCN2E.js").then(e=>e.createWorkflowCommand(t,o,s))});i(r,{name:"test",description:"Test generation, execution, scheduling, and load testing",factory:()=>import("./chunks/test-UWA377D4.js").then(e=>e.createTestCommand(t,o,s))});i(r,{name:"coverage",description:"Coverage analysis shortcut",factory:()=>import("./chunks/coverage-B7MCGNTE.js").then(e=>e.createCoverageCommand(t,o,s))});i(r,{name:"quality",description:"Quality assessment shortcut",factory:()=>import("./chunks/quality-QO4XPAUM.js").then(e=>e.createQualityCommand(t,o,s))});i(r,{name:"quality-gate",description:"Two-gate, three-valued quality verdict against a pinned checklist (ADR-119)",factory:()=>import("./chunks/quality-gate-FBKE5E6F.js").then(e=>e.createQualityGateCommand(t,o,s))});i(r,{name:"security",description:"Security scanning and URL validation",factory:()=>import("./chunks/security-VSPNKCDS.js").then(e=>e.createSecurityCommand(t,o,s))});i(r,{name:"arena",description:"Competitive test-strategy tournaments (ADR-104)",factory:()=>import("./chunks/arena-OPS36NFZ.js").then(e=>e.createArenaCommand(t,o,s))});i(r,{name:"code",description:"Code intelligence analysis",factory:()=>import("./chunks/code-ZDJRIL3S.js").then(e=>e.createCodeCommand(t,o,s))});i(r,{name:"completions",description:"Generate shell completions for aqe",factory:()=>import("./chunks/completions-6N64JUXJ.js").then(e=>e.createCompletionsCommand(o))});i(r,{name:"upgrade",description:"Detect optional native bindings and recommend install / flag changes",factory:()=>import("./chunks/upgrade-4IC4F6AB.js").then(e=>e.createUpgradeCommand(o))});i(r,{name:"fleet",description:"Fleet operations with multi-agent progress tracking",factory:()=>import("./chunks/fleet-2Y3ZE6CE.js").then(e=>e.createFleetCommand(t,o,s,q))});i(r,{name:"validate",description:"Validation commands for skills and agents",factory:()=>import("./chunks/validate-swarm-OERQNOX5.js").then(e=>e.createValidateSwarmCommand(t,o,s))});i(r,{name:"skill",description:"Skill validation and reporting (ADR-056)",factory:()=>import("./chunks/validate-DHUWW7PF.js").then(e=>e.createValidateCommand(t,o,s))});i(r,{name:"eval",description:"Run skill evaluation suites in parallel",factory:()=>import("./chunks/eval-GNB574IM.js").then(e=>e.createEvalCommand())});i(r,{name:"ci",description:"CI/CD pipeline orchestration",factory:()=>import("./chunks/ci-MSKMVH5X.js").then(e=>e.createCICommand(t,o,s))});i(r,{name:"token-usage",description:"View and analyze token consumption metrics (ADR-042)",factory:()=>import("./chunks/token-usage-DO6WLMXP.js").then(e=>e.createTokenUsageCommand())});i(r,{name:"llm",description:"LLM Router management (ADR-043)",factory:()=>import("./chunks/llm-router-SQ56FF6Z.js").then(e=>e.createLLMRouterCommand())});i(r,{name:"sync",description:"Sync local learning data to cloud PostgreSQL",factory:()=>import("./chunks/sync-QF5Y3EMZ.js").then(e=>e.createSyncCommands())});i(r,{name:"hooks",description:"Self-learning QE hooks for pattern recognition and guidance",factory:()=>import("./chunks/hooks-IP7XE34Z.js").then(e=>e.createHooksCommand())});i(r,{name:"learning",description:"AQE self-learning system management (standalone, no claude-flow required)",factory:()=>import("./chunks/learning-4UWTQLMF.js").then(e=>e.createLearningCommand())});i(r,{name:"memory",description:"Memory store, retrieve, search, and delete operations",factory:()=>Promise.all([import("./chunks/memory-PFQ3KPVJ.js"),import("./chunks/standalone-memory-O4QUTK6L.js")]).then(([e,n])=>e.createMemoryCommand(t,o,n.createEnsureMemoryBackend(t)))});i(r,{name:"mcp",description:"Start the MCP protocol server for Claude Code integration",factory:()=>import("./chunks/mcp-TELMAC7Z.js").then(e=>e.createMcpCommand())});i(r,{name:"platform",description:"Manage coding agent platform configurations",factory:()=>import("./chunks/platform-3E3DXLYB.js").then(e=>e.createPlatformCommand())});i(r,{name:"prove",description:"Generate a verifiable Proof-of-Quality attestation",factory:()=>import("./chunks/prove-H52QGC6B.js").then(e=>e.createProveCommand(t,o,s))});i(r,{name:"ruvector",description:"RuVector integration management",factory:()=>import("./chunks/ruvector-commands-XE32PGKC.js").then(e=>e.createRuVectorCommand())});i(r,{name:"audit",description:"Witness chain audit trail management",factory:()=>import("./chunks/audit-AO5NDZRI.js").then(e=>e.createAuditCommand(t,o,s))});i(r,{name:"pipeline",description:"Manage YAML deterministic pipelines (Imp-9)",factory:()=>import("./chunks/pipeline-AVXY4MVB.js").then(e=>e.createPipelineCommand(t,o,s))});i(r,{name:"plugin",description:"Manage external QE domain plugins",factory:()=>import("./chunks/plugin-7FUQAKRE.js").then(e=>e.createPluginCommand())});i(r,{name:"daemon",description:"Manage the QE Quality Daemon",factory:()=>import("./chunks/daemon-CQFNZLXU.js").then(e=>e.createDaemonCommand())});process.on("SIGINT",async()=>{y("SIGINT")||(console.log(l.yellow(`
 
 Shutting down...`)),console.log(l.green(`Shutdown complete
 `)),await o(0))});process.on("SIGTERM",async()=>{y("SIGTERM")||(console.log(l.yellow(`
-Received SIGTERM, shutting down gracefully...`)),await o(0))});async function $(){let{isVersionFastPath:e}=await import("./chunks/fast-paths-6RGPYALD.js");e(process.argv)&&(console.log(z),process.exit(0)),w();let n=process.argv.slice(2).filter(a=>a!=="--"),c=n[0]==="learning"&&(n[1]==="backup"||n[1]==="restore");if(n[0]==="init"){let{explicitRootError:a}=await import("./chunks/init-guard-S4I2R46S.js"),m=a();if(m){console.error(l.red(`
+Received SIGTERM, shutting down gracefully...`)),await o(0))});async function $(){let{isVersionFastPath:e}=await import("./chunks/fast-paths-KTZ5SF54.js");e(process.argv)&&(console.log(z),process.exit(0)),w();let n=process.argv.slice(2).filter(a=>a!=="--"),c=n[0]==="learning"&&(n[1]==="backup"||n[1]==="restore");if(n[0]==="init"){let{explicitRootError:a}=await import("./chunks/init-guard-RYVV5R3Z.js"),m=a();if(m){console.error(l.red(`
   ${m}
-`)),await o(1);return}}if(!c){let{bootstrapTokenTracking:a}=await import("./chunks/token-bootstrap-EDK6FNQ3.js");await a({enableOptimization:!0,enablePersistence:!0,verbose:process.env.AQE_VERBOSE==="true"})}await r.parseAsync(),!x()&&await o(process.exitCode??0)}$().catch(async e=>{console.error(l.red("Fatal error:"),k(e)),await o(1)});
+`)),await o(1);return}}if(!c){let{bootstrapTokenTracking:a}=await import("./chunks/token-bootstrap-F7C6UKTC.js");await a({enableOptimization:!0,enablePersistence:!0,verbose:process.env.AQE_VERBOSE==="true"})}await r.parseAsync(),!x()&&await o(process.exitCode??0)}$().catch(async e=>{console.error(l.red("Fatal error:"),k(e)),await o(1)});

package/dist/cli/chunks/adapter-TR5SLAZC.js

@@ -0,0 +1,2 @@
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.10");process.exit(0)}
+import{a,b,c}from"./chunk-CFBEBXLO.js";import"./chunk-FKL3R5JQ.js";import"./chunk-H74Q7TJN.js";import"./chunk-ACWFKES2.js";import"./chunk-GHBNRMSJ.js";import"./chunk-OY2AHLSF.js";export{a as AgentBoosterAdapter,b as createAgentBoosterAdapter,c as createAgentBoosterAdapterSync};

package/dist/cli/chunks/agent-booster-wasm-H7ANGXW4.js

@@ -0,0 +1,2 @@
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.15.10");process.exit(0)}
+import{a as x}from"./chunk-HOZUDE4C.js";import{c as f}from"./chunk-ATHWDAXB.js";import"./chunk-N6PIIK6G.js";import"./chunk-WSF24I3D.js";import"./chunk-OY2AHLSF.js";x();import{createRequire as w}from"module";var S=f.create("agent-booster-wasm"),t={JavaScript:0,TypeScript:1,Python:2,Rust:3,Go:4,Java:5,C:6,Cpp:7},l={ExactReplace:0,FuzzyReplace:1,InsertAfter:2,InsertBefore:3,Append:4},v={0:"JavaScript",1:"TypeScript",2:"Python",3:"Rust",4:"Go",5:"Java",6:"C",7:"Cpp"},a=null,u=null,p=null;async function g(){if(a)return!0;if(p)return!1;try{if(a=w(import.meta.url)("./agent_booster_wasm.js"),!a)throw new Error("WASM module loaded but is null");return u=new a.AgentBoosterWasm,!0}catch(e){return p=e,console.warn("[AgentBoosterWASM] Failed to load WASM module:",e),!1}}function A(e){return{".js":t.JavaScript,".mjs":t.JavaScript,".cjs":t.JavaScript,".jsx":t.JavaScript,".ts":t.TypeScript,".tsx":t.TypeScript,".mts":t.TypeScript,".cts":t.TypeScript,".py":t.Python,".rs":t.Rust,".go":t.Go,".java":t.Java,".c":t.C,".h":t.C,".cpp":t.Cpp,".cc":t.Cpp,".cxx":t.Cpp,".hpp":t.Cpp}[e.toLowerCase()]??t.JavaScript}var M=[{name:"var-to-const",detect:(e,r)=>e.includes("var ")&&r.includes("const "),apply:(e,r)=>e.replace(/\bvar\s+/g,"const ")},{name:"var-to-let",detect:(e,r)=>e.includes("var ")&&r.includes("let "),apply:(e,r)=>e.replace(/\bvar\s+/g,"let ")},{name:"add-types-function",detect:(e,r)=>e.includes("function")&&!e.includes(":")&&r.includes(":"),apply:(e,r)=>r},{name:"async-wrapper",detect:(e,r)=>!e.includes("async")&&r.includes("async")&&r.includes("await"),apply:(e,r)=>r},{name:"try-catch-wrapper",detect:(e,r)=>!e.includes("try {")&&r.includes("try {"),apply:(e,r)=>r},{name:"null-check",detect:(e,r)=>!e.includes("if (!")&&!e.includes("if (!")&&(r.includes("if (!")||r.includes("?.")),apply:(e,r)=>r},{name:"test-assertion",detect:(e,r)=>e.includes("test(")&&!e.includes("expect(")&&r.includes("expect("),apply:(e,r)=>r}];function y(e,r){for(let n of M)if(n.detect(e,r))try{return{success:!0,code:n.apply(e,r),pattern:n.name}}catch(s){S.debug("Pattern transform failed, trying next",{pattern:n.name,error:s instanceof Error?s.message:String(s)});continue}return{success:!1,code:r}}async function b(e,r,n,s={}){let o=performance.now(),{confidenceThreshold:T=.5,allowFallback:d=!0}=s;if(!e.trim())return{success:!0,mergedCode:r,confidence:1,strategy:l.Append,syntaxValid:!0,source:"fallback",latencyMs:performance.now()-o};if(await g()&&u&&a)try{let c=a.WasmLanguage[v[n]],i=u.apply_edit(e,r,c);return{success:!0,mergedCode:i.merged_code,confidence:i.confidence,strategy:i.strategy,syntaxValid:i.syntax_valid,source:"wasm",latencyMs:performance.now()-o}}catch(c){let i=c;if(d){let m=y(e,r);if(m.success)return{success:!0,mergedCode:m.code,confidence:.7,strategy:l.FuzzyReplace,syntaxValid:!0,source:"pattern",latencyMs:performance.now()-o}}return{success:!1,mergedCode:r,confidence:0,strategy:l.Append,syntaxValid:!1,source:"fallback",latencyMs:performance.now()-o,error:i.message}}if(d){let c=y(e,r);return{success:c.success,mergedCode:c.code,confidence:c.success?.7:0,strategy:l.FuzzyReplace,syntaxValid:!0,source:"pattern",latencyMs:performance.now()-o}}return{success:!1,mergedCode:r,confidence:0,strategy:l.Append,syntaxValid:!1,source:"fallback",latencyMs:performance.now()-o,error:p?.message??"WASM not available"}}async function W(e,r={}){return Promise.all(e.map(({original:n,edit:s,language:o})=>b(n,s,o,r)))}async function C(){return g()}async function L(){return await g()&&a?a.AgentBoosterWasm.version():"unavailable"}async function R(){if(await g(),u&&a)try{u.apply_edit("function x() {}","function x() {}",a.WasmLanguage.JavaScript)}catch(e){console.debug("[AgentBoosterWASM] Warmup error:",e instanceof Error?e.message:e)}}var _={transform:b,batchTransform:W,isWasmAvailable:C,getVersion:L,warmup:R,Language:t,MergeStrategy:l,languageFromExtension:A};export{t as Language,l as MergeStrategy,W as batchTransform,_ as default,L as getVersion,C as isWasmAvailable,A as languageFromExtension,b as transform,R as warmup};