agentic-qe 3.15.9 → 3.15.11

package/.claude/skills/skills-manifest.json

@@ -940,7 +940,7 @@
   },
   "metadata": {
     "generatedBy": "Agentic QE Fleet",
-    "fleetVersion": "3.15.9",
+    "fleetVersion": "3.15.11",
     "manifestVersion": "1.4.0",
     "lastUpdated": "2026-04-13T00:00:00.000Z",
     "contributors": [

package/CHANGELOG.md

@@ -5,6 +5,371 @@ All notable changes to the Agentic QE project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.15.11] - 2026-10-22
+
+AQE now works on npm 12 and on a plain install without the optional
+embedding package, and its MCP tools load in VS Code Copilot. When the
+database cannot start, `aqe init` prints the real cause and the command that
+fixes it. `aqe fleet run` progress output is readable, a test that passes on
+retry counts as passed and flaky, and an `eval()` is no longer reported twice.
+Four security fixes close the follow-ups from the 3.15.10 review: a checked
+file is read from exactly what was checked, runner stderr is redacted before
+it is cut, and names like `constructor` or `__proto__` are plain names in
+every data lookup.
+
+### Fixed
+
+- **`aqe init` explains a missing database driver** ([#1173], [#1175]): on
+  npm 12, `npm install -g agentic-qe` blocks the install script of
+  `better-sqlite3`, so its native binary is never built. `aqe init` then
+  failed at "Initialize persistence database" with no error printed. Now
+  `init` prints the real error, and every command that opens the database
+  (`init`, `health`, `status`, `memory`, MCP fleet init) names the cause and
+  prints the exact fix:
+  `npm install -g agentic-qe --allow-scripts=agentic-qe,better-sqlite3,hnswlib-node`.
+  The README and getting-started guide include the npm 12 install note.
+- **MCP tools load in VS Code Copilot** ([#1185], [#1193]): Copilot refused
+  `fleet_init` and 17 other tools with "tool parameters array type must have
+  items". Every list parameter in every tool schema now declares what its
+  elements are, including the `qe/*` domain tools, whose element types were
+  dropped when they were published.
+- **`task_orchestrate` and `aqe eval` work without an embedder** ([#1022],
+  [#1181]): on a plain install without `@huggingface/transformers`,
+  `task_orchestrate` always failed with "Transformer initialization
+  previously failed" and `aqe eval` failed to load. Both now work. Pattern
+  learning stores patterns without a vector and searches them by text; its
+  response says so in a new `learning` field (`patternSearch: "vector"`,
+  `"lexical-only"` with the reason, or `"unavailable"`). Text matches report
+  `similarity: 0` because no similarity was measured. Experience guidance is
+  not produced without an embedding of the task, instead of guidance for an
+  unrelated task with a made-up similarity.
+- **`aqe fleet run` progress output** ([#1168], [#1177]): the progress header
+  shows `Fleet Progress` instead of a literal `{name}` and a stray `0`. When
+  the verdict is FAILED, the completion line no longer says "successfully".
+- **A test that passes on retry counts as passed and flaky** ([#1170],
+  [#1177]): MCP `test_execute_parallel` and `aqe test execute` (text, JSON and
+  markdown) now count it as passed, report it as flaky, and agree with
+  `retryStats`. MCP and the CLI share one default retry count, 2 (MCP used 3).
+- **`sast-scan` runs without naming a domain** ([#1170], [#1177]):
+  `task_submit` and `aqe task submit` route it to `security-compliance`. A
+  task type no loaded domain handles is still rejected, with an error that
+  says so.
+- **One `eval()` is reported once** ([#1170], [#1177], [#1184]):
+  `security_scan_comprehensive` dropped a duplicate generic eval/exec finding
+  only when SAST reported eval injection (CWE-95) on the same file and line,
+  at the same or a higher severity, and the line has no `exec()`. Secret, CORS
+  and debug findings are always kept. The generic rule reports every matching
+  line, and its findings name the scanned path.
+- **Learning recommendations stay in their domain and objective** ([#1091],
+  thanks @rudycelekli): a strategy tuned to maximize coverage can no longer
+  be recommended for minimizing latency or for another domain.
+- **CRDT sync rejects non-finite timestamps** ([#1087], thanks
+  @rudycelekli): a remote register with a `NaN` or infinite timestamp is
+  skipped at merge instead of winning every later comparison; valid
+  registers, including cleared ones, keep converging.
+
+### Security
+
+- **A checked file is read from exactly what was checked** ([#1161],
+  [#1179]): the path guard checked a path, and the handler opened it again
+  later by name, so a file or symlink swapped in between was read
+  unchecked. Fixed-name files inside an accepted folder (coverage reports,
+  `package.json`, dependency manifests) were not checked at all, so a
+  committed symlink could pull an outside file into results or point a
+  coverage report at `/dev/zero`. One shared reader now opens the file once
+  without following a final symlink, checks the open file (regular, within the
+  size limit, inside the project) and reads from it. Code index, SAST,
+  security scans, contract and requirements validation, test generation, C4
+  and every coverage report parser use it.
+- **Test runner stderr is redacted before it is cut** ([#1150], [#1180]):
+  when coverage tests crashed without a report, `coverage_analyze_sublinear`
+  quoted the runner's raw stderr, and a secret cut at the 2 KB boundary left a
+  fragment no redaction pattern recognizes. Stderr is now redacted first, then
+  cut. Claim-verifier command evidence and the claude-code provider's parse
+  error are redacted the same way.
+- **`constructor`, `__proto__` and other built-in names are plain names**
+  ([#1157], [#1182]): names from callers, files or stored data matched
+  built-in JavaScript members. A pipeline condition on `input.constructor`
+  ran a step that should be skipped, a dependency named `constructor` crashed
+  `qe/code/c4` and hid real findings, an agent-overlay `__proto__:` section
+  wrote onto every object, and a tool named `constructor` could claim to be
+  read-only. Every such lookup now reads own entries only.
+
+### Changed
+
+- `vite` (dev dependency) 8.3.0 → 8.3.4 ([#1172]).
+
+[#1022]: https://github.com/proffesor-for-testing/agentic-qe/issues/1022
+[#1087]: https://github.com/proffesor-for-testing/agentic-qe/pull/1087
+[#1091]: https://github.com/proffesor-for-testing/agentic-qe/pull/1091
+[#1150]: https://github.com/proffesor-for-testing/agentic-qe/issues/1150
+[#1157]: https://github.com/proffesor-for-testing/agentic-qe/issues/1157
+[#1161]: https://github.com/proffesor-for-testing/agentic-qe/issues/1161
+[#1168]: https://github.com/proffesor-for-testing/agentic-qe/issues/1168
+[#1170]: https://github.com/proffesor-for-testing/agentic-qe/issues/1170
+[#1172]: https://github.com/proffesor-for-testing/agentic-qe/pull/1172
+[#1173]: https://github.com/proffesor-for-testing/agentic-qe/issues/1173
+[#1175]: https://github.com/proffesor-for-testing/agentic-qe/pull/1175
+[#1177]: https://github.com/proffesor-for-testing/agentic-qe/pull/1177
+[#1179]: https://github.com/proffesor-for-testing/agentic-qe/pull/1179
+[#1180]: https://github.com/proffesor-for-testing/agentic-qe/pull/1180
+[#1181]: https://github.com/proffesor-for-testing/agentic-qe/pull/1181
+[#1182]: https://github.com/proffesor-for-testing/agentic-qe/pull/1182
+[#1184]: https://github.com/proffesor-for-testing/agentic-qe/pull/1184
+[#1185]: https://github.com/proffesor-for-testing/agentic-qe/issues/1185
+[#1193]: https://github.com/proffesor-for-testing/agentic-qe/pull/1193
+
+## [3.15.10] - 2026-10-19
+
+Files named in a request are now read only when they are inside your
+project, and secrets in test failures are redacted everywhere AQE returns
+or stores them. Advertised `aqe fleet run` and `task_orchestrate` commands
+run real handlers and judge what they returned. A dream can no longer lose
+an acknowledged memory write, git and other slow tools no longer freeze
+the MCP server, and the learning success rate counts measured outcomes
+only. Every change was reviewed adversarially before merge.
+
+### Security
+
+- **Paths in a request are read only inside the project** ([#1126],
+  [#1162], [#1125], [#1144]): before, a caller could ask AQE over MCP to
+  read any file on the machine, and one request for `/dev/zero` crashed the
+  server. Every handler that reads a file or folder named in a request
+  (`generate-tests`, `execute-tests`, `predict-defects`, `sast-scan`,
+  `security_scan_comprehensive`, `coverage_analyze_sublinear`,
+  `code_index`, `contract_validate` and others) now applies one shared
+  check, on every entry point: MCP tools, `task_submit`,
+  `task_orchestrate` and `aqe task submit`.
+  - The real location, with every symlink followed, must be inside the
+    project root. A symlink that points out, and `src/link/../x` when
+    `src/link` points out, are refused.
+  - Only regular files are read, at most 2 MB each where a file is read
+    whole. Devices, FIFOs and (except where a folder is expected)
+    directories are refused before anything is opened.
+  - A path outside the project is refused without touching the
+    filesystem, so the error does not reveal whether the file exists.
+  - The refusal is a caller error: it is not retried and does not trip the
+    domain circuit breaker.
+- **Secrets in test failures are redacted** ([#1122], [#1139]): a
+  connection string, AWS key or bearer token in a failing test's message
+  used to come back verbatim from `test_execute_parallel` and
+  `aqe test execute`, and was saved under `.agentic-qe/results/`, in
+  session logs and in `memory.db` (test runs, experiences, retry and flaky
+  history). All of these copies are now redacted, before any length cap,
+  so a secret cut in half cannot survive. The `error` of every MCP domain
+  tool is redacted as a backstop.
+- **Lookups keyed by caller data read own properties only** ([#1136],
+  [#1156], [#1118], [#1132]):
+  - `${constructor}` or `{{toString}}` in a pipeline YAML, browser
+    workflow, workflow condition or cross-phase hook no longer expands to
+    native function source. It stays literal.
+  - JSON Pointer and JSON Patch paths such as `/__proto__/x` in the A2UI
+    and AG-UI adapters can no longer write to `Object.prototype`.
+  - Required-property checks in contract, enterprise-integration and MCP
+    schema validation no longer count an inherited `constructor` as
+    present.
+  - Name tables (agent names, gate rules, routing categories,
+    `aqe ruvector flags --profile`, faker paths and recovery playbook
+    services) no longer match inherited members. Thanks to @rudycelekli
+    for the recovery playbook fix.
+- **DAST scans fail when the target cannot be reached** ([#1092]): an
+  initial 401/403 now fails with `DAST_AUTHENTICATION_FAILED` and a 5xx
+  with `DAST_TARGET_UNAVAILABLE`. Before, an unreachable target could
+  produce a completed scan. Failed follow-up probes fail the scan, and a
+  failed scan is not stored as completed. Thanks to @rudycelekli.
+
+### Fixed
+
+- **Dreams no longer put memory writes at risk** ([#1060], [#1160]): a
+  dream does its work in memory and writes its results in one short
+  transaction at the end. An acknowledged `memory_store` made during a
+  dream is kept however the dream ends: it finishes, is cancelled, the
+  engine closes, stdin closes or the process is killed. `cancelDream()`,
+  `close()` and shutdown stop a dream at once and record it `interrupted`.
+  A second dream request while one runs is refused instead of interrupting
+  it. A cycle left `running` by a dead process is marked `interrupted`
+  (never deleted) after 11 minutes. Thanks to @pacphi for the report and
+  reproduction in [#1060].
+- **Slow child processes no longer freeze the MCP server** ([#1115],
+  [#1148]): git (defect prediction, task routing, the quality daemon's
+  watcher), `cloc`/`tokei` and test-runner listings for `code_index`, and
+  `npx agent-browser` for the browser tools now run asynchronously with
+  timeouts. A timeout stops the child's whole process group, so nothing is
+  left running. With a git that took 1 s per call, `fleet_status` used to
+  wait up to 12 s; now it answers in well under a second.
+- **Learning's success rate counts measured outcomes only** ([#1129],
+  [#1121], [#1142]): `aqe learning stats` said 100% after test runs with a
+  failing test. Now only a test run is a measured outcome (it passes when
+  every test passed, and both results are recorded), and the rate counts
+  runs, not rows. Completed calls, errors, hook-reported `--success` and
+  session-consolidation aggregates count as uses, not verdicts. Existing
+  rows are classified on read; nothing is deleted or rewritten. The
+  learning dashboard no longer shows an invented `0.5` learning rate or a
+  `100%` transfer rate, and patterns stored before 3.15.9 are kept but left
+  out of stats.
+- **Learning consolidation cannot lose patterns** ([#1106], [#1143]): a
+  merge now reads back every archived source and the merged pattern before
+  removing the sources. If any step fails, nothing is merged. A failed
+  domain or merge is reported as `status: 'partial'` with an `errors` list
+  instead of success. A dry run now predicts the same trims as a real run,
+  and a key scan that never ends stops with an error.
+- **Advertised commands run real handlers** ([#1125], [#1144]):
+  `aqe fleet run scan` runs a SAST scan on the target's JS/TS files,
+  `analyze` uses the coverage report that already exists for the target,
+  and `test` generates tests for the target's sources. `task_orchestrate`
+  routes `scan-security` to `sast-scan` and `assess-quality` to
+  `analyze-quality` when you pass `filePaths`. Requests that lack the
+  input a handler needs are refused with the tool to use instead; nothing
+  is estimated. `task_submit` with `sast-scan` now accepts plain path
+  strings.
+- **Index tasks run, or are refused up front** ([#1086], [#1134],
+  [#1159]): an inferred `index-code` task now runs the code-intelligence
+  handler with the paths it was given. Thanks to @rudycelekli.
+- **Queen slots are always handed on** ([#1127], [#1138], [#1140],
+  [#1152]): a slot freed while the queue drains goes to the next queued
+  task. Work stealing moves a task only to a domain that can run it and
+  never exceeds `maxConcurrentTasks`. A failure at dispatch publishes
+  `QueenTaskFailed` once and frees its slot once; a plugin that throws no
+  longer leaves its task `running`.
+- **Retries rerun tests inside `describe` blocks** ([#1141], [#1151]): the
+  retry filter only ever matched top-level tests. It now matches the full
+  name for Vitest, Jest and Mocha. A retry that selects no test is
+  reported as `unmatched` instead of counting as an attempt.
+- **Retry results are reported** ([#1130], [#1163]):
+  `test_execute_parallel` returns `retryStats` (retries run, now passing,
+  still failing, per test) and `aqe test execute` prints a `Retries:` line.
+- **`fleet_status` stays healthy during a test run** ([#1130], [#1163]):
+  the agent spawned for one task no longer marks the fleet `degraded`
+  while it runs or after it finishes. Real topology problems and failed
+  agents still degrade the status. `fleet_health({ detailed: true })`
+  shows the raw MinCut reading.
+- **Chaos wording is not run as tests** ([#1130], [#1163]): "Run chaos
+  resilience testing with fault injection" now gets chaos guidance from
+  `task_orchestrate` instead of being submitted as `execute-tests`.
+- **Dream archive and worker status are reported truthfully** ([#1116],
+  [#1155]): a stale insight with a NULL id no longer makes every retention
+  sweep fail. The generated `start-daemon.cjs` honours
+  `AQE_WORKERS_ENABLED` (environment or Claude settings files) and says
+  "started" only when the server is still running. MCP startup reports
+  workers as `starting` until they have started.
+- **Concurrent startups no longer fail with "database is locked" during a
+  schema migration** ([#1116], [#1155]): a migration takes the write lock
+  up front and waits for it.
+- **Defect predictions reach the background worker** ([#1088]): public
+  predictions are recorded in the shape the worker reads, history is
+  bounded to the newest 32 runs, and the newest result is no longer hidden
+  behind an old scan cap. Static scores are labelled as estimates. Thanks
+  to @rudycelekli.
+
+### Changed
+
+- **`task_orchestrate` and fleet responses:** `type` is now the handler
+  type that actually ran (for example `sast-scan`). The type inferred from
+  the description moves to the new field `inferredType`. Clients that read
+  `type` as the inferred type should read `inferredType`.
+- **`aqe fleet run` shows results and a verdict.** It prints the findings,
+  coverage or generated tests, and exits 1 with `Verdict: FAILED (…)` on a
+  critical or high finding, incomplete scan evidence, a failed quality
+  gate, coverage below 80% or an unreadable result. The count line now
+  says `Completed: N` instead of `Successful: N`.
+- **Payload paths are confined to the project root.** After `aqe init` in
+  a monorepo package, a sibling package such as `../b/tests/x.test.ts` is
+  refused. Set `AQE_PROJECT_ROOT=<repo root>` to let packages reach each
+  other.
+- **Interpolation no longer resolves inherited values.** `${constructor}`,
+  `${toString}` and similar placeholders stay literal unless you define
+  them.
+- **`enableBranching` is a deprecated no-op.** The option is still
+  accepted and logs a warning. `RVCOWBranchManager` is deprecated.
+- **Index tasks without `paths` are refused at submit.** `task_submit` and
+  `aqe task submit` with `index` or `index-code` need a non-empty `paths`
+  list, and `task_orchestrate` needs `filePaths`. Use `code_index` or
+  `aqe code index` to index a directory.
+- **`task_orchestrate` refuses `optimize-learning` from free text**,
+  because it overwrites the stored learned strategies. Use `task_submit`
+  with type `optimize-strategies`. `run-chaos`, `validate-contracts`,
+  `validate-requirements` and `test-accessibility` are refused with the
+  tool to use instead.
+- **Schema v14.** The `dream_insights_archive` table moves into the
+  versioned schema with an additive, idempotent migration. 3.15.8 and
+  3.15.9 still open a migrated database.
+- **Learning success rates count measured outcomes only.** Projects that
+  only have hook-reported outcomes now show "insufficient evidence"
+  instead of 100%. `aqe learning stats --json` reports `measuredOutcomes`
+  and `unmeasuredOutcomes`, and `patternSuccessRate` can be `null`.
+- **Git timeouts are reported as unavailable, never as 0.** A prediction
+  whose git history timed out carries a `warnings` entry, and its metrics
+  are not cached.
+
+### Known issues
+
+- `task_orchestrate` still fails on an install without an embedder (the
+  optional `@huggingface/transformers` package or `AQE_EMBEDDER_ENDPOINT`),
+  so its new routing is only reachable with one configured ([#1022]).
+- Payload path checks and the read that follows are not atomic, so a path
+  swapped between them is not caught yet ([#1161]).
+- Some direct `map[userKey]` lookups on plain objects remain to be audited
+  ([#1157]).
+- `aqe fleet run analyze` and `aqe coverage` can pass from a report that
+  covers only part of the target ([#1154]).
+- The daemon spawned by `start-daemon.cjs` exits on stdin EOF, so it never
+  stays up; it now says so instead of reporting "started" ([#1158]).
+- A rare "database is locked" on concurrent first open of a non-WAL
+  database ([#1164]).
+- Git timeout follow-ups: per-path deadlines and the watcher baseline
+  ([#1165]).
+- Queen follow-ups: a late `onComplete` can settle twice, and work stealing
+  rarely runs under the slot cap ([#1153]).
+- Learning outcome follow-ups: failures can still mint patterns, and
+  routing still uses completion-based success ([#1147]).
+- Pattern consolidation follow-ups: id-only read-back and no
+  compare-and-delete ([#1149]).
+
+[#1022]: https://github.com/proffesor-for-testing/agentic-qe/issues/1022
+[#1060]: https://github.com/proffesor-for-testing/agentic-qe/issues/1060
+[#1086]: https://github.com/proffesor-for-testing/agentic-qe/pull/1086
+[#1088]: https://github.com/proffesor-for-testing/agentic-qe/pull/1088
+[#1092]: https://github.com/proffesor-for-testing/agentic-qe/pull/1092
+[#1106]: https://github.com/proffesor-for-testing/agentic-qe/issues/1106
+[#1115]: https://github.com/proffesor-for-testing/agentic-qe/issues/1115
+[#1116]: https://github.com/proffesor-for-testing/agentic-qe/issues/1116
+[#1118]: https://github.com/proffesor-for-testing/agentic-qe/issues/1118
+[#1121]: https://github.com/proffesor-for-testing/agentic-qe/issues/1121
+[#1122]: https://github.com/proffesor-for-testing/agentic-qe/issues/1122
+[#1125]: https://github.com/proffesor-for-testing/agentic-qe/issues/1125
+[#1126]: https://github.com/proffesor-for-testing/agentic-qe/issues/1126
+[#1127]: https://github.com/proffesor-for-testing/agentic-qe/issues/1127
+[#1129]: https://github.com/proffesor-for-testing/agentic-qe/issues/1129
+[#1130]: https://github.com/proffesor-for-testing/agentic-qe/issues/1130
+[#1132]: https://github.com/proffesor-for-testing/agentic-qe/pull/1132
+[#1134]: https://github.com/proffesor-for-testing/agentic-qe/issues/1134
+[#1136]: https://github.com/proffesor-for-testing/agentic-qe/issues/1136
+[#1138]: https://github.com/proffesor-for-testing/agentic-qe/pull/1138
+[#1139]: https://github.com/proffesor-for-testing/agentic-qe/pull/1139
+[#1140]: https://github.com/proffesor-for-testing/agentic-qe/issues/1140
+[#1141]: https://github.com/proffesor-for-testing/agentic-qe/issues/1141
+[#1142]: https://github.com/proffesor-for-testing/agentic-qe/pull/1142
+[#1143]: https://github.com/proffesor-for-testing/agentic-qe/pull/1143
+[#1144]: https://github.com/proffesor-for-testing/agentic-qe/pull/1144
+[#1147]: https://github.com/proffesor-for-testing/agentic-qe/issues/1147
+[#1148]: https://github.com/proffesor-for-testing/agentic-qe/pull/1148
+[#1149]: https://github.com/proffesor-for-testing/agentic-qe/issues/1149
+[#1151]: https://github.com/proffesor-for-testing/agentic-qe/pull/1151
+[#1152]: https://github.com/proffesor-for-testing/agentic-qe/pull/1152
+[#1153]: https://github.com/proffesor-for-testing/agentic-qe/issues/1153
+[#1154]: https://github.com/proffesor-for-testing/agentic-qe/issues/1154
+[#1155]: https://github.com/proffesor-for-testing/agentic-qe/pull/1155
+[#1156]: https://github.com/proffesor-for-testing/agentic-qe/pull/1156
+[#1157]: https://github.com/proffesor-for-testing/agentic-qe/issues/1157
+[#1158]: https://github.com/proffesor-for-testing/agentic-qe/issues/1158
+[#1159]: https://github.com/proffesor-for-testing/agentic-qe/pull/1159
+[#1160]: https://github.com/proffesor-for-testing/agentic-qe/pull/1160
+[#1161]: https://github.com/proffesor-for-testing/agentic-qe/issues/1161
+[#1162]: https://github.com/proffesor-for-testing/agentic-qe/pull/1162
+[#1163]: https://github.com/proffesor-for-testing/agentic-qe/pull/1163
+[#1164]: https://github.com/proffesor-for-testing/agentic-qe/issues/1164
+[#1165]: https://github.com/proffesor-for-testing/agentic-qe/issues/1165
+
 ## [3.15.9] - 2026-10-17
 
 Tasks no longer get stuck in `running` and quietly use up Queen slots.

package/README.md

@@ -34,6 +34,14 @@ aqe init --auto
 aqe health
 ```
 
+**npm 12+:** dependency install scripts are blocked unless allowed, and AQE's SQLite store (`better-sqlite3`) needs its install script to fetch its native binary. Name the packages when you install:
+
+```bash
+npm install -g agentic-qe --allow-scripts=agentic-qe,better-sqlite3,hnswlib-node
+```
+
+Include `agentic-qe` in the command — npm's warning suggests `npm install -g --allow-scripts=...` without a package name, which installs the current directory instead. If `aqe init` reports that the `better-sqlite3` native module could not be loaded on an existing install, rebuild it with `npm rebuild -g better-sqlite3 --allow-scripts=better-sqlite3` (for a project-local install: `npm install-scripts approve better-sqlite3 && npm rebuild better-sqlite3`). `hnswlib-node` is optional; AQE runs without it.
+
 `aqe init --auto` analyzes your project and configures the default Claude Code surface, including MCP. Review the generated project files. For another client, select its setup flag below and use its MCP connection flow.
 
 In your coding agent, start with a narrow request:

package/assets/skills/skills-manifest.json

@@ -940,7 +940,7 @@
   },
   "metadata": {
     "generatedBy": "Agentic QE Fleet",
-    "fleetVersion": "3.15.9",
+    "fleetVersion": "3.15.11",
     "manifestVersion": "1.4.0",
     "lastUpdated": "2026-04-13T00:00:00.000Z",
     "contributors": [

package/dist/adapters/a2a/agent-cards/generator.js

@@ -53,15 +53,18 @@ export function parseFrontmatter(markdown) {
         if (keyValueMatch) {
             const [, indent, key, value] = keyValueMatch;
             const currentIndent = indent.length;
+            // #1157: keys come from agent markdown; skip ones that would re-prototype
+            // the result (and, for a top-level key, the nested block under it).
+            const unsafe = key === '__proto__' || key === 'constructor' || key === 'prototype';
             if (currentIndent === 0) {
                 // Top-level key
                 if (currentKey && indentLevel > 0) {
                     result[currentKey] = nestedObj;
                     nestedObj = {};
                 }
-                currentKey = key;
+                currentKey = unsafe ? '' : key;
                 indentLevel = 0;
-                if (value.trim()) {
+                if (value.trim() && !unsafe) {
                     // Clean up quoted values
                     result[key] = value.replace(/^["']|["']$/g, '');
                 }
@@ -69,7 +72,7 @@ export function parseFrontmatter(markdown) {
             else if (currentIndent > 0 && currentKey) {
                 // Nested key
                 indentLevel = currentIndent;
-                if (value.trim()) {
+                if (value.trim() && !unsafe) {
                     nestedObj[key] = value.replace(/^["']|["']$/g, '');
                 }
             }

package/dist/adapters/a2a/tasks/task-router.js

@@ -401,7 +401,9 @@ export class TaskRouter extends EventEmitter {
         // Check capabilities
         if (request.requiredCapabilities) {
             for (const cap of request.requiredCapabilities) {
-                if (!agent.capabilities[cap]) {
+                // #1157: the capability name comes from the routing request; an
+                // inherited member such as `toString` is not a capability.
+                if (!Object.hasOwn(agent.capabilities, cap) || !agent.capabilities[cap]) {
                     return false;
                 }
             }

package/dist/adapters/a2ui/catalog/component-schemas.js

@@ -965,7 +965,8 @@ export function validateComponent(component, componentType) {
     // Check required properties
     if (schema.required) {
         for (const prop of schema.required) {
-            if (!(prop in comp)) {
+            // #1136: own properties only; an inherited `constructor` is not present.
+            if (!Object.hasOwn(comp, prop)) {
                 errors.push({
                     path: prop,
                     message: `Missing required property: ${prop}`,

package/dist/adapters/a2ui/data/json-pointer-resolver.js

@@ -7,6 +7,7 @@
  * @see https://www.rfc-editor.org/rfc/rfc6901
  * @module adapters/a2ui/data/json-pointer-resolver
  */
+import { setOwn } from '../../../shared/utils/safe-record.js';
 // ============================================================================
 // Types
 // ============================================================================
@@ -176,7 +177,9 @@ export function resolvePointerWithInfo(data, pointer) {
         else {
             // Object access
             const obj = current;
-            if (!(segment in obj)) {
+            // #1136: own properties only; `/constructor` or `/__proto__` does not
+            // resolve to an inherited member.
+            if (!Object.hasOwn(obj, segment)) {
                 return { found: false, value: undefined };
             }
             lastKey = segment;
@@ -239,9 +242,11 @@ export function setAtPointer(data, pointer, value) {
         }
         else {
             const obj = current;
-            if (!(segment in obj)) {
+            // #1136: own properties only, and created as own data properties, so
+            // `/__proto__/x` cannot walk into and write Object.prototype.
+            if (!Object.hasOwn(obj, segment)) {
                 // Auto-create intermediate objects
-                obj[segment] = {};
+                setOwn(obj, segment, {});
             }
             current = obj[segment];
         }
@@ -269,7 +274,7 @@ export function setAtPointer(data, pointer, value) {
         }
     }
     else {
-        current[lastSegment] = value;
+        setOwn(current, lastSegment, value);
     }
 }
 /**
@@ -304,7 +309,7 @@ export function deleteAtPointer(data, pointer) {
     }
     else {
         const obj = parent;
-        if (!(lastSegment in obj)) {
+        if (!Object.hasOwn(obj, lastSegment)) {
             return false;
         }
         delete obj[lastSegment];

package/dist/adapters/a2ui/integration/agui-sync.js

@@ -8,6 +8,7 @@
  */
 import { EventEmitter } from 'events';
 import { v4 as uuidv4 } from 'uuid';
+import { getOwn, setOwn } from '../../../shared/utils/safe-record.js';
 /**
  * Default configuration
  */
@@ -473,7 +474,8 @@ export class AGUISyncService extends EventEmitter {
         const parts = extractor.split('.');
         let value = payload;
         for (const part of parts) {
-            if (value && typeof value === 'object' && part in value) {
+            // #1136: own properties only.
+            if (value && typeof value === 'object' && Object.hasOwn(value, part)) {
                 value = value[part];
             }
             else {
@@ -498,7 +500,7 @@ export class AGUISyncService extends EventEmitter {
             if (typeof current !== 'object') {
                 return undefined;
             }
-            current = current[part];
+            current = getOwn(current, part);
         }
         return current;
     }
@@ -512,14 +514,16 @@ export class AGUISyncService extends EventEmitter {
         }
         const parts = path.split('/').filter(Boolean);
         let current = obj;
+        // #1136: own properties only, created as own data properties, so
+        // `/__proto__/x` cannot walk into and write Object.prototype.
         for (let i = 0; i < parts.length - 1; i++) {
             const part = parts[i];
-            if (!(part in current) || typeof current[part] !== 'object') {
-                current[part] = {};
+            if (!Object.hasOwn(current, part) || typeof current[part] !== 'object' || current[part] === null) {
+                setOwn(current, part, {});
             }
             current = current[part];
         }
-        current[parts[parts.length - 1]] = value;
+        setOwn(current, parts[parts.length - 1], value);
     }
     /**
      * Delete value at JSON Pointer path
@@ -532,7 +536,7 @@ export class AGUISyncService extends EventEmitter {
         let current = obj;
         for (let i = 0; i < parts.length - 1; i++) {
             const part = parts[i];
-            if (!(part in current) || typeof current[part] !== 'object') {
+            if (!Object.hasOwn(current, part) || typeof current[part] !== 'object') {
                 return;
             }
             current = current[part];

package/dist/adapters/a2ui/integration/surface-state-bridge.js

@@ -8,6 +8,7 @@
  */
 import { EventEmitter } from 'events';
 import { v4 as uuidv4 } from 'uuid';
+import { getOwn, setOwn } from '../../../shared/utils/safe-record.js';
 import { createSurfaceGenerator, createComponentBuilder, } from '../renderer/index.js';
 /**
  * Default configuration
@@ -461,7 +462,8 @@ export class SurfaceStateBridge extends EventEmitter {
             if (typeof current !== 'object') {
                 return undefined;
             }
-            current = current[part];
+            // #1136: own properties only.
+            current = getOwn(current, part);
         }
         return current;
     }
@@ -475,14 +477,16 @@ export class SurfaceStateBridge extends EventEmitter {
         }
         const parts = path.split('/').filter(Boolean);
         let current = obj;
+        // #1136: own properties only, created as own data properties, so
+        // `/__proto__/x` cannot walk into and write Object.prototype.
         for (let i = 0; i < parts.length - 1; i++) {
             const part = parts[i];
-            if (!(part in current) || typeof current[part] !== 'object' || current[part] === null) {
-                current[part] = {};
+            if (!Object.hasOwn(current, part) || typeof current[part] !== 'object' || current[part] === null) {
+                setOwn(current, part, {});
             }
             current = current[part];
         }
-        current[parts[parts.length - 1]] = value;
+        setOwn(current, parts[parts.length - 1], value);
     }
     /**
      * Delete value at JSON Pointer path
@@ -495,7 +499,7 @@ export class SurfaceStateBridge extends EventEmitter {
         let current = obj;
         for (let i = 0; i < parts.length - 1; i++) {
             const part = parts[i];
-            if (!(part in current) || typeof current[part] !== 'object') {
+            if (!Object.hasOwn(current, part) || typeof current[part] !== 'object') {
                 return;
             }
             current = current[part];