agentic-qe 3.7.19 → 3.7.21

package/dist/domains/test-execution/services/mincut-test-optimizer.js

@@ -263,6 +263,8 @@ export class MinCutTestOptimizerImpl {
             criticalTests.add(promotedId);
             skippableTests.delete(promotedId);
             const promotedTest = testMap.get(promotedId);
+            if (!promotedTest)
+                continue;
             for (const file of promotedTest.coveredFiles) {
                 covered.add(file);
             }

package/dist/governance/continue-gate-integration.js

@@ -153,7 +153,7 @@ export class ContinueGateIntegration {
                     budgetRemaining: {
                         tokens: Math.max(0, (flags.maxConsecutiveRetries * 10 * 500) - (history.length * 500)),
                         toolCalls: Math.max(0, (flags.maxConsecutiveRetries * 10) - history.length),
-                        timeMs: Math.max(0, flags.idleTimeoutMs - (history.length > 0 ? Date.now() - history[0].timestamp : 0)),
+                        timeMs: Math.max(0, flags.idleTimeoutMs - (history.length > 0 ? Date.now() - history[history.length - 1].timestamp : 0)),
                     },
                     recentDecisions: [],
                 };

package/dist/governance/feature-flags.js

@@ -16,7 +16,7 @@ export const DEFAULT_GOVERNANCE_FLAGS = {
         enabled: true,
         maxConsecutiveRetries: 3,
         reworkRatioThreshold: 0.5,
-        idleTimeoutMs: 5 * 60 * 1000, // 5 minutes
+        idleTimeoutMs: 15 * 60 * 1000, // 15 minutes
         throttleOnExceed: true,
     },
     memoryWriteGate: {
@@ -124,7 +124,7 @@ export function loadFlagsFromEnv() {
             enabled: env.GOVERNANCE_CONTINUE_GATE !== 'false',
             maxConsecutiveRetries: parseInt(env.GOVERNANCE_MAX_RETRIES || '3', 10),
             reworkRatioThreshold: parseFloat(env.GOVERNANCE_REWORK_THRESHOLD || '0.5'),
-            idleTimeoutMs: parseInt(env.GOVERNANCE_IDLE_TIMEOUT || '300000', 10),
+            idleTimeoutMs: parseInt(env.GOVERNANCE_IDLE_TIMEOUT || '900000', 10),
             throttleOnExceed: env.GOVERNANCE_THROTTLE !== 'false',
         },
         memoryWriteGate: {

package/dist/init/agents-installer.d.ts

@@ -21,6 +21,8 @@ export interface AgentsInstallResult {
     overlaysApplied?: string[];
     /** Warnings from overlay loading */
     overlayWarnings?: string[];
+    /** MCP dependency validation warnings (advisory only) */
+    mcpValidationWarnings?: string[];
 }
 export interface AgentsInstallerOptions {
     /** Project root directory */

package/dist/init/agents-installer.js

@@ -10,6 +10,7 @@ import { join, dirname } from 'path';
 import { fileURLToPath } from 'url';
 import { toErrorMessage } from '../shared/error-utils.js';
 import { loadOverlays, applyOverlayToContent } from '../agents/overlay-loader.js';
+import { validateFleetMcpDeps } from '../validation/steps/agent-mcp-validator.js';
 // ============================================================================
 // Agent Categories
 // ============================================================================
@@ -298,6 +299,18 @@ export class AgentsInstaller {
         if (result.overlaysApplied.length > 0) {
             console.error(`[AgentsInstaller] Applied ${result.overlaysApplied.length} agent overlay(s): ${result.overlaysApplied.join(', ')}`);
         }
+        // Validate MCP dependencies (advisory only -- Issue #342 Item 1)
+        const mcpValidation = validateFleetMcpDeps(targetAgentsDir, this.projectRoot);
+        result.mcpValidationWarnings = mcpValidation.warnings;
+        if (mcpValidation.warnings.length > 0) {
+            console.error(`[AgentsInstaller] MCP dependency warnings (${mcpValidation.agentsWithMissingDeps.length} agents affected):`);
+            for (const warning of mcpValidation.warnings.slice(0, 10)) {
+                console.error(`  ${warning}`);
+            }
+            if (mcpValidation.warnings.length > 10) {
+                console.error(`  ... and ${mcpValidation.warnings.length - 10} more warnings`);
+            }
+        }
         // Create agents index file
         await this.createAgentsIndex(targetAgentsDir, result.installed);
         return result;

package/dist/init/enhancements/claude-flow-adapter.js

@@ -11,9 +11,18 @@
  */
 import { detectClaudeFlow } from '../../adapters/claude-flow/detect.js';
 import { safeJsonParse } from '../../shared/safe-json.js';
-/** Shared execSync options for cross-platform CLI calls */
-const SHELL = process.platform === 'win32' ? 'cmd.exe' : '/bin/sh';
-const EXEC_OPTS = { encoding: 'utf-8', shell: SHELL };
+/** Shared execFileSync options */
+const EXEC_OPTS = { encoding: 'utf-8' };
+/**
+ * Build args array for npx @claude-flow/cli calls.
+ * Using execFileSync with explicit args prevents shell injection.
+ */
+function cfCliArgs(...subcommand) {
+    return {
+        bin: 'npx',
+        args: ['--no-install', '@claude-flow/cli', ...subcommand],
+    };
+}
 /**
  * Claude Flow Adapter Implementation
  * Falls back gracefully when Claude Flow is not available
@@ -86,9 +95,12 @@ export class ClaudeFlowAdapterImpl {
             return `aqe-trajectory-${Date.now()}`;
         }
         try {
-            const { execSync } = await import('child_process');
-            const agentArg = agent ? `--agent "${agent}"` : '';
-            const result = execSync(`npx --no-install @claude-flow/cli hooks intelligence trajectory-start --task "${task}" ${agentArg}`, { ...EXEC_OPTS, timeout: 10000 });
+            const { execFileSync } = await import('child_process');
+            const { bin, args } = cfCliArgs('hooks', 'intelligence', 'trajectory-start', '--task', task);
+            if (agent) {
+                args.push('--agent', agent);
+            }
+            const result = execFileSync(bin, args, { ...EXEC_OPTS, timeout: 10000 });
             // Parse trajectory ID from result
             const match = result.match(/trajectoryId[:\s]+["']?([^"'\s]+)/i);
             return match?.[1] || `cf-trajectory-${Date.now()}`;
@@ -104,10 +116,15 @@ export class ClaudeFlowAdapterImpl {
         if (!this.available)
             return;
         try {
-            const { execSync } = await import('child_process');
-            const resultArg = result ? `--result "${result}"` : '';
-            const qualityArg = quality !== undefined ? `--quality ${quality}` : '';
-            execSync(`npx --no-install @claude-flow/cli hooks intelligence trajectory-step --trajectory-id "${trajectoryId}" --action "${action}" ${resultArg} ${qualityArg}`, { ...EXEC_OPTS, timeout: 10000 });
+            const { execFileSync } = await import('child_process');
+            const { bin, args } = cfCliArgs('hooks', 'intelligence', 'trajectory-step', '--trajectory-id', trajectoryId, '--action', action);
+            if (result) {
+                args.push('--result', result);
+            }
+            if (quality !== undefined) {
+                args.push('--quality', String(quality));
+            }
+            execFileSync(bin, args, { ...EXEC_OPTS, timeout: 10000 });
         }
         catch (error) {
             // Non-critical: trajectory tracking is optional
@@ -121,9 +138,12 @@ export class ClaudeFlowAdapterImpl {
         if (!this.available)
             return;
         try {
-            const { execSync } = await import('child_process');
-            const feedbackArg = feedback ? `--feedback "${feedback}"` : '';
-            execSync(`npx --no-install @claude-flow/cli hooks intelligence trajectory-end --trajectory-id "${trajectoryId}" --success ${success} ${feedbackArg}`, { ...EXEC_OPTS, timeout: 10000 });
+            const { execFileSync } = await import('child_process');
+            const { bin, args } = cfCliArgs('hooks', 'intelligence', 'trajectory-end', '--trajectory-id', trajectoryId, '--success', String(success));
+            if (feedback) {
+                args.push('--feedback', feedback);
+            }
+            execFileSync(bin, args, { ...EXEC_OPTS, timeout: 10000 });
         }
         catch (error) {
             // Non-critical: trajectory end is optional
@@ -139,8 +159,9 @@ export class ClaudeFlowAdapterImpl {
             return { model: 'sonnet', confidence: 0.5 };
         }
         try {
-            const { execSync } = await import('child_process');
-            const result = execSync(`npx --no-install @claude-flow/cli hooks model-route --task "${task}"`, { ...EXEC_OPTS, timeout: 10000 });
+            const { execFileSync } = await import('child_process');
+            const { bin, args } = cfCliArgs('hooks', 'model-route', '--task', task);
+            const result = execFileSync(bin, args, { ...EXEC_OPTS, timeout: 10000 });
             // Parse result
             const modelMatch = result.match(/model[:\s]+["']?(haiku|sonnet|opus)/i);
             const confMatch = result.match(/confidence[:\s]+([0-9.]+)/i);
@@ -162,8 +183,9 @@ export class ClaudeFlowAdapterImpl {
         if (!this.available)
             return;
         try {
-            const { execSync } = await import('child_process');
-            execSync(`npx --no-install @claude-flow/cli hooks model-outcome --task "${task}" --model ${model} --outcome ${outcome}`, { ...EXEC_OPTS, timeout: 10000 });
+            const { execFileSync } = await import('child_process');
+            const { bin, args } = cfCliArgs('hooks', 'model-outcome', '--task', task, '--model', model, '--outcome', outcome);
+            execFileSync(bin, args, { ...EXEC_OPTS, timeout: 10000 });
         }
         catch (error) {
             // Non-critical: outcome recording is optional
@@ -178,8 +200,9 @@ export class ClaudeFlowAdapterImpl {
             return { success: false, reason: 'Claude Flow not available' };
         }
         try {
-            const { execSync } = await import('child_process');
-            const result = execSync(`npx --no-install @claude-flow/cli hooks pretrain --path "${path}" --depth ${depth}`, { ...EXEC_OPTS, timeout: 60000 });
+            const { execFileSync } = await import('child_process');
+            const { bin, args } = cfCliArgs('hooks', 'pretrain', '--path', path, '--depth', depth);
+            const result = execFileSync(bin, args, { ...EXEC_OPTS, timeout: 60000 });
             // Try to parse JSON result
             try {
                 return safeJsonParse(result);
@@ -199,9 +222,12 @@ export class ClaudeFlowAdapterImpl {
         if (!this.available)
             return;
         try {
-            const { execSync } = await import('child_process');
-            const metadataArg = metadata ? `--metadata '${JSON.stringify(metadata)}'` : '';
-            execSync(`npx --no-install @claude-flow/cli hooks intelligence pattern-store --pattern "${pattern}" --type ${type} --confidence ${confidence} ${metadataArg}`, { ...EXEC_OPTS, timeout: 10000 });
+            const { execFileSync } = await import('child_process');
+            const { bin, args } = cfCliArgs('hooks', 'intelligence', 'pattern-store', '--pattern', pattern, '--type', type, '--confidence', String(confidence));
+            if (metadata) {
+                args.push('--metadata', JSON.stringify(metadata));
+            }
+            execFileSync(bin, args, { ...EXEC_OPTS, timeout: 10000 });
         }
         catch (error) {
             // Non-critical: pattern storage is optional
@@ -216,8 +242,9 @@ export class ClaudeFlowAdapterImpl {
             return [];
         }
         try {
-            const { execSync } = await import('child_process');
-            const result = execSync(`npx --no-install @claude-flow/cli hooks intelligence pattern-search --query "${query}" --top-k ${topK}`, { ...EXEC_OPTS, timeout: 10000 });
+            const { execFileSync } = await import('child_process');
+            const { bin, args } = cfCliArgs('hooks', 'intelligence', 'pattern-search', '--query', query, '--top-k', String(topK));
+            const result = execFileSync(bin, args, { ...EXEC_OPTS, timeout: 10000 });
             // Try to parse JSON result
             try {
                 const parsed = safeJsonParse(result);

package/dist/init/init-wizard.js

@@ -272,7 +272,7 @@ export class InitOrchestrator {
         if (this.options.autoMigrate) {
             console.log('Auto-migrate mode enabled. Running migration...\n');
             // Fire and forget - the caller will await initialize() which runs migration inline
-            runV2Migration(this.projectRoot, v2Detection).catch(() => { });
+            runV2Migration(this.projectRoot, v2Detection).catch((e) => { console.warn('[InitWizard] V2 migration failed:', e instanceof Error ? e.message : e); });
             return null;
         }
         // Warn and suggest migration

package/dist/init/phases/07-hooks.js

@@ -285,9 +285,9 @@ export class HooksPhase extends BasePhase {
  */
 const fs = require('fs');
 const path = require('path');
-const { execSync } = require('child_process');
+const { execFileSync } = require('child_process');
 
-function q(cmd, d) { try { return execSync(cmd, { encoding: 'utf-8', timeout: 3000 }).trim(); } catch { return d || ''; } }
+function q(bin, args, d) { try { return execFileSync(bin, args, { encoding: 'utf-8', timeout: 3000, stdio: ['pipe', 'pipe', 'pipe'] }).trim(); } catch { return d || ''; } }
 
 const dir = process.cwd();
 const dbPath = path.join(dir, '.agentic-qe', 'memory.db');
@@ -301,7 +301,7 @@ try {
   }
 } catch { /* ignore */ }
 
-const branch = q('git branch --show-current 2>/dev/null');
+const branch = q('git', ['branch', '--show-current']);
 const branchStr = branch ? \`  \\x1b[34m⎇ \${branch}\\x1b[0m\` : '';
 const patStr = patterns > 0 ? \`  \\x1b[35m🎓 \${patterns} patterns\\x1b[0m\` : '';
 
@@ -321,7 +321,7 @@ console.log(\`\\x1b[1m\\x1b[35m▊ Agentic QE v3\\x1b[0m\${branchStr}\${patStr}\
  *   node brain-checkpoint.cjs export   # Export brain to aqe.rvf (session-end)
  *   node brain-checkpoint.cjs verify   # Verify aqe.rvf exists (session-start)
  */
-const { execSync } = require('child_process');
+const { execFileSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
 
@@ -338,8 +338,8 @@ function exportBrain() {
     if (fs.existsSync(RVF_PATH)) fs.unlinkSync(RVF_PATH);
     const idmap = RVF_PATH + '.idmap.json';
     if (fs.existsSync(idmap)) fs.unlinkSync(idmap);
-    const result = execSync(
-      'npx agentic-qe brain export -o "' + RVF_PATH + '" --format rvf 2>&1',
+    const result = execFileSync(
+      'npx', ['agentic-qe', 'brain', 'export', '-o', RVF_PATH, '--format', 'rvf'],
       { timeout: 60000, encoding: 'utf-8' }
     );
     const m = result.match(/Patterns:\\s+(\\d+)/);

package/dist/init/settings-merge.js

@@ -13,6 +13,8 @@ const AQE_COMMAND_PATTERNS = [
     /\bagentic-qe\b/i,
     /\bnpx\s+agentic-qe\b/i,
     /\bnpx\s+@anthropics\/agentic-qe\b/i,
+    /brain-checkpoint\.cjs/i,
+    /\.claude\/helpers\//i,
 ];
 /**
  * Check if a single hook entry belongs to AQE (any variant).

package/dist/integrations/ruvector/brain-rvf-exporter.js

@@ -195,7 +195,13 @@ export function importBrainFromRvf(db, rvfPath, options) {
         if (!kernel || !kernel.image) {
             throw new Error('No brain data found in RVF file (missing kernel segment)');
         }
-        const brainData = JSON.parse(kernel.image.toString('utf-8'));
+        let brainData;
+        try {
+            brainData = JSON.parse(kernel.image.toString('utf-8'));
+        }
+        catch (parseErr) {
+            throw new Error(`Failed to parse brain kernel data as JSON: ${parseErr instanceof Error ? parseErr.message : parseErr}`);
+        }
         if (options.dryRun) {
             let total = 0;
             if (brainData.tables) {
@@ -296,7 +302,13 @@ export function brainInfoFromRvf(rvfPath) {
             throw new Error('No brain data found in RVF file');
         }
         const brainJson = kernel.image.toString('utf-8');
-        const brainData = JSON.parse(brainJson);
+        let brainData;
+        try {
+            brainData = JSON.parse(brainJson);
+        }
+        catch (parseErr) {
+            throw new Error(`Failed to parse brain kernel data as JSON: ${parseErr instanceof Error ? parseErr.message : parseErr}`);
+        }
         const status = rvf.status();
         const fileSize = statSync(filePath).size;
         const t = brainData.tables;

package/dist/learning/experience-capture-middleware.js

@@ -14,6 +14,8 @@
 import { v4 as uuidv4 } from 'uuid';
 import { getUnifiedMemory } from '../kernel/unified-memory.js';
 import { toErrorMessage } from '../shared/error-utils.js';
+import { createLogger } from '../logging/logger-factory.js';
+const ecLogger = createLogger('ExperienceCapture');
 // ============================================================================
 // Active Experience Tracking
 // ============================================================================
@@ -269,7 +271,7 @@ async function persistExperience(context, outcome) {
     `);
         stmt.run(outcome.id, context.task, context.agent, context.domain, outcome.success ? 1 : 0, outcome.quality, outcome.durationMs, context.modelTier || null, safeJsonStringify(context.routing), safeJsonStringify(outcome.steps), safeJsonStringify(outcome.result), outcome.error || null, context.startedAt.toISOString(), 'middleware');
         // Fire-and-forget: compute and store embedding for this experience
-        computeExperienceEmbedding(db, outcome.id, context.task, context.domain).catch(() => { });
+        computeExperienceEmbedding(db, outcome.id, context.task, context.domain).catch((e) => { ecLogger.warn('Embedding computation failed', { error: e instanceof Error ? e.message : String(e), experienceId: outcome.id, domain: context.domain }); });
     }
     catch (error) {
         console.error('[ExperienceCaptureMiddleware] Failed to persist experience:', error);

package/dist/learning/qe-reasoning-bank.js

@@ -1059,7 +1059,7 @@ On promotion:
         const result = await this.patternStore.create(options);
         // ADR-070: Record pattern creation in witness chain
         if (result.success) {
-            getWitnessChain().then(wc => wc.append('PATTERN_CREATE', { patternId: result.value.id, domain: result.value.qeDomain, confidence: result.value.confidence, name: result.value.name }, 'reasoning-bank')).catch(() => { });
+            getWitnessChain().then(wc => wc.append('PATTERN_CREATE', { patternId: result.value.id, domain: result.value.qeDomain, confidence: result.value.confidence, name: result.value.name }, 'reasoning-bank')).catch((e) => { logger.warn('Witness chain PATTERN_CREATE failed', { error: toErrorMessage(e) }); });
             // Phase 3: Best-effort RVF dual-write for vector replication
             if (this.rvfDualWriter && result.value.embedding && result.value.embedding.length > 0) {
                 try {
@@ -1137,7 +1137,7 @@ On promotion:
                 this.stats.successfulOutcomes++;
             }
             // ADR-070: Record pattern update in witness chain
-            getWitnessChain().then(wc => wc.append('PATTERN_UPDATE', { patternId: outcome.patternId, success: outcome.success }, 'reasoning-bank')).catch(() => { });
+            getWitnessChain().then(wc => wc.append('PATTERN_UPDATE', { patternId: outcome.patternId, success: outcome.success }, 'reasoning-bank')).catch((e) => { logger.warn('Witness chain PATTERN_UPDATE failed', { error: toErrorMessage(e) }); });
             // Check if pattern should be promoted (with coherence gate)
             const pattern = await this.getPattern(outcome.patternId);
             if (pattern && await this.checkPatternPromotionWithCoherence(pattern)) {
@@ -1240,7 +1240,7 @@ On promotion:
                 }
             }
             // ADR-070: Record pattern promotion in witness chain
-            getWitnessChain().then(wc => wc.append('PATTERN_PROMOTE', { patternId }, 'reasoning-bank')).catch(() => { });
+            getWitnessChain().then(wc => wc.append('PATTERN_PROMOTE', { patternId }, 'reasoning-bank')).catch((e) => { logger.warn('Witness chain PATTERN_PROMOTE failed', { error: toErrorMessage(e) }); });
             logger.info('Promoted pattern to long-term', { patternId });
             if (this.eventBus) {
                 await this.eventBus.publish({

package/dist/learning/sqlite-persistence.js

@@ -183,6 +183,22 @@ export class SQLitePatternStore {
         FOREIGN KEY (pattern_id) REFERENCES qe_patterns(id) ON DELETE CASCADE
       );
 
+      -- Agent co-execution tracking (Issue #342 Item 3)
+      CREATE TABLE IF NOT EXISTS qe_agent_co_execution (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        agent_a TEXT NOT NULL,
+        agent_b TEXT NOT NULL,
+        domain TEXT NOT NULL,
+        success INTEGER NOT NULL DEFAULT 0,
+        task_description TEXT,
+        created_at TEXT DEFAULT (datetime('now'))
+      );
+
+      CREATE INDEX IF NOT EXISTS idx_co_exec_agents
+        ON qe_agent_co_execution(agent_a, agent_b);
+      CREATE INDEX IF NOT EXISTS idx_co_exec_domain
+        ON qe_agent_co_execution(domain);
+
       -- Unique constraint to prevent duplicate patterns
       CREATE UNIQUE INDEX IF NOT EXISTS idx_patterns_unique_name_domain_type
         ON qe_patterns(name, qe_domain, pattern_type);

package/dist/learning/token-tracker.js

@@ -34,6 +34,8 @@ import { randomUUID } from 'crypto';
 import { getUnifiedMemory } from '../kernel/unified-memory.js';
 import { toErrorMessage } from '../shared/error-utils.js';
 import { safeJsonParse } from '../shared/safe-json.js';
+import { createLogger } from '../logging/logger-factory.js';
+const ttLogger = createLogger('TokenTracker');
 const DEFAULT_COST_CONFIG = {
     costPerInputToken: 0.003 / 1000, // $3 per 1M input tokens
     costPerOutputToken: 0.015 / 1000, // $15 per 1M output tokens
@@ -84,7 +86,7 @@ class TokenMetricsCollectorImpl {
             this.costConfig = { ...DEFAULT_COST_CONFIG, ...config };
         }
         // Activate DB-backed persistence and auto-save timer
-        this.initializeDb().catch(() => { });
+        this.initializeDb().catch((e) => { ttLogger.warn('DB initialization failed', { error: e instanceof Error ? e.message : String(e) }); });
         this.startAutoSave();
     }
     /**
@@ -601,7 +603,7 @@ class TokenMetricsCollectorImpl {
         this.kvPersistCount++;
         if (this.kvPersistCount >= TokenMetricsCollectorImpl.KV_PERSIST_INTERVAL) {
             this.kvPersistCount = 0;
-            this.persistToKv().catch(() => { });
+            this.persistToKv().catch((e) => { ttLogger.warn('KV persist failed', { error: e instanceof Error ? e.message : String(e) }); });
         }
     }
     // ============================================================================