agentic-qe 3.8.1 → 3.8.3

package/dist/init/phases/07-hooks.js

@@ -58,7 +58,7 @@ export class HooksPhase extends BasePhase {
             }
         }
         // Generate new AQE hooks
-        const aqeHooks = this.generateHooksConfig(config);
+        const aqeHooks = this.generateHooksConfig(config, projectRoot);
         const hookTypes = Object.keys(aqeHooks);
         // Detect if there are existing AQE hooks
         const existingHooks = settings.hooks || {};
@@ -74,10 +74,24 @@ export class HooksPhase extends BasePhase {
             ...existingEnv,
             ...generateAqeEnvVars(config),
         };
-        // Apply v3 settings sections (statusLine, permissions, v3Configuration, v3Learning, etc.)
-        const v3Sections = generateV3SettingsSections(config);
+        // Apply v3 settings sections (statusLine, v3Configuration, v3Learning, etc.)
+        // Permissions are union-merged to preserve user entries (#362)
+        const v3Sections = generateV3SettingsSections(config, projectRoot);
         for (const [key, value] of Object.entries(v3Sections)) {
-            settings[key] = value;
+            if (key === '_aqePermissions') {
+                // Union-merge: add AQE entries without removing user-added permissions
+                const existingPerms = settings.permissions || {};
+                const existingAllow = existingPerms.allow || [];
+                const aqeEntries = value;
+                const merged = [...new Set([...existingAllow, ...aqeEntries])];
+                settings.permissions = {
+                    ...existingPerms,
+                    allow: merged,
+                };
+            }
+            else {
+                settings[key] = value;
+            }
         }
         // Enable MCP servers (deduplicate, replace old 'aqe' with 'agentic-qe')
         let existingMcp = settings.enabledMcpjsonServers || [];
@@ -378,7 +392,7 @@ if (process.argv.includes('--json')) process.stdout.write(JSON.stringify(result)
      * Uses `npx agentic-qe` for portability - works without global installation.
      * All hooks use --json output for structured data and fail silently with continueOnError.
      */
-    generateHooksConfig(_config) {
+    generateHooksConfig(_config, _projectRoot) {
         // Shell injection safety: env vars like $TOOL_INPUT_file_path are set by
         // Claude Code as environment variables before invoking the hook command.
         // We pass them via --file "$TOOL_INPUT_file_path" which is safe because
@@ -498,7 +512,7 @@ if (process.argv.includes('--json')) process.stdout.write(JSON.stringify(result)
                     hooks: [
                         {
                             type: 'command',
-                            command: 'node "$(git rev-parse --show-toplevel 2>/dev/null || pwd)/.claude/helpers/brain-checkpoint.cjs" verify --json',
+                            command: 'node .claude/helpers/brain-checkpoint.cjs verify --json',
                             timeout: 5000,
                             continueOnError: true,
                         },
@@ -520,7 +534,7 @@ if (process.argv.includes('--json')) process.stdout.write(JSON.stringify(result)
                     hooks: [
                         {
                             type: 'command',
-                            command: 'node "$(git rev-parse --show-toplevel 2>/dev/null || pwd)/.claude/helpers/brain-checkpoint.cjs" export --json',
+                            command: 'node .claude/helpers/brain-checkpoint.cjs export --json',
                             timeout: 60000,
                             continueOnError: true,
                         },

package/dist/init/settings-merge.d.ts

@@ -31,5 +31,5 @@ export declare function generateAqeEnvVars(config: AQEInitConfig): Record<string
  * Generate v3-specific settings sections for settings.json.
  * These sections enable the self-learning system, status line, and permissions.
  */
-export declare function generateV3SettingsSections(config: AQEInitConfig): Record<string, unknown>;
+export declare function generateV3SettingsSections(config: AQEInitConfig, projectRoot?: string): Record<string, unknown>;
 //# sourceMappingURL=settings-merge.d.ts.map

package/dist/init/settings-merge.js

@@ -87,7 +87,7 @@ export function generateAqeEnvVars(config) {
  * Generate v3-specific settings sections for settings.json.
  * These sections enable the self-learning system, status line, and permissions.
  */
-export function generateV3SettingsSections(config) {
+export function generateV3SettingsSections(config, projectRoot) {
     const domains = config.domains?.enabled || [];
     return {
         aqe: {
@@ -97,21 +97,20 @@ export function generateV3SettingsSections(config) {
         },
         statusLine: {
             type: 'command',
-            command: 'node "$(git rev-parse --show-toplevel 2>/dev/null || pwd)/.claude/helpers/statusline-v3.cjs" 2>/dev/null || echo "▊ Agentic QE v3"',
+            command: 'node .claude/helpers/statusline-v3.cjs 2>/dev/null || echo "▊ Agentic QE v3"',
             refreshMs: 5000,
             enabled: true,
         },
-        permissions: {
-            allow: [
-                'Bash(npx claude-flow:*)',
-                'Bash(npx @claude-flow/cli:*)',
-                'mcp__claude-flow__:*',
-                'mcp__agentic-qe__*',
-            ],
-            deny: [
-                'Bash(rm -rf /)',
-            ],
-        },
+        // permissions are union-merged in 07-hooks.ts — not set here to avoid overwriting user entries (#362)
+        _aqePermissions: [
+            'Bash(npx ruflo:*)',
+            'Bash(npx @ruflo/cli:*)',
+            'Bash(npx claude-flow:*)',
+            'Bash(npx @claude-flow/cli:*)',
+            'mcp__ruflo__:*',
+            'mcp__claude-flow__:*',
+            'mcp__agentic-qe__*',
+        ],
         includeCoAuthoredBy: true,
         v3Configuration: {
             domains: {

package/dist/init/skills-installer.d.ts

@@ -14,6 +14,7 @@ export interface SkillInfo {
 export interface SkillsInstallResult {
     installed: SkillInfo[];
     skipped: string[];
+    removed: string[];
     errors: string[];
     totalCount: number;
     skillsDir: string;
@@ -52,6 +53,15 @@ export declare class SkillsInstaller {
      * ADR-056: Deterministic Skill Validation System
      */
     private installValidationInfrastructure;
+    /**
+     * Remove deprecated/merged skills from an existing installation.
+     * Only runs during --upgrade to clean up stale skill directories.
+     */
+    private removeDeprecatedSkills;
+    /**
+     * Remove a directory and all its contents recursively
+     */
+    private removeDirectoryRecursive;
     /**
      * Get list of available skills from source directory
      */

package/dist/init/skills-installer.js

@@ -5,7 +5,7 @@
  * Installs AQE skills (both v2 methodology and v3 domain skills) to user projects.
  * Skills are copied from the bundled skills directory to the project's .claude/skills/.
  */
-import { existsSync, mkdirSync, readdirSync, statSync, readFileSync, writeFileSync, copyFileSync } from 'fs';
+import { existsSync, mkdirSync, readdirSync, statSync, readFileSync, writeFileSync, copyFileSync, unlinkSync, rmdirSync } from 'fs';
 import { join, dirname } from 'path';
 import { fileURLToPath } from 'url';
 import { toErrorMessage } from '../shared/error-utils.js';
@@ -13,11 +13,11 @@ import { toErrorMessage } from '../shared/error-utils.js';
 // Skill Categories (QE Skills Only - Claude Flow skills are managed separately)
 // ============================================================================
 /**
- * V3 QE domain skills - 13 bounded contexts + migration/iteration utilities
+ * V3 QE domain skills - 10 bounded contexts + utilities + new ADR-086 skills
  * These are QE-specific skills for v3's DDD architecture
  */
 const V3_DOMAIN_SKILLS = [
-    // 12 DDD bounded context skills
+    // 10 DDD bounded context skills (qe-security-compliance merged into security-testing, qe-contract-testing merged into contract-testing)
     'qe-test-generation', // AI-powered test synthesis
     'qe-test-execution', // Parallel execution, retry logic
     'qe-coverage-analysis', // O(log n) sublinear coverage
@@ -25,15 +25,23 @@ const V3_DOMAIN_SKILLS = [
     'qe-defect-intelligence', // ML defect prediction, root cause
     'qe-requirements-validation', // BDD scenarios, acceptance criteria
     'qe-code-intelligence', // Knowledge graphs, 80% token reduction
-    'qe-security-compliance', // OWASP, CVE detection
     'pentest-validation', // Graduated exploit validation (Shannon-inspired)
-    'qe-contract-testing', // Pact, schema validation
     'qe-visual-accessibility', // Visual regression, WCAG
     'qe-chaos-resilience', // Fault injection, resilience
     'qe-learning-optimization', // Transfer learning, self-improvement
     // V3 utilities
-    'aqe-v2-v3-migration', // Migration guide from v2 to v3
     'qe-iterative-loop', // QE iteration patterns
+    // New skills (ADR-086 skill design standards)
+    'strict-tdd', // On-demand hook: TDD enforcement
+    'no-skip', // On-demand hook: prevent test skips
+    'coverage-guard', // On-demand hook: coverage regression prevention
+    'freeze-tests', // On-demand hook: block test edits during refactoring
+    'security-watch', // On-demand hook: real-time security scanning
+    'skill-stats', // Skill usage measurement
+    'test-failure-investigator', // Runbook: test failure root cause
+    'coverage-drop-investigator', // Runbook: coverage regression tracing
+    'e2e-flow-verifier', // Product verification with Playwright
+    'test-metrics-dashboard', // Test history and trend analysis
 ];
 /**
  * Internal/excluded skills - NOT installed for end users
@@ -95,6 +103,16 @@ const EXCLUDED_SKILLS = [
     // Internal release workflow skill
     'release',
 ];
+/**
+ * Deprecated/removed skills that should be cleaned up from existing installations.
+ * These were merged into other skills or removed entirely.
+ * On --upgrade, these directories are deleted from the user's .claude/skills/.
+ */
+const DEPRECATED_SKILLS = [
+    'qe-contract-testing', // Merged into contract-testing (ADR-086)
+    'qe-security-compliance', // Merged into security-testing (ADR-086)
+    'aqe-v2-v3-migration', // No longer needed
+];
 // ============================================================================
 // Skills Installer Class
 // ============================================================================
@@ -170,6 +188,7 @@ export class SkillsInstaller {
         const result = {
             installed: [],
             skipped: [],
+            removed: [],
             errors: [],
             totalCount: 0,
             skillsDir: join(this.projectRoot, '.claude', 'skills'),
@@ -205,6 +224,10 @@ export class SkillsInstaller {
                 result.errors.push(`Failed to install ${skillName}: ${toErrorMessage(error)}`);
             }
         }
+        // Remove deprecated skills from existing installations
+        if (this.options.overwrite) {
+            result.removed = this.removeDeprecatedSkills(targetSkillsDir);
+        }
         // Install validation infrastructure (ADR-056)
         result.validationInstalled = this.installValidationInfrastructure(targetSkillsDir);
         // Create skills index file
@@ -243,6 +266,45 @@ export class SkillsInstaller {
             return false;
         }
     }
+    /**
+     * Remove deprecated/merged skills from an existing installation.
+     * Only runs during --upgrade to clean up stale skill directories.
+     */
+    removeDeprecatedSkills(targetSkillsDir) {
+        const removed = [];
+        for (const skillName of DEPRECATED_SKILLS) {
+            const skillDir = join(targetSkillsDir, skillName);
+            if (existsSync(skillDir)) {
+                try {
+                    this.removeDirectoryRecursive(skillDir);
+                    removed.push(skillName);
+                }
+                catch (error) {
+                    console.error(`[SkillsInstaller] Failed to remove deprecated skill ${skillName}:`, error instanceof Error ? error.message : error);
+                }
+            }
+        }
+        if (removed.length > 0) {
+            console.debug(`[SkillsInstaller] Removed ${removed.length} deprecated skills: ${removed.join(', ')}`);
+        }
+        return removed;
+    }
+    /**
+     * Remove a directory and all its contents recursively
+     */
+    removeDirectoryRecursive(dirPath) {
+        const entries = readdirSync(dirPath, { withFileTypes: true });
+        for (const entry of entries) {
+            const fullPath = join(dirPath, entry.name);
+            if (entry.isDirectory()) {
+                this.removeDirectoryRecursive(fullPath);
+            }
+            else {
+                unlinkSync(fullPath);
+            }
+        }
+        rmdirSync(dirPath);
+    }
     /**
      * Get list of available skills from source directory
      */

package/dist/integrations/ruvector/sona-persistence.d.ts

@@ -302,6 +302,12 @@ export declare class PersistentSONAEngine {
         requestCount: number;
         ewcLambda: number;
     } | null;
+    /**
+     * Internal variant of loadFisherMatrix that skips ensureInitialized().
+     * Used only during _doInitialize() when DB and statements are ready
+     * but this.initialized has not been set yet.
+     */
+    private _loadFisherMatrixUnsafe;
     /**
      * Delete Fisher matrix for a domain.
      *

package/dist/integrations/ruvector/sona-persistence.js

@@ -168,7 +168,9 @@ export class PersistentSONAEngine {
                     this.saveFisherMatrix(domain, fisher, optimal, base, meta);
                 }, this.config.domain);
                 // Restore Fisher state from SQLite if available
-                const saved = this.loadFisherMatrix(this.config.domain);
+                // Use prepared statement directly — ensureInitialized() would throw
+                // because this.initialized is not yet set during _doInitialize()
+                const saved = this._loadFisherMatrixUnsafe(this.config.domain);
                 if (saved) {
                     const engine = this.baseEngine.getThreeLoopEngine();
                     if (engine) {
@@ -770,6 +772,29 @@ export class PersistentSONAEngine {
             ewcLambda: row.ewc_lambda,
         };
     }
+    /**
+     * Internal variant of loadFisherMatrix that skips ensureInitialized().
+     * Used only during _doInitialize() when DB and statements are ready
+     * but this.initialized has not been set yet.
+     */
+    _loadFisherMatrixUnsafe(domain) {
+        const stmt = this.prepared.get('getFisher');
+        if (!stmt)
+            return null;
+        const row = stmt.get(domain);
+        if (!row)
+            return null;
+        return {
+            fisherDiagonal: this.bufferToFloat32(row.fisher_diagonal),
+            optimalParams: this.bufferToFloat32(row.optimal_params),
+            baseWeights: row.base_weights ? this.bufferToFloat32(row.base_weights) : null,
+            dimension: row.dimension,
+            taskBoundaries: row.task_boundaries,
+            consolidationCycles: row.consolidation_cycles,
+            requestCount: row.request_count,
+            ewcLambda: row.ewc_lambda,
+        };
+    }
     /**
      * Delete Fisher matrix for a domain.
      *