agentic-qe 3.8.13 → 3.9.0

package/.claude/skills/skills-manifest.json

@@ -932,7 +932,7 @@
   },
   "metadata": {
     "generatedBy": "Agentic QE Fleet",
-    "fleetVersion": "3.8.13",
+    "fleetVersion": "3.9.0",
     "manifestVersion": "1.3.0",
     "lastUpdated": "2026-02-04T00:00:00.000Z",
     "contributors": [

package/CHANGELOG.md

@@ -5,6 +5,54 @@ All notable changes to the Agentic QE project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.9.0] - 2026-04-02
+
+### Added
+
+- **CC-internals improvements (IMP-00 through IMP-10)** — 11 production-hardening improvements across 4 priority tiers with 466+ new tests across 37 test files.
+- **4-tier context compaction pipeline** — Progressive memory compaction with microcompact (tier 1), session summary (tier 2), LLM compact (tier 3), and reactive eviction (tier 4). Context budget tracking prevents overflows.
+- **Plugin architecture** — Extensible plugin system with lifecycle management, manifest validation, dependency resolution, security sandboxing, and caching. Supports local, GitHub, and npm plugin sources.
+- **QE Quality Daemon** — Background quality monitoring service with priority queue, git watcher (Linux polling fallback), coverage delta analyzer, CI monitor, test suggester, nightly consolidation, notification service with SSRF guard, and persistent SQLite-backed memory.
+- **Retry engine** — Configurable retry mechanism with exponential backoff, jitter, circuit breaker, and per-error-class strategies for resilient service calls.
+- **Prompt cache latch** — Intelligent prompt caching with field-level latch controls to reduce redundant LLM calls.
+- **Session durability middleware** — MCP session state persistence and resume across connection interruptions.
+- **Startup fast paths** — Parallel module prefetch and fast-path boot sequences that skip unused subsystems.
+- **Hook security hardening** — SSRF guard for webhook URLs, config snapshot verification, and standardized exit codes.
+- **Middleware chain and batch executor** — Composable MCP middleware pipeline with batched tool execution support.
+- **8 env var kill switches** — `AQE_MICROCOMPACT`, `AQE_RETRY_DISABLED`, `AQE_SESSION_DURABILITY`, `AQE_PROMPT_CACHE_LATCH`, `AQE_FAST_PATHS`, `AQE_HOOKS_SSRF_DISABLED`, `AQE_COMPACTION_DISABLED`, `AQE_PLUGINS_DISABLED` for granular feature control.
+- **`aqe daemon` CLI commands** — Start, stop, and manage the QE Quality Daemon from the command line.
+- **`aqe plugin` CLI commands** — Install, list, and manage plugins from the command line.
+
+### Changed
+
+- **Lazy-load CLI handlers** — Heavy imports (kernel, coordination, workers, unified-memory) are now deferred until command execution. Reduces CLI startup cost by avoiding eager module resolution.
+- **esbuild code splitting** — CLI build now uses chunk output with splitting enabled for smaller initial bundles.
+- **CLI index refactored** — Extracted workflow command into dedicated module, added lazy-registry for on-demand handler loading.
+
+### Fixed
+
+- **Internal log leak to stdout** — Redirected `[ParserRegistry]`, `[ContinueGateIntegration]`, and timestamped internal logs to stderr so they don't interfere with structured CLI output.
+
+## [3.8.14] - 2026-03-31
+
+### Fixed
+
+- **Security: SQL injection in witness-chain LIMIT/OFFSET** — Parameterized LIMIT and OFFSET values in `getEntries()` query instead of string interpolation. Also handles offset-without-limit correctly via SQLite `LIMIT -1` idiom, and `limit=0` now properly returns zero rows.
+- **Removed `@faker-js/faker` from 7 production generator files** — Replaced with lightweight `test-value-helpers.ts` using only `node:crypto`. Eliminates ~6 MB runtime dependency for npm consumers. Generators now work without devDependencies installed.
+- **`aqe init` hook paths break from subfolders** — Adopted `CLAUDE_PROJECT_DIR` pattern so hook commands resolve correctly regardless of working directory.
+- **Removed ruflo permissions from `aqe init`** — Only AQE-specific entries are injected into user settings; third-party tool permissions no longer leak in.
+- **Dead MCP `server.ts` removed (911 lines)** — Eliminated unused dual-server divergence risk; production uses `MCPProtocolServer` via `entry.ts`.
+- **CI publishes without test gate** — Added mandatory unit test pass gate to `npm-publish.yml`. Removed `continue-on-error` from `optimized-ci.yml` test steps.
+- **ESLint broken in ESM project** — Renamed `.eslintrc.js` to `.eslintrc.cjs` for CommonJS compatibility.
+- **Hardcoded version `3.0.0` in MCP servers** — `protocol-server.ts` and `http-server.ts` now read version dynamically from `package.json`.
+- **Vitest process hang on native modules** — Added worker-level `afterAll` force-exit and global teardown safety net for `better-sqlite3` / `hnswlib-node` handles.
+
+### Added
+
+- **`test-value-helpers.ts`** — Zero-dependency test data generator for test-generation domain using `node:crypto` built-ins with range guards for edge cases.
+- **Pagination edge case tests** — `limit=0`, offset-without-limit, and offset-beyond-total coverage in witness-chain tests.
+- **17 unit tests for test-value-helpers** — Covers all value generators including boundary inputs and inverted ranges.
+
 ## [3.8.13] - 2026-03-30
 
 ### Added

package/dist/adapters/a2ui/integration/agui-sync.js

@@ -455,7 +455,8 @@ export class AGUISyncService extends EventEmitter {
     findActionMapping(actionId) {
         return this.actionMappings.find((m) => {
             if (m.actionPattern.includes('*')) {
-                const regex = new RegExp('^' + m.actionPattern.replace(/\*/g, '.*') + '$');
+                const escaped = m.actionPattern.replace(/[.+?^${}()|[\]\\]/g, '\\$&');
+                const regex = new RegExp('^' + escaped.replace(/\*/g, '.*') + '$');
                 return regex.test(actionId);
             }
             return m.actionPattern === actionId;

package/dist/audit/witness-chain.js

@@ -190,9 +190,21 @@ export class WitnessChain {
             params.push(filter.actor);
         }
         const where = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : '';
-        const limit = filter?.limit ? `LIMIT ${filter.limit}` : '';
-        const offset = filter?.offset ? `OFFSET ${filter.offset}` : '';
-        return this.db.prepare(`SELECT * FROM witness_chain ${where} ORDER BY id ASC ${limit} ${offset}`).all(...params);
+        const hasLimit = filter?.limit != null;
+        const hasOffset = filter?.offset != null;
+        // SQLite requires LIMIT before OFFSET; use LIMIT -1 ("all rows") when only offset is given
+        const limitClause = hasLimit ? 'LIMIT ?' : (hasOffset ? 'LIMIT ?' : '');
+        const offsetClause = hasOffset ? 'OFFSET ?' : '';
+        if (hasLimit) {
+            params.push(filter.limit);
+        }
+        else if (hasOffset) {
+            params.push(-1);
+        }
+        if (hasOffset) {
+            params.push(filter.offset);
+        }
+        return this.db.prepare(`SELECT * FROM witness_chain ${where} ORDER BY id ASC ${limitClause} ${offsetClause}`).all(...params);
     }
     /** Get all witness entries for a pattern by ID (checks both patternId and pattern_id keys). */
     getPatternLineage(patternId) {

package/dist/boot/fast-paths.d.ts

@@ -0,0 +1,24 @@
+/**
+ * IMP-06: Startup Fast Paths
+ *
+ * Mode detection and fast-path helpers that allow trivial CLI commands
+ * (--version, health) to bypass full kernel initialization.
+ *
+ * Integration into cli/index.ts and mcp/entry.ts is deferred to a follow-up wave.
+ */
+export type BootMode = 'cli-version' | 'cli-health' | 'cli-full' | 'mcp' | 'http';
+/**
+ * Detect the boot mode from process argv and environment variables.
+ * Checked in priority order: version flag > health subcommand > env-based modes > full CLI.
+ */
+export declare function detectBootMode(argv: string[]): BootMode;
+/**
+ * Returns true when argv contains --version or -v.
+ * Disabled via AQE_FAST_PATHS=false.
+ */
+export declare function isVersionFastPath(argv: string[]): boolean;
+/**
+ * Returns true when the first positional argument is "health".
+ */
+export declare function isHealthFastPath(argv: string[]): boolean;
+//# sourceMappingURL=fast-paths.d.ts.map

package/dist/boot/fast-paths.js

@@ -0,0 +1,43 @@
+/**
+ * IMP-06: Startup Fast Paths
+ *
+ * Mode detection and fast-path helpers that allow trivial CLI commands
+ * (--version, health) to bypass full kernel initialization.
+ *
+ * Integration into cli/index.ts and mcp/entry.ts is deferred to a follow-up wave.
+ */
+/**
+ * Detect the boot mode from process argv and environment variables.
+ * Checked in priority order: version flag > health subcommand > env-based modes > full CLI.
+ */
+export function detectBootMode(argv) {
+    // Check for version flag first (fastest path — no kernel needed)
+    if (argv.includes('--version') || argv.includes('-v'))
+        return 'cli-version';
+    // Check for health subcommand (second arg after node + script)
+    const subcommand = argv[2];
+    if (subcommand === 'health')
+        return 'cli-health';
+    // Check environment for MCP/HTTP mode
+    if (process.env.AQE_MCP === '1' || process.env.AQE_MCP_MODE === '1')
+        return 'mcp';
+    if (process.env.AQE_HTTP_PORT)
+        return 'http';
+    return 'cli-full';
+}
+/**
+ * Returns true when argv contains --version or -v.
+ * Disabled via AQE_FAST_PATHS=false.
+ */
+export function isVersionFastPath(argv) {
+    if (process.env.AQE_FAST_PATHS === 'false')
+        return false;
+    return argv.includes('--version') || argv.includes('-v');
+}
+/**
+ * Returns true when the first positional argument is "health".
+ */
+export function isHealthFastPath(argv) {
+    return argv[2] === 'health';
+}
+//# sourceMappingURL=fast-paths.js.map

package/dist/boot/parallel-prefetch.d.ts

@@ -0,0 +1,26 @@
+/**
+ * IMP-06: Parallel Prefetch
+ *
+ * Runs independent initialization tasks concurrently so that MCP/CLI startup
+ * time is bounded by the slowest single task rather than the sum of all tasks.
+ *
+ * Each task is wrapped in try/catch via Promise.allSettled so one failure
+ * does not block others.
+ */
+export interface PrefetchResult {
+    completedTasks: string[];
+    failedTasks: Array<{
+        name: string;
+        error: string;
+    }>;
+    totalTimeMs: number;
+}
+/**
+ * Run independent initialization tasks in parallel.
+ * Each task is wrapped in try/catch so one failure doesn't block others.
+ */
+export declare function parallelPrefetch(tasks: Array<{
+    name: string;
+    fn: () => Promise<void>;
+}>): Promise<PrefetchResult>;
+//# sourceMappingURL=parallel-prefetch.d.ts.map

package/dist/boot/parallel-prefetch.js

@@ -0,0 +1,36 @@
+/**
+ * IMP-06: Parallel Prefetch
+ *
+ * Runs independent initialization tasks concurrently so that MCP/CLI startup
+ * time is bounded by the slowest single task rather than the sum of all tasks.
+ *
+ * Each task is wrapped in try/catch via Promise.allSettled so one failure
+ * does not block others.
+ */
+/**
+ * Run independent initialization tasks in parallel.
+ * Each task is wrapped in try/catch so one failure doesn't block others.
+ */
+export async function parallelPrefetch(tasks) {
+    const start = performance.now();
+    const results = await Promise.allSettled(tasks.map(t => t.fn()));
+    const completedTasks = [];
+    const failedTasks = [];
+    results.forEach((result, i) => {
+        if (result.status === 'fulfilled') {
+            completedTasks.push(tasks[i].name);
+        }
+        else {
+            failedTasks.push({
+                name: tasks[i].name,
+                error: result.reason?.message ?? String(result.reason),
+            });
+        }
+    });
+    return {
+        completedTasks,
+        failedTasks,
+        totalTimeMs: performance.now() - start,
+    };
+}
+//# sourceMappingURL=parallel-prefetch.js.map