Semgrep integration was well-written but only used as a fallback in the
coordination layer — never invoked when the regex scanner succeeded.
Now SASTScanner.scanWithRules() runs pattern scanning + semgrep in parallel
when semgrep is installed, merging and deduplicating results.
Also corrects agent documentation that falsely claimed OWASP ZAP, TruffleHog,
Gitleaks, ESLint Security, and Snyk integrations. The actual implementations
are: regex patterns + semgrep (SAST), OSV API (deps), custom fetch-based
scanner (DAST), and regex patterns (secrets).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Brutal honesty review of the flatten-to-root migration found 12 categories
of issues. This commit fixes all of them:
- Fix @agentic-qe/v3 package refs in init installers and quality-criteria-service
- Fix 7 broken import() paths in rvf-baseline-benchmark.ts (v3/src → src)
- Fix prepare-assets.sh and demo-warmup.sh path references
- Delete dead scripts/migrate-v2-to-v3-memory.js
- Remove .claude-flow daemon state dirs (284KB) from agents/skills
- Add .claude-flow exclusion to .npmignore
- Fix JSDoc @agentic-qe/v3/ → agentic-qe/ in 27 source files
- Fix @module v3/ tags in 9 dream engine files
- Fix stale v3/ path refs in docs and architecture ADRs
- Revert memory namespace changes (aqe/v3/domains/* are DB identifiers,
not filesystem paths — changing them orphans 150K+ existing records)
- Update CLAUDE.md with agent classification rules (QE vs non-QE agents)
- Fix domain-team-manager test (scaling is not capped by defaultTeamSize)
- Fix adr-040 timing test threshold (20ms → 50ms for CI tolerance)
- Rename test:v3 → test:all in package.json
- Update README.md project structure tree
- Fix infra-healing test and demo script cd v3 references
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Convert static ESM imports in attention-wrapper.ts and gnn-wrapper.ts to
lazy require() with try/catch so the modules don't crash at import time
when native binaries are missing. Add musl→gnu aliases and x64 variants
to optionalDependencies to prevent npm arborist resolution failures.
Also fix Agent Booster keyword-based eligibility detection when WASM
adapter is unavailable, and trim qe-qx-partner system prompt to fit
the 2000-token budget.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Fix skill tier mapping: tier1-fast → tier1-any (valid tier name)
- Trim qe-accessibility-auditor systemPrompt under 2000 token limit
- Add 7500-char cap to agent generator to prevent future overflows
- Fix in both generated YAML and generator scripts
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Rewrite agent generator to read from .claude/agents/v3/*.md instead of
.claude/skills/, extracting rich systemPrompts from XML sections (identity,
capabilities, operating principles, memory integration, learning protocol,
output format, coordination notes). Fix skill generator CRLF parsing and
double qe- prefix issue. All non-excluded skill directories now generate
output.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Dragan Spiridonov