mirror of
https://github.com/proffesor-for-testing/agentic-qe.git
synced 2026-09-19 08:45:47 +08:00
working-may
9 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Dragan Spiridonov
|
122f223c9a |
fix(security): migrate from @xenova/transformers to @huggingface/transformers
@xenova/transformers v2.17.2 (last publish 2024-05-29) pins onnxruntime-web@1.14.0, which pulls onnx-proto → protobufjs <=7.5.5. That chain has 8 GHSA advisories including a critical arbitrary-code- execution one (GHSA-xq3m-2v4x-88gg). Our top-level `overrides` block forced protobufjs@^7.5.6 in our own tree, hiding the vulns from `npm audit` in this repo — but `overrides` are root-only by design and do not propagate to downstream consumers. End users running `npm install agentic-qe` were getting 5 vulns (4 high, 1 critical). @huggingface/transformers@4.2.0 is the official maintained successor (same project, renamed). It pulls onnxruntime-web@1.26 which depends on protobufjs@^7.2.4 directly (no onnx-proto), so the version range resolves cleanly to the patched line. API changes handled: - pipeline()/Tensor: drop-in compatible, just the import path changes - `quantized: bool` → `dtype: DataType` (mapped from our QuantizationType enum: 'none'→'fp32', 'fp16'→'fp16', 'int8'→'int8', 'binary'→'q8'; binary stays a post-process step downstream) - progress_callback signature: ProgressInfo is now a discriminated union; `progress` only exists on the "progress" variant — narrowed accordingly Also added onnxruntime-node and onnxruntime-web to the CLI and MCP bundle externals lists. @huggingface/transformers ships both runtimes (node for Node.js, web as fallback); esbuild can't bundle the native .node binary so it must remain external. End-user verification (npm pack + clean install in /tmp/aqe-canary): - 183 packages (was 180 pre-migration; same order of magnitude) - 0 vulnerabilities (was 5: 4 high, 1 critical) - aqe init --auto runs in 93 ms; all 13 phases pass; optional-peers hint renders correctly. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
9d3b514ee2 |
fix(v3.9.14): second P0/P1 wave from QE audit follow-up
Security (M-01): - src/cli/commands/learning.ts: replace execSync shell-interpolation of the user-controlled --file path with execFileSync + file-descriptor redirect (dump) and stdin input (import). Closes the command-injection vector where a crafted --file="x.db\"; rm -rf ~; \"" would escape shell quoting. Build / supply chain: - Move @claude-flow/guidance from dependencies to optionalDependencies alongside @claude-flow/browser. No stable successor exists on npm; usage is already guarded by try/await-import/catch fallbacks so demotion is safe. Documented in the follow-up research memo. - Lazy-load @faker-js/faker via dynamic import in test-data-generator.ts and mark it external in build-cli.mjs / build-mcp.mjs. Faker is a devDep that previously got statically bundled into shipped artefacts because of a top-level import. Tarball drops 11.5 MB → 9.6 MB. MCP API contracts: - Add required:true to semantically load-bearing first parameters on agent_metrics (agentId), coverage_analyze_sublinear (target), accessibility_test (url), defect_predict (target), code_index (target). Verified via live MCP tools/list handshake — required arrays now match the intent documented in each tool's description. CI hygiene: - Rewrite the "Commit telemetry data" step in qcsd-production-trigger.yml to push to a bot branch and open a PR instead of `git push` direct to protected main. That push failed 8/10 runs on the last audit cycle because of branch protection. Artifact upload (already present) continues to preserve the raw payload for 90 days regardless of whether the PR lands. Verification: - npm audit --omit=dev: 0 critical, 0 high (1 moderate in @mapbox/node-pre-gyp — extraneous, pre-existing, unrelated). - npm run typecheck: clean. - CLI + MCP bundles rebuild successfully. - 253/253 test-generation unit tests pass. - Live MCP protocol smoke: new required flags visible on tools/list; advisor_consult guard from v3.9.14 round 1 still fires. Memory note: see feedback_cli_is_aqe.md — CLAUDE.md ruflo refs were audited. Only 2 lines (204, 260-261) are stale AQE-product refs; the other 11 swarm/memory/daemon ruflo commands are legitimate orchestration-layer invocations and are intentionally retained. Deferred to a dedicated docs PR so the user can review each. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
6dd39a9938 |
fix(v3.9.14): close all 5 P0 blockers identified by v3.9.13 QE audit
Security (15 criticals → 0):
- Pin protobufjs to ^7.5.5 via overrides + resolutions to break the
@xenova/transformers → @claude-flow/{browser,guidance,embeddings}
→ onnxruntime-web → onnx-proto chain reaching the CVE-94 payload
(GHSA-xq3m-2v4x-88gg). npm audit --omit=dev now reports 0 vulns.
Tarball bloat (-42%):
- Add rmSync(dist/cli/chunks) to build-cli.mjs before the code-split
build so only fresh chunks ship. 799 → 240 chunks, dist/cli 44 → 11
MB, npm tarball 19.9 → 11.5 MB.
Retiring-model refs (ADR-093 tier-1 hardcodes):
- Replace 'claude-3-haiku-20240307' with 'claude-haiku-4-5' in
MODEL_TIERS[1] at constants.ts:608 and in five mirror implementations
across test-execution, contract-testing, chaos-resilience,
learning-optimization, and visual-accessibility services. Haiku 3
retirement will no longer 404 these tier-1 fallback paths. Backward-
compat refs retained intentionally in bedrock ARN table, cost
tracker, type unions, and RETIRING_MODELS schedule.
ESLint harness:
- package.json lint script invoked eslint on both `src` and `tests`
but .eslintrc.cjs explicitly ignores `tests`, causing ESLint to
abort. Narrow the script to `eslint src --ext .ts` so the harness
runs. (955 pre-existing rule violations remain as separate backlog.)
advisor_consult MCP contract (ADR-092 F-01):
- Mark `agent` and `task` parameters as required:true in the schema.
- Validate via trim() guard in the handler and return a structured
error when either is empty/whitespace instead of shelling out to
`aqe llm advise` with placeholder values. Verified via live MCP
stdio handshake: both empty-string and whitespace-only `agent`
produce the expected rejection without any child process spawn.
Verification:
- npm audit --omit=dev → 0 vulnerabilities (verified from node_modules,
not just lockfile).
- npm run typecheck → clean.
- npm run build → CLI + MCP bundles both build.
- 94/94 tests pass across the patterns touched (security-compliance
scanners + task-executor-errors).
- MCP protocol smoke test confirms advisor_consult guard fires.
Restores Dependency/Build from Grade C to Grade B and lifts the
composite quality score from 7.0 to ~7.3.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|
Dragan Spiridonov
|
a6202c39a3 |
chore(release): v3.9.1 (#395)
* feat: implement ADR-062 (StrongDM all 3 tiers) and ADR-087 (RuVector 14/14 capabilities)
ADR-062 StrongDM Software Factory — all 6 actions across 3 tiers:
- Tier 1: Loop detection wired to MCP protocol-server (blocks on strike 3+),
token dashboard (pre-existing)
- Tier 2: Holdout testing (10% FNV-1a selection, filtered in test-execution),
gate ratcheting (monotonic 5-pass/2%/95% cap, persisted to MemoryBackend)
- Tier 3: Progressive context (TF-IDF prediction, reduces availableFiles on spawn),
meta-learning cycle (4 insight types, stored + published as domain events)
ADR-087 RuVector Advanced Capabilities — milestones 1-5:
- EWC++ recordOutcome + backgroundConsolidate wired to 3 domain coordinators
- R1: HDC fingerprinting (10K-bit hypervectors, wired to PatternStore.store())
- R3: Delta event sourcing (sparse encoding, wired to PatternStore.store())
- R13: Cognitive routing (predictive compression, wired to mailbox.send/receive)
- R14: Hyperbolic HNSW (Poincare ball, auto-indexed in PatternStore.store())
Also updates ADR statuses: 059, 060, 061 → Implemented (were already done),
062 → Implemented, 086 → In Progress, 087 → Implemented.
223 new tests across 11 test files, all passing. Zero regressions.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: implement RVF cluster (ADR-065/066/067/071) with native benchmarks
Implements the RVF persistence cluster for persistent HNSW vector storage,
agent memory branching, and HNSW unification foundation.
Key changes:
- RvfPatternStore: IPatternStore backed by @ruvector/rvf-node native HNSW
(1.2ms cold-start, 0.19ms search p50, verified with real native binary)
- AgentMemoryBranch: per-agent COW isolation via derive(), ingest-log merge,
wired into Kernel.initialize() + DefaultAgentCoordinator
- HnswLegacyBridge: adapts old IHNSWIndex to unified IHnswIndexProvider,
wired into PatternStore when useUnifiedHnsw flag enabled
- Factory routing: createPatternStore() returns RvfPatternStore when flag
enabled + native available + data directory exists
- Dream engine: accepts external RVF adapter (no duplicate file handles),
RVCOWBranchManager enhanced with recall validation check
- @ruvector/gnn bumped 0.1.19→0.1.25, 3 new feature flags added
- IPatternStore interface extracted for polymorphic pattern store usage
- 50 new tests (16 RvfPatternStore + 17 AgentMemoryBranch + 12 bridge + 5 benchmarks)
- 1188 tests pass, 0 regressions
ADR status: 066 Implemented, 067 Implemented, 065 Implemented,
069/071 In Progress (honest assessment after brutal-honesty review)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(init): resolve skills/agents paths from package root, not relative to bundle depth
esbuild code-splitting puts installer code into dist/cli/chunks/ (3 levels
deep) instead of dist/init/ (2 levels deep), so the old ../../ traversals
landed at dist/ instead of the package root — causing "Source directory not
found" errors for all global installs.
Replace brittle relative-path resolution in all 4 installers with a shared
findPackageRoot() that walks up to the nearest package.json with
name=agentic-qe. Prioritise assets/ paths (canonical npm source) over
.claude/ paths.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: complete RVF cluster Phases 2-3 (ADR-067/069/071/072) with devil's advocate fixes
Phase 2A (ADR-067): Agent memory branching enabled — useAgentMemoryBranching=true,
BRANCH_DISCARD witness action, recordIngest callback exposed to agents via config.
Phase 2B (ADR-069): Dream RVF COW — useRvfFork driven by isRVFPatternStoreEnabled(),
child adapter stored + temp files cleaned up on merge/discard, 13 tests.
Phase 2C (ADR-071): HNSW unification — useUnifiedHnsw=true, HNSWEmbeddingIndex routes
through HnswAdapter, UnifiedMemory vectorIndex uses UnifiedHnswIndex, HnswLegacyBridge
delegates to adapter string-ID APIs (no duplicate ID maps), addEmbeddingsBatch routed
correctly, saveIndex/loadIndex safe under unified mode.
Phase 3 (ADR-072): RVF primary migration scaffolding — RvfMigrationAdapter (5-stage
routing with write latency tracking), RvfConsistencyValidator (rolling divergence +
compaction), RvfStageGate (go/no-go with witness chain), rvfMigrationStage=1 default,
wired into shared-rvf-dual-writer at stage >= 2, 32 tests.
Cross-cutting fixes from devil's advocate review:
- Shared RVF adapter singleton eliminates dual file handles (kernel + dream engine)
- RvfPatternStore reports honest nativeAvailable=false + rvfInitError on failure
- ESM-safe dynamic import() replaces require() in dream-engine and branch-manager
- quality_assess defaults to src/ instead of cwd to prevent full-project scan hang
- discoverSourceFiles skips .agentic-qe/.claude/.cache dirs, adds maxFiles=5000 cap
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: complete RVF cluster plan — Phase 2C decommission, Phase 3 integration, fix 7 pre-existing test failures
Phase 2C (ADR-071) — HNSW decommission:
- Remove RuvectorFlatIndex fallback from unified-memory.ts; always use UnifiedHnswIndex
- Hardcode isUnifiedHnswActive()=true in HNSWEmbeddingIndex (hnswlib-node legacy path is dead code)
- Create HnswShadowValidator for brute-force vs HnswAdapter divergence validation
- Benchmark alias (rvf-pattern-store.bench.ts) for plan compliance
Phase 3 (ADR-072) — RVF Primary Migration integration:
- RvfMigrationCoordinator: wires adapter + validator + gate with real SQLite/RVF handles
- MCP tools: migration_status, migration_check, migration_promote (persistence category)
- Kernel boot wiring: coordinator initializes when rvfMigrationStage >= 2
- RvfMigrationAdapter.setStage(): propagate promotions to routing logic
- Promote default rvfMigrationStage from 1 (hybrid) to 2 (dual-write-sqlite-primary)
- Integration test: 13 tests covering full lifecycle (stage 1→2→3→4), write/read routing,
consistency checks, gate enforcement, fallback, metrics
Test fixes (7 pre-existing failures → 1 remaining):
- code-intelligence-metrics-wiring: spy console.info not console.log (logger routes to console.info)
- mcp-integration: disable ADR-062 loop detection (repeated identical calls are by design)
- dream-cycle-tool (2 tests): RvfPatternStore empty-query branch returns all patterns from SQLite
- coherence-integration (4 tests): RvfPatternStore vector search fallback computes brute-force
cosine over SQLite embeddings when RVF adapter unavailable; getStats() falls back to SQLite count;
auto-attach SQLitePatternStore in initialize() when not explicitly wired
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore(release): bump version to v3.9.1
- Version bump in package.json and skills-manifest.json
- Fix "Dynamic require of X is not supported" in ESM bundles by adding
createRequire banner to both CLI and MCP build scripts — every chunk
now has a working require() for Node.js builtins
- Add CHANGELOG.md entry and release notes for v3.9.1
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): regenerate package-lock.json for npm ci compatibility
The lock file was out of sync with package.json — new transitive
dependencies added on main were missing. All 15 CI checks failed
at `npm ci` with "Missing from lock file" errors.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(ci): pin Node to 24.13.0 and restore working lock file
Node 24.14.1 ships npm 11.11.0 which enforces stricter lock file
validation than 11.6.x (what 24.13.0 ships). The existing lock file
passes under 11.6.x but fails under 11.11.0 with "Missing from lock
file" for transitive dependencies of private-registry packages.
Pin all 5 workflow files to node-version: '24.13.0' and restore the
lock file from commit
|
||
|
Dragan Spiridonov
|
1dcbfa5fb6 |
perf: lazy-load CLI handlers and enable esbuild code splitting
Convert heavy top-level imports (kernel, coordination, workers, unified-memory) to dynamic imports deferred until command execution. Extract workflow command into src/cli/commands/workflow.ts, add lazy-registry for on-demand handler loading, and enable esbuild splitting with chunk output. Reduces CLI startup cost by avoiding eager module resolution for unused commands. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
2086bafa6b |
feat(parsers): add web-tree-sitter WASM for Python, Java, C#, Rust, Swift (#323)
Integrate tree-sitter WASM as the default parser for 5 languages, replacing regex-only parsing (~97-98%) with AST-based parsing (~100% accuracy). - Add TreeSitterWASMParser implementing ILanguageParser for 5 languages - Bundle only needed WASM grammars in assets/grammars/ (8.5MB vs 50MB) - Add FallbackParser with 3-retry logic before permanent regex degradation - Add per-call parser instances to prevent concurrency races across await - Add cyclomatic complexity computation from AST branching nodes - Add property extraction from class/struct AST nodes - Add AQE_PARSER_REGEX_ONLY=1 env var for opt-out to regex - Replace require() with ESM-compatible dynamic import() in registry - Mark web-tree-sitter as external in CLI/MCP esbuild configs - Amend ADR-076 with decision rationale and alternatives evaluated Alternatives evaluated and rejected: - @ast-grep/napi: npm package only ships JS/TS/CSS/HTML, others need native .so - node-tree-sitter: requires native C compilation via node-gyp Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|
Dragan Spiridonov
|
fc1e86ad2d |
fix(security): resolve P0/P1 issues from v3.8.3 QE swarm analysis
P0 fixes: - Fix command injection (CWE-78) in test-verifier.ts: replace exec() with execFile() + ALLOWED_TEST_COMMANDS allowlist - Unify SQL allowlists: add 5 missing tables to sql-safety.ts, replace local duplicate in unified-memory.ts with canonical validateTableName() - Add validateTableName() to all 7 SQL interpolation sites in ruvector/brain-shared.ts P1 fixes: - Remove 70 process.exit() calls from learning.ts (45) and hooks.ts (25), replacing with return/throw for proper cleanup handler execution - Move @faker-js/faker from dependencies to devDependencies (~8MB savings) - Enable bundle minification: CLI 9.8→6.9MB (-30%), MCP 12→7.2MB (-40%) - Fix no-op verification scripts to perform real checks with non-zero exit codes on failure QE reports: - Add 12 comprehensive QE analysis reports for v3.8.3 covering code quality, security, performance, tests, SFDIPOT, dependencies, API contracts, architecture/DDD, accessibility, and brutal honesty audit Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|
Profa
|
9f5b3b49bf |
fix: lazy-load typescript to prevent CLI crash on global install
TypeScript was an external ESM dependency loaded at bundle startup, crashing `aqe --version` when typescript isn't installed (global installs). Now lazy-loaded via createRequire Proxy — only triggers when AST parsing features are used. Also adds isolated install verification to /release skill (steps 8e and 15) to catch missing externals before they reach users. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> |
||
|
Profa
|
c0ba2b4d86 |
fix: rename scripts to .cjs/.mjs for ESM compatibility
package.json has "type": "module" so .js files are treated as ESM. Scripts using require() renamed to .cjs, scripts using import to .mjs. Fixes Test Dashboard CI failure. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> |