BREAKING CHANGE: Network policies are now permissive by default
Previously, all agents had restrictive domain whitelisting enabled by
default (blockUnknownDomains: true), which blocked access to:
- Multi-model router's 8+ LLM providers (only Anthropic was allowed)
- Arbitrary websites needed for QE testing purposes
Changes:
- Default policies now use blockUnknownDomains: false (permissive)
- Rate limiting still applies for protection
- Audit logging enabled by default for visibility
- Added LLM_PROVIDER_DOMAINS constant with 15 provider domains
- Added createRestrictivePolicy() for opt-in security when needed
- Added enableRestrictiveModeGlobally() for secure deployments
For security-sensitive deployments, use:
```typescript
// Option 1: Per-agent restrictive policy
const policy = createRestrictivePolicy('qe-test-generator', ['custom.api.com']);
manager.registerPolicy(policy);
// Option 2: Global restrictive mode
enableRestrictiveModeGlobally();
```
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Major Features:
- Nervous System Integration: BTSP learning, HDC memory, circadian cycling,
global workspace attention - all QE agents now benefit automatically
- Supabase Cloud Persistence: HybridPersistenceProvider with local-first
storage and background cloud sync, full CLI commands (aqe supabase)
- Migration Support: Transfer local SQLite data to Supabase cloud
Changes:
- BaseAgent: Auto-initializes nervous system components
- Persistence: New IPersistenceProvider interface with adapters
- CLI: Added supabase subcommands (setup, test, status, sync, schema)
- Version bump to 2.8.1 across all files
Tests:
- 41 nervous system integration tests (all passing)
- BaseAgent.nervous-system.test.ts validates HDC, BTSP, workspace
Closes#188 (MCP tool handlers implemented in previous commit)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Security:
- Add prototype pollution protection in setStateValue()
- Block __proto__, constructor, prototype property access
- Log warning when pollution attempt is detected
Docs:
- Update MCP tools count from 92 to 100 in README.md
- Update MCP tools count from 92 to 100 in package.json
Fixes CodeQL alert: js/prototype-pollution-utility
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
ts-node fails to resolve .js extension imports used throughout the codebase
for ESM compatibility. tsx handles ESM/CommonJS interop correctly.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
### Added
- Database Migration System (src/persistence/migrations/)
- MigrationRunner class for versioned schema migrations
- 7 migrations covering all core tables
- Version tracking in schema_migrations table
- Helper functions: tableExists, columnExists, safeAddColumn, safeCreateIndex
- CLI Migrate Command (src/cli/commands/migrate/)
- aqe migrate status - Show migration status
- aqe migrate run - Run pending migrations
- aqe migrate rollback - Rollback last migration
- aqe migrate reset - Reset all migrations
### Changed
- Database initialization now runs migrations automatically during aqe init
- Schema consistency ensured across all installations
### Fixed
- Schema evolution issues from backup restoration
- Dream learning cycle now works with migrated data
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The flaky-detection journey tests themselves are flaky due to their
statistical nature. Exclude them from the publish workflow's fast tests
to prevent CI failures. The tests still run in the full test suite.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add `fast-glob` as explicit dependency to fix "Cannot find module 'fast-glob'"
error when installing globally via `npm install -g agentic-qe`.
The module was used in ComponentBoundaryAnalyzer but only available as a
transitive dependency, which wasn't reliably installed during global npm installs.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
### Added
- C4 diagram builders for context, container, and component levels
- ProjectMetadataAnalyzer for system type inference from package.json/docker-compose
- ExternalSystemDetector for database, API, cache, and queue detection
- ComponentBoundaryAnalyzer for layer and relationship mapping
- CLI commands: `aqe kg c4-context`, `aqe kg c4-container`, `aqe kg c4-component`
- CodeIntelligenceAgent c4-diagrams capability
- 22 unit tests for C4 diagram builders
### Changed
- MermaidGenerator with static C4 generation methods
- Type consolidation in src/code-intelligence/inference/types.ts
- Standardized ComponentRelationship to use sourceId/targetId
- Updated qe-code-intelligence.md with C4 capabilities and examples
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add `aqe kg` CLI command with index, query, graph, stats subcommands
- Fix default database credentials to match ruvector container (ruvector/ruvector_db)
- Add post-release indexing to release workflow in CLAUDE.md
- Create scripts/post-release-index.sh for automated code indexing
- Add npm script: `npm run postrelease:index`
- fix(security): resolve prototype pollution in ConfigLoader.setNestedProperty (CodeQL #47)
Usage:
aqe kg index --git-since v2.6.1 # Index changes since release
aqe kg query "how does routing work" # Natural language search
aqe kg stats # Show knowledge graph statistics
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
## Fixes
- Add jose@5.10.0 dependency to fix npm ci sync error
- All CI workflows were failing due to missing jose in lock file
## Changed
- README.md Features section completely rewritten:
- Removed all version references (v1.9.0, v2.2.0, Phase 1/2/3)
- User-focused language highlighting unique value
- Clear tables showing cost savings by task complexity
- Updated agent count to 48 (21 + 11 + 15 + 1)
- Highlighted December 2025 model catalog
- Better skill organization with contributor credits
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
## Added
- ML-Based Complexity Classification with 4-level task analysis
- Model Capability Registry with 25+ December 2025 models
- Claude Opus 4.5, DeepSeek R1/V3, GPT-5, Gemini 2.5 Pro
- Cost Optimization Strategies (PromptCompressor, Caching, Batching)
- HybridRouter integration with complexity-based model selection
## Changed
- README.md Quick Start section (user-focused, no version numbers)
- .env.example rewritten for Phase 2 features
- CONTRIBUTORS.md updated with @fndlalit's n8n contribution (#151)
## Fixed
- HybridRouter RuVector test isolation
- Compression benchmarks with honest expectations (2-8% vs false 50%)
## New Tests
- ComplexityClassifier, ModelCapabilityRegistry, CompressionBenchmark
- HybridRouter integration, model selection, and cost tracking tests
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Upgrade tree-sitter-typescript from ^0.21.2 to ^0.23.2
- Add nested overrides for all tree-sitter language parsers
- Uses $tree-sitter reference to inherit version from direct dependency
- Reduces peer dependency warnings during npm install
Note: Some warnings persist for end users because npm overrides only
apply during local development. tree-sitter@0.22.4 is required for
Node.js 20/22 LTS compatibility (has prebuilt binaries).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add npm overrides to force tree-sitter@^0.22.4 resolution
- Remove --legacy-peer-deps from all CI workflows
- Fix DbOptions type import in HNSWPatternStore.ts
Closes#167🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
## Wave 1: Database Foundation
- Add SQL schema for code_chunks, code_entities, entity_relationships
- Use RuVector 768-dim embeddings (not pgvector)
- Implement hybrid_code_search function (BM25 + vector)
- Add pg_trgm extension for full-text search
- Create setup scripts for Ollama/nomic-embed-text
## Wave 2: Multi-Language Parser
- Implement TreeSitterParser with 5 language support
- Add language-specific extractors (TS, Python, Go, Rust, JS)
- Implement incremental parsing with tree caching
- Create comprehensive test suite with fixtures
## Architecture Decision
- Defer Apache AGE to v2 (see ADR-002)
- Use SQL tables for graph relationships
- Rationale: Lower complexity, team familiarity, sufficient for v1
Closes#159, Closes#160🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
## Problem
MCP server failed to start with error: Cannot find module '@axe-core/playwright'
This happened because @axe-core/playwright was in devDependencies but imported
at the top level of scan-comprehensive.ts.
## Solution
1. Changed @axe-core/playwright import to lazy/dynamic loading
2. Added optional dependencies prompt to `aqe init`:
- Interactive: "Do you plan to use accessibility testing features?"
- Non-interactive (-y): Skips optional deps for faster init
3. Clear error message when accessibility tools are used without dependency
## Changes
- src/mcp/tools/qe/accessibility/scan-comprehensive.ts: Lazy import
- src/cli/init/optional-dependencies.ts: New module for optional deps
- src/cli/init/index.ts: Integrated optional deps prompt
- src/types/index.ts: Added yes/nonInteractive to InitOptions
Closes#139🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
## Fixed
- Issue #137: FleetManager MemoryManager type mismatch
- FleetManager now uses SwarmMemoryManager instead of MemoryManager
- Agents spawned by FleetManager now have learning features enabled
- Added validateLearningConfig() for early warning
- Added isSwarmMemoryManager() helper function
- Added regression test
## Enhanced
- A11y-Ally Agent (PR #136, @fndlalit)
- Bot detection bypass with realistic browser fingerprinting
- Strict video analysis pipeline with validation checkpoints
- Output folder standardization (.agentic-qe/a11y-scans/)
- Executive summary template
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
## Changes
### A11y-Ally Agent Enhancements (PR #135)
- Developer-focused output with copy-paste ready code fixes
- Claude Code Native Vision for zero-config video analysis
- Mandatory WebVTT caption and audio description generation
- Updated multi-provider video analysis cascade
### Fixes
- Agent count consistency (19 → 20) in usage.md, skills.md
- CLAUDE.md restored to full Agentic QE configuration
- Root file cleanup - moved aqe wrapper to scripts/aqe-wrapper
### Removed
- All brand-specific (Audi) references from examples
### Added
- Learning scheduler config and startup script
- Test video frames for accessibility testing
- .gitignore updates for CLAUDE.md.backup and /aqe
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Remove Audi Q3/Sportback references from test files
- Update scan-comprehensive.ts with generic examples
- Update video-vision-analyzer.ts with generic vehicle example
- Delete docs/accessibility/ folder with brand-specific content
- Update enhancement plan with generic test references
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The AccessibilityAllyAgent (PR #129) added new MCP accessibility tools,
increasing the total from 84 to 85 tools.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The AccessibilityAllyAgent (PR #129) requires @axe-core/playwright
for WCAG 2.2 scanning but it was missing from dependencies.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
## Major Features
### G4: Unified Memory Architecture - BinaryCache Integration
- Integrate BinaryMetadataCache with UnifiedMemoryCoordinator
- Add TRM pattern caching with 6x faster pattern loading
- New methods: cacheTRMPattern(), getCachedTRMPattern(), persistBinaryCache()
### G6: OpenRouter Provider with Model Hot-Swap
- Full ILLMProvider implementation for OpenRouter API (300+ models)
- Model hot-swapping at runtime without restart
- Smart environment detection for auto provider selection
### ruvLLM Integration (Issue #131)
- SONA Learning Strategy with MicroLoRA/BaseLoRA/EWC++
- TRM Learning Strategy for trajectory tracking
- ReasoningBank integration for pattern storage
- 104 new integration tests
Closes#131🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Added three CI scripts required by learning-integration.yml workflow:
- ci:learning:validate - Validates database integrity
- ci:learning:check - Generates metrics.json for quality gates
- ci:learning:regression - Compares metrics against baselines
Scripts handle fresh CI environments where tables may not exist yet.
Uses captured_experiences table (actual schema) instead of agent_experiences.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Profa