1.2.7

1.2.7: clean up after the pipeline, see more dependencies

Built from a heavy user's report: 461 agent runs, about $632, every feature of their last release built through the pipeline.

Problem they hit	What 1.2.7 does
169 agent/issue-N branches on the remote, 114 local, 83 worktrees, left behind after merges	agent-flow clean previews first and removes only with --yes. It touches only agent/issue-N, and only when the work is provably merged (tip is in the default branch, or equals the head of a merged PR, squash merges via gh). Never uncommitted work, never an issue with a run or decision still open. Each delete is checked against the commit it judged, so a push that landed after the preview is kept.
state dismiss --merged left the worktrees and branches	--clean removes them too, with the same checks.
A new database image or Python dev dependency reached review unseen	Risk review now reads poetry groups, PEP 735 [dependency-groups], uv dev-dependencies, requirements/*.txt, constraints*.txt, Pipfile, and base images in a Dockerfile or compose file.
A push blocked by GitHub secret scanning said almost nothing	The message names the file, says to build a fixture's fake secret at run time, and gives the URL to allow it. Other repository rules keep their own message.
QA re-ran what the gates had just run	QA reuses a passing gate run when it would run the same commands, so the QA role is not launched. One trial run on a real repo took 18 min and $0.68, against 63 min and $1.23 for a comparable run before. pipeline.qa_reuses_gates: false turns it off.
New tests that no gate ran passed unnoticed	The final summary lists them (not_gated).
Runs killed mid-way by a 30-minute background limit	The orchestrator skill says a run takes one to two hours and how to resume (npx @drix10/agent-flow run <issue>).

When you update

Dependencies that were invisible before can now show up as new in agent-flow audit-risk --fail-on-new, once. A base image looks like dependency:Dockerfile:image:node. Review the list, then run agent-flow baseline accept --all --yes. A Dockerfile or compose edit is also a medium-risk change now.

Tested

522 tests on Windows (520 passed, 2 skipped) and on Linux (521 passed, 1 skipped), 0 failed. CI is green on Ubuntu, macOS and Windows with Node 20 and 22.

Full list: CHANGELOG

1.2.6

Agent Flow 1.2.6: fixes from a real repository

Found by reading a real repository's history (294 role runs, about $83 over five days) and by installing 1.2.5 on real Gemini CLI and Codex. Every change below names the number that justified it.

Faster and cheaper

• QA no longer repeats the gates. When QA's commands are exactly the gates' commands and every one just passed on this commit, run records the QA result from the gate logs instead of launching a QA role. In the arena that repeat cost 8 hours and $11 over 63 issues and caught nothing the gates had passed. Turn it off with pipeline.qa_reuses_gates: false.
• A QA timeout is no longer a round for the Implementer. When every failing QA command was killed by a timeout, the run stops as qa_environment instead of starting another implementer round for something no code change can fix.

Fewer false blocks

• Git Bash paths on Windows. /c/… and /cygdrive/c/… are read as the drive they name. They were read as C:\c\…, outside the worktree: 16 of 28 confinement blocks in the real run.
• > $null is treated like /dev/null.
• A blocked call now records what it tried (shortened, with tokens and passwords replaced), so a false positive can be told from an attack.

Less clutter

• status collapses a long backlog of finished issues to one summary line (--json still lists every one).
• Finished work merged by hand clears itself: status says so in one line and state dismiss --merged drops them all (it also recognises squash merges).
• A new test that no gate runs is reported in the log, the result and the pull request body.

Honesty and diagnosis

• A plugin or skill install no longer looks like protection. The Claude plugin installs the skills only; the bootstrap and orchestrator skills now check agent-flow status first and say plainly when no guard is wired. The README says the same, and shows the npm install commands.
• A malformed first report is kept as <role>-rN.attempt1.raw so it can be inspected.
• The implementer and QA skills now say never to end a turn waiting on a background job.

Verified on real hosts

Gemini CLI 0.62 installs the extension with all six skills; Codex 0.160 installs the plugin with all six; npx skills add Drix10/agent-flow --list finds all six.

Full details: CHANGELOG.md.

Update an existing repo: npx @drix10/agent-flow@latest update --yes.

1.2.5

[1.2.5] - 2026-10-07

• Fixed: the /debt prompt failed to load in Pi — its frontmatter description held a bare ": " ((lean: comments)), the same nested-mapping rejection as the implementer skill. The value is quoted, and the prompt test now enforces quoting everywhere, not just in skills.

• Codex plugin + distribution tracker: plugins/agent-flow/plugin.json (portable manifest, version pinned by scripts/check-versions.mjs) bundles copies of all six skills, and .agents/plugins/marketplace.json exposes it as a repo marketplace, so codex plugin marketplace add Drix10/agent-flow installs the skills into Codex. tests/dogfood.test.js fails if the plugin's skill copies drift from skills/; tests/package.test.js checks the marketplace entry. docs/DISTRIBUTION.md tracks every directory/marketplace, its state and its next step.

• Installable from skills.sh: npx skills add Drix10/agent-flow discovers all six skills with no packaging changes (verified live against the skills CLI); the README leads with a 30-second try (npx @drix10/agent-flow scan, read-only, nothing installed) and documents the skills.sh command. tests/package.test.js pins the install surface: every directory under skills/ is a skill, and the README names the command.

1.2.4

[1.2.4] - 2026-10-06

Lean mode, a session briefing, more hosts and a safer uninstall, and the bugs found while reviewing the rest of the code. What is and isn't claimed for lean mode: docs/LEAN.md.

• pipeline.lean (off, lite by default, full): the Implementer and Reviewer are told to make the smallest correct change. At lite: reuse before writing, fix the root cause (grep every caller), leave one runnable check for non-trivial logic, mark a deliberate shortcut with a lean: comment and list it in the report, never lean away validation, error handling, security or accessibility. At full: also climb the ladder (needed at all, repo, standard library, platform, installed dependency, one line, minimum) and the Reviewer blocks an avoidable new dependency. skills/implementer/references/native-first.md is a lookup of what the platform, the standard library and the database already do. Read from the default branch, so a branch can't switch it off for its own review. The reviewer's lens tags findings delete/stdlib/native/reuse/yagni/shrink and reports net_lines_removable; the implementer report gains shortcuts, which run --pr lists in the pull request. Whether it shrinks what a model writes in a given repo is not measured here.
• agent-flow debt reads every lean: comment (a ponytail: one is read too) back from the code with its ceiling and upgrade trigger, flags those that name none, and has --json and --fail-on-no-trigger. status shows the count; the Gardener gains /debt and /audit-lean (and prompts for both). A marker inside a string literal (a fixture) is text, not a comment.
• agent-flow uninstall [--harness] [--yes] [--keep-runtime] [--keep-hook] takes out what install wrote and nothing else. Previews until --yes. Unedited skills, agents, rules files, the OpenCode plugin and the vendored runtime go; an edited one is kept and named; only agent-flow's own entries leave the hook files (your other hooks and settings stay, an unparseable file is untouched); a skills folder shared by several harnesses stays until the last one goes; AGENTS.md, the manifest, CODEOWNERS, the baseline and the pipeline's state are never touched. A pipeline role can't run it.
• A session briefing. agent-flow brief says what is protected, review-only and always blocked, which checks must pass and how many issues wait on a person: facts only, never an issue's free text. install wires it as SessionStart (and SubagentStart on Claude Code) for Claude Code, and SessionStart/sessionStart for Codex and Cursor; --no-brief leaves it out, update adds it to an existing install. It answers in the shape each harness reads (and Copilot, Qoder and ZCode if one is wired by hand), never reads stdin, never fails.
• agent-flow statusline is one line for Claude Code's statusLine (guard on or OFF, how many need you, are ready, are working); install --statusline sets it only when none is set.
• agent-flow mcp, a zero-dependency read-only MCP server on stdio: status, pipeline state, classify, debt, doctor, audit summary, gates and the brief, as tools and a prompt, for any MCP client. Every tool is one of a short list of read-only CLI commands with validated arguments.
• pipeline.isolate_roles launches each role with --setting-sources project,local, so a plugin or hook installed globally on the machine can't add context to a role. Off by default.
• More hosts: install --harness cline|kiro|qoder (a rules file, plus skills in .agents/skills) and swival|factory|commandcode (skills folders), instruction-tier and listed as such in the harness matrix, with paths that were not run live here.
• The guard no longer hangs on input that never arrives. A wrapper that swallows the piped JSON used to leave the hook waiting until the harness killed it, which lets the call through. It waits 10 s (AGENT_FLOW_HOOK_STDIN_MS) and refuses wherever protection is configured; the stop gate and the badge are bounded too (FM-22).
• Fixed: re-running install stacked another guard hook for Codex, Cursor and Gemini when the runtime was vendored (the "is this ours" check only knew the node_modules path), so the guard ran once per install on every tool call. A re-install now replaces ours, and update leaves a customised guard hook alone with a note.
• Fixed: install --harness claude overwrote a user's own hook whose name merely contained agent-flow and guard (a ./scripts/agent-flow-guard.sh in PreToolUse was replaced by agent-flow's command). "Ours" now means "runs agent-flow's own binary" (the project copy or the vendored runtime), for install, the briefing, uninstall and the status badge alike.
• Fixed: update treated every harness that shares .agents/skills as installed (it would have written rules files for ones nobody installed); installed harnesses are now told apart by the install record and their own wiring. The install record no longer forgets what a sibling harness wrote.
• Fixed: piped output could be cut short. The CLI called process.exit() right after a large write (status --json, classify), which can truncate output on a pipe; it now lets stdout drain first.
• Fewer tokens spent on agent-flow's own instructions (see docs/LEAN.md): skill descriptions 3,285 to 1,969 characters; the orchestrator skill 15.2 KB to 3.9 KB with its manual procedure moved to references/manual.md; the implementer, reviewer and QA skills tightened, and told to be terse; QA keeps the first 50 and last 100 lines of a long log; the starter DOCS_INDEX.md and the rules files shortened; agents are told to run agent-flow brief instead of reading the manifest; the MCP server cuts answers at 20,000 characters. tests/token-budget.test.js pins the ceilings.
• doctor warns when a context file is heavy: an .md context file over 150 lines or about 9 KB is named with its size in tokens (a warning, never a failure; context_weight in --json). Bootstrap now asks for under 60 lines per module.
• Fixed: the MCP server's input buffer was unbounded. A client line with no end grew memory without limit; it is now refused past 1 MB and dropped to its newline, a batch is capped at 50, and the next request still works.
• Fixed: brief loaded the manifest twice (once per trust level) and now once; the status shortcut scan has a 1.5 s budget and says when it is partial; a pre-record install in the shared skills folder is read as the generic agents target; the review-violation message names the CRLF trap beside the missing-final-newline one.
• Fixed (review comments on the pull request): added lines that couldn't be read (a diff past the buffer) were treated as none, so a risky CI line could pass unchecked; they are now a review_violations entry. check-versions let a release tag that isn't shaped like a version (v1.2) through to publish; every tag that isn't the version now fails. A test left its polling timer running on early exit.
• Release hygiene: scripts/check-versions.mjs (every version file, the CHANGELOG section and the docs' action tag agree; on a release tag it equals the tag) runs in CI and before publishing; tests/release-hygiene.test.js pins the load-bearing rules in every skill, prompt and harness copy, and the frontmatter every skill needs. A frontmatter value with a bare ": " must be quoted, or strict YAML readers (Pi) reject the skill as a nested mapping.
• Fixed: the implementer skill failed to load in Pi — its frontmatter description held a bare ": " ((agent/issue-N): smallest…), which strict YAML reads as a nested mapping. The value is now quoted in skills/ and the .agents, .cursor and .gemini copies.
• Skills renamed to agent-flow-* (bootstrap → agent-flow-bootstrap, gardener → agent-flow-gardener, implementer → agent-flow-implementer, invoking-agents → agent-flow-invoking-agents, qa → agent-flow-qa, reviewer → agent-flow-reviewer): one generic word shares a flat skill namespace with every other package on every harness (Pi keeps the first discovered and warns; Claude Code project skills collide silently), so the unprefixed names are retired. Skill directories, frontmatter names, prompts, launch procedures, docs and the Claude reviewer's skills: field use the new names. update removes a pre-rename dir that is still exactly what install wrote and keeps (named) one you edited; uninstall and a fresh install do the same. Role identifiers (AGENT_FLOW_ROLE=implementer, …) are unchanged.

v1.2.3

Agent Flow 1.2.3: unattended runs stop less, and cost fewer tokens

Run AI coding agents unattended without letting them go loose: one implements, another reviews, a third tests, a guard blocks what they must never touch, and you only see what needs you.

Headline

• review_paths: agents can now add a line to your CI or test list (a new test, a new step) without stopping the run. The pull request opens as a draft that waits for you, and an edited or deleted line, or a line that reaches secrets, goes back to the agent. Protected paths stay hard.
• Lean mode (pipeline.lean, on at lite): the Implementer and Reviewer aim for the smallest correct change. Deliberate shortcuts are marked lean: in the code, and agent-flow debt lists them.
• Fewer tokens: skill descriptions 3,285 → 1,969 characters, the orchestrator skill 15.2 KB → 3.9 KB, terse role output, and doctor warns when a context file is heavy.

New

• agent-flow uninstall takes out only what install wrote (preview first, --yes to apply).
• agent-flow brief and statusline: a session briefing and a status badge for Claude Code, Codex and Cursor.
• agent-flow mcp: a read-only, zero-dependency MCP server.
• pipeline.isolate_roles: stops a globally installed plugin from adding context to a role.
• More install targets: cline, kiro, qoder, swival, factory, commandcode (instruction-tier, not run live here).

Fixed

• Re-running install stacked duplicate guard hooks for Codex, Cursor and Gemini.
• install --harness claude overwrote a user's own hook with agent-flow and guard in its name.
• The guard could hang on hook input that never arrives; it now waits 10 s and refuses where protection is on.
• A huge role output could hang report validation.
• Unreadable CI diffs counted as "nothing added"; they are now a violation.
• The MCP server's input buffer was unbounded; piped output could be cut short.

Tested: 494 tests against real git repositories, passing on Windows, macOS and Linux, Node 20 and 22.

Full details: CHANGELOG.md and docs/LEAN.md.

v1.2.2

Fixes from running agent-flow run unattended on a real repository: script files no longer bypass the guard, the rule files are guarded, merged work can be marked done, usage limits wait instead of parking the issue, doctor names tests no gate runs, and run --pr anchors the audit head in the PR. See CHANGELOG.

v1.2.1

Fix: agent-flow run roles can read their issue folder and worktree. An Implementer that cd'd into its worktree lost permission to read issue.md, which stopped 3 of 4 live runs. See CHANGELOG.

v1.2.0

What's Changed

• Prepare Agent Flow 1.2.0 for local-first repository workflows by @Drix10 in #10

Full Changelog: v1.1.7...v1.2.0

v1.1.7

Found by asking how a vendored install ever learns about a newer version (it didn't).

• agent-flow update [--yes] [--check] [--force]. Brings the skills, reviewer agents, hook wiring and the vendored runtime up to the running version. install now records what it wrote (<harness dir>/agent-flow-install.json); update replaces only files that still match that record, keeps and lists anything you edited, never downgrades, and previews unless given --yes. --check exits 10 when an update is available, for a scheduled CI job (a ready workflow is in docs/ADOPTION.md). The vendored copy can't update itself and prints the npx @drix10/agent-flow@latest update --yes command. A repo installed before this release has no record, so its first update needs --force once.
• doctor tells you when agent-flow is behind, as one dim line for humans at a terminal: when a newer CLI finds an older vendored runtime (no network), or when the npm registry has a newer version (one GET, 2.2 s cap, cached for a day in ~/.agent-flow/). Never in --json/SARIF output, CI, the guard or the pre-commit hook; NO_UPDATE_NOTIFIER=1, AGENT_FLOW_NO_UPDATE_CHECK=1, AGENT_FLOW_OFFLINE=1 and --offline turn it off. The GitHub Code Owner lookup added in 1.1.6 now also skips itself in CI.
• Docs now say what the network does. README.md and SECURITY.md claimed "no network calls"; both are corrected to name the two optional, read-only lookups in doctor (npm registry version, gh branch-protection).
• update is a setup action like install: no pipeline role may run it. It leaves a customized guard hook alone (with a note) unless --force, treats hook wiring that is out of date as an update on its own, and compares the OpenCode plugin with the same hash format install records. Fixed on the way: a dry run of the vendoring step no longer stops the real copy.
• Install-style table in docs/ADOPTION.md ("Keeping it current"): npm, npx and vendored, and how each is told about and applies an update.

v1.1.6

Found by running bootstrap on a real C++/Python repo with no package.json, on Windows.

• Any language, no npm. install copies a ~0.5 MB runtime to .agent-flow-runtime/ for the guard hooks (Claude, Gemini, Codex, Cursor) when agent-flow isn't in the project's node_modules, or with --vendor. It used to refuse and tell you to npm install -D. Commit the folder; the pre-commit hook finds it too. The guard treats it as hook wiring, and audit-risk, scan and classify ignore it. The skills no longer claim a devDependency.
• install keeps .agent-flow/ (audit log, gate logs, backups) out of git through .git/info/exclude, and its next steps say what to commit.
• Behavior change on Windows: string gates run in Git Bash, not cmd.exe. Gate commands come from CI files and READMEs, which are POSIX; under cmd.exe they failed and looked like test failures. A gate written for cmd.exe (.\scripts\check.bat, set X=1 && …) now needs AGENT_FLOW_SHELL=cmd.exe, or an os-specific rewrite. Details: String gates went through cmd.exe, so every POSIX command (./build.sh, a for loop, the commands scan reads from CI) failed and looked like a test failure. AGENT_FLOW_SHELL overrides. A command the shell itself can't start is now an environment error (exit 2); a 126/127 from inside a script is still that script's failure.
• os on a gate (["linux"]): elsewhere the gate is reported as skipped, never as a pass, and CI judges it. For builds that need a Linux toolchain or a POSIX filesystem.
• agent-flow manifest sync [--yes] rebuilds context_files from the context files on disk (new AGENTS.md files, install's CLAUDE.md, the paths their prose names) and keeps protected_paths, risk_boundaries, gates and every other key. Bootstrap and the gardener use it instead of editing references by hand. Roles without bootstrap_write can't run it.
• scan finds commands in CI workflow steps, including each plain line of a run: | block (loops, continuations and lines with variables are left out), and in build.sh/test.sh, so a repo with no package.json or Makefile no longer reports none. Three or more sibling commands collapse into one …/<name>.py (N files) line.
• CODEOWNERS without the friction. A missing or partial CODEOWNERS is now one quiet note, not a warning: the guard and pre-commit hook already protect against local agents, and CODEOWNERS only matters for pull requests pushed from elsewhere. agent-flow codeowners [--yes] [--owner @x] previews, then appends the lines (owner from origin); an existing file is appended to, never replaced. When the lines are in place and a logged-in gh is available, doctor also reports whether GitHub really requires Code Owner review (rulesets and classic protection); with no gh, no login or no network it says nothing, never asks for a token, and --offline / AGENT_FLOW_OFFLINE=1 skips the call. Solo repos are told that requiring it blocks their own PRs.
• doctor --allow-stale reports stale context without failing, and doctor --allow-stale reports stale context without failing (for CI on every push; broken paths, schema problems and placeholders still fail). Without it, a repo's CI went red 30 days after setup with no change.
• The OpenCode plugin finds the CLI relative to itself (the vendored runtime or node_modules) instead of the absolute path of whichever copy ran install, so it works in every clone.
• Bootstrap skill: the secrets gate offers fake / real / keep-flagged instead of only stopping; a new gates step (where each can run, timeouts, on_stop); glob and highest-level-wins rules spelled out; manifest sync for context_files; Phase 6 runs the gates and sorts every failure; CODEOWNERS and CI steps without Node in the project; the repo's own rules bind bootstrap.
• Guard: an unquoted glob that expands to an env file or a deny_read path (cat .e*) is a secret read, like naming the file.
• Guard: a recursive search (grep -r, rg --hidden) over a directory that holds an env file or a deny_read path is a secret read; rg without --hidden skips dotfiles as it does itself.