1.2.4

[1.2.4] - 2026-10-06

Lean mode, a session briefing, more hosts and a safer uninstall, and the bugs found while reviewing the rest of the code. What is and isn't claimed for lean mode: docs/LEAN.md.

• pipeline.lean (off, lite by default, full): the Implementer and Reviewer are told to make the smallest correct change. At lite: reuse before writing, fix the root cause (grep every caller), leave one runnable check for non-trivial logic, mark a deliberate shortcut with a lean: comment and list it in the report, never lean away validation, error handling, security or accessibility. At full: also climb the ladder (needed at all, repo, standard library, platform, installed dependency, one line, minimum) and the Reviewer blocks an avoidable new dependency. skills/implementer/references/native-first.md is a lookup of what the platform, the standard library and the database already do. Read from the default branch, so a branch can't switch it off for its own review. The reviewer's lens tags findings delete/stdlib/native/reuse/yagni/shrink and reports net_lines_removable; the implementer report gains shortcuts, which run --pr lists in the pull request. Whether it shrinks what a model writes in a given repo is not measured here.
• agent-flow debt reads every lean: comment (a ponytail: one is read too) back from the code with its ceiling and upgrade trigger, flags those that name none, and has --json and --fail-on-no-trigger. status shows the count; the Gardener gains /debt and /audit-lean (and prompts for both). A marker inside a string literal (a fixture) is text, not a comment.
• agent-flow uninstall [--harness] [--yes] [--keep-runtime] [--keep-hook] takes out what install wrote and nothing else. Previews until --yes. Unedited skills, agents, rules files, the OpenCode plugin and the vendored runtime go; an edited one is kept and named; only agent-flow's own entries leave the hook files (your other hooks and settings stay, an unparseable file is untouched); a skills folder shared by several harnesses stays until the last one goes; AGENTS.md, the manifest, CODEOWNERS, the baseline and the pipeline's state are never touched. A pipeline role can't run it.
• A session briefing. agent-flow brief says what is protected, review-only and always blocked, which checks must pass and how many issues wait on a person: facts only, never an issue's free text. install wires it as SessionStart (and SubagentStart on Claude Code) for Claude Code, and SessionStart/sessionStart for Codex and Cursor; --no-brief leaves it out, update adds it to an existing install. It answers in the shape each harness reads (and Copilot, Qoder and ZCode if one is wired by hand), never reads stdin, never fails.
• agent-flow statusline is one line for Claude Code's statusLine (guard on or OFF, how many need you, are ready, are working); install --statusline sets it only when none is set.
• agent-flow mcp, a zero-dependency read-only MCP server on stdio: status, pipeline state, classify, debt, doctor, audit summary, gates and the brief, as tools and a prompt, for any MCP client. Every tool is one of a short list of read-only CLI commands with validated arguments.
• pipeline.isolate_roles launches each role with --setting-sources project,local, so a plugin or hook installed globally on the machine can't add context to a role. Off by default.
• More hosts: install --harness cline|kiro|qoder (a rules file, plus skills in .agents/skills) and swival|factory|commandcode (skills folders), instruction-tier and listed as such in the harness matrix, with paths that were not run live here.
• The guard no longer hangs on input that never arrives. A wrapper that swallows the piped JSON used to leave the hook waiting until the harness killed it, which lets the call through. It waits 10 s (AGENT_FLOW_HOOK_STDIN_MS) and refuses wherever protection is configured; the stop gate and the badge are bounded too (FM-22).
• Fixed: re-running install stacked another guard hook for Codex, Cursor and Gemini when the runtime was vendored (the "is this ours" check only knew the node_modules path), so the guard ran once per install on every tool call. A re-install now replaces ours, and update leaves a customised guard hook alone with a note.
• Fixed: install --harness claude overwrote a user's own hook whose name merely contained agent-flow and guard (a ./scripts/agent-flow-guard.sh in PreToolUse was replaced by agent-flow's command). "Ours" now means "runs agent-flow's own binary" (the project copy or the vendored runtime), for install, the briefing, uninstall and the status badge alike.
• Fixed: update treated every harness that shares .agents/skills as installed (it would have written rules files for ones nobody installed); installed harnesses are now told apart by the install record and their own wiring. The install record no longer forgets what a sibling harness wrote.
• Fixed: piped output could be cut short. The CLI called process.exit() right after a large write (status --json, classify), which can truncate output on a pipe; it now lets stdout drain first.
• Fewer tokens spent on agent-flow's own instructions (see docs/LEAN.md): skill descriptions 3,285 to 1,969 characters; the orchestrator skill 15.2 KB to 3.9 KB with its manual procedure moved to references/manual.md; the implementer, reviewer and QA skills tightened, and told to be terse; QA keeps the first 50 and last 100 lines of a long log; the starter DOCS_INDEX.md and the rules files shortened; agents are told to run agent-flow brief instead of reading the manifest; the MCP server cuts answers at 20,000 characters. tests/token-budget.test.js pins the ceilings.
• doctor warns when a context file is heavy: an .md context file over 150 lines or about 9 KB is named with its size in tokens (a warning, never a failure; context_weight in --json). Bootstrap now asks for under 60 lines per module.
• Fixed: the MCP server's input buffer was unbounded. A client line with no end grew memory without limit; it is now refused past 1 MB and dropped to its newline, a batch is capped at 50, and the next request still works.
• Fixed: brief loaded the manifest twice (once per trust level) and now once; the status shortcut scan has a 1.5 s budget and says when it is partial; a pre-record install in the shared skills folder is read as the generic agents target; the review-violation message names the CRLF trap beside the missing-final-newline one.
• Fixed (review comments on the pull request): added lines that couldn't be read (a diff past the buffer) were treated as none, so a risky CI line could pass unchecked; they are now a review_violations entry. check-versions let a release tag that isn't shaped like a version (v1.2) through to publish; every tag that isn't the version now fails. A test left its polling timer running on early exit.
• Release hygiene: scripts/check-versions.mjs (every version file, the CHANGELOG section and the docs' action tag agree; on a release tag it equals the tag) runs in CI and before publishing; tests/release-hygiene.test.js pins the load-bearing rules in every skill, prompt and harness copy, and the frontmatter every skill needs. A frontmatter value with a bare ": " must be quoted, or strict YAML readers (Pi) reject the skill as a nested mapping.
• Fixed: the implementer skill failed to load in Pi — its frontmatter description held a bare ": " ((agent/issue-N): smallest…), which strict YAML reads as a nested mapping. The value is now quoted in skills/ and the .agents, .cursor and .gemini copies.
• Skills renamed to agent-flow-* (bootstrap → agent-flow-bootstrap, gardener → agent-flow-gardener, implementer → agent-flow-implementer, invoking-agents → agent-flow-invoking-agents, qa → agent-flow-qa, reviewer → agent-flow-reviewer): one generic word shares a flat skill namespace with every other package on every harness (Pi keeps the first discovered and warns; Claude Code project skills collide silently), so the unprefixed names are retired. Skill directories, frontmatter names, prompts, launch procedures, docs and the Claude reviewer's skills: field use the new names. update removes a pre-rename dir that is still exactly what install wrote and keeps (named) one you edited; uninstall and a fresh install do the same. Role identifiers (AGENT_FLOW_ROLE=implementer, …) are unchanged.