v1.3.0 — AST Analysis, Executor Pattern & Security Hardening

What's New in v1.3.0

This release is a significant architectural and security upgrade. It introduces AST-based Python analysis, the Executor Strategy pattern, and hardens multiple security boundaries.

✨ Added

• — deep security analysis using Python's native ast module; detects exec(), eval(), pickle.loads(), subprocess calls, and dangerous imports that regex cannot catch
  • Graceful degradation if Python 3.8+ is not available
• Executor Strategy Pattern (src/executors/) — pluggable skill executors; decomposes _executeSkill() from CC=13 to CC=4
• SemanticMemoryClient (src/memory/semantic-memory.js) — SRP extraction from MemoryStoreClient
• ComplianceValidator (src/mcp/validators/compliance-validator.js) — extracted from mcp-server.js; CC reduced from 12 to 3
• EXPORT_NAMES_MAP / ALLOWED_HOOK_EVENTS constants in hook-registry.js for O(1) lookup

🔒 Fixed

• CWE-362 Race Condition: FileMemoryDriver now properly awaits _ensureReady() in all write paths
• Stack Overflow: redact() has a maxDepth=10 recursion guard
• CWE-78 Docker Injection: Docker binary validated against ALLOWED_DOCKER_PATHS whitelist before spawn
• URL Validation: Network request URLs validated (null + format) before hook dispatch
• semanticSearch() input guard: rejects non-string or empty queries early

⚡ Changed

• spawnAsync() replaces execFile/promisify in agent-runner.js — non-blocking, concurrent-safe subprocess execution
• Python analyzers are now async — analyzeCodePython() and auditSecurityPython() return Promise<Finding[]>

🧪 Tests

	Before	After
Test Suites	8	12
Tests	39	87

New suites: executor-factory, compliance-validator, semantic-memory, python-ast-analyzer

⚙️ CI

• CI matrix now includes Python 3.x setup for full AST analysis capability

---

Full Changelog: v1.2.1...v1.3.0