AgentDoctor v3.0.3

AgentDoctor 3.0.3

Patch release on top of public 3.0.2: Brain → Project Chat evidence bridge and real operation-based progress UX for agentdoctor ask.

Public relationship

• 3.0.2 remains the immutable public discovery patch (v3.0.2 → 8d41936).
• 3.0.3 packages Brain→Chat evidence integration and ask progress UX (2e2aa388).
• Does not rewrite 3.0.0, 3.0.1, or 3.0.2 history.

Fixed

• Deterministic agentdoctor ask / Project Chat now consumes searchable Project Brain claims/components as first-class INFERRED evidence (aligned with brain search).
• Brain-derived source paths are ownership-gated before excerpts; Brain claims are never auto-upgraded to VERIFIED.
• .agentdoctor/** control-plane paths cannot become VERIFIED application source evidence.
• Architecture/module answers prioritize Brain + owned sources over generic minified graph noise.
• Ownership, containment, HOME/broad-root, .private, nested-repo, symlink, and stale-brain protections remain enforced.

Added

• agentdoctor ask progress UX driven by real pipeline stages (understand → search → retrieve → verify → prepare).
• Progress writes to stderr (TTY spinner / non-TTY stable lines); answers and --json stay on stdout without contamination.
• No artificial delays — spinner frames only animate while real work is in flight.

Verification

• npm run verify: 143 files / 691 tests PASS
• npm pack --dry-run: package @praneeth_54/agentdoctor@3.0.3 (730 files)

Install

npm install -g @praneeth_54/agentdoctor@3.0.3
agentdoctor --version

Full Changelog: v3.0.2...v3.0.3

AgentDoctor 3.0.2

AgentDoctor 3.0.2 fixes current-directory project discovery for agentdoctor start.

When classic project markers are absent, start now uses the existing deterministic project detection engine as a safe fallback, aligning discovery behavior with dna.

Also includes clearer discovery UX and regression coverage.

Existing ownership, containment, nested-repository, symlink, HOME, and multi-project protections remain enforced.

Fixed

• agentdoctor start no longer reports (none found) for valid software trees without classic manifests
• Discovery fallback reuses detectProject (same engine as dna)
• Reject empty/unknown-only trees; do not silently absorb multi-project parents with 2+ child marker projects
• Clearer ✓ Project detected UX

Install

npm install -g @praneeth_54/agentdoctor@3.0.2
agentdoctor --version   # 3.0.2

Release commit: 8d41936

AgentDoctor 3.0.1

AgentDoctor 3.0.1

AgentDoctor 3.0.1 is a production-hardening follow-up to the original public 3.0.0 release.

Highlights

• Production freeze remediation carried forward into the 3.0.1 release line
• Project ownership and filesystem boundary hardening
• Agent/MCP path-safety improvements
• What-if ownership protection
• Brain/Twin/Graph stale-state protection
• CLI broad-root safety
• Dashboard/API hostile-input protection
• Adversarial security and certification coverage

Verification

• 140 files / 666 tests passing at release preparation
• Clean package inspection
• Clean installation verification
• Public npm package verification

Documented limitations

• Full TTY chat REPL is not automated; ask and dashboard chat are the certified paths.
• Native Anthropic and Gemini providers are not bundled.
• Vendor LLM behavior remains external.
• Live K8s/APM telemetry, enterprise IdP, embeddings, and commercial SAST/SCA integrations remain external.
• Knowledge-document scanning has documented shallow-readdir limitations.

AgentDoctor 3.0.0

AgentDoctor is local-first engineering intelligence for AI coding agents: understand a repository, ask grounded questions, plan changes, require human approval, apply path-safe tools, and produce evidence/proof — without claiming absolute correctness.

[3.0.0] — 2026-09-26

Public release of the AgentDoctor 3.0 local core: project intelligence, doctors,
student/agent workflows, MCP, dashboard, evidence/proof, and honest EXTERNAL
boundaries. AI providers remain opt-in. Correctness is never claimed.

Limitations: docs/LIMITATIONS.md.
Release prep: docs/FINAL_PRE_RELEASE_CHECK.md.

Highlights

• Project intelligence — discovery, DNA, Brain, software map, hybrid search,
  dependency/lockfile analysis, architecture contracts, git/change impact.
• Project Chat — deterministic ask / chat with truth labels
  (VERIFIED | INFERRED | UNKNOWN | EXTERNAL); optional AI when configured.
• Coding agent — plan → human approval → path-safe tools → verify; no
  unrestricted shell; ENGINEERING_CORRECTNESS_NOT_CLAIMED preserved.
• Student workflows — learn, viva, docs, Build With Me (explain → plan →
  approve → apply → verify).
• Security & approval — Security Doctor (static), secret redaction, forensic
  read-only mode, MCP approval tokens + planHash (bare approved:true rejected).
• Evidence & verification — change analysis, evidence bundles, change proof
  (hash integrity; engineering correctness not claimed).
• MCP — combined server with 38 tools (project, intelligence, agent,
  assurance); path/workspace escape blocked.
• Dashboard — embedded local UI + APIs (status, DNA, graph, search, security,
  twin, what-if, forensic, chat).
• Digital Twin / What-If — local refreshable twin snapshot; graph-derived
  impact with uncertainty (not certainty).
• Doctors — API, Database, Event, Security, Privacy, Incident, Deployment
  (file/static evidence); live runtime / IdP / brokers remain EXTERNAL.
• Evaluation Lab — fixture-driven eval including prompt-injection detect-only.
• Self-diagnosis — product self-check surfaces.

Providers (local)

• Implemented: none | mock | openai-compatible | ollama.
• Native Anthropic / Gemini SDKs: not implemented (fail closed via none).

Limitations (not unfinished stubs)

• Live cloud/DB/K8s/APM runtime intelligence: EXTERNAL.
• Neural embeddings / enterprise IdP-SSO: EXTERNAL.
• Full compiler-grade AST/call binding for every language: not claimed.
• Not an OS sandbox / EDR; not a replacement for commercial SAST/SCA.
• Proof asserts hash integrity — not absolute engineering correctness.

Docs / packaging

• Rebuilt public README; public docs under docs/; audits in docs/internal/.
• npm package contents: dist, README.md, LICENSE, CHANGELOG.md.
• GitHub Action default package pin: 3.0.0.

Install

npm install -g @praneeth_54/agentdoctor@3.0.0
agentdoctor --version

Limitations

See docs/LIMITATIONS.md.

Verification

• npm run verify: 627/627
• MCP tools: 38
• Package commit: release: AgentDoctor 3.0.0

AgentDoctor 2.1.0

AgentDoctor 2.1.0 — Release Notes

Package: @praneeth_54/agentdoctor@2.1.0
Status: Release cut authorized
Release notes: this document

---

What 2.0.1 was

AgentDoctor 2.0.1 is engineering assurance for AI coding agents:

• Repository intelligence (graph, impact, architecture signals)
• Project Brain and knowledge surfaces
• Safety scan → Safe Fix → verify
• Change assurance, evidence bundles, and Change Proof integrity
• Policy / controlled runner (shell=false by default)
• Workspace isolation
• Brain + intelligence MCP tools
• Local dashboard (read-oriented)

It was not a general chatbot and did not claim engineering correctness.

---

What 2.1.0 adds

An optional Project AI Agent line on top of the same assurance substrate.

AI is opt-in. Core scan / fix / verify / change / Brain / MCP intelligence remain usable without a model provider.

Architecture (invariant)

THE MODEL REASONS.
AGENTDOCTOR PROVIDES PROJECT CONTEXT.
AGENTDOCTOR CONTROLS TOOLS.
AGENTDOCTOR VERIFIES RESULTS.

The model never becomes the source of truth for repository facts. Tool results and repository excerpts are DATA, not SYSTEM instructions.

Surfaces

Surface	Role
CLI chat / ask	Evidence-backed project Q&A with truth labels
CLI plan / agent	Plan + approved coding loop (path-safe tools)
CLI learn	Student explain / viva / docs / BUILD_WITH_ME
Dashboard POST /api/chat	Ask-only Project Chat; fail-closed if provider=none
MCP agent tools	Context, ask, search, path-safe file ops, plan, change verify

Providers

Provider	Status
none	Default — fail closed for chat surfaces
mock	Explicit tests / offline demos only
openai-compatible	Optional HTTP (incl. custom base URL)
ollama	Optional via OpenAI-compatible endpoint
Native Anthropic / Gemini SDKs	NOT IMPLEMENTED

Configure via AGENTDOCTOR_AI_PROVIDER (and related env). Keys are never stored in Brain/evidence.

---

Highlights by area

Project intelligence

• Project-aware context packing
• Project Chat with citations
• Truth labels: VERIFIED / INFERRED / UNKNOWN / EXTERNAL

Agent tools & coding loop

• Read / search
• Create / edit / delete (approval required)
• Controlled run_command / run_tests
• PLAN → APPROVAL → EXECUTE → OBSERVE → VERIFY

Safety

• Path + symlink write protection
• Workspace isolation (when WorkspaceModel provided) + repo-root binding
• Mode allowWrites (LEARN cannot write)
• Approval gates; model cannot self-approve
• Dangerous command blocking
• Prompt-injection channel separation
• Secret redaction
• Hard limits (tool calls, iterations, wall time, files, context)

Verification

• Change analysis, evidence, proof, architecture where applicable
• Optional test run after edits
• Always: ENGINEERING_CORRECTNESS_NOT_CLAIMED

Student

• Learn / viva / docs
• BUILD_WITH_ME → shared coding loop after approval

MCP & dashboard

• Agent MCP subset (no unrestricted shell)
• Dashboard ask-only chat; fail-closed on unconfigured AI

---

Limitations (must ship in release notes)

• Not an OS sandbox or EDR (EXTERNAL LIMITATION).
• Native Anthropic / Gemini SDKs NOT IMPLEMENTED.
• MCP approved=true is trusted-caller input, not cryptographic human identity.
• MCP does not carry AgentMode (LEARN ban is CLI/loop-scoped).
• Rich interactive student UI is PARTIAL.
• Correctness is never guaranteed — integrity ≠ correctness.
• Do not claim: fully autonomous, 100% correct, completely safe, production guaranteed, or understands everything.

---

Upgrade notes (after version cut + publish)

npm install -g @praneeth_54/agentdoctor@2.1.0
agentdoctor --version   # expect 2.1.0 after cut

# Optional AI
export AGENTDOCTOR_AI_PROVIDER=mock   # or openai-compatible / ollama
agentdoctor ask "How does authentication work?" .

# Writes still require explicit approval
agentdoctor agent --goal "Add feature" --approve --apply --apply-ops '[...]' .

2.0.1 assurance CLIs (scan, fix, verify, change, evidence, proof, Brain MCP) remain available.

---

Related docs

• CHANGELOG.md — Unreleased / planned 2.1.0 section
• docs/RELEASE_CHECKLIST_2_1_0.md
• docs/AI_AGENT.md
• docs/SECURITY_AGENT.md
• docs/STUDENT_MODE.md
• docs/AGENTDOCTOR_2_1_ARCHITECTURE.md

AgentDoctor 2.0.1

AgentDoctor 2.0.1 — Release Candidate Hardening Report

Date: 2026-09-23
Package: @praneeth_54/agentdoctor@2.0.1
Scope: FINAL RELEASE CANDIDATE HARDENING validation only
Rule: No git commit / tag / push / npm publish in this session.

---

Final status

RELEASE CANDIDATE — READY FOR HUMAN RELEASE AUTHORIZATION

Local verify, pack integrity, clean-install CLI/MCP smoke, and security subset are green. External / experimental limitations from FINAL_COMPLETION_AUDIT.md remain documented and unchanged. Publish and git publish actions require explicit human authorization.

---

A) Stale CURRENT version references (fixed)

File	Change
docs/2.0/README.md	Package line → 2.0.1 (local/RC; npm may still show 2.0.0); note historical 2.0.0 report; pointer to docs/2.0.1/
docs/2.0/overview/architecture.md	Package version → 2.0.1 (contracts string 2.0.0-contracts kept)
docs/2.0/guides/deployment.md	Current release → 2.0.1 with honest npm caveat
docs/2.0/guides/migration.md	Package version → 2.0.1 (contracts string kept)
docs/guides/migration-v2.md	Package version → 2.0.1
docs/features/v2-features.md	Package version → 2.0.1
docs/README.md	Kept historical final-release-report as 2.0.0; added pointer to docs/2.0.1/
README.md	Install section phrased honestly: local/RC 2.0.1; npm may still show 2.0.0 until published

Not edited (per instruction): docs/archive/*, docs/2.0/release/final-release-report.md, CHANGELOG historical 2.0.0 section.

---

B) npm run verify

Result: PASSED

Step	Result
typecheck	pass
lint	pass
format:check	pass (after Prettier on docs/README.md)
build	pass
test	70 files, 451 tests passed

First verify attempt failed only on Prettier for docs/README.md; fixed and re-ran → full green.

---

C) Package (npm pack)

Field	Value
filename	praneeth_54-agentdoctor-2.0.1.tgz
package size	328.9 kB (328935 bytes on disk)
unpacked size	1.4 MB
total files	550
shasum	c06102c70fc1bb14c3ca10222a77d84ae4e87900
contents	Option B: dist/ + README.md + LICENSE + CHANGELOG.md + package.json

Forbidden-path inspection (tar -tzf)

Pattern	Finding
.git	absent
node_modules	absent
.private	absent
.env	absent
.agentdoctor data	absent
coverage string	Matches only product module dist/coverage/* (LCOV/Istanbul parsers) — not a test-coverage artifact tree

Post-test: tarball removed from repo root (no leftover *.tgz in git status).

---

D) Clean install smoke (/tmp/agentdoctor-2.0.1-release-test)

Install: npm install …/praneeth_54-agentdoctor-2.0.1.tgz → OK (0 vulnerabilities).

Check	Result	Exit
agentdoctor --version	2.0.1	0
--help	Usage banner OK	0
`scan	graph	change

Fixture smoke

Command	Result	Exit
scan "$FIX" --json	JSON includes "version":"2.0.1"	0
graph "$FIX" --json	Snapshot JSON, agentDoctorVersion 2.0.1	0
change analyze "$FIX"	Assessment produced (chg_*)	0
change verify "$FIX"	Evidence produced under .agentdoctor/evidence/	0
evidence inspect <id>	Lists evidence files	0
proof build / proof inspect	Integrity HASH_INTEGRITY_VERIFIED; correctnessStatus: ENGINEERING_CORRECTNESS_NOT_CLAIMED; engineering checks FAILED on minimal fixture (expected)	0
architecture init / check	Contract written; 0 violations	0
impact --json	Heuristic mode, git available	0
policy check --command "npm test"	decision=allow, evaluate-only	0
run explain --command "npm --version"	allow / wouldExecute	0
workspace create	N/A — command is workspace init (not create)	—
workspace init --name rc-test	ws_* created	0
workspace list	Lists rc-test	0

Note (non-blocking): change verify --json / global --json change verify still emit human terminal text in this cut (evidence files on disk are authoritative). Not treated as RC blocker.

---

E) MCP smoke (clean install)

Check	Result
mcp --help / brain-mcp --help	OK (exit 0)
STDIO initialize + tools/list via @modelcontextprotocol/sdk against installed dist/cli	26 tools
Required tools	change_analyze, architecture_check, proof_inspect, evidence_inspect, graph_query — all PRESENT
Hostile dependency_lookup `target=../../e...

AgentDoctor 2.0.0

[2.0.0] — 2026-09-21

AgentDoctor 2.0 expands the product from Safety + Project Brain into codebase
intelligence for developers, agents, and engineering teams — while preserving
Safety CLI behavior and Brain MCP tool names.

Canonical docs: docs/2.0/. Readiness:
docs/2.0/overview/readiness-matrix.md.
Limitations: docs/2.0/overview/known-limitations.md.

Added

• Shared contracts layer (CONTRACTS_VERSION) unifying findings / graph /
  knowledge / policy shapes.
• Repository Brain productization: init, proposal artifacts, brain review /
  brain proposals / product snapshots (proposals never auto-approved).
• TypeScript/JavaScript AST intelligence graph (graph) with regex fallback.
• Git engineering intelligence (health) with per-metric method disclosure.
• C4-style architecture views (c4) labeled inferred/proposed.
• Impact surfaces: impact, test-impact, refactor-impact.
• Governed knowledge store with abstention (knowledge, knowledge-create,
  knowledge-approve).
• Policy packs + AgentDoctor-controlled enforcement runner (enforce) distinct
  from evaluate-only firewall.
• Combined MCP server (agentdoctor mcp) exposing Brain tools plus
  intelligence tools without renaming brain_*.
• Dashboard /api/v2/* endpoints (graph, health, c4, knowledge,
  projects/workspaces stubs).
• Local-dev team authentication (team-register, team-login) — not enterprise SSO.
• Ops health via doctor --json.
• Security hardening: MCP/dashboard path-safety, symlink skip in AST walk,
  secret redaction on exports/API samples.
• Documentation tree: docs/2.0/ (overview, guides, reports, audits, release).
• Additional 2.0 platform / Safety surfaces landed with this release train:
  evaluate-only Action Policy Evaluator (platform policy-check, alias
  firewall-check), session audit, provenance, context-security, architecture
  drift, time-machine, token planner, readiness scorecard, multi-format reports,
  Copilot / Windsurf / Gemini CLI / Aider adapters, Project Brain CLI
  (brain init|status|inspect|rebuild|history|search|export|import),
  changes, context-health, secrets, Safe Fix 2.0 backup/undo, named
  baselines, monorepo packages, local pr-review, loopback dashboard,
  plugins, optional local-ai.

Security

• Path-traversal hardening for MCP dependency_lookup and dashboard hostile URLs.
• Evaluate-only policy evaluation remains explicit (executionResult: "not-executed").
• blocked-by-enforcement only on the AgentDoctor-controlled runner block path.
• Loopback dashboard default retained; non-loopback requires explicit opt-in.
• Safe Fix target hardening: refuse symlink write-through, symlink ancestors,
  directory targets, and non-allowlisted paths.

Compatibility

• Safety scan / fix / verify workflows and exit codes preserved.
• Brain MCP tool names preserved (brain_overview, …, brain_snapshot).
• Additive CLI commands only; no intentional removal of 1.x public surfaces.
• Platform evaluate-only firewall behavior preserved.

Known limitations (at release)

• AST analysis is TypeScript/JavaScript-focused; other languages unsupported for
  deep graph analysis.
• Test-impact is heuristic/graph-based (no coverage-file oracle).
• C4 views are inferred, not approved architecture truth.
• No IDE interception of third-party agents.
• Local-dev team auth is not SSO.
• SQLite/Postgres/vector backends are not production-complete.
• See README limitations and docs/2.0/overview/known-limitations.md.

Migration notes

• Upgrading from 1.1.x: existing .agentdoctor Safety/Brain data remains valid.
• New directories may appear under .agentdoctor/repository-brain/,
  .agentdoctor/knowledge/, .agentdoctor/team/, .agentdoctor/platform/.
• Treat init outputs as proposed until reviewed.
• Prefer agentdoctor mcp for combined tools; brain-mcp remains for Brain-only clients.
• Full guide: docs/2.0/guides/migration.md.

Notes

• Readiness matrix classifications remain honest; many 2.0 surfaces are
  implemented but partially validated. No blanket 5/5 claims.
• Multi-writer Safe Fix is still not fully atomic across targets after preflight.
• Vitest 3 → 4/5 major upgrade remains deferred (dev-only moderate advisory).
• Do not auto-publish from CI agents. Tag/publish require a separate human step.

AgentDoctor v1.1.1

AgentDoctor v1.1.1

Patch release after v1.1.0: Marketplace Action naming + dependency security pins.

Channels (aligned)

Channel	Version
npm @praneeth_54/agentdoctor	1.1.1
Git tag / GitHub Release	v1.1.1
Action default version input	1.1.1

What this release is

• GitHub Action Marketplace display name: AgentDoctor Safety
• Transitive dependency overrides for known advisories (js-yaml, fast-uri, hono, qs)
• Fixture Next.js pin update for Dependabot noise reduction

What this release is not

• Not a new Safety feature release
• Not a Project Brain behavior change
• Not an automatic Vitest 5 upgrade (deferred; major)

Install

npx @praneeth_54/agentdoctor@1.1.1

- uses: pranee54/AgentDoctor@v1.1.1
  with:
    version: "1.1.1"

Docs

• CHANGELOG.md
• docs/DEPENDENCY_SECURITY_AUDIT.md
• docs/DEPENDABOT_PR_REVIEW.md

Full Changelog: v1.1.0...v1.1.1

AgentDoctor v1.1.0

AgentDoctor v1.1.0

Minor release after Safety V1 (1.0.0): Brain → MCP → Agent.

Product shape

AgentDoctor
    │
    ├── Safety
    │     └── Scan → Fix → Verify → Policy → CI
    │
    └── Project Brain
          │
          ├── Understanding / Evidence / Confidence
          ├── Ownership / Risk / Claims / Snapshots
          ├── Delta / Explain / Trace
          │
          ▼
        MCP (STDIO)
          │
  Cursor · Claude Code · Codex
          │
          ▼
    AI coding agent

Promise: help AI coding agents understand what is in a repository, what can be trusted, and why.

Not a generic coding assistant. Not chatbot memory. Not RAG.

Highlights

• agentdoctor brain-mcp --root <path> — local STDIO MCP server (required --root)
• Ten evidence-backed tools with provenance envelopes
• Controlled write only: brain_snapshot rebuild under .agentdoctor/project-brain/
• Safety Scan → Fix → Verify → CI unchanged

Install (after npm publish)

npx @praneeth_54/agentdoctor@1.1.0

agentdoctor brain-mcp --root /absolute/path/to/project

Action consumers can keep pinning version: "1.0.0" for Safety-only CI until they intentionally adopt 1.1.0. Bump the Action default version input only after npm has published 1.1.0.

Docs

• CHANGELOG.md
• docs/mcp/brain-mcp.md
• docs/project-brain.md
• docs/demo/brain-mcp-demo.md
• validation/mcp-agent/

Owner publish checklist (manual)

1. Confirm npm run verify and validation scripts green on the release commit
2. npm publish (owner only)
3. Git tag v1.1.0 + GitHub Release from these notes
4. Optionally bump Action default version to 1.1.0 in a follow-up commit

Do not publish, tag, or push from unattended agents unless the owner explicitly requests it.

Full Changelog: v1.0.0...v1.1.0

AgentDoctor v1.0.0

AgentDoctor v1.0.0

First production release. Scan → Fix → Verify → CI is the supported workflow.

Highlights

• Claude Code and Codex safe-context Fix writers (alongside Cursor .cursorignore)
• CI policy gates on CLI and GitHub Action (minimum-score, fail-on-severity, fail-on-rule, fail-on-new, verify-baseline)
• scan --ci fails on critical findings; omit --ci for report-only
• Honest limited-analysis / no-agent scoring (n/a, --min-score fails)
• Windows CI + Windows-safe Fix overwrite
• Action verify-baseline containment after realpath

Install

npx @praneeth_54/agentdoctor@1.0.0

- uses: pranee54/AgentDoctor@v1.0.0
  with:
    path: .
    version: "1.0.0"
    minimum-score: "70"
    fail-on-severity: critical

Until this release is published to npm, pin the Action input to the last published
package (version: 0.3.0-beta) or use version: workspace after npm run build.
After npm has 1.0.0, bump the Action default version from 0.3.0-beta to 1.0.0.

Docs

• CHANGELOG.md
• docs/compatibility.md
• docs/exit-codes.md
• docs/scoring.md

What's Changed

• chore: npm badge + Action pin for 0.3.0-beta by @pranee54 in #28
• feat: complete Scan → Fix → Verify → CI developer loop by @pranee54 in #31
• fix: nested instruction-dir resolution for missing-path (#30) by @pranee54 in #32

Full Changelog: v0.3.0-beta...v1.0.0