chore: release v1.13.0 — autonomous web dev pipeline, ClawWork quality improvements

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: escapeboy

.version

@@ -1 +1 @@
-1.12.0
+1.13.0

CHANGELOG.md

@@ -2,6 +2,27 @@
 
 All notable changes to Agent Fleet Community Edition are documented here.
 
+## [1.13.0] - 2026-03-26
+
+### Added
+
+- **Autonomous Web Dev Pipeline** — Full end-to-end agentic software development cycle. New Git operation MCP tools: `git_pr_merge`, `git_pr_status`, `git_pr_close`, `git_workflow_dispatch`, `git_release_create`. `GitClientInterface` extended with `mergePullRequest`, `getPullRequestStatus`, `dispatchWorkflow`, `createRelease`, `closePullRequest`, `getCommitLog` — implemented in GitHub, GitLab, Sandbox, and Bridge clients.
+- **Deploy Integration Drivers** — Three new integration drivers: `VercelIntegrationDriver` (deploy, get_deployment, list_deployments, cancel, rollback), `NetlifyIntegrationDriver` (trigger_build, get_deploy, list_deploys, cancel, publish), `SshDeployIntegrationDriver` (run_deploy, check_health, rollback via SSH). GitHub driver extended with `create_pr`, `merge_pr`, `dispatch_workflow`, `create_release` actions.
+- **Web Dev Cycle Workflow Template** — Pre-built DAG workflow: plan → implement → test → fix-loop → lint → review → human approval → deploy. Seeded via `PlatformWorkflowsSeeder`.
+- **Per-Call Working Directory** — `AiRequestDTO` gains a `workingDirectory` field. `LocalAgentGateway` now prefers the per-call value over global config in both direct-exec and bridge-exec modes (`executeViaBridge` + `streamViaBridge`). `ExecuteAgentAction` passes `agent.configuration['working_directory']` into both `executeWithTools()` and `executeDirectPrompt()` requests.
+- **Pre-Execution Scout Phase** — New `PreExecutionScout` middleware runs a cheap lightweight LLM call (Haiku / GPT-4o-mini / Gemini Flash) before memory and KG injection to identify what specific knowledge the agent needs. Results are stored in `AgentExecutionContext::$scoutQueries` and consumed by `InjectMemoryContext` and `InjectKnowledgeGraphContext` for targeted retrieval instead of generic semantic search. Enable per-agent via `config['enable_scout_phase']` or globally via `AGENT_SCOUT_PHASE_ENABLED`. Disabled by default.
+- **Domain-Specific QA Rubrics** — `crew.settings.task_rubrics` JSONB map allows per-task-type weighted evaluation criteria. `ValidateTaskOutputAction` keyword-matches the task title/description against rubric keys, falls back to `default`, and injects weighted criteria into the QA agent's system prompt. `criterion_scores` are captured per rubric dimension in `qa_feedback`.
+- **Crew QA Rubric Validation** — `CreateCrewAction` and `UpdateCrewAction` validate `task_rubrics` at write time: max 10 rubric types, criterion names restricted to `[\w\s\-]+` (blocks prompt injection), descriptions capped at 500 chars, weights must be 0–1 numerics.
+- **Step Budget Awareness** — Agent system prompt now includes an `## Execution Budget` section when `max_steps > 1`, instructing the agent to complete core work by 80% of its step budget and reserve remaining steps for summarising and delivering results.
+- **Chatbot Knowledge Source Toggle** — `chatbot_knowledge_sources.is_enabled` boolean column allows individual knowledge sources to be enabled or disabled without deletion. `ChatbotResponseService` filters to enabled sources only when building RAG context. Toggle UI added to ChatbotKnowledgeBasePage.
+
+### Fixed
+
+- `PreExecutionScout` uses `ProviderResolver` to respect the BYOK credential hierarchy (skill → agent → team → platform) instead of hardcoding `anthropic`. Scout queries are capped at 200 chars and 5 queries to prevent prompt-injection amplification when prepended to embedding inputs.
+- `host-bridge.php` `working_directory` hardened against path traversal: realpath validation, null byte stripping, and assertion that the resolved path is within an allowed prefix.
+- `InjectKnowledgeGraphContext` fixed `array_filter` without callback (was incorrectly filtering non-empty strings).
+- `ValidateTaskOutputAction::resolveRubric` applies `strtolower()` to rubric keys before `str_contains` match (previously uppercase keys never matched lowercased task text).
+
 ## [1.12.0] - 2026-03-26
 
 ### Added

README.md

@@ -131,22 +131,26 @@ Failed tasks display detailed error information including provider, error type,
 - **AI Agents** -- Configure agents with roles, goals, backstories, personality traits, and skill assignments
 - **Agent Templates** -- 14 pre-built templates across 5 categories (engineering, content, business, design, research)
 - **Agent Evolution** -- AI-driven self-improvement: analyze execution history, propose config changes, and apply improvements
-- **Agent Crews** -- Multi-agent teams with lead/member roles and shared context
+- **Agent Crews** -- Multi-agent teams with coordinator, QA, and worker roles; domain-specific evaluation rubrics; weighted QA scoring per task type
+- **Pre-Execution Scout Phase** -- Optional cheap LLM pre-call before memory retrieval that identifies what knowledge the agent needs, enabling targeted semantic search instead of generic recall
+- **Step Budget Awareness** -- Agents receive an execution budget section in their system prompt, targeting 80% of allowed steps for core work and reserving the rest for synthesis
 - **Skills** -- Reusable AI skill definitions (LLM, connector, rule, hybrid, browser, RunPod, GPU compute) with versioning and cost tracking
 - **RunPod GPU Integration** -- Invoke RunPod serverless endpoints or manage full GPU pod lifecycles as skills; BYOK API key; spot pricing; cost tracking
 - **Pluggable Compute Providers** -- `gpu_compute` skill type backed by RunPod, Replicate, Fal.ai, and Vast.ai; configure via `compute_manage` MCP tool; zero platform credits
 - **Local LLM Support** -- Run Ollama or any OpenAI-compatible server (LM Studio, vLLM, llama.cpp) as a provider; 17 preset Ollama models; zero cost; SSRF protection
-- **Integrations** -- Connect GitHub, Slack, Notion, Airtable, Linear, Stripe, and generic webhooks/polling sources via unified driver interface with OAuth 2.0 support
+- **Integrations** -- Connect GitHub, Slack, Notion, Airtable, Linear, Stripe, Vercel, Netlify, and generic webhooks/polling sources via unified driver interface with OAuth 2.0 support
+- **Autonomous Web Dev Pipeline** -- Agents can open PRs, merge, dispatch CI workflows, create releases, and trigger Vercel/Netlify/SSH deploys through MCP tools and integration drivers
+- **Per-Call Working Directory** -- Local and bridge agents can operate in a configured working directory per-agent, enabling isolated project contexts
 - **Playbooks** -- Sequential or parallel multi-step workflows combining skills
-- **Workflows** -- Visual DAG builder with 8 node types: agent, conditional, human task, switch, dynamic fork, do-while loops
+- **Workflows** -- Visual DAG builder with 8 node types: agent, conditional, human task, switch, dynamic fork, do-while loops; pre-built Web Dev Cycle template
 - **Projects** -- One-shot and continuous long-running agent projects with cron scheduling, budget caps, milestones, and overlap policies
 - **Human-in-the-Loop** -- Approval queue and human task forms with SLA enforcement and escalation
 - **Multi-Channel Outbound** -- Email (SMTP), Telegram, Slack, and webhook delivery with rate limiting
 - **Webhooks** -- Inbound signal ingestion (HMAC-SHA256) and outbound webhook delivery with retry and event filtering
 - **Budget Controls** -- Per-experiment and per-project credit ledger with pessimistic locking and auto-pause on overspend
 - **Marketplace** -- Browse, publish, and install shared skills, agents, and workflows
 - **REST API** -- 175+ endpoints under `/api/v1/` with Sanctum auth, cursor pagination, and auto-generated OpenAPI 3.1 docs at `/docs/api`
-- **MCP Server** -- 200+ Model Context Protocol tools across 31 domains for LLM/agent access (stdio + HTTP/SSE)
+- **MCP Server** -- 316+ Model Context Protocol tools across 38 domains for LLM/agent access (stdio + HTTP/SSE)
 - **Tool Management** -- MCP servers (stdio/HTTP), built-in tools (bash/filesystem/browser), risk classification, per-agent assignment
 - **Credentials** -- Encrypted credential vault for external services with rotation, expiry tracking, and per-project injection
 - **Testing** -- Regression test suites for agent outputs with automated evaluation