@evo-dev/core 0.0.1-alpha.2 → 0.0.1-alpha.20

package/dist/config/index.js

@@ -117,9 +117,164 @@ function expectString(value, path) {
   return value;
 }
 // packages/core/src/config/settings.ts
-import { readFile as readFile2 } from "node:fs/promises";
+import { readFile as readFile3 } from "node:fs/promises";
+
+// packages/core/src/utils/errors.ts
+function isNotFoundError(error) {
+  return error instanceof Error && (("code" in error) && error.code === "ENOENT" || error.message.includes("ENOENT"));
+}
+// packages/core/src/utils/hash.ts
+import { createHash } from "node:crypto";
+function sha256Hex(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+function sha256Short(value, length = 16) {
+  return sha256Hex(value).slice(0, length);
+}
+// packages/core/src/utils/ids.ts
+function sanitizeStorageId(value, fallbackPrefix) {
+  const sanitized = value.replace(/[^a-zA-Z0-9._-]/g, "-").slice(0, 120);
+  return sanitized === "" || sanitized === "." || sanitized === ".." ? `${fallbackPrefix}-local` : sanitized;
+}
+// packages/core/src/utils/parsing.ts
+function optionalBoolean(value, fallback) {
+  return typeof value === "boolean" ? value : fallback;
+}
+function positiveInteger(value, fallback) {
+  return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : fallback;
+}
+// packages/core/src/evolution/evidence/session-memory/sensitivity.ts
+var SESSION_MEMORY_CREDENTIAL_REDACTION = "[credential-redacted]";
+var CREDENTIAL_FIELD_KEYS = new Set([
+  "accesstoken",
+  "apikey",
+  "auth",
+  "authtoken",
+  "authorization",
+  "clientsecret",
+  "cookie",
+  "credential",
+  "credentials",
+  "idtoken",
+  "password",
+  "passwd",
+  "privatekey",
+  "proxyauthorization",
+  "refreshtoken",
+  "secret",
+  "secretvalue",
+  "sessiontoken",
+  "setcookie",
+  "signingkey",
+  "token"
+]);
+var CREDENTIAL_KEY_PATTERN = String.raw`(?:access[_-]?token|api[_-]?key|auth(?:orization)?|client[_-]?secret|cookie|credential(?:s)?|id[_-]?token|password|passwd|private[_-]?key|proxy[_-]?authorization|refresh[_-]?token|secret(?:[_-]?value)?|session[_-]?token|set[_-]?cookie|signing[_-]?key|token)`;
+var CREDENTIAL_SHAPE_PATTERNS = [
+  /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/i,
+  /\bAKIA[0-9A-Z]{16}\b/,
+  /\bgh[pousr]_[A-Za-z0-9]{20,}\b/,
+  /\bxox[baprs]-[A-Za-z0-9-]{16,}\b/,
+  /\bBearer\s+[A-Za-z0-9._~+/=-]+/i,
+  /\bBasic\s+[A-Za-z0-9+/]+={0,2}/i,
+  new RegExp(String.raw`(?:^|[^A-Za-z0-9_])["']?${CREDENTIAL_KEY_PATTERN}["']?\s*[:=]\s*["']?[A-Za-z0-9][A-Za-z0-9._~+/=-]*`, "i"),
+  new RegExp(String.raw`(?:^|[^A-Za-z0-9_])["']?${CREDENTIAL_KEY_PATTERN}["']?\s*[:=]\s*["'](?!\[credential-redacted\]["'])[^"'\r\n]+["']`, "i")
+];
+var PRIVATE_KEY_BLOCK_PATTERN = /-----BEGIN ([A-Z0-9 ]*PRIVATE KEY)-----[\s\S]*?-----END \1-----/giu;
+var AUTHORIZATION_HEADER_PATTERN = /(^|[\r\n])(\s*(?:authorization|proxy-authorization)\s*:\s*)(?:Bearer|Basic)\s+[^\r\n]+/gimu;
+var COOKIE_HEADER_PATTERN = /(^|[\r\n])(\s*(?:cookie|set-cookie)\s*:\s*)[^\r\n]+/gimu;
+var BEARER_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]+/giu;
+var BASIC_PATTERN = /\bBasic\s+[A-Za-z0-9+/]+={0,2}/giu;
+var AWS_ACCESS_KEY_PATTERN = /\bAKIA[0-9A-Z]{16}\b/gu;
+var GITHUB_TOKEN_PATTERN = /\bgh[pousr]_[A-Za-z0-9]{20,}\b/gu;
+var SLACK_TOKEN_PATTERN = /\bxox[baprs]-[A-Za-z0-9-]{16,}\b/gu;
+var QUOTED_SERIALIZED_CREDENTIAL_PATTERN = new RegExp(String.raw`(^|[^A-Za-z0-9_])(["']?${CREDENTIAL_KEY_PATTERN}["']?\s*[:=]\s*)(["'])([^"'\r\n]+)(\3)`, "gimu");
+var SERIALIZED_CREDENTIAL_PATTERN = new RegExp(String.raw`(^|[^A-Za-z0-9_])(["']?${CREDENTIAL_KEY_PATTERN}["']?\s*[:=]\s*)(["']?)([A-Za-z0-9][A-Za-z0-9._~+/=-]*)(\3)`, "gimu");
+var URL_USERINFO_PATTERN = /(https?:\/\/)[^@\s/"']+@/giu;
+var URL_CREDENTIAL_PARAMETER_PATTERN = new RegExp(String.raw`([?&#]["']?${CREDENTIAL_KEY_PATTERN}["']?=)[^&#\s"'<>]+`, "giu");
+function redactSessionMemoryCredentialText(value) {
+  let redacted = value.replace(PRIVATE_KEY_BLOCK_PATTERN, SESSION_MEMORY_CREDENTIAL_REDACTION).replace(AUTHORIZATION_HEADER_PATTERN, (_, boundary, prefix) => {
+    return `${boundary}${prefix}${SESSION_MEMORY_CREDENTIAL_REDACTION}`;
+  }).replace(COOKIE_HEADER_PATTERN, (_, boundary, prefix) => {
+    return `${boundary}${prefix}${SESSION_MEMORY_CREDENTIAL_REDACTION}`;
+  }).replace(BEARER_PATTERN, `Bearer ${SESSION_MEMORY_CREDENTIAL_REDACTION}`).replace(BASIC_PATTERN, `Basic ${SESSION_MEMORY_CREDENTIAL_REDACTION}`).replace(AWS_ACCESS_KEY_PATTERN, SESSION_MEMORY_CREDENTIAL_REDACTION).replace(GITHUB_TOKEN_PATTERN, SESSION_MEMORY_CREDENTIAL_REDACTION).replace(SLACK_TOKEN_PATTERN, SESSION_MEMORY_CREDENTIAL_REDACTION).replace(QUOTED_SERIALIZED_CREDENTIAL_PATTERN, (_, boundary, prefix, quote) => `${boundary}${prefix}${quote}${SESSION_MEMORY_CREDENTIAL_REDACTION}${quote}`).replace(SERIALIZED_CREDENTIAL_PATTERN, (_, boundary, prefix, quote, credentialValue) => {
+    const trailingPunctuation = quote === "" ? credentialValue.match(/[.,;!?]+$/u)?.[0] ?? "" : "";
+    return `${boundary}${prefix}${quote}${SESSION_MEMORY_CREDENTIAL_REDACTION}${quote}${trailingPunctuation}`;
+  }).replace(URL_CREDENTIAL_PARAMETER_PATTERN, (_, prefix) => `${prefix}${SESSION_MEMORY_CREDENTIAL_REDACTION}`).replace(URL_USERINFO_PATTERN, (_, protocol) => protocol);
+  if (redacted === "")
+    redacted = value;
+  return { value: redacted, redacted: redacted !== value };
+}
+
+// packages/core/src/evolution/shared.ts
+var MAX_PROPOSED_CHANGE_LENGTH = 16 * 1024;
+var PROCESS_LOCK_STALE_MS = 5 * 60 * 1000;
+var FORBIDDEN_RAW_KEYS = new Set([
+  "commandhistory",
+  "commandoutput",
+  "credential",
+  "credentials",
+  "env",
+  "fullsource",
+  "memorybody",
+  "password",
+  "privatekey",
+  "prompt",
+  "promptbody",
+  "prompttext",
+  "rawcommand",
+  "rawcommandoutput",
+  "rawlog",
+  "rawlogs",
+  "rawoutput",
+  "rawpayload",
+  "rawprompt",
+  "secret",
+  "secretvalue",
+  "source",
+  "sourcebody",
+  "sourcecode",
+  "sourcecontent",
+  "sourcetext",
+  "stderr",
+  "stdout",
+  "token",
+  "transcript",
+  "transcriptbody",
+  "transcripttext"
+]);
+// packages/core/src/evolution/evidence/session-memory/policy.ts
+function createDefaultSessionMemoryPolicy() {
+  return {
+    enabled: true,
+    storeRawSegments: true,
+    maxRawSegmentBytes: 200000,
+    retentionDays: 30,
+    minimumMessageTokensToInit: 1e4,
+    minimumTokensBetweenUpdate: 5000,
+    toolCallsBetweenUpdates: 9
+  };
+}
+function parseSessionMemoryPolicy(value) {
+  const defaults = createDefaultSessionMemoryPolicy();
+  if (value === undefined)
+    return defaults;
+  return {
+    enabled: optionalBoolean(value.enabled, defaults.enabled),
+    storeRawSegments: optionalBoolean(value.storeRawSegments, defaults.storeRawSegments),
+    maxRawSegmentBytes: positiveInteger(value.maxRawSegmentBytes, defaults.maxRawSegmentBytes),
+    retentionDays: positiveInteger(value.retentionDays, defaults.retentionDays),
+    minimumMessageTokensToInit: positiveInteger(value.minimumMessageTokensToInit, defaults.minimumMessageTokensToInit),
+    minimumTokensBetweenUpdate: positiveInteger(value.minimumTokensBetweenUpdate, defaults.minimumTokensBetweenUpdate),
+    toolCallsBetweenUpdates: positiveInteger(value.toolCallsBetweenUpdates, defaults.toolCallsBetweenUpdates)
+  };
+}
+// packages/core/src/projects/index.ts
+import { lstat, readFile, readdir, realpath, stat } from "node:fs/promises";
+import { basename as basename2, dirname as dirname2, isAbsolute as isAbsolute2, join as join2, parse } from "node:path";
 
 // packages/core/src/runtime-logs/index.ts
+import { lstatSync, readFileSync, realpathSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 var SAFE_EXECUTION_METADATA_KEYS = new Set([
   "phase",
   "runtimeSurface",
@@ -135,6 +290,7 @@ var SAFE_EXECUTION_METADATA_KEYS = new Set([
   "redactionLabels",
   "normalizedEventType"
 ]);
+var SENSITIVE_EVENT_TEXT_PATTERN = /https?:\/\/\S+|(^|[^a-z0-9])(secret|token|password|passwd|private|internal|api[_-]?key|apikey|credential|credentials|stdout|stderr|transcript|formattedresponse|additionalcontext)([^a-z0-9]|$)|raw[\s_-]?(payload|prompt|output|source)|source[\s_-]?dump/i;
 var SAFE_REDACTION_LABELS = new Set([
   "raw-command",
   "raw-command-output",
@@ -142,26 +298,341 @@ var SAFE_REDACTION_LABELS = new Set([
   "sensitive-command",
   "sensitive-text"
 ]);
+function resolveProjectLogIdentity(homeDir, repoRoot) {
+  const identityHomeDir = realpathDirectoryOrFallback(homeDir);
+  const workspaceRoot = realpathDirectoryOrFallback(repoRoot);
+  const workspaceKey = resolvePathProjectLogKey(identityHomeDir, workspaceRoot);
+  const gitCommonDir = resolveGitCommonDir(workspaceRoot);
+  if (gitCommonDir === null) {
+    return {
+      projectKey: workspaceKey,
+      workspaceKey,
+      projectRoot: workspaceRoot,
+      workspaceRoot,
+      gitCommonDir: null,
+      linkedWorktree: false
+    };
+  }
+  const commonDirOwnsWorktree = basename(gitCommonDir) === ".git";
+  const projectIdentityPath = commonDirOwnsWorktree ? dirname(gitCommonDir) : gitCommonDir;
+  const projectRoot = commonDirOwnsWorktree ? projectIdentityPath : workspaceRoot;
+  return {
+    projectKey: resolvePathProjectLogKey(identityHomeDir, projectIdentityPath),
+    workspaceKey,
+    projectRoot,
+    workspaceRoot,
+    gitCommonDir,
+    linkedWorktree: workspaceKey !== resolvePathProjectLogKey(identityHomeDir, projectIdentityPath)
+  };
+}
+function resolvePathProjectLogKey(homeDir, repoRoot) {
+  const trimmedHome = stripTrailingSlash2(homeDir);
+  const trimmedRepo = stripTrailingSlash2(repoRoot);
+  const relativePath = relative(trimmedHome, trimmedRepo);
+  const source = relativePath !== "" && !relativePath.startsWith("..") && !isAbsolute(relativePath) ? relativePath : trimmedRepo.replace(/^[/\\]+/, "");
+  const projectKey = source.split(/[/\\]+/).filter(Boolean).map((part) => sanitizePathSegment(part)).join("-") || "project-local";
+  return sanitizePersistentIdentifier(projectKey, "project");
+}
+function realpathDirectoryOrFallback(path) {
+  try {
+    return realpathSync(path);
+  } catch {
+    if (!isAbsolute(path))
+      return stripTrailingSlash2(path);
+    const missingSegments = [];
+    let current = stripTrailingSlash2(path);
+    for (;; ) {
+      const parent = dirname(current);
+      if (parent === current)
+        return stripTrailingSlash2(path);
+      missingSegments.unshift(basename(current));
+      current = parent;
+      try {
+        return join(realpathSync(current), ...missingSegments);
+      } catch {}
+    }
+  }
+}
+function resolveGitCommonDir(workspaceRoot) {
+  const markerPath = join(workspaceRoot, ".git");
+  let gitDir;
+  try {
+    const marker = lstatSync(markerPath);
+    if (marker.isDirectory()) {
+      gitDir = realpathSync(markerPath);
+    } else if (marker.isFile()) {
+      const value = readFileSync(markerPath, "utf8").trim();
+      const match = value.match(/^gitdir:\s*(.+)$/u);
+      if (match?.[1] === undefined || match[1].includes("\x00"))
+        return null;
+      gitDir = realpathSync(isAbsolute(match[1]) ? match[1] : resolve(workspaceRoot, match[1]));
+    } else {
+      return null;
+    }
+  } catch {
+    return null;
+  }
+  try {
+    const commonDirValue = readFileSync(join(gitDir, "commondir"), "utf8").trim();
+    if (commonDirValue === "" || commonDirValue.includes("\x00"))
+      return gitDir;
+    return realpathSync(isAbsolute(commonDirValue) ? commonDirValue : resolve(gitDir, commonDirValue));
+  } catch {
+    return gitDir;
+  }
+}
+function sanitizePathSegment(value) {
+  return value.replace(/[^a-zA-Z0-9._-]/g, "-").slice(0, 120) || "session-local";
+}
+function sanitizePersistentIdentifier(value, prefix) {
+  const pathSafe = value.replace(/[^a-zA-Z0-9._-]/g, "-").slice(0, 120) || `${prefix}-local`;
+  if (!SENSITIVE_EVENT_TEXT_PATTERN.test(value) && !SENSITIVE_EVENT_TEXT_PATTERN.test(pathSafe)) {
+    return pathSafe;
+  }
+  return `${prefix}-${sha256Short(value)}`;
+}
+function stripTrailingSlash2(path) {
+  if (path === "/" || /^[A-Za-z]:[\\/]?$/.test(path))
+    return path;
+  return path.replace(/[/\\]+$/, "");
+}
 
-// packages/core/src/knowledge/index.ts
-import { mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
-import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+// packages/core/src/projects/index.ts
+class ProjectRegistrationError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "ProjectRegistrationError";
+    this.code = code;
+  }
+}
+function resolveProjectRegistryPaths(homeDir) {
+  const paths = resolveEvoDevPaths(homeDir);
+  const discoveredDir = join2(paths.stateDir, "projects", "discovered");
+  const registeredDir = join2(paths.rootDir, "projects");
+  const workspaceDir = join2(paths.stateDir, "projects", "workspaces");
+  const aliasDir = join2(paths.stateDir, "projects", "aliases");
+  return {
+    discoveredDir,
+    registeredDir,
+    workspaceDir,
+    aliasDir,
+    discoveredPath: (projectKey) => join2(discoveredDir, `${projectKey}.json`),
+    registeredPath: (projectKey) => join2(registeredDir, projectKey, "workspace.json"),
+    workspacePath: (workspaceKey) => join2(workspaceDir, `${workspaceKey}.json`),
+    aliasPath: (aliasProjectKey) => join2(aliasDir, `${aliasProjectKey}.json`)
+  };
+}
+async function resolveProjectWorkspaceFromCwd(input) {
+  if (!isAbsolute2(input.cwd))
+    return null;
+  let cwd;
+  try {
+    const info = await stat(input.cwd);
+    if (!info.isDirectory())
+      return null;
+    cwd = await realpath(input.cwd);
+  } catch (error) {
+    if (isNotFoundError(error))
+      return null;
+    throw error;
+  }
+  const gitRoot = await findNearestGitRoot(cwd);
+  const workspaceRoot = gitRoot ?? cwd;
+  const identity = resolveProjectLogIdentity(input.homeDir, workspaceRoot);
+  return {
+    projectKey: sanitizeStorageId(identity.projectKey, "project"),
+    workspaceKey: sanitizeStorageId(identity.workspaceKey, "workspace"),
+    displayName: basename2(identity.projectRoot) || parse(identity.projectRoot).root,
+    projectRoot: identity.projectRoot,
+    workspaceRoot,
+    workspaceKind: gitRoot === null ? "directory" : "git",
+    gitCommonDir: identity.gitCommonDir,
+    linkedWorktree: identity.linkedWorktree,
+    cwd
+  };
+}
+async function listProjectAliases(input) {
+  const paths = resolveProjectRegistryPaths(input.homeDir);
+  const aliases = {};
+  for (const path of await listJsonFilePaths(paths.aliasDir)) {
+    const record = await readProjectAlias(path);
+    if (record !== null)
+      aliases[record.aliasProjectKey] = record.canonicalProjectKey;
+  }
+  for (const path of await listJsonFilePaths(paths.discoveredDir)) {
+    const record = await readDiscoveredProject(path);
+    if (record !== null) {
+      await collectAvailableProjectAlias(input.homeDir, record, aliases);
+    }
+  }
+  for (const projectKey of await listDirectoryNames2(paths.registeredDir)) {
+    const record = await readRegisteredProject(join2(paths.registeredDir, projectKey, "workspace.json"));
+    if (record !== null) {
+      await collectAvailableProjectAlias(input.homeDir, record, aliases);
+    }
+  }
+  return normalizeProjectAliases(aliases);
+}
+function canonicalizeProjectKey(projectKey, aliases) {
+  let current = projectKey;
+  const seen = new Set;
+  while (!seen.has(current)) {
+    seen.add(current);
+    const next = aliases[current];
+    if (next === undefined || next === current)
+      return current;
+    current = next;
+  }
+  return projectKey;
+}
+async function listEquivalentProjectKeys(input) {
+  const aliases = await listProjectAliases({ homeDir: input.homeDir });
+  const canonical = canonicalizeProjectKey(input.projectKey, aliases);
+  return [
+    ...new Set([
+      canonical,
+      input.projectKey,
+      ...Object.keys(aliases).filter((alias) => canonicalizeProjectKey(alias, aliases) === canonical)
+    ])
+  ].sort();
+}
+async function collectAvailableProjectAlias(homeDir, record, aliases) {
+  const workspace = await resolveProjectWorkspaceFromCwd({
+    homeDir,
+    cwd: record.workspaceRoot
+  }).catch(() => null);
+  if (workspace === null)
+    return;
+  if (record.projectKey !== workspace.projectKey) {
+    aliases[record.projectKey] = workspace.projectKey;
+  }
+  if (workspace.workspaceKey !== workspace.projectKey) {
+    aliases[workspace.workspaceKey] = workspace.projectKey;
+  }
+}
+function normalizeProjectAliases(aliases) {
+  return Object.fromEntries(Object.keys(aliases).sort().flatMap((alias) => {
+    const canonical = canonicalizeProjectKey(alias, aliases);
+    return canonical === alias ? [] : [[alias, canonical]];
+  }));
+}
+async function findNearestGitRoot(cwd) {
+  let current = cwd;
+  for (;; ) {
+    try {
+      const marker = await lstat(join2(current, ".git"));
+      if (marker.isDirectory() || marker.isFile())
+        return current;
+    } catch (error) {
+      if (!isNotFoundError(error))
+        throw error;
+    }
+    const parent = dirname2(current);
+    if (parent === current)
+      return null;
+    current = parent;
+  }
+}
+async function readDiscoveredProject(path) {
+  try {
+    return parseDiscoveredProject(JSON.parse(await readFile(path, "utf8")));
+  } catch (error) {
+    if (isNotFoundError(error) || error instanceof ProjectRegistrationError)
+      return null;
+    throw error;
+  }
+}
+async function readRegisteredProject(path) {
+  try {
+    return parseRegisteredProject(JSON.parse(await readFile(path, "utf8")));
+  } catch (error) {
+    if (isNotFoundError(error) || error instanceof ProjectRegistrationError)
+      return null;
+    throw error;
+  }
+}
+async function readProjectAlias(path) {
+  try {
+    return parseProjectAlias(JSON.parse(await readFile(path, "utf8")));
+  } catch (error) {
+    if (isNotFoundError(error) || error instanceof ProjectRegistrationError)
+      return null;
+    throw error;
+  }
+}
+function parseDiscoveredProject(value) {
+  const record = requireRecord(value);
+  if (record.schemaVersion !== 1 || record.kind !== "discovered-project" || !isProjectKey(record.projectKey) || !isNonEmptyString(record.displayName) || !isAbsoluteString(record.workspaceRoot) || !isAbsoluteString(record.lastCwd) || !isWorkspaceKind(record.workspaceKind) || !isDiscoveryTargetArray(record.sourceTargets) || !(record.lastSessionKey === null || isNonEmptyString(record.lastSessionKey)) || !isNonEmptyString(record.firstSeenAt) || !isNonEmptyString(record.lastSeenAt) || record.localOnly !== true || record.sourceContentStored !== false) {
+    throw new ProjectRegistrationError("invalid", "Discovered project record is invalid.");
+  }
+  return record;
+}
+function parseRegisteredProject(value) {
+  const record = requireRecord(value);
+  if (record.schemaVersion !== 1 || record.kind !== "registered-project" || !isProjectKey(record.projectKey) || !isNonEmptyString(record.displayName) || !isAbsoluteString(record.workspaceRoot) || !isWorkspaceKind(record.workspaceKind) || !isNonEmptyString(record.registeredAt) || !isNonEmptyString(record.lastSeenAt) || record.localOnly !== true || record.sourceContentStored !== false) {
+    throw new ProjectRegistrationError("invalid", "Registered project record is invalid.");
+  }
+  return record;
+}
+function parseProjectAlias(value) {
+  const record = requireRecord(value);
+  if (record.schemaVersion !== 1 || record.kind !== "project-alias" || !isProjectKey(record.aliasProjectKey) || !isProjectKey(record.canonicalProjectKey) || record.aliasProjectKey === record.canonicalProjectKey || !isAbsoluteString(record.workspaceRoot) || !isNonEmptyString(record.createdAt) || !isNonEmptyString(record.updatedAt) || record.localOnly !== true || record.sourceContentStored !== false) {
+    throw new ProjectRegistrationError("invalid", "Project alias record is invalid.");
+  }
+  return record;
+}
+async function listJsonFilePaths(path) {
+  try {
+    return (await readdir(path, { withFileTypes: true })).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => join2(path, entry.name)).sort();
+  } catch (error) {
+    if (isNotFoundError(error))
+      return [];
+    throw error;
+  }
+}
+async function listDirectoryNames2(path) {
+  try {
+    return (await readdir(path, { withFileTypes: true })).filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort();
+  } catch (error) {
+    if (isNotFoundError(error))
+      return [];
+    throw error;
+  }
+}
+function isProjectKey(value) {
+  return typeof value === "string" && value !== "." && value !== ".." && /^[A-Za-z0-9._-]{1,120}$/.test(value);
+}
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.trim() !== "";
+}
+function isAbsoluteString(value) {
+  return isNonEmptyString(value) && isAbsolute2(value);
+}
+function isWorkspaceKind(value) {
+  return value === "git" || value === "directory";
+}
+function isDiscoveryTargetArray(value) {
+  return Array.isArray(value) && value.length > 0 && value.every((item) => item === "claude" || item === "codex");
+}
+function requireRecord(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new ProjectRegistrationError("invalid", "Project record must be an object.");
+  }
+  return value;
+}
+
+// packages/core/src/evolution/evidence/session-memory/constants.ts
+var DEFAULT_MAX_RAW_EVENT_BYTES = 64 * 1024;
+// packages/core/src/evolution/knowledge/index.ts
+import { mkdir, readFile as readFile2, readdir as readdir2, rename, rm, stat as stat2, writeFile } from "node:fs/promises";
+import { dirname as dirname3, isAbsolute as isAbsolute3, join as join3, relative as relative2, resolve as resolve2 } from "node:path";
+
+// packages/core/src/evolution/knowledge/change-store.ts
+var KNOWLEDGE_CHANGE_LOCK_STALE_MS = 5 * 60 * 1000;
+
+// packages/core/src/evolution/knowledge/index.ts
 var RESERVED_OKF_FILENAMES = new Set(["index.md", "log.md"]);
-var FORBIDDEN_OKF_TEXT = /\b(secret|token|password|passwd|api[_-]?key|apikey|credential|credentials|secret[\s_-]*token(?:[\s_-]*repro)?|raw[\s_-]*(?:log|logs|output|source|prompt)(?:[\s_-]*repro)?|shell[\s_-]*history|command[\s_-]*history)\b/i;
-var PRIVATE_OR_INTERNAL_URL = /https?:\/\/\S*(?:internal|private|corp|localhost|127\.0\.0\.1)\S*/i;
-var OKF_PRIVACY_FLAG_KEYS = [
-  "rawPromptsStored",
-  "rawLogsStored",
-  "sourceDumpsStored",
-  "rawCommandOutputStored",
-  "secretsStored",
-  "internalLinksStored"
-];
-var OKF_QUERY_PRIVACY_FLAG_KEYS = [
-  ...OKF_PRIVACY_FLAG_KEYS,
-  "rawOutputStored",
-  "sourceContentStored"
-];
 var ACTIVE_OKF_REVIEW_STATES = ["accepted", "auto-accepted"];
 var OKF_REVIEW_STATES = [
   "auto-accepted",
@@ -192,19 +663,19 @@ var BEHAVIOR_CHANGE_KINDS = new Set([
   "repo-asset-suggestion"
 ]);
 function resolveOkfKnowledgePaths(homeDir) {
-  const paths = resolveEvoDevPaths(homeDir);
+  const paths2 = resolveEvoDevPaths(homeDir);
   return {
-    knowledgeDir: paths.knowledgeDir,
-    okfDir: join(paths.knowledgeDir, "okf"),
-    indexesDir: join(paths.knowledgeDir, "indexes"),
-    tmpDir: join(paths.knowledgeDir, "tmp")
+    knowledgeDir: paths2.knowledgeDir,
+    okfDir: join3(paths2.knowledgeDir, "okf"),
+    indexesDir: join3(paths2.knowledgeDir, "indexes"),
+    tmpDir: join3(paths2.knowledgeDir, "tmp")
   };
 }
 async function ensureOkfKnowledgeBase(homeDir) {
-  const paths = resolveOkfKnowledgePaths(homeDir);
-  await ensureLocalKnowledgeGitRepository(paths.knowledgeDir);
-  await mkdir(paths.indexesDir, { recursive: true });
-  await mkdir(paths.tmpDir, { recursive: true });
+  const paths2 = resolveOkfKnowledgePaths(homeDir);
+  await ensureLocalKnowledgeGitRepository(paths2.knowledgeDir);
+  await mkdir(paths2.indexesDir, { recursive: true });
+  await mkdir(paths2.tmpDir, { recursive: true });
   const directories = [
     {
       path: "",
@@ -234,13 +705,47 @@ async function ensureOkfKnowledgeBase(homeDir) {
     { path: "references", title: "References", description: "Cited references." }
   ];
   for (const directory of directories) {
-    await ensureOkfDirectory(paths.okfDir, directory.path, directory.title, directory.description);
+    await ensureOkfDirectory(paths2.okfDir, directory.path, directory.title, directory.description);
   }
   await rebuildOkfKnowledgeIndexes({ homeDir });
 }
+function normalizeKnowledgeSupportRef(value, path) {
+  const input = assertRecordValue(value, path);
+  const kind = readRequiredString(input.kind, `${path}.kind`);
+  if (kind !== "user-declaration" && kind !== "repo-policy" && kind !== "state-observation" && kind !== "verified-outcome" && kind !== "semantic-inference") {
+    throw new Error(`${path}.kind is invalid.`);
+  }
+  const observedAt = readRequiredString(input.observedAt, `${path}.observedAt`);
+  if (!Number.isFinite(Date.parse(observedAt)))
+    throw new Error(`${path}.observedAt is invalid.`);
+  const subjectFingerprint = input.subjectFingerprint === null ? null : sanitizeOkfText(readRequiredString(input.subjectFingerprint, `${path}.subjectFingerprint`));
+  return {
+    id: sanitizeOkfText(readRequiredString(input.id, `${path}.id`)),
+    kind,
+    sourceRefId: sanitizeOkfText(readRequiredString(input.sourceRefId, `${path}.sourceRefId`)),
+    subjectFingerprint,
+    observedAt: new Date(observedAt).toISOString()
+  };
+}
+function assertRecordValue(value, path) {
+  if (!isRecord(value))
+    throw new Error(`${path} must be an object.`);
+  return value;
+}
+function readRequiredString(value, path) {
+  if (!isNonEmptyString2(value))
+    throw new Error(`${path} must be a non-empty string.`);
+  return value;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isNonEmptyString2(value) {
+  return typeof value === "string" && value.trim() !== "";
+}
 async function rebuildOkfKnowledgeIndexes(input) {
-  const paths = resolveOkfKnowledgePaths(input.homeDir);
-  await mkdir(paths.indexesDir, { recursive: true });
+  const paths2 = resolveOkfKnowledgePaths(input.homeDir);
+  await mkdir(paths2.indexesDir, { recursive: true });
   const concepts = (await listOkfKnowledgeConcepts({ homeDir: input.homeDir })).filter(isActiveOkfConcept);
   const conceptSummaries = concepts.map((concept) => ({
     id: concept.id,
@@ -257,34 +762,34 @@ async function rebuildOkfKnowledgeIndexes(input) {
     pathScopes: concept.pathScopes
   }));
   const pathsWritten = [
-    join(paths.indexesDir, "index.json"),
-    join(paths.indexesDir, "concepts.json"),
-    join(paths.indexesDir, "repos.json"),
-    join(paths.indexesDir, "roles.json"),
-    join(paths.indexesDir, "workflows.json")
+    join3(paths2.indexesDir, "index.json"),
+    join3(paths2.indexesDir, "concepts.json"),
+    join3(paths2.indexesDir, "repos.json"),
+    join3(paths2.indexesDir, "roles.json"),
+    join3(paths2.indexesDir, "workflows.json")
   ];
-  await writeJson(pathsWritten[0], {
+  await writeJson2(pathsWritten[0], {
     schemaVersion: 1,
     kind: "okf-knowledge-index",
     conceptCount: concepts.length,
     updatedAt: new Date().toISOString()
   }, { overwrite: true });
-  await writeJson(pathsWritten[1], {
+  await writeJson2(pathsWritten[1], {
     schemaVersion: 1,
     kind: "okf-concepts-index",
     concepts: conceptSummaries
   }, { overwrite: true });
-  await writeJson(pathsWritten[2], {
+  await writeJson2(pathsWritten[2], {
     schemaVersion: 1,
     kind: "okf-repos-index",
     repos: groupConceptsByTag(concepts, "repoTags")
   }, { overwrite: true });
-  await writeJson(pathsWritten[3], {
+  await writeJson2(pathsWritten[3], {
     schemaVersion: 1,
     kind: "okf-roles-index",
     roles: groupConceptsByTag(concepts, "roleTags")
   }, { overwrite: true });
-  await writeJson(pathsWritten[4], {
+  await writeJson2(pathsWritten[4], {
     schemaVersion: 1,
     kind: "okf-workflows-index",
     workflows: groupConceptsByTag(concepts, "workflowTags")
@@ -293,33 +798,37 @@ async function rebuildOkfKnowledgeIndexes(input) {
 }
 async function listOkfKnowledgeConcepts(input) {
   const okfDir = resolveOkfKnowledgePaths(input.homeDir).okfDir;
-  if (!await pathExists(okfDir))
+  if (!await pathExists2(okfDir))
     return [];
+  const equivalentProjectKeys = input.projectKey === undefined ? undefined : await listEquivalentProjectKeys({
+    homeDir: input.homeDir,
+    projectKey: input.projectKey
+  });
   const files = await listMarkdownFiles(okfDir);
   const concepts = [];
   for (const file of files) {
     if (RESERVED_OKF_FILENAMES.has(file.name))
       continue;
-    const content = await readFile(file.path, "utf8");
+    const content = await readFile2(file.path, "utf8");
     const parsed = parseOkfConceptFile(okfDir, file.path, content);
     if (parsed !== null)
       concepts.push(parsed);
   }
-  return concepts.filter((concept) => matchesConceptFilters(concept, input)).sort((left, right) => left.id.localeCompare(right.id));
+  return concepts.filter((concept) => matchesConceptFilters(concept, input, equivalentProjectKeys)).sort((left, right) => left.id.localeCompare(right.id));
 }
 async function ensureLocalKnowledgeGitRepository(knowledgeDir) {
   await mkdir(knowledgeDir, { recursive: true });
-  const gitDir = join(knowledgeDir, ".git");
-  if (await pathExists(gitDir))
+  const gitDir = join3(knowledgeDir, ".git");
+  if (await pathExists2(gitDir))
     return;
-  await mkdir(join(gitDir, "objects", "info"), { recursive: true });
-  await mkdir(join(gitDir, "objects", "pack"), { recursive: true });
-  await mkdir(join(gitDir, "refs", "heads"), { recursive: true });
-  await mkdir(join(gitDir, "refs", "tags"), { recursive: true });
-  await mkdir(join(gitDir, "info"), { recursive: true });
-  await writeTextIfMissing(join(gitDir, "HEAD"), `ref: refs/heads/main
+  await mkdir(join3(gitDir, "objects", "info"), { recursive: true });
+  await mkdir(join3(gitDir, "objects", "pack"), { recursive: true });
+  await mkdir(join3(gitDir, "refs", "heads"), { recursive: true });
+  await mkdir(join3(gitDir, "refs", "tags"), { recursive: true });
+  await mkdir(join3(gitDir, "info"), { recursive: true });
+  await writeTextIfMissing(join3(gitDir, "HEAD"), `ref: refs/heads/main
 `);
-  await writeTextIfMissing(join(gitDir, "config"), [
+  await writeTextIfMissing(join3(gitDir, "config"), [
     "[core]",
     "\trepositoryformatversion = 0",
     "\tfilemode = true",
@@ -328,7 +837,7 @@ async function ensureLocalKnowledgeGitRepository(knowledgeDir) {
     ""
   ].join(`
 `));
-  await writeTextIfMissing(join(gitDir, "info", "exclude"), [
+  await writeTextIfMissing(join3(gitDir, "info", "exclude"), [
     "# EvoDev user-local knowledge git repository.",
     "# No remote is configured by default.",
     ""
@@ -336,20 +845,20 @@ async function ensureLocalKnowledgeGitRepository(knowledgeDir) {
 `));
 }
 async function writeTextIfMissing(path, value) {
-  if (await pathExists(path))
+  if (await pathExists2(path))
     return;
-  await mkdir(dirname(path), { recursive: true });
+  await mkdir(dirname3(path), { recursive: true });
   await writeFile(path, value, { encoding: "utf8", flag: "wx" });
 }
 function sanitizeOkfText(value) {
-  return value.replace(new RegExp(PRIVATE_OR_INTERNAL_URL.source, "gi"), "[redacted]").replace(new RegExp(FORBIDDEN_OKF_TEXT.source, "gi"), "[redacted]").replace(/\s+/gu, " ").trim().slice(0, 800);
+  return redactSessionMemoryCredentialText(value).value.replace(/\s+/gu, " ").trim().slice(0, 800);
 }
 async function ensureOkfDirectory(okfDir, relativeDir, title, description) {
   const dir = relativeDir === "" || relativeDir === "." ? okfDir : resolveOkfTargetPath(okfDir, relativeDir);
   await mkdir(dir, { recursive: true });
   const isRoot = dir === okfDir;
-  const indexPath = join(dir, "index.md");
-  if (!await pathExists(indexPath)) {
+  const indexPath = join3(dir, "index.md");
+  if (!await pathExists2(indexPath)) {
     await writeFile(indexPath, isRoot ? [
       "---",
       `okf_version: ${yamlString("0.1")}`,
@@ -365,8 +874,8 @@ async function ensureOkfDirectory(okfDir, relativeDir, title, description) {
 `) : [`# ${title}`, "", description, ""].join(`
 `), "utf8");
   }
-  const logPath = join(dir, "log.md");
-  if (!await pathExists(logPath)) {
+  const logPath = join3(dir, "log.md");
+  if (!await pathExists2(logPath)) {
     await writeFile(logPath, [
       "# Directory Update Log",
       "",
@@ -411,6 +920,8 @@ function parseOkfConceptFile(okfDir, filePath, content) {
     reviewState,
     lifecycle: lifecycleParsed.lifecycle,
     lifecyclePersisted: lifecycleParsed.persisted,
+    verificationSnapshot: parseOkfVerificationSnapshot(frontmatter),
+    supportRef: parseOkfKnowledgeSupportRef(frontmatter),
     title,
     description,
     tags,
@@ -421,8 +932,40 @@ function parseOkfConceptFile(okfDir, filePath, content) {
     body: parsed.body
   };
 }
-function matchesConceptFilters(concept, input) {
-  if (input.projectKey !== undefined && concept.repoTags.length > 0 && !concept.repoTags.includes(sanitizeSlug(input.projectKey)) && !concept.tags.includes(`repo:${sanitizeSlug(input.projectKey)}`)) {
+function parseOkfKnowledgeSupportRef(frontmatter) {
+  const block = extractNestedYamlBlock(frontmatter, "evodev", "supportRef");
+  if (block === null)
+    return null;
+  try {
+    return normalizeKnowledgeSupportRef({
+      id: readIndentedYamlScalar(block, "id"),
+      kind: readIndentedYamlScalar(block, "kind"),
+      sourceRefId: readIndentedYamlScalar(block, "sourceRefId"),
+      subjectFingerprint: readNullableLifecycleString(readIndentedYamlScalar(block, "subjectFingerprint")),
+      observedAt: readIndentedYamlScalar(block, "observedAt")
+    }, "evodev.supportRef");
+  } catch {
+    return null;
+  }
+}
+function parseOkfVerificationSnapshot(frontmatter) {
+  const block = extractNestedYamlBlock(frontmatter, "evodev", "verificationSnapshot");
+  if (block === null)
+    return null;
+  const schemaVersion = readIndentedYamlScalar(block, "schemaVersion");
+  const verifiedAt = normalizeIsoDateString(readIndentedYamlScalar(block, "verifiedAt"));
+  if (schemaVersion !== "1" || verifiedAt === null)
+    return null;
+  return {
+    schemaVersion: 1,
+    verifiedAt,
+    evidenceRefs: readYamlList(block, "evidenceRefs"),
+    repository: null
+  };
+}
+function matchesConceptFilters(concept, input, equivalentProjectKeys) {
+  const projectKeys = (equivalentProjectKeys ?? []).map(sanitizeSlug);
+  if (input.projectKey !== undefined && concept.repoTags.length > 0 && ![sanitizeSlug(input.projectKey), ...projectKeys].some((projectKey) => concept.repoTags.includes(projectKey) || concept.tags.includes(`repo:${projectKey}`))) {
     return false;
   }
   if (input.roleId !== undefined && concept.roleTags.length > 0 && !concept.roleTags.includes(sanitizeSlug(input.roleId)) && !concept.tags.includes(`role:${sanitizeSlug(input.roleId)}`)) {
@@ -473,13 +1016,13 @@ function isLifecycleDateDue(value, now) {
 }
 function createDefaultOkfLifecycle(input) {
   const createdAt = normalizeIsoDateString(input.createdAt) ?? "1970-01-01T00:00:00.000Z";
-  const policy = resolveOkfLifecyclePolicy(input);
+  const policy2 = resolveOkfLifecyclePolicy(input);
   return {
     status: lifecycleStatusFromReviewState(input.reviewState),
     createdAt,
     lastVerifiedAt: createdAt,
-    reviewAfter: addDaysIso(createdAt, policy.reviewAfterDays),
-    staleAfter: addDaysIso(createdAt, policy.staleAfterDays),
+    reviewAfter: addDaysIso(createdAt, policy2.reviewAfterDays),
+    staleAfter: addDaysIso(createdAt, policy2.staleAfterDays),
     supersedes: [],
     supersededBy: null,
     revokedAt: null,
@@ -537,10 +1080,10 @@ function isOkfLifecycleStatus(value) {
 function normalizeIsoDateString(value) {
   if (value === undefined || value === null || value === "" || value === "null")
     return null;
-  const time = Date.parse(value);
-  if (!Number.isFinite(time))
+  const time2 = Date.parse(value);
+  if (!Number.isFinite(time2))
     return null;
-  return new Date(time).toISOString();
+  return new Date(time2).toISOString();
 }
 function addDaysIso(value, days) {
   const date = new Date(value);
@@ -641,12 +1184,12 @@ function parseYamlValue(value) {
   return trimmed.replace(/^['"]|['"]$/gu, "");
 }
 async function listMarkdownFiles(root) {
-  if (!await pathExists(root))
+  if (!await pathExists2(root))
     return [];
-  const entries = await readdir(root, { withFileTypes: true });
+  const entries = await readdir2(root, { withFileTypes: true });
   const files = [];
   for (const entry of entries) {
-    const path = join(root, entry.name);
+    const path = join3(root, entry.name);
     if (entry.isDirectory()) {
       files.push(...await listMarkdownFiles(path));
     } else if (entry.isFile() && entry.name.endsWith(".md")) {
@@ -672,14 +1215,14 @@ function resolveOkfTargetPath(okfDir, targetPath) {
   if (clean.split("/").some((segment) => segment === ".." || segment === "." || segment === "")) {
     throw new Error(`Unsafe OKF target path: ${targetPath}`);
   }
-  const resolved = join(okfDir, clean);
-  const rel = relative(okfDir, resolved);
+  const resolved = join3(okfDir, clean);
+  const rel = relative2(okfDir, resolved);
   if (rel.startsWith("..") || rel === "")
     throw new Error(`Unsafe OKF target path: ${targetPath}`);
   return resolved;
 }
 function toOkfRelativePath(okfDir, path) {
-  return relative(okfDir, path).replace(/\\/gu, "/");
+  return relative2(okfDir, path).replace(/\\/gu, "/");
 }
 function sanitizeSlug(value) {
   const slug = value.trim().toLowerCase().replace(/[^a-z0-9._/-]+/gu, "-").replace(/\/+/gu, "/").replace(/^-+|-+$/gu, "");
@@ -694,15 +1237,15 @@ function escapeRegExp(value) {
 function todayIsoDate() {
   return new Date().toISOString().slice(0, 10);
 }
-async function writeJson(path, value, options = {}) {
-  await mkdir(dirname(path), { recursive: true });
+async function writeJson2(path, value, options = {}) {
+  await mkdir(dirname3(path), { recursive: true });
   const flag = options.overwrite === true ? "w" : "wx";
   await writeFile(path, `${JSON.stringify(value, null, 2)}
 `, { encoding: "utf8", flag });
 }
-async function pathExists(path) {
+async function pathExists2(path) {
   try {
-    await stat(path);
+    await stat2(path);
     return true;
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT")
@@ -711,79 +1254,6 @@ async function pathExists(path) {
   }
 }
 
-// packages/core/src/evolution/index.ts
-var PROCESS_LOCK_STALE_MS = 5 * 60 * 1000;
-var FORBIDDEN_RAW_KEYS = new Set([
-  "commandhistory",
-  "commandoutput",
-  "credential",
-  "credentials",
-  "env",
-  "fullsource",
-  "memorybody",
-  "password",
-  "privatekey",
-  "prompt",
-  "promptbody",
-  "prompttext",
-  "rawcommand",
-  "rawcommandoutput",
-  "rawlog",
-  "rawlogs",
-  "rawoutput",
-  "rawpayload",
-  "rawprompt",
-  "secret",
-  "secretvalue",
-  "source",
-  "sourcebody",
-  "sourcecode",
-  "sourcecontent",
-  "sourcetext",
-  "stderr",
-  "stdout",
-  "token",
-  "transcript",
-  "transcriptbody",
-  "transcripttext"
-]);
-
-// packages/core/src/task/index.ts
-var FORBIDDEN_TASK_WRITE_SEGMENTS = new Set([".claude", ".codex"]);
-var FORBIDDEN_PROJECT_ASSET_SEGMENTS = new Set(["packages", "src"]);
-var FORBIDDEN_TASK_WRITE_FILES = new Set(["agents.md", "claude.md", "package.json", "readme.md"]);
-var FORBIDDEN_RAW_KEYS2 = new Set([
-  "rawoutput",
-  "raw_output",
-  "stdout",
-  "stderr",
-  "source",
-  "sourcecontent",
-  "source_content",
-  "sourcetext",
-  "source_text",
-  "prompt",
-  "prompttext",
-  "prompt_text",
-  "transcript",
-  "transcripttext",
-  "transcript_text",
-  "secret",
-  "secretvalue",
-  "secret_value"
-]);
-var ALLOWED_VERIFICATION_KEYS = new Set([
-  "acceptanceResults",
-  "antiCriteriaResults",
-  "commands",
-  "evidence",
-  "exitCode",
-  "id",
-  "status",
-  "summary",
-  "type"
-]);
-
 // packages/core/src/team/prompts.ts
 var TEAM_ROLE_STARTUP_PROMPT_TEMPLATE = [
   "You are an EvoDev managed role agent.",
@@ -848,6 +1318,23 @@ var TEAM_INTERNAL_WAKE_SIGNAL = [
   "No user request is included in this message. Continue only from EvoDev team inbox messages injected by hooks."
 ].join(`
 `);
+var BUILT_IN_TEAM_DEFINITION = {
+  version: 1,
+  name: "builtin-minimal-team",
+  description: "Built-in minimal EvoDev team fallback.",
+  agents: {
+    executor: "builtin:executor",
+    reviewer: "builtin:reviewer",
+    tester: "builtin:tester"
+  },
+  body: [
+    "# Built-in Minimal Team",
+    "",
+    "Use role agents only when delegation improves correctness, coverage, safety, or latency.",
+    "Spawn roles on demand and send self-contained assignments through Teams MCP."
+  ].join(`
+`)
+};
 
 // packages/core/src/hooks/index.ts
 var CANONICAL_HOOK_EVENT_TYPES = [
@@ -916,6 +1403,12 @@ var CODEX_STOP_EVENTS_WITHOUT_ADDITIONAL_CONTEXT = new Set([
   "Stop",
   "SubagentStop"
 ]);
+var COMPLETION_EVENTS_WITHOUT_DEVELOPMENT_DIAGNOSTICS = new Set([
+  "Stop",
+  "SubagentStop",
+  "TaskCompleted",
+  "TeammateIdle"
+]);
 function createDefaultHookSettings() {
   return {
     enabled: true,
@@ -944,13 +1437,13 @@ function parseHookSettings(value) {
   const defaults = createDefaultHookSettings();
   if (value === undefined || value === null)
     return defaults;
-  if (!isRecord(value))
+  if (!isRecord2(value))
     throw new Error("Invalid hooks settings; expected object.");
-  const observability = isRecord(value.observability) ? value.observability : undefined;
-  optionalBoolean(observability?.metadataOnly, defaults.observability.metadataOnly, "hooks.observability.metadataOnly");
-  optionalBoolean(observability?.rawPayloadStorage, defaults.observability.rawPayloadStorage, "hooks.observability.rawPayloadStorage");
+  const observability = isRecord2(value.observability) ? value.observability : undefined;
+  optionalBoolean2(observability?.metadataOnly, defaults.observability.metadataOnly, "hooks.observability.metadataOnly");
+  optionalBoolean2(observability?.rawPayloadStorage, defaults.observability.rawPayloadStorage, "hooks.observability.rawPayloadStorage");
   return {
-    enabled: optionalBoolean(value.enabled, defaults.enabled, "hooks.enabled"),
+    enabled: optionalBoolean2(value.enabled, defaults.enabled, "hooks.enabled"),
     targets: {
       claude: parseHookTargetSettings(value.targets, defaults.targets.claude, "claude"),
       codex: parseHookTargetSettings(value.targets, defaults.targets.codex, "codex")
@@ -958,7 +1451,7 @@ function parseHookSettings(value) {
     observability: {
       metadataOnly: true,
       rawPayloadStorage: false,
-      appendEvents: optionalBoolean(observability?.appendEvents, defaults.observability.appendEvents, "hooks.observability.appendEvents")
+      appendEvents: optionalBoolean2(observability?.appendEvents, defaults.observability.appendEvents, "hooks.observability.appendEvents")
     },
     learning: {
       emitCandidates: false,
@@ -967,26 +1460,26 @@ function parseHookSettings(value) {
   };
 }
 function parseHookTargetSettings(value, defaults, target) {
-  const targets = isRecord(value) ? value : {};
-  const targetSettings = isRecord(targets[target]) ? targets[target] : {};
-  const events = isRecord(targetSettings.events) ? targetSettings.events : {};
+  const targets = isRecord2(value) ? value : {};
+  const targetSettings = isRecord2(targets[target]) ? targets[target] : {};
+  const events = isRecord2(targetSettings.events) ? targetSettings.events : {};
   const parsedEvents = { ...defaults.events };
   for (const eventType of CANONICAL_HOOK_EVENT_TYPES) {
-    parsedEvents[eventType] = optionalBoolean(events[eventType], defaults.events[eventType], `hooks.targets.${target}.events.${eventType}`);
+    parsedEvents[eventType] = optionalBoolean2(events[eventType], defaults.events[eventType], `hooks.targets.${target}.events.${eventType}`);
   }
   return {
-    enabled: optionalBoolean(targetSettings.enabled, defaults.enabled, `hooks.targets.${target}.enabled`),
+    enabled: optionalBoolean2(targetSettings.enabled, defaults.enabled, `hooks.targets.${target}.enabled`),
     events: parsedEvents
   };
 }
-function optionalBoolean(value, fallback, path) {
+function optionalBoolean2(value, fallback, path) {
   if (value === undefined)
     return fallback;
   if (typeof value !== "boolean")
     throw new Error(`Invalid ${path}; expected boolean.`);
   return value;
 }
-function isRecord(value) {
+function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -1020,7 +1513,8 @@ function createDefaultSettings(os = process.platform) {
     },
     hooks: createDefaultHookSettings(),
     teamRuntime: createDefaultTeamRuntimeSettings(),
-    memory: createDefaultMemorySettings()
+    memory: createDefaultMemorySettings(),
+    evolution: createDefaultEvolutionSettings()
   };
 }
 function createDefaultTeamRuntimeSettings() {
@@ -1034,10 +1528,23 @@ function createDefaultTeamRuntimeSettings() {
 }
 function createDefaultMemorySettings() {
   return {
-    autoAccept: true,
+    reviewKnowledgeUpdates: true,
     runtimeInjection: true,
     staleReview: true,
-    lexicalIndex: true
+    lexicalIndex: true,
+    sessionMemory: createDefaultSessionMemoryPolicy()
+  };
+}
+function createDefaultEvolutionSettings() {
+  return {
+    schedule: {
+      dailyTime: "02:00"
+    },
+    automation: {
+      knowledge: true,
+      semanticKnowledge: false,
+      recommendations: false
+    }
   };
 }
 function mergeSettings(existing, defaults = createDefaultSettings()) {
@@ -1080,16 +1587,28 @@ function mergeSettings(existing, defaults = createDefaultSettings()) {
     memory: {
       ...defaults.memory,
       ...existing.memory
+    },
+    evolution: {
+      ...defaults.evolution,
+      ...existing.evolution,
+      schedule: {
+        ...defaults.evolution.schedule,
+        ...existing.evolution?.schedule
+      },
+      automation: {
+        ...defaults.evolution.automation,
+        ...existing.evolution?.automation
+      }
     }
   };
   return parseSettings(merged);
 }
 async function readRuntimeInjectionSettings(homeDir) {
-  const paths = resolveEvoDevPaths(homeDir);
+  const paths2 = resolveEvoDevPaths(homeDir);
   try {
-    return parseSettings(JSON.parse(await readFile2(paths.settingsPath, "utf8"))).memory;
+    return parseSettings(JSON.parse(await readFile3(paths2.settingsPath, "utf8"))).memory;
   } catch (error) {
-    if (isNotFoundError(error))
+    if (isNotFoundError2(error))
       return createDefaultMemorySettings();
     throw error;
   }
@@ -1126,18 +1645,47 @@ function parseSettings(value) {
     },
     hooks: parseHookSettings(root.hooks),
     teamRuntime: parseTeamRuntimeSettings(root.teamRuntime ?? createDefaultTeamRuntimeSettings(), "settings.teamRuntime"),
-    memory: parseMemorySettings(root.memory ?? createDefaultMemorySettings(), "settings.memory")
+    memory: parseMemorySettings(root.memory ?? createDefaultMemorySettings(), "settings.memory"),
+    evolution: parseEvolutionSettings(root.evolution ?? createDefaultEvolutionSettings(), "settings.evolution")
   };
   return parsed;
 }
+function parseEvolutionSettings(value, path) {
+  const input = expectRecord2(value, path);
+  const defaults = createDefaultEvolutionSettings();
+  const schedule = expectRecord2(input.schedule ?? defaults.schedule, `${path}.schedule`);
+  const automation = expectRecord2(input.automation ?? defaults.automation, `${path}.automation`);
+  return {
+    schedule: {
+      dailyTime: parseDailyTime(schedule.dailyTime ?? defaults.schedule.dailyTime, `${path}.schedule.dailyTime`)
+    },
+    automation: {
+      knowledge: automation.knowledge === undefined ? defaults.automation.knowledge : expectBoolean(automation.knowledge, `${path}.automation.knowledge`),
+      semanticKnowledge: automation.semanticKnowledge === undefined ? defaults.automation.semanticKnowledge : expectBoolean(automation.semanticKnowledge, `${path}.automation.semanticKnowledge`),
+      recommendations: automation.recommendations === undefined ? defaults.automation.recommendations : expectBoolean(automation.recommendations, `${path}.automation.recommendations`)
+    }
+  };
+}
+function parseDailyTime(value, path) {
+  const dailyTime = expectString2(value, path);
+  const match = /^(\d{2}):(\d{2})$/u.exec(dailyTime);
+  if (match === null || Number(match[1]) > 23 || Number(match[2]) > 59) {
+    throw new EvoDevConfigError(`Invalid ${path}; expected a 24-hour HH:MM time`);
+  }
+  return dailyTime;
+}
 function parseMemorySettings(value, path) {
   const input = expectRecord2(value, path);
   const defaults = createDefaultMemorySettings();
+  if (input.autoAccept !== undefined) {
+    expectBoolean(input.autoAccept, `${path}.autoAccept`);
+  }
   return {
-    autoAccept: input.autoAccept === undefined ? defaults.autoAccept : expectBoolean(input.autoAccept, `${path}.autoAccept`),
+    reviewKnowledgeUpdates: input.reviewKnowledgeUpdates === undefined ? defaults.reviewKnowledgeUpdates : expectBoolean(input.reviewKnowledgeUpdates, `${path}.reviewKnowledgeUpdates`),
     runtimeInjection: input.runtimeInjection === undefined ? defaults.runtimeInjection : expectBoolean(input.runtimeInjection, `${path}.runtimeInjection`),
     staleReview: input.staleReview === undefined ? defaults.staleReview : expectBoolean(input.staleReview, `${path}.staleReview`),
-    lexicalIndex: input.lexicalIndex === undefined ? defaults.lexicalIndex : expectBoolean(input.lexicalIndex, `${path}.lexicalIndex`)
+    lexicalIndex: input.lexicalIndex === undefined ? defaults.lexicalIndex : expectBoolean(input.lexicalIndex, `${path}.lexicalIndex`),
+    sessionMemory: parseSessionMemoryPolicy(isPlainRecord(input.sessionMemory) ? input.sessionMemory : defaults.sessionMemory)
   };
 }
 function parseTeamRuntimeSettings(value, path) {
@@ -1181,7 +1729,10 @@ function expectRecord2(value, path) {
   }
   return value;
 }
-function isNotFoundError(error) {
+function isPlainRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isNotFoundError2(error) {
   return error instanceof Error && "code" in error && error.code === "ENOENT";
 }
 function expectString2(value, path) {
@@ -1283,53 +1834,53 @@ function expectNonNegativeInteger(value, path) {
   return value;
 }
 // packages/core/src/config/store.ts
-import { mkdir as mkdir2, readFile as readFile3, writeFile as writeFile2 } from "node:fs/promises";
-import { dirname as dirname2 } from "node:path";
+import { mkdir as mkdir2, readFile as readFile4, writeFile as writeFile2 } from "node:fs/promises";
+import { dirname as dirname4 } from "node:path";
 function createCoreConfigStore(homeDir) {
-  const paths = resolveEvoDevPaths(homeDir);
+  const paths2 = resolveEvoDevPaths(homeDir);
   return {
-    paths,
+    paths: paths2,
     async ensureBaseDirs() {
-      await mkdir2(paths.stateDir, { recursive: true });
-      await mkdir2(paths.logsDir, { recursive: true });
-      await mkdir2(paths.knowledgeDir, { recursive: true });
-      await mkdir2(paths.evosCasesDir, { recursive: true });
-      await mkdir2(paths.roleAgentsDir, { recursive: true });
-      await mkdir2(paths.teamsDir, { recursive: true });
-      await mkdir2(paths.runsDir, { recursive: true });
+      await mkdir2(paths2.stateDir, { recursive: true });
+      await mkdir2(paths2.logsDir, { recursive: true });
+      await mkdir2(paths2.knowledgeDir, { recursive: true });
+      await mkdir2(paths2.evosCasesDir, { recursive: true });
+      await mkdir2(paths2.roleAgentsDir, { recursive: true });
+      await mkdir2(paths2.teamsDir, { recursive: true });
+      await mkdir2(paths2.runsDir, { recursive: true });
     },
     async ensureKnowledgeBase() {
-      await ensureKnowledgeBaseFiles(paths);
+      await ensureKnowledgeBaseFiles(paths2);
     },
     async readSettings() {
-      return readJsonFile(paths.settingsPath, parseSettings);
+      return readJsonFile(paths2.settingsPath, parseSettings);
     },
     async writeSettings(settings) {
-      await writeJsonFile(paths.settingsPath, parseSettings(settings));
+      await writeJsonFile2(paths2.settingsPath, parseSettings(settings));
     },
     async mergeAndWriteSettings(input) {
-      const current = await readJsonFileOrDefault(paths.settingsPath, parseSettings, createDefaultSettings());
+      const current = await readJsonFileOrDefault(paths2.settingsPath, parseSettings, createDefaultSettings());
       const merged = mergeSettings(input, current);
-      await writeJsonFile(paths.settingsPath, merged);
+      await writeJsonFile2(paths2.settingsPath, merged);
       return merged;
     },
     async readRegistry() {
-      return readJsonFile(paths.registryPath, parseRegistry);
+      return readJsonFile(paths2.registryPath, parseRegistry);
     },
     async writeRegistry(registry) {
-      await writeJsonFile(paths.registryPath, parseRegistry(registry));
+      await writeJsonFile2(paths2.registryPath, parseRegistry(registry));
     },
     async readInstallState() {
-      return readJsonFile(paths.installStatePath, parseInstallState);
+      return readJsonFile(paths2.installStatePath, parseInstallState);
     },
     async writeInstallState(state) {
-      await writeJsonFile(paths.installStatePath, parseInstallState(state));
+      await writeJsonFile2(paths2.installStatePath, parseInstallState(state));
     },
     async readSyncState() {
-      return readJsonFile(paths.syncStatePath, parseSyncState);
+      return readJsonFile(paths2.syncStatePath, parseSyncState);
     },
     async writeSyncState(state) {
-      await writeJsonFile(paths.syncStatePath, parseSyncState(state));
+      await writeJsonFile2(paths2.syncStatePath, parseSyncState(state));
     }
   };
 }
@@ -1343,11 +1894,11 @@ async function initializeCoreConfig(homeDir) {
   await writeIfMissing(store.paths.syncStatePath, createDefaultSyncState());
   return store;
 }
-async function ensureKnowledgeBaseFiles(paths) {
-  await mkdir2(paths.knowledgeDir, { recursive: true });
-  await mkdir2(paths.evosCasesDir, { recursive: true });
-  await ensureOkfKnowledgeBase(paths.homeDir);
-  await writeTextIfMissing2(`${paths.knowledgeDir}/README.md`, [
+async function ensureKnowledgeBaseFiles(paths2) {
+  await mkdir2(paths2.knowledgeDir, { recursive: true });
+  await mkdir2(paths2.evosCasesDir, { recursive: true });
+  await ensureOkfKnowledgeBase(paths2.homeDir);
+  await writeTextIfMissing2(`${paths2.knowledgeDir}/README.md`, [
     "# EvoDev Knowledge",
     "",
     "Local-private knowledge base for user-accepted facts, decisions, architecture notes, and reusable domain context.",
@@ -1356,13 +1907,13 @@ async function ensureKnowledgeBaseFiles(paths) {
     ""
   ].join(`
 `));
-  await writeIndexIfMissingOrMigrate(paths.knowledgeIndexPath, "knowledge-index", {
+  await writeIndexIfMissingOrMigrate(paths2.knowledgeIndexPath, "knowledge-index", {
     version: 1,
     kind: "knowledge-index",
     roleTags: [],
     entries: []
   });
-  await writeTextIfMissing2(`${paths.evosDir}/README.md`, [
+  await writeTextIfMissing2(`${paths2.evosDir}/README.md`, [
     "# EvoDev Evos",
     "",
     "Local-private evolution case library for reviewed improvement cases and reusable process changes.",
@@ -1371,20 +1922,20 @@ async function ensureKnowledgeBaseFiles(paths) {
     ""
   ].join(`
 `));
-  await writeTextIfMissing2(`${paths.evosCasesDir}/README.md`, [
+  await writeTextIfMissing2(`${paths2.evosCasesDir}/README.md`, [
     "# Evolution Cases",
     "",
     "Store one reviewed evolution case per file. Do not store raw prompts, source dumps, secrets, transcripts, or raw command output here.",
     ""
   ].join(`
 `));
-  await writeIndexIfMissingOrMigrate(paths.evosIndexPath, "evos-index", {
+  await writeIndexIfMissingOrMigrate(paths2.evosIndexPath, "evos-index", {
     version: 1,
     kind: "evos-index",
     roleTags: [],
     cases: []
   });
-  await writeTextIfMissing2(`${paths.roleAgentsDir}/README.md`, [
+  await writeTextIfMissing2(`${paths2.roleAgentsDir}/README.md`, [
     "# Role Agents",
     "",
     "Local-private role agent registry for EvoDev-managed agent roles and user-reviewed role extensions.",
@@ -1393,13 +1944,13 @@ async function ensureKnowledgeBaseFiles(paths) {
     ""
   ].join(`
 `));
-  await writeIndexIfMissingOrMigrate(paths.roleAgentsIndexPath, "role-agent-index", {
+  await writeIndexIfMissingOrMigrate(paths2.roleAgentsIndexPath, "role-agent-index", {
     version: 1,
     kind: "role-agent-index",
     roles: [],
     projectExtensions: []
   });
-  await writeTextIfMissing2(`${paths.teamsDir}/README.md`, [
+  await writeTextIfMissing2(`${paths2.teamsDir}/README.md`, [
     "# Agent Teams",
     "",
     "Local-private EvoHub team registry for reviewed role-agent team definitions.",
@@ -1408,16 +1959,16 @@ async function ensureKnowledgeBaseFiles(paths) {
     ""
   ].join(`
 `));
-  await writeIndexIfMissingOrMigrate(paths.teamsIndexPath, "agent-team-index", {
+  await writeIndexIfMissingOrMigrate(paths2.teamsIndexPath, "agent-team-index", {
     version: 1,
     kind: "agent-team-index",
     teams: []
   });
 }
-async function readJsonFile(filePath, parse) {
+async function readJsonFile(filePath, parse2) {
   let raw;
   try {
-    raw = await readFile3(filePath, "utf8");
+    raw = await readFile4(filePath, "utf8");
   } catch (error) {
     throw new EvoDevConfigError(`Cannot read config file (${describeFileError(error)})`, filePath);
   }
@@ -1428,7 +1979,7 @@ async function readJsonFile(filePath, parse) {
     throw new EvoDevConfigError(`Invalid JSON (${describeFileError(error)})`, filePath);
   }
   try {
-    return parse(json);
+    return parse2(json);
   } catch (error) {
     if (error instanceof EvoDevConfigError) {
       throw new EvoDevConfigError(error.message, filePath);
@@ -1436,9 +1987,9 @@ async function readJsonFile(filePath, parse) {
     throw error;
   }
 }
-async function readJsonFileOrDefault(filePath, parse, fallback) {
+async function readJsonFileOrDefault(filePath, parse2, fallback) {
   try {
-    return await readJsonFile(filePath, parse);
+    return await readJsonFile(filePath, parse2);
   } catch (error) {
     if (error instanceof EvoDevConfigError && error.message.includes("ENOENT")) {
       return fallback;
@@ -1448,10 +1999,10 @@ async function readJsonFileOrDefault(filePath, parse, fallback) {
 }
 async function writeIfMissing(filePath, value) {
   try {
-    await readFile3(filePath, "utf8");
+    await readFile4(filePath, "utf8");
   } catch (error) {
     if (isNodeError(error) && error.code === "ENOENT") {
-      await writeJsonFile(filePath, value);
+      await writeJsonFile2(filePath, value);
       return;
     }
     throw new EvoDevConfigError(`Cannot inspect config file (${describeFileError(error)})`, filePath);
@@ -1460,10 +2011,10 @@ async function writeIfMissing(filePath, value) {
 async function writeIndexIfMissingOrMigrate(filePath, kind, defaults) {
   let raw;
   try {
-    raw = await readFile3(filePath, "utf8");
+    raw = await readFile4(filePath, "utf8");
   } catch (error) {
     if (isNodeError(error) && error.code === "ENOENT") {
-      await writeJsonFile(filePath, defaults);
+      await writeJsonFile2(filePath, defaults);
       return;
     }
     throw new EvoDevConfigError(`Cannot inspect config file (${describeFileError(error)})`, filePath);
@@ -1474,27 +2025,27 @@ async function writeIndexIfMissingOrMigrate(filePath, kind, defaults) {
   } catch (error) {
     throw new EvoDevConfigError(`Invalid bootstrap index JSON (${describeFileError(error)})`, filePath);
   }
-  if (!isRecord2(existing) || existing.kind !== kind)
+  if (!isRecord3(existing) || existing.kind !== kind)
     return;
   const migrated = { ...defaults, ...existing };
   if (Object.keys(defaults).every((key) => (key in existing)))
     return;
-  await writeJsonFile(filePath, migrated);
+  await writeJsonFile2(filePath, migrated);
 }
 async function writeTextIfMissing2(filePath, value) {
   try {
-    await readFile3(filePath, "utf8");
+    await readFile4(filePath, "utf8");
   } catch (error) {
     if (isNodeError(error) && error.code === "ENOENT") {
-      await mkdir2(dirname2(filePath), { recursive: true });
+      await mkdir2(dirname4(filePath), { recursive: true });
       await writeFile2(filePath, value, "utf8");
       return;
     }
     throw new EvoDevConfigError(`Cannot inspect config file (${describeFileError(error)})`, filePath);
   }
 }
-async function writeJsonFile(filePath, value) {
-  await mkdir2(dirname2(filePath), { recursive: true });
+async function writeJsonFile2(filePath, value) {
+  await mkdir2(dirname4(filePath), { recursive: true });
   await writeFile2(filePath, `${JSON.stringify(value, null, 2)}
 `, "utf8");
 }
@@ -1507,24 +2058,25 @@ function describeFileError(error) {
 function isNodeError(error) {
   return error instanceof Error && "code" in error;
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 export {
-  resolveEvoDevPaths,
-  readRuntimeInjectionSettings,
-  parseSyncState,
-  parseSettings,
-  parseRegistry,
-  parseInstallState,
-  mergeSettings,
-  initializeCoreConfig,
-  createDefaultTeamRuntimeSettings,
-  createDefaultSyncState,
-  createDefaultSettings,
-  createDefaultRegistry,
-  createDefaultMemorySettings,
-  createDefaultInstallState,
+  EvoDevConfigError,
   createCoreConfigStore,
-  EvoDevConfigError
+  createDefaultEvolutionSettings,
+  createDefaultInstallState,
+  createDefaultMemorySettings,
+  createDefaultRegistry,
+  createDefaultSettings,
+  createDefaultSyncState,
+  createDefaultTeamRuntimeSettings,
+  initializeCoreConfig,
+  mergeSettings,
+  parseInstallState,
+  parseRegistry,
+  parseSettings,
+  parseSyncState,
+  readRuntimeInjectionSettings,
+  resolveEvoDevPaths
 };