@evo-dev/core 0.0.1-alpha → 0.0.1-alpha.2

package/dist/config/index.js

@@ -21,12 +21,30 @@ function resolveEvoDevPaths(homeDir = getHomeDir()) {
   const normalizedHome = stripTrailingSlash(homeDir);
   const rootDir = `${normalizedHome}/.evodev`;
   const stateDir = `${rootDir}/state`;
+  const logsDir = `${rootDir}/logs`;
+  const knowledgeDir = `${rootDir}/knowledge`;
+  const evosDir = `${rootDir}/evos`;
+  const roleAgentsDir = `${rootDir}/agents/roles`;
+  const teamsDir = `${rootDir}/teams`;
+  const runsDir = `${teamsDir}/runs`;
   return {
     homeDir: normalizedHome,
     rootDir,
     settingsPath: `${rootDir}/settings.json`,
     registryPath: `${rootDir}/registry.json`,
     stateDir,
+    logsDir,
+    knowledgeDir,
+    knowledgeIndexPath: `${knowledgeDir}/index.json`,
+    evosDir,
+    evosCasesDir: `${evosDir}/cases`,
+    evosIndexPath: `${evosDir}/index.json`,
+    roleAgentsDir,
+    roleAgentsIndexPath: `${roleAgentsDir}/index.json`,
+    teamsDir,
+    teamsIndexPath: `${teamsDir}/index.json`,
+    runsDir,
+    latestRunPath: `${runsDir}/latest.json`,
     installStatePath: `${stateDir}/install.json`,
     syncStatePath: `${stateDir}/sync.json`
   };
@@ -98,11 +116,643 @@ function expectString(value, path) {
   }
   return value;
 }
+// packages/core/src/config/settings.ts
+import { readFile as readFile2 } from "node:fs/promises";
+
+// packages/core/src/runtime-logs/index.ts
+var SAFE_EXECUTION_METADATA_KEYS = new Set([
+  "phase",
+  "runtimeSurface",
+  "stdinBytes",
+  "durationMs",
+  "enabled",
+  "stateWriteCount",
+  "warningCount",
+  "commandClass",
+  "exitCode",
+  "status",
+  "redactionCount",
+  "redactionLabels",
+  "normalizedEventType"
+]);
+var SAFE_REDACTION_LABELS = new Set([
+  "raw-command",
+  "raw-command-output",
+  "raw-prompt",
+  "sensitive-command",
+  "sensitive-text"
+]);
+
+// packages/core/src/knowledge/index.ts
+import { mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+var RESERVED_OKF_FILENAMES = new Set(["index.md", "log.md"]);
+var FORBIDDEN_OKF_TEXT = /\b(secret|token|password|passwd|api[_-]?key|apikey|credential|credentials|secret[\s_-]*token(?:[\s_-]*repro)?|raw[\s_-]*(?:log|logs|output|source|prompt)(?:[\s_-]*repro)?|shell[\s_-]*history|command[\s_-]*history)\b/i;
+var PRIVATE_OR_INTERNAL_URL = /https?:\/\/\S*(?:internal|private|corp|localhost|127\.0\.0\.1)\S*/i;
+var OKF_PRIVACY_FLAG_KEYS = [
+  "rawPromptsStored",
+  "rawLogsStored",
+  "sourceDumpsStored",
+  "rawCommandOutputStored",
+  "secretsStored",
+  "internalLinksStored"
+];
+var OKF_QUERY_PRIVACY_FLAG_KEYS = [
+  ...OKF_PRIVACY_FLAG_KEYS,
+  "rawOutputStored",
+  "sourceContentStored"
+];
+var ACTIVE_OKF_REVIEW_STATES = ["accepted", "auto-accepted"];
+var OKF_REVIEW_STATES = [
+  "auto-accepted",
+  "accepted",
+  "needs-human",
+  "rejected",
+  "deferred",
+  "stale",
+  "deprecated",
+  "revoked",
+  "superseded",
+  "auto-stored/unreviewed"
+];
+var OKF_LIFECYCLE_STATUSES = [
+  "active",
+  "stale",
+  "deprecated",
+  "revoked",
+  "superseded"
+];
+var BEHAVIOR_CHANGE_KINDS = new Set([
+  "skill-improvement",
+  "role-agent-suggestion",
+  "team-suggestion",
+  "workflow-improvement",
+  "task-split-improvement",
+  "tool-use-improvement",
+  "repo-asset-suggestion"
+]);
+function resolveOkfKnowledgePaths(homeDir) {
+  const paths = resolveEvoDevPaths(homeDir);
+  return {
+    knowledgeDir: paths.knowledgeDir,
+    okfDir: join(paths.knowledgeDir, "okf"),
+    indexesDir: join(paths.knowledgeDir, "indexes"),
+    tmpDir: join(paths.knowledgeDir, "tmp")
+  };
+}
+async function ensureOkfKnowledgeBase(homeDir) {
+  const paths = resolveOkfKnowledgePaths(homeDir);
+  await ensureLocalKnowledgeGitRepository(paths.knowledgeDir);
+  await mkdir(paths.indexesDir, { recursive: true });
+  await mkdir(paths.tmpDir, { recursive: true });
+  const directories = [
+    {
+      path: "",
+      title: "EvoDev Knowledge",
+      description: "User-local active engineering knowledge."
+    },
+    { path: "concepts", title: "Core Concepts", description: "Canonical core knowledge." },
+    { path: "concepts/rules", title: "Rules", description: "Normative engineering rules." },
+    {
+      path: "concepts/decisions",
+      title: "Decisions",
+      description: "Durable engineering decisions."
+    },
+    { path: "concepts/patterns", title: "Patterns", description: "Reusable engineering patterns." },
+    { path: "concepts/warnings", title: "Warnings", description: "Risks and anti-patterns." },
+    { path: "concepts/checklists", title: "Checklists", description: "Verification checklists." },
+    {
+      path: "concepts/verification",
+      title: "Verification",
+      description: "Repeatable verification patterns."
+    },
+    { path: "concepts/evos", title: "Evolution Cases", description: "Reviewed evolution cases." },
+    { path: "concepts/glossary", title: "Glossary", description: "Terms and taxonomy notes." },
+    { path: "repos", title: "Repositories", description: "Repository attention overlays." },
+    { path: "roles", title: "Roles", description: "Role attention overlays." },
+    { path: "workflows", title: "Workflows", description: "Workflow attention overlays." },
+    { path: "references", title: "References", description: "Cited references." }
+  ];
+  for (const directory of directories) {
+    await ensureOkfDirectory(paths.okfDir, directory.path, directory.title, directory.description);
+  }
+  await rebuildOkfKnowledgeIndexes({ homeDir });
+}
+async function rebuildOkfKnowledgeIndexes(input) {
+  const paths = resolveOkfKnowledgePaths(input.homeDir);
+  await mkdir(paths.indexesDir, { recursive: true });
+  const concepts = (await listOkfKnowledgeConcepts({ homeDir: input.homeDir })).filter(isActiveOkfConcept);
+  const conceptSummaries = concepts.map((concept) => ({
+    id: concept.id,
+    type: concept.type,
+    title: concept.title,
+    description: concept.description,
+    sourceLink: concept.sourceLink,
+    stableKey: concept.stableKey,
+    reviewState: concept.reviewState,
+    tags: concept.tags,
+    repoTags: concept.repoTags,
+    roleTags: concept.roleTags,
+    workflowTags: concept.workflowTags,
+    pathScopes: concept.pathScopes
+  }));
+  const pathsWritten = [
+    join(paths.indexesDir, "index.json"),
+    join(paths.indexesDir, "concepts.json"),
+    join(paths.indexesDir, "repos.json"),
+    join(paths.indexesDir, "roles.json"),
+    join(paths.indexesDir, "workflows.json")
+  ];
+  await writeJson(pathsWritten[0], {
+    schemaVersion: 1,
+    kind: "okf-knowledge-index",
+    conceptCount: concepts.length,
+    updatedAt: new Date().toISOString()
+  }, { overwrite: true });
+  await writeJson(pathsWritten[1], {
+    schemaVersion: 1,
+    kind: "okf-concepts-index",
+    concepts: conceptSummaries
+  }, { overwrite: true });
+  await writeJson(pathsWritten[2], {
+    schemaVersion: 1,
+    kind: "okf-repos-index",
+    repos: groupConceptsByTag(concepts, "repoTags")
+  }, { overwrite: true });
+  await writeJson(pathsWritten[3], {
+    schemaVersion: 1,
+    kind: "okf-roles-index",
+    roles: groupConceptsByTag(concepts, "roleTags")
+  }, { overwrite: true });
+  await writeJson(pathsWritten[4], {
+    schemaVersion: 1,
+    kind: "okf-workflows-index",
+    workflows: groupConceptsByTag(concepts, "workflowTags")
+  }, { overwrite: true });
+  return pathsWritten;
+}
+async function listOkfKnowledgeConcepts(input) {
+  const okfDir = resolveOkfKnowledgePaths(input.homeDir).okfDir;
+  if (!await pathExists(okfDir))
+    return [];
+  const files = await listMarkdownFiles(okfDir);
+  const concepts = [];
+  for (const file of files) {
+    if (RESERVED_OKF_FILENAMES.has(file.name))
+      continue;
+    const content = await readFile(file.path, "utf8");
+    const parsed = parseOkfConceptFile(okfDir, file.path, content);
+    if (parsed !== null)
+      concepts.push(parsed);
+  }
+  return concepts.filter((concept) => matchesConceptFilters(concept, input)).sort((left, right) => left.id.localeCompare(right.id));
+}
+async function ensureLocalKnowledgeGitRepository(knowledgeDir) {
+  await mkdir(knowledgeDir, { recursive: true });
+  const gitDir = join(knowledgeDir, ".git");
+  if (await pathExists(gitDir))
+    return;
+  await mkdir(join(gitDir, "objects", "info"), { recursive: true });
+  await mkdir(join(gitDir, "objects", "pack"), { recursive: true });
+  await mkdir(join(gitDir, "refs", "heads"), { recursive: true });
+  await mkdir(join(gitDir, "refs", "tags"), { recursive: true });
+  await mkdir(join(gitDir, "info"), { recursive: true });
+  await writeTextIfMissing(join(gitDir, "HEAD"), `ref: refs/heads/main
+`);
+  await writeTextIfMissing(join(gitDir, "config"), [
+    "[core]",
+    "\trepositoryformatversion = 0",
+    "\tfilemode = true",
+    "\tbare = false",
+    "\tlogallrefupdates = true",
+    ""
+  ].join(`
+`));
+  await writeTextIfMissing(join(gitDir, "info", "exclude"), [
+    "# EvoDev user-local knowledge git repository.",
+    "# No remote is configured by default.",
+    ""
+  ].join(`
+`));
+}
+async function writeTextIfMissing(path, value) {
+  if (await pathExists(path))
+    return;
+  await mkdir(dirname(path), { recursive: true });
+  await writeFile(path, value, { encoding: "utf8", flag: "wx" });
+}
+function sanitizeOkfText(value) {
+  return value.replace(new RegExp(PRIVATE_OR_INTERNAL_URL.source, "gi"), "[redacted]").replace(new RegExp(FORBIDDEN_OKF_TEXT.source, "gi"), "[redacted]").replace(/\s+/gu, " ").trim().slice(0, 800);
+}
+async function ensureOkfDirectory(okfDir, relativeDir, title, description) {
+  const dir = relativeDir === "" || relativeDir === "." ? okfDir : resolveOkfTargetPath(okfDir, relativeDir);
+  await mkdir(dir, { recursive: true });
+  const isRoot = dir === okfDir;
+  const indexPath = join(dir, "index.md");
+  if (!await pathExists(indexPath)) {
+    await writeFile(indexPath, isRoot ? [
+      "---",
+      `okf_version: ${yamlString("0.1")}`,
+      `title: ${yamlString(title)}`,
+      `description: ${yamlString(description)}`,
+      "---",
+      "",
+      `# ${title}`,
+      "",
+      description,
+      ""
+    ].join(`
+`) : [`# ${title}`, "", description, ""].join(`
+`), "utf8");
+  }
+  const logPath = join(dir, "log.md");
+  if (!await pathExists(logPath)) {
+    await writeFile(logPath, [
+      "# Directory Update Log",
+      "",
+      `## ${todayIsoDate()}`,
+      "* **Initialization**: Created OKF directory.",
+      ""
+    ].join(`
+`), "utf8");
+  }
+}
+function parseOkfConceptFile(okfDir, filePath, content) {
+  const parsed = extractFrontmatter(content);
+  if (parsed === null)
+    return null;
+  const rel = toOkfRelativePath(okfDir, filePath);
+  const id = rel.replace(/\.md$/, "");
+  const frontmatter = parsed.frontmatter;
+  const stableKey = readIndentedYamlScalar(frontmatter, "stableKey") ?? `legacy:${rel.replace(/\.md$/, "")}`;
+  const reviewState = parseOkfReviewState(readIndentedYamlScalar(frontmatter, "reviewState") ?? "auto-stored/unreviewed");
+  const type = readYamlScalar(frontmatter, "type") ?? "Unknown";
+  const title = readYamlScalar(frontmatter, "title") ?? titleFromSlug(id.split("/").at(-1) ?? id);
+  const description = readYamlScalar(frontmatter, "description") ?? "";
+  const tags = readYamlList(frontmatter, "tags");
+  const repoTags = readYamlList(frontmatter, "repoTags");
+  const roleTags = readYamlList(frontmatter, "roleTags");
+  const workflowTags = readYamlList(frontmatter, "workflowTags");
+  const pathScopes = readYamlList(frontmatter, "pathScopes");
+  const lifecycleParsed = parseOkfLifecycle(frontmatter, {
+    type,
+    path: rel,
+    tags,
+    title,
+    reviewState,
+    createdAt: readYamlScalar(frontmatter, "timestamp") ?? undefined
+  });
+  return {
+    id,
+    path: filePath,
+    sourceLink: `/${rel}`,
+    type,
+    stableKey,
+    reviewState,
+    lifecycle: lifecycleParsed.lifecycle,
+    lifecyclePersisted: lifecycleParsed.persisted,
+    title,
+    description,
+    tags,
+    repoTags,
+    roleTags,
+    workflowTags,
+    pathScopes,
+    body: parsed.body
+  };
+}
+function matchesConceptFilters(concept, input) {
+  if (input.projectKey !== undefined && concept.repoTags.length > 0 && !concept.repoTags.includes(sanitizeSlug(input.projectKey)) && !concept.tags.includes(`repo:${sanitizeSlug(input.projectKey)}`)) {
+    return false;
+  }
+  if (input.roleId !== undefined && concept.roleTags.length > 0 && !concept.roleTags.includes(sanitizeSlug(input.roleId)) && !concept.tags.includes(`role:${sanitizeSlug(input.roleId)}`)) {
+    return false;
+  }
+  if (input.workflowId !== undefined && concept.workflowTags.length > 0 && !concept.workflowTags.includes(sanitizeSlug(input.workflowId)) && !concept.tags.includes(`workflow:${sanitizeSlug(input.workflowId)}`)) {
+    return false;
+  }
+  if (input.paths !== undefined && input.paths.length > 0 && concept.pathScopes.length > 0) {
+    return input.paths.some((path) => concept.pathScopes.some((scope) => path.startsWith(scope) || scope.startsWith(path)));
+  }
+  return true;
+}
+function isActiveOkfConcept(concept) {
+  return resolveOkfConceptQueryEligibility(concept, {
+    includeStale: false,
+    now: new Date
+  }).include;
+}
+function isActiveOkfReviewState(reviewState) {
+  return ACTIVE_OKF_REVIEW_STATES.includes(reviewState);
+}
+function resolveOkfConceptQueryEligibility(concept, input) {
+  if (concept.lifecycle.status === "deprecated" || concept.lifecycle.status === "revoked" || concept.lifecycle.status === "superseded" || concept.reviewState === "deprecated" || concept.reviewState === "revoked" || concept.reviewState === "superseded") {
+    return { include: false, stale: false, scoreAdjustment: 0, reason: "inactive" };
+  }
+  const staleByStatus = concept.lifecycle.status === "stale" || concept.reviewState === "stale";
+  const staleByDate = isLifecycleDateDue(concept.lifecycle.staleAfter, input.now);
+  const stale = staleByStatus || staleByDate;
+  if (stale) {
+    return {
+      include: input.includeStale,
+      stale: input.includeStale,
+      scoreAdjustment: input.includeStale ? -250 : 0,
+      reason: staleByStatus ? "status=stale" : `staleAfter=${concept.lifecycle.staleAfter}`
+    };
+  }
+  return {
+    include: isActiveOkfReviewState(concept.reviewState) && concept.lifecycle.status === "active",
+    stale: false,
+    scoreAdjustment: 0,
+    reason: "active"
+  };
+}
+function isLifecycleDateDue(value, now) {
+  const normalized = normalizeIsoDateString(value);
+  return normalized !== null && Date.parse(normalized) <= now.getTime();
+}
+function createDefaultOkfLifecycle(input) {
+  const createdAt = normalizeIsoDateString(input.createdAt) ?? "1970-01-01T00:00:00.000Z";
+  const policy = resolveOkfLifecyclePolicy(input);
+  return {
+    status: lifecycleStatusFromReviewState(input.reviewState),
+    createdAt,
+    lastVerifiedAt: createdAt,
+    reviewAfter: addDaysIso(createdAt, policy.reviewAfterDays),
+    staleAfter: addDaysIso(createdAt, policy.staleAfterDays),
+    supersedes: [],
+    supersededBy: null,
+    revokedAt: null,
+    revokedReason: null
+  };
+}
+function parseOkfLifecycle(frontmatter, input) {
+  const defaults = createDefaultOkfLifecycle(input);
+  const block = extractNestedYamlBlock(frontmatter, "evodev", "lifecycle");
+  if (block === null)
+    return { lifecycle: defaults, persisted: false };
+  const status = readIndentedYamlScalar(block, "status");
+  const createdAt = readIndentedYamlScalar(block, "createdAt");
+  const lastVerifiedAt = readIndentedYamlScalar(block, "lastVerifiedAt");
+  const reviewAfter = readIndentedYamlScalar(block, "reviewAfter");
+  const staleAfter = readIndentedYamlScalar(block, "staleAfter");
+  const revokedAt = readIndentedYamlScalar(block, "revokedAt");
+  return {
+    persisted: true,
+    lifecycle: {
+      status: isOkfLifecycleStatus(status) ? status : defaults.status,
+      createdAt: normalizeIsoDateString(createdAt) ?? defaults.createdAt,
+      lastVerifiedAt: normalizeIsoDateString(lastVerifiedAt) ?? defaults.lastVerifiedAt,
+      reviewAfter: normalizeIsoDateString(reviewAfter) ?? defaults.reviewAfter,
+      staleAfter: normalizeIsoDateString(staleAfter) ?? defaults.staleAfter,
+      supersedes: readYamlList(block, "supersedes"),
+      supersededBy: readNullableLifecycleString(readIndentedYamlScalar(block, "supersededBy")),
+      revokedAt: readNullableLifecycleString(revokedAt) === null ? null : normalizeIsoDateString(revokedAt),
+      revokedReason: readNullableLifecycleString(readIndentedYamlScalar(block, "revokedReason"))
+    }
+  };
+}
+function lifecycleStatusFromReviewState(reviewState) {
+  if (reviewState === "stale")
+    return "stale";
+  if (reviewState === "deprecated")
+    return "deprecated";
+  if (reviewState === "revoked")
+    return "revoked";
+  if (reviewState === "superseded")
+    return "superseded";
+  return "active";
+}
+function resolveOkfLifecyclePolicy(input) {
+  const comparable = `${input.type} ${input.path} ${input.tags.join(" ")} ${input.title}`.toLowerCase();
+  if (/\bverification\b/u.test(comparable))
+    return { reviewAfterDays: 120, staleAfterDays: 240 };
+  if (/\bworkflow\b/u.test(comparable))
+    return { reviewAfterDays: 60, staleAfterDays: 120 };
+  return { reviewAfterDays: 90, staleAfterDays: 180 };
+}
+function isOkfLifecycleStatus(value) {
+  return OKF_LIFECYCLE_STATUSES.includes(value);
+}
+function normalizeIsoDateString(value) {
+  if (value === undefined || value === null || value === "" || value === "null")
+    return null;
+  const time = Date.parse(value);
+  if (!Number.isFinite(time))
+    return null;
+  return new Date(time).toISOString();
+}
+function addDaysIso(value, days) {
+  const date = new Date(value);
+  date.setUTCDate(date.getUTCDate() + days);
+  return date.toISOString();
+}
+function readNullableLifecycleString(value) {
+  if (value === null)
+    return null;
+  const normalized = sanitizeOkfText(value);
+  return normalized === "" || normalized === "null" ? null : normalized;
+}
+function yamlString(value) {
+  return JSON.stringify(value);
+}
+function extractFrontmatter(content) {
+  if (!content.startsWith(`---
+`))
+    return null;
+  const end = content.indexOf(`
+---`, 4);
+  if (end < 0)
+    return null;
+  const frontmatter = content.slice(4, end).trim();
+  const body = content.slice(end + 4).replace(/^\n/u, "");
+  return { frontmatter, body };
+}
+function extractNestedYamlBlock(frontmatter, rootKey, childKey) {
+  const lines = frontmatter.split(`
+`);
+  const rootIndex = lines.findIndex((line) => line.trim() === `${rootKey}:`);
+  if (rootIndex < 0)
+    return null;
+  const rootEnd = findYamlBlockEnd(lines, rootIndex, 0);
+  const childIndex = lines.findIndex((line, index) => index > rootIndex && index < rootEnd && line.startsWith("  ") && line.trim() === `${childKey}:`);
+  if (childIndex < 0)
+    return null;
+  const childEnd = findYamlBlockEnd(lines, childIndex, 2);
+  return lines.slice(childIndex + 1, childEnd).join(`
+`);
+}
+function findYamlBlockEnd(lines, startIndex, parentIndent) {
+  for (let index = startIndex + 1;index < lines.length; index += 1) {
+    const line = lines[index] ?? "";
+    if (line.trim() === "")
+      continue;
+    const indent = line.length - line.trimStart().length;
+    if (indent <= parentIndent)
+      return index;
+  }
+  return lines.length;
+}
+function readYamlScalar(frontmatter, key) {
+  const match = frontmatter.match(new RegExp(`^${escapeRegExp(key)}:\\s*(.+?)\\s*$`, "m"));
+  if (match?.[1] === undefined)
+    return null;
+  return parseYamlValue(match[1]);
+}
+function readIndentedYamlScalar(frontmatter, key) {
+  const match = frontmatter.match(new RegExp(`^\\s*${escapeRegExp(key)}:\\s*(.+?)\\s*$`, "m"));
+  if (match?.[1] === undefined)
+    return null;
+  return parseYamlValue(match[1]);
+}
+function parseOkfReviewState(value) {
+  return OKF_REVIEW_STATES.includes(value) ? value : "auto-stored/unreviewed";
+}
+function readYamlList(frontmatter, key) {
+  const inline = frontmatter.match(new RegExp(`^\\s*${escapeRegExp(key)}:\\s*\\[(.*?)\\]\\s*$`, "m"));
+  if (inline?.[1] !== undefined) {
+    return inline[1].split(",").map((item) => parseYamlValue(item.trim())).filter((item) => item !== "");
+  }
+  const lines = frontmatter.split(`
+`);
+  const values = [];
+  for (let index = 0;index < lines.length; index += 1) {
+    const line = lines[index] ?? "";
+    if (!line.trim().startsWith(`${key}:`))
+      continue;
+    for (let next = index + 1;next < lines.length; next += 1) {
+      const candidate = lines[next] ?? "";
+      if (!/^\s+-\s+/u.test(candidate))
+        break;
+      values.push(parseYamlValue(candidate.replace(/^\s+-\s+/u, "")));
+    }
+  }
+  return [...new Set(values.filter((value) => value !== ""))];
+}
+function parseYamlValue(value) {
+  const trimmed = value.trim();
+  if (trimmed.startsWith('"') && trimmed.endsWith('"')) {
+    try {
+      return JSON.parse(trimmed);
+    } catch {
+      return trimmed.slice(1, -1);
+    }
+  }
+  return trimmed.replace(/^['"]|['"]$/gu, "");
+}
+async function listMarkdownFiles(root) {
+  if (!await pathExists(root))
+    return [];
+  const entries = await readdir(root, { withFileTypes: true });
+  const files = [];
+  for (const entry of entries) {
+    const path = join(root, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...await listMarkdownFiles(path));
+    } else if (entry.isFile() && entry.name.endsWith(".md")) {
+      files.push({ path, name: entry.name });
+    }
+  }
+  return files;
+}
+function groupConceptsByTag(concepts, field) {
+  const groups = new Map;
+  for (const concept of concepts) {
+    for (const id of concept[field]) {
+      groups.set(id, [
+        ...groups.get(id) ?? [],
+        { id: concept.id, title: concept.title, sourceLink: concept.sourceLink }
+      ]);
+    }
+  }
+  return [...groups.entries()].map(([id, groupedConcepts]) => ({ id, concepts: groupedConcepts }));
+}
+function resolveOkfTargetPath(okfDir, targetPath) {
+  const clean = targetPath.replace(/^\/+/u, "");
+  if (clean.split("/").some((segment) => segment === ".." || segment === "." || segment === "")) {
+    throw new Error(`Unsafe OKF target path: ${targetPath}`);
+  }
+  const resolved = join(okfDir, clean);
+  const rel = relative(okfDir, resolved);
+  if (rel.startsWith("..") || rel === "")
+    throw new Error(`Unsafe OKF target path: ${targetPath}`);
+  return resolved;
+}
+function toOkfRelativePath(okfDir, path) {
+  return relative(okfDir, path).replace(/\\/gu, "/");
+}
+function sanitizeSlug(value) {
+  const slug = value.trim().toLowerCase().replace(/[^a-z0-9._/-]+/gu, "-").replace(/\/+/gu, "/").replace(/^-+|-+$/gu, "");
+  return slug === "" ? "unknown" : slug;
+}
+function titleFromSlug(value) {
+  return value.replace(/\.md$/u, "").split(/[/-]/u).filter(Boolean).map((part) => `${part.charAt(0).toUpperCase()}${part.slice(1)}`).join(" ");
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+}
+function todayIsoDate() {
+  return new Date().toISOString().slice(0, 10);
+}
+async function writeJson(path, value, options = {}) {
+  await mkdir(dirname(path), { recursive: true });
+  const flag = options.overwrite === true ? "w" : "wx";
+  await writeFile(path, `${JSON.stringify(value, null, 2)}
+`, { encoding: "utf8", flag });
+}
+async function pathExists(path) {
+  try {
+    await stat(path);
+    return true;
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT")
+      return false;
+    throw error;
+  }
+}
+
+// packages/core/src/evolution/index.ts
+var PROCESS_LOCK_STALE_MS = 5 * 60 * 1000;
+var FORBIDDEN_RAW_KEYS = new Set([
+  "commandhistory",
+  "commandoutput",
+  "credential",
+  "credentials",
+  "env",
+  "fullsource",
+  "memorybody",
+  "password",
+  "privatekey",
+  "prompt",
+  "promptbody",
+  "prompttext",
+  "rawcommand",
+  "rawcommandoutput",
+  "rawlog",
+  "rawlogs",
+  "rawoutput",
+  "rawpayload",
+  "rawprompt",
+  "secret",
+  "secretvalue",
+  "source",
+  "sourcebody",
+  "sourcecode",
+  "sourcecontent",
+  "sourcetext",
+  "stderr",
+  "stdout",
+  "token",
+  "transcript",
+  "transcriptbody",
+  "transcripttext"
+]);
+
 // packages/core/src/task/index.ts
 var FORBIDDEN_TASK_WRITE_SEGMENTS = new Set([".claude", ".codex"]);
 var FORBIDDEN_PROJECT_ASSET_SEGMENTS = new Set(["packages", "src"]);
 var FORBIDDEN_TASK_WRITE_FILES = new Set(["agents.md", "claude.md", "package.json", "readme.md"]);
-var FORBIDDEN_RAW_KEYS = new Set([
+var FORBIDDEN_RAW_KEYS2 = new Set([
   "rawoutput",
   "raw_output",
   "stdout",
@@ -134,6 +784,71 @@ var ALLOWED_VERIFICATION_KEYS = new Set([
   "type"
 ]);
 
+// packages/core/src/team/prompts.ts
+var TEAM_ROLE_STARTUP_PROMPT_TEMPLATE = [
+  "You are an EvoDev managed role agent.",
+  "Team run: {{runId}}",
+  "Repository: {{repoRoot}}",
+  "Role id: {{roleId}}",
+  "Role name: {{roleName}}",
+  "Runtime: {{runtime}}",
+  "Native Code Agent binding: {{nativeAgentBinding}}",
+  "Model: {{model}}",
+  "Thinking level: {{thinkingLevel}}",
+  "Write mode: {{writeMode}}",
+  "Transcript recording: {{transcriptRecording}}",
+  "",
+  "Current known agents:",
+  "{{roster}}",
+  "",
+  "EvoDev team runtime control contract:",
+  "This run is already inside the EvoDev-managed team runtime.",
+  "For EvoDev role-agent lifecycle, use the current EvoDev run control plane.",
+  "Unprefixed user requests such as 'start the team', 'execute team', 'create agents', or 'spawn roles' mean: use the current EvoDev run control plane.",
+  "Do not answer those requests with only a role plan when a role agent should be created.",
+  "",
+  "Use Teams MCP as the primary control plane:",
+  "- list_agents: discover current EvoDev role agents.",
+  "- spawn_role: create or reuse exactly one EvoDev role agent.",
+  "- send_message: communicate through the EvoDev broker.",
+  "- stop_role: stop a role agent when allowed.",
+  "If Teams MCP is unavailable, fall back to the EvoDev CLI from this repository:",
+  "- evodev team spawn --role <roleId>",
+  "- evodev team send --to <roleId> --message <text>",
+  "- evodev team status",
+  "Teams MCP defaults are inherited from the environment:",
+  "EVODEV_TEAM_RUN_ID={{runId}}",
+  "EVODEV_TEAM_ROLE_ID={{roleId}}",
+  "When calling Teams MCP tools, let the MCP server-bound environment identify this run and role.",
+  "Do not operate tmux directly for role lifecycle; let EvoDev create and track panes.",
+  "Any server-bound role may request role lifecycle changes; EvoDev records and tracks panes but does not use role policy to stop execution.",
+  "{{roleGuidance}}",
+  "{{nativeAgentInstruction}}",
+  "Team messages are durably queued and delivered at hook safe points, not pasted into a live prompt. cc values are audit context; they are not an instruction for main to immediately forward or act.",
+  "{{scopedContext}}",
+  "",
+  "{{rolePrompt}}"
+].join(`
+`);
+var MAIN_ROLE_GUIDANCE = [
+  "As main, you are the planner and delegator for complex work, not a standby worker.",
+  "On each user prompt or hook-delivered inbox message, decide whether to answer directly, ask for clarification, or use team execution.",
+  "Use team execution only when role separation improves correctness, coverage, safety, or latency.",
+  "When team execution is needed, create an upfront task plan with required role ids, role-specific assignments, dependencies, and runnable batches.",
+  "Spawn or reuse all roles needed for the first runnable batch and send each role a self-contained task message.",
+  "After all currently runnable tasks are delegated, finish your current turn immediately; do not call sleep, wait idly, poll list_agents/status, or keep the turn alive to watch progress.",
+  "Use list_agents only for one-time roster discovery when the current roster is genuinely unknown, never as a progress check.",
+  "Resume coordination only when the user sends new input or a role message is delivered by hooks; then decide whether to adjust tasks, send supplemental instructions, spawn dependent roles, synthesize completed results, or ask the user.",
+  "While delegated role work is pending, do not perform concrete implementation, testing, package research, or review work yourself."
+].join(" ");
+
+// packages/core/src/team/index.ts
+var TEAM_INTERNAL_WAKE_SIGNAL = [
+  "[EvoDev internal wake signal]",
+  "No user request is included in this message. Continue only from EvoDev team inbox messages injected by hooks."
+].join(`
+`);
+
 // packages/core/src/hooks/index.ts
 var CANONICAL_HOOK_EVENT_TYPES = [
   "SessionStart",
@@ -162,41 +877,55 @@ var CANONICAL_HOOK_EVENT_TYPES = [
   "WorktreeRemove"
 ];
 var DEFAULT_EVENT_SETTINGS = {
-  SessionStart: false,
-  UserPromptSubmit: false,
-  UserPromptExpansion: false,
-  PreToolUse: false,
-  PermissionRequest: false,
-  PostToolUse: false,
-  PostToolUseFailure: false,
-  PostToolBatch: false,
-  PermissionDenied: false,
-  SubagentStart: false,
-  Stop: false,
-  StopFailure: false,
-  TeammateIdle: false,
-  SubagentStop: false,
-  TaskCreated: false,
-  TaskCompleted: false,
-  PreCompact: false,
-  PostCompact: false,
-  SessionEnd: false,
-  ConfigChange: false,
-  CwdChanged: false,
-  FileChanged: false,
-  WorktreeCreate: false,
-  WorktreeRemove: false
+  SessionStart: true,
+  UserPromptSubmit: true,
+  UserPromptExpansion: true,
+  PreToolUse: true,
+  PermissionRequest: true,
+  PostToolUse: true,
+  PostToolUseFailure: true,
+  PostToolBatch: true,
+  PermissionDenied: true,
+  SubagentStart: true,
+  Stop: true,
+  StopFailure: true,
+  TeammateIdle: true,
+  SubagentStop: true,
+  TaskCreated: true,
+  TaskCompleted: true,
+  PreCompact: true,
+  PostCompact: true,
+  SessionEnd: true,
+  ConfigChange: true,
+  CwdChanged: true,
+  FileChanged: true,
+  WorktreeCreate: true,
+  WorktreeRemove: true
 };
+var TEAM_MESSAGE_DELIVERY_EVENTS = new Set([
+  "SessionStart",
+  "UserPromptSubmit",
+  "PostToolUse",
+  "PostToolUseFailure",
+  "Stop",
+  "TeammateIdle",
+  "SubagentStop",
+  "TaskCompleted"
+]);
+var CODEX_STOP_EVENTS_WITHOUT_ADDITIONAL_CONTEXT = new Set([
+  "Stop",
+  "SubagentStop"
+]);
 function createDefaultHookSettings() {
   return {
-    enabled: false,
+    enabled: true,
     targets: {
       claude: {
-        enabled: false,
+        enabled: true,
         events: { ...DEFAULT_EVENT_SETTINGS }
       },
       codex: {
-        enabled: false,
+        enabled: true,
         events: { ...DEFAULT_EVENT_SETTINGS }
       }
     },
@@ -217,6 +946,9 @@ function parseHookSettings(value) {
     return defaults;
   if (!isRecord(value))
     throw new Error("Invalid hooks settings; expected object.");
+  const observability = isRecord(value.observability) ? value.observability : undefined;
+  optionalBoolean(observability?.metadataOnly, defaults.observability.metadataOnly, "hooks.observability.metadataOnly");
+  optionalBoolean(observability?.rawPayloadStorage, defaults.observability.rawPayloadStorage, "hooks.observability.rawPayloadStorage");
   return {
     enabled: optionalBoolean(value.enabled, defaults.enabled, "hooks.enabled"),
     targets: {
@@ -226,7 +958,7 @@ function parseHookSettings(value) {
     observability: {
       metadataOnly: true,
       rawPayloadStorage: false,
-      appendEvents: false
+      appendEvents: optionalBoolean(observability?.appendEvents, defaults.observability.appendEvents, "hooks.observability.appendEvents")
     },
     learning: {
       emitCandidates: false,
@@ -286,7 +1018,26 @@ function createDefaultSettings(os = process.platform) {
     doctor: {
       lastRunAt: null
     },
-    hooks: createDefaultHookSettings()
+    hooks: createDefaultHookSettings(),
+    teamRuntime: createDefaultTeamRuntimeSettings(),
+    memory: createDefaultMemorySettings()
+  };
+}
+function createDefaultTeamRuntimeSettings() {
+  return {
+    defaultRuntime: "codex",
+    defaultModel: null,
+    defaultThinkingLevel: null,
+    recordTranscript: false,
+    displayMode: "normal"
+  };
+}
+function createDefaultMemorySettings() {
+  return {
+    autoAccept: true,
+    runtimeInjection: true,
+    staleReview: true,
+    lexicalIndex: true
   };
 }
 function mergeSettings(existing, defaults = createDefaultSettings()) {
@@ -321,10 +1072,28 @@ function mergeSettings(existing, defaults = createDefaultSettings()) {
       ...defaults.doctor,
       ...existing.doctor
     },
-    hooks: existing.hooks ?? defaults.hooks
+    hooks: existing.hooks ?? defaults.hooks,
+    teamRuntime: {
+      ...defaults.teamRuntime,
+      ...existing.teamRuntime
+    },
+    memory: {
+      ...defaults.memory,
+      ...existing.memory
+    }
   };
   return parseSettings(merged);
 }
+async function readRuntimeInjectionSettings(homeDir) {
+  const paths = resolveEvoDevPaths(homeDir);
+  try {
+    return parseSettings(JSON.parse(await readFile2(paths.settingsPath, "utf8"))).memory;
+  } catch (error) {
+    if (isNotFoundError(error))
+      return createDefaultMemorySettings();
+    throw error;
+  }
+}
 function parseSettings(value) {
   const root = expectRecord2(value, "settings");
   const version = root.version;
@@ -355,10 +1124,44 @@ function parseSettings(value) {
     doctor: {
       lastRunAt: expectNullableString(doctor.lastRunAt, "settings.doctor.lastRunAt")
     },
-    hooks: parseHookSettings(root.hooks)
+    hooks: parseHookSettings(root.hooks),
+    teamRuntime: parseTeamRuntimeSettings(root.teamRuntime ?? createDefaultTeamRuntimeSettings(), "settings.teamRuntime"),
+    memory: parseMemorySettings(root.memory ?? createDefaultMemorySettings(), "settings.memory")
   };
   return parsed;
 }
+function parseMemorySettings(value, path) {
+  const input = expectRecord2(value, path);
+  const defaults = createDefaultMemorySettings();
+  return {
+    autoAccept: input.autoAccept === undefined ? defaults.autoAccept : expectBoolean(input.autoAccept, `${path}.autoAccept`),
+    runtimeInjection: input.runtimeInjection === undefined ? defaults.runtimeInjection : expectBoolean(input.runtimeInjection, `${path}.runtimeInjection`),
+    staleReview: input.staleReview === undefined ? defaults.staleReview : expectBoolean(input.staleReview, `${path}.staleReview`),
+    lexicalIndex: input.lexicalIndex === undefined ? defaults.lexicalIndex : expectBoolean(input.lexicalIndex, `${path}.lexicalIndex`)
+  };
+}
+function parseTeamRuntimeSettings(value, path) {
+  const input = expectRecord2(value, path);
+  const defaults = createDefaultTeamRuntimeSettings();
+  const defaultRuntime = input.defaultRuntime ?? defaults.defaultRuntime;
+  if (defaultRuntime !== "codex" && defaultRuntime !== "claude") {
+    throw new EvoDevConfigError(`Invalid ${path}.defaultRuntime; expected codex or claude`);
+  }
+  return {
+    defaultRuntime,
+    defaultModel: input.defaultModel === undefined ? defaults.defaultModel : expectNullableString(input.defaultModel, `${path}.defaultModel`),
+    defaultThinkingLevel: input.defaultThinkingLevel === undefined ? defaults.defaultThinkingLevel : expectNullableString(input.defaultThinkingLevel, `${path}.defaultThinkingLevel`),
+    recordTranscript: input.recordTranscript === undefined ? defaults.recordTranscript : expectBoolean(input.recordTranscript, `${path}.recordTranscript`),
+    displayMode: parseTeamRuntimeDisplayMode(input.displayMode, defaults.displayMode, path)
+  };
+}
+function parseTeamRuntimeDisplayMode(value, fallback, path) {
+  if (value === undefined)
+    return fallback;
+  if (value === "normal" || value === "development")
+    return value;
+  throw new EvoDevConfigError(`Invalid ${path}.displayMode; expected normal or development`);
+}
 function parsePluginSettings(value, path) {
   const input = expectRecord2(value, path);
   const parsed = {
@@ -378,6 +1181,9 @@ function expectRecord2(value, path) {
   }
   return value;
 }
+function isNotFoundError(error) {
+  return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
 function expectString2(value, path) {
   if (typeof value !== "string" || value.length === 0) {
     throw new EvoDevConfigError(`Invalid ${path}; expected non-empty string`);
@@ -477,14 +1283,23 @@ function expectNonNegativeInteger(value, path) {
   return value;
 }
 // packages/core/src/config/store.ts
-import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { dirname } from "node:path";
+import { mkdir as mkdir2, readFile as readFile3, writeFile as writeFile2 } from "node:fs/promises";
+import { dirname as dirname2 } from "node:path";
 function createCoreConfigStore(homeDir) {
   const paths = resolveEvoDevPaths(homeDir);
   return {
     paths,
     async ensureBaseDirs() {
-      await mkdir(paths.stateDir, { recursive: true });
+      await mkdir2(paths.stateDir, { recursive: true });
+      await mkdir2(paths.logsDir, { recursive: true });
+      await mkdir2(paths.knowledgeDir, { recursive: true });
+      await mkdir2(paths.evosCasesDir, { recursive: true });
+      await mkdir2(paths.roleAgentsDir, { recursive: true });
+      await mkdir2(paths.teamsDir, { recursive: true });
+      await mkdir2(paths.runsDir, { recursive: true });
+    },
+    async ensureKnowledgeBase() {
+      await ensureKnowledgeBaseFiles(paths);
     },
     async readSettings() {
       return readJsonFile(paths.settingsPath, parseSettings);
@@ -521,16 +1336,88 @@ function createCoreConfigStore(homeDir) {
 async function initializeCoreConfig(homeDir) {
   const store = createCoreConfigStore(homeDir);
   await store.ensureBaseDirs();
+  await store.ensureKnowledgeBase();
   await writeIfMissing(store.paths.settingsPath, createDefaultSettings());
   await writeIfMissing(store.paths.registryPath, createDefaultRegistry());
   await writeIfMissing(store.paths.installStatePath, createDefaultInstallState());
   await writeIfMissing(store.paths.syncStatePath, createDefaultSyncState());
   return store;
 }
+async function ensureKnowledgeBaseFiles(paths) {
+  await mkdir2(paths.knowledgeDir, { recursive: true });
+  await mkdir2(paths.evosCasesDir, { recursive: true });
+  await ensureOkfKnowledgeBase(paths.homeDir);
+  await writeTextIfMissing2(`${paths.knowledgeDir}/README.md`, [
+    "# EvoDev Knowledge",
+    "",
+    "Local-private knowledge base for user-accepted facts, decisions, architecture notes, and reusable domain context.",
+    "",
+    "EvoDev must not populate this directory from source code, prompts, command output, logs, or transcripts without an explicit consent flow.",
+    ""
+  ].join(`
+`));
+  await writeIndexIfMissingOrMigrate(paths.knowledgeIndexPath, "knowledge-index", {
+    version: 1,
+    kind: "knowledge-index",
+    roleTags: [],
+    entries: []
+  });
+  await writeTextIfMissing2(`${paths.evosDir}/README.md`, [
+    "# EvoDev Evos",
+    "",
+    "Local-private evolution case library for reviewed improvement cases and reusable process changes.",
+    "",
+    "Cases start empty. Future automation may propose candidates, but accepted evos require explicit review before they can influence workflows or routing.",
+    ""
+  ].join(`
+`));
+  await writeTextIfMissing2(`${paths.evosCasesDir}/README.md`, [
+    "# Evolution Cases",
+    "",
+    "Store one reviewed evolution case per file. Do not store raw prompts, source dumps, secrets, transcripts, or raw command output here.",
+    ""
+  ].join(`
+`));
+  await writeIndexIfMissingOrMigrate(paths.evosIndexPath, "evos-index", {
+    version: 1,
+    kind: "evos-index",
+    roleTags: [],
+    cases: []
+  });
+  await writeTextIfMissing2(`${paths.roleAgentsDir}/README.md`, [
+    "# Role Agents",
+    "",
+    "Local-private role agent registry for EvoDev-managed agent roles and user-reviewed role extensions.",
+    "",
+    "Repository-specific role agents should be proposed first and written into a user repository only after explicit project opt-in.",
+    ""
+  ].join(`
+`));
+  await writeIndexIfMissingOrMigrate(paths.roleAgentsIndexPath, "role-agent-index", {
+    version: 1,
+    kind: "role-agent-index",
+    roles: [],
+    projectExtensions: []
+  });
+  await writeTextIfMissing2(`${paths.teamsDir}/README.md`, [
+    "# Agent Teams",
+    "",
+    "Local-private EvoHub team registry for reviewed role-agent team definitions.",
+    "",
+    "Teams may reference role agents and role-tagged knowledge, but they must not contain raw source, prompts, transcripts, secrets, or raw command output.",
+    ""
+  ].join(`
+`));
+  await writeIndexIfMissingOrMigrate(paths.teamsIndexPath, "agent-team-index", {
+    version: 1,
+    kind: "agent-team-index",
+    teams: []
+  });
+}
 async function readJsonFile(filePath, parse) {
   let raw;
   try {
-    raw = await readFile(filePath, "utf8");
+    raw = await readFile3(filePath, "utf8");
   } catch (error) {
     throw new EvoDevConfigError(`Cannot read config file (${describeFileError(error)})`, filePath);
   }
@@ -561,7 +1448,7 @@ async function readJsonFileOrDefault(filePath, parse, fallback) {
 }
 async function writeIfMissing(filePath, value) {
   try {
-    await readFile(filePath, "utf8");
+    await readFile3(filePath, "utf8");
   } catch (error) {
     if (isNodeError(error) && error.code === "ENOENT") {
       await writeJsonFile(filePath, value);
@@ -570,9 +1457,45 @@ async function writeIfMissing(filePath, value) {
     throw new EvoDevConfigError(`Cannot inspect config file (${describeFileError(error)})`, filePath);
   }
 }
+async function writeIndexIfMissingOrMigrate(filePath, kind, defaults) {
+  let raw;
+  try {
+    raw = await readFile3(filePath, "utf8");
+  } catch (error) {
+    if (isNodeError(error) && error.code === "ENOENT") {
+      await writeJsonFile(filePath, defaults);
+      return;
+    }
+    throw new EvoDevConfigError(`Cannot inspect config file (${describeFileError(error)})`, filePath);
+  }
+  let existing;
+  try {
+    existing = JSON.parse(raw);
+  } catch (error) {
+    throw new EvoDevConfigError(`Invalid bootstrap index JSON (${describeFileError(error)})`, filePath);
+  }
+  if (!isRecord2(existing) || existing.kind !== kind)
+    return;
+  const migrated = { ...defaults, ...existing };
+  if (Object.keys(defaults).every((key) => (key in existing)))
+    return;
+  await writeJsonFile(filePath, migrated);
+}
+async function writeTextIfMissing2(filePath, value) {
+  try {
+    await readFile3(filePath, "utf8");
+  } catch (error) {
+    if (isNodeError(error) && error.code === "ENOENT") {
+      await mkdir2(dirname2(filePath), { recursive: true });
+      await writeFile2(filePath, value, "utf8");
+      return;
+    }
+    throw new EvoDevConfigError(`Cannot inspect config file (${describeFileError(error)})`, filePath);
+  }
+}
 async function writeJsonFile(filePath, value) {
-  await mkdir(dirname(filePath), { recursive: true });
-  await writeFile(filePath, `${JSON.stringify(value, null, 2)}
+  await mkdir2(dirname2(filePath), { recursive: true });
+  await writeFile2(filePath, `${JSON.stringify(value, null, 2)}
 `, "utf8");
 }
 function describeFileError(error) {
@@ -584,17 +1507,23 @@ function describeFileError(error) {
 function isNodeError(error) {
   return error instanceof Error && "code" in error;
 }
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 export {
   resolveEvoDevPaths,
+  readRuntimeInjectionSettings,
   parseSyncState,
   parseSettings,
   parseRegistry,
   parseInstallState,
   mergeSettings,
   initializeCoreConfig,
+  createDefaultTeamRuntimeSettings,
   createDefaultSyncState,
   createDefaultSettings,
   createDefaultRegistry,
+  createDefaultMemorySettings,
   createDefaultInstallState,
   createCoreConfigStore,
   EvoDevConfigError