@evomap/evolver-core 2.0.0-beta.18 → 2.0.0-beta.19

package/dist/bootstrap/v1EnvCompat.js

@@ -0,0 +1,256 @@
+/**
+ * V1 → V2 environment variable compatibility layer (#698).
+ *
+ * Evolver V1 used several env var names that are no longer recognized by V2
+ * resolvers. When operators upgrade from V1 to V2 without updating their env
+ * files, these legacy names silently do nothing. This module detects the
+ * presence of deprecated V1 env vars and emits structured warnings so
+ * operators know which knobs to migrate.
+ *
+ * ## Migration map
+ *
+ * | V1 name | V2 equivalent | Notes |
+ * |---|---|---|
+ * | `OPENCLAW_WORKSPACE` | *(manual)* | Partial V2 support does not preserve V1 workspace and bridge semantics |
+ * | `EVOLVER_NO_PARENT_GIT` | *(none)* | V2 uses `EVOLVER_REPO_ROOT` or nearest Git root |
+ * | `EVOLVER_VERBOSE` | *(none)* | V2 has no global switch; opt in to feature-specific diagnostics manually |
+ * | `EVOLVER_AUTO_ISSUE` | *(none)* | V2 creates local drafts; submit requires explicit approval-gated flow |
+ * | `EVOLVER_ROLLBACK_MODE` | *(none)* | V2 uses worktree/snapshot/recovery policy |
+ * | `WORKER_ENABLED` | *(none)* | No merchant-worker resolver in V2 |
+ * | `WORKER_DOMAINS` | *(none)* | No merchant-worker resolver in V2 |
+ * | `WORKER_MAX_LOAD` | *(none)* | No merchant-worker resolver in V2 |
+ * | `EVOLVER_MEMORY_GRAPH_AUTO_ROTATE` | *(none)* | V2 LocalMemoryGraph always performs bounded maintenance |
+ * | `EVOLVER_MEMORY_GRAPH_MAX_SIZE_MB` | *(none)* | V2 LocalMemoryGraph uses a fixed 4 MiB active-file limit |
+ * | `EVOLVER_MEMORY_GRAPH_RETENTION_COUNT` | *(none)* | V2 LocalMemoryGraph retains three archives by default |
+ * | `GITHUB_TOKEN` | `GITHUB_TOKEN` | Already supported by V2 issue reporter and PR tooling |
+ *
+ * GITHUB_TOKEN is NOT deprecated — it's actively used. We only note its
+ * presence for observability.
+ */
+/**
+ * The canonical table of V1 → V2 env var deprecations.
+ *
+ * Order matters for deterministic output; the scan iterates this list
+ * and checks each entry against the provided `env` object.
+ */
+export const V1_DEPRECATION_TABLE = [
+    {
+        v1Name: 'OPENCLAW_WORKSPACE',
+        v2Equivalent: null,
+        migrationAction: 'manual',
+        guidance: 'OPENCLAW_WORKSPACE is still read directly by the pending-signals resolver. ' +
+            'Do not copy it verbatim: identify the Git repo root before setting EVOLVER_REPO_ROOT, ' +
+            'and migrate V1 bridge behavior separately.',
+    },
+    {
+        v1Name: 'EVOLVER_NO_PARENT_GIT',
+        v2Equivalent: null,
+        migrationAction: 'remove',
+        guidance: 'V2 uses EVOLVER_REPO_ROOT or the nearest Git root for workspace detection. ' +
+            'Prefer EVOLVER_REPO_ROOT; EVOLVER_NO_PARENT_GIT has no V2 effect.',
+    },
+    {
+        v1Name: 'EVOLVER_VERBOSE',
+        v2Equivalent: null,
+        migrationAction: 'remove',
+        guidance: 'V2 has no global verbose switch. Remove this variable and opt in to a ' +
+            'feature-specific flag such as EVOLVER_HOOK_VERBOSE=1 only when hook diagnostics are needed.',
+    },
+    {
+        v1Name: 'EVOLVER_AUTO_ISSUE',
+        v2Equivalent: null,
+        migrationAction: 'remove',
+        guidance: 'V2 does not auto-submit issues. It creates local drafts and requires ' +
+            'explicit approval-gated submission via `evolver issue-report submit`.',
+    },
+    {
+        v1Name: 'EVOLVER_ROLLBACK_MODE',
+        v2Equivalent: null,
+        migrationAction: 'remove',
+        guidance: 'V2 uses worktree, snapshot, and recovery policy instead of legacy hard-reset. ' +
+            'Remove this variable; it has no effect.',
+    },
+    {
+        v1Name: 'WORKER_ENABLED',
+        v2Equivalent: null,
+        migrationAction: 'remove',
+        guidance: 'V2 has no merchant-worker resolver. Remove this variable; it has no effect.',
+    },
+    {
+        v1Name: 'WORKER_DOMAINS',
+        v2Equivalent: null,
+        migrationAction: 'remove',
+        guidance: 'V2 has no merchant-worker resolver. Remove this variable; it has no effect.',
+    },
+    {
+        v1Name: 'WORKER_MAX_LOAD',
+        v2Equivalent: null,
+        migrationAction: 'remove',
+        guidance: 'V2 has no merchant-worker resolver. Remove this variable; it has no effect.',
+    },
+    {
+        v1Name: 'EVOLVER_MEMORY_GRAPH_AUTO_ROTATE',
+        v2Equivalent: null,
+        migrationAction: 'remove',
+        guidance: 'V2 LocalMemoryGraph always rotates and compacts automatically at its bounded defaults. ' +
+            'There is no environment override; remove this variable.',
+    },
+    {
+        v1Name: 'EVOLVER_MEMORY_GRAPH_MAX_SIZE_MB',
+        v2Equivalent: null,
+        migrationAction: 'remove',
+        guidance: 'V2 LocalMemoryGraph uses a fixed 4 MiB active-file limit before rotation and compaction. ' +
+            'There is no environment override; remove this variable.',
+    },
+    {
+        v1Name: 'EVOLVER_MEMORY_GRAPH_RETENTION_COUNT',
+        v2Equivalent: null,
+        migrationAction: 'remove',
+        guidance: 'V2 LocalMemoryGraph retains three archives by default and prunes older archives automatically. ' +
+            'There is no environment override; remove this variable.',
+    },
+];
+/**
+ * Scan the provided environment for deprecated V1 env vars and return
+ * structured results. This function is purely read-only and never mutates
+ * the `env` object.
+ *
+ * @param env  The environment to scan (defaults to `process.env`).
+ * @returns    Structured scan results including detected deprecations.
+ */
+export function scanV1EnvCompat(env = typeof process !== 'undefined' ? process.env : {}) {
+    const detected = [];
+    for (const entry of V1_DEPRECATION_TABLE) {
+        const value = env[entry.v1Name];
+        if (value !== undefined && value.trim() !== '') {
+            detected.push(entry);
+        }
+    }
+    const githubTokenPresent = (env['GITHUB_TOKEN'] !== undefined && env['GITHUB_TOKEN'].trim() !== '') ||
+        (env['GH_TOKEN'] !== undefined && env['GH_TOKEN'].trim() !== '');
+    return { detected, githubTokenPresent };
+}
+/** Resolve the migration action while preserving compatibility with pre-action table entries. */
+export function resolveV1EnvMigrationAction(entry) {
+    return entry.migrationAction ?? (entry.v2Equivalent ? 'map' : 'remove');
+}
+/**
+ * Emit deprecation warnings to the provided logger for all detected
+ * deprecated V1 env vars. This is the primary integration point for
+ * entrypoints that want human-readable console output.
+ *
+ * @param result  The scan result from `scanV1EnvCompat`.
+ * @param warn    Logger function (defaults to `console.warn`).
+ */
+export function emitV1DeprecationWarnings(result, warn = (msg) => console.warn(msg)) {
+    for (const dep of result.detected) {
+        const action = resolveV1EnvMigrationAction(dep);
+        const v2Hint = action === 'map' && dep.v2Equivalent
+            ? ` Use ${dep.v2Equivalent} instead.`
+            : '';
+        const lead = action === 'manual'
+            ? `Deprecated env var ${dep.v1Name} is set and requires manual migration.`
+            : action === 'map'
+                ? `Deprecated env var ${dep.v1Name} is set.`
+                : `Deprecated env var ${dep.v1Name} is set but has no V2 resolver.`;
+        warn(`[evolver:v1-compat] ${lead}${v2Hint} ${dep.guidance}`);
+    }
+    // githubTokenPresent is intentionally not warned: GITHUB_TOKEN/GH_TOKEN remain
+    // supported by V2 issue reporter / PR tooling. Flag retained for callers/tests.
+}
+/**
+ * Convenience function: scan + emit in one call. Intended for early
+ * bootstrap in CLI/proxy/MCP entrypoints.
+ *
+ * @param env  The environment to scan.
+ * @param warn Logger function.
+ * @returns    The scan result (useful for programmatic inspection).
+ */
+export function checkV1EnvCompat(env = typeof process !== 'undefined' ? process.env : {}, warn) {
+    const result = scanV1EnvCompat(env);
+    if (result.detected.length > 0) {
+        emitV1DeprecationWarnings(result, warn);
+    }
+    return result;
+}
+/**
+ * Build an offline V1→V2 env translation report.
+ * Does not write files; callers decide how to present or apply suggestions.
+ * Raw values are retained only as v2Value for mappable non-secret keys.
+ * GITHUB_TOKEN and GH_TOKEN are reported as keep without retaining their values.
+ */
+export function translateV1Env(env = typeof process !== 'undefined' ? process.env : {}) {
+    const suggestions = [];
+    for (const entry of V1_DEPRECATION_TABLE) {
+        const raw = env[entry.v1Name];
+        if (raw === undefined || raw.trim() === '')
+            continue;
+        const action = resolveV1EnvMigrationAction(entry);
+        if (action === 'map') {
+            if (!entry.v2Equivalent)
+                throw new Error(`missing V2 equivalent for ${entry.v1Name}`);
+            suggestions.push({
+                v1Name: entry.v1Name,
+                action: 'map',
+                v2Name: entry.v2Equivalent,
+                v2Value: raw,
+                guidance: entry.guidance,
+            });
+        }
+        else {
+            suggestions.push({
+                v1Name: entry.v1Name,
+                action,
+                guidance: entry.guidance,
+            });
+        }
+    }
+    const githubTokenPresent = (env['GITHUB_TOKEN'] !== undefined && env['GITHUB_TOKEN'].trim() !== '') ||
+        (env['GH_TOKEN'] !== undefined && env['GH_TOKEN'].trim() !== '');
+    if (githubTokenPresent) {
+        const key = env['GITHUB_TOKEN']?.trim() ? 'GITHUB_TOKEN' : 'GH_TOKEN';
+        suggestions.push({
+            v1Name: key,
+            action: 'keep',
+            v2Name: key,
+            guidance: 'GITHUB_TOKEN/GH_TOKEN remain valid for issue submit and gh-based PR tooling. ' +
+                'Prefer GH_TOKEN when using the GitHub CLI.',
+        });
+    }
+    return {
+        suggestions,
+        detectedCount: suggestions.filter((s) => s.action !== 'keep').length,
+        mappableCount: suggestions.filter((s) => s.action === 'map').length,
+        manualCount: suggestions.filter((s) => s.action === 'manual').length,
+        removableCount: suggestions.filter((s) => s.action === 'remove').length,
+        githubTokenPresent,
+    };
+}
+/** Human-readable report (never prints secret-looking values; only key names + actions). */
+export function formatV1EnvTranslationReport(report) {
+    const lines = [
+        'V1 → V2 env translation (offline, no writes):',
+        `  detected_deprecated=${report.detectedCount} map=${report.mappableCount} manual=${report.manualCount} remove=${report.removableCount} github_token=${report.githubTokenPresent ? 'present' : 'absent'}`,
+    ];
+    if (report.suggestions.length === 0) {
+        lines.push('  (no V1-only knobs detected)');
+        return `${lines.join('\n')}\n`;
+    }
+    for (const s of report.suggestions) {
+        if (s.action === 'map') {
+            lines.push(`  map  ${s.v1Name} → ${s.v2Name}`);
+        }
+        else if (s.action === 'manual') {
+            lines.push(`  review ${s.v1Name} (manual migration required)`);
+        }
+        else if (s.action === 'remove') {
+            lines.push(`  drop ${s.v1Name} (no V2 resolver)`);
+        }
+        else {
+            lines.push(`  keep ${s.v1Name} (still valid in V2)`);
+        }
+        lines.push(`       ${s.guidance}`);
+    }
+    lines.push('  See docs/migration-guide.md and docs/config-env.md § V1 变量不再是 V2 的有效配置.');
+    return `${lines.join('\n')}\n`;
+}

package/dist/events/public.d.ts

@@ -10,7 +10,7 @@ export type { RootEventArchiveOptions, RootEventArchivePlan, RootEventArchiveRes
 export { rootEventsPath, evomapHome, mvDir, personalityStatePath, assetsDir, materialDir, materialStorePath, materialWatermarkPath, tracesDir, assetCallLogPath, learningTraceDir } from './paths.js';
 export { EVENT_SCHEMA_VERSION } from './eventSchema.js';
 export type { RootEvent, RawEvent, HumanNarrative, Actor, Replayability } from './eventSchema.js';
-export { readEvents, statusReport, listCycles, showCycle, listTriggers, dailySummary, buildNarrativeSnapshot, NARRATIVE_DEFAULT_LIMIT, NARRATIVE_MAX_LIMIT, } from './reports.js';
+export { readEvents, statusReport, listCycles, showCycle, listTriggers, dailySummary, dailyCapsuleCount, buildNarrativeSnapshot, NARRATIVE_DEFAULT_LIMIT, NARRATIVE_MAX_LIMIT, } from './reports.js';
 export { buildRetentionReport, defaultMaterialCursorPath, defaultMaterialCursorPaths, RETENTION_DEFAULT_MAX_MATERIAL_BYTES, RETENTION_DEFAULT_MAX_MATERIAL_RECORDS, RETENTION_DEFAULT_MAX_ROOT_BYTES, RETENTION_DEFAULT_MAX_ROOT_EVENTS, RETENTION_DEFAULT_ROOT_TAIL_EVENTS, RETENTION_DEFAULT_WATCH_RATIO, } from './retention.js';
 export type { ReportEvent, StatusReport, CycleSummary, CycleTimeline, TriggerRow, DailySummary, NarrativeEntry, NarrativeOutcome, NarrativeSnapshot, NarrativeSnapshotOptions, } from './reports.js';
 export type { MaterialRetentionSnapshot, RetentionReport, RetentionReportOptions, RetentionState, RetentionThresholds, RootRetentionSnapshot, } from './retention.js';

package/dist/events/public.js

@@ -5,5 +5,5 @@ export { LineTooLargeError, MAX_LINE_BYTES } from './eventStore.js';
 export { ArchiveSegmentConflictError, InvalidRootEventArchiveError, InvalidRootEventLogError, RootEventHistoryGapError, archiveRootEvents, inspectRootEventArchive, planRootEventArchive, readRootEventHistory, rootEventArchiveDir, rootEventArchiveSegmentName, validateRootEventHistory, ROOT_EVENT_ARCHIVE_DEFAULT_KEEP_EVENTS, } from './eventArchive.js';
 export { rootEventsPath, evomapHome, mvDir, personalityStatePath, assetsDir, materialDir, materialStorePath, materialWatermarkPath, tracesDir, assetCallLogPath, learningTraceDir } from './paths.js';
 export { EVENT_SCHEMA_VERSION } from './eventSchema.js';
-export { readEvents, statusReport, listCycles, showCycle, listTriggers, dailySummary, buildNarrativeSnapshot, NARRATIVE_DEFAULT_LIMIT, NARRATIVE_MAX_LIMIT, } from './reports.js';
+export { readEvents, statusReport, listCycles, showCycle, listTriggers, dailySummary, dailyCapsuleCount, buildNarrativeSnapshot, NARRATIVE_DEFAULT_LIMIT, NARRATIVE_MAX_LIMIT, } from './reports.js';
 export { buildRetentionReport, defaultMaterialCursorPath, defaultMaterialCursorPaths, RETENTION_DEFAULT_MAX_MATERIAL_BYTES, RETENTION_DEFAULT_MAX_MATERIAL_RECORDS, RETENTION_DEFAULT_MAX_ROOT_BYTES, RETENTION_DEFAULT_MAX_ROOT_EVENTS, RETENTION_DEFAULT_ROOT_TAIL_EVENTS, RETENTION_DEFAULT_WATCH_RATIO, } from './retention.js';

package/dist/events/reports.d.ts

@@ -61,6 +61,8 @@ export interface DailySummary {
     suppressedFailures: number;
 }
 export declare function dailySummary(evts: readonly ReportEvent[], dayPrefix: string): DailySummary;
+/** 统计指定日期前缀的 capsule.produced 事件数. */
+export declare function dailyCapsuleCount(evts: readonly ReportEvent[], dayPrefix: string): number;
 export type NarrativeOutcome = 'success' | 'failed' | 'inert' | 'unknown';
 export interface NarrativeEntry {
     seq: number;

package/dist/events/reports.js

@@ -85,6 +85,10 @@ export function dailySummary(evts, dayPrefix) {
         suppressedFailures,
     };
 }
+/** 统计指定日期前缀的 capsule.produced 事件数. */
+export function dailyCapsuleCount(evts, dayPrefix) {
+    return evts.filter((e) => e.type === 'capsule.produced' && e.ts.startsWith(dayPrefix)).length;
+}
 export const NARRATIVE_DEFAULT_LIMIT = 30;
 export const NARRATIVE_MAX_LIMIT = 200;
 const NARRATIVE_EVENTS = new Set([

package/dist/exec/autoExec.d.ts

@@ -4,7 +4,7 @@ import type { ReviewLedger } from '../assetstore/reviewLedger.js';
 import type { GeneCandidateInput } from '../algo/geneSelection.js';
 import type { CycleEngine, ExecutionFailureKind, SolidifyPermitGate } from '../algo/cycleEngine.js';
 import { type AutonomousSafety } from './autonomousCycle.js';
-import type { GitRunner, ValidateHook } from './claudeBridge.js';
+import { type GitRunner, type ValidateHook } from './claudeBridge.js';
 import type { AgentRunner } from './runnerRegistry.js';
 import { type OpenPrLister } from './openPrRegistry.js';
 import type { ReuseOutcomeSummary, ReuseOutcomeEvent } from '../ops/reuseOutcomes.js';

package/dist/exec/autoExec.js

@@ -1,22 +1,16 @@
-// Autonomous-exec task runner — the productized per-task kernel a resident daemon polls (the deployment form
-// of the scratch autoexec daemon). One task → one fully-hardened evolution cycle, with a deny-by-default
-// allowlist pre-check that yields a clean "refused" verdict WITHOUT running anything when the repo is not
-// allowlisted. Secure by construction: the execute is built by makeSafeExecute (all six controls); callers
-// cannot bypass the safety composition.
-import { resolve as resolvePath, sep } from 'node:path';
 import { normalizeForPut } from '../assetstore/provider.js';
 import { ingestUntrusted } from '../assetstore/provenance.js';
 import { mergePendingSignalsForStore } from '../assetstore/pendingSignals.js';
 import { intakeGene } from '../algo/geneIntake.js';
 import { runEvolutionCycle } from '../algo/orchestrator.js';
 import { makeSafeExecute, makeTrustedGeneResolver } from './autonomousCycle.js';
+import { isWithinRoot } from './claudeBridge.js';
 import { findSignalHints } from './openPrRegistry.js';
 import { AgentRunTraceRecorder, buildLearningPacketDraft } from '../trace/learningTrace.js';
 import { collectRunLlmTurns } from '../trace/proxyTurns.js';
 /** Same path-containment as the bridge guard — used here to refuse before running anything (clean verdict). */
 function withinAllowlist(repo, roots) {
-    const c = resolvePath(repo);
-    return roots.some((root) => { const r = resolvePath(root); return c === r || c.startsWith(r.endsWith(sep) ? r : r + sep); });
+    return roots.some((root) => isWithinRoot(repo, root));
 }
 function cleanForcedGeneId(value) {
     if (typeof value !== 'string')
@@ -151,7 +145,7 @@ export async function runAutoExecTask(deps, rawTask, safety) {
     // Wall-clock window of this run, used to correlate the proxy's llm_turn records (slice 5). Captured
     // unconditionally-cheaply only when the fold is configured.
     const proxyTraceClock = deps.learningTrace?.proxyTraces?.now ?? Date.now;
-    const runStartMs = deps.learningTrace?.proxyTraces ? proxyTraceClock() : 0;
+    let runStartMs = 0;
     try {
         traceRecorder?.runStarted({ taskSummary: task.expectedEffect, signals: cycleSignals, metadata: { repo: task.repo, target: task.target } });
     }
@@ -164,6 +158,7 @@ export async function runAutoExecTask(deps, rawTask, safety) {
             hubCandidates = [];
         }
     }
+    runStartMs = deps.learningTrace?.proxyTraces ? proxyTraceClock() : 0;
     // evaluation fill-in (slice 6): the validate hook is the run's external verifier (sandboxed validation
     // commands), so its result — when it actually RAN — becomes the packet's evaluation.verification
     // (verifier 'automated_test'). Observation is a pass-through wrapper: the hook's result reaches the
@@ -253,7 +248,10 @@ export async function runAutoExecTask(deps, rawTask, safety) {
                 sourceRepo: deps.learningTrace.sourceRepo ?? 'evolver-v2',
                 taskSummary: task.expectedEffect,
                 signals: cycleSignals,
-                environment: { repo: task.repo, runner: safety.runner ?? 'claude' },
+                environment: {
+                    repo: task.repo,
+                    runner: safety.runner ?? (deps.agent ? 'claude' : 'codex'),
+                },
                 ...(observedVerification !== undefined ? { verification: observedVerification } : {}),
             }));
         }

package/dist/exec/autonomousCycle.d.ts

@@ -4,7 +4,7 @@ import type { ReviewLedger } from '../assetstore/reviewLedger.js';
 import type { Mutation } from '../wire/index.js';
 import type { GeneDecision } from '../algo/geneSelection.js';
 import type { ExecutionResult } from '../algo/cycleEngine.js';
-import { type GeneResolver, type ValidateHook, type AgentRunnerOptions, type RunnerName, type AgentRunner, type GitRunner } from './claudeBridge.js';
+import { type GeneResolver, type ValidateHook, type AgentRunnerOptions, type AgentSessionResume, type RunnerName, type AgentRunner, type GitRunner } from './claudeBridge.js';
 import type { PersonalityStore } from '../personality/store.js';
 import type { AgentRunTraceRecorder } from '../trace/learningTrace.js';
 /**
@@ -19,9 +19,11 @@ export declare function makeTrustedGeneResolver(store: AssetStoreProvider, prove
 export interface AutonomousSafety {
     /** Deny-by-default repo allowlist (#41). Required — an empty array refuses everything. */
     allowedRoots: readonly string[];
-    /** Which built-in runner (#66). Default 'claude'. The same safety controls wrap whichever runner. cursor is a scaffold (unverified). */
+    /** Which built-in runner (#66). Default 'codex'. The same safety controls wrap whichever runner. cursor is a scaffold (unverified). */
     runner?: RunnerName;
-    /** Agent runner options (#38/#40). Default: bounded skip-permissions (Read/Edit/Write). */
+    /** Explicit opt-in to continue a native session owned by the selected runner. */
+    resume?: AgentSessionResume;
+    /** Agent runner options (#38/#40). Default: no pre-authorized host access. */
     agentOptions?: AgentRunnerOptions;
     /** Strip evolver/hub secrets from the agent env (#42). Default true. */
     scrubEnv?: boolean;
@@ -33,10 +35,23 @@ export interface AutonomousSafety {
     /** Cooperative cancellation propagated to the spawned runner process tree. */
     signal?: AbortSignal;
 }
+export declare class UnsupportedCursorAutonomousIsolationError extends Error {
+    constructor();
+}
+export declare class UnsupportedAutonomousHostAccessError extends Error {
+    constructor();
+}
+export declare class UnsupportedAutonomousClaudeRunnerError extends Error {
+    constructor();
+}
+export declare class UnsupportedAutonomousCodexRunnerError extends Error {
+    constructor();
+}
+export declare function resolveAutonomousAgentOptions(runner: RunnerName | undefined, isolation: AutonomousSafety['isolation'], overrides?: AgentRunnerOptions): AgentRunnerOptions;
 /**
  * Build the fully-hardened `execute` for an autonomous run against `repo`. Composes every exec-bridge control
  * with secure defaults so they can't be forgotten piecemeal: deny-by-default allowedRoots (#41) + worktree
- * isolation (#43) + env scrub (#42) + bounded skip-permissions agent (#38/#40) + trusted-gene gate fed by
+ * isolation (#43) + env scrub (#42) + non-bypassing agent permissions (#38/#40) + trusted-gene gate fed by
  * provenance (#45/#30). Pass the result as runEvolutionCycle's `execute`.
  */
 export declare function makeSafeExecute(repo: string, store: AssetStoreProvider, safety: AutonomousSafety, opts?: {

package/dist/exec/autonomousCycle.js

@@ -1,4 +1,4 @@
-import { makeClaudeExecBridge } from './claudeBridge.js';
+import { CLAUDE_SAFE_AUTONOMOUS_TOOLS, hasBoundedClaudeFileAccess, makeClaudeExecBridge, validateAgentSessionResume } from './claudeBridge.js';
 const asStrings = (v) => (Array.isArray(v) ? v.filter((x) => typeof x === 'string') : []);
 /**
  * Resolve a gene's strategy from the store and whether it is safe to EMBED into an autonomous agent's prompt —
@@ -33,19 +33,19 @@ export function makeTrustedGeneResolver(store, provenance, review, includeProbat
         return info;
     };
 }
-// Claude's safe default: bypass the permission prompts but BOUND the agent to file edits (#38/#40).
-const CLAUDE_DEFAULT_AGENT_OPTIONS = { skipPermissions: true, allowedTools: ['Read', 'Edit', 'Write'] };
-// Codex's safe default is SANDBOXED (no skip): the autonomous-bypass flag is gated until verified (#66), so
-// skipPermissions would throw at construction. `codex exec` still runs non-interactively under its own sandbox.
+// Keep Claude's project path checks enabled and expose only file/search tools.
+// Bash, web, task, and MCP tools remain unavailable.
+const CLAUDE_DEFAULT_AGENT_OPTIONS = {
+    permissionMode: 'acceptEdits',
+    tools: CLAUDE_SAFE_AUTONOMOUS_TOOLS,
+};
+// Codex workspace-write prevents host writes but does not contain host reads. It therefore remains explicit.
 const CODEX_DEFAULT_AGENT_OPTIONS = {};
-// Cursor's safe default keeps skip OFF (#66 SCAFFOLD). The runner is flag-confirmed via `cursor-agent --help`
-// but not yet run-verified end to end (needs an authed cursor-agent). The `-p --force --trust` bypass would
-// auto-approve shell+write, but Cursor has no verified per-run allowlist/sandbox mapping yet, so skipPermissions
-// is refused outright. Use default cursor with worktree isolation until the CLI is run-verified.
+// Cursor has no verified host filesystem/network sandbox. Worktree isolation cannot safely authorize `--trust`.
 const CURSOR_DEFAULT_AGENT_OPTIONS = {};
 // Gemini's verified safe default is `--approval-mode auto_edit`; shell remains gated and --yolo is refused.
 const GEMINI_DEFAULT_AGENT_OPTIONS = {};
-/** Per-runner safe default agent options — claude bypasses-with-bounds; codex + cursor stay non-bypassing (codex sandboxed; cursor skip refused, #66). */
+/** Per-runner safe default agent options. Host permission bypass is never enabled by default. */
 function defaultAgentOptions(runner) {
     if (runner === 'codex')
         return CODEX_DEFAULT_AGENT_OPTIONS;
@@ -55,13 +55,62 @@ function defaultAgentOptions(runner) {
         return GEMINI_DEFAULT_AGENT_OPTIONS;
     return CLAUDE_DEFAULT_AGENT_OPTIONS;
 }
+export class UnsupportedCursorAutonomousIsolationError extends Error {
+    constructor() {
+        super('Autonomous Cursor cannot use worktree isolation because --trust grants host filesystem and network access');
+        this.name = 'UnsupportedCursorAutonomousIsolationError';
+    }
+}
+export class UnsupportedAutonomousHostAccessError extends Error {
+    constructor() {
+        super('Autonomous Claude requires project-scoped acceptEdits with bounded file/search tools; host access bypass or unsupported tools are forbidden because a worktree is not a security boundary');
+        this.name = 'UnsupportedAutonomousHostAccessError';
+    }
+}
+export class UnsupportedAutonomousClaudeRunnerError extends Error {
+    constructor() {
+        super('Autonomous claude is disabled because its headless edit mode has no verified host filesystem sandbox; inject an externally sandboxed agent or explicitly select a runner after reviewing its host-access boundary');
+        this.name = 'UnsupportedAutonomousClaudeRunnerError';
+    }
+}
+export class UnsupportedAutonomousCodexRunnerError extends Error {
+    constructor() {
+        super('Autonomous codex is disabled because workspace-write does not restrict host filesystem reads; inject an externally sandboxed agent');
+        this.name = 'UnsupportedAutonomousCodexRunnerError';
+    }
+}
+export function resolveAutonomousAgentOptions(runner, isolation, overrides) {
+    const options = {
+        ...defaultAgentOptions(runner),
+        ...(isolation !== 'none' ? { workspaceTrust: 'isolated-worktree' } : {}),
+        ...(overrides ?? {}),
+    };
+    if (runner === 'cursor' && isolation !== 'none') {
+        throw new UnsupportedCursorAutonomousIsolationError();
+    }
+    const effectiveRunner = runner ?? 'claude';
+    const unsafeClaudeOptions = effectiveRunner === 'claude' && !hasBoundedClaudeFileAccess(options);
+    if (unsafeClaudeOptions) {
+        throw new UnsupportedAutonomousHostAccessError();
+    }
+    return options;
+}
 /**
  * Build the fully-hardened `execute` for an autonomous run against `repo`. Composes every exec-bridge control
  * with secure defaults so they can't be forgotten piecemeal: deny-by-default allowedRoots (#41) + worktree
- * isolation (#43) + env scrub (#42) + bounded skip-permissions agent (#38/#40) + trusted-gene gate fed by
+ * isolation (#43) + env scrub (#42) + non-bypassing agent permissions (#38/#40) + trusted-gene gate fed by
  * provenance (#45/#30). Pass the result as runEvolutionCycle's `execute`.
  */
 export function makeSafeExecute(repo, store, safety, opts = {}) {
+    const runner = safety.runner ?? (opts.agent ? undefined : 'claude');
+    if (safety.resume && runner)
+        validateAgentSessionResume(safety.resume, runner);
+    if (!opts.agent && runner === 'claude') {
+        throw new UnsupportedAutonomousClaudeRunnerError();
+    }
+    if (!opts.agent && runner === 'codex') {
+        throw new UnsupportedAutonomousCodexRunnerError();
+    }
     return makeClaudeExecBridge({
         cwd: repo,
         enabled: true,
@@ -69,11 +118,12 @@ export function makeSafeExecute(repo, store, safety, opts = {}) {
         ...(opts.git ? { git: opts.git } : {}),
         ...(opts.traceRecorder ? { traceRecorder: opts.traceRecorder } : {}),
         allowedRoots: safety.allowedRoots,
-        ...(safety.runner ? { runner: safety.runner } : {}),
+        ...(runner ? { runner } : {}),
+        ...(safety.resume ? { resume: safety.resume } : {}),
         ...(safety.isolation === 'none' ? {} : { isolation: 'worktree' }),
         scrubEnv: safety.scrubEnv ?? true,
         requireTrustedGene: safety.requireTrustedGene ?? true,
-        agentOptions: safety.agentOptions ?? defaultAgentOptions(safety.runner),
+        agentOptions: resolveAutonomousAgentOptions(runner, safety.isolation, safety.agentOptions),
         ...(safety.timeoutMs !== undefined ? { timeoutMs: safety.timeoutMs } : {}),
         ...(safety.signal ? { signal: safety.signal } : {}),
         resolveGene: makeTrustedGeneResolver(store, opts.provenance, opts.review, opts.includeProbation ?? false),

package/dist/exec/claudeBridge.d.ts

@@ -4,9 +4,9 @@ import type { ExecutionResult } from '../algo/cycleEngine.js';
 import { type GeneStrategyInfo } from './prompt.js';
 import type { PersonalityStore } from '../personality/store.js';
 import type { AgentRunTraceRecorder } from '../trace/learningTrace.js';
-import { type AgentRunner, type AgentRunnerOptions, type RunnerName } from './runnerRegistry.js';
-export { resolveSpawnCommand, spawnCapture, DEFAULT_MAX_CAPTURE_BYTES, UnboundedSkipPermissionsError, UnsupportedCursorSkipPermissionsError, UnsupportedGeminiPermissionOptionsError, claudeRunnerArgs, makeClaudeHeadlessRunner, claudeHeadlessRunner, codexRunnerArgs, makeCodexHeadlessRunner, cursorRunnerArgs, makeCursorHeadlessRunner, getRunnerSpec, geminiRunnerArgs, makeGeminiHeadlessRunner, classifyGeminiRunnerResult, } from './runnerRegistry.js';
-export type { AgentRunContext, AgentRunResult, AgentRunner, RunnerName, AgentRunnerOptions, ClaudeRunnerOptions, CodexRunnerOptions, AgentRunnerSpec, } from './runnerRegistry.js';
+import { type AgentRunner, type AgentRunnerOptions, type AgentSessionResume, type RunnerName } from './runnerRegistry.js';
+export { resolveSpawnCommand, spawnCapture, DEFAULT_MAX_CAPTURE_BYTES, MAX_AGENT_SESSION_ID_CHARS, AgentSessionResumeError, validateAgentSessionResume, UnboundedSkipPermissionsError, UnsupportedCodexPermissionOptionsError, UnsupportedCursorAllowedToolsError, UnsupportedCursorSkipPermissionsError, UnsupportedCursorWorkspaceTrustError, UnsupportedGeminiPermissionOptionsError, claudeRunnerArgs, makeClaudeHeadlessRunner, claudeHeadlessRunner, codexRunnerArgs, makeCodexHeadlessRunner, cursorRunnerArgs, makeCursorHeadlessRunner, getRunnerSpec, hasBoundedClaudeFileAccess, CLAUDE_SAFE_AUTONOMOUS_TOOLS, geminiRunnerArgs, makeGeminiHeadlessRunner, classifyGeminiRunnerResult, } from './runnerRegistry.js';
+export type { AgentRunContext, AgentRunResult, AgentRunner, RunnerName, AgentRunnerOptions, ClaudeRunnerOptions, CodexRunnerOptions, AgentRunnerSpec, AgentSessionResume, } from './runnerRegistry.js';
 export interface GitRunnerOptions {
     processSignalMode?: 'cancel' | 'ignore';
 }
@@ -32,6 +32,8 @@ export interface ExecBridgeOptions {
     agent?: AgentRunner;
     /** Which built-in runner to use when `agent` is not injected (#66). Default 'claude' (byte-identical). cursor is a scaffold (unverified runner). */
     runner?: RunnerName;
+    /** Explicit native session continuation. Must name the same runner selected above. */
+    resume?: AgentSessionResume;
     /** When `agent` is not injected, options for the built-in headless runner (permission bypass / allowed tools / model). */
     agentOptions?: AgentRunnerOptions;
     /** Default: spawns `git`. Inject a fake in tests. */
@@ -105,19 +107,33 @@ export declare class ExecBridgeForbiddenError extends Error {
  * Thrown when a FULL-ACCESS (or unverified) agent run is requested without worktree isolation. The throwaway
  * worktree is the containment WE control — allowedRoots gates the cwd but cannot stop an auto-approved or
  * unsandboxed process writing/running outside it. Gated runners:
- *  - codex with skipPermissions → `--sandbox danger-full-access` (no inner OS sandbox). Without skip it stays
- *    workspace-write, so only the skip path is gated.
+ *  - codex permission overrides are refused by the runner because it has no enforceable per-tool allowlist.
  *  - cursor default → gated UNCONDITIONALLY. cursor-agent base `-p` already documents write+shell access, cursor
  *    skipPermissions is rejected by the runner layer, and the scaffold remains unverified (#66/#181) — so default
  *    cursor still needs the wrapper worktree rather than risk mutating the real tree.
- * claude is exempt: its skip is bounded by --allowedTools (finding #80).
+ * Claude is fail-closed below because a tool-name allowlist does not constrain absolute filesystem paths.
  */
 export declare class UnsandboxedFullAccessRequiresIsolationError extends Error {
     constructor();
 }
+export declare class WorkspaceTrustRequiresIsolationError extends Error {
+    readonly code = "WORKSPACE_TRUST_REQUIRES_ISOLATION";
+    constructor();
+}
+export declare class UnsupportedCursorBuiltInRunnerError extends Error {
+    constructor();
+}
+export declare class UnsupportedClaudeBuiltInRunnerError extends Error {
+    constructor();
+}
+export declare class UnsupportedCodexBuiltInRunnerError extends Error {
+    constructor();
+}
 export declare class UnsafeWorktreePathError extends Error {
     constructor(reason: string);
 }
+/** Whether `child` is the same as, or nested under, `root`, including filesystem symlink resolution. */
+export declare function isWithinRoot(child: string, root: string): boolean;
 /**
  * Whitelist-filter `env` for a spawned agent/tool: keep ONLY the minimal runtime env + the caller-declared
  * extras (the runner's own auth via allowPrefixes/allowKeys); drop everything else. Fail-safe by construction —
@@ -134,4 +150,6 @@ export declare const defaultGitPatchWriter: GitPatchWriter;
  * Build the `execute` function CycleEngine/runEvolutionCycle consume. Default-off: throws
  * ExecBridgeDisabledError on first call unless enabled.
  */
-export declare function makeClaudeExecBridge(opts: ExecBridgeOptions): (mutation: Mutation, decision: GeneDecision) => Promise<ExecutionResult>;
+export declare function makeClaudeExecBridge(opts: ExecBridgeOptions, internal?: {
+    cursorWorktreeRoot?: string;
+}): (mutation: Mutation, decision: GeneDecision) => Promise<ExecutionResult>;