@evomap/evolver-core 2.0.0-beta.2 → 2.0.0-beta.22

package/dist/exec/autonomousCycle.d.ts

@@ -4,8 +4,10 @@ import type { ReviewLedger } from '../assetstore/reviewLedger.js';
 import type { Mutation } from '../wire/index.js';
 import type { GeneDecision } from '../algo/geneSelection.js';
 import type { ExecutionResult } from '../algo/cycleEngine.js';
-import { type GeneResolver, type ValidateHook, type AgentRunnerOptions, type RunnerName, type AgentRunner, type GitRunner } from './claudeBridge.js';
+import { type GeneResolver, type ValidateHook, type AgentRunnerOptions, type AgentSessionResume, type RunnerName, type AgentRunner, type GitRunner } from './claudeBridge.js';
 import type { PersonalityStore } from '../personality/store.js';
+import type { AgentRunTraceRecorder } from '../trace/learningTrace.js';
+import type { ExecutionObserver } from './claudeBridge.js';
 /**
  * Resolve a gene's strategy from the store and whether it is safe to EMBED into an autonomous agent's prompt —
  * the exec-side link from #30 (provenance ledger) and the review-state gate to #45 (requireTrustedGene gate). A
@@ -18,9 +20,11 @@ export declare function makeTrustedGeneResolver(store: AssetStoreProvider, prove
 export interface AutonomousSafety {
     /** Deny-by-default repo allowlist (#41). Required — an empty array refuses everything. */
     allowedRoots: readonly string[];
-    /** Which built-in runner (#66). Default 'claude'. The same safety controls wrap whichever runner. cursor is a scaffold (unverified). */
+    /** Which built-in runner (#66). Default 'codex'. The same safety controls wrap whichever runner. cursor is a scaffold (unverified). */
     runner?: RunnerName;
-    /** Agent runner options (#38/#40). Default: bounded skip-permissions (Read/Edit/Write). */
+    /** Explicit opt-in to continue a native session owned by the selected runner. */
+    resume?: AgentSessionResume;
+    /** Agent runner options (#38/#40). Default: no pre-authorized host access. */
     agentOptions?: AgentRunnerOptions;
     /** Strip evolver/hub secrets from the agent env (#42). Default true. */
     scrubEnv?: boolean;
@@ -29,11 +33,26 @@ export interface AutonomousSafety {
     /** Only embed trusted gene strategies (#45). Default true. */
     requireTrustedGene?: boolean;
     timeoutMs?: number;
+    /** Cooperative cancellation propagated to the spawned runner process tree. */
+    signal?: AbortSignal;
 }
+export declare class UnsupportedCursorAutonomousIsolationError extends Error {
+    constructor();
+}
+export declare class UnsupportedAutonomousHostAccessError extends Error {
+    constructor();
+}
+export declare class UnsupportedAutonomousClaudeRunnerError extends Error {
+    constructor();
+}
+export declare class UnsupportedAutonomousCodexRunnerError extends Error {
+    constructor();
+}
+export declare function resolveAutonomousAgentOptions(runner: RunnerName | undefined, isolation: AutonomousSafety['isolation'], overrides?: AgentRunnerOptions): AgentRunnerOptions;
 /**
  * Build the fully-hardened `execute` for an autonomous run against `repo`. Composes every exec-bridge control
  * with secure defaults so they can't be forgotten piecemeal: deny-by-default allowedRoots (#41) + worktree
- * isolation (#43) + env scrub (#42) + bounded skip-permissions agent (#38/#40) + trusted-gene gate fed by
+ * isolation (#43) + env scrub (#42) + non-bypassing agent permissions (#38/#40) + trusted-gene gate fed by
  * provenance (#45/#30). Pass the result as runEvolutionCycle's `execute`.
  */
 export declare function makeSafeExecute(repo: string, store: AssetStoreProvider, safety: AutonomousSafety, opts?: {
@@ -45,4 +64,12 @@ export declare function makeSafeExecute(repo: string, store: AssetStoreProvider,
     personality?: PersonalityStore;
     agent?: AgentRunner;
     git?: GitRunner;
+    /** Optional learning-trace recorder forwarded to the exec bridge (Learning Ops slice 2). */
+    traceRecorder?: AgentRunTraceRecorder;
+    executionObserver?: ExecutionObserver;
+    executionLimits?: {
+        maxRuntimeMs: number;
+        maxFiles: number;
+        maxLines: number;
+    };
 }): (mutation: Mutation, decision: GeneDecision) => Promise<ExecutionResult>;

package/dist/exec/autonomousCycle.js

@@ -1,4 +1,4 @@
-import { makeClaudeExecBridge } from './claudeBridge.js';
+import { CLAUDE_SAFE_AUTONOMOUS_TOOLS, hasBoundedClaudeFileAccess, makeClaudeExecBridge, validateAgentSessionResume } from './claudeBridge.js';
 const asStrings = (v) => (Array.isArray(v) ? v.filter((x) => typeof x === 'string') : []);
 /**
  * Resolve a gene's strategy from the store and whether it is safe to EMBED into an autonomous agent's prompt —
@@ -33,43 +33,101 @@ export function makeTrustedGeneResolver(store, provenance, review, includeProbat
         return info;
     };
 }
-// Claude's safe default: bypass the permission prompts but BOUND the agent to file edits (#38/#40).
-const CLAUDE_DEFAULT_AGENT_OPTIONS = { skipPermissions: true, allowedTools: ['Read', 'Edit', 'Write'] };
-// Codex's safe default is SANDBOXED (no skip): the autonomous-bypass flag is gated until verified (#66), so
-// skipPermissions would throw at construction. `codex exec` still runs non-interactively under its own sandbox.
+// Keep Claude's project path checks enabled and expose only file/search tools.
+// Bash, web, task, and MCP tools remain unavailable.
+const CLAUDE_DEFAULT_AGENT_OPTIONS = {
+    permissionMode: 'acceptEdits',
+    tools: CLAUDE_SAFE_AUTONOMOUS_TOOLS,
+};
+// Codex workspace-write prevents host writes but does not contain host reads. It therefore remains explicit.
 const CODEX_DEFAULT_AGENT_OPTIONS = {};
-// Cursor's safe default keeps skip OFF (#66 SCAFFOLD). The runner is flag-confirmed via `cursor-agent --help`
-// but not yet run-verified end to end (needs an authed cursor-agent). The `-p --force --trust` bypass would
-// auto-approve shell+write, but Cursor has no verified per-run allowlist/sandbox mapping yet, so skipPermissions
-// is refused outright. Use default cursor with worktree isolation until the CLI is run-verified.
+// Cursor has no verified host filesystem/network sandbox. Worktree isolation cannot safely authorize `--trust`.
 const CURSOR_DEFAULT_AGENT_OPTIONS = {};
-/** Per-runner safe default agent options — claude bypasses-with-bounds; codex + cursor stay non-bypassing (codex sandboxed; cursor skip refused, #66). */
+// Gemini's verified safe default is `--approval-mode auto_edit`; shell remains gated and --yolo is refused.
+const GEMINI_DEFAULT_AGENT_OPTIONS = {};
+/** Per-runner safe default agent options. Host permission bypass is never enabled by default. */
 function defaultAgentOptions(runner) {
     if (runner === 'codex')
         return CODEX_DEFAULT_AGENT_OPTIONS;
     if (runner === 'cursor')
         return CURSOR_DEFAULT_AGENT_OPTIONS;
+    if (runner === 'gemini')
+        return GEMINI_DEFAULT_AGENT_OPTIONS;
     return CLAUDE_DEFAULT_AGENT_OPTIONS;
 }
+export class UnsupportedCursorAutonomousIsolationError extends Error {
+    constructor() {
+        super('Autonomous Cursor cannot use worktree isolation because --trust grants host filesystem and network access');
+        this.name = 'UnsupportedCursorAutonomousIsolationError';
+    }
+}
+export class UnsupportedAutonomousHostAccessError extends Error {
+    constructor() {
+        super('Autonomous Claude requires project-scoped acceptEdits with bounded file/search tools; host access bypass or unsupported tools are forbidden because a worktree is not a security boundary');
+        this.name = 'UnsupportedAutonomousHostAccessError';
+    }
+}
+export class UnsupportedAutonomousClaudeRunnerError extends Error {
+    constructor() {
+        super('Autonomous claude is disabled because its headless edit mode has no verified host filesystem sandbox; inject an externally sandboxed agent or explicitly select a runner after reviewing its host-access boundary');
+        this.name = 'UnsupportedAutonomousClaudeRunnerError';
+    }
+}
+export class UnsupportedAutonomousCodexRunnerError extends Error {
+    constructor() {
+        super('Autonomous codex is disabled because workspace-write does not restrict host filesystem reads; inject an externally sandboxed agent');
+        this.name = 'UnsupportedAutonomousCodexRunnerError';
+    }
+}
+export function resolveAutonomousAgentOptions(runner, isolation, overrides) {
+    const options = {
+        ...defaultAgentOptions(runner),
+        ...(isolation !== 'none' ? { workspaceTrust: 'isolated-worktree' } : {}),
+        ...(overrides ?? {}),
+    };
+    if (runner === 'cursor' && isolation !== 'none') {
+        throw new UnsupportedCursorAutonomousIsolationError();
+    }
+    const effectiveRunner = runner ?? 'claude';
+    const unsafeClaudeOptions = effectiveRunner === 'claude' && !hasBoundedClaudeFileAccess(options);
+    if (unsafeClaudeOptions) {
+        throw new UnsupportedAutonomousHostAccessError();
+    }
+    return options;
+}
 /**
  * Build the fully-hardened `execute` for an autonomous run against `repo`. Composes every exec-bridge control
  * with secure defaults so they can't be forgotten piecemeal: deny-by-default allowedRoots (#41) + worktree
- * isolation (#43) + env scrub (#42) + bounded skip-permissions agent (#38/#40) + trusted-gene gate fed by
+ * isolation (#43) + env scrub (#42) + non-bypassing agent permissions (#38/#40) + trusted-gene gate fed by
  * provenance (#45/#30). Pass the result as runEvolutionCycle's `execute`.
  */
 export function makeSafeExecute(repo, store, safety, opts = {}) {
+    const runner = safety.runner ?? (opts.agent ? undefined : 'claude');
+    if (safety.resume && runner)
+        validateAgentSessionResume(safety.resume, runner);
+    if (!opts.agent && runner === 'claude') {
+        throw new UnsupportedAutonomousClaudeRunnerError();
+    }
+    if (!opts.agent && runner === 'codex') {
+        throw new UnsupportedAutonomousCodexRunnerError();
+    }
     return makeClaudeExecBridge({
         cwd: repo,
         enabled: true,
         ...(opts.agent ? { agent: opts.agent } : {}),
         ...(opts.git ? { git: opts.git } : {}),
+        ...(opts.traceRecorder ? { traceRecorder: opts.traceRecorder } : {}),
+        ...(opts.executionObserver ? { executionObserver: opts.executionObserver } : {}),
+        ...(opts.executionLimits ? { executionLimits: opts.executionLimits } : {}),
         allowedRoots: safety.allowedRoots,
-        ...(safety.runner ? { runner: safety.runner } : {}),
+        ...(runner ? { runner } : {}),
+        ...(safety.resume ? { resume: safety.resume } : {}),
         ...(safety.isolation === 'none' ? {} : { isolation: 'worktree' }),
         scrubEnv: safety.scrubEnv ?? true,
         requireTrustedGene: safety.requireTrustedGene ?? true,
-        agentOptions: safety.agentOptions ?? defaultAgentOptions(safety.runner),
+        agentOptions: resolveAutonomousAgentOptions(runner, safety.isolation, safety.agentOptions),
         ...(safety.timeoutMs !== undefined ? { timeoutMs: safety.timeoutMs } : {}),
+        ...(safety.signal ? { signal: safety.signal } : {}),
         resolveGene: makeTrustedGeneResolver(store, opts.provenance, opts.review, opts.includeProbation ?? false),
         ...(opts.validate ? { validate: opts.validate } : {}),
         ...(opts.validationCmds ? { validationCmds: opts.validationCmds } : {}),

package/dist/exec/claudeBridge.d.ts

@@ -3,21 +3,34 @@ import type { GeneDecision } from '../algo/geneSelection.js';
 import type { ExecutionResult } from '../algo/cycleEngine.js';
 import { type GeneStrategyInfo } from './prompt.js';
 import type { PersonalityStore } from '../personality/store.js';
-import { type AgentRunner, type AgentRunnerOptions, type RunnerName } from './runnerRegistry.js';
-export { resolveSpawnCommand, spawnCapture, UnboundedSkipPermissionsError, UnsupportedCursorSkipPermissionsError, claudeRunnerArgs, makeClaudeHeadlessRunner, claudeHeadlessRunner, codexRunnerArgs, makeCodexHeadlessRunner, cursorRunnerArgs, makeCursorHeadlessRunner, getRunnerSpec, } from './runnerRegistry.js';
-export type { AgentRunContext, AgentRunResult, AgentRunner, RunnerName, AgentRunnerOptions, ClaudeRunnerOptions, CodexRunnerOptions, AgentRunnerSpec, } from './runnerRegistry.js';
+import type { AgentRunTraceRecorder } from '../trace/learningTrace.js';
+import type { PolicyDecision, ProofReference, ToolDecision, ValidatorEvidence } from './executionBinding.js';
+import { type AgentRunner, type AgentRunnerOptions, type AgentSessionResume, type RunnerName } from './runnerRegistry.js';
+export { resolveSpawnCommand, spawnCapture, DEFAULT_MAX_CAPTURE_BYTES, MAX_AGENT_SESSION_ID_CHARS, AgentSessionResumeError, validateAgentSessionResume, UnboundedSkipPermissionsError, UnsupportedCodexPermissionOptionsError, UnsupportedCursorAllowedToolsError, UnsupportedCursorSkipPermissionsError, UnsupportedCursorWorkspaceTrustError, UnsupportedGeminiPermissionOptionsError, claudeRunnerArgs, makeClaudeHeadlessRunner, claudeHeadlessRunner, codexRunnerArgs, makeCodexHeadlessRunner, cursorRunnerArgs, makeCursorHeadlessRunner, getRunnerSpec, hasBoundedClaudeFileAccess, CLAUDE_SAFE_AUTONOMOUS_TOOLS, geminiRunnerArgs, makeGeminiHeadlessRunner, classifyGeminiRunnerResult, } from './runnerRegistry.js';
+export type { AgentRunContext, AgentRunResult, AgentRunner, RunnerName, AgentRunnerOptions, ClaudeRunnerOptions, CodexRunnerOptions, AgentRunnerSpec, AgentSessionResume, } from './runnerRegistry.js';
+export interface GitRunnerOptions {
+    processSignalMode?: 'cancel' | 'ignore';
+}
 /** Run a git subcommand in cwd and return its stdout. */
-export type GitRunner = (args: readonly string[], cwd: string) => Promise<string>;
+export type GitRunner = (args: readonly string[], cwd: string, signal?: AbortSignal, options?: GitRunnerOptions) => Promise<string>;
+export type GitPatchWriter = (args: readonly string[], cwd: string, destination: string, signal?: AbortSignal, 
+/** Call immediately after this writer exclusively creates `destination`. */
+onDestinationOpened?: () => void) => Promise<void>;
 /** Resolve the selected gene's learned strategy (for prompt enrichment). */
 export type GeneResolver = (geneId: string) => Promise<GeneStrategyInfo | null> | GeneStrategyInfo | null;
 /** Decide success from the post-run working tree (e.g. run the gene's validation plan). */
-export type ValidateHook = (mutation: Mutation, decision: GeneDecision, cwd: string) => Promise<{
-    passed: boolean;
-    score?: number;
-}> | {
+export interface ValidateHookResult {
     passed: boolean;
     score?: number;
-};
+    validator?: ValidatorEvidence;
+}
+export type ValidateHook = (mutation: Mutation, decision: GeneDecision, cwd: string, signal: AbortSignal) => Promise<ValidateHookResult> | ValidateHookResult;
+export interface ExecutionObserver {
+    onToolDecision?(decision: ToolDecision, signal?: AbortSignal): Promise<void> | void;
+    onPolicyDecision?(decision: PolicyDecision, signal?: AbortSignal): Promise<void> | void;
+    onValidatorDecision?(decision: ValidatorEvidence, signal?: AbortSignal): Promise<void> | void;
+    onProofReference?(reference: ProofReference, signal?: AbortSignal): Promise<void> | void;
+}
 export interface ExecBridgeOptions {
     /** Working directory the agent edits and git is measured in. */
     cwd: string;
@@ -25,10 +38,18 @@ export interface ExecBridgeOptions {
     agent?: AgentRunner;
     /** Which built-in runner to use when `agent` is not injected (#66). Default 'claude' (byte-identical). cursor is a scaffold (unverified runner). */
     runner?: RunnerName;
+    /** Explicit native session continuation. Must name the same runner selected above. */
+    resume?: AgentSessionResume;
     /** When `agent` is not injected, options for the built-in headless runner (permission bypass / allowed tools / model). */
     agentOptions?: AgentRunnerOptions;
     /** Default: spawns `git`. Inject a fake in tests. */
     git?: GitRunner;
+    /** Optional complete-patch sink. The default streams built-in git output directly to disk. */
+    gitPatchWriter?: GitPatchWriter;
+    /** Test seam for fallback patch persistence; production callers should use the exclusive private writer. */
+    writePatchFile?: (path: string, patch: string) => void;
+    /** Test seam for temporary patch cleanup; production callers should use the filesystem default. */
+    removePatchFile?: (path: string) => void;
     /** Default: EVOLVE_EXEC_BRIDGE === '1'. Set true to force-enable (e.g. integration tests). */
     enabled?: boolean;
     /**
@@ -45,7 +66,7 @@ export interface ExecBridgeOptions {
     /**
      * Run the agent in a throwaway git worktree of `cwd` instead of the repo's real working tree (finding #39.4):
      * the agent's edits land in an isolated checkout, never touching the user's working tree. The diff is measured
-     * there, captured as a patch (proof.gitDiff.patchRef), and the worktree is removed. `cwd` must be a git repo.
+     * there, captured as a patch (proof.git_diff.patch_ref), and the worktree is removed. `cwd` must be a git repo.
      */
     isolation?: 'worktree';
     /**
@@ -57,12 +78,22 @@ export interface ExecBridgeOptions {
     requireTrustedGene?: boolean;
     /** Per-run agent timeout. Default 600_000ms (10 min). */
     timeoutMs?: number;
+    /** Cooperative cancellation propagated to the runner process tree. */
+    signal?: AbortSignal;
+    /** Binding hard limits are intersected with the existing policy/runner controls; never widen local safety. */
+    executionLimits?: {
+        maxRuntimeMs: number;
+        maxFiles: number;
+        maxLines: number;
+    };
     /** Optional: enrich the prompt with the selected gene's strategy. */
     resolveGene?: GeneResolver;
     /** Optional: validation commands surfaced in the prompt's done-criteria. */
     validationCmds?: readonly string[];
     /** Optional: authoritative success decision after the agent runs. Falls back to "agent ok + produced a diff". */
     validate?: ValidateHook;
+    /** Bound execution provenance observer. Failures are authoritative and fail the execution closed. */
+    executionObserver?: ExecutionObserver;
     /**
      * Optional evolvable personality (use-case ①): when set, the agent prompt gets a behavioral-style block
      * rendered from the store's CURRENT persisted state. CycleEngine's applySelectForRun has already run and
@@ -72,6 +103,12 @@ export interface ExecBridgeOptions {
      * the store's default state (store.load never throws), it never fails the run.
      */
     personality?: PersonalityStore;
+    /**
+     * Optional learning-trace recorder (Learning Ops slice 2): when set, the bridge emits `model.called` around
+     * each agent spawn and `tool.failed`/`retry.attempted` metadata on failures. Best-effort observability — a
+     * recorder/sink failure must never affect the execution result, so every emission is wrapped defensively.
+     */
+    traceRecorder?: AgentRunTraceRecorder;
 }
 export declare class ExecBridgeDisabledError extends Error {
     constructor();
@@ -84,16 +121,33 @@ export declare class ExecBridgeForbiddenError extends Error {
  * Thrown when a FULL-ACCESS (or unverified) agent run is requested without worktree isolation. The throwaway
  * worktree is the containment WE control — allowedRoots gates the cwd but cannot stop an auto-approved or
  * unsandboxed process writing/running outside it. Gated runners:
- *  - codex with skipPermissions → `--sandbox danger-full-access` (no inner OS sandbox). Without skip it stays
- *    workspace-write, so only the skip path is gated.
+ *  - codex permission overrides are refused by the runner because it has no enforceable per-tool allowlist.
  *  - cursor default → gated UNCONDITIONALLY. cursor-agent base `-p` already documents write+shell access, cursor
  *    skipPermissions is rejected by the runner layer, and the scaffold remains unverified (#66/#181) — so default
  *    cursor still needs the wrapper worktree rather than risk mutating the real tree.
- * claude is exempt: its skip is bounded by --allowedTools (finding #80).
+ * Claude is fail-closed below because a tool-name allowlist does not constrain absolute filesystem paths.
  */
 export declare class UnsandboxedFullAccessRequiresIsolationError extends Error {
     constructor();
 }
+export declare class WorkspaceTrustRequiresIsolationError extends Error {
+    readonly code = "WORKSPACE_TRUST_REQUIRES_ISOLATION";
+    constructor();
+}
+export declare class UnsupportedCursorBuiltInRunnerError extends Error {
+    constructor();
+}
+export declare class UnsupportedClaudeBuiltInRunnerError extends Error {
+    constructor();
+}
+export declare class UnsupportedCodexBuiltInRunnerError extends Error {
+    constructor();
+}
+export declare class UnsafeWorktreePathError extends Error {
+    constructor(reason: string);
+}
+/** Whether `child` is the same as, or nested under, `root`, including filesystem symlink resolution. */
+export declare function isWithinRoot(child: string, root: string): boolean;
 /**
  * Whitelist-filter `env` for a spawned agent/tool: keep ONLY the minimal runtime env + the caller-declared
  * extras (the runner's own auth via allowPrefixes/allowKeys); drop everything else. Fail-safe by construction —
@@ -103,10 +157,21 @@ export declare function scrubAgentEnv(env: NodeJS.ProcessEnv, opts?: {
     allowKeys?: readonly string[];
     allowPrefixes?: readonly string[];
 }): NodeJS.ProcessEnv;
-/** Default git runner: spawn `git <args>` in cwd, return stdout (empty string on error). Env scrubbed — git never needs evolver/hub secrets. */
+/**
+ * 绑定执行不能接受无法收到权威截止时间取消信号的旧验证器或写入器。
+ * AbortSignal 本身是协作式的；先拒绝不暴露该信号的回调，避免旧 hook
+ * 被静默地当作无界工作运行。
+ */
+export declare class ExecBridgeCancellationContractError extends Error {
+    constructor(hook: 'validate' | 'gitPatchWriter');
+}
+/** Default git runner: every incomplete command result fails closed. */
 export declare const defaultGitRunner: GitRunner;
+export declare const defaultGitPatchWriter: GitPatchWriter;
 /**
  * Build the `execute` function CycleEngine/runEvolutionCycle consume. Default-off: throws
  * ExecBridgeDisabledError on first call unless enabled.
  */
-export declare function makeClaudeExecBridge(opts: ExecBridgeOptions): (mutation: Mutation, decision: GeneDecision) => Promise<ExecutionResult>;
+export declare function makeClaudeExecBridge(opts: ExecBridgeOptions, internal?: {
+    cursorWorktreeRoot?: string;
+}): (mutation: Mutation, decision: GeneDecision) => Promise<ExecutionResult>;