@evomap/evolver-core 2.0.0-beta.6 → 2.0.0-beta.8

package/dist/algo/conversationSniffer.js

@@ -1,7 +1,11 @@
 import { createHash } from 'node:crypto';
 import { redactString } from '../hub/sanitize.js';
-const REUSABLE_RE = /\b(reusable|repeatable|workflow|playbook|runbook|capability|procedure|pattern|recipe|documented|future runs?|next time|can reuse|reuse this)\b|可复用|复用|能力|流程|工作流/i;
-const PROOF_RE = /\b(validated|verified|passed|green|success(?:ful|fully)?|succeeded|works?|completed|published|uploaded|recorded:true|exit code:?\s*0|all tests passed)\b|验证|通过|成功|已发布|可用/i;
+// The Chinese branches require compound/intentful phrases on purpose: everyday words (能力/流程/成功/通过)
+// occur in nearly every Chinese dev session, and matching them bare made this fallback the DOMINANT distill
+// path — 105 of 118 drafts in one bulk ingest (#562). English gets specificity from \b word boundaries;
+// Chinese has no \b, so specificity must come from the phrase itself.
+const REUSABLE_RE = /\b(reusable|repeatable|workflow|playbook|runbook|capability|procedure|pattern|recipe|documented|future runs?|next time|can reuse|reuse this)\b|复用|可重用|工作流|方法论|沉淀/i;
+const PROOF_RE = /\b(validated|verified|passed|green|success(?:ful|fully)?|succeeded|works?|completed|published|uploaded|recorded:true|exit code:?\s*0|all tests passed)\b|(?:验证|校验|测试|检查|构建|编译|运行|执行|部署|发布)(?:都|均|全部)?(?:通过|成功)|全部通过|跑通|已(?:验证|发布|上线)/i;
 const FAILURE_RE = /\b(failed|failure|error|exception|traceback|exit code:?\s*[1-9]|not working|unable to)\b|失败|错误|报错/i;
 const EXIT_ZERO_RE = /\bexit code:?\s*0\b/i;
 const EXIT_NON_ZERO_RE = /\bexit code:?\s*[1-9]\d*\b/i;

package/dist/events/paths.d.ts

@@ -1,22 +1,22 @@
 /** ~/.evomap, 可 EVOLVER_HOME/EVOMAP_HOME 覆盖. */
 export declare function evomapHome(env?: Readonly<Record<string, string | undefined>>): string;
-export declare function rootEventsPath(): string;
-export declare function mvDir(): string;
+export declare function rootEventsPath(env?: Readonly<Record<string, string | undefined>>): string;
+export declare function mvDir(env?: Readonly<Record<string, string | undefined>>): string;
 /** 可进化人格模型持久化文件 (五维向量 + 各键统计 + 变更历史). v1 personality_state.json 的 v2 落点. */
-export declare function personalityStatePath(): string;
-export declare function assetsDir(): string;
+export declare function personalityStatePath(env?: Readonly<Record<string, string | undefined>>): string;
+export declare function assetsDir(env?: Readonly<Record<string, string | undefined>>): string;
 /** M1 raw-material substrate (append-only jsonl consumed by the cycle). */
-export declare function materialDir(): string;
+export declare function materialDir(env?: Readonly<Record<string, string | undefined>>): string;
 /** MaterialStore backing file. */
-export declare function materialStorePath(): string;
+export declare function materialStorePath(env?: Readonly<Record<string, string | undefined>>): string;
 /** Per-source watermark cursor used to make re-ingest idempotent (file-level dedup). */
-export declare function materialWatermarkPath(): string;
+export declare function materialWatermarkPath(env?: Readonly<Record<string, string | undefined>>): string;
 /** Proxy LLM-trace day-files dir (`llm-trace-YYYYMMDD.jsonl`), the route-savings source for the value ledger.
  *  Mirrors the proxy's EVOLVER_LLM_TRACE_DIR default so the outreach layer reads what the proxy wrote. */
-export declare function tracesDir(): string;
+export declare function tracesDir(env?: Readonly<Record<string, string | undefined>>): string;
 /** Hub-asset audit trail (`asset_call_log.jsonl`): one JSONL line per hub-asset interaction (search hit/miss,
  *  reuse/reference, publish, review). Written best-effort by AssetCallLog; the desktop's RecallHistory / 召回历程
  *  reads it. Defaults to the evomap home root, beside assets/ + evolution/.
  *  NOTE(reuse/#234): confirm this matches where the proxy/RecallHistory reads — best-effort append, so a path
  *  mismatch degrades the audit line, never the reuse write itself. */
-export declare function assetCallLogPath(): string;
+export declare function assetCallLogPath(env?: Readonly<Record<string, string | undefined>>): string;

package/dist/events/paths.js

@@ -4,41 +4,41 @@ import { join } from 'node:path';
 export function evomapHome(env = process.env) {
     return env['EVOLVER_HOME'] ?? env['EVOMAP_HOME'] ?? join(homedir(), '.evomap');
 }
-export function rootEventsPath() {
-    return join(evomapHome(), 'evolution', 'root_events.jsonl');
+export function rootEventsPath(env = process.env) {
+    return join(evomapHome(env), 'evolution', 'root_events.jsonl');
 }
-export function mvDir() {
-    return join(evomapHome(), 'evolution', 'mv');
+export function mvDir(env = process.env) {
+    return join(evomapHome(env), 'evolution', 'mv');
 }
 /** 可进化人格模型持久化文件 (五维向量 + 各键统计 + 变更历史). v1 personality_state.json 的 v2 落点. */
-export function personalityStatePath() {
-    return join(evomapHome(), 'evolution', 'personality_state.json');
+export function personalityStatePath(env = process.env) {
+    return join(evomapHome(env), 'evolution', 'personality_state.json');
 }
-export function assetsDir() {
-    return join(evomapHome(), 'assets');
+export function assetsDir(env = process.env) {
+    return join(evomapHome(env), 'assets');
 }
 /** M1 raw-material substrate (append-only jsonl consumed by the cycle). */
-export function materialDir() {
-    return join(evomapHome(), 'evolution', 'material');
+export function materialDir(env = process.env) {
+    return join(evomapHome(env), 'evolution', 'material');
 }
 /** MaterialStore backing file. */
-export function materialStorePath() {
-    return join(materialDir(), 'material.jsonl');
+export function materialStorePath(env = process.env) {
+    return join(materialDir(env), 'material.jsonl');
 }
 /** Per-source watermark cursor used to make re-ingest idempotent (file-level dedup). */
-export function materialWatermarkPath() {
-    return join(materialDir(), 'watermark.json');
+export function materialWatermarkPath(env = process.env) {
+    return join(materialDir(env), 'watermark.json');
 }
 /** Proxy LLM-trace day-files dir (`llm-trace-YYYYMMDD.jsonl`), the route-savings source for the value ledger.
  *  Mirrors the proxy's EVOLVER_LLM_TRACE_DIR default so the outreach layer reads what the proxy wrote. */
-export function tracesDir() {
-    return process.env['EVOLVER_LLM_TRACE_DIR'] ?? join(evomapHome(), 'proxy', 'traces');
+export function tracesDir(env = process.env) {
+    return env['EVOLVER_LLM_TRACE_DIR'] ?? join(evomapHome(env), 'proxy', 'traces');
 }
 /** Hub-asset audit trail (`asset_call_log.jsonl`): one JSONL line per hub-asset interaction (search hit/miss,
  *  reuse/reference, publish, review). Written best-effort by AssetCallLog; the desktop's RecallHistory / 召回历程
  *  reads it. Defaults to the evomap home root, beside assets/ + evolution/.
  *  NOTE(reuse/#234): confirm this matches where the proxy/RecallHistory reads — best-effort append, so a path
  *  mismatch degrades the audit line, never the reuse write itself. */
-export function assetCallLogPath() {
-    return join(evomapHome(), 'asset_call_log.jsonl');
+export function assetCallLogPath(env = process.env) {
+    return join(evomapHome(env), 'asset_call_log.jsonl');
 }

package/dist/exec/claudeBridge.d.ts

@@ -108,6 +108,9 @@ export declare class ExecBridgeForbiddenError extends Error {
 export declare class UnsandboxedFullAccessRequiresIsolationError extends Error {
     constructor();
 }
+export declare class UnsafeWorktreePathError extends Error {
+    constructor(reason: string);
+}
 /**
  * Whitelist-filter `env` for a spawned agent/tool: keep ONLY the minimal runtime env + the caller-declared
  * extras (the runner's own auth via allowPrefixes/allowKeys); drop everything else. Fail-safe by construction —

package/dist/exec/claudeBridge.js

@@ -14,7 +14,7 @@
 import { randomUUID } from 'node:crypto';
 import { resolve as resolvePath, sep, join as joinPath } from 'node:path';
 import { tmpdir } from 'node:os';
-import { closeSync, existsSync, mkdtempSync, openSync, rmSync, writeFileSync } from 'node:fs';
+import { closeSync, lstatSync, mkdtempSync, openSync, realpathSync, rmdirSync, rmSync, writeFileSync, } from 'node:fs';
 import { renderExecPrompt } from './prompt.js';
 import { parseGitShortstat, gitDiffProof } from './proofOfWork.js';
 // Policy enforcement core (#107): checkPolicy runs the always-on global guards (blast hard cap +
@@ -55,6 +55,112 @@ export class UnsandboxedFullAccessRequiresIsolationError extends Error {
         this.name = 'UnsandboxedFullAccessRequiresIsolationError';
     }
 }
+export class UnsafeWorktreePathError extends Error {
+    constructor(reason) {
+        super(`worktree isolation refused: ${reason}`);
+        this.name = 'UnsafeWorktreePathError';
+    }
+}
+function errorCode(error) {
+    return typeof error === 'object' && error !== null && 'code' in error
+        ? String(error.code)
+        : undefined;
+}
+function assertPathAbsent(path) {
+    try {
+        lstatSync(path);
+    }
+    catch (error) {
+        if (errorCode(error) === 'ENOENT')
+            return;
+        throw error;
+    }
+    throw new UnsafeWorktreePathError('reserved destination already exists');
+}
+function reserveWorktreePath() {
+    // The random 0700 container is atomically created by the OS. The git destination remains absent inside it,
+    // so `git worktree add` cannot adopt an attacker-precreated path from the shared temp directory.
+    const container = mkdtempSync(joinPath(tmpdir(), 'evolver-wt-'));
+    const containerStat = lstatSync(container);
+    if (containerStat.isSymbolicLink() || !containerStat.isDirectory()) {
+        throw new UnsafeWorktreePathError('temporary reservation is not a real directory');
+    }
+    const workDir = joinPath(container, 'worktree');
+    assertPathAbsent(workDir);
+    return {
+        container,
+        containerDev: containerStat.dev,
+        containerIno: containerStat.ino,
+        workDir,
+        expectedRealPath: joinPath(realpathSync(container), 'worktree'),
+    };
+}
+function verifyWorktreePath(reservation) {
+    const stat = lstatSync(reservation.workDir);
+    if (stat.isSymbolicLink() || !stat.isDirectory()) {
+        throw new UnsafeWorktreePathError('git worktree destination is not a real directory');
+    }
+    if (realpathSync(reservation.workDir) !== reservation.expectedRealPath) {
+        throw new UnsafeWorktreePathError('git worktree destination resolves outside its reservation');
+    }
+    return { dev: stat.dev, ino: stat.ino };
+}
+function worktreePathStillOwned(reservation, identity) {
+    try {
+        const stat = lstatSync(reservation.workDir);
+        return !stat.isSymbolicLink()
+            && stat.isDirectory()
+            && stat.dev === identity.dev
+            && stat.ino === identity.ino
+            && realpathSync(reservation.workDir) === reservation.expectedRealPath;
+    }
+    catch {
+        return false;
+    }
+}
+function removeEmptyReservation(reservation) {
+    try {
+        const stat = lstatSync(reservation.container);
+        if (stat.isSymbolicLink() || !stat.isDirectory()
+            || stat.dev !== reservation.containerDev || stat.ino !== reservation.containerIno)
+            return;
+        rmdirSync(reservation.container);
+    }
+    catch (error) {
+        // Never recurse through a path that may have been replaced. Empty, owned reservations are the only thing
+        // removed directly; non-empty or already-gone containers are intentionally left for safe diagnosis.
+        if (!['ENOENT', 'ENOTEMPTY', 'EEXIST'].includes(errorCode(error) ?? ''))
+            throw error;
+    }
+}
+async function cleanupWorktreeReservation(reservation, identity, git, repoCwd) {
+    let cleanupIdentity = identity;
+    if (!cleanupIdentity) {
+        try {
+            cleanupIdentity = verifyWorktreePath(reservation);
+        }
+        catch (error) {
+            if (errorCode(error) !== 'ENOENT')
+                throw error;
+            // `git worktree add` may register metadata before failing without creating the destination. Give Git a
+            // signal-shielded chance to prune that partial registration, then reclaim only the still-empty container.
+            try {
+                await git(['worktree', 'remove', '--force', reservation.workDir], repoCwd, undefined, { processSignalMode: 'ignore' });
+            }
+            catch { /* no child exists, so an unregistered cleanup failure is harmless */ }
+            removeEmptyReservation(reservation);
+            return;
+        }
+    }
+    if (cleanupIdentity) {
+        if (!worktreePathStillOwned(reservation, cleanupIdentity)) {
+            throw new UnsafeWorktreePathError('verified worktree path changed before cleanup');
+        }
+        await git(['worktree', 'remove', '--force', reservation.workDir], repoCwd, undefined, { processSignalMode: 'ignore' });
+        assertPathAbsent(reservation.workDir);
+    }
+    removeEmptyReservation(reservation);
+}
 /** Whether `child` is the same as, or nested under, `root` (both resolved to absolute paths). */
 function isWithinRoot(child, root) {
     const c = resolvePath(child);
@@ -278,27 +384,26 @@ export function makeClaudeExecBridge(opts) {
             // use-case ①: inject the personality style block from the state applySelectForRun just persisted.
             ...(opts.personality ? { personality: opts.personality.currentState() } : {}),
         });
-        // Isolation: run in a throwaway git worktree so the agent's edits never touch the real working tree.
+        // Isolation: atomically reserve an unpredictable private temp container, then let git create the absent
+        // worktree path inside it. Cleanup is armed only after git succeeds and the resulting directory is verified.
         const isolate = opts.isolation === 'worktree';
         if (opts.signal?.aborted)
             return cancelledExecutionResult(undefined);
-        // Reserve a parent namespace atomically before handing its child path to Git. The parent stays owned until
-        // cleanup completes, so another run cannot reuse the worktree path between Git removal and disk cleanup.
-        const worktreeReservation = isolate ? mkdtempSync(joinPath(tmpdir(), 'evolver-wt-')) : undefined;
-        const workDir = worktreeReservation ? joinPath(worktreeReservation, 'worktree') : opts.cwd;
-        let worktreeRegistered = false;
+        const reservation = isolate ? reserveWorktreePath() : undefined;
+        const workDir = reservation?.workDir ?? opts.cwd;
+        let worktreeIdentity;
+        let result;
         let observedRun;
         let patchRef;
         let ownsPatchRef = false;
         let preservePatchRef = false;
         let failedProof;
-        const proofGit = async (args, cwd, onResolved) => {
+        const proofGit = async (args, cwd, checkCancellationAfter = true) => {
             if (opts.signal?.aborted)
                 throw new ExecBridgeRunCancelledError();
             try {
                 const output = await git(args, cwd, opts.signal);
-                onResolved?.();
-                if (opts.signal?.aborted)
+                if (checkCancellationAfter && opts.signal?.aborted)
                     throw new ExecBridgeRunCancelledError();
                 return output;
             }
@@ -311,8 +416,11 @@ export function makeClaudeExecBridge(opts) {
             }
         };
         try {
-            if (isolate) {
-                await proofGit(['worktree', 'add', '--detach', workDir, 'HEAD'], opts.cwd, () => { worktreeRegistered = true; });
+            if (reservation) {
+                await proofGit(['worktree', 'add', '--detach', workDir, 'HEAD'], opts.cwd, false);
+                worktreeIdentity = verifyWorktreePath(reservation);
+                if (opts.signal?.aborted)
+                    throw new ExecBridgeRunCancelledError();
             }
             const run = await agent(prompt, {
                 cwd: workDir,
@@ -443,7 +551,7 @@ export function makeClaudeExecBridge(opts) {
                 reason = summarizeViolations(violations);
             }
             preservePatchRef = patchRef !== undefined && ownsPatchRef;
-            return {
+            result = {
                 outcome: { status: passed ? 'success' : 'failed', score, ...(reason ? { reason } : {}) },
                 proofOfWork: proof,
                 strongEvidence: passed && stat.files > 0,
@@ -457,12 +565,22 @@ export function makeClaudeExecBridge(opts) {
         }
         catch (error) {
             if (error instanceof ExecBridgeRunCancelledError || opts.signal?.aborted) {
-                return cancelledExecutionResult(observedRun);
+                result = cancelledExecutionResult(observedRun);
             }
-            if (error instanceof GitProofError && observedRun) {
-                return failedProofExecutionResult(observedRun, error, failedProof);
+            else if (error instanceof GitProofError && observedRun) {
+                result = failedProofExecutionResult(observedRun, error, failedProof);
+            }
+            else {
+                if (reservation) {
+                    try {
+                        await cleanupWorktreeReservation(reservation, worktreeIdentity, git, opts.cwd);
+                    }
+                    catch {
+                        // Preserve the primary execution error. The abandoned reservation remains private and diagnosable.
+                    }
+                }
+                throw error;
             }
-            throw error;
         }
         finally {
             if (!preservePatchRef && ownsPatchRef && patchRef) {
@@ -471,21 +589,18 @@ export function makeClaudeExecBridge(opts) {
                 }
                 catch { /* best-effort cleanup must not replace the execution result or its primary failure */ }
             }
-            if (isolate) {
-                let worktreeRemoved = false;
-                try {
-                    await git(['worktree', 'remove', '--force', workDir], opts.cwd, undefined, { processSignalMode: 'ignore' });
-                    worktreeRemoved = true;
-                }
-                catch { /* best-effort cleanup */ }
-                const addFailedBeforeCreatingWorktree = !worktreeRegistered && !existsSync(workDir);
-                if (worktreeReservation && (worktreeRemoved || addFailedBeforeCreatingWorktree)) {
-                    try {
-                        rmSync(worktreeReservation, { recursive: true, force: true, maxRetries: 3, retryDelay: 50 });
-                    }
-                    catch { /* best-effort cleanup of the owned reservation */ }
-                }
+        }
+        if (reservation) {
+            try {
+                await cleanupWorktreeReservation(reservation, worktreeIdentity, git, opts.cwd);
+            }
+            catch (error) {
+                // A successful run must not hide abandoned edits/resources. Failed and cancelled results retain their
+                // primary classification; the private reservation remains available for diagnosis.
+                if (result.outcome.status === 'success')
+                    throw error;
             }
         }
+        return result;
     };
 }

package/dist/issueReporter/index.js

@@ -10,6 +10,7 @@ const STATE_VERSION = 1;
 const DEFAULT_DEDUP_WINDOW_MS = 24 * 60 * 60 * 1000;
 const DEFAULT_RATE_LIMIT_WINDOW_MS = 60 * 60 * 1000;
 const DEFAULT_MAX_SUBMISSIONS = 2;
+const PENDING_RESOLUTION_GRACE_MS = 5 * 60 * 1000;
 const MAX_IDS = 5;
 const MAX_REMOTE_RECONCILE_PAGES = 10;
 const REMOTE_RECONCILE_PAGE_SIZE = 100;
@@ -902,6 +903,11 @@ function safeIsoNow(now) {
     }
     return new Date().toISOString();
 }
+function pendingSubmissionIsLive(reservedAt, nowMs) {
+    const reservedAtMs = Date.parse(reservedAt);
+    return !Number.isFinite(reservedAtMs)
+        || nowMs - reservedAtMs < PENDING_RESOLUTION_GRACE_MS;
+}
 function latestSubmission(state, fingerprint) {
     for (let index = state.submissions.length - 1; index >= 0; index -= 1) {
         const record = state.submissions[index];
@@ -1353,6 +1359,18 @@ export async function submitIssueDraft(draft, submit, options) {
                     status: 'rejected',
                     updatedAt: priorRejection.rejectedAt,
                 });
+                const submittedGuard = {
+                    version: STATE_VERSION,
+                    fingerprint: prepared.draft.fingerprint,
+                    attemptId: prepared.attemptId,
+                    reservedAt: prepared.reservedAt,
+                    status: 'submitted',
+                };
+                writeSubmissionGuard(options.rootDir, submittedGuard);
+                state.reservations = state.reservations.filter((record) => !(record.fingerprint === prepared.draft.fingerprint
+                    && record.attemptId === prepared.attemptId
+                    && record.reservedAt === prepared.reservedAt));
+                writeState(options.rootDir, state);
                 throw new Error('issue_report_rejected_before_finalize');
             }
             const priorSubmission = latestSubmission(state, prepared.draft.fingerprint);
@@ -1498,18 +1516,21 @@ export function resolveIssueSubmission(fingerprint, resolution, options) {
         const storedGuard = readSubmissionGuard(options.rootDir, fingerprint);
         const guard = recoverPreparingReservation(options.rootDir, state, quotaIndex, storedGuard);
         const reservations = state.reservations.filter((record) => record.fingerprint === fingerprint);
-        if (guard?.status === 'pending'
-            || reservations.some((record) => record.status === 'pending')) {
+        const timestamp = safeIsoNow(options.now);
+        const nowMs = Date.parse(timestamp);
+        if ((guard?.status === 'pending' && pendingSubmissionIsLive(guard.reservedAt, nowMs))
+            || reservations.some((record) => (record.status === 'pending' && pendingSubmissionIsLive(record.reservedAt, nowMs)))) {
             throw new IssueDraftConflictError('issue_report_submission_in_flight');
         }
         if (guard?.status === 'submitted' && resolution.outcome !== 'submitted') {
             throw new IssueDraftConflictError('issue_report_submission_ambiguous');
         }
-        const reservation = reservations.filter((record) => record.status === 'ambiguous').at(-1);
+        const reservation = reservations.filter((record) => record.status === 'ambiguous' || record.status === 'pending').at(-1);
         const quotaEntry = quotaIndex.entries.filter((entry) => entry.fingerprint === fingerprint).at(-1);
         const attempt = state.attempts.filter((record) => record.fingerprint === fingerprint).at(-1);
         const guardEvidence = guard?.status === 'ambiguous'
             || (guard?.status === 'submitted' && resolution.outcome === 'submitted')
+            || guard?.status === 'pending'
             ? guard
             : storedGuard?.status === 'preparing' ? storedGuard : undefined;
         if (!guardEvidence && !reservation && !quotaEntry && !attempt) {
@@ -1523,7 +1544,6 @@ export function resolveIssueSubmission(fingerprint, resolution, options) {
             ?? reservation?.reservedAt
             ?? quotaEntry?.countedAt
             ?? attempt.attemptedAt;
-        const timestamp = safeIsoNow(options.now);
         if (resolution.outcome === 'submitted') {
             const submitted = {
                 ...draft,

package/dist/util/fileLock.d.ts

@@ -20,9 +20,11 @@ export interface AcquireLockOptions {
  * The lock file records the owner pid and token. If a waiter finds the lock held by a pid that is no longer
  * alive (the owner crashed without releaseLock), it reclaims the stale lock instead of spinning
  * until timeout — otherwise one crashed process would deadlock every future writer until the file
- * is removed by hand. Acquisition stays atomic (O_EXCL), and stale reclaim moves the old lock aside
- * under a mutation guard before deletion so waiters cannot delete each other's newly-created locks.
- * A live owner's lock (including this process's own) is never stolen.
+ * is removed by hand. Empty or truncated locks are reclaimed only after the same inode and contents
+ * remain malformed for a grace period, so a live creator can finish publishing its owner payload.
+ * Acquisition stays atomic (O_EXCL), and stale reclaim moves the old lock aside under a mutation
+ * guard, then verifies the inode snapshot before deletion. A live owner's lock (including this
+ * process's own) is never stolen.
  *
  * NOTE: still synchronous (blocks the event loop while waiting) by design — it guards short
  * synchronous critical sections (append-only writes).