@evomap/evolver-proxy 2.0.0-beta.5 → 2.0.0-beta.7

package/dist/bin/evolver-proxy.d.ts

@@ -52,6 +52,7 @@ export interface RunProxyCliOptions {
 }
 export interface ProxyCliPathOptions {
     home?: string;
+    evomapHome?: string;
     store?: string;
     settings?: string;
     envFile?: string;

package/dist/bin/evolver-proxy.js

@@ -242,11 +242,12 @@ export function proxyUsage(command = 'evolver-proxy') {
         'Starts the local Evolver proxy daemon.',
         '',
         'Options (CLI overrides environment variables):',
-        '  --home <dir>       Root for assets, store, settings, and traces',
-        '  --store <path>     Mailbox store path (EVOLVER_PROXY_STORE)',
-        '  --settings <path>  Proxy settings file (EVOLVER_PROXY_SETTINGS_FILE)',
-        '  --env-file <path>  Environment file (EVOLVER_ENV_FILE)',
-        '  -h, --help         Show this help',
+        '  --home <dir>         Root for assets, store, settings, and traces',
+        '  --evomap-home <dir>  Identity home for node_id/node_secret (EVOMAP_HOME); defaults to --home',
+        '  --store <path>       Mailbox store path (EVOLVER_PROXY_STORE)',
+        '  --settings <path>    Proxy settings file (EVOLVER_PROXY_SETTINGS_FILE)',
+        '  --env-file <path>    Environment file (EVOLVER_ENV_FILE)',
+        '  -h, --help           Show this help',
         '',
         'Required for public mode:',
         '  EVOMAP_NODE_SECRET or A2A_NODE_SECRET',
@@ -267,6 +268,7 @@ export function proxyUsage(command = 'evolver-proxy') {
 }
 const PROXY_PATH_FLAGS = new Map([
     ['--home', 'home'],
+    ['--evomap-home', 'evomapHome'],
     ['--store', 'store'],
     ['--settings', 'settings'],
     ['--env-file', 'envFile'],
@@ -309,6 +311,11 @@ export function prepareProxyCliEnvironment(argv, env) {
         env['EVOLVER_PROXY_SETTINGS_FILE'] = join(options.home, 'settings.json');
         env['EVOLVER_LLM_TRACE_DIR'] = join(options.home, 'proxy', 'traces');
     }
+    // Identity/state split for embedders whose node identity lives outside the state root (evox agentDir keeps
+    // node_id/node_secret under <agentDir>/evomap while evolver state lives under <agentDir>/evolver, #555 T2).
+    // Applied AFTER --home so it overrides the single-root EVOMAP_HOME derivation; state paths stay on --home.
+    if (options.evomapHome)
+        env['EVOMAP_HOME'] = options.evomapHome;
     if (options.store)
         env['EVOLVER_PROXY_STORE'] = options.store;
     if (options.settings)
@@ -706,13 +713,29 @@ function readTrimmedFile(path) {
         return undefined;
     }
 }
+// Identity-home probe order (#555 T2): EVOMAP_HOME is THE identity home and outranks the state root
+// (EVOLVER_HOME) — under the evox agentDir split (`--home <agentDir>/evolver --evomap-home <agentDir>/evomap`)
+// node files live only under the evomap dir, and the old single-home read (EVOLVER_HOME-first) would miss
+// them and fall back to the machine-global ~/.evomap node. Probing is a fall-through union, so single-home
+// setups (only EVOLVER_HOME, or neither) resolve exactly as before.
+function identityHomeCandidates(env = process.env) {
+    const candidates = [
+        env['EVOMAP_HOME'],
+        env['EVOMAP_DIR'],
+        env['EVOLVER_HOME'],
+        join(env['HOME'] || homedir(), '.evomap'),
+    ];
+    return [...new Set(candidates.map((value) => value?.trim()).filter((value) => Boolean(value)))];
+}
 function readLegacyNodeSecret(env = process.env) {
-    const home = evomapHome(env);
-    const nodeSecret = readTrimmedFile(join(home, 'node_secret'));
-    if (!nodeSecret || !isNodeSecret(nodeSecret))
-        return undefined;
-    const nodeSecretVersion = parseNodeSecretVersion(readTrimmedFile(join(home, 'node_secret_version')));
-    return { nodeSecret, ...(nodeSecretVersion !== undefined ? { nodeSecretVersion } : {}) };
+    for (const home of identityHomeCandidates(env)) {
+        const nodeSecret = readTrimmedFile(join(home, 'node_secret'));
+        if (!nodeSecret || !isNodeSecret(nodeSecret))
+            continue;
+        const nodeSecretVersion = parseNodeSecretVersion(readTrimmedFile(join(home, 'node_secret_version')));
+        return { nodeSecret, ...(nodeSecretVersion !== undefined ? { nodeSecretVersion } : {}) };
+    }
+    return undefined;
 }
 // Durable copies of the legacy node_secret, cleared on hub-signalled divergence.
 // Store keys mirror cli LOCAL_SECRET_STATE_KEYS (index.ts:82); on-disk files mirror
@@ -728,13 +751,17 @@ const LEGACY_SECRET_FILES = ['node_secret', 'node_secret_version'];
 export function clearDivergedPublicNodeSecret(store, env = process.env) {
     for (const key of LOCAL_SECRET_STATE_KEYS)
         store.setState(key, '');
-    const home = evomapHome(env);
-    for (const file of LEGACY_SECRET_FILES) {
-        try {
-            rmSync(join(home, file), { force: true });
-        }
-        catch (err) {
-            process.stderr.write(`[evolver-proxy] failed to unlink diverged ${file}: ${err instanceof Error ? err.message : String(err)}\n`);
+    // Wipe every identity-home candidate, not just the resolved state home: under the identity/state split
+    // (EVOMAP_HOME ≠ EVOLVER_HOME) the diverged files live in the evomap dir, and clearing only one home would
+    // leave them to resurrect the diverged secret on the next start (same union rationale as reset-local-secret).
+    for (const home of identityHomeCandidates(env)) {
+        for (const file of LEGACY_SECRET_FILES) {
+            try {
+                rmSync(join(home, file), { force: true });
+            }
+            catch (err) {
+                process.stderr.write(`[evolver-proxy] failed to unlink diverged ${file}: ${err instanceof Error ? err.message : String(err)}\n`);
+            }
         }
     }
 }

package/dist/daemon/proxyDaemon.d.ts

@@ -151,6 +151,7 @@ export declare class ProxyDaemon {
     private recordTickError;
     /** 启动: 锁 + IPC 监听 + 初次 hello. 返回 IPC 端口. */
     start(): Promise<number>;
+    private listenIpc;
     /** 单轮: core pump/TTL/wake + proxy 出站 + hub 入站 + 到点心跳. */
     tick(): Promise<ProxyTickReport>;
     /** 下一轮建议延时: inbound 背压/idle 与 outbound pending cadence 取更快者. */

package/dist/daemon/proxyDaemon.js

@@ -1,5 +1,5 @@
 import { dirname, join } from 'node:path';
-import { mailbox, hub as hubNs, shadow as shadow_, assetstore } from '@evomap/evolver-core';
+import { mailbox, hub as hubNs, shadow as shadow_, assetstore, util } from '@evomap/evolver-core';
 import { SyncEngine, SYNC_INTERVALS } from '../sync/engine.js';
 import { LifecycleManager } from '../lifecycle/manager.js';
 import { executeForceUpdate } from '../selfUpdate/executor.js';
@@ -11,6 +11,7 @@ export const DEFAULT_IPC_PORT = 19820;
 const MAX_TIMER_DELAY_MS = 2_147_483_647;
 const MAX_PROXY_TICK_ERROR_LENGTH = 2_000;
 const MAX_HEARTBEAT_TICK_ERROR_LENGTH = 1_000;
+const MAX_EPHEMERAL_IPC_LISTEN_ATTEMPTS = 5;
 /**
  * ProxyDaemon(M6-4) 装配层: 把 core(MailboxStore/Dispatcher/MailboxDaemon/IpcServer) +
  * HubBindings(M6-1) + SyncEngine(M6-2) + LifecycleManager(M6-3) 拼成系统级 proxy.
@@ -164,7 +165,7 @@ export class ProxyDaemon {
                 ...(this.deps.onIpcAuthFailure ? { onAuthFailure: this.deps.onIpcAuthFailure } : {}),
                 extraRoutes: [(ctx) => this.handleProxyRoute(ctx)],
             });
-            const port = await this.ipc.listen(this.deps.ipcPort ?? DEFAULT_IPC_PORT);
+            const port = await this.listenIpc(this.ipc);
             try {
                 this.deps.onIpcListen?.(port);
             }
@@ -188,6 +189,22 @@ export class ProxyDaemon {
             throw err;
         }
     }
+    async listenIpc(ipc) {
+        const requestedPort = this.deps.ipcPort ?? DEFAULT_IPC_PORT;
+        if (requestedPort !== 0)
+            return ipc.listen(requestedPort);
+        for (let attempt = 0; attempt < MAX_EPHEMERAL_IPC_LISTEN_ATTEMPTS; attempt += 1) {
+            const assignedPort = await ipc.listen(0);
+            if (!util.isFetchForbiddenPort(assignedPort))
+                return assignedPort;
+            // The outer start() cleanup owns the final listener when retries are exhausted.
+            if (attempt === MAX_EPHEMERAL_IPC_LISTEN_ATTEMPTS - 1) {
+                throw new Error('proxy_ipc_safe_port_unavailable');
+            }
+            await ipc.close();
+        }
+        throw new Error('proxy_ipc_safe_port_unavailable');
+    }
     /** 单轮: core pump/TTL/wake + proxy 出站 + hub 入站 + 到点心跳. */
     async tick() {
         const errors = [];

package/dist/lifecycle/legacyNodeId.d.ts

@@ -12,31 +12,29 @@ export interface LegacyNodeIdCandidateOptions {
  * Legacy node_id file locations, in priority order. Mirror of v1
  * `_loadPersistedNodeId`:
  *
- *  0. `<EVOMAP_DIR>/node_id` — the explicit dir the CLI recipe / ATP / proxy
+ *  0. `<EVOMAP_HOME>/node_id` — when an explicit identity home is configured, it
+ *     must precede every state-root candidate. The legacy node_secret resolver uses
+ *     the same priority, keeping both credentials on one identity in split layouts.
+ *  1. `<EVOMAP_DIR>/node_id` — the explicit dir the CLI recipe / ATP / proxy
  *     anti-abuse code write under (`recipeHomeCandidates` puts EVOMAP_DIR ahead
  *     of EVOLVER_HOME/EVOMAP_HOME). `resolveEvomapHome` never consults EVOMAP_DIR,
  *     so a deployment that pivots on it would otherwise send no node_id on hello
- *     and let the hub mint a duplicate. Probed FIRST and ADDITIVELY (the
- *     EVOLVER_HOME/EVOMAP_HOME candidates below are kept), so setting EVOMAP_DIR
- *     never hides an id that lives under one of the home overrides. Deduped.
- *  1. `<evomapHome>/node_id` — the override-aware home file. `resolveEvomapHome()`
- *     honours EVOLVER_HOME (matching v1 `getEvomapDir`) and ADDITIONALLY
- *     EVOMAP_HOME after dropping blank/relative overrides. It wins first so a
- *     home relocated via EVOLVER_HOME reads the file the v1 writer put there —
- *     the lesson of v1 #120, which routed the reader through the same helper as
- *     the writer.
- *  2. `~/.evomap/node_id` — the UNCONDITIONAL v1 location. v1's writer pivots on
+ *     and let the hub mint a duplicate. It remains first when EVOMAP_HOME is not
+ *     configured, preserving the existing EVOMAP_DIR-only contract. Deduped.
+ *  2. `<EVOLVER_HOME>/node_id` — the state-home compatibility candidate, kept
+ *     after the identity roots so readers still walk every dir a writer may have used.
+ *  3. `~/.evomap/node_id` — the UNCONDITIONAL v1 location. v1's writer pivots on
  *     `getEvomapDir` = `EVOLVER_HOME || ~/.evomap` and ignores EVOMAP_HOME
  *     entirely, so unless EVOLVER_HOME was set a v1 file always physically lands
  *     here. We probe it explicitly so a v2 install that sets only EVOMAP_HOME
  *     (which steers candidate 1 away from `~/.evomap`) still recovers the v1
  *     identity instead of letting the hub mint a duplicate orphan node. Deduped
  *     against candidate 1 for the common no-override case where they coincide.
- *  3. `<proxy package>/.evomap_node_id` — the install-root file the writer falls
+ *  4. `<proxy package>/.evomap_node_id` — the install-root file the writer falls
  *     back to when `~/.evomap/` isn't writable (read-only $HOME in
  *     containers / restricted CI). Kept first for parity with the old v2
  *     candidate.
- *  4. `<outer package/workspace root>/.evomap_node_id` — the v1/outer install
+ *  5. `<outer package/workspace root>/.evomap_node_id` — the v1/outer install
  *     root fallback. In v2's multi-package layout the proxy code lives below
  *     `packages/evolver-proxy`, so only checking the proxy package root misses
  *     a file written at the install/workspace root.

package/dist/lifecycle/legacyNodeId.js

@@ -17,11 +17,23 @@ function cleanAbsolutePath(value) {
         return undefined;
     return isAbsolute(trimmed) ? trimmed : undefined;
 }
-function resolveEvomapHome(opts, fallbackHomeDir) {
-    return cleanAbsolutePath(opts.evomapHomeDir)
-        ?? cleanAbsolutePath(process.env['EVOLVER_HOME'])
-        ?? cleanAbsolutePath(process.env['EVOMAP_HOME'])
-        ?? (fallbackHomeDir === undefined ? undefined : join(fallbackHomeDir, '.evomap'));
+// Identity homes in probe order (#555 T2): the explicit test/caller override wins outright; otherwise
+// EVOMAP_HOME (THE identity home) outranks EVOLVER_HOME (the state root) so the evox agentDir split
+// (`--evomap-home <agentDir>/evomap` + `--home <agentDir>/evolver`) reads node files from the evomap dir.
+// legacyNodeIdCandidates() splices that explicit identity home ahead of EVOMAP_DIR so node_id and
+// node_secret cannot come from different halves of the split layout. Both homes stay in the candidate union,
+// so single-home setups resolve exactly as before.
+function identityHomeCandidates(opts, fallbackHomeDir) {
+    const fromOpts = cleanAbsolutePath(opts.evomapHomeDir);
+    if (fromOpts !== undefined)
+        return [fromOpts];
+    const homes = [
+        cleanAbsolutePath(process.env['EVOMAP_HOME']),
+        cleanAbsolutePath(process.env['EVOLVER_HOME']),
+    ].filter((value) => value !== undefined);
+    if (homes.length > 0)
+        return homes;
+    return fallbackHomeDir === undefined ? [] : [join(fallbackHomeDir, '.evomap')];
 }
 function packageNameAt(dir) {
     const pkgPath = join(dir, 'package.json');
@@ -59,31 +71,29 @@ function installRootNodeIdCandidates(moduleDir) {
  * Legacy node_id file locations, in priority order. Mirror of v1
  * `_loadPersistedNodeId`:
  *
- *  0. `<EVOMAP_DIR>/node_id` — the explicit dir the CLI recipe / ATP / proxy
+ *  0. `<EVOMAP_HOME>/node_id` — when an explicit identity home is configured, it
+ *     must precede every state-root candidate. The legacy node_secret resolver uses
+ *     the same priority, keeping both credentials on one identity in split layouts.
+ *  1. `<EVOMAP_DIR>/node_id` — the explicit dir the CLI recipe / ATP / proxy
  *     anti-abuse code write under (`recipeHomeCandidates` puts EVOMAP_DIR ahead
  *     of EVOLVER_HOME/EVOMAP_HOME). `resolveEvomapHome` never consults EVOMAP_DIR,
  *     so a deployment that pivots on it would otherwise send no node_id on hello
- *     and let the hub mint a duplicate. Probed FIRST and ADDITIVELY (the
- *     EVOLVER_HOME/EVOMAP_HOME candidates below are kept), so setting EVOMAP_DIR
- *     never hides an id that lives under one of the home overrides. Deduped.
- *  1. `<evomapHome>/node_id` — the override-aware home file. `resolveEvomapHome()`
- *     honours EVOLVER_HOME (matching v1 `getEvomapDir`) and ADDITIONALLY
- *     EVOMAP_HOME after dropping blank/relative overrides. It wins first so a
- *     home relocated via EVOLVER_HOME reads the file the v1 writer put there —
- *     the lesson of v1 #120, which routed the reader through the same helper as
- *     the writer.
- *  2. `~/.evomap/node_id` — the UNCONDITIONAL v1 location. v1's writer pivots on
+ *     and let the hub mint a duplicate. It remains first when EVOMAP_HOME is not
+ *     configured, preserving the existing EVOMAP_DIR-only contract. Deduped.
+ *  2. `<EVOLVER_HOME>/node_id` — the state-home compatibility candidate, kept
+ *     after the identity roots so readers still walk every dir a writer may have used.
+ *  3. `~/.evomap/node_id` — the UNCONDITIONAL v1 location. v1's writer pivots on
  *     `getEvomapDir` = `EVOLVER_HOME || ~/.evomap` and ignores EVOMAP_HOME
  *     entirely, so unless EVOLVER_HOME was set a v1 file always physically lands
  *     here. We probe it explicitly so a v2 install that sets only EVOMAP_HOME
  *     (which steers candidate 1 away from `~/.evomap`) still recovers the v1
  *     identity instead of letting the hub mint a duplicate orphan node. Deduped
  *     against candidate 1 for the common no-override case where they coincide.
- *  3. `<proxy package>/.evomap_node_id` — the install-root file the writer falls
+ *  4. `<proxy package>/.evomap_node_id` — the install-root file the writer falls
  *     back to when `~/.evomap/` isn't writable (read-only $HOME in
  *     containers / restricted CI). Kept first for parity with the old v2
  *     candidate.
- *  4. `<outer package/workspace root>/.evomap_node_id` — the v1/outer install
+ *  5. `<outer package/workspace root>/.evomap_node_id` — the v1/outer install
  *     root fallback. In v2's multi-package layout the proxy code lives below
  *     `packages/evolver-proxy`, so only checking the proxy package root misses
  *     a file written at the install/workspace root.
@@ -97,12 +107,17 @@ function installRootNodeIdCandidates(moduleDir) {
 export function legacyNodeIdCandidates(opts = {}) {
     const home = cleanAbsolutePath(opts.homeDir) ?? cleanAbsolutePath(homedir());
     const moduleDir = opts.moduleDir ?? _moduleDir;
-    const evomapHome = resolveEvomapHome(opts, home);
+    const evomapHomes = identityHomeCandidates(opts, home);
+    const identityHome = cleanAbsolutePath(opts.evomapHomeDir)
+        ?? cleanAbsolutePath(process.env['EVOMAP_HOME']);
     const evomapDir = cleanAbsolutePath(opts.evomapDir) ?? cleanAbsolutePath(process.env['EVOMAP_DIR']);
     return [
         ...new Set([
+            ...(identityHome === undefined ? [] : [join(identityHome, 'node_id')]),
             ...(evomapDir === undefined ? [] : [join(evomapDir, 'node_id')]),
-            ...(evomapHome === undefined ? [] : [join(evomapHome, 'node_id')]),
+            ...evomapHomes
+                .filter((dir) => dir !== identityHome)
+                .map((dir) => join(dir, 'node_id')),
             ...(home === undefined ? [] : [join(home, '.evomap', 'node_id')]),
             ...installRootNodeIdCandidates(moduleDir),
         ]),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evomap/evolver-proxy",
-  "version": "2.0.0-beta.5",
+  "version": "2.0.0-beta.7",
   "private": false,
   "type": "module",
   "description": "系统级 mailbox/hub 同步 daemon (Node)",
@@ -26,8 +26,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-bedrock-runtime": "^3.1053.0",
-    "@evomap/evolver-adapter-public": "2.0.0-beta.5",
-    "@evomap/evolver-core": "2.0.0-beta.5"
+    "@evomap/evolver-adapter-public": "2.0.0-beta.7",
+    "@evomap/evolver-core": "2.0.0-beta.7"
   },
   "repository": {
     "type": "git",