@evomap/evolver 1.89.14 → 1.89.17

package/index.js

@@ -1,4 +1,150 @@
 #!/usr/bin/env node
+function _parseBootstrapSemver(version) {
+  const match = /^v?(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(String(version || ''));
+  if (!match) return null;
+  return {
+    major: match[1],
+    minor: match[2],
+    patch: match[3],
+    prerelease: match[4] ? match[4].split('.') : [],
+  };
+}
+
+function _compareBootstrapNumeric(left, right) {
+  if (left.length !== right.length) return left.length - right.length;
+  if (left < right) return -1;
+  if (left > right) return 1;
+  return 0;
+}
+
+function _compareBootstrapPrerelease(left, right) {
+  const leftNumeric = /^\d+$/.test(left);
+  const rightNumeric = /^\d+$/.test(right);
+  if (leftNumeric && rightNumeric) return _compareBootstrapNumeric(left, right);
+  if (leftNumeric) return -1;
+  if (rightNumeric) return 1;
+  if (left < right) return -1;
+  if (left > right) return 1;
+  return 0;
+}
+
+function _compareBootstrapSemver(left, right) {
+  const a = _parseBootstrapSemver(left);
+  const b = _parseBootstrapSemver(right);
+  if (!a || !b) return null;
+  for (const key of ['major', 'minor', 'patch']) {
+    const cmp = _compareBootstrapNumeric(a[key], b[key]);
+    if (cmp !== 0) return cmp;
+  }
+  if (!a.prerelease.length && !b.prerelease.length) return 0;
+  if (!a.prerelease.length) return 1;
+  if (!b.prerelease.length) return -1;
+  const max = Math.max(a.prerelease.length, b.prerelease.length);
+  for (let i = 0; i < max; i++) {
+    if (a.prerelease[i] === undefined) return -1;
+    if (b.prerelease[i] === undefined) return 1;
+    const cmp = _compareBootstrapPrerelease(a.prerelease[i], b.prerelease[i]);
+    if (cmp !== 0) return cmp;
+  }
+  return 0;
+}
+
+function _bootstrapVersionSatisfies(currentVersion, requiredVersion) {
+  if (String(currentVersion || '') === String(requiredVersion || '')) return true;
+  const cmp = _compareBootstrapSemver(currentVersion, requiredVersion);
+  return cmp !== null && cmp >= 0;
+}
+
+function _failClosedForceUpdateBootstrap(backupName, entryName, error) {
+  const detail = error && error.message ? error.message : String(error || 'unknown error');
+  console.error('[ForceUpdate] Bootstrap recovery failed for ' + backupName +
+    (entryName ? ' while restoring ' + entryName : '') + ': ' + detail);
+  console.error('[ForceUpdate] Refusing to continue startup; recovery backup and journal were left in place.');
+  process.exit(1);
+}
+
+function _recoverInterruptedForceUpdateBootstrap() {
+  const fs = require('fs');
+  const path = require('path');
+  const installRoot = __dirname;
+  const backupPrefix = '.evolver-force-update-backup-';
+  const journalName = '.evolver-force-update-journal.json';
+  let backups = [];
+  try {
+    backups = fs.readdirSync(installRoot)
+      .filter((name) => name.startsWith(backupPrefix))
+      .sort()
+      .reverse();
+  } catch (_) {
+    return false;
+  }
+  for (const backupName of backups) {
+    const backupRoot = path.join(installRoot, backupName);
+    const journalPath = path.join(backupRoot, journalName);
+    let journal = null;
+    try {
+      journal = JSON.parse(fs.readFileSync(journalPath, 'utf8'));
+    } catch (_) {
+      // Not a force-update recovery journal; leave unrelated directories alone.
+      continue;
+    }
+    if (!journal || journal.state !== 'precommit' || !journal.requiredVersion) continue;
+    let currentVersion = '';
+    try {
+      const pkg = JSON.parse(fs.readFileSync(path.join(installRoot, 'package.json'), 'utf8'));
+      currentVersion = pkg && pkg.version ? String(pkg.version) : '';
+    } catch (_) {
+      // If the package marker is unreadable, prefer restoring the old payload.
+    }
+    if (_bootstrapVersionSatisfies(currentVersion, String(journal.requiredVersion))) {
+      try { fs.rmSync(backupRoot, { recursive: true, force: true }); } catch (_) {
+        // Cleanup failure is non-fatal; normal startup can continue.
+      }
+      continue;
+    }
+    let entries = [];
+    try {
+      entries = fs.readdirSync(backupRoot, { withFileTypes: true });
+    } catch (readErr) {
+      _failClosedForceUpdateBootstrap(backupName, '', readErr);
+    }
+    for (const entry of entries) {
+      if (entry.name === journalName) continue;
+      const livePath = path.join(installRoot, entry.name);
+      const backupPath = path.join(backupRoot, entry.name);
+      try {
+        if (entry.name === 'index.js') {
+          const tmpPath = livePath + '.' + process.pid + '.recover-tmp';
+          try { fs.rmSync(tmpPath, { force: true }); } catch (_) {}
+          fs.copyFileSync(backupPath, tmpPath);
+          try {
+            const backupStat = fs.statSync(backupPath);
+            fs.chmodSync(tmpPath, backupStat.mode & 0o777);
+          } catch (_) {
+            // Recovery can proceed without mode restoration; npm/service launches
+            // normally use `node index.js` after an interrupted update.
+          }
+          fs.renameSync(tmpPath, livePath);
+          fs.rmSync(backupPath, { force: true });
+        } else {
+          fs.rmSync(livePath, { recursive: true, force: true });
+          fs.renameSync(backupPath, livePath);
+        }
+      } catch (restoreErr) {
+        _failClosedForceUpdateBootstrap(backupName, entry.name, restoreErr);
+      }
+    }
+    try { fs.rmSync(backupRoot, { recursive: true, force: true }); } catch (_) {
+      // Best-effort cleanup; recovery already restored the payload.
+    }
+    console.warn('[ForceUpdate] Recovered interrupted install from ' + backupName);
+    return true;
+  }
+  return false;
+}
+
+_recoverInterruptedForceUpdateBootstrap();
+
 function _printProxyTokenUsage(out = process.stderr) {
   out.write('Usage: node index.js proxy-token [--settings FILE]\n');
 }
@@ -2716,8 +2862,9 @@ async function main() {
     // Wipe every local store of node_secret in one shot, so a daemon stuck
     // after a manual web reset (https://evomap.ai/account -> Reset Secret)
     // can boot clean. Local stores involved:
-    //   - MailboxStore: ~/.evomap/mailbox/state.json key node_secret + version
-    //   - Legacy files: ~/.evomap/node_secret and ~/.evomap/node_secret_version
+    //   - MailboxStore: ~/.evomap/mailbox/state.json node_secret state keys
+    //   - Legacy files: ~/.evomap/node_secret, node_secret_version,
+    //     node_secret_source, and node_secret_env_suppressed
     //   - Shell env:    A2A_NODE_SECRET / EVOMAP_NODE_SECRET and matching
     //                   version vars (we cannot mutate the parent shell; we
     //                   just print the unset hint)
@@ -2730,38 +2877,47 @@ async function main() {
     // this fallback, test/resetLocalSecret.test.js cannot inject a fake home
     // and the reset operates on the real user dir.
     const home = process.env.HOME || os.homedir();
-    const stateFile = path.join(home, '.evomap', 'mailbox', 'state.json');
-    const legacyFile = path.join(home, '.evomap', 'node_secret');
-    const legacyVersionFile = path.join(home, '.evomap', 'node_secret_version');
+    const evomapDirs = [];
+    const seenEvomapDirs = new Set();
+    const addEvomapDir = (dir) => {
+      if (!dir) return;
+      const resolved = path.resolve(dir);
+      if (seenEvomapDirs.has(resolved)) return;
+      seenEvomapDirs.add(resolved);
+      evomapDirs.push(dir);
+    };
+    addEvomapDir(path.join(home, '.evomap'));
+    addEvomapDir(process.env.EVOLVER_HOME);
     let cleared = 0;
     try {
-      if (fs.existsSync(stateFile)) {
-        const raw = JSON.parse(fs.readFileSync(stateFile, 'utf8'));
-        let mutated = false;
-        for (const k of ['node_secret', 'node_secret_source', 'node_secret_version']) {
-          if (raw[k] !== undefined && raw[k] !== '') {
-            raw[k] = '';
-            mutated = true;
+      for (const evomapDir of evomapDirs) {
+        const stateFile = path.join(evomapDir, 'mailbox', 'state.json');
+        if (fs.existsSync(stateFile)) {
+          const raw = JSON.parse(fs.readFileSync(stateFile, 'utf8'));
+          let mutated = false;
+          for (const k of ['node_secret', 'node_secret_source', 'node_secret_version', 'node_secret_env_suppressed']) {
+            if (raw[k] !== undefined && raw[k] !== '') {
+              raw[k] = '';
+              mutated = true;
+            }
+          }
+          if (mutated) {
+            fs.writeFileSync(stateFile, JSON.stringify(raw, null, 2) + '\n', 'utf8');
+            cleared += 1;
+            console.log('[reset-local-secret] cleared MailboxStore at ' + stateFile);
+          } else {
+            console.log('[reset-local-secret] MailboxStore had no node_secret to clear at ' + stateFile);
           }
         }
-        if (mutated) {
-          fs.writeFileSync(stateFile, JSON.stringify(raw, null, 2) + '\n', 'utf8');
-          cleared += 1;
-          console.log('[reset-local-secret] cleared MailboxStore at ' + stateFile);
-        } else {
-          console.log('[reset-local-secret] MailboxStore had no node_secret to clear');
+        for (const legacyName of ['node_secret', 'node_secret_version', 'node_secret_source', 'node_secret_env_suppressed']) {
+          const legacyFile = path.join(evomapDir, legacyName);
+          if (fs.existsSync(legacyFile)) {
+            fs.unlinkSync(legacyFile);
+            cleared += 1;
+            console.log('[reset-local-secret] removed legacy file ' + legacyFile);
+          }
         }
       }
-      if (fs.existsSync(legacyFile)) {
-        fs.unlinkSync(legacyFile);
-        cleared += 1;
-        console.log('[reset-local-secret] removed legacy file ' + legacyFile);
-      }
-      if (fs.existsSync(legacyVersionFile)) {
-        fs.unlinkSync(legacyVersionFile);
-        cleared += 1;
-        console.log('[reset-local-secret] removed legacy file ' + legacyVersionFile);
-      }
     } catch (err) {
       console.error('[reset-local-secret] error:', err && err.message || err);
       process.exit(1);
@@ -2875,6 +3031,35 @@ async function main() {
       process.exit(1);
     }
 
+  } else if (command === 'reuse') {
+    try {
+      const { runReuseCommand } = require('./src/gep/cliContracts');
+      process.exit(await runReuseCommand(args.slice(1)));
+    } catch (e) {
+      process.stdout.write(JSON.stringify({
+        ok: false,
+        contract: 'reuse.v1',
+        reason: 'internal_error',
+        message: 'evolver reuse failed',
+      }) + '\n');
+      process.exit(1);
+    }
+
+  } else if (command === 'publish') {
+    try {
+      const { runPublishCommand } = require('./src/gep/cliContracts');
+      process.exit(await runPublishCommand(args.slice(1)));
+    } catch (e) {
+      process.stdout.write(JSON.stringify({
+        ok: false,
+        contract: 'publish.v1',
+        reason: 'internal_error',
+        retryable: false,
+        message: 'evolver publish failed',
+      }) + '\n');
+      process.exit(1);
+    }
+
   } else if (command === 'recipe') {
     // recipe build  — assemble a DNA blueprint from owned Gene/Capsule assets
     // recipe reuse  — fetch + express an existing recipe into an organism
@@ -3042,7 +3227,7 @@ async function main() {
     }
 
   } else {
-    console.log(`Usage: node index.js [run|/evolve|login|logout|proxy-token|solidify|review|distill|fetch|sync|asset-log|webui|setup-hooks|recipe|buy|orders|verify|atp|atp-complete|experiment] [--loop]
+    console.log(`Usage: node index.js [run|/evolve|login|logout|proxy-token|solidify|review|distill|fetch|sync|asset-log|webui|setup-hooks|reuse|publish|recipe|buy|orders|verify|atp|atp-complete|experiment] [--loop]
   - login                      (authorize this device via the hub, gh-auth-login style; stores an OAuth token used instead of node_secret)
   - logout                     (remove the stored OAuth token)
   - proxy-token                (print the local proxy bearer token for command-backed client auth)
@@ -3054,6 +3239,11 @@ async function main() {
     - build --title="..." --genes=<asset_id,...> [--description] [--price=N] [--publish]
                               (builds a DRAFT DNA blueprint; --publish is opt-in)
     - reuse --id=<recipe_id> [--input=<json>]   (express a recipe into an organism)
+  - reuse flags:
+    - --id=<asset_id> --json     (reuse a Hub asset into the local library; stdout JSON contract reuse.v1)
+  - publish flags:
+    - --asset=<id|path> [--asset ...] [--dry-run] --json
+                              (publish.v1 stdout JSON contract for Desktop)
   - fetch flags:
     - --skill=<id> | -s <id>   (skill ID to download)
     - --out=<dir>              (output directory, default: ./skills/<skill_id>)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evomap/evolver",
-  "version": "1.89.14",
+  "version": "1.89.17",
   "description": "A GEP-powered self-evolution engine for AI agents. Features automated log analysis and Genome Evolution Protocol (GEP) for auditable, reusable evolution assets.",
   "main": "index.js",
   "bin": {

package/src/adapters/claudeCode.js

@@ -1,6 +1,6 @@
 const fs = require('fs');
 const path = require('path');
-const { mergeJsonFile, copyHookScripts, appendSectionToFile, removeHookScripts, removeMarkedSection, assertSafeConfigDir } = require('./hookAdapter');
+const { mergeJsonFile, copyHookScripts, appendSectionToFile, removeHookScripts, removeMarkedSection, assertSafeConfigDir, isEvolverHookCommand } = require('./hookAdapter');
 
 const HOOK_SCRIPTS_DIR_NAME = 'hooks';
 const EVOLVER_MARKER = '<!-- evolver-evolution-memory -->';
@@ -146,7 +146,7 @@ function uninstall({ configRoot }) {
                 const innerBefore = matcher.hooks.length;
                 const filtered = matcher.hooks.filter(h => {
                   const cmd = (h && h.command) || '';
-                  return !cmd.includes('evolver-session') && !cmd.includes('evolver-signal') && !cmd.includes('evolver-task-recall');
+                  return !isEvolverHookCommand(cmd);
                 });
                 // A matcher containing both evolver and user hooks shrinks
                 // its inner array without changing the outer matcher count.

package/src/adapters/codex.js

@@ -1,6 +1,6 @@
 const fs = require('fs');
 const path = require('path');
-const { mergeJsonFile, copyHookScripts, appendSectionToFile, removeHookScripts, removeMarkedSection, assertSafeConfigDir } = require('./hookAdapter');
+const { mergeJsonFile, copyHookScripts, appendSectionToFile, removeHookScripts, removeMarkedSection, assertSafeConfigDir, isEvolverHookCommand } = require('./hookAdapter');
 
 const HOOK_SCRIPTS_DIR_NAME = 'hooks';
 const EVOLVER_MARKER = '<!-- evolver-evolution-memory -->';
@@ -166,7 +166,7 @@ function uninstall({ configRoot }) {
             const before = data.hooks[event].length;
             data.hooks[event] = data.hooks[event].filter(h => {
               const cmd = (h && h.command) || '';
-              return !cmd.includes('evolver-session') && !cmd.includes('evolver-signal');
+              return !isEvolverHookCommand(cmd);
             });
             if (data.hooks[event].length !== before) touched = true;
             if (data.hooks[event].length === 0) delete data.hooks[event];

package/src/adapters/hookAdapter.js

@@ -76,7 +76,7 @@ function mergeWithHooksUnion(target, source) {
       if (tArr && sArr) {
         const isEvolverOwned = (entry) => {
           const cmds = collectCommands(entry);
-          return cmds.some(c => c.includes('evolver-session') || c.includes('evolver-signal') || c.includes('evolver-task-recall'));
+          return cmds.some(isEvolverHookCommand);
         };
         const userEntries = tArr.filter(e => !isEvolverOwned(e));
         result.hooks[event] = [...userEntries, ...sArr];
@@ -101,6 +101,17 @@ function collectCommands(entry) {
   return out;
 }
 
+function isEvolverHookCommand(command) {
+  if (typeof command !== 'string') return false;
+  return command.includes('evolver-session') ||
+    command.includes('evolver-signal') ||
+    command.includes('evolver-task-recall') ||
+    // Legacy installs briefly shipped this companion daemon hook. Treat it
+    // as evolver-owned so reinstall/merge can remove it instead of preserving
+    // a stale supervisor that may point clients at a dead proxy.
+    command.includes('evolver-daemon-start');
+}
+
 function deepMerge(target, source) {
   const result = { ...target };
   for (const key of Object.keys(source)) {
@@ -226,7 +237,7 @@ function removeEvolverHooks(filePath, { markerKey = '_evolver_managed' } = {}) {
           const before = data.hooks[event].length;
           data.hooks[event] = data.hooks[event].filter(h => {
             const cmd = h.command || '';
-            return !cmd.includes('evolver-session') && !cmd.includes('evolver-signal') && !cmd.includes('evolver-task-recall');
+            return !isEvolverHookCommand(cmd);
           });
           if (data.hooks[event].length !== before) changed = true;
           if (data.hooks[event].length === 0) delete data.hooks[event];
@@ -358,6 +369,7 @@ module.exports = {
   deepMerge,
   mergeWithHooksUnion,
   collectCommands,
+  isEvolverHookCommand,
   copyHookScripts,
   appendSectionToFile,
   assertSafeConfigDir,

package/src/adapters/scripts/evolver-session-start.js

@@ -14,6 +14,180 @@ const { filterRelevantOutcomes } = require('./_memoryFiltering');
 // _maybeRestartDaemon's catch-all and silently disable daemon auto-restart.
 const lockPaths = require('./_lockPaths');
 
+function _readJson(file) {
+  try {
+    if (!file || !fs.existsSync(file)) return null;
+    return JSON.parse(fs.readFileSync(file, 'utf8'));
+  } catch (_) {
+    return null;
+  }
+}
+
+function _isLoopbackProxyUrl(value) {
+  const raw = String(value || '').trim();
+  if (!raw) return false;
+  try {
+    const u = new URL(raw);
+    const host = u.hostname.toLowerCase();
+    return u.protocol === 'http:' && (host === '127.0.0.1' || host === 'localhost' || host === '::1' || host === '[::1]');
+  } catch (_) {
+    return false;
+  }
+}
+
+function _stripTomlComment(line) {
+  let out = '';
+  let quote = null;
+  let escaped = false;
+  for (const ch of String(line || '')) {
+    if (escaped) {
+      out += ch;
+      escaped = false;
+      continue;
+    }
+    if (ch === '\\' && quote === '"') {
+      out += ch;
+      escaped = true;
+      continue;
+    }
+    if ((ch === '"' || ch === "'") && !quote) {
+      quote = ch;
+      out += ch;
+      continue;
+    }
+    if (ch === quote) {
+      quote = null;
+      out += ch;
+      continue;
+    }
+    if (ch === '#' && !quote) break;
+    out += ch;
+  }
+  return out.trim();
+}
+
+function _tomlStringValue(value) {
+  const raw = _stripTomlComment(value);
+  const match = raw.match(/^(['"])([\s\S]*)\1$/);
+  return match ? match[2] : raw.trim();
+}
+
+function _codexConfigPath() {
+  if (process.env.CODEX_CONFIG_FILE || process.env.EVOMAP_CODEX_CONFIG_FILE) {
+    return process.env.CODEX_CONFIG_FILE || process.env.EVOMAP_CODEX_CONFIG_FILE;
+  }
+  const home = process.env.HOME || os.homedir();
+  return home ? path.join(home, '.codex', 'config.toml') : null;
+}
+
+function _codexConfigExpectsProxy() {
+  const file = _codexConfigPath();
+  if (!file || !fs.existsSync(file)) return false;
+  let selectedProvider = null;
+  let section = '';
+  const providerUrls = {};
+  try {
+    const content = fs.readFileSync(file, 'utf8');
+    for (const line of content.split(/\r?\n/)) {
+      const clean = _stripTomlComment(line);
+      if (!clean) continue;
+      const sectionMatch = clean.match(/^\[([^\]]+)\]$/);
+      if (sectionMatch) {
+        section = sectionMatch[1].trim();
+        continue;
+      }
+      const kv = clean.match(/^([A-Za-z0-9_.-]+)\s*=\s*([\s\S]+)$/);
+      if (!kv) continue;
+      const key = kv[1].trim();
+      const value = _tomlStringValue(kv[2]);
+      if (!section && key === 'model_provider') {
+        selectedProvider = value;
+        continue;
+      }
+      const providerMatch = section.match(/^model_providers\.([A-Za-z0-9_.-]+)$/);
+      if (providerMatch && key === 'base_url') {
+        providerUrls[providerMatch[1]] = value;
+        continue;
+      }
+      if (!section && key === 'base_url' && _isLoopbackProxyUrl(value)) return true;
+    }
+  } catch {
+    return false;
+  }
+  if (selectedProvider && _isLoopbackProxyUrl(providerUrls[selectedProvider])) return true;
+  return Object.keys(providerUrls).some(name =>
+    /(?:evomap|proxy)/i.test(name) && _isLoopbackProxyUrl(providerUrls[name])
+  );
+}
+
+function _proxyExpected() {
+  if (String(process.env.EVOMAP_PROXY || '').trim() === '1') return true;
+  if (String(process.env.A2A_TRANSPORT || '').trim().toLowerCase() === 'mailbox') return true;
+  if (_isLoopbackProxyUrl(process.env.EVOMAP_PROXY_URL) || _isLoopbackProxyUrl(process.env.ANTHROPIC_BASE_URL)) return true;
+  if (_codexConfigExpectsProxy()) return true;
+
+  const home = process.env.HOME || os.homedir();
+  const settingsFile = process.env.CLAUDE_SETTINGS_FILE || process.env.EVOMAP_CLAUDE_SETTINGS_FILE ||
+    (home ? path.join(home, '.claude', 'settings.json') : null);
+  const settings = _readJson(settingsFile);
+  const cfg = settings && settings.env;
+  return !!(cfg && (
+    _isLoopbackProxyUrl(cfg.EVOMAP_PROXY_URL) ||
+    (String(cfg.EVOMAP_PROXY_AUTO_INJECTED || '') === '1' && _isLoopbackProxyUrl(cfg.ANTHROPIC_BASE_URL))
+  ));
+}
+
+function _proxyReachable(url, token) {
+  if (!_isLoopbackProxyUrl(url) || !token) return false;
+  try {
+    const { execFileSync } = require('child_process');
+    execFileSync(process.execPath, ['-e', `
+const fs = require('fs');
+const http = require('http');
+const url = process.argv[1].replace(/\\/+$/, '') + '/proxy/status';
+const token = fs.readFileSync(0, 'utf8').trim();
+if (!token) process.exit(1);
+const req = http.get(url, { headers: { Authorization: 'Bearer ' + token } }, (res) => {
+  let body = '';
+  res.setEncoding('utf8');
+  res.on('data', (chunk) => {
+    body += chunk;
+    if (body.length > 1024 * 1024) req.destroy(new Error('response too large'));
+  });
+  res.on('end', () => {
+    if (res.statusCode < 200 || res.statusCode >= 300) process.exit(1);
+    let parsed;
+    try { parsed = JSON.parse(body); } catch (_) { process.exit(1); }
+    if (parsed && parsed.status === 'running' && (parsed.proxy_protocol_version || parsed.schema_version || parsed.node_id != null)) {
+      process.exit(0);
+    }
+    process.exit(1);
+  });
+});
+req.setTimeout(700, () => req.destroy(new Error('timeout')));
+req.on('error', () => process.exit(1));
+`, url], { input: String(token), stdio: ['pipe', 'ignore', 'ignore'], timeout: 1200, windowsHide: true });
+    return true;
+  } catch (_) {
+    return false;
+  }
+}
+
+function _proxyHealthyIfExpected() {
+  if (!_proxyExpected()) return true;
+  const dir = process.env.EVOLVER_SETTINGS_DIR || path.join(os.homedir(), '.evolver');
+  const settings = _readJson(path.join(dir, 'settings.json'));
+  const proxy = settings && settings.proxy;
+  if (!proxy || !proxy.url) return false;
+  if (proxy.pid) {
+    try { process.kill(proxy.pid, 0); } catch (e) {
+      if (!(e && e.code === 'EPERM')) return false;
+    }
+  }
+  if (!proxy.token) return false;
+  return _proxyReachable(proxy.url, proxy.token);
+}
+
 // Auto-restart guard: if the evolver daemon is not running when a new agent
 // session starts, attempt a background restart. This covers the "idle-death"
 // scenario: the user closed the machine (macOS sleep), the process died due to
@@ -69,7 +243,7 @@ function _maybeRestartDaemon(evolverRoot) {
       }
     } catch (_) { /* lock file unreadable or absent: assume not running */ }
 
-    if (daemonRunning) return; // already alive, nothing to do
+    if (daemonRunning && _proxyHealthyIfExpected()) return; // already alive, nothing to do
 
     // Daemon appears dead. Spawn lifecycle.js start in the background so
     // this session-start script exits immediately (< 50 ms) and does not
@@ -305,5 +479,11 @@ function main() {
 if (require.main === module) {
   main();
 } else {
-  module.exports = { belongsToWorkspace };
+  module.exports = {
+    belongsToWorkspace,
+    _isLoopbackProxyUrl,
+    _proxyExpected,
+    _proxyReachable,
+    _proxyHealthyIfExpected,
+  };
 }

package/src/config.js

@@ -85,9 +85,17 @@ const HUB_SEARCH_TIMEOUT_MS = envPositiveInt('EVOLVER_HUB_SEARCH_TIMEOUT_MS', 80
 const PUBLIC_DEFAULT_HUB_URL = 'https://evomap.ai';
 
 function resolveHubUrl() {
-  const raw = process.env.A2A_HUB_URL
-    || process.env.EVOMAP_HUB_URL
-    || process.env.EVOLVER_DEFAULT_HUB_URL
+  // Trim each candidate and fall through on empty/whitespace-only values.
+  // A trailing space in a `.env` value (common with quoted entries like
+  // A2A_HUB_URL="https://evomap.ai ") otherwise survives into endpoint
+  // construction: `hubUrl.replace(/\/+$/, '')` strips trailing slashes but
+  // NOT whitespace, producing "https://evomap.ai /a2a/events/poll" which
+  // fails URL validation (#580 Bug 1). `||` alone would also pick a
+  // whitespace-only override as "truthy", so trim-then-fall-through here.
+  const pick = (v) => { const t = (v == null ? '' : String(v)).trim(); return t || null; };
+  const raw = pick(process.env.A2A_HUB_URL)
+    || pick(process.env.EVOMAP_HUB_URL)
+    || pick(process.env.EVOLVER_DEFAULT_HUB_URL)
     || PUBLIC_DEFAULT_HUB_URL;
 
   if (process.env.EVOMAP_HUB_ALLOW_INSECURE !== '1') {