dsh-continual-evolve 0.11.0 → 0.12.1

package/lib/review-scheduler.js

@@ -1,183 +0,0 @@
-/**
- * Serial latest-boundary scheduler for automatic memory+review snapshots.
- *
- * One runner exists per session. A burst is coalesced by durable cursor rather
- * than promise arrival: once multiple pending captures settle, the highest
- * comparable boundary runs first. A cursor advances only after success/no-op;
- * errors, aborts, and stale boundaries leave it unchanged.
- */
-/** Bound unresolved acquisitions; actual auto capture is serialized per session. */
-const MAX_PENDING_ACQUISITIONS = 16;
-/**
- * Create a scheduler with ZCode-compatible serial/coalescing semantics.
- *
- * @param execute - one serial extraction/review operation
- * @param cursorOf - extracts the durable boundary from a snapshot
- */
-export function createReviewScheduler(execute, cursorOf) {
-    let cursor;
-    let running;
-    let shuttingDown = false;
-    let wakePending;
-    const pending = [];
-    const shutdownController = new AbortController();
-    const signal = shutdownController.signal;
-    const trackPending = (acquisition) => {
-        const entry = {};
-        entry.promise = acquisition.then((result) => {
-            entry.result = result;
-            wakePending?.();
-            return result;
-        });
-        pending.push(entry);
-        while (pending.length > MAX_PENDING_ACQUISITIONS)
-            pending.shift();
-    };
-    const takeHighestPending = async () => {
-        while (!signal.aborted) {
-            for (let index = pending.length - 1; index >= 0; index -= 1) {
-                if (pending[index]?.result?.status === "error")
-                    pending.splice(index, 1);
-            }
-            if (pending.length === 0)
-                return undefined;
-            const settled = pending.filter((entry) => entry.result !== undefined);
-            if (settled.length > 0) {
-                let bestIndex = -1;
-                let bestCursor;
-                for (let index = 0; index < settled.length; index += 1) {
-                    const entry = settled[index];
-                    if (!entry || entry.result?.status !== "acquired")
-                        continue;
-                    const candidate = cursorOf(entry.result.snapshot);
-                    const order = bestCursor === undefined || candidate === undefined
-                        ? 1
-                        : compareReviewCursors(candidate, bestCursor);
-                    if (bestIndex < 0 || order === undefined || order > 0) {
-                        bestIndex = pending.indexOf(entry);
-                        bestCursor = candidate;
-                    }
-                }
-                // bestIndex is always set here: the error purge above leaves only
-                // acquired snapshots in `settled` (SnapshotAcquisition has exactly
-                // two variants), so the first settled entry takes the slot.
-                const chosen = pending[bestIndex];
-                pending.splice(bestIndex, 1);
-                for (let index = pending.length - 1; index >= 0; index -= 1) {
-                    if (pending[index]?.result !== undefined)
-                        pending.splice(index, 1);
-                }
-                return chosen?.result;
-            }
-            await new Promise((resolve) => {
-                const cleanup = () => signal.removeEventListener("abort", onAbort);
-                const onAbort = () => {
-                    cleanup();
-                    resolve();
-                };
-                wakePending = () => {
-                    cleanup();
-                    wakePending = undefined;
-                    resolve();
-                };
-                signal.addEventListener("abort", onAbort, { once: true });
-            });
-        }
-        return undefined;
-    };
-    const processSnapshot = async (snapshot) => {
-        if (shuttingDown || signal.aborted)
-            return;
-        const nextCursor = cursorOf(snapshot);
-        if (cursor !== undefined && nextCursor !== undefined) {
-            const order = compareReviewCursors(nextCursor, cursor);
-            if (order !== undefined && order <= 0)
-                return;
-        }
-        let status;
-        try {
-            status = await execute({ snapshot, signal });
-        }
-        catch {
-            return;
-        }
-        if (!shuttingDown && (status === "success" || status === "no-op") && nextCursor !== undefined) {
-            const order = cursor === undefined ? 1 : compareReviewCursors(nextCursor, cursor);
-            if (order === undefined || order > 0)
-                cursor = nextCursor;
-        }
-    };
-    const run = async (first) => {
-        try {
-            let acquisition = await waitForSnapshotAcquisitionOrShutdown(first, signal);
-            while (acquisition.status !== "shutdown" && !shuttingDown) {
-                if (acquisition.status === "acquired")
-                    await processSnapshot(acquisition.snapshot);
-                const next = await takeHighestPending();
-                if (!next)
-                    break;
-                acquisition = next;
-            }
-        }
-        finally {
-            if (shuttingDown) {
-                pending.length = 0;
-                wakePending?.();
-                wakePending = undefined;
-            }
-            running = undefined;
-        }
-    };
-    return {
-        async drain() {
-            while (running)
-                await running;
-        },
-        getCursor() {
-            return cursor;
-        },
-        hasPendingWork() {
-            return running !== undefined || pending.length > 0;
-        },
-        schedule(snapshot) {
-            if (shuttingDown)
-                return;
-            const acquisition = acquireSnapshot(snapshot);
-            if (running)
-                trackPending(acquisition);
-            else
-                running = run(acquisition);
-        },
-        shutdown() {
-            if (shuttingDown)
-                return;
-            shuttingDown = true;
-            pending.length = 0;
-            shutdownController.abort();
-            wakePending?.();
-            wakePending = undefined;
-        },
-    };
-}
-function acquireSnapshot(snapshot) {
-    return Promise.resolve(snapshot).then((value) => ({ status: "acquired", snapshot: value }), () => ({ status: "error" }));
-}
-function waitForSnapshotAcquisitionOrShutdown(acquisition, signal) {
-    if (signal.aborted)
-        return Promise.resolve({ status: "shutdown" });
-    return new Promise((resolve) => {
-        const cleanup = () => signal.removeEventListener("abort", onAbort);
-        const onAbort = () => {
-            cleanup();
-            resolve({ status: "shutdown" });
-        };
-        signal.addEventListener("abort", onAbort, { once: true });
-        void acquisition.then((result) => {
-            cleanup();
-            resolve(result);
-        });
-    });
-}
-export { compareReviewCursors } from "./turn-snapshot.js";
-import { compareReviewCursors } from "./turn-snapshot.js";
-//# sourceMappingURL=review-scheduler.js.map

package/lib/review.d.ts

@@ -1,60 +0,0 @@
-/**
- * The automatic /evolve review gate: a cheap model call that decides whether
- * the current trajectory justifies running the planner. Runs on a turn
- * interval (and, in a later step, at compaction). The gate is deliberately
- * small (bounded input, small output budget) — it only answers
- * "should we refine?", never "what should we edit?".
- */
-import type { Context } from "@deepseek-ai/cordis";
-import type { Agent } from "@deepseek-ai/dsh-agent";
-import type { HarnessState, RefinementResult } from "./types.js";
-import { type PrefixCacheOptions } from "./prefix-cache.js";
-import { type TokenUsageTarget } from "./token-usage.js";
-import { type RecordLanguage } from "./record-language.js";
-export interface AutoRefineReview {
-    shouldRefine: boolean;
-    rationale: string;
-    instructions?: string;
-}
-export type AutoRefineReason = "turn_snapshot" | "turn_interval" | "compact" | "goal_blocked";
-export interface AutoRefineReviewContext {
-    reason: AutoRefineReason;
-    turnsSinceLastReview: number;
-}
-export interface ReviewOptions {
-    agent: Agent;
-    state: HarnessState;
-    history: readonly RefinementResult[];
-    context: AutoRefineReviewContext;
-    /** Serialized trajectory text; when absent the gate is skipped by the caller. */
-    trajectory?: string;
-    /** Incremental surface rows captured for this turn snapshot. */
-    trajectoryEvents?: readonly unknown[];
-    signal?: AbortSignal;
-    budgetTokens?: number;
-    /** Gap C1: optional provider/model override for the review gate (cheaper model). */
-    overrideProvider?: string;
-    overrideModel?: string;
-    /**
-     * Prefix-cache routing for the gate input. Route A prepends a
-     * session-derived message prefix and drops the flat `<conversation>`
-     * block (same source, structured form); Route B keeps it. Absent →
-     * auto-detect with the default budget.
-     */
-    prefixCache?: PrefixCacheOptions;
-    /** Direct-call token ledger destination; the review phase is fixed by this module. */
-    tokenUsage?: TokenUsageTarget;
-    /**
-     * Authoring language for the rationale. Absent → resolved per call
-     * (explicit config upstream, else durable client preference, else
-     * trajectory detection, else `en`).
-     */
-    language?: RecordLanguage;
-}
-export declare const AUTO_REVIEW_SYSTEM_PROMPT = "You are the automatic /evolve review gate.\n\nDecide whether this checkpoint should continue the non-memory /evolve path.\nA dedicated memory extraction agent has already processed the same snapshot\nwith a frozen memory manifest, so do NOT approve solely to create, update,\narchive, or delete a memory entry. Decline with a rationale that the memory\nphase owns that evidence. For the remaining kinds, approve ONLY when the\ntrajectory shows repeated evidence: the same failure, tactic, delegation\nrole, or behavioral policy recurs at least twice across turns. A single\none-off interaction defaults to decline no matter how useful it looks for\nfuture turns \u2014 one data point is never enough to generalize. When approving,\ncite the repeated spans in the instructions so the planner can ground its\nedits.\n\nThe current harness state below includes GLOBAL entries (scope=global) plus\nthis session's local entries (scope=local). When a topic is already covered\nby a global entry, do NOT approve a local duplicate of it \u2014 decline and say\nin the rationale that the topic is already covered globally.\n\nReject one-off noise, unsupported hypotheses, transient tool outputs, and\nrequests that carry no reusable content.\n\nStale local entries (superseded, long-unused, obsolete facts) are a valid\nrefine target: approve with instructions naming the entry ids, and tell the\nplanner to archive them (archive hides from injection, data stays restorable)\nrather than delete.\n\nSkill-related trajectories (the evidence concerns creating or improving a\nskill entry) are judged against the DSH skill quality standard (skill-audit\ndimensions: frontmatter routing, the 7 structural features, paragraph\nskeleton, no duplication of the official 11 skills or covered skills).\nApprove only when the trajectory shows a REAL trigger scenario and the\nresulting skill would meet the standard; otherwise decline and say in the\nrationale what must improve \u2014 drafting follows skill-creator, and the\nplanner receives the standard as its <skill_quality_standard> block.\n\nRepeated multi-step workflows (session start/end routines, recurring\nwrap-up or handoff procedures) are a valid refine target: approve with\ninstructions telling the planner to propose a guidance skill (kind=skill,\nskill_kind=guidance \u2014 a SKILL.md document, no python reference). Only\npropose when the same workflow recurs in the trajectory \u2014 never for\none-off flows. Auto-created skills are always offered to the user for a\ndecision before they land; the gate never writes a skill silently.\n\nReturn JSON only:\n{\n  \"shouldRefine\": true|false,\n  \"rationale\": \"short reason\",\n  \"instructions\": \"optional concise instructions for /evolve if shouldRefine is true\"\n}";
-/** Parse the gate's JSON reply. */
-export declare function parseAutoRefineReview(text: string): AutoRefineReview;
-/** Serialize surface events to bounded role-prefixed text. */
-export declare function serializeSurface(events: readonly unknown[], maxChars: number): string;
-export declare function reviewAutoRefine(ctx: Context, options: ReviewOptions): Promise<AutoRefineReview>;
-//# sourceMappingURL=review.d.ts.map

package/lib/review.js

@@ -1,145 +0,0 @@
-import { extractJsonObject } from "./plan.js";
-import { formatHarnessStateForPrompt, historyForPrompt } from "./render.js";
-import { sessionEventsOf } from "./inject.js";
-import { buildPrefixMessages, detectPlannerRoute, resolvePrefixCache } from "./prefix-cache.js";
-import { asLlmSessionId, streamText } from "./llm-text.js";
-import { createTokenUsageObserver } from "./token-usage.js";
-import { recordLanguageInstruction, resolveRecordLanguage } from "./record-language.js";
-export const AUTO_REVIEW_SYSTEM_PROMPT = `You are the automatic /evolve review gate.
-
-Decide whether this checkpoint should continue the non-memory /evolve path.
-A dedicated memory extraction agent has already processed the same snapshot
-with a frozen memory manifest, so do NOT approve solely to create, update,
-archive, or delete a memory entry. Decline with a rationale that the memory
-phase owns that evidence. For the remaining kinds, approve ONLY when the
-trajectory shows repeated evidence: the same failure, tactic, delegation
-role, or behavioral policy recurs at least twice across turns. A single
-one-off interaction defaults to decline no matter how useful it looks for
-future turns — one data point is never enough to generalize. When approving,
-cite the repeated spans in the instructions so the planner can ground its
-edits.
-
-The current harness state below includes GLOBAL entries (scope=global) plus
-this session's local entries (scope=local). When a topic is already covered
-by a global entry, do NOT approve a local duplicate of it — decline and say
-in the rationale that the topic is already covered globally.
-
-Reject one-off noise, unsupported hypotheses, transient tool outputs, and
-requests that carry no reusable content.
-
-Stale local entries (superseded, long-unused, obsolete facts) are a valid
-refine target: approve with instructions naming the entry ids, and tell the
-planner to archive them (archive hides from injection, data stays restorable)
-rather than delete.
-
-Skill-related trajectories (the evidence concerns creating or improving a
-skill entry) are judged against the DSH skill quality standard (skill-audit
-dimensions: frontmatter routing, the 7 structural features, paragraph
-skeleton, no duplication of the official 11 skills or covered skills).
-Approve only when the trajectory shows a REAL trigger scenario and the
-resulting skill would meet the standard; otherwise decline and say in the
-rationale what must improve — drafting follows skill-creator, and the
-planner receives the standard as its <skill_quality_standard> block.
-
-Repeated multi-step workflows (session start/end routines, recurring
-wrap-up or handoff procedures) are a valid refine target: approve with
-instructions telling the planner to propose a guidance skill (kind=skill,
-skill_kind=guidance — a SKILL.md document, no python reference). Only
-propose when the same workflow recurs in the trajectory — never for
-one-off flows. Auto-created skills are always offered to the user for a
-decision before they land; the gate never writes a skill silently.
-
-Return JSON only:
-{
-  "shouldRefine": true|false,
-  "rationale": "short reason",
-  "instructions": "optional concise instructions for /evolve if shouldRefine is true"
-}`;
-/** Parse the gate's JSON reply. */
-export function parseAutoRefineReview(text) {
-    const value = extractJsonObject(text);
-    if (typeof value !== "object" || value === null || Array.isArray(value)) {
-        throw new Error("auto-refine review JSON must be an object");
-    }
-    const record = value;
-    const review = {
-        shouldRefine: record["shouldRefine"] === true,
-        rationale: typeof record["rationale"] === "string" ? record["rationale"] : "No rationale provided.",
-    };
-    if (typeof record["instructions"] === "string" && record["instructions"].length > 0) {
-        review.instructions = record["instructions"];
-    }
-    return review;
-}
-/** Serialize surface events to bounded role-prefixed text. */
-export function serializeSurface(events, maxChars) {
-    const lines = [];
-    for (const raw of events) {
-        if (typeof raw !== "object" || raw === null)
-            continue;
-        const event = raw;
-        const role = event.type === "user/message" ? "user" : event.type === "assistant/message" ? "assistant" : null;
-        if (role === null)
-            continue;
-        const content = event.data?.content;
-        if (!Array.isArray(content))
-            continue;
-        const text = content
-            .filter((block) => typeof block === "object" && block !== null && block.type === "text")
-            .map((block) => block.text ?? "")
-            .filter(Boolean)
-            .join(" ");
-        if (text.length > 0) {
-            lines.push(`${role}: ${text}`);
-        }
-    }
-    const joined = lines.join("\n");
-    return joined.length <= maxChars ? joined : joined.slice(-maxChars);
-}
-export async function reviewAutoRefine(ctx, options) {
-    const { agent, state, history } = options;
-    const provider = options.overrideProvider ?? agent.options.provider;
-    const model = options.overrideModel ?? agent.options.model;
-    if (!provider || !model) {
-        throw new Error("evolve: no provider/model route for the review gate");
-    }
-    if (!options.trajectory || options.trajectory.length === 0) {
-        throw new Error("evolve: review gate has no trajectory to judge");
-    }
-    // Route A carries the judged conversation as a session-derived message
-    // prefix and drops the flat block; an empty prefix falls back to B.
-    const events = options.trajectoryEvents ?? sessionEventsOf(agent);
-    const routing = resolvePrefixCache(options.prefixCache);
-    const route = detectPlannerRoute(events, routing.mode);
-    let prefixMessages = [];
-    if (route === "A") {
-        prefixMessages = buildPrefixMessages(events, {
-            ...(provider ? { provider } : {}),
-            ...(model ? { model } : {}),
-            maxChars: routing.maxChars,
-        });
-    }
-    const conversationBlock = prefixMessages.length > 0 ? "" : `<conversation>\n${options.trajectory}\n</conversation>`;
-    const userPrompt = [
-        `<trigger>\n${options.context.reason}; ${options.context.turnsSinceLastReview} turns since the last review\n</trigger>`,
-        `<current_harness_state>\n${formatHarnessStateForPrompt(state)}\n</current_harness_state>`,
-        `<refinement_history>\n${historyForPrompt(history)}\n</refinement_history>`,
-        conversationBlock,
-        "Return shouldRefine=true only when the trajectory shows repeated evidence (>=2 occurrences) useful to this session's future turns. A single one-off interaction defaults to shouldRefine=false. Prefer local edits; do not ask for global refinement here.",
-    ]
-        .filter(Boolean)
-        .join("\n\n");
-    const text = await streamText(ctx, {
-        provider,
-        model,
-        sessionId: asLlmSessionId(agent.id),
-        system: `${AUTO_REVIEW_SYSTEM_PROMPT}\n\n${recordLanguageInstruction(options.language ?? resolveRecordLanguage({ ctx, trajectoryText: options.trajectory }))}`,
-        prompt: userPrompt,
-        maxTokens: options.budgetTokens ?? 8000,
-        signal: options.signal,
-        ...(prefixMessages.length > 0 ? { prefixMessages } : {}),
-        ...(options.tokenUsage ? { onUsage: createTokenUsageObserver(options.tokenUsage, "review", provider, model) } : {}),
-    });
-    return parseAutoRefineReview(text);
-}
-//# sourceMappingURL=review.js.map

package/lib/rollback.d.ts

@@ -1,9 +0,0 @@
-/**
- * Deterministic rollback: rebuild the inverse edit list from the applied
- * result, in reverse order. Rollback is pure data transformation — no LLM
- * is asked to "guess" the previous state.
- */
-import type { RefinementProposal, RefinementResult } from "./types.js";
-/** Build the inverse proposal for an applied refinement. */
-export declare function rollbackProposal(target: RefinementResult): RefinementProposal;
-//# sourceMappingURL=rollback.d.ts.map

package/lib/rollback.js

@@ -1,68 +0,0 @@
-/** Build the inverse proposal for an applied refinement. */
-export function rollbackProposal(target) {
-    const edits = [];
-    for (const edit of [...target.appliedEdits].reverse()) {
-        if (!edit.applied)
-            continue;
-        const inverse = inverseEdit(edit, target.id);
-        if (inverse) {
-            edits.push(inverse);
-        }
-    }
-    return {
-        summary: `Rollback refinement ${target.id}`,
-        rationale: `Restores harness state to the snapshot recorded before refinement ${target.id}.`,
-        expectedOutcome: "Faulty refinement edits are reverted.",
-        edits,
-    };
-}
-function inverseEdit(edit, refinementId) {
-    if (edit.before && edit.after) {
-        // Forward action was an update: restore the before snapshot.
-        // skill_kind rides along (review audit 2026-08-28 B4): without it a
-        // rollback could flip the skill form or fail validation on re-apply.
-        return {
-            action: "update",
-            kind: edit.kind,
-            id: edit.id,
-            title: edit.before.title,
-            content: edit.before.content,
-            path: edit.before.path,
-            reference: edit.before.reference,
-            arguments: edit.before.arguments,
-            ...(edit.before.skill_kind !== undefined ? { skill_kind: edit.before.skill_kind } : {}),
-            metadata: edit.before.metadata,
-            reason: `Rollback ${refinementId}`,
-        };
-    }
-    if (edit.before) {
-        // Forward action was a delete: re-create the entry from the snapshot.
-        // skill_kind is required for the re-created skill to pass the same
-        // contract validation as the original create (B4: a deleted guidance
-        // skill was previously unrecoverable via rollback).
-        return {
-            action: "create",
-            kind: edit.kind,
-            id: edit.id,
-            title: edit.before.title,
-            content: edit.before.content,
-            path: edit.before.path,
-            reference: edit.before.reference,
-            arguments: edit.before.arguments,
-            ...(edit.before.skill_kind !== undefined ? { skill_kind: edit.before.skill_kind } : {}),
-            metadata: edit.before.metadata,
-            reason: `Rollback ${refinementId}`,
-        };
-    }
-    if (edit.after) {
-        // Forward action was a create: delete the created entry.
-        return {
-            action: "delete",
-            kind: edit.kind,
-            id: edit.id,
-            reason: `Rollback ${refinementId}`,
-        };
-    }
-    return undefined;
-}
-//# sourceMappingURL=rollback.js.map

package/lib/rubric.d.ts

@@ -1,29 +0,0 @@
-/** The development fallback key — reachable only when the local key file is unusable. */
-export declare const DEV_RUBRIC_KEY = "dsh-continual-evolve-dev-key";
-/** Name of the per-installation key file under `<baseDir>/evolve/`. */
-export declare const RUBRIC_KEY_FILE_NAME = "rubric.key";
-/** Full path of the per-installation rubric key file. */
-export declare function rubricKeyFilePath(baseDir: string): string;
-export interface RubricCipher {
-    iv: string;
-    tag: string;
-    data: string;
-}
-export declare const RUBRIC_PREFIX = "v1:";
-/** Derive a 32-byte AES-256 key from any passphrase. */
-export declare function deriveKey(passphrase: string): Buffer;
-/** Resolve the effective rubric key with the documented precedence. */
-export declare function resolveRubricKey(baseDir: string, configKey: string | undefined, env?: NodeJS.ProcessEnv, warn?: (message: string) => void): Buffer;
-/** Encrypt rubric plaintext into the `v1:` envelope (never written raw). */
-export declare function encryptRubric(plaintext: string, key: Buffer): string;
-/**
- * Decrypt a `v1:` envelope. Legacy plaintext (no prefix) passes through
- * unchanged so pre-ACL benchmark files keep working. Throws on tampered
- * data, a wrong key, or a malformed envelope.
- */
-export declare function decryptRubric(payload: string, key: Buffer): string;
-/** True when a stored rubric is an encrypted envelope rather than legacy plaintext. */
-export declare function isEncryptedRubric(payload: string): boolean;
-/** Shape helper for tests and callers that inspect envelopes. */
-export declare function parseEnvelope(payload: string): RubricCipher | undefined;
-//# sourceMappingURL=rubric.d.ts.map

package/lib/rubric.js

@@ -1,119 +0,0 @@
-/**
- * Rubric ACL: rubric plaintext never touches the disk. The evaluation runner
- * is the ONLY consumer that decrypts — the optimizer (planner) and the model
- * (with its bash tools) can read benchmark files and see ciphertext only, so
- * rubric isolation is enforced by code, not by prompt construction.
- *
- * Format: `v1:<base64(iv) | base64(tag) | base64(ciphertext)>` — each part is
- * URL-safe base64 without padding, joined by `|`. A value without the `v1:`
- * prefix is treated as legacy plaintext (pre-ACL files) and passes through.
- *
- * Key resolution (first match wins):
- *   1. plugin config `rubricKey`
- *   2. environment `DSH_EVOLVE_RUBRIC_KEY`
- *   3. a per-installation local key file at `<baseDir>/evolve/rubric.key`
- *      (auto-generated with 0600 permissions on first use — every install
- *      gets its own random key, so no user setup is needed and no publicly
- *      known key protects anyone's rubrics)
- *   4. a fixed development key as a last-resort fallback when the key file
- *      can neither be read nor written (warns; only reachable in
- *      pathological environments, since the plugin's stores live under the
- *      same directory)
- * The key string is derived to 32 bytes with SHA-256, so any passphrase works.
- */
-import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-/** The development fallback key — reachable only when the local key file is unusable. */
-export const DEV_RUBRIC_KEY = "dsh-continual-evolve-dev-key";
-/** Name of the per-installation key file under `<baseDir>/evolve/`. */
-export const RUBRIC_KEY_FILE_NAME = "rubric.key";
-/** Full path of the per-installation rubric key file. */
-export function rubricKeyFilePath(baseDir) {
-    return join(baseDir, "evolve", RUBRIC_KEY_FILE_NAME);
-}
-export const RUBRIC_PREFIX = "v1:";
-/** Derive a 32-byte AES-256 key from any passphrase. */
-export function deriveKey(passphrase) {
-    return createHash("sha256").update(passphrase, "utf8").digest();
-}
-/** Resolve the effective rubric key with the documented precedence. */
-export function resolveRubricKey(baseDir, configKey, env = process.env, warn) {
-    if (configKey && configKey.length > 0) {
-        return deriveKey(configKey);
-    }
-    const envKey = env["DSH_EVOLVE_RUBRIC_KEY"];
-    if (envKey && envKey.length > 0) {
-        return deriveKey(envKey);
-    }
-    return loadOrCreateLocalKey(baseDir, warn);
-}
-/**
- * Load the per-installation key file, generating a fresh random key (0600)
- * on first use. Falls back to the development key with a warning when the
- * file can neither be read nor written.
- */
-function loadOrCreateLocalKey(baseDir, warn) {
-    const path = rubricKeyFilePath(baseDir);
-    try {
-        if (existsSync(path)) {
-            const content = readFileSync(path, "utf8").trim();
-            if (content.length > 0) {
-                return deriveKey(content);
-            }
-        }
-        const key = randomBytes(32).toString("hex");
-        mkdirSync(dirname(path), { recursive: true });
-        writeFileSync(path, `${key}\n`, { encoding: "utf8", mode: 0o600 });
-        return deriveKey(key);
-    }
-    catch (cause) {
-        warn?.(`rubric encryption: cannot read/write the local key file (${path}): ${cause instanceof Error ? cause.message : String(cause)} — using the development key`);
-        return deriveKey(DEV_RUBRIC_KEY);
-    }
-}
-/** Encrypt rubric plaintext into the `v1:` envelope (never written raw). */
-export function encryptRubric(plaintext, key) {
-    const iv = randomBytes(12);
-    const cipher = createCipheriv("aes-256-gcm", key, iv);
-    const data = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
-    const tag = cipher.getAuthTag();
-    return `${RUBRIC_PREFIX}${[iv, tag, data].map((part) => part.toString("base64url")).join("|")}`;
-}
-/**
- * Decrypt a `v1:` envelope. Legacy plaintext (no prefix) passes through
- * unchanged so pre-ACL benchmark files keep working. Throws on tampered
- * data, a wrong key, or a malformed envelope.
- */
-export function decryptRubric(payload, key) {
-    if (!payload.startsWith(RUBRIC_PREFIX)) {
-        return payload; // legacy plaintext file
-    }
-    const raw = payload.slice(RUBRIC_PREFIX.length);
-    const parts = raw.split("|");
-    if (parts.length !== 3) {
-        throw new Error("rubric: malformed encrypted envelope");
-    }
-    const [ivText, tagText, dataText] = parts;
-    const iv = Buffer.from(ivText, "base64url");
-    const tag = Buffer.from(tagText, "base64url");
-    const data = Buffer.from(dataText, "base64url");
-    const decipher = createDecipheriv("aes-256-gcm", key, iv);
-    decipher.setAuthTag(tag);
-    return Buffer.concat([decipher.update(data), decipher.final()]).toString("utf8");
-}
-/** True when a stored rubric is an encrypted envelope rather than legacy plaintext. */
-export function isEncryptedRubric(payload) {
-    return payload.startsWith(RUBRIC_PREFIX);
-}
-/** Shape helper for tests and callers that inspect envelopes. */
-export function parseEnvelope(payload) {
-    if (!isEncryptedRubric(payload))
-        return undefined;
-    const parts = payload.slice(RUBRIC_PREFIX.length).split("|");
-    if (parts.length !== 3)
-        return undefined;
-    const [iv, tag, data] = parts;
-    return { iv, tag, data };
-}
-//# sourceMappingURL=rubric.js.map

package/lib/runtime-commands.d.ts

@@ -1,14 +0,0 @@
-import type { EvolutionEngine } from "./service.js";
-import { type CommandRuntimeOptions, type CommandTextResult } from "./command-util.js";
-/** `/evolve pause|resume` — the runtime switch is independent of registration. */
-export declare function executePauseResumeCommand(engine: EvolutionEngine, sub: "pause" | "resume", runtime: CommandRuntimeOptions): CommandTextResult;
-/** `/evolve status` — listener wiring plus per-store entry counts and retention. */
-export declare function executeStatusCommand(engine: EvolutionEngine, sessionId: string, projectKey: string | undefined, runtime: CommandRuntimeOptions): CommandTextResult;
-/**
- * `/evolve usage` — injection counts per entry across the stores the human
- * can see (global + this session + this project), plus the exact direct-call
- * token report. Counts are per-session since the v2 usage shape — "in how
- * many sessions did this entry surface".
- */
-export declare function executeUsageCommand(engine: EvolutionEngine, sessionId: string, projectKey: string | undefined): CommandTextResult;
-//# sourceMappingURL=runtime-commands.d.ts.map