v1.80.4

What's Changed

Internal refactor

• Gene schema factory (src/gep/schemas/gene.js): introduced createGene() and validateGene() as a single source of truth for the Gene object shape. All array fields (signals_match, strategy, validation, preconditions, epigenetic_marks, learning_history, anti_patterns) and constraints.forbidden_paths are now freshly cloned on every gene instance, eliminating a class of cross-gene contamination bugs where downstream .push() calls could leak between gene objects.
• Evolve pipeline modularization: Stage 4 (hub) and Stage 5 (enrich) are now extracted into dedicated modules under src/evolve/pipeline/, reducing src/evolve.js from ~700 lines to a thin orchestrator and making each stage independently testable.
• Migrated solidify.js, assetStore.js, and skillDistiller.js to use createGene() for gene construction and normalization.

Tests

• 21 new unit tests for the Gene schema factory (defaulting, normalization, idempotency, mutation isolation, validator errors).
• New integration tests for the extracted pipeline stages (evolveEnrich, evolveHub).
• Full suite: 1309 / 1309 tests passing.

Internal improvements and stability enhancements.

v1.80.3

v1.80.3

Fixes

• proxy: env override no longer undoes a successful secret rotation (#529 follow-up, Bugbot review on PR #22).

  v1.80.2 introduced an A2A_NODE_SECRET env-vs-store reconciliation that fires whenever the two values disagree. That reconciliation also fired during the verification heartbeat that runs right after hello rotates the secret, silently overwriting the freshly stored secret Z with the stale env value Y. The heartbeat would sign with Y, get a 403, and the proxy slipped back into the exact 30-minute auth loop the original patch fixed.

  v1.80.3: as soon as hello persists a hub-supplied fresh secret, the env override is suppressed for the rest of this process. Hub-supplied secrets are always newer than A2A_NODE_SECRET, so this locks in the right side of the conflict. The verification heartbeat now signs with the rotated secret as intended.

  New regression test in test/lifecycleStaleNodeSecret.test.js covers the exact path Bugbot flagged (env=Y, store=X stale, rotate to Z, verification heartbeat must use Z).

Recommendation

If you are running v1.80.2 in proxy mode, please upgrade. v1.80.2 still fixes the original cold-start case, but if a stale A2A_NODE_SECRET was set and the hub triggered a rotation later, the heartbeat afterwards could silently revert. v1.80.3 closes that window.

v1.80.2

v1.80.2

Fixes

• proxy: break stale node_secret auth loop in proxy mode (#529).

  Proxy users hitting an infinite heartbeat 403 -> rotate_secret hello -> node_id_already_claimed -> 30-min backoff cycle would previously stay stuck across restarts because LifecycleManager preferred the persisted secret in ~/.evomap/mailbox/state.json over a freshly minted A2A_NODE_SECRET in .env.

  • nodeSecret now reconciles env vs store on conflict: a valid hex64 env value wins and the store is rewritten, with a one-shot warning so operators know to clean up stale state.
  • reAuthenticate recognises node_id_already_claimed, drops the cached secret, and retries hello without an Authorization header. If the second rotate is still rejected, a high-priority manual_secret_reset_required system event is delivered to the mailbox pointing operators at https://evomap.ai/account instead of churning forever.
  • 5 new regression tests in test/lifecycleStaleNodeSecret.test.js.

Internal

• evolve pipeline Stage 7 (dispatch / solidify / bridge) extracted into src/evolve/pipeline/dispatch.js. No behaviour change; covered by 5 new unit tests.

v1.80.1

Fixed

• Validator no longer floods the Hub with env_fail reports when the local toolchain cannot run node <script>. The validator daemon now runs a one-shot preflight self-test on startup that confirms spawn(node, [trivial-script]) exits cleanly inside the sandbox. If preflight fails (no node on PATH for headless invocations, missing exec perm, unwritable TMPDIR, ...) the validator role is skipped instead of returning commands_passed=0, duration_ms=1 for every Hub-issued task. A user-visible warning is printed once with the diagnostic stderr tail so the operator can fix the host. Restart evolver after fixing PATH to re-enable the validator role.

Added

• Validator report diagnostics: per-command summaries + failure_class on every ValidationReport. Each report now carries a top-level failure_class (one of ok, parse_failed, executable_not_allowed, sandbox_block_node_flag, spawn_failed, timeout, exit_nonzero, unknown) and a bounded commands array (capped at 8 entries) where each entry has cmd, ok, exit_code, duration_ms, timed_out, failure_class, and a 240-char stderr_tail. This lets the Hub-side classifier distinguish "Gene shipped legacy node -e \"...\" that the hardened sandbox rejects" from "validator host is broken" instead of lumping both into env_fail. Older Hubs that ignore unknown payload fields keep working unchanged.

Internal

• Refactor: extract Stage 1 (preflight, guards, ATP bootstrap) and Stage 2 (context collection) out of the 1,400-line run() function in src/evolve.js into dedicated pipeline modules (src/evolve/guards.js, src/evolve/pipeline/collect.js, src/evolve/utils.js). Behavior unchanged; full test suite stays green (1236 passing).

v1.80.0

Release created by publish script.

v1.79.1

What's fixed

Windows cmd-popup loop on suicide-respawn (Issue #528)

On Windows, child_process.spawn(detached: true, windowsHide: true) opens a fresh conhost (cmd) window every time -- windowsHide is silently ignored in detached mode (this is a long-standing Node.js limitation, documented in the child_process docs).

So whenever the daemon hit EVOLVER_MAX_CYCLES (default 100) or EVOLVER_MAX_RSS_MB (default 500) and ran the in-process suicide-respawn, Windows users saw a new cmd popup. v1.79.0 made this worse by adding a third spawn site for the cycle hard-timeout, copying the same buggy options.

The two in-process spawn sites are now consolidated into one helper spawnReplacementProcess() that, on Windows, defaults to not spawning. Instead the daemon process.exit(1)s and an external supervisor restarts it. No popup. macOS/Linux behavior is unchanged.

Recommended Windows supervisors

• feishu-evolver-wrapper >= 1.10.0 (recommended; auto-restart with backoff + already detects inner stuck cycles since v1.79.0)
• NSSM (Non-Sucking Service Manager)
• pm2-windows-startup
• Windows Task Scheduler with "On failure: restart"

Escape hatch

Users who explicitly want the in-process respawn (and accept the cmd popups) can opt back in:

EVOLVER_SUICIDE_WINDOWS=true

This is only honored on Windows; it is a no-op everywhere else.

A note on the original report

The reporter's auto-generated diagnosis attributed a separate symptom -- "evolver buy/orders/publish subcommands break the daemon" -- to lock contention on evolver.pid. That hypothesis is incorrect: subcommands do not call acquireLock(); only --loop does. What the reporter observed was the same suicide-respawn cycle ending exactly when a subcommand happened to run, and the new conhost popup made it look like the subcommand caused it. Fixing the popup also fixes the perceived "daemon got killed" symptom.

Install

npm

npm install -g @evomap/evolver@1.79.1

Standalone binary (no Node required)

Platform	Asset
macOS (Apple Silicon)	evolver-darwin-arm64
macOS (Intel)	evolver-darwin-x64
Linux (x86_64)	evolver-linux-x64
Linux (ARM64)	evolver-linux-arm64
Windows (x86_64)	evolver-windows-x64.exe

Verify (Linux/macOS):

sha256sum -c SHA256SUMS.txt --ignore-missing
chmod +x evolver-linux-x64
./evolver-linux-x64 --help

Tests

• test/spawnReplacementProcess.test.js (10 cases covering Windows default, Windows with EVOLVER_SUICIDE_WINDOWS=true, non-Windows, and source-level guards)
• Full suite: 1178 / 1178 passing.

Closes #528.

v1.79.0

What's new

Cycle hard-timeout watchdog (Issue #19)

The daemon main loop in index.js previously called await evolve.run() with no upper bound, so a single hung cycle (unclosed socket, stalled LLM call, etc.) could freeze the process indefinitely. One reporter observed cycle #5372 stuck for 22 days at 0% CPU.

evolve.run() is now wrapped in Promise.race(evolvePromise, cycleTimeoutPromise). When the timeout fires, the daemon emits a diagnostic, force-spawns a replacement process, and exits with code 1 so a host wrapper observes the dead pid and respawns.

Default behavior is opt-out:

• EVOLVER_CYCLE_TIMEOUT_ENABLED (default true)
• EVOLVER_CYCLE_TIMEOUT_MS (default 2700000, 45 minutes)
• EVOLVER_PROGRESS_UPDATE_MS (default 60000)

Set EVOLVER_CYCLE_TIMEOUT_ENABLED=false to keep the v1.78.x behavior.

cycle_progress.json heartbeat

The daemon now atomically writes memory/evolution/cycle_progress.json at cycle start, every 60s while evolve.run() is in flight, and again at sleep entry. External watchdogs (such as feishu-evolver-wrapper v1.10.0+) poll updated_at to detect a true freeze; normal long LLM cycles still refresh it via the 60-second ticker, so legitimate slow cycles will not be flagged as stuck.

Schema:

{ "pid": 12345, "outer_cycle": 5372, "inner_cycle": 17,
  "started_at": 1746543112000, "phase": "evolve.run",
  "updated_at": 1746543210000 }

Install

Option 1: npm (recommended for Node users)

npm install -g @evomap/evolver@1.79.0

Option 2: standalone binary (no Node required)

Download the binary for your platform below. Each .sha256 is the matching checksum; SHA256SUMS.txt contains all five in one file.

Platform	Asset
macOS (Apple Silicon)	evolver-darwin-arm64
macOS (Intel)	evolver-darwin-x64
Linux (x86_64)	evolver-linux-x64
Linux (ARM64)	evolver-linux-arm64
Windows (x86_64)	evolver-windows-x64.exe

Verify integrity (Linux/macOS):

sha256sum -c SHA256SUMS.txt --ignore-missing
chmod +x evolver-linux-x64
./evolver-linux-x64 --help

Tests

• test/cycleHardTimeout.test.js (11 cases)
• test/cycleProgressFile.test.js (4 cases)
• Full suite: 1168 / 1168 passing.

Closes EvoMap/evolver-private-dev#19.

v1.78.10

Release created by publish script.

Standalone Binaries (new)

This release ships standalone, dependency-free executables for the evolver CLI. No Node.js, no npm, no install — download, chmod +x, run.

Platform	File	Size
macOS (Apple Silicon)	evolver-darwin-arm64	63 MB
macOS (Intel)	evolver-darwin-x64	68 MB
Linux x86_64	evolver-linux-x64	100 MB
Linux ARM64	evolver-linux-arm64	99 MB
Windows x64	evolver-windows-x64.exe	115 MB

Quick start (macOS / Linux)

curl -L -o evolver https://github.com/EvoMap/evolver/releases/download/v1.78.10/evolver-darwin-arm64
chmod +x evolver
./evolver --help

Verify your download

SHA256SUMS.txt lists the sha256 for every asset. Each binary also has a sibling <name>.sha256 file.

shasum -a 256 -c SHA256SUMS.txt

The npm package (@evomap/evolver) and source distribution remain unchanged and continue to be the recommended path for users with Node.js already installed.

v1.78.9

Release created by publish script.

v1.78.8

Release created by publish script.