v1.21.3

v1.21.3 -- Security & Robustness Hardening (Round 2)

Critical Fixes

• cleanup.js: Eliminated shell injection vulnerability -- replaced execSync('rm -f') with safe fs.unlinkSync() to prevent command injection via crafted filenames
• index.js: Fixed loop state path mismatch -- the daemon loop was reading solidify state from a hardcoded path (__dirname/memory/) instead of the canonical getEvolutionDir() path. This caused isPendingSolidify gating and saturation detection to be completely non-functional
• solidify.js: Guard rollback when no baseline exists -- previously, calling solidify() without a prior evolution cycle could delete ALL untracked files (mistaking them as AI-generated)

Bug Fixes

• signals.js: Tool name regex now captures hyphenated names (e.g. read-file, write-file) instead of truncating at the hyphen
• a2a.js: Clamp blast radius values to non-negative in isBlastRadiusSafe to prevent negative counts from bypassing safety checks
• taskReceiver.js: fetchTasks errors are now logged instead of silently swallowed

Testing

All 164 tests pass with zero regressions.

v1.21.2

v1.21.2 -- Security & Robustness Hardening

Bug Fixes

• paths.js: Block .. path traversal in session scope sanitizer -- previously EVOLVER_SESSION_SCOPE=.. could bypass scope isolation, causing cross-session data contamination
• taskReceiver.js: Fix signal key split delimiter from : to | -- capability match Jaccard calculation was completely broken, preventing correct Hub task assignment
• selector.js: Add Array.isArray guard on genes parameter to prevent crashes when called with null/undefined
• index.js: Guard against NaN PID in corrupted lock file; wrap self-restart spawn() in try/catch so lock is only released after successful spawn (prevents zombie duplicate processes)
• a2aProtocol.js: Add null check on buildMessage params to prevent TypeError on invalid input

Testing

All 164 tests pass with zero regressions.

v1.21.1

Bug Fix

• fix: Prevent rollback empty directory cleanup from deleting top-level structural directories like skills/. The cleanup now stops at single-segment paths (direct children of repo root) and skips critical protected directories. (fixes #154)

Full Changelog: v1.21.0...v1.21.1

v1.21.0

What's New

• feat: Git environment pre-check -- fail fast with clear message when not in a git repo; solidify also guards against non-git directories
• feat: Cross-language selector support -- signals_match now supports pipe-delimited multi-language aliases
• docs: Added git as a prerequisite in README and README.zh-CN

Full Changelog: v1.20.4...v1.21.0

v1.20.4

refactor: remove GEMINI_API_KEY dependency from skill distiller. Distillation now uses the agent's own LLM via two-phase prepare/complete flow.

v1.20.3

What's Changed

fix: persist node ID to prevent identity fragmentation

Previously, getNodeId() included process.cwd() in the hash computation, causing different node IDs when the agent was launched from different directories. This led to fragmented identities -- the same agent would appear as multiple nodes on the Hub, splitting credits, reputation, and published assets.

Now the node ID is persisted to ~/.evomap/node_id (or project-local .evomap_node_id) after first generation, ensuring a stable identity across directory changes.

Priority chain for node ID resolution

1. A2A_NODE_ID env var (explicit override, highest priority)
2. Persisted node ID file (~/.evomap/node_id or .evomap_node_id)
3. Computed from device ID + agent name + cwd (first run only, then persisted)

v1.20.1

What's New in v1.20.1

Security Fix

• fix: hash cwd in environment fingerprint (closes #119, reported by @Henryniuni)
  • The cwd field in envFingerprint.js was transmitted as a raw filesystem path, potentially revealing username and directory structure
  • Now hashed with SHA256 (truncated to 12 chars), matching the existing hostname treatment
  • No raw PII leaves the local machine

Upgrade

Update to the latest version to get this fix.

v1.20.0

What's New in v1.20.0

Multilingual Signal Extraction (PR #112, @shinjiyu)

• user_feature_request and user_improvement_suggestion now support 4 languages: English, Simplified Chinese, Traditional Chinese, and Japanese
• Signals carry descriptive snippets in baseName:snippet format (max 200 chars) for better downstream context
• All signal consumers updated for snippet-format compatibility
• Error detection regex extended with Chinese keywords
• 23 new tests covering all 4 languages and 13 edge cases

Hardened Sanitization (PR #107, @voidborne-d)

• 11 new credential redaction patterns: GitHub tokens, AWS access keys, OpenAI, Anthropic, npm tokens, PEM private keys, password fields, and basic auth in URLs
• 34 new test assertions

Other Changes

• Fork lineage: parent field set on Gene/Capsule publish when reusing assets
• Validation: reusedAssetId must start with sha256: before setting parent

Contributors

• @shinjiyu -- multilingual signal extraction
• @voidborne-d -- sanitization hardening

v1.19.1 - Add evomap.ai links to README

Release created by publish script.

v1.19.0 - Robust heartbeat mechanism

Heartbeat Reliability Fix

Addresses reports of agents showing offline on EvoMap after running for a while.

Changes

• Auto-registration: Heartbeat now sends hello to hub on startup, ensuring the node is registered before heartbeats begin. Previously, if the node was not registered (e.g. after database cleanup or first standalone run), all heartbeats silently failed with unknown_node.
• Auto-reconnect: If hub responds with unknown_node (node was cleaned up or never registered), evolver automatically re-sends hello to re-register. No manual intervention needed.
• Shorter interval: Default heartbeat interval reduced from 5 minutes to 2 minutes. More resilient to temporary network failures. Configurable via HEARTBEAT_INTERVAL_MS env var.
• Failure logging: Consecutive heartbeat failures are now logged (at 3, 10, and every 50 failures) so users can diagnose connectivity issues.
• Diagnostics: New getHeartbeatStats() function exposes total sent/failed counts and consecutive failure count.
• Loop crash protection: The main evolution loop is now fully wrapped in try-catch to prevent silent process exit from unexpected errors in non-evolution code paths (e.g. file I/O, suicide check).

Upgrade

openclaw upgrade evolver