v1.87.2

Highlights

This release brings the proxy/Bedrock and force-update fixes from main into the supported channel, and lands the ATP autoBuyer consent surface that started in #141 and finished with the default-on tuning in #145.

If you upgraded straight from 1.87.0 (skipping 1.87.1), this release also includes everything 1.87.1 shipped — the recallVerifier default flip (#136) and the setup-hooks _memoryFiltering.js fix (#547).

Added

• ATP autoBuyer consent surface (#141). New evolver atp <enable|disable|status> subcommands, ack file at <memory>/atp-autobuy-ack.json, env override EVOLVER_ATP_AUTOBUY=on|off. Resolution order: env > ack > default. Atomic setConsent writes, strict ack validation, CLI warning when env override would silently shadow the ack, and URL.origin sanitization on the daemon WARN so basic-auth creds in the hub URL are never logged.

Changed

• ATP autoBuyer default ON for new installs (#145). No env override + no ack → autoBuyer starts under the daily / per-order caps (50/day, 10/order; cold-start half-cap for 5 min). TTY first-run prompt and evolver atp disable are the opt-out paths; an explicit ack=disable continues to win over the default. Daemon/hook/CI cold-start emits a one-time WARN with the hub origin, active caps, and the disable command — never silent.

• recallVerifier default off (#136). Already shipped in 1.87.1; included here for the main-line changelog. Opt back in with EVOLVE_RECALL_VERIFY=1.

Fixed

• Proxy router: canonicalize Bedrock model IDs + skip alias-only 5xx retry (#135) and defense-in-depth canonicalize at proxy boundary (#139). Model alias drift between Anthropic-shaped requests and Bedrock model IDs is resolved at both layers; a 5xx originating from an unresolvable alias is no longer retried as a different alias of the same family.

• forceUpdate preserves .env, .env.local, USER.md, and .evolver/ (#142). Force-update no longer wipes operator configuration or workspace identity files when overlaying a new release.

• evolver setup-hooks ships _memoryFiltering.js (#547, #140, #143). Already shipped in 1.87.1; a regression suite now scans every require('./_*') in the source adapter scripts to assert install + uninstall cover the helpers.

  Thanks to @rendigua for the Windows reproduction on the official 1.87.0 install path, and to @mvanhorn for #550 — an independent fix with the same diagnosis on the same day.

Install

npm i -g @evomap/evolver@latest
# or pinned:
npm i -g @evomap/evolver@1.87.2

Notes

This is a stable patch on top of 1.87.1. Standalone binaries for darwin-arm64 / darwin-x64 / linux-x64 / linux-arm64 / windows-x64 are attached to this release.