fix(eval): adopt agent-eval 0.135.1

[drewstone]

Summary

• pin @tangle-network/agent-eval to 0.135.1
• migrate the WebVoyager research command from removed prompt-evolution exports to the maintained pairwise ranking API
• upgrade the optional Claude Code provider to 3.5.3 and update its fail-closed process-error patch for the current source
• pin PostCSS 8.5.24

Checks

• frozen install
• lint and typecheck
• build
• 1,933 of 1,933 tests passed across 159 files
• package boundary check passed across 271 files
• two-variant WebVoyager command selected the expected candidate
• provider construction and idempotent postinstall patch passed
• provider patch transform, idempotency, and upstream-drift tests passed

Security

• production audit: 0 advisories
• full audit: 0 advisories
• the 2 open GitHub alerts on main are old development-only @hono/node-server lock entries; this lock resolves 2.0.12, above both fixed versions

[tangletools]

✅ Auto-approved drewstone PR — ba9b407c

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

_{tangletools · auto-approval · reason: drewstone_author · 2026-07-28T23:04:03Z}

[tangletools]

⚠️ Review Interrupted — ba9b407c

The review runner stopped before publishing a final verdict: webhook_restarted.

State	Detail
Interrupted	webhook restarted

No review verdict was produced for this run. Trigger a fresh review on the current PR head if the PR is still open.

_{tangletools · #139 · model: kimi-for-coding · updated 2026-07-28T23:05:24Z}

[tangletools]

✅ Auto-approved drewstone PR — ba9b407c

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

_{tangletools · auto-approval · reason: drewstone_author · 2026-07-28T23:06:20Z}

[tangletools]

🟢 Value Audit — sound

Verdict	sound
Concerns	0 (none)
Heuristic	0.0s
Duplication	0.0s
Interrogation	77.0s (2 bridge agents)
Total	77.0s

💰 Value — sound

Forced migration off removed agent-eval prompt-evolution APIs, executed as a clean simplification (the old evolution call was already a no-op ranking pass); no capability lost, no better approach available.

• What it does: Three coupled dep bumps in one PR: (1) pins @tangle-network/agent-eval to 0.135.1 (from ^0.23.0) and rewrites bench/research/webvoyager-agent-eval-loop.mjs to drop runPromptEvolution/JsonlTrialCache/aggregateRunScore in favor of the maintained PairwiseSteeringOptimizer + AxGepaSteeringOptimizer APIs; (2) bumps the optional ai-sdk-provider-claude-code from ^2.2.3 to 3.5.3 and simplifies scripts/pos
• Goals it achieves: Keep the WebVoyager research command working against a current agent-eval (the old prompt-evolution exports were removed upstream), and keep the fail-closed Claude Code process-error patch aligned with the provider's 3.5.x source. Net effect: the command gets simpler (-107 lines), depends only on maintained APIs, and the postinstall patch has fewer fragile needle anchors.
• Assessment: Good change, in the codebase's grain. The key signal: the old runPromptEvolution call (bench/research/webvoyager-agent-eval-loop.mjs:124-125 in HEAD~1) ran with generations:1 and a mutateAdapter.mutate that literally threw — so it was already just a single-generation ranking pass that produced evolution.bestVariant.id. The new code produces the equivalent pairwise.recommendedVariantId (webvoyager-
• Better / existing approach: none — this is the right approach. Searched for a local equivalent to reuse: the only other GEPA-style loop is bench/design/gepa/loop.ts, but it is design-audit-specific and its own header comment (loop.ts:16-17) says it is 'upstreamable to agent-eval' — i.e. the upstream is the canonical home, exactly what this PR migrrates onto. The WebVoyager file correctly stays a thin adapter (help text at :3
• Model: opencode/zai-coding-plan/glm-5.2
• Bridge attempts: 2
• Bridge warning: opencode/kimi-for-coding/k2p7: bridge stream ended without value-audit content

🎯 Usefulness — sound

Forced dependency migration that keeps two already-reachable capabilities (WebVoyager research loop, Claude Code provider patch) working against agent-eval 0.135.1's removed exports; no new surface, no dead code introduced.

• Integration: Both touchpoints are wired and reachable. The WebVoyager loop is exposed as pnpm research:webvoyager:agent-eval (package.json:50) and its optimize subcommand consumes the new PairwiseSteeringOptimizer().optimize(rows,{weights}) return shape fully — recommendedVariantId (line 106), backend (line 124), rankings (line 126). The provider patch runs on every install via the postinstall sc
• Fit with existing patterns: Migration to PairwiseSteeringOptimizer matches the codebase's own stated direction — the updated help text (line 314) explicitly reframes the script as 'Browser Agent Driver produces and scores variants; agent-eval ranks them,' consistent with the existing thin-adapter pattern shared with extract-google-flights-corpus.mjs. The patch continues the repo's established fail-closed string-anchor patc
• Real-world viability: The optimize path degrades gracefully: AxGEPA skips cleanly on <2 variants or missing keys (lines 207-218), and the pairwise ranking still produces a result for the single-variant case (the explicit variantIds.length < 2 branch at line 128). The postinstall patch is fail-closed — if upstream 3.5.3's receivedResultMessage anchor or catch-block shape drifts, it throws with a clear message (line
• Model: opencode/zai-coding-plan/glm-5.2
• Bridge attempts: 1

No concerns — sound change, no better or existing approach found. ✅

---

What this audit checks

It judges the change on its merits — not whether it was tasked out in an issue. Unticketed, fast-moving work is fine; the question is whether the change is good and whether a better or existing approach should be used instead.

Pass	What it asks
Heuristic	Vague title? Whitespace-only or cruft-bearing diff? (content signals only)
Duplication	Do added function/class names already exist elsewhere in the repo?
Value Audit	What does it do? What goal does it achieve? Is it good? Better architecture or already-exists?
Usefulness Audit	Does it integrate and fit? Will it hold up in real use and actually get used?

Findings are concerns, not blocks — the human reviewer decides what to do with them.

_{value-audit · 20260728T230800Z}

[tangletools]

✅ No Blockers — ba9b407c

Review health 100/100 · Reviewer score 65/100 · Confidence 85/100 · 10 findings (10 low)

glm: Correctness 65 · Security 65 · Testing 65 · Architecture 65

Reviewer score is advisory once the run is complete and the verdict has no blockers.

Full multi-shot audit completed 5/5 planned shots over 5 changed files. Global verifier still owns final merge decision.

🟡 LOW Changeset omits caret-to-exact pinning strategy shift — .changeset/update-agent-eval.md

package.json moves ai-sdk-provider-claude-code from ^2.2.3 to a bare 3.5.3, @tangle-network/agent-eval from ^0.23.0 to 0.135.1, and pnpm overrides pin postcss from ^8.5.10 to 8.5.24 — all dropping the caret for exact pins. The changeset summary describes the functional change but not this supply-chain strategy shift. Impact is minimal for consumers (versions still resolve identically at install time today), but repo contributors and downstream forks benefit from knowing the pinning policy changed. Consider a one-clause addition or accept as internal detail.

🟡 LOW Dead intersection helper orphaned by refactor — bench/research/webvoyager-agent-eval-loop.mjs

function intersection(lists) (lines 287-291) has zero callers in this file or anywhere in bench/, src/, scripts/ (rg-confirmed). It was used by the removed evolution/scenario logic. Delete it with the rest of the cleanup. No runtime impact, just rot.

🟡 LOW No compile-time safety net for bench/research .mjs — bench/research/webvoyager-agent-eval-loop.mjs

tsconfig.json include: ['src/**/*'] excludes bench/, so pnpm lint (tsc --noEmit) cannot catch type drift against @tangle-network/agent-eval. The API surface I verified (recommendedVariantId, backend, rankings) is correct today, but a future agent-eval bump can break this file silently until someone runs pnpm research:webvoyager:agent-eval optimize. Pre-existing condition, not introduced here — flagging because the dependency just jumped 0.23 -> 0.135.

🟡 LOW Changeset policy unclear for optional/devDep bumps — package.json

CLAUDE.md says 'Every PR with user-visible changes must include a changeset.' This PR has no .changeset/*.md added in this shot. Per the exemption ('Chores, docs-only tweaks, internal refactors with no consumer impact don't need one') this arguably qualifies since ai-sdk-provider-claude-code is optional and agent-eval is a devDep — but confirm with the global reviewer that no changeset is required, since the claude-code provider is a documented user-facing provider (docs/guides/providers.md).

🟡 LOW Commit message understates PR scope — package.json

Commit subject is 'fix(eval): adopt agent-eval 0.135.1' but the diff also bumps ai-sdk-provider-claude-code 2.x -> 3.x (a MAJOR) and pins postcss 8.5.24. The claude-code major bump is the higher-risk change and is invisible from the message. Suggest amending the subject/body to mention all three, or splitting. No functional impact.

🟡 LOW postinstall patch remains fragile under 3.x minor/patch releases — package.json

scripts/postinstall-provider-patches.mjs matches literal strings ('let receivedResultMessage = false;' + a multi-line catch block) inside ai-sdk-provider-claude-code/dist/index.js. Verified these anchors still exist in 3.5.3 today, but exact-pinning to '3.5.3' (not ^3.5.3) is what protects against breakage — any future bump of this dep will need to re-verify anchors. Worth a one-line README/code comment on the pin rationale; current state is functionally correct.

🟡 LOW claude-code provider now requires zod ^4 only (dropped ^3) — pnpm-lock.yaml

The peerDependencies for ai-sdk-provider-claude-code@3.5.3 are zod: ^4.0.0, narrowed from ^3.0.0 || ^4.0.0 at 2.3.0. The lockfile correctly resolves the whole tree to zod@4.4.3 (was 4.3.6), so there is no conflict today, but any future re-introduction of a zod-3-only transitive would fail peer resolution. Not a blocker; flagging the tightened peer contract.

🟡 LOW postcss override pinned to exact 8.5.24 instead of caret range — pnpm-lock.yaml

The postcss override changed from ^8.5.10 to the exact 8.5.24. This is consistent with package.json and intentionally freezes the version (likely to satisfy a transitive security advisory), but it means future pnpm update will not pick up patch releases without an explicit override bump. Confirm the pin is intentional; if so, no action needed.

🟡 LOW No test covers the patch transform — scripts/postinstall-provider-patches.mjs

The patch mutates a vendored provider file via fragile multi-line string anchors but has no unit test asserting (a) the transform produces the expected catch block, (b) idempotency on a second apply, and (c) the drift error fires when anchors are missing. This is a pre-existing gap (the old patch had the same exposure) and the upstream file in node_modules was manually verified to match, but each agent-eval bump will continue to require manual re-verification until a snapshot-style test is added. Not blocking for this PR.

🟡 LOW Patch existence-check only verifies declaration, not assignment — scripts/postinstall-provider-patches.mjs

The guard source.includes(resultState) confirms let receivedResultMessage = false; is present but does not confirm upstream still sets it to true on result messages. If a future upstream rename/rework kept the declaration but removed the assignment, the patch would silently apply a dead else if (receivedResultMessage) branch that never fires — post-result exit errors would regress to thrown errors with no test catching it. Cheap fix: also assert source.includes('receivedResultMessage = true') (or the assignment needle) alongside the declaration check, matching the defensive style already used for catchNeedle.

---

_{tangletools · 2026-07-28T23:13:22Z · trace}

[tangletools]

✅ Approved — 10 non-blocking findings — ba9b407c

Full multi-shot audit completed 5/5 planned shots over 5 changed files. Global verifier still owns final merge decision.

Full immutable report for this review: trace

Summary comment for this run: full summary

---

_{tangletools · 2026-07-28T23:13:22Z · immutable trace}

[tangletools]

✅ Auto-approved drewstone PR — 21f345b8

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

_{tangletools · auto-approval · reason: drewstone_author · 2026-07-28T23:17:43Z}