@evomap/evolver 1.84.1 → 1.84.2

package/src/adapters/kiro.js

@@ -1,6 +1,6 @@
 const fs = require('fs');
 const path = require('path');
-const { copyHookScripts, removeHookScripts } = require('./hookAdapter');
+const { copyHookScripts, removeHookScripts, removeMarkedSection, assertSafeConfigDir } = require('./hookAdapter');
 
 const HOOK_SCRIPTS_DIR_NAME = 'hooks';
 const EVOLVER_MARKER = '<!-- evolver-evolution-memory -->';
@@ -110,6 +110,7 @@ function install({ configRoot, evolverRoot, force }) {
   const hooksDir = path.join(kiroDir, HOOK_SCRIPTS_DIR_NAME);
   const agentsMdPath = path.join(configRoot, 'AGENTS.md');
   const scriptsBase = '.kiro/hooks';
+  assertSafeConfigDir(kiroDir, '.kiro', { subdirs: [HOOK_SCRIPTS_DIR_NAME] });
 
   const hookPaths = Object.values(HOOK_FILES).map(name => path.join(hooksDir, name));
 
@@ -153,6 +154,7 @@ function uninstall({ configRoot }) {
   const kiroDir = path.join(configRoot, '.kiro');
   const hooksDir = path.join(kiroDir, HOOK_SCRIPTS_DIR_NAME);
   const agentsMdPath = path.join(configRoot, 'AGENTS.md');
+  assertSafeConfigDir(kiroDir, '.kiro', { subdirs: [HOOK_SCRIPTS_DIR_NAME] });
 
   let changed = false;
   let removedCount = 0;
@@ -173,19 +175,9 @@ function uninstall({ configRoot }) {
   const scripts = removeHookScripts(hooksDir);
   if (scripts > 0) changed = true;
 
-  try {
-    if (fs.existsSync(agentsMdPath)) {
-      let content = fs.readFileSync(agentsMdPath, 'utf8');
-      if (content.includes(EVOLVER_MARKER)) {
-        const idx = content.indexOf(EVOLVER_MARKER);
-        const nextSection = content.indexOf('\n## ', idx + EVOLVER_MARKER.length);
-        const endIdx = nextSection !== -1 ? nextSection : content.length;
-        content = content.slice(0, idx).trimEnd() + (nextSection !== -1 ? content.slice(endIdx) : '');
-        fs.writeFileSync(agentsMdPath, content.trimEnd() + '\n', 'utf8');
-        changed = true;
-      }
-    }
-  } catch { /* ignore */ }
+  if (removeMarkedSection(agentsMdPath, EVOLVER_MARKER)) {
+    changed = true;
+  }
 
   console.log(changed
     ? `[kiro] Uninstalled evolver hooks (${removedCount} hook files + ${scripts} scripts removed).`

package/src/adapters/opencode.js

@@ -1,6 +1,6 @@
 const fs = require('fs');
 const path = require('path');
-const { copyHookScripts, removeHookScripts } = require('./hookAdapter');
+const { copyHookScripts, removeHookScripts, removeMarkedSection, assertSafeConfigDir } = require('./hookAdapter');
 
 const HOOK_SCRIPTS_DIR_NAME = 'hooks';
 const PLUGINS_DIR_NAME = 'plugins';
@@ -124,6 +124,7 @@ function install({ configRoot, evolverRoot, force }) {
   const pluginsDir = path.join(opencodeDir, PLUGINS_DIR_NAME);
   const pluginPath = path.join(pluginsDir, PLUGIN_FILE_NAME);
   const agentsMdPath = path.join(configRoot, 'AGENTS.md');
+  assertSafeConfigDir(opencodeDir, '.opencode', { subdirs: [HOOK_SCRIPTS_DIR_NAME, PLUGINS_DIR_NAME] });
 
   if (!force && isEvolverManagedPluginFile(pluginPath)) {
     console.log('[opencode] Evolver plugin already installed. Use --force to overwrite.');
@@ -292,6 +293,7 @@ function uninstall({ configRoot }) {
   const pluginsDir = path.join(opencodeDir, PLUGINS_DIR_NAME);
   const pluginPath = path.join(pluginsDir, PLUGIN_FILE_NAME);
   const agentsMdPath = path.join(configRoot, 'AGENTS.md');
+  assertSafeConfigDir(opencodeDir, '.opencode', { subdirs: [HOOK_SCRIPTS_DIR_NAME, PLUGINS_DIR_NAME] });
 
   let changed = false;
 
@@ -302,19 +304,9 @@ function uninstall({ configRoot }) {
   const scripts = removeHookScripts(hooksDir);
   if (scripts > 0) changed = true;
 
-  try {
-    if (fs.existsSync(agentsMdPath)) {
-      let content = fs.readFileSync(agentsMdPath, 'utf8');
-      if (content.includes(EVOLVER_MARKER)) {
-        const idx = content.indexOf(EVOLVER_MARKER);
-        const nextSection = content.indexOf('\n## ', idx + EVOLVER_MARKER.length);
-        const endIdx = nextSection !== -1 ? nextSection : content.length;
-        content = content.slice(0, idx).trimEnd() + (nextSection !== -1 ? content.slice(endIdx) : '');
-        fs.writeFileSync(agentsMdPath, content.trimEnd() + '\n', 'utf8');
-        changed = true;
-      }
-    }
-  } catch { /* ignore */ }
+  if (removeMarkedSection(agentsMdPath, EVOLVER_MARKER)) {
+    changed = true;
+  }
 
   console.log(changed
     ? '[opencode] Uninstalled evolver plugin and hooks.'

package/src/adapters/scripts/_runtimePaths.js

@@ -0,0 +1,114 @@
+// _runtimePaths.js
+// Shared path resolution for evolver hook scripts.
+//
+// Two responsibilities:
+//   1. Locate the evolver package root, supporting:
+//      - $EVOLVER_ROOT explicit override
+//      - The "scripts colocated with src" layout used during dev (../../..)
+//      - The npm-global install layout, where the hook script lives under
+//        `<prefix>/lib/node_modules/<host>/.../hooks/` and `..` walks lead
+//        somewhere outside the evolver package. We resolve via
+//        `require.resolve('@evomap/evolver/package.json')` instead.
+//      - The `~/skills/evolver` fallback (some users symlink there).
+//
+//   2. Locate (or pick a writable default for) the evolution memory graph,
+//      so that hook scripts in environments without an evolver-managed
+//      project directory still record outcomes somewhere instead of
+//      reporting "nowhere (no Hub or local path)" (#536).
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+function isEvolverPackageJson(filePath) {
+  try {
+    const raw = fs.readFileSync(filePath, 'utf8');
+    const pkg = JSON.parse(raw);
+    return pkg && (pkg.name === '@evomap/evolver' || pkg.name === 'evolver');
+  } catch {
+    return false;
+  }
+}
+
+function findEvolverRoot() {
+  if (process.env.EVOLVER_ROOT) {
+    const explicit = process.env.EVOLVER_ROOT;
+    if (fs.existsSync(path.join(explicit, 'package.json')) &&
+        isEvolverPackageJson(path.join(explicit, 'package.json'))) {
+      return explicit;
+    }
+  }
+
+  // Dev/repo layout: this file lives at src/adapters/scripts/_runtimePaths.js,
+  // so `../../..` is the package root.
+  const repoRoot = path.resolve(__dirname, '..', '..', '..');
+  if (fs.existsSync(path.join(repoRoot, 'package.json')) &&
+      isEvolverPackageJson(path.join(repoRoot, 'package.json'))) {
+    return repoRoot;
+  }
+
+  // npm-global / npm-local install layout. The hook script may have been
+  // copied out of the package into `.claude/hooks/` etc., breaking relative
+  // walks. Use require.resolve to find the installed package authoritatively.
+  //
+  // SECURITY: do NOT include `process.cwd()` here. A hostile workspace can
+  // place its own `node_modules/@evomap/evolver/package.json`, which would
+  // be selected here and control `findMemoryGraph()` -> the memory graph
+  // contents become attacker-controlled prompt-injection material in
+  // `evolver-session-start.js`'s `additionalContext`. Restrict to trusted,
+  // user/system-scoped install roots.
+  try {
+    const pkgJson = require.resolve('@evomap/evolver/package.json', {
+      paths: [
+        path.join(os.homedir(), '.npm-global', 'lib', 'node_modules'),
+        path.join(os.homedir(), '.local', 'lib', 'node_modules'),
+        '/usr/lib/node_modules',
+        '/usr/local/lib/node_modules',
+      ],
+    });
+    if (pkgJson && isEvolverPackageJson(pkgJson)) {
+      return path.dirname(pkgJson);
+    }
+  } catch { /* not installed via npm */ }
+
+  const homeSkills = path.join(os.homedir(), 'skills', 'evolver');
+  if (fs.existsSync(path.join(homeSkills, 'package.json')) &&
+      isEvolverPackageJson(path.join(homeSkills, 'package.json'))) {
+    return homeSkills;
+  }
+
+  return null;
+}
+
+// Returns a path to the evolution memory graph, or a fallback location that
+// is guaranteed to be writable. Never returns null — when no evolver root is
+// available, we fall back to `~/.evolver/memory/evolution/memory_graph.jsonl`
+// so npm-global installs without a project-local evolver still capture
+// outcomes (#536). Callers that need a "does the file already exist" check
+// should use `fs.existsSync()` separately.
+function findMemoryGraph(evolverRoot) {
+  if (process.env.MEMORY_GRAPH_PATH) {
+    return process.env.MEMORY_GRAPH_PATH;
+  }
+  if (evolverRoot) {
+    const lower = path.join(evolverRoot, 'memory', 'evolution', 'memory_graph.jsonl');
+    if (fs.existsSync(lower)) return lower;
+    const upper = path.join(evolverRoot, 'MEMORY', 'evolution', 'memory_graph.jsonl');
+    if (fs.existsSync(upper)) return upper;
+    // Neither exists yet — prefer lowercase under the evolver root if the
+    // root itself is writable (dev/local install case).
+    try {
+      fs.accessSync(evolverRoot, fs.constants.W_OK);
+      const dir = path.dirname(lower);
+      try { fs.mkdirSync(dir, { recursive: true }); } catch { /* fall through */ }
+      return lower;
+    } catch { /* not writable, fall through to user-level */ }
+  }
+
+  // User-level fallback. Always writable, consistent across platforms.
+  const userDir = path.join(os.homedir(), '.evolver', 'memory', 'evolution');
+  try { fs.mkdirSync(userDir, { recursive: true }); } catch { /* best-effort */ }
+  return path.join(userDir, 'memory_graph.jsonl');
+}
+
+module.exports = { findEvolverRoot, findMemoryGraph };

package/src/adapters/scripts/evolver-session-end.js

@@ -5,75 +5,51 @@
 // Input: stdin JSON. Output: stdout JSON with followup_message.
 
 const fs = require('fs');
-const path = require('path');
-const { execSync, spawnSync } = require('child_process');
+const { spawnSync } = require('child_process');
 // 10 MB — prevents RangeError on large child process output (e.g. git log/diff
 // on large repos). See GHSA reports / issue #451.
 const MAX_EXEC_BUFFER = 10 * 1024 * 1024;
 
-
-function findEvolverRoot() {
-  const candidates = [
-    process.env.EVOLVER_ROOT,
-    path.resolve(__dirname, '..', '..', '..'),
-  ];
-  for (const c of candidates) {
-    if (c && fs.existsSync(path.join(c, 'package.json'))) {
-      try {
-        const pkg = JSON.parse(fs.readFileSync(path.join(c, 'package.json'), 'utf8'));
-        if (pkg.name === '@evomap/evolver' || pkg.name === 'evolver') return c;
-      } catch { /* skip */ }
-    }
-  }
-  const homeSkills = path.join(require('os').homedir(), 'skills', 'evolver');
-  if (fs.existsSync(path.join(homeSkills, 'package.json'))) return homeSkills;
-  return null;
-}
-
-function findMemoryGraph(evolverRoot) {
-  if (process.env.MEMORY_GRAPH_PATH && fs.existsSync(process.env.MEMORY_GRAPH_PATH)) {
-    return process.env.MEMORY_GRAPH_PATH;
-  }
-  const candidates = [
-    evolverRoot && path.join(evolverRoot, 'memory', 'evolution', 'memory_graph.jsonl'),
-    evolverRoot && path.join(evolverRoot, 'MEMORY', 'evolution', 'memory_graph.jsonl'),
-  ];
-  for (const c of candidates) {
-    if (c && fs.existsSync(c)) return c;
-  }
-  if (evolverRoot) {
-    const defaultPath = path.join(evolverRoot, 'memory', 'evolution', 'memory_graph.jsonl');
-    fs.mkdirSync(path.dirname(defaultPath), { recursive: true });
-    return defaultPath;
+const { findEvolverRoot, findMemoryGraph } = require('./_runtimePaths');
+
+function runGit(args, cwd) {
+  // Argv-array form, no shell. Avoids POSIX `2>/dev/null` redirects that
+  // break on Windows cmd.exe (#537). Failures (e.g. no HEAD~1 in a fresh
+  // repo) are surfaced as a non-zero status; callers distinguish them
+  // from successful empty output via the `ok` flag (PR #94 round-6 LOW).
+  const res = spawnSync('git', args, {
+    cwd,
+    encoding: 'utf8',
+    timeout: 5000,
+    maxBuffer: MAX_EXEC_BUFFER,
+    stdio: ['ignore', 'pipe', 'pipe'],
+    shell: false,
+  });
+  if (res.status === 0 && typeof res.stdout === 'string') {
+    return { ok: true, out: res.stdout.trim() };
   }
-  return null;
+  return { ok: false, out: '' };
 }
 
 function getGitDiffStats() {
-  try {
-    const cwd = process.cwd();
-    const stat = execSync('git diff --stat HEAD~1 2>/dev/null || git diff --stat 2>/dev/null || echo ""', {
-      cwd,
-      encoding: 'utf8',
-      timeout: 5000, maxBuffer: MAX_EXEC_BUFFER
-    }).trim();
-    const diffContent = execSync('git diff HEAD~1 --no-color 2>/dev/null || git diff --no-color 2>/dev/null || echo ""', {
-      cwd,
-      encoding: 'utf8',
-      timeout: 5000, maxBuffer: MAX_EXEC_BUFFER
-    }).trim();
-    const filesChanged = (stat.match(/\d+ files? changed/) || ['0'])[0];
-    const insertions = (stat.match(/(\d+) insertions?/) || [null, '0'])[1];
-    const deletions = (stat.match(/(\d+) deletions?/) || [null, '0'])[1];
-    return {
-      stat,
-      summary: `${filesChanged}, +${insertions}/-${deletions}`,
-      diffSnippet: diffContent.slice(0, 2000),
-      hasChanges: stat.length > 0,
-    };
-  } catch {
-    return { stat: '', summary: 'unknown', diffSnippet: '', hasChanges: false };
-  }
+  const cwd = process.cwd();
+  // Distinguish "git failed (no HEAD~1, etc.)" from "git succeeded with
+  // empty output (e.g. empty merge)". The previous `||` chain treated
+  // both as falsy and fell through to the working-tree diff, which can
+  // surface unrelated unstaged changes as the session outcome.
+  const statHead1 = runGit(['diff', '--stat', 'HEAD~1'], cwd);
+  const stat = statHead1.ok ? statHead1.out : runGit(['diff', '--stat'], cwd).out;
+  const diffHead1 = runGit(['diff', '--no-color', 'HEAD~1'], cwd);
+  const diffContent = diffHead1.ok ? diffHead1.out : runGit(['diff', '--no-color'], cwd).out;
+  const filesChanged = (stat.match(/\d+ files? changed/) || ['0'])[0];
+  const insertions = (stat.match(/(\d+) insertions?/) || [null, '0'])[1];
+  const deletions = (stat.match(/(\d+) deletions?/) || [null, '0'])[1];
+  return {
+    stat,
+    summary: `${filesChanged}, +${insertions}/-${deletions}`,
+    diffSnippet: diffContent.slice(0, 2000),
+    hasChanges: stat.length > 0,
+  };
 }
 
 function detectSignals(text) {

package/src/adapters/scripts/evolver-session-start.js

@@ -7,37 +7,7 @@ const fs = require('fs');
 const path = require('path');
 const os = require('os');
 
-function findEvolverRoot() {
-  const candidates = [
-    process.env.EVOLVER_ROOT,
-    path.resolve(__dirname, '..', '..', '..'),
-  ];
-  for (const c of candidates) {
-    if (c && fs.existsSync(path.join(c, 'package.json'))) {
-      try {
-        const pkg = JSON.parse(fs.readFileSync(path.join(c, 'package.json'), 'utf8'));
-        if (pkg.name === '@evomap/evolver' || pkg.name === 'evolver') return c;
-      } catch { /* skip */ }
-    }
-  }
-  const homeSkills = path.join(require('os').homedir(), 'skills', 'evolver');
-  if (fs.existsSync(path.join(homeSkills, 'package.json'))) return homeSkills;
-  return null;
-}
-
-function findMemoryGraph(evolverRoot) {
-  if (process.env.MEMORY_GRAPH_PATH && fs.existsSync(process.env.MEMORY_GRAPH_PATH)) {
-    return process.env.MEMORY_GRAPH_PATH;
-  }
-  const candidates = [
-    evolverRoot && path.join(evolverRoot, 'memory', 'evolution', 'memory_graph.jsonl'),
-    evolverRoot && path.join(evolverRoot, 'MEMORY', 'evolution', 'memory_graph.jsonl'),
-  ];
-  for (const c of candidates) {
-    if (c && fs.existsSync(c)) return c;
-  }
-  return null;
-}
+const { findEvolverRoot, findMemoryGraph } = require('./_runtimePaths');
 
 function readLastN(filePath, n) {
   try {

package/src/config.js

@@ -51,10 +51,29 @@ const HUB_SEARCH_TIMEOUT_MS = envInt('EVOLVER_HUB_SEARCH_TIMEOUT_MS', 8000);
 const PUBLIC_DEFAULT_HUB_URL = 'https://evomap.ai';
 
 function resolveHubUrl() {
-  return process.env.A2A_HUB_URL
+  const raw = process.env.A2A_HUB_URL
     || process.env.EVOMAP_HUB_URL
     || process.env.EVOLVER_DEFAULT_HUB_URL
     || PUBLIC_DEFAULT_HUB_URL;
+
+  if (process.env.EVOMAP_HUB_ALLOW_INSECURE !== '1') {
+    let parsed;
+    try {
+      parsed = new URL(raw);
+    } catch {
+      throw new Error(
+        '[config] Hub URL is not a valid URL: ' + JSON.stringify(raw) + '. ' +
+        'Set EVOMAP_HUB_ALLOW_INSECURE=1 to bypass (local dev / mock hub only).'
+      );
+    }
+    if (parsed.protocol !== 'https:') {
+      throw new Error(
+        '[config] Hub URL must use https:// — got ' + JSON.stringify(raw) + '. ' +
+        'Set EVOMAP_HUB_ALLOW_INSECURE=1 to bypass (local dev / mock hub only).'
+      );
+    }
+  }
+  return raw;
 }
 
 // --- Solidify & Validation ---