@evomap/evolver 1.89.17 → 1.89.19

package/README.ja-JP.md

@@ -1,6 +1,6 @@
 # 🧬 Evolver
 
-[![GitHub stars](https://img.shields.io/badge/Stars-8.7k-2b3137?logo=github&logoColor=white)](https://github.com/EvoMap/evolver/stargazers)
+[![GitHub stars](https://img.shields.io/badge/Stars-8.8k-2b3137?logo=github&logoColor=white)](https://github.com/EvoMap/evolver/stargazers)
 [![License: GPL-3.0](https://img.shields.io/badge/License-GPL--3.0-blue.svg)](https://opensource.org/licenses/GPL-3.0)
 [![Node.js >= 18](https://img.shields.io/badge/Node.js-%3E%3D%2018-green.svg)](https://nodejs.org/)
 [![npm downloads](https://img.shields.io/npm/dm/@evomap/evolver.svg)](https://www.npmjs.com/package/@evomap/evolver)

package/README.ko-KR.md

@@ -1,6 +1,6 @@
 # 🧬 Evolver
 
-[![GitHub stars](https://img.shields.io/badge/Stars-8.7k-2b3137?logo=github&logoColor=white)](https://github.com/EvoMap/evolver/stargazers)
+[![GitHub stars](https://img.shields.io/badge/Stars-8.8k-2b3137?logo=github&logoColor=white)](https://github.com/EvoMap/evolver/stargazers)
 [![License: GPL-3.0](https://img.shields.io/badge/License-GPL--3.0-blue.svg)](https://opensource.org/licenses/GPL-3.0)
 [![Node.js >= 18](https://img.shields.io/badge/Node.js-%3E%3D%2018-green.svg)](https://nodejs.org/)
 [![npm downloads](https://img.shields.io/npm/dm/@evomap/evolver.svg)](https://www.npmjs.com/package/@evomap/evolver)

package/README.md

@@ -1,6 +1,6 @@
 # 🧬 Evolver
 
-[![GitHub stars](https://img.shields.io/badge/Stars-8.7k-2b3137?logo=github&logoColor=white)](https://github.com/EvoMap/evolver/stargazers)
+[![GitHub stars](https://img.shields.io/badge/Stars-8.8k-2b3137?logo=github&logoColor=white)](https://github.com/EvoMap/evolver/stargazers)
 [![License: GPL-3.0](https://img.shields.io/badge/License-GPL--3.0-blue.svg)](https://opensource.org/licenses/GPL-3.0)
 [![Node.js >= 18](https://img.shields.io/badge/Node.js-%3E%3D%2018-green.svg)](https://nodejs.org/)
 [![npm downloads](https://img.shields.io/npm/dm/@evomap/evolver.svg)](https://www.npmjs.com/package/@evomap/evolver)

package/README.zh-CN.md

@@ -1,6 +1,6 @@
 # 🧬 Evolver
 
-[![GitHub stars](https://img.shields.io/badge/Stars-8.7k-2b3137?logo=github&logoColor=white)](https://github.com/EvoMap/evolver/stargazers)
+[![GitHub stars](https://img.shields.io/badge/Stars-8.8k-2b3137?logo=github&logoColor=white)](https://github.com/EvoMap/evolver/stargazers)
 [![License: GPL-3.0](https://img.shields.io/badge/License-GPL--3.0-blue.svg)](https://opensource.org/licenses/GPL-3.0)
 [![Node.js >= 18](https://img.shields.io/badge/Node.js-%3E%3D%2018-green.svg)](https://nodejs.org/)
 [![npm downloads](https://img.shields.io/npm/dm/@evomap/evolver.svg)](https://www.npmjs.com/package/@evomap/evolver)

package/index.js

@@ -464,6 +464,68 @@ function writeCycleProgressAtomic(progressPath, fields) {
   }
 }
 
+function handleCycleTimeout({ error, cycleProgressPath, progressFields, suicideEnabled, args, logPath, spawnReplacementFn }) {
+  const msg = error && error.message ? String(error.message) : String(error);
+  console.error('[Daemon] ' + msg);
+
+  if (!suicideEnabled) {
+    console.warn('[Daemon] Cycle hard-timeout treated as non-fatal because EVOLVER_SUICIDE=false.');
+    writeCycleProgressAtomic(cycleProgressPath, Object.assign({}, progressFields, {
+      phase: 'cycle_timeout_nonfatal',
+    }));
+    return { action: 'continue' };
+  }
+
+  writeCycleProgressAtomic(cycleProgressPath, Object.assign({}, progressFields, {
+    phase: 'cycle_timeout_respawn',
+  }));
+  spawnReplacementFn({
+    reason: 'cycle_hard_timeout',
+    args: args,
+    logPath: logPath,
+  });
+  return { action: 'respawn' };
+}
+
+function logTimedOutEvolveRejection(error, logFn) {
+  const lateMsg = error && error.message ? String(error.message) : String(error);
+  try {
+    logFn('[Daemon] Timed-out evolve.run() eventually rejected: ' + lateMsg);
+  } catch (logError) {
+    const fallbackMsg = logError && logError.message ? String(logError.message) : String(logError);
+    console.error('[Daemon] Failed to log timed-out evolve.run() rejection: ' + fallbackMsg);
+  }
+}
+
+function observeTimedOutEvolvePromise(evolvePromise, logFn = console.error) {
+  if (!evolvePromise || typeof evolvePromise.then !== 'function') {
+    return { status: 'ignored' };
+  }
+
+  Promise.resolve(evolvePromise).then(
+    function () {},
+    function (error) {
+      logTimedOutEvolveRejection(error, logFn);
+    }
+  );
+
+  return { status: 'observing' };
+}
+
+async function waitForTimedOutEvolvePromise(evolvePromise, logFn = console.error) {
+  if (!evolvePromise || typeof evolvePromise.then !== 'function') {
+    return { status: 'ignored' };
+  }
+
+  try {
+    await evolvePromise;
+    return { status: 'resolved' };
+  } catch (error) {
+    logTimedOutEvolveRejection(error, logFn);
+    return { status: 'rejected' };
+  }
+}
+
 function getLastSignals(statePath) {
   try {
     const st = readJsonSafe(statePath);
@@ -1357,6 +1419,7 @@ async function main() {
             const { startProxy } = require('./src/proxy');
             const proxyInfo = await startProxy({
               hubUrl: process.env.A2A_HUB_URL,
+              clientSettings: {},
             });
             console.log('[Proxy] Started on ' + proxyInfo.url);
             try {
@@ -1592,13 +1655,12 @@ async function main() {
             if (typeof progressTicker.unref === 'function') progressTicker.unref();
           }
           let cycleTimeoutHandle = null;
-          let cycleTimedOut = false;
+          let evolvePromise = null;
           try {
-            const evolvePromise = evolve.run();
+            evolvePromise = evolve.run();
             if (cycleTimeoutEnabled && cycleTimeoutMs > 0) {
               const timeoutPromise = new Promise(function (_, reject) {
                 cycleTimeoutHandle = setTimeout(function () {
-                  cycleTimedOut = true;
                   reject(new CycleTimeoutError(cycleTimeoutMs, 'evolve.run', cycleCount));
                 }, cycleTimeoutMs);
                 if (cycleTimeoutHandle && typeof cycleTimeoutHandle.unref === 'function') cycleTimeoutHandle.unref();
@@ -1621,25 +1683,32 @@ async function main() {
           } catch (error) {
             const msg = error && error.message ? String(error.message) : String(error);
             if (error && error.code === 'CYCLE_TIMEOUT') {
-              console.error('[Daemon] ' + msg);
               if (progressTicker) { clearInterval(progressTicker); progressTicker = null; }
               if (cycleTimeoutHandle) { clearTimeout(cycleTimeoutHandle); cycleTimeoutHandle = null; }
-              writeCycleProgressAtomic(cycleProgressPath, {
-                pid: process.pid,
-                outer_cycle: cycleCount,
-                inner_cycle: cycleCount,
-                started_at: t0,
-                phase: 'cycle_timeout_respawn',
-              });
-              spawnReplacementProcess({
-                reason: 'cycle_hard_timeout',
-                args: args,
+              const timeoutAction = handleCycleTimeout({
+                error,
+                cycleProgressPath,
+                progressFields: {
+                  pid: process.pid,
+                  outer_cycle: cycleCount,
+                  inner_cycle: cycleCount,
+                  started_at: t0,
+                },
+                suicideEnabled,
+                args,
                 logPath: getEvolverLogPath(),
+                spawnReplacementFn: spawnReplacementProcess,
               });
-              releaseLock();
-              process.exit(1);
+              if (timeoutAction.action === 'respawn') {
+                releaseLock();
+                process.exit(1);
+              }
+              if (timeoutAction.action === 'continue') {
+                await waitForTimedOutEvolvePromise(evolvePromise);
+              }
+            } else {
+              console.error(`Evolution cycle failed: ${msg}`);
             }
-            console.error(`Evolution cycle failed: ${msg}`);
           } finally {
             if (progressTicker) { clearInterval(progressTicker); progressTicker = null; }
             if (cycleTimeoutHandle) { clearTimeout(cycleTimeoutHandle); cycleTimeoutHandle = null; }
@@ -2748,6 +2817,165 @@ async function main() {
       console.log('');
     }
 
+  } else if (command === 'trajectory-export') {
+    const allowPartial = args.includes('--allow-partial');
+    const runtimeSessions = args.includes('--runtime-sessions');
+    // Strict-by-default marking gate (v1): runtime-session discovery only
+    // collects sessions evolver actively marked (session-start hook), minus
+    // those the gateway already captured. These flags open each gate back up.
+    const includeUnmarked = args.includes('--include-unmarked');
+    const includeGatewayCaptured = args.includes('--include-gateway-captured');
+    try {
+      const optionValue = (name) => {
+        let value;
+        for (let i = 0; i < args.length; i += 1) {
+          const arg = args[i];
+          if (arg === name) {
+            if (i + 1 >= args.length || String(args[i + 1]).startsWith('--')) {
+              throw new Error('missing value for ' + name);
+            }
+            value = String(args[i + 1]);
+          } else if (typeof arg === 'string' && arg.startsWith(name + '=')) {
+            value = arg.slice(name.length + 1);
+          }
+        }
+        return value;
+      };
+      const optionValues = (name) => {
+        const values = [];
+        for (let i = 0; i < args.length; i += 1) {
+          const arg = args[i];
+          if (arg === name) {
+            if (i + 1 >= args.length || String(args[i + 1]).startsWith('--')) {
+              throw new Error('missing value for ' + name);
+            }
+            values.push(String(args[i + 1]));
+          } else if (typeof arg === 'string' && arg.startsWith(name + '=')) {
+            values.push(arg.slice(name.length + 1));
+          }
+        }
+        return values;
+      };
+      const input = optionValue('--input');
+      const output = optionValue('--output');
+      const runtimeSessionDirs = optionValues('--runtime-session-dir');
+      const nodeSecretInline = optionValue('--node-secret');
+      const nodeSecretFile = optionValue('--node-secret-file');
+      const nodeSecretEnv = optionValue('--node-secret-env');
+      const hubPrivateKeyFile = optionValue('--hub-private-key');
+      const nodeSecretKeyringFile = optionValue('--node-secret-keyring');
+      const markedSessionsFile = optionValue('--marked-sessions-file');
+      let nodeSecret;
+      let hubPrivateKey;
+      let nodeSecretKeyring;
+      const nodeSecretSourceCount = [nodeSecretInline, nodeSecretFile, nodeSecretEnv]
+        .filter((value) => value !== undefined).length;
+      if (nodeSecretSourceCount > 1) {
+        throw new Error('use only one node secret source');
+      }
+      if (nodeSecretInline !== undefined) {
+        if (!nodeSecretInline) throw new Error('missing value for --node-secret');
+        if (fs.existsSync(nodeSecretInline)) {
+          try {
+            nodeSecret = fs.readFileSync(nodeSecretInline, 'utf8').trim();
+          } catch (readErr) {
+            const err = new Error('node secret file is not readable: ' + nodeSecretInline);
+            err.cause = readErr;
+            throw err;
+          }
+          if (!nodeSecret) throw new Error('node secret file is empty');
+        } else {
+          nodeSecret = String(nodeSecretInline).trim();
+          if (!nodeSecret) throw new Error('node secret is empty');
+        }
+      }
+      if (nodeSecretFile !== undefined) {
+        if (!nodeSecretFile) throw new Error('missing path for --node-secret-file');
+        try {
+          nodeSecret = fs.readFileSync(nodeSecretFile, 'utf8').trim();
+        } catch (readErr) {
+          const err = new Error('node secret file is not readable: ' + nodeSecretFile);
+          err.cause = readErr;
+          throw err;
+        }
+        if (!nodeSecret) throw new Error('node secret file is empty');
+      }
+      if (nodeSecretEnv !== undefined) {
+        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(nodeSecretEnv)) {
+          throw new Error('invalid environment variable name for --node-secret-env');
+        }
+        nodeSecret = String(process.env[nodeSecretEnv] || '').trim();
+        if (!nodeSecret) throw new Error('node secret environment variable is empty or unset');
+      }
+      if (hubPrivateKeyFile !== undefined) {
+        if (!hubPrivateKeyFile) throw new Error('missing path for --hub-private-key');
+        try {
+          hubPrivateKey = fs.readFileSync(hubPrivateKeyFile, 'utf8');
+        } catch (readErr) {
+          const err = new Error('hub private key file is not readable: ' + hubPrivateKeyFile);
+          err.cause = readErr;
+          throw err;
+        }
+        if (!String(hubPrivateKey || '').trim()) throw new Error('hub private key file is empty');
+      }
+      if (nodeSecretKeyringFile !== undefined) {
+        if (!nodeSecretKeyringFile) throw new Error('missing path for --node-secret-keyring');
+        try {
+          nodeSecretKeyring = JSON.parse(fs.readFileSync(nodeSecretKeyringFile, 'utf8'));
+        } catch (readErr) {
+          const err = new Error('node secret keyring file is not readable or invalid JSON: ' + nodeSecretKeyringFile);
+          err.cause = readErr;
+          throw err;
+        }
+      }
+      const { writeTrajectories } = require('./src/gep/trajectoryExport');
+      const result = writeTrajectories({
+        input,
+        output,
+        nodeSecret,
+        nodeSecretKeyring,
+        hubPrivateKey,
+        allowPartial,
+        runtimeSessions: runtimeSessions ? true : undefined,
+        runtimeSessionDirs,
+        markedSessionsFile,
+        includeUnmarked: includeUnmarked ? true : undefined,
+        includeGatewayCaptured: includeGatewayCaptured ? true : undefined,
+      });
+      console.log('[trajectory-export] Wrote ' + result.trajectories.length + ' trajector' + (result.trajectories.length === 1 ? 'y' : 'ies') + ' to ' + result.outputPath);
+      console.log('[trajectory-export] Read ' + result.rowsRead + ' trace row(s) and ' + (result.sessionTurnsRead || 0) + ' session turn(s) from ' + (result.filesRead || 0) + ' file(s).');
+      if (result.sessionFilesRead > 0) {
+        console.log('[trajectory-export] Converted ' + result.sessionFilesRead + ' runtime session file(s).');
+      }
+      if (result.runtimeSessionDiscovery && result.runtimeSessionDiscovery.enabled) {
+        console.log('[trajectory-export] Runtime session discovery is local-only; no Hub upload is performed.');
+        console.log('[trajectory-export] Runtime discovery scanned '
+          + result.runtimeSessionDiscovery.dirsScanned + ' Codex/Claude dir(s), matched '
+          + result.runtimeSessionDiscovery.filesMatched + ' workspace session file(s).');
+        const mg = result.runtimeSessionDiscovery.markGate;
+        if (mg) {
+          console.log('[trajectory-export] Marking gate: enforce_marked=' + mg.enforceMarked
+            + ', exclude_gateway_captured=' + mg.excludeGatewayCaptured
+            + '; marked_registry=' + mg.markedSessionCount
+            + ', gateway_captured=' + mg.gatewayCapturedCount
+            + ', excluded_unmarked=' + mg.excludedByMark
+            + ', excluded_gateway=' + mg.excludedByGateway + '.');
+        }
+      }
+      if (result.stats) {
+        console.log('[trajectory-export] Scanned ' + result.stats.rowsScanned
+          + ' row(s); encrypted=' + result.stats.encryptedRows
+          + ', skipped_missing_secret=' + result.stats.skippedMissingSecret
+          + ', decrypt_failures=' + result.stats.decryptFailures
+          + ', invalid_json=' + result.stats.invalidJson
+          + ', session_invalid_json=' + (result.stats.sessionInvalidJson || 0)
+          + ', non_prism=' + result.stats.nonPrismSkipped + '.');
+      }
+    } catch (error) {
+      console.error('[trajectory-export] Failed: ' + (error && error.message || error));
+      process.exit(1);
+    }
+
   } else if (command === 'webui') {
     const portFlag = args.find(a => typeof a === 'string' && a.startsWith('--port='));
     const port = portFlag ? Number(portFlag.slice('--port='.length)) : undefined;
@@ -3227,7 +3455,7 @@ async function main() {
     }
 
   } else {
-    console.log(`Usage: node index.js [run|/evolve|login|logout|proxy-token|solidify|review|distill|fetch|sync|asset-log|webui|setup-hooks|reuse|publish|recipe|buy|orders|verify|atp|atp-complete|experiment] [--loop]
+    console.log(`Usage: node index.js [run|/evolve|login|logout|proxy-token|solidify|review|distill|fetch|sync|asset-log|trajectory-export|webui|setup-hooks|reuse|publish|recipe|buy|orders|verify|atp|atp-complete|experiment] [--loop]
   - login                      (authorize this device via the hub, gh-auth-login style; stores an OAuth token used instead of node_secret)
   - logout                     (remove the stored OAuth token)
   - proxy-token                (print the local proxy bearer token for command-backed client auth)
@@ -3276,6 +3504,29 @@ async function main() {
     - --last=<N>               (show last N entries)
     - --since=<ISO_date>       (entries after date)
     - --json                   (raw JSON output)
+  - trajectory-export flags:
+    - --input=<path>|--input <path>
+                                (proxy trace JSONL, Claude/Codex/Cursor session JSONL, or directory; default: platform trace file)
+    - --output=<path>|--output <path>
+                                (output JSONL; default: ./coding-trajectories.jsonl)
+    - --runtime-sessions        (local-only: also scan current-workspace Codex/Claude JSONL from ~/.codex/sessions and ~/.claude/projects; env: EVOLVER_TRAJECTORY_RUNTIME_SESSIONS=1)
+    - --runtime-session-dir=<path>|--runtime-session-dir <path>
+                                (local-only: extra Codex/Claude runtime session directory; may be repeated)
+    - --include-unmarked        (collect runtime sessions even if evolver did not actively mark them; default: strict — only marked sessions are collected; env: EVOLVER_TRAJECTORY_INCLUDE_UNMARKED=1)
+    - --include-gateway-captured (collect runtime sessions even if the proxy gateway already captured them; default: strict — gateway-captured sessions are skipped; env: EVOLVER_TRAJECTORY_INCLUDE_GATEWAY_CAPTURED=1)
+    - --marked-sessions-file=<path>|--marked-sessions-file <path>
+                                (override the evolver-marked-sessions registry path; default: <trace-dir>/marked-sessions.jsonl; env: EVOLVER_MARKED_SESSIONS_FILE)
+    - --allow-partial           (skip unreadable encrypted rows instead of failing the whole export)
+    - --node-secret=<hex|path>|--node-secret <hex|path>
+                                (read node secret from an existing local file, otherwise use the literal value)
+    - --node-secret-file=<path>|--node-secret-file <path>
+                                (read node secret from a local file)
+    - --node-secret-env=<name>|--node-secret-env <name>
+                                (read node secret from an environment variable)
+    - --node-secret-keyring=<path>|--node-secret-keyring <path>
+                                (read versioned node secrets from a JSON file)
+    - --hub-private-key=<path>|--hub-private-key <path>
+                                (decrypt hub_key_envelope trace rows with a local private key)
   - webui flags:
     - --port=<N>               (local Web UI port, default 19821)
 
@@ -3328,5 +3579,8 @@ module.exports = {
   parseBoolEnv,
   CycleTimeoutError,
   writeCycleProgressAtomic,
+  handleCycleTimeout,
+  observeTimedOutEvolvePromise,
+  waitForTimedOutEvolvePromise,
   spawnReplacementProcess,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evomap/evolver",
-  "version": "1.89.17",
+  "version": "1.89.19",
   "description": "A GEP-powered self-evolution engine for AI agents. Features automated log analysis and Genome Evolution Protocol (GEP) for auditable, reusable evolution assets.",
   "main": "index.js",
   "bin": {
@@ -41,7 +41,7 @@
     "@evomap/atp-sdk": "^0.1.0",
     "@evomap/gep-sdk": "^1.5.0",
     "dotenv": "^16.4.7",
-    "undici": "^7.0.0"
+    "undici": "^7.28.0"
   },
   "devDependencies": {
     "javascript-obfuscator": "^5.4.1"
@@ -49,6 +49,11 @@
   "optionalDependencies": {
     "@napi-rs/keyring": "^1.1.6"
   },
+  "overrides": {
+    "@vercel/blob": {
+      "undici": "6.27.0"
+    }
+  },
   "files": [
     "assets/",
     "index.js",

package/src/adapters/claudeCode.js

@@ -1,12 +1,20 @@
 const fs = require('fs');
 const path = require('path');
-const { mergeJsonFile, copyHookScripts, appendSectionToFile, removeHookScripts, removeMarkedSection, assertSafeConfigDir, isEvolverHookCommand } = require('./hookAdapter');
+const { mergeJsonFile, copyHookScripts, appendSectionToFile, removeHookScripts, removeMarkedSection, assertSafeConfigDir, isEvolverHookCommand, buildSafeNodeHookCommand } = require('./hookAdapter');
 
 const HOOK_SCRIPTS_DIR_NAME = 'hooks';
 const EVOLVER_MARKER = '<!-- evolver-evolution-memory -->';
 
-function buildClaudeHooks(evolverRoot) {
-  const scriptsBase = '.claude/hooks';
+function buildClaudeHooks(evolverRoot, configRoot) {
+  // Resolve hook scripts to an absolute path rooted at the real config dir so
+  // the command works regardless of the cwd Claude Code is launched from
+  // (#590). Falls back to the legacy relative base only when configRoot is
+  // absent (callers should always pass it).
+  const scriptsBase = configRoot
+    ? path.resolve(configRoot, '.claude', 'hooks')
+    : path.join('.claude', 'hooks');
+  const hookCommand = (scriptName) =>
+    buildSafeNodeHookCommand(path.join(scriptsBase, scriptName));
   return {
     hooks: {
       SessionStart: [
@@ -14,7 +22,7 @@ function buildClaudeHooks(evolverRoot) {
           hooks: [
             {
               type: 'command',
-              command: `node ${scriptsBase}/evolver-session-start.js`,
+              command: hookCommand('evolver-session-start.js'),
               timeout: 3,
             },
           ],
@@ -32,7 +40,7 @@ function buildClaudeHooks(evolverRoot) {
               // ABOVE that watchdog, so the host never kills the script
               // mid-write. A stuck/slow recall can never block or erase the
               // user's prompt.
-              command: `node ${scriptsBase}/evolver-task-recall.js`,
+              command: hookCommand('evolver-task-recall.js'),
               timeout: 5,
             },
           ],
@@ -44,7 +52,7 @@ function buildClaudeHooks(evolverRoot) {
           hooks: [
             {
               type: 'command',
-              command: `node ${scriptsBase}/evolver-signal-detect.js`,
+              command: hookCommand('evolver-signal-detect.js'),
               timeout: 2,
             },
           ],
@@ -55,7 +63,7 @@ function buildClaudeHooks(evolverRoot) {
           hooks: [
             {
               type: 'command',
-              command: `node ${scriptsBase}/evolver-session-end.js`,
+              command: hookCommand('evolver-session-end.js'),
               timeout: 8,
             },
           ],
@@ -87,19 +95,9 @@ function install({ configRoot, evolverRoot, force }) {
   const claudeMdPath = path.join(configRoot, 'CLAUDE.md');
   assertSafeConfigDir(claudeDir, '.claude', { subdirs: [HOOK_SCRIPTS_DIR_NAME] });
 
-  if (!force && fs.existsSync(settingsPath)) {
-    try {
-      const existing = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
-      if (existing._evolver_managed) {
-        console.log('[claude-code] Evolver hooks already installed. Use --force to overwrite.');
-        return { ok: true, skipped: true };
-      }
-    } catch { /* proceed */ }
-  }
-
   fs.mkdirSync(claudeDir, { recursive: true });
 
-  const hooksCfg = buildClaudeHooks(evolverRoot);
+  const hooksCfg = buildClaudeHooks(evolverRoot, configRoot);
   mergeJsonFile(settingsPath, hooksCfg);
   console.log('[claude-code] Wrote ' + settingsPath);
 

package/src/adapters/hookAdapter.js

@@ -10,7 +10,47 @@ const PLATFORMS = {
   opencode: { name: 'opencode', configDir: '.opencode', detector: '.opencode' },
 };
 
+// Detect the host agent from runtime environment signals, which are far more
+// reliable than scanning for `.claude` / `.cursor` directories when both exist
+// on disk (e.g. under $HOME). Precedence when signals conflict (#590):
+//   1. strong Claude Code signals (set only by the Claude Code runtime)
+//   2. Cursor signals
+//   3. Codex signals
+//   4. CLAUDE_PROJECT_DIR — a weak Claude alias some hosts (incl. Cursor's
+//      Claude integration) export, so it loses to explicit Cursor signals.
+function detectPlatformFromEnv(env = process.env) {
+  const hasStrongClaudeSignal = env.CLAUDECODE || env.CLAUDE_CODE_ENTRYPOINT;
+  if (hasStrongClaudeSignal) {
+    return 'claude-code';
+  }
+
+  const hasCursorSignal =
+    env.CURSOR_TRACE_ID ||
+    env.CURSOR_SESSION_ID ||
+    env.CURSOR_PROJECT_DIR ||
+    env.CURSOR_AGENT ||
+    String(env.TERM_PROGRAM || '').toLowerCase() === 'cursor';
+  if (hasCursorSignal) {
+    return 'cursor';
+  }
+  const hasCodexSignal =
+    env.CODEX_THREAD_ID ||
+    env.CODEX_SHELL ||
+    env.CODEX_CI ||
+    env.CODEX_INTERNAL_ORIGINATOR_OVERRIDE;
+  if (hasCodexSignal) {
+    return 'codex';
+  }
+  if (env.CLAUDE_PROJECT_DIR) {
+    return 'claude-code';
+  }
+  return null;
+}
+
 function detectPlatform(cwd) {
+  const envPlatform = detectPlatformFromEnv();
+  if (envPlatform) return envPlatform;
+
   const root = cwd || process.cwd();
   const home = os.homedir();
   for (const [id, meta] of Object.entries(PLATFORMS)) {
@@ -22,6 +62,37 @@ function detectPlatform(cwd) {
   return null;
 }
 
+// Quote `value` as a single shell argument for the host that runs hook
+// `command` strings (POSIX sh, or cmd.exe on Windows).
+function shellQuoteForHost(value) {
+  const raw = String(value);
+  if (process.platform === 'win32') {
+    return `"${raw.replace(/"/g, '\\"')}"`;
+  }
+  return `'${raw.replace(/'/g, "'\\''")}'`;
+}
+
+// Build a hook `command` that runs `scriptPath` with node WITHOUT exposing the
+// path bytes to the shell. The absolute path is base64-encoded into a `node -e`
+// wrapper that decodes it and spawns the real script with `shell:false`, so
+// spaces / `$()` / backticks / `%VAR%` in the path can never be expanded by sh
+// or cmd.exe (#590). The plaintext basename is appended as a final, inert arg
+// so uninstall/reinstall can still match evolver-owned hooks by command
+// substring (see isEvolverHookCommand) even though the path itself is encoded.
+//
+// Shared across adapters so there is exactly one implementation to audit.
+function buildSafeNodeHookCommand(scriptPath) {
+  const encodedPath = Buffer.from(String(scriptPath), 'utf8').toString('base64');
+  const js = [
+    "const{spawnSync}=require('child_process')",
+    `const p=Buffer.from('${encodedPath}','base64').toString('utf8')`,
+    "const r=spawnSync(process.execPath,[p],{stdio:'inherit',shell:false})",
+    "if(r.error){console.error(r.error.message||String(r.error));process.exit(1)}",
+    "process.exit(r.status==null?1:r.status)",
+  ].join(';');
+  return `node -e ${shellQuoteForHost(js)} ${path.basename(scriptPath)}`;
+}
+
 function resolveConfigRoot(platformId, cwd) {
   const root = cwd || process.cwd();
   const home = os.homedir();
@@ -74,11 +145,9 @@ function mergeWithHooksUnion(target, source) {
       const tArr = Array.isArray(target.hooks[event]) ? target.hooks[event] : null;
       const sArr = Array.isArray(source.hooks[event]) ? source.hooks[event] : null;
       if (tArr && sArr) {
-        const isEvolverOwned = (entry) => {
-          const cmds = collectCommands(entry);
-          return cmds.some(isEvolverHookCommand);
-        };
-        const userEntries = tArr.filter(e => !isEvolverOwned(e));
+        const userEntries = tArr
+          .map(stripEvolverCommands)
+          .filter(Boolean);
         result.hooks[event] = [...userEntries, ...sArr];
       }
     }
@@ -86,6 +155,22 @@ function mergeWithHooksUnion(target, source) {
   return result;
 }
 
+function stripEvolverCommands(entry) {
+  if (!entry || typeof entry !== 'object') return entry;
+  if (typeof entry.command === 'string' && isEvolverHookCommand(entry.command)) {
+    return null;
+  }
+  if (!Array.isArray(entry.hooks)) return entry;
+
+  const hooks = entry.hooks.filter(h => {
+    const cmd = h && h.command;
+    return !(typeof cmd === 'string' && isEvolverHookCommand(cmd));
+  });
+  if (hooks.length === 0) return null;
+  if (hooks.length === entry.hooks.length) return entry;
+  return { ...entry, hooks };
+}
+
 // Pull all `command` strings out of an event entry, supporting both flat
 // shape (Codex: `{type, command}`) and Claude Code matcher shape
 // (`{matcher, hooks: [{type, command}]}`). Returns [] when neither applies.
@@ -362,7 +447,9 @@ async function setupHooks({ platform, cwd, force, uninstall, evolverRoot } = {})
 }
 
 module.exports = {
+  detectPlatformFromEnv,
   detectPlatform,
+  buildSafeNodeHookCommand,
   resolveConfigRoot,
   loadAdapter,
   mergeJsonFile,