@lamentis/naome 1.3.5 → 1.3.6

package/Cargo.lock

@@ -76,7 +76,7 @@ checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
 
 [[package]]
 name = "naome-cli"
-version = "1.3.5"
+version = "1.3.6"
 dependencies = [
  "naome-core",
  "serde_json",
@@ -84,7 +84,7 @@ dependencies = [
 
 [[package]]
 name = "naome-core"
-version = "1.3.5"
+version = "1.3.6"
 dependencies = [
  "serde",
  "serde_json",

package/crates/naome-cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "naome-cli"
-version = "1.3.5"
+version = "1.3.6"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true

package/crates/naome-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "naome-core"
-version = "1.3.5"
+version = "1.3.6"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true

package/installer/flows.js

@@ -1,3 +1,5 @@
+import { posix } from "node:path";
+
 import { ensureArchiveDirectory, copyTemplateFile, walk } from "./filesystem.js";
 import {
   ensureBuiltInVerificationChecks,
@@ -19,7 +21,7 @@ import { printError } from "./output.js";
 import { compareVersions } from "./version.js";
 import { confirmAgentsTakeover, takeoverExistingAgents } from "./agents.js";
 
-const legacyCodexHookPaths = [
+const legacyOptionalHookPaths = [
   ".codex/config.toml",
   ".codex/hooks.json",
   ".naome/bin/codex-hook-io.js",
@@ -63,10 +65,14 @@ export async function runExistingInstall(ctx, existingInstall) {
     }
 
     ensureArchiveDirectory(ctx);
-    await runRepair(ctx, existingInstall.version, { fromVersion: existingInstall.version });
+    await runRepair(ctx, existingInstall.version, {
+      existingManifest: existingInstall.manifest,
+      fromVersion: existingInstall.version,
+      retireLegacyOptionalHooks: true,
+    });
   } else {
     ensureArchiveDirectory(ctx);
-    await runRepair(ctx, existingInstall.version);
+    await runRepair(ctx, existingInstall.version, { existingManifest: existingInstall.manifest });
   }
 }
 
@@ -89,14 +95,57 @@ async function runRepair(ctx, version, options = {}) {
   ensureBuiltInVerificationChecks(ctx);
   ensureTestingProofHarnessSections(ctx);
   ensureRepositoryStructurePolicyFiles(ctx);
-  removeLegacyCodexHookFiles(ctx, `repair-${version}`);
+  removeRetiredMachineOwnedFiles(ctx, options.existingManifest, `repair-${version}`, {
+    extraPaths: options.retireLegacyOptionalHooks ? legacyOptionalHookPaths : [],
+  });
   refreshManifestHealthMetadata(ctx);
   ensureCompleteUpgradeState(ctx, options.fromVersion ?? null);
   ensureLocalOnlySourceControlBoundary(ctx);
 }
 
-function removeLegacyCodexHookFiles(ctx, archiveDirName) {
-  for (const relativePath of legacyCodexHookPaths) {
+function removeRetiredMachineOwnedFiles(ctx, manifest, archiveDirName, options = {}) {
+  const currentOwnedPaths = new Set([
+    ...ctx.machineOwnedPaths,
+    ...ctx.projectOwnedPaths,
+    ...ctx.localOnlyMachineOwnedPaths,
+    ctx.nativeBinaryRelativePath,
+  ].filter(Boolean));
+  const retiredPaths = [
+    ...(Array.isArray(manifest?.machineOwned) ? manifest.machineOwned : []),
+    ...(Array.isArray(options.extraPaths) ? options.extraPaths : []),
+  ];
+
+  for (const relativePath of [...new Set(retiredPaths)]) {
+    if (!isSafeManifestPath(relativePath)) {
+      const pathLabel = String(relativePath);
+      ctx.skipped.push(pathLabel);
+      ctx.unsafeSkipped.push(pathLabel);
+      continue;
+    }
+
+    if (currentOwnedPaths.has(relativePath)) {
+      continue;
+    }
+
     removeLegacyHarnessFile(ctx, relativePath, archiveDirName);
   }
 }
+
+function isSafeManifestPath(relativePath) {
+  if (
+    typeof relativePath !== "string" ||
+    relativePath.length === 0 ||
+    relativePath.includes("\0") ||
+    relativePath.includes("\\") ||
+    relativePath.includes(":")
+  ) {
+    return false;
+  }
+
+  if (posix.isAbsolute(relativePath)) {
+    return false;
+  }
+
+  const normalizedPath = posix.normalize(relativePath);
+  return normalizedPath === relativePath && normalizedPath !== "." && !normalizedPath.startsWith("../");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamentis/naome",
-  "version": "1.3.5",
+  "version": "1.3.6",
   "description": "Native-first CLI for the NAOME agent harness.",
   "license": "Apache-2.0",
   "type": "module",
@@ -10,7 +10,6 @@
     "ai",
     "harness",
     "repository",
-    "codex",
     "claude"
   ],
   "repository": {