v1.84.2

EvoMap/evolverv1.84.2May 22, 2026by autogame-17

AI Summary

This release addresses critical fixes for Codex and Claude Code hook adapters, resolving recording failures and Windows path errors. It also implements significant security hardening measures to prevent symlink attacks and path redirection vulnerabilities.

Key Highlights

Fixed Codex `session-end` recording to work correctly with npm-global installs.
Resolved Windows path errors by replacing shell string redirects with argv-array `spawnSync`.
Hardened security against symlink attacks in adapter config directories.
Refused to trust `process.cwd()` when resolving the evolver root to prevent prompt injection.
Improved uninstall handling to remove all hook-related files and configuration.

New Features

Security hardening for adapter config paths and hook scripts.
Hook adapter fixes for Codex and Claude Code.
Enhanced uninstall logic for hook scripts.

Full Release Notes

## v1.84.2

Fixes for Codex / Claude Code hook adapters reported on the public
issue tracker (#536–#540), plus security hardening surfaced during
review.

### Hook adapter fixes

- **#536** Codex `session-end` no longer "records to nowhere" on
  npm-global installs. `_runtimePaths.js` is now copied alongside the
  hook scripts and resolves `@evomap/evolver` via system roots; falls
  back to `~/.evolver/memory/evolution/memory_graph.jsonl` if the
  evolver root is read-only.
- **#537** Codex `session-end` no longer prints `The system cannot
  find the path specified.` on Windows. `execSync` shell strings
  with POSIX `2>/dev/null` redirects are replaced with argv-array
  `spawnSync`, so cmd.exe never sees `/dev/null`.
- **#538** `evolver setup-hooks --uninstall` now removes everything
  it installs: hook scripts (including `_runtimePaths.js`), the
  evolution-memory section in `AGENTS.md` / `CLAUDE.md`, and
  `codex_hooks = true` plus the empty `[features]` block in
  `.codex/config.toml`. Uninstall also catches evolver-owned hook
  entries even when the `_evolver_managed` marker has been stripped.
- **#539** `evolver setup-hooks` no longer overwrites user-installed
  hooks under the same event. `mergeWithHooksUnion` keeps existing
  user `Stop` / `SessionStart` / `PostToolUse` entries and appends
  evolver entries alongside them.
- **#540** The review engine no longer hard-depends on repo-local
  `MEMORY.md` / `USER.md`. It first reads platform-supplied
  `additionalContext` / session_state, then falls back to
  evolver-managed `memory_graph.jsonl`, then to the markdown files.
  Codex's lack of session-log hooks is documented as a platform
  limitation (not an evolver bug).

### Security hardening

- Refuse to follow symlinks at adapter config dirs (`.codex`,
  `.claude`, `.cursor`, `.kiro`, `.opencode`) or at their nested
  `hooks/` and `plugins/` subdirs.
- Refuse to copy a hook script when the destination path is a
  pre-planted symlink (would otherwise let a hostile workspace
  redirect overwrites to arbitrary writable files).
- `findEvolverRoot()` no longer trusts `process.cwd()` when
  resolving `@evomap/evolver` — only system module roots are
  searched, so a workspace-controlled `node_modules/@evomap/evolver`
  cannot redirect the memory graph and inject prompt-injection
  content via `additionalContext`.
- Codex `cleanConfigToml` only drops the `[features]` header when
  the section is genuinely empty; user entries under `[features]`
  are preserved across uninstall.
- `evolver-session-end` `runGit` distinguishes "command failed"
  from "command succeeded with empty output", so an empty merge
  doesn't fall through to the working-tree diff and surface
  unrelated unstaged changes as a session outcome.

### Reviewed by

Cursor Bugbot agentic security review (7 rounds), final commit
`f32f709b75eeb0187780318a9a8a602a53214c4d`. 99 / 99 adapter tests
passing.