fix: make setup-hooks targeting and verification explicit by autogame-17 · Pull Request #618 · EvoMap/evolver

autogame-17 · 2026-08-25T10:04:56Z

Summary

honor explicit setup target roots and retain --runtime as a checked compatibility alias for --platform
add machine-readable, read-only verification for Claude Code and Codex integrations
verify installed hook assets byte-for-byte and avoid executing workspace plugin code during health checks
update Codex TOML without corrupting comments, multiline strings, unrelated tables, or case-sensitive keys

What changed

parse --platform, --runtime, --root, and the verify/json flags in one CLI owner
reject conflicting --platform and --runtime values
verify Claude Code, Codex, and OpenCode hook installs by exact command match and source-byte copies
keep Codex config.toml edits inside the [features] table and preserve comments or multiline strings

How to test

node --test test/adapters.test.js test/adapters.opencode.test.js test/proxyCliOptions.test.js
Expected: 121 passed
npm test
Expected: full suite passed locally (3314)

Risk

Medium -- this changes the adapter execution bridge used by Claude Code, Codex, and OpenCode setup-hooks, including how config files are rewritten and how verify reports health.

Harness/evaluator governance

Upstream governance surface: adapter execution bridge (src/adapters/* setup-hooks install/verify for Claude Code, Codex, and OpenCode)
Downstream EvoX impact: desktop/CLI evolver setup-hooks callers can now pass --root and --runtime, and verify --json becomes a read-only health contract they can consume; no EvoX runtime tool surface is opened in this PR
Rollout-local scope: opt-in operator command only; existing installs stay unchanged until the operator reruns setup-hooks or verify
Promotion boundary: lands as default CLI behavior on merge; no shadow cohort and no automatic rewrite of existing user configs
Evaluator mismatch sets: verification now distinguishes missing, altered, disabled, and merely similarly named hooks; observation/action/repair/evidence/belief evaluator sets are unchanged
Non-regression evidence: test/adapters.test.js and test/adapters.opencode.test.js cover CLI targeting, exact hook matching, TOML comment/multiline preservation, and read-only OpenCode verify
Fix-severity review: medium
Owner approval: adapter/setup-hooks owner review required before merge
Security boundary: reads and rewrites user runtime config under an explicit --root or detected config root; verify never executes workspace plugin code; no secrets or network egress added
Rollback: revert this PR; operators can rerun setup-hooks --uninstall to remove managed hooks
Live promotion: no
Autonomous evaluator self-editing: no

Test plan

node --test test/adapters.test.js test/adapters.opencode.test.js test/proxyCliOptions.test.js (121 passed)
npm test (3314 passed)
focused Sentinel Advice completed with no hard constraints

Notes

The first full-suite run hit one unrelated proxyStreaming ECONNRESET flake; its isolated rerun passed, and the final full-suite run completed with zero failures.

Self-check

Tests added or updated to cover the new behavior; focused adapter suites and the full suite passed locally (node --test test/*.test.js / npm test).
No new runtime dependencies added.

Sentinel 保留了 7 个尚未确认的审核候选。它们不阻塞合并；单一猜测、缺少变更行证据或纯 checklist 的候选会统一降为 P3。
开发 agent：请 review 以下 advisory，并逐条给出“已验证无风险 / 已修复 / 转为后续事项”的结论；不要只做整体确认。

[P3] Codex 卸载会删除用户在 [features] 下的注释 — 新的 TOML 解析器把注释从 structuralTomlLines 中移除；删除 codex_hooks 后，remaining 只检查结�...(truncated) · src/adapters/codex.js · advisory_ea53d46dd275036202556a50
[P3] 数组表头未结束 [features] 范围，导致误报启用并修改错误配置项 — tomlSectionName() 只识别单层 [section]，不把合法的 [[array-table]] 视为新表边界。因此 feature...(truncated) · src/adapters/codex.js·advisory_e5e4d25ab89ec16210a2418b`
[P3] 合法的引号式 [features] 表头会被误判并写出重复 TOML 表 — TOML 允许表头键使用引号，["features"] 与 [features] 表示同一个表。但新增 tomlSectionName() ��...(truncated) · src/adapters/codex.js · advisory_5ead75d952952a4b0ef7ccc1
[P3] Claude/Codex verify 使用空路径构造期望 hook 命令，可能导致已安装配置始终校��...(truncated) — 安装流程接收真实的 evolverRoot，而 verify 分别以空字符串调用 buildClaudeHooks('', configRoot) ��...(truncated) · src/adapters/claudeCode.js`, `src/adapters/codex.js · advisory_2ea0dabdc2397fc61030bd20
[P3] 卸载会删除用户原有的 codex_hooks = false — 新实现把所有 codex_hooks 行加入 settingIndexes，禁用分支不检查当前值便全部删除；旧实现�...(truncated) · src/adapters/codex.js · advisory_0d8efa024b29ffce3a15132c
[P3] 入口未向 verify 提供安装路径，可能造成安装后仍校验失败 — Claude/Codex adapter 的 verify 需要用实际安装路径构造期望 hook 命令，但切片摘要表明调用链��...(truncated) · index.js、src/adapters/claudeCode.js、src/adapters/codex.js · advisory_cad9f3d71752e18db8f9b506
[P3] 状态机一致性路由未覆盖实际生命周期实现 — state_consistency 的 scoped route 仅指向包含 README 的 client_orchestration_01，而安装、校验、卸载�...(truncated) · src/adapters/codex.js · advisory_515719ba21e0853737bd1068

需要完整证据时，可用行末 finding_key 查询 Sentinel PR review context。

由 Sentinel 审核 · 目标提交 a252a4092f2b

pull_request_target does not rerun on body edits, so the harness packet needs a new synchronize event.

evomap-aiqa-bot · 2026-08-25T12:36:10Z

Sentinel 已审核此变更，并发现 4 个已核验问题。

无法定位到 diff 的已核验问题

Claude/Codex verify 使用空路径比较 hook 命令，正常安装结果可能始终校验失败

🟠 严重程度：中（P2）
install 使用调用方提供的真实 evolverRoot 构造并写入 hook command；新增 verify 却调用 buildClaudeHooks('', configRoot)，Codex 同样调用 buildCodexHooksJson('')。校验采用 actualHook.command === expectedHook.command 的��...(truncated)

Finding：finding_22ed5570235e3bc828e61de4 · 文件：src/adapters/claudeCode.js · 详情：/api/v1/aiqa/findings/finding_22ed5570235e3bc828e61de4

卸载会删除用户原有的 `codex_hooks = false`

🟠 严重程度：中（P2）
新的 updateCodexHooksFeature(content, false) 将 [features] 区块内所有能匹配 codex_hooks = (true|false) 的行加入 settingIndexes，禁用分支不区分值，统一删除。旧实现只处理 codex_hooks = true，因此本 PR 改变了��...(truncated)

Finding：finding_3a80d725cbdcd4e380f26be0 · 文件：src/adapters/codex.js · 详情：/api/v1/aiqa/findings/finding_3a80d725cbdcd4e380f26be0

合法的引号式 `[features]` 表头会生成重复 TOML 表

🟠 严重程度：中（P2）
tomlSectionName 返回表头内部文本的原始值；[\"features\"] 返回 \"features\"，而 featuresSection 只接受精确的 features。因此已有 features 表无法被识别，updateCodexHooksFeature(content, true) 会在文件末尾追加...(truncated)

Finding：finding_99c792b9233a4dd0f83d8b12 · 文件：src/adapters/codex.js · 详情：/api/v1/aiqa/findings/finding_99c792b9233a4dd0f83d8b12

P0/P1 会让 Sentinel check 失败；P2/P3 不阻塞合并。

另有 7 个需要人工确认的风险；它们不阻塞合并，但开发 agent 必须 review advisory 评论并逐条确认。

审核覆盖提示： 4 个 hunk/条目缺少完整输入；它们不作为 bug 报告。

开发 agent 查询详情： 调用 MCP 工具 sentinel_pr_review_context，传入 owner_repo="evomap/evolver"、pr_number=618、head_sha="d6f9e33bd0deaf25f00f15f9482d85a311521273"，并按条目追加 finding_id 或 finding_key。

由 Sentinel 审核 · 目标提交 d6f9e33bd0de

evomap-aiqa-bot · 2026-08-25T12:44:53Z

Sentinel 保留了 7 个尚未确认的审核候选。它们不阻塞合并；单一猜测、缺少变更行证据或纯 checklist 的候选会统一降为 P3。
开发 agent：请 review 以下 advisory，并逐条给出“已验证无风险 / 已修复 / 转为后续事项”的结论；不要只做整体确认。

[P3] Claude/Codex 安装后验证使用了错误的 evolverRoot — verify() 通过 buildClaudeHooks('', configRoot) / buildCodexHooksJson('') 构造期望命令，而安装流程使...(truncated) · src/adapters/claudeCode.js`、`src/adapters/codex.js · advisory_ec80fc9fa8fcdedf15e246d0
[P3] Codex 配置解析未把数组表视为 [features] 的结束边界 — tomlSectionName() 只匹配单层 [section]，不匹配合法的 [[array-table]]。featuresSection() 因此会��...(truncated) · src/adapters/codex.js · advisory_6fb6eed9b7ed0624c00f334c
[P3] verify 测试缺少用于重建 hook 命令的 evolverRoot — 测试安装时传入了真实的 evolverRoot，但调用 verify 时只传入 configRoot。当前 verify 实现若...(truncated) · test/adapters.test.js · advisory_f49ce10648a84a2bf3ea1512
[P3] 验证将运行时定制的脚本误判为版本不一致 — 新验证直接将已安装 hook 脚本与适配器源码逐字节比较；但安装函数显式接收 evolverRoot，�...(truncated) · src/adapters/hookAdapter.js · advisory_5fb65dc96bc5ee3f615cd958
[P3] Codex 数组表破坏 [features] 生命周期边界 — 配置解析没有把 TOML 数组表 [[...]] 视为当前 [features] 表的结束边界，导致后续键仍被当��...(truncated) · src/adapters/codex.js · advisory_fae5abfbf4295c56cd1f0af4
[P3] 卸载会删除用户预先设置的禁用状态 — 安装前用户已有 codex_hooks = false 时，卸载逻辑无法区分用户原始配置与安装器拥有的配置�...(truncated) · src/adapters/codex.js · advisory_90679c9fbbb1d37d693033a6
[P3] 安装调用与验证器的 evolverRoot 契约不一致 — Claude/Codex 验证器需要 evolverRoot 重建预期 hook 命令，但调用链或测试未提供正确值，最终��...(truncated) · index.js · advisory_ca375177f0a8a2117325ed0e

需要完整证据时，可用行末 finding_key 查询 Sentinel PR review context。

由 Sentinel 审核 · 目标提交 d6f9e33bd0de

evomap-aiqa-bot · 2026-08-25T12:44:54Z

+}
+
+function tomlSectionName(line) {
+  const header = line.match(/^\[([^\]]+)\]$/);


数组表未结束 [features] 范围，安装与校验操作了错误状态

🟠 严重程度：中（P2）
tomlSectionName() 只匹配单层表头，不识别 [[providers]] 等数组表边界。featuresSection() 因此把数组元素继续视为 [features] 内容，继而把其中的 codex_hooks 当成功能开关。

Finding：finding_b0773b7225dbaa27f9883653

fix: make setup-hooks targeting and verification explicit

a252a40

Honor desktop-provided runtime and root selections, and expose read-only machine health reports without executing installed workspace code.

ci: retrigger governance check after PR body fix

d6f9e33

pull_request_target does not rerun on body edits, so the harness packet needs a new synchronize event.

evomap-aiqa-bot Bot reviewed Aug 25, 2026

View reviewed changes

autogame-17 mentioned this pull request Aug 25, 2026

adapters: write a unique evox-product MCP config and stdio shim #619

Open

6 tasks

autogame-17 closed this Aug 26, 2026

autogame-17 reopened this Aug 27, 2026

Navigation Menu

Uh oh!

fix: make setup-hooks targeting and verification explicit - #618

fix: make setup-hooks targeting and verification explicit#618
autogame-17 wants to merge 2 commits into
mainfrom
evox/product-bridge-contract-20260825

autogame-17 commented Aug 25, 2026 •

edited

Loading

Uh oh!

evomap-aiqa-bot Bot commented Aug 25, 2026 •

edited

Loading

Uh oh!

evomap-aiqa-bot Bot commented Aug 25, 2026

Uh oh!

evomap-aiqa-bot Bot commented Aug 25, 2026 •

edited

Loading

Uh oh!

evomap-aiqa-bot Bot commented Aug 25, 2026

Uh oh!

evomap-aiqa-bot Bot Aug 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

autogame-17 commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What changed

How to test

Risk

Harness/evaluator governance

Test plan

Notes

Self-check

Related

Uh oh!

evomap-aiqa-bot Bot commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

evomap-aiqa-bot Bot commented Aug 25, 2026

Uh oh!

evomap-aiqa-bot Bot commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

无法定位到 diff 的已核验问题

Claude/Codex verify 使用空路径比较 hook 命令，正常安装结果可能始终校验失败

卸载会删除用户原有的 codex_hooks = false

合法的引号式 [features] 表头会生成重复 TOML 表

Uh oh!

evomap-aiqa-bot Bot commented Aug 25, 2026

Uh oh!

evomap-aiqa-bot Bot Aug 25, 2026

Choose a reason for hiding this comment

数组表未结束 [features] 范围，安装与校验操作了错误状态

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

autogame-17 commented Aug 25, 2026 •

edited

Loading

evomap-aiqa-bot Bot commented Aug 25, 2026 •

edited

Loading

evomap-aiqa-bot Bot commented Aug 25, 2026 •

edited

Loading

卸载会删除用户原有的 `codex_hooks = false`

合法的引号式 `[features]` 表头会生成重复 TOML 表

数组表未结束 `[features]` 范围，安装与校验操作了错误状态