fix(codex): harden lite sharing workflows

Author: visahak

platform-integrations/codex/plugins/evolve-lite/skills/publish/scripts/publish.py

@@ -81,6 +81,9 @@ def main():
     if not dest_path.is_relative_to(dest_base):
         print(f"Error: invalid entity name: {args.entity!r}", file=sys.stderr)
         sys.exit(1)
+    if dest_path.exists():
+        print(f"Error: already published: {dest_path}\nUnpublish it first or delete it manually.", file=sys.stderr)
+        sys.exit(1)
     dest_path.write_text(entity_to_markdown(entity), encoding="utf-8")
     src_path.unlink()
 

platform-integrations/codex/plugins/evolve-lite/skills/subscribe/scripts/subscribe.py

@@ -38,7 +38,7 @@ def main():
     project_root = str(evolve_dir.resolve()) if evolve_dir.name != ".evolve" else str(evolve_dir.resolve().parent)
     subscribed_base = (evolve_dir / "subscribed").resolve()
     dest = (evolve_dir / "subscribed" / args.name).resolve()
-    if not dest.is_relative_to(subscribed_base):
+    if args.name in {"", "."} or dest == subscribed_base or not dest.is_relative_to(subscribed_base):
         print(f"Error: invalid subscription name: {args.name!r}", file=sys.stderr)
         sys.exit(1)
 
@@ -53,7 +53,8 @@ def main():
             sys.exit(1)
 
     if dest.exists():
-        print(f"Warning: {dest} already exists, skipping clone.", file=sys.stderr)
+        print(f"Error: destination already exists: {dest}", file=sys.stderr)
+        sys.exit(1)
     else:
         dest.parent.mkdir(parents=True, exist_ok=True)
         subprocess.run(

platform-integrations/codex/plugins/evolve-lite/skills/sync/scripts/sync.py

@@ -42,6 +42,8 @@ def copy_entities(subscribed_repo_path, entities_subscribed_path):
     if entities_subscribed_path.exists():
         shutil.rmtree(entities_subscribed_path)
     for md in sorted(subscribed_repo_path.glob("**/*.md")):
+        if md.is_symlink():
+            continue
         rel = md.relative_to(subscribed_repo_path)
         dest = entities_subscribed_path / rel
         dest.parent.mkdir(parents=True, exist_ok=True)
@@ -78,6 +80,11 @@ def main():
     parser = argparse.ArgumentParser()
     parser.add_argument("--quiet", action="store_true", help="Suppress output if no changes")
     parser.add_argument("--config", default=None, help="Explicit config path")
+    parser.add_argument(
+        "--session-start",
+        action="store_true",
+        help="Apply session-start gating for automatic hook execution",
+    )
     args = parser.parse_args()
 
     evolve_dir = Path(os.environ.get("EVOLVE_DIR", ".evolve"))
@@ -90,7 +97,7 @@ def main():
         cfg = load_config(project_root)
 
     sync_cfg = cfg.get("sync", {})
-    if isinstance(sync_cfg, dict) and sync_cfg.get("on_session_start") is False:
+    if args.session_start and isinstance(sync_cfg, dict) and sync_cfg.get("on_session_start") is False:
         sys.exit(0)
 
     subscriptions = cfg.get("subscriptions", [])

platform-integrations/install.sh

@@ -381,7 +381,7 @@ def _codex_sync_hook_command():
         'd=\"$PWD\"; '
         "while :; do "
         'candidate=\"$d/plugins/evolve-lite/skills/sync/scripts/sync.py\"; '
-        'if [ -f \"$candidate\" ]; then EVOLVE_DIR=\"$d/.evolve\" exec python3 \"$candidate\" --quiet; fi; '
+        'if [ -f \"$candidate\" ]; then EVOLVE_DIR=\"$d/.evolve\" exec python3 \"$candidate\" --quiet --session-start; fi; '
         '[ \"$d\" = \"/\" ] && break; '
         'd=\"$(dirname \"$d\")\"; '
         "done; "

tests/platform_integrations/test_codex.py

@@ -113,7 +113,7 @@ def test_install_creates_expected_files(self, temp_project_dir, install_runner,
             'd="$PWD"; '
             "while :; do "
             'candidate="$d/plugins/evolve-lite/skills/sync/scripts/sync.py"; '
-            'if [ -f "$candidate" ]; then EVOLVE_DIR="$d/.evolve" exec python3 "$candidate" --quiet; fi; '
+            'if [ -f "$candidate" ]; then EVOLVE_DIR="$d/.evolve" exec python3 "$candidate" --quiet --session-start; fi; '
             '[ "$d" = "/" ] && break; '
             'd="$(dirname "$d")"; '
             "done; "

tests/platform_integrations/test_codex_sharing.py

@@ -169,6 +169,30 @@ def test_publish_succeeds_without_user_flag(self, temp_project_dir):
         content = (temp_project_dir / ".evolve" / "public" / "guideline" / "my-tip.md").read_text()
         assert "visibility: public" in content
 
+    def test_publish_fails_when_public_entity_already_exists(self, temp_project_dir):
+        guideline_dir = temp_project_dir / ".evolve" / "entities" / "guideline"
+        guideline_dir.mkdir(parents=True)
+        source = guideline_dir / "my-tip.md"
+        source.write_text("---\ntype: guideline\n---\n\nPrefer composition.\n")
+
+        public_path = temp_project_dir / ".evolve" / "public" / "guideline" / "my-tip.md"
+        public_path.parent.mkdir(parents=True)
+        existing_content = "---\ntype: guideline\nvisibility: public\n---\n\nExisting public content.\n"
+        public_path.write_text(existing_content)
+
+        result = run_script(
+            PUBLISH_SCRIPT,
+            project_dir=temp_project_dir,
+            args=["--entity", "my-tip.md"],
+            evolve_dir=temp_project_dir / ".evolve",
+            expect_success=False,
+        )
+
+        assert result.returncode != 0
+        assert "already published" in result.stderr
+        assert public_path.read_text() == existing_content
+        assert source.exists()
+
     def test_publish_rejects_path_traversal_in_entity_name(self, temp_project_dir):
         guideline_dir = temp_project_dir / ".evolve" / "entities" / "guideline"
         guideline_dir.mkdir(parents=True)
@@ -240,6 +264,37 @@ def test_subscribe_rejects_path_traversal_in_name(self, temp_project_dir, local_
         assert result.returncode != 0
         assert "invalid subscription name" in result.stderr
 
+    @pytest.mark.parametrize("name", ["", "."])
+    def test_subscribe_rejects_empty_or_dot_name(self, temp_project_dir, local_repo, name):
+        result = run_script(
+            SUBSCRIBE_SCRIPT,
+            project_dir=temp_project_dir,
+            args=["--name", name, "--remote", str(local_repo["bare"]), "--branch", "main"],
+            evolve_dir=temp_project_dir / ".evolve",
+            expect_success=False,
+        )
+
+        assert result.returncode != 0
+        assert "invalid subscription name" in result.stderr
+
+    def test_subscribe_fails_when_destination_already_exists(self, temp_project_dir, local_repo):
+        evolve_dir = temp_project_dir / ".evolve"
+        existing_dest = evolve_dir / "subscribed" / "alice"
+        existing_dest.mkdir(parents=True)
+
+        result = run_script(
+            SUBSCRIBE_SCRIPT,
+            project_dir=temp_project_dir,
+            args=["--name", "alice", "--remote", str(local_repo["bare"]), "--branch", "main"],
+            evolve_dir=evolve_dir,
+            expect_success=False,
+        )
+
+        assert result.returncode != 0
+        assert "destination already exists" in result.stderr
+        config_path = temp_project_dir / "evolve.config.yaml"
+        assert not config_path.exists()
+
     def test_unsubscribe_list_and_not_found(self, temp_project_dir, local_repo):
         evolve_dir = temp_project_dir / ".evolve"
         run_script(
@@ -315,6 +370,78 @@ def test_sync_no_subscriptions_exits_cleanly(self, temp_project_dir):
         assert "No subscriptions" in result.stdout
         assert "evolve-lite:subscribe" in result.stdout
 
+    def test_sync_skips_invalid_subscription_name(self, temp_project_dir):
+        evolve_dir = temp_project_dir / ".evolve"
+        (temp_project_dir / "evolve.config.yaml").write_text(
+            'subscriptions:\n'
+            '  - name: "."\n'
+            '    remote: "https://example.com/repo.git"\n'
+            '    branch: "main"\n'
+        )
+
+        result = run_script(
+            SYNC_SCRIPT,
+            project_dir=temp_project_dir,
+            evolve_dir=evolve_dir,
+            expect_success=False,
+        )
+
+        assert result.returncode == 0
+        assert ". (invalid subscription name)" in result.stdout
+        assert not (evolve_dir / "entities" / "subscribed").exists()
+
+    def test_manual_sync_runs_even_when_on_session_start_is_false(self, temp_project_dir, local_repo):
+        evolve_dir = temp_project_dir / ".evolve"
+        run_script(
+            SUBSCRIBE_SCRIPT,
+            project_dir=temp_project_dir,
+            args=["--name", "alice", "--remote", str(local_repo["bare"]), "--branch", "main"],
+            evolve_dir=evolve_dir,
+        )
+        (temp_project_dir / "evolve.config.yaml").write_text(
+            'subscriptions:\n'
+            f'  - name: "alice"\n    remote: "{local_repo["bare"]}"\n    branch: "main"\n'
+            'sync:\n'
+            '  on_session_start: false\n'
+        )
+
+        result = run_script(
+            SYNC_SCRIPT,
+            project_dir=temp_project_dir,
+            evolve_dir=evolve_dir,
+            expect_success=False,
+        )
+
+        assert result.returncode == 0
+        assert "Synced 1 repo(s):" in result.stdout
+
+    def test_session_start_sync_respects_on_session_start_false(self, temp_project_dir, local_repo):
+        evolve_dir = temp_project_dir / ".evolve"
+        run_script(
+            SUBSCRIBE_SCRIPT,
+            project_dir=temp_project_dir,
+            args=["--name", "alice", "--remote", str(local_repo["bare"]), "--branch", "main"],
+            evolve_dir=evolve_dir,
+        )
+        (temp_project_dir / "evolve.config.yaml").write_text(
+            'subscriptions:\n'
+            f'  - name: "alice"\n    remote: "{local_repo["bare"]}"\n    branch: "main"\n'
+            'sync:\n'
+            '  on_session_start: false\n'
+        )
+
+        result = run_script(
+            SYNC_SCRIPT,
+            project_dir=temp_project_dir,
+            args=["--quiet", "--session-start"],
+            evolve_dir=evolve_dir,
+            expect_success=False,
+        )
+
+        assert result.returncode == 0
+        mirrored = evolve_dir / "entities" / "subscribed" / "alice" / "guideline" / "tip-one.md"
+        assert not mirrored.exists()
+
     def test_sync_writes_audit_log(self, temp_project_dir, local_repo):
         evolve_dir = temp_project_dir / ".evolve"
         run_script(
@@ -351,6 +478,29 @@ def test_sync_picks_up_new_entity_after_push(self, temp_project_dir, local_repo)
         assert mirrored.exists()
         assert "Delete dead code promptly." in mirrored.read_text()
 
+    def test_sync_skips_symlinked_markdown_files(self, temp_project_dir, local_repo):
+        evolve_dir = temp_project_dir / ".evolve"
+        run_script(
+            SUBSCRIBE_SCRIPT,
+            project_dir=temp_project_dir,
+            args=["--name", "alice", "--remote", str(local_repo["bare"]), "--branch", "main"],
+            evolve_dir=evolve_dir,
+        )
+
+        git_env = local_repo["env"]
+        target = local_repo["work"] / "guideline" / "tip-one.md"
+        symlink = local_repo["work"] / "guideline" / "tip-link.md"
+        symlink.symlink_to(target.name)
+        subprocess.run(["git", "-C", str(local_repo["work"]), "add", "."], check=True, env=git_env)
+        subprocess.run(["git", "-C", str(local_repo["work"]), "commit", "-m", "add tip symlink"], check=True, env=git_env)
+        subprocess.run(["git", "-C", str(local_repo["work"]), "push", "origin", "main"], check=True, env=git_env)
+
+        run_script(SYNC_SCRIPT, project_dir=temp_project_dir, evolve_dir=evolve_dir)
+
+        mirrored_dir = evolve_dir / "entities" / "subscribed" / "alice" / "guideline"
+        assert (mirrored_dir / "tip-one.md").exists()
+        assert not (mirrored_dir / "tip-link.md").exists()
+
     def test_sync_removed_entity_disappears_after_sync(self, temp_project_dir, local_repo):
         evolve_dir = temp_project_dir / ".evolve"
         run_script(