fix(codex): harden sharing edge cases

Author: visahak

platform-integrations/codex/plugins/evolve-lite/skills/publish/scripts/publish.py

@@ -6,7 +6,7 @@
 import os
 import re
 import sys
-from pathlib import Path
+from pathlib import Path, PurePath
 
 # Walk up from the script location to find the installed plugin lib directory.
 _script = Path(__file__).resolve()
@@ -53,6 +53,10 @@ def main():
     args = parser.parse_args()
 
     evolve_dir = Path(os.environ.get("EVOLVE_DIR", ".evolve"))
+    if PurePath(args.entity).name != args.entity or args.entity in {".", ".."}:
+        print(f"Error: invalid entity name: {args.entity!r}", file=sys.stderr)
+        sys.exit(1)
+
     src_base = (evolve_dir / "entities" / "guideline").resolve()
     src_path = (evolve_dir / "entities" / "guideline" / args.entity).resolve()
 

platform-integrations/codex/plugins/evolve-lite/skills/recall/scripts/retrieve_entities.py

@@ -65,7 +65,7 @@ def load_entities_with_source(entities_dirs):
         for md in sorted(entities_dir.glob("**/*.md")):
             try:
                 entity = markdown_to_entity(md)
-            except OSError:
+            except (OSError, UnicodeError):
                 continue
             if not entity.get("content"):
                 continue

platform-integrations/codex/plugins/evolve-lite/skills/sync/scripts/sync.py

@@ -88,7 +88,9 @@ def main():
     args = parser.parse_args()
 
     evolve_dir = Path(os.environ.get("EVOLVE_DIR", ".evolve"))
-    project_root = str(evolve_dir.resolve()) if evolve_dir.name != ".evolve" else str(evolve_dir.resolve().parent)
+    resolved_evolve_dir = evolve_dir.resolve()
+    project_root = str(resolved_evolve_dir.parent)
+    audit_root = resolved_evolve_dir if resolved_evolve_dir.name == ".evolve" else resolved_evolve_dir / ".evolve"
 
     if args.config:
         cfg_path = Path(args.config)
@@ -149,7 +151,7 @@ def main():
 
         summaries.append(f"{name} (+{delta['added']} added, {delta['updated']} updated, {delta['removed']} removed)")
 
-    audit_append(project_root=project_root, action="sync", actor=actor, delta=total_delta)
+    audit_append(project_root=str(audit_root.parent), action="sync", actor=actor, delta=total_delta)
 
     if args.quiet and not any_changes:
         sys.exit(0)

tests/platform_integrations/test_codex_sharing.py

@@ -8,7 +8,7 @@
 
 import pytest
 
-pytestmark = pytest.mark.platform_integrations
+pytestmark = [pytest.mark.platform_integrations, pytest.mark.e2e]
 
 _PLUGIN_ROOT = Path(__file__).parent.parent.parent / "platform-integrations/codex/plugins/evolve-lite"
 SAVE_SCRIPT = _PLUGIN_ROOT / "skills/learn/scripts/save_entities.py"
@@ -196,14 +196,15 @@ def test_publish_fails_when_public_entity_already_exists(self, temp_project_dir)
         assert public_path.read_text() == existing_content
         assert source.exists()
 
-    def test_publish_rejects_path_traversal_in_entity_name(self, temp_project_dir):
+    @pytest.mark.parametrize("entity_name", ["../../etc/passwd", "subdir/tip.md", ".", ".."])
+    def test_publish_rejects_invalid_entity_name(self, temp_project_dir, entity_name):
         guideline_dir = temp_project_dir / ".evolve" / "entities" / "guideline"
         guideline_dir.mkdir(parents=True)
         (guideline_dir / "tip.md").write_text("---\ntype: guideline\n---\n\nA tip.\n")
         result = run_script(
             PUBLISH_SCRIPT,
             project_dir=temp_project_dir,
-            args=["--entity", "../../etc/passwd"],
+            args=["--entity", entity_name],
             evolve_dir=temp_project_dir / ".evolve",
             expect_success=False,
         )
@@ -390,6 +391,35 @@ def test_sync_skips_invalid_subscription_name(self, temp_project_dir):
         assert ". (invalid subscription name)" in result.stdout
         assert not (evolve_dir / "entities" / "subscribed").exists()
 
+    def test_sync_uses_workspace_config_with_custom_evolve_dir(self, temp_project_dir, local_repo):
+        evolve_dir = temp_project_dir / "custom-evolve"
+        subscribed_dir = evolve_dir / "subscribed"
+        subscribed_dir.mkdir(parents=True)
+        subprocess.run(
+            ["git", "clone", "--branch", "main", "--depth", "1", str(local_repo["bare"]), str(subscribed_dir / "alice")],
+            check=True,
+            env=local_repo["env"],
+        )
+        (temp_project_dir / "evolve.config.yaml").write_text(
+            f'identity:\n  user: "alice"\nsubscriptions:\n  - name: "alice"\n    remote: "{local_repo["bare"]}"\n    branch: "main"\n'
+        )
+
+        result = run_script(
+            SYNC_SCRIPT,
+            project_dir=temp_project_dir,
+            evolve_dir=evolve_dir,
+            expect_success=False,
+        )
+
+        assert result.returncode == 0
+        mirrored = evolve_dir / "entities" / "subscribed" / "alice" / "guideline" / "tip-one.md"
+        assert mirrored.exists()
+        audit_log = evolve_dir / ".evolve" / "audit.log"
+        assert audit_log.exists()
+        entry = json.loads(audit_log.read_text().strip())
+        assert entry["action"] == "sync"
+        assert entry["actor"] == "alice"
+
     def test_manual_sync_runs_even_when_on_session_start_is_false(self, temp_project_dir, local_repo):
         evolve_dir = temp_project_dir / ".evolve"
         run_script(

tests/platform_integrations/test_entity_io.py

@@ -63,8 +63,9 @@ def test_find_entities_dir_env_missing_subdir_returns_none(monkeypatch, tmp_path
     assert entity_io.find_entities_dir() is None
 
 
-def test_find_recall_entity_dirs_includes_entities_and_public(monkeypatch, tmp_path):
-    custom = tmp_path / "custom-evolve"
+@pytest.mark.unit
+def test_find_recall_entity_dirs_includes_entities_and_public(monkeypatch, temp_project_dir):
+    custom = temp_project_dir / "custom-evolve"
     entities = custom / "entities"
     public = custom / "public"
     entities.mkdir(parents=True)
@@ -73,8 +74,9 @@ def test_find_recall_entity_dirs_includes_entities_and_public(monkeypatch, tmp_p
     assert entity_io.find_recall_entity_dirs() == [entities, public]
 
 
-def test_find_recall_entity_dirs_skips_missing_locations(monkeypatch, tmp_path):
-    custom = tmp_path / "custom-evolve"
+@pytest.mark.unit
+def test_find_recall_entity_dirs_skips_missing_locations(monkeypatch, temp_project_dir):
+    custom = temp_project_dir / "custom-evolve"
     public = custom / "public"
     public.mkdir(parents=True)
     monkeypatch.setenv("EVOLVE_DIR", str(custom))

tests/platform_integrations/test_sync.py

@@ -8,7 +8,7 @@
 
 import pytest
 
-pytestmark = pytest.mark.platform_integrations
+pytestmark = [pytest.mark.platform_integrations, pytest.mark.e2e]
 
 _PLUGIN_ROOT = Path(__file__).parent.parent.parent / "platform-integrations/claude/plugins/evolve-lite"
 SUBSCRIBE_SCRIPT = _PLUGIN_ROOT / "skills/subscribe/scripts/subscribe.py"
@@ -118,6 +118,18 @@ def test_skips_symlinked_entities(self, subscribed_project):
         real_file.write_text("---\ntype: guideline\n---\n\nReal content.\n")
         symlink_file = lr["work"] / "guideline" / "link.md"
         symlink_file.symlink_to(real_file)
+        git_env = lr["env"]
+        subprocess.run(["git", "-C", str(lr["work"]), "add", "."], check=True, env=git_env)
+        subprocess.run(
+            ["git", "-C", str(lr["work"]), "commit", "-m", "add symlinked entity"],
+            check=True,
+            env=git_env,
+        )
+        subprocess.run(
+            ["git", "-C", str(lr["work"]), "push", "origin", "main"],
+            check=True,
+            env=git_env,
+        )
         run_script(SYNC_SCRIPT, p["project_dir"], evolve_dir=p["evolve_dir"])
         mirrored = p["evolve_dir"] / "entities" / "subscribed" / "alice" / "guideline"
         assert not (mirrored / "link.md").exists()