fix(codex): tighten sharing script safeguards

Author: visahak

platform-integrations/codex/plugins/evolve-lite/skills/publish/scripts/publish.py

@@ -91,15 +91,18 @@ def main():
     if dest_path.exists():
         print(f"Error: already published: {dest_path}\nUnpublish it first or delete it manually.", file=sys.stderr)
         sys.exit(1)
-    dest_path.write_text(entity_to_markdown(entity), encoding="utf-8")
-    src_path.unlink()
-
-    audit_append(
-        project_root=str(evolve_dir.resolve()) if evolve_dir.name != ".evolve" else str(evolve_dir.resolve().parent),
-        action="publish",
-        actor=effective_user or "unknown",
-        entity=args.entity,
-    )
+    src_path.write_text(entity_to_markdown(entity), encoding="utf-8")
+    src_path.replace(dest_path)
+
+    try:
+        audit_append(
+            project_root=str(evolve_dir.resolve()) if evolve_dir.name != ".evolve" else str(evolve_dir.resolve().parent),
+            action="publish",
+            actor=effective_user or "unknown",
+            entity=args.entity,
+        )
+    except Exception as exc:
+        print(f"Warning: failed to append audit entry for publish: {exc}", file=sys.stderr)
 
     print(f"Published: {args.entity} -> {dest_path}")
 

platform-integrations/codex/plugins/evolve-lite/skills/recall/scripts/retrieve_entities.py

@@ -72,11 +72,10 @@ def load_entities_with_source(entities_dirs):
             if not entity.get("content"):
                 continue
 
+            entity.pop("_source", None)
             parts = md.relative_to(entities_dir).parts
-            for index, part in enumerate(parts):
-                if part == "subscribed" and index + 1 < len(parts):
-                    entity["_source"] = parts[index + 1]
-                    break
+            if parts and parts[0] == "subscribed" and len(parts) > 1:
+                entity["_source"] = parts[1]
 
             entities.append(entity)
 

platform-integrations/codex/plugins/evolve-lite/skills/sync/scripts/sync.py

@@ -3,6 +3,7 @@
 
 import argparse
 import os
+import re
 import subprocess
 import sys
 from pathlib import Path
@@ -27,22 +28,35 @@
 from config import _parse_yaml, load_config  # noqa: E402
 
 
+_GIT_TIMEOUT = 30  # seconds
+
+
 def git_pull(repo_path, branch):
-    """Pull latest from origin."""
-    return subprocess.run(
-        ["git", "-C", str(repo_path), "pull", "origin", branch, "--ff-only"],
-        capture_output=True,
-        text=True,
-    )
+    """Pull latest from origin. Returns CompletedProcess, or None on timeout."""
+    try:
+        return subprocess.run(
+            ["git", "-C", str(repo_path), "pull", "origin", branch, "--ff-only"],
+            capture_output=True,
+            text=True,
+            timeout=_GIT_TIMEOUT,
+        )
+    except subprocess.TimeoutExpired:
+        print(f"Warning: git pull timed out for {repo_path} (branch: {branch})", file=sys.stderr)
+        return None
 
 
 def count_delta(repo_path):
-    """Count added, modified, and deleted markdown files since last pull."""
+    """Count added/modified/deleted .md files since last pull."""
     result = subprocess.run(
         ["git", "-C", str(repo_path), "diff", "--name-status", "HEAD@{1}", "HEAD"],
         capture_output=True,
         text=True,
+        timeout=_GIT_TIMEOUT,
     )
+    if result.returncode != 0:
+        # HEAD@{1} doesn't exist (initial sync) — count all .md files as added.
+        added = len(list(repo_path.glob("**/*.md")))
+        return {"added": added, "updated": 0, "removed": 0}
     added = updated = removed = 0
     for line in result.stdout.splitlines():
         if not line.strip():
@@ -103,19 +117,25 @@ def main():
     summaries = []
     total_delta = {}
     any_changes = False
+    safe_name = re.compile(r"^[A-Za-z0-9._-]+$")
 
     for sub in subscriptions:
         if not isinstance(sub, dict):
             continue
         name = sub.get("name", "unknown")
         branch = sub.get("branch", "main")
+
+        if not safe_name.match(name):
+            summaries.append(f"{name!r} (skipped - invalid subscription name)")
+            continue
+
         subscribed_base = (evolve_dir / "entities" / "subscribed").resolve()
         repo_path = (evolve_dir / "entities" / "subscribed" / name).resolve()
         legacy_base = (evolve_dir / "subscribed").resolve()
         legacy_repo_path = (evolve_dir / "subscribed" / name).resolve()
 
         if repo_path == subscribed_base or not repo_path.is_relative_to(subscribed_base):
-            summaries.append(f"{name} (invalid subscription name)")
+            summaries.append(f"{name!r} (skipped - invalid subscription name)")
             continue
 
         if legacy_repo_path != legacy_base and legacy_repo_path.is_relative_to(legacy_base):
@@ -131,13 +151,17 @@ def main():
             continue
 
         pull_result = git_pull(repo_path, branch)
-        if pull_result.returncode != 0:
+        if pull_result is None or pull_result.returncode != 0:
             error_lines = (pull_result.stderr or pull_result.stdout or "").strip().splitlines()
             short_error = error_lines[-1] if error_lines else "unknown error"
             summaries.append(f"{name} (git pull failed: {short_error})")
+            total_delta[name] = {"added": 0, "updated": 0, "removed": 0}
             continue
 
-        delta = count_delta(repo_path)
+        if "Already up to date" in (pull_result.stdout or ""):
+            delta = {"added": 0, "updated": 0, "removed": 0}
+        else:
+            delta = count_delta(repo_path)
         total_delta[name] = delta
         if any(value > 0 for value in delta.values()):
             any_changes = True

platform-integrations/codex/plugins/evolve-lite/skills/unsubscribe/scripts/unsubscribe.py

@@ -50,13 +50,13 @@ def main():
     name = args.name
     subscribed_base = (evolve_dir / "entities" / "subscribed").resolve()
     dest = (evolve_dir / "entities" / "subscribed" / name).resolve()
-    if not dest.is_relative_to(subscribed_base):
+    if name in {"", "."} or dest == subscribed_base or not dest.is_relative_to(subscribed_base):
         print(f"Error: invalid subscription name: {name!r}", file=sys.stderr)
         sys.exit(1)
 
     legacy_base = (evolve_dir / "subscribed").resolve()
     legacy_dest = (evolve_dir / "subscribed" / name).resolve()
-    if not legacy_dest.is_relative_to(legacy_base):
+    if legacy_dest == legacy_base or not legacy_dest.is_relative_to(legacy_base):
         print(f"Error: invalid subscription name: {name!r}", file=sys.stderr)
         sys.exit(1)
 

tests/platform_integrations/test_codex_sharing.py

@@ -389,7 +389,7 @@ def test_sync_skips_invalid_subscription_name(self, temp_project_dir):
         )
 
         assert result.returncode == 0
-        assert ". (invalid subscription name)" in result.stdout
+        assert "'.' (skipped - invalid subscription name)" in result.stdout
         assert not (evolve_dir / "entities" / "subscribed").exists()
 
     def test_sync_uses_workspace_config_with_custom_evolve_dir(self, temp_project_dir, local_repo):