feat(claw-code): add Claw Code platform support to installer (#208)

* feat(claw-code): add Claw Code platform support to installer

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat(claw-code): sync evolve-lite skills with claude (sharing + updates)

Bring claw-code's evolve-lite plugin up to parity with claude's after
rebase: port post-rebase updates to learn/recall/save/save-trajectory,
add the publish/subscribe/sync/unsubscribe sharing skills, and sync
shared lib/ (audit.py, config.py, entity_io.py). SKILL.md command
examples are adapted to claw's sh -lc path-resolution pattern instead
of \${CLAUDE_PLUGIN_ROOT}.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(evolve-lite): address PR review feedback (CodeRabbit on #208)

- claw-code retrieve_entities.sh: clarify the PreToolUse hook is optional
  and not auto-registered by the packaged plugin
- entity_io.write_entity_file: initialize target=None so the except handler
  can't raise UnboundLocalError (claude + claw-code)
- save_entities.py: reject malformed payloads where `entities` is not a
  list (claude + claw-code + codex + bob)
- claw-code recall retrieve_entities.py: redact HOOK_*/CLAWD_* env values
  (HOOK_TOOL_INPUT may carry prompts/secrets); only HOOK_EVENT and
  HOOK_TOOL_NAME remain logged verbatim
- save_trajectory.py: prefer EVOLVE_DIR over CLAUDE_PROJECT_ROOT (matches
  the documented contract); claim trajectory filenames atomically with
  O_CREAT|O_EXCL to survive same-second races; require `messages` to be
  a non-empty list instead of accepting any truthy value (claude + claw-code)
- claw-code save-trajectory/SKILL.md: drop the duplicate Step 5 block —
  keep only the CLAW_CONFIG_HOME-aware variant

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(evolve-lite): address PR #208 round-2 review feedback

- config._cast: quoted YAML scalars stay strings — only unquoted scalars
  coerce to bool/null/int/float/list (claude + claw-code)
- config._coerce_repo: reject names that fail is_valid_repo_name so a
  hand-edited evolve.config.yaml can't smuggle path traversal into
  downstream clone paths (claude + claw-code)
- claw-code recall retrieve_entities.py: guard input_data type before
  calling .keys(); non-dict JSON no longer aborts recall
- subscribe clone: wrap subprocess.run with timeout + capture_output and
  clean up the partial dest directory on failure (claude + claw-code +
  codex + bob)
- sync._head_hash: route through the existing _git helper so
  subprocess.TimeoutExpired no longer aborts the whole sync run
  (claude + claw-code)
- sync --config: load_config takes project_root, not filepath — the
  prior call raised TypeError on every --config usage. Resolve the path
  to its parent and pass project_root (claude + claw-code + codex)
- unsubscribe: add --force; refuse to delete a write-scope clone without
  it (the clone may hold unpushed publish commits). SKILL.md updated to
  surface the flag for the agent. (claude + claw-code + codex + bob)
- claw-code sync/SKILL.md and claude sync/SKILL.md: collapse the two
  example blockquotes into one block (markdownlint MD028)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Punleuk Oum <5661986+illeatmyhat@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: illeatmyhat

platform-integrations/bob/evolve-lite/skills/evolve-lite:learn/scripts/save_entities.py

@@ -53,6 +53,10 @@ def main():
         sys.exit(1)
 
     new_entities = input_data.get("entities", [])
+    if not isinstance(new_entities, list):
+        log(f"Invalid entities payload type: {type(new_entities).__name__}")
+        print("Error: `entities` must be a list.", file=sys.stderr)
+        sys.exit(1)
     if not new_entities:
         log("No entities in input")
         print("No entities provided in input.", file=sys.stderr)

platform-integrations/bob/evolve-lite/skills/evolve-lite:subscribe/scripts/subscribe.py

@@ -63,7 +63,17 @@ def main():
     clone_cmd = ["git", "clone", args.remote, str(dest), "--branch", args.branch]
     if args.scope == "read":
         clone_cmd += ["--depth", "1"]
-    subprocess.run(clone_cmd, check=True)
+    try:
+        subprocess.run(clone_cmd, check=True, timeout=60, capture_output=True, text=True)
+    except subprocess.TimeoutExpired:
+        shutil.rmtree(dest, ignore_errors=True)
+        print("Error: git clone timed out", file=sys.stderr)
+        sys.exit(1)
+    except subprocess.CalledProcessError as exc:
+        shutil.rmtree(dest, ignore_errors=True)
+        detail = (exc.stderr or exc.stdout or "").strip() or f"exit {exc.returncode}"
+        print(f"Error: git clone failed: {detail}", file=sys.stderr)
+        sys.exit(1)
 
     repos.append(
         {

platform-integrations/bob/evolve-lite/skills/evolve-lite:unsubscribe/scripts/unsubscribe.py

@@ -36,6 +36,11 @@ def main():
     group = parser.add_mutually_exclusive_group(required=True)
     group.add_argument("--list", action="store_true", help="Print repos as JSON array")
     group.add_argument("--name", help="Name of repo to remove")
+    parser.add_argument(
+        "--force",
+        action="store_true",
+        help="Required to remove a write-scope repo (its clone may hold unpushed publishes)",
+    )
     args = parser.parse_args()
 
     evolve_dir = Path(os.environ.get("EVOLVE_DIR", ".evolve"))
@@ -56,11 +61,21 @@ def main():
         print(f"Error: invalid subscription name: {name!r}", file=sys.stderr)
         sys.exit(1)
 
-    new_repos = [r for r in repos if r.get("name") != name]
-    if len(new_repos) == len(repos):
+    matched = next((r for r in repos if r.get("name") == name), None)
+    if matched is None:
         print(f"Error: subscription '{name}' not found.", file=sys.stderr)
         sys.exit(1)
 
+    if matched.get("scope") == "write" and not args.force:
+        print(
+            f"Error: '{name}' is a write-scope repo. Removing it would delete the local clone, "
+            "including any unpushed publish commits. Re-run with --force to confirm.",
+            file=sys.stderr,
+        )
+        sys.exit(1)
+
+    new_repos = [r for r in repos if r.get("name") != name]
+
     if dest.exists():
         shutil.rmtree(dest)
         print(f"Deleted {dest}")

platform-integrations/claude/plugins/evolve-lite/lib/config.py

@@ -175,17 +175,17 @@ def _parse_yaml(text):
 
 
 def _cast(value):
-    """Cast a YAML scalar string to an appropriate Python type."""
-    # Strip surrounding quotes first to handle quoted empty strings correctly
+    """Cast a YAML scalar string to an appropriate Python type.
+
+    Quoted scalars stay strings — that's the whole point of YAML quoting.
+    Only unquoted scalars get coerced to bool / null / int / float / list.
+    """
+    # Quoted: return the string verbatim (with single-quote unescaping).
     if (value.startswith('"') and value.endswith('"')) or (value.startswith("'") and value.endswith("'")):
         stripped = value[1:-1]
-        # Quoted empty string should return empty string, not None
-        if stripped == "":
-            return ""
-        # Un-double single quotes escaped by _scalar (e.g. "a''b" → "a'b")
         if value.startswith("'"):
             stripped = stripped.replace("''", "'")
-        value = stripped
+        return stripped
 
     if value in ("true", "True", "yes"):
         return True
@@ -335,6 +335,12 @@ def _coerce_repo(entry):
     remote = entry.get("remote")
     if not isinstance(name, str) or not name.strip():
         return None
+    if not is_valid_repo_name(name.strip()):
+        print(
+            f"evolve-lite: ignoring repo entry {name!r} — invalid name (only A-Z, a-z, 0-9, '.', '_', '-' allowed)",
+            file=sys.stderr,
+        )
+        return None
     if not isinstance(remote, str) or not remote.strip():
         return None
     scope = entry.get("scope", "read")

platform-integrations/claude/plugins/evolve-lite/lib/entity_io.py

@@ -269,6 +269,7 @@ def write_entity_file(directory, entity):
 
     # Write to a unique temp file first (avoids predictable .tmp collisions)
     fd, tmp_path = tempfile.mkstemp(dir=type_dir, suffix=".tmp", prefix=slug)
+    target = None
     try:
         os.write(fd, content.encode("utf-8"))
         os.close(fd)

platform-integrations/claude/plugins/evolve-lite/skills/learn/scripts/save_entities.py

@@ -48,6 +48,10 @@ def main():
         sys.exit(1)
 
     new_entities = input_data.get("entities", [])
+    if not isinstance(new_entities, list):
+        log(f"Invalid entities payload type: {type(new_entities).__name__}")
+        print("Error: `entities` must be a list.", file=sys.stderr)
+        sys.exit(1)
     if not new_entities:
         log("No entities in input")
         print("No entities provided in input.", file=sys.stderr)

platform-integrations/claude/plugins/evolve-lite/skills/save-trajectory/scripts/save_trajectory.py

@@ -44,31 +44,45 @@ def log(message):
 
 
 def get_trajectories_dir():
-    """Get the trajectories output directory, creating it if needed."""
-    project_root = os.environ.get("CLAUDE_PROJECT_ROOT", "")
-    if project_root:
-        base = Path(project_root) / ".evolve" / "trajectories"
+    """Get the trajectories output directory, creating it if needed.
+
+    Resolution order:
+      1. ``EVOLVE_DIR`` env var (matches the documented contract)
+      2. ``CLAUDE_PROJECT_ROOT`` env var (the agent's project root)
+      3. ``.evolve/`` in the current working directory
+    """
+    evolve_dir = os.environ.get("EVOLVE_DIR")
+    if evolve_dir:
+        base = Path(evolve_dir) / "trajectories"
     else:
-        base = Path(".evolve") / "trajectories"
+        project_root = os.environ.get("CLAUDE_PROJECT_ROOT", "")
+        if project_root:
+            base = Path(project_root) / ".evolve" / "trajectories"
+        else:
+            base = Path(".evolve") / "trajectories"
 
     base.mkdir(parents=True, exist_ok=True, mode=0o700)
     return base.resolve()
 
 
-def generate_filename(trajectories_dir):
-    """Generate a timestamped filename, adding a suffix on collision."""
+def open_trajectory_file(trajectories_dir):
+    """Atomically claim a timestamped trajectory file.
+
+    Returns a ``(Path, fd)`` tuple. Uses ``O_CREAT | O_EXCL`` so two saves
+    racing within the same second pick distinct filenames instead of one
+    overwriting the other.
+    """
     now = datetime.datetime.now().strftime("%Y-%m-%dT%H-%M-%S")
     base_name = f"trajectory_{now}"
 
-    candidate = trajectories_dir / f"{base_name}.json"
-    if not candidate.exists():
-        return candidate
-
-    # Handle collisions with _1, _2, etc.
-    for suffix in range(1, 1000):
-        candidate = trajectories_dir / f"{base_name}_{suffix}.json"
-        if not candidate.exists():
-            return candidate
+    for suffix in range(0, 1000):
+        name = f"{base_name}.json" if suffix == 0 else f"{base_name}_{suffix}.json"
+        candidate = trajectories_dir / name
+        try:
+            fd = os.open(str(candidate), os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+            return candidate, fd
+        except FileExistsError:
+            continue
 
     raise RuntimeError(f"Too many trajectory files for timestamp {now}")
 
@@ -99,21 +113,20 @@ def main():
         sys.exit(1)
 
     log(f"Received trajectory with keys: {list(trajectory.keys())}")
-    messages = trajectory.get("messages", [])
-    if not messages:
-        log("No messages in trajectory")
-        print("No messages in trajectory.", file=sys.stderr)
+    messages = trajectory.get("messages")
+    if not isinstance(messages, list) or not messages:
+        log(f"Invalid messages in trajectory: {type(messages).__name__}")
+        print("Error: `messages` must be a non-empty list.", file=sys.stderr)
         sys.exit(1)
 
     log(f"Trajectory has {len(messages)} messages")
 
-    # Determine output path
+    # Atomically claim a unique output path (handles same-second races)
     trajectories_dir = get_trajectories_dir()
-    output_path = generate_filename(trajectories_dir)
+    output_path, fd = open_trajectory_file(trajectories_dir)
 
-    # Write formatted JSON with owner-only permissions
+    # Write formatted JSON via the already-opened owner-only fd
     try:
-        fd = os.open(output_path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
         with os.fdopen(fd, "w", encoding="utf-8") as f:
             json.dump(trajectory, f, indent=2, default=str)
             f.write("\n")

platform-integrations/claude/plugins/evolve-lite/skills/subscribe/scripts/subscribe.py

@@ -95,7 +95,17 @@ def main():
     clone_cmd = ["git", "clone", args.remote, str(dest), "--branch", args.branch]
     if args.scope == "read":
         clone_cmd += ["--depth", "1"]
-    subprocess.run(clone_cmd, check=True)
+    try:
+        subprocess.run(clone_cmd, check=True, timeout=60, capture_output=True, text=True)
+    except subprocess.TimeoutExpired:
+        shutil.rmtree(dest, ignore_errors=True)
+        print("Error: git clone timed out", file=sys.stderr)
+        sys.exit(1)
+    except subprocess.CalledProcessError as exc:
+        shutil.rmtree(dest, ignore_errors=True)
+        detail = (exc.stderr or exc.stdout or "").strip() or f"exit {exc.returncode}"
+        print(f"Error: git clone failed: {detail}", file=sys.stderr)
+        sys.exit(1)
 
     repos.append(
         {

platform-integrations/claude/plugins/evolve-lite/skills/sync/SKILL.md

@@ -25,7 +25,7 @@ python3 ${CLAUDE_PLUGIN_ROOT}/skills/sync/scripts/sync.py
 Display the script's stdout verbatim to the user. Example outputs:
 
 > "Synced 2 repo(s): memory [write] (+2 added, 0 updated, 0 removed), bob [read] (+0 added, 1 updated, 0 removed)"
-
+>
 > "No subscriptions configured. Add one with /evolve-lite:subscribe to start syncing shared guidelines."
 
 Under `--quiet`, the script exits silently when there's nothing to report.

platform-integrations/claude/plugins/evolve-lite/skills/sync/scripts/sync.py

@@ -42,13 +42,8 @@ def _git(repo_path, *args, timeout=_GIT_TIMEOUT):
 
 
 def _head_hash(repo_path):
-    result = subprocess.run(
-        ["git", "-c", f"safe.directory={repo_path}", "-C", str(repo_path), "rev-parse", "HEAD"],
-        capture_output=True,
-        text=True,
-        timeout=_GIT_TIMEOUT,
-    )
-    if result.returncode != 0:
+    result = _git(repo_path, "rev-parse", "HEAD")
+    if result is None or result.returncode != 0:
         return None
     return result.stdout.strip()
 
@@ -138,7 +133,14 @@ def main():
     project_root = str(evolve_dir.parent) if "EVOLVE_DIR" in os.environ else "."
 
     if args.config:
-        cfg = load_config(filepath=args.config)
+        config_path = Path(args.config).resolve()
+        if config_path.name != "evolve.config.yaml":
+            print(
+                f"Error: --config must point to an evolve.config.yaml file, got: {config_path}",
+                file=sys.stderr,
+            )
+            sys.exit(1)
+        cfg = load_config(project_root=str(config_path.parent))
     else:
         cfg = load_config(project_root)