fix: address Bugbot review (cursor/plugins#110) — 5 findings

- session-end: watchdog timeout now runs proceed() instead of emitting {}
  bare, so a session outcome is no longer silently dropped when stdin stays
  open past the timeout (was a real data-loss path).
- session-start: gate main() on stdin end/2s-watchdog with an emit-once guard,
  consistent with the other hooks; no behavior change but no pipe race.
- session-start: belongsToWorkspace no longer blanket-includes foreign
  workspace_id-tagged entries when our own id can't be resolved — falls back to
  cwd matching, so a shared user-level graph can't leak another project's recall.
- _paths: findMemoryGraph(projectDir) now resolves a project-local
  <projectDir>/memory/evolution/memory_graph.jsonl when it exists (matching the
  docs), before the user-level fallback; both hooks pass their projectDir.
- README/SKILL: corrected the claim that hooks auto-detect/invoke the installed
  engine — they don't; @evomap/evolver gives you the CLI (evolver run/review)
  to run the pipeline separately, fed by the memory the hooks record. Also fixed
  stale hook filenames in the README table and the bundling description.

Verified: node --check all hooks; watchdog path now records; project-local
path resolution + user-level fallback; official validate-plugins.mjs passes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: autogame-17

README.md

@@ -19,9 +19,9 @@ Three hooks run automatically — you don't invoke them:
 
 | Hook | Event | Effect |
 |---|---|---|
-| `evolver-session-start.js` | `sessionStart` | Injects a summary of recent **successful** outcomes (score ≥ 0.5, < 7 days, max 3) as context. |
-| `evolver-signal-detect.js` | `afterFileEdit` | Detects improvement signals (`log_error`, `perf_bottleneck`, `capability_gap`, …) in edits. |
-| `evolver-session-end.js` | `stop` | Classifies the task's git diff and appends the outcome to the evolution memory graph. |
+| `session-start.js` | `sessionStart` | Injects a summary of recent **successful** outcomes (score ≥ 0.5, < 7 days, max 3) as context. |
+| `signal-detect.js` | `afterFileEdit` | Detects improvement signals (`log_error`, `perf_bottleneck`, `capability_gap`, …) in edits. |
+| `session-end.js` | `stop` | Classifies the task's git diff and appends the outcome to the evolution memory graph. |
 
 It also ships:
 
@@ -64,11 +64,14 @@ immediately. **No account, no key, no network.**
 npm install -g @evomap/evolver
 ```
 
-Once `@evomap/evolver` is on `PATH`, the same hooks automatically find it and
-run the **full pipeline** — automated log analysis and the review-and-solidify
-cycle that proposes and applies code improvements — instead of the local-only
-fallback. Set `EVOLVER_ROOT` to point at a specific install if you have more
-than one.
+The bundled hooks always do lightweight **local** recall/record — local git
+diff + JSONL append, plus optional Hub sync. Installing `@evomap/evolver` does
+**not** change what the hooks do and they do not auto-detect or invoke it.
+What it adds is the engine's **CLI** — e.g. `evolver run` (the full automated
+review-and-solidify pipeline that analyzes logs and proposes/applies code
+improvements) and `evolver review` — which you run separately. The memory the
+hooks record feeds that pipeline, so the two compose without the hooks ever
+shelling out to the engine.
 
 ### EvoMap Hub (community strategies)
 
@@ -90,21 +93,22 @@ registration.
 EvoMap deliberately splits two products:
 
 - **`@evomap/evolver`** — the GPL-licensed, source-available evolution engine
-  (daemon + CLI). Its hook scripts are what this plugin bundles.
+  (daemon + CLI). This plugin does **not** bundle it; the plugin's own hooks are
+  an independent MIT clean-room implementation that records memory in the same
+  format the engine reads, so the two interoperate when you install it.
 - **`@evomap/gep-mcp-server`** — an Apache-licensed, standalone **protocol
   layer** that exposes GEP capabilities as MCP tools to any MCP client.
 
-This plugin bundles the **evolver hooks** because they are exactly the
-session-lifecycle glue Cursor needs, and they degrade gracefully when the
-engine isn't installed. If you also want the `gep_*` MCP tools inside Cursor,
-add `@evomap/gep-mcp-server` to your Cursor MCP config directly — it is not
-re-bundled here to avoid duplicating that separately-maintained product.
+This plugin ships its own lightweight session-lifecycle hooks (the glue Cursor
+needs), which work standalone and degrade gracefully. If you also want the
+`gep_*` MCP tools inside Cursor, add `@evomap/gep-mcp-server` to your Cursor MCP
+config directly — it is not re-bundled here to avoid duplicating that
+separately-maintained product.
 
 ## Environment variables
 
 | Variable | Default | Purpose |
 |---|---|---|
-| `EVOLVER_ROOT` | (auto-detected) | Path to the `@evomap/evolver` install. |
 | `MEMORY_GRAPH_PATH` | (auto) | Override the memory graph file location. |
 | `EVOMAP_HUB_URL` / `EVOMAP_API_KEY` / `EVOMAP_NODE_ID` | (unset) | Enable Hub recording. |
 | `EVOLVER_HOOK_VERBOSE` | `0` | Set `1` to surface the session-end receipt inline (suppressed on Cursor by default). |

hooks/_paths.js

@@ -81,15 +81,37 @@ function isGitWorkspace(dir) {
 }
 
 /**
- * Return the path to the evolution memory graph (a JSONL file). Honours the
- * MEMORY_GRAPH_PATH override; otherwise defaults to a well-known location under
- * the home directory and best-effort creates the parent directory.
+ * Return the path to the evolution memory graph (a JSONL file).
+ *
+ * Resolution order:
+ *   1. MEMORY_GRAPH_PATH override, if set.
+ *   2. `<projectDir>/memory/evolution/memory_graph.jsonl` — but only if it
+ *      already EXISTS (an evolver-managed project owns this file). We never
+ *      create a project-local graph in an arbitrary folder, so plain projects
+ *      fall through to the user-level path.
+ *   3. The user-level `~/.evolver/memory/evolution/memory_graph.jsonl`, whose
+ *      parent directory is best-effort created.
  */
-function findMemoryGraph() {
+function findMemoryGraph(projectDir) {
   const override = process.env.MEMORY_GRAPH_PATH;
   if (typeof override === 'string' && override.length > 0) {
     return override;
   }
+  if (looksLikeDir(projectDir)) {
+    const projectPath = path.join(
+      projectDir,
+      'memory',
+      'evolution',
+      'memory_graph.jsonl'
+    );
+    try {
+      if (fs.statSync(projectPath).isFile()) {
+        return projectPath;
+      }
+    } catch (_err) {
+      // Not present — fall through to the user-level default.
+    }
+  }
   const defaultPath = path.join(
     os.homedir(),
     '.evolver',

hooks/session-end.js

@@ -181,9 +181,9 @@ function recordToHub(payload) {
  * contract consumed by external tooling — keep it exact. Returns true on
  * success.
  */
-function recordToLocal(entry) {
+function recordToLocal(entry, projectDir) {
   try {
-    const graphPath = findMemoryGraph();
+    const graphPath = findMemoryGraph(projectDir);
     fs.mkdirSync(path.dirname(graphPath), { recursive: true });
     fs.appendFileSync(graphPath, `${JSON.stringify(entry)}\n`);
     return true;
@@ -230,15 +230,18 @@ function finish(projectDir, diff) {
   });
 
   // Always also attempt a local record.
-  const localOk = recordToLocal({
-    timestamp: new Date().toISOString(),
-    gene_id: 'ad_hoc',
-    signals,
-    outcome: { status, score, note: summary },
-    cwd: projectDir,
-    workspace_id: resolveWorkspaceId(projectDir),
-    source: 'hook:session-end',
-  });
+  const localOk = recordToLocal(
+    {
+      timestamp: new Date().toISOString(),
+      gene_id: 'ad_hoc',
+      signals,
+      outcome: { status, score, note: summary },
+      cwd: projectDir,
+      workspace_id: resolveWorkspaceId(projectDir),
+      source: 'hook:session-end',
+    },
+    projectDir
+  );
 
   let destination;
   if (hubOk) {
@@ -280,11 +283,9 @@ function finish(projectDir, diff) {
     };
 
     const watchdog = setTimeout(() => {
-      // Stdin never closed in time — emit a bare object and bail.
-      if (!done) {
-        done = true;
-        emit({});
-      }
+      // Stdin never closed in time — still do the work (proceed() is guarded
+      // by `done`, so it runs at most once whether the timeout or `end` fires).
+      proceed();
     }, STDIN_WATCHDOG_MS);
     if (typeof watchdog.unref === 'function') {
       watchdog.unref();

hooks/session-start.js

@@ -32,11 +32,20 @@ const NONGIT_NOTICE =
   'inactive (outcomes are derived from git diffs). Run `git init` here, or ' +
   'open a git project, to enable recall and recording.';
 
+// The hook's own timeout is 3s; give stdin a slightly shorter window to drain.
+const STDIN_WATCHDOG_MS = 2000;
+
+let alreadyEmitted = false;
+
 /**
- * Emit a JSON object and exit cleanly. Falls back to `{}` if serialization
- * somehow fails.
+ * Emit a JSON object exactly once and exit cleanly. Falls back to `{}` if
+ * serialization somehow fails.
  */
 function emit(obj) {
+  if (alreadyEmitted) {
+    return;
+  }
+  alreadyEmitted = true;
   let text = '{}';
   try {
     text = JSON.stringify(obj);
@@ -97,15 +106,25 @@ function throttled(key, ttlMs) {
 
 /**
  * Decide whether a memory entry belongs to the current workspace.
- *   - tagged with workspace_id: match iff we know our id and it's equal
- *     (if we don't know our id, don't exclude on this basis)
- *   - else tagged with cwd: match iff equal (likewise lenient when unknown)
- *   - untagged: always include
+ *   - tagged with workspace_id, our id known: match iff equal.
+ *   - tagged with workspace_id, our id UNKNOWN: do not blanket-include (that
+ *     would leak other workspaces' entries from a shared graph). Fall back to
+ *     cwd matching: in-scope iff the entry's cwd equals currentDir; if the
+ *     entry has no cwd and currentDir is unknown too, then (and only then)
+ *     don't exclude.
+ *   - else tagged with cwd: match iff equal (lenient only when currentDir
+ *     is unknown).
+ *   - untagged (no workspace_id and no cwd): always include (legacy).
  */
 function belongsToWorkspace(entry, currentId, currentDir) {
   if (entry && typeof entry.workspace_id === 'string' && entry.workspace_id) {
     if (currentId === null || currentId === undefined) {
-      return true;
+      // Cannot resolve our own id — fall back to cwd matching rather than
+      // surfacing a possibly-foreign workspace's entries.
+      if (typeof entry.cwd === 'string' && entry.cwd) {
+        return currentDir ? entry.cwd === currentDir : false;
+      }
+      return !currentDir;
     }
     return entry.workspace_id === currentId;
   }
@@ -217,7 +236,7 @@ function main() {
 
   // 2. Workspace-scoped evolution memory.
   try {
-    const graphPath = findMemoryGraph();
+    const graphPath = findMemoryGraph(currentDir);
     const currentId = resolveWorkspaceId(currentDir);
     const candidates = gatherWorkspaceEntries(graphPath, currentId, currentDir);
     const relevant = filterRelevant(candidates);
@@ -238,13 +257,41 @@ function main() {
 }
 
 // This hook does not need stdin, but Cursor still pipes a JSON object. Drain it
-// so the writer never gets EPIPE, then run. Guard everything.
-try {
-  // Consume stdin without blocking; we don't actually use its contents.
-  process.stdin.on('data', () => {});
-  process.stdin.on('error', () => {});
-  process.stdin.resume();
-  main();
-} catch (_err) {
-  emit({});
-}
+// (so the writer never races a half-drained pipe / gets EPIPE) and only then
+// run main(). A short watchdog guarantees we still run if stdin never closes.
+// main() stays synchronous; we only gate when it is invoked. Guard everything.
+(function run() {
+  try {
+    let started = false;
+    const start = () => {
+      if (started) {
+        return;
+      }
+      started = true;
+      try {
+        main();
+      } catch (_err) {
+        emit({});
+      }
+    };
+
+    const watchdog = setTimeout(start, STDIN_WATCHDOG_MS);
+    if (typeof watchdog.unref === 'function') {
+      watchdog.unref();
+    }
+
+    // Consume stdin without blocking; we don't actually use its contents.
+    process.stdin.on('data', () => {});
+    process.stdin.on('end', () => {
+      clearTimeout(watchdog);
+      start();
+    });
+    process.stdin.on('error', () => {
+      clearTimeout(watchdog);
+      start();
+    });
+    process.stdin.resume();
+  } catch (_err) {
+    emit({});
+  }
+})();

skills/capability-evolver/SKILL.md

@@ -59,14 +59,15 @@ outcomes in terms the memory graph indexes well:
 ## Full pipeline (optional)
 
 The bundled hooks record outcomes and recall them — that works on its own. To
-unlock the **full evolution engine** (automated log analysis, the
-review-and-solidify cycle that proposes and applies code improvements, and
-EvoMap Hub sync for community strategies), install the engine:
+get the **full evolution engine** (automated log analysis, the
+review-and-solidify cycle that proposes and applies code improvements), install
+it:
 
 ```bash
 npm install -g @evomap/evolver
 ```
 
-Once it's on `PATH`, the same hooks automatically find it and run the complete
-pipeline instead of the local-only fallback. See the plugin README for
-connecting an EvoMap Hub node.
+This gives you the engine's CLI (e.g. `evolver run`) to run that pipeline
+separately — the hooks do not auto-detect or invoke it. The memory the hooks
+record is what the pipeline consumes. See the plugin README for connecting an
+EvoMap Hub node for community strategies.