Function findEvolverRoot

src/adapters/scripts/_runtimePaths.js:165–216

()

}

function findEvolverRoot() {
  if (process.env.EVOLVER_ROOT) {
    const explicit = process.env.EVOLVER_ROOT;
    if (fs.existsSync(path.join(explicit, 'package.json')) &&
        isEvolverPackageJson(path.join(explicit, 'package.json'))) {
      return explicit;
    }
  }

  // Dev/repo layout: this file lives at src/adapters/scripts/_runtimePaths.js,
  // so `../../..` is the package root.
  const repoRoot = path.resolve(__dirname, '..', '..', '..');
  if (fs.existsSync(path.join(repoRoot, 'package.json')) &&
      isEvolverPackageJson(path.join(repoRoot, 'package.json'))) {
    return repoRoot;
  }

  // npm-global / npm-local install layout. The hook script may have been
  // copied out of the package into `.claude/hooks/` etc., breaking relative
  // walks. Use require.resolve to find the installed package authoritatively.
  //
  // SECURITY: do NOT include `process.cwd()` here. A hostile workspace can
  // place its own `node_modules/@evomap/evolver/package.json`, which would
  // be selected here and control `findMemoryGraph()` -> the memory graph
  // contents become attacker-controlled prompt-injection material in
  // `evolver-session-start.js`'s `additionalContext`. Restrict to trusted,
  // user/system-scoped install roots (built in `_buildInstallSearchPaths`).
  try {
    // Allowlist of trusted user/system-scoped install roots. Built by
    // _buildInstallSearchPaths() above so the list is one source of truth
    // (Apple Silicon Homebrew, Linuxbrew, NVM / fnm / Volta / asdf,
    // and Windows %APPDATA%\npm + %ProgramFiles%\nodejs install layouts).
    // process.cwd() is intentionally excluded: a hostile workspace can plant
    // its own node_modules/@evomap/evolver/package.json which would then
    // control findMemoryGraph() and feed attacker-controlled content into
    // evolver-session-start.js's additionalContext.
    const pkgJson = require.resolve('@evomap/evolver/package.json', {
      paths: _buildInstallSearchPaths(),
    });
    if (pkgJson && isEvolverPackageJson(pkgJson)) {
      return path.dirname(pkgJson);
    }
  } catch { /* not installed via npm */ }

  const homeSkills = path.join(os.homedir(), 'skills', 'evolver');
  if (fs.existsSync(path.join(homeSkills, 'package.json')) &&
      isEvolverPackageJson(path.join(homeSkills, 'package.json'))) {
    return homeSkills;
  }

  return null;
}

// Resolve the user's PROJECT directory — the workspace the agent is actually
// working in — for git-diff collection and workspace tagging.