Function recordToLocal

src/adapters/scripts/evolver-session-end.js:153–199

(graphPath, outcome)

}

function recordToLocal(graphPath, outcome) {
  try {
    // Resolve the project dir once so the cwd tag and the workspace_id secret
    // share a single, consistent source (both must agree with the session-start
    // reader's resolveProjectDir()-based scoping).
    const projectDir = resolveProjectDir();
    const entry = {
      timestamp: new Date().toISOString(),
      gene_id: outcome.geneId || 'ad_hoc',
      signals: outcome.signals,
      outcome: {
        status: outcome.status,
        score: outcome.score,
        note: outcome.summary,
      },
      // Tag the originating workspace so the review-time reader in
      // collect.js can scope user-level fallback entries to the current
      // cwd. Without this, two unrelated projects sharing the user-level
      // fallback file (~/.evolver/memory/evolution/memory_graph.jsonl,
      // used by npm-global installs) would cross-pollinate each other's
      // review context — a prompt-injection / disclosure surface flagged
      // by Bugbot on PR #105 round-2.
      //
      // workspace_id is the forge-resistant tag (PR #108 round-3): the
      // reader compares it against the secret in the workspace's own
      // .evolver/workspace-id file. cwd is retained as a backward-compat
      // tag so older entries written before this hardening still pass
      // the cwd check.
      //
      // Use resolveProjectDir() (NOT process.cwd()) so the cwd tag records the
      // user's project, consistent with how the diff above is collected and
      // with the session-start reader's cwd fallback. Under Cursor, cwd is the
      // plugin install dir, so a raw process.cwd() tag would never match the
      // reader's resolveProjectDir()-derived currentDir — silently hiding every
      // cwd-only entry (Bugbot PR #555). collect.js only uses cwd as a legacy
      // fallback (disabled once a workspace_id secret exists), so changing the
      // tag's source — still a directory path — does not affect its scoping.
      cwd: projectDir,
      workspace_id: resolveWorkspaceId(undefined, projectDir),
      source: 'hook:session-end',
    };
    fs.appendFileSync(graphPath, JSON.stringify(entry) + '\n', 'utf8');
    return true;
  } catch {
    return false;
  }
}

// Append a single timestamped line to ~/.evolver/logs/evolution.log (or
// EVOLVER_HOOK_LOG_DIR). Best-effort: a log-write failure must never break the