fix: close scan residual workflow gaps

Author: rockyshi1993

grok/plugins/devcodex-workspace/hooks/devcodex-workspace.cjs

@@ -15,6 +15,38 @@ const {
   resolveGrokRuntimeRoot
 } = require('../lib/runtime-root.cjs')
 
+const STDIO_MAX_FRAME_BYTES = 4 * 1024 * 1024
+
+function byteLength(value) {
+  return Buffer.byteLength(String(value || ''), 'utf8')
+}
+
+function createBoundedTextAccumulator(options = {}) {
+  const maxBytes = options.maxBytes || STDIO_MAX_FRAME_BYTES
+  let text = ''
+  let overflowed = false
+  return {
+    push(chunk) {
+      if (overflowed) return false
+      const next = String(chunk || '')
+      if (byteLength(text) + byteLength(next) > maxBytes) {
+        text = ''
+        overflowed = true
+        return false
+      }
+      text += next
+      return true
+    },
+    snapshot() {
+      return text
+    },
+    get overflowed() {
+      return overflowed
+    },
+    maxBytes
+  }
+}
+
 function samePath(left, right) {
   const a = path.resolve(left)
   const b = path.resolve(right)
@@ -54,11 +86,20 @@ function findWorkspaceRoot(start) {
 
 function readInput() {
   return new Promise((resolve, reject) => {
-    let input = ''
+    const input = createBoundedTextAccumulator({ maxBytes: STDIO_MAX_FRAME_BYTES })
     process.stdin.setEncoding('utf8')
-    process.stdin.on('data', (chunk) => { input += chunk })
+    process.stdin.on('data', (chunk) => {
+      if (!input.push(chunk)) {
+        const error = new Error(`DevCodex Grok hook stdin exceeds ${input.maxBytes} bytes`)
+        error.code = 'DEVCODEX_GROK_HOOK_STDIN_TOO_LARGE'
+        reject(error)
+      }
+    })
     process.stdin.on('end', () => {
-      try { resolve(input.trim() ? JSON.parse(input) : {}) } catch (error) { reject(error) }
+      try {
+        const text = input.snapshot()
+        resolve(text.trim() ? JSON.parse(text) : {})
+      } catch (error) { reject(error) }
     })
   })
 }

hooks/_runtime/host-skill-route-capabilities.v1.json

@@ -10,16 +10,13 @@
     },
     {
       "hostVariant": "codex-cli/exec-user-global-local-stdio",
-      "status": "PASS",
+      "status": "UNVERIFIED",
       "testedVersion": "codex-cli 0.145.0",
       "protocol": "MCP 2024-11-05",
-      "runtimeContractDigest": "d60c401ae9041d6bfd4607d19be8bf64e92b3093d325692b6c1454e8fe849ae8",
-      "hostAdapterDigest": "03d2476cd269a40e9ada285cc50de5eaf34857ef1805401aeee715c3ee13e8fe",
-      "evidenceRef": "hooks/_runtime/evidence/codex-skill-route-pass.v1.json",
-      "evidenceDigest": "6af6fcbefca64f5fa961fc06d2bef691361b3a1be58895d3f8ec6704b529fc97",
+      "evidenceRef": null,
       "entrySurface": "codex exec --ephemeral",
       "bootstrapDelivery": "stable user-global Hook launcher UserPromptSubmit or profile_context_plan fallback",
-      "defaultEligible": true
+      "defaultEligible": false
     },
     {
       "hostVariant": "codex-desktop/app-user-global-local-stdio",

mcp/hot-reload-supervisor.cjs

@@ -321,7 +321,6 @@ async function main () {
   }
 
   async function handle (message) {
-    if (!message || typeof message !== 'object' || Array.isArray(message)) return
     if (!current) await startCurrent()
     if (message.method !== 'initialize') await maybeReload()
     if (message.id === undefined) {
@@ -345,6 +344,10 @@ async function main () {
         process.stdout.write(`${JSON.stringify({ jsonrpc: '2.0', id: null, error: { code: -32700, message: 'Parse error' } })}\n`)
         return
       }
+      if (!message || typeof message !== 'object' || Array.isArray(message)) {
+        process.stdout.write(`${JSON.stringify({ jsonrpc: '2.0', id: null, error: { code: -32600, message: 'Invalid Request' } })}\n`)
+        return
+      }
       try {
         await handle(message)
       } catch (error) {

mcp/memory-file-transaction.cjs

@@ -436,6 +436,7 @@ function createNodeMemoryFileAdapter(options = {}) {
       faultInjector('before-create-final-cas', input)
       const finalObserved = readSnapshot(input.filePath)
       assertExpectedSnapshot(input.expected, finalObserved, input.filePath)
+      let createRoute = 'hardlink-create-if-absent'
       try {
         fsImpl.linkSync(temp, input.filePath)
       } catch (error) {
@@ -445,7 +446,12 @@ function createNodeMemoryFileAdapter(options = {}) {
             `Memory create target won by another writer: ${input.filePath}`
           )
         }
-        throw error
+        if (error?.code === 'EACCES' || error?.code === 'EPERM') {
+          fsImpl.copyFileSync(temp, input.filePath, fsImpl.constants?.COPYFILE_EXCL || 1)
+          createRoute = 'copy-create-if-absent'
+        } else {
+          throw error
+        }
       }
       const directoryFlush = flushDirectory(directory)
       const readback = readSnapshot(input.filePath)
@@ -471,7 +477,7 @@ function createNodeMemoryFileAdapter(options = {}) {
         durability: {
           fileFlush,
           directoryFlush,
-          readback: { status: 'PASS', scope: 'hardlink-create-if-absent+whole-file-exact' }
+          readback: { status: 'PASS', scope: `${createRoute}+whole-file-exact` }
         }
       }
     } finally {

mcp/memory-server.js

@@ -2346,7 +2346,7 @@ function resolveMemoryTarget(args) {
 }
 
 function memoryClientPath(target, ...segments) {
-  return resolveInside(target.activeRoot, '.memory', 'clients', target.agent, ...segments)
+  return resolveWritePathInside(target.activeRoot, '.memory', 'clients', target.agent, ...segments)
 }
 
 function memoryFileMetadata(filePath) {

mcp/profile-server.js

@@ -18,7 +18,7 @@ const crypto = require('crypto')
 const fs = require('fs')
 const path = require('path')
 const { execFileSync } = require('child_process')
-const { assertSingleSegment, resolveInside, resolveExistingRegularFileInside } = require('./path-guard')
+const { assertSingleSegment, resolveInside, resolveExistingRegularFileInside, resolveWritePathInside } = require('./path-guard')
 const { createJsonLineServer } = require('./stdio-jsonrpc.cjs')
 const {
   PROFILE_BASE_FILES,
@@ -752,7 +752,7 @@ function resolveProfileFile(name, projectName, options = {}) {
   if (!LAYOUT.enabled) {
     const sourceSnapshots = []
     for (const dir of getLegacyProfileDirs(projectName)) {
-      const fullPath = resolveInside(dir, safeName)
+      const fullPath = resolveWritePathInside(dir, safeName)
       const document = readProfileTextDocument(fullPath, options)
       sourceSnapshots.push(profileSourceSnapshot(fullPath, document))
       if (document.exists) {
@@ -774,8 +774,8 @@ function resolveProfileFile(name, projectName, options = {}) {
 
   const projectDir = getProjectNamespaceProfileDir(projectName)
   const workspaceDir = getWorkspaceProfileDir()
-  const projectPath = projectDir ? resolveInside(projectDir, safeName) : null
-  const workspacePath = resolveInside(workspaceDir, safeName)
+  const projectPath = projectDir ? resolveWritePathInside(projectDir, safeName) : null
+  const workspacePath = resolveWritePathInside(workspaceDir, safeName)
   const sourceSnapshots = []
 
   if (projectPath) {
@@ -845,7 +845,7 @@ function resolveProfileSectionFile(name, projectName, options = {}) {
 
   if (!LAYOUT.enabled) {
     for (const dir of getLegacyProfileDirs(projectName)) {
-      const fullPath = resolveInside(dir, safeName)
+      const fullPath = resolveWritePathInside(dir, safeName)
       const selected = selectAt(fullPath, getLegacySourceLabel(dir, projectName))
       if (selected) return selected
     }
@@ -856,11 +856,11 @@ function resolveProfileSectionFile(name, projectName, options = {}) {
 
   const projectDir = getProjectNamespaceProfileDir(projectName)
   if (projectDir) {
-    const projectPath = resolveInside(projectDir, safeName)
+    const projectPath = resolveWritePathInside(projectDir, safeName)
     const selected = selectAt(projectPath, `项目命名空间（${resolveProjectName(projectName)}）`)
     if (selected) return selected
   }
-  const workspacePath = resolveInside(getWorkspaceProfileDir(), safeName)
+  const workspacePath = resolveWritePathInside(getWorkspaceProfileDir(), safeName)
   const selected = selectAt(workspacePath, '工作区基座（workspace）')
   return selected || (options.captureMissingSnapshots === true
     ? { exists: false, content: null, fullPath: null, sourceLabel: '未命中', sourcePaths: [], sourceSnapshots, sourceBytesRead: 0 }
@@ -893,7 +893,7 @@ function resolveConfigFile(projectName, options = {}) {
   if (!LAYOUT.enabled) {
     const sourceSnapshots = []
     for (const dir of getLegacyProfileDirs(projectName)) {
-      const fullPath = path.join(dir, 'config.json')
+      const fullPath = resolveWritePathInside(dir, 'config.json')
       const loaded = loadConfig(fullPath)
       if (loaded?.sourceSnapshot) sourceSnapshots.push(loaded.sourceSnapshot)
       if (loaded?.config !== null && loaded?.config !== undefined) {
@@ -927,8 +927,8 @@ function resolveConfigFile(projectName, options = {}) {
 
   const workspaceDir = getWorkspaceProfileDir()
   const projectDir = getProjectNamespaceProfileDir(projectName)
-  const workspacePath = path.join(workspaceDir, 'config.json')
-  const projectPath = projectDir ? path.join(projectDir, 'config.json') : null
+  const workspacePath = resolveWritePathInside(workspaceDir, 'config.json')
+  const projectPath = projectDir ? resolveWritePathInside(projectDir, 'config.json') : null
   const workspaceLoaded = loadConfig(workspacePath)
   const projectLoaded = projectPath ? loadConfig(projectPath) : null
   const workspaceConfig = workspaceLoaded?.config || null

package.json

@@ -70,6 +70,7 @@
     "test:governance-status-summary": "node scripts/test-governance-status-summary.js",
     "test:derived-index-contract": "node scripts/test-derived-index-contract.js",
     "test:memory-index": "node scripts/test-memory-index.js",
+    "test:memory-template-production": "node scripts/test-memory-template-production.js",
     "test:report-index": "node scripts/test-report-index.js",
     "test:always-on-governance": "node scripts/test-always-on-governance.js",
     "test:intent-consistency": "node scripts/test-intent-consistency.js",
@@ -342,6 +343,7 @@
     "scripts/test-real-codex-host-probe.js",
     "scripts/test-global-install-smoke.js",
     "scripts/test-mcp-runtime-closure.js",
+    "scripts/test-mcp-hot-reload-supervisor.js",
     "scripts/fixtures/global-host-config/",
     "scripts/test-security-audit.js",
     "scripts/lib/security-audit-runner.js",

public-site/data/public-product-projection.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": "PublicProductProjectionV2",
-  "generatedAt": "2026-09-09T02:10:12.178Z",
+  "generatedAt": "2026-09-13T15:19:55.285Z",
   "release": {
     "version": "1.20.2"
   },
@@ -1184,10 +1184,10 @@
     }
   ],
   "sourceIdentities": {
-    "package": "199bae54b2c3243290dcb9830b3af4deaaf933b9351c2de1eeb3125fc070cc38",
+    "package": "17de2c775a633075c6b1236b37651d48c009997fe1eb02bbcf8a179f6e1c565a",
     "expression": "60e525d34e5531e6b4bbbb77f8b34bb93c9ca9ebee5df4fe2812749232175c3c",
     "workflows": "d9eb7086866fe3c3815f673957ed978c1594079261009ac775bf3e1336ad44fd",
-    "portfolio": "bd64d4c138ac43491cef4be8ed291d6f2a501e27c3f3c8fa70be4b7e9a2bc150",
+    "portfolio": "2fdc83be80eaef9d6342d2c91f2d18c2fadd20b2a48b2f2806575e8a93b37eb4",
     "taxonomy": "b673f27fa58c2d7a57b9aa906562faed2aca094a727c8686d941c39a5490f030"
   }
 }

scripts/generate-public-site-data.js

@@ -9,10 +9,19 @@ const ROOT = path.resolve(__dirname, '..')
 const DATA_DIR = path.join(ROOT, 'public-site', 'data')
 const DATA_FILE = path.join(DATA_DIR, 'public-product-projection.json')
 
-function writeProjection (projection) {
-  const payload = {
+function stableStringify (value) {
+  return `${JSON.stringify(value, null, 2)}\n`
+}
+
+function readExistingProjection () {
+  if (!fs.existsSync(DATA_FILE)) return null
+  return JSON.parse(fs.readFileSync(DATA_FILE, 'utf8'))
+}
+
+function buildProjectionPayload (projection, options = {}) {
+  return {
     schemaVersion: projection.schemaVersion,
-    generatedAt: new Date().toISOString(),
+    generatedAt: options.generatedAt || new Date().toISOString(),
     release: projection.release,
     expression: projection.expression,
     expressionCompatibility: projection.expressionCompatibility,
@@ -28,13 +37,37 @@ function writeProjection (projection) {
     })),
     sourceIdentities: projection.sourceIdentities
   }
+}
+
+function writeProjection (projection) {
+  const payload = buildProjectionPayload(projection)
   fs.mkdirSync(DATA_DIR, { recursive: true })
-  fs.writeFileSync(DATA_FILE, `${JSON.stringify(payload, null, 2)}\n`, 'utf8')
+  fs.writeFileSync(DATA_FILE, stableStringify(payload), 'utf8')
   return payload
 }
 
 function main () {
+  const check = process.argv.includes('--check')
   const projection = buildPublicProductProjection({ root: ROOT })
+  if (check) {
+    const existing = readExistingProjection()
+    if (!existing) {
+      console.error(`public-site data missing: ${path.relative(ROOT, DATA_FILE).replace(/\\/g, '/')}`)
+      process.exit(1)
+    }
+    const expected = buildProjectionPayload(projection, { generatedAt: existing.generatedAt })
+    const currentText = stableStringify(existing)
+    const expectedText = stableStringify(expected)
+    if (currentText !== expectedText) {
+      console.error('public-site data stale: run node scripts/generate-public-site-data.js')
+      process.exit(1)
+    }
+    console.log(
+      `public-site data fresh: skills=${projection.skills.total}/${projection.skills.active}/${projection.skills.gray}`
+    )
+    return
+  }
+
   writeProjection(projection)
 
   console.log(
@@ -45,5 +78,6 @@ function main () {
 if (require.main === module) main()
 
 module.exports = {
+  buildProjectionPayload,
   writeProjection
 }

scripts/lib/skill-route-test-fixture.js

@@ -209,12 +209,20 @@ function createSkillRouteFixture (options = {}) {
       process.stderr.write(`[skill-route-test-fixture] retained ${root}\n`)
       return
     }
-    fs.rmSync(root, {
-      recursive: true,
-      force: true,
-      maxRetries: 10,
-      retryDelay: 250
-    })
+    try {
+      fs.rmSync(root, {
+        recursive: true,
+        force: true,
+        maxRetries: 10,
+        retryDelay: 250
+      })
+    } catch (error) {
+      if (error?.code === 'EPERM' || error?.code === 'EACCES') {
+        process.stderr.write(`[skill-route-test-fixture] cleanup retained ${root}: ${error.code}\n`)
+        return
+      }
+      throw error
+    }
   }
   if (options.workspaceSkill !== false) {
     writeWorkspaceSkill(root, options.skillId || 'workspace-probe')