Summary
--verify reports a healthy installation when installed hook and MCP runtime files are syntactically invalid.
Verified on main at 3048fb73910a0a8944f74fb2e70abd5752a60b2f.
Reproduction
- Install the plugin into a temporary workspace.
- Replace the beginning of both files with invalid JavaScript such as
const broken = ;:
hooks/session-end.jsmcp/evolver-proxy.mjs
- Confirm
node --check exits 1 for both files.
- Run
node scripts/install.js --verify --workspace <temporary-workspace>.
Actual result
Verify exits 0, prints Verify passed, and marks both hook:session-end.js and mcp_bridge as [OK].
Expected result
Verification should fail for corrupted or unloadable runtime files. Syntax checks and/or content hashes against the packaged runtime would catch this case.
Cause
scripts/install.js:259-277 checks only file existence for hooks, the MCP bridge, and the skill. Lines 280-281 then treat those existence checks as installation health.
Impact
Users can receive a false healthy status while the installed runtime cannot execute.
Summary
--verifyreports a healthy installation when installed hook and MCP runtime files are syntactically invalid.Verified on
mainat3048fb73910a0a8944f74fb2e70abd5752a60b2f.Reproduction
const broken = ;:hooks/session-end.jsmcp/evolver-proxy.mjsnode --checkexits1for both files.node scripts/install.js --verify --workspace <temporary-workspace>.Actual result
Verify exits
0, printsVerify passed, and marks bothhook:session-end.jsandmcp_bridgeas[OK].Expected result
Verification should fail for corrupted or unloadable runtime files. Syntax checks and/or content hashes against the packaged runtime would catch this case.
Cause
scripts/install.js:259-277checks only file existence for hooks, the MCP bridge, and the skill. Lines 280-281 then treat those existence checks as installation health.Impact
Users can receive a false healthy status while the installed runtime cannot execute.