Add Cowork plugin, DCR setup, and security checks

[somethingwentwell]

Touches hot-path: no
Phase: legacy-backfill
Risk vector: neutral

Summary

Backfilled metadata for PR #7 (Add Cowork plugin, DCR setup, and security checks), which was opened before pr metadata policy became a required check in this repository. This edit changes only the PR body, not the branch diff. The original author-supplied body is preserved below.

Scope and cuts

This is a metadata backfill for an already-open PR. It does not claim the implementation cut nothing; that cannot be inferred safely by a body-migration pass. The PR author or reviewer should refine this section before merge if the original request had omitted work.

Module boundary

Unknown from metadata alone. Review the changed files, preserved original body, and CI results before merging. This backfill itself touches no code and changes no branch content.

Alternative considered

Leave this legacy PR body in the old format. Rejected because the newly required machine gate would remain absent or fail for missing required sections even when the underlying diff is unrelated to the gate rollout. A mechanical metadata shell is safer than pretending to infer exact scope from outside the PR author's context, because it preserves the original body and makes the uncertainty visible.

Validation

Body shape generated from this repository's default-branch template and validated with its default-branch validator before upload. Original body preserved below. No product code, workflow, branch, or commit is changed by this PR-body edit.

Rollback / recovery

Restore the original body from /tmp/evo-pr-backfill-all/evolver-copilot-plugin-before.json entry #7, or from the “Original body before metadata backfill” section below.

---

Original body before metadata backfill

Original PR author: somethingwentwell

Summary

• add the packaged Microsoft 365 Copilot Cowork plugin with EvoMap recall/record tools
• add a Microsoft 365 Agents Toolkit DCR provisioning harness and document separate admin and user setup flows
• require EvoMap sign-in and gep_status identity verification before other Evolver operations
• document the confidential OAuth client response required from POST https://evomap.ai/oauth/register
• add dependency scanning, local SAST checks, CodeQL, dependency review, validation, tests, and package builds to CI

Verification

• npm run check
• npm audit --omit=dev --audit-level=high --offline
• npm run build:cowork
• git diff --check

Cowork package: dist/evolver-cowork.zip

SHA-256: 706cb911984ae4e6c841436d5807f1c0662c574d2d961fa64b05cd010ae54458

Known deployment blocker

Microsoft DCR provisioning currently fails because EvoMap's registration response omits client_secret. The README documents the required confidential-client response and secure handling. A focused backend issue will be created after this PR is merged.

---

Note

Medium Risk
New OAuth/DCR and hosted-connector surface increases auth and deployment risk, though secrets stay server-side and the skill enforces identity checks; end-to-end Cowork deploy remains blocked until EvoMap returns client_secret from DCR.

Overview
v0.2.0 extends Evolver beyond VS Code with a Microsoft 365 Copilot Cowork upload package (cowork/ → dist/evolver-cowork.zip): Unified App manifest, capability-evolver Agent Skill (auth via gep_identity/gep_status, redaction rules), hosted https://evomap.ai/mcp connector with DCR (no embedded secrets), and a static eight-tool mcp-tools.json catalog.

Adds validate/build/remote-check scripts and tests for deterministic ZIP output, plus a toolkit/evolver-cowork-dcr Agents Toolkit project to provision OAuth via dcr/register and document admin/user flows. README and CHANGELOG call out a deployment blocker: EvoMap’s POST /oauth/register must return a confidential client_secret for Microsoft DCR.

CI and supply chain: new security.yml (npm audit, local SAST, tests, Cowork validate/build, PR dependency review, CodeQL) and weekly Dependabot for npm and GitHub Actions.

^{Reviewed by Cursor Bugbot for commit af72ee8. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit af72ee8. Configure here.}

[cursor]

Committed ZIP can drift from source

High Severity

The npm package ships dist/evolver-cowork.zip, but validate:cowork and CI only check the cowork/ source. The build process rebuilds the ZIP without verifying if the newly built artifact matches the committed version, which could result in an outdated dist/evolver-cowork.zip being shipped.

 

^{Triggered by team rule: Mandatory review after completing all tasks}

^{Reviewed by Cursor Bugbot for commit af72ee8. Configure here.}

[cursor]

Validator skips required identity tool

Medium Severity

The validation script doesn't require the gep_identity tool, even though it's essential for EvoMap sign-in and operations. This means a package could pass validation but be functionally incomplete.

 

^{Triggered by team rule: GEP evolution memory full integration}

^{Reviewed by Cursor Bugbot for commit af72ee8. Configure here.}

[cursor]

Tool catalog path unchecked

Medium Severity

The validatePackage function doesn't validate remote.mcpToolDescription.file for path traversal. This allows a crafted manifest to specify a path outside the package root, leading to arbitrary file reads during validation.

 

^{Reviewed by Cursor Bugbot for commit af72ee8. Configure here.}