Problem
Five places in the repository reference the legacy personal-account
handle autogame-17:
src/gep/issueReporter.js:14 const DEFAULT_REPO = 'autogame-17/capability-evolver';
src/gep/skillPublisher.js:162 ... [Evolver](https://github.com/autogame-17/evolver) ...
index.js:740 ' https://github.com/autogame-17/evolver/issues'
README.md:301 | EVOLVER_ISSUE_REPO | autogame-17/capability-evolver | ... |
README.zh-CN.md:293 | EVOLVER_ISSUE_REPO | autogame-17/capability-evolver | ... |
GitHub currently 301-redirects autogame-17/capability-evolver and
autogame-17/evolver to EvoMap/evolver, so these paths work today.
They depend on a GitHub redirect that is pinned to a personal-user
account (autogame-17).
Why this matters
-
Repo-jacking surface: if the autogame-17 account ever deletes,
renames, or transfers the legacy repository — or the account itself
is suspended — GitHub makes the old autogame-17/capability-evolver
name claimable. Running evolver deployments that have
GITHUB_TOKEN set and EVOLVER_AUTO_ISSUE unset (which defaults to
'true') would begin POSTing auto-issue bodies — env fingerprints,
sanitized session logs, node IDs, failure signatures — to whichever
third party claimed the name. Blast radius is bounded to users who
have already provided a token, but the default is opt-out.
-
Documentation consistency: three of the five references appear
in user-facing docs (README.md, README.zh-CN.md, the error message
in index.js:740). Users who copy-paste the link see a URL that
only resolves because of the legacy redirect.
Request
Replace the five occurrences with the current org slug
EvoMap/evolver (or EvoMap/capability-evolver if the legacy name is
deliberate). Optionally, consider flipping the EVOLVER_AUTO_ISSUE
default to false and prompting on first run, so the auto-issue
pipeline stays opt-in; this is orthogonal to the handle cleanup.
Happy to submit a small PR once the target name is confirmed.
Problem
Five places in the repository reference the legacy personal-account
handle
autogame-17:GitHub currently 301-redirects
autogame-17/capability-evolverandautogame-17/evolvertoEvoMap/evolver, so these paths work today.They depend on a GitHub redirect that is pinned to a personal-user
account (
autogame-17).Why this matters
Repo-jacking surface: if the
autogame-17account ever deletes,renames, or transfers the legacy repository — or the account itself
is suspended — GitHub makes the old
autogame-17/capability-evolvername claimable. Running evolver deployments that have
GITHUB_TOKENset andEVOLVER_AUTO_ISSUEunset (which defaults to'true') would begin POSTing auto-issue bodies — env fingerprints,sanitized session logs, node IDs, failure signatures — to whichever
third party claimed the name. Blast radius is bounded to users who
have already provided a token, but the default is opt-out.
Documentation consistency: three of the five references appear
in user-facing docs (README.md, README.zh-CN.md, the error message
in
index.js:740). Users who copy-paste the link see a URL thatonly resolves because of the legacy redirect.
Request
Replace the five occurrences with the current org slug
EvoMap/evolver(orEvoMap/capability-evolverif the legacy name isdeliberate). Optionally, consider flipping the
EVOLVER_AUTO_ISSUEdefault to
falseand prompting on first run, so the auto-issuepipeline stays opt-in; this is orthogonal to the handle cleanup.
Happy to submit a small PR once the target name is confirmed.