kodelyth-ecc 2.10.0 → 2.12.0

package/CHANGELOG.md

@@ -2,6 +2,112 @@
 
 All notable changes to Kodelyth ECC are documented here.
 
+## v2.12.0 — `scripts/lib/safe-fs.js`: the guard the arena asked for (August 2026)
+
+Across two arena runs the **same containment bug was confirmed four times** in
+three unrelated files — `terse/compress.js`, `dashboard/data.js`,
+`dashboard/server.js`. Every instance was this shape:
+
+```js
+const abs = path.join(root, userInput);
+if (!abs.startsWith(root + path.sep)) return null;   // lexical only
+fs.readFileSync(abs);                                // follows symlinks
+```
+
+`path.join` and `path.resolve` normalise `..`, so a *textual* escape is caught.
+Neither resolves symlinks. A link sitting lexically inside the root passes the
+check while its target is anywhere on disk.
+
+Four spot fixes would have been a fifth bug waiting. The arena's guard proposal
+said to build the guard instead, so here it is.
+
+### Added — `scripts/lib/safe-fs.js`
+
+- **`resolveContained(candidate, root)`** — canonicalises both sides, so a link
+  is judged by where it *points*, not where it sits. Rejects intermediate
+  directory symlinks and dangling links; still allows a symlinked root to serve
+  its own files, and a link that stays inside.
+- **`statRegularFile(abs)`** — refuses symlinks and non-regular files outright,
+  for callers about to rewrite a file.
+- **`safeConfigDir(value, fallback)`** — inspects the **raw** env value for `..`
+  before resolving. (The first draft resolved first and then looked for `..` —
+  dead code, since `path.resolve` collapses it. Its own test caught that.)
+- **`writeNewFile(dest, data, mode)`** — `O_EXCL` so a dangling symlink cannot
+  redirect the write, plus `fchmod` so a restrictive umask cannot silently
+  narrow the mode.
+- **`replaceFileAtomic(abs, contents, mode)`** — random temp name, rename, and
+  `finally`-unlink so a crash leaves no stray copy of the document.
+
+**13 raw `realpath`/`lstat`/`openSync`/`rename` calls across four files became
+zero.** All four now route through one 157-line module with **19 tests**.
+
+### Fixed — the ledger env var, which was never actually fixed
+
+`KODELYTH_TERSE_DIR` was confirmed unvalidated in the first arena run, and the
+run recorded it as *addressed* when no fix had been written. That accounting was
+wrong. It now goes through `safeConfigDir`: a raw `..` falls back to the default,
+a clean absolute path is still honoured.
+
+**554 tests passing**, up from 535.
+
+## v2.11.0 — Arena run #2: three containment bugs in the dashboard (August 2026)
+
+Pointed the arena at `scripts/dashboard` — the localhost HTTP server that serves
+static files and returns your private memory store. Round 1 found **3 findings,
+all 3 confirmed by executed repro**. Round 2 attacked the fixes across 7 vectors
+and found **nothing new**.
+
+All three are **low severity** and the reasoning matters: the server is
+localhost-only, read-only, GET-only, and each finding needs local write access
+that already grants the same data. None is a browser-reachable hole. They are
+containment bugs worth closing, not emergencies.
+
+### Fixed — three containment gaps
+
+- **`sessionDetail` followed symlinks out of the coordination root.** The check
+  compared the *joined* path, which for a symlink is the link's own location —
+  inside the root, so it passed — while the target was anywhere on disk. It
+  returned real `task.md` / `handoff.md` / `status.md` excerpts from outside.
+- **`resolveStatic` followed symlinks out of `STATIC_DIR`.** Same class:
+  `path.resolve` does not resolve symlinks, so a lexically-contained link passed
+  the guard and `readFile` followed it. `/etc/hosts` was readable through it.
+- **An empty or absent `Host` header bypassed the DNS-rebinding guard.** The
+  condition read `reqHost !== '' && ...`, so a missing Host short-circuited the
+  whole check to false. An HTTP/1.0 request reached the private-data APIs with
+  `200 OK`. Browsers always send Host, so this was never browser-reachable.
+
+All three now canonicalize with `realpathSync` and re-check against the real
+destination; the Host guard denies by default.
+
+### Fixed — `Host` comparison is now case-insensitive
+
+Hostnames are case-insensitive per RFC 3986, so `Host: LOCALHOST` was a
+legitimate spelling being rejected.
+
+### Fixed — arena recall ignored scope
+
+Every arena memory carries the tag `arena`, and recall is BM25 — so a query
+mentioning the arena matched **all** of them regardless of origin. The first
+dashboard run was handed all 10 `scripts/terse` findings and told they were
+*"confirmed here previously."* That is false, and it would have sent EVIL hunting
+for `compress.js` bugs in an HTTP server. Recall is now filtered to memories
+whose files actually live in the scope.
+
+### Added — `access-control` bug class
+
+The Host-header bypass classified as `uncategorized`. Its guard advice: *deny by
+default — an allowlist, with every absent or empty case treated as invalid rather
+than waved through.*
+
+### Compound learning is earning its keep
+
+`filesystem-symlink` is now confirmed **4 times across 3 files** — `compress.js`,
+`data.js`, and `server.js`. Every one is the same mistake: a lexical containment
+check that a symlink walks straight through. The guard proposal says what to do
+about it — a shared path-safety helper, rather than a fourth spot fix.
+
+**535 tests passing**, up from 525.
+
 ## v2.10.0 — Arena dashboard tab + docs (phases 5 & 6) (August 2026)
 
 ### Added — Arena tab in the dashboard

package/CLAUDE.md

@@ -26,7 +26,7 @@ scripts/     → Node.js utilities: MCP server, dashboard, swarm, replay, router
 bundles/     → 3 power bundles (indie-hacker, red-team, enterprise)
 actions/     → GitHub Action (CI/CD integration for PR review)
 docs/        → Feature docs (arena.md, mcp.md, dashboard.md, swarm.md, replay.md, evolve.md, supply-chain.md)
-tests/       → 525 passing tests across 29 test files
+tests/       → 554 passing tests across 30 test files
 ```
 
 ## Running Tests

package/VERSION

@@ -1 +1 @@
-2.10.0
+2.12.0

package/bin/kodelyth-ecc.js

@@ -501,8 +501,14 @@ if (args[0] === 'god' || args[0] === 'evil' || args[0] === 'arena') {
         try {
           const learn = require(path.join(ROOT, 'scripts', 'arena', 'learn.js'));
           const memStore = require(path.join(ROOT, 'scripts', 'memory', 'store.js'));
-          const hits = memStore.recall(`arena ${scopeArg} ${task}`, { limit: 20 })
-            .filter(m => (m.source || '') === 'arena');
+          // Filter to the scope. BM25 matches every arena memory on the word
+          // "arena" alone, so without this a dashboard run is handed terse findings
+          // and told they were confirmed in this very scope.
+          const hits = learn.filterToScope(
+            memStore.recall(`arena ${scopeArg} ${task}`, { limit: 60 })
+              .filter(m => (m.source || '') === 'arena'),
+            scopeArg,
+          ).slice(0, 20);
           recalledCount = hits.length;
           priorKnowledge = learn.priorKnowledgeBrief(hits);
         } catch { /* memory is optional — a missing store must never block a run */ }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kodelyth-ecc",
-  "version": "2.10.0",
+  "version": "2.12.0",
   "description": "Production-grade AI coding toolkit — 70 agents (incl. devil-mode adversarial crew), 194 skills, 97 commands, parallel multi-agent commands, semantic intent routing, self-learning memory, and a built-in MCP server (16 tools / 6 prompts / 377 resources) that bridges to Claude Desktop, LangGraph, AutoGen, CrewAI, and OpenAI Agents SDK. Works with Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, RooCode, Aider, Kimi, and Gemini CLI.",
   "author": "Kodelyth <github.com/sifxprime>",
   "license": "MIT",

package/scripts/arena/learn.js

@@ -43,6 +43,7 @@ const CLASSES = [
   ['semantic-corruption', /\bsemantic|meaning|threshold|negation|inverts?|widen/i],
   ['idempotency',         /\bidempoten|fixed point|second run|re-?run\b/i],
   ['input-validation',    /validat|wrong shape|silently accept|malformed|type ?error|unsanitiz/i],
+  ['access-control',      /\bbypass(?:es|ed)? the|rebinding|host header|allowlist|authoriz|access control\b/i],
   ['supply-chain',        /\btyposquat|lockfile|install script|dependency confusion\b/i],
 ];
 
@@ -169,6 +170,25 @@ function priorKnowledgeBrief(memories = [], { limit = 8 } = {}) {
   return lines.join('\n');
 }
 
+// Recall is BM25 over the whole memory store, and every arena memory carries the
+// tag "arena" — so a query mentioning the arena matches ALL of them regardless of
+// which scope they came from. Left unfiltered, a run against scripts/dashboard is
+// told that bugs in scripts/terse were "confirmed here previously", which is false
+// and sends EVIL hunting for the wrong thing in the wrong file.
+//
+// A memory belongs to this scope only if it actually points at a file inside it.
+function filterToScope(memories = [], scope) {
+  if (!scope || scope === '.' || scope === './') return memories;
+  const norm = String(scope).replace(/^\.\//, '').replace(/\/+$/, '');
+  if (!norm) return memories;
+  return memories.filter(m =>
+    (m.files || []).some(f => {
+      const file = String(f).replace(/^\.\//, '');
+      return file === norm || file.startsWith(norm + '/');
+    }),
+  );
+}
+
 // ── Recurring classes → evolve proposals ────────────────────────────────────
 //
 // One bug is an incident. The same class across several runs is a gap in the
@@ -210,6 +230,7 @@ const GUARD_ADVICE = {
   'semantic-corruption': 'Add golden tests asserting that meaning-bearing tokens survive transformation.',
   'idempotency':         'Assert f(f(x)) === f(x) in the test suite for every transform.',
   'input-validation':    'Validate argument shape at every public boundary and throw — never silently coerce to a plausible default.',
+  'access-control':      'Deny by default: an allowlist of permitted values, with every absent or empty case treated as invalid rather than waved through.',
   'supply-chain':        'Pin and verify dependencies; add a lockfile-drift check to CI.',
 };
 
@@ -265,6 +286,7 @@ module.exports = {
   refutedToMemory,
   runToMemories,
   priorKnowledgeBrief,
+  filterToScope,
   recurringClasses,
   buildGuardProposalMarkdown,
   guardProposalId,

package/scripts/dashboard/data.js

@@ -19,6 +19,7 @@
 const fs   = require('fs');
 const os   = require('os');
 const path = require('path');
+const safeFs = require('../lib/safe-fs.js');
 
 const ROOT = path.resolve(__dirname, '..', '..');
 
@@ -305,10 +306,12 @@ function sessionsList({ coordRoot = defaultCoordRoot(), limit = 30 } = {}) {
 
 function sessionDetail({ session, coordRoot = defaultCoordRoot() } = {}) {
   if (!session || session === '..' || session === '.') return null;
-  const dir = path.join(coordRoot, session);
-  // Containment check — ensure the resolved path stays within coordRoot.
-  if (!dir.startsWith(coordRoot + path.sep) && dir !== coordRoot) return null;
-  if (!fs.existsSync(dir)) return null;
+  // Containment, including symlink resolution — see scripts/lib/safe-fs.js.
+  // A link sitting inside coordRoot passes a lexical check while pointing
+  // anywhere on disk, which handed the API task/handoff/status excerpts from
+  // outside the root.
+  const dir = safeFs.resolveContained(session, coordRoot);
+  if (!dir) return null;
   const workers = safeReadDir(dir).filter(e => e.isDirectory());
   return {
     session,

package/scripts/dashboard/server.js

@@ -24,6 +24,7 @@ const http = require('http');
 const fs   = require('fs');
 const path = require('path');
 const os   = require('os');
+const safeFs = require('../lib/safe-fs.js');
 const { execFileSync } = require('child_process');
 
 const data = require('./data.js');
@@ -147,21 +148,34 @@ function serveStaticFile(res, filePath) {
 }
 
 // Defensive — block path traversal, only allow files under STATIC_DIR.
-function resolveStatic(reqPath) {
+// baseDir is injectable so the containment logic can be tested against a real
+// symlink without planting one in the shipped static/ directory.
+function resolveStatic(reqPath, baseDir = STATIC_DIR) {
   const decoded = decodeURIComponent(reqPath.replace(/^\/+/, ''));
   if (decoded.includes('..')) return null;
-  if (decoded === '' || decoded === '/') return path.join(STATIC_DIR, 'index.html');
-  const abs = path.resolve(STATIC_DIR, decoded);
-  if (!abs.startsWith(STATIC_DIR + path.sep) && abs !== path.join(STATIC_DIR, 'index.html')) return null;
-  return abs;
+  if (decoded === '' || decoded === '/') return path.join(baseDir, 'index.html');
+  // Containment, including symlink resolution — see scripts/lib/safe-fs.js.
+  // path.resolve normalises ".." but does not resolve symlinks, so a link
+  // sitting lexically inside baseDir used to pass while readFile followed it
+  // anywhere on disk.
+  return safeFs.resolveContained(decoded, baseDir, {
+    allowExact: path.join(baseDir, 'index.html'),
+  });
 }
 
 // ── route handlers ───────────────────────────────────────────────────────────
 
 function handleRequest(req, res) {
   // DNS-rebinding defence: only respond to requests targeting localhost.
-  const reqHost = (req.headers.host || '').split(':')[0];
-  if (reqHost !== '' && reqHost !== '127.0.0.1' && reqHost !== 'localhost') {
+  // A missing or empty Host is treated as INVALID, not as valid. The original
+  // `reqHost !== ''` short-circuited the whole condition whenever the header was
+  // absent, so an HTTP/1.0 request — or any raw socket writing "Host:" with no
+  // value — sailed past the rebinding guard and got the private-data APIs.
+  // Deny by default: only an explicit localhost Host is allowed through.
+  // Hostnames are case-insensitive (RFC 3986), so LOCALHOST is a legitimate
+  // spelling. Node already strips OWS around the field value.
+  const reqHost = (req.headers.host || '').split(':')[0].toLowerCase();
+  if (reqHost !== '127.0.0.1' && reqHost !== 'localhost') {
     res.writeHead(400, { 'Content-Type': 'application/json; charset=utf-8' });
     return res.end(JSON.stringify({ ok: false, error: 'bad request' }));
   }

package/scripts/lib/safe-fs.js

@@ -0,0 +1,162 @@
+// scripts/lib/safe-fs.js
+//
+// Path containment and safe file replacement, in one place.
+//
+// This module exists because the same bug was confirmed four times across three
+// unrelated files — `scripts/terse/compress.js`, `scripts/dashboard/data.js`,
+// and `scripts/dashboard/server.js`. Every instance was the same mistake:
+//
+//     const abs = path.join(root, userInput);
+//     if (!abs.startsWith(root + path.sep)) return null;   // lexical only
+//     fs.readFileSync(abs);                                // follows symlinks
+//
+// `path.join` and `path.resolve` normalise `..`, so a *textual* escape is
+// caught. Neither resolves symlinks. A link sitting lexically inside the root
+// passes the check while its target is anywhere on disk, and the read follows
+// it. Four spot fixes would have been a fifth bug waiting; this is the guard.
+//
+// Everything here fails closed: on any doubt, return null or throw.
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+
+// ── Containment ─────────────────────────────────────────────────────────────
+
+/**
+ * Resolve `candidate` and confirm it really lives inside `root`.
+ *
+ * Both sides are canonicalised, so a symlink is judged by where it POINTS, not
+ * where it sits. Returns the resolved absolute path, or null if it escapes, is
+ * missing, or cannot be read.
+ *
+ * `allowExact` names a path that may equal the root itself (some callers serve
+ * an index file at the boundary).
+ */
+function resolveContained(candidate, root, { allowExact = null } = {}) {
+  if (!candidate || !root) return null;
+
+  const absRoot = path.resolve(root);
+  const abs = path.isAbsolute(candidate) ? path.resolve(candidate) : path.resolve(absRoot, candidate);
+
+  // Cheap lexical rejection first — catches `..` without touching the disk.
+  const lexicallyInside = abs === absRoot || abs.startsWith(absRoot + path.sep);
+  if (!lexicallyInside && abs !== allowExact) return null;
+
+  // The check that actually matters. realpath resolves every symlink in the
+  // path, including intermediate directories.
+  let real;
+  try {
+    real = fs.realpathSync(abs);
+  } catch {
+    return null;   // missing, dangling link, or unreadable
+  }
+
+  let realRoot;
+  try {
+    realRoot = fs.realpathSync(absRoot);
+  } catch {
+    realRoot = absRoot;   // the root itself may legitimately not exist yet
+  }
+
+  const reallyInside = real === realRoot || real.startsWith(realRoot + path.sep);
+  if (!reallyInside && real !== allowExact) return null;
+
+  // Callers get the pre-realpath path so user-facing output keeps the name the
+  // caller asked for; containment has already been proven against the target.
+  return abs;
+}
+
+/**
+ * Stat a path that must be a regular file, refusing symlinks outright.
+ *
+ * Used where the caller is about to REWRITE the file: following a link there
+ * means writing through it to a target the user never named, and copying its
+ * contents into a backup beside the link.
+ */
+function statRegularFile(absPath) {
+  let st;
+  try {
+    st = fs.lstatSync(absPath);
+  } catch {
+    throw new Error(`file not found: ${absPath}`);
+  }
+  if (st.isSymbolicLink()) throw new Error(`refusing to operate on a symlink: ${absPath}`);
+  if (!st.isFile()) throw new Error(`not a regular file: ${absPath}`);
+  return st;
+}
+
+/**
+ * A directory path taken from configuration (an env var, usually).
+ *
+ * This is a trusted-config surface — anyone who can set your environment
+ * already has leverage — but an unnormalised value silently creates trees
+ * wherever `..` points, so normalise and reject the obvious escapes.
+ */
+function safeConfigDir(value, fallback) {
+  if (!value) return fallback;
+  const raw = String(value);
+
+  // Inspect the RAW value, not the resolved one. path.resolve collapses `..`
+  // before any check could see it — resolving first and then looking for `..`
+  // is dead code that always passes.
+  if (raw.split(/[\\/]/).includes('..')) return fallback;
+
+  return path.resolve(raw);
+}
+
+// ── Writing ─────────────────────────────────────────────────────────────────
+
+/**
+ * Create a NEW file, refusing to follow a link or overwrite anything.
+ *
+ * `wx` is O_CREAT|O_EXCL|O_WRONLY: if `dest` exists — including as a *dangling*
+ * symlink, which `fs.existsSync` reports as absent — the open fails instead of
+ * writing through the link to a path someone else chose.
+ *
+ * The mode is applied twice on purpose. `open` filters its mode argument
+ * through the process umask, so a 0644 original would come back 0600 under
+ * `umask 077`; `fchmod` ignores the umask and restores it exactly. Passing it
+ * to `open` as well means the file is never briefly world-readable.
+ */
+function writeNewFile(dest, data, mode) {
+  const fd = fs.openSync(dest, 'wx', mode);
+  try {
+    fs.writeFileSync(fd, data);
+    fs.fchmodSync(fd, mode);
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+/**
+ * Replace a file's contents atomically, preserving its permissions.
+ *
+ * Writes to a randomly-named sibling and renames over the target, so a crash
+ * cannot leave the user with a truncated file. The name is random rather than
+ * pid-based because a predictable one lets another process pre-plant a symlink
+ * there and capture the write. A failed rename unlinks the temp rather than
+ * leaving the document's contents in a stray world-readable file.
+ */
+function replaceFileAtomic(absPath, contents, mode) {
+  const tmp = `${absPath}.tmp-${crypto.randomBytes(8).toString('hex')}`;
+  let renamed = false;
+  try {
+    writeNewFile(tmp, contents, mode);
+    fs.renameSync(tmp, absPath);
+    renamed = true;
+  } finally {
+    if (!renamed) { try { fs.unlinkSync(tmp); } catch { /* nothing to clean */ } }
+  }
+  return absPath;
+}
+
+module.exports = {
+  resolveContained,
+  statRegularFile,
+  safeConfigDir,
+  writeNewFile,
+  replaceFileAtomic,
+};

package/scripts/terse/compress.js

@@ -12,6 +12,7 @@
 const fs   = require('fs');
 const path = require('path');
 const crypto = require('crypto');
+const safeFs = require('../lib/safe-fs.js');
 
 // ── Substitutions: wordy connective → short form ────────────────────────────
 // These run BEFORE deletions. Order matters: "due to the fact that" must become
@@ -258,27 +259,6 @@ function compressText(source) {
   };
 }
 
-// Write `data` to `dest` with the given mode, refusing to follow a symlink and
-// refusing to overwrite anything that already exists.
-//
-// `wx` is O_CREAT|O_EXCL|O_WRONLY: if `dest` exists — including as a *dangling*
-// symlink, which `fs.existsSync` reports as absent — the open fails instead of
-// silently writing through the link to a path the attacker chose. The mode is
-// applied at create time so the file is never briefly world-readable.
-// The mode is passed to `open` so the file is never briefly world-readable, and
-// then applied again with fchmod: `open` filters its mode argument through the
-// process umask, so under `umask 077` a 0644 original would come back 0600.
-// fchmod ignores the umask, so the original permissions survive exactly.
-function writeNewFile(dest, data, mode) {
-  const fd = fs.openSync(dest, 'wx', mode);
-  try {
-    fs.writeFileSync(fd, data);
-    fs.fchmodSync(fd, mode);
-  } finally {
-    fs.closeSync(fd);
-  }
-}
-
 // ── Public: compress a file, optionally write ───────────────────────────────
 //
 // Note on paths: `filePath` is deliberately unconfined — compressing
@@ -289,21 +269,9 @@ function writeNewFile(dest, data, mode) {
 function compressFile(filePath, { write = false, backup = true } = {}) {
   const abs = path.resolve(filePath);
 
-  // lstat, not existsSync: we need to know whether this is a symlink *before*
-  // reading through it. Following one would copy the link target's bytes into a
-  // backup beside the link — which is how a 0600 secret ends up in a 0644 file.
-  let st;
-  try {
-    st = fs.lstatSync(abs);
-  } catch {
-    throw new Error(`file not found: ${abs}`);
-  }
-  if (st.isSymbolicLink()) {
-    throw new Error(`refusing to compress a symlink: ${abs}`);
-  }
-  if (!st.isFile()) {
-    throw new Error(`not a regular file: ${abs}`);
-  }
+  // Refuses symlinks: following one would copy the link target's bytes into a
+  // backup beside the link, which is how a 0600 secret ends up in a 0644 file.
+  const st = safeFs.statRegularFile(abs);
 
   // Check the size from the stat we already have, before reading. Otherwise an
   // oversized file is pulled fully into memory only to be rejected a line later.
@@ -336,7 +304,7 @@ function compressFile(filePath, { write = false, backup = true } = {}) {
     backupPath = `${abs}.pre-terse.bak`;
     for (let n = 1; ; n++) {
       try {
-        writeNewFile(backupPath, source, mode);
+        safeFs.writeNewFile(backupPath, source, mode);
         break;
       } catch (err) {
         if (err.code !== 'EEXIST') throw err;
@@ -346,19 +314,8 @@ function compressFile(filePath, { write = false, backup = true } = {}) {
     }
   }
 
-  // Write via temp + rename so a crash cannot truncate the user's file. The
-  // suffix is random rather than the pid: a predictable name lets another
-  // process pre-plant a symlink there and capture the write.
-  const tmp = `${abs}.terse-tmp-${crypto.randomBytes(8).toString('hex')}`;
-  let renamed = false;
-  try {
-    writeNewFile(tmp, output, mode);
-    fs.renameSync(tmp, abs);
-    renamed = true;
-  } finally {
-    // A failed rename leaves the document's content sitting in a stray file.
-    if (!renamed) { try { fs.unlinkSync(tmp); } catch { /* nothing to clean */ } }
-  }
+  // Atomic replace preserving the original mode — see scripts/lib/safe-fs.js.
+  safeFs.replaceFileAtomic(abs, output, mode);
 
   return { path: abs, output, stats, wrote: true, backupPath };
 }

package/scripts/terse/ledger.js

@@ -12,9 +12,15 @@
 const fs   = require('fs');
 const os   = require('os');
 const path = require('path');
+const safeFs = require('../lib/safe-fs.js');
 
-const DIR = process.env.KODELYTH_TERSE_DIR
-  || path.join(os.homedir(), '.kodelythecc', 'terse');
+// The env var is a trusted-config surface — anyone who can set your environment
+// already has leverage — but an unnormalised value silently creates a ledger
+// tree wherever ".." points. safeConfigDir rejects those and falls back.
+const DIR = safeFs.safeConfigDir(
+  process.env.KODELYTH_TERSE_DIR,
+  path.join(os.homedir(), '.kodelythecc', 'terse'),
+);
 const LEDGER = path.join(DIR, 'ledger.jsonl');
 
 function ensureDir() { fs.mkdirSync(DIR, { recursive: true }); }