kodelyth-ecc 2.13.0 → 2.14.0

package/CHANGELOG.md

@@ -2,6 +2,62 @@
 
 All notable changes to Kodelyth ECC are documented here.
 
+## v2.14.0 — A false recurring class, and five more atomic writes (August 2026)
+
+### Fixed — the guard proposal was pointing at the wrong thing
+
+After three arena runs the classifier reported **`resource-exhaustion` ×5** as the
+top recurring class. Four of those five were not resource exhaustion at all:
+
+```
+resource-exhaustion  <- Prototype-key collision crashes indexing
+resource-exhaustion  <- A crash mid-append fuses the next memory into the torn row
+resource-exhaustion  <- A patch row surfaced as a phantom memory
+```
+
+The pattern contained the bare word `memory`, which matches every finding about
+the memory *store*. Acting on it would have meant building a guard nobody needed
+— exactly the waste the proposal mechanism exists to prevent. This is the second
+generic-word collision in this classifier; `permission` was the first.
+
+`resource-exhaustion` now requires an actual exhaustion signal (`heap`, `rss`,
+`oom`, `memory leak/usage/growth`, `allocates N`). A new **`data-integrity`**
+class covers the double-index / desync / phantom-row / torn-row family, and
+prototype-key findings now classify as `input-validation`. The 5 mis-tagged
+memories already in the store were re-tagged.
+
+The corrected picture across three runs:
+
+| class | count | status |
+|---|---|---|
+| `filesystem-symlink` | 4 | already guarded by `scripts/lib/safe-fs.js` |
+| `data-integrity` | 4 | all four in one file, all fixed |
+| `input-validation` | 2 | fixed |
+| everything else | 1 each | — |
+
+**No new abstraction was built for `data-integrity`.** All four members live in
+`store.js` and are already fixed, and no other subsystem keeps derived state with
+the same drift — so a shared guard would have been speculative.
+
+### Added — `replaceFilePreservingMode`, applied to five real writers
+
+What the sweep *did* find is the durability pattern in files holding state worth
+keeping. `fs.writeFileSync` opens with `'w'`, truncating to zero before writing,
+so a crash or a full disk part-way through leaves a truncated file and no copy of
+the original:
+
+- `scripts/codex/merge-mcp-config.js` — the user's **Codex IDE config**
+- `scripts/codex/merge-codex-config.js` — the user's **Codex IDE config**
+- `scripts/evolve/stats.js` — accumulated reuse and routing-miss stats
+- `scripts/mcp/client.js` — the MCP server registry
+- `scripts/memory/store.js` — the BM25 index
+
+All five now write through `safeFs.replaceFilePreservingMode`, which keeps the
+file's existing permissions and renames atomically. A crash leaves the original
+completely untouched.
+
+**572 tests passing**, up from 569.
+
 ## v2.13.0 — Arena run #3: eight bugs in the memory store (August 2026)
 
 Pointed the arena at `scripts/memory` — the persistent BM25 store every other

package/CLAUDE.md

@@ -26,7 +26,7 @@ scripts/     → Node.js utilities: MCP server, dashboard, swarm, replay, router
 bundles/     → 3 power bundles (indie-hacker, red-team, enterprise)
 actions/     → GitHub Action (CI/CD integration for PR review)
 docs/        → Feature docs (arena.md, mcp.md, dashboard.md, swarm.md, replay.md, evolve.md, supply-chain.md)
-tests/       → 569 passing tests across 30 test files
+tests/       → 572 passing tests across 30 test files
 ```
 
 ## Running Tests

package/VERSION

@@ -1 +1 @@
-2.13.0
+2.14.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kodelyth-ecc",
-  "version": "2.13.0",
+  "version": "2.14.0",
   "description": "Production-grade AI coding toolkit — 70 agents (incl. devil-mode adversarial crew), 194 skills, 97 commands, parallel multi-agent commands, semantic intent routing, self-learning memory, and a built-in MCP server (16 tools / 6 prompts / 377 resources) that bridges to Claude Desktop, LangGraph, AutoGen, CrewAI, and OpenAI Agents SDK. Works with Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, RooCode, Aider, Kimi, and Gemini CLI.",
   "author": "Kodelyth <github.com/sifxprime>",
   "license": "MIT",

package/scripts/arena/learn.js

@@ -35,14 +35,15 @@ const CLASSES = [
   ['redos',               /\bredos|backtrack|quadratic|catastrophic|O\(n\^?2\)|unanchored\b/i],
   ['path-traversal',      /\btraversal|confinement|arbitrary (?:write|path)|escape the root\b/i],
   ['race-condition',      /\btoctou|race condition|check.to.use\b/i],
-  ['resource-exhaustion', /\bmemory|heap|rss|oom|amplification|exhaust\b/i],
+  ['resource-exhaustion', /\bheap\b|\brss\b|\boom\b|amplification|exhaust|out of memory|memory (?:leak|usage|growth|pressure)|allocates? ~?\d/i],
   ['missing-limit',       /\bno (?:input )?(?:size )?cap|unbounded|no limit|missing limit\b/i],
   ['temp-file-handling',  /\btemp(?:orary)? file|tmp file|leftover|predictable (?:name|filename)\b/i],
   ['prompt-injection',    /\binjection|jailbreak|untrusted (?:text|content|input)|system.prompt leak|inert data|trust.boundary\b/i],
   ['secret-exposure',     /\bsecret|credential|api key|token leak|password\b/i],
   ['semantic-corruption', /\bsemantic|meaning|threshold|negation|inverts?|widen/i],
   ['idempotency',         /\bidempoten|fixed point|second run|re-?run\b/i],
-  ['input-validation',    /validat|wrong shape|silently accept|malformed|type ?error|unsanitiz/i],
+  ['data-integrity',      /\bdouble-?index|desync|out of sync|phantom|corrupt|torn row|lost update|inconsisten|silently lost\b/i],
+  ['input-validation',    /validat|wrong shape|silently accept|malformed|type ?error|unsanitiz|prototype[- ]key|__proto__|prototype pollution/i],
   ['access-control',      /\bbypass(?:es|ed)? the|rebinding|host header|allowlist|authoriz|access control\b/i],
   ['supply-chain',        /\btyposquat|lockfile|install script|dependency confusion\b/i],
 ];
@@ -229,6 +230,7 @@ const GUARD_ADVICE = {
   'secret-exposure':     'Add a secret scan to the pre-commit hook for this path.',
   'semantic-corruption': 'Add golden tests asserting that meaning-bearing tokens survive transformation.',
   'idempotency':         'Assert f(f(x)) === f(x) in the test suite for every transform.',
+  'data-integrity':      'Derive the secondary structure from the primary one and add a cheap staleness check, so drift self-heals instead of persisting.',
   'input-validation':    'Validate argument shape at every public boundary and throw — never silently coerce to a plausible default.',
   'access-control':      'Deny by default: an allowlist of permitted values, with every absent or empty case treated as invalid rather than waved through.',
   'supply-chain':        'Pin and verify dependencies; add a lockfile-drift check to CI.',

package/scripts/codex/merge-codex-config.js

@@ -13,6 +13,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const safeFs = require('../lib/safe-fs.js');
 
 let TOML;
 try {
@@ -310,7 +311,7 @@ function main() {
     return;
   }
 
-  fs.writeFileSync(configPath, nextRaw, 'utf8');
+  safeFs.replaceFilePreservingMode(configPath, nextRaw);
   log('Done. Baseline Codex settings merged.');
 }
 

package/scripts/codex/merge-mcp-config.js

@@ -19,6 +19,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const safeFs = require('../lib/safe-fs.js');
 const { parseDisabledMcpServers } = require('../lib/mcp-config');
 
 let TOML;
@@ -319,7 +320,7 @@ function main() {
   if (updateMcp || hasRemovals) {
     for (const label of toRemoveLog) log(`  [update] ${label}`);
     const cleaned = raw.replace(/\n+$/, '\n');
-    fs.writeFileSync(configPath, cleaned + (toAppend.length > 0 ? appendText : ''), 'utf8');
+    safeFs.replaceFilePreservingMode(configPath, cleaned + (toAppend.length > 0 ? appendText : ''));
   } else {
     fs.appendFileSync(configPath, appendText, 'utf8');
   }

package/scripts/evolve/stats.js

@@ -29,6 +29,7 @@ const fs   = require('fs');
 const os   = require('os');
 const path = require('path');
 const crypto = require('crypto');
+const safeFs = require('../lib/safe-fs.js');
 
 const DEFAULT_DIR = process.env.KODELYTH_EVOLVE_DIR
   || path.join(os.homedir(), '.kodelythecc', 'evolve');
@@ -54,7 +55,7 @@ function safeReadJson(p, fallback) {
 
 function safeWriteJson(p, data) {
   try {
-    fs.writeFileSync(p, JSON.stringify(data, null, 2));
+    safeFs.replaceFilePreservingMode(p, JSON.stringify(data, null, 2));
     return true;
   } catch { return false; }
 }

package/scripts/lib/safe-fs.js

@@ -153,10 +153,29 @@ function replaceFileAtomic(absPath, contents, mode) {
   return absPath;
 }
 
+/**
+ * Replace an existing file's contents atomically, keeping whatever permissions
+ * it already had (or `fallbackMode` when it does not exist yet).
+ *
+ * This is the safe replacement for `fs.writeFileSync(path, data)` on any file
+ * that holds state worth keeping — a user's IDE config, an accumulated stats
+ * file, a registry. `writeFileSync` opens with 'w', truncating to zero before
+ * writing, so a crash or a full disk part-way through leaves the user with a
+ * truncated file and no copy of the original anywhere.
+ */
+function replaceFilePreservingMode(absPath, contents, fallbackMode = 0o644) {
+  let mode = fallbackMode;
+  try {
+    mode = fs.statSync(absPath).mode & 0o7777;
+  } catch { /* new file — use the fallback */ }
+  return replaceFileAtomic(absPath, contents, mode);
+}
+
 module.exports = {
   resolveContained,
   statRegularFile,
   safeConfigDir,
   writeNewFile,
   replaceFileAtomic,
+  replaceFilePreservingMode,
 };

package/scripts/mcp/client.js

@@ -30,6 +30,7 @@
 const fs   = require('fs');
 const os   = require('os');
 const path = require('path');
+const safeFs = require('../lib/safe-fs.js');
 
 const REGISTRY_DIR = process.env.KODELYTH_MCP_CLIENT_DIR
   || path.join(os.homedir(), '.kodelythecc');
@@ -54,7 +55,7 @@ function loadRegistry() {
 
 function saveRegistry(reg) {
   ensureDir(REGISTRY_DIR);
-  fs.writeFileSync(REGISTRY_FILE, JSON.stringify(reg, null, 2) + '\n');
+  safeFs.replaceFilePreservingMode(REGISTRY_FILE, JSON.stringify(reg, null, 2) + '\n');
 }
 
 // ── Registry mutations ───────────────────────────────────────────────────────

package/scripts/memory/store.js

@@ -18,6 +18,7 @@ const fs   = require('fs');
 const os   = require('os');
 const path = require('path');
 const crypto = require('crypto');
+const safeFs = require('../lib/safe-fs.js');
 
 // Auto-migrate legacy ~/.kodelyth/ → ~/.kodelythecc/ before we touch any path.
 try { require('../migrate-legacy').main(); } catch { /* best-effort */ }
@@ -142,7 +143,7 @@ function logSize() {
 
 function saveIndex(index) {
   ensureDir(PATHS.dir);
-  fs.writeFileSync(PATHS.index, JSON.stringify({ ...index, logSize: logSize() }, null, 2));
+  safeFs.replaceFilePreservingMode(PATHS.index, JSON.stringify({ ...index, logSize: logSize() }, null, 2));
 }
 
 // A patch row does not change any searchable text, so the index stays valid —