kodelyth-ecc 2.14.0 → 2.16.0

package/CHANGELOG.md

@@ -2,6 +2,120 @@
 
 All notable changes to Kodelyth ECC are documented here.
 
+## v2.16.0 — Arena run #4: three path-escapes in evolve (September 2026)
+
+### Fixed — `applyProposalToDisk` wrote wherever the proposal told it to
+
+`evolve accept <id>` applies a proposal to disk. The target came straight from
+proposal data with no containment check:
+
+```js
+const abs = path.resolve(repoRoot, proposal.proposal.target_path);
+fs.writeFileSync(abs, proposal.proposal.diff);
+```
+
+Three vectors, all reproduced:
+
+- `../../escaped.md` wrote to `/tmp/escaped.md`
+- an **absolute** `target_path` discards `repoRoot` entirely — `path.resolve(root, '/abs')` returns `/abs`
+- with `overwrite: true`, a real user file **outside** the root was overwritten
+
+This is the fifth occurrence of the containment class the arena has confirmed,
+in the one file that never adopted the guard.
+
+### Added — `safeFs.resolveContainedForWrite`
+
+The existing `resolveContained` could not answer this case: it canonicalises the
+target, which fails for a file about to be *created*. The new function walks up
+to the nearest existing ancestor, canonicalises that, and re-checks — so a
+symlinked parent directory still cannot be used to escape. Absolute candidates
+are rejected up front rather than joined and hoped about.
+
+### Fixed — the classifier missed naturally-phrased findings, again
+
+All three findings filed as `uncategorized`. The `path-traversal` pattern wanted
+the literal words *traversal* / *confinement*, while the findings said "writes
+outside repoRoot" and "discards repoRoot entirely". Widened to match
+`\w*root` forms — `repoRoot`, `projectRoot`, `coordRoot` — and the stored
+memories re-tagged.
+
+That is the third generic-vs-specific gap in this classifier (`permission`,
+`memory`, now `root`). The pattern is consistent: it matches jargon and misses
+the plain phrasing people actually write.
+
+### Removed — the ecc-web dispatch workflow
+
+It fired a `repository_dispatch` at ecc-web on every push for instant deploys,
+needed a cross-repo PAT, and had been returning HTTP 403 while reporting green.
+Measured on the ecc-web side across 12 consecutive deploys: **12 from its own
+10-minute cron, 0 from the dispatch.** It was contributing nothing but an
+expiring secret and a red check.
+
+Removed rather than repaired. ecc-web keeps its `repository_dispatch` trigger,
+so restoring instant deploys is just a matter of adding a fine-grained PAT with
+`Contents: read-write`. The rationale is recorded in that repo's `deploy.yml` so
+it does not get rebuilt. The cost is latency the site already had.
+
+**576 tests passing. All 9 CI checks green.**
+
+## v2.15.0 — Green CI, and the agents learn what the arena found (September 2026)
+
+### Fixed — CI had been red since v2.8.0
+
+Eight tests asserted POSIX file semantics on the Windows runner. Every release
+from 2.8.0 through 2.14.0 shipped with a failing badge, because `npm test` was
+only ever run on macOS — a green local run beside a red CI is exactly the trap
+this release also teaches `release-captain` to catch.
+
+On Windows `chmod` only toggles the read-only bit, `statSync().mode` is
+synthesized rather than real, `umask` is meaningless, and `symlinkSync` needs
+administrator rights or Developer Mode. The eight tests assert precisely those
+semantics.
+
+They are **skipped there with a stated reason, not deleted** — the behaviour they
+guard (mode preservation, umask independence, `O_EXCL` against planted symlinks)
+is real on Linux and macOS, which is where CI proves it.
+
+```
+tests/lib/safe-fs.test.js      5 guarded
+tests/terse/compress.test.js   3 guarded
+```
+
+All nine CI jobs now pass: Node 18/20/22 across Linux, macOS, and Windows.
+
+### Changed — three agents learned from three arena runs
+
+The arena confirmed the same defects repeatedly, and none of the 70 agents knew
+to look for them. Each addition below is a bug that was actually reproduced, not
+a hypothetical.
+
+**`security-reviewer`** gained three hunt blocks:
+
+- **Lexical-only path containment** — `path.join`/`resolve` normalise `..` but do
+  not resolve symlinks, so a link inside the root passes a `startsWith` check
+  while pointing anywhere on disk. Confirmed four times across three files.
+- **Prototype keys as map keys** — `map['constructor']` returns a truthy
+  function, so `if (!map[k])` never fires. Needs no attacker: one document
+  containing the word "constructor" bricked the memory store.
+- **Truncate-then-write on persistent state** — `writeFileSync` opens with `'w'`.
+  A 6.3 MB store was measured at 0 bytes mid-rewrite, 32 torn reads in 1423
+  samples.
+
+**`code-reviewer`** gained the same three as checklist items under Security.
+
+**`release-captain`** gained **Phase 1.5 — Prove the build is green where it
+actually runs**, with the `gh run list` / `gh run view --log-failed` commands and
+a table of one-platform traps (POSIX modes, umask, symlinks, path separators,
+BSD vs GNU flags). It states plainly: never cut a release on a red CI, and never
+report "all tests passing" when only your own platform is passing.
+
+### Fixed — repository metadata
+
+The GitHub About sidebar still advertised `194 skills · 97 commands`. Corrected
+to 196 / 102, and the arena added to the description.
+
+**572 tests passing on every supported platform.**
+
 ## v2.14.0 — A false recurring class, and five more atomic writes (August 2026)
 
 ### Fixed — the guard proposal was pointing at the wrong thing

package/CLAUDE.md

@@ -26,7 +26,7 @@ scripts/     → Node.js utilities: MCP server, dashboard, swarm, replay, router
 bundles/     → 3 power bundles (indie-hacker, red-team, enterprise)
 actions/     → GitHub Action (CI/CD integration for PR review)
 docs/        → Feature docs (arena.md, mcp.md, dashboard.md, swarm.md, replay.md, evolve.md, supply-chain.md)
-tests/       → 572 passing tests across 30 test files
+tests/       → 576 passing tests across 30 test files
 ```
 
 ## Running Tests

package/README.md

@@ -72,7 +72,7 @@ You never typed `use debug-detective`. You didn't have to. The toolkit read the
 |---|---|---|
 | **Intent routing** | Plain-language → right specialist via 10-tier priority rules | Mostly missing — you memorize names |
 | **70 agents** | Specialists with playbooks, severity calibration, real commands | Often persona-only ("you are a senior engineer...") |
-| **194 skills** | Domain knowledge files agents read on demand | Rarely separated from agents |
+| **196 skills** | Domain knowledge files agents read on demand | Rarely separated from agents |
 | **102 commands** | Slash workflows (`/tdd`, `/arena`, `/devil-mode`, `/team-review`) | Limited or none |
 | **8 parallel commands** | Fire 3-8 agents simultaneously, aggregate results | Rare |
 | **Compound memory** | BM25 local recall + auto-inject + project lessons | Cloud-only or absent |
@@ -118,7 +118,7 @@ kodelythecc --target claude-code --codebase-graph
 That's it. This single flow:
 
 1. Installs both binaries (`kodelyth-ecc` and short-form `kodelythecc`) to your PATH
-2. Copies 70 agents + 194 skills + 97 commands + 22 hooks + 14 rules into your AI tool's config dir
+2. Copies 70 agents + 196 skills + 102 commands + 22 hooks + 14 rules into your AI tool's config dir
 3. Auto-installs **RTK** binary and wires its PreToolUse hook (input compression starts on next AI restart)
 4. Installs **Terse mode** skill + `/terse` and `/terse-compress` slash commands (dormant — user types `/terse` to activate)
 5. Auto-installs **codebase-memory-mcp** and registers its MCP entries in your AI tool (with `--codebase-graph`)
@@ -220,7 +220,7 @@ npx kodelyth-ecc --bundle red-team        # Security engineer — devil-mode + a
 npx kodelyth-ecc --bundle enterprise      # Compliance / audit team — SBOM, license, supply chain
 ```
 
-Each bundle installs the full ECC toolkit (all 70 agents, 194 skills, 97 commands, 22+ hooks), adds a `BUNDLE.md` cheat sheet, and biases the AI toward audience-fit workflows on every session.
+Each bundle installs the full ECC toolkit (all 70 agents, 196 skills, 102 commands, 22+ hooks), adds a `BUNDLE.md` cheat sheet, and biases the AI toward audience-fit workflows on every session.
 
 Combine with any target:
 
@@ -417,7 +417,7 @@ What's inside:
 | **Overview** | Agent count, memory stats, session count, recent activity |
 | **Memory** | Browse, search, and manage your local BM25 memory store |
 | **Evolve** | Self-improving memory — review AI-proposed refinements |
-| **Catalog** | Full searchable index of all 70 agents, 194 skills, 97 commands |
+| **Catalog** | Full searchable index of all 70 agents, 196 skills, 102 commands |
 | **Sessions** | **Live IDE activity** (Claude Code, Windsurf, Windsurf-Next, Cursor, Antigravity) + orchestration/swarm sessions |
 
 Real-time:
@@ -888,7 +888,7 @@ The intent router will route you to the right one. The AI announces who's taking
 | Source | Destination | What it does |
 |---|---|---|
 | `agents/` | `~/.claude/agents/` | All 70 subagents available globally |
-| `skills/` | `~/.claude/skills/` | All 194 skills loadable via commands |
+| `skills/` | `~/.claude/skills/` | All 196 skills loadable via commands |
 | `hooks/hooks.json` | `~/.claude/hooks/` | Automated quality gates |
 | `rules/` | `~/.claude/rules/` | Always-on standards + intent routing |
 | `commands/` | `~/.claude/commands/` | Slash commands (`/tdd`, `/plan`, etc.) |

package/VERSION

@@ -1 +1 @@
-2.14.0
+2.16.0

package/agents/code-reviewer.md

@@ -37,6 +37,16 @@ These MUST be flagged — they can cause real damage:
 - **SQL injection** — String concatenation in queries instead of parameterized queries
 - **XSS vulnerabilities** — Unescaped user input rendered in HTML/JSX
 - **Path traversal** — User-controlled file paths without sanitization
+- **Lexical-only containment** — `startsWith(root)` after `path.join` catches `..` but NOT
+  symlinks: `path.resolve` does not resolve them, so a link inside the root passes the check
+  while pointing anywhere on disk. Demand `realpath` on both sides before the comparison.
+- **Prototype keys as map keys** — `map['constructor']` returns a truthy function, so
+  `if (!map[k])` never fires and the next line reads a property off it. Any object keyed by
+  user text (tokens, tags, headers, filenames) must be `Object.create(null)`. Words like
+  "constructor" and "toString" are ordinary vocabulary — this needs no attacker.
+- **Truncate-then-write on state worth keeping** — `fs.writeFileSync` opens with `'w'` and
+  truncates to zero before writing. A crash, a full disk, or a concurrent reader sees an
+  empty file. Config files, registries, ledgers and indexes need temp + rename.
 - **CSRF vulnerabilities** — State-changing endpoints without CSRF protection
 - **Authentication bypasses** — Missing auth checks on protected routes
 - **Insecure dependencies** — Known vulnerable packages

package/agents/release-captain.md

@@ -40,6 +40,31 @@ Read the diff since last tag. Classify each change:
 
 Be **strict** about MAJOR. Most teams under-call breaking changes and lose user trust.
 
+### Phase 1.5 — Prove the build is green where it actually runs
+
+A local `npm test` proves the suite passes **on your machine**. It says nothing
+about the other platforms CI covers, and a green local run beside a red badge is
+how a project ships eight broken releases in a row without noticing.
+
+```bash
+gh run list --workflow=CI --limit 5      # is the badge actually green?
+gh run view <id> --log-failed            # if not, what fails and on which OS?
+```
+
+**Never cut a release on a red CI.** If the failure is platform-specific, fix or
+explicitly guard it — do not delete the test, and do not tell the user "all tests
+passing" when only your platform is passing.
+
+Common one-platform traps:
+
+| Assumption | Breaks on |
+|---|---|
+| `chmod` / `statSync().mode` carry POSIX bits | Windows — only the read-only bit exists |
+| `process.umask()` is meaningful | Windows |
+| `symlinkSync` just works | Windows — needs admin or Developer Mode |
+| Paths use `/` | Windows — compare with `path.sep` |
+| `timeout`, `stat -f`, GNU flags exist | macOS ships BSD variants; Windows ships neither |
+
 ### Phase 2 — Generate the changelog
 
 Group entries by category, in this order:

package/agents/security-reviewer.md

@@ -55,6 +55,30 @@ rg -n 'Math\.random\(\)'                                          # non-CSPRNG f
 
 # ── Unsafe deserialization + prototype pollution (HIGH) ─────────────────────
 rg -n 'pickle\.loads|yaml\.load\(|Marshal\.load|JSON\.parse\([^)]*req\.|_\.merge\(\{\}|Object\.assign\(target'   # yaml.load: confirm it lacks SafeLoader
+
+# ── Lexical-only path containment (HIGH) ────────────────────────────────────
+# path.join/resolve normalise ".." but do NOT resolve symlinks. A link sitting
+# lexically inside the root passes a startsWith() check while its target is
+# anywhere on disk, and the read follows it. Confirmed four times across three
+# unrelated files in this codebase before the guard existed.
+rg -n 'startsWith\(.*(?:ROOT|DIR|BASE|root|base|dir).*sep|startsWith\(.*\+ .?/.?\)'   # then check: is there a realpathSync nearby?
+rg -n 'readFileSync|createReadStream|readdirSync' --context 3 | rg -n 'path\.(join|resolve)'  # read after a lexical check = the bug
+# The fix is realpath on BOTH sides before comparing, or an existing helper.
+
+# ── Prototype keys used as map keys (HIGH) ──────────────────────────────────
+# map['constructor'] returns Object.prototype.constructor — TRUTHY — so an
+# `if (!map[k])` guard never fires and the next line reads a property off a
+# function. "constructor" and "toString" are ordinary vocabulary, so this needs
+# no attacker: one document containing the word is enough.
+rg -n 'if \(!\w+\[\w+\]\)|\w+\[\w+\] = \w+\[\w+\] \|\|'   # any map keyed by user text
+rg -n '= \{\};' --context 2 | rg -n 'token|term|word|tag|key|freq|count'  # should be Object.create(null)
+
+# ── Truncate-then-write on persistent state (HIGH) ──────────────────────────
+# fs.writeFileSync opens with 'w', truncating to zero BEFORE writing. A crash,
+# a full disk, or a concurrent reader sees an empty file. Measured: a 6.3 MB
+# store observed at 0 bytes mid-rewrite, 32 torn reads in 1423 samples.
+rg -n 'writeFileSync\(' | rg -v 'tmp|\.tmp|test'   # then ask: does this file hold state worth keeping?
+# Config files, registries, ledgers, and indexes need temp+rename, not writeFileSync.
 ```
 
 Report every confirmed hit with: file:line, severity, the exact fix, and (for secrets) "rotate immediately."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kodelyth-ecc",
-  "version": "2.14.0",
+  "version": "2.16.0",
   "description": "Production-grade AI coding toolkit — 70 agents (incl. devil-mode adversarial crew), 194 skills, 97 commands, parallel multi-agent commands, semantic intent routing, self-learning memory, and a built-in MCP server (16 tools / 6 prompts / 377 resources) that bridges to Claude Desktop, LangGraph, AutoGen, CrewAI, and OpenAI Agents SDK. Works with Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, RooCode, Aider, Kimi, and Gemini CLI.",
   "author": "Kodelyth <github.com/sifxprime>",
   "license": "MIT",

package/scripts/arena/learn.js

@@ -33,7 +33,7 @@ const CLASSES = [
   ['filesystem-symlink',  /\bsymlink|lstat|O_NOFOLLOW|hard ?link|dangling\b/i],
   ['file-permissions',    /\bchmod|umask|0600|0644|0444|world-readable|file mode|file permission|permissions? (?:not )?preserved\b/i],
   ['redos',               /\bredos|backtrack|quadratic|catastrophic|O\(n\^?2\)|unanchored\b/i],
-  ['path-traversal',      /\btraversal|confinement|arbitrary (?:write|path)|escape the root\b/i],
+  ['path-traversal',      /\btraversal|confinement|arbitrary (?:write|path)|escapes? (?:the )?\w*root|outside (?:the )?\w*(?:root|repo\w*)|writes? outside|discards? (?:the )?\w*root/i],
   ['race-condition',      /\btoctou|race condition|check.to.use\b/i],
   ['resource-exhaustion', /\bheap\b|\brss\b|\boom\b|amplification|exhaust|out of memory|memory (?:leak|usage|growth|pressure)|allocates? ~?\d/i],
   ['missing-limit',       /\bno (?:input )?(?:size )?cap|unbounded|no limit|missing limit\b/i],

package/scripts/evolve/proposals.js

@@ -20,6 +20,7 @@
 const fs   = require('fs');
 const path = require('path');
 const os   = require('os');
+const safeFs = require('../lib/safe-fs.js');
 
 const DEFAULT_DIR = process.env.KODELYTH_EVOLVE_DIR
   || path.join(os.homedir(), '.kodelythecc', 'evolve');
@@ -139,7 +140,18 @@ function applyProposalToDisk(proposal, { repoRoot, overwrite = false } = {}) {
     throw new Error('applyProposalToDisk: proposal lacks diff or target_path');
   }
   if (!repoRoot) throw new Error('applyProposalToDisk: repoRoot is required');
-  const abs = path.resolve(repoRoot, proposal.proposal.target_path);
+
+  // target_path comes from proposal data, not from the caller, so it is not
+  // trusted. path.resolve normalises ".." but still returns a path OUTSIDE the
+  // root when the target escapes — and an ABSOLUTE target_path discards the root
+  // entirely. Confirmed writing to /tmp/escaped.md and overwriting a real file
+  // outside the root with overwrite:true.
+  const abs = safeFs.resolveContainedForWrite(proposal.proposal.target_path, repoRoot);
+  if (!abs) {
+    throw new Error(
+      `applyProposalToDisk: refusing to write outside repoRoot — target_path "${proposal.proposal.target_path}" escapes ${repoRoot}`,
+    );
+  }
   if (fs.existsSync(abs) && !overwrite) {
     throw new Error(`applyProposalToDisk: refusing to overwrite existing file at ${abs} (pass overwrite=true)`);
   }

package/scripts/lib/safe-fs.js

@@ -69,6 +69,49 @@ function resolveContained(candidate, root, { allowExact = null } = {}) {
   return abs;
 }
 
+/**
+ * Confirm a path that does not exist yet still resolves inside `root`.
+ *
+ * `resolveContained` cannot answer this: it realpaths the target, which fails
+ * for a file about to be created. So walk up to the nearest ancestor that DOES
+ * exist, canonicalise that, and re-check — which still catches a symlinked
+ * parent directory pointing out of the root.
+ *
+ * Returns the resolved absolute path, or null if it escapes.
+ */
+function resolveContainedForWrite(candidate, root) {
+  if (!candidate || !root) return null;
+
+  const absRoot = path.resolve(root);
+  // path.resolve(root, '/abs/path') returns '/abs/path' — an absolute candidate
+  // discards the root entirely, so it must be rejected up front rather than
+  // joined and hoped about.
+  const abs = path.isAbsolute(candidate) ? path.resolve(candidate) : path.resolve(absRoot, candidate);
+
+  if (abs !== absRoot && !abs.startsWith(absRoot + path.sep)) return null;
+
+  // The lexical check above is defeated by a symlinked ancestor, so canonicalise
+  // the deepest directory that actually exists and confirm it is still inside.
+  let probe = path.dirname(abs);
+  while (probe !== path.dirname(probe) && !fs.existsSync(probe)) probe = path.dirname(probe);
+
+  let realProbe;
+  try {
+    realProbe = fs.realpathSync(probe);
+  } catch {
+    return null;
+  }
+  let realRoot;
+  try {
+    realRoot = fs.realpathSync(absRoot);
+  } catch {
+    realRoot = absRoot;
+  }
+  if (realProbe !== realRoot && !realProbe.startsWith(realRoot + path.sep)) return null;
+
+  return abs;
+}
+
 /**
  * Stat a path that must be a regular file, refusing symlinks outright.
  *
@@ -173,6 +216,7 @@ function replaceFilePreservingMode(absPath, contents, fallbackMode = 0o644) {
 
 module.exports = {
   resolveContained,
+  resolveContainedForWrite,
   statRegularFile,
   safeConfigDir,
   writeNewFile,