kodelyth-ecc 2.15.0 → 2.16.0

package/CHANGELOG.md

@@ -2,6 +2,62 @@
 
 All notable changes to Kodelyth ECC are documented here.
 
+## v2.16.0 — Arena run #4: three path-escapes in evolve (September 2026)
+
+### Fixed — `applyProposalToDisk` wrote wherever the proposal told it to
+
+`evolve accept <id>` applies a proposal to disk. The target came straight from
+proposal data with no containment check:
+
+```js
+const abs = path.resolve(repoRoot, proposal.proposal.target_path);
+fs.writeFileSync(abs, proposal.proposal.diff);
+```
+
+Three vectors, all reproduced:
+
+- `../../escaped.md` wrote to `/tmp/escaped.md`
+- an **absolute** `target_path` discards `repoRoot` entirely — `path.resolve(root, '/abs')` returns `/abs`
+- with `overwrite: true`, a real user file **outside** the root was overwritten
+
+This is the fifth occurrence of the containment class the arena has confirmed,
+in the one file that never adopted the guard.
+
+### Added — `safeFs.resolveContainedForWrite`
+
+The existing `resolveContained` could not answer this case: it canonicalises the
+target, which fails for a file about to be *created*. The new function walks up
+to the nearest existing ancestor, canonicalises that, and re-checks — so a
+symlinked parent directory still cannot be used to escape. Absolute candidates
+are rejected up front rather than joined and hoped about.
+
+### Fixed — the classifier missed naturally-phrased findings, again
+
+All three findings filed as `uncategorized`. The `path-traversal` pattern wanted
+the literal words *traversal* / *confinement*, while the findings said "writes
+outside repoRoot" and "discards repoRoot entirely". Widened to match
+`\w*root` forms — `repoRoot`, `projectRoot`, `coordRoot` — and the stored
+memories re-tagged.
+
+That is the third generic-vs-specific gap in this classifier (`permission`,
+`memory`, now `root`). The pattern is consistent: it matches jargon and misses
+the plain phrasing people actually write.
+
+### Removed — the ecc-web dispatch workflow
+
+It fired a `repository_dispatch` at ecc-web on every push for instant deploys,
+needed a cross-repo PAT, and had been returning HTTP 403 while reporting green.
+Measured on the ecc-web side across 12 consecutive deploys: **12 from its own
+10-minute cron, 0 from the dispatch.** It was contributing nothing but an
+expiring secret and a red check.
+
+Removed rather than repaired. ecc-web keeps its `repository_dispatch` trigger,
+so restoring instant deploys is just a matter of adding a fine-grained PAT with
+`Contents: read-write`. The rationale is recorded in that repo's `deploy.yml` so
+it does not get rebuilt. The cost is latency the site already had.
+
+**576 tests passing. All 9 CI checks green.**
+
 ## v2.15.0 — Green CI, and the agents learn what the arena found (September 2026)
 
 ### Fixed — CI had been red since v2.8.0

package/CLAUDE.md

@@ -26,7 +26,7 @@ scripts/     → Node.js utilities: MCP server, dashboard, swarm, replay, router
 bundles/     → 3 power bundles (indie-hacker, red-team, enterprise)
 actions/     → GitHub Action (CI/CD integration for PR review)
 docs/        → Feature docs (arena.md, mcp.md, dashboard.md, swarm.md, replay.md, evolve.md, supply-chain.md)
-tests/       → 572 passing tests across 30 test files
+tests/       → 576 passing tests across 30 test files
 ```
 
 ## Running Tests

package/VERSION

@@ -1 +1 @@
-2.15.0
+2.16.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kodelyth-ecc",
-  "version": "2.15.0",
+  "version": "2.16.0",
   "description": "Production-grade AI coding toolkit — 70 agents (incl. devil-mode adversarial crew), 194 skills, 97 commands, parallel multi-agent commands, semantic intent routing, self-learning memory, and a built-in MCP server (16 tools / 6 prompts / 377 resources) that bridges to Claude Desktop, LangGraph, AutoGen, CrewAI, and OpenAI Agents SDK. Works with Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, RooCode, Aider, Kimi, and Gemini CLI.",
   "author": "Kodelyth <github.com/sifxprime>",
   "license": "MIT",

package/scripts/arena/learn.js

@@ -33,7 +33,7 @@ const CLASSES = [
   ['filesystem-symlink',  /\bsymlink|lstat|O_NOFOLLOW|hard ?link|dangling\b/i],
   ['file-permissions',    /\bchmod|umask|0600|0644|0444|world-readable|file mode|file permission|permissions? (?:not )?preserved\b/i],
   ['redos',               /\bredos|backtrack|quadratic|catastrophic|O\(n\^?2\)|unanchored\b/i],
-  ['path-traversal',      /\btraversal|confinement|arbitrary (?:write|path)|escape the root\b/i],
+  ['path-traversal',      /\btraversal|confinement|arbitrary (?:write|path)|escapes? (?:the )?\w*root|outside (?:the )?\w*(?:root|repo\w*)|writes? outside|discards? (?:the )?\w*root/i],
   ['race-condition',      /\btoctou|race condition|check.to.use\b/i],
   ['resource-exhaustion', /\bheap\b|\brss\b|\boom\b|amplification|exhaust|out of memory|memory (?:leak|usage|growth|pressure)|allocates? ~?\d/i],
   ['missing-limit',       /\bno (?:input )?(?:size )?cap|unbounded|no limit|missing limit\b/i],

package/scripts/evolve/proposals.js

@@ -20,6 +20,7 @@
 const fs   = require('fs');
 const path = require('path');
 const os   = require('os');
+const safeFs = require('../lib/safe-fs.js');
 
 const DEFAULT_DIR = process.env.KODELYTH_EVOLVE_DIR
   || path.join(os.homedir(), '.kodelythecc', 'evolve');
@@ -139,7 +140,18 @@ function applyProposalToDisk(proposal, { repoRoot, overwrite = false } = {}) {
     throw new Error('applyProposalToDisk: proposal lacks diff or target_path');
   }
   if (!repoRoot) throw new Error('applyProposalToDisk: repoRoot is required');
-  const abs = path.resolve(repoRoot, proposal.proposal.target_path);
+
+  // target_path comes from proposal data, not from the caller, so it is not
+  // trusted. path.resolve normalises ".." but still returns a path OUTSIDE the
+  // root when the target escapes — and an ABSOLUTE target_path discards the root
+  // entirely. Confirmed writing to /tmp/escaped.md and overwriting a real file
+  // outside the root with overwrite:true.
+  const abs = safeFs.resolveContainedForWrite(proposal.proposal.target_path, repoRoot);
+  if (!abs) {
+    throw new Error(
+      `applyProposalToDisk: refusing to write outside repoRoot — target_path "${proposal.proposal.target_path}" escapes ${repoRoot}`,
+    );
+  }
   if (fs.existsSync(abs) && !overwrite) {
     throw new Error(`applyProposalToDisk: refusing to overwrite existing file at ${abs} (pass overwrite=true)`);
   }

package/scripts/lib/safe-fs.js

@@ -69,6 +69,49 @@ function resolveContained(candidate, root, { allowExact = null } = {}) {
   return abs;
 }
 
+/**
+ * Confirm a path that does not exist yet still resolves inside `root`.
+ *
+ * `resolveContained` cannot answer this: it realpaths the target, which fails
+ * for a file about to be created. So walk up to the nearest ancestor that DOES
+ * exist, canonicalise that, and re-check — which still catches a symlinked
+ * parent directory pointing out of the root.
+ *
+ * Returns the resolved absolute path, or null if it escapes.
+ */
+function resolveContainedForWrite(candidate, root) {
+  if (!candidate || !root) return null;
+
+  const absRoot = path.resolve(root);
+  // path.resolve(root, '/abs/path') returns '/abs/path' — an absolute candidate
+  // discards the root entirely, so it must be rejected up front rather than
+  // joined and hoped about.
+  const abs = path.isAbsolute(candidate) ? path.resolve(candidate) : path.resolve(absRoot, candidate);
+
+  if (abs !== absRoot && !abs.startsWith(absRoot + path.sep)) return null;
+
+  // The lexical check above is defeated by a symlinked ancestor, so canonicalise
+  // the deepest directory that actually exists and confirm it is still inside.
+  let probe = path.dirname(abs);
+  while (probe !== path.dirname(probe) && !fs.existsSync(probe)) probe = path.dirname(probe);
+
+  let realProbe;
+  try {
+    realProbe = fs.realpathSync(probe);
+  } catch {
+    return null;
+  }
+  let realRoot;
+  try {
+    realRoot = fs.realpathSync(absRoot);
+  } catch {
+    realRoot = absRoot;
+  }
+  if (realProbe !== realRoot && !realProbe.startsWith(realRoot + path.sep)) return null;
+
+  return abs;
+}
+
 /**
  * Stat a path that must be a regular file, refusing symlinks outright.
  *
@@ -173,6 +216,7 @@ function replaceFilePreservingMode(absPath, contents, fallbackMode = 0o644) {
 
 module.exports = {
   resolveContained,
+  resolveContainedForWrite,
   statRegularFile,
   safeConfigDir,
   writeNewFile,