kodelyth-ecc 2.15.0 → 2.17.0

package/CHANGELOG.md

@@ -2,6 +2,157 @@
 
 All notable changes to Kodelyth ECC are documented here.
 
+## v2.17.0 — ECC Immunity: the arena's findings, made executable (September 2026)
+
+Four arena runs confirmed real bugs and stored them as prose. Prose does not
+scan a codebase. This release turns each confirmed class into a **detector that
+runs**, so a bug proven here can be found anywhere — including in repositories
+that never ran the arena.
+
+```bash
+kodelythecc immune              # scan the current directory
+kodelythecc immune scripts/     # scan a subtree
+kodelythecc immune --json       # machine-readable, exits 1 on any high finding
+```
+
+### How each detector earned its place
+
+A detector ships only if it does **both**: FIRES on the exact source the arena
+found the bug in, and goes SILENT on the source after the fix. Verified against
+this repository's own history at v2.7.0, the last release before any arena fix:
+
+```
+detector               file                    BEFORE   AFTER   verdict
+lexical-containment    dashboard/data.js       FIRES    silent  PROVEN
+lexical-containment    dashboard/server.js     FIRES    silent  PROVEN
+prototype-key-map      memory/store.js         FIRES    silent  PROVEN
+truncate-then-write    memory/store.js         FIRES    silent  PROVEN
+```
+
+`predictable-temp-name` is proven against a fixture rather than a commit: that
+bug was caught by an EVIL agent in the working tree and fixed before it was ever
+committed, so no historical version exists. Stated plainly rather than implied
+to carry the same provenance.
+
+### Two classes were deliberately NOT shipped
+
+This matters more than the four that were.
+
+**ReDoS.** Real — 7.6 s on 293 KB. But arena run #1 *measured* five structurally
+identical regexes in one file: fenced-code, inline-code, bare-URL and file-path
+were all linear; only the link target was quadratic. The difference is whether
+the closing delimiter is commonly absent in real input — a property of the data,
+not the pattern. A detector would have flagged all five and been wrong about
+four.
+
+**Unbounded input.** Also real — 4.9 MB allocated ~417 MB. But the detectable
+shape is "this module reads a file", which described **57 of 165 files** here.
+
+A scanner that is wrong four times out of five gets muted, and a muted scanner
+protects nothing.
+
+### What it found on its first real run
+
+Pointed at ECC itself, in code four arena runs never audited:
+
+- **`scripts/hooks/run-with-flags.js`** — lexical containment on a path that is
+  then **executed**. A symlink inside the plugin root would have run an
+  arbitrary script.
+- **`scripts/lib/agent-compress.js`** — same class, on a read.
+- **10 × `prototype-key-map`**, including `PACKAGE_MANAGERS['constructor']`,
+  which is truthy — so `setPreferredPackageManager('constructor')` skipped the
+  "Unknown package manager" throw entirely and persisted the bad name. Verified
+  live, then fixed with `Object.hasOwn`.
+- **2 × durable state rewritten with `writeFileSync`** — the update-check cache
+  and the engagement state file.
+
+It also caught a spot **I had missed**: `restampIndex` in the memory store still
+used a raw `writeFileSync` after the 2.14.0 atomic-write sweep converted
+`saveIndex` beside it.
+
+```
+raw detectors                104 findings (12 high, 92 medium)
+dropped 2 imprecise classes   12 findings (10 high,  2 medium)
+fixed every real finding       0 findings
+```
+
+### Added
+
+- `scripts/immune/detectors.js` — pure, executable detectors
+- `scripts/immune/scan.js` — tree walker that skips `node_modules`, test
+  fixtures, and never follows a symlink out of the tree
+- `kodelythecc immune` and `/immune`
+- 28 tests, including one asserting the scanner does not flag its own
+  documentation, and one pinning the fixtures to real git history when it is
+  available
+
+### Fixed — found while building it
+
+`stripNoise` originally stripped string literals too, and the apostrophe in
+"don't" opened a span that swallowed regex literals several lines later. That
+silenced a detector on a real, confirmed bug. Regex-based lexing of JavaScript
+strings is not reliable enough to build detection on; only comments are stripped
+now. And `walk`'s `maxFiles` cap was checked between directories but not within
+one, so a single large directory blew straight past it — caught by its own test.
+
+**604 tests passing**, up from 576.
+
+## v2.16.0 — Arena run #4: three path-escapes in evolve (September 2026)
+
+### Fixed — `applyProposalToDisk` wrote wherever the proposal told it to
+
+`evolve accept <id>` applies a proposal to disk. The target came straight from
+proposal data with no containment check:
+
+```js
+const abs = path.resolve(repoRoot, proposal.proposal.target_path);
+fs.writeFileSync(abs, proposal.proposal.diff);
+```
+
+Three vectors, all reproduced:
+
+- `../../escaped.md` wrote to `/tmp/escaped.md`
+- an **absolute** `target_path` discards `repoRoot` entirely — `path.resolve(root, '/abs')` returns `/abs`
+- with `overwrite: true`, a real user file **outside** the root was overwritten
+
+This is the fifth occurrence of the containment class the arena has confirmed,
+in the one file that never adopted the guard.
+
+### Added — `safeFs.resolveContainedForWrite`
+
+The existing `resolveContained` could not answer this case: it canonicalises the
+target, which fails for a file about to be *created*. The new function walks up
+to the nearest existing ancestor, canonicalises that, and re-checks — so a
+symlinked parent directory still cannot be used to escape. Absolute candidates
+are rejected up front rather than joined and hoped about.
+
+### Fixed — the classifier missed naturally-phrased findings, again
+
+All three findings filed as `uncategorized`. The `path-traversal` pattern wanted
+the literal words *traversal* / *confinement*, while the findings said "writes
+outside repoRoot" and "discards repoRoot entirely". Widened to match
+`\w*root` forms — `repoRoot`, `projectRoot`, `coordRoot` — and the stored
+memories re-tagged.
+
+That is the third generic-vs-specific gap in this classifier (`permission`,
+`memory`, now `root`). The pattern is consistent: it matches jargon and misses
+the plain phrasing people actually write.
+
+### Removed — the ecc-web dispatch workflow
+
+It fired a `repository_dispatch` at ecc-web on every push for instant deploys,
+needed a cross-repo PAT, and had been returning HTTP 403 while reporting green.
+Measured on the ecc-web side across 12 consecutive deploys: **12 from its own
+10-minute cron, 0 from the dispatch.** It was contributing nothing but an
+expiring secret and a red check.
+
+Removed rather than repaired. ecc-web keeps its `repository_dispatch` trigger,
+so restoring instant deploys is just a matter of adding a fine-grained PAT with
+`Contents: read-write`. The rationale is recorded in that repo's `deploy.yml` so
+it does not get rebuilt. The cost is latency the site already had.
+
+**576 tests passing. All 9 CI checks green.**
+
 ## v2.15.0 — Green CI, and the agents learn what the arena found (September 2026)
 
 ### Fixed — CI had been red since v2.8.0

package/CLAUDE.md

@@ -8,7 +8,7 @@ Guidance for Claude Code when working with this repository.
 
 - **70 specialist agents** — debug-detective, incident-commander, load-tester, image-architect, kodelyth-memory, security-reviewer, plus 8 adversarial devil-mode agents
 - **196 skills** — domain knowledge, patterns, testing, security, intent routing, local memory, swarm orchestration, MCP integration
-- **102 commands** — slash workflows (`/tdd`, `/plan`, `/code-review`, `/team-review`, `/devil-mode`, `/debug-blitz`, `/security-audit`, ...)
+- **103 commands** — slash workflows (`/tdd`, `/plan`, `/code-review`, `/team-review`, `/devil-mode`, `/debug-blitz`, `/security-audit`, ...)
 - **22+ hooks** — quality gates, memory inject + capture, correction encoding, prompt-injection guard, token-budget enforcer
 - **14 rules** — always-on coding standards + semantic intent routing + memory protocol + self-improvement
 
@@ -18,7 +18,7 @@ Works with Claude Code, Windsurf, Cursor, Codex CLI, Antigravity, OpenCode, Clin
 
 ```
 agents/      → 70 specialist subagents (planner, code-reviewer, debug-detective, devil-mode crew, ...)
-commands/    → 102 slash commands (8 parallel multi-agent, 1 adversarial loop, rest single-agent)
+commands/    → 103 slash commands (8 parallel multi-agent, 1 adversarial loop, rest single-agent)
 skills/      → 196 workflow + domain knowledge files (loadable via slash commands)
 hooks/       → 22+ automations (pre-commit, session memory, prompt-injection guard, token-budget)
 rules/       → 14 always-on guidelines (agent-intent-routing, self-improvement, memory-protocol, ...)
@@ -26,7 +26,7 @@ scripts/     → Node.js utilities: MCP server, dashboard, swarm, replay, router
 bundles/     → 3 power bundles (indie-hacker, red-team, enterprise)
 actions/     → GitHub Action (CI/CD integration for PR review)
 docs/        → Feature docs (arena.md, mcp.md, dashboard.md, swarm.md, replay.md, evolve.md, supply-chain.md)
-tests/       → 572 passing tests across 30 test files
+tests/       → 604 passing tests across 32 test files
 ```
 
 ## Running Tests

package/VERSION

@@ -1 +1 @@
-2.15.0
+2.17.0

package/bin/kodelyth-ecc.js

@@ -431,6 +431,58 @@ if (args[0] === 'memory') {
 //   kodelythecc arena list                           list past arena runs
 //   kodelythecc arena learn <run-id> [--commit]      remember what the run proved
 //   kodelythecc arena report <run-id>                show a run's report
+// ── Subcommand: immune (scan for arena-confirmed bug classes) ────────────────
+//   kodelyth-ecc immune [path] [--json] [--tests]
+if (args[0] === 'immune') {
+  const rest = args.slice(1);
+  const w = (m) => process.stdout.write(m + '\n');
+  const target = rest.find((a) => !a.startsWith('--')) || '.';
+  const { scanTree } = require(path.join(ROOT, 'scripts', 'immune', 'scan.js'));
+  const { DETECTORS } = require(path.join(ROOT, 'scripts', 'immune', 'detectors.js'));
+
+  let res;
+  try {
+    res = scanTree(target, { includeTests: rest.includes('--tests') });
+  } catch (err) {
+    process.stderr.write(`immune: cannot scan ${target}: ${err.message}\n`);
+    process.exit(2);
+  }
+
+  if (rest.includes('--json')) { w(JSON.stringify(res, null, 2)); process.exit(res.counts.high > 0 ? 1 : 0); }
+
+  w('');
+  w(`\x1b[1mECC Immunity\x1b[0m — ${DETECTORS.length} bug classes the arena confirmed, checked against \x1b[33m${target}\x1b[0m`);
+  w('─'.repeat(72));
+
+  if (!res.findings.length) {
+    w(`\x1b[32mClean.\x1b[0m ${res.scanned} files scanned, none matched a known class.`);
+    w('');
+    w('This is not proof of correctness — only that none of the specific classes');
+    w('the arena has confirmed are present. Run /arena to hunt for new ones.');
+    w('');
+    process.exit(0);
+  }
+
+  const colour = { high: '31', medium: '33', low: '90' };
+  for (const f of res.findings) {
+    w(`\x1b[${colour[f.severity] || '0'}m${f.severity.toUpperCase().padEnd(6)}\x1b[0m ${f.file}:${f.line}`);
+    w(`       ${f.title}`);
+    w(`       \x1b[90m${f.evidence}\x1b[0m`);
+    w(`       \x1b[36mfix:\x1b[0m ${f.fix}`);
+    w('');
+  }
+
+  w('─'.repeat(72));
+  w(`${res.counts.total} finding(s) across ${res.scanned} files — ` +
+    `${res.counts.high} high, ${res.counts.medium} medium, ${res.counts.low} low`);
+  w('');
+  w('Each class here was reproduced with a real repro during an arena run, and');
+  w('each detector is pinned to the commit that proves it fires on the bug and');
+  w('stays silent on the fix.');
+  w('');
+  process.exit(res.counts.high > 0 ? 1 : 0);
+}
+
 if (args[0] === 'god' || args[0] === 'evil' || args[0] === 'arena') {
   const mode = args[0];
   const rest = args.slice(1);

package/commands/immune.md

@@ -0,0 +1,89 @@
+---
+description: Scan any codebase for the bug classes the arena has actually confirmed — executable detectors, each pinned to the commit that proves it.
+argument-hint: "[path]"
+---
+
+# /immune — the arena's findings, made executable
+
+The arena finds bugs one repository at a time and remembers them as prose. Prose
+does not scan a codebase. `/immune` turns each **confirmed** class into a
+detector that runs, so a bug proven here can be found anywhere — including in
+repositories that never ran the arena.
+
+```bash
+kodelythecc immune              # scan the current directory
+kodelythecc immune scripts/     # scan a subtree
+kodelythecc immune --json       # machine-readable
+kodelythecc immune --tests      # include test files (normally skipped)
+```
+
+Exits non-zero when anything **high** is found, so it drops straight into CI.
+
+## What it looks for
+
+Every detector below encodes a class that was reproduced with a real repro
+during an arena run. Nothing here is hypothetical.
+
+| Detector | Confirmed | What it catches |
+|---|---|---|
+| `lexical-containment` | 5× | `startsWith(root)` with no `realpath` — a symlink inside the root passes while pointing anywhere on disk |
+| `prototype-key-map` | 1× | `map['constructor']` is truthy, so `if (!map[k])` never fires |
+| `truncate-then-write` | 3× | `writeFileSync` on durable state truncates to zero before writing |
+| `predictable-temp-name` | 1× | a pid-derived temp path can be pre-planted with a symlink |
+
+## How each detector earns its place
+
+A detector ships only if it does **both**:
+
+1. **FIRES** on the exact source the arena found the bug in
+2. Goes **SILENT** on the source after the fix
+
+Both halves matter. A detector that misses the real bug is decoration; one that
+still fires after the fix is a false positive. The fixtures in
+`tests/immune/detectors.test.js` are real code quoted from this repository at
+v2.7.0 — the last release before any arena fix landed.
+
+## Two classes were deliberately NOT shipped
+
+This matters more than the four that were.
+
+**ReDoS.** The class is real: an unbounded quantifier cost 7.6 s on 293 KB. But
+arena run #1 *measured* five structurally identical regexes in one file — the
+fenced-code, inline-code, bare-URL and file-path patterns were all linear, and
+only the link-target pattern was quadratic. The difference is whether the
+closing delimiter is commonly absent in real input: a property of the data, not
+the pattern, and invisible to a scanner. A detector would have flagged all five
+and been wrong about four.
+
+**Unbounded input.** Also real — 4.9 MB allocated ~417 MB and OOMed under a
+256 MB heap. But the detectable shape is "this module reads a file", which
+described 57 of 165 files here. The actual bug is reading *untrusted* input
+without a cap, and a scanner cannot tell which reads are untrusted.
+
+Both stay where they were actually caught: measurement under `/arena`, and human
+review under `security-reviewer`.
+
+> A scanner that is wrong four times out of five gets muted, and a muted scanner
+> protects nothing. Precision over recall, deliberately.
+
+## What a clean result means
+
+```
+Clean. 165 files scanned, none matched a known class.
+```
+
+That is **not** proof of correctness. It means none of the specific classes the
+arena has confirmed are present. New classes are found by running `/arena`, and
+each new confirmation is a candidate for a new detector.
+
+## The loop this closes
+
+```
+/arena  ──▶  confirmed findings  ──▶  memories  ──▶  detectors  ──▶  /immune
+   ▲                                                                     │
+   └──────────────  new classes found in new code  ◀────────────────────┘
+```
+
+`/arena` is expensive and thorough — agents, rounds, real repros. `/immune` is
+instant and narrow. Use the arena to *discover* a class; use immune to make sure
+it never comes back, anywhere.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kodelyth-ecc",
-  "version": "2.15.0",
+  "version": "2.17.0",
   "description": "Production-grade AI coding toolkit — 70 agents (incl. devil-mode adversarial crew), 194 skills, 97 commands, parallel multi-agent commands, semantic intent routing, self-learning memory, and a built-in MCP server (16 tools / 6 prompts / 377 resources) that bridges to Claude Desktop, LangGraph, AutoGen, CrewAI, and OpenAI Agents SDK. Works with Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, RooCode, Aider, Kimi, and Gemini CLI.",
   "author": "Kodelyth <github.com/sifxprime>",
   "license": "MIT",

package/scripts/arena/learn.js

@@ -33,7 +33,7 @@ const CLASSES = [
   ['filesystem-symlink',  /\bsymlink|lstat|O_NOFOLLOW|hard ?link|dangling\b/i],
   ['file-permissions',    /\bchmod|umask|0600|0644|0444|world-readable|file mode|file permission|permissions? (?:not )?preserved\b/i],
   ['redos',               /\bredos|backtrack|quadratic|catastrophic|O\(n\^?2\)|unanchored\b/i],
-  ['path-traversal',      /\btraversal|confinement|arbitrary (?:write|path)|escape the root\b/i],
+  ['path-traversal',      /\btraversal|confinement|arbitrary (?:write|path)|escapes? (?:the )?\w*root|outside (?:the )?\w*(?:root|repo\w*)|writes? outside|discards? (?:the )?\w*root/i],
   ['race-condition',      /\btoctou|race condition|check.to.use\b/i],
   ['resource-exhaustion', /\bheap\b|\brss\b|\boom\b|amplification|exhaust|out of memory|memory (?:leak|usage|growth|pressure)|allocates? ~?\d/i],
   ['missing-limit',       /\bno (?:input )?(?:size )?cap|unbounded|no limit|missing limit\b/i],

package/scripts/ci/validate-install-manifests.js

@@ -135,7 +135,7 @@ function validateInstallManifests() {
   const expectedProfileIds = ['core', 'developer', 'security', 'research', 'full'];
 
   for (const profileId of expectedProfileIds) {
-    if (!profiles[profileId]) {
+    if (!Object.hasOwn(profiles, profileId)) {
       console.error(`ERROR: Missing required install profile: ${profileId}`);
       hasErrors = true;
     }

package/scripts/cli/update-check.js

@@ -8,6 +8,7 @@ const https = require('https');
 const fs    = require('fs');
 const os    = require('os');
 const path  = require('path');
+const safeFs = require('../lib/safe-fs.js');
 
 const CACHE_DIR  = path.join(os.homedir(), '.kodelythecc');
 const CACHE_FILE = path.join(CACHE_DIR, 'update-check.json');
@@ -23,7 +24,7 @@ function readCache() {
 
 function writeCache(latest) {
   try { fs.mkdirSync(CACHE_DIR, { recursive: true }); } catch {}
-  try { fs.writeFileSync(CACHE_FILE, JSON.stringify({ at: Date.now(), latest })); } catch {}
+  try { safeFs.replaceFilePreservingMode(CACHE_FILE, JSON.stringify({ at: Date.now(), latest })); } catch {}
 }
 
 function fetchLatest() {

package/scripts/evolve/proposals.js

@@ -20,6 +20,7 @@
 const fs   = require('fs');
 const path = require('path');
 const os   = require('os');
+const safeFs = require('../lib/safe-fs.js');
 
 const DEFAULT_DIR = process.env.KODELYTH_EVOLVE_DIR
   || path.join(os.homedir(), '.kodelythecc', 'evolve');
@@ -139,7 +140,18 @@ function applyProposalToDisk(proposal, { repoRoot, overwrite = false } = {}) {
     throw new Error('applyProposalToDisk: proposal lacks diff or target_path');
   }
   if (!repoRoot) throw new Error('applyProposalToDisk: repoRoot is required');
-  const abs = path.resolve(repoRoot, proposal.proposal.target_path);
+
+  // target_path comes from proposal data, not from the caller, so it is not
+  // trusted. path.resolve normalises ".." but still returns a path OUTSIDE the
+  // root when the target escapes — and an ABSOLUTE target_path discards the root
+  // entirely. Confirmed writing to /tmp/escaped.md and overwriting a real file
+  // outside the root with overwrite:true.
+  const abs = safeFs.resolveContainedForWrite(proposal.proposal.target_path, repoRoot);
+  if (!abs) {
+    throw new Error(
+      `applyProposalToDisk: refusing to write outside repoRoot — target_path "${proposal.proposal.target_path}" escapes ${repoRoot}`,
+    );
+  }
   if (fs.existsSync(abs) && !overwrite) {
     throw new Error(`applyProposalToDisk: refusing to overwrite existing file at ${abs} (pass overwrite=true)`);
   }

package/scripts/hooks/run-with-flags.js

@@ -10,6 +10,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const safeFs = require('../lib/safe-fs.js');
 const { spawnSync } = require('child_process');
 const { isHookEnabled } = require('../lib/hook-flags');
 
@@ -103,8 +104,10 @@ async function main() {
   const resolvedRoot = path.resolve(pluginRoot);
   const scriptPath = path.resolve(pluginRoot, relScriptPath);
 
-  // Prevent path traversal outside the plugin root
-  if (!scriptPath.startsWith(resolvedRoot + path.sep)) {
+  // Prevent path traversal outside the plugin root — including via a symlink.
+  // The lexical check alone passed for a link sitting inside the root, and this
+  // path is EXECUTED, so following one runs an arbitrary script.
+  if (!safeFs.resolveContained(scriptPath, resolvedRoot)) {
     process.stderr.write(`[Hook] Path traversal rejected for ${hookId}: ${scriptPath}\n`);
     process.stdout.write(raw);
     process.exit(0);

package/scripts/immune/detectors.js

@@ -0,0 +1,220 @@
+// scripts/immune/detectors.js
+//
+// Executable detectors for the bug classes the arena has actually confirmed.
+//
+// The arena finds bugs and remembers them as prose. Prose does not scan a
+// codebase. Each detector below encodes one class that was reproduced with a
+// real repro during an arena run, so the knowledge becomes something that can
+// run against any repository instead of only informing the next conversation.
+//
+// Every detector is proven against git history: it must FIRE on the exact
+// pre-fix source the arena found the bug in, and stay SILENT on the fixed
+// source. A detector that cannot do both does not ship. See
+// tests/immune/detectors.test.js, which pins each one to a real commit.
+//
+// Precision over recall, deliberately. A scanner that cries wolf gets muted,
+// and a muted scanner protects nothing.
+
+'use strict';
+
+// Strip comments and string literals before matching. Without this, every
+// detector fires on its own documentation and on the changelog entry describing
+// the bug it looks for — which is exactly how a scanner earns its mute button.
+// Blank out COMMENTS ONLY, preserving line numbers.
+//
+// An earlier version also stripped string literals, which broke on the first
+// apostrophe in ordinary prose ("don't") — the quote opened a span that ate
+// everything to the next quote, including regex literals several lines later.
+// The unbounded-quantifier detector went silent on a real, confirmed bug
+// because of it. Regex-based lexing of JavaScript strings is not reliable
+// enough to build detection on.
+//
+// Comments are the only noise that actually matters: a detector describing the
+// bug it hunts would otherwise flag its own documentation.
+function stripNoise(src) {
+  return src
+    // Block comments — keep newlines so line numbers stay correct.
+    .replace(/\/\*[\s\S]*?\*\//g, (m) => m.replace(/[^\n]/g, ' '))
+    // Line comments, but not the "//" inside a URL like https://example.com.
+    .replace(/(^|[^:\\])\/\/[^\n]*/g, (m, lead) => lead + ' '.repeat(m.length - lead.length));
+}
+
+function lineOf(src, index) {
+  return src.slice(0, index).split('\n').length;
+}
+
+// ── The classes ─────────────────────────────────────────────────────────────
+
+const DETECTORS = [
+  {
+    id: 'lexical-containment',
+    severity: 'high',
+    confirmed: 5,
+    title: 'Path containment checked lexically, without resolving symlinks',
+    why:
+      'path.join and path.resolve normalise ".." but do not resolve symlinks. A link ' +
+      'sitting lexically inside the root passes a startsWith() check while its target is ' +
+      'anywhere on disk, and the read or write follows it.',
+    fix: 'Canonicalise both sides with fs.realpathSync before comparing, or route through a shared guard.',
+    detect(src) {
+      const clean = stripNoise(src);
+      // A containment comparison against a root-ish identifier...
+      const guard = /\.startsWith\(\s*([A-Za-z_$][\w$]*(?:Root|Dir|DIR|Base|BASE|dir|base))\s*\+/g;
+      const out = [];
+      let m;
+      while ((m = guard.exec(clean))) {
+        // ...that is never accompanied by a realpath anywhere in the file.
+        if (/realpathSync|realpath\(/.test(clean)) continue;
+        // ...and the file actually touches the filesystem with that path.
+        if (!/fs\.(?:readFileSync|readdirSync|writeFileSync|createReadStream|openSync|statSync)/.test(clean)) continue;
+        out.push({ line: lineOf(clean, m.index), evidence: `startsWith(${m[1]} + ...) with no realpath in the file` });
+      }
+      return out;
+    },
+  },
+
+  {
+    id: 'prototype-key-map',
+    severity: 'high',
+    confirmed: 1,
+    title: 'Plain object used as a map keyed by user-controlled text',
+    why:
+      'map["constructor"] returns Object.prototype.constructor, which is TRUTHY, so an ' +
+      'if (!map[k]) guard never fires and the next line reads a property off a function. ' +
+      '"constructor" and "toString" are ordinary vocabulary — this needs no attacker.',
+    fix: 'Use Object.create(null) for any map keyed by tokens, tags, headers, or filenames.',
+    detect(src) {
+      const clean = stripNoise(src);
+      const out = [];
+      // The exact shape: guard-then-index on a dynamically keyed map.
+      const re = /if\s*\(\s*!\s*([A-Za-z_$][\w$.]*)\[\s*([A-Za-z_$][\w$]*)\s*\]\s*\)/g;
+      let m;
+      while ((m = re.exec(clean))) {
+        const [, map, key] = m;
+        // A numeric-looking key (i, idx, n) is an array index, not a text map.
+        if (/^(?:i|j|k|n|idx|index)$/.test(key)) continue;
+        // Fires only when the map is never given a null prototype.
+        if (new RegExp(`${map.split('.').pop()}\\s*=\\s*Object\\.create\\(null\\)`).test(clean)) continue;
+        if (/Object\.create\(null\)/.test(clean) && new RegExp(`${map.split('.').pop()}:\\s*nullMap`).test(clean)) continue;
+        out.push({ line: lineOf(clean, m.index), evidence: `if (!${map}[${key}]) — ${map} is keyed by a dynamic value and has a prototype` });
+      }
+      return out;
+    },
+  },
+
+  {
+    id: 'truncate-then-write',
+    severity: 'medium',
+    confirmed: 3,
+    title: 'fs.writeFileSync used to replace persistent state',
+    why:
+      "writeFileSync opens with 'w', truncating the file to zero BEFORE writing. A crash, " +
+      'a full disk, or a concurrent reader sees an empty file — measured at 0 bytes on a ' +
+      '6.3 MB store, 32 torn reads in 1423 samples.',
+    fix: 'Write to a temp sibling and rename, or use safeFs.replaceFilePreservingMode.',
+    detect(src) {
+      const clean = stripNoise(src);
+      const out = [];
+      const re = /fs\.writeFileSync\(\s*([A-Za-z_$][\w$.]*)/g;
+      let m;
+      while ((m = re.exec(clean))) {
+        const target = m[1];
+        // A temp file being written before a rename is the CORRECT pattern.
+        if (/tmp|temp/i.test(target)) continue;
+        // Only a module-level constant or a PATHS.x member reads as durable
+        // user state. A local `filePath` loop variable is usually generated
+        // output — regenerable, and truncating it costs nothing. Matching those
+        // made this fire on half the CI scripts, which is how a scanner earns
+        // its mute button.
+        const durable = /^[A-Z][A-Z0-9_]*$/.test(target) || /^PATHS\.[a-z]/i.test(target);
+        if (!durable) continue;
+        if (/renameSync/.test(clean)) continue;   // already doing temp+rename
+        out.push({ line: lineOf(clean, m.index), evidence: `fs.writeFileSync(${target}, ...) with no temp+rename in the file` });
+      }
+      return out;
+    },
+  },
+
+  // REMOVED: 'unbounded-quantifier' (ReDoS).
+  //
+  // The class is real — an unbounded negated class cost 7.6 s on 293 KB — but it
+  // cannot be detected statically with acceptable precision. Arena run #1
+  // MEASURED five structurally identical regexes in one file: the fenced-code,
+  // inline-code, bare-URL and file-path patterns were all linear, and only the
+  // link-target pattern was quadratic. The difference is whether the closing
+  // delimiter is commonly absent in real input — a property of the data, not of
+  // the pattern, and invisible to a scanner.
+  //
+  // A detector here would have flagged all five and been wrong about four. A
+  // scanner that is wrong four times out of five gets muted, and a muted scanner
+  // protects nothing. ReDoS stays where it was actually caught: measurement,
+  // under /arena, with a doubling ladder.
+
+  {
+    id: 'predictable-temp-name',
+    severity: 'low',
+    confirmed: 1,
+    title: 'Temp filename derived from the process id',
+    why:
+      'A predictable temp name lets another process pre-plant a symlink there and capture ' +
+      'the write. It also collides between concurrent runs.',
+    fix: 'Use crypto.randomBytes for the suffix and create with O_EXCL.',
+    detect(src) {
+      const clean = stripNoise(src);
+      const out = [];
+      const re = /process\.pid/g;
+      let m;
+      while ((m = re.exec(clean))) {
+        const around = clean.slice(Math.max(0, m.index - 160), m.index + 80);
+        if (!/tmp|temp|\.lock|pidfile|pidFile/i.test(around)) continue;
+        if (/pidFile|pidfile/i.test(around)) continue;   // writing a real pidfile is fine
+        out.push({ line: lineOf(clean, m.index), evidence: 'temp path built from process.pid' });
+      }
+      return out;
+    },
+  },
+
+  // REMOVED: 'unbounded-input'.
+  //
+  // The class is real — 4.9 MB of dense input allocated ~417 MB and OOMed under
+  // a 256 MB heap — but the detectable shape is "this module reads a file",
+  // which described 57 of 165 files here. The actual bug is reading UNTRUSTED
+  // input with no cap, and a scanner cannot tell which reads are untrusted.
+  //
+  // Kept as a review question for security-reviewer and code-reviewer, where a
+  // human can judge the trust boundary, rather than as a detector that flags a
+  // third of every codebase it touches.
+];
+
+function detectorById(id) {
+  return DETECTORS.find((d) => d.id === id) || null;
+}
+
+// Run every detector over one file's source.
+function scanSource(src, file = '<source>') {
+  const findings = [];
+  for (const d of DETECTORS) {
+    let hits = [];
+    try {
+      hits = d.detect(src) || [];
+    } catch {
+      continue;   // a detector must never take the scan down with it
+    }
+    for (const h of hits) {
+      findings.push({
+        detector: d.id,
+        severity: d.severity,
+        title: d.title,
+        file,
+        line: h.line,
+        evidence: h.evidence,
+        why: d.why,
+        fix: d.fix,
+        confirmedByArena: d.confirmed,
+      });
+    }
+  }
+  return findings;
+}
+
+module.exports = { DETECTORS, detectorById, scanSource, _internals: { stripNoise, lineOf } };

package/scripts/immune/scan.js

@@ -0,0 +1,99 @@
+// scripts/immune/scan.js
+//
+// Walk a tree and apply every arena-derived detector to it.
+//
+// The arena finds bugs one repository at a time and remembers them as prose.
+// This turns that memory into something executable, so a class confirmed here
+// can be found anywhere — including in the repositories of people who never ran
+// the arena at all.
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { scanSource, DETECTORS } = require('./detectors');
+
+const SKIP_DIRS = new Set([
+  'node_modules', '.git', 'dist', 'build', 'coverage', '.next',
+  'out', 'vendor', '__pycache__', '.cache', 'tmp',
+]);
+
+// Tests deliberately contain the buggy shapes they guard against, so scanning
+// them reports the fixtures rather than the code that ships.
+function isSkippable(rel) {
+  return /(?:^|[\\/])(?:tests?|__tests__|spec)[\\/]/.test(rel) || /\.(?:test|spec)\.[cm]?js$/.test(rel);
+}
+
+function walk(root, { includeTests = false, maxFiles = 5000 } = {}) {
+  const out = [];
+  const stack = [root];
+  while (stack.length && out.length < maxFiles) {
+    const dir = stack.pop();
+    let entries;
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      continue;   // unreadable directory is not a scan failure
+    }
+    for (const e of entries) {
+      const abs = path.join(dir, e.name);
+      if (e.isSymbolicLink()) continue;         // never follow links out of the tree
+      if (e.isDirectory()) {
+        if (!SKIP_DIRS.has(e.name)) stack.push(abs);
+        continue;
+      }
+      if (!/\.[cm]?js$/.test(e.name)) continue;
+      const rel = path.relative(root, abs);
+      if (!includeTests && isSkippable(rel)) continue;
+      out.push(abs);
+      // The cap has to be enforced HERE, not only between directories — a single
+      // large directory would otherwise push every entry before the outer loop
+      // re-checked, and maxFiles would not actually cap anything.
+      if (out.length >= maxFiles) return out.sort();
+    }
+  }
+  return out.sort();
+}
+
+const SEVERITY_RANK = { high: 3, medium: 2, low: 1 };
+
+function scanTree(root, opts = {}) {
+  const absRoot = path.resolve(root);
+  const files = walk(absRoot, opts);
+  const findings = [];
+  let scanned = 0;
+
+  for (const abs of files) {
+    let src;
+    try {
+      src = fs.readFileSync(abs, 'utf8');
+    } catch {
+      continue;
+    }
+    scanned++;
+    for (const f of scanSource(src, path.relative(absRoot, abs))) findings.push(f);
+  }
+
+  findings.sort((a, b) =>
+    (SEVERITY_RANK[b.severity] || 0) - (SEVERITY_RANK[a.severity] || 0) ||
+    a.file.localeCompare(b.file) || a.line - b.line);
+
+  const byDetector = {};
+  for (const f of findings) byDetector[f.detector] = (byDetector[f.detector] || 0) + 1;
+
+  return {
+    root: absRoot,
+    scanned,
+    detectors: DETECTORS.length,
+    findings,
+    byDetector,
+    counts: {
+      total: findings.length,
+      high: findings.filter((f) => f.severity === 'high').length,
+      medium: findings.filter((f) => f.severity === 'medium').length,
+      low: findings.filter((f) => f.severity === 'low').length,
+    },
+  };
+}
+
+module.exports = { scanTree, walk, isSkippable, SKIP_DIRS };

package/scripts/lib/agent-compress.js

@@ -2,6 +2,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const safeFs = require('./safe-fs.js');
 
 /**
  * Parse YAML frontmatter from a markdown string.
@@ -222,9 +223,11 @@ function lazyLoadAgent(agentsDir, agentName) {
 
   const filePath = path.resolve(agentsDir, `${agentName}.md`);
 
-  // Verify the resolved path is still within agentsDir
-  const resolvedAgentsDir = path.resolve(agentsDir);
-  if (!filePath.startsWith(resolvedAgentsDir + path.sep)) {
+  // Containment, including symlinks. The previous check compared the JOINED
+  // path, which for a symlink is the link's own location — inside agentsDir, so
+  // it passed — while the target could be anywhere. Found by `kodelythecc
+  // immune`, which encodes this class from five prior arena confirmations.
+  if (!safeFs.resolveContained(filePath, agentsDir)) {
     return null;
   }
 

package/scripts/lib/package-manager.js

@@ -239,7 +239,7 @@ function getPackageManager(options = {}) {
  * Set user's preferred package manager (global)
  */
 function setPreferredPackageManager(pmName) {
-  if (!PACKAGE_MANAGERS[pmName]) {
+  if (!Object.hasOwn(PACKAGE_MANAGERS, pmName)) {
     throw new Error(`Unknown package manager: ${pmName}`);
   }
 
@@ -260,7 +260,7 @@ function setPreferredPackageManager(pmName) {
  * Set project's preferred package manager
  */
 function setProjectPackageManager(pmName, projectDir = process.cwd()) {
-  if (!PACKAGE_MANAGERS[pmName]) {
+  if (!Object.hasOwn(PACKAGE_MANAGERS, pmName)) {
     throw new Error(`Unknown package manager: ${pmName}`);
   }
 

package/scripts/lib/safe-fs.js

@@ -69,6 +69,49 @@ function resolveContained(candidate, root, { allowExact = null } = {}) {
   return abs;
 }
 
+/**
+ * Confirm a path that does not exist yet still resolves inside `root`.
+ *
+ * `resolveContained` cannot answer this: it realpaths the target, which fails
+ * for a file about to be created. So walk up to the nearest ancestor that DOES
+ * exist, canonicalise that, and re-check — which still catches a symlinked
+ * parent directory pointing out of the root.
+ *
+ * Returns the resolved absolute path, or null if it escapes.
+ */
+function resolveContainedForWrite(candidate, root) {
+  if (!candidate || !root) return null;
+
+  const absRoot = path.resolve(root);
+  // path.resolve(root, '/abs/path') returns '/abs/path' — an absolute candidate
+  // discards the root entirely, so it must be rejected up front rather than
+  // joined and hoped about.
+  const abs = path.isAbsolute(candidate) ? path.resolve(candidate) : path.resolve(absRoot, candidate);
+
+  if (abs !== absRoot && !abs.startsWith(absRoot + path.sep)) return null;
+
+  // The lexical check above is defeated by a symlinked ancestor, so canonicalise
+  // the deepest directory that actually exists and confirm it is still inside.
+  let probe = path.dirname(abs);
+  while (probe !== path.dirname(probe) && !fs.existsSync(probe)) probe = path.dirname(probe);
+
+  let realProbe;
+  try {
+    realProbe = fs.realpathSync(probe);
+  } catch {
+    return null;
+  }
+  let realRoot;
+  try {
+    realRoot = fs.realpathSync(absRoot);
+  } catch {
+    realRoot = absRoot;
+  }
+  if (realProbe !== realRoot && !realProbe.startsWith(realRoot + path.sep)) return null;
+
+  return abs;
+}
+
 /**
  * Stat a path that must be a regular file, refusing symlinks outright.
  *
@@ -173,6 +216,7 @@ function replaceFilePreservingMode(absPath, contents, fallbackMode = 0o644) {
 
 module.exports = {
   resolveContained,
+  resolveContainedForWrite,
   statRegularFile,
   safeConfigDir,
   writeNewFile,

package/scripts/lib/session-aliases.js

@@ -281,7 +281,7 @@ function listAliases(options = {}) {
 function deleteAlias(alias) {
   const data = loadAliases();
 
-  if (!data.aliases[alias]) {
+  if (!Object.hasOwn(data.aliases, alias)) {
     return { success: false, error: `Alias '${alias}' not found` };
   }
 
@@ -308,7 +308,7 @@ function deleteAlias(alias) {
 function renameAlias(oldAlias, newAlias) {
   const data = loadAliases();
 
-  if (!data.aliases[oldAlias]) {
+  if (!Object.hasOwn(data.aliases, oldAlias)) {
     return { success: false, error: `Alias '${oldAlias}' not found` };
   }
 
@@ -386,7 +386,7 @@ function updateAliasTitle(alias, title) {
 
   const data = loadAliases();
 
-  if (!data.aliases[alias]) {
+  if (!Object.hasOwn(data.aliases, alias)) {
     return { success: false, error: `Alias '${alias}' not found` };
   }
 

package/scripts/lib/skill-improvement/health.js

@@ -15,7 +15,7 @@ function rankCounts(values) {
 function summarizeVariantRuns(records) {
   return records.reduce((accumulator, record) => {
     const key = record.run && record.run.variant ? record.run.variant : 'baseline';
-    if (!accumulator[key]) {
+    if (!Object.hasOwn(accumulator, key)) {
       accumulator[key] = { runs: 0, successes: 0, failures: 0 };
     }
 

package/scripts/mcp/client.js

@@ -80,7 +80,7 @@ function addServer({ name, command, args = [], env = {}, description = '' }) {
 
 function removeServer(name) {
   const reg = loadRegistry();
-  if (!reg.servers[name]) return false;
+  if (!Object.hasOwn(reg.servers, name)) return false;
   delete reg.servers[name];
   saveRegistry(reg);
   return true;

package/scripts/memory/store.js

@@ -154,7 +154,7 @@ function restampIndex() {
     if (!fs.existsSync(PATHS.index)) return;
     const idx = JSON.parse(fs.readFileSync(PATHS.index, 'utf8'));
     idx.logSize = logSize();
-    fs.writeFileSync(PATHS.index, JSON.stringify(idx, null, 2));
+    safeFs.replaceFilePreservingMode(PATHS.index, JSON.stringify(idx, null, 2));
   } catch { /* a broken index is rebuilt on the next load anyway */ }
 }
 

package/scripts/setup-package-manager.js

@@ -113,7 +113,7 @@ function listAvailable() {
 }
 
 function setGlobal(pmName) {
-  if (!PACKAGE_MANAGERS[pmName]) {
+  if (!Object.hasOwn(PACKAGE_MANAGERS, pmName)) {
     console.error(`Error: Unknown package manager "${pmName}"`);
     console.error(`Available: ${Object.keys(PACKAGE_MANAGERS).join(', ')}`);
     process.exit(1);
@@ -136,7 +136,7 @@ function setGlobal(pmName) {
 }
 
 function setProject(pmName) {
-  if (!PACKAGE_MANAGERS[pmName]) {
+  if (!Object.hasOwn(PACKAGE_MANAGERS, pmName)) {
     console.error(`Error: Unknown package manager "${pmName}"`);
     console.error(`Available: ${Object.keys(PACKAGE_MANAGERS).join(', ')}`);
     process.exit(1);