kodelyth-ecc 2.24.1 → 2.24.3

package/CHANGELOG.md

@@ -2,6 +2,118 @@
 
 All notable changes to Kodelyth ECC are documented here.
 
+## v2.24.3 — remove decorative emoji from docs and catalog (October 2026)
+
+Documentation only. No code, no behaviour change.
+
+`rules/common/coding-style.md` bans decorative emoji and names the permitted
+status indicators: `PASS`/`FAIL` or the text characters `✓` (U+2713) and `✗`
+(U+2717). Three shipped files were not following it.
+
+### README comparison table
+
+39 emoji across 11 rows replaced with `✓` / `✗`.
+
+This also fixed a polarity bug the emoji were hiding. In every row `❌` meant
+"lacks this", where lacking it is the bad outcome. In the telemetry row it meant
+"none", where none is the *good* outcome — so one glyph carried opposite meanings
+in the same column, and ECC's `❌` sat beside a competitor's `❌` looking like
+agreement while reading as praise and criticism. A mechanical swap would have
+preserved that, so the row now states the value instead of a verdict:
+
+    | Telemetry | **None** | Varies | None | Varies |
+
+### Agent and command bodies
+
+10 decorative `❌` prefixes removed from bullet lists in
+`agents/chaos-engineer.md` and `commands/devil-mode.md`. Dropped rather than
+swapped for `✗`: both lists sit under headings that already state the negation —
+"What You DON'T Do" and "When NOT to Use" — so every bullet was marked negative
+twice.
+
+These two files were also the upstream source of the emoji appearing on the
+website. `ecc-web` syncs agent bodies into `src/lib/agents.json`, so the site
+inherited them and could not be fixed there; a site-side edit would be
+overwritten by the next sync.
+
+### Deliberately left alone
+
+`rules/common/coding-style.md` still contains `✅ 🔍 🎯 🚀 ❌`. Every one sits in
+the **Wrong** column of the table teaching which emoji not to use. They are
+quoted specimens, not decoration — stripping them would empty the column and
+leave the rule unable to demonstrate its own point. Future emoji sweeps should
+skip that file.
+
+The `←  ↑  ↓  ⚙` in README.md are also kept. They sit inside terminal-output code
+blocks and reproduce what the CLI actually prints — the gear comes from
+`scripts/cli/menu.js:243`. Changing them would make the README stop matching the
+tool.
+
+Catalog parsing verified unchanged: 70 agents, 103 commands, frontmatter intact.
+**665 tests across 43 files.**
+
+## v2.24.2 — adversarial pass: path traversal in get_rule, unrecallable memories (October 2026)
+
+**Security fix.** Three defects found by attacking the memory store, MCP server
+and dashboard rather than reading them.
+
+### `get_rule` returned any markdown file on the machine
+
+`loadRule` was the only catalog loader that built a filesystem path out of its
+argument. Every other loader — agents, skills, commands, bundles — enumerates a
+directory and matches by name, so a caller can only ever select something already
+listed. This one did `path.join(PATHS.rules, name + '.md')`, so:
+
+    get_rule("../../README")              -> 51,297 bytes of ROOT/README.md
+    get_rule("testing/../../../README")   -> same, via nested traversal
+
+The `.md` suffix was the only thing bounding the reach, which left every readable
+markdown file on the machine in scope.
+
+This matters because the caller is not always the user. An MCP tool argument can
+originate in text the agent merely read — a dependency README, an issue comment,
+a fetched page — which made this an arbitrary-markdown-read primitive reachable
+by prompt injection. That is exactly the class ECC's own `prompt-injection-hunter`
+agent exists to catch.
+
+Fixed with two guards that fail differently: a name pattern that rejects anything
+that is a path rather than a name before touching disk, and the existing
+`resolveContained()` from `scripts/lib/safe-fs.js`, which proves the target sits
+under `rules/common` once symlinks resolve. The pattern alone is not enough —
+`escape-probe` is a valid rule name, and a symlink under that name reads 51KB.
+
+`loadRule` had no test coverage at all, which is why this survived. It now has
+four tests, including the symlink case.
+
+### One memory was mathematically unrecallable
+
+`search()` defaulted to an absolute `minScore` of 0.5 against unnormalised BM25
+scores. BM25 IDF is `log(1 + (N - df + 0.5) / (df + 0.5))`, so a term appearing in
+every memory drives IDF toward zero and can never clear a fixed floor at any
+corpus size. The floor is now relative to the top hit, so it scales with the
+corpus instead of fighting it. An explicitly passed `minScore` is still honoured
+exactly. `recall_memory` passes none, so it was using the broken default.
+
+### Malformed request URIs returned 500 and wrote to stderr
+
+`decodeURIComponent` throws on `/%`, `/%zz` or a truncated `/%e0%a4`. The dashboard
+did not guard it, so a malformed *client* URI became a 500 "internal server error"
+plus one stderr line per request — meaning any local process could spam the
+terminal the dashboard runs in. A path that cannot be decoded names no file, so
+it is now a 404 like any other miss.
+
+### What resisted
+
+Worth recording, since the absence of findings was tested rather than assumed.
+Dashboard traversal (plain, encoded, double-encoded, backslash, absolute,
+null-byte) all returned 404. Host validation rejects absent, empty and foreign
+`Host` headers. Non-GET is 405. Stored XSS was tested in a real browser: a memory
+captured through the real store with breakout payloads in problem, approach, tags,
+language and project rendered as visible text, setting no global, creating no
+element and no attribute, with the `</pre>` breakout still inside its `<pre>`.
+
+**665 tests across 43 files.**
+
 ## v2.24.1 — verify Windows downloads before running them (October 2026)
 
 **Security fix.** The Windows installer added in 2.23.0 downloaded a release zip

package/CLAUDE.md

@@ -26,7 +26,7 @@ scripts/     → Node.js utilities: MCP server, dashboard, swarm, replay, router
 bundles/     → 3 power bundles (indie-hacker, red-team, enterprise)
 actions/     → GitHub Action (CI/CD integration for PR review)
 docs/        → Feature docs (arena.md, mcp.md, dashboard.md, swarm.md, replay.md, evolve.md, supply-chain.md)
-tests/       → 656 passing tests across 43 test files
+tests/       → 665 passing tests across 43 test files
 ```
 
 ## Running Tests

package/README.md

@@ -107,18 +107,18 @@ Most "AI agent kits" are folders of markdown files you have to remember the name
 | Feature | **Kodelyth ECC** | `agency-agents` | `awesome-claude-agents` | Generic prompt libs |
 |---|---|---|---|---|
 | Specialist agents | **70** | ~30 | ~20 | Varies |
-| Skills as separate layer | ✅ 196 | ❌ | ❌ | ❌ |
-| Slash commands | ✅ 103 | Some | Some | ❌ |
-| **Parallel multi-agent commands** | ✅ 8 (incl. `/devil-mode`) | ❌ | ❌ | ❌ |
-| **Intent routing (plain language → agent)** | ✅ 10-tier rule | ❌ | ❌ | ❌ |
-| **Local BM25 self-learning memory** | ✅ | ❌ | ❌ | ❌ |
-| **Compound learning from corrections** | ✅ `tasks/lessons.md` | ❌ | ❌ | ❌ |
-| **Adversarial / red-team agents** | ✅ 8 (devil-mode) | ❌ | ❌ | ❌ |
-| **Adversarial build/attack loop** | ✅ `/arena` — scored, verified, converges | ❌ | ❌ | ❌ |
-| Quality hooks | ✅ 44 | Some | ❌ | ❌ |
+| Skills as separate layer | ✓ 196 | ✗ | ✗ | ✗ |
+| Slash commands | ✓ 103 | Some | Some | ✗ |
+| **Parallel multi-agent commands** | ✓ 8 (incl. `/devil-mode`) | ✗ | ✗ | ✗ |
+| **Intent routing (plain language → agent)** | ✓ 10-tier rule | ✗ | ✗ | ✗ |
+| **Local BM25 self-learning memory** | ✓ | ✗ | ✗ | ✗ |
+| **Compound learning from corrections** | ✓ `tasks/lessons.md` | ✗ | ✗ | ✗ |
+| **Adversarial / red-team agents** | ✓ 8 (devil-mode) | ✗ | ✗ | ✗ |
+| **Adversarial build/attack loop** | ✓ `/arena` — scored, verified, converges | ✗ | ✗ | ✗ |
+| Quality hooks | ✓ 44 | Some | ✗ | ✗ |
 | IDE platforms | **11** (Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, Roo Code, Aider, Kimi, Gemini CLI) | 1-2 | 1 | Varies |
-| Telemetry | ❌ none | Varies | ❌ | Varies |
-| Test coverage | ✅ 656 tests | ❌ | ❌ | ❌ |
+| Telemetry | **None** | Varies | None | Varies |
+| Test coverage | ✓ 665 tests | ✗ | ✗ | ✗ |
 | Distributed via | `npx`, curl, clone | Manual | Manual | Manual |
 
 ---

package/agents/chaos-engineer.md

@@ -173,13 +173,13 @@ curl -X POST localhost:3000/admin/flags/new-feature --data '{"enabled":true}'
 
 ## What You DON'T Do
 
-- ❌ Run experiments in production without an SRE on call and explicit sign-off
-- ❌ Touch production data without an explicit backup and tested restore
-- ❌ Cause unbounded blast radius (kill all services, all regions, all replicas)
-- ❌ Run during high-traffic events (peak hours, launches, marketing campaigns)
-- ❌ Run without monitoring (chaos without observability is just sabotage)
-- ❌ Continue past abort criteria — if abort fires, abort, no exceptions
-- ❌ Inject faults into systems you don't own without coordination
+- Run experiments in production without an SRE on call and explicit sign-off
+- Touch production data without an explicit backup and tested restore
+- Cause unbounded blast radius (kill all services, all regions, all replicas)
+- Run during high-traffic events (peak hours, launches, marketing campaigns)
+- Run without monitoring (chaos without observability is just sabotage)
+- Continue past abort criteria — if abort fires, abort, no exceptions
+- Inject faults into systems you don't own without coordination
 
 ## Output Format
 

package/commands/devil-mode.md

@@ -83,9 +83,9 @@ PRIORITIZED ACTIONS:
 
 ## When NOT to Use
 
-- ❌ On code you don't have permission to audit (run only on your own repos / authorized targets)
-- ❌ On production systems for `chaos-engineer` flag — chaos requires `--staging` or signed-off blast radius
-- ❌ As a substitute for actual security review — this finds patterns; humans verify exploitability
+- On code you don't have permission to audit (run only on your own repos / authorized targets)
+- On production systems for `chaos-engineer` flag — chaos requires `--staging` or signed-off blast radius
+- As a substitute for actual security review — this finds patterns; humans verify exploitability
 
 ## Execute Now
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kodelyth-ecc",
-  "version": "2.24.1",
+  "version": "2.24.3",
   "description": "Production-grade AI coding toolkit — 70 agents (incl. devil-mode adversarial crew), 196 skills, 103 commands, parallel multi-agent commands, semantic intent routing, self-learning memory, and a built-in MCP server (16 tools / 6 prompts / 377 resources) that bridges to Claude Desktop, LangGraph, AutoGen, CrewAI, and OpenAI Agents SDK. Works on macOS, Linux and Windows with Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, RooCode, Aider, Kimi, and Gemini CLI.",
   "author": "Kodelyth <github.com/sifxprime>",
   "license": "MIT",

package/scripts/dashboard/server.js

@@ -151,7 +151,18 @@ function serveStaticFile(res, filePath) {
 // baseDir is injectable so the containment logic can be tested against a real
 // symlink without planting one in the shipped static/ directory.
 function resolveStatic(reqPath, baseDir = STATIC_DIR) {
-  const decoded = decodeURIComponent(reqPath.replace(/^\/+/, ''));
+  // decodeURIComponent throws URIError on malformed percent-encoding — "/%",
+  // "/%zz", a truncated "/%e0%a4". That threw out to the route handler, which
+  // turned a client's malformed URI into a 500 "internal server error" and wrote
+  // a line to stderr, so any local process could both mislabel its own bad
+  // request as a server fault and spam the terminal the dashboard runs in.
+  // A path that cannot be decoded names no file, so it is simply not found.
+  let decoded;
+  try {
+    decoded = decodeURIComponent(reqPath.replace(/^\/+/, ''));
+  } catch {
+    return null;
+  }
   if (decoded.includes('..')) return null;
   if (decoded === '' || decoded === '/') return path.join(baseDir, 'index.html');
   // Containment, including symlink resolution — see scripts/lib/safe-fs.js.

package/scripts/mcp/catalog.js

@@ -8,6 +8,7 @@
 
 const fs   = require('fs');
 const path = require('path');
+const { resolveContained } = require('../lib/safe-fs');
 
 const ROOT = path.join(__dirname, '..', '..');
 
@@ -157,8 +158,28 @@ function loadCommands() {
 }
 
 // ── Rules ────────────────────────────────────────────────────────────────────
+// A rule name is a flat basename: rules/common has no subdirectories, and every
+// other loader here resolves a name against a directory LISTING, so a caller can
+// only ever select something already enumerated. This one built a path out of the
+// argument instead, which made `../../README` read ROOT/README.md — any .md file
+// the process could reach, through a tool whose contract is "return a rule".
+//
+// That matters because the caller is not always the user. An MCP tool argument
+// can originate in text the agent merely read — a dependency's README, an issue
+// comment, a fetched page — so this was an arbitrary-markdown-read primitive
+// reachable by prompt injection, which is exactly what ECC's own
+// prompt-injection-hunter agent exists to catch.
+//
+// Two guards, because they fail differently. The pattern rejects anything that is
+// a path rather than a name, before touching disk. resolveContained then proves
+// the target really sits under rules/common once symlinks are resolved, which a
+// pattern cannot know.
+const RULE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+
 function loadRule(name) {
-  const file = path.join(PATHS.rules, `${name}.md`);
+  if (typeof name !== 'string' || !RULE_NAME.test(name)) return null;
+  const file = resolveContained(path.join(PATHS.rules, `${name}.md`), PATHS.rules);
+  if (file === null) return null;
   const raw = safeReadFile(file);
   if (raw === null) return null;
   return { name, file, relpath: path.relative(ROOT, file), body: raw };

package/scripts/memory/store.js

@@ -185,8 +185,33 @@ function indexMemory(index, memory) {
 }
 
 // ── BM25 retrieval (k1=1.5, b=0.75) ──────────────────────────────────────────
+/**
+ * Fraction of the best hit's score a result must reach to be kept, when the
+ * caller does not impose an absolute floor of its own.
+ *
+ * Relative, not absolute, and that is the whole point. BM25 scores are not
+ * normalised — they scale with corpus size and term rarity — so any fixed
+ * threshold is really a statement about how many memories you have. The old
+ * default of 0.5 made a single stored memory mathematically unrecallable: with
+ * N=1 and df=1 the IDF term caps the score at ~0.288, so recall() returned
+ * nothing no matter what you searched for.
+ *
+ * It was worse for common words. A token appearing in every memory scores
+ * 0.288 at N=1, 0.087 at N=5 and 0.010 at N=50 — correct BM25 behaviour, since
+ * a term that is everywhere carries no signal, but under a fixed floor it meant
+ * those words never matched at any corpus size.
+ *
+ * Three call sites had already worked around this by passing minScore: 0.1
+ * (doctor and two tests, one of which names the ~0.29 figure outright). The
+ * user-facing paths had not: the MCP recall_memory tool, the memory CLI and
+ * SessionStart injection all used the default and silently returned nothing.
+ */
+const RELATIVE_SCORE_FLOOR = 0.25;
+
 function search(query, options = {}) {
-  const { limit = 5, minScore = 0.5, projectFilter = null } = options;
+  // minScore stays honoured when passed, so existing callers keep their exact
+  // behaviour; only the default changes from an absolute floor to a relative one.
+  const { limit = 5, minScore = null, projectFilter = null } = options;
   const index   = loadIndex();
   const tokens  = tokenise(query);
   if (tokens.length === 0 || index.docCount === 0) return [];
@@ -208,9 +233,13 @@ function search(query, options = {}) {
     }
   }
 
-  const ranked = Object.entries(scores)
-    .filter(([, score]) => score >= minScore)
-    .sort(([, a], [, b]) => b - a)
+  const sorted = Object.entries(scores).sort(([, a], [, b]) => b - a);
+  const topScore = sorted.length ? sorted[0][1] : 0;
+  const floor = minScore !== null && minScore !== undefined
+    ? minScore
+    : topScore * RELATIVE_SCORE_FLOOR;
+  const ranked = sorted
+    .filter(([, score]) => score >= floor)
     .slice(0, limit * 3);
 
   if (ranked.length === 0) return [];