kodelyth-ecc 2.24.2 → 2.24.4

package/CHANGELOG.md

@@ -2,6 +2,125 @@
 
 All notable changes to Kodelyth ECC are documented here.
 
+## v2.24.4 — fix catastrophic backtracking in the prompt-injection guard (October 2026)
+
+**Security fix.** The guard that scans untrusted text for prompt injection could
+be hung indefinitely by the text it was scanning.
+
+### What was wrong
+
+`override-prior-instructions` — the critical-severity pattern matching the single
+most common injection phrase — was written as
+
+    \s+ (group)? \s* (group)? \s*
+
+Three whitespace quantifiers with optional groups between them. With both groups
+matching empty they sat adjacent, so a run of N spaces could be partitioned
+between them in O(N^2) ways, and every partition was retried once the trailing
+noun failed to match. On `"ignore" + N spaces + "x"`:
+
+| N | time |
+|---|---|
+| 2,000 | 1.5s |
+| 4,000 | 12.5s |
+| 8,000 | never observed to finish |
+| 19,000 | never observed to finish |
+
+The guard caps input at 20,000 characters, so the cap does not help: the blow-up
+begins around N=2,000, well inside it. Confirmed end to end through the hook's own
+stdin path with the payload delivered in `tool_response`, which is where
+untrusted file and network content arrives.
+
+### Why it is more than a hang
+
+This hook runs on every tool call and is fail-open by design. In the default
+`warn` mode the session stalls until the harness kills the hook, and no warning is
+ever emitted. In `block` mode it is worse: a guard that never returns never exits
+2, so the critical pattern it exists to catch goes unblocked. The denial of
+service doubles as a bypass of the control itself.
+
+### The fix
+
+Each optional segment now carries its own leading `\s+` inside the group —
+`(?:\s+X)?` rather than `\s+(X)?\s*` — so a whitespace run has exactly one valid
+partition and there is nothing to backtrack through. The pattern now takes 4.8ms
+at the full 20,000-character cap, and stays linear beyond it: 3.9ms on a million
+spaces.
+
+`system-prompt-leak` carried the same shape one group shallower, making it
+quadratic rather than catastrophic (~590ms at 32,000 spaces, ~200ms at the cap).
+Not a denial of service today, but the identical defect and one optional group
+away from becoming one, so it is rewritten the same way. The other ten patterns
+were swept with trigger words they actually match and are unaffected (4-5ms at
+the cap).
+
+### Detection is unchanged
+
+Verified rather than assumed. Both rewrites were checked against every phrase
+their grammars generate — 1,140 for the first, 483 for the second — and agree
+with the originals on all 1,623, with no phrase matched by one and not the other.
+
+New tests cover the detections that must still fire, the ordinary text that must
+not, and the timing. The timing test runs in a child process with a hard timeout
+on purpose: a catastrophic regex is synchronous and CPU-bound, so node:test's own
+timeout cannot interrupt it — against the old pattern the assertion was never
+reached and the suite simply hung, which is a red build with no explanation. The
+child turns the same regression into a named failure. Verified in both
+directions: the old regex is killed at 15s with `ETIMEDOUT`, the new one finishes
+in 59ms.
+
+**668 tests across 43 files.**
+
+## v2.24.3 — remove decorative emoji from docs and catalog (October 2026)
+
+Documentation only. No code, no behaviour change.
+
+`rules/common/coding-style.md` bans decorative emoji and names the permitted
+status indicators: `PASS`/`FAIL` or the text characters `✓` (U+2713) and `✗`
+(U+2717). Three shipped files were not following it.
+
+### README comparison table
+
+39 emoji across 11 rows replaced with `✓` / `✗`.
+
+This also fixed a polarity bug the emoji were hiding. In every row `❌` meant
+"lacks this", where lacking it is the bad outcome. In the telemetry row it meant
+"none", where none is the *good* outcome — so one glyph carried opposite meanings
+in the same column, and ECC's `❌` sat beside a competitor's `❌` looking like
+agreement while reading as praise and criticism. A mechanical swap would have
+preserved that, so the row now states the value instead of a verdict:
+
+    | Telemetry | **None** | Varies | None | Varies |
+
+### Agent and command bodies
+
+10 decorative `❌` prefixes removed from bullet lists in
+`agents/chaos-engineer.md` and `commands/devil-mode.md`. Dropped rather than
+swapped for `✗`: both lists sit under headings that already state the negation —
+"What You DON'T Do" and "When NOT to Use" — so every bullet was marked negative
+twice.
+
+These two files were also the upstream source of the emoji appearing on the
+website. `ecc-web` syncs agent bodies into `src/lib/agents.json`, so the site
+inherited them and could not be fixed there; a site-side edit would be
+overwritten by the next sync.
+
+### Deliberately left alone
+
+`rules/common/coding-style.md` still contains `✅ 🔍 🎯 🚀 ❌`. Every one sits in
+the **Wrong** column of the table teaching which emoji not to use. They are
+quoted specimens, not decoration — stripping them would empty the column and
+leave the rule unable to demonstrate its own point. Future emoji sweeps should
+skip that file.
+
+The `←  ↑  ↓  ⚙` in README.md are also kept. They sit inside terminal-output code
+blocks and reproduce what the CLI actually prints — the gear comes from
+`scripts/cli/menu.js:243`. Changing them would make the README stop matching the
+tool.
+
+Catalog parsing verified unchanged: 70 agents, 103 commands, frontmatter intact.
+**665 tests across 43 files.**
+
 ## v2.24.2 — adversarial pass: path traversal in get_rule, unrecallable memories (October 2026)
 
 **Security fix.** Three defects found by attacking the memory store, MCP server

package/CLAUDE.md

@@ -26,7 +26,7 @@ scripts/     → Node.js utilities: MCP server, dashboard, swarm, replay, router
 bundles/     → 3 power bundles (indie-hacker, red-team, enterprise)
 actions/     → GitHub Action (CI/CD integration for PR review)
 docs/        → Feature docs (arena.md, mcp.md, dashboard.md, swarm.md, replay.md, evolve.md, supply-chain.md)
-tests/       → 665 passing tests across 43 test files
+tests/       → 668 passing tests across 43 test files
 ```
 
 ## Running Tests

package/README.md

@@ -107,18 +107,18 @@ Most "AI agent kits" are folders of markdown files you have to remember the name
 | Feature | **Kodelyth ECC** | `agency-agents` | `awesome-claude-agents` | Generic prompt libs |
 |---|---|---|---|---|
 | Specialist agents | **70** | ~30 | ~20 | Varies |
-| Skills as separate layer | ✅ 196 | ❌ | ❌ | ❌ |
-| Slash commands | ✅ 103 | Some | Some | ❌ |
-| **Parallel multi-agent commands** | ✅ 8 (incl. `/devil-mode`) | ❌ | ❌ | ❌ |
-| **Intent routing (plain language → agent)** | ✅ 10-tier rule | ❌ | ❌ | ❌ |
-| **Local BM25 self-learning memory** | ✅ | ❌ | ❌ | ❌ |
-| **Compound learning from corrections** | ✅ `tasks/lessons.md` | ❌ | ❌ | ❌ |
-| **Adversarial / red-team agents** | ✅ 8 (devil-mode) | ❌ | ❌ | ❌ |
-| **Adversarial build/attack loop** | ✅ `/arena` — scored, verified, converges | ❌ | ❌ | ❌ |
-| Quality hooks | ✅ 44 | Some | ❌ | ❌ |
+| Skills as separate layer | ✓ 196 | ✗ | ✗ | ✗ |
+| Slash commands | ✓ 103 | Some | Some | ✗ |
+| **Parallel multi-agent commands** | ✓ 8 (incl. `/devil-mode`) | ✗ | ✗ | ✗ |
+| **Intent routing (plain language → agent)** | ✓ 10-tier rule | ✗ | ✗ | ✗ |
+| **Local BM25 self-learning memory** | ✓ | ✗ | ✗ | ✗ |
+| **Compound learning from corrections** | ✓ `tasks/lessons.md` | ✗ | ✗ | ✗ |
+| **Adversarial / red-team agents** | ✓ 8 (devil-mode) | ✗ | ✗ | ✗ |
+| **Adversarial build/attack loop** | ✓ `/arena` — scored, verified, converges | ✗ | ✗ | ✗ |
+| Quality hooks | ✓ 44 | Some | ✗ | ✗ |
 | IDE platforms | **11** (Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, Roo Code, Aider, Kimi, Gemini CLI) | 1-2 | 1 | Varies |
-| Telemetry | ❌ none | Varies | ❌ | Varies |
-| Test coverage | ✅ 665 tests | ❌ | ❌ | ❌ |
+| Telemetry | **None** | Varies | None | Varies |
+| Test coverage | ✓ 668 tests | ✗ | ✗ | ✗ |
 | Distributed via | `npx`, curl, clone | Manual | Manual | Manual |
 
 ---

package/agents/chaos-engineer.md

@@ -173,13 +173,13 @@ curl -X POST localhost:3000/admin/flags/new-feature --data '{"enabled":true}'
 
 ## What You DON'T Do
 
-- ❌ Run experiments in production without an SRE on call and explicit sign-off
-- ❌ Touch production data without an explicit backup and tested restore
-- ❌ Cause unbounded blast radius (kill all services, all regions, all replicas)
-- ❌ Run during high-traffic events (peak hours, launches, marketing campaigns)
-- ❌ Run without monitoring (chaos without observability is just sabotage)
-- ❌ Continue past abort criteria — if abort fires, abort, no exceptions
-- ❌ Inject faults into systems you don't own without coordination
+- Run experiments in production without an SRE on call and explicit sign-off
+- Touch production data without an explicit backup and tested restore
+- Cause unbounded blast radius (kill all services, all regions, all replicas)
+- Run during high-traffic events (peak hours, launches, marketing campaigns)
+- Run without monitoring (chaos without observability is just sabotage)
+- Continue past abort criteria — if abort fires, abort, no exceptions
+- Inject faults into systems you don't own without coordination
 
 ## Output Format
 

package/commands/devil-mode.md

@@ -83,9 +83,9 @@ PRIORITIZED ACTIONS:
 
 ## When NOT to Use
 
-- ❌ On code you don't have permission to audit (run only on your own repos / authorized targets)
-- ❌ On production systems for `chaos-engineer` flag — chaos requires `--staging` or signed-off blast radius
-- ❌ As a substitute for actual security review — this finds patterns; humans verify exploitability
+- On code you don't have permission to audit (run only on your own repos / authorized targets)
+- On production systems for `chaos-engineer` flag — chaos requires `--staging` or signed-off blast radius
+- As a substitute for actual security review — this finds patterns; humans verify exploitability
 
 ## Execute Now
 

package/hooks/safety/lib/patterns.js

@@ -20,13 +20,28 @@ const PATTERNS = [
   {
     id: 'override-prior-instructions',
     severity: 'critical',
-    regex: /\b(ignore|disregard|forget)\s+(all|any|the|your|my|all\s+(?:prior|previous|above|earlier))?\s*(prior|previous|above|earlier|prev|preceding)?\s*(instructions?|rules?|prompt|system\s*prompt|directives?)\b/i,
+    // Each optional segment carries its own leading \s+, so a run of whitespace
+    // has exactly ONE valid partition. The previous form was
+    //   \s+ (group)? \s* (group)? \s*
+    // — three whitespace quantifiers with optional groups between them. When both
+    // groups matched empty they sat adjacent, so N spaces could be split between
+    // them in O(N^2) ways, and every split was retried once the final noun failed
+    // to match. Measured on "ignore" + N spaces + "x": 1.5s at N=2000, 12.5s at
+    // N=4000, over 40s at N=8000 — all well inside this hook's own 20000-char
+    // input cap, and reachable through tool_response, which carries untrusted
+    // file and network content. Verified equivalent across 1140 generated phrases.
+    regex: /\b(?:ignore|disregard|forget)(?:\s+(?:all|any|the|your|my))?(?:\s+(?:prior|previous|above|earlier|prev|preceding))?\s+(?:instructions?|rules?|system\s*prompt|prompt|directives?)\b/i,
     why:   'Classic instruction-override prompt injection.',
   },
   {
     id: 'system-prompt-leak',
     severity: 'critical',
-    regex: /\b(reveal|print|show|repeat|output|dump|leak|expose)\s+(your|the|all|any)?\s*(system\s*prompt|hidden\s*prompt|initial\s*(prompt|instructions?)|original\s*(prompt|instructions?)|first\s*(message|prompt|instruction))/i,
+    // Same adjacent-quantifier shape as above, one group shallower, so quadratic
+    // rather than catastrophic: ~590ms at 32000 spaces, ~200ms at the 20000 cap.
+    // Not a denial of service today, but the identical defect, and it would become
+    // one the moment another optional group is added. Verified equivalent across
+    // 483 generated phrases.
+    regex: /\b(?:reveal|print|show|repeat|output|dump|leak|expose)(?:\s+(?:your|the|all|any))?\s+(?:system\s*prompt|hidden\s*prompt|initial\s*(?:prompt|instructions?)|original\s*(?:prompt|instructions?)|first\s*(?:message|prompt|instruction))/i,
     why:   'Explicit attempt to extract the system prompt.',
   },
   {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kodelyth-ecc",
-  "version": "2.24.2",
+  "version": "2.24.4",
   "description": "Production-grade AI coding toolkit — 70 agents (incl. devil-mode adversarial crew), 196 skills, 103 commands, parallel multi-agent commands, semantic intent routing, self-learning memory, and a built-in MCP server (16 tools / 6 prompts / 377 resources) that bridges to Claude Desktop, LangGraph, AutoGen, CrewAI, and OpenAI Agents SDK. Works on macOS, Linux and Windows with Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, RooCode, Aider, Kimi, and Gemini CLI.",
   "author": "Kodelyth <github.com/sifxprime>",
   "license": "MIT",