kodelyth-ecc 2.24.3 → 2.24.4

package/CHANGELOG.md

@@ -2,6 +2,75 @@
 
 All notable changes to Kodelyth ECC are documented here.
 
+## v2.24.4 — fix catastrophic backtracking in the prompt-injection guard (October 2026)
+
+**Security fix.** The guard that scans untrusted text for prompt injection could
+be hung indefinitely by the text it was scanning.
+
+### What was wrong
+
+`override-prior-instructions` — the critical-severity pattern matching the single
+most common injection phrase — was written as
+
+    \s+ (group)? \s* (group)? \s*
+
+Three whitespace quantifiers with optional groups between them. With both groups
+matching empty they sat adjacent, so a run of N spaces could be partitioned
+between them in O(N^2) ways, and every partition was retried once the trailing
+noun failed to match. On `"ignore" + N spaces + "x"`:
+
+| N | time |
+|---|---|
+| 2,000 | 1.5s |
+| 4,000 | 12.5s |
+| 8,000 | never observed to finish |
+| 19,000 | never observed to finish |
+
+The guard caps input at 20,000 characters, so the cap does not help: the blow-up
+begins around N=2,000, well inside it. Confirmed end to end through the hook's own
+stdin path with the payload delivered in `tool_response`, which is where
+untrusted file and network content arrives.
+
+### Why it is more than a hang
+
+This hook runs on every tool call and is fail-open by design. In the default
+`warn` mode the session stalls until the harness kills the hook, and no warning is
+ever emitted. In `block` mode it is worse: a guard that never returns never exits
+2, so the critical pattern it exists to catch goes unblocked. The denial of
+service doubles as a bypass of the control itself.
+
+### The fix
+
+Each optional segment now carries its own leading `\s+` inside the group —
+`(?:\s+X)?` rather than `\s+(X)?\s*` — so a whitespace run has exactly one valid
+partition and there is nothing to backtrack through. The pattern now takes 4.8ms
+at the full 20,000-character cap, and stays linear beyond it: 3.9ms on a million
+spaces.
+
+`system-prompt-leak` carried the same shape one group shallower, making it
+quadratic rather than catastrophic (~590ms at 32,000 spaces, ~200ms at the cap).
+Not a denial of service today, but the identical defect and one optional group
+away from becoming one, so it is rewritten the same way. The other ten patterns
+were swept with trigger words they actually match and are unaffected (4-5ms at
+the cap).
+
+### Detection is unchanged
+
+Verified rather than assumed. Both rewrites were checked against every phrase
+their grammars generate — 1,140 for the first, 483 for the second — and agree
+with the originals on all 1,623, with no phrase matched by one and not the other.
+
+New tests cover the detections that must still fire, the ordinary text that must
+not, and the timing. The timing test runs in a child process with a hard timeout
+on purpose: a catastrophic regex is synchronous and CPU-bound, so node:test's own
+timeout cannot interrupt it — against the old pattern the assertion was never
+reached and the suite simply hung, which is a red build with no explanation. The
+child turns the same regression into a named failure. Verified in both
+directions: the old regex is killed at 15s with `ETIMEDOUT`, the new one finishes
+in 59ms.
+
+**668 tests across 43 files.**
+
 ## v2.24.3 — remove decorative emoji from docs and catalog (October 2026)
 
 Documentation only. No code, no behaviour change.

package/CLAUDE.md

@@ -26,7 +26,7 @@ scripts/     → Node.js utilities: MCP server, dashboard, swarm, replay, router
 bundles/     → 3 power bundles (indie-hacker, red-team, enterprise)
 actions/     → GitHub Action (CI/CD integration for PR review)
 docs/        → Feature docs (arena.md, mcp.md, dashboard.md, swarm.md, replay.md, evolve.md, supply-chain.md)
-tests/       → 665 passing tests across 43 test files
+tests/       → 668 passing tests across 43 test files
 ```
 
 ## Running Tests

package/README.md

@@ -118,7 +118,7 @@ Most "AI agent kits" are folders of markdown files you have to remember the name
 | Quality hooks | ✓ 44 | Some | ✗ | ✗ |
 | IDE platforms | **11** (Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, Roo Code, Aider, Kimi, Gemini CLI) | 1-2 | 1 | Varies |
 | Telemetry | **None** | Varies | None | Varies |
-| Test coverage | ✓ 665 tests | ✗ | ✗ | ✗ |
+| Test coverage | ✓ 668 tests | ✗ | ✗ | ✗ |
 | Distributed via | `npx`, curl, clone | Manual | Manual | Manual |
 
 ---

package/hooks/safety/lib/patterns.js

@@ -20,13 +20,28 @@ const PATTERNS = [
   {
     id: 'override-prior-instructions',
     severity: 'critical',
-    regex: /\b(ignore|disregard|forget)\s+(all|any|the|your|my|all\s+(?:prior|previous|above|earlier))?\s*(prior|previous|above|earlier|prev|preceding)?\s*(instructions?|rules?|prompt|system\s*prompt|directives?)\b/i,
+    // Each optional segment carries its own leading \s+, so a run of whitespace
+    // has exactly ONE valid partition. The previous form was
+    //   \s+ (group)? \s* (group)? \s*
+    // — three whitespace quantifiers with optional groups between them. When both
+    // groups matched empty they sat adjacent, so N spaces could be split between
+    // them in O(N^2) ways, and every split was retried once the final noun failed
+    // to match. Measured on "ignore" + N spaces + "x": 1.5s at N=2000, 12.5s at
+    // N=4000, over 40s at N=8000 — all well inside this hook's own 20000-char
+    // input cap, and reachable through tool_response, which carries untrusted
+    // file and network content. Verified equivalent across 1140 generated phrases.
+    regex: /\b(?:ignore|disregard|forget)(?:\s+(?:all|any|the|your|my))?(?:\s+(?:prior|previous|above|earlier|prev|preceding))?\s+(?:instructions?|rules?|system\s*prompt|prompt|directives?)\b/i,
     why:   'Classic instruction-override prompt injection.',
   },
   {
     id: 'system-prompt-leak',
     severity: 'critical',
-    regex: /\b(reveal|print|show|repeat|output|dump|leak|expose)\s+(your|the|all|any)?\s*(system\s*prompt|hidden\s*prompt|initial\s*(prompt|instructions?)|original\s*(prompt|instructions?)|first\s*(message|prompt|instruction))/i,
+    // Same adjacent-quantifier shape as above, one group shallower, so quadratic
+    // rather than catastrophic: ~590ms at 32000 spaces, ~200ms at the 20000 cap.
+    // Not a denial of service today, but the identical defect, and it would become
+    // one the moment another optional group is added. Verified equivalent across
+    // 483 generated phrases.
+    regex: /\b(?:reveal|print|show|repeat|output|dump|leak|expose)(?:\s+(?:your|the|all|any))?\s+(?:system\s*prompt|hidden\s*prompt|initial\s*(?:prompt|instructions?)|original\s*(?:prompt|instructions?)|first\s*(?:message|prompt|instruction))/i,
     why:   'Explicit attempt to extract the system prompt.',
   },
   {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kodelyth-ecc",
-  "version": "2.24.3",
+  "version": "2.24.4",
   "description": "Production-grade AI coding toolkit — 70 agents (incl. devil-mode adversarial crew), 196 skills, 103 commands, parallel multi-agent commands, semantic intent routing, self-learning memory, and a built-in MCP server (16 tools / 6 prompts / 377 resources) that bridges to Claude Desktop, LangGraph, AutoGen, CrewAI, and OpenAI Agents SDK. Works on macOS, Linux and Windows with Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, RooCode, Aider, Kimi, and Gemini CLI.",
   "author": "Kodelyth <github.com/sifxprime>",
   "license": "MIT",