kodelyth-ecc 2.24.3 → 2.24.5

package/CHANGELOG.md

@@ -2,6 +2,115 @@
 
 All notable changes to Kodelyth ECC are documented here.
 
+## v2.24.5 — fix path traversal in session bundles (October 2026)
+
+**Security fix.** A session bundle is a portable, shareable artifact — that is the
+entire point of the format — so every string in one is untrusted input from
+whoever built it. `validateBundle` type-checked `session` and each worker `slug`
+and nothing else, and both are used to build filesystem paths:
+
+    targetDir = path.join(coordRoot, bundle.session)   -> fs.rmSync(recursive, force)
+    wdir      = path.join(targetDir, w.slug)           -> mkdirSync + 3x writeFileSync
+
+### Arbitrary file write
+
+A slug of `../../fake-claude/rules/common/injected` wrote `task.md`, `handoff.md`
+and `status.md` with bundle-chosen contents three levels outside the import
+target. Aimed at a real install that path is an always-on rule file, so a shared
+bundle plants standing instructions into every future session. The CLI printed
+`imported bundle into: .../.orchestration/looks-normal` and then printed the
+escaped path in its own `inspect:` hint.
+
+### Arbitrary recursive delete
+
+A session of `../important-work` with `--overwrite` reached
+`fs.rmSync(dir, { recursive: true, force: true })` and recursively deleted an
+unrelated project directory. It printed success for that too.
+
+Both were confirmed by running the real CLI against a sandboxed victim tree, not
+by reading the code.
+
+### The fix
+
+`session` and every `slug` must now be a single path segment. `exportBundle` only
+ever emits those — `session` is a `path.basename`, each `slug` a `readdirSync`
+entry name that `slugify` constrains to `[a-z0-9-]+` — so this rejects nothing a
+genuine bundle contains, which a real export/import round-trip confirms with
+identical trees. A containment check was added at the write site as a backstop for
+future callers; the comment states plainly that it guards no currently reachable
+vector, because `importBundle` always creates the directory it writes into.
+
+**672 tests across 43 files.**
+
+## v2.24.4 — fix catastrophic backtracking in the prompt-injection guard (October 2026)
+
+**Security fix.** The guard that scans untrusted text for prompt injection could
+be hung indefinitely by the text it was scanning.
+
+### What was wrong
+
+`override-prior-instructions` — the critical-severity pattern matching the single
+most common injection phrase — was written as
+
+    \s+ (group)? \s* (group)? \s*
+
+Three whitespace quantifiers with optional groups between them. With both groups
+matching empty they sat adjacent, so a run of N spaces could be partitioned
+between them in O(N^2) ways, and every partition was retried once the trailing
+noun failed to match. On `"ignore" + N spaces + "x"`:
+
+| N | time |
+|---|---|
+| 2,000 | 1.5s |
+| 4,000 | 12.5s |
+| 8,000 | never observed to finish |
+| 19,000 | never observed to finish |
+
+The guard caps input at 20,000 characters, so the cap does not help: the blow-up
+begins around N=2,000, well inside it. Confirmed end to end through the hook's own
+stdin path with the payload delivered in `tool_response`, which is where
+untrusted file and network content arrives.
+
+### Why it is more than a hang
+
+This hook runs on every tool call and is fail-open by design. In the default
+`warn` mode the session stalls until the harness kills the hook, and no warning is
+ever emitted. In `block` mode it is worse: a guard that never returns never exits
+2, so the critical pattern it exists to catch goes unblocked. The denial of
+service doubles as a bypass of the control itself.
+
+### The fix
+
+Each optional segment now carries its own leading `\s+` inside the group —
+`(?:\s+X)?` rather than `\s+(X)?\s*` — so a whitespace run has exactly one valid
+partition and there is nothing to backtrack through. The pattern now takes 4.8ms
+at the full 20,000-character cap, and stays linear beyond it: 3.9ms on a million
+spaces.
+
+`system-prompt-leak` carried the same shape one group shallower, making it
+quadratic rather than catastrophic (~590ms at 32,000 spaces, ~200ms at the cap).
+Not a denial of service today, but the identical defect and one optional group
+away from becoming one, so it is rewritten the same way. The other ten patterns
+were swept with trigger words they actually match and are unaffected (4-5ms at
+the cap).
+
+### Detection is unchanged
+
+Verified rather than assumed. Both rewrites were checked against every phrase
+their grammars generate — 1,140 for the first, 483 for the second — and agree
+with the originals on all 1,623, with no phrase matched by one and not the other.
+
+New tests cover the detections that must still fire, the ordinary text that must
+not, and the timing. The timing test runs in a child process with a hard timeout
+on purpose: a catastrophic regex is synchronous and CPU-bound, so node:test's own
+timeout cannot interrupt it — against the old pattern the assertion was never
+reached and the suite simply hung, which is a red build with no explanation. The
+child turns the same regression into a named failure. Verified in both
+directions: the old regex is killed at 15s with `ETIMEDOUT`, the new one finishes
+in 59ms.
+
+**668 tests across 43 files.**
+
 ## v2.24.3 — remove decorative emoji from docs and catalog (October 2026)
 
 Documentation only. No code, no behaviour change.

package/CLAUDE.md

@@ -26,7 +26,7 @@ scripts/     → Node.js utilities: MCP server, dashboard, swarm, replay, router
 bundles/     → 3 power bundles (indie-hacker, red-team, enterprise)
 actions/     → GitHub Action (CI/CD integration for PR review)
 docs/        → Feature docs (arena.md, mcp.md, dashboard.md, swarm.md, replay.md, evolve.md, supply-chain.md)
-tests/       → 665 passing tests across 43 test files
+tests/       → 672 passing tests across 43 test files
 ```
 
 ## Running Tests

package/README.md

@@ -118,7 +118,7 @@ Most "AI agent kits" are folders of markdown files you have to remember the name
 | Quality hooks | ✓ 44 | Some | ✗ | ✗ |
 | IDE platforms | **11** (Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, Roo Code, Aider, Kimi, Gemini CLI) | 1-2 | 1 | Varies |
 | Telemetry | **None** | Varies | None | Varies |
-| Test coverage | ✓ 665 tests | ✗ | ✗ | ✗ |
+| Test coverage | ✓ 672 tests | ✗ | ✗ | ✗ |
 | Distributed via | `npx`, curl, clone | Manual | Manual | Manual |
 
 ---

package/hooks/safety/lib/patterns.js

@@ -20,13 +20,28 @@ const PATTERNS = [
   {
     id: 'override-prior-instructions',
     severity: 'critical',
-    regex: /\b(ignore|disregard|forget)\s+(all|any|the|your|my|all\s+(?:prior|previous|above|earlier))?\s*(prior|previous|above|earlier|prev|preceding)?\s*(instructions?|rules?|prompt|system\s*prompt|directives?)\b/i,
+    // Each optional segment carries its own leading \s+, so a run of whitespace
+    // has exactly ONE valid partition. The previous form was
+    //   \s+ (group)? \s* (group)? \s*
+    // — three whitespace quantifiers with optional groups between them. When both
+    // groups matched empty they sat adjacent, so N spaces could be split between
+    // them in O(N^2) ways, and every split was retried once the final noun failed
+    // to match. Measured on "ignore" + N spaces + "x": 1.5s at N=2000, 12.5s at
+    // N=4000, over 40s at N=8000 — all well inside this hook's own 20000-char
+    // input cap, and reachable through tool_response, which carries untrusted
+    // file and network content. Verified equivalent across 1140 generated phrases.
+    regex: /\b(?:ignore|disregard|forget)(?:\s+(?:all|any|the|your|my))?(?:\s+(?:prior|previous|above|earlier|prev|preceding))?\s+(?:instructions?|rules?|system\s*prompt|prompt|directives?)\b/i,
     why:   'Classic instruction-override prompt injection.',
   },
   {
     id: 'system-prompt-leak',
     severity: 'critical',
-    regex: /\b(reveal|print|show|repeat|output|dump|leak|expose)\s+(your|the|all|any)?\s*(system\s*prompt|hidden\s*prompt|initial\s*(prompt|instructions?)|original\s*(prompt|instructions?)|first\s*(message|prompt|instruction))/i,
+    // Same adjacent-quantifier shape as above, one group shallower, so quadratic
+    // rather than catastrophic: ~590ms at 32000 spaces, ~200ms at the 20000 cap.
+    // Not a denial of service today, but the identical defect, and it would become
+    // one the moment another optional group is added. Verified equivalent across
+    // 483 generated phrases.
+    regex: /\b(?:reveal|print|show|repeat|output|dump|leak|expose)(?:\s+(?:your|the|all|any))?\s+(?:system\s*prompt|hidden\s*prompt|initial\s*(?:prompt|instructions?)|original\s*(?:prompt|instructions?)|first\s*(?:message|prompt|instruction))/i,
     why:   'Explicit attempt to extract the system prompt.',
   },
   {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kodelyth-ecc",
-  "version": "2.24.3",
+  "version": "2.24.5",
   "description": "Production-grade AI coding toolkit — 70 agents (incl. devil-mode adversarial crew), 196 skills, 103 commands, parallel multi-agent commands, semantic intent routing, self-learning memory, and a built-in MCP server (16 tools / 6 prompts / 377 resources) that bridges to Claude Desktop, LangGraph, AutoGen, CrewAI, and OpenAI Agents SDK. Works on macOS, Linux and Windows with Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, RooCode, Aider, Kimi, and Gemini CLI.",
   "author": "Kodelyth <github.com/sifxprime>",
   "license": "MIT",

package/scripts/replay/bundle.js

@@ -35,6 +35,7 @@
 
 const fs   = require('fs');
 const path = require('path');
+const { resolveContainedForWrite } = require('../lib/safe-fs');
 
 const BUNDLE_SCHEMA = 'kodelyth.session-bundle/v1';
 const BUNDLE_VERSION = '1.7.0';
@@ -94,6 +95,21 @@ function readBundle(bundlePath) {
   return validateBundle(raw);
 }
 
+// One path segment: no separator, no traversal, no leading dot. This matches what
+// exportBundle actually emits — slugify yields [a-z0-9-]+ and session is a
+// basename — so it rejects nothing a genuine bundle contains.
+const SAFE_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+const MAX_SEGMENT = 128;
+
+function assertSafeSegment(value, label) {
+  if (typeof value !== 'string' || value.length > MAX_SEGMENT || !SAFE_SEGMENT.test(value)) {
+    throw new Error(
+      `bundle: ${label} must be a single path segment matching ${SAFE_SEGMENT} ` +
+      `(got ${JSON.stringify(String(value).slice(0, 60))})`
+    );
+  }
+}
+
 function validateBundle(raw) {
   if (!raw || typeof raw !== 'object') throw new Error('bundle: not an object');
   if (raw.schema !== BUNDLE_SCHEMA) {
@@ -102,11 +118,26 @@ function validateBundle(raw) {
   if (typeof raw.session !== 'string' || !raw.session) {
     throw new Error('bundle: missing "session"');
   }
+  // A bundle exists to be SHARED — that is the whole point of the format — so every
+  // string in it is untrusted input. exportBundle only ever emits single path
+  // segments here: `session` is a path.basename and each `slug` is a readdirSync
+  // entry name. Nothing legitimate contains a separator, so anything that does is
+  // an attempt to escape the directory the importer chose.
+  //
+  // Unchecked, `session` became the import target via path.join(coordRoot, session),
+  // and with --overwrite that target is handed to fs.rmSync(recursive, force):
+  // "../important-work" recursively deleted an unrelated project while the CLI
+  // printed success. Each `slug` became path.join(targetDir, slug) for a
+  // mkdirSync(recursive) plus three writeFileSync calls, so
+  // "../../.claude/rules/common/x" planted an always-on rule file whose contents
+  // the bundle author chose.
+  assertSafeSegment(raw.session, 'session');
   if (!Array.isArray(raw.workers) || raw.workers.length === 0) {
     throw new Error('bundle: "workers" must be a non-empty array');
   }
   for (const w of raw.workers) {
     if (!w || typeof w.slug !== 'string') throw new Error('bundle: each worker needs a string "slug"');
+    assertSafeSegment(w.slug, 'worker slug');
   }
   return raw;
 }
@@ -122,7 +153,14 @@ function importBundle(bundle, { targetDir, overwrite = false } = {}) {
   }
   fs.mkdirSync(dir, { recursive: true });
   for (const w of bundle.workers) {
-    const wdir = path.join(dir, w.slug);
+    // Backstop, not the primary guard: validateBundle already rejected every slug
+    // containing a separator, and `dir` was just created by this function (an
+    // existing targetDir is either refused or rmSync'd above), so no attacker-planted
+    // symlink can survive into this loop today. The check costs nothing and keeps the
+    // invariant true for any future caller that hands importBundle a directory it
+    // did not create — which is the only way the symlink case becomes reachable.
+    const wdir = resolveContainedForWrite(path.join(dir, w.slug), dir);
+    if (!wdir) throw new Error(`importBundle: worker slug escapes targetDir: ${w.slug}`);
     fs.mkdirSync(wdir, { recursive: true });
     if (typeof w.task    === 'string') fs.writeFileSync(path.join(wdir, 'task.md'),    w.task,    'utf8');
     if (typeof w.handoff === 'string') fs.writeFileSync(path.join(wdir, 'handoff.md'), w.handoff, 'utf8');