kodelyth-ecc 2.24.4 → 2.24.5

package/CHANGELOG.md

@@ -2,6 +2,46 @@
 
 All notable changes to Kodelyth ECC are documented here.
 
+## v2.24.5 — fix path traversal in session bundles (October 2026)
+
+**Security fix.** A session bundle is a portable, shareable artifact — that is the
+entire point of the format — so every string in one is untrusted input from
+whoever built it. `validateBundle` type-checked `session` and each worker `slug`
+and nothing else, and both are used to build filesystem paths:
+
+    targetDir = path.join(coordRoot, bundle.session)   -> fs.rmSync(recursive, force)
+    wdir      = path.join(targetDir, w.slug)           -> mkdirSync + 3x writeFileSync
+
+### Arbitrary file write
+
+A slug of `../../fake-claude/rules/common/injected` wrote `task.md`, `handoff.md`
+and `status.md` with bundle-chosen contents three levels outside the import
+target. Aimed at a real install that path is an always-on rule file, so a shared
+bundle plants standing instructions into every future session. The CLI printed
+`imported bundle into: .../.orchestration/looks-normal` and then printed the
+escaped path in its own `inspect:` hint.
+
+### Arbitrary recursive delete
+
+A session of `../important-work` with `--overwrite` reached
+`fs.rmSync(dir, { recursive: true, force: true })` and recursively deleted an
+unrelated project directory. It printed success for that too.
+
+Both were confirmed by running the real CLI against a sandboxed victim tree, not
+by reading the code.
+
+### The fix
+
+`session` and every `slug` must now be a single path segment. `exportBundle` only
+ever emits those — `session` is a `path.basename`, each `slug` a `readdirSync`
+entry name that `slugify` constrains to `[a-z0-9-]+` — so this rejects nothing a
+genuine bundle contains, which a real export/import round-trip confirms with
+identical trees. A containment check was added at the write site as a backstop for
+future callers; the comment states plainly that it guards no currently reachable
+vector, because `importBundle` always creates the directory it writes into.
+
+**672 tests across 43 files.**
+
 ## v2.24.4 — fix catastrophic backtracking in the prompt-injection guard (October 2026)
 
 **Security fix.** The guard that scans untrusted text for prompt injection could

package/CLAUDE.md

@@ -26,7 +26,7 @@ scripts/     → Node.js utilities: MCP server, dashboard, swarm, replay, router
 bundles/     → 3 power bundles (indie-hacker, red-team, enterprise)
 actions/     → GitHub Action (CI/CD integration for PR review)
 docs/        → Feature docs (arena.md, mcp.md, dashboard.md, swarm.md, replay.md, evolve.md, supply-chain.md)
-tests/       → 668 passing tests across 43 test files
+tests/       → 672 passing tests across 43 test files
 ```
 
 ## Running Tests

package/README.md

@@ -118,7 +118,7 @@ Most "AI agent kits" are folders of markdown files you have to remember the name
 | Quality hooks | ✓ 44 | Some | ✗ | ✗ |
 | IDE platforms | **11** (Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, Roo Code, Aider, Kimi, Gemini CLI) | 1-2 | 1 | Varies |
 | Telemetry | **None** | Varies | None | Varies |
-| Test coverage | ✓ 668 tests | ✗ | ✗ | ✗ |
+| Test coverage | ✓ 672 tests | ✗ | ✗ | ✗ |
 | Distributed via | `npx`, curl, clone | Manual | Manual | Manual |
 
 ---

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kodelyth-ecc",
-  "version": "2.24.4",
+  "version": "2.24.5",
   "description": "Production-grade AI coding toolkit — 70 agents (incl. devil-mode adversarial crew), 196 skills, 103 commands, parallel multi-agent commands, semantic intent routing, self-learning memory, and a built-in MCP server (16 tools / 6 prompts / 377 resources) that bridges to Claude Desktop, LangGraph, AutoGen, CrewAI, and OpenAI Agents SDK. Works on macOS, Linux and Windows with Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, RooCode, Aider, Kimi, and Gemini CLI.",
   "author": "Kodelyth <github.com/sifxprime>",
   "license": "MIT",

package/scripts/replay/bundle.js

@@ -35,6 +35,7 @@
 
 const fs   = require('fs');
 const path = require('path');
+const { resolveContainedForWrite } = require('../lib/safe-fs');
 
 const BUNDLE_SCHEMA = 'kodelyth.session-bundle/v1';
 const BUNDLE_VERSION = '1.7.0';
@@ -94,6 +95,21 @@ function readBundle(bundlePath) {
   return validateBundle(raw);
 }
 
+// One path segment: no separator, no traversal, no leading dot. This matches what
+// exportBundle actually emits — slugify yields [a-z0-9-]+ and session is a
+// basename — so it rejects nothing a genuine bundle contains.
+const SAFE_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+const MAX_SEGMENT = 128;
+
+function assertSafeSegment(value, label) {
+  if (typeof value !== 'string' || value.length > MAX_SEGMENT || !SAFE_SEGMENT.test(value)) {
+    throw new Error(
+      `bundle: ${label} must be a single path segment matching ${SAFE_SEGMENT} ` +
+      `(got ${JSON.stringify(String(value).slice(0, 60))})`
+    );
+  }
+}
+
 function validateBundle(raw) {
   if (!raw || typeof raw !== 'object') throw new Error('bundle: not an object');
   if (raw.schema !== BUNDLE_SCHEMA) {
@@ -102,11 +118,26 @@ function validateBundle(raw) {
   if (typeof raw.session !== 'string' || !raw.session) {
     throw new Error('bundle: missing "session"');
   }
+  // A bundle exists to be SHARED — that is the whole point of the format — so every
+  // string in it is untrusted input. exportBundle only ever emits single path
+  // segments here: `session` is a path.basename and each `slug` is a readdirSync
+  // entry name. Nothing legitimate contains a separator, so anything that does is
+  // an attempt to escape the directory the importer chose.
+  //
+  // Unchecked, `session` became the import target via path.join(coordRoot, session),
+  // and with --overwrite that target is handed to fs.rmSync(recursive, force):
+  // "../important-work" recursively deleted an unrelated project while the CLI
+  // printed success. Each `slug` became path.join(targetDir, slug) for a
+  // mkdirSync(recursive) plus three writeFileSync calls, so
+  // "../../.claude/rules/common/x" planted an always-on rule file whose contents
+  // the bundle author chose.
+  assertSafeSegment(raw.session, 'session');
   if (!Array.isArray(raw.workers) || raw.workers.length === 0) {
     throw new Error('bundle: "workers" must be a non-empty array');
   }
   for (const w of raw.workers) {
     if (!w || typeof w.slug !== 'string') throw new Error('bundle: each worker needs a string "slug"');
+    assertSafeSegment(w.slug, 'worker slug');
   }
   return raw;
 }
@@ -122,7 +153,14 @@ function importBundle(bundle, { targetDir, overwrite = false } = {}) {
   }
   fs.mkdirSync(dir, { recursive: true });
   for (const w of bundle.workers) {
-    const wdir = path.join(dir, w.slug);
+    // Backstop, not the primary guard: validateBundle already rejected every slug
+    // containing a separator, and `dir` was just created by this function (an
+    // existing targetDir is either refused or rmSync'd above), so no attacker-planted
+    // symlink can survive into this loop today. The check costs nothing and keeps the
+    // invariant true for any future caller that hands importBundle a directory it
+    // did not create — which is the only way the symlink case becomes reachable.
+    const wdir = resolveContainedForWrite(path.join(dir, w.slug), dir);
+    if (!wdir) throw new Error(`importBundle: worker slug escapes targetDir: ${w.slug}`);
     fs.mkdirSync(wdir, { recursive: true });
     if (typeof w.task    === 'string') fs.writeFileSync(path.join(wdir, 'task.md'),    w.task,    'utf8');
     if (typeof w.handoff === 'string') fs.writeFileSync(path.join(wdir, 'handoff.md'), w.handoff, 'utf8');