kodelyth-ecc 2.24.4 → 2.24.6

package/CHANGELOG.md

@@ -2,6 +2,102 @@
 
 All notable changes to Kodelyth ECC are documented here.
 
+## v2.24.6 — brand assets advertised the wrong version and stale counts (October 2026)
+
+Assets and documentation only. No code changes to the toolkit.
+
+### What was wrong
+
+Every social and brand SVG carries its version and headline counts as literal
+artwork, and nothing kept them in step with releases.
+
+ECC's 23 SVGs said `v2.24.1`, four releases behind. The website's copies said
+`v2.18.0` — seven behind — and the two sets had drifted apart, so the marketing
+images on the site advertised a different version from the ones in the README.
+
+The counts were worse, and were nearly missed: grepping for the *correct* values
+(70 agents, 196 skills) found them and suggested the counts were fine. Rendering
+`github-social-preview.png` showed otherwise — **97 COMMANDS** and **22+ HOOKS**
+against an actual 103 and 44, on the flagship image used for the repository's
+social card. Fixed across 11 SVGs per repo: 97 to 103 commands, 22+/20+ to 44
+hooks, 384 to 672 tests, 14 to 15 rules.
+
+The PNG exports were worse still, at `v2.7.0`.
+
+### Root cause
+
+`.gitignore` names `node brand/convert.js` as the way to regenerate the exports.
+That script covers only the `brand/` lockups from a hardcoded list, never the 49
+`social/` exports — and it cannot run at all, because `puppeteer-core` is neither
+installed nor declared in `package.json`. The documented regeneration path was
+broken, and because the PNGs are gitignored build artifacts the drift was
+invisible.
+
+### What ships
+
+Two scripts, so this cannot recur silently:
+
+- `scripts/brand/sync-asset-version.js` stamps the version from `package.json`
+  into every SVG. Takes `--root` so the website's copies are driven from the same
+  source of truth, and `--check` exits non-zero when anything is stale.
+- `scripts/brand/export-assets.js` renders all 49 exports at 7680px, taking each
+  height from the SVG's own viewBox. `--check` compares mtimes and fails when a
+  PNG is older than its source.
+
+Counts are deliberately NOT stamped by script. They are laid out as artwork, and
+some numbers that look like catalog counts are not: "20+ rules stacked" counts
+accumulated lessons, and "4 agents" / "8 agents" describe how many a given
+parallel command fires. A blanket replace would rewrite those into nonsense, so
+each count fix here was read in context first and those were left alone.
+
+### Also
+
+The README now asks for a star. The post-install CLI asked once; the README —
+which is also the npm package page, and the first thing most people see — never
+did.
+
+**672 tests across 43 files.**
+
+## v2.24.5 — fix path traversal in session bundles (October 2026)
+
+**Security fix.** A session bundle is a portable, shareable artifact — that is the
+entire point of the format — so every string in one is untrusted input from
+whoever built it. `validateBundle` type-checked `session` and each worker `slug`
+and nothing else, and both are used to build filesystem paths:
+
+    targetDir = path.join(coordRoot, bundle.session)   -> fs.rmSync(recursive, force)
+    wdir      = path.join(targetDir, w.slug)           -> mkdirSync + 3x writeFileSync
+
+### Arbitrary file write
+
+A slug of `../../fake-claude/rules/common/injected` wrote `task.md`, `handoff.md`
+and `status.md` with bundle-chosen contents three levels outside the import
+target. Aimed at a real install that path is an always-on rule file, so a shared
+bundle plants standing instructions into every future session. The CLI printed
+`imported bundle into: .../.orchestration/looks-normal` and then printed the
+escaped path in its own `inspect:` hint.
+
+### Arbitrary recursive delete
+
+A session of `../important-work` with `--overwrite` reached
+`fs.rmSync(dir, { recursive: true, force: true })` and recursively deleted an
+unrelated project directory. It printed success for that too.
+
+Both were confirmed by running the real CLI against a sandboxed victim tree, not
+by reading the code.
+
+### The fix
+
+`session` and every `slug` must now be a single path segment. `exportBundle` only
+ever emits those — `session` is a `path.basename`, each `slug` a `readdirSync`
+entry name that `slugify` constrains to `[a-z0-9-]+` — so this rejects nothing a
+genuine bundle contains, which a real export/import round-trip confirms with
+identical trees. A containment check was added at the write site as a backstop for
+future callers; the comment states plainly that it guards no currently reachable
+vector, because `importBundle` always creates the directory it writes into.
+
+**672 tests across 43 files.**
+
 ## v2.24.4 — fix catastrophic backtracking in the prompt-injection guard (October 2026)
 
 **Security fix.** The guard that scans untrusted text for prompt injection could

package/CLAUDE.md

@@ -26,7 +26,7 @@ scripts/     → Node.js utilities: MCP server, dashboard, swarm, replay, router
 bundles/     → 3 power bundles (indie-hacker, red-team, enterprise)
 actions/     → GitHub Action (CI/CD integration for PR review)
 docs/        → Feature docs (arena.md, mcp.md, dashboard.md, swarm.md, replay.md, evolve.md, supply-chain.md)
-tests/       → 668 passing tests across 43 test files
+tests/       → 672 passing tests across 43 test files
 ```
 
 ## Running Tests

package/README.md

@@ -118,7 +118,7 @@ Most "AI agent kits" are folders of markdown files you have to remember the name
 | Quality hooks | ✓ 44 | Some | ✗ | ✗ |
 | IDE platforms | **11** (Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, Roo Code, Aider, Kimi, Gemini CLI) | 1-2 | 1 | Varies |
 | Telemetry | **None** | Varies | None | Varies |
-| Test coverage | ✓ 668 tests | ✗ | ✗ | ✗ |
+| Test coverage | ✓ 672 tests | ✗ | ✗ | ✗ |
 | Distributed via | `npx`, curl, clone | Manual | Manual | Manual |
 
 ---
@@ -1157,6 +1157,20 @@ command you ran, the full error, and your `kodelythecc doctor` output.
 
 <div align="center">
 
+### If ECC saved you time
+
+Starring the repo is the main way other developers find it — the project has no
+marketing budget and no telemetry, so visibility is the only signal that it is
+worth anyone's time.
+
+[![Star on GitHub](https://img.shields.io/github/stars/sifxprime/kodelyth-ecc?style=social)](https://github.com/sifxprime/kodelyth-ecc)
+
+</div>
+
+---
+
+<div align="center">
+
 [![npm](https://img.shields.io/badge/npm-kodelyth--ecc-red.svg)](https://www.npmjs.com/package/kodelyth-ecc)
 [![GitHub](https://img.shields.io/badge/GitHub-sifxprime%2Fkodelyth--ecc-181717.svg)](https://github.com/sifxprime/kodelyth-ecc)
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kodelyth-ecc",
-  "version": "2.24.4",
+  "version": "2.24.6",
   "description": "Production-grade AI coding toolkit — 70 agents (incl. devil-mode adversarial crew), 196 skills, 103 commands, parallel multi-agent commands, semantic intent routing, self-learning memory, and a built-in MCP server (16 tools / 6 prompts / 377 resources) that bridges to Claude Desktop, LangGraph, AutoGen, CrewAI, and OpenAI Agents SDK. Works on macOS, Linux and Windows with Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, RooCode, Aider, Kimi, and Gemini CLI.",
   "author": "Kodelyth <github.com/sifxprime>",
   "license": "MIT",

package/scripts/brand/export-assets.js

@@ -0,0 +1,135 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * Render every social SVG to its 8K PNG export.
+ *
+ * The PNGs under social/exports/8k/ are rasterised copies of the SVGs, used where
+ * an SVG will not do — GitHub's social preview, and most social platforms, accept
+ * only raster uploads. Nothing regenerated them, so they drifted badly: by v2.24.5
+ * the exports still read v2.7.0, 97 commands and 22+ hooks, against an actual
+ * 103 and 44. The SVGs had been corrected several times; the PNGs never were.
+ *
+ * Every existing export is 7680px wide with the aspect ratio taken from the SVG's
+ * own viewBox, so that is what this reproduces.
+ *
+ *   node scripts/brand/export-assets.js                 # render all
+ *   node scripts/brand/export-assets.js --check         # report stale, change nothing
+ *   node scripts/brand/export-assets.js card-main       # render one, by name
+ *
+ * --check compares mtimes and exits non-zero when any PNG is older than its SVG,
+ * so a release step can catch exports that no longer match their source.
+ *
+ * Requires rsvg-convert (librsvg). It is not installed by default anywhere, so its
+ * absence is reported as a clear instruction rather than a spawn error.
+ *
+ * On the choice of renderer: brand/convert.js already renders the brand/ lockups
+ * with puppeteer-core, chosen there for font fidelity, and consistency would argue
+ * for using it here too. It is not used because it cannot run — puppeteer-core is
+ * neither installed nor declared in package.json, so `node brand/convert.js` fails
+ * on a clean checkout. That is most likely why these exports went stale in the
+ * first place: the tool named in .gitignore for regenerating them does not work.
+ *
+ * rsvg-convert was checked against the output it replaces rather than assumed
+ * equivalent: re-rendering github-social-preview.png produced 491,233 bytes against
+ * the previous Chrome-rendered 491,564 at identical dimensions, and the two were
+ * compared side by side — same fonts, same geometry, differing only in the text
+ * that was actually corrected. If puppeteer-core is ever added as a real
+ * dependency, moving this to the same renderer would be a reasonable tidy-up.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { execFileSync, spawnSync } = require('child_process');
+
+const ROOT = path.join(__dirname, '..', '..');
+const SVG_DIR = path.join(ROOT, 'social');
+const PNG_DIR = path.join(SVG_DIR, 'exports', '8k');
+const WIDTH = 7680;
+
+function haveRenderer() {
+  try {
+    execFileSync('rsvg-convert', ['--version'], { stdio: 'ignore' });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function listPairs(filter) {
+  if (!fs.existsSync(SVG_DIR)) return [];
+  return fs
+    .readdirSync(SVG_DIR)
+    .filter((f) => f.endsWith('.svg'))
+    .map((f) => path.basename(f, '.svg'))
+    .filter((name) => !filter || name === filter)
+    .sort()
+    .map((name) => ({
+      name,
+      svg: path.join(SVG_DIR, `${name}.svg`),
+      png: path.join(PNG_DIR, `${name}.png`),
+    }));
+}
+
+/** A PNG is stale when it is missing or older than the SVG it came from. */
+function isStale({ svg, png }) {
+  if (!fs.existsSync(png)) return true;
+  return fs.statSync(png).mtimeMs < fs.statSync(svg).mtimeMs;
+}
+
+function run({ check = false, only = null } = {}) {
+  const pairs = listPairs(only);
+  if (pairs.length === 0) {
+    console.error(only ? `no such SVG: social/${only}.svg` : `no SVGs in ${SVG_DIR}`);
+    return 1;
+  }
+
+  const stale = pairs.filter(isStale);
+
+  if (check) {
+    for (const p of stale) console.log(`  STALE  ${p.name}.png`);
+    console.log(
+      stale.length === 0
+        ? `  all ${pairs.length} exports are newer than their SVG`
+        : `  ${stale.length} of ${pairs.length} export(s) stale`
+    );
+    return stale.length === 0 ? 0 : 1;
+  }
+
+  if (!haveRenderer()) {
+    console.error('  rsvg-convert not found. Install librsvg:');
+    console.error('    macOS:  brew install librsvg');
+    console.error('    Debian: apt-get install librsvg2-bin');
+    return 1;
+  }
+
+  fs.mkdirSync(PNG_DIR, { recursive: true });
+
+  let ok = 0;
+  const failed = [];
+  for (const p of pairs) {
+    // Width only — rsvg-convert derives the height from the viewBox, so each
+    // card keeps its own aspect ratio without hardcoding 49 different heights.
+    const r = spawnSync('rsvg-convert', ['-w', String(WIDTH), p.svg, '-o', p.png], {
+      stdio: ['ignore', 'ignore', 'pipe'],
+    });
+    if (r.status === 0 && fs.existsSync(p.png) && fs.statSync(p.png).size > 0) {
+      ok += 1;
+    } else {
+      failed.push(`${p.name}: ${String(r.stderr || '').trim() || `exit ${r.status}`}`);
+    }
+  }
+
+  console.log(`  rendered ${ok}/${pairs.length} at ${WIDTH}px wide`);
+  for (const f of failed) console.error(`  FAILED  ${f}`);
+  return failed.length === 0 ? 0 : 1;
+}
+
+if (require.main === module) {
+  const args = process.argv.slice(2);
+  const check = args.includes('--check');
+  const only = args.find((a) => !a.startsWith('--')) || null;
+  process.exit(run({ check, only }));
+}
+
+module.exports = { run, listPairs, isStale, WIDTH };

package/scripts/brand/sync-asset-version.js

@@ -0,0 +1,100 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * Stamp the current package version into every brand and social SVG.
+ *
+ * These assets carry a literal "v2.24.1" in their artwork, and nothing kept them
+ * in step with releases. By 2.24.5 the ECC copies were four releases behind and
+ * the website's copies were SEVEN behind, at v2.18.0 — the two sets had drifted
+ * apart as well, so the marketing images on the site advertised a different
+ * version from the ones in the README.
+ *
+ * Only the version token is touched. Counts (70 agents, 196 skills, …) are laid
+ * out as artwork and change rarely, so they stay a deliberate edit; a script that
+ * silently reflowed them would do more harm than the staleness it fixed.
+ *
+ *   node scripts/brand/sync-asset-version.js                  # ECC's own assets
+ *   node scripts/brand/sync-asset-version.js --check          # report, change nothing
+ *   node scripts/brand/sync-asset-version.js --root ../ecc-web/public
+ *
+ * --check exits non-zero when anything is stale, so a release step can refuse to
+ * ship assets that advertise the wrong version.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const ROOT = path.join(__dirname, '..', '..');
+const VERSION = require(path.join(ROOT, 'package.json')).version;
+
+// A version token in artwork: "v" followed by semver, as a whole word. Anchored
+// on the leading "v" so it cannot match an IP address — section-dashboard.svg
+// contains "127.0.0.1", which a bare semver pattern happily mangles.
+const VERSION_TOKEN = /\bv\d+\.\d+\.\d+\b/g;
+
+function collectSvgs(root) {
+  const out = [];
+  for (const dir of ['social', 'brand']) {
+    const full = path.join(root, dir);
+    if (!fs.existsSync(full)) continue;
+    for (const name of fs.readdirSync(full)) {
+      if (name.endsWith('.svg')) out.push(path.join(full, name));
+    }
+  }
+  return out.sort();
+}
+
+function run({ root, check }) {
+  const files = collectSvgs(root);
+  if (files.length === 0) {
+    console.error(`no social/ or brand/ SVGs under ${root}`);
+    return 1;
+  }
+
+  const stale = [];
+  let changedFiles = 0;
+  let changedTokens = 0;
+
+  for (const file of files) {
+    const before = fs.readFileSync(file, 'utf8');
+    const found = before.match(VERSION_TOKEN);
+    if (!found) continue;
+
+    const outdated = found.filter((t) => t !== `v${VERSION}`);
+    if (outdated.length === 0) continue;
+
+    stale.push({ file, versions: [...new Set(outdated)], count: outdated.length });
+    changedTokens += outdated.length;
+    changedFiles += 1;
+
+    if (!check) {
+      fs.writeFileSync(file, before.replace(VERSION_TOKEN, `v${VERSION}`), 'utf8');
+    }
+  }
+
+  const rel = (f) => path.relative(root, f);
+  for (const s of stale) {
+    console.log(`  ${check ? 'STALE' : 'updated'}  ${rel(s.file).padEnd(40)} ${s.versions.join(', ')} -> v${VERSION}`);
+  }
+
+  if (stale.length === 0) {
+    console.log(`  all ${files.length} SVGs already at v${VERSION}`);
+    return 0;
+  }
+
+  console.log(
+    `  ${check ? 'stale' : 'synced'}: ${changedFiles} file(s), ${changedTokens} token(s) -> v${VERSION}`
+  );
+  return check ? 1 : 0;
+}
+
+if (require.main === module) {
+  const args = process.argv.slice(2);
+  const check = args.includes('--check');
+  const rootFlag = args.indexOf('--root');
+  const root = rootFlag >= 0 ? path.resolve(args[rootFlag + 1]) : ROOT;
+  process.exit(run({ root, check }));
+}
+
+module.exports = { run, collectSvgs, VERSION_TOKEN };

package/scripts/replay/bundle.js

@@ -35,6 +35,7 @@
 
 const fs   = require('fs');
 const path = require('path');
+const { resolveContainedForWrite } = require('../lib/safe-fs');
 
 const BUNDLE_SCHEMA = 'kodelyth.session-bundle/v1';
 const BUNDLE_VERSION = '1.7.0';
@@ -94,6 +95,21 @@ function readBundle(bundlePath) {
   return validateBundle(raw);
 }
 
+// One path segment: no separator, no traversal, no leading dot. This matches what
+// exportBundle actually emits — slugify yields [a-z0-9-]+ and session is a
+// basename — so it rejects nothing a genuine bundle contains.
+const SAFE_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+const MAX_SEGMENT = 128;
+
+function assertSafeSegment(value, label) {
+  if (typeof value !== 'string' || value.length > MAX_SEGMENT || !SAFE_SEGMENT.test(value)) {
+    throw new Error(
+      `bundle: ${label} must be a single path segment matching ${SAFE_SEGMENT} ` +
+      `(got ${JSON.stringify(String(value).slice(0, 60))})`
+    );
+  }
+}
+
 function validateBundle(raw) {
   if (!raw || typeof raw !== 'object') throw new Error('bundle: not an object');
   if (raw.schema !== BUNDLE_SCHEMA) {
@@ -102,11 +118,26 @@ function validateBundle(raw) {
   if (typeof raw.session !== 'string' || !raw.session) {
     throw new Error('bundle: missing "session"');
   }
+  // A bundle exists to be SHARED — that is the whole point of the format — so every
+  // string in it is untrusted input. exportBundle only ever emits single path
+  // segments here: `session` is a path.basename and each `slug` is a readdirSync
+  // entry name. Nothing legitimate contains a separator, so anything that does is
+  // an attempt to escape the directory the importer chose.
+  //
+  // Unchecked, `session` became the import target via path.join(coordRoot, session),
+  // and with --overwrite that target is handed to fs.rmSync(recursive, force):
+  // "../important-work" recursively deleted an unrelated project while the CLI
+  // printed success. Each `slug` became path.join(targetDir, slug) for a
+  // mkdirSync(recursive) plus three writeFileSync calls, so
+  // "../../.claude/rules/common/x" planted an always-on rule file whose contents
+  // the bundle author chose.
+  assertSafeSegment(raw.session, 'session');
   if (!Array.isArray(raw.workers) || raw.workers.length === 0) {
     throw new Error('bundle: "workers" must be a non-empty array');
   }
   for (const w of raw.workers) {
     if (!w || typeof w.slug !== 'string') throw new Error('bundle: each worker needs a string "slug"');
+    assertSafeSegment(w.slug, 'worker slug');
   }
   return raw;
 }
@@ -122,7 +153,14 @@ function importBundle(bundle, { targetDir, overwrite = false } = {}) {
   }
   fs.mkdirSync(dir, { recursive: true });
   for (const w of bundle.workers) {
-    const wdir = path.join(dir, w.slug);
+    // Backstop, not the primary guard: validateBundle already rejected every slug
+    // containing a separator, and `dir` was just created by this function (an
+    // existing targetDir is either refused or rmSync'd above), so no attacker-planted
+    // symlink can survive into this loop today. The check costs nothing and keeps the
+    // invariant true for any future caller that hands importBundle a directory it
+    // did not create — which is the only way the symlink case becomes reachable.
+    const wdir = resolveContainedForWrite(path.join(dir, w.slug), dir);
+    if (!wdir) throw new Error(`importBundle: worker slug escapes targetDir: ${w.slug}`);
     fs.mkdirSync(wdir, { recursive: true });
     if (typeof w.task    === 'string') fs.writeFileSync(path.join(wdir, 'task.md'),    w.task,    'utf8');
     if (typeof w.handoff === 'string') fs.writeFileSync(path.join(wdir, 'handoff.md'), w.handoff, 'utf8');