kodelyth-ecc 2.4.2 → 2.4.4

package/CHANGELOG.md

@@ -2,6 +2,63 @@
 
 All notable changes to Kodelyth ECC are documented here.
 
+## v2.4.4 — Real-user audit: prompt-injection guard was a silent no-op (July 2026)
+
+Phase 1 of the real-user audit — firing every hook with realistic input instead of fixtures. Found a second "installed but dummy" feature.
+
+### Fixed
+
+- **Prompt-injection guard defaulted to `MODE=off`** — so on every fresh install the hook was registered, fired on each prompt, and did **absolutely nothing** unless the user knew to set `KODELYTH_PI_GUARD=warn`. A safety feature nobody knew to turn on is a safety feature that doesn't exist.
+- **Fix**: default is now `warn` — the guard scans every prompt + tool response and surfaces injection findings to stderr (visible in transcript), but **never blocks** (exit 0 always). Measured **0 false positives** across 8 realistic legit prompts containing trigger-adjacent words ("ignore", "override", "system prompt", "bypass", "reveal"). Set `KODELYTH_PI_GUARD=off` to silence, `=block` to hard-block critical patterns (still opt-in, since block can halt on false positives).
+
+### Verified (real-user audit, this round)
+
+Fired all 8 hooks with realistic Claude Code payloads:
+
+| Hook | Result |
+|---|---|
+| `inject-start` | ✓ outputs memory context block |
+| `read-lessons` | ✓ exit 0 |
+| `auto-recall` | ✓ recalls 3 real memories (post-2.4.3 fix) |
+| `capture-stop` | ✓ exit 0 |
+| `capture-correction` | ✓ exit 0 |
+| `auto-resolve` | ✓ exit 0 |
+| `prompt-injection-guard` | ✗→✓ was silent no-op, now warns by default |
+| `token-budget` | ✓ exit 0 |
+
+Also verified on real data: `route` (correctly classified a production outage as hard→opus), `evolve analyze` (scanned 195 reuse + 3 miss signals → 5 proposals).
+
+### Tests
+
+- Updated `mode=off` test to set the env var explicitly (default is no longer off)
+- Added 2 tests: default-no-env warns on injection + stays silent on legit prompts
+- Full suite: 0 failures across 25 files
+
+## v2.4.3 — Memory recall crash fix (the "still dummy" bug) (July 2026)
+
+Found by testing ECC as a real user actually experiences it, not just in the test harness. **Memory recall was silently crashing on every prompt** for any user whose `~/.kodelythecc/memory/index.json` was written by an older/foreign BM25 schema.
+
+### Fixed
+
+- **`scripts/memory/store.js` — recall threw `Cannot read properties of undefined (reading '<token>')` on every UserPromptSubmit** when the on-disk `index.json` used the schema `{k1, b, corpusStats, index, documents, docFreq}` (from a prior BM25 implementation) instead of the current `{tokens, docCount, avgDocLength, totalLength}`. `search()` read `index.tokens[token]` where `index.tokens` was undefined.
+- **Root cause was a two-headed bug**:
+  1. `loadIndex()` blindly returned whatever JSON was on disk, with no schema validation
+  2. The canonical `rebuildIndex()` correctly rebuilt + saved a valid index but **returned `{count}` instead of the index object**
+- **Fix**: `loadIndex()` now validates the schema via `isValidIndexSchema()` and, on any mismatch/corruption, rebuilds from the append-only `memories.jsonl` (the source of truth). `rebuildIndex()` now returns the rebuilt index (with a `count` property preserved for its other caller). Recall self-heals on first call — no crash, no manual `index.json` deletion needed.
+
+### Added
+
+- **Regression test** in `tests/memory/store.test.js` — writes a foreign-schema `index.json`, asserts `recall()` does not throw and returns results, and asserts the on-disk index is rebuilt to the valid schema. This class of bug can no longer ship silently.
+
+### Impact
+
+- Every real user with a stale index had **zero working memory recall** — the hook fired, errored, and returned nothing. Auto-recall now works end-to-end.
+- Verified live: corrupted the index with the foreign schema, ran both `store.recall()` and the actual `hooks/memory/auto-recall.js` hook — both self-heal and return real Stripe/CORS memories.
+
+### Why this matters
+
+This is exactly the "is it real or is it dummy" gap. Files were installed, hooks were registered, rules loaded — but one core feature crashed on real input while passing every existing test. The lesson: test the installed experience with real data, not just unit fixtures.
+
 ## v2.4.2 — SEO-massive documentation refresh (July 2026)
 
 Full documentation rewrite for website-ready SEO. Every doc now ships with YAML frontmatter (title, description, keywords, Open Graph, Twitter card, canonical URL, last_updated, version, category). Six new feature docs cover subsystems shipped since v2.0 that were undocumented until now.

package/VERSION

@@ -1 +1 @@
-2.4.2
+2.4.4

package/hooks/hooks.json

@@ -163,7 +163,7 @@
             "timeout": 3
           }
         ],
-        "description": "Kodelyth Safety: scan user prompts for jailbreak / instruction-override patterns. Opt-in via KODELYTH_PI_GUARD=warn|block (default off).",
+        "description": "Kodelyth Safety: scan user prompts for jailbreak / instruction-override patterns. Scans by default in warn mode (logs, never blocks). KODELYTH_PI_GUARD=off to silence, =block to hard-block critical.",
         "id": "kodelyth:user-prompt:prompt-injection-guard"
       }
     ],
@@ -387,7 +387,7 @@
             "timeout": 3
           }
         ],
-        "description": "Kodelyth Safety: scan Read/WebFetch/MCP tool responses for indirect prompt-injection. Opt-in via KODELYTH_PI_GUARD=warn|block (default off).",
+        "description": "Kodelyth Safety: scan Read/WebFetch/MCP tool responses for indirect prompt-injection. Scans by default in warn mode (logs, never blocks). KODELYTH_PI_GUARD=off to silence, =block to hard-block critical.",
         "id": "kodelyth:post-tool:prompt-injection-guard"
       }
     ],

package/hooks/safety/prompt-injection-guard.js

@@ -10,7 +10,7 @@
 //                                           injection from external content)
 //
 // Modes (env var KODELYTH_PI_GUARD):
-//   off    — never run (default if unset)
+//   off    — never run
 //   warn   — exit 0 always; print findings to stderr (visible in transcript)
 //   block  — exit 2 (block) on critical; warn on high; pass on medium
 //
@@ -28,7 +28,12 @@ const path = require('path');
 
 const { scan, maxSeverity } = require('./lib/patterns');
 
-const MODE = String(process.env.KODELYTH_PI_GUARD || 'off').toLowerCase();
+// Default is 'warn' (v2.4.4+): the guard scans and surfaces findings to stderr
+// but NEVER blocks — exit 0 always. This makes the safety feature actually run
+// on a fresh install instead of being a silent no-op. Measured 0 false positives
+// on realistic legit prompts. Set KODELYTH_PI_GUARD=off to silence entirely, or
+// =block to hard-block on critical patterns (opt-in, can halt on false positives).
+const MODE = String(process.env.KODELYTH_PI_GUARD || 'warn').toLowerCase();
 const MAX_INPUT = Number(process.env.KODELYTH_PI_GUARD_MAX_INPUT || 20000);
 const LOG_PATH = process.env.KODELYTH_PI_GUARD_LOG || null;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kodelyth-ecc",
-  "version": "2.4.2",
+  "version": "2.4.4",
   "description": "Production-grade AI coding toolkit — 70 agents (incl. devil-mode adversarial crew), 194 skills, 97 commands, parallel multi-agent commands, semantic intent routing, self-learning memory, and a built-in MCP server (16 tools / 6 prompts / 377 resources) that bridges to Claude Desktop, LangGraph, AutoGen, CrewAI, and OpenAI Agents SDK. Works with Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, RooCode, Aider, Kimi, and Gemini CLI.",
   "author": "Kodelyth <github.com/sifxprime>",
   "license": "MIT",

package/scripts/memory/store.js

@@ -72,15 +72,37 @@ function newMemoryId() {
 }
 
 // ── Index ────────────────────────────────────────────────────────────────────
+function emptyIndex() {
+  return { tokens: {}, docCount: 0, avgDocLength: 0, totalLength: 0 };
+}
+
+// A valid index for the current schema MUST have a `tokens` object and a
+// numeric `docCount`. Older/foreign schemas (e.g. `{index, documents, docFreq}`
+// from a prior BM25 implementation) are unrecognised — we rebuild from the
+// append-only memories.jsonl rather than crash on `index.tokens[token]`.
+function isValidIndexSchema(idx) {
+  return !!idx
+    && typeof idx === 'object'
+    && idx.tokens && typeof idx.tokens === 'object'
+    && typeof idx.docCount === 'number';
+}
+
 function loadIndex() {
   if (!fs.existsSync(PATHS.index)) {
-    return { tokens: {}, docCount: 0, avgDocLength: 0, totalLength: 0 };
+    return rebuildIndex();
   }
+  let parsed;
   try {
-    return JSON.parse(fs.readFileSync(PATHS.index, 'utf8'));
+    parsed = JSON.parse(fs.readFileSync(PATHS.index, 'utf8'));
   } catch {
-    return { tokens: {}, docCount: 0, avgDocLength: 0, totalLength: 0 };
+    return rebuildIndex();
+  }
+  if (!isValidIndexSchema(parsed)) {
+    // Stale or foreign schema on disk — rebuild from the source of truth
+    // (the canonical rebuildIndex defined below rebuilds AND persists a valid index).
+    return rebuildIndex();
   }
+  return parsed;
 }
 
 function saveIndex(index) {
@@ -360,14 +382,19 @@ function autoResolveOnEdit(filePath, projectRoot = null) {
   return resolved;
 }
 
+// Rebuild the inverted index from memories.jsonl, persist it, and RETURN the
+// index object (with a `count` property for callers that want the memory total).
+// Returning the index lets loadIndex() self-heal a stale/foreign on-disk schema
+// in a single pass instead of returning a bare {count} that breaks search().
 function rebuildIndex() {
   const memories = readMemories();
-  let index = { tokens: {}, docCount: 0, avgDocLength: 0, totalLength: 0 };
+  let index = emptyIndex();
   for (const m of memories) {
-    index = indexMemory(index, m);
+    if (m && m.id) index = indexMemory(index, m);
   }
-  saveIndex(index);
-  return { count: memories.length };
+  try { saveIndex(index); } catch { /* read-only fs — keep in-memory index */ }
+  index.count = memories.length;
+  return index;
 }
 
 function stats() {