kodelyth-ecc 2.4.3 → 2.4.4

package/CHANGELOG.md

@@ -2,6 +2,38 @@
 
 All notable changes to Kodelyth ECC are documented here.
 
+## v2.4.4 — Real-user audit: prompt-injection guard was a silent no-op (July 2026)
+
+Phase 1 of the real-user audit — firing every hook with realistic input instead of fixtures. Found a second "installed but dummy" feature.
+
+### Fixed
+
+- **Prompt-injection guard defaulted to `MODE=off`** — so on every fresh install the hook was registered, fired on each prompt, and did **absolutely nothing** unless the user knew to set `KODELYTH_PI_GUARD=warn`. A safety feature nobody knew to turn on is a safety feature that doesn't exist.
+- **Fix**: default is now `warn` — the guard scans every prompt + tool response and surfaces injection findings to stderr (visible in transcript), but **never blocks** (exit 0 always). Measured **0 false positives** across 8 realistic legit prompts containing trigger-adjacent words ("ignore", "override", "system prompt", "bypass", "reveal"). Set `KODELYTH_PI_GUARD=off` to silence, `=block` to hard-block critical patterns (still opt-in, since block can halt on false positives).
+
+### Verified (real-user audit, this round)
+
+Fired all 8 hooks with realistic Claude Code payloads:
+
+| Hook | Result |
+|---|---|
+| `inject-start` | ✓ outputs memory context block |
+| `read-lessons` | ✓ exit 0 |
+| `auto-recall` | ✓ recalls 3 real memories (post-2.4.3 fix) |
+| `capture-stop` | ✓ exit 0 |
+| `capture-correction` | ✓ exit 0 |
+| `auto-resolve` | ✓ exit 0 |
+| `prompt-injection-guard` | ✗→✓ was silent no-op, now warns by default |
+| `token-budget` | ✓ exit 0 |
+
+Also verified on real data: `route` (correctly classified a production outage as hard→opus), `evolve analyze` (scanned 195 reuse + 3 miss signals → 5 proposals).
+
+### Tests
+
+- Updated `mode=off` test to set the env var explicitly (default is no longer off)
+- Added 2 tests: default-no-env warns on injection + stays silent on legit prompts
+- Full suite: 0 failures across 25 files
+
 ## v2.4.3 — Memory recall crash fix (the "still dummy" bug) (July 2026)
 
 Found by testing ECC as a real user actually experiences it, not just in the test harness. **Memory recall was silently crashing on every prompt** for any user whose `~/.kodelythecc/memory/index.json` was written by an older/foreign BM25 schema.

package/VERSION

@@ -1 +1 @@
-2.4.3
+2.4.4

package/hooks/hooks.json

@@ -163,7 +163,7 @@
             "timeout": 3
           }
         ],
-        "description": "Kodelyth Safety: scan user prompts for jailbreak / instruction-override patterns. Opt-in via KODELYTH_PI_GUARD=warn|block (default off).",
+        "description": "Kodelyth Safety: scan user prompts for jailbreak / instruction-override patterns. Scans by default in warn mode (logs, never blocks). KODELYTH_PI_GUARD=off to silence, =block to hard-block critical.",
         "id": "kodelyth:user-prompt:prompt-injection-guard"
       }
     ],
@@ -387,7 +387,7 @@
             "timeout": 3
           }
         ],
-        "description": "Kodelyth Safety: scan Read/WebFetch/MCP tool responses for indirect prompt-injection. Opt-in via KODELYTH_PI_GUARD=warn|block (default off).",
+        "description": "Kodelyth Safety: scan Read/WebFetch/MCP tool responses for indirect prompt-injection. Scans by default in warn mode (logs, never blocks). KODELYTH_PI_GUARD=off to silence, =block to hard-block critical.",
         "id": "kodelyth:post-tool:prompt-injection-guard"
       }
     ],

package/hooks/safety/prompt-injection-guard.js

@@ -10,7 +10,7 @@
 //                                           injection from external content)
 //
 // Modes (env var KODELYTH_PI_GUARD):
-//   off    — never run (default if unset)
+//   off    — never run
 //   warn   — exit 0 always; print findings to stderr (visible in transcript)
 //   block  — exit 2 (block) on critical; warn on high; pass on medium
 //
@@ -28,7 +28,12 @@ const path = require('path');
 
 const { scan, maxSeverity } = require('./lib/patterns');
 
-const MODE = String(process.env.KODELYTH_PI_GUARD || 'off').toLowerCase();
+// Default is 'warn' (v2.4.4+): the guard scans and surfaces findings to stderr
+// but NEVER blocks — exit 0 always. This makes the safety feature actually run
+// on a fresh install instead of being a silent no-op. Measured 0 false positives
+// on realistic legit prompts. Set KODELYTH_PI_GUARD=off to silence entirely, or
+// =block to hard-block on critical patterns (opt-in, can halt on false positives).
+const MODE = String(process.env.KODELYTH_PI_GUARD || 'warn').toLowerCase();
 const MAX_INPUT = Number(process.env.KODELYTH_PI_GUARD_MAX_INPUT || 20000);
 const LOG_PATH = process.env.KODELYTH_PI_GUARD_LOG || null;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kodelyth-ecc",
-  "version": "2.4.3",
+  "version": "2.4.4",
   "description": "Production-grade AI coding toolkit — 70 agents (incl. devil-mode adversarial crew), 194 skills, 97 commands, parallel multi-agent commands, semantic intent routing, self-learning memory, and a built-in MCP server (16 tools / 6 prompts / 377 resources) that bridges to Claude Desktop, LangGraph, AutoGen, CrewAI, and OpenAI Agents SDK. Works with Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, RooCode, Aider, Kimi, and Gemini CLI.",
   "author": "Kodelyth <github.com/sifxprime>",
   "license": "MIT",