kodelyth-ecc 2.4.3 → 2.4.5

package/CHANGELOG.md

@@ -2,6 +2,56 @@
 
 All notable changes to Kodelyth ECC are documented here.
 
+## v2.4.5 — Real-user audit: auto-capture never captured anything (July 2026)
+
+Third "installed but dummy" feature found in the audit — and the biggest. **The entire memory-capture side was dead.**
+
+### Fixed
+
+- **`scripts/memory/extract.js` mined ZERO candidates from real transcripts.** Real Claude Code transcript events nest `role`, `content`, and tool calls under `.message` (e.g. `event.message.role`, `content[].type === 'tool_use'`). `extractCandidates()` read flat `ev.role` / `ev.tool_name` / `ev.tool_input`, so it skipped every event and never captured a single memory. The 52 memories in the store came from seeds and MCP `capture_memory` — the automatic Stop-hook capture had **never worked** on real data.
+- **Fix**: `readTranscript()` now normalizes every raw event to the flat shape downstream code expects — resolving `role` from `message.role`, surfacing the first `tool_use` as `tool_name`/`tool_input`, and exposing `tool_result` output for success scoring. Verified: a real transcript now mines **12 candidates** (was 0); the full `capture-stop` hook queues 3 to `pending-review.jsonl` end-to-end.
+- **Bonus quality fix**: `approach` extraction now finds the last assistant message *with text*, skipping trailing `tool_use`/`tool_result` events that carry no explanation. Previously a fix followed by a tool call produced an empty approach and got dropped.
+
+### Added
+
+- **`tests/memory/extract.test.js`** — `extract.js` was completely untested, which is exactly how this shipped. New tests cover: nested-message mining, no-success-signal → no capture, legacy flat shape still works, and empty/malformed safety.
+
+### Impact
+
+Memory now works **both ways** for real users: recall (fixed in 2.4.3) AND capture (fixed here). Before this session, a fresh install's memory system was effectively write-nothing / read-crash.
+
+## v2.4.4 — Real-user audit: prompt-injection guard was a silent no-op (July 2026)
+
+Phase 1 of the real-user audit — firing every hook with realistic input instead of fixtures. Found a second "installed but dummy" feature.
+
+### Fixed
+
+- **Prompt-injection guard defaulted to `MODE=off`** — so on every fresh install the hook was registered, fired on each prompt, and did **absolutely nothing** unless the user knew to set `KODELYTH_PI_GUARD=warn`. A safety feature nobody knew to turn on is a safety feature that doesn't exist.
+- **Fix**: default is now `warn` — the guard scans every prompt + tool response and surfaces injection findings to stderr (visible in transcript), but **never blocks** (exit 0 always). Measured **0 false positives** across 8 realistic legit prompts containing trigger-adjacent words ("ignore", "override", "system prompt", "bypass", "reveal"). Set `KODELYTH_PI_GUARD=off` to silence, `=block` to hard-block critical patterns (still opt-in, since block can halt on false positives).
+
+### Verified (real-user audit, this round)
+
+Fired all 8 hooks with realistic Claude Code payloads:
+
+| Hook | Result |
+|---|---|
+| `inject-start` | ✓ outputs memory context block |
+| `read-lessons` | ✓ exit 0 |
+| `auto-recall` | ✓ recalls 3 real memories (post-2.4.3 fix) |
+| `capture-stop` | ✓ exit 0 |
+| `capture-correction` | ✓ exit 0 |
+| `auto-resolve` | ✓ exit 0 |
+| `prompt-injection-guard` | ✗→✓ was silent no-op, now warns by default |
+| `token-budget` | ✓ exit 0 |
+
+Also verified on real data: `route` (correctly classified a production outage as hard→opus), `evolve analyze` (scanned 195 reuse + 3 miss signals → 5 proposals).
+
+### Tests
+
+- Updated `mode=off` test to set the env var explicitly (default is no longer off)
+- Added 2 tests: default-no-env warns on injection + stays silent on legit prompts
+- Full suite: 0 failures across 25 files
+
 ## v2.4.3 — Memory recall crash fix (the "still dummy" bug) (July 2026)
 
 Found by testing ECC as a real user actually experiences it, not just in the test harness. **Memory recall was silently crashing on every prompt** for any user whose `~/.kodelythecc/memory/index.json` was written by an older/foreign BM25 schema.

package/VERSION

@@ -1 +1 @@
-2.4.3
+2.4.5

package/hooks/hooks.json

@@ -163,7 +163,7 @@
             "timeout": 3
           }
         ],
-        "description": "Kodelyth Safety: scan user prompts for jailbreak / instruction-override patterns. Opt-in via KODELYTH_PI_GUARD=warn|block (default off).",
+        "description": "Kodelyth Safety: scan user prompts for jailbreak / instruction-override patterns. Scans by default in warn mode (logs, never blocks). KODELYTH_PI_GUARD=off to silence, =block to hard-block critical.",
         "id": "kodelyth:user-prompt:prompt-injection-guard"
       }
     ],
@@ -387,7 +387,7 @@
             "timeout": 3
           }
         ],
-        "description": "Kodelyth Safety: scan Read/WebFetch/MCP tool responses for indirect prompt-injection. Opt-in via KODELYTH_PI_GUARD=warn|block (default off).",
+        "description": "Kodelyth Safety: scan Read/WebFetch/MCP tool responses for indirect prompt-injection. Scans by default in warn mode (logs, never blocks). KODELYTH_PI_GUARD=off to silence, =block to hard-block critical.",
         "id": "kodelyth:post-tool:prompt-injection-guard"
       }
     ],

package/hooks/safety/prompt-injection-guard.js

@@ -10,7 +10,7 @@
 //                                           injection from external content)
 //
 // Modes (env var KODELYTH_PI_GUARD):
-//   off    — never run (default if unset)
+//   off    — never run
 //   warn   — exit 0 always; print findings to stderr (visible in transcript)
 //   block  — exit 2 (block) on critical; warn on high; pass on medium
 //
@@ -28,7 +28,12 @@ const path = require('path');
 
 const { scan, maxSeverity } = require('./lib/patterns');
 
-const MODE = String(process.env.KODELYTH_PI_GUARD || 'off').toLowerCase();
+// Default is 'warn' (v2.4.4+): the guard scans and surfaces findings to stderr
+// but NEVER blocks — exit 0 always. This makes the safety feature actually run
+// on a fresh install instead of being a silent no-op. Measured 0 false positives
+// on realistic legit prompts. Set KODELYTH_PI_GUARD=off to silence entirely, or
+// =block to hard-block on critical patterns (opt-in, can halt on false positives).
+const MODE = String(process.env.KODELYTH_PI_GUARD || 'warn').toLowerCase();
 const MAX_INPUT = Number(process.env.KODELYTH_PI_GUARD_MAX_INPUT || 20000);
 const LOG_PATH = process.env.KODELYTH_PI_GUARD_LOG || null;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kodelyth-ecc",
-  "version": "2.4.3",
+  "version": "2.4.5",
   "description": "Production-grade AI coding toolkit — 70 agents (incl. devil-mode adversarial crew), 194 skills, 97 commands, parallel multi-agent commands, semantic intent routing, self-learning memory, and a built-in MCP server (16 tools / 6 prompts / 377 resources) that bridges to Claude Desktop, LangGraph, AutoGen, CrewAI, and OpenAI Agents SDK. Works with Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, RooCode, Aider, Kimi, and Gemini CLI.",
   "author": "Kodelyth <github.com/sifxprime>",
   "license": "MIT",

package/scripts/memory/extract.js

@@ -36,12 +36,54 @@ const FAILURE_PHRASES = [
   /\bsame error\b/i,
 ];
 
+// Real Claude Code transcript events nest role/content/tool info under
+// `.message`; tool calls live as `content[].type === 'tool_use'` and tool
+// results come back in the next user message as `content[].type === 'tool_result'`.
+// Downstream code reads flat `ev.role`, `ev.tool_name`, `ev.tool_input`,
+// `ev.content` — so we normalise every raw event to that flat shape. Without
+// this, extractCandidates() skips every event and auto-capture never fires.
+function normalizeEvent(raw) {
+  if (!raw || typeof raw !== 'object') return null;
+  const msg = raw.message && typeof raw.message === 'object' ? raw.message : null;
+
+  // role: prefer message.role, fall back to the top-level `type` (user/assistant)
+  const role = (msg && msg.role) || (raw.role) ||
+    (raw.type === 'user' || raw.type === 'assistant' ? raw.type : undefined);
+
+  // content: keep whatever extractText already understands (string | array | message)
+  const content = (msg && msg.content !== undefined) ? msg.content : raw.content;
+
+  const out = { ...raw, role, content };
+
+  // tool_use: surface the FIRST tool call in an assistant message as
+  // ev.tool_name / ev.tool_input so the flat readers see it.
+  if (Array.isArray(content)) {
+    const toolUse = content.find(c => c && c.type === 'tool_use');
+    if (toolUse) {
+      out.tool_name  = toolUse.name;
+      out.tool_input = toolUse.input || {};
+    }
+    // tool_result carries command output (exit codes, "tests passed", etc.)
+    const toolResult = content.find(c => c && c.type === 'tool_result');
+    if (toolResult && !out.tool_name) {
+      const rc = toolResult.content;
+      out._toolResultText = typeof rc === 'string'
+        ? rc
+        : Array.isArray(rc) ? rc.map(x => (typeof x === 'string' ? x : x?.text || '')).join('\n') : '';
+    }
+  }
+  return out;
+}
+
 function readTranscript(jsonlPath) {
   if (!fs.existsSync(jsonlPath)) return [];
   const lines = fs.readFileSync(jsonlPath, 'utf8').split('\n').filter(Boolean);
   const events = [];
   for (const line of lines) {
-    try { events.push(JSON.parse(line)); } catch { /* skip malformed */ }
+    try {
+      const norm = normalizeEvent(JSON.parse(line));
+      if (norm) events.push(norm);
+    } catch { /* skip malformed */ }
   }
   return events;
 }
@@ -49,11 +91,15 @@ function readTranscript(jsonlPath) {
 function extractText(event) {
   if (typeof event.content === 'string') return event.content;
   if (Array.isArray(event.content)) {
-    return event.content
+    const text = event.content
       .filter(c => c && (c.type === 'text' || typeof c.text === 'string'))
       .map(c => c.text || '')
       .join('\n');
+    if (text) return text;
+    // tool_result content (command output) — used for success scoring
+    if (event._toolResultText) return event._toolResultText;
   }
+  if (event._toolResultText) return event._toolResultText;
   if (event.message?.content) return extractText({ content: event.message.content });
   return '';
 }
@@ -148,8 +194,15 @@ function extractCandidates(jsonlPath) {
         .filter(Boolean)
     )).slice(0, 5);
 
-    const lastAssistant = window.reverse().find(e => e.role === 'assistant');
-    const approach = lastAssistant ? extractText(lastAssistant).slice(0, 600) : null;
+    // Find the last assistant message that actually has TEXT — skip trailing
+    // tool_use/tool_result events which carry no explanation of the fix.
+    const reversed = window.slice().reverse();
+    let approach = null;
+    for (const e of reversed) {
+      if (e.role !== 'assistant') continue;
+      const t = extractText(e).trim();
+      if (t) { approach = t.slice(0, 600); break; }
+    }
 
     if (!problem || !approach) continue;