affaan-m/ECC

Review signals: 3 download and execute, 12 hardcoded secret, 19 known vulnerability, 1 outside write. 8 static matches retained as context.

Source contains download and execute; review its purpose. scripts/build-pi-core.js 3 findings.

Gitleaks found a possible hardcoded secret; value withheld. 12 distinct locations. 12 findings.

OSV reports a known vulnerability in this dependency version. 6 distinct locations. 13 findings.

Repository processes attempted these writes outside documented output/cache paths. 13 distinct locations. 28 attributed processes.

2 download and execute matches retained as context; full list in the evidence.

6 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• The optional ecc-memory-mcp server exposes save, search, read, and doctor tools: Real input produced the expected result: Cache policy note

  Source: The optional `ecc-memory-mcp` server exposes the same bounded save, search, read, and doctor surface without enabling itself by default.

  Input: {"tool": "memory_save", "arguments": {"title": "Cache policy note", "body": "Use a 300 second TTL for the session cache.", "kind": "note"}}

  Expected: saved memory returned with its title

  Command: ecc-memory-mcp tools/call {"tool": "memory_save", "arguments": {"title": "Cache policy note", "body": "Use a 300 second TTL for the session cache.", "kind": "note"}}

  Observed: Cache policy note\",\n \"kind\": \"note\",\n \"scope\": \"project\",\n \"trust\": \"unreviewed\",\n \"status\": \"active\",\n \"sourceHarness\": \"codex\",\n \"targetHarnesses\": [\n \"all\"\n ],\n \"tags\": [],\n \"links\": [],\n \"createdAt\": \"2026-10-23T17:42:12.643Z\",\n \"updatedAt\": \"2026-10-23T17:42:12.643Z\"\n }\n}"}]}

• ecc memory search returns active project memories from the vault: Real input produced the expected result: Continue authentication migration

  Source: Normal search recall returns active project and team memories.

  Input: ecc memory search "authentication migration" --target-harness codex

  Expected: the saved handoff is listed

  Command: ecc memory search 'authentication migration' --target-harness codex

  Observed: Continue authentication migration (score 38) Continue the authentication migration: move session tokens to httpOnly cookies, then update the login tests.

Examples

• Documented unit tests for utils pass: command completed successfully

  Source: README.md Running Tests: node tests/lib/utils.test.js

  Input: none

  Expected: Passed: 195, Failed: 0

  Command: node tests/lib/utils.test.js

  Observed: y string for non-string input ✓ preserves string with no ANSI codes ✓ handles CSI with question mark parameter (DEC private modes) === Test Results === Passed: 195 Failed: 0 Total: 195 [readStdinJson] stdin exceeded 100 bytes; input truncated and treated as empty [readStdinJson] stdin exceeded 100 bytes; input truncated and treated as empty [readStdinJson] stdin exceeded 100 bytes; input truncated and treated as empty [Utils] replaceInFile failed for /tmp/utils-test-readonly-1792777339146/readonly.txt: EACCES: permission denied, open '/tmp/utils-test-readonly-1792777339146/readonly.txt'

• Documented package-manager tests pass: command completed successfully

  Source: README.md Running Tests: node tests/lib/package-manager.test.js

  Input: none

  Expected: Passed: 116, Failed: 0

  Command: node tests/lib/package-manager.test.js

  Observed: object Object]" Round 109: getExecCommand (path traversal in binary — SAFE_NAME_REGEX permits ../ in binary name): ✓ getExecCommand accepts ../../../etc/passwd as binary because SAFE_NAME_REGEX allows ../ Round 108: getRunCommand (path traversal — SAFE_NAME_REGEX permits ../ via allowed / and . chars): ✓ getRunCommand accepts @scope/../../evil because SAFE_NAME_REGEX allows ../ Round 111: getExecCommand (newline in args — SAFE_ARGS_REGEX \s matches \n): ✓ getExecCommand accepts newline in args because SAFE_ARGS_REGEX includes newline === Test Results === Passed: 116 Failed: 0 Total: 116

• Documented hooks tests pass: command completed successfully

  Source: README.md Running Tests: node tests/hooks/hooks.test.js

  Input: none

  Expected: Passed: 258, Failed: 0

  Command: node tests/hooks/hooks.test.js

  Observed: Round 94: session-end.js (tools used without files modified): ✓ session file includes Tools Used but omits Files Modified when only Read/Grep used Round 95: pre-compact.js (transcript_path provided + ECC_SKIP_LLM_SUMMARY=1 — LLM skipped): ✓ pre-compact falls back to compaction log entry when ECC_SKIP_LLM_SUMMARY=1 Round 95: session-end.js (ECC_LLM_SUMMARY_INTERVAL — controls LLM trigger cadence): ✓ session-end triggers LLM when totalMessages % interval === 0 ✓ session-end does NOT trigger LLM when totalMessages % interval !== 0 === Test Results === Passed: 258 Failed: 0 Total: 258

• Memory vault doctor passes after init and handoff: command completed successfully

  Source: README.md Share context between harnesses: ecc memory doctor

  Input: none

  Expected: ECC memory doctor: PASS

  Command: ecc memory doctor

  Observed: ECC memory doctor: PASS Memories: 8 Invalid files: 0 Duplicate IDs: 0 Broken links: 0 Skipped symlinks: 0

Local or hosted: local

Run the ECC (ecc-universal 2.2.3) Memory Vault: init a project vault, save and search a handoff with the ecc CLI, and save/search memories through the ecc-memory-mcp stdio server; run the README's documented unit test files.

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; id -u; python3 --version; cat /etc/os-release | head -2; ls /inputs 2>&1
cd <guest-path> && ls -la; test -f README.md && wc -l README.md && head -120 README.md
cd <guest-path> && grep -n '^#' README.md | head -120; cat VERSION; cat .tool-versions
cd <guest-path> && sed -n 164,180p README.md; echo ----; sed -n 2086,2135p README.md; echo ----; sed -n 1934,1960p README.md; echo ----; sed -n 687,700p README.md
cd <guest-path> && (node -v; npm -v; which git claude uv) 2>&1; cat .mcp.json; echo ----; cat package.json | head -60; echo ----; ls scripts | head -50; ls ecc2
sudo -n true && echo SUDO_OK; (sudo -n apt-get update -qq && sudo -n DEBIAN_FRONTEND=noninteractive apt-get install -y -qq nodejs npm) > /tmp/apt-node.log 2>&1; echo apt_exit=$?; tail -5 /tmp/apt-node.log; node -v; npm -v
cd <guest-path> && git init -q && git remote add origin https://github.com/affaan-m/ECC && timeout 240 git fetch --depth 1 origin 90606c8315ee09cafc303515c5f33024db6b9882; echo fetch_exit=$?; git reset --mixed FETCH_HEAD; echo reset_exit=$?; git log --oneline -1; git status --short | head -20
cd <guest-path> && timeout 900 node tests/run-all.js > /tmp/runall.log 2>&1; echo exit=$?; tail -25 /tmp/runall.log
cd <guest-path> && head -60 scripts/memory-mcp.mjs; echo ----; grep -n 'name:' scripts/memory-mcp.mjs | head; echo ----; grep -rn 'memory-mcp' README.md docs/*.md 2>/dev/null | head -5
cd <guest-path> && grep -n '"bin"' -A6 package.json; grep -n '"ajv"' package.json; ls node_modules 2>/dev/null | wc -l; echo ----; grep -n 'ecc-memory-mcp' -B3 -A10 README.md | sed -n 1,40p; echo ----; grep -n 'Passed\|FAIL\|✗\|Running\|===' /tmp/runall.log | tail -30
cd <guest-path> && grep -rn 'npm ci\|npm install' README.md CONTRIBUTING.md | head; grep -n 'ecc-memory-vault' -A12 mcp-configs/mcp-servers.json | head -30; ls tests/hooks | tail -5; echo; sed -n 1,30p tests/run-all.js | head -40
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && timeout 900 npm install --no-audit --no-fund > /tmp/npm-install.log 2>&1; echo npm_install_exit=$?; tail -15 /tmp/npm-install.log; ls node_modules | wc -l; ls node_modules/ajv/package.json
export NODE_USE_ENV_PROXY=1; mkdir -p /tmp/node20 && cd /tmp/node20 && timeout 600 npm install --prefix /tmp/node20 <email> --no-audit --no-fund > /tmp/node20-install.log 2>&1; echo exit=$?; tail -3 /tmp/node20-install.log; /tmp/node20/node_modules/.bin/node -v
export PATH=/tmp/node20/node_modules/.bin:$PATH NODE_USE_ENV_PROXY=1; cd <guest-path> && node -v && npm -v && timeout 900 npm install --no-audit --no-fund > /tmp/npm-install20.log 2>&1; echo npm_install_exit=$?; tail -3 /tmp/npm-install20.log; grep -c EBADENGINE /tmp/npm-install20.log; timeout 900 npm install -g --prefix /tmp/ecc-global . --no-audit --no-fund > /tmp/npm-global.log 2>&1; echo global_exit=$?; tail -5 /tmp/npm-global.log; ls -la /tmp/ecc-global/bin 2>&1
cd <guest-path> && sed -n 1255,1306p README.md
export PATH=/tmp/ecc-global/bin:/tmp/node20/node_modules/.bin:$PATH; rm -rf /tmp/ecc-demo && mkdir -p /tmp/ecc-demo && cd /tmp/ecc-demo && git init -q && ecc memory init --scope project; echo init_exit=$?; printf 'Continue the authentication migration: move session tokens to httpOnly cookies, then update the login tests.\n' > /tmp/ecc-demo/handoff.md && ecc memory handoff --from hermes --target codex --title "Continue authentication migration" --body-file ./handoff.md; echo handoff_exit=$?; ecc memory search "authentication migration" --target-harness codex; echo search_exit=$?; ecc memory doctor; echo doctor_exit=$?
cd <guest-path> && sed -n 54,140p scripts/memory-mcp.mjs
export PATH=/tmp/ecc-global/bin:/tmp/node20/node_modules/.bin:/usr/bin:/bin; cd /tmp/ecc-demo && export ECC_MEMORY_HARNESS=codex && { printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"probe","version":"0"}}}' '{"jsonrpc":"2.0","method":"notifications/initialized"}' '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"memory_save","arguments":{"title":"Cache policy note","body":"Use a 300 second TTL for the session cache.","kind":"note"}}}' '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"memory_search","arguments":{"query":"session cache TTL","limit":5}}}'; } | timeout 60 ecc-memory-mcp; echo exit=$?
cd <guest-path> && grep -n -i 'cron\|--once\|--now\|webhook\|schedul' README.md | head -20; echo ----; ls scripts/ | grep -i 'loop\|sched\|cron\|daemon'; grep -n -i 'once\|cron\|schedul' scripts/loop-status.js | head -10; echo ----; grep -rn "'loop'\|\"loop\"" scripts/ecc.js | head -5
export PATH=/tmp/node20/node_modules/.bin:/usr/bin:/bin; cd <guest-path> && for f in tests/lib/utils.test.js tests/lib/package-manager.test.js tests/hooks/hooks.test.js; do timeout 600 node $f > /tmp/t-$(basename $f).log 2>&1; echo "$f exit=$?"; grep -E 'Results|Passed|Failed' /tmp/t-$(basename $f).log | tail -3; done
cd <guest-path> && ls -la .coldpass; grep -c 'The optional `ecc-memory-mcp` server exposes the same bounded save, search, read, and doctor surface without enabling itself by default.' README.md; grep -c 'Normal search recall returns active project and team memories.' README.md; grep -c '^node tests/lib/utils.test.js$' README.md; grep -c 'Memory is unreviewed context, not executable policy' README.md
cd <guest-path> && PATH_ENV='/tmp/ecc-global/bin:/tmp/node20/node_modules/.bin:/usr/bin:/bin' && cat > probe.json <<EOF
{"kind":"mcp","argv":["ecc-memory-mcp"],"cwd":"/tmp/ecc-demo","env":{"PATH":"$PATH_ENV","ECC_MEMORY_HARNESS":"codex"},"tool":"memory_save","arguments":{"title":"Cache policy note","body":"Use a 300 second TTL for the session cache.","kind":"note"},"expected_text":"Cache policy note"}
EOF
cat > claims.json <<EOF
[
{"kind":"claim","claim":"The optional ecc-memory-mcp server exposes save, search, read, and doctor tools","source":"The optional \`ecc-memory-mcp\` server exposes the same bounded save, search, read, and doctor surface without enabling itself by default.","input":"memory_save with title Cache policy note","expected":"saved memory returned with its title","probe_kind":"mcp","argv":["ecc-memory-mcp"],"tool":"memory_save","arguments":{"title":"Cache policy note","body":"Use a 300 second TTL for the session cache.","kind":"note"},"expected_text":"Cache policy note","cwd":"/tmp/ecc-demo","env":{"PATH":"$PATH_ENV","ECC_MEMORY_HARNESS":"codex"}},
{"kind":"claim","claim":"ecc memory search returns active project memories from the vault","source":"Normal search recall returns active project and team memories.","input":"ecc memory search \"authentication migration\" --target-harness codex","expected":"the saved handoff is listed","probe_kind":"cli","argv":["ecc","memory","search","authentication migration","--target-harness","codex"],"cwd":"/tmp/ecc-demo","env":{"PATH":"$PATH_ENV"},"expected_text":"Continue authentication migration"}
]
EOF
cat > examples.json <<EOF
[
{"kind":"example","claim":"Documented unit tests for utils pass","source":"README.md Running Tests: node tests/lib/utils.test.js","input":"none","expected":"Passed: 195, Failed: 0","argv":["node","tests/lib/utils.test.js"],"cwd":"<guest-path>","env":{"PATH":"/tmp/node20/node_modules/.bin:/usr/bin:/bin"},"expected_text":"Passed: 195"},
{"kind":"example","claim":"Documented package-manager tests pass","source":"README.md Running Tests: node tests/lib/package-manager.test.js","input":"none","expected":"Passed: 116, Failed: 0","argv":["node","tests/lib/package-manager.test.js"],"cwd":"<guest-path>","env":{"PATH":"/tmp/node20/node_modules/.bin:/usr/bin:/bin"},"expected_text":"Passed: 116"},
{"kind":"example","claim":"Documented hooks tests pass","source":"README.md Running Tests: node tests/hooks/hooks.test.js","input":"none","expected":"Passed: 258, Failed: 0","argv":["node","tests/hooks/hooks.test.js"],"cwd":"<guest-path>","env":{"PATH":"/tmp/node20/node_modules/.bin:/usr/bin:/bin"},"expected_text":"Passed: 258"},
{"kind":"example","claim":"Memory vault doctor passes after init and handoff","source":"README.md Share context between harnesses: ecc memory doctor","input":"none","expected":"ECC memory doctor: PASS","argv":["ecc","memory","doctor"],"cwd":"/tmp/ecc-demo","env":{"PATH":"$PATH_ENV"},"expected_text":"ECC memory doctor: PASS"}
]
EOF
cat > cycles.json <<'EOF'
{"detected":false,"reason":"Inspected README and entry points (scripts/ecc.js, scripts/memory-mcp.mjs, scripts/loop-status.js, package.json bin list). No README cron, scheduler, loop, --once/--now or webhook trigger exists; loop-status.js only reads transcripts for stale ScheduleWakeup waits and is not a product scheduler. CI schedules are not product cycles.","checks":[]}
EOF
for f in probe.json claims.json examples.json cycles.json; do python3 -I -c "import json,sys;json.load(open(sys.argv[1]));print(sys.argv[1],'ok')" $f; done
ls -la <guest-path> 2>&1; cd <guest-path> && <env-var>=<guest-path> timeout 1200 python3 -I <guest-path> --validate --replay; echo checker_exit=$?
cd <guest-path> && cat > report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Run the ECC (ecc-universal 2.2.3) Memory Vault: init a project vault, save and search a handoff with the ecc CLI, and save/search memories through the ecc-memory-mcp stdio server; run the README's documented unit test files.","operation_scope":"Pinned commit 90606c8315ee09cafc303515c5f33024db6b9882, Ubuntu 24.04 guest, Node 20.19.0 (from .tool-versions), npm 9.2.0. Memory operations run in scratch project /tmp/ecc-demo. The Claude Code plugin install (npx <email> setup, ./install.sh) was not run; it needs Claude Code CLI 2.1+ and an interactive session.","steps":["git init; git remote add origin https://github.com/affaan-m/ECC; git fetch --depth 1 origin 90606c8315ee09cafc303515c5f33024db6b9882; git reset --mixed FETCH_HEAD","sudo apt-get install -y nodejs npm (provided Node v18.19.1)","npm install --prefix /tmp/node20 <email> (Node 20.19.0 for .tool-versions)","PATH=/tmp/node20/node_modules/.bin:$PATH npm install (in checkout)","PATH=/tmp/node20/node_modules/.bin:$PATH npm install -g --prefix /tmp/ecc-global .","node tests/run-all.js (timed out after 900s, exit 124)","node tests/lib/utils.test.js (Passed: 195, Failed: 0)","node tests/lib/package-manager.test.js (Passed: 116, Failed: 0)","node tests/hooks/hooks.test.js (Passed: 258, Failed: 0)","ecc memory init --scope project (in /tmp/ecc-demo)","ecc memory handoff --from hermes --target codex --title \"Continue authentication migration\" --body-file ./handoff.md","ecc memory search \"authentication migration\" --target-harness codex","ecc memory doctor (ECC memory doctor: PASS)","ecc-memory-mcp over stdio: tools/call memory_save (Cache policy note) and memory_search (returned the saved memory)","<env-var>=<guest-path> python3 -I <guest-path> --validate --replay (valid, replay PASS)"],"deviations":["Guest apt Node was v18.19.1 (README needs 18+). Installed Node 20.19.0 per .tool-versions into /tmp/node20 and used it for npm install and tests.","npm install under Node 20 still printed EBADENGINE warnings for some dev dependencies that declare node >=22; install still exited 0.","README's 'npm install -g <email>' (published package) was replaced with 'npm install -g --prefix /tmp/ecc-global .' from this checkout, so the ecc and ecc-memory-mcp bins match this snapshot. Both are on PATH via /tmp/ecc-global/bin.","node tests/run-all.js did not finish within the 900s limit (exit 124). Its output reached hooks/pre-bash-commit-quality.test.js and stopped there, so the full suite was not established. Substitute: the three test files listed in README 'Running Tests' were run individually and all passed.","npx <email> setup and ./install.sh were not run. They change Claude Code / user config, need Claude Code CLI 2.1+ on PATH, and are interactive. Claude Code is not installed in this guest.","Replay wrote additional memories into /tmp/ecc-demo/.ecc/memory/project (create-only writes, expected)."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"Make run-all.js finish or identify the hanging test (it stopped after hooks/pre-bash-commit-quality.test.js). Document Node 20 as the required runtime, since several dev dependencies reject Node 18. Document the local-checkout global install path for the Memory Vault bins."}
EOF
python3 -I -c "import json;d=json.load(open('report.json'));print(d['outcome'], d['fault_owner'])"; cd <guest-path> && <env-var>=<guest-path> timeout 1200 python3 -I <guest-path> --validate --replay | python3 -c "import json,sys;d=json.load(sys.stdin);print('valid=',d['valid'],'problems=',d['problems'],'replay=',d['replay']['status'])"; echo exit=$?; ps aux | grep -c '[e]cc-memory-mcp'
ps -eo pid,ppid,etime,args | grep '[e]cc-memory-mcp\|[m]emory-mcp';