fix: 80 validated findings from the 2026-10-12 bug hunt

AGENTS.md

@@ -107,7 +107,8 @@ internal/
                               from tool output); effects.go + reconcile.go — effect evidence and
                               post-batch reconciliation; signal.go — SignalEvent observability
                               (context_trimmed, tool_recovery, tool_running heartbeat); budget enforcement
-                              (budget.Checker) + odek.event/v1 emission.
+                              (budget.Checker) + odek.event/v1 emission; neutralise_tags.go — rewrites
+                              look-alikes of the untrusted-content boundary tag inside wrapped bodies.
   tool/                       Thread-safe tool registry, clarify.go, send_message.go, purity.go (first-party-only
                               pure-output registry: a registered type's pure calls skip the ingest taint)
   danger/                     Command/URL classification + bypass-resistant tokenizer. Approver interface +
@@ -129,6 +130,13 @@ internal/
     readledger.go               Unread-script gate: fingerprinted, bounded read ledger; ForgetReadLedger per session key
     ledger_indirect.go          Scripts delivered indirectly (pipes, substitutions, eval, find -exec, program-file options)
     path_identity.go            Symlink-resolving path targets for classification (snapshot, not an execution boundary)
+    sensitive_read.go           IsSensitiveReadPath: paths @-references refuse (shares the home credential table with ClassifyPath)
+    arith_eval.go               Arithmetic-evaluating builtins (let, declare, …): command substitutions in subscripts are classified
+    param_default.go            ${name:-word} / ${name:=word} / ${name:+word} default words classified as the commands they can run
+    env_dump_tools.go           jq/yq/ps environment disclosure → system_write
+    env_code.go                 PROMPT_COMMAND / PS0-PS4 / BASH_FUNC_ assignments: values classified as commands
+    gpg_adapter.go              gpg classified by operation (keyring mutation, photo viewer, non-default homedir)
+    kill_broadcast.go           pkill/killall broadcast detection (match-everything patterns, user selectors, -P 1)
     injection.go                Injection scanner (ScanInjection) with Unicode folding
     approver.go                 Approver interface, TTY approver, friction
     display.go                  SanitizeForDisplay/SanitizeInline: control/bidi/invisible characters escaped in every prompt
@@ -154,7 +162,8 @@ internal/
                               Config: `maintenance` section (operator-only).
   skills/                     Skill system (types, loader, triggers, import, cache). SkillProvenance gate.
   config/                     Config file loading, env vars, secrets.env, priority merge, limits clamp (project may only lower budgets)
-  telegram/                   Telegram bot: bot.go, poller.go, handler.go, commands.go, session.go, health.go, plan.go, media_path.go
+  telegram/                   Telegram bot: bot.go, poller.go, handler.go, commands.go, session.go, health.go, plan.go, media_path.go,
+                              session_scope.go (session-id → chat ownership check), send_fallback.go (plain-text resend when markup is rejected)
   render/                     Terminal output and narrator support
   narrate/                    LLM-powered emoji-rich progress messages
   redact/                     Secret redaction (20+ patterns)

cmd/odek/artifact_read_tool.go

@@ -26,6 +26,7 @@ import (
 	"io"
 	"os"
 	"strings"
+	"sync"
 	"syscall"
 
 	"github.com/BackendStack21/odek"
@@ -172,6 +173,23 @@ func verifyArtifactWindow(path string, ref artifact.Ref, maxBytes, offset, limit
 // artifactReadTool reads registered sub-agent result artifacts by id.
 type artifactReadTool struct {
 	ctxTool
+	sessMu    sync.Mutex
+	sessionID string
+}
+
+// SetSessionID binds the tool to the calling session: it resolves and lists
+// only artifacts that session's delegate_tasks registered. Serve rebinds it
+// between prompts, hence the lock.
+func (t *artifactReadTool) SetSessionID(id string) {
+	t.sessMu.Lock()
+	t.sessionID = id
+	t.sessMu.Unlock()
+}
+
+func (t *artifactReadTool) getSessionID() string {
+	t.sessMu.Lock()
+	defer t.sessMu.Unlock()
+	return t.sessionID
 }
 
 var _ odek.Tool = (*artifactReadTool)(nil)
@@ -234,9 +252,10 @@ func (t *artifactReadTool) Call(args string) (string, error) {
 		in.Limit = artifactReadMaxLimit
 	}
 
-	entry, ok := lookupSubagentArtifact(in.ID)
+	session := t.getSessionID()
+	entry, ok := lookupSessionArtifact(session, in.ID)
 	if !ok {
-		return fmt.Sprintf(`{"error":"unknown artifact id %q — registered artifacts: %s"}`, in.ID, artifactIDList()), nil
+		return fmt.Sprintf(`{"error":"unknown artifact id %q — registered artifacts: %s"}`, in.ID, sessionArtifactIDList(session)), nil
 	}
 
 	// Re-verify at read time (TOCTOU): the file is re-opened with symlink

cmd/odek/audit.go

@@ -113,7 +113,7 @@ func recordTurnAudit(store *session.AuditStore, sessionID string, turn int, user
 	// mention. We intentionally do not scan raw tool results here; a
 	// resource that merely appears in a fetched page is not itself a
 	// divergence unless the agent acts on it.
-	novel := session.NovelResources(userText, actionText.String())
+	novel := session.NovelResources(redact.RedactSecrets(userText), redact.RedactSecrets(actionText.String()))
 
 	// Resources introduced by untrusted content itself. Even if the user
 	// mentioned the same resource earlier, acting on it after it appears in
@@ -169,7 +169,7 @@ func recordTurnAudit(store *session.AuditStore, sessionID string, turn int, user
 	}
 	var untrustedResources []string
 	seen := make(map[string]bool)
-	for _, r := range session.ResourcesIn(actionText.String()) {
+	for _, r := range session.ResourcesIn(redact.RedactSecrets(actionText.String())) {
 		lr := auditKey(r)
 		if untrustedResSet[lr] && !seen[lr] {
 			seen[lr] = true
@@ -194,9 +194,12 @@ func recordTurnAudit(store *session.AuditStore, sessionID string, turn int, user
 }
 
 // auditOpsResourceMatchesSource reports whether resource r is the untrusted
-// content's own source s (case-insensitive): equal, or one lies under the
-// other on a path boundary — the longer continues with '/', '?' or '#', or
-// the shorter ends with '/'. A raw string prefix is not enough: the
+// content's own source s (case-insensitive): equal, or r lies under s on a
+// path boundary: r continues s with '/', '?' or '#', or s ends with '/'.
+// The match is one-directional: an ancestor of the source (the directory a
+// file lives in, the site root of a page) is not the content's own source,
+// so the content naming it is a reused-resource signal. A raw string prefix
+// is not enough either: the
 // look-alike host https://news.example.com.collector.net extends the source
 // https://news.example.com without being part of it.
 func auditOpsResourceMatchesSource(r, s string) bool {
@@ -207,17 +210,13 @@ func auditOpsResourceMatchesSource(r, s string) bool {
 	if lr == ls {
 		return true
 	}
-	short, long := ls, lr
-	if len(lr) < len(ls) {
-		short, long = lr, ls
-	}
-	if !strings.HasPrefix(long, short) {
+	if !strings.HasPrefix(lr, ls) {
 		return false
 	}
-	if strings.HasSuffix(short, "/") {
+	if strings.HasSuffix(ls, "/") {
 		return true
 	}
-	switch long[len(short)] {
+	switch lr[len(ls)] {
 	case '/', '?', '#':
 		return true
 	}
@@ -275,12 +274,15 @@ func auditList(store *session.Store, auditStore *session.AuditStore) error {
 				suspicious++
 			}
 		}
-		firstSource := log.Ingests[0].Source
+		// Ingest sources are tool-chosen labels built from attacker-
+		// influenced text: escape control/bidi characters first, then
+		// truncate on rune boundaries.
+		firstSource := []rune(danger.SanitizeInline(log.Ingests[0].Source))
 		if len(firstSource) > 40 {
-			firstSource = firstSource[:37] + "..."
+			firstSource = append(firstSource[:37], '.', '.', '.')
 		}
 		fmt.Printf("%-22s %7d %6d %11d  %s\n",
-			s.ID, len(log.Ingests), len(log.Turns), suspicious, firstSource)
+			danger.SanitizeInline(s.ID), len(log.Ingests), len(log.Turns), suspicious, string(firstSource))
 	}
 	return nil
 }

cmd/odek/bg_telegram.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/BackendStack21/odek/internal/bgproc"
 	"github.com/BackendStack21/odek/internal/config"
+	"github.com/BackendStack21/odek/internal/redact"
 	"github.com/BackendStack21/odek/internal/telegram"
 )
 
@@ -265,9 +266,9 @@ func formatBGJobsForChat(rt *bgRuntime) string {
 	b.WriteString("📋 Background jobs:\n")
 	for _, j := range jobs {
 		if j.Status == bgproc.StatusRunning {
-			fmt.Fprintf(&b, "• %s — %s — running (%.0fs)\n", j.ID, headString(j.Command, 48), jobRuntimeSeconds(j))
+			fmt.Fprintf(&b, "• %s — %s — running (%.0fs)\n", j.ID, headString(redact.RedactSecrets(j.Command), 48), jobRuntimeSeconds(j))
 		} else {
-			fmt.Fprintf(&b, "• %s — %s — %s (exit %d)\n", j.ID, headString(j.Command, 48), j.Status, j.ExitCode)
+			fmt.Fprintf(&b, "• %s — %s — %s (exit %d)\n", j.ID, headString(redact.RedactSecrets(j.Command), 48), j.Status, j.ExitCode)
 		}
 	}
 	return strings.TrimRight(b.String(), "\n")

cmd/odek/bg_tools.go

@@ -203,13 +203,13 @@ func formatOneNotice(n bgproc.Notice) string {
 	var line string
 	switch n.Status {
 	case bgproc.StatusExited:
-		line = fmt.Sprintf("%s `%s` → exited (code %d) after %s", n.JobID, headString(n.Command, bgCommandHead), n.ExitCode, dur)
+		line = fmt.Sprintf("%s `%s` → exited (code %d) after %s", n.JobID, bgClientCommandHead(n.Command), n.ExitCode, dur)
 	case bgproc.StatusFailed:
-		line = fmt.Sprintf("%s `%s` → failed (exit %d) after %s", n.JobID, headString(n.Command, bgCommandHead), n.ExitCode, dur)
+		line = fmt.Sprintf("%s `%s` → failed (exit %d) after %s", n.JobID, bgClientCommandHead(n.Command), n.ExitCode, dur)
 	case bgproc.StatusTimeout:
-		line = fmt.Sprintf("%s `%s` → timeout after %s", n.JobID, headString(n.Command, bgCommandHead), dur)
+		line = fmt.Sprintf("%s `%s` → timeout after %s", n.JobID, bgClientCommandHead(n.Command), dur)
 	default:
-		line = fmt.Sprintf("%s `%s` → %s after %s", n.JobID, headString(n.Command, bgCommandHead), n.Status, dur)
+		line = fmt.Sprintf("%s `%s` → %s after %s", n.JobID, bgClientCommandHead(n.Command), n.Status, dur)
 	}
 	if n.Tail != "" {
 		line += "\n  tail: " + redact.RedactSecrets(n.Tail)
@@ -360,6 +360,17 @@ func (t *bgStartTool) Schema() any {
 const maxBGTimeoutSeconds = 365 * 24 * 3600
 
 func (t *bgStartTool) Call(args string) (string, error) {
+	return t.CallContext(context.Background(), args)
+}
+
+// CallContext evaluates the approval gate with the invocation context scoped
+// to this runtime's session, so the unread-script gate consults the session's
+// read ledger (as the shell tool does) rather than whatever context the shell
+// tool last recorded.
+func (t *bgStartTool) CallContext(ctx context.Context, args string) (string, error) {
+	if t.rt != nil {
+		ctx = withReadLedger(ctx, t.rt.session)
+	}
 	var p struct {
 		Command        string `json:"command"`
 		TimeoutSeconds int    `json:"timeout_seconds"`
@@ -385,9 +396,9 @@ func (t *bgStartTool) Call(args string) (string, error) {
 	if t.shell == nil {
 		return "", fmt.Errorf("bg_start unavailable: approval gate not wired")
 	}
-	approvedRisk, _ := danger.ClassifyScriptGateCtx(t.shell.toolCtx(), p.Command)
+	approvedRisk, unreadTargets := shellScriptGate(ctx, p.Command)
 	approvedEffects := danger.Analyze(p.Command).Effects
-	if err := t.shell.checkApproval(p.Command, "background job"); err != nil {
+	if err := t.shell.checkApprovalGated(p.Command, "background job", unreadTargets); err != nil {
 		return "", err
 	}
 	opts := bgproc.SpawnOptions{}
@@ -398,7 +409,7 @@ func (t *bgStartTool) Call(args string) (string, error) {
 			return "", err
 		}
 	}
-	if err := revalidateShellRisk(t.shell.toolCtx(), p.Command, approvedRisk, approvedEffects); err != nil {
+	if err := revalidateShellRisk(ctx, p.Command, approvedRisk, approvedEffects); err != nil {
 		if opts.Release != nil {
 			opts.Release()
 		}

cmd/odek/browser_tool.go

@@ -60,6 +60,21 @@ const maxBrowserElements = 500
 // history limit cannot be bypassed by a small number of huge pages.
 const maxBrowserSnapshotBytes = 1 * 1024 * 1024
 
+// Per-field caps for page-derived strings kept outside Content (title, element
+// text, link URLs). With maxBrowserElements they bound the whole snapshot.
+const (
+	maxBrowserFieldBytes = 2 * 1024
+	maxBrowserURLBytes   = 8 * 1024
+)
+
+// capBrowserField clamps a single page-derived string to maxBrowserFieldBytes.
+func capBrowserField(s string) string {
+	if len(s) <= maxBrowserFieldBytes {
+		return s
+	}
+	return truncateUTF8Safe(s, maxBrowserFieldBytes)
+}
+
 // truncatePageContent caps page text at maxBrowserSnapshotBytes, backing up
 // to a UTF-8 rune boundary so a multibyte character split by the cap never
 // ships U+FFFD mojibake, and appends a truncation marker.
@@ -117,7 +132,7 @@ func (t *browserTool) checkRedirect(req *http.Request, via []*http.Request) erro
 		return fmt.Errorf("stopped after 10 redirects")
 	}
 	target := req.URL.String()
-	risk := danger.ClassifyURL(target)
+	risk := ssrfClassifyURL(target)
 	if err := t.dangerousConfig.CheckOperation(danger.ToolOperation{
 		Name: "browser", Resource: target, Risk: risk,
 	}, t.trustedClasses); err != nil {
@@ -229,7 +244,7 @@ func (t *browserTool) doNavigate(rawURL string) (string, error) {
 	req.Header.Set("Accept", "text/html,application/xhtml+xml")
 
 	// Security: classify and check browser operation
-	risk := danger.ClassifyURL(rawURL)
+	risk := ssrfClassifyURL(rawURL)
 	if err := t.dangerousConfig.CheckOperation(danger.ToolOperation{
 		Name: "browser", Resource: rawURL, Risk: risk,
 	}, t.trustedClasses); err != nil {
@@ -378,7 +393,7 @@ func parseHTML(ctx context.Context, html, pageURL string, status int) browserSna
 
 	// Extract title
 	if m := reTitle.FindStringSubmatch(html); len(m) > 1 {
-		snap.Title = strings.TrimSpace(m[1])
+		snap.Title = capBrowserField(strings.TrimSpace(m[1]))
 	}
 
 	var contentParts []string
@@ -416,12 +431,12 @@ func parseHTML(ctx context.Context, html, pageURL string, status int) browserSna
 			break
 		}
 		href := strings.TrimSpace(m[1])
-		text := strings.TrimSpace(m[2])
+		text := capBrowserField(strings.TrimSpace(m[2]))
 		// Skip non-navigable schemes. The check is case-insensitive and
 		// covers javascript:, data:, and vbscript: — all of which can carry
 		// script/active content the agent must never be sent into.
 		lowerHref := strings.ToLower(href)
-		if href == "" || text == "" || href == "#" ||
+		if href == "" || text == "" || href == "#" || len(href) > maxBrowserURLBytes ||
 			strings.HasPrefix(lowerHref, "javascript:") ||
 			strings.HasPrefix(lowerHref, "data:") ||
 			strings.HasPrefix(lowerHref, "vbscript:") {
@@ -451,7 +466,7 @@ func parseHTML(ctx context.Context, html, pageURL string, status int) browserSna
 		if len(elements) >= maxBrowserElements {
 			break
 		}
-		text := strings.TrimSpace(m[1])
+		text := capBrowserField(strings.TrimSpace(m[1]))
 		if text == "" {
 			text = "button"
 		}
@@ -476,6 +491,7 @@ func parseHTML(ctx context.Context, html, pageURL string, status int) browserSna
 		} else if pm := reInputPlaceholder.FindStringSubmatch(tag); len(pm) > 1 {
 			text = "[" + pm[1] + "]"
 		}
+		text = capBrowserField(text)
 		if text == "" {
 			text = "input"
 		}

cmd/odek/file_tool.go

@@ -982,7 +982,7 @@ func (t *searchFilesTool) searchContent(args searchFilesArgs) (string, error) {
 	}
 
 	t.wrapContentMatches(matches)
-	return jsonResult(searchFilesResult{Matches: matches, Skipped: skipped})
+	return jsonResult(searchFilesResult{Matches: matches, Skipped: t.wrapSkipped(skipped)})
 }
 
 // wrapContentMatches marks every matched path and line as untrusted. All
@@ -1043,7 +1043,20 @@ func (t *searchFilesTool) searchFiles(args searchFilesArgs) (string, error) {
 		}
 	}
 
-	return jsonResult(searchFilesResult{Matches: matches, Skipped: skipped})
+	return jsonResult(searchFilesResult{Matches: matches, Skipped: t.wrapSkipped(skipped)})
+}
+
+// wrapSkipped marks skipped entries as untrusted: they carry repository file
+// names and error text, which are as attacker-controlled as matched paths.
+func (t *searchFilesTool) wrapSkipped(skipped []string) []string {
+	if len(skipped) == 0 {
+		return skipped
+	}
+	sources := make([]string, len(skipped))
+	for i, s := range skipped {
+		sources[i] = "search_files:skipped:" + s
+	}
+	return wrapUntrustedBatch(t.toolCtx(), "search_files:skipped", sources, skipped)
 }
 
 // ── Patch Tool ─────────────────────────────────────────────────────────
@@ -1590,8 +1603,9 @@ func confineToCWD(path string) (string, error) {
 		}
 		for _, h := range homes {
 			odekPrefix := h + "/.odek/"
-			if len(absResolved) >= len(odekPrefix) && strings.EqualFold(absResolved[:len(odekPrefix)], odekPrefix) {
-				if isProtectedOdekPath(absResolved[len(odekPrefix):]) {
+			foldedAbs, foldedPrefix := danger.FoldPathCase(absResolved), danger.FoldPathCase(odekPrefix)
+			if strings.HasPrefix(foldedAbs, foldedPrefix) {
+				if isProtectedOdekPath(foldedAbs[len(foldedPrefix):]) {
 					return "", fmt.Errorf("path %q is a protected odek configuration path and cannot be written by file tools", path)
 				}
 				return abs, nil
@@ -1614,7 +1628,7 @@ func confineToCWD(path string) (string, error) {
 func isProtectedOdekPath(rel string) bool {
 	// Case-folding defends against case-insensitive filesystems (macOS APFS):
 	// ~/.odek/CONFIG.JSON and ~/.odek/config.json are the same file.
-	rel = strings.ToLower(filepath.Clean(rel))
+	rel = danger.FoldPathCase(filepath.Clean(rel))
 
 	// Exact-file trust anchors. Rewriting any of these can disable safety
 	// policy, exfiltrate secrets, or persist attacker control.