fix: 69 validated findings from the second 2026-10-12 bug hunt

[jkyberneees]

Summary

Fixes all 69 findings from the second 2026-10-12 functional + security bug hunt over v2.34.3 (3df53de1) — 11 high, 37 medium, 21 low — plus 8 extra issues the fixers confirmed while verifying unproven hunter concerns (Telegram /plan_view rune cut, /plan_resume lock, budget fail-open; config project-limit clamps and skill promote symlink; episode index ordering; MCP LoadProjectFile O_NOFOLLOW and HTTP error-body sanitising) and every issue from the per-area reviews, one full-branch Opus review (2 high, 6 medium, 11 low) and the Sonnet re-reviews of those fixes.

Same workflow as #317: Opus hunters per area proved each finding with a failing TestRED_* test; Sonnet fixers re-validated on base, then RED → GREEN → docs (one commit per finding where hunks didn't interleave); Sonnet adversarial review per area with fix rounds; branches cherry-picked together; full-branch Opus review; Sonnet re-review of the final fixes.

High-severity highlights

• danger — $(…) inside single quotes in $(( )), $[ ], ${s:off} and subscripts auto-allowed (bash evaluates it); glob spellings of secrets (~/.odek/secrets.en?, /proc/self/env*, ~/.bash*); HOME=. bash -i running unread startup files; composed xargs/parallel expansion now budgeted and failing closed (was unbounded: 13 s / 7.6 GB on a 30 KB command).
• tools — http_request sent credential headers in cleartext after a two-hop https→http redirect (now compared against the original request).
• config — a repo-planted .odek-artifacts symlink made sub-agent staging cleanup RemoveAll sibling projects and relocate ~/.ssh keys (staging now via os.Root); --tool/--no-tool, sandbox knobs and project-sandbox approval now propagate to sub-agents through the task file; untrusted AGENTS.md could leave the security pillar inside an open code fence (CommonMark fence tracker incl. blockquotes and list items).
• memory — credential-named tool arguments/headers persisted unredacted (key-aware JSON redaction).
• ops — bare-key redaction leaked values with password characters; redaction redesigned around one credential-value check (code expressions stay visible, so read_file/patch output isn't corrupted; linear on hostile input).

Medium/low fixes span untrusted-tag look-alike neutralising (padding, modifier separators, enclosed/Armenian/Cherokee letters, look-alike brackets, spaced forms — linear), argv secret leaks in events, batch-trust for no-risk tools, MCP schema pattern/format/$ref/enum prose (structural rule), MCP tool names > 64 chars (shortened, __ kept), tools/list pagination, HTTP MCP Close, ffmpeg protocol/format whitelists, speak symlink writes, first-turn audit on serve, delete-vs-audit race, late approval/clarify answers, WS lookup rate limits, Telegram MarkdownV2 chunking/fallback/**bold**, media credential files, upload cap, scheduler delivery, budget counter atomicity, compaction digest redaction, ~/.odek reads tainting episodes, pkill/kill broadcast forms, gpg verbs, sqlite readfile(), recursive readers over $HOME//proc, denylist over extracted code bodies, history-file tables shared by ClassifyPath and the @-reference gate.

Per-finding detail: .claude/bughunt-2026-10-12b/ (gitignored) — fix-input-*.json, fix-reports/, review-reports/.

Coverage (before → after)

package	v2.34.3	after
cmd/odek	76.6%	77.1%
internal/danger	92.7%	92.8%
internal/redact	96.8%	97.1%
internal/agent	82.3%	83.5%
internal/config	86.9%	87.4%
internal/session	90.4%	90.5%
internal/memory	85.1%	85.2%
internal/loop	93.6%	93.7%
internal/telegram	91.1%	91.1%
internal/mcpclient	96.2%	95.7% (new defensive branches in pagination/Close paths)

Test plan

• go build ./..., go vet ./..., gofmt -l, go mod tidy -diff clean
• go test ./...
• CI mode: go test ./... -short -race with a temp HOME (only pre-existing macOS-temp-HOME failures in internal/telegram media-path tests, identical on main)
• HOME=/home/user go test -race ./internal/danger/
• Fuzz 30 s each: FuzzSeparatorThenWipe, FuzzPipeIntoShell, FuzzHarmlessPrefixKeepsRank, FuzzAnalyzeBounded (-parallel 1)
• Redaction corpus check: 11.2 MB of this repo's Go/Markdown — no non-test source line gains redaction; ~87 former over-redactions removed
• CI: golangci-lint, govulncheck

Known residuals (documented, not fixed)

• Redaction: unquoted passwords starting with {, &, * or mixed-case letters-only passphrases before ,/) read as code; values judged on their first 256 bytes; hostile 1 MiB inputs up to ~1–2 s (linear).
• Classifier: v='a[$(cmd)]'; let "$v"; git $x dynamic verb; sqlite .output; dotglob; rg -f file / -g GLOB parsing (fail-safe); hostile 64 KiB inputs ~2.5× slower than main (bounded); a catch-all pgrep and kill anywhere on one line is flagged.
• MCP property/required/$defs names can still spell a few joined words.
• A once ("y") Dockerfile.odek approval persists for a long-lived serve/Telegram process (forwarded to children only for the same dir + content hash).
• Telegram daily budget counter is keyed by UTC date: one-time reset for non-UTC users on upgrade.
• Memory is a global operator store (not per Telegram chat) by design.

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	odek	05b2d0a	Commit Preview URL Branch Preview URL	Oct 12 2026, 04:38 PM