fix: 69 validated findings from the second 2026-10-12 bug hunt

AGENTS.md

@@ -46,6 +46,8 @@ cmd/odek/
   subagent.go                 Sub-agent command (--goal, --context, --task) + flag parsing/limits
   subagent_tool.go            delegate_tasks built-in tool (sub-agent spawning)
   subagent_key.go             FD-based API key handoff (parent → sub-agent, never via env)
+  subagent_posture.go         Parent posture stamped into task files: configured tool allow/deny filter, container
+                              settings and granted sandbox approval keys (children never exceed the parent)
   subagent_registry.go        Parent-side registry of in-flight sub-agent tasks (cancel, status)
   subagent_artifacts.go       Sub-agent result-artifact protocol (files auto-delivered to the parent)
   subagent_artifact_registry.go  Collation-time artifact-id registry backing artifact_read
@@ -123,6 +125,9 @@ internal/
                                 command inside is classified; unpaired constructs are unknown
     wrapper_grammar.go          One option grammar for wrappers (timeout/nice/sudo/flock/script/nix/mise/…) incl. command-string options
     denylist.go                 Denylist token-prefix matching at every command position
+    argv_compose.go             Argument composition of xargs/parallel/find -exec stages (bounded; over budget ⇒ unknown)
+    secret_globs.go             Globs that can expand to credential files, shell rc/history files or /proc environ
+    secret_recursive.go         Recursive reads/greps over trees that contain secrets
     secret_reads.go             Secret-shaped env-var references and credential-file reads/writes → system_write
     network_upload.go           network_upload class: bodies from files/stdin, credentials, mutating methods, uploads, listeners
     gh_adapter.go               gh classified by command and verb (reads egress, mutations system_write, deletes destructive)
@@ -131,7 +136,10 @@ internal/
     ledger_indirect.go          Scripts delivered indirectly (pipes, substitutions, eval, find -exec, program-file options)
     path_identity.go            Symlink-resolving path targets for classification (snapshot, not an execution boundary)
     sensitive_read.go           IsSensitiveReadPath: paths @-references refuse (shares the home credential table with ClassifyPath)
-    arith_eval.go               Arithmetic-evaluating builtins (let, declare, …): command substitutions in subscripts are classified
+    arith_eval.go               Arithmetic-evaluating builtins (let, declare, …) and arithmetic expansions ($(( )), $[ ], ${s:off:len}, ${a[sub]}): command substitutions inside are classified even when single-quoted
+    secret_globs.go             Wildcard operands matched segment-wise against odek anchors, /proc/<pid>/environ and the credential path table
+    secret_recursive.go         Recursive readers (grep -r, rg, find -exec cat, tar c, cp -r, …) rooted at /proc/<pid>, /etc, / or a home
+    argv_compose.go             xargs / GNU parallel / xe composition: static stdin, here-strings, ::: sources and -I/{} placeholders expanded into commands (classifier + denylist)
     param_default.go            ${name:-word} / ${name:=word} / ${name:+word} default words classified as the commands they can run
     env_dump_tools.go           jq/yq/ps environment disclosure → system_write
     env_code.go                 PROMPT_COMMAND / PS0-PS4 / BASH_FUNC_ assignments: values classified as commands
@@ -166,7 +174,7 @@ internal/
                               session_scope.go (session-id → chat ownership check), send_fallback.go (plain-text resend when markup is rejected)
   render/                     Terminal output and narrator support
   narrate/                    LLM-powered emoji-rich progress messages
-  redact/                     Secret redaction (20+ patterns)
+  redact/                     Secret redaction (20+ patterns; credential_value.go judges unquoted credential values)
   mcp/                        MCP server handler (stdio JSON-RPC: tools/list, tools/call)
   mcpclient/                  MCP client (connect to external MCP servers); per-server limits (timeout/response bytes/result
                               chars/artifact roots) + odek-extension/v1 contract (contract.go), artifact-ref enforcement in CallTool

cmd/odek/audit.go

@@ -6,6 +6,8 @@ import (
 	"fmt"
 	"os"
 	"strings"
+	"unicode"
+	"unicode/utf16"
 
 	"github.com/BackendStack21/odek/internal/danger"
 	"github.com/BackendStack21/odek/internal/loop"
@@ -252,11 +254,53 @@ func auditCmd(args []string) error {
 		if err != nil {
 			return fmt.Errorf("audit: marshal: %w", err)
 		}
-		fmt.Println(string(out))
+		fmt.Println(escapeJSONForTerminal(string(out)))
 		return nil
 	}
 }
 
+// escapeJSONForTerminal rewrites the characters json.Marshal leaves raw but
+// a terminal acts on or hides (C1 controls such as the 8-bit CSI, bidi and
+// other format characters, zero-width marks, blank fillers, any non-printable
+// rune) as \uXXXX escapes. Such runes can only occur inside JSON strings, so
+// the result stays valid JSON that decodes to the same value.
+func escapeJSONForTerminal(s string) string {
+	clean := true
+	for _, r := range s {
+		if jsonRuneNeedsEscape(r) {
+			clean = false
+			break
+		}
+	}
+	if clean {
+		return s
+	}
+	var b strings.Builder
+	for _, r := range s {
+		switch {
+		case !jsonRuneNeedsEscape(r):
+			b.WriteRune(r)
+		case r > 0xFFFF:
+			hi, lo := utf16.EncodeRune(r)
+			fmt.Fprintf(&b, `\u%04x\u%04x`, hi, lo)
+		default:
+			fmt.Fprintf(&b, `\u%04x`, r)
+		}
+	}
+	return b.String()
+}
+
+func jsonRuneNeedsEscape(r rune) bool {
+	if r < 0x80 {
+		return false
+	}
+	switch r {
+	case '\u034F', '\u115F', '\u1160', '\u180E', '\u3164', '\uFFA0':
+		return true
+	}
+	return !unicode.IsPrint(r) || unicode.Is(unicode.Cf, r) || danger.IsZeroWidthMark(r)
+}
+
 func auditList(store *session.Store, auditStore *session.AuditStore) error {
 	sessions, err := store.List(0)
 	if err != nil {

cmd/odek/browser_tool.go

@@ -262,7 +262,8 @@ func (t *browserTool) doNavigate(rawURL string) (string, error) {
 
 	body, err := io.ReadAll(io.LimitReader(resp.Body, 10*1024*1024)) // 10MB cap
 	if err != nil {
-		return jsonError(fmt.Sprintf("cannot read response: %v", err))
+		msg := fmt.Sprintf("cannot read response: %v", err)
+		return jsonError(wrapUntrusted(t.toolCtx(), rawURL, msg))
 	}
 
 	html := string(body)

cmd/odek/clarify.go

@@ -14,7 +14,7 @@ import (
 
 // clarifyTimeout is how long a principal-channel question waits before
 // the tool returns an error and the loop continues.
-const clarifyTimeout = 5 * time.Minute
+var clarifyTimeout = 5 * time.Minute
 
 func ttyClarifyAvailable() bool {
 	f, err := os.OpenFile(danger.TTYDevicePath(), os.O_RDWR, 0)

cmd/odek/http_request_tool.go

@@ -90,8 +90,10 @@ func (t *httpRequestTool) checkRedirect(req *http.Request, via []*http.Request)
 	// every credential header and re-gate a method-preserving redirect as an
 	// upload to the new host.
 	// A scheme downgrade (https to http) on the same host sends them in the clear.
+	// Every hop is compared with the ORIGINAL request: net/http re-copies the
+	// original headers on each hop, so a strip on one hop does not carry over.
 	if len(via) > 0 && (!strings.EqualFold(via[0].URL.Host, req.URL.Host) ||
-		(via[len(via)-1].URL.Scheme == "https" && req.URL.Scheme != "https")) {
+		(via[0].URL.Scheme == "https" && req.URL.Scheme != "https")) {
 		for name := range req.Header {
 			if danger.CredentialHeaderName(name) {
 				req.Header.Del(name)

cmd/odek/introspect.go

@@ -175,6 +175,23 @@ func toolEnabled(name string, enabledSet, disabledSet map[string]bool, whitelist
 // --api-key, -token, --secret-file, --db-password, --credential, …
 var credentialArgFlag = regexp.MustCompile(`(?i)^-{1,2}[a-z0-9_-]*(key|token|secret|password|passwd|credential)[a-z0-9_-]*$`)
 
+// credentialArgFlagWord matches flags whose dash/underscore-separated
+// component names a credential (--auth, --pass, --pat, --cookie, --creds,
+// --dsn, --bearer, --session), the vocabulary credentialEnvName uses. Whole
+// components only, so --path or --author stay readable.
+var credentialArgFlagWord = regexp.MustCompile(`(?i)^-{1,2}(?:[a-z0-9]+[-_])*(?:auth|pass|pat|cookie|cookies|creds|dsn|bearer|session|apikey)(?:[-_][a-z0-9]+)*$`)
+
+// nonCredentialArgFlag matches switches that merely mention a credential word
+// (--no-auth, --pass-through, --auth-mode, --token-type): they take no secret.
+var nonCredentialArgFlag = regexp.MustCompile(`(?i)^-{1,2}no[-_]|[-_](mode|through|type)$`)
+
+func isCredentialArgFlag(a string) bool {
+	if nonCredentialArgFlag.MatchString(a) {
+		return false
+	}
+	return credentialArgFlag.MatchString(a) || credentialArgFlagWord.MatchString(a)
+}
+
 const redactedArgPlaceholder = "[redacted]"
 
 // redactMCPServersView is the defense-in-depth pass for the TOOL face of
@@ -236,9 +253,13 @@ func redactCredentialArgs(args []string) []string {
 	envNext := false
 	for i, a := range args {
 		if redactNext {
-			out[i] = redactedArgPlaceholder
 			redactNext = false
-			continue
+			// A following long flag (--name) means the credential flag took
+			// no value; anything else, even a dash-led token, is the value.
+			if !looksLikeLongFlag(a) {
+				out[i] = redactedArgPlaceholder
+				continue
+			}
 		}
 		if envNext {
 			envNext = false
@@ -247,11 +268,11 @@ func redactCredentialArgs(args []string) []string {
 				continue
 			}
 		}
-		if eq := strings.IndexByte(a, '='); eq > 0 && credentialArgFlag.MatchString(a[:eq]) {
+		if eq := strings.IndexByte(a, '='); eq > 0 && isCredentialArgFlag(a[:eq]) {
 			out[i] = a[:eq+1] + redactedArgPlaceholder
 			continue
 		}
-		if credentialArgFlag.MatchString(a) {
+		if isCredentialArgFlag(a) {
 			redactNext = true
 			out[i] = a
 			continue
@@ -266,6 +287,16 @@ func redactCredentialArgs(args []string) []string {
 	return out
 }
 
+// looksLikeLongFlag reports whether a is shaped like `--name` or `--name=…`
+// (a letter right after the double dash).
+func looksLikeLongFlag(a string) bool {
+	if len(a) < 3 || a[0] != '-' || a[1] != '-' {
+		return false
+	}
+	c := a[2]
+	return c >= 'a' && c <= 'z' || c >= 'A' && c <= 'Z'
+}
+
 // redactPositionalArg masks a credential embedded in a single argument that
 // no preceding flag identified.
 func redactPositionalArg(a string) string {

cmd/odek/introspect_credflag_test.go

@@ -0,0 +1,18 @@
+package main
+
+import "testing"
+
+// A credential flag's value is masked even when it starts with a dash; only a
+// following long flag means the credential flag took no value.
+func TestRedactCredentialArgs_DashPrefixedValue(t *testing.T) {
+	for _, val := range []string{"-AbC123xyz", "-s3cr3t", "-"} {
+		got := redactCredentialArgs([]string{"--token", val})
+		if got[1] != redactedArgPlaceholder {
+			t.Errorf("value %q leaked: %v", val, got)
+		}
+	}
+	got := redactCredentialArgs([]string{"--password", "--verbose"})
+	if got[1] != "--verbose" {
+		t.Errorf("following flag masked: %v", got)
+	}
+}

cmd/odek/main.go

@@ -2470,6 +2470,7 @@ func setupSandbox(tools []odek.Tool, cfg sandboxConfig) (containerName string, c
 	})
 
 	applySandboxToolBindings(tools, containerName)
+	recordChildSandbox(tools, cfg)
 	return containerName, cleanup, nil
 }
 
@@ -2832,6 +2833,10 @@ func filterBuiltinTools(tools []odek.Tool, cfg config.ToolConfig, required map[s
 	for i, t := range filtered {
 		out[i] = t.(odekToolAdapter).tool
 	}
+	// delegate_tasks children inherit the filter itself (they can narrow it
+	// further, never widen it); with no filter configured they get their
+	// normal tool set.
+	recordChildToolFilter(tools, cfg)
 	return out
 }
 

cmd/odek/main_test.go

@@ -2275,6 +2275,7 @@ func setupTestHome(t *testing.T) string {
 	dir := t.TempDir()
 	os.Setenv("HOME", dir)
 	t.Cleanup(func() { os.Setenv("HOME", orig) })
+	confighuntResetSessionApprovals(t)
 	return dir
 }
 

cmd/odek/mcp_approval.go

@@ -301,6 +301,9 @@ func approveMCPToolsWithTTY(projectDir, serverName string, cfg mcpclient.ServerC
 		}
 
 		fmt.Fprintf(stdout, "\nMCP server %q wants to register tool %q\n", serverName, def.Name)
+		if reg := mcpclient.RegisteredToolName(serverName, def.Name); reg != serverName+"__"+def.Name {
+			fmt.Fprintf(stdout, "  registered as %q (shortened to the %d-character provider limit)\n", reg, mcpclient.MaxRegisteredToolNameLen)
+		}
 		writeMCPToolContract(stdout, def, schemaHash, schemaSize)
 		fmt.Fprintf(stdout, "Approve? [y/N] ")
 
@@ -427,23 +430,7 @@ func hashServerLimits(h hash.Hash, cfg mcpclient.ServerConfig) {
 	}
 }
 
-// truncateDescription limits a tool description for the approval prompt.
-func truncateDescription(desc string, max int) string {
-	if len(desc) <= max {
-		return desc
-	}
-	if max <= 3 {
-		return desc[:max]
-	}
-	return desc[:max-3] + "..."
-}
-
 const (
-	// mcpPromptDescriptionBytes bounds the description shown in the per-tool
-	// approval prompt. It exceeds the old 200-byte excerpt by far, so a
-	// payload appended after a benign opening is visible when a server
-	// rewrites an approved tool.
-	mcpPromptDescriptionBytes = 2048
 	// mcpPromptMaxParams bounds the parameter summary lines.
 	mcpPromptMaxParams = 32
 	// mcpPromptIndent prefixes continuation lines of multi-line fields so
@@ -461,7 +448,10 @@ const (
 // danger.SanitizeInline.
 func writeMCPToolContract(w io.Writer, def mcpclient.ToolDef, schemaHash string, schemaSize int) {
 	if strings.TrimSpace(def.Description) != "" {
-		desc := danger.SanitizeForDisplay(truncateDescription(def.Description, mcpPromptDescriptionBytes))
+		// The prompt shows exactly the description text the model receives
+		// (same rune cap as sanitizeMCPToolDoc), so a payload appended after
+		// a long benign opening is visible when a server rewrites a tool.
+		desc := danger.SanitizeForDisplay(capMCPDescription(def.Description))
 		fmt.Fprintf(w, "  description:\n%s%s\n", mcpPromptIndent, indentMCPPrompt(desc))
 	}
 	fmt.Fprintf(w, "  schema: sha256:%s (%d bytes)\n", schemaHash[:16], schemaSize)