fix: 81 validated findings from the 2026-10-11 bug hunt

AGENTS.md

@@ -180,7 +180,7 @@ ReAct cycle: observe → think → act → repeat.
 - LLM returns tool calls or a final answer.
 - **Parallel tool execution** — independent tool calls run concurrently (`max_tool_parallel`, default: 4).
 - **Plan tool** — built-in `plan` tool (docs/PLANNING.md) for multi-step work: steps, optional acceptance checks, revise/check_replace lifecycle. Sub-agents never own or mutate parent plans. Check recording (`completion_checks.go`) consumes engine outcomes only — a check passes when its declared tool actually ran and succeeded, never from claims inside tool output; a failed or unclassifiable effect invalidates earlier checks in the same batch.
-- **Batch approval gate** — multiple risky tools shown in one prompt. `classifyToolCall` classifies each individual `shell` command, each `patch`/`write_file` target, and the `browser` tool; shows full commands; withholds blanket `SetTrustAll` when unclassifiable tools (incl. MCP tools, classified `unknown`) remain.
+- **Batch approval gate** — multiple risky tools shown in one prompt. `classifyToolCall` classifies each individual `shell` command, each `patch`/`write_file` target, the `browser` tool, and `http_request` (mutating method or credential header → `network_upload`, as for curl); shows full commands; withholds blanket `SetTrustAll` when unclassifiable tools (incl. MCP tools, classified `unknown`) remain.
 - **Tool-failure recovery** — retry transient errors, skip permanent failures, continue without crashing. Stall detection: 3 consecutive identical tool calls inject a corrective hint + fire `tool_recovery` — a hint, never aborts the run.
 - **Context-limit protection** — graduated trimming near the context window: old large tool results replaced with markers (4 most recent kept intact), then oldest turn groups dropped atomically (tool messages stay grouped with their parent). The protected head (system prompt, memory block, compaction digest, original task) is never dropped. The digest (body capped at an eighth of the budget) and the trim warning are reserved against the budget before groups are dropped, so the post-trim history fits. Token estimator counts tool schemas + reasoning content; safety margin self-tightens when provider-reported tokens exceed estimates (`margin_calibrated` signal). `trimToSurvival` handles provider context-length errors. **Rolling compaction** (on by default; `compaction: false` / `ODEK_COMPACTION=false` / `--no-compaction`) sketches dropped groups extractively into a rolling digest immediately, then a thinking-off side call replaces that sketch with a model digest on a later iteration if it arrives.
 - **Final-answer verification pass** (`internal/loop/verify.go`, optional) — after a candidate final answer, a side-call checks the answer against the run's evidence and can trigger corrective cycles. Config: `verify` section (`enabled`, `mode` hint|strict|off, optional cheaper `model`, `max_cycles` ≤ 3, `max_tokens`); default off, `hint` when enabled. Sub-agents are opted in only via an explicit `subagent.verify` section — `delegate_tasks` never enables it implicitly, so N children cannot multiply verify cost.
@@ -215,7 +215,7 @@ Layered prompt-injection / approval-fatigue defenses. The full per-mitigation li
 
 - **Untrusted-content boundary** (`cmd/odek/untrusted.go`) — every externally-sourced tool result (browser, file/shell/search tools, MCP, session_search, @-refs, --ctx, attachments, artifact_read) is wrapped in a per-call nonce'd `<untrusted·content_<nonce>>` tag; tool-result delimiters are also nonce'd (`internal/loop`). Skill/episode context injected into the system prompt is wrapped too. The per-session audit log (`cmd/odek/audit.go`) records every ingest and flags divergence between user-mentioned resources and agent actions.
 - **Provenance gates** — tainted memory episodes are stored but never auto-replayed (the episode taint is sticky session state, `Session.EpisodeUntrusted`, so trimming cannot launder it); skills from untrusted sources (imported via URI, project `./.odek/skills/`) are pinned `NeedsReview` until `odek skill promote --force` is run after human review, excluded from trigger matching, and protected against frontmatter tampering. Load-time and import-time skill bodies go through the injection scanner (`guard.ScanContentWithScope`). `odek` self-invocation via shell is `system_write` so the agent can't reach its own trust mutations.
-- **Danger classifier** (`internal/danger/classifier.go`; layered design in its package doc) — quote-aware normalization ($IFS, ANSI-C, brace lists/sequences, substitutions, heredocs, wrappers, backslashes, basenames); compound commands (`for`/`while`/`if`/`case`/groups/functions/`[[ ]]`) parsed so every simple command inside is classified, unterminated constructs and quotes classify `unknown`. Wrappers share one option grammar (`wrapper_grammar.go`) incl. command-string options (`env -S`, `script -c`, `flock -c`). Covers awk/sed/editor escapes, pipe-fed xargs composition, root-level mutation targets, git data-loss verbs, `git -c`/config code exec, find/rsync destructive flags, env dumps, exec-controlling `export`s, shell operand/redirect path classification (writes to shell rc files, ~/.ssh, ~/.odek escalate to system_write). `network_upload` (default prompt, ranked between `network_egress` and `code_execution`) splits uploads, credentialed/mutating requests, listeners and tunnels from plain egress; `gh` is classified by command and verb (`gh_adapter.go`). Ordinary git verbs escalate to `code_execution` only when the targeted repository is armed (hooks, fsmonitor, filters/drivers, editors, includes); an undeterminable repo, `GIT_*` overrides, sudo wrappers or a hook written earlier in the same command fail closed (`git_repo_arming.go`). Denylist entries are token prefixes matched at every command position, with tool global options stripped and known variables resolved — not raw string prefixes; here-strings and static echo/printf text piped into a shell, also through pass-through stages (cat, tee, sort, uniq, tac, head, tail), are scanned too, and the recursive scan is memoised depth-aware so nested eval/find -exec chains stay bounded. Secret-shaped env vars (`$NAME`, `${!v}`, `printenv`, `os.environ`) and credential files (by basename, extension or directory) are `system_write` (`secret_reads.go`). Trust anchors under `~/.odek` are write-protected from generic file tools. The read ledger is fingerprinted (`WasReadFresh`: post-read mutation re-fires the unread-script gate), covers scripts delivered through pipes, substitutions, `eval`, `find -exec` and program-file options, is bounded (4096 paths per session, 1024 sessions, LRU eviction only ever removes a licence) and dropped per session with `danger.ForgetReadLedger` (serve session delete, Telegram reset, schedule run end); unread-script approvals carry a pre-exec injection-scan enrichment incl. single-layer base64/hex decode (`cmd/odek/unreadscan.go`, scan never populates the ledger). Quoted operator-shaped words (`';'`, `'|'`, a decoded `$'\n'`) are arguments in every segment/pipe split (literal-marked tokens), the denylist scan examines each distinct command line once (bounded on nested `eval`/`find -exec`) and also reads here-strings and static `echo`/`printf` pipes into a shell, and a home reached through a symlink counts as the same home. Fuzz invariants in `monotonicity_fuzz_test.go` (suffix wipe never hidden, pipe into shell at least `code_execution`, harmless prefix never lowers a verdict, bounded time).
+- **Danger classifier** (`internal/danger/classifier.go`; layered design in its package doc) — quote-aware normalization ($IFS, ANSI-C, brace lists/sequences, substitutions, heredocs, wrappers, backslashes, basenames); compound commands (`for`/`while`/`if`/`case`/groups/functions/`[[ ]]`) parsed so every simple command inside is classified, unterminated constructs and quotes classify `unknown`. Wrappers share one option grammar (`wrapper_grammar.go`) incl. command-string options (`env -S`, `script -c`, `flock -c`). Covers awk/sed/editor escapes, pipe-fed xargs composition, root-level mutation targets, git data-loss verbs, `git -c`/config code exec, find/rsync destructive flags, env dumps, exec-controlling `export`s, shell operand/redirect path classification (writes to shell rc files, ~/.ssh, ~/.odek escalate to system_write). `network_upload` (default prompt, ranked between `network_egress` and `code_execution`) splits uploads, credentialed/mutating requests, listeners and tunnels from plain egress; `gh` is classified by command and verb (`gh_adapter.go`). Ordinary git verbs escalate to `code_execution` only when the targeted repository is armed (hooks, fsmonitor, filters/drivers, editors, includes); an undeterminable repo, `GIT_*` overrides, sudo wrappers or a hook written earlier in the same command fail closed (`git_repo_arming.go`). Denylist entries are token prefixes matched at every command position, with tool global options stripped and known variables resolved — not raw string prefixes; here-strings and static echo/printf text piped into a shell, also through pass-through stages (cat, tee, sort, uniq, tac, head, tail), are scanned too, and the recursive scan is memoised depth-aware so nested eval/find -exec chains stay bounded. Secret-shaped env vars (`$NAME`, `${!v}`, `printenv`, `os.environ`), credential files (by basename, extension or directory) and credential stores read through their own tooling (`git credential …`, `gpg --export-secret-*`) are `system_write` (`secret_reads.go`). Aliases are tracked across the command (`alias.go`): a use is classified as its expansion (body plus remaining words) alongside the literal command, all bodies are kept and `unalias` removes nothing; an unused definition runs nothing. sqlite3 program launchers (abbreviated `.shell`/`.system`, `|cmd` dot-command arguments, `edit()`, scripts fed on stdin) are `code_execution`, and `writefile()`/`VACUUM INTO` paths (whole-literal only, else `unknown`) and write dot-command operands are write targets. Trust anchors under `~/.odek` are write-protected from generic file tools. The read ledger is fingerprinted (`WasReadFresh`: post-read mutation re-fires the unread-script gate), covers scripts delivered through pipes, substitutions, `eval`, `find -exec` and program-file options, is bounded (4096 paths per session, 1024 sessions, LRU eviction only ever removes a licence) and dropped per session with `danger.ForgetReadLedger` (serve session delete, Telegram reset, schedule run end); unread-script approvals carry a pre-exec injection-scan enrichment incl. single-layer base64/hex decode (`cmd/odek/unreadscan.go`, scan never populates the ledger). Quoted operator-shaped words (`';'`, `'|'`, a decoded `$'\n'`) are arguments in every segment/pipe split (literal-marked tokens), the denylist scan examines each distinct command line once (bounded on nested `eval`/`find -exec`) and also reads here-strings and static `echo`/`printf` pipes into a shell, and a home reached through a symlink counts as the same home. Fuzz invariants in `monotonicity_fuzz_test.go` (suffix wipe never hidden, pipe into shell at least `code_execution`, harmless prefix never lowers a verdict, bounded time).
 - **Plan-check honesty** — plan acceptance checks record outcomes from actual engine observation only; failed or unclassifiable tool effects invalidate earlier checks in the same batch, so a check can never be satisfied by a claim inside tool output.
 - **Approval friction** — TTY/WS/Telegram approvers engage friction after 3 same-class approvals in 60s (type `approve`, pause, trust shortcut hidden); `destructive`/`blocked`/`unknown` never get trust shortcuts. TTY prompts are process-wide serialized. Everything shown in an approval (TTY/WebSocket/Telegram prompts, batch cards, MCP/sandbox approval prompts, denial error strings) goes through `danger.SanitizeForDisplay`/`SanitizeInline`, which escape control, bidi and invisible characters so the human reads the bytes that run; the read_only non-interactive carve-out is keyed on the native tool name, never the model-supplied description.
 - **Sub-agent caps** — `delegate_tasks` carries trust_level + max_risk enforced via the sub-agent's DangerousConfig; MCP tools withheld from untrusted sub-agents; API keys handed off via unlinked-tempfile FD, never env. Sub-agent results over ~2000 chars are delivered as registry-backed artifacts the parent reads via `artifact_read`.

cmd/odek/audit.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/BackendStack21/odek/internal/danger"
 	"github.com/BackendStack21/odek/internal/loop"
+	"github.com/BackendStack21/odek/internal/redact"
 	"github.com/BackendStack21/odek/internal/session"
 )
 
@@ -59,6 +60,8 @@ func recordTurnAudit(store *session.AuditStore, sessionID string, turn int, user
 	var actionText strings.Builder // agent actions: tool calls + final response
 	var untrustedBodies strings.Builder
 	var untrustedSources []string
+	// Sources read back from the audit store were persisted redacted.
+	var persistedSources []string
 	var recordedResources []string
 	ingestedUntrusted := false
 	lastAssistantContent := ""
@@ -70,7 +73,7 @@ func recordTurnAudit(store *session.AuditStore, sessionID string, turn int, user
 		for _, ingest := range prior.Ingests {
 			if ingest.Turn == turn {
 				ingestedUntrusted = true
-				untrustedSources = append(untrustedSources, ingest.Source)
+				persistedSources = append(persistedSources, ingest.Source)
 				recordedResources = append(recordedResources, ingest.Resources...)
 			}
 		}
@@ -118,31 +121,56 @@ func recordTurnAudit(store *session.AuditStore, sessionID string, turn int, user
 	// We exclude resources that match the source of the untrusted content
 	// (e.g. a fetched page mentioning its own URL) to avoid false positives
 	// for legitimate user-requested fetches.
-	isSource := func(r string) bool {
-		lr := strings.ToLower(r)
+	// The audit store persists resources redacted, so resource keys use the
+	// redacted, lower-cased form of both sides. The source exclusion compares
+	// each resource in the form it was captured: raw resources from this
+	// turn's messages against raw sources, never their redacted forms, since
+	// redaction swallows the rest of a URL after a token and two different
+	// URLs on one host can redact to the same text. Persisted resources are
+	// already redacted, so they are matched against the redacted sources.
+	auditKey := func(r string) string { return strings.ToLower(redact.RedactSecrets(r)) }
+	isRawSource := func(r string) bool {
 		for _, s := range untrustedSources {
-			ls := strings.ToLower(s)
-			if lr == ls || strings.HasPrefix(lr, ls) || strings.HasPrefix(ls, lr) {
+			if auditOpsResourceMatchesSource(r, s) {
+				return true
+			}
+		}
+		for _, s := range persistedSources {
+			if !strings.Contains(s, "[REDACTED]") && auditOpsResourceMatchesSource(r, s) {
+				return true
+			}
+		}
+		return false
+	}
+	isRedactedSource := func(r string) bool {
+		lr := auditKey(r)
+		for _, s := range untrustedSources {
+			if auditOpsResourceMatchesSource(lr, auditKey(s)) {
+				return true
+			}
+		}
+		for _, s := range persistedSources {
+			if auditOpsResourceMatchesSource(lr, auditKey(s)) {
 				return true
 			}
 		}
 		return false
 	}
 	untrustedResSet := make(map[string]bool)
 	for _, r := range session.ResourcesIn(untrustedBodies.String()) {
-		if !isSource(r) {
-			untrustedResSet[strings.ToLower(r)] = true
+		if !isRawSource(r) {
+			untrustedResSet[auditKey(r)] = true
 		}
 	}
 	for _, r := range recordedResources {
-		if !isSource(r) {
-			untrustedResSet[strings.ToLower(r)] = true
+		if !isRedactedSource(r) {
+			untrustedResSet[auditKey(r)] = true
 		}
 	}
 	var untrustedResources []string
 	seen := make(map[string]bool)
 	for _, r := range session.ResourcesIn(actionText.String()) {
-		lr := strings.ToLower(r)
+		lr := auditKey(r)
 		if untrustedResSet[lr] && !seen[lr] {
 			seen[lr] = true
 			untrustedResources = append(untrustedResources, r)
@@ -165,6 +193,37 @@ func recordTurnAudit(store *session.AuditStore, sessionID string, turn int, user
 	_ = store.RecordTurn(sessionID, at)
 }
 
+// auditOpsResourceMatchesSource reports whether resource r is the untrusted
+// content's own source s (case-insensitive): equal, or one lies under the
+// other on a path boundary — the longer continues with '/', '?' or '#', or
+// the shorter ends with '/'. A raw string prefix is not enough: the
+// look-alike host https://news.example.com.collector.net extends the source
+// https://news.example.com without being part of it.
+func auditOpsResourceMatchesSource(r, s string) bool {
+	lr, ls := strings.ToLower(r), strings.ToLower(s)
+	if lr == "" || ls == "" {
+		return false
+	}
+	if lr == ls {
+		return true
+	}
+	short, long := ls, lr
+	if len(lr) < len(ls) {
+		short, long = lr, ls
+	}
+	if !strings.HasPrefix(long, short) {
+		return false
+	}
+	if strings.HasSuffix(short, "/") {
+		return true
+	}
+	switch long[len(short)] {
+	case '/', '?', '#':
+		return true
+	}
+	return false
+}
+
 // auditCmd handles `odek audit <session-id>` and `odek audit --list`.
 // Read-only: it never modifies the audit log. Output is JSON to stdout
 // so the caller can pipe through jq / their tool of choice.