fix: session ID entropy + auth tokens; restrict send_message callbacks

Finding #9 — Predictable session IDs:
- Generate 128-bit random session IDs (YYYYMMDD-<32 hex chars>).
- Add a 256-bit session-scoped AuthToken stored in the session JSON.
- Require the token via X-Session-Token header, session_token cookie, or
  auth_token WebSocket field for GET/DELETE/POST /api/sessions/<id> and
  WebSocket session resume.
- Add per-IP rate limiting (60/min) on session detail lookups.
- Redact AuthToken from the /api/sessions list endpoint.
- Update the Web UI to store and send tokens.

Finding #10 — send_message callback injection:
- Reject callback_data values that start with reserved internal prefixes
  (apr:, den:, trs:, clarify:, skill_save:, skill_skip:) in the
  send_message tool.
- Add defense-in-depth validation in the Telegram sender closure.
- Only user-facing cb: callbacks are allowed.

Tests and docs updated.

Author: jkyberneees

AGENTS.md

@@ -137,6 +137,8 @@ Layered prompt-injection / approval-fatigue defenses. Full reference: [docs/SECU
 - **Schedule atomic-write hardening** (`internal/schedule/store.go` + `internal/fsatomic`) — schedule file writes now use `fsatomic.WriteFile`, which creates a random temp file with `O_EXCL`, fsyncs data and directory, and renames over the target. A swapped-in symlink is replaced rather than followed, closing the symlink-override attack on `schedules.json` / `schedule-state.json`.
 - **Telegram singleton flock lock** (`cmd/odek/telegram.go` + `internal/flock`) — the Telegram bot now uses an advisory `flock` on `~/.odek/telegram.lock` instead of a PID file probed with signals. This removes the non-Linux path where a planted PID could cause odek to kill an arbitrary process.
 - **Telegram photo caption wrapping** (`cmd/odek/telegram.go`) — photo captions cross the Telegram trust boundary, so they are wrapped as untrusted content both when passed to the local vision model and when injected into the main agent's user message.
+- **`send_message` callback prefix restriction** (`internal/tool/send_message.go` + `cmd/odek/telegram.go`) — the `send_message` tool rejects any button whose `callback_data` starts with a reserved internal prefix (`apr:`, `den:`, `trs:`, `clarify:`, `skill_save:`, `skill_skip:`); only user-facing `cb:` callbacks are allowed. The Telegram sender closure validates again as defense-in-depth, preventing a forged approval or skill button.
+- **Session ID entropy + session-scoped auth tokens** (`internal/session/session.go`, `cmd/odek/serve.go`) — session IDs now carry 128 bits of randomness (16 bytes / 32 hex chars); each session stores a 256-bit `AuthToken` required by `GET/DELETE/POST /api/sessions/<id>` and WebSocket session-resume messages via `X-Session-Token` header, `session_token` cookie, or `auth_token` WS field. Per-IP rate limiting (60/min) on session lookups adds a brute-force backstop.
 - **Secret redaction** (`internal/redact/redact.go`) — 20+ patterns: OpenAI, Anthropic, GitHub PAT, AWS, PEM, JWT, Vault, Google OAuth, SendGrid, Discord, DB URLs, etc.
 
 ### Platform Support

cmd/odek/serve.go

@@ -50,6 +50,59 @@ var wsConns sync.Map // map[*golangws.Conn]struct{}
 // after closing all connections to ensure cleanup completes.
 var wsHandlerWG sync.WaitGroup
 
+// sessionLookupLimiter provides basic per-IP rate limiting for session detail
+// lookups, raising the cost of brute-force enumeration of session IDs.
+var sessionLookupLimiter = newRateLimiter(60, time.Minute)
+
+// rateLimiter is a tiny per-key sliding-window rate limiter.
+type rateLimiter struct {
+	mu      sync.Mutex
+	windows map[string][]time.Time
+	max     int
+	window  time.Duration
+}
+
+func newRateLimiter(max int, window time.Duration) *rateLimiter {
+	return &rateLimiter{
+		windows: make(map[string][]time.Time),
+		max:     max,
+		window:  window,
+	}
+}
+
+// allow returns true if the key has not exceeded max requests in the sliding
+// window. It prunes stale entries on each call.
+func (rl *rateLimiter) allow(key string) bool {
+	if rl == nil || rl.max <= 0 {
+		return true
+	}
+	rl.mu.Lock()
+	defer rl.mu.Unlock()
+
+	now := time.Now().UTC()
+	cutoff := now.Add(-rl.window)
+	var times []time.Time
+	for _, t := range rl.windows[key] {
+		if t.After(cutoff) {
+			times = append(times, t)
+		}
+	}
+	if len(times) >= rl.max {
+		rl.windows[key] = times
+		return false
+	}
+	times = append(times, now)
+	rl.windows[key] = times
+	return true
+}
+
+// reset clears all tracked windows (useful in tests).
+func (rl *rateLimiter) reset() {
+	rl.mu.Lock()
+	defer rl.mu.Unlock()
+	rl.windows = make(map[string][]time.Time)
+}
+
 // ── Serve Command ───────────────────────────────────────────────────────
 
 func serveCmd(args []string) error {
@@ -444,6 +497,7 @@ type wsClientMsg struct {
 	Type      string `json:"type"`
 	Content   string `json:"content"`
 	SessionID string `json:"session_id"`
+	AuthToken string `json:"auth_token,omitempty"`
 	Model     string `json:"model,omitempty"`
 	Thinking  string `json:"thinking,omitempty"` // "enabled" | "" — per-query toggle
 }
@@ -633,12 +687,18 @@ func handleWS(store *session.Store, resources *resource.Registry, resolved confi
 		// Handle session switch mid-connection (new conversation)
 		if msg.SessionID != "" && (currentSession == nil || currentSession.ID != msg.SessionID) {
 			sess, err := store.Load(msg.SessionID)
-			if err == nil {
-				currentSession = sess
-				// Restore buffer from the resumed session
-				if mm := agent.Memory(); mm != nil && len(sess.Buffer) > 0 {
-					mm.RestoreBuffer(sess.Buffer)
-				}
+			if err != nil {
+				writeWSError(conn, "session not found")
+				continue
+			}
+			if _, ok := validateSessionToken(store, sess, msg.AuthToken); !ok {
+				writeWSError(conn, "invalid session token")
+				continue
+			}
+			currentSession = sess
+			// Restore buffer from the resumed session
+			if mm := agent.Memory(); mm != nil && len(sess.Buffer) > 0 {
+				mm.RestoreBuffer(sess.Buffer)
 			}
 		}
 
@@ -735,10 +795,12 @@ func handlePrompt(
 
 	// Send session info
 	sid := ""
+	authToken := ""
 	if sess != nil {
 		sid = sess.ID
+		authToken = sess.AuthToken
 	}
-	writeWSJSON(conn, map[string]any{"type": "session", "session_id": sid, "model": resolved.Model, "sandbox": resolved.Sandbox})
+	writeWSJSON(conn, map[string]any{"type": "session", "session_id": sid, "auth_token": authToken, "model": resolved.Model, "sandbox": resolved.Sandbox})
 
 	// Append user input to buffer (AppendBuffer summarizes raw text).
 	if mm := agent.Memory(); mm != nil {
@@ -986,6 +1048,41 @@ func isStateChangingMethod(method string) bool {
 	return true
 }
 
+// sessionTokenFromRequest returns the session auth token from the
+// X-Session-Token header or the session_token cookie, in that order.
+func sessionTokenFromRequest(r *http.Request) string {
+	if t := r.Header.Get("X-Session-Token"); t != "" {
+		return t
+	}
+	if c, err := r.Cookie("session_token"); err == nil && c.Value != "" {
+		return c.Value
+	}
+	return ""
+}
+
+// validateSessionToken checks the provided token against the session. If the
+// session has no token (legacy session created before this defense), a token is
+// generated and the session is persisted. The returned string is the effective
+// token (empty only when validation failed). The bool indicates success.
+func validateSessionToken(store *session.Store, sess *session.Session, token string) (string, bool) {
+	if sess == nil {
+		return "", false
+	}
+	if sess.AuthToken == "" {
+		sess.AuthToken = session.GenerateAuthToken()
+		if err := store.Save(sess); err != nil {
+			// If we cannot persist the token, still allow this request but do not
+			// leak a transient token to the client.
+			return "", true
+		}
+		return sess.AuthToken, true
+	}
+	if token == sess.AuthToken {
+		return sess.AuthToken, true
+	}
+	return "", false
+}
+
 func writeWSJSON(conn *golangws.Conn, data any) {
 	payload, err := json.Marshal(data)
 	if err != nil {
@@ -1032,6 +1129,12 @@ func handleSessionList(store *session.Store) http.HandlerFunc {
 			sessions = []session.Session{}
 		}
 
+		// Never leak session-scoped auth tokens in the list endpoint. Tokens are
+		// only returned (in the X-Session-Token header) after a valid detail lookup.
+		for i := range sessions {
+			sessions[i].AuthToken = ""
+		}
+
 		w.Header().Set("Content-Type", "application/json")
 		json.NewEncoder(w).Encode(sessions)
 	}
@@ -1040,24 +1143,45 @@ func handleSessionList(store *session.Store) http.HandlerFunc {
 func handleSessionByID(store *session.Store) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		id := strings.TrimPrefix(r.URL.Path, "/api/sessions/")
+		if id == "" {
+			http.Error(w, "missing session id", http.StatusBadRequest)
+			return
+		}
 
 		switch r.Method {
 		case http.MethodGet:
-			if id == "" {
-				http.Error(w, "missing session id", http.StatusBadRequest)
+			// Rate-limit session detail lookups per IP to slow brute-force
+			// enumeration of the 128-bit ID space.
+			if !sessionLookupLimiter.allow(clientIP(r)) {
+				http.Error(w, "rate limit exceeded", http.StatusTooManyRequests)
 				return
 			}
 			sess, err := store.Load(id)
 			if err != nil {
 				http.Error(w, "session not found", http.StatusNotFound)
 				return
 			}
+			token := sessionTokenFromRequest(r)
+			effectiveToken, ok := validateSessionToken(store, sess, token)
+			if !ok {
+				http.Error(w, "invalid session token", http.StatusUnauthorized)
+				return
+			}
 			w.Header().Set("Content-Type", "application/json")
+			if effectiveToken != "" {
+				w.Header().Set("X-Session-Token", effectiveToken)
+			}
 			json.NewEncoder(w).Encode(sess)
 
 		case http.MethodDelete:
-			if id == "" {
-				http.Error(w, "missing session id", http.StatusBadRequest)
+			sess, err := store.Load(id)
+			if err != nil {
+				http.Error(w, "session not found", http.StatusNotFound)
+				return
+			}
+			token := sessionTokenFromRequest(r)
+			if _, ok := validateSessionToken(store, sess, token); !ok {
+				http.Error(w, "invalid session token", http.StatusUnauthorized)
 				return
 			}
 			if err := store.Delete(id); err != nil {
@@ -1068,10 +1192,6 @@ func handleSessionByID(store *session.Store) http.HandlerFunc {
 
 		case http.MethodPost:
 			// Rename session
-			if id == "" {
-				http.Error(w, "missing session id", http.StatusBadRequest)
-				return
-			}
 			var body struct {
 				Name string `json:"name"`
 			}
@@ -1084,6 +1204,11 @@ func handleSessionByID(store *session.Store) http.HandlerFunc {
 				http.Error(w, "session not found", http.StatusNotFound)
 				return
 			}
+			token := sessionTokenFromRequest(r)
+			if _, ok := validateSessionToken(store, sess, token); !ok {
+				http.Error(w, "invalid session token", http.StatusUnauthorized)
+				return
+			}
 			sess.Task = body.Name
 			store.Save(sess)
 			w.Header().Set("Content-Type", "application/json")
@@ -1095,6 +1220,29 @@ func handleSessionByID(store *session.Store) http.HandlerFunc {
 	}
 }
 
+// clientIP returns a best-effort client identifier for rate limiting. It prefers
+// X-Forwarded-For / X-Real-Ip only when the direct remote address is a loopback
+// proxy, otherwise uses RemoteAddr. This avoids trusting spoofed headers from
+// arbitrary clients while still working behind a local reverse proxy.
+func clientIP(r *http.Request) string {
+	host, _, err := net.SplitHostPort(r.RemoteAddr)
+	if err != nil {
+		host = r.RemoteAddr
+	}
+	if host == "127.0.0.1" || host == "::1" || host == "localhost" {
+		if fwd := r.Header.Get("X-Forwarded-For"); fwd != "" {
+			if i := strings.Index(fwd, ","); i > 0 {
+				return strings.TrimSpace(fwd[:i])
+			}
+			return strings.TrimSpace(fwd)
+		}
+		if real := r.Header.Get("X-Real-Ip"); real != "" {
+			return real
+		}
+	}
+	return host
+}
+
 func handleModelList(configuredModel string) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		if r.Method != http.MethodGet {