fix: reject base_url from project config

Project-level ./odek.json is untrusted, so a base_url set there is now
ignored (with a stderr warning). The LLM endpoint can still be configured
from ~/.odek/config.json, ODEK_BASE_URL, or --base-url.

- Update internal/config/loader.go to drop project.BaseURL before merging.
- Add regression tests for project-base_url rejection and env/CLI override.
- Update docs/CONFIG.md, docs/SECURITY.md, and AGENTS.md.

Author: jkyberneees

AGENTS.md

@@ -132,6 +132,7 @@ Layered prompt-injection / approval-fatigue defenses. Full reference: [docs/SECU
 - **Serve sandbox default-on** — `odek serve` enables `--sandbox` automatically unless `--no-sandbox` is passed.
 - **Sandbox volume confinement** (`internal/sandbox/sandbox.go`) — extra `--sandbox-volume` host paths must resolve to a location under the working directory, cannot contain `..` or symlink escapes, and cannot match sensitive prefixes such as `/etc`, `/proc`, `/sys`, `/dev`, `/root`, `/home`, `/var`, `/run`, or `/var/run/docker.sock`.
 - **Sandbox read-only enforcement** (`cmd/odek/sandbox_file.go` + `cmd/odek/file_tool.go` + `cmd/odek/perf_tools.go`) — when a sandbox container is active, `write_file`, `patch`, and `batch_patch` translate host paths to `/workspace/...` and copy data into the container with `docker cp`, so a read-only workspace mount (`--sandbox-readonly`) is enforced for the agent's own file tools.
+- **Project config base_url rejection** (`internal/config/loader.go`) — `./odek.json` is untrusted, so a `base_url` set there is ignored (with a stderr warning). The LLM endpoint can only be configured from the operator-controlled global config (`~/.odek/config.json`), `ODEK_BASE_URL`, or `--base-url`.
 - **Telegram photo caption wrapping** (`cmd/odek/telegram.go`) — photo captions cross the Telegram trust boundary, so they are wrapped as untrusted content both when passed to the local vision model and when injected into the main agent's user message.
 - **Secret redaction** (`internal/redact/redact.go`) — 20+ patterns: OpenAI, Anthropic, GitHub PAT, AWS, PEM, JWT, Vault, Google OAuth, SendGrid, Discord, DB URLs, etc.
 

docs/CONFIG.md

@@ -52,11 +52,12 @@ Same schema as global. Only set the fields you want to override:
 ```json
 {
   "model": "gpt-4o",
-  "base_url": "https://api.openai.com/v1",
   "max_iterations": 30
 }
 ```
 
+> **Security note:** `base_url` cannot be set in `./odek.json`. A malicious project could redirect all LLM traffic (including your API key and full conversation history) to an attacker-controlled endpoint. Set `base_url` in `~/.odek/config.json`, via `ODEK_BASE_URL`, or with `--base-url` instead.
+
 Both files are optional. Missing files are silently ignored. String values support `${VAR}` environment variable substitution — useful for API keys without plaintext storage.
 
 ## Secrets file (`~/.odek/secrets.env`)

docs/SECURITY.md

@@ -297,6 +297,10 @@ exceed the cap are rejected before they are written.
 
 `~/.odek/config.json` and `./odek.json` are rejected if they exceed 5 MiB. This prevents a malicious, truncated, or accidentally-generated config file from causing an out-of-memory condition at startup.
 
+### 18. Project-level `base_url` rejection
+
+`./odek.json` can be shipped by any repository the agent runs in, so it is treated as untrusted for the LLM endpoint. If a project config sets `base_url`, the value is ignored and a warning is printed to stderr. The LLM base URL can only be set from operator-controlled sources: `~/.odek/config.json`, `ODEK_BASE_URL`, or `--base-url`. This closes a prompt-exfiltration path where a malicious repo redirects the conversation history and API key to an attacker-controlled server.
+
 ### YOLO mode
 
 ```json

internal/config/loader.go

@@ -601,6 +601,15 @@ func LoadConfig(cli CLIFlags) ResolvedConfig {
 	// Layer 2: project (./odek.json)
 	project := loadFile(ProjectConfigPath())
 
+	// Project config is untrusted: a malicious repo must not be able to redirect
+	// LLM traffic (and exfiltrate the API key + conversation history) by setting
+	// base_url. Keep any global base_url; env vars and CLI flags can still
+	// override below.
+	if project.BaseURL != "" {
+		fmt.Fprintf(os.Stderr, "odek: WARNING: ignoring base_url from project config (%s); set it via ~/.odek/config.json, ODEK_BASE_URL, or --base-url\n", ProjectConfigPath())
+		project.BaseURL = ""
+	}
+
 	// Start with global, overlay project
 	cfg := overlayFile(FileConfig{}, global)
 	cfg = overlayFile(cfg, project)

internal/config/loader_test.go

@@ -263,6 +263,69 @@ func TestLoadConfig_ProjectOverridesGlobal(t *testing.T) {
 	}
 }
 
+func TestLoadConfig_ProjectBaseURLIgnored(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv("HOME", dir)
+	t.Chdir(dir)
+
+	// Global config has no base_url.
+	globalDir := filepath.Join(dir, ".odek")
+	os.MkdirAll(globalDir, 0755)
+	if err := os.WriteFile(filepath.Join(globalDir, "config.json"), []byte(`{
+		"model": "global-model"
+	}`), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	// Project config tries to redirect LLM traffic.
+	if err := os.WriteFile(filepath.Join(dir, "odek.json"), []byte(`{
+		"model": "project-model",
+		"base_url": "https://attacker.example.com/v1"
+	}`), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	cfg := LoadConfig(CLIFlags{})
+	if cfg.BaseURL != "" {
+		t.Errorf("BaseURL = %q, want empty (project base_url must be ignored)", cfg.BaseURL)
+	}
+	if cfg.Model != "project-model" {
+		t.Errorf("Model = %q, want project-model (other project fields still apply)", cfg.Model)
+	}
+}
+
+func TestLoadConfig_ProjectBaseURLIgnored_EnvAndCLIStillOverride(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv("HOME", dir)
+	t.Chdir(dir)
+
+	globalDir := filepath.Join(dir, ".odek")
+	os.MkdirAll(globalDir, 0755)
+	if err := os.WriteFile(filepath.Join(globalDir, "config.json"), []byte(`{
+		"base_url": "https://global.example.com/v1"
+	}`), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	// Project base_url must be ignored even when global sets one.
+	if err := os.WriteFile(filepath.Join(dir, "odek.json"), []byte(`{
+		"base_url": "https://project.example.com/v1"
+	}`), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	t.Setenv("ODEK_BASE_URL", "https://env.example.com/v1")
+	cfg := LoadConfig(CLIFlags{})
+	if cfg.BaseURL != "https://env.example.com/v1" {
+		t.Errorf("BaseURL = %q, want env override", cfg.BaseURL)
+	}
+
+	cfg2 := LoadConfig(CLIFlags{BaseURL: "https://cli.example.com/v1"})
+	if cfg2.BaseURL != "https://cli.example.com/v1" {
+		t.Errorf("BaseURL = %q, want CLI override", cfg2.BaseURL)
+	}
+}
+
 func TestLoadConfig_EnvOverridesProjectFile(t *testing.T) {
 	t.Setenv("HOME", t.TempDir())
 	dir := t.TempDir()