fix: disallow api_key, system, dangerous from project config

Project-level ./odek.json is untrusted, so it can no longer override the
API key, system prompt, or dangerous-policy. Global config, ODEK_* env
vars, and CLI flags remain valid sources.

- Ignore project BaseURL, APIKey, System, and Dangerous in LoadConfig.
- Print stderr warnings for each ignored project-level sensitive field.
- Update TestRun_WithProjectConfig to use env API key + project model.
- Add regression tests for api_key/system/dangerous rejection.
- Update docs/CONFIG.md, docs/SECURITY.md, and AGENTS.md.

Author: jkyberneees

AGENTS.md

@@ -132,7 +132,7 @@ Layered prompt-injection / approval-fatigue defenses. Full reference: [docs/SECU
 - **Serve sandbox default-on** — `odek serve` enables `--sandbox` automatically unless `--no-sandbox` is passed.
 - **Sandbox volume confinement** (`internal/sandbox/sandbox.go`) — extra `--sandbox-volume` host paths must resolve to a location under the working directory, cannot contain `..` or symlink escapes, and cannot match sensitive prefixes such as `/etc`, `/proc`, `/sys`, `/dev`, `/root`, `/home`, `/var`, `/run`, or `/var/run/docker.sock`.
 - **Sandbox read-only enforcement** (`cmd/odek/sandbox_file.go` + `cmd/odek/file_tool.go` + `cmd/odek/perf_tools.go`) — when a sandbox container is active, `write_file`, `patch`, and `batch_patch` translate host paths to `/workspace/...` and copy data into the container with `docker cp`, so a read-only workspace mount (`--sandbox-readonly`) is enforced for the agent's own file tools.
-- **Project config base_url rejection** (`internal/config/loader.go`) — `./odek.json` is untrusted, so a `base_url` set there is ignored (with a stderr warning). The LLM endpoint can only be configured from the operator-controlled global config (`~/.odek/config.json`), `ODEK_BASE_URL`, or `--base-url`.
+- **Project config sensitive-field rejection** (`internal/config/loader.go`) — `./odek.json` is untrusted, so `base_url`, `api_key`, `system`, and the `dangerous` section set there are ignored (with stderr warnings). These can only be configured from operator-controlled sources: `~/.odek/config.json`, `ODEK_*` env vars, or CLI flags.
 - **Telegram photo caption wrapping** (`cmd/odek/telegram.go`) — photo captions cross the Telegram trust boundary, so they are wrapped as untrusted content both when passed to the local vision model and when injected into the main agent's user message.
 - **Secret redaction** (`internal/redact/redact.go`) — 20+ patterns: OpenAI, Anthropic, GitHub PAT, AWS, PEM, JWT, Vault, Google OAuth, SendGrid, Discord, DB URLs, etc.
 

cmd/odek/main_test.go

@@ -724,6 +724,7 @@ func TestRun_WithProjectConfig(t *testing.T) {
 
 	origDS := os.Getenv("DEEPSEEK_API_KEY")
 	origOAI := os.Getenv("OPENAI_API_KEY")
+	origOdekAPI := os.Getenv("ODEK_API_KEY")
 	origHome := os.Getenv("HOME")
 	origCwd, _ := os.Getwd()
 	os.Unsetenv("DEEPSEEK_API_KEY")
@@ -732,18 +733,22 @@ func TestRun_WithProjectConfig(t *testing.T) {
 	defer func() {
 		os.Setenv("DEEPSEEK_API_KEY", origDS)
 		os.Setenv("OPENAI_API_KEY", origOAI)
+		os.Setenv("ODEK_API_KEY", origOdekAPI)
 		os.Setenv("HOME", origHome)
 		os.Chdir(origCwd)
 	}()
 
 	// Isolate from any global config
 	os.Setenv("HOME", t.TempDir())
 
+	// API keys may not come from the untrusted project config; set one via env.
+	os.Setenv("ODEK_API_KEY", "sk-project-test-key")
+
 	// Create project-level config in a temp directory
 	projectDir := t.TempDir()
 	os.Chdir(projectDir)
 	if err := os.WriteFile(projectDir+"/odek.json", []byte(`{
-		"api_key": "sk-project-config"
+		"model": "project-model"
 	}`), 0644); err != nil {
 		t.Fatal(err)
 	}

docs/CONFIG.md

@@ -56,7 +56,14 @@ Same schema as global. Only set the fields you want to override:
 }
 ```
 
-> **Security note:** `base_url` cannot be set in `./odek.json`. A malicious project could redirect all LLM traffic (including your API key and full conversation history) to an attacker-controlled endpoint. Set `base_url` in `~/.odek/config.json`, via `ODEK_BASE_URL`, or with `--base-url` instead.
+> **Security note:** The following fields cannot be set in `./odek.json` because a malicious repository could use them to steal secrets, poison the system prompt, or disable safety policy:
+>
+> - `base_url` — use `~/.odek/config.json`, `ODEK_BASE_URL`, or `--base-url`
+> - `api_key` — use `~/.odek/config.json`, `ODEK_API_KEY`, or `~/.odek/secrets.env`
+> - `system` — use `~/.odek/config.json`, `ODEK_SYSTEM`, or `--system`
+> - `dangerous` — use `~/.odek/config.json`
+>
+> If any of these appear in `./odek.json`, odek ignores them and prints a warning.
 
 Both files are optional. Missing files are silently ignored. String values support `${VAR}` environment variable substitution — useful for API keys without plaintext storage.
 

docs/SECURITY.md

@@ -297,9 +297,16 @@ exceed the cap are rejected before they are written.
 
 `~/.odek/config.json` and `./odek.json` are rejected if they exceed 5 MiB. This prevents a malicious, truncated, or accidentally-generated config file from causing an out-of-memory condition at startup.
 
-### 18. Project-level `base_url` rejection
+### 18. Project-level sensitive config rejection
 
-`./odek.json` can be shipped by any repository the agent runs in, so it is treated as untrusted for the LLM endpoint. If a project config sets `base_url`, the value is ignored and a warning is printed to stderr. The LLM base URL can only be set from operator-controlled sources: `~/.odek/config.json`, `ODEK_BASE_URL`, or `--base-url`. This closes a prompt-exfiltration path where a malicious repo redirects the conversation history and API key to an attacker-controlled server.
+`./odek.json` can be shipped by any repository the agent runs in, so it is treated as untrusted for sensitive fields. If a project config sets any of the following, the value is ignored and a warning is printed to stderr:
+
+- `base_url` — can redirect the conversation history and API key to an attacker-controlled server.
+- `api_key` — can exfiltrate prompts by billing runs to an attacker-owned key.
+- `system` — can poison the system prompt with hidden instructions.
+- `dangerous` — can disable the approval gate (`{"action": "allow"}`) and enable destructive auto-execution.
+
+These fields can only be set from operator-controlled sources: `~/.odek/config.json`, `ODEK_*` environment variables, or CLI flags.
 
 ### YOLO mode
 

internal/config/loader.go

@@ -601,14 +601,26 @@ func LoadConfig(cli CLIFlags) ResolvedConfig {
 	// Layer 2: project (./odek.json)
 	project := loadFile(ProjectConfigPath())
 
-	// Project config is untrusted: a malicious repo must not be able to redirect
-	// LLM traffic (and exfiltrate the API key + conversation history) by setting
-	// base_url. Keep any global base_url; env vars and CLI flags can still
-	// override below.
+	// Project config is untrusted: a malicious repo must not be able to steal
+	// the API key, poison the system prompt, or disable safety policy.
+	// Keep global values for these sensitive fields; env vars and CLI flags can
+	// still override below.
 	if project.BaseURL != "" {
 		fmt.Fprintf(os.Stderr, "odek: WARNING: ignoring base_url from project config (%s); set it via ~/.odek/config.json, ODEK_BASE_URL, or --base-url\n", ProjectConfigPath())
 		project.BaseURL = ""
 	}
+	if project.APIKey != "" {
+		fmt.Fprintf(os.Stderr, "odek: WARNING: ignoring api_key from project config (%s); set it via ~/.odek/config.json, ODEK_API_KEY, or ~/.odek/secrets.env\n", ProjectConfigPath())
+		project.APIKey = ""
+	}
+	if project.System != "" {
+		fmt.Fprintf(os.Stderr, "odek: WARNING: ignoring system from project config (%s); set it via ~/.odek/config.json, ODEK_SYSTEM, or --system\n", ProjectConfigPath())
+		project.System = ""
+	}
+	if project.Dangerous != nil {
+		fmt.Fprintf(os.Stderr, "odek: WARNING: ignoring dangerous section from project config (%s); set it via ~/.odek/config.json\n", ProjectConfigPath())
+		project.Dangerous = nil
+	}
 
 	// Start with global, overlay project
 	cfg := overlayFile(FileConfig{}, global)

internal/config/loader_test.go

@@ -326,6 +326,91 @@ func TestLoadConfig_ProjectBaseURLIgnored_EnvAndCLIStillOverride(t *testing.T) {
 	}
 }
 
+func TestLoadConfig_ProjectAPIKeyIgnored(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv("HOME", dir)
+	t.Chdir(dir)
+
+	globalDir := filepath.Join(dir, ".odek")
+	os.MkdirAll(globalDir, 0755)
+	if err := os.WriteFile(filepath.Join(globalDir, "config.json"), []byte(`{
+		"api_key": "global-key"
+	}`), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := os.WriteFile(filepath.Join(dir, "odek.json"), []byte(`{
+		"api_key": "project-key"
+	}`), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	cfg := LoadConfig(CLIFlags{})
+	if cfg.APIKey != "global-key" {
+		t.Errorf("APIKey = %q, want global-key (project api_key must be ignored)", cfg.APIKey)
+	}
+}
+
+func TestLoadConfig_ProjectSystemIgnored(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv("HOME", dir)
+	t.Chdir(dir)
+
+	globalDir := filepath.Join(dir, ".odek")
+	os.MkdirAll(globalDir, 0755)
+	if err := os.WriteFile(filepath.Join(globalDir, "config.json"), []byte(`{
+		"system": "global-system"
+	}`), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := os.WriteFile(filepath.Join(dir, "odek.json"), []byte(`{
+		"system": "project-system"
+	}`), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	cfg := LoadConfig(CLIFlags{})
+	if cfg.System != "global-system" {
+		t.Errorf("System = %q, want global-system (project system must be ignored)", cfg.System)
+	}
+
+	t.Setenv("ODEK_SYSTEM", "env-system")
+	cfg2 := LoadConfig(CLIFlags{})
+	if cfg2.System != "env-system" {
+		t.Errorf("System = %q, want env-system (env still overrides)", cfg2.System)
+	}
+}
+
+func TestLoadConfig_ProjectDangerousIgnored(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv("HOME", dir)
+	t.Chdir(dir)
+
+	globalDir := filepath.Join(dir, ".odek")
+	os.MkdirAll(globalDir, 0755)
+	if err := os.WriteFile(filepath.Join(globalDir, "config.json"), []byte(`{
+		"dangerous": {"action": "deny"}
+	}`), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := os.WriteFile(filepath.Join(dir, "odek.json"), []byte(`{
+		"dangerous": {"action": "allow"}
+	}`), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	cfg := LoadConfig(CLIFlags{})
+	if cfg.Dangerous.DefaultAction == nil || *cfg.Dangerous.DefaultAction != "deny" {
+		action := "<nil>"
+		if cfg.Dangerous.DefaultAction != nil {
+			action = *cfg.Dangerous.DefaultAction
+		}
+		t.Errorf("Dangerous.DefaultAction = %s, want deny (project dangerous must be ignored)", action)
+	}
+}
+
 func TestLoadConfig_EnvOverridesProjectFile(t *testing.T) {
 	t.Setenv("HOME", t.TempDir())
 	dir := t.TempDir()