fix: validate session/episode vector index IDs and reject symlinks

Finding #14 — Session vector index rebuild:
- Validate each session filename-derived ID with ValidateSessionID before
  embedding it.
- Skip entries whose DirEntry.Type() is a symlink and double-check with
  os.Lstat.
- Add internal/session/vector_index_test.go regression tests.

Finding #15 — Episode vector index session_id trust:
- Treat index.json as untrusted input.
- Call session.ValidateSessionID(m.SessionID) before building the .md path.
- Add defense-in-depth checks for .. and path separators.
- Log warnings for rejected entries.
- Add regression tests in internal/memory/episode_index_test.go.

Update docs/SECURITY.md and AGENTS.md for both defenses.

Author: jkyberneees

AGENTS.md

@@ -113,6 +113,7 @@ Layered prompt-injection / approval-fatigue defenses. Full reference: [docs/SECU
 - **glob tool hardening** (`cmd/odek/file_tool.go`) — `glob` caps results at 1,000 matches and wraps returned paths as untrusted content.
 - **Sub-agent task-file cap** (`cmd/odek/subagent.go`) — `odek subagent --task <file>` rejects task files larger than 10 MiB before loading them into memory.
 - **session_search hardening** (`cmd/odek/session_search_tool.go`) — the `get` action returns at most the 100 most recent messages and wraps each message content, task, and buffer entry as untrusted; `list`/`search`/`find` also wrap session tasks.
+- **Session vector index hardening** (`internal/session/vector_index.go`) — `rebuildLocked` validates every session filename with `ValidateSessionID` and skips symlinks via `DirEntry.Type()` and `os.Lstat`, preventing a planted symlink from embedding arbitrary files into the semantic search corpus.
 - **@-resource / --ctx prompt wrapping** (`cmd/odek/refs.go`, `cmd/odek/serve.go`) — content resolved from `@file` references and `--ctx` files is wrapped as untrusted before being inserted into the prompt.
 - **Config file size cap** (`internal/config/loader.go`) — `~/.odek/config.json` and `./odek.json` are rejected if larger than 5 MiB to prevent OOM from a malicious or broken config at startup.
 - **Resource resolver size cap** (`internal/resource/resource.go`) — `@-resource` file loads are capped at 1 MiB to prevent OOM from `@hugefile` references.
@@ -141,6 +142,7 @@ Layered prompt-injection / approval-fatigue defenses. Full reference: [docs/SECU
 - **Telegram outbound media path allowlist** (`internal/telegram/media_path.go` + `internal/telegram/handler.go` + `internal/tool/send_message.go` + `cmd/odek/telegram.go`) — paths supplied to `MEDIA:...` prefixes or `send_message(file=...)` are resolved to an absolute path and verified against an allowlist (cwd, `~/.odek/media/`, system temp dir). `os.Lstat` rejects symlink final components and `filepath.EvalSymlinks` ensures the resolved path does not escape the allowlist, preventing prompt-injection-driven exfiltration of arbitrary files.
 - **Session ID entropy + session-scoped auth tokens** (`internal/session/session.go`, `cmd/odek/serve.go`) — session IDs now carry 128 bits of randomness (16 bytes / 32 hex chars); each session stores a 256-bit `AuthToken` required by `GET/DELETE/POST /api/sessions/<id>` and WebSocket session-resume messages via `X-Session-Token` header, `session_token` cookie, or `auth_token` WS field. Per-IP rate limiting (60/min) on session lookups adds a brute-force backstop.
 - **Skill/episode untrusted wrapper** (`internal/loop/loop.go` + `odek.go`) — skill context and retrieved session-episode context are passed through the caller-provided untrusted wrapper (the same nonce'd `<untrusted_content_*>` boundary used for tool output) before being injected into the model's system context. This prevents a compromised or tainted skill/episode from being treated as trusted system instructions.
+- **Episode index session ID validation** (`internal/memory/episode_index.go` + `internal/session/session.go`) — `readAllSummaries` treats `index.json` as untrusted input and validates every `session_id` with `session.ValidateSessionID` before building the `filepath.Join(dir, sessionID+".md")` path. Invalid / traversal / separator-containing IDs are skipped with a warning, preventing a tampered episode index from pulling arbitrary files (e.g. `~/.odek/config.json`, `IDENTITY.md`) into the embedding space.
 - **Secret redaction** (`internal/redact/redact.go`) — 20+ patterns: OpenAI, Anthropic, GitHub PAT, AWS, PEM, JWT, Vault, Google OAuth, SendGrid, Discord, DB URLs, etc.
 
 ### Platform Support

docs/SECURITY.md

@@ -350,6 +350,19 @@ Legacy sessions created before this defense have no `AuthToken`; the first acces
 
 Skill content and retrieved session episodes are externally-sourced data that cross the trust boundary. Before injecting them as `system` messages, the loop passes them through the same nonce'd `<untrusted_content_*>` wrapper used for tool output. The skill manager already gates `NeedsReview`/tainted skills, and the memory manager filters tainted episodes from search, but the wrapper provides defense-in-depth so a compromised skill or episode cannot pose as trusted system instructions.
 
+### 26. Session vector index rebuild hardening
+
+`internal/session/vector_index.go::rebuildLocked` scans the session directory to build the semantic search corpus. Before a file is read it must pass two checks:
+
+1. **Session-ID validation** — the filename is stripped of its `.json` suffix and passed through `ValidateSessionID`. Names that are empty, contain path separators, or contain `..` are skipped.
+2. **Symlink rejection** — the `os.DirEntry.Type()` is checked for `ModeSymlink`, and the full path is then `os.Lstat`ed to skip symlinks even on platforms/filesystems where `Type()` does not report the link.
+
+This closes the path where an attacker plants a symlink named like a session file (e.g. `20260518-abc….json`) that points to a sensitive file outside the sessions directory, which would otherwise have its content embedded into the session search corpus.
+
+### 27. Episode index session ID validation
+
+The episode vector index is rebuilt from `index.json` plus one `.md` summary file per entry. Because `index.json` is persisted JSON that can be tampered with on disk, `internal/memory/episode_index.go::readAllSummaries` treats every `session_id` as untrusted input. It calls `session.ValidateSessionID` before constructing the path `filepath.Join(dir, sessionID+".md")` and skips (with a stderr warning) any entry that is empty, contains path separators, contains `..`, or is otherwise malformed. This prevents a tampered entry such as `"../../../.odek/config"` from causing the rebuild to read arbitrary files (e.g. `~/.odek/config.json` or `IDENTITY.md`) and include them in the embedding space.
+
 ### YOLO mode
 
 ```json
@@ -404,6 +417,7 @@ Defaults: `FrictionThreshold=3`, `FrictionWindow=60s`. To opt out (TTYApprover o
 | Memory replays a previously-injected episode forever | Tainted episodes filtered from `Search` |
 | User reflex-approves a destructive class after many benign ones | Friction mode requires typed `approve` + 1.5 s pause |
 | Successful injection steers agent to attacker URL | `odek audit` flags `suspicious_divergence` on the turn |
+| Symlink planted as session file exfiltrates arbitrary file into semantic search | `rebuildLocked` validates IDs and skips symlinks via `Lstat` |
 
 ---
 

internal/memory/episode_index.go

@@ -2,13 +2,15 @@ package memory
 
 import (
 	"encoding/json"
+	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
 	"sync"
 	"time"
 
 	"github.com/BackendStack21/go-vector/pkg/vector"
+	"github.com/BackendStack21/odek/internal/session"
 )
 
 const (
@@ -323,6 +325,21 @@ func (vi *episodeVectorIndex) readAllSummaries() []idText {
 	}
 	out := make([]idText, 0, len(index))
 	for _, m := range index {
+		// index.json is untrusted input; validate the session ID before using it
+		// to construct a filesystem path. Reject traversal, separators, and any
+		// other malformed ID silently so a tampered index cannot pull arbitrary
+		// files (e.g. ~/.odek/config.json) into the embedding space.
+		if err := session.ValidateSessionID(m.SessionID); err != nil {
+			fmt.Fprintf(os.Stderr, "odek: warning: episode index rejected invalid session_id %q: %v\n", m.SessionID, err)
+			continue
+		}
+		// Defense-in-depth: ValidateSessionID already rejects these, but the
+		// consequences of a missed check are a path traversal read, so verify
+		// explicitly before joining.
+		if strings.Contains(m.SessionID, "..") || strings.ContainsAny(m.SessionID, "/\\") {
+			fmt.Fprintf(os.Stderr, "odek: warning: episode index rejected unsafe session_id %q\n", m.SessionID)
+			continue
+		}
 		path := filepath.Join(vi.dir, m.SessionID+".md")
 		b, err := os.ReadFile(path)
 		if err != nil {

internal/memory/episode_index_test.go

@@ -2,11 +2,14 @@ package memory
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
+	"os"
 	"path/filepath"
 	"sync"
 	"sync/atomic"
 	"testing"
+	"time"
 )
 
 // resetEpIdxes clears the process-wide singleton map so each test gets a fresh
@@ -402,5 +405,106 @@ func TestSearchEpisodes_OOVFallbackToLLM(t *testing.T) {
 	// After D-05 fix: OOV → recallByVector returns nil → SearchEpisodes falls back to episodes.Search
 	// which uses the LLM ranker. We don't assert an exact count because the fallback
 	// path (episodes.Search) may or may not call LLM depending on whether the index
-	// is also empty from LLM ranker's perspective, but we confirm no panic.
+	// is also empty from the LLM ranker's perspective, but we confirm no panic.
+}
+
+// ── Episode index untrusted-session-id validation (Finding #15) ───────────────
+
+// TestReadAllSummaries_ValidSessionID confirms that a well-formed session ID is
+// accepted and its summary is loaded normally.
+func TestReadAllSummaries_ValidSessionID(t *testing.T) {
+	dir := t.TempDir()
+	validID := "20260601-valid"
+	if err := os.WriteFile(filepath.Join(dir, validID+".md"), []byte("valid summary"), 0600); err != nil {
+		t.Fatalf("write valid episode: %v", err)
+	}
+	idx := []EpisodeMeta{{SessionID: validID, CreatedAt: time.Now().UTC()}}
+	data, err := json.Marshal(idx)
+	if err != nil {
+		t.Fatalf("marshal index: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, episodeIndexFile), data, 0600); err != nil {
+		t.Fatalf("write index: %v", err)
+	}
+
+	vi := &episodeVectorIndex{dir: dir}
+	out := vi.readAllSummaries()
+	if len(out) != 1 || out[0].id != validID || out[0].text != "valid summary" {
+		t.Fatalf("expected 1 valid result for %q, got %v", validID, out)
+	}
+}
+
+// TestReadAllSummaries_TraversalRejected confirms that a tampered session_id
+// like "../secret" cannot escape the episodes directory and pull arbitrary
+// files into the embedding space.
+func TestReadAllSummaries_TraversalRejected(t *testing.T) {
+	root := t.TempDir()
+	epDir := filepath.Join(root, "episodes")
+	if err := os.MkdirAll(epDir, 0700); err != nil {
+		t.Fatalf("mkdir episodes: %v", err)
+	}
+	validID := "20260601-valid"
+	if err := os.WriteFile(filepath.Join(epDir, validID+".md"), []byte("valid summary"), 0600); err != nil {
+		t.Fatalf("write valid episode: %v", err)
+	}
+	// Place a file one directory above the episodes dir; a traversal would read it.
+	if err := os.WriteFile(filepath.Join(root, "secret.md"), []byte("stolen"), 0600); err != nil {
+		t.Fatalf("write secret: %v", err)
+	}
+
+	idx := []EpisodeMeta{
+		{SessionID: validID, CreatedAt: time.Now().UTC()},
+		{SessionID: "../secret", CreatedAt: time.Now().UTC()},
+	}
+	data, err := json.Marshal(idx)
+	if err != nil {
+		t.Fatalf("marshal index: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(epDir, episodeIndexFile), data, 0600); err != nil {
+		t.Fatalf("write index: %v", err)
+	}
+
+	vi := &episodeVectorIndex{dir: epDir}
+	out := vi.readAllSummaries()
+	if len(out) != 1 || out[0].id != validID || out[0].text != "valid summary" {
+		t.Fatalf("expected only valid episode, got %v", out)
+	}
+}
+
+// TestReadAllSummaries_PathSeparatorRejected confirms that session IDs
+// containing forward or backward slashes are rejected.
+func TestReadAllSummaries_PathSeparatorRejected(t *testing.T) {
+	dir := t.TempDir()
+	validID := "20260601-valid"
+	if err := os.WriteFile(filepath.Join(dir, validID+".md"), []byte("valid summary"), 0600); err != nil {
+		t.Fatalf("write valid episode: %v", err)
+	}
+
+	// Create a subdirectory with a file that a separator-containing ID could reach.
+	subDir := filepath.Join(dir, "sub")
+	if err := os.MkdirAll(subDir, 0700); err != nil {
+		t.Fatalf("mkdir sub: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(subDir, "secret.md"), []byte("stolen"), 0600); err != nil {
+		t.Fatalf("write secret: %v", err)
+	}
+
+	idx := []EpisodeMeta{
+		{SessionID: validID, CreatedAt: time.Now().UTC()},
+		{SessionID: "sub/secret", CreatedAt: time.Now().UTC()},
+		{SessionID: "sub\\secret", CreatedAt: time.Now().UTC()},
+	}
+	data, err := json.Marshal(idx)
+	if err != nil {
+		t.Fatalf("marshal index: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, episodeIndexFile), data, 0600); err != nil {
+		t.Fatalf("write index: %v", err)
+	}
+
+	vi := &episodeVectorIndex{dir: dir}
+	out := vi.readAllSummaries()
+	if len(out) != 1 || out[0].id != validID {
+		t.Fatalf("expected only valid episode, got %v", out)
+	}
 }

internal/session/vector_index.go

@@ -155,15 +155,34 @@ func (vi *VectorIndex) rebuildLocked() error {
 		if e.IsDir() || !isSessionFile(e.Name()) {
 			continue
 		}
-		data, err := os.ReadFile(filepath.Join(vi.dir, e.Name()))
+
+		// Only load session files whose base name is a valid session ID and
+		// that are not symlinks. This prevents a planted symlink named like a
+		// session file from pointing outside the directory and having its
+		// content embedded into the search corpus.
+		id := idFromPath(e.Name())
+		if err := ValidateSessionID(id); err != nil {
+			continue
+		}
+		if e.Type()&os.ModeSymlink != 0 {
+			continue
+		}
+
+		path := filepath.Join(vi.dir, e.Name())
+		info, err := os.Lstat(path)
+		if err != nil || info.Mode()&os.ModeSymlink != 0 {
+			continue
+		}
+
+		data, err := os.ReadFile(path)
 		if err != nil {
 			continue
 		}
 		text := extractConversationText(data)
 		if text == "" {
 			continue
 		}
-		ids = append(ids, idFromPath(e.Name()))
+		ids = append(ids, id)
 		corpus = append(corpus, text)
 	}