fix(search): classify each discovered path in search_files and multi_grep

H-4: search_files and multi_grep previously only classified the root path,
then walked and read every matching file. Add checkSearchPath helpers that
classify each descended directory and each file the same way the root path is
checked; sensitive paths are skipped and reported in a new Skipped field
rather than returned silently.

H-5: add regression tests for case-insensitive ~/.odek trust-anchor matching
(macOS APFS) and shell rc files.

- file_tool.go: wire checkSearchPath into searchContent and searchFiles;
  return Skipped in searchFilesResult.
- perf_tools.go: add multiGrepTool.checkSearchPath; guard multi_grep walker;
  return Skipped in grepPatternResult.
- file_tool_test.go / perf_tools_test.go / classifier_test.go: regression
  tests for skipped sensitive paths and case-insensitive anchors.

Author: jkyberneees

cmd/odek/file_tool.go

@@ -525,6 +525,7 @@ type searchMatch struct {
 
 type searchFilesResult struct {
 	Matches []searchMatch `json:"matches"`
+	Skipped []string      `json:"skipped,omitempty"`
 	Error   string        `json:"error,omitempty"`
 }
 
@@ -567,13 +568,28 @@ func (t *searchFilesTool) Call(argsJSON string) (string, error) {
 	}
 }
 
+// checkSearchPath classifies a discovered path the same way the root path was
+// classified. If the path is more restrictive (e.g. a file under ~/.odek
+// discovered while searching $HOME), it returns skip=true so the walker does
+// not silently read sensitive files.
+func (t *searchFilesTool) checkSearchPath(path string) (skip bool, reason string) {
+	risk := danger.ClassifyPath(path)
+	if err := t.dangerousConfig.CheckOperation(danger.ToolOperation{
+		Name: "search_files", Resource: path, Risk: risk,
+	}, nil); err != nil {
+		return true, err.Error()
+	}
+	return false, ""
+}
+
 func (t *searchFilesTool) searchContent(args searchFilesArgs) (string, error) {
 	re, err := regexp.Compile(args.Pattern)
 	if err != nil {
 		return jsonError(fmt.Sprintf("invalid regex pattern %q: %v", args.Pattern, err))
 	}
 
 	var matches []searchMatch
+	var skipped []string
 	limit := args.Limit
 	resultBytes := 0
 
@@ -590,6 +606,13 @@ func (t *searchFilesTool) searchContent(args searchFilesArgs) (string, error) {
 			if skipDir(info.Name()) {
 				return filepath.SkipDir
 			}
+			// Security: a broad search root may contain a sensitive subtree
+			// (e.g. ~/.odek under $HOME). Classify the directory before
+			// descending; if it would require approval/denial, skip it.
+			if skip, reason := t.checkSearchPath(path); skip {
+				skipped = append(skipped, path+": "+reason)
+				return filepath.SkipDir
+			}
 			return nil
 		}
 		// Skip symlinks — prevents TOCTOU on the path and avoids listing
@@ -598,6 +621,13 @@ func (t *searchFilesTool) searchContent(args searchFilesArgs) (string, error) {
 			return nil
 		}
 
+		// Security: classify each file before reading. This prevents a broad
+		// search from silently returning files that read_file would gate.
+		if skip, reason := t.checkSearchPath(path); skip {
+			skipped = append(skipped, path+": "+reason)
+			return nil
+		}
+
 		// Apply file_glob filter
 		if args.FileGlob != "" {
 			match, _ := filepath.Match(args.FileGlob, info.Name())
@@ -659,7 +689,7 @@ func (t *searchFilesTool) searchContent(args searchFilesArgs) (string, error) {
 		return jsonError(fmt.Sprintf("search failed: %v", err))
 	}
 
-	return jsonResult(searchFilesResult{Matches: matches})
+	return jsonResult(searchFilesResult{Matches: matches, Skipped: skipped})
 }
 
 func (t *searchFilesTool) searchFiles(args searchFilesArgs) (string, error) {
@@ -673,7 +703,15 @@ func (t *searchFilesTool) searchFiles(args searchFilesArgs) (string, error) {
 	}
 
 	var matches []searchMatch
+	var skipped []string
 	for _, p := range paths {
+		// Security: each discovered path is classified the same way the root
+		// path is. Sensitive files (e.g. under ~/.odek, /etc) are skipped
+		// rather than returned silently.
+		if skip, reason := t.checkSearchPath(p); skip {
+			skipped = append(skipped, p+": "+reason)
+			continue
+		}
 		matches = append(matches, searchMatch{Path: wrapUntrusted(t.toolCtx(), "search_files:"+p, p)})
 	}
 
@@ -688,7 +726,7 @@ func (t *searchFilesTool) searchFiles(args searchFilesArgs) (string, error) {
 		return fi.ModTime().After(fj.ModTime())
 	})
 
-	return jsonResult(searchFilesResult{Matches: matches})
+	return jsonResult(searchFilesResult{Matches: matches, Skipped: skipped})
 }
 
 // ── Patch Tool ─────────────────────────────────────────────────────────
@@ -1091,14 +1129,16 @@ func confineToCWD(path string) (string, error) {
 // must not be writable through the generic file tools. Keep in sync with
 // the SystemWrite escalation in danger.ClassifyPath.
 func isProtectedOdekPath(rel string) bool {
-	rel = filepath.Clean(rel)
+	// Case-folding defends against case-insensitive filesystems (macOS APFS):
+	// ~/.odek/CONFIG.JSON and ~/.odek/config.json are the same file.
+	rel = strings.ToLower(filepath.Clean(rel))
 
 	// Exact-file trust anchors. Rewriting any of these can disable safety
 	// policy, exfiltrate secrets, or persist attacker control.
 	protectedExact := []string{
 		"config.json",
 		"secrets.env",
-		"IDENTITY.md",
+		"identity.md",
 		"schedules.json",
 		"schedule-state.json",
 		"schedules.lock",

cmd/odek/file_tool_test.go

@@ -6,6 +6,7 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"sync"
 	"testing"
 
 	"github.com/BackendStack21/odek/internal/danger"
@@ -1220,6 +1221,179 @@ func TestWriteFile_SecurityDenied(t *testing.T) {
 	}
 }
 
+// ── Search path classification tests (H-4 / H-5) ────────────────────────
+
+// countingApprover is a test double that approves the first N prompt requests
+// and denies the rest. It lets us approve a search root while denying the
+// sensitive files discovered underneath it.
+type countingApprover struct {
+	mu          sync.Mutex
+	calls       int
+	allowFirstN int
+}
+
+func (a *countingApprover) PromptCommand(cls danger.RiskClass, cmd, description string) error {
+	return a.prompt()
+}
+
+func (a *countingApprover) PromptOperation(op danger.ToolOperation) error {
+	return a.prompt()
+}
+
+func (a *countingApprover) prompt() error {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	a.calls++
+	if a.calls <= a.allowFirstN {
+		return nil
+	}
+	return fmt.Errorf("denied by test approver")
+}
+
+// makeTestHomeDir creates a HOME directory outside /tmp and /var so that
+// ClassifyPath treats paths under it as real home-directory paths rather than
+// temporary/system paths. The directory is created under the current working
+// directory and removed when the test ends.
+func makeTestHomeDir(t *testing.T) string {
+	t.Helper()
+	cwd, err := os.Getwd()
+	if err != nil {
+		t.Fatalf("cannot get cwd: %v", err)
+	}
+	home, err := os.MkdirTemp(cwd, "odek-test-home-*")
+	if err != nil {
+		t.Fatalf("cannot create test home: %v", err)
+	}
+	t.Cleanup(func() { os.RemoveAll(home) })
+	return home
+}
+
+func TestSearchFiles_TargetFiles_SkipsSensitiveOdekPaths(t *testing.T) {
+	home := makeTestHomeDir(t)
+	t.Setenv("HOME", home)
+
+	odekDir := filepath.Join(home, ".odek")
+	if err := os.MkdirAll(odekDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	os.WriteFile(filepath.Join(odekDir, "config.json"), []byte("api-key-secret\n"), 0644)
+	os.WriteFile(filepath.Join(odekDir, "notes.md"), []byte("hello world\n"), 0644)
+
+	cfg := danger.DangerousConfig{
+		Classes: map[danger.RiskClass]danger.Action{danger.SystemWrite: danger.Prompt},
+		Approver: &countingApprover{allowFirstN: 1}, // approve the search root only
+	}
+	tool := &searchFilesTool{dangerousConfig: cfg}
+
+	args := fmt.Sprintf(`{"pattern":"*","target":"files","path":%q}`, odekDir)
+	result := callJSON(t, tool, args)
+
+	var r struct {
+		Matches []struct {
+			Path string `json:"path"`
+		} `json:"matches"`
+		Skipped []string `json:"skipped"`
+		Error   string   `json:"error,omitempty"`
+	}
+	mustUnmarshal(t, result, &r)
+	if r.Error != "" {
+		t.Fatalf("unexpected error: %s", r.Error)
+	}
+	if len(r.Matches) != 1 {
+		t.Fatalf("expected 1 allowed match, got %d", len(r.Matches))
+	}
+	if !strings.Contains(unwrapUntrusted(r.Matches[0].Path), "notes.md") {
+		t.Errorf("expected notes.md match, got %q", r.Matches[0].Path)
+	}
+	if len(r.Skipped) != 1 {
+		t.Fatalf("expected 1 skipped sensitive path, got %d: %v", len(r.Skipped), r.Skipped)
+	}
+	if !strings.Contains(r.Skipped[0], "config.json") {
+		t.Errorf("expected config.json in skipped list, got %q", r.Skipped[0])
+	}
+}
+
+func TestSearchFiles_TargetFiles_SkipsCaseInsensitiveAnchor(t *testing.T) {
+	home := makeTestHomeDir(t)
+	t.Setenv("HOME", home)
+
+	odekDir := filepath.Join(home, ".odek")
+	if err := os.MkdirAll(odekDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	os.WriteFile(filepath.Join(odekDir, "CONFIG.JSON"), []byte("api-key-secret\n"), 0644)
+	os.WriteFile(filepath.Join(odekDir, "notes.md"), []byte("hello world\n"), 0644)
+
+	cfg := danger.DangerousConfig{
+		Classes: map[danger.RiskClass]danger.Action{danger.SystemWrite: danger.Prompt},
+		Approver: &countingApprover{allowFirstN: 1},
+	}
+	tool := &searchFilesTool{dangerousConfig: cfg}
+
+	args := fmt.Sprintf(`{"pattern":"*","target":"files","path":%q}`, odekDir)
+	result := callJSON(t, tool, args)
+
+	var r struct {
+		Matches []struct {
+			Path string `json:"path"`
+		} `json:"matches"`
+		Skipped []string `json:"skipped"`
+		Error   string   `json:"error,omitempty"`
+	}
+	mustUnmarshal(t, result, &r)
+	if r.Error != "" {
+		t.Fatalf("unexpected error: %s", r.Error)
+	}
+	if len(r.Matches) != 1 {
+		t.Fatalf("expected 1 allowed match, got %d", len(r.Matches))
+	}
+	if len(r.Skipped) != 1 || !strings.Contains(strings.ToLower(r.Skipped[0]), "config.json") {
+		t.Fatalf("expected CONFIG.JSON skipped, got %v", r.Skipped)
+	}
+}
+
+func TestSearchFiles_CheckSearchPath_DeniesSystemWrite(t *testing.T) {
+	home := makeTestHomeDir(t)
+	t.Setenv("HOME", home)
+
+	cfg := danger.DangerousConfig{
+		Classes: map[danger.RiskClass]danger.Action{danger.SystemWrite: danger.Deny},
+	}
+	tool := &searchFilesTool{dangerousConfig: cfg}
+
+	skip, reason := tool.checkSearchPath(filepath.Join(home, ".odek", "config.json"))
+	if !skip {
+		t.Fatalf("expected checkSearchPath to skip ~/.odek/config.json")
+	}
+	if !strings.Contains(reason, "system_write") {
+		t.Errorf("expected system_write denial, got %q", reason)
+	}
+
+	skip, _ = tool.checkSearchPath(filepath.Join(home, ".odek", "notes.md"))
+	if skip {
+		t.Errorf("expected non-anchor ~/.odek path to be allowed")
+	}
+}
+
+// TestIsProtectedOdekPath_CaseInsensitive verifies the file-tool write guard
+// rejects case variants of trust anchors on case-insensitive filesystems.
+func TestIsProtectedOdekPath_CaseInsensitive(t *testing.T) {
+	cases := []string{
+		"CONFIG.JSON",
+		"Secrets.Env",
+		"IDENTITY.MD",
+		"SKILLS/evil/SKILL.md",
+		"SESSIONS/abc.json",
+		"AUDIT/turn.json",
+		"PLANS/evil.md",
+	}
+	for _, c := range cases {
+		if !isProtectedOdekPath(c) {
+			t.Errorf("isProtectedOdekPath(%q) = false, want true", c)
+		}
+	}
+}
+
 // ── Helpers ────────────────────────────────────────────────────────────
 
 func callJSON(t *testing.T, tool interface {

cmd/odek/perf_tools.go

@@ -1198,6 +1198,7 @@ type grepPatternResult struct {
 	Pattern string      `json:"pattern"`
 	Matches []grepMatch `json:"matches"`
 	Count   int         `json:"count"`
+	Skipped []string    `json:"skipped,omitempty"`
 	Error   string      `json:"error,omitempty"`
 }
 
@@ -1269,6 +1270,20 @@ func (t *multiGrepTool) Call(argsJSON string) (string, error) {
 	return jsonResult(multiGrepResult{Results: results})
 }
 
+// checkSearchPath classifies a discovered path the same way the root path was
+// checked in Call. If the path is more restrictive (e.g. a file under ~/.odek
+// discovered while searching $HOME), it returns skip=true so the walker does
+// not silently read sensitive files.
+func (t *multiGrepTool) checkSearchPath(path string) (skip bool, reason string) {
+	risk := danger.ClassifyPath(path)
+	if err := t.dangerousConfig.CheckOperation(danger.ToolOperation{
+		Name: "multi_grep", Resource: path, Risk: risk,
+	}, nil); err != nil {
+		return true, err.Error()
+	}
+	return false, ""
+}
+
 func (t *multiGrepTool) searchPattern(pattern, root, fileGlob string, limit int) (result grepPatternResult) {
 	defer func() {
 		if r := recover(); r != nil {
@@ -1283,6 +1298,7 @@ func (t *multiGrepTool) searchPattern(pattern, root, fileGlob string, limit int)
 	var matches []grepMatch
 	resultBytes := 0
 
+	var skipped []string
 	filepath.Walk(root, func(path string, info os.FileInfo, err error) error {
 		if err != nil || info == nil {
 			return nil
@@ -1294,12 +1310,22 @@ func (t *multiGrepTool) searchPattern(pattern, root, fileGlob string, limit int)
 			if skipDir(info.Name()) {
 				return filepath.SkipDir
 			}
+			// Security: classify each directory before descending.
+			if skip, reason := t.checkSearchPath(path); skip {
+				skipped = append(skipped, path+": "+reason)
+				return filepath.SkipDir
+			}
 			return nil
 		}
 		// Skip symlinks — prevents TOCTOU and listing unreadable files.
 		if info.Mode()&os.ModeSymlink != 0 {
 			return nil
 		}
+		// Security: classify each file before reading.
+		if skip, reason := t.checkSearchPath(path); skip {
+			skipped = append(skipped, path+": "+reason)
+			return nil
+		}
 		if fileGlob != "" {
 			match, _ := filepath.Match(fileGlob, info.Name())
 			if !match {
@@ -1352,6 +1378,7 @@ func (t *multiGrepTool) searchPattern(pattern, root, fileGlob string, limit int)
 		Pattern: pattern,
 		Matches: matches,
 		Count:   len(matches),
+		Skipped: skipped,
 	}
 }