fix: skip empty untrusted-content sources in audit aggregation

Self-review follow-up. When unwrapUntrusted/untrustedSource (singular, with an
`src != ""` call-site guard) were replaced by untrustedSourcesAll, the
empty-source filter was dropped. A wrapper with source="" (reachable when a
wrapUntrusted caller passes an empty source, e.g. a browser snapshot with an
empty URL) then entered untrustedSources. In the audit divergence check,
isSource() does strings.HasPrefix(resource, ""), which is always true, so a
single empty-source blob marked every resource as a "source", emptied
untrustedResSet, and silently suppressed reused-resource injection detection
for the whole turn — defeating the multi-blob hardening the change introduced.

Restore the empty-source skip in untrustedSourcesAll and add a regression test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: jkyberneees

cmd/odek/untrusted.go

@@ -219,7 +219,14 @@ func untrustedSourcesAll(s string) []string {
 	rep := strings.NewReplacer("'", `"`, "‹", "<", "›", ">")
 	srcs := make([]string, 0, len(matches))
 	for _, m := range matches {
-		srcs = append(srcs, rep.Replace(m[1]))
+		src := rep.Replace(m[1])
+		// Skip empty sources. An empty source would match every resource as a
+		// prefix in the audit divergence check (strings.HasPrefix(r, "")), which
+		// would blind the reused-resource injection heuristic for the whole turn.
+		if src == "" {
+			continue
+		}
+		srcs = append(srcs, src)
 	}
 	return srcs
 }

cmd/odek/untrusted_test.go

@@ -89,3 +89,28 @@ func TestWrapUntrusted_EmptyInputBypasses(t *testing.T) {
 		t.Errorf("wrapUntrusted(_, \"\") = %q, want \"\"", got)
 	}
 }
+
+// TestUntrustedSourcesAll_SkipsEmptySource verifies that a wrapper with an
+// empty source attribute does not contribute an empty string to the source
+// list. An empty source would match every resource via strings.HasPrefix(r, "")
+// in the audit divergence check, blinding the reused-resource heuristic.
+func TestUntrustedSourcesAll_SkipsEmptySource(t *testing.T) {
+	// A blob with no source, concatenated with a blob that has a real source.
+	combined := wrapUntrusted("", "anonymous body") + wrapUntrusted("https://evil.example/x", "named body")
+
+	srcs := untrustedSourcesAll(combined)
+	for _, s := range srcs {
+		if s == "" {
+			t.Fatalf("untrustedSourcesAll returned an empty source: %#v", srcs)
+		}
+	}
+	if len(srcs) != 1 || srcs[0] != "https://evil.example/x" {
+		t.Fatalf("untrustedSourcesAll = %#v, want exactly [https://evil.example/x]", srcs)
+	}
+
+	// Both bodies must still be aggregated (the empty-source blob is not dropped).
+	bodies := unwrapUntrustedAll(combined)
+	if len(bodies) != 2 {
+		t.Fatalf("unwrapUntrustedAll returned %d bodies, want 2: %#v", len(bodies), bodies)
+	}
+}