fix: wrap tree paths, cap head_tail/AGENTS/IDENTITY, harden search_files symlinks

Author: jkyberneees

AGENTS.md

@@ -91,7 +91,7 @@ System prompt is loaded by priority: `--system` flag > `~/.odek/IDENTITY.md` > c
 ### Security Architecture
 Layered prompt-injection / approval-fatigue defenses. Full reference: [docs/SECURITY.md](docs/SECURITY.md).
 
-- **Untrusted-content wrapper** (`cmd/odek/untrusted.go`) — every tool whose output sources from outside the trust boundary (`browser`, `read_file`, `shell`, `search_files`, `multi_grep`, `transcribe`, `head_tail`, `diff`, `tr`, `sort`, `json_query`, `batch_patch`, `glob`, `file_info`, `session_search`, `@-resources`, `--ctx` files, any MCP tool) wraps results in `<untrusted_content_<nonce> source="...">…</untrusted_content_<nonce>>`. Per-call nonce defeats wrapper-escape via literal close tag.
+- **Untrusted-content wrapper** (`cmd/odek/untrusted.go`) — every tool whose output sources from outside the trust boundary (`browser`, `read_file`, `shell`, `search_files`, `multi_grep`, `transcribe`, `head_tail`, `diff`, `tr`, `sort`, `json_query`, `batch_patch`, `glob`, `file_info`, `tree`, `session_search`, `@-resources`, `--ctx` files, any MCP tool) wraps results in `<untrusted_content_<nonce> source="...">…</untrusted_content_<nonce>>`. Per-call nonce defeats wrapper-escape via literal close tag.
 - **Audit log** (`cmd/odek/audit.go` + `internal/session/audit.go`) — every `wrapUntrusted` call records source + content-hash + turn into `<sessions>/audit/<id>.json`. After each turn a divergence heuristic flags `suspicious_divergence=true` when the agent ingested untrusted content AND its tool calls referenced resources the user did not mention. Inspect with `odek audit <session-id>` / `odek audit --list`.
 - **Memory taint** (`internal/memory/provenance.go`) — `EpisodeProvenance` tracks Untrusted/Sources/UserApproved. Tainted episodes are stored but `Search()` filters them out, so a one-shot injection cannot persist via the episode pipeline. User must explicitly promote.
 - **Skill provenance gate** (`internal/skills/loader.go` + `cache.go`) — `Skill.Provenance{Untrusted, Sources, NeedsReview}`. NeedsReview skills pin to Lazy regardless of `auto_load`. `odek skill promote <name>` clears the flag after user review.
@@ -115,6 +115,11 @@ Layered prompt-injection / approval-fatigue defenses. Full reference: [docs/SECU
 - **@-resource / --ctx prompt wrapping** (`cmd/odek/refs.go`, `cmd/odek/serve.go`) — content resolved from `@file` references and `--ctx` files is wrapped as untrusted before being inserted into the prompt.
 - **Resource resolver size cap** (`internal/resource/resource.go`) — `@-resource` file loads are capped at 1 MiB to prevent OOM from `@hugefile` references.
 - **Sub-agent summary cap** (`cmd/odek/subagent_tool.go`) — each sub-agent result included in the `delegate_tasks` summary is truncated to 100 KiB to prevent memory DoS.
+- **Tree path wrapping** (`cmd/odek/perf_tools.go`) — the `tree` tool wraps every filesystem-derived path as untrusted content.
+- **head_tail output cap** (`cmd/odek/perf_tools.go`) — `head_tail` truncates returned lines so total content stays within 1 MiB, preventing multi-file/multi-line memory DoS.
+- **search_files symlink hardening** (`cmd/odek/file_tool.go`) — the `files` target uses `Lstat` (not `Stat`) and skips symlinks in the glob branch, closing metadata disclosure via symlinked paths.
+- **AGENTS.md size cap** (`odek.go`) — project-level `AGENTS.md` is ignored if larger than 256 KiB to prevent OOM/prompt stuffing from a malicious repo.
+- **IDENTITY.md size cap** (`cmd/odek/main.go`) — `~/.odek/IDENTITY.md` is ignored if larger than 256 KiB, falling back to the default identity.
 - **patch / batch_patch output expansion cap** (`cmd/odek/file_tool.go`, `cmd/odek/perf_tools.go`) — the post-replacement result is capped at 10 MiB so `ReplaceAll` cannot explode memory.
 - **write_file content cap** (`cmd/odek/file_tool.go`) — the `content` argument is capped at 1 MiB to prevent disk exhaustion and memory pressure from a single enormous tool call.
 - **file_info confinement + wrapping** (`cmd/odek/file_tool.go`) — `file_info` respects the same `restrictToCWD` path confinement as `write_file`/`patch`, and the returned path is wrapped as untrusted content.

cmd/odek/file_tool.go

@@ -522,12 +522,18 @@ func (t *searchFilesTool) searchFiles(args searchFilesArgs) (string, error) {
 			return jsonError(fmt.Sprintf("invalid glob %q: %v", pattern, err))
 		}
 		for _, p := range globMatches {
-			info, err := os.Stat(p)
-			if err == nil && !info.IsDir() {
-				matches = append(matches, searchMatch{Path: p})
-				if len(matches) >= limit {
-					break
-				}
+			// Lstat so symlinks are not followed to their targets for metadata.
+			info, err := os.Lstat(p)
+			if err != nil {
+				continue
+			}
+			// Skip directories and symlinks — same policy as the walk branch.
+			if info.IsDir() || info.Mode()&os.ModeSymlink != 0 {
+				continue
+			}
+			matches = append(matches, searchMatch{Path: wrapUntrusted("search_files:"+p, p)})
+			if len(matches) >= limit {
+				break
 			}
 		}
 	} else {
@@ -551,7 +557,7 @@ func (t *searchFilesTool) searchFiles(args searchFilesArgs) (string, error) {
 			}
 			match, _ := filepath.Match(pattern, info.Name())
 			if match {
-				matches = append(matches, searchMatch{Path: path})
+				matches = append(matches, searchMatch{Path: wrapUntrusted("search_files:"+path, path)})
 				if len(matches) >= limit {
 					return filepath.SkipAll
 				}
@@ -560,12 +566,13 @@ func (t *searchFilesTool) searchFiles(args searchFilesArgs) (string, error) {
 		})
 	}
 
-	// Sort by modification time (newest first)
+	// Sort by modification time (newest first). Use Lstat so symlinks are not
+	// followed and their own metadata is used for sorting.
 	sort.Slice(matches, func(i, j int) bool {
-		fi, _ := os.Stat(matches[i].Path)
-		fj, _ := os.Stat(matches[j].Path)
+		fi, _ := os.Lstat(unwrapUntrusted(matches[i].Path))
+		fj, _ := os.Lstat(unwrapUntrusted(matches[j].Path))
 		if fi == nil || fj == nil {
-			return matches[i].Path < matches[j].Path
+			return unwrapUntrusted(matches[i].Path) < unwrapUntrusted(matches[j].Path)
 		}
 		return fi.ModTime().After(fj.ModTime())
 	})

cmd/odek/file_tool_test.go

@@ -402,7 +402,7 @@ func TestSearchFiles_FindByName(t *testing.T) {
 	}
 
 	for _, m := range r.Matches {
-		name := filepath.Base(m.Path)
+		name := filepath.Base(unwrapUntrusted(m.Path))
 		if name != "main.go" && name != "main_test.go" {
 			t.Errorf("unexpected match: %s", name)
 		}
@@ -939,8 +939,9 @@ func TestSearchFiles_GlobWithPathSeparator(t *testing.T) {
 	if len(r.Matches) != 1 {
 		t.Fatalf("expected 1 match for 'subdir/*.txt', got %d", len(r.Matches))
 	}
-	if !strings.HasSuffix(r.Matches[0].Path, "subdir/result.txt") && !strings.HasSuffix(r.Matches[0].Path, "subdir\\result.txt") {
-		t.Errorf("unexpected match path: %s", r.Matches[0].Path)
+	p := unwrapUntrusted(r.Matches[0].Path)
+	if !strings.HasSuffix(p, "subdir/result.txt") && !strings.HasSuffix(p, "subdir\\result.txt") {
+		t.Errorf("unexpected match path: %s", p)
 	}
 }
 
@@ -1491,8 +1492,8 @@ func TestSearchFiles_FilesTargetWithPathSeparator(t *testing.T) {
 	if len(r.Matches) != 1 {
 		t.Fatalf("expected 1 match for 'sub/*.txt', got %d", len(r.Matches))
 	}
-	if !strings.Contains(r.Matches[0].Path, "nested.txt") {
-		t.Errorf("expected nested.txt match, got: %s", r.Matches[0].Path)
+	if !strings.Contains(unwrapUntrusted(r.Matches[0].Path), "nested.txt") {
+		t.Errorf("expected nested.txt match, got: %s", unwrapUntrusted(r.Matches[0].Path))
 	}
 }
 
@@ -1512,8 +1513,8 @@ func TestSearchFiles_FilesTargetHiddenDirSkipped(t *testing.T) {
 	}
 	mustUnmarshal(t, result, &r)
 	for _, m := range r.Matches {
-		if strings.Contains(m.Path, ".hidden") {
-			t.Errorf("should not include hidden dir contents: %s", m.Path)
+		if strings.Contains(unwrapUntrusted(m.Path), ".hidden") {
+			t.Errorf("should not include hidden dir contents: %s", unwrapUntrusted(m.Path))
 		}
 	}
 	if len(r.Matches) != 1 {

cmd/odek/main.go

@@ -158,6 +158,11 @@ func buildSystemPrompt(resolved config.ResolvedConfig) string {
 	return base
 }
 
+// maxIdentityFileBytes caps the size of ~/.odek/IDENTITY.md that will be
+// loaded into the system prompt. A tampered or corrupted identity file could
+// otherwise OOM the process or stuff every prompt.
+const maxIdentityFileBytes = 256 * 1024 // 256 KiB
+
 // loadIdentityFile reads ~/.odek/IDENTITY.md and returns its content.
 // Returns defaultSystem if the file does not exist or cannot be read.
 func loadIdentityFile() string {
@@ -166,6 +171,14 @@ func loadIdentityFile() string {
 		return defaultSystem
 	}
 	path := filepath.Join(home, ".odek", "IDENTITY.md")
+	info, err := os.Stat(path)
+	if err != nil {
+		return defaultSystem
+	}
+	if info.Size() > maxIdentityFileBytes {
+		fmt.Fprintf(os.Stderr, "odek: warning: IDENTITY.md is too large (%d bytes, max %d) — using default identity\n", info.Size(), maxIdentityFileBytes)
+		return defaultSystem
+	}
 	data, err := os.ReadFile(path)
 	if err != nil {
 		return defaultSystem

cmd/odek/next_security_vulnerabilities_test.go

@@ -900,3 +900,117 @@ func TestSkillLoader_CapsFileSize(t *testing.T) {
 		t.Fatalf("skill loader should reject a huge SKILL.md, got %d skills", len(result.AutoLoad)+len(result.Lazy))
 	}
 }
+
+// ── 25. tree must wrap filesystem-derived paths as untrusted ──────────────
+
+func TestTree_WrapsPaths(t *testing.T) {
+	dir := t.TempDir()
+	os.WriteFile(filepath.Join(dir, "note.txt"), []byte("hello"), 0644)
+
+	tool := &treeTool{dangerousConfig: danger.DangerousConfig{}}
+	result := callJSON(t, tool, fmt.Sprintf(`{"path":%q,"max_depth":1}`, dir))
+	var r struct {
+		Tree struct {
+			Path     string `json:"path"`
+			Children []struct {
+				Path string `json:"path"`
+			} `json:"children"`
+		} `json:"tree"`
+		Error string `json:"error,omitempty"`
+	}
+	mustUnmarshal(t, result, &r)
+	if r.Error != "" {
+		t.Fatalf("tree error: %s", r.Error)
+	}
+	if !strings.HasPrefix(r.Tree.Path, "<untrusted_content_") {
+		t.Fatalf("tree root path should be wrapped, got: %q", r.Tree.Path)
+	}
+	if len(r.Tree.Children) == 0 {
+		t.Fatal("expected at least one child")
+	}
+	if !strings.HasPrefix(r.Tree.Children[0].Path, "<untrusted_content_") {
+		t.Fatalf("tree child path should be wrapped, got: %q", r.Tree.Children[0].Path)
+	}
+}
+
+// ── 26. head_tail must cap total output size ──────────────────────────────
+
+func TestHeadTail_CapsOutputSize(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "biglines.txt")
+	// 10 lines of 200 KB => 2 MB of content, exceeding the 1 MiB cap.
+	var lines []string
+	for i := 0; i < 10; i++ {
+		lines = append(lines, fmt.Sprintf("line-%d-%s", i, strings.Repeat("x", 200*1024)))
+	}
+	os.WriteFile(path, []byte(strings.Join(lines, "\n")), 0644)
+
+	tool := &headTailTool{dangerousConfig: danger.DangerousConfig{}}
+	result := callJSON(t, tool, fmt.Sprintf(`{"files":[{"path":%q}],"lines":100}`, path))
+	var r struct {
+		Results []struct {
+			Lines []string `json:"lines"`
+			Total int      `json:"total"`
+		} `json:"results"`
+	}
+	mustUnmarshal(t, result, &r)
+	if len(r.Results) != 1 {
+		t.Fatalf("expected 1 result, got %d", len(r.Results))
+	}
+
+	total := 0
+	for _, line := range r.Results[0].Lines {
+		total += len(unwrapUntrusted(line))
+	}
+	if total > maxHeadTailTotalBytes+200 {
+		t.Fatalf("head_tail returned %d bytes of content, expected cap near %d", total, maxHeadTailTotalBytes)
+	}
+}
+
+// ── 27. search_files target=files must not follow symlinks for metadata ───
+
+func TestSearchFiles_TargetFiles_NoSymlinkFollow(t *testing.T) {
+	dir := t.TempDir()
+	sub := filepath.Join(dir, "sub")
+	os.MkdirAll(sub, 0755)
+	// Regular file
+	os.WriteFile(filepath.Join(sub, "real.txt"), []byte("hello"), 0644)
+	// Symlink to a non-existent target — old os.Stat would skip it; Lstat lets us detect and skip it ourselves.
+	os.Symlink("/nonexistent/odek-test", filepath.Join(sub, "link.txt"))
+
+	tool := &searchFilesTool{dangerousConfig: danger.DangerousConfig{}}
+	// Pattern with a separator forces the filepath.Glob branch.
+	result := callJSON(t, tool, fmt.Sprintf(`{"pattern":"**/*.txt","path":%q,"target":"files"}`, dir))
+	var r struct {
+		Matches []struct {
+			Path string `json:"path"`
+		} `json:"matches"`
+	}
+	mustUnmarshal(t, result, &r)
+	if len(r.Matches) != 1 {
+		t.Fatalf("expected 1 regular file match, got %d", len(r.Matches))
+	}
+	if !strings.Contains(r.Matches[0].Path, "real.txt") {
+		t.Fatalf("expected real.txt match, got: %q", r.Matches[0].Path)
+	}
+	if !strings.HasPrefix(r.Matches[0].Path, "<untrusted_content_") {
+		t.Fatalf("search_files file path should be wrapped, got: %q", r.Matches[0].Path)
+	}
+}
+
+// ── 28. IDENTITY.md must be size-capped ───────────────────────────────────
+
+func TestIdentityFile_CapsSize(t *testing.T) {
+	t.Setenv("HOME", t.TempDir())
+	home, _ := os.UserHomeDir()
+	identityPath := filepath.Join(home, ".odek", "IDENTITY.md")
+	if err := os.MkdirAll(filepath.Dir(identityPath), 0755); err != nil {
+		t.Fatal(err)
+	}
+	os.WriteFile(identityPath, []byte(strings.Repeat("x", maxIdentityFileBytes+1)), 0644)
+
+	got := loadIdentityFile()
+	if got != defaultSystem {
+		t.Fatalf("loadIdentityFile should fall back to defaultSystem for a huge IDENTITY.md, got length %d", len(got))
+	}
+}

cmd/odek/perf_tools.go

@@ -1513,7 +1513,7 @@ func (t *treeTool) Call(argsJSON string) (result string, err error) {
 func buildTree(root, path string, depth, maxDepth int, includeHidden bool) (treeEntry, error) {
 	info, err := os.Lstat(path)
 	if err != nil {
-		return treeEntry{Path: path, ErrMsg: err.Error()}, nil
+		return treeEntry{Path: wrapUntrusted("tree:"+root, path), ErrMsg: err.Error()}, nil
 	}
 
 	entry := treeEntry{
@@ -1526,6 +1526,10 @@ func buildTree(root, path string, depth, maxDepth int, includeHidden bool) (tree
 		entry.Path = path
 	}
 
+	// Tree paths come from the filesystem trust boundary, so mark them as
+	// untrusted before returning them to the model.
+	entry.Path = wrapUntrusted("tree:"+root, entry.Path)
+
 	if !info.IsDir() || depth >= maxDepth {
 		if !info.IsDir() {
 			entry.FileCount = 1
@@ -1880,6 +1884,11 @@ func (t *sortTool) Call(argsJSON string) (result string, err error) {
 // 12. head_tail — Quick file preview (first/last N lines)
 // ═════════════════════════════════════════════════════════════════════════
 
+// maxHeadTailTotalBytes caps the total content returned by head_tail across
+// all requested files. Without this, 10 files × 100 lines × 1 MiB lines can
+// allocate roughly 1 GB in a single tool call.
+const maxHeadTailTotalBytes = maxReadBytes // 1 MiB
+
 type headTailTool struct {
 	dangerousConfig danger.DangerousConfig
 }
@@ -1988,14 +1997,19 @@ func (t *headTailTool) readPreview(path string, n int, mode string) (result head
 func (t *headTailTool) readHead(f *os.File, path string, n int) headTailFileResult {
 	scanner := bufio.NewScanner(f)
 	scanner.Buffer(make([]byte, 1024*1024), 1024*1024)
-	var lines []string
+	var rawLines []string
 	total := 0
 	for scanner.Scan() {
 		total++
-		if len(lines) < n {
-			lines = append(lines, wrapUntrusted(path, scanner.Text()))
+		if len(rawLines) < n {
+			rawLines = append(rawLines, scanner.Text())
 		}
 	}
+	rawLines = truncateHeadTailLines(rawLines)
+	lines := make([]string, len(rawLines))
+	for i, l := range rawLines {
+		lines[i] = wrapUntrusted(path, l)
+	}
 	return headTailFileResult{Path: path, Lines: lines, Count: len(lines), Total: total}
 }
 
@@ -2012,17 +2026,39 @@ func (t *headTailTool) readTail(f *os.File, path string, n int) headTailFileResu
 		total++
 	}
 	// Extract in correct order
-	var lines []string
+	var rawLines []string
 	start := 0
 	if written >= n {
 		start = written % n
 	}
 	for i := 0; i < n && i < written; i++ {
-		lines = append(lines, wrapUntrusted(path, buf[(start+i)%n]))
+		rawLines = append(rawLines, buf[(start+i)%n])
+	}
+	rawLines = truncateHeadTailLines(rawLines)
+	lines := make([]string, len(rawLines))
+	for i, l := range rawLines {
+		lines[i] = wrapUntrusted(path, l)
 	}
 	return headTailFileResult{Path: path, Lines: lines, Count: len(lines), Total: total}
 }
 
+// truncateHeadTailLines truncates a slice of raw lines so the total byte
+// count stays within maxHeadTailTotalBytes. It preserves leading lines and
+// appends a marker when truncation occurs.
+func truncateHeadTailLines(lines []string) []string {
+	total := 0
+	for i, l := range lines {
+		if total+len(l) > maxHeadTailTotalBytes {
+			if i == 0 {
+				return []string{"... [truncated]"}
+			}
+			return append(lines[:i], "... [truncated]")
+		}
+		total += len(l)
+	}
+	return lines
+}
+
 // ═════════════════════════════════════════════════════════════════════════
 // 13. base64 — Encode/decode base64
 // ═════════════════════════════════════════════════════════════════════════

docs/SECURITY.md

@@ -62,6 +62,7 @@ Tools that wrap:
 | `web_search` | `web_search:<query>` (results + answers from SearXNG) |
 | `session_search` | `session_search` (whole result — past sessions may be tainted) |
 | `file_info` | `file_info:<path>` (metadata about an external file) |
+| `tree` | `tree:<root>` (directory/file names from the filesystem) |
 | any MCP tool | `mcp:<server>:<tool>` |
 
 `session_search` is wrapped because it can surface content from arbitrary past sessions — including sessions that ingested untrusted content. Wrapping its whole output keeps that content from re-entering as trusted instructions and records the retrieval in the audit log, closing a path that otherwise bypassed the memory taint gate (defense 5).

odek.go

@@ -298,6 +298,11 @@ func ProfileLabel(model string) string {
 // that odek automatically loads from the working directory.
 const ProjectFileName = "AGENTS.md"
 
+// maxProjectFileBytes caps the size of AGENTS.md that will be loaded into the
+// system prompt. A maliciously huge project file could otherwise OOM the
+// process at startup or bloat every prompt.
+const maxProjectFileBytes = 256 * 1024 // 256 KiB
+
 // LoadProjectFile reads ProjectFileName from the current working directory.
 // Returns the file content (trimmed) if it exists and is readable.
 // Returns empty string if the file doesn't exist or can't be read.
@@ -315,6 +320,10 @@ func LoadProjectFile() string {
 		fmt.Fprintf(os.Stderr, "odek: warning: %s is a symlink — refusing to follow for security\n", ProjectFileName)
 		return ""
 	}
+	if info.Size() > maxProjectFileBytes {
+		fmt.Fprintf(os.Stderr, "odek: warning: %s is too large (%d bytes, max %d) — ignoring\n", ProjectFileName, info.Size(), maxProjectFileBytes)
+		return ""
+	}
 	data, err := os.ReadFile(ProjectFileName)
 	if err != nil {
 		return ""