fix(security): close ~/.odek/ write carve-out privilege escalation (#30)

* fix(security): close ~/.odek/ write carve-out privilege escalation

A confined agent could rewrite its own trust anchors through the
auto-allowed LocalWrite path: confineToCWD carved out all of ~/.odek/,
and ~/.odek/config.json classified as LocalWrite — so a prompt-injected
sub-agent could disable the sandbox or enable YOLO mode for the next
run, or drop an auto-loaded SKILL.md. Shell rc files also fell through
to auto-allowed LocalWrite.

- ClassifyPath now escalates ~/.odek/config.json, ~/.odek/secrets.env,
  ~/.odek/skills/, and shell rc/profile files in $HOME to SystemWrite
  (prompt/deny). Crontab locations were already SystemWrite via the
  /etc, /var, /usr prefixes — locked in with tests.
- confineToCWD excludes those trust anchors from the ~/.odek/ carve-out
  (skills are legitimately written via skill_save/skill_patch, not the
  generic file tools).
- patch and batch_patch get the same restrictToCWD confinement
  write_file already had; both are now wired with it in builtinTools.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs(danger): update ClassifyPath doc comment with new classification rules

Axis 2.9 auto-remediation (vprotocol): the exported ClassifyPath function
gained new SystemWrite cases (odek trust anchors, shell rc files) but the
function-level comment still described only the old rules.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: jkyberneees

cmd/odek/file_tool.go

@@ -532,6 +532,7 @@ func (t *searchFilesTool) searchFiles(args searchFilesArgs) (string, error) {
 type patchTool struct {
 	dangerousConfig danger.DangerousConfig
 	trustedClasses  map[danger.RiskClass]bool
+	restrictToCWD   bool // when true, reject paths escaping the working directory
 }
 
 func (t *patchTool) Name() string { return "patch" }
@@ -592,6 +593,16 @@ func (t *patchTool) Call(argsJSON string) (string, error) {
 		return jsonError("old_string is required")
 	}
 
+	// Path confinement: same as write_file — reject paths that escape the
+	// working directory via ".." traversal or absolute paths.
+	if t.restrictToCWD {
+		resolved, err := confineToCWD(args.Path)
+		if err != nil {
+			return jsonError(err.Error())
+		}
+		args.Path = resolved
+	}
+
 	// Security: classify and check patch operation
 	risk := danger.ClassifyPath(args.Path)
 	if err := t.dangerousConfig.CheckOperation(danger.ToolOperation{
@@ -758,11 +769,20 @@ func confineToCWD(path string) (string, error) {
 	}
 
 	// Allow paths under ~/.odek/ even when outside CWD — the agent
-	// frequently writes skills, memory, and config to this directory.
+	// frequently writes memory and other state to this directory. The
+	// carve-out deliberately EXCLUDES odek's trust anchors (config.json,
+	// secrets.env, skills/): a confined agent that can rewrite its own
+	// config can disable the sandbox or enable YOLO mode on the next run,
+	// and a dropped SKILL.md is auto-loaded into future prompts. Skills
+	// are legitimately written through the dedicated skill_save/skill_patch
+	// tools, not the generic file tools.
 	home, homeErr := os.UserHomeDir()
 	if homeErr == nil {
 		odekPrefix := home + "/.odek/"
 		if strings.HasPrefix(abs, odekPrefix) {
+			if isProtectedOdekPath(strings.TrimPrefix(abs, odekPrefix)) {
+				return "", fmt.Errorf("path %q is a protected odek configuration path and cannot be written by file tools", path)
+			}
 			return abs, nil
 		}
 	}
@@ -775,6 +795,15 @@ func confineToCWD(path string) (string, error) {
 	return abs, nil
 }
 
+// isProtectedOdekPath reports whether rel (a path relative to ~/.odek/,
+// already cleaned by confineToCWD) names one of odek's trust anchors that
+// must not be writable through the generic file tools. Keep in sync with
+// the SystemWrite escalation in danger.ClassifyPath.
+func isProtectedOdekPath(rel string) bool {
+	return rel == "config.json" || rel == "secrets.env" ||
+		rel == "skills" || strings.HasPrefix(rel, "skills"+string(filepath.Separator))
+}
+
 func truncateDiff(s string, maxLen int) string {
 	// Take first line for diff display
 	firstLine := strings.SplitN(s, "\n", 2)[0]

cmd/odek/file_tool_test.go

@@ -770,20 +770,60 @@ func TestConfineToCWD_DoubleDotEscape(t *testing.T) {
 	}
 }
 
-// TestConfineToCWD_AllowsOdekDir verifies that paths under ~/.odek/
-// are allowed by confineToCWD even when they are outside the project
-// CWD. The agent frequently needs to write skills, memory, and config
-// to ~/.odek/ — blocking these forces wasteful shell workarounds.
+// TestConfineToCWD_AllowsOdekDir verifies that non-sensitive paths under
+// ~/.odek/ (memory, state) are allowed by confineToCWD even when they are
+// outside the project CWD — blocking these forces wasteful shell workarounds.
 func TestConfineToCWD_AllowsOdekDir(t *testing.T) {
 	home, err := os.UserHomeDir()
 	if err != nil {
 		t.Fatal(err)
 	}
-	odekPath := home + "/.odek/skills/test-skill/SKILL.md"
+	for _, p := range []string{
+		home + "/.odek/memory/episodes.json",
+		home + "/.odek/sessions/abc.json",
+		home + "/.odek/notes.md",
+	} {
+		if _, err := confineToCWD(p); err != nil {
+			t.Errorf("non-sensitive ~/.odek/ path %q should be allowed, got: %v", p, err)
+		}
+	}
+}
+
+// TestConfineToCWD_RejectsProtectedOdekPaths verifies that odek's trust
+// anchors are EXCLUDED from the ~/.odek/ carve-out. A confined agent that
+// can rewrite its own config.json can disable the sandbox or enable YOLO
+// mode on the next run; a dropped SKILL.md is auto-loaded into future
+// prompts; secrets.env is injected into the process environment. Skills
+// writes go through the dedicated skill_save/skill_patch tools instead.
+func TestConfineToCWD_RejectsProtectedOdekPaths(t *testing.T) {
+	home, err := os.UserHomeDir()
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, p := range []string{
+		home + "/.odek/config.json",
+		home + "/.odek/secrets.env",
+		home + "/.odek/skills/evil/SKILL.md",
+		home + "/.odek/skills",
+		// ".." traversal inside the carve-out must not reach the anchors
+		home + "/.odek/memory/../config.json",
+	} {
+		if _, err := confineToCWD(p); err == nil {
+			t.Errorf("protected odek path %q should be rejected by confineToCWD", p)
+		}
+	}
+}
 
-	_, err = confineToCWD(odekPath)
+// TestConfineToCWD_SkillsPrefixNotOverbroad verifies the skills/ exclusion
+// matches the directory itself, not sibling names sharing the prefix.
+func TestConfineToCWD_SkillsPrefixNotOverbroad(t *testing.T) {
+	home, err := os.UserHomeDir()
 	if err != nil {
-		t.Errorf("~/.odek/ paths should be allowed by confineToCWD, got: %v", err)
+		t.Fatal(err)
+	}
+	p := home + "/.odek/skills-backup/notes.md"
+	if _, err := confineToCWD(p); err != nil {
+		t.Errorf("%q is not under skills/ and should be allowed, got: %v", p, err)
 	}
 }
 
@@ -1059,6 +1099,81 @@ func TestWriteFile_PathConfinementAllow(t *testing.T) {
 	}
 }
 
+func TestPatch_PathConfinementReject(t *testing.T) {
+	tool := &patchTool{
+		restrictToCWD: true,
+	}
+	// ../ escape should be rejected before any classification or file I/O
+	result := callJSON(t, tool, `{"path":"../escape-test.txt","old_string":"a","new_string":"b"}`)
+	var r struct {
+		Error string `json:"error"`
+	}
+	mustUnmarshal(t, result, &r)
+	if r.Error == "" {
+		t.Fatal("expected error for path confinement violation")
+	}
+	if !strings.Contains(r.Error, "escapes the working directory") {
+		t.Errorf("error should mention escaping, got: %s", r.Error)
+	}
+}
+
+func TestPatch_PathConfinementAllow(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "patchme.txt")
+	if err := os.WriteFile(path, []byte("hello world"), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	origDir, _ := os.Getwd()
+	os.Chdir(dir)
+	defer os.Chdir(origDir)
+
+	tool := &patchTool{
+		restrictToCWD: true,
+	}
+	result := callJSON(t, tool, `{"path":"patchme.txt","old_string":"world","new_string":"there"}`)
+	var r struct {
+		Success bool   `json:"success"`
+		Error   string `json:"error,omitempty"`
+	}
+	mustUnmarshal(t, result, &r)
+	if !r.Success {
+		t.Fatalf("expected success, got error: %s", r.Error)
+	}
+
+	data, _ := os.ReadFile(path)
+	if string(data) != "hello there" {
+		t.Errorf("content = %q, want %q", string(data), "hello there")
+	}
+}
+
+// TestPatch_RejectsProtectedOdekPaths verifies the patch tool cannot edit
+// odek's trust anchors through the ~/.odek/ carve-out — closing the
+// escalation where a confined agent patches its own config.json to
+// disable the sandbox on the next run.
+func TestPatch_RejectsProtectedOdekPaths(t *testing.T) {
+	home, err := os.UserHomeDir()
+	if err != nil {
+		t.Skip("no home dir")
+	}
+	tool := &patchTool{
+		restrictToCWD: true,
+	}
+	for _, p := range []string{
+		home + "/.odek/config.json",
+		home + "/.odek/skills/x/SKILL.md",
+	} {
+		result := callJSON(t, tool, `{"path":"`+p+`","old_string":"a","new_string":"b"}`)
+		var r struct {
+			Error string `json:"error"`
+		}
+		mustUnmarshal(t, result, &r)
+		if r.Error == "" {
+			t.Errorf("patch to %q should be rejected", p)
+		}
+	}
+}
+
 func TestWriteFile_SecurityDenied(t *testing.T) {
 	// Test that a deny configuration blocks the write
 	action := "deny"

cmd/odek/main.go

@@ -1137,11 +1137,11 @@ func builtinTools(dc danger.DangerousConfig, sm *skills.SkillManager, approver d
 		&readFileTool{dangerousConfig: dc},
 		&writeFileTool{dangerousConfig: dc, restrictToCWD: true},
 		&searchFilesTool{dangerousConfig: dc},
-		&patchTool{dangerousConfig: dc},
+		&patchTool{dangerousConfig: dc, restrictToCWD: true},
 		&batchReadTool{dangerousConfig: dc},
 		&globTool{dangerousConfig: dc},
 		&fileInfoTool{dangerousConfig: dc},
-		&batchPatchTool{dangerousConfig: dc},
+		&batchPatchTool{dangerousConfig: dc, restrictToCWD: true},
 		&parallelShellTool{dangerousConfig: dc, approver: approver},
 		newHTTPBatchTool(dc),
 		&mathEvalTool{},

cmd/odek/perf_tools.go

@@ -47,6 +47,7 @@ const maxBatchPatches = 10
 
 type batchPatchTool struct {
 	dangerousConfig danger.DangerousConfig
+	restrictToCWD   bool // when true, reject paths escaping the working directory
 }
 
 func (t *batchPatchTool) Name() string { return "batch_patch" }
@@ -129,6 +130,19 @@ func (t *batchPatchTool) Call(argsJSON string) (result string, err error) {
 			continue
 		}
 
+		// Path confinement: same as write_file/patch — reject paths that
+		// escape the working directory.
+		if t.restrictToCWD {
+			resolved, err := confineToCWD(p.Path)
+			if err != nil {
+				entry.Error = err.Error()
+				results[idx] = entry
+				continue
+			}
+			p.Path = resolved
+			entry.Path = resolved
+		}
+
 		if err := t.dangerousConfig.CheckOperation(danger.ToolOperation{
 			Name: "batch_patch", Resource: p.Path, Risk: danger.ClassifyPath(p.Path),
 		}, nil); err != nil {

cmd/odek/perf_tools_test.go

@@ -44,6 +44,50 @@ func TestBatchPatch_Basic(t *testing.T) {
 	}
 }
 
+// TestBatchPatch_PathConfinement verifies batch_patch enforces the same
+// restrictToCWD confinement as write_file/patch: escapes are rejected
+// per-entry, and odek's trust anchors are excluded from the ~/.odek/
+// carve-out.
+func TestBatchPatch_PathConfinement(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "ok.txt")
+	os.WriteFile(path, []byte("hello world\n"), 0644)
+
+	origDir, _ := os.Getwd()
+	os.Chdir(dir)
+	defer os.Chdir(origDir)
+
+	home, _ := os.UserHomeDir()
+	tool := &batchPatchTool{restrictToCWD: true}
+	args := fmt.Sprintf(`{"patches":[
+		{"path":"ok.txt","old_string":"world","new_string":"there"},
+		{"path":"../escape.txt","old_string":"a","new_string":"b"},
+		{"path":"%s/.odek/config.json","old_string":"a","new_string":"b"}
+	]}`, home)
+	result := callJSON(t, tool, args)
+
+	var r struct {
+		Results []struct {
+			Success bool   `json:"success"`
+			Error   string `json:"error"`
+		} `json:"results"`
+	}
+	mustUnmarshal(t, result, &r)
+
+	if len(r.Results) != 3 {
+		t.Fatalf("Results = %d, want 3", len(r.Results))
+	}
+	if !r.Results[0].Success {
+		t.Errorf("in-CWD patch should succeed: %s", r.Results[0].Error)
+	}
+	if r.Results[1].Success || !strings.Contains(r.Results[1].Error, "escapes the working directory") {
+		t.Errorf("escape should be rejected, got success=%v err=%q", r.Results[1].Success, r.Results[1].Error)
+	}
+	if r.Results[2].Success || r.Results[2].Error == "" {
+		t.Errorf("~/.odek/config.json should be rejected, got success=%v err=%q", r.Results[2].Success, r.Results[2].Error)
+	}
+}
+
 func TestBatchPatch_MultipleFiles(t *testing.T) {
 	dir := t.TempDir()
 	path1 := filepath.Join(dir, "a.txt")

internal/danger/classifier.go

@@ -136,8 +136,18 @@ type ToolOperation struct {
 // ── Path-based classification ──────────────────────────────────────────
 
 // ClassifyPath returns a RiskClass for a filesystem path.
-// /tmp/*, working directory → local_write; /etc/*, /root/* → system_write;
-// /boot/*, /dev/*, /sys/* → destructive; home sensitive dirs → system_write.
+//
+// Classification rules (highest wins):
+//   - /boot, /dev, /proc, /sys, /mnt, /media → destructive
+//   - /tmp, $TMPDIR → local_write
+//   - /etc, /root, /var, /run, /lib, /usr → system_write
+//   - $HOME/.ssh, .config, .gnupg, .aws, .kube, .docker, .gitconfig, .env → system_write
+//   - $HOME/.odek/config.json, secrets.env, skills/ → system_write (odek trust anchors;
+//     rewriting them can disable the sandbox or inject prompts on the next run)
+//   - $HOME shell rc/profile files (.bashrc, .zshrc, .profile, .zshenv, etc.) → system_write
+//   - everything else → local_write
+//
+// macOS: /private/{etc,var,tmp} are transparently normalised before matching.
 func ClassifyPath(path string) RiskClass {
 	abs, err := filepath.Abs(path)
 	if err != nil {
@@ -182,10 +192,40 @@ func ClassifyPath(path string) RiskClass {
 				return SystemWrite
 			}
 		}
+		// odek's own trust anchors. Rewriting ~/.odek/config.json can disable
+		// the sandbox or set "action": "allow" (YOLO) for the next run; a
+		// SKILL.md dropped under ~/.odek/skills/ is auto-loaded into future
+		// prompts; secrets.env is injected into the process environment.
+		// Auto-allowing these as LocalWrite would let a confined agent
+		// escalate out of its own sandbox, so they classify as SystemWrite
+		// (prompt/deny). Keep in sync with the carve-out exclusions in
+		// cmd/odek/file_tool.go (isProtectedOdekPath).
+		for _, sub := range []string{"/.odek/config.json", "/.odek/secrets.env", "/.odek/skills"} {
+			if strings.HasPrefix(abs, home+sub) {
+				return SystemWrite
+			}
+		}
+		// Shell rc/profile files execute on the user's next shell start —
+		// writing them is persistence/escalation, not a local file edit.
+		if filepath.Dir(abs) == home && shellRCFiles[filepath.Base(abs)] {
+			return SystemWrite
+		}
 	}
 	return LocalWrite
 }
 
+// shellRCFiles are dotfiles in $HOME that shells execute automatically on
+// startup/login. Writing any of them is code execution on the next shell,
+// so ClassifyPath escalates them to SystemWrite. Fish/nushell configs live
+// under ~/.config, which is already covered by the home-sensitive-dir list.
+var shellRCFiles = map[string]bool{
+	".bashrc": true, ".bash_profile": true, ".bash_login": true,
+	".bash_logout": true, ".bash_aliases": true, ".profile": true,
+	".zshrc": true, ".zprofile": true, ".zshenv": true, ".zlogin": true,
+	".zlogout": true, ".kshrc": true, ".cshrc": true, ".tcshrc": true,
+	".login": true, ".logout": true,
+}
+
 // ClassifyURL returns a RiskClass for a browser URL.
 // Internal IPs → system_write; external → network_egress.
 // Uses proper IP parsing (handles decimal, octal, hex, IPv6 compressed,