fix(search): classify each discovered path in search_files and multi_grep (H-4, H-5) (#52)

* fix(search): classify each discovered path in search_files and multi_grep

H-4: search_files and multi_grep previously only classified the root path,
then walked and read every matching file. Add checkSearchPath helpers that
classify each descended directory and each file the same way the root path is
checked; sensitive paths are skipped and reported in a new Skipped field
rather than returned silently.

H-5: add regression tests for case-insensitive ~/.odek trust-anchor matching
(macOS APFS) and shell rc files.

- file_tool.go: wire checkSearchPath into searchContent and searchFiles;
  return Skipped in searchFilesResult.
- perf_tools.go: add multiGrepTool.checkSearchPath; guard multi_grep walker;
  return Skipped in grepPatternResult.
- file_tool_test.go / perf_tools_test.go / classifier_test.go: regression
  tests for skipped sensitive paths and case-insensitive anchors.

* docs: document per-path search classification and case-insensitive anchors

- AGENTS.md: add Search path classification bullet and note case-insensitive
  ~/.odek trust-anchor matching.
- docs/SECURITY.md: add 3c subsection describing search_files/multi_grep
  per-path classification and the skipped field.
- docs/CHEATSHEET.md: note that search_files/multi_grep report skipped
  sensitive paths.

Author: jkyberneees

AGENTS.md

@@ -119,6 +119,7 @@ Layered prompt-injection / approval-fatigue defenses. Full reference: [docs/SECU
 - **REST API CSRF protection** (`cmd/odek/serve.go::requireLocalOrigin`) — state-changing HTTP endpoints (POST/PUT/PATCH/DELETE) require a localhost origin or no Origin header, and static responses set `X-Frame-Options: DENY` + `Content-Security-Policy: frame-ancestors 'none'` to block clickjacking.
 - **Browser history cap** (`cmd/odek/browser_tool.go`) — navigation history is capped at 50 snapshots to prevent memory DoS from repeated `browser_navigate` calls.
 - **Browser element cap** (`cmd/odek/browser_tool.go`) — the number of interactive elements extracted per page is capped at 500 so a hostile page cannot OOM the agent with thousands of links or buttons.
+- **Search path classification** (`cmd/odek/file_tool.go`, `cmd/odek/perf_tools.go`) — `search_files` and `multi_grep` classify every descended directory and every discovered file the same way the search root is classified. Sensitive paths that would require approval (or are denied) are skipped and reported in the `skipped` field rather than returned silently, closing the gap where a broad search root auto-approved sensitive files.
 - **Search result bounds** (`cmd/odek/file_tool.go`, `cmd/odek/perf_tools.go`) — `search_files` and `multi_grep` enforce a max match limit (500) and a total returned-content cap (1 MiB) to avoid unbounded result JSON.
 - **Perf-tool file-size cap** (`cmd/odek/perf_tools.go`) — `diff`, `base64`, `tr`, `sort`, `json_query`, and `batch_patch` reject files larger than 10 MiB to avoid loading multi-gigabyte files into memory.
 - **Shell output cap** (`cmd/odek/shell.go`, `cmd/odek/perf_tools.go`) — `shell` and `parallel_shell` cap captured stdout/stderr at 1 MiB per stream to prevent memory DoS from commands that dump huge files.
@@ -158,7 +159,7 @@ Layered prompt-injection / approval-fatigue defenses. Full reference: [docs/SECU
 - **Schedule cross-process lock hard error** (`internal/schedule/store.go`) — `fileLock` now returns an error instead of silently falling back to a no-op releaser when `~/.odek/schedules.lock` cannot be opened or locked. Mutating schedule operations abort rather than risk two concurrent processes loading the same baseline and overwriting each other.
 - **Schedule JSON file-size cap** (`internal/schedule/store.go`) — `schedules.json` and `schedule-state.json` are rejected if larger than 10 MiB before being read into memory, preventing a tampered multi-gigabyte file from OOMing the scheduler.
 - **Default non-interactive policy is deny** (`internal/danger/classifier.go`, `cmd/odek/main.go`) — headless/CI/piped runs no longer auto-approve dangerous operations. Operators must explicitly set `non_interactive: "allow"` for unattended execution.
-- **`~/.odek` trust-anchor protection** (`internal/danger/classifier.go`, `cmd/odek/file_tool.go`) — generic file tools reject writes to `~/.odek/config.json`, `secrets.env`, `IDENTITY.md`, `skills/`, `sessions/`, `audit/`, `plans/`, `schedules.json`, `schedule-state.json`, `mcp_approvals.json`, `mcp_tool_approvals.json`, `restart.json`, `telegram.lock`, and related state files. These paths classify as `system_write` and must be modified through their dedicated subsystems. Shell reads of these trust anchors are also escalated to `system_write`.
+- **`~/.odek` trust-anchor protection** (`internal/danger/classifier.go`, `cmd/odek/file_tool.go`) — generic file tools reject writes to `~/.odek/config.json`, `secrets.env`, `IDENTITY.md`, `skills/`, `sessions/`, `audit/`, `plans/`, `schedules.json`, `schedule-state.json`, `mcp_approvals.json`, `mcp_tool_approvals.json`, `restart.json`, `telegram.lock`, and related state files. These paths classify as `system_write` and must be modified through their dedicated subsystems. Matching is case-insensitive so variants such as `CONFIG.JSON` or `SECRETS.ENV` are also blocked on case-insensitive filesystems (e.g. macOS APFS). Shell reads of these trust anchors are also escalated to `system_write`.
 - **Nonce'd tool-result delimiter** (`internal/loop/loop.go`) — the static `┌── TOOL RESULT: ... └── END TOOL RESULT: ...` delimiter is now unique per tool call via a random hex nonce embedded in both the opening and closing lines. A tool or MCP server can no longer forge the closing delimiter to break out of the data framing and inject instructions.
 - **`parallel_shell` context + process-group kill** (`cmd/odek/perf_tools.go`) — commands now run via `exec.CommandContext` bound to the agent context, in their own process group. Cancellation or timeout kills the whole group (negative PID), so `sh -c 'sleep 3600 &'` cannot leave orphaned children. Per-command timeouts are also capped at 30 minutes.
 - **`batch_patch` trusted-class propagation** (`cmd/odek/perf_tools.go`) — `batch_patch` now passes its cached `trustedClasses` to `CheckOperation`, matching `write_file` and `patch`. A trusted `local_write` class is honored across all patches in the batch instead of re-prompting per patch.

cmd/odek/file_tool.go

@@ -525,6 +525,7 @@ type searchMatch struct {
 
 type searchFilesResult struct {
 	Matches []searchMatch `json:"matches"`
+	Skipped []string      `json:"skipped,omitempty"`
 	Error   string        `json:"error,omitempty"`
 }
 
@@ -567,13 +568,28 @@ func (t *searchFilesTool) Call(argsJSON string) (string, error) {
 	}
 }
 
+// checkSearchPath classifies a discovered path the same way the root path was
+// classified. If the path is more restrictive (e.g. a file under ~/.odek
+// discovered while searching $HOME), it returns skip=true so the walker does
+// not silently read sensitive files.
+func (t *searchFilesTool) checkSearchPath(path string) (skip bool, reason string) {
+	risk := danger.ClassifyPath(path)
+	if err := t.dangerousConfig.CheckOperation(danger.ToolOperation{
+		Name: "search_files", Resource: path, Risk: risk,
+	}, nil); err != nil {
+		return true, err.Error()
+	}
+	return false, ""
+}
+
 func (t *searchFilesTool) searchContent(args searchFilesArgs) (string, error) {
 	re, err := regexp.Compile(args.Pattern)
 	if err != nil {
 		return jsonError(fmt.Sprintf("invalid regex pattern %q: %v", args.Pattern, err))
 	}
 
 	var matches []searchMatch
+	var skipped []string
 	limit := args.Limit
 	resultBytes := 0
 
@@ -590,6 +606,13 @@ func (t *searchFilesTool) searchContent(args searchFilesArgs) (string, error) {
 			if skipDir(info.Name()) {
 				return filepath.SkipDir
 			}
+			// Security: a broad search root may contain a sensitive subtree
+			// (e.g. ~/.odek under $HOME). Classify the directory before
+			// descending; if it would require approval/denial, skip it.
+			if skip, reason := t.checkSearchPath(path); skip {
+				skipped = append(skipped, path+": "+reason)
+				return filepath.SkipDir
+			}
 			return nil
 		}
 		// Skip symlinks — prevents TOCTOU on the path and avoids listing
@@ -598,6 +621,13 @@ func (t *searchFilesTool) searchContent(args searchFilesArgs) (string, error) {
 			return nil
 		}
 
+		// Security: classify each file before reading. This prevents a broad
+		// search from silently returning files that read_file would gate.
+		if skip, reason := t.checkSearchPath(path); skip {
+			skipped = append(skipped, path+": "+reason)
+			return nil
+		}
+
 		// Apply file_glob filter
 		if args.FileGlob != "" {
 			match, _ := filepath.Match(args.FileGlob, info.Name())
@@ -659,7 +689,7 @@ func (t *searchFilesTool) searchContent(args searchFilesArgs) (string, error) {
 		return jsonError(fmt.Sprintf("search failed: %v", err))
 	}
 
-	return jsonResult(searchFilesResult{Matches: matches})
+	return jsonResult(searchFilesResult{Matches: matches, Skipped: skipped})
 }
 
 func (t *searchFilesTool) searchFiles(args searchFilesArgs) (string, error) {
@@ -673,7 +703,15 @@ func (t *searchFilesTool) searchFiles(args searchFilesArgs) (string, error) {
 	}
 
 	var matches []searchMatch
+	var skipped []string
 	for _, p := range paths {
+		// Security: each discovered path is classified the same way the root
+		// path is. Sensitive files (e.g. under ~/.odek, /etc) are skipped
+		// rather than returned silently.
+		if skip, reason := t.checkSearchPath(p); skip {
+			skipped = append(skipped, p+": "+reason)
+			continue
+		}
 		matches = append(matches, searchMatch{Path: wrapUntrusted(t.toolCtx(), "search_files:"+p, p)})
 	}
 
@@ -688,7 +726,7 @@ func (t *searchFilesTool) searchFiles(args searchFilesArgs) (string, error) {
 		return fi.ModTime().After(fj.ModTime())
 	})
 
-	return jsonResult(searchFilesResult{Matches: matches})
+	return jsonResult(searchFilesResult{Matches: matches, Skipped: skipped})
 }
 
 // ── Patch Tool ─────────────────────────────────────────────────────────
@@ -1091,14 +1129,16 @@ func confineToCWD(path string) (string, error) {
 // must not be writable through the generic file tools. Keep in sync with
 // the SystemWrite escalation in danger.ClassifyPath.
 func isProtectedOdekPath(rel string) bool {
-	rel = filepath.Clean(rel)
+	// Case-folding defends against case-insensitive filesystems (macOS APFS):
+	// ~/.odek/CONFIG.JSON and ~/.odek/config.json are the same file.
+	rel = strings.ToLower(filepath.Clean(rel))
 
 	// Exact-file trust anchors. Rewriting any of these can disable safety
 	// policy, exfiltrate secrets, or persist attacker control.
 	protectedExact := []string{
 		"config.json",
 		"secrets.env",
-		"IDENTITY.md",
+		"identity.md",
 		"schedules.json",
 		"schedule-state.json",
 		"schedules.lock",

cmd/odek/file_tool_test.go

@@ -6,6 +6,7 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"sync"
 	"testing"
 
 	"github.com/BackendStack21/odek/internal/danger"
@@ -1220,6 +1221,179 @@ func TestWriteFile_SecurityDenied(t *testing.T) {
 	}
 }
 
+// ── Search path classification tests (H-4 / H-5) ────────────────────────
+
+// countingApprover is a test double that approves the first N prompt requests
+// and denies the rest. It lets us approve a search root while denying the
+// sensitive files discovered underneath it.
+type countingApprover struct {
+	mu          sync.Mutex
+	calls       int
+	allowFirstN int
+}
+
+func (a *countingApprover) PromptCommand(cls danger.RiskClass, cmd, description string) error {
+	return a.prompt()
+}
+
+func (a *countingApprover) PromptOperation(op danger.ToolOperation) error {
+	return a.prompt()
+}
+
+func (a *countingApprover) prompt() error {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	a.calls++
+	if a.calls <= a.allowFirstN {
+		return nil
+	}
+	return fmt.Errorf("denied by test approver")
+}
+
+// makeTestHomeDir creates a HOME directory outside /tmp and /var so that
+// ClassifyPath treats paths under it as real home-directory paths rather than
+// temporary/system paths. The directory is created under the current working
+// directory and removed when the test ends.
+func makeTestHomeDir(t *testing.T) string {
+	t.Helper()
+	cwd, err := os.Getwd()
+	if err != nil {
+		t.Fatalf("cannot get cwd: %v", err)
+	}
+	home, err := os.MkdirTemp(cwd, "odek-test-home-*")
+	if err != nil {
+		t.Fatalf("cannot create test home: %v", err)
+	}
+	t.Cleanup(func() { os.RemoveAll(home) })
+	return home
+}
+
+func TestSearchFiles_TargetFiles_SkipsSensitiveOdekPaths(t *testing.T) {
+	home := makeTestHomeDir(t)
+	t.Setenv("HOME", home)
+
+	odekDir := filepath.Join(home, ".odek")
+	if err := os.MkdirAll(odekDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	os.WriteFile(filepath.Join(odekDir, "config.json"), []byte("api-key-secret\n"), 0644)
+	os.WriteFile(filepath.Join(odekDir, "notes.md"), []byte("hello world\n"), 0644)
+
+	cfg := danger.DangerousConfig{
+		Classes: map[danger.RiskClass]danger.Action{danger.SystemWrite: danger.Prompt},
+		Approver: &countingApprover{allowFirstN: 1}, // approve the search root only
+	}
+	tool := &searchFilesTool{dangerousConfig: cfg}
+
+	args := fmt.Sprintf(`{"pattern":"*","target":"files","path":%q}`, odekDir)
+	result := callJSON(t, tool, args)
+
+	var r struct {
+		Matches []struct {
+			Path string `json:"path"`
+		} `json:"matches"`
+		Skipped []string `json:"skipped"`
+		Error   string   `json:"error,omitempty"`
+	}
+	mustUnmarshal(t, result, &r)
+	if r.Error != "" {
+		t.Fatalf("unexpected error: %s", r.Error)
+	}
+	if len(r.Matches) != 1 {
+		t.Fatalf("expected 1 allowed match, got %d", len(r.Matches))
+	}
+	if !strings.Contains(unwrapUntrusted(r.Matches[0].Path), "notes.md") {
+		t.Errorf("expected notes.md match, got %q", r.Matches[0].Path)
+	}
+	if len(r.Skipped) != 1 {
+		t.Fatalf("expected 1 skipped sensitive path, got %d: %v", len(r.Skipped), r.Skipped)
+	}
+	if !strings.Contains(r.Skipped[0], "config.json") {
+		t.Errorf("expected config.json in skipped list, got %q", r.Skipped[0])
+	}
+}
+
+func TestSearchFiles_TargetFiles_SkipsCaseInsensitiveAnchor(t *testing.T) {
+	home := makeTestHomeDir(t)
+	t.Setenv("HOME", home)
+
+	odekDir := filepath.Join(home, ".odek")
+	if err := os.MkdirAll(odekDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	os.WriteFile(filepath.Join(odekDir, "CONFIG.JSON"), []byte("api-key-secret\n"), 0644)
+	os.WriteFile(filepath.Join(odekDir, "notes.md"), []byte("hello world\n"), 0644)
+
+	cfg := danger.DangerousConfig{
+		Classes: map[danger.RiskClass]danger.Action{danger.SystemWrite: danger.Prompt},
+		Approver: &countingApprover{allowFirstN: 1},
+	}
+	tool := &searchFilesTool{dangerousConfig: cfg}
+
+	args := fmt.Sprintf(`{"pattern":"*","target":"files","path":%q}`, odekDir)
+	result := callJSON(t, tool, args)
+
+	var r struct {
+		Matches []struct {
+			Path string `json:"path"`
+		} `json:"matches"`
+		Skipped []string `json:"skipped"`
+		Error   string   `json:"error,omitempty"`
+	}
+	mustUnmarshal(t, result, &r)
+	if r.Error != "" {
+		t.Fatalf("unexpected error: %s", r.Error)
+	}
+	if len(r.Matches) != 1 {
+		t.Fatalf("expected 1 allowed match, got %d", len(r.Matches))
+	}
+	if len(r.Skipped) != 1 || !strings.Contains(strings.ToLower(r.Skipped[0]), "config.json") {
+		t.Fatalf("expected CONFIG.JSON skipped, got %v", r.Skipped)
+	}
+}
+
+func TestSearchFiles_CheckSearchPath_DeniesSystemWrite(t *testing.T) {
+	home := makeTestHomeDir(t)
+	t.Setenv("HOME", home)
+
+	cfg := danger.DangerousConfig{
+		Classes: map[danger.RiskClass]danger.Action{danger.SystemWrite: danger.Deny},
+	}
+	tool := &searchFilesTool{dangerousConfig: cfg}
+
+	skip, reason := tool.checkSearchPath(filepath.Join(home, ".odek", "config.json"))
+	if !skip {
+		t.Fatalf("expected checkSearchPath to skip ~/.odek/config.json")
+	}
+	if !strings.Contains(reason, "system_write") {
+		t.Errorf("expected system_write denial, got %q", reason)
+	}
+
+	skip, _ = tool.checkSearchPath(filepath.Join(home, ".odek", "notes.md"))
+	if skip {
+		t.Errorf("expected non-anchor ~/.odek path to be allowed")
+	}
+}
+
+// TestIsProtectedOdekPath_CaseInsensitive verifies the file-tool write guard
+// rejects case variants of trust anchors on case-insensitive filesystems.
+func TestIsProtectedOdekPath_CaseInsensitive(t *testing.T) {
+	cases := []string{
+		"CONFIG.JSON",
+		"Secrets.Env",
+		"IDENTITY.MD",
+		"SKILLS/evil/SKILL.md",
+		"SESSIONS/abc.json",
+		"AUDIT/turn.json",
+		"PLANS/evil.md",
+	}
+	for _, c := range cases {
+		if !isProtectedOdekPath(c) {
+			t.Errorf("isProtectedOdekPath(%q) = false, want true", c)
+		}
+	}
+}
+
 // ── Helpers ────────────────────────────────────────────────────────────
 
 func callJSON(t *testing.T, tool interface {

cmd/odek/perf_tools.go

@@ -1198,6 +1198,7 @@ type grepPatternResult struct {
 	Pattern string      `json:"pattern"`
 	Matches []grepMatch `json:"matches"`
 	Count   int         `json:"count"`
+	Skipped []string    `json:"skipped,omitempty"`
 	Error   string      `json:"error,omitempty"`
 }
 
@@ -1269,6 +1270,20 @@ func (t *multiGrepTool) Call(argsJSON string) (string, error) {
 	return jsonResult(multiGrepResult{Results: results})
 }
 
+// checkSearchPath classifies a discovered path the same way the root path was
+// checked in Call. If the path is more restrictive (e.g. a file under ~/.odek
+// discovered while searching $HOME), it returns skip=true so the walker does
+// not silently read sensitive files.
+func (t *multiGrepTool) checkSearchPath(path string) (skip bool, reason string) {
+	risk := danger.ClassifyPath(path)
+	if err := t.dangerousConfig.CheckOperation(danger.ToolOperation{
+		Name: "multi_grep", Resource: path, Risk: risk,
+	}, nil); err != nil {
+		return true, err.Error()
+	}
+	return false, ""
+}
+
 func (t *multiGrepTool) searchPattern(pattern, root, fileGlob string, limit int) (result grepPatternResult) {
 	defer func() {
 		if r := recover(); r != nil {
@@ -1283,6 +1298,7 @@ func (t *multiGrepTool) searchPattern(pattern, root, fileGlob string, limit int)
 	var matches []grepMatch
 	resultBytes := 0
 
+	var skipped []string
 	filepath.Walk(root, func(path string, info os.FileInfo, err error) error {
 		if err != nil || info == nil {
 			return nil
@@ -1294,12 +1310,22 @@ func (t *multiGrepTool) searchPattern(pattern, root, fileGlob string, limit int)
 			if skipDir(info.Name()) {
 				return filepath.SkipDir
 			}
+			// Security: classify each directory before descending.
+			if skip, reason := t.checkSearchPath(path); skip {
+				skipped = append(skipped, path+": "+reason)
+				return filepath.SkipDir
+			}
 			return nil
 		}
 		// Skip symlinks — prevents TOCTOU and listing unreadable files.
 		if info.Mode()&os.ModeSymlink != 0 {
 			return nil
 		}
+		// Security: classify each file before reading.
+		if skip, reason := t.checkSearchPath(path); skip {
+			skipped = append(skipped, path+": "+reason)
+			return nil
+		}
 		if fileGlob != "" {
 			match, _ := filepath.Match(fileGlob, info.Name())
 			if !match {
@@ -1352,6 +1378,7 @@ func (t *multiGrepTool) searchPattern(pattern, root, fileGlob string, limit int)
 		Pattern: pattern,
 		Matches: matches,
 		Count:   len(matches),
+		Skipped: skipped,
 	}
 }